2 * Copyright (C) 2015 - ARM Ltd
3 * Author: Marc Zyngier <marc.zyngier@arm.com>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program. If not, see <http://www.gnu.org/licenses/>.
18 #include <linux/types.h>
19 #include <linux/jump_label.h>
21 #include <asm/kvm_asm.h>
22 #include <asm/kvm_emulate.h>
23 #include <asm/kvm_hyp.h>
25 static bool __hyp_text __fpsimd_enabled_nvhe(void)
27 return !(read_sysreg(cptr_el2) & CPTR_EL2_TFP);
30 static bool __hyp_text __fpsimd_enabled_vhe(void)
32 return !!(read_sysreg(cpacr_el1) & CPACR_EL1_FPEN);
35 static hyp_alternate_select(__fpsimd_is_enabled,
36 __fpsimd_enabled_nvhe, __fpsimd_enabled_vhe,
37 ARM64_HAS_VIRT_HOST_EXTN);
39 bool __hyp_text __fpsimd_enabled(void)
41 return __fpsimd_is_enabled()();
44 static void __hyp_text __activate_traps_vhe(void)
48 val = read_sysreg(cpacr_el1);
50 val &= ~CPACR_EL1_FPEN;
51 write_sysreg(val, cpacr_el1);
53 write_sysreg(__kvm_hyp_vector, vbar_el1);
56 static void __hyp_text __activate_traps_nvhe(void)
60 val = CPTR_EL2_DEFAULT;
61 val |= CPTR_EL2_TTA | CPTR_EL2_TFP;
62 write_sysreg(val, cptr_el2);
65 static hyp_alternate_select(__activate_traps_arch,
66 __activate_traps_nvhe, __activate_traps_vhe,
67 ARM64_HAS_VIRT_HOST_EXTN);
69 static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu)
74 * We are about to set CPTR_EL2.TFP to trap all floating point
75 * register accesses to EL2, however, the ARM ARM clearly states that
76 * traps are only taken to EL2 if the operation would not otherwise
77 * trap to EL1. Therefore, always make sure that for 32-bit guests,
78 * we set FPEXC.EN to prevent traps to EL1, when setting the TFP bit.
80 val = vcpu->arch.hcr_el2;
81 if (!(val & HCR_RW)) {
82 write_sysreg(1 << 30, fpexc32_el2);
85 write_sysreg(val, hcr_el2);
86 /* Trap on AArch32 cp15 c15 accesses (EL1 or EL0) */
87 write_sysreg(1 << 15, hstr_el2);
88 /* Make sure we trap PMU access from EL0 to EL2 */
89 write_sysreg(ARMV8_PMU_USERENR_MASK, pmuserenr_el0);
90 write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
91 __activate_traps_arch()();
94 static void __hyp_text __deactivate_traps_vhe(void)
96 extern char vectors[]; /* kernel exception vectors */
98 write_sysreg(HCR_HOST_VHE_FLAGS, hcr_el2);
99 write_sysreg(CPACR_EL1_FPEN, cpacr_el1);
100 write_sysreg(vectors, vbar_el1);
103 static void __hyp_text __deactivate_traps_nvhe(void)
105 write_sysreg(HCR_RW, hcr_el2);
106 write_sysreg(CPTR_EL2_DEFAULT, cptr_el2);
109 static hyp_alternate_select(__deactivate_traps_arch,
110 __deactivate_traps_nvhe, __deactivate_traps_vhe,
111 ARM64_HAS_VIRT_HOST_EXTN);
113 static void __hyp_text __deactivate_traps(struct kvm_vcpu *vcpu)
116 * If we pended a virtual abort, preserve it until it gets
117 * cleared. See D1.14.3 (Virtual Interrupts) for details, but
118 * the crucial bit is "On taking a vSError interrupt,
119 * HCR_EL2.VSE is cleared to 0."
121 if (vcpu->arch.hcr_el2 & HCR_VSE)
122 vcpu->arch.hcr_el2 = read_sysreg(hcr_el2);
124 __deactivate_traps_arch()();
125 write_sysreg(0, hstr_el2);
126 write_sysreg(read_sysreg(mdcr_el2) & MDCR_EL2_HPMN_MASK, mdcr_el2);
127 write_sysreg(0, pmuserenr_el0);
130 static void __hyp_text __activate_vm(struct kvm_vcpu *vcpu)
132 struct kvm *kvm = kern_hyp_va(vcpu->kvm);
133 write_sysreg(kvm->arch.vttbr, vttbr_el2);
136 static void __hyp_text __deactivate_vm(struct kvm_vcpu *vcpu)
138 write_sysreg(0, vttbr_el2);
141 static void __hyp_text __vgic_save_state(struct kvm_vcpu *vcpu)
143 if (static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif))
144 __vgic_v3_save_state(vcpu);
146 __vgic_v2_save_state(vcpu);
148 write_sysreg(read_sysreg(hcr_el2) & ~HCR_INT_OVERRIDE, hcr_el2);
151 static void __hyp_text __vgic_restore_state(struct kvm_vcpu *vcpu)
155 val = read_sysreg(hcr_el2);
156 val |= HCR_INT_OVERRIDE;
157 val |= vcpu->arch.irq_lines;
158 write_sysreg(val, hcr_el2);
160 if (static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif))
161 __vgic_v3_restore_state(vcpu);
163 __vgic_v2_restore_state(vcpu);
166 static bool __hyp_text __true_value(void)
171 static bool __hyp_text __false_value(void)
176 static hyp_alternate_select(__check_arm_834220,
177 __false_value, __true_value,
178 ARM64_WORKAROUND_834220);
180 static bool __hyp_text __translate_far_to_hpfar(u64 far, u64 *hpfar)
185 * Resolve the IPA the hard way using the guest VA.
187 * Stage-1 translation already validated the memory access
188 * rights. As such, we can use the EL1 translation regime, and
189 * don't have to distinguish between EL0 and EL1 access.
191 * We do need to save/restore PAR_EL1 though, as we haven't
192 * saved the guest context yet, and we may return early...
194 par = read_sysreg(par_el1);
195 asm volatile("at s1e1r, %0" : : "r" (far));
198 tmp = read_sysreg(par_el1);
199 write_sysreg(par, par_el1);
201 if (unlikely(tmp & 1))
202 return false; /* Translation failed, back to guest */
204 /* Convert PAR to HPFAR format */
205 *hpfar = ((tmp >> 12) & ((1UL << 36) - 1)) << 4;
209 static bool __hyp_text __populate_fault_info(struct kvm_vcpu *vcpu)
211 u64 esr = read_sysreg_el2(esr);
212 u8 ec = ESR_ELx_EC(esr);
215 vcpu->arch.fault.esr_el2 = esr;
217 if (ec != ESR_ELx_EC_DABT_LOW && ec != ESR_ELx_EC_IABT_LOW)
220 far = read_sysreg_el2(far);
223 * The HPFAR can be invalid if the stage 2 fault did not
224 * happen during a stage 1 page table walk (the ESR_EL2.S1PTW
225 * bit is clear) and one of the two following cases are true:
226 * 1. The fault was due to a permission fault
227 * 2. The processor carries errata 834220
229 * Therefore, for all non S1PTW faults where we either have a
230 * permission fault or the errata workaround is enabled, we
231 * resolve the IPA using the AT instruction.
233 if (!(esr & ESR_ELx_S1PTW) &&
234 (__check_arm_834220()() || (esr & ESR_ELx_FSC_TYPE) == FSC_PERM)) {
235 if (!__translate_far_to_hpfar(far, &hpfar))
238 hpfar = read_sysreg(hpfar_el2);
241 vcpu->arch.fault.far_el2 = far;
242 vcpu->arch.fault.hpfar_el2 = hpfar;
246 static void __hyp_text __skip_instr(struct kvm_vcpu *vcpu)
248 *vcpu_pc(vcpu) = read_sysreg_el2(elr);
250 if (vcpu_mode_is_32bit(vcpu)) {
251 vcpu->arch.ctxt.gp_regs.regs.pstate = read_sysreg_el2(spsr);
252 kvm_skip_instr32(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
253 write_sysreg_el2(vcpu->arch.ctxt.gp_regs.regs.pstate, spsr);
258 write_sysreg_el2(*vcpu_pc(vcpu), elr);
261 int __hyp_text __kvm_vcpu_run(struct kvm_vcpu *vcpu)
263 struct kvm_cpu_context *host_ctxt;
264 struct kvm_cpu_context *guest_ctxt;
268 vcpu = kern_hyp_va(vcpu);
269 write_sysreg(vcpu, tpidr_el2);
271 host_ctxt = kern_hyp_va(vcpu->arch.host_cpu_context);
272 guest_ctxt = &vcpu->arch.ctxt;
274 __sysreg_save_host_state(host_ctxt);
275 __debug_cond_save_host_state(vcpu);
277 __activate_traps(vcpu);
280 __vgic_restore_state(vcpu);
281 __timer_restore_state(vcpu);
284 * We must restore the 32-bit state before the sysregs, thanks
285 * to erratum #852523 (Cortex-A57) or #853709 (Cortex-A72).
287 __sysreg32_restore_state(vcpu);
288 __sysreg_restore_guest_state(guest_ctxt);
289 __debug_restore_state(vcpu, kern_hyp_va(vcpu->arch.debug_ptr), guest_ctxt);
291 /* Jump in the fire! */
293 exit_code = __guest_enter(vcpu, host_ctxt);
294 /* And we're baaack! */
297 * We're using the raw exception code in order to only process
298 * the trap if no SError is pending. We will come back to the
299 * same PC once the SError has been injected, and replay the
300 * trapping instruction.
302 if (exit_code == ARM_EXCEPTION_TRAP && !__populate_fault_info(vcpu))
305 if (static_branch_unlikely(&vgic_v2_cpuif_trap) &&
306 exit_code == ARM_EXCEPTION_TRAP) {
309 valid = kvm_vcpu_trap_get_class(vcpu) == ESR_ELx_EC_DABT_LOW &&
310 kvm_vcpu_trap_get_fault_type(vcpu) == FSC_FAULT &&
311 kvm_vcpu_dabt_isvalid(vcpu) &&
312 !kvm_vcpu_dabt_isextabt(vcpu) &&
313 !kvm_vcpu_dabt_iss1tw(vcpu);
316 int ret = __vgic_v2_perform_cpuif_access(vcpu);
324 /* Promote an illegal access to an SError */
326 exit_code = ARM_EXCEPTION_EL1_SERROR;
329 /* 0 falls through to be handler out of EL2 */
333 fp_enabled = __fpsimd_enabled();
335 __sysreg_save_guest_state(guest_ctxt);
336 __sysreg32_save_state(vcpu);
337 __timer_save_state(vcpu);
338 __vgic_save_state(vcpu);
340 __deactivate_traps(vcpu);
341 __deactivate_vm(vcpu);
343 __sysreg_restore_host_state(host_ctxt);
346 __fpsimd_save_state(&guest_ctxt->gp_regs.fp_regs);
347 __fpsimd_restore_state(&host_ctxt->gp_regs.fp_regs);
350 __debug_save_state(vcpu, kern_hyp_va(vcpu->arch.debug_ptr), guest_ctxt);
351 __debug_cond_restore_host_state(vcpu);
356 static const char __hyp_panic_string[] = "HYP panic:\nPS:%08llx PC:%016llx ESR:%08llx\nFAR:%016llx HPFAR:%016llx PAR:%016llx\nVCPU:%p\n";
358 static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par)
360 unsigned long str_va;
363 * Force the panic string to be loaded from the literal pool,
364 * making sure it is a kernel address and not a PC-relative
367 asm volatile("ldr %0, =__hyp_panic_string" : "=r" (str_va));
369 __hyp_do_panic(str_va,
371 read_sysreg(esr_el2), read_sysreg_el2(far),
372 read_sysreg(hpfar_el2), par,
373 (void *)read_sysreg(tpidr_el2));
376 static void __hyp_text __hyp_call_panic_vhe(u64 spsr, u64 elr, u64 par)
378 panic(__hyp_panic_string,
380 read_sysreg_el2(esr), read_sysreg_el2(far),
381 read_sysreg(hpfar_el2), par,
382 (void *)read_sysreg(tpidr_el2));
385 static hyp_alternate_select(__hyp_call_panic,
386 __hyp_call_panic_nvhe, __hyp_call_panic_vhe,
387 ARM64_HAS_VIRT_HOST_EXTN);
389 void __hyp_text __noreturn __hyp_panic(void)
391 u64 spsr = read_sysreg_el2(spsr);
392 u64 elr = read_sysreg_el2(elr);
393 u64 par = read_sysreg(par_el1);
395 if (read_sysreg(vttbr_el2)) {
396 struct kvm_vcpu *vcpu;
397 struct kvm_cpu_context *host_ctxt;
399 vcpu = (struct kvm_vcpu *)read_sysreg(tpidr_el2);
400 host_ctxt = kern_hyp_va(vcpu->arch.host_cpu_context);
401 __deactivate_traps(vcpu);
402 __deactivate_vm(vcpu);
403 __sysreg_restore_host_state(host_ctxt);
406 /* Call panic for real */
407 __hyp_call_panic()(spsr, elr, par);