1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2012,2013 - ARM Ltd 4 * Author: Marc Zyngier <marc.zyngier@arm.com> 5 * 6 * Derived from arch/arm/kvm/reset.c 7 * Copyright (C) 2012 - Virtual Open Systems and Columbia University 8 * Author: Christoffer Dall <c.dall@virtualopensystems.com> 9 */ 10 11 #include <linux/errno.h> 12 #include <linux/kernel.h> 13 #include <linux/kvm_host.h> 14 #include <linux/kvm.h> 15 #include <linux/hw_breakpoint.h> 16 #include <linux/slab.h> 17 #include <linux/string.h> 18 #include <linux/types.h> 19 20 #include <kvm/arm_arch_timer.h> 21 22 #include <asm/cpufeature.h> 23 #include <asm/cputype.h> 24 #include <asm/fpsimd.h> 25 #include <asm/ptrace.h> 26 #include <asm/kvm_arm.h> 27 #include <asm/kvm_asm.h> 28 #include <asm/kvm_coproc.h> 29 #include <asm/kvm_emulate.h> 30 #include <asm/kvm_mmu.h> 31 #include <asm/virt.h> 32 33 /* Maximum phys_shift supported for any VM on this host */ 34 static u32 kvm_ipa_limit; 35 36 /* 37 * ARMv8 Reset Values 38 */ 39 #define VCPU_RESET_PSTATE_EL1 (PSR_MODE_EL1h | PSR_A_BIT | PSR_I_BIT | \ 40 PSR_F_BIT | PSR_D_BIT) 41 42 #define VCPU_RESET_PSTATE_SVC (PSR_AA32_MODE_SVC | PSR_AA32_A_BIT | \ 43 PSR_AA32_I_BIT | PSR_AA32_F_BIT) 44 45 static bool system_has_full_ptr_auth(void) 46 { 47 return system_supports_address_auth() && system_supports_generic_auth(); 48 } 49 50 /** 51 * kvm_arch_vm_ioctl_check_extension 52 * 53 * We currently assume that the number of HW registers is uniform 54 * across all CPUs (see cpuinfo_sanity_check). 55 */ 56 int kvm_arch_vm_ioctl_check_extension(struct kvm *kvm, long ext) 57 { 58 int r; 59 60 switch (ext) { 61 case KVM_CAP_ARM_EL1_32BIT: 62 r = cpus_have_const_cap(ARM64_HAS_32BIT_EL1); 63 break; 64 case KVM_CAP_GUEST_DEBUG_HW_BPS: 65 r = get_num_brps(); 66 break; 67 case KVM_CAP_GUEST_DEBUG_HW_WPS: 68 r = get_num_wrps(); 69 break; 70 case KVM_CAP_ARM_PMU_V3: 71 r = kvm_arm_support_pmu_v3(); 72 break; 73 case KVM_CAP_ARM_INJECT_SERROR_ESR: 74 r = cpus_have_const_cap(ARM64_HAS_RAS_EXTN); 75 break; 76 case KVM_CAP_SET_GUEST_DEBUG: 77 case KVM_CAP_VCPU_ATTRIBUTES: 78 r = 1; 79 break; 80 case KVM_CAP_ARM_VM_IPA_SIZE: 81 r = kvm_ipa_limit; 82 break; 83 case KVM_CAP_ARM_SVE: 84 r = system_supports_sve(); 85 break; 86 case KVM_CAP_ARM_PTRAUTH_ADDRESS: 87 case KVM_CAP_ARM_PTRAUTH_GENERIC: 88 r = system_has_full_ptr_auth(); 89 break; 90 default: 91 r = 0; 92 } 93 94 return r; 95 } 96 97 unsigned int kvm_sve_max_vl; 98 99 int kvm_arm_init_sve(void) 100 { 101 if (system_supports_sve()) { 102 kvm_sve_max_vl = sve_max_virtualisable_vl; 103 104 /* 105 * The get_sve_reg()/set_sve_reg() ioctl interface will need 106 * to be extended with multiple register slice support in 107 * order to support vector lengths greater than 108 * SVE_VL_ARCH_MAX: 109 */ 110 if (WARN_ON(kvm_sve_max_vl > SVE_VL_ARCH_MAX)) 111 kvm_sve_max_vl = SVE_VL_ARCH_MAX; 112 113 /* 114 * Don't even try to make use of vector lengths that 115 * aren't available on all CPUs, for now: 116 */ 117 if (kvm_sve_max_vl < sve_max_vl) 118 pr_warn("KVM: SVE vector length for guests limited to %u bytes\n", 119 kvm_sve_max_vl); 120 } 121 122 return 0; 123 } 124 125 static int kvm_vcpu_enable_sve(struct kvm_vcpu *vcpu) 126 { 127 if (!system_supports_sve()) 128 return -EINVAL; 129 130 /* Verify that KVM startup enforced this when SVE was detected: */ 131 if (WARN_ON(!has_vhe())) 132 return -EINVAL; 133 134 vcpu->arch.sve_max_vl = kvm_sve_max_vl; 135 136 /* 137 * Userspace can still customize the vector lengths by writing 138 * KVM_REG_ARM64_SVE_VLS. Allocation is deferred until 139 * kvm_arm_vcpu_finalize(), which freezes the configuration. 140 */ 141 vcpu->arch.flags |= KVM_ARM64_GUEST_HAS_SVE; 142 143 return 0; 144 } 145 146 /* 147 * Finalize vcpu's maximum SVE vector length, allocating 148 * vcpu->arch.sve_state as necessary. 149 */ 150 static int kvm_vcpu_finalize_sve(struct kvm_vcpu *vcpu) 151 { 152 void *buf; 153 unsigned int vl; 154 155 vl = vcpu->arch.sve_max_vl; 156 157 /* 158 * Responsibility for these properties is shared between 159 * kvm_arm_init_arch_resources(), kvm_vcpu_enable_sve() and 160 * set_sve_vls(). Double-check here just to be sure: 161 */ 162 if (WARN_ON(!sve_vl_valid(vl) || vl > sve_max_virtualisable_vl || 163 vl > SVE_VL_ARCH_MAX)) 164 return -EIO; 165 166 buf = kzalloc(SVE_SIG_REGS_SIZE(sve_vq_from_vl(vl)), GFP_KERNEL); 167 if (!buf) 168 return -ENOMEM; 169 170 vcpu->arch.sve_state = buf; 171 vcpu->arch.flags |= KVM_ARM64_VCPU_SVE_FINALIZED; 172 return 0; 173 } 174 175 int kvm_arm_vcpu_finalize(struct kvm_vcpu *vcpu, int feature) 176 { 177 switch (feature) { 178 case KVM_ARM_VCPU_SVE: 179 if (!vcpu_has_sve(vcpu)) 180 return -EINVAL; 181 182 if (kvm_arm_vcpu_sve_finalized(vcpu)) 183 return -EPERM; 184 185 return kvm_vcpu_finalize_sve(vcpu); 186 } 187 188 return -EINVAL; 189 } 190 191 bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu) 192 { 193 if (vcpu_has_sve(vcpu) && !kvm_arm_vcpu_sve_finalized(vcpu)) 194 return false; 195 196 return true; 197 } 198 199 void kvm_arm_vcpu_destroy(struct kvm_vcpu *vcpu) 200 { 201 kfree(vcpu->arch.sve_state); 202 } 203 204 static void kvm_vcpu_reset_sve(struct kvm_vcpu *vcpu) 205 { 206 if (vcpu_has_sve(vcpu)) 207 memset(vcpu->arch.sve_state, 0, vcpu_sve_state_size(vcpu)); 208 } 209 210 static int kvm_vcpu_enable_ptrauth(struct kvm_vcpu *vcpu) 211 { 212 /* 213 * For now make sure that both address/generic pointer authentication 214 * features are requested by the userspace together and the system 215 * supports these capabilities. 216 */ 217 if (!test_bit(KVM_ARM_VCPU_PTRAUTH_ADDRESS, vcpu->arch.features) || 218 !test_bit(KVM_ARM_VCPU_PTRAUTH_GENERIC, vcpu->arch.features) || 219 !system_has_full_ptr_auth()) 220 return -EINVAL; 221 222 vcpu->arch.flags |= KVM_ARM64_GUEST_HAS_PTRAUTH; 223 return 0; 224 } 225 226 /** 227 * kvm_reset_vcpu - sets core registers and sys_regs to reset value 228 * @vcpu: The VCPU pointer 229 * 230 * This function finds the right table above and sets the registers on 231 * the virtual CPU struct to their architecturally defined reset 232 * values, except for registers whose reset is deferred until 233 * kvm_arm_vcpu_finalize(). 234 * 235 * Note: This function can be called from two paths: The KVM_ARM_VCPU_INIT 236 * ioctl or as part of handling a request issued by another VCPU in the PSCI 237 * handling code. In the first case, the VCPU will not be loaded, and in the 238 * second case the VCPU will be loaded. Because this function operates purely 239 * on the memory-backed values of system registers, we want to do a full put if 240 * we were loaded (handling a request) and load the values back at the end of 241 * the function. Otherwise we leave the state alone. In both cases, we 242 * disable preemption around the vcpu reset as we would otherwise race with 243 * preempt notifiers which also call put/load. 244 */ 245 int kvm_reset_vcpu(struct kvm_vcpu *vcpu) 246 { 247 int ret; 248 bool loaded; 249 u32 pstate; 250 251 /* Reset PMU outside of the non-preemptible section */ 252 kvm_pmu_vcpu_reset(vcpu); 253 254 preempt_disable(); 255 loaded = (vcpu->cpu != -1); 256 if (loaded) 257 kvm_arch_vcpu_put(vcpu); 258 259 if (!kvm_arm_vcpu_sve_finalized(vcpu)) { 260 if (test_bit(KVM_ARM_VCPU_SVE, vcpu->arch.features)) { 261 ret = kvm_vcpu_enable_sve(vcpu); 262 if (ret) 263 goto out; 264 } 265 } else { 266 kvm_vcpu_reset_sve(vcpu); 267 } 268 269 if (test_bit(KVM_ARM_VCPU_PTRAUTH_ADDRESS, vcpu->arch.features) || 270 test_bit(KVM_ARM_VCPU_PTRAUTH_GENERIC, vcpu->arch.features)) { 271 if (kvm_vcpu_enable_ptrauth(vcpu)) { 272 ret = -EINVAL; 273 goto out; 274 } 275 } 276 277 switch (vcpu->arch.target) { 278 default: 279 if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features)) { 280 if (!cpus_have_const_cap(ARM64_HAS_32BIT_EL1)) { 281 ret = -EINVAL; 282 goto out; 283 } 284 pstate = VCPU_RESET_PSTATE_SVC; 285 } else { 286 pstate = VCPU_RESET_PSTATE_EL1; 287 } 288 289 break; 290 } 291 292 /* Reset core registers */ 293 memset(vcpu_gp_regs(vcpu), 0, sizeof(*vcpu_gp_regs(vcpu))); 294 vcpu_gp_regs(vcpu)->pstate = pstate; 295 296 /* Reset system registers */ 297 kvm_reset_sys_regs(vcpu); 298 299 /* 300 * Additional reset state handling that PSCI may have imposed on us. 301 * Must be done after all the sys_reg reset. 302 */ 303 if (vcpu->arch.reset_state.reset) { 304 unsigned long target_pc = vcpu->arch.reset_state.pc; 305 306 /* Gracefully handle Thumb2 entry point */ 307 if (vcpu_mode_is_32bit(vcpu) && (target_pc & 1)) { 308 target_pc &= ~1UL; 309 vcpu_set_thumb(vcpu); 310 } 311 312 /* Propagate caller endianness */ 313 if (vcpu->arch.reset_state.be) 314 kvm_vcpu_set_be(vcpu); 315 316 *vcpu_pc(vcpu) = target_pc; 317 vcpu_set_reg(vcpu, 0, vcpu->arch.reset_state.r0); 318 319 vcpu->arch.reset_state.reset = false; 320 } 321 322 /* Default workaround setup is enabled (if supported) */ 323 if (kvm_arm_have_ssbd() == KVM_SSBD_KERNEL) 324 vcpu->arch.workaround_flags |= VCPU_WORKAROUND_2_FLAG; 325 326 /* Reset timer */ 327 ret = kvm_timer_vcpu_reset(vcpu); 328 out: 329 if (loaded) 330 kvm_arch_vcpu_load(vcpu, smp_processor_id()); 331 preempt_enable(); 332 return ret; 333 } 334 335 u32 get_kvm_ipa_limit(void) 336 { 337 return kvm_ipa_limit; 338 } 339 340 int kvm_set_ipa_limit(void) 341 { 342 unsigned int ipa_max, pa_max, va_max, parange, tgran_2; 343 u64 mmfr0; 344 345 mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); 346 parange = cpuid_feature_extract_unsigned_field(mmfr0, 347 ID_AA64MMFR0_PARANGE_SHIFT); 348 349 /* 350 * Check with ARMv8.5-GTG that our PAGE_SIZE is supported at 351 * Stage-2. If not, things will stop very quickly. 352 */ 353 switch (PAGE_SIZE) { 354 default: 355 case SZ_4K: 356 tgran_2 = ID_AA64MMFR0_TGRAN4_2_SHIFT; 357 break; 358 case SZ_16K: 359 tgran_2 = ID_AA64MMFR0_TGRAN16_2_SHIFT; 360 break; 361 case SZ_64K: 362 tgran_2 = ID_AA64MMFR0_TGRAN64_2_SHIFT; 363 break; 364 } 365 366 switch (cpuid_feature_extract_unsigned_field(mmfr0, tgran_2)) { 367 default: 368 case 1: 369 kvm_err("PAGE_SIZE not supported at Stage-2, giving up\n"); 370 return -EINVAL; 371 case 0: 372 kvm_debug("PAGE_SIZE supported at Stage-2 (default)\n"); 373 break; 374 case 2: 375 kvm_debug("PAGE_SIZE supported at Stage-2 (advertised)\n"); 376 break; 377 } 378 379 pa_max = id_aa64mmfr0_parange_to_phys_shift(parange); 380 381 /* Clamp the IPA limit to the PA size supported by the kernel */ 382 ipa_max = (pa_max > PHYS_MASK_SHIFT) ? PHYS_MASK_SHIFT : pa_max; 383 /* 384 * Since our stage2 table is dependent on the stage1 page table code, 385 * we must always honor the following condition: 386 * 387 * Number of levels in Stage1 >= Number of levels in Stage2. 388 * 389 * So clamp the ipa limit further down to limit the number of levels. 390 * Since we can concatenate upto 16 tables at entry level, we could 391 * go upto 4bits above the maximum VA addressable with the current 392 * number of levels. 393 */ 394 va_max = PGDIR_SHIFT + PAGE_SHIFT - 3; 395 va_max += 4; 396 397 if (va_max < ipa_max) 398 ipa_max = va_max; 399 400 /* 401 * If the final limit is lower than the real physical address 402 * limit of the CPUs, report the reason. 403 */ 404 if (ipa_max < pa_max) 405 pr_info("kvm: Limiting the IPA size due to kernel %s Address limit\n", 406 (va_max < pa_max) ? "Virtual" : "Physical"); 407 408 WARN(ipa_max < KVM_PHYS_SHIFT, 409 "KVM IPA limit (%d bit) is smaller than default size\n", ipa_max); 410 kvm_ipa_limit = ipa_max; 411 kvm_info("IPA Size Limit: %dbits\n", kvm_ipa_limit); 412 413 return 0; 414 } 415 416 /* 417 * Configure the VTCR_EL2 for this VM. The VTCR value is common 418 * across all the physical CPUs on the system. We use system wide 419 * sanitised values to fill in different fields, except for Hardware 420 * Management of Access Flags. HA Flag is set unconditionally on 421 * all CPUs, as it is safe to run with or without the feature and 422 * the bit is RES0 on CPUs that don't support it. 423 */ 424 int kvm_arm_setup_stage2(struct kvm *kvm, unsigned long type) 425 { 426 u64 vtcr = VTCR_EL2_FLAGS, mmfr0; 427 u32 parange, phys_shift; 428 u8 lvls; 429 430 if (type & ~KVM_VM_TYPE_ARM_IPA_SIZE_MASK) 431 return -EINVAL; 432 433 phys_shift = KVM_VM_TYPE_ARM_IPA_SIZE(type); 434 if (phys_shift) { 435 if (phys_shift > kvm_ipa_limit || 436 phys_shift < 32) 437 return -EINVAL; 438 } else { 439 phys_shift = KVM_PHYS_SHIFT; 440 } 441 442 mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); 443 parange = cpuid_feature_extract_unsigned_field(mmfr0, 444 ID_AA64MMFR0_PARANGE_SHIFT); 445 if (parange > ID_AA64MMFR0_PARANGE_MAX) 446 parange = ID_AA64MMFR0_PARANGE_MAX; 447 vtcr |= parange << VTCR_EL2_PS_SHIFT; 448 449 vtcr |= VTCR_EL2_T0SZ(phys_shift); 450 /* 451 * Use a minimum 2 level page table to prevent splitting 452 * host PMD huge pages at stage2. 453 */ 454 lvls = stage2_pgtable_levels(phys_shift); 455 if (lvls < 2) 456 lvls = 2; 457 vtcr |= VTCR_EL2_LVLS_TO_SL0(lvls); 458 459 /* 460 * Enable the Hardware Access Flag management, unconditionally 461 * on all CPUs. The features is RES0 on CPUs without the support 462 * and must be ignored by the CPUs. 463 */ 464 vtcr |= VTCR_EL2_HA; 465 466 /* Set the vmid bits */ 467 vtcr |= (kvm_get_vmid_bits() == 16) ? 468 VTCR_EL2_VS_16BIT : 469 VTCR_EL2_VS_8BIT; 470 kvm->arch.vtcr = vtcr; 471 return 0; 472 } 473