arch/arm64/kvm/va_layout.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (C) 2017 ARM Ltd.
   4  * Author: Marc Zyngier <marc.zyngier@arm.com>
   5  */
   6
   7 #include <linux/kvm_host.h>
   8 #include <linux/random.h>
   9 #include <linux/memblock.h>
  10 #include <asm/alternative.h>
  11 #include <asm/debug-monitors.h>
  12 #include <asm/insn.h>
  13 #include <asm/kvm_mmu.h>
  14
  15 /*
  16  * The LSB of the random hyp VA tag or 0 if no randomization is used.
  17  */
  18 static u8 tag_lsb;
  19 /*
  20  * The random hyp VA tag value with the region bit if hyp randomization is used
  21  */
  22 static u64 tag_val;
  23 static u64 va_mask;
  24
  25 __init void kvm_compute_layout(void)
  26 {
  27         phys_addr_t idmap_addr = __pa_symbol(__hyp_idmap_text_start);
  28         u64 hyp_va_msb;
  29         int kva_msb;
  30
  31         /* Where is my RAM region? */
  32         hyp_va_msb  = idmap_addr & BIT(vabits_actual - 1);
  33         hyp_va_msb ^= BIT(vabits_actual - 1);
  34
  35         kva_msb = fls64((u64)phys_to_virt(memblock_start_of_DRAM()) ^
  36                         (u64)(high_memory - 1));
  37
  38         if (kva_msb == (vabits_actual - 1)) {
  39                 /*
  40                  * No space in the address, let's compute the mask so
  41                  * that it covers (vabits_actual - 1) bits, and the region
  42                  * bit. The tag stays set to zero.
  43                  */
  44                 va_mask  = BIT(vabits_actual - 1) - 1;
  45                 va_mask |= hyp_va_msb;
  46         } else {
  47                 /*
  48                  * We do have some free bits to insert a random tag.
  49                  * Hyp VAs are now created from kernel linear map VAs
  50                  * using the following formula (with V == vabits_actual):
  51                  *
  52                  *  63 ... V |     V-1    | V-2 .. tag_lsb | tag_lsb - 1 .. 0
  53                  *  ---------------------------------------------------------
  54                  * | 0000000 | hyp_va_msb |    random tag  |  kern linear VA |
  55                  */
  56                 tag_lsb = kva_msb;
  57                 va_mask = GENMASK_ULL(tag_lsb - 1, 0);
  58                 tag_val = get_random_long() & GENMASK_ULL(vabits_actual - 2, tag_lsb);
  59                 tag_val |= hyp_va_msb;
  60                 tag_val >>= tag_lsb;
  61         }
  62 }
  63
  64 static u32 compute_instruction(int n, u32 rd, u32 rn)
  65 {
  66         u32 insn = AARCH64_BREAK_FAULT;
  67
  68         switch (n) {
  69         case 0:
  70                 insn = aarch64_insn_gen_logical_immediate(AARCH64_INSN_LOGIC_AND,
  71                                                           AARCH64_INSN_VARIANT_64BIT,
  72                                                           rn, rd, va_mask);
  73                 break;
  74
  75         case 1:
  76                 /* ROR is a variant of EXTR with Rm = Rn */
  77                 insn = aarch64_insn_gen_extr(AARCH64_INSN_VARIANT_64BIT,
  78                                              rn, rn, rd,
  79                                              tag_lsb);
  80                 break;
  81
  82         case 2:
  83                 insn = aarch64_insn_gen_add_sub_imm(rd, rn,
  84                                                     tag_val & GENMASK(11, 0),
  85                                                     AARCH64_INSN_VARIANT_64BIT,
  86                                                     AARCH64_INSN_ADSB_ADD);
  87                 break;
  88
  89         case 3:
  90                 insn = aarch64_insn_gen_add_sub_imm(rd, rn,
  91                                                     tag_val & GENMASK(23, 12),
  92                                                     AARCH64_INSN_VARIANT_64BIT,
  93                                                     AARCH64_INSN_ADSB_ADD);
  94                 break;
  95
  96         case 4:
  97                 /* ROR is a variant of EXTR with Rm = Rn */
  98                 insn = aarch64_insn_gen_extr(AARCH64_INSN_VARIANT_64BIT,
  99                                              rn, rn, rd, 64 - tag_lsb);
 100                 break;
 101         }
 102
 103         return insn;
 104 }
 105
 106 void __init kvm_update_va_mask(struct alt_instr *alt,
 107                                __le32 *origptr, __le32 *updptr, int nr_inst)
 108 {
 109         int i;
 110
 111         BUG_ON(nr_inst != 5);
 112
 113         for (i = 0; i < nr_inst; i++) {
 114                 u32 rd, rn, insn, oinsn;
 115
 116                 /*
 117                  * VHE doesn't need any address translation, let's NOP
 118                  * everything.
 119                  *
 120                  * Alternatively, if we don't have any spare bits in
 121                  * the address, NOP everything after masking that
 122                  * kernel VA.
 123                  */
 124                 if (has_vhe() || (!tag_lsb && i > 0)) {
 125                         updptr[i] = cpu_to_le32(aarch64_insn_gen_nop());
 126                         continue;
 127                 }
 128
 129                 oinsn = le32_to_cpu(origptr[i]);
 130                 rd = aarch64_insn_decode_register(AARCH64_INSN_REGTYPE_RD, oinsn);
 131                 rn = aarch64_insn_decode_register(AARCH64_INSN_REGTYPE_RN, oinsn);
 132
 133                 insn = compute_instruction(i, rd, rn);
 134                 BUG_ON(insn == AARCH64_BREAK_FAULT);
 135
 136                 updptr[i] = cpu_to_le32(insn);
 137         }
 138 }
 139
 140 void *__kvm_bp_vect_base;
 141 int __kvm_harden_el2_vector_slot;
 142
 143 void kvm_patch_vector_branch(struct alt_instr *alt,
 144                              __le32 *origptr, __le32 *updptr, int nr_inst)
 145 {
 146         u64 addr;
 147         u32 insn;
 148
 149         BUG_ON(nr_inst != 5);
 150
 151         if (has_vhe() || !cpus_have_const_cap(ARM64_HARDEN_EL2_VECTORS)) {
 152                 WARN_ON_ONCE(cpus_have_const_cap(ARM64_HARDEN_EL2_VECTORS));
 153                 return;
 154         }
 155
 156         /*
 157          * Compute HYP VA by using the same computation as kern_hyp_va()
 158          */
 159         addr = (uintptr_t)kvm_ksym_ref(__kvm_hyp_vector);
 160         addr &= va_mask;
 161         addr |= tag_val << tag_lsb;
 162
 163         /* Use PC[10:7] to branch to the same vector in KVM */
 164         addr |= ((u64)origptr & GENMASK_ULL(10, 7));
 165
 166         /*
 167          * Branch over the preamble in order to avoid the initial store on
 168          * the stack (which we already perform in the hardening vectors).
 169          */
 170         addr += KVM_VECTOR_PREAMBLE;
 171
 172         /* stp x0, x1, [sp, #-16]! */
 173         insn = aarch64_insn_gen_load_store_pair(AARCH64_INSN_REG_0,
 174                                                 AARCH64_INSN_REG_1,
 175                                                 AARCH64_INSN_REG_SP,
 176                                                 -16,
 177                                                 AARCH64_INSN_VARIANT_64BIT,
 178                                                 AARCH64_INSN_LDST_STORE_PAIR_PRE_INDEX);
 179         *updptr++ = cpu_to_le32(insn);
 180
 181         /* movz x0, #(addr & 0xffff) */
 182         insn = aarch64_insn_gen_movewide(AARCH64_INSN_REG_0,
 183                                          (u16)addr,
 184                                          0,
 185                                          AARCH64_INSN_VARIANT_64BIT,
 186                                          AARCH64_INSN_MOVEWIDE_ZERO);
 187         *updptr++ = cpu_to_le32(insn);
 188
 189         /* movk x0, #((addr >> 16) & 0xffff), lsl #16 */
 190         insn = aarch64_insn_gen_movewide(AARCH64_INSN_REG_0,
 191                                          (u16)(addr >> 16),
 192                                          16,
 193                                          AARCH64_INSN_VARIANT_64BIT,
 194                                          AARCH64_INSN_MOVEWIDE_KEEP);
 195         *updptr++ = cpu_to_le32(insn);
 196
 197         /* movk x0, #((addr >> 32) & 0xffff), lsl #32 */
 198         insn = aarch64_insn_gen_movewide(AARCH64_INSN_REG_0,
 199                                          (u16)(addr >> 32),
 200                                          32,
 201                                          AARCH64_INSN_VARIANT_64BIT,
 202                                          AARCH64_INSN_MOVEWIDE_KEEP);
 203         *updptr++ = cpu_to_le32(insn);
 204
 205         /* br x0 */
 206         insn = aarch64_insn_gen_branch_reg(AARCH64_INSN_REG_0,
 207                                            AARCH64_INSN_BRANCH_NOLINK);
 208         *updptr++ = cpu_to_le32(insn);
 209 }