1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * guest access functions |
4 | * |
5 | * Copyright IBM Corp. 2014 |
6 | * |
7 | */ |
8 | |
9 | #include <linux/vmalloc.h> |
10 | #include <linux/mm_types.h> |
11 | #include <linux/err.h> |
12 | #include <linux/pgtable.h> |
13 | #include <linux/bitfield.h> |
14 | #include <asm/access-regs.h> |
15 | #include <asm/fault.h> |
16 | #include <asm/gmap.h> |
17 | #include "kvm-s390.h" |
18 | #include "gaccess.h" |
19 | |
20 | union asce { |
21 | unsigned long val; |
22 | struct { |
23 | unsigned long origin : 52; /* Region- or Segment-Table Origin */ |
24 | unsigned long : 2; |
25 | unsigned long g : 1; /* Subspace Group Control */ |
26 | unsigned long p : 1; /* Private Space Control */ |
27 | unsigned long s : 1; /* Storage-Alteration-Event Control */ |
28 | unsigned long x : 1; /* Space-Switch-Event Control */ |
29 | unsigned long r : 1; /* Real-Space Control */ |
30 | unsigned long : 1; |
31 | unsigned long dt : 2; /* Designation-Type Control */ |
32 | unsigned long tl : 2; /* Region- or Segment-Table Length */ |
33 | }; |
34 | }; |
35 | |
36 | enum { |
37 | ASCE_TYPE_SEGMENT = 0, |
38 | ASCE_TYPE_REGION3 = 1, |
39 | ASCE_TYPE_REGION2 = 2, |
40 | ASCE_TYPE_REGION1 = 3 |
41 | }; |
42 | |
43 | union region1_table_entry { |
44 | unsigned long val; |
45 | struct { |
46 | unsigned long rto: 52;/* Region-Table Origin */ |
47 | unsigned long : 2; |
48 | unsigned long p : 1; /* DAT-Protection Bit */ |
49 | unsigned long : 1; |
50 | unsigned long tf : 2; /* Region-Second-Table Offset */ |
51 | unsigned long i : 1; /* Region-Invalid Bit */ |
52 | unsigned long : 1; |
53 | unsigned long tt : 2; /* Table-Type Bits */ |
54 | unsigned long tl : 2; /* Region-Second-Table Length */ |
55 | }; |
56 | }; |
57 | |
58 | union region2_table_entry { |
59 | unsigned long val; |
60 | struct { |
61 | unsigned long rto: 52;/* Region-Table Origin */ |
62 | unsigned long : 2; |
63 | unsigned long p : 1; /* DAT-Protection Bit */ |
64 | unsigned long : 1; |
65 | unsigned long tf : 2; /* Region-Third-Table Offset */ |
66 | unsigned long i : 1; /* Region-Invalid Bit */ |
67 | unsigned long : 1; |
68 | unsigned long tt : 2; /* Table-Type Bits */ |
69 | unsigned long tl : 2; /* Region-Third-Table Length */ |
70 | }; |
71 | }; |
72 | |
73 | struct region3_table_entry_fc0 { |
74 | unsigned long sto: 52;/* Segment-Table Origin */ |
75 | unsigned long : 1; |
76 | unsigned long fc : 1; /* Format-Control */ |
77 | unsigned long p : 1; /* DAT-Protection Bit */ |
78 | unsigned long : 1; |
79 | unsigned long tf : 2; /* Segment-Table Offset */ |
80 | unsigned long i : 1; /* Region-Invalid Bit */ |
81 | unsigned long cr : 1; /* Common-Region Bit */ |
82 | unsigned long tt : 2; /* Table-Type Bits */ |
83 | unsigned long tl : 2; /* Segment-Table Length */ |
84 | }; |
85 | |
86 | struct region3_table_entry_fc1 { |
87 | unsigned long rfaa : 33; /* Region-Frame Absolute Address */ |
88 | unsigned long : 14; |
89 | unsigned long av : 1; /* ACCF-Validity Control */ |
90 | unsigned long acc: 4; /* Access-Control Bits */ |
91 | unsigned long f : 1; /* Fetch-Protection Bit */ |
92 | unsigned long fc : 1; /* Format-Control */ |
93 | unsigned long p : 1; /* DAT-Protection Bit */ |
94 | unsigned long iep: 1; /* Instruction-Execution-Protection */ |
95 | unsigned long : 2; |
96 | unsigned long i : 1; /* Region-Invalid Bit */ |
97 | unsigned long cr : 1; /* Common-Region Bit */ |
98 | unsigned long tt : 2; /* Table-Type Bits */ |
99 | unsigned long : 2; |
100 | }; |
101 | |
102 | union region3_table_entry { |
103 | unsigned long val; |
104 | struct region3_table_entry_fc0 fc0; |
105 | struct region3_table_entry_fc1 fc1; |
106 | struct { |
107 | unsigned long : 53; |
108 | unsigned long fc : 1; /* Format-Control */ |
109 | unsigned long : 4; |
110 | unsigned long i : 1; /* Region-Invalid Bit */ |
111 | unsigned long cr : 1; /* Common-Region Bit */ |
112 | unsigned long tt : 2; /* Table-Type Bits */ |
113 | unsigned long : 2; |
114 | }; |
115 | }; |
116 | |
117 | struct segment_entry_fc0 { |
118 | unsigned long pto: 53;/* Page-Table Origin */ |
119 | unsigned long fc : 1; /* Format-Control */ |
120 | unsigned long p : 1; /* DAT-Protection Bit */ |
121 | unsigned long : 3; |
122 | unsigned long i : 1; /* Segment-Invalid Bit */ |
123 | unsigned long cs : 1; /* Common-Segment Bit */ |
124 | unsigned long tt : 2; /* Table-Type Bits */ |
125 | unsigned long : 2; |
126 | }; |
127 | |
128 | struct segment_entry_fc1 { |
129 | unsigned long sfaa : 44; /* Segment-Frame Absolute Address */ |
130 | unsigned long : 3; |
131 | unsigned long av : 1; /* ACCF-Validity Control */ |
132 | unsigned long acc: 4; /* Access-Control Bits */ |
133 | unsigned long f : 1; /* Fetch-Protection Bit */ |
134 | unsigned long fc : 1; /* Format-Control */ |
135 | unsigned long p : 1; /* DAT-Protection Bit */ |
136 | unsigned long iep: 1; /* Instruction-Execution-Protection */ |
137 | unsigned long : 2; |
138 | unsigned long i : 1; /* Segment-Invalid Bit */ |
139 | unsigned long cs : 1; /* Common-Segment Bit */ |
140 | unsigned long tt : 2; /* Table-Type Bits */ |
141 | unsigned long : 2; |
142 | }; |
143 | |
144 | union segment_table_entry { |
145 | unsigned long val; |
146 | struct segment_entry_fc0 fc0; |
147 | struct segment_entry_fc1 fc1; |
148 | struct { |
149 | unsigned long : 53; |
150 | unsigned long fc : 1; /* Format-Control */ |
151 | unsigned long : 4; |
152 | unsigned long i : 1; /* Segment-Invalid Bit */ |
153 | unsigned long cs : 1; /* Common-Segment Bit */ |
154 | unsigned long tt : 2; /* Table-Type Bits */ |
155 | unsigned long : 2; |
156 | }; |
157 | }; |
158 | |
159 | enum { |
160 | TABLE_TYPE_SEGMENT = 0, |
161 | TABLE_TYPE_REGION3 = 1, |
162 | TABLE_TYPE_REGION2 = 2, |
163 | TABLE_TYPE_REGION1 = 3 |
164 | }; |
165 | |
166 | union page_table_entry { |
167 | unsigned long val; |
168 | struct { |
169 | unsigned long pfra : 52; /* Page-Frame Real Address */ |
170 | unsigned long z : 1; /* Zero Bit */ |
171 | unsigned long i : 1; /* Page-Invalid Bit */ |
172 | unsigned long p : 1; /* DAT-Protection Bit */ |
173 | unsigned long iep: 1; /* Instruction-Execution-Protection */ |
174 | unsigned long : 8; |
175 | }; |
176 | }; |
177 | |
178 | /* |
179 | * vaddress union in order to easily decode a virtual address into its |
180 | * region first index, region second index etc. parts. |
181 | */ |
182 | union vaddress { |
183 | unsigned long addr; |
184 | struct { |
185 | unsigned long rfx : 11; |
186 | unsigned long rsx : 11; |
187 | unsigned long rtx : 11; |
188 | unsigned long sx : 11; |
189 | unsigned long px : 8; |
190 | unsigned long bx : 12; |
191 | }; |
192 | struct { |
193 | unsigned long rfx01 : 2; |
194 | unsigned long : 9; |
195 | unsigned long rsx01 : 2; |
196 | unsigned long : 9; |
197 | unsigned long rtx01 : 2; |
198 | unsigned long : 9; |
199 | unsigned long sx01 : 2; |
200 | unsigned long : 29; |
201 | }; |
202 | }; |
203 | |
204 | /* |
205 | * raddress union which will contain the result (real or absolute address) |
206 | * after a page table walk. The rfaa, sfaa and pfra members are used to |
207 | * simply assign them the value of a region, segment or page table entry. |
208 | */ |
209 | union raddress { |
210 | unsigned long addr; |
211 | unsigned long rfaa : 33; /* Region-Frame Absolute Address */ |
212 | unsigned long sfaa : 44; /* Segment-Frame Absolute Address */ |
213 | unsigned long pfra : 52; /* Page-Frame Real Address */ |
214 | }; |
215 | |
216 | union alet { |
217 | u32 val; |
218 | struct { |
219 | u32 reserved : 7; |
220 | u32 p : 1; |
221 | u32 alesn : 8; |
222 | u32 alen : 16; |
223 | }; |
224 | }; |
225 | |
226 | union ald { |
227 | u32 val; |
228 | struct { |
229 | u32 : 1; |
230 | u32 alo : 24; |
231 | u32 all : 7; |
232 | }; |
233 | }; |
234 | |
235 | struct ale { |
236 | unsigned long i : 1; /* ALEN-Invalid Bit */ |
237 | unsigned long : 5; |
238 | unsigned long fo : 1; /* Fetch-Only Bit */ |
239 | unsigned long p : 1; /* Private Bit */ |
240 | unsigned long alesn : 8; /* Access-List-Entry Sequence Number */ |
241 | unsigned long aleax : 16; /* Access-List-Entry Authorization Index */ |
242 | unsigned long : 32; |
243 | unsigned long : 1; |
244 | unsigned long asteo : 25; /* ASN-Second-Table-Entry Origin */ |
245 | unsigned long : 6; |
246 | unsigned long astesn : 32; /* ASTE Sequence Number */ |
247 | }; |
248 | |
249 | struct aste { |
250 | unsigned long i : 1; /* ASX-Invalid Bit */ |
251 | unsigned long ato : 29; /* Authority-Table Origin */ |
252 | unsigned long : 1; |
253 | unsigned long b : 1; /* Base-Space Bit */ |
254 | unsigned long ax : 16; /* Authorization Index */ |
255 | unsigned long atl : 12; /* Authority-Table Length */ |
256 | unsigned long : 2; |
257 | unsigned long ca : 1; /* Controlled-ASN Bit */ |
258 | unsigned long ra : 1; /* Reusable-ASN Bit */ |
259 | unsigned long asce : 64; /* Address-Space-Control Element */ |
260 | unsigned long ald : 32; |
261 | unsigned long astesn : 32; |
262 | /* .. more fields there */ |
263 | }; |
264 | |
265 | int ipte_lock_held(struct kvm *kvm) |
266 | { |
267 | if (sclp.has_siif) { |
268 | int rc; |
269 | |
270 | read_lock(&kvm->arch.sca_lock); |
271 | rc = kvm_s390_get_ipte_control(kvm)->kh != 0; |
272 | read_unlock(&kvm->arch.sca_lock); |
273 | return rc; |
274 | } |
275 | return kvm->arch.ipte_lock_count != 0; |
276 | } |
277 | |
278 | static void ipte_lock_simple(struct kvm *kvm) |
279 | { |
280 | union ipte_control old, new, *ic; |
281 | |
282 | mutex_lock(&kvm->arch.ipte_mutex); |
283 | kvm->arch.ipte_lock_count++; |
284 | if (kvm->arch.ipte_lock_count > 1) |
285 | goto out; |
286 | retry: |
287 | read_lock(&kvm->arch.sca_lock); |
288 | ic = kvm_s390_get_ipte_control(kvm); |
289 | do { |
290 | old = READ_ONCE(*ic); |
291 | if (old.k) { |
292 | read_unlock(&kvm->arch.sca_lock); |
293 | cond_resched(); |
294 | goto retry; |
295 | } |
296 | new = old; |
297 | new.k = 1; |
298 | } while (cmpxchg(&ic->val, old.val, new.val) != old.val); |
299 | read_unlock(&kvm->arch.sca_lock); |
300 | out: |
301 | mutex_unlock(lock: &kvm->arch.ipte_mutex); |
302 | } |
303 | |
304 | static void ipte_unlock_simple(struct kvm *kvm) |
305 | { |
306 | union ipte_control old, new, *ic; |
307 | |
308 | mutex_lock(&kvm->arch.ipte_mutex); |
309 | kvm->arch.ipte_lock_count--; |
310 | if (kvm->arch.ipte_lock_count) |
311 | goto out; |
312 | read_lock(&kvm->arch.sca_lock); |
313 | ic = kvm_s390_get_ipte_control(kvm); |
314 | do { |
315 | old = READ_ONCE(*ic); |
316 | new = old; |
317 | new.k = 0; |
318 | } while (cmpxchg(&ic->val, old.val, new.val) != old.val); |
319 | read_unlock(&kvm->arch.sca_lock); |
320 | wake_up(&kvm->arch.ipte_wq); |
321 | out: |
322 | mutex_unlock(lock: &kvm->arch.ipte_mutex); |
323 | } |
324 | |
325 | static void ipte_lock_siif(struct kvm *kvm) |
326 | { |
327 | union ipte_control old, new, *ic; |
328 | |
329 | retry: |
330 | read_lock(&kvm->arch.sca_lock); |
331 | ic = kvm_s390_get_ipte_control(kvm); |
332 | do { |
333 | old = READ_ONCE(*ic); |
334 | if (old.kg) { |
335 | read_unlock(&kvm->arch.sca_lock); |
336 | cond_resched(); |
337 | goto retry; |
338 | } |
339 | new = old; |
340 | new.k = 1; |
341 | new.kh++; |
342 | } while (cmpxchg(&ic->val, old.val, new.val) != old.val); |
343 | read_unlock(&kvm->arch.sca_lock); |
344 | } |
345 | |
346 | static void ipte_unlock_siif(struct kvm *kvm) |
347 | { |
348 | union ipte_control old, new, *ic; |
349 | |
350 | read_lock(&kvm->arch.sca_lock); |
351 | ic = kvm_s390_get_ipte_control(kvm); |
352 | do { |
353 | old = READ_ONCE(*ic); |
354 | new = old; |
355 | new.kh--; |
356 | if (!new.kh) |
357 | new.k = 0; |
358 | } while (cmpxchg(&ic->val, old.val, new.val) != old.val); |
359 | read_unlock(&kvm->arch.sca_lock); |
360 | if (!new.kh) |
361 | wake_up(&kvm->arch.ipte_wq); |
362 | } |
363 | |
364 | void ipte_lock(struct kvm *kvm) |
365 | { |
366 | if (sclp.has_siif) |
367 | ipte_lock_siif(kvm); |
368 | else |
369 | ipte_lock_simple(kvm); |
370 | } |
371 | |
372 | void ipte_unlock(struct kvm *kvm) |
373 | { |
374 | if (sclp.has_siif) |
375 | ipte_unlock_siif(kvm); |
376 | else |
377 | ipte_unlock_simple(kvm); |
378 | } |
379 | |
380 | static int ar_translation(struct kvm_vcpu *vcpu, union asce *asce, u8 ar, |
381 | enum gacc_mode mode) |
382 | { |
383 | union alet alet; |
384 | struct ale ale; |
385 | struct aste aste; |
386 | unsigned long ald_addr, authority_table_addr; |
387 | union ald ald; |
388 | int eax, rc; |
389 | u8 authority_table; |
390 | |
391 | if (ar >= NUM_ACRS) |
392 | return -EINVAL; |
393 | |
394 | if (vcpu->arch.acrs_loaded) |
395 | save_access_regs(vcpu->run->s.regs.acrs); |
396 | alet.val = vcpu->run->s.regs.acrs[ar]; |
397 | |
398 | if (ar == 0 || alet.val == 0) { |
399 | asce->val = vcpu->arch.sie_block->gcr[1]; |
400 | return 0; |
401 | } else if (alet.val == 1) { |
402 | asce->val = vcpu->arch.sie_block->gcr[7]; |
403 | return 0; |
404 | } |
405 | |
406 | if (alet.reserved) |
407 | return PGM_ALET_SPECIFICATION; |
408 | |
409 | if (alet.p) |
410 | ald_addr = vcpu->arch.sie_block->gcr[5]; |
411 | else |
412 | ald_addr = vcpu->arch.sie_block->gcr[2]; |
413 | ald_addr &= 0x7fffffc0; |
414 | |
415 | rc = read_guest_real(vcpu, gra: ald_addr + 16, data: &ald.val, len: sizeof(union ald)); |
416 | if (rc) |
417 | return rc; |
418 | |
419 | if (alet.alen / 8 > ald.all) |
420 | return PGM_ALEN_TRANSLATION; |
421 | |
422 | if (0x7fffffff - ald.alo * 128 < alet.alen * 16) |
423 | return PGM_ADDRESSING; |
424 | |
425 | rc = read_guest_real(vcpu, gra: ald.alo * 128 + alet.alen * 16, data: &ale, |
426 | len: sizeof(struct ale)); |
427 | if (rc) |
428 | return rc; |
429 | |
430 | if (ale.i == 1) |
431 | return PGM_ALEN_TRANSLATION; |
432 | if (ale.alesn != alet.alesn) |
433 | return PGM_ALE_SEQUENCE; |
434 | |
435 | rc = read_guest_real(vcpu, gra: ale.asteo * 64, data: &aste, len: sizeof(struct aste)); |
436 | if (rc) |
437 | return rc; |
438 | |
439 | if (aste.i) |
440 | return PGM_ASTE_VALIDITY; |
441 | if (aste.astesn != ale.astesn) |
442 | return PGM_ASTE_SEQUENCE; |
443 | |
444 | if (ale.p == 1) { |
445 | eax = (vcpu->arch.sie_block->gcr[8] >> 16) & 0xffff; |
446 | if (ale.aleax != eax) { |
447 | if (eax / 16 > aste.atl) |
448 | return PGM_EXTENDED_AUTHORITY; |
449 | |
450 | authority_table_addr = aste.ato * 4 + eax / 4; |
451 | |
452 | rc = read_guest_real(vcpu, gra: authority_table_addr, |
453 | data: &authority_table, |
454 | len: sizeof(u8)); |
455 | if (rc) |
456 | return rc; |
457 | |
458 | if ((authority_table & (0x40 >> ((eax & 3) * 2))) == 0) |
459 | return PGM_EXTENDED_AUTHORITY; |
460 | } |
461 | } |
462 | |
463 | if (ale.fo == 1 && mode == GACC_STORE) |
464 | return PGM_PROTECTION; |
465 | |
466 | asce->val = aste.asce; |
467 | return 0; |
468 | } |
469 | |
470 | enum prot_type { |
471 | PROT_TYPE_LA = 0, |
472 | PROT_TYPE_KEYC = 1, |
473 | PROT_TYPE_ALC = 2, |
474 | PROT_TYPE_DAT = 3, |
475 | PROT_TYPE_IEP = 4, |
476 | /* Dummy value for passing an initialized value when code != PGM_PROTECTION */ |
477 | PROT_NONE, |
478 | }; |
479 | |
480 | static int trans_exc_ending(struct kvm_vcpu *vcpu, int code, unsigned long gva, u8 ar, |
481 | enum gacc_mode mode, enum prot_type prot, bool terminate) |
482 | { |
483 | struct kvm_s390_pgm_info *pgm = &vcpu->arch.pgm; |
484 | union teid *teid; |
485 | |
486 | memset(pgm, 0, sizeof(*pgm)); |
487 | pgm->code = code; |
488 | teid = (union teid *)&pgm->trans_exc_code; |
489 | |
490 | switch (code) { |
491 | case PGM_PROTECTION: |
492 | switch (prot) { |
493 | case PROT_NONE: |
494 | /* We should never get here, acts like termination */ |
495 | WARN_ON_ONCE(1); |
496 | break; |
497 | case PROT_TYPE_IEP: |
498 | teid->b61 = 1; |
499 | fallthrough; |
500 | case PROT_TYPE_LA: |
501 | teid->b56 = 1; |
502 | break; |
503 | case PROT_TYPE_KEYC: |
504 | teid->b60 = 1; |
505 | break; |
506 | case PROT_TYPE_ALC: |
507 | teid->b60 = 1; |
508 | fallthrough; |
509 | case PROT_TYPE_DAT: |
510 | teid->b61 = 1; |
511 | break; |
512 | } |
513 | if (terminate) { |
514 | teid->b56 = 0; |
515 | teid->b60 = 0; |
516 | teid->b61 = 0; |
517 | } |
518 | fallthrough; |
519 | case PGM_ASCE_TYPE: |
520 | case PGM_PAGE_TRANSLATION: |
521 | case PGM_REGION_FIRST_TRANS: |
522 | case PGM_REGION_SECOND_TRANS: |
523 | case PGM_REGION_THIRD_TRANS: |
524 | case PGM_SEGMENT_TRANSLATION: |
525 | /* |
526 | * op_access_id only applies to MOVE_PAGE -> set bit 61 |
527 | * exc_access_id has to be set to 0 for some instructions. Both |
528 | * cases have to be handled by the caller. |
529 | */ |
530 | teid->addr = gva >> PAGE_SHIFT; |
531 | teid->fsi = mode == GACC_STORE ? TEID_FSI_STORE : TEID_FSI_FETCH; |
532 | teid->as = psw_bits(vcpu->arch.sie_block->gpsw).as; |
533 | fallthrough; |
534 | case PGM_ALEN_TRANSLATION: |
535 | case PGM_ALE_SEQUENCE: |
536 | case PGM_ASTE_VALIDITY: |
537 | case PGM_ASTE_SEQUENCE: |
538 | case PGM_EXTENDED_AUTHORITY: |
539 | /* |
540 | * We can always store exc_access_id, as it is |
541 | * undefined for non-ar cases. It is undefined for |
542 | * most DAT protection exceptions. |
543 | */ |
544 | pgm->exc_access_id = ar; |
545 | break; |
546 | } |
547 | return code; |
548 | } |
549 | |
550 | static int trans_exc(struct kvm_vcpu *vcpu, int code, unsigned long gva, u8 ar, |
551 | enum gacc_mode mode, enum prot_type prot) |
552 | { |
553 | return trans_exc_ending(vcpu, code, gva, ar, mode, prot, terminate: false); |
554 | } |
555 | |
556 | static int get_vcpu_asce(struct kvm_vcpu *vcpu, union asce *asce, |
557 | unsigned long ga, u8 ar, enum gacc_mode mode) |
558 | { |
559 | int rc; |
560 | struct psw_bits psw = psw_bits(vcpu->arch.sie_block->gpsw); |
561 | |
562 | if (!psw.dat) { |
563 | asce->val = 0; |
564 | asce->r = 1; |
565 | return 0; |
566 | } |
567 | |
568 | if ((mode == GACC_IFETCH) && (psw.as != PSW_BITS_AS_HOME)) |
569 | psw.as = PSW_BITS_AS_PRIMARY; |
570 | |
571 | switch (psw.as) { |
572 | case PSW_BITS_AS_PRIMARY: |
573 | asce->val = vcpu->arch.sie_block->gcr[1]; |
574 | return 0; |
575 | case PSW_BITS_AS_SECONDARY: |
576 | asce->val = vcpu->arch.sie_block->gcr[7]; |
577 | return 0; |
578 | case PSW_BITS_AS_HOME: |
579 | asce->val = vcpu->arch.sie_block->gcr[13]; |
580 | return 0; |
581 | case PSW_BITS_AS_ACCREG: |
582 | rc = ar_translation(vcpu, asce, ar, mode); |
583 | if (rc > 0) |
584 | return trans_exc(vcpu, code: rc, gva: ga, ar, mode, prot: PROT_TYPE_ALC); |
585 | return rc; |
586 | } |
587 | return 0; |
588 | } |
589 | |
590 | static int deref_table(struct kvm *kvm, unsigned long gpa, unsigned long *val) |
591 | { |
592 | return kvm_read_guest(kvm, gpa, data: val, len: sizeof(*val)); |
593 | } |
594 | |
595 | /** |
596 | * guest_translate - translate a guest virtual into a guest absolute address |
597 | * @vcpu: virtual cpu |
598 | * @gva: guest virtual address |
599 | * @gpa: points to where guest physical (absolute) address should be stored |
600 | * @asce: effective asce |
601 | * @mode: indicates the access mode to be used |
602 | * @prot: returns the type for protection exceptions |
603 | * |
604 | * Translate a guest virtual address into a guest absolute address by means |
605 | * of dynamic address translation as specified by the architecture. |
606 | * If the resulting absolute address is not available in the configuration |
607 | * an addressing exception is indicated and @gpa will not be changed. |
608 | * |
609 | * Returns: - zero on success; @gpa contains the resulting absolute address |
610 | * - a negative value if guest access failed due to e.g. broken |
611 | * guest mapping |
612 | * - a positive value if an access exception happened. In this case |
613 | * the returned value is the program interruption code as defined |
614 | * by the architecture |
615 | */ |
616 | static unsigned long guest_translate(struct kvm_vcpu *vcpu, unsigned long gva, |
617 | unsigned long *gpa, const union asce asce, |
618 | enum gacc_mode mode, enum prot_type *prot) |
619 | { |
620 | union vaddress vaddr = {.addr = gva}; |
621 | union raddress raddr = {.addr = gva}; |
622 | union page_table_entry pte; |
623 | int dat_protection = 0; |
624 | int iep_protection = 0; |
625 | union ctlreg0 ctlreg0; |
626 | unsigned long ptr; |
627 | int edat1, edat2, iep; |
628 | |
629 | ctlreg0.val = vcpu->arch.sie_block->gcr[0]; |
630 | edat1 = ctlreg0.edat && test_kvm_facility(kvm: vcpu->kvm, nr: 8); |
631 | edat2 = edat1 && test_kvm_facility(kvm: vcpu->kvm, nr: 78); |
632 | iep = ctlreg0.iep && test_kvm_facility(kvm: vcpu->kvm, nr: 130); |
633 | if (asce.r) |
634 | goto real_address; |
635 | ptr = asce.origin * PAGE_SIZE; |
636 | switch (asce.dt) { |
637 | case ASCE_TYPE_REGION1: |
638 | if (vaddr.rfx01 > asce.tl) |
639 | return PGM_REGION_FIRST_TRANS; |
640 | ptr += vaddr.rfx * 8; |
641 | break; |
642 | case ASCE_TYPE_REGION2: |
643 | if (vaddr.rfx) |
644 | return PGM_ASCE_TYPE; |
645 | if (vaddr.rsx01 > asce.tl) |
646 | return PGM_REGION_SECOND_TRANS; |
647 | ptr += vaddr.rsx * 8; |
648 | break; |
649 | case ASCE_TYPE_REGION3: |
650 | if (vaddr.rfx || vaddr.rsx) |
651 | return PGM_ASCE_TYPE; |
652 | if (vaddr.rtx01 > asce.tl) |
653 | return PGM_REGION_THIRD_TRANS; |
654 | ptr += vaddr.rtx * 8; |
655 | break; |
656 | case ASCE_TYPE_SEGMENT: |
657 | if (vaddr.rfx || vaddr.rsx || vaddr.rtx) |
658 | return PGM_ASCE_TYPE; |
659 | if (vaddr.sx01 > asce.tl) |
660 | return PGM_SEGMENT_TRANSLATION; |
661 | ptr += vaddr.sx * 8; |
662 | break; |
663 | } |
664 | switch (asce.dt) { |
665 | case ASCE_TYPE_REGION1: { |
666 | union region1_table_entry rfte; |
667 | |
668 | if (!kvm_is_gpa_in_memslot(vcpu->kvm, ptr)) |
669 | return PGM_ADDRESSING; |
670 | if (deref_table(kvm: vcpu->kvm, gpa: ptr, val: &rfte.val)) |
671 | return -EFAULT; |
672 | if (rfte.i) |
673 | return PGM_REGION_FIRST_TRANS; |
674 | if (rfte.tt != TABLE_TYPE_REGION1) |
675 | return PGM_TRANSLATION_SPEC; |
676 | if (vaddr.rsx01 < rfte.tf || vaddr.rsx01 > rfte.tl) |
677 | return PGM_REGION_SECOND_TRANS; |
678 | if (edat1) |
679 | dat_protection |= rfte.p; |
680 | ptr = rfte.rto * PAGE_SIZE + vaddr.rsx * 8; |
681 | } |
682 | fallthrough; |
683 | case ASCE_TYPE_REGION2: { |
684 | union region2_table_entry rste; |
685 | |
686 | if (!kvm_is_gpa_in_memslot(vcpu->kvm, ptr)) |
687 | return PGM_ADDRESSING; |
688 | if (deref_table(kvm: vcpu->kvm, gpa: ptr, val: &rste.val)) |
689 | return -EFAULT; |
690 | if (rste.i) |
691 | return PGM_REGION_SECOND_TRANS; |
692 | if (rste.tt != TABLE_TYPE_REGION2) |
693 | return PGM_TRANSLATION_SPEC; |
694 | if (vaddr.rtx01 < rste.tf || vaddr.rtx01 > rste.tl) |
695 | return PGM_REGION_THIRD_TRANS; |
696 | if (edat1) |
697 | dat_protection |= rste.p; |
698 | ptr = rste.rto * PAGE_SIZE + vaddr.rtx * 8; |
699 | } |
700 | fallthrough; |
701 | case ASCE_TYPE_REGION3: { |
702 | union region3_table_entry rtte; |
703 | |
704 | if (!kvm_is_gpa_in_memslot(vcpu->kvm, ptr)) |
705 | return PGM_ADDRESSING; |
706 | if (deref_table(kvm: vcpu->kvm, gpa: ptr, val: &rtte.val)) |
707 | return -EFAULT; |
708 | if (rtte.i) |
709 | return PGM_REGION_THIRD_TRANS; |
710 | if (rtte.tt != TABLE_TYPE_REGION3) |
711 | return PGM_TRANSLATION_SPEC; |
712 | if (rtte.cr && asce.p && edat2) |
713 | return PGM_TRANSLATION_SPEC; |
714 | if (rtte.fc && edat2) { |
715 | dat_protection |= rtte.fc1.p; |
716 | iep_protection = rtte.fc1.iep; |
717 | raddr.rfaa = rtte.fc1.rfaa; |
718 | goto absolute_address; |
719 | } |
720 | if (vaddr.sx01 < rtte.fc0.tf) |
721 | return PGM_SEGMENT_TRANSLATION; |
722 | if (vaddr.sx01 > rtte.fc0.tl) |
723 | return PGM_SEGMENT_TRANSLATION; |
724 | if (edat1) |
725 | dat_protection |= rtte.fc0.p; |
726 | ptr = rtte.fc0.sto * PAGE_SIZE + vaddr.sx * 8; |
727 | } |
728 | fallthrough; |
729 | case ASCE_TYPE_SEGMENT: { |
730 | union segment_table_entry ste; |
731 | |
732 | if (!kvm_is_gpa_in_memslot(vcpu->kvm, ptr)) |
733 | return PGM_ADDRESSING; |
734 | if (deref_table(kvm: vcpu->kvm, gpa: ptr, val: &ste.val)) |
735 | return -EFAULT; |
736 | if (ste.i) |
737 | return PGM_SEGMENT_TRANSLATION; |
738 | if (ste.tt != TABLE_TYPE_SEGMENT) |
739 | return PGM_TRANSLATION_SPEC; |
740 | if (ste.cs && asce.p) |
741 | return PGM_TRANSLATION_SPEC; |
742 | if (ste.fc && edat1) { |
743 | dat_protection |= ste.fc1.p; |
744 | iep_protection = ste.fc1.iep; |
745 | raddr.sfaa = ste.fc1.sfaa; |
746 | goto absolute_address; |
747 | } |
748 | dat_protection |= ste.fc0.p; |
749 | ptr = ste.fc0.pto * (PAGE_SIZE / 2) + vaddr.px * 8; |
750 | } |
751 | } |
752 | if (!kvm_is_gpa_in_memslot(vcpu->kvm, ptr)) |
753 | return PGM_ADDRESSING; |
754 | if (deref_table(kvm: vcpu->kvm, gpa: ptr, val: &pte.val)) |
755 | return -EFAULT; |
756 | if (pte.i) |
757 | return PGM_PAGE_TRANSLATION; |
758 | if (pte.z) |
759 | return PGM_TRANSLATION_SPEC; |
760 | dat_protection |= pte.p; |
761 | iep_protection = pte.iep; |
762 | raddr.pfra = pte.pfra; |
763 | real_address: |
764 | raddr.addr = kvm_s390_real_to_abs(vcpu, gra: raddr.addr); |
765 | absolute_address: |
766 | if (mode == GACC_STORE && dat_protection) { |
767 | *prot = PROT_TYPE_DAT; |
768 | return PGM_PROTECTION; |
769 | } |
770 | if (mode == GACC_IFETCH && iep_protection && iep) { |
771 | *prot = PROT_TYPE_IEP; |
772 | return PGM_PROTECTION; |
773 | } |
774 | if (!kvm_is_gpa_in_memslot(vcpu->kvm, raddr.addr)) |
775 | return PGM_ADDRESSING; |
776 | *gpa = raddr.addr; |
777 | return 0; |
778 | } |
779 | |
780 | static inline int is_low_address(unsigned long ga) |
781 | { |
782 | /* Check for address ranges 0..511 and 4096..4607 */ |
783 | return (ga & ~0x11fful) == 0; |
784 | } |
785 | |
786 | static int low_address_protection_enabled(struct kvm_vcpu *vcpu, |
787 | const union asce asce) |
788 | { |
789 | union ctlreg0 ctlreg0 = {.val = vcpu->arch.sie_block->gcr[0]}; |
790 | psw_t *psw = &vcpu->arch.sie_block->gpsw; |
791 | |
792 | if (!ctlreg0.lap) |
793 | return 0; |
794 | if (psw_bits(*psw).dat && asce.p) |
795 | return 0; |
796 | return 1; |
797 | } |
798 | |
799 | static int vm_check_access_key(struct kvm *kvm, u8 access_key, |
800 | enum gacc_mode mode, gpa_t gpa) |
801 | { |
802 | u8 storage_key, access_control; |
803 | bool fetch_protected; |
804 | unsigned long hva; |
805 | int r; |
806 | |
807 | if (access_key == 0) |
808 | return 0; |
809 | |
810 | hva = gfn_to_hva(kvm, gfn: gpa_to_gfn(gpa)); |
811 | if (kvm_is_error_hva(hva)) |
812 | return PGM_ADDRESSING; |
813 | |
814 | mmap_read_lock(current->mm); |
815 | r = get_guest_storage_key(current->mm, hva, &storage_key); |
816 | mmap_read_unlock(current->mm); |
817 | if (r) |
818 | return r; |
819 | access_control = FIELD_GET(_PAGE_ACC_BITS, storage_key); |
820 | if (access_control == access_key) |
821 | return 0; |
822 | fetch_protected = storage_key & _PAGE_FP_BIT; |
823 | if ((mode == GACC_FETCH || mode == GACC_IFETCH) && !fetch_protected) |
824 | return 0; |
825 | return PGM_PROTECTION; |
826 | } |
827 | |
828 | static bool fetch_prot_override_applicable(struct kvm_vcpu *vcpu, enum gacc_mode mode, |
829 | union asce asce) |
830 | { |
831 | psw_t *psw = &vcpu->arch.sie_block->gpsw; |
832 | unsigned long override; |
833 | |
834 | if (mode == GACC_FETCH || mode == GACC_IFETCH) { |
835 | /* check if fetch protection override enabled */ |
836 | override = vcpu->arch.sie_block->gcr[0]; |
837 | override &= CR0_FETCH_PROTECTION_OVERRIDE; |
838 | /* not applicable if subject to DAT && private space */ |
839 | override = override && !(psw_bits(*psw).dat && asce.p); |
840 | return override; |
841 | } |
842 | return false; |
843 | } |
844 | |
845 | static bool fetch_prot_override_applies(unsigned long ga, unsigned int len) |
846 | { |
847 | return ga < 2048 && ga + len <= 2048; |
848 | } |
849 | |
850 | static bool storage_prot_override_applicable(struct kvm_vcpu *vcpu) |
851 | { |
852 | /* check if storage protection override enabled */ |
853 | return vcpu->arch.sie_block->gcr[0] & CR0_STORAGE_PROTECTION_OVERRIDE; |
854 | } |
855 | |
856 | static bool storage_prot_override_applies(u8 access_control) |
857 | { |
858 | /* matches special storage protection override key (9) -> allow */ |
859 | return access_control == PAGE_SPO_ACC; |
860 | } |
861 | |
862 | static int vcpu_check_access_key(struct kvm_vcpu *vcpu, u8 access_key, |
863 | enum gacc_mode mode, union asce asce, gpa_t gpa, |
864 | unsigned long ga, unsigned int len) |
865 | { |
866 | u8 storage_key, access_control; |
867 | unsigned long hva; |
868 | int r; |
869 | |
870 | /* access key 0 matches any storage key -> allow */ |
871 | if (access_key == 0) |
872 | return 0; |
873 | /* |
874 | * caller needs to ensure that gfn is accessible, so we can |
875 | * assume that this cannot fail |
876 | */ |
877 | hva = gfn_to_hva(kvm: vcpu->kvm, gfn: gpa_to_gfn(gpa)); |
878 | mmap_read_lock(current->mm); |
879 | r = get_guest_storage_key(current->mm, hva, &storage_key); |
880 | mmap_read_unlock(current->mm); |
881 | if (r) |
882 | return r; |
883 | access_control = FIELD_GET(_PAGE_ACC_BITS, storage_key); |
884 | /* access key matches storage key -> allow */ |
885 | if (access_control == access_key) |
886 | return 0; |
887 | if (mode == GACC_FETCH || mode == GACC_IFETCH) { |
888 | /* it is a fetch and fetch protection is off -> allow */ |
889 | if (!(storage_key & _PAGE_FP_BIT)) |
890 | return 0; |
891 | if (fetch_prot_override_applicable(vcpu, mode, asce) && |
892 | fetch_prot_override_applies(ga, len)) |
893 | return 0; |
894 | } |
895 | if (storage_prot_override_applicable(vcpu) && |
896 | storage_prot_override_applies(access_control)) |
897 | return 0; |
898 | return PGM_PROTECTION; |
899 | } |
900 | |
901 | /** |
902 | * guest_range_to_gpas() - Calculate guest physical addresses of page fragments |
903 | * covering a logical range |
904 | * @vcpu: virtual cpu |
905 | * @ga: guest address, start of range |
906 | * @ar: access register |
907 | * @gpas: output argument, may be NULL |
908 | * @len: length of range in bytes |
909 | * @asce: address-space-control element to use for translation |
910 | * @mode: access mode |
911 | * @access_key: access key to mach the range's storage keys against |
912 | * |
913 | * Translate a logical range to a series of guest absolute addresses, |
914 | * such that the concatenation of page fragments starting at each gpa make up |
915 | * the whole range. |
916 | * The translation is performed as if done by the cpu for the given @asce, @ar, |
917 | * @mode and state of the @vcpu. |
918 | * If the translation causes an exception, its program interruption code is |
919 | * returned and the &struct kvm_s390_pgm_info pgm member of @vcpu is modified |
920 | * such that a subsequent call to kvm_s390_inject_prog_vcpu() will inject |
921 | * a correct exception into the guest. |
922 | * The resulting gpas are stored into @gpas, unless it is NULL. |
923 | * |
924 | * Note: All fragments except the first one start at the beginning of a page. |
925 | * When deriving the boundaries of a fragment from a gpa, all but the last |
926 | * fragment end at the end of the page. |
927 | * |
928 | * Return: |
929 | * * 0 - success |
930 | * * <0 - translation could not be performed, for example if guest |
931 | * memory could not be accessed |
932 | * * >0 - an access exception occurred. In this case the returned value |
933 | * is the program interruption code and the contents of pgm may |
934 | * be used to inject an exception into the guest. |
935 | */ |
936 | static int guest_range_to_gpas(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, |
937 | unsigned long *gpas, unsigned long len, |
938 | const union asce asce, enum gacc_mode mode, |
939 | u8 access_key) |
940 | { |
941 | psw_t *psw = &vcpu->arch.sie_block->gpsw; |
942 | unsigned int offset = offset_in_page(ga); |
943 | unsigned int fragment_len; |
944 | int lap_enabled, rc = 0; |
945 | enum prot_type prot; |
946 | unsigned long gpa; |
947 | |
948 | lap_enabled = low_address_protection_enabled(vcpu, asce); |
949 | while (min(PAGE_SIZE - offset, len) > 0) { |
950 | fragment_len = min(PAGE_SIZE - offset, len); |
951 | ga = kvm_s390_logical_to_effective(vcpu, ga); |
952 | if (mode == GACC_STORE && lap_enabled && is_low_address(ga)) |
953 | return trans_exc(vcpu, PGM_PROTECTION, ga, ar, mode, |
954 | PROT_TYPE_LA); |
955 | if (psw_bits(*psw).dat) { |
956 | rc = guest_translate(vcpu, gva: ga, gpa: &gpa, asce, mode, prot: &prot); |
957 | if (rc < 0) |
958 | return rc; |
959 | } else { |
960 | gpa = kvm_s390_real_to_abs(vcpu, gra: ga); |
961 | if (!kvm_is_gpa_in_memslot(kvm: vcpu->kvm, gpa)) { |
962 | rc = PGM_ADDRESSING; |
963 | prot = PROT_NONE; |
964 | } |
965 | } |
966 | if (rc) |
967 | return trans_exc(vcpu, code: rc, gva: ga, ar, mode, prot); |
968 | rc = vcpu_check_access_key(vcpu, access_key, mode, asce, gpa, ga, |
969 | len: fragment_len); |
970 | if (rc) |
971 | return trans_exc(vcpu, code: rc, gva: ga, ar, mode, prot: PROT_TYPE_KEYC); |
972 | if (gpas) |
973 | *gpas++ = gpa; |
974 | offset = 0; |
975 | ga += fragment_len; |
976 | len -= fragment_len; |
977 | } |
978 | return 0; |
979 | } |
980 | |
981 | static int access_guest_page(struct kvm *kvm, enum gacc_mode mode, gpa_t gpa, |
982 | void *data, unsigned int len) |
983 | { |
984 | const unsigned int offset = offset_in_page(gpa); |
985 | const gfn_t gfn = gpa_to_gfn(gpa); |
986 | int rc; |
987 | |
988 | if (mode == GACC_STORE) |
989 | rc = kvm_write_guest_page(kvm, gfn, data, offset, len); |
990 | else |
991 | rc = kvm_read_guest_page(kvm, gfn, data, offset, len); |
992 | return rc; |
993 | } |
994 | |
995 | static int |
996 | access_guest_page_with_key(struct kvm *kvm, enum gacc_mode mode, gpa_t gpa, |
997 | void *data, unsigned int len, u8 access_key) |
998 | { |
999 | struct kvm_memory_slot *slot; |
1000 | bool writable; |
1001 | gfn_t gfn; |
1002 | hva_t hva; |
1003 | int rc; |
1004 | |
1005 | gfn = gpa >> PAGE_SHIFT; |
1006 | slot = gfn_to_memslot(kvm, gfn); |
1007 | hva = gfn_to_hva_memslot_prot(slot, gfn, writable: &writable); |
1008 | |
1009 | if (kvm_is_error_hva(hva)) |
1010 | return PGM_ADDRESSING; |
1011 | /* |
1012 | * Check if it's a ro memslot, even tho that can't occur (they're unsupported). |
1013 | * Don't try to actually handle that case. |
1014 | */ |
1015 | if (!writable && mode == GACC_STORE) |
1016 | return -EOPNOTSUPP; |
1017 | hva += offset_in_page(gpa); |
1018 | if (mode == GACC_STORE) |
1019 | rc = copy_to_user_key((void __user *)hva, data, len, access_key); |
1020 | else |
1021 | rc = copy_from_user_key(data, (void __user *)hva, len, access_key); |
1022 | if (rc) |
1023 | return PGM_PROTECTION; |
1024 | if (mode == GACC_STORE) |
1025 | mark_page_dirty_in_slot(kvm, memslot: slot, gfn); |
1026 | return 0; |
1027 | } |
1028 | |
1029 | int access_guest_abs_with_key(struct kvm *kvm, gpa_t gpa, void *data, |
1030 | unsigned long len, enum gacc_mode mode, u8 access_key) |
1031 | { |
1032 | int offset = offset_in_page(gpa); |
1033 | int fragment_len; |
1034 | int rc; |
1035 | |
1036 | while (min(PAGE_SIZE - offset, len) > 0) { |
1037 | fragment_len = min(PAGE_SIZE - offset, len); |
1038 | rc = access_guest_page_with_key(kvm, mode, gpa, data, len: fragment_len, access_key); |
1039 | if (rc) |
1040 | return rc; |
1041 | offset = 0; |
1042 | len -= fragment_len; |
1043 | data += fragment_len; |
1044 | gpa += fragment_len; |
1045 | } |
1046 | return 0; |
1047 | } |
1048 | |
1049 | int access_guest_with_key(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, |
1050 | void *data, unsigned long len, enum gacc_mode mode, |
1051 | u8 access_key) |
1052 | { |
1053 | psw_t *psw = &vcpu->arch.sie_block->gpsw; |
1054 | unsigned long nr_pages, idx; |
1055 | unsigned long gpa_array[2]; |
1056 | unsigned int fragment_len; |
1057 | unsigned long *gpas; |
1058 | enum prot_type prot; |
1059 | int need_ipte_lock; |
1060 | union asce asce; |
1061 | bool try_storage_prot_override; |
1062 | bool try_fetch_prot_override; |
1063 | int rc; |
1064 | |
1065 | if (!len) |
1066 | return 0; |
1067 | ga = kvm_s390_logical_to_effective(vcpu, ga); |
1068 | rc = get_vcpu_asce(vcpu, asce: &asce, ga, ar, mode); |
1069 | if (rc) |
1070 | return rc; |
1071 | nr_pages = (((ga & ~PAGE_MASK) + len - 1) >> PAGE_SHIFT) + 1; |
1072 | gpas = gpa_array; |
1073 | if (nr_pages > ARRAY_SIZE(gpa_array)) |
1074 | gpas = vmalloc(array_size(nr_pages, sizeof(unsigned long))); |
1075 | if (!gpas) |
1076 | return -ENOMEM; |
1077 | try_fetch_prot_override = fetch_prot_override_applicable(vcpu, mode, asce); |
1078 | try_storage_prot_override = storage_prot_override_applicable(vcpu); |
1079 | need_ipte_lock = psw_bits(*psw).dat && !asce.r; |
1080 | if (need_ipte_lock) |
1081 | ipte_lock(kvm: vcpu->kvm); |
1082 | /* |
1083 | * Since we do the access further down ultimately via a move instruction |
1084 | * that does key checking and returns an error in case of a protection |
1085 | * violation, we don't need to do the check during address translation. |
1086 | * Skip it by passing access key 0, which matches any storage key, |
1087 | * obviating the need for any further checks. As a result the check is |
1088 | * handled entirely in hardware on access, we only need to take care to |
1089 | * forego key protection checking if fetch protection override applies or |
1090 | * retry with the special key 9 in case of storage protection override. |
1091 | */ |
1092 | rc = guest_range_to_gpas(vcpu, ga, ar, gpas, len, asce, mode, access_key: 0); |
1093 | if (rc) |
1094 | goto out_unlock; |
1095 | for (idx = 0; idx < nr_pages; idx++) { |
1096 | fragment_len = min(PAGE_SIZE - offset_in_page(gpas[idx]), len); |
1097 | if (try_fetch_prot_override && fetch_prot_override_applies(ga, len: fragment_len)) { |
1098 | rc = access_guest_page(kvm: vcpu->kvm, mode, gpa: gpas[idx], |
1099 | data, len: fragment_len); |
1100 | } else { |
1101 | rc = access_guest_page_with_key(kvm: vcpu->kvm, mode, gpa: gpas[idx], |
1102 | data, len: fragment_len, access_key); |
1103 | } |
1104 | if (rc == PGM_PROTECTION && try_storage_prot_override) |
1105 | rc = access_guest_page_with_key(vcpu->kvm, mode, gpas[idx], |
1106 | data, fragment_len, PAGE_SPO_ACC); |
1107 | if (rc) |
1108 | break; |
1109 | len -= fragment_len; |
1110 | data += fragment_len; |
1111 | ga = kvm_s390_logical_to_effective(vcpu, ga: ga + fragment_len); |
1112 | } |
1113 | if (rc > 0) { |
1114 | bool terminate = (mode == GACC_STORE) && (idx > 0); |
1115 | |
1116 | if (rc == PGM_PROTECTION) |
1117 | prot = PROT_TYPE_KEYC; |
1118 | else |
1119 | prot = PROT_NONE; |
1120 | rc = trans_exc_ending(vcpu, code: rc, gva: ga, ar, mode, prot, terminate); |
1121 | } |
1122 | out_unlock: |
1123 | if (need_ipte_lock) |
1124 | ipte_unlock(kvm: vcpu->kvm); |
1125 | if (nr_pages > ARRAY_SIZE(gpa_array)) |
1126 | vfree(addr: gpas); |
1127 | return rc; |
1128 | } |
1129 | |
1130 | int access_guest_real(struct kvm_vcpu *vcpu, unsigned long gra, |
1131 | void *data, unsigned long len, enum gacc_mode mode) |
1132 | { |
1133 | unsigned int fragment_len; |
1134 | unsigned long gpa; |
1135 | int rc = 0; |
1136 | |
1137 | while (len && !rc) { |
1138 | gpa = kvm_s390_real_to_abs(vcpu, gra); |
1139 | fragment_len = min(PAGE_SIZE - offset_in_page(gpa), len); |
1140 | rc = access_guest_page(kvm: vcpu->kvm, mode, gpa, data, len: fragment_len); |
1141 | len -= fragment_len; |
1142 | gra += fragment_len; |
1143 | data += fragment_len; |
1144 | } |
1145 | return rc; |
1146 | } |
1147 | |
1148 | /** |
1149 | * cmpxchg_guest_abs_with_key() - Perform cmpxchg on guest absolute address. |
1150 | * @kvm: Virtual machine instance. |
1151 | * @gpa: Absolute guest address of the location to be changed. |
1152 | * @len: Operand length of the cmpxchg, required: 1 <= len <= 16. Providing a |
1153 | * non power of two will result in failure. |
1154 | * @old_addr: Pointer to old value. If the location at @gpa contains this value, |
1155 | * the exchange will succeed. After calling cmpxchg_guest_abs_with_key() |
1156 | * *@old_addr contains the value at @gpa before the attempt to |
1157 | * exchange the value. |
1158 | * @new: The value to place at @gpa. |
1159 | * @access_key: The access key to use for the guest access. |
1160 | * @success: output value indicating if an exchange occurred. |
1161 | * |
1162 | * Atomically exchange the value at @gpa by @new, if it contains *@old. |
1163 | * Honors storage keys. |
1164 | * |
1165 | * Return: * 0: successful exchange |
1166 | * * >0: a program interruption code indicating the reason cmpxchg could |
1167 | * not be attempted |
1168 | * * -EINVAL: address misaligned or len not power of two |
1169 | * * -EAGAIN: transient failure (len 1 or 2) |
1170 | * * -EOPNOTSUPP: read-only memslot (should never occur) |
1171 | */ |
1172 | int cmpxchg_guest_abs_with_key(struct kvm *kvm, gpa_t gpa, int len, |
1173 | __uint128_t *old_addr, __uint128_t new, |
1174 | u8 access_key, bool *success) |
1175 | { |
1176 | gfn_t gfn = gpa_to_gfn(gpa); |
1177 | struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn); |
1178 | bool writable; |
1179 | hva_t hva; |
1180 | int ret; |
1181 | |
1182 | if (!IS_ALIGNED(gpa, len)) |
1183 | return -EINVAL; |
1184 | |
1185 | hva = gfn_to_hva_memslot_prot(slot, gfn, writable: &writable); |
1186 | if (kvm_is_error_hva(hva)) |
1187 | return PGM_ADDRESSING; |
1188 | /* |
1189 | * Check if it's a read-only memslot, even though that cannot occur |
1190 | * since those are unsupported. |
1191 | * Don't try to actually handle that case. |
1192 | */ |
1193 | if (!writable) |
1194 | return -EOPNOTSUPP; |
1195 | |
1196 | hva += offset_in_page(gpa); |
1197 | /* |
1198 | * The cmpxchg_user_key macro depends on the type of "old", so we need |
1199 | * a case for each valid length and get some code duplication as long |
1200 | * as we don't introduce a new macro. |
1201 | */ |
1202 | switch (len) { |
1203 | case 1: { |
1204 | u8 old; |
1205 | |
1206 | ret = cmpxchg_user_key((u8 __user *)hva, &old, *old_addr, new, access_key); |
1207 | *success = !ret && old == *old_addr; |
1208 | *old_addr = old; |
1209 | break; |
1210 | } |
1211 | case 2: { |
1212 | u16 old; |
1213 | |
1214 | ret = cmpxchg_user_key((u16 __user *)hva, &old, *old_addr, new, access_key); |
1215 | *success = !ret && old == *old_addr; |
1216 | *old_addr = old; |
1217 | break; |
1218 | } |
1219 | case 4: { |
1220 | u32 old; |
1221 | |
1222 | ret = cmpxchg_user_key((u32 __user *)hva, &old, *old_addr, new, access_key); |
1223 | *success = !ret && old == *old_addr; |
1224 | *old_addr = old; |
1225 | break; |
1226 | } |
1227 | case 8: { |
1228 | u64 old; |
1229 | |
1230 | ret = cmpxchg_user_key((u64 __user *)hva, &old, *old_addr, new, access_key); |
1231 | *success = !ret && old == *old_addr; |
1232 | *old_addr = old; |
1233 | break; |
1234 | } |
1235 | case 16: { |
1236 | __uint128_t old; |
1237 | |
1238 | ret = cmpxchg_user_key((__uint128_t __user *)hva, &old, *old_addr, new, access_key); |
1239 | *success = !ret && old == *old_addr; |
1240 | *old_addr = old; |
1241 | break; |
1242 | } |
1243 | default: |
1244 | return -EINVAL; |
1245 | } |
1246 | if (*success) |
1247 | mark_page_dirty_in_slot(kvm, memslot: slot, gfn); |
1248 | /* |
1249 | * Assume that the fault is caused by protection, either key protection |
1250 | * or user page write protection. |
1251 | */ |
1252 | if (ret == -EFAULT) |
1253 | ret = PGM_PROTECTION; |
1254 | return ret; |
1255 | } |
1256 | |
1257 | /** |
1258 | * guest_translate_address_with_key - translate guest logical into guest absolute address |
1259 | * @vcpu: virtual cpu |
1260 | * @gva: Guest virtual address |
1261 | * @ar: Access register |
1262 | * @gpa: Guest physical address |
1263 | * @mode: Translation access mode |
1264 | * @access_key: access key to mach the storage key with |
1265 | * |
1266 | * Parameter semantics are the same as the ones from guest_translate. |
1267 | * The memory contents at the guest address are not changed. |
1268 | * |
1269 | * Note: The IPTE lock is not taken during this function, so the caller |
1270 | * has to take care of this. |
1271 | */ |
1272 | int guest_translate_address_with_key(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar, |
1273 | unsigned long *gpa, enum gacc_mode mode, |
1274 | u8 access_key) |
1275 | { |
1276 | union asce asce; |
1277 | int rc; |
1278 | |
1279 | gva = kvm_s390_logical_to_effective(vcpu, ga: gva); |
1280 | rc = get_vcpu_asce(vcpu, asce: &asce, ga: gva, ar, mode); |
1281 | if (rc) |
1282 | return rc; |
1283 | return guest_range_to_gpas(vcpu, ga: gva, ar, gpas: gpa, len: 1, asce, mode, |
1284 | access_key); |
1285 | } |
1286 | |
1287 | /** |
1288 | * check_gva_range - test a range of guest virtual addresses for accessibility |
1289 | * @vcpu: virtual cpu |
1290 | * @gva: Guest virtual address |
1291 | * @ar: Access register |
1292 | * @length: Length of test range |
1293 | * @mode: Translation access mode |
1294 | * @access_key: access key to mach the storage keys with |
1295 | */ |
1296 | int check_gva_range(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar, |
1297 | unsigned long length, enum gacc_mode mode, u8 access_key) |
1298 | { |
1299 | union asce asce; |
1300 | int rc = 0; |
1301 | |
1302 | rc = get_vcpu_asce(vcpu, asce: &asce, ga: gva, ar, mode); |
1303 | if (rc) |
1304 | return rc; |
1305 | ipte_lock(kvm: vcpu->kvm); |
1306 | rc = guest_range_to_gpas(vcpu, ga: gva, ar, NULL, len: length, asce, mode, |
1307 | access_key); |
1308 | ipte_unlock(kvm: vcpu->kvm); |
1309 | |
1310 | return rc; |
1311 | } |
1312 | |
1313 | /** |
1314 | * check_gpa_range - test a range of guest physical addresses for accessibility |
1315 | * @kvm: virtual machine instance |
1316 | * @gpa: guest physical address |
1317 | * @length: length of test range |
1318 | * @mode: access mode to test, relevant for storage keys |
1319 | * @access_key: access key to mach the storage keys with |
1320 | */ |
1321 | int check_gpa_range(struct kvm *kvm, unsigned long gpa, unsigned long length, |
1322 | enum gacc_mode mode, u8 access_key) |
1323 | { |
1324 | unsigned int fragment_len; |
1325 | int rc = 0; |
1326 | |
1327 | while (length && !rc) { |
1328 | fragment_len = min(PAGE_SIZE - offset_in_page(gpa), length); |
1329 | rc = vm_check_access_key(kvm, access_key, mode, gpa); |
1330 | length -= fragment_len; |
1331 | gpa += fragment_len; |
1332 | } |
1333 | return rc; |
1334 | } |
1335 | |
1336 | /** |
1337 | * kvm_s390_check_low_addr_prot_real - check for low-address protection |
1338 | * @vcpu: virtual cpu |
1339 | * @gra: Guest real address |
1340 | * |
1341 | * Checks whether an address is subject to low-address protection and set |
1342 | * up vcpu->arch.pgm accordingly if necessary. |
1343 | * |
1344 | * Return: 0 if no protection exception, or PGM_PROTECTION if protected. |
1345 | */ |
1346 | int kvm_s390_check_low_addr_prot_real(struct kvm_vcpu *vcpu, unsigned long gra) |
1347 | { |
1348 | union ctlreg0 ctlreg0 = {.val = vcpu->arch.sie_block->gcr[0]}; |
1349 | |
1350 | if (!ctlreg0.lap || !is_low_address(ga: gra)) |
1351 | return 0; |
1352 | return trans_exc(vcpu, PGM_PROTECTION, gra, 0, GACC_STORE, PROT_TYPE_LA); |
1353 | } |
1354 | |
1355 | /** |
1356 | * kvm_s390_shadow_tables - walk the guest page table and create shadow tables |
1357 | * @sg: pointer to the shadow guest address space structure |
1358 | * @saddr: faulting address in the shadow gmap |
1359 | * @pgt: pointer to the beginning of the page table for the given address if |
1360 | * successful (return value 0), or to the first invalid DAT entry in |
1361 | * case of exceptions (return value > 0) |
1362 | * @dat_protection: referenced memory is write protected |
1363 | * @fake: pgt references contiguous guest memory block, not a pgtable |
1364 | */ |
1365 | static int kvm_s390_shadow_tables(struct gmap *sg, unsigned long saddr, |
1366 | unsigned long *pgt, int *dat_protection, |
1367 | int *fake) |
1368 | { |
1369 | struct kvm *kvm; |
1370 | struct gmap *parent; |
1371 | union asce asce; |
1372 | union vaddress vaddr; |
1373 | unsigned long ptr; |
1374 | int rc; |
1375 | |
1376 | *fake = 0; |
1377 | *dat_protection = 0; |
1378 | kvm = sg->private; |
1379 | parent = sg->parent; |
1380 | vaddr.addr = saddr; |
1381 | asce.val = sg->orig_asce; |
1382 | ptr = asce.origin * PAGE_SIZE; |
1383 | if (asce.r) { |
1384 | *fake = 1; |
1385 | ptr = 0; |
1386 | asce.dt = ASCE_TYPE_REGION1; |
1387 | } |
1388 | switch (asce.dt) { |
1389 | case ASCE_TYPE_REGION1: |
1390 | if (vaddr.rfx01 > asce.tl && !*fake) |
1391 | return PGM_REGION_FIRST_TRANS; |
1392 | break; |
1393 | case ASCE_TYPE_REGION2: |
1394 | if (vaddr.rfx) |
1395 | return PGM_ASCE_TYPE; |
1396 | if (vaddr.rsx01 > asce.tl) |
1397 | return PGM_REGION_SECOND_TRANS; |
1398 | break; |
1399 | case ASCE_TYPE_REGION3: |
1400 | if (vaddr.rfx || vaddr.rsx) |
1401 | return PGM_ASCE_TYPE; |
1402 | if (vaddr.rtx01 > asce.tl) |
1403 | return PGM_REGION_THIRD_TRANS; |
1404 | break; |
1405 | case ASCE_TYPE_SEGMENT: |
1406 | if (vaddr.rfx || vaddr.rsx || vaddr.rtx) |
1407 | return PGM_ASCE_TYPE; |
1408 | if (vaddr.sx01 > asce.tl) |
1409 | return PGM_SEGMENT_TRANSLATION; |
1410 | break; |
1411 | } |
1412 | |
1413 | switch (asce.dt) { |
1414 | case ASCE_TYPE_REGION1: { |
1415 | union region1_table_entry rfte; |
1416 | |
1417 | if (*fake) { |
1418 | ptr += vaddr.rfx * _REGION1_SIZE; |
1419 | rfte.val = ptr; |
1420 | goto shadow_r2t; |
1421 | } |
1422 | *pgt = ptr + vaddr.rfx * 8; |
1423 | rc = gmap_read_table(parent, ptr + vaddr.rfx * 8, &rfte.val); |
1424 | if (rc) |
1425 | return rc; |
1426 | if (rfte.i) |
1427 | return PGM_REGION_FIRST_TRANS; |
1428 | if (rfte.tt != TABLE_TYPE_REGION1) |
1429 | return PGM_TRANSLATION_SPEC; |
1430 | if (vaddr.rsx01 < rfte.tf || vaddr.rsx01 > rfte.tl) |
1431 | return PGM_REGION_SECOND_TRANS; |
1432 | if (sg->edat_level >= 1) |
1433 | *dat_protection |= rfte.p; |
1434 | ptr = rfte.rto * PAGE_SIZE; |
1435 | shadow_r2t: |
1436 | rc = gmap_shadow_r2t(sg, saddr, rfte.val, *fake); |
1437 | if (rc) |
1438 | return rc; |
1439 | kvm->stat.gmap_shadow_r1_entry++; |
1440 | } |
1441 | fallthrough; |
1442 | case ASCE_TYPE_REGION2: { |
1443 | union region2_table_entry rste; |
1444 | |
1445 | if (*fake) { |
1446 | ptr += vaddr.rsx * _REGION2_SIZE; |
1447 | rste.val = ptr; |
1448 | goto shadow_r3t; |
1449 | } |
1450 | *pgt = ptr + vaddr.rsx * 8; |
1451 | rc = gmap_read_table(parent, ptr + vaddr.rsx * 8, &rste.val); |
1452 | if (rc) |
1453 | return rc; |
1454 | if (rste.i) |
1455 | return PGM_REGION_SECOND_TRANS; |
1456 | if (rste.tt != TABLE_TYPE_REGION2) |
1457 | return PGM_TRANSLATION_SPEC; |
1458 | if (vaddr.rtx01 < rste.tf || vaddr.rtx01 > rste.tl) |
1459 | return PGM_REGION_THIRD_TRANS; |
1460 | if (sg->edat_level >= 1) |
1461 | *dat_protection |= rste.p; |
1462 | ptr = rste.rto * PAGE_SIZE; |
1463 | shadow_r3t: |
1464 | rste.p |= *dat_protection; |
1465 | rc = gmap_shadow_r3t(sg, saddr, rste.val, *fake); |
1466 | if (rc) |
1467 | return rc; |
1468 | kvm->stat.gmap_shadow_r2_entry++; |
1469 | } |
1470 | fallthrough; |
1471 | case ASCE_TYPE_REGION3: { |
1472 | union region3_table_entry rtte; |
1473 | |
1474 | if (*fake) { |
1475 | ptr += vaddr.rtx * _REGION3_SIZE; |
1476 | rtte.val = ptr; |
1477 | goto shadow_sgt; |
1478 | } |
1479 | *pgt = ptr + vaddr.rtx * 8; |
1480 | rc = gmap_read_table(parent, ptr + vaddr.rtx * 8, &rtte.val); |
1481 | if (rc) |
1482 | return rc; |
1483 | if (rtte.i) |
1484 | return PGM_REGION_THIRD_TRANS; |
1485 | if (rtte.tt != TABLE_TYPE_REGION3) |
1486 | return PGM_TRANSLATION_SPEC; |
1487 | if (rtte.cr && asce.p && sg->edat_level >= 2) |
1488 | return PGM_TRANSLATION_SPEC; |
1489 | if (rtte.fc && sg->edat_level >= 2) { |
1490 | *dat_protection |= rtte.fc0.p; |
1491 | *fake = 1; |
1492 | ptr = rtte.fc1.rfaa * _REGION3_SIZE; |
1493 | rtte.val = ptr; |
1494 | goto shadow_sgt; |
1495 | } |
1496 | if (vaddr.sx01 < rtte.fc0.tf || vaddr.sx01 > rtte.fc0.tl) |
1497 | return PGM_SEGMENT_TRANSLATION; |
1498 | if (sg->edat_level >= 1) |
1499 | *dat_protection |= rtte.fc0.p; |
1500 | ptr = rtte.fc0.sto * PAGE_SIZE; |
1501 | shadow_sgt: |
1502 | rtte.fc0.p |= *dat_protection; |
1503 | rc = gmap_shadow_sgt(sg, saddr, rtte.val, *fake); |
1504 | if (rc) |
1505 | return rc; |
1506 | kvm->stat.gmap_shadow_r3_entry++; |
1507 | } |
1508 | fallthrough; |
1509 | case ASCE_TYPE_SEGMENT: { |
1510 | union segment_table_entry ste; |
1511 | |
1512 | if (*fake) { |
1513 | ptr += vaddr.sx * _SEGMENT_SIZE; |
1514 | ste.val = ptr; |
1515 | goto shadow_pgt; |
1516 | } |
1517 | *pgt = ptr + vaddr.sx * 8; |
1518 | rc = gmap_read_table(parent, ptr + vaddr.sx * 8, &ste.val); |
1519 | if (rc) |
1520 | return rc; |
1521 | if (ste.i) |
1522 | return PGM_SEGMENT_TRANSLATION; |
1523 | if (ste.tt != TABLE_TYPE_SEGMENT) |
1524 | return PGM_TRANSLATION_SPEC; |
1525 | if (ste.cs && asce.p) |
1526 | return PGM_TRANSLATION_SPEC; |
1527 | *dat_protection |= ste.fc0.p; |
1528 | if (ste.fc && sg->edat_level >= 1) { |
1529 | *fake = 1; |
1530 | ptr = ste.fc1.sfaa * _SEGMENT_SIZE; |
1531 | ste.val = ptr; |
1532 | goto shadow_pgt; |
1533 | } |
1534 | ptr = ste.fc0.pto * (PAGE_SIZE / 2); |
1535 | shadow_pgt: |
1536 | ste.fc0.p |= *dat_protection; |
1537 | rc = gmap_shadow_pgt(sg, saddr, ste.val, *fake); |
1538 | if (rc) |
1539 | return rc; |
1540 | kvm->stat.gmap_shadow_sg_entry++; |
1541 | } |
1542 | } |
1543 | /* Return the parent address of the page table */ |
1544 | *pgt = ptr; |
1545 | return 0; |
1546 | } |
1547 | |
1548 | /** |
1549 | * kvm_s390_shadow_fault - handle fault on a shadow page table |
1550 | * @vcpu: virtual cpu |
1551 | * @sg: pointer to the shadow guest address space structure |
1552 | * @saddr: faulting address in the shadow gmap |
1553 | * @datptr: will contain the address of the faulting DAT table entry, or of |
1554 | * the valid leaf, plus some flags |
1555 | * |
1556 | * Returns: - 0 if the shadow fault was successfully resolved |
1557 | * - > 0 (pgm exception code) on exceptions while faulting |
1558 | * - -EAGAIN if the caller can retry immediately |
1559 | * - -EFAULT when accessing invalid guest addresses |
1560 | * - -ENOMEM if out of memory |
1561 | */ |
1562 | int kvm_s390_shadow_fault(struct kvm_vcpu *vcpu, struct gmap *sg, |
1563 | unsigned long saddr, unsigned long *datptr) |
1564 | { |
1565 | union vaddress vaddr; |
1566 | union page_table_entry pte; |
1567 | unsigned long pgt = 0; |
1568 | int dat_protection, fake; |
1569 | int rc; |
1570 | |
1571 | mmap_read_lock(mm: sg->mm); |
1572 | /* |
1573 | * We don't want any guest-2 tables to change - so the parent |
1574 | * tables/pointers we read stay valid - unshadowing is however |
1575 | * always possible - only guest_table_lock protects us. |
1576 | */ |
1577 | ipte_lock(kvm: vcpu->kvm); |
1578 | |
1579 | rc = gmap_shadow_pgt_lookup(sg, saddr, &pgt, &dat_protection, &fake); |
1580 | if (rc) |
1581 | rc = kvm_s390_shadow_tables(sg, saddr, pgt: &pgt, dat_protection: &dat_protection, |
1582 | fake: &fake); |
1583 | |
1584 | vaddr.addr = saddr; |
1585 | if (fake) { |
1586 | pte.val = pgt + vaddr.px * PAGE_SIZE; |
1587 | goto shadow_page; |
1588 | } |
1589 | |
1590 | switch (rc) { |
1591 | case PGM_SEGMENT_TRANSLATION: |
1592 | case PGM_REGION_THIRD_TRANS: |
1593 | case PGM_REGION_SECOND_TRANS: |
1594 | case PGM_REGION_FIRST_TRANS: |
1595 | pgt |= PEI_NOT_PTE; |
1596 | break; |
1597 | case 0: |
1598 | pgt += vaddr.px * 8; |
1599 | rc = gmap_read_table(sg->parent, pgt, &pte.val); |
1600 | } |
1601 | if (datptr) |
1602 | *datptr = pgt | dat_protection * PEI_DAT_PROT; |
1603 | if (!rc && pte.i) |
1604 | rc = PGM_PAGE_TRANSLATION; |
1605 | if (!rc && pte.z) |
1606 | rc = PGM_TRANSLATION_SPEC; |
1607 | shadow_page: |
1608 | pte.p |= dat_protection; |
1609 | if (!rc) |
1610 | rc = gmap_shadow_page(sg, saddr, __pte(val: pte.val)); |
1611 | vcpu->kvm->stat.gmap_shadow_pg_entry++; |
1612 | ipte_unlock(kvm: vcpu->kvm); |
1613 | mmap_read_unlock(mm: sg->mm); |
1614 | return rc; |
1615 | } |
1616 | |