1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Hosting Protected Virtual Machines 4 * 5 * Copyright IBM Corp. 2019, 2020 6 * Author(s): Janosch Frank <frankja@linux.ibm.com> 7 */ 8 #include <linux/kvm.h> 9 #include <linux/kvm_host.h> 10 #include <linux/pagemap.h> 11 #include <linux/sched/signal.h> 12 #include <asm/gmap.h> 13 #include <asm/uv.h> 14 #include <asm/mman.h> 15 #include "kvm-s390.h" 16 17 int kvm_s390_pv_destroy_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc) 18 { 19 int cc = 0; 20 21 if (kvm_s390_pv_cpu_get_handle(vcpu)) { 22 cc = uv_cmd_nodata(kvm_s390_pv_cpu_get_handle(vcpu), 23 UVC_CMD_DESTROY_SEC_CPU, rc, rrc); 24 25 KVM_UV_EVENT(vcpu->kvm, 3, 26 "PROTVIRT DESTROY VCPU %d: rc %x rrc %x", 27 vcpu->vcpu_id, *rc, *rrc); 28 WARN_ONCE(cc, "protvirt destroy cpu failed rc %x rrc %x", 29 *rc, *rrc); 30 } 31 /* Intended memory leak for something that should never happen. */ 32 if (!cc) 33 free_pages(vcpu->arch.pv.stor_base, 34 get_order(uv_info.guest_cpu_stor_len)); 35 36 free_page(sida_origin(vcpu->arch.sie_block)); 37 vcpu->arch.sie_block->pv_handle_cpu = 0; 38 vcpu->arch.sie_block->pv_handle_config = 0; 39 memset(&vcpu->arch.pv, 0, sizeof(vcpu->arch.pv)); 40 vcpu->arch.sie_block->sdf = 0; 41 /* 42 * The sidad field (for sdf == 2) is now the gbea field (for sdf == 0). 43 * Use the reset value of gbea to avoid leaking the kernel pointer of 44 * the just freed sida. 45 */ 46 vcpu->arch.sie_block->gbea = 1; 47 kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu); 48 49 return cc ? EIO : 0; 50 } 51 52 int kvm_s390_pv_create_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc) 53 { 54 struct uv_cb_csc uvcb = { 55 .header.cmd = UVC_CMD_CREATE_SEC_CPU, 56 .header.len = sizeof(uvcb), 57 }; 58 int cc; 59 60 if (kvm_s390_pv_cpu_get_handle(vcpu)) 61 return -EINVAL; 62 63 vcpu->arch.pv.stor_base = __get_free_pages(GFP_KERNEL_ACCOUNT, 64 get_order(uv_info.guest_cpu_stor_len)); 65 if (!vcpu->arch.pv.stor_base) 66 return -ENOMEM; 67 68 /* Input */ 69 uvcb.guest_handle = kvm_s390_pv_get_handle(vcpu->kvm); 70 uvcb.num = vcpu->arch.sie_block->icpua; 71 uvcb.state_origin = (u64)vcpu->arch.sie_block; 72 uvcb.stor_origin = (u64)vcpu->arch.pv.stor_base; 73 74 /* Alloc Secure Instruction Data Area Designation */ 75 vcpu->arch.sie_block->sidad = __get_free_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO); 76 if (!vcpu->arch.sie_block->sidad) { 77 free_pages(vcpu->arch.pv.stor_base, 78 get_order(uv_info.guest_cpu_stor_len)); 79 return -ENOMEM; 80 } 81 82 cc = uv_call(0, (u64)&uvcb); 83 *rc = uvcb.header.rc; 84 *rrc = uvcb.header.rrc; 85 KVM_UV_EVENT(vcpu->kvm, 3, 86 "PROTVIRT CREATE VCPU: cpu %d handle %llx rc %x rrc %x", 87 vcpu->vcpu_id, uvcb.cpu_handle, uvcb.header.rc, 88 uvcb.header.rrc); 89 90 if (cc) { 91 u16 dummy; 92 93 kvm_s390_pv_destroy_cpu(vcpu, &dummy, &dummy); 94 return -EIO; 95 } 96 97 /* Output */ 98 vcpu->arch.pv.handle = uvcb.cpu_handle; 99 vcpu->arch.sie_block->pv_handle_cpu = uvcb.cpu_handle; 100 vcpu->arch.sie_block->pv_handle_config = kvm_s390_pv_get_handle(vcpu->kvm); 101 vcpu->arch.sie_block->sdf = 2; 102 kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu); 103 return 0; 104 } 105 106 /* only free resources when the destroy was successful */ 107 static void kvm_s390_pv_dealloc_vm(struct kvm *kvm) 108 { 109 vfree(kvm->arch.pv.stor_var); 110 free_pages(kvm->arch.pv.stor_base, 111 get_order(uv_info.guest_base_stor_len)); 112 memset(&kvm->arch.pv, 0, sizeof(kvm->arch.pv)); 113 } 114 115 static int kvm_s390_pv_alloc_vm(struct kvm *kvm) 116 { 117 unsigned long base = uv_info.guest_base_stor_len; 118 unsigned long virt = uv_info.guest_virt_var_stor_len; 119 unsigned long npages = 0, vlen = 0; 120 struct kvm_memory_slot *memslot; 121 122 kvm->arch.pv.stor_var = NULL; 123 kvm->arch.pv.stor_base = __get_free_pages(GFP_KERNEL_ACCOUNT, get_order(base)); 124 if (!kvm->arch.pv.stor_base) 125 return -ENOMEM; 126 127 /* 128 * Calculate current guest storage for allocation of the 129 * variable storage, which is based on the length in MB. 130 * 131 * Slots are sorted by GFN 132 */ 133 mutex_lock(&kvm->slots_lock); 134 memslot = kvm_memslots(kvm)->memslots; 135 npages = memslot->base_gfn + memslot->npages; 136 mutex_unlock(&kvm->slots_lock); 137 138 kvm->arch.pv.guest_len = npages * PAGE_SIZE; 139 140 /* Allocate variable storage */ 141 vlen = ALIGN(virt * ((npages * PAGE_SIZE) / HPAGE_SIZE), PAGE_SIZE); 142 vlen += uv_info.guest_virt_base_stor_len; 143 /* 144 * The Create Secure Configuration Ultravisor Call does not support 145 * using large pages for the virtual memory area. 146 * This is a hardware limitation. 147 */ 148 kvm->arch.pv.stor_var = vmalloc_no_huge(vlen); 149 if (!kvm->arch.pv.stor_var) 150 goto out_err; 151 return 0; 152 153 out_err: 154 kvm_s390_pv_dealloc_vm(kvm); 155 return -ENOMEM; 156 } 157 158 /* this should not fail, but if it does, we must not free the donated memory */ 159 int kvm_s390_pv_deinit_vm(struct kvm *kvm, u16 *rc, u16 *rrc) 160 { 161 int cc; 162 163 /* make all pages accessible before destroying the guest */ 164 s390_reset_acc(kvm->mm); 165 166 cc = uv_cmd_nodata(kvm_s390_pv_get_handle(kvm), 167 UVC_CMD_DESTROY_SEC_CONF, rc, rrc); 168 WRITE_ONCE(kvm->arch.gmap->guest_handle, 0); 169 atomic_set(&kvm->mm->context.is_protected, 0); 170 KVM_UV_EVENT(kvm, 3, "PROTVIRT DESTROY VM: rc %x rrc %x", *rc, *rrc); 171 WARN_ONCE(cc, "protvirt destroy vm failed rc %x rrc %x", *rc, *rrc); 172 /* Inteded memory leak on "impossible" error */ 173 if (!cc) 174 kvm_s390_pv_dealloc_vm(kvm); 175 return cc ? -EIO : 0; 176 } 177 178 int kvm_s390_pv_init_vm(struct kvm *kvm, u16 *rc, u16 *rrc) 179 { 180 struct uv_cb_cgc uvcb = { 181 .header.cmd = UVC_CMD_CREATE_SEC_CONF, 182 .header.len = sizeof(uvcb) 183 }; 184 int cc, ret; 185 u16 dummy; 186 187 ret = kvm_s390_pv_alloc_vm(kvm); 188 if (ret) 189 return ret; 190 191 /* Inputs */ 192 uvcb.guest_stor_origin = 0; /* MSO is 0 for KVM */ 193 uvcb.guest_stor_len = kvm->arch.pv.guest_len; 194 uvcb.guest_asce = kvm->arch.gmap->asce; 195 uvcb.guest_sca = (unsigned long)kvm->arch.sca; 196 uvcb.conf_base_stor_origin = (u64)kvm->arch.pv.stor_base; 197 uvcb.conf_virt_stor_origin = (u64)kvm->arch.pv.stor_var; 198 199 cc = uv_call(0, (u64)&uvcb); 200 *rc = uvcb.header.rc; 201 *rrc = uvcb.header.rrc; 202 KVM_UV_EVENT(kvm, 3, "PROTVIRT CREATE VM: handle %llx len %llx rc %x rrc %x", 203 uvcb.guest_handle, uvcb.guest_stor_len, *rc, *rrc); 204 205 /* Outputs */ 206 kvm->arch.pv.handle = uvcb.guest_handle; 207 208 if (cc) { 209 if (uvcb.header.rc & UVC_RC_NEED_DESTROY) 210 kvm_s390_pv_deinit_vm(kvm, &dummy, &dummy); 211 else 212 kvm_s390_pv_dealloc_vm(kvm); 213 return -EIO; 214 } 215 kvm->arch.gmap->guest_handle = uvcb.guest_handle; 216 return 0; 217 } 218 219 int kvm_s390_pv_set_sec_parms(struct kvm *kvm, void *hdr, u64 length, u16 *rc, 220 u16 *rrc) 221 { 222 struct uv_cb_ssc uvcb = { 223 .header.cmd = UVC_CMD_SET_SEC_CONF_PARAMS, 224 .header.len = sizeof(uvcb), 225 .sec_header_origin = (u64)hdr, 226 .sec_header_len = length, 227 .guest_handle = kvm_s390_pv_get_handle(kvm), 228 }; 229 int cc = uv_call(0, (u64)&uvcb); 230 231 *rc = uvcb.header.rc; 232 *rrc = uvcb.header.rrc; 233 KVM_UV_EVENT(kvm, 3, "PROTVIRT VM SET PARMS: rc %x rrc %x", 234 *rc, *rrc); 235 if (!cc) 236 atomic_set(&kvm->mm->context.is_protected, 1); 237 return cc ? -EINVAL : 0; 238 } 239 240 static int unpack_one(struct kvm *kvm, unsigned long addr, u64 tweak, 241 u64 offset, u16 *rc, u16 *rrc) 242 { 243 struct uv_cb_unp uvcb = { 244 .header.cmd = UVC_CMD_UNPACK_IMG, 245 .header.len = sizeof(uvcb), 246 .guest_handle = kvm_s390_pv_get_handle(kvm), 247 .gaddr = addr, 248 .tweak[0] = tweak, 249 .tweak[1] = offset, 250 }; 251 int ret = gmap_make_secure(kvm->arch.gmap, addr, &uvcb); 252 253 *rc = uvcb.header.rc; 254 *rrc = uvcb.header.rrc; 255 256 if (ret && ret != -EAGAIN) 257 KVM_UV_EVENT(kvm, 3, "PROTVIRT VM UNPACK: failed addr %llx with rc %x rrc %x", 258 uvcb.gaddr, *rc, *rrc); 259 return ret; 260 } 261 262 int kvm_s390_pv_unpack(struct kvm *kvm, unsigned long addr, unsigned long size, 263 unsigned long tweak, u16 *rc, u16 *rrc) 264 { 265 u64 offset = 0; 266 int ret = 0; 267 268 if (addr & ~PAGE_MASK || !size || size & ~PAGE_MASK) 269 return -EINVAL; 270 271 KVM_UV_EVENT(kvm, 3, "PROTVIRT VM UNPACK: start addr %lx size %lx", 272 addr, size); 273 274 while (offset < size) { 275 ret = unpack_one(kvm, addr, tweak, offset, rc, rrc); 276 if (ret == -EAGAIN) { 277 cond_resched(); 278 if (fatal_signal_pending(current)) 279 break; 280 continue; 281 } 282 if (ret) 283 break; 284 addr += PAGE_SIZE; 285 offset += PAGE_SIZE; 286 } 287 if (!ret) 288 KVM_UV_EVENT(kvm, 3, "%s", "PROTVIRT VM UNPACK: successful"); 289 return ret; 290 } 291 292 int kvm_s390_pv_set_cpu_state(struct kvm_vcpu *vcpu, u8 state) 293 { 294 struct uv_cb_cpu_set_state uvcb = { 295 .header.cmd = UVC_CMD_CPU_SET_STATE, 296 .header.len = sizeof(uvcb), 297 .cpu_handle = kvm_s390_pv_cpu_get_handle(vcpu), 298 .state = state, 299 }; 300 int cc; 301 302 cc = uv_call(0, (u64)&uvcb); 303 KVM_UV_EVENT(vcpu->kvm, 3, "PROTVIRT SET CPU %d STATE %d rc %x rrc %x", 304 vcpu->vcpu_id, state, uvcb.header.rc, uvcb.header.rrc); 305 if (cc) 306 return -EINVAL; 307 return 0; 308 } 309