arch/arm64/kvm/hyp/hyp-entry.S

   1 /* SPDX-License-Identifier: GPL-2.0-only */
   2 /*
   3  * Copyright (C) 2015-2018 - ARM Ltd
   4  * Author: Marc Zyngier <marc.zyngier@arm.com>
   5  */
   6
   7 #include <linux/arm-smccc.h>
   8 #include <linux/linkage.h>
   9
  10 #include <asm/alternative.h>
  11 #include <asm/assembler.h>
  12 #include <asm/cpufeature.h>
  13 #include <asm/kvm_arm.h>
  14 #include <asm/kvm_asm.h>
  15 #include <asm/mmu.h>
  16 #include <asm/spectre.h>
  17
  18 .macro save_caller_saved_regs_vect
  19         /* x0 and x1 were saved in the vector entry */
  20         stp     x2, x3,   [sp, #-16]!
  21         stp     x4, x5,   [sp, #-16]!
  22         stp     x6, x7,   [sp, #-16]!
  23         stp     x8, x9,   [sp, #-16]!
  24         stp     x10, x11, [sp, #-16]!
  25         stp     x12, x13, [sp, #-16]!
  26         stp     x14, x15, [sp, #-16]!
  27         stp     x16, x17, [sp, #-16]!
  28 .endm
  29
  30 .macro restore_caller_saved_regs_vect
  31         ldp     x16, x17, [sp], #16
  32         ldp     x14, x15, [sp], #16
  33         ldp     x12, x13, [sp], #16
  34         ldp     x10, x11, [sp], #16
  35         ldp     x8, x9,   [sp], #16
  36         ldp     x6, x7,   [sp], #16
  37         ldp     x4, x5,   [sp], #16
  38         ldp     x2, x3,   [sp], #16
  39         ldp     x0, x1,   [sp], #16
  40 .endm
  41
  42         .text
  43
  44 el1_sync:                               // Guest trapped into EL2
  45
  46         mrs     x0, esr_el2
  47         ubfx    x0, x0, #ESR_ELx_EC_SHIFT, #ESR_ELx_EC_WIDTH
  48         cmp     x0, #ESR_ELx_EC_HVC64
  49         ccmp    x0, #ESR_ELx_EC_HVC32, #4, ne
  50         b.ne    el1_trap
  51
  52         /*
  53          * Fastest possible path for ARM_SMCCC_ARCH_WORKAROUND_1.
  54          * The workaround has already been applied on the host,
  55          * so let's quickly get back to the guest. We don't bother
  56          * restoring x1, as it can be clobbered anyway.
  57          */
  58         ldr     x1, [sp]                                // Guest's x0
  59         eor     w1, w1, #ARM_SMCCC_ARCH_WORKAROUND_1
  60         cbz     w1, wa_epilogue
  61
  62         /* ARM_SMCCC_ARCH_WORKAROUND_2 handling */
  63         eor     w1, w1, #(ARM_SMCCC_ARCH_WORKAROUND_1 ^ \
  64                           ARM_SMCCC_ARCH_WORKAROUND_2)
  65         cbz     w1, wa_epilogue
  66
  67         eor     w1, w1, #(ARM_SMCCC_ARCH_WORKAROUND_2 ^ \
  68                           ARM_SMCCC_ARCH_WORKAROUND_3)
  69         cbnz    w1, el1_trap
  70
  71 wa_epilogue:
  72         mov     x0, xzr
  73         add     sp, sp, #16
  74         eret
  75         sb
  76
  77 el1_trap:
  78         get_vcpu_ptr    x1, x0
  79         mov     x0, #ARM_EXCEPTION_TRAP
  80         b       __guest_exit
  81
  82 el1_irq:
  83 el1_fiq:
  84         get_vcpu_ptr    x1, x0
  85         mov     x0, #ARM_EXCEPTION_IRQ
  86         b       __guest_exit
  87
  88 el1_error:
  89         get_vcpu_ptr    x1, x0
  90         mov     x0, #ARM_EXCEPTION_EL1_SERROR
  91         b       __guest_exit
  92
  93 el2_sync:
  94         /* Check for illegal exception return */
  95         mrs     x0, spsr_el2
  96         tbnz    x0, #20, 1f
  97
  98         save_caller_saved_regs_vect
  99         stp     x29, x30, [sp, #-16]!
 100         bl      kvm_unexpected_el2_exception
 101         ldp     x29, x30, [sp], #16
 102         restore_caller_saved_regs_vect
 103
 104         eret
 105
 106 1:
 107         /* Let's attempt a recovery from the illegal exception return */
 108         get_vcpu_ptr    x1, x0
 109         mov     x0, #ARM_EXCEPTION_IL
 110         b       __guest_exit
 111
 112
 113 el2_error:
 114         save_caller_saved_regs_vect
 115         stp     x29, x30, [sp, #-16]!
 116
 117         bl      kvm_unexpected_el2_exception
 118
 119         ldp     x29, x30, [sp], #16
 120         restore_caller_saved_regs_vect
 121
 122         eret
 123         sb
 124
 125 .macro invalid_vector   label, target = __guest_exit_panic
 126         .align  2
 127 SYM_CODE_START_LOCAL(\label)
 128         b \target
 129 SYM_CODE_END(\label)
 130 .endm
 131
 132         /* None of these should ever happen */
 133         invalid_vector  el2t_sync_invalid
 134         invalid_vector  el2t_irq_invalid
 135         invalid_vector  el2t_fiq_invalid
 136         invalid_vector  el2t_error_invalid
 137         invalid_vector  el2h_irq_invalid
 138         invalid_vector  el2h_fiq_invalid
 139
 140         .ltorg
 141
 142         .align 11
 143
 144 .macro check_preamble_length start, end
 145 /* kvm_patch_vector_branch() generates code that jumps over the preamble. */
 146 .if ((\end-\start) != KVM_VECTOR_PREAMBLE)
 147         .error "KVM vector preamble length mismatch"
 148 .endif
 149 .endm
 150
 151 .macro valid_vect target
 152         .align 7
 153 661:
 154         esb
 155         stp     x0, x1, [sp, #-16]!
 156 662:
 157         /*
 158          * spectre vectors __bp_harden_hyp_vecs generate br instructions at runtime
 159          * that jump at offset 8 at __kvm_hyp_vector.
 160          * As hyp .text is guarded section, it needs bti j.
 161          */
 162         bti j
 163         b       \target
 164
 165 check_preamble_length 661b, 662b
 166 .endm
 167
 168 .macro invalid_vect target
 169         .align 7
 170 661:
 171         nop
 172         stp     x0, x1, [sp, #-16]!
 173 662:
 174         /* Check valid_vect */
 175         bti j
 176         b       \target
 177
 178 check_preamble_length 661b, 662b
 179 .endm
 180
 181 SYM_CODE_START(__kvm_hyp_vector)
 182         invalid_vect    el2t_sync_invalid       // Synchronous EL2t
 183         invalid_vect    el2t_irq_invalid        // IRQ EL2t
 184         invalid_vect    el2t_fiq_invalid        // FIQ EL2t
 185         invalid_vect    el2t_error_invalid      // Error EL2t
 186
 187         valid_vect      el2_sync                // Synchronous EL2h
 188         invalid_vect    el2h_irq_invalid        // IRQ EL2h
 189         invalid_vect    el2h_fiq_invalid        // FIQ EL2h
 190         valid_vect      el2_error               // Error EL2h
 191
 192         valid_vect      el1_sync                // Synchronous 64-bit EL1
 193         valid_vect      el1_irq                 // IRQ 64-bit EL1
 194         valid_vect      el1_fiq                 // FIQ 64-bit EL1
 195         valid_vect      el1_error               // Error 64-bit EL1
 196
 197         valid_vect      el1_sync                // Synchronous 32-bit EL1
 198         valid_vect      el1_irq                 // IRQ 32-bit EL1
 199         valid_vect      el1_fiq                 // FIQ 32-bit EL1
 200         valid_vect      el1_error               // Error 32-bit EL1
 201 SYM_CODE_END(__kvm_hyp_vector)
 202
 203 .macro spectrev2_smccc_wa1_smc
 204         sub     sp, sp, #(8 * 4)
 205         stp     x2, x3, [sp, #(8 * 0)]
 206         stp     x0, x1, [sp, #(8 * 2)]
 207         alternative_cb ARM64_ALWAYS_SYSTEM, spectre_bhb_patch_wa3
 208         /* Patched to mov WA3 when supported */
 209         mov     w0, #ARM_SMCCC_ARCH_WORKAROUND_1
 210         alternative_cb_end
 211         smc     #0
 212         ldp     x2, x3, [sp, #(8 * 0)]
 213         add     sp, sp, #(8 * 2)
 214 .endm
 215
 216 .macro hyp_ventry       indirect, spectrev2
 217         .align  7
 218 1:      esb
 219         .if \spectrev2 != 0
 220         spectrev2_smccc_wa1_smc
 221         .else
 222         stp     x0, x1, [sp, #-16]!
 223         mitigate_spectre_bhb_loop       x0
 224         mitigate_spectre_bhb_clear_insn
 225         .endif
 226         .if \indirect != 0
 227         alternative_cb ARM64_ALWAYS_SYSTEM, kvm_patch_vector_branch
 228         /*
 229          * For ARM64_SPECTRE_V3A configurations, these NOPs get replaced with:
 230          *
 231          * movz x0, #(addr & 0xffff)
 232          * movk x0, #((addr >> 16) & 0xffff), lsl #16
 233          * movk x0, #((addr >> 32) & 0xffff), lsl #32
 234          * br   x0
 235          *
 236          * Where:
 237          * addr = kern_hyp_va(__kvm_hyp_vector) + vector-offset + KVM_VECTOR_PREAMBLE.
 238          * See kvm_patch_vector_branch for details.
 239          */
 240         nop
 241         nop
 242         nop
 243         nop
 244         alternative_cb_end
 245         .endif
 246         b       __kvm_hyp_vector + (1b - 0b + KVM_VECTOR_PREAMBLE)
 247 .endm
 248
 249 .macro generate_vectors indirect, spectrev2
 250 0:
 251         .rept 16
 252         hyp_ventry      \indirect, \spectrev2
 253         .endr
 254         .org 0b + SZ_2K         // Safety measure
 255 .endm
 256
 257         .align  11
 258 SYM_CODE_START(__bp_harden_hyp_vecs)
 259         generate_vectors indirect = 0, spectrev2 = 1 // HYP_VECTOR_SPECTRE_DIRECT
 260         generate_vectors indirect = 1, spectrev2 = 0 // HYP_VECTOR_INDIRECT
 261         generate_vectors indirect = 1, spectrev2 = 1 // HYP_VECTOR_SPECTRE_INDIRECT
 262 1:      .org __bp_harden_hyp_vecs + __BP_HARDEN_HYP_VECS_SZ
 263         .org 1b
 264 SYM_CODE_END(__bp_harden_hyp_vecs)