arch/arm/kvm/interrupts.S

   1 /*
   2  * Copyright (C) 2012 - Virtual Open Systems and Columbia University
   3  * Author: Christoffer Dall <c.dall@virtualopensystems.com>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License, version 2, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, write to the Free Software
  16  * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  17  */
  18
  19 #include <linux/linkage.h>
  20 #include <linux/const.h>
  21 #include <asm/unified.h>
  22 #include <asm/page.h>
  23 #include <asm/ptrace.h>
  24 #include <asm/asm-offsets.h>
  25 #include <asm/kvm_asm.h>
  26 #include <asm/kvm_arm.h>
  27 #include <asm/vfpmacros.h>
  28 #include "interrupts_head.S"
  29
  30         .text
  31
  32 __kvm_hyp_code_start:
  33         .globl __kvm_hyp_code_start
  34
  35 /********************************************************************
  36  * Flush per-VMID TLBs
  37  *
  38  * void __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa);
  39  *
  40  * We rely on the hardware to broadcast the TLB invalidation to all CPUs
  41  * inside the inner-shareable domain (which is the case for all v7
  42  * implementations).  If we come across a non-IS SMP implementation, we'll
  43  * have to use an IPI based mechanism. Until then, we stick to the simple
  44  * hardware assisted version.
  45  *
  46  * As v7 does not support flushing per IPA, just nuke the whole TLB
  47  * instead, ignoring the ipa value.
  48  */
  49 ENTRY(__kvm_tlb_flush_vmid_ipa)
  50         push    {r2, r3}
  51
  52         dsb     ishst
  53         add     r0, r0, #KVM_VTTBR
  54         ldrd    r2, r3, [r0]
  55         mcrr    p15, 6, r2, r3, c2      @ Write VTTBR
  56         isb
  57         mcr     p15, 0, r0, c8, c3, 0   @ TLBIALLIS (rt ignored)
  58         dsb
  59         isb
  60         mov     r2, #0
  61         mov     r3, #0
  62         mcrr    p15, 6, r2, r3, c2      @ Back to VMID #0
  63         isb                             @ Not necessary if followed by eret
  64
  65         pop     {r2, r3}
  66         bx      lr
  67 ENDPROC(__kvm_tlb_flush_vmid_ipa)
  68
  69 /********************************************************************
  70  * Flush TLBs and instruction caches of all CPUs inside the inner-shareable
  71  * domain, for all VMIDs
  72  *
  73  * void __kvm_flush_vm_context(void);
  74  */
  75 ENTRY(__kvm_flush_vm_context)
  76         mov     r0, #0                  @ rn parameter for c15 flushes is SBZ
  77
  78         /* Invalidate NS Non-Hyp TLB Inner Shareable (TLBIALLNSNHIS) */
  79         mcr     p15, 4, r0, c8, c3, 4
  80         /* Invalidate instruction caches Inner Shareable (ICIALLUIS) */
  81         mcr     p15, 0, r0, c7, c1, 0
  82         dsb
  83         isb                             @ Not necessary if followed by eret
  84
  85         bx      lr
  86 ENDPROC(__kvm_flush_vm_context)
  87
  88
  89 /********************************************************************
  90  *  Hypervisor world-switch code
  91  *
  92  *
  93  * int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
  94  */
  95 ENTRY(__kvm_vcpu_run)
  96         @ Save the vcpu pointer
  97         mcr     p15, 4, vcpu, c13, c0, 2        @ HTPIDR
  98
  99         save_host_regs
 100
 101         restore_vgic_state
 102         restore_timer_state
 103
 104         @ Store hardware CP15 state and load guest state
 105         read_cp15_state store_to_vcpu = 0
 106         write_cp15_state read_from_vcpu = 1
 107
 108         @ If the host kernel has not been configured with VFPv3 support,
 109         @ then it is safer if we deny guests from using it as well.
 110 #ifdef CONFIG_VFPv3
 111         @ Set FPEXC_EN so the guest doesn't trap floating point instructions
 112         VFPFMRX r2, FPEXC               @ VMRS
 113         push    {r2}
 114         orr     r2, r2, #FPEXC_EN
 115         VFPFMXR FPEXC, r2               @ VMSR
 116 #endif
 117
 118         @ Configure Hyp-role
 119         configure_hyp_role vmentry
 120
 121         @ Trap coprocessor CRx accesses
 122         set_hstr vmentry
 123         set_hcptr vmentry, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11))
 124         set_hdcr vmentry
 125
 126         @ Write configured ID register into MIDR alias
 127         ldr     r1, [vcpu, #VCPU_MIDR]
 128         mcr     p15, 4, r1, c0, c0, 0
 129
 130         @ Write guest view of MPIDR into VMPIDR
 131         ldr     r1, [vcpu, #CP15_OFFSET(c0_MPIDR)]
 132         mcr     p15, 4, r1, c0, c0, 5
 133
 134         @ Set up guest memory translation
 135         ldr     r1, [vcpu, #VCPU_KVM]
 136         add     r1, r1, #KVM_VTTBR
 137         ldrd    r2, r3, [r1]
 138         mcrr    p15, 6, r2, r3, c2      @ Write VTTBR
 139
 140         @ We're all done, just restore the GPRs and go to the guest
 141         restore_guest_regs
 142         clrex                           @ Clear exclusive monitor
 143         eret
 144
 145 __kvm_vcpu_return:
 146         /*
 147          * return convention:
 148          * guest r0, r1, r2 saved on the stack
 149          * r0: vcpu pointer
 150          * r1: exception code
 151          */
 152         save_guest_regs
 153
 154         @ Set VMID == 0
 155         mov     r2, #0
 156         mov     r3, #0
 157         mcrr    p15, 6, r2, r3, c2      @ Write VTTBR
 158
 159         @ Don't trap coprocessor accesses for host kernel
 160         set_hstr vmexit
 161         set_hdcr vmexit
 162         set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11))
 163
 164 #ifdef CONFIG_VFPv3
 165         @ Save floating point registers we if let guest use them.
 166         tst     r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
 167         bne     after_vfp_restore
 168
 169         @ Switch VFP/NEON hardware state to the host's
 170         add     r7, vcpu, #VCPU_VFP_GUEST
 171         store_vfp_state r7
 172         add     r7, vcpu, #VCPU_VFP_HOST
 173         ldr     r7, [r7]
 174         restore_vfp_state r7
 175
 176 after_vfp_restore:
 177         @ Restore FPEXC_EN which we clobbered on entry
 178         pop     {r2}
 179         VFPFMXR FPEXC, r2
 180 #endif
 181
 182         @ Reset Hyp-role
 183         configure_hyp_role vmexit
 184
 185         @ Let host read hardware MIDR
 186         mrc     p15, 0, r2, c0, c0, 0
 187         mcr     p15, 4, r2, c0, c0, 0
 188
 189         @ Back to hardware MPIDR
 190         mrc     p15, 0, r2, c0, c0, 5
 191         mcr     p15, 4, r2, c0, c0, 5
 192
 193         @ Store guest CP15 state and restore host state
 194         read_cp15_state store_to_vcpu = 1
 195         write_cp15_state read_from_vcpu = 0
 196
 197         save_timer_state
 198         save_vgic_state
 199
 200         restore_host_regs
 201         clrex                           @ Clear exclusive monitor
 202         mov     r0, r1                  @ Return the return code
 203         mov     r1, #0                  @ Clear upper bits in return value
 204         bx      lr                      @ return to IOCTL
 205
 206 /********************************************************************
 207  *  Call function in Hyp mode
 208  *
 209  *
 210  * u64 kvm_call_hyp(void *hypfn, ...);
 211  *
 212  * This is not really a variadic function in the classic C-way and care must
 213  * be taken when calling this to ensure parameters are passed in registers
 214  * only, since the stack will change between the caller and the callee.
 215  *
 216  * Call the function with the first argument containing a pointer to the
 217  * function you wish to call in Hyp mode, and subsequent arguments will be
 218  * passed as r0, r1, and r2 (a maximum of 3 arguments in addition to the
 219  * function pointer can be passed).  The function being called must be mapped
 220  * in Hyp mode (see init_hyp_mode in arch/arm/kvm/arm.c).  Return values are
 221  * passed in r0 and r1.
 222  *
 223  * The calling convention follows the standard AAPCS:
 224  *   r0 - r3: caller save
 225  *   r12:     caller save
 226  *   rest:    callee save
 227  */
 228 ENTRY(kvm_call_hyp)
 229         hvc     #0
 230         bx      lr
 231
 232 /********************************************************************
 233  * Hypervisor exception vector and handlers
 234  *
 235  *
 236  * The KVM/ARM Hypervisor ABI is defined as follows:
 237  *
 238  * Entry to Hyp mode from the host kernel will happen _only_ when an HVC
 239  * instruction is issued since all traps are disabled when running the host
 240  * kernel as per the Hyp-mode initialization at boot time.
 241  *
 242  * HVC instructions cause a trap to the vector page + offset 0x14 (see hyp_hvc
 243  * below) when the HVC instruction is called from SVC mode (i.e. a guest or the
 244  * host kernel) and they cause a trap to the vector page + offset 0x8 when HVC
 245  * instructions are called from within Hyp-mode.
 246  *
 247  * Hyp-ABI: Calling HYP-mode functions from host (in SVC mode):
 248  *    Switching to Hyp mode is done through a simple HVC #0 instruction. The
 249  *    exception vector code will check that the HVC comes from VMID==0 and if
 250  *    so will push the necessary state (SPSR, lr_usr) on the Hyp stack.
 251  *    - r0 contains a pointer to a HYP function
 252  *    - r1, r2, and r3 contain arguments to the above function.
 253  *    - The HYP function will be called with its arguments in r0, r1 and r2.
 254  *    On HYP function return, we return directly to SVC.
 255  *
 256  * Note that the above is used to execute code in Hyp-mode from a host-kernel
 257  * point of view, and is a different concept from performing a world-switch and
 258  * executing guest code SVC mode (with a VMID != 0).
 259  */
 260
 261 /* Handle undef, svc, pabt, or dabt by crashing with a user notice */
 262 .macro bad_exception exception_code, panic_str
 263         push    {r0-r2}
 264         mrrc    p15, 6, r0, r1, c2      @ Read VTTBR
 265         lsr     r1, r1, #16
 266         ands    r1, r1, #0xff
 267         beq     99f
 268
 269         load_vcpu                       @ Load VCPU pointer
 270         .if \exception_code == ARM_EXCEPTION_DATA_ABORT
 271         mrc     p15, 4, r2, c5, c2, 0   @ HSR
 272         mrc     p15, 4, r1, c6, c0, 0   @ HDFAR
 273         str     r2, [vcpu, #VCPU_HSR]
 274         str     r1, [vcpu, #VCPU_HxFAR]
 275         .endif
 276         .if \exception_code == ARM_EXCEPTION_PREF_ABORT
 277         mrc     p15, 4, r2, c5, c2, 0   @ HSR
 278         mrc     p15, 4, r1, c6, c0, 2   @ HIFAR
 279         str     r2, [vcpu, #VCPU_HSR]
 280         str     r1, [vcpu, #VCPU_HxFAR]
 281         .endif
 282         mov     r1, #\exception_code
 283         b       __kvm_vcpu_return
 284
 285         @ We were in the host already. Let's craft a panic-ing return to SVC.
 286 99:     mrs     r2, cpsr
 287         bic     r2, r2, #MODE_MASK
 288         orr     r2, r2, #SVC_MODE
 289 THUMB(  orr     r2, r2, #PSR_T_BIT      )
 290         msr     spsr_cxsf, r2
 291         mrs     r1, ELR_hyp
 292         ldr     r2, =BSYM(panic)
 293         msr     ELR_hyp, r2
 294         ldr     r0, =\panic_str
 295         clrex                           @ Clear exclusive monitor
 296         eret
 297 .endm
 298
 299         .text
 300
 301         .align 5
 302 __kvm_hyp_vector:
 303         .globl __kvm_hyp_vector
 304
 305         @ Hyp-mode exception vector
 306         W(b)    hyp_reset
 307         W(b)    hyp_undef
 308         W(b)    hyp_svc
 309         W(b)    hyp_pabt
 310         W(b)    hyp_dabt
 311         W(b)    hyp_hvc
 312         W(b)    hyp_irq
 313         W(b)    hyp_fiq
 314
 315         .align
 316 hyp_reset:
 317         b       hyp_reset
 318
 319         .align
 320 hyp_undef:
 321         bad_exception ARM_EXCEPTION_UNDEFINED, und_die_str
 322
 323         .align
 324 hyp_svc:
 325         bad_exception ARM_EXCEPTION_HVC, svc_die_str
 326
 327         .align
 328 hyp_pabt:
 329         bad_exception ARM_EXCEPTION_PREF_ABORT, pabt_die_str
 330
 331         .align
 332 hyp_dabt:
 333         bad_exception ARM_EXCEPTION_DATA_ABORT, dabt_die_str
 334
 335         .align
 336 hyp_hvc:
 337         /*
 338          * Getting here is either becuase of a trap from a guest or from calling
 339          * HVC from the host kernel, which means "switch to Hyp mode".
 340          */
 341         push    {r0, r1, r2}
 342
 343         @ Check syndrome register
 344         mrc     p15, 4, r1, c5, c2, 0   @ HSR
 345         lsr     r0, r1, #HSR_EC_SHIFT
 346 #ifdef CONFIG_VFPv3
 347         cmp     r0, #HSR_EC_CP_0_13
 348         beq     switch_to_guest_vfp
 349 #endif
 350         cmp     r0, #HSR_EC_HVC
 351         bne     guest_trap              @ Not HVC instr.
 352
 353         /*
 354          * Let's check if the HVC came from VMID 0 and allow simple
 355          * switch to Hyp mode
 356          */
 357         mrrc    p15, 6, r0, r2, c2
 358         lsr     r2, r2, #16
 359         and     r2, r2, #0xff
 360         cmp     r2, #0
 361         bne     guest_trap              @ Guest called HVC
 362
 363 host_switch_to_hyp:
 364         pop     {r0, r1, r2}
 365
 366         push    {lr}
 367         mrs     lr, SPSR
 368         push    {lr}
 369
 370         mov     lr, r0
 371         mov     r0, r1
 372         mov     r1, r2
 373         mov     r2, r3
 374
 375 THUMB(  orr     lr, #1)
 376         blx     lr                      @ Call the HYP function
 377
 378         pop     {lr}
 379         msr     SPSR_csxf, lr
 380         pop     {lr}
 381         eret
 382
 383 guest_trap:
 384         load_vcpu                       @ Load VCPU pointer to r0
 385         str     r1, [vcpu, #VCPU_HSR]
 386
 387         @ Check if we need the fault information
 388         lsr     r1, r1, #HSR_EC_SHIFT
 389         cmp     r1, #HSR_EC_IABT
 390         mrceq   p15, 4, r2, c6, c0, 2   @ HIFAR
 391         beq     2f
 392         cmp     r1, #HSR_EC_DABT
 393         bne     1f
 394         mrc     p15, 4, r2, c6, c0, 0   @ HDFAR
 395
 396 2:      str     r2, [vcpu, #VCPU_HxFAR]
 397
 398         /*
 399          * B3.13.5 Reporting exceptions taken to the Non-secure PL2 mode:
 400          *
 401          * Abort on the stage 2 translation for a memory access from a
 402          * Non-secure PL1 or PL0 mode:
 403          *
 404          * For any Access flag fault or Translation fault, and also for any
 405          * Permission fault on the stage 2 translation of a memory access
 406          * made as part of a translation table walk for a stage 1 translation,
 407          * the HPFAR holds the IPA that caused the fault. Otherwise, the HPFAR
 408          * is UNKNOWN.
 409          */
 410
 411         /* Check for permission fault, and S1PTW */
 412         mrc     p15, 4, r1, c5, c2, 0   @ HSR
 413         and     r0, r1, #HSR_FSC_TYPE
 414         cmp     r0, #FSC_PERM
 415         tsteq   r1, #(1 << 7)           @ S1PTW
 416         mrcne   p15, 4, r2, c6, c0, 4   @ HPFAR
 417         bne     3f
 418
 419         /* Preserve PAR */
 420         mrrc    p15, 0, r0, r1, c7      @ PAR
 421         push    {r0, r1}
 422
 423         /* Resolve IPA using the xFAR */
 424         mcr     p15, 0, r2, c7, c8, 0   @ ATS1CPR
 425         isb
 426         mrrc    p15, 0, r0, r1, c7      @ PAR
 427         tst     r0, #1
 428         bne     4f                      @ Failed translation
 429         ubfx    r2, r0, #12, #20
 430         lsl     r2, r2, #4
 431         orr     r2, r2, r1, lsl #24
 432
 433         /* Restore PAR */
 434         pop     {r0, r1}
 435         mcrr    p15, 0, r0, r1, c7      @ PAR
 436
 437 3:      load_vcpu                       @ Load VCPU pointer to r0
 438         str     r2, [r0, #VCPU_HPFAR]
 439
 440 1:      mov     r1, #ARM_EXCEPTION_HVC
 441         b       __kvm_vcpu_return
 442
 443 4:      pop     {r0, r1}                @ Failed translation, return to guest
 444         mcrr    p15, 0, r0, r1, c7      @ PAR
 445         clrex
 446         pop     {r0, r1, r2}
 447         eret
 448
 449 /*
 450  * If VFPv3 support is not available, then we will not switch the VFP
 451  * registers; however cp10 and cp11 accesses will still trap and fallback
 452  * to the regular coprocessor emulation code, which currently will
 453  * inject an undefined exception to the guest.
 454  */
 455 #ifdef CONFIG_VFPv3
 456 switch_to_guest_vfp:
 457         load_vcpu                       @ Load VCPU pointer to r0
 458         push    {r3-r7}
 459
 460         @ NEON/VFP used.  Turn on VFP access.
 461         set_hcptr vmexit, (HCPTR_TCP(10) | HCPTR_TCP(11))
 462
 463         @ Switch VFP/NEON hardware state to the guest's
 464         add     r7, r0, #VCPU_VFP_HOST
 465         ldr     r7, [r7]
 466         store_vfp_state r7
 467         add     r7, r0, #VCPU_VFP_GUEST
 468         restore_vfp_state r7
 469
 470         pop     {r3-r7}
 471         pop     {r0-r2}
 472         clrex
 473         eret
 474 #endif
 475
 476         .align
 477 hyp_irq:
 478         push    {r0, r1, r2}
 479         mov     r1, #ARM_EXCEPTION_IRQ
 480         load_vcpu                       @ Load VCPU pointer to r0
 481         b       __kvm_vcpu_return
 482
 483         .align
 484 hyp_fiq:
 485         b       hyp_fiq
 486
 487         .ltorg
 488
 489 __kvm_hyp_code_end:
 490         .globl  __kvm_hyp_code_end
 491
 492         .section ".rodata"
 493
 494 und_die_str:
 495         .ascii  "unexpected undefined exception in Hyp mode at: %#08x"
 496 pabt_die_str:
 497         .ascii  "unexpected prefetch abort in Hyp mode at: %#08x"
 498 dabt_die_str:
 499         .ascii  "unexpected data abort in Hyp mode at: %#08x"
 500 svc_die_str:
 501         .ascii  "unexpected HVC/SVC trap in Hyp mode at: %#08x"