1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2015 - ARM Ltd
4  * Author: Marc Zyngier <marc.zyngier@arm.com>
5  */
6 
7 #ifndef __ARM64_KVM_HYP_SWITCH_H__
8 #define __ARM64_KVM_HYP_SWITCH_H__
9 
10 #include <hyp/adjust_pc.h>
11 #include <hyp/fault.h>
12 
13 #include <linux/arm-smccc.h>
14 #include <linux/kvm_host.h>
15 #include <linux/types.h>
16 #include <linux/jump_label.h>
17 #include <uapi/linux/psci.h>
18 
19 #include <kvm/arm_psci.h>
20 
21 #include <asm/barrier.h>
22 #include <asm/cpufeature.h>
23 #include <asm/extable.h>
24 #include <asm/kprobes.h>
25 #include <asm/kvm_asm.h>
26 #include <asm/kvm_emulate.h>
27 #include <asm/kvm_hyp.h>
28 #include <asm/kvm_mmu.h>
29 #include <asm/kvm_nested.h>
30 #include <asm/fpsimd.h>
31 #include <asm/debug-monitors.h>
32 #include <asm/processor.h>
33 #include <asm/traps.h>
34 
35 struct kvm_exception_table_entry {
36 	int insn, fixup;
37 };
38 
39 extern struct kvm_exception_table_entry __start___kvm_ex_table;
40 extern struct kvm_exception_table_entry __stop___kvm_ex_table;
41 
42 /* Save the 32-bit only FPSIMD system register state */
__fpsimd_save_fpexc32(struct kvm_vcpu * vcpu)43 static inline void __fpsimd_save_fpexc32(struct kvm_vcpu *vcpu)
44 {
45 	if (!vcpu_el1_is_32bit(vcpu))
46 		return;
47 
48 	__vcpu_sys_reg(vcpu, FPEXC32_EL2) = read_sysreg(fpexc32_el2);
49 }
50 
__activate_traps_fpsimd32(struct kvm_vcpu * vcpu)51 static inline void __activate_traps_fpsimd32(struct kvm_vcpu *vcpu)
52 {
53 	/*
54 	 * We are about to set CPTR_EL2.TFP to trap all floating point
55 	 * register accesses to EL2, however, the ARM ARM clearly states that
56 	 * traps are only taken to EL2 if the operation would not otherwise
57 	 * trap to EL1.  Therefore, always make sure that for 32-bit guests,
58 	 * we set FPEXC.EN to prevent traps to EL1, when setting the TFP bit.
59 	 * If FP/ASIMD is not implemented, FPEXC is UNDEFINED and any access to
60 	 * it will cause an exception.
61 	 */
62 	if (vcpu_el1_is_32bit(vcpu) && system_supports_fpsimd()) {
63 		write_sysreg(1 << 30, fpexc32_el2);
64 		isb();
65 	}
66 }
67 
68 #define compute_clr_set(vcpu, reg, clr, set)				\
69 	do {								\
70 		u64 hfg;						\
71 		hfg = __vcpu_sys_reg(vcpu, reg) & ~__ ## reg ## _RES0;	\
72 		set |= hfg & __ ## reg ## _MASK; 			\
73 		clr |= ~hfg & __ ## reg ## _nMASK; 			\
74 	} while(0)
75 
76 #define reg_to_fgt_group_id(reg)					\
77 	({								\
78 		enum fgt_group_id id;					\
79 		switch(reg) {						\
80 		case HFGRTR_EL2:					\
81 		case HFGWTR_EL2:					\
82 			id = HFGxTR_GROUP;				\
83 			break;						\
84 		case HFGITR_EL2:					\
85 			id = HFGITR_GROUP;				\
86 			break;						\
87 		case HDFGRTR_EL2:					\
88 		case HDFGWTR_EL2:					\
89 			id = HDFGRTR_GROUP;				\
90 			break;						\
91 		case HAFGRTR_EL2:					\
92 			id = HAFGRTR_GROUP;				\
93 			break;						\
94 		default:						\
95 			BUILD_BUG_ON(1);				\
96 		}							\
97 									\
98 		id;							\
99 	})
100 
101 #define compute_undef_clr_set(vcpu, kvm, reg, clr, set)			\
102 	do {								\
103 		u64 hfg = kvm->arch.fgu[reg_to_fgt_group_id(reg)];	\
104 		set |= hfg & __ ## reg ## _MASK;			\
105 		clr |= hfg & __ ## reg ## _nMASK; 			\
106 	} while(0)
107 
108 #define update_fgt_traps_cs(hctxt, vcpu, kvm, reg, clr, set)		\
109 	do {								\
110 		u64 c = 0, s = 0;					\
111 									\
112 		ctxt_sys_reg(hctxt, reg) = read_sysreg_s(SYS_ ## reg);	\
113 		if (vcpu_has_nv(vcpu) && !is_hyp_ctxt(vcpu))		\
114 			compute_clr_set(vcpu, reg, c, s);		\
115 									\
116 		compute_undef_clr_set(vcpu, kvm, reg, c, s);		\
117 									\
118 		s |= set;						\
119 		c |= clr;						\
120 		if (c || s) {						\
121 			u64 val = __ ## reg ## _nMASK;			\
122 			val |= s;					\
123 			val &= ~c;					\
124 			write_sysreg_s(val, SYS_ ## reg);		\
125 		}							\
126 	} while(0)
127 
128 #define update_fgt_traps(hctxt, vcpu, kvm, reg)		\
129 	update_fgt_traps_cs(hctxt, vcpu, kvm, reg, 0, 0)
130 
131 /*
132  * Validate the fine grain trap masks.
133  * Check that the masks do not overlap and that all bits are accounted for.
134  */
135 #define CHECK_FGT_MASKS(reg)							\
136 	do {									\
137 		BUILD_BUG_ON((__ ## reg ## _MASK) & (__ ## reg ## _nMASK));	\
138 		BUILD_BUG_ON(~((__ ## reg ## _RES0) ^ (__ ## reg ## _MASK) ^	\
139 			       (__ ## reg ## _nMASK)));				\
140 	} while(0)
141 
cpu_has_amu(void)142 static inline bool cpu_has_amu(void)
143 {
144        u64 pfr0 = read_sysreg_s(SYS_ID_AA64PFR0_EL1);
145 
146        return cpuid_feature_extract_unsigned_field(pfr0,
147                ID_AA64PFR0_EL1_AMU_SHIFT);
148 }
149 
__activate_traps_hfgxtr(struct kvm_vcpu * vcpu)150 static inline void __activate_traps_hfgxtr(struct kvm_vcpu *vcpu)
151 {
152 	struct kvm_cpu_context *hctxt = host_data_ptr(host_ctxt);
153 	struct kvm *kvm = kern_hyp_va(vcpu->kvm);
154 
155 	CHECK_FGT_MASKS(HFGRTR_EL2);
156 	CHECK_FGT_MASKS(HFGWTR_EL2);
157 	CHECK_FGT_MASKS(HFGITR_EL2);
158 	CHECK_FGT_MASKS(HDFGRTR_EL2);
159 	CHECK_FGT_MASKS(HDFGWTR_EL2);
160 	CHECK_FGT_MASKS(HAFGRTR_EL2);
161 	CHECK_FGT_MASKS(HCRX_EL2);
162 
163 	if (!cpus_have_final_cap(ARM64_HAS_FGT))
164 		return;
165 
166 	update_fgt_traps(hctxt, vcpu, kvm, HFGRTR_EL2);
167 	update_fgt_traps_cs(hctxt, vcpu, kvm, HFGWTR_EL2, 0,
168 			    cpus_have_final_cap(ARM64_WORKAROUND_AMPERE_AC03_CPU_38) ?
169 			    HFGxTR_EL2_TCR_EL1_MASK : 0);
170 	update_fgt_traps(hctxt, vcpu, kvm, HFGITR_EL2);
171 	update_fgt_traps(hctxt, vcpu, kvm, HDFGRTR_EL2);
172 	update_fgt_traps(hctxt, vcpu, kvm, HDFGWTR_EL2);
173 
174 	if (cpu_has_amu())
175 		update_fgt_traps(hctxt, vcpu, kvm, HAFGRTR_EL2);
176 }
177 
178 #define __deactivate_fgt(htcxt, vcpu, kvm, reg)				\
179 	do {								\
180 		if ((vcpu_has_nv(vcpu) && !is_hyp_ctxt(vcpu)) ||	\
181 		    kvm->arch.fgu[reg_to_fgt_group_id(reg)])		\
182 			write_sysreg_s(ctxt_sys_reg(hctxt, reg),	\
183 				       SYS_ ## reg);			\
184 	} while(0)
185 
__deactivate_traps_hfgxtr(struct kvm_vcpu * vcpu)186 static inline void __deactivate_traps_hfgxtr(struct kvm_vcpu *vcpu)
187 {
188 	struct kvm_cpu_context *hctxt = host_data_ptr(host_ctxt);
189 	struct kvm *kvm = kern_hyp_va(vcpu->kvm);
190 
191 	if (!cpus_have_final_cap(ARM64_HAS_FGT))
192 		return;
193 
194 	__deactivate_fgt(hctxt, vcpu, kvm, HFGRTR_EL2);
195 	if (cpus_have_final_cap(ARM64_WORKAROUND_AMPERE_AC03_CPU_38))
196 		write_sysreg_s(ctxt_sys_reg(hctxt, HFGWTR_EL2), SYS_HFGWTR_EL2);
197 	else
198 		__deactivate_fgt(hctxt, vcpu, kvm, HFGWTR_EL2);
199 	__deactivate_fgt(hctxt, vcpu, kvm, HFGITR_EL2);
200 	__deactivate_fgt(hctxt, vcpu, kvm, HDFGRTR_EL2);
201 	__deactivate_fgt(hctxt, vcpu, kvm, HDFGWTR_EL2);
202 
203 	if (cpu_has_amu())
204 		__deactivate_fgt(hctxt, vcpu, kvm, HAFGRTR_EL2);
205 }
206 
__activate_traps_mpam(struct kvm_vcpu * vcpu)207 static inline void  __activate_traps_mpam(struct kvm_vcpu *vcpu)
208 {
209 	u64 r = MPAM2_EL2_TRAPMPAM0EL1 | MPAM2_EL2_TRAPMPAM1EL1;
210 
211 	if (!system_supports_mpam())
212 		return;
213 
214 	/* trap guest access to MPAMIDR_EL1 */
215 	if (system_supports_mpam_hcr()) {
216 		write_sysreg_s(MPAMHCR_EL2_TRAP_MPAMIDR_EL1, SYS_MPAMHCR_EL2);
217 	} else {
218 		/* From v1.1 TIDR can trap MPAMIDR, set it unconditionally */
219 		r |= MPAM2_EL2_TIDR;
220 	}
221 
222 	write_sysreg_s(r, SYS_MPAM2_EL2);
223 }
224 
__deactivate_traps_mpam(void)225 static inline void __deactivate_traps_mpam(void)
226 {
227 	if (!system_supports_mpam())
228 		return;
229 
230 	write_sysreg_s(0, SYS_MPAM2_EL2);
231 
232 	if (system_supports_mpam_hcr())
233 		write_sysreg_s(MPAMHCR_HOST_FLAGS, SYS_MPAMHCR_EL2);
234 }
235 
__activate_traps_common(struct kvm_vcpu * vcpu)236 static inline void __activate_traps_common(struct kvm_vcpu *vcpu)
237 {
238 	struct kvm_cpu_context *hctxt = host_data_ptr(host_ctxt);
239 
240 	/* Trap on AArch32 cp15 c15 (impdef sysregs) accesses (EL1 or EL0) */
241 	write_sysreg(1 << 15, hstr_el2);
242 
243 	/*
244 	 * Make sure we trap PMU access from EL0 to EL2. Also sanitize
245 	 * PMSELR_EL0 to make sure it never contains the cycle
246 	 * counter, which could make a PMXEVCNTR_EL0 access UNDEF at
247 	 * EL1 instead of being trapped to EL2.
248 	 */
249 	if (system_supports_pmuv3()) {
250 		write_sysreg(0, pmselr_el0);
251 
252 		ctxt_sys_reg(hctxt, PMUSERENR_EL0) = read_sysreg(pmuserenr_el0);
253 		write_sysreg(ARMV8_PMU_USERENR_MASK, pmuserenr_el0);
254 		vcpu_set_flag(vcpu, PMUSERENR_ON_CPU);
255 	}
256 
257 	*host_data_ptr(host_debug_state.mdcr_el2) = read_sysreg(mdcr_el2);
258 	write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
259 
260 	if (cpus_have_final_cap(ARM64_HAS_HCX)) {
261 		u64 hcrx = vcpu->arch.hcrx_el2;
262 		if (vcpu_has_nv(vcpu) && !is_hyp_ctxt(vcpu)) {
263 			u64 clr = 0, set = 0;
264 
265 			compute_clr_set(vcpu, HCRX_EL2, clr, set);
266 
267 			hcrx |= set;
268 			hcrx &= ~clr;
269 		}
270 
271 		ctxt_sys_reg(hctxt, HCRX_EL2) = read_sysreg_s(SYS_HCRX_EL2);
272 		write_sysreg_s(hcrx, SYS_HCRX_EL2);
273 	}
274 
275 	__activate_traps_hfgxtr(vcpu);
276 	__activate_traps_mpam(vcpu);
277 }
278 
__deactivate_traps_common(struct kvm_vcpu * vcpu)279 static inline void __deactivate_traps_common(struct kvm_vcpu *vcpu)
280 {
281 	struct kvm_cpu_context *hctxt = host_data_ptr(host_ctxt);
282 
283 	write_sysreg(*host_data_ptr(host_debug_state.mdcr_el2), mdcr_el2);
284 
285 	write_sysreg(0, hstr_el2);
286 	if (system_supports_pmuv3()) {
287 		write_sysreg(ctxt_sys_reg(hctxt, PMUSERENR_EL0), pmuserenr_el0);
288 		vcpu_clear_flag(vcpu, PMUSERENR_ON_CPU);
289 	}
290 
291 	if (cpus_have_final_cap(ARM64_HAS_HCX))
292 		write_sysreg_s(ctxt_sys_reg(hctxt, HCRX_EL2), SYS_HCRX_EL2);
293 
294 	__deactivate_traps_hfgxtr(vcpu);
295 	__deactivate_traps_mpam();
296 }
297 
___activate_traps(struct kvm_vcpu * vcpu,u64 hcr)298 static inline void ___activate_traps(struct kvm_vcpu *vcpu, u64 hcr)
299 {
300 	if (cpus_have_final_cap(ARM64_WORKAROUND_CAVIUM_TX2_219_TVM))
301 		hcr |= HCR_TVM;
302 
303 	write_sysreg(hcr, hcr_el2);
304 
305 	if (cpus_have_final_cap(ARM64_HAS_RAS_EXTN) && (hcr & HCR_VSE))
306 		write_sysreg_s(vcpu->arch.vsesr_el2, SYS_VSESR_EL2);
307 }
308 
___deactivate_traps(struct kvm_vcpu * vcpu)309 static inline void ___deactivate_traps(struct kvm_vcpu *vcpu)
310 {
311 	/*
312 	 * If we pended a virtual abort, preserve it until it gets
313 	 * cleared. See D1.14.3 (Virtual Interrupts) for details, but
314 	 * the crucial bit is "On taking a vSError interrupt,
315 	 * HCR_EL2.VSE is cleared to 0."
316 	 */
317 	if (vcpu->arch.hcr_el2 & HCR_VSE) {
318 		vcpu->arch.hcr_el2 &= ~HCR_VSE;
319 		vcpu->arch.hcr_el2 |= read_sysreg(hcr_el2) & HCR_VSE;
320 	}
321 }
322 
__populate_fault_info(struct kvm_vcpu * vcpu)323 static inline bool __populate_fault_info(struct kvm_vcpu *vcpu)
324 {
325 	return __get_fault_info(vcpu->arch.fault.esr_el2, &vcpu->arch.fault);
326 }
327 
kvm_hyp_handle_mops(struct kvm_vcpu * vcpu,u64 * exit_code)328 static inline bool kvm_hyp_handle_mops(struct kvm_vcpu *vcpu, u64 *exit_code)
329 {
330 	*vcpu_pc(vcpu) = read_sysreg_el2(SYS_ELR);
331 	arm64_mops_reset_regs(vcpu_gp_regs(vcpu), vcpu->arch.fault.esr_el2);
332 	write_sysreg_el2(*vcpu_pc(vcpu), SYS_ELR);
333 
334 	/*
335 	 * Finish potential single step before executing the prologue
336 	 * instruction.
337 	 */
338 	*vcpu_cpsr(vcpu) &= ~DBG_SPSR_SS;
339 	write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR);
340 
341 	return true;
342 }
343 
__hyp_sve_restore_guest(struct kvm_vcpu * vcpu)344 static inline void __hyp_sve_restore_guest(struct kvm_vcpu *vcpu)
345 {
346 	/*
347 	 * The vCPU's saved SVE state layout always matches the max VL of the
348 	 * vCPU. Start off with the max VL so we can load the SVE state.
349 	 */
350 	sve_cond_update_zcr_vq(vcpu_sve_max_vq(vcpu) - 1, SYS_ZCR_EL2);
351 	__sve_restore_state(vcpu_sve_pffr(vcpu),
352 			    &vcpu->arch.ctxt.fp_regs.fpsr,
353 			    true);
354 
355 	/*
356 	 * The effective VL for a VM could differ from the max VL when running a
357 	 * nested guest, as the guest hypervisor could select a smaller VL. Slap
358 	 * that into hardware before wrapping up.
359 	 */
360 	if (vcpu_has_nv(vcpu) && !is_hyp_ctxt(vcpu))
361 		sve_cond_update_zcr_vq(__vcpu_sys_reg(vcpu, ZCR_EL2), SYS_ZCR_EL2);
362 
363 	write_sysreg_el1(__vcpu_sys_reg(vcpu, vcpu_sve_zcr_elx(vcpu)), SYS_ZCR);
364 }
365 
__hyp_sve_save_host(void)366 static inline void __hyp_sve_save_host(void)
367 {
368 	struct cpu_sve_state *sve_state = *host_data_ptr(sve_state);
369 
370 	sve_state->zcr_el1 = read_sysreg_el1(SYS_ZCR);
371 	write_sysreg_s(sve_vq_from_vl(kvm_host_sve_max_vl) - 1, SYS_ZCR_EL2);
372 	__sve_save_state(sve_state->sve_regs + sve_ffr_offset(kvm_host_sve_max_vl),
373 			 &sve_state->fpsr,
374 			 true);
375 }
376 
fpsimd_lazy_switch_to_guest(struct kvm_vcpu * vcpu)377 static inline void fpsimd_lazy_switch_to_guest(struct kvm_vcpu *vcpu)
378 {
379 	u64 zcr_el1, zcr_el2;
380 
381 	if (!guest_owns_fp_regs())
382 		return;
383 
384 	if (vcpu_has_sve(vcpu)) {
385 		/* A guest hypervisor may restrict the effective max VL. */
386 		if (vcpu_has_nv(vcpu) && !is_hyp_ctxt(vcpu))
387 			zcr_el2 = __vcpu_sys_reg(vcpu, ZCR_EL2);
388 		else
389 			zcr_el2 = vcpu_sve_max_vq(vcpu) - 1;
390 
391 		write_sysreg_el2(zcr_el2, SYS_ZCR);
392 
393 		zcr_el1 = __vcpu_sys_reg(vcpu, vcpu_sve_zcr_elx(vcpu));
394 		write_sysreg_el1(zcr_el1, SYS_ZCR);
395 	}
396 }
397 
fpsimd_lazy_switch_to_host(struct kvm_vcpu * vcpu)398 static inline void fpsimd_lazy_switch_to_host(struct kvm_vcpu *vcpu)
399 {
400 	u64 zcr_el1, zcr_el2;
401 
402 	if (!guest_owns_fp_regs())
403 		return;
404 
405 	/*
406 	 * When the guest owns the FP regs, we know that guest+hyp traps for
407 	 * any FPSIMD/SVE/SME features exposed to the guest have been disabled
408 	 * by either fpsimd_lazy_switch_to_guest() or kvm_hyp_handle_fpsimd()
409 	 * prior to __guest_entry(). As __guest_entry() guarantees a context
410 	 * synchronization event, we don't need an ISB here to avoid taking
411 	 * traps for anything that was exposed to the guest.
412 	 */
413 	if (vcpu_has_sve(vcpu)) {
414 		zcr_el1 = read_sysreg_el1(SYS_ZCR);
415 		__vcpu_sys_reg(vcpu, vcpu_sve_zcr_elx(vcpu)) = zcr_el1;
416 
417 		/*
418 		 * The guest's state is always saved using the guest's max VL.
419 		 * Ensure that the host has the guest's max VL active such that
420 		 * the host can save the guest's state lazily, but don't
421 		 * artificially restrict the host to the guest's max VL.
422 		 */
423 		if (has_vhe()) {
424 			zcr_el2 = vcpu_sve_max_vq(vcpu) - 1;
425 			write_sysreg_el2(zcr_el2, SYS_ZCR);
426 		} else {
427 			zcr_el2 = sve_vq_from_vl(kvm_host_sve_max_vl) - 1;
428 			write_sysreg_el2(zcr_el2, SYS_ZCR);
429 
430 			zcr_el1 = vcpu_sve_max_vq(vcpu) - 1;
431 			write_sysreg_el1(zcr_el1, SYS_ZCR);
432 		}
433 	}
434 }
435 
kvm_hyp_save_fpsimd_host(struct kvm_vcpu * vcpu)436 static void kvm_hyp_save_fpsimd_host(struct kvm_vcpu *vcpu)
437 {
438 	/*
439 	 * Non-protected kvm relies on the host restoring its sve state.
440 	 * Protected kvm restores the host's sve state as not to reveal that
441 	 * fpsimd was used by a guest nor leak upper sve bits.
442 	 */
443 	if (system_supports_sve()) {
444 		__hyp_sve_save_host();
445 
446 		/* Re-enable SVE traps if not supported for the guest vcpu. */
447 		if (!vcpu_has_sve(vcpu))
448 			cpacr_clear_set(CPACR_EL1_ZEN, 0);
449 
450 	} else {
451 		__fpsimd_save_state(host_data_ptr(host_ctxt.fp_regs));
452 	}
453 
454 	if (kvm_has_fpmr(kern_hyp_va(vcpu->kvm)))
455 		*host_data_ptr(fpmr) = read_sysreg_s(SYS_FPMR);
456 }
457 
458 
459 /*
460  * We trap the first access to the FP/SIMD to save the host context and
461  * restore the guest context lazily.
462  * If FP/SIMD is not implemented, handle the trap and inject an undefined
463  * instruction exception to the guest. Similarly for trapped SVE accesses.
464  */
kvm_hyp_handle_fpsimd(struct kvm_vcpu * vcpu,u64 * exit_code)465 static inline bool kvm_hyp_handle_fpsimd(struct kvm_vcpu *vcpu, u64 *exit_code)
466 {
467 	bool sve_guest;
468 	u8 esr_ec;
469 
470 	if (!system_supports_fpsimd())
471 		return false;
472 
473 	sve_guest = vcpu_has_sve(vcpu);
474 	esr_ec = kvm_vcpu_trap_get_class(vcpu);
475 
476 	/* Only handle traps the vCPU can support here: */
477 	switch (esr_ec) {
478 	case ESR_ELx_EC_FP_ASIMD:
479 		/* Forward traps to the guest hypervisor as required */
480 		if (guest_hyp_fpsimd_traps_enabled(vcpu))
481 			return false;
482 		break;
483 	case ESR_ELx_EC_SYS64:
484 		if (WARN_ON_ONCE(!is_hyp_ctxt(vcpu)))
485 			return false;
486 		fallthrough;
487 	case ESR_ELx_EC_SVE:
488 		if (!sve_guest)
489 			return false;
490 		if (guest_hyp_sve_traps_enabled(vcpu))
491 			return false;
492 		break;
493 	default:
494 		return false;
495 	}
496 
497 	/* Valid trap.  Switch the context: */
498 
499 	/* First disable enough traps to allow us to update the registers */
500 	if (sve_guest || (is_protected_kvm_enabled() && system_supports_sve()))
501 		cpacr_clear_set(0, CPACR_EL1_FPEN | CPACR_EL1_ZEN);
502 	else
503 		cpacr_clear_set(0, CPACR_EL1_FPEN);
504 	isb();
505 
506 	/* Write out the host state if it's in the registers */
507 	if (is_protected_kvm_enabled() && host_owns_fp_regs())
508 		kvm_hyp_save_fpsimd_host(vcpu);
509 
510 	/* Restore the guest state */
511 	if (sve_guest)
512 		__hyp_sve_restore_guest(vcpu);
513 	else
514 		__fpsimd_restore_state(&vcpu->arch.ctxt.fp_regs);
515 
516 	if (kvm_has_fpmr(kern_hyp_va(vcpu->kvm)))
517 		write_sysreg_s(__vcpu_sys_reg(vcpu, FPMR), SYS_FPMR);
518 
519 	/* Skip restoring fpexc32 for AArch64 guests */
520 	if (!(read_sysreg(hcr_el2) & HCR_RW))
521 		write_sysreg(__vcpu_sys_reg(vcpu, FPEXC32_EL2), fpexc32_el2);
522 
523 	*host_data_ptr(fp_owner) = FP_STATE_GUEST_OWNED;
524 
525 	return true;
526 }
527 
handle_tx2_tvm(struct kvm_vcpu * vcpu)528 static inline bool handle_tx2_tvm(struct kvm_vcpu *vcpu)
529 {
530 	u32 sysreg = esr_sys64_to_sysreg(kvm_vcpu_get_esr(vcpu));
531 	int rt = kvm_vcpu_sys_get_rt(vcpu);
532 	u64 val = vcpu_get_reg(vcpu, rt);
533 
534 	/*
535 	 * The normal sysreg handling code expects to see the traps,
536 	 * let's not do anything here.
537 	 */
538 	if (vcpu->arch.hcr_el2 & HCR_TVM)
539 		return false;
540 
541 	switch (sysreg) {
542 	case SYS_SCTLR_EL1:
543 		write_sysreg_el1(val, SYS_SCTLR);
544 		break;
545 	case SYS_TTBR0_EL1:
546 		write_sysreg_el1(val, SYS_TTBR0);
547 		break;
548 	case SYS_TTBR1_EL1:
549 		write_sysreg_el1(val, SYS_TTBR1);
550 		break;
551 	case SYS_TCR_EL1:
552 		write_sysreg_el1(val, SYS_TCR);
553 		break;
554 	case SYS_ESR_EL1:
555 		write_sysreg_el1(val, SYS_ESR);
556 		break;
557 	case SYS_FAR_EL1:
558 		write_sysreg_el1(val, SYS_FAR);
559 		break;
560 	case SYS_AFSR0_EL1:
561 		write_sysreg_el1(val, SYS_AFSR0);
562 		break;
563 	case SYS_AFSR1_EL1:
564 		write_sysreg_el1(val, SYS_AFSR1);
565 		break;
566 	case SYS_MAIR_EL1:
567 		write_sysreg_el1(val, SYS_MAIR);
568 		break;
569 	case SYS_AMAIR_EL1:
570 		write_sysreg_el1(val, SYS_AMAIR);
571 		break;
572 	case SYS_CONTEXTIDR_EL1:
573 		write_sysreg_el1(val, SYS_CONTEXTIDR);
574 		break;
575 	default:
576 		return false;
577 	}
578 
579 	__kvm_skip_instr(vcpu);
580 	return true;
581 }
582 
583 /* Open-coded version of timer_get_offset() to allow for kern_hyp_va() */
hyp_timer_get_offset(struct arch_timer_context * ctxt)584 static inline u64 hyp_timer_get_offset(struct arch_timer_context *ctxt)
585 {
586 	u64 offset = 0;
587 
588 	if (ctxt->offset.vm_offset)
589 		offset += *kern_hyp_va(ctxt->offset.vm_offset);
590 	if (ctxt->offset.vcpu_offset)
591 		offset += *kern_hyp_va(ctxt->offset.vcpu_offset);
592 
593 	return offset;
594 }
595 
compute_counter_value(struct arch_timer_context * ctxt)596 static inline u64 compute_counter_value(struct arch_timer_context *ctxt)
597 {
598 	return arch_timer_read_cntpct_el0() - hyp_timer_get_offset(ctxt);
599 }
600 
kvm_handle_cntxct(struct kvm_vcpu * vcpu)601 static bool kvm_handle_cntxct(struct kvm_vcpu *vcpu)
602 {
603 	struct arch_timer_context *ctxt;
604 	u32 sysreg;
605 	u64 val;
606 
607 	/*
608 	 * We only get here for 64bit guests, 32bit guests will hit
609 	 * the long and winding road all the way to the standard
610 	 * handling. Yes, it sucks to be irrelevant.
611 	 *
612 	 * Also, we only deal with non-hypervisor context here (either
613 	 * an EL1 guest, or a non-HYP context of an EL2 guest).
614 	 */
615 	if (is_hyp_ctxt(vcpu))
616 		return false;
617 
618 	sysreg = esr_sys64_to_sysreg(kvm_vcpu_get_esr(vcpu));
619 
620 	switch (sysreg) {
621 	case SYS_CNTPCT_EL0:
622 	case SYS_CNTPCTSS_EL0:
623 		if (vcpu_has_nv(vcpu)) {
624 			/* Check for guest hypervisor trapping */
625 			val = __vcpu_sys_reg(vcpu, CNTHCTL_EL2);
626 			if (!vcpu_el2_e2h_is_set(vcpu))
627 				val = (val & CNTHCTL_EL1PCTEN) << 10;
628 
629 			if (!(val & (CNTHCTL_EL1PCTEN << 10)))
630 				return false;
631 		}
632 
633 		ctxt = vcpu_ptimer(vcpu);
634 		break;
635 	case SYS_CNTVCT_EL0:
636 	case SYS_CNTVCTSS_EL0:
637 		if (vcpu_has_nv(vcpu)) {
638 			/* Check for guest hypervisor trapping */
639 			val = __vcpu_sys_reg(vcpu, CNTHCTL_EL2);
640 
641 			if (val & CNTHCTL_EL1TVCT)
642 				return false;
643 		}
644 
645 		ctxt = vcpu_vtimer(vcpu);
646 		break;
647 	default:
648 		return false;
649 	}
650 
651 	val = compute_counter_value(ctxt);
652 
653 	vcpu_set_reg(vcpu, kvm_vcpu_sys_get_rt(vcpu), val);
654 	__kvm_skip_instr(vcpu);
655 	return true;
656 }
657 
handle_ampere1_tcr(struct kvm_vcpu * vcpu)658 static bool handle_ampere1_tcr(struct kvm_vcpu *vcpu)
659 {
660 	u32 sysreg = esr_sys64_to_sysreg(kvm_vcpu_get_esr(vcpu));
661 	int rt = kvm_vcpu_sys_get_rt(vcpu);
662 	u64 val = vcpu_get_reg(vcpu, rt);
663 
664 	if (sysreg != SYS_TCR_EL1)
665 		return false;
666 
667 	/*
668 	 * Affected parts do not advertise support for hardware Access Flag /
669 	 * Dirty state management in ID_AA64MMFR1_EL1.HAFDBS, but the underlying
670 	 * control bits are still functional. The architecture requires these be
671 	 * RES0 on systems that do not implement FEAT_HAFDBS.
672 	 *
673 	 * Uphold the requirements of the architecture by masking guest writes
674 	 * to TCR_EL1.{HA,HD} here.
675 	 */
676 	val &= ~(TCR_HD | TCR_HA);
677 	write_sysreg_el1(val, SYS_TCR);
678 	__kvm_skip_instr(vcpu);
679 	return true;
680 }
681 
kvm_hyp_handle_sysreg(struct kvm_vcpu * vcpu,u64 * exit_code)682 static inline bool kvm_hyp_handle_sysreg(struct kvm_vcpu *vcpu, u64 *exit_code)
683 {
684 	if (cpus_have_final_cap(ARM64_WORKAROUND_CAVIUM_TX2_219_TVM) &&
685 	    handle_tx2_tvm(vcpu))
686 		return true;
687 
688 	if (cpus_have_final_cap(ARM64_WORKAROUND_AMPERE_AC03_CPU_38) &&
689 	    handle_ampere1_tcr(vcpu))
690 		return true;
691 
692 	if (static_branch_unlikely(&vgic_v3_cpuif_trap) &&
693 	    __vgic_v3_perform_cpuif_access(vcpu) == 1)
694 		return true;
695 
696 	if (kvm_handle_cntxct(vcpu))
697 		return true;
698 
699 	return false;
700 }
701 
kvm_hyp_handle_cp15_32(struct kvm_vcpu * vcpu,u64 * exit_code)702 static inline bool kvm_hyp_handle_cp15_32(struct kvm_vcpu *vcpu, u64 *exit_code)
703 {
704 	if (static_branch_unlikely(&vgic_v3_cpuif_trap) &&
705 	    __vgic_v3_perform_cpuif_access(vcpu) == 1)
706 		return true;
707 
708 	return false;
709 }
710 
kvm_hyp_handle_memory_fault(struct kvm_vcpu * vcpu,u64 * exit_code)711 static inline bool kvm_hyp_handle_memory_fault(struct kvm_vcpu *vcpu,
712 					       u64 *exit_code)
713 {
714 	if (!__populate_fault_info(vcpu))
715 		return true;
716 
717 	return false;
718 }
719 #define kvm_hyp_handle_iabt_low		kvm_hyp_handle_memory_fault
720 #define kvm_hyp_handle_watchpt_low	kvm_hyp_handle_memory_fault
721 
kvm_hyp_handle_dabt_low(struct kvm_vcpu * vcpu,u64 * exit_code)722 static inline bool kvm_hyp_handle_dabt_low(struct kvm_vcpu *vcpu, u64 *exit_code)
723 {
724 	if (kvm_hyp_handle_memory_fault(vcpu, exit_code))
725 		return true;
726 
727 	if (static_branch_unlikely(&vgic_v2_cpuif_trap)) {
728 		bool valid;
729 
730 		valid = kvm_vcpu_trap_is_translation_fault(vcpu) &&
731 			kvm_vcpu_dabt_isvalid(vcpu) &&
732 			!kvm_vcpu_abt_issea(vcpu) &&
733 			!kvm_vcpu_abt_iss1tw(vcpu);
734 
735 		if (valid) {
736 			int ret = __vgic_v2_perform_cpuif_access(vcpu);
737 
738 			if (ret == 1)
739 				return true;
740 
741 			/* Promote an illegal access to an SError.*/
742 			if (ret == -1)
743 				*exit_code = ARM_EXCEPTION_EL1_SERROR;
744 		}
745 	}
746 
747 	return false;
748 }
749 
750 typedef bool (*exit_handler_fn)(struct kvm_vcpu *, u64 *);
751 
752 /*
753  * Allow the hypervisor to handle the exit with an exit handler if it has one.
754  *
755  * Returns true if the hypervisor handled the exit, and control should go back
756  * to the guest, or false if it hasn't.
757  */
kvm_hyp_handle_exit(struct kvm_vcpu * vcpu,u64 * exit_code,const exit_handler_fn * handlers)758 static inline bool kvm_hyp_handle_exit(struct kvm_vcpu *vcpu, u64 *exit_code,
759 				       const exit_handler_fn *handlers)
760 {
761 	exit_handler_fn fn = handlers[kvm_vcpu_trap_get_class(vcpu)];
762 	if (fn)
763 		return fn(vcpu, exit_code);
764 
765 	return false;
766 }
767 
synchronize_vcpu_pstate(struct kvm_vcpu * vcpu,u64 * exit_code)768 static inline void synchronize_vcpu_pstate(struct kvm_vcpu *vcpu, u64 *exit_code)
769 {
770 	/*
771 	 * Check for the conditions of Cortex-A510's #2077057. When these occur
772 	 * SPSR_EL2 can't be trusted, but isn't needed either as it is
773 	 * unchanged from the value in vcpu_gp_regs(vcpu)->pstate.
774 	 * Are we single-stepping the guest, and took a PAC exception from the
775 	 * active-not-pending state?
776 	 */
777 	if (cpus_have_final_cap(ARM64_WORKAROUND_2077057)		&&
778 	    vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP			&&
779 	    *vcpu_cpsr(vcpu) & DBG_SPSR_SS				&&
780 	    ESR_ELx_EC(read_sysreg_el2(SYS_ESR)) == ESR_ELx_EC_PAC)
781 		write_sysreg_el2(*vcpu_cpsr(vcpu), SYS_SPSR);
782 
783 	vcpu->arch.ctxt.regs.pstate = read_sysreg_el2(SYS_SPSR);
784 }
785 
786 /*
787  * Return true when we were able to fixup the guest exit and should return to
788  * the guest, false when we should restore the host state and return to the
789  * main run loop.
790  */
__fixup_guest_exit(struct kvm_vcpu * vcpu,u64 * exit_code,const exit_handler_fn * handlers)791 static inline bool __fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code,
792 				      const exit_handler_fn *handlers)
793 {
794 	if (ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ)
795 		vcpu->arch.fault.esr_el2 = read_sysreg_el2(SYS_ESR);
796 
797 	if (ARM_SERROR_PENDING(*exit_code) &&
798 	    ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ) {
799 		u8 esr_ec = kvm_vcpu_trap_get_class(vcpu);
800 
801 		/*
802 		 * HVC already have an adjusted PC, which we need to
803 		 * correct in order to return to after having injected
804 		 * the SError.
805 		 *
806 		 * SMC, on the other hand, is *trapped*, meaning its
807 		 * preferred return address is the SMC itself.
808 		 */
809 		if (esr_ec == ESR_ELx_EC_HVC32 || esr_ec == ESR_ELx_EC_HVC64)
810 			write_sysreg_el2(read_sysreg_el2(SYS_ELR) - 4, SYS_ELR);
811 	}
812 
813 	/*
814 	 * We're using the raw exception code in order to only process
815 	 * the trap if no SError is pending. We will come back to the
816 	 * same PC once the SError has been injected, and replay the
817 	 * trapping instruction.
818 	 */
819 	if (*exit_code != ARM_EXCEPTION_TRAP)
820 		goto exit;
821 
822 	/* Check if there's an exit handler and allow it to handle the exit. */
823 	if (kvm_hyp_handle_exit(vcpu, exit_code, handlers))
824 		goto guest;
825 exit:
826 	/* Return to the host kernel and handle the exit */
827 	return false;
828 
829 guest:
830 	/* Re-enter the guest */
831 	asm(ALTERNATIVE("nop", "dmb sy", ARM64_WORKAROUND_1508412));
832 	return true;
833 }
834 
__kvm_unexpected_el2_exception(void)835 static inline void __kvm_unexpected_el2_exception(void)
836 {
837 	extern char __guest_exit_restore_elr_and_panic[];
838 	unsigned long addr, fixup;
839 	struct kvm_exception_table_entry *entry, *end;
840 	unsigned long elr_el2 = read_sysreg(elr_el2);
841 
842 	entry = &__start___kvm_ex_table;
843 	end = &__stop___kvm_ex_table;
844 
845 	while (entry < end) {
846 		addr = (unsigned long)&entry->insn + entry->insn;
847 		fixup = (unsigned long)&entry->fixup + entry->fixup;
848 
849 		if (addr != elr_el2) {
850 			entry++;
851 			continue;
852 		}
853 
854 		write_sysreg(fixup, elr_el2);
855 		return;
856 	}
857 
858 	/* Trigger a panic after restoring the hyp context. */
859 	this_cpu_ptr(&kvm_hyp_ctxt)->sys_regs[ELR_EL2] = elr_el2;
860 	write_sysreg(__guest_exit_restore_elr_and_panic, elr_el2);
861 }
862 
863 #endif /* __ARM64_KVM_HYP_SWITCH_H__ */
864