LXR linux/arch/s390/kvm/pv.c

   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * Hosting Protected Virtual Machines
   4 *
   5 * Copyright IBM Corp. 2019, 2020
   6 *    Author(s): Janosch Frank <frankja@linux.ibm.com>
   7 */
   8#include <linux/kvm.h>
   9#include <linux/kvm_host.h>
  10#include <linux/pagemap.h>
  11#include <linux/sched/signal.h>
  12#include <asm/gmap.h>
  13#include <asm/uv.h>
  14#include <asm/mman.h>
  15#include "kvm-s390.h"
  16
  17int kvm_s390_pv_destroy_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc)
  18{
  19        int cc = 0;
  20
  21        if (kvm_s390_pv_cpu_get_handle(vcpu)) {
  22                cc = uv_cmd_nodata(kvm_s390_pv_cpu_get_handle(vcpu),
  23                                   UVC_CMD_DESTROY_SEC_CPU, rc, rrc);
  24
  25                KVM_UV_EVENT(vcpu->kvm, 3,
  26                             "PROTVIRT DESTROY VCPU %d: rc %x rrc %x",
  27                             vcpu->vcpu_id, *rc, *rrc);
  28                WARN_ONCE(cc, "protvirt destroy cpu failed rc %x rrc %x",
  29                          *rc, *rrc);
  30        }
  31        /* Intended memory leak for something that should never happen. */
  32        if (!cc)
  33                free_pages(vcpu->arch.pv.stor_base,
  34                           get_order(uv_info.guest_cpu_stor_len));
  35
  36        free_page(sida_origin(vcpu->arch.sie_block));
  37        vcpu->arch.sie_block->pv_handle_cpu = 0;
  38        vcpu->arch.sie_block->pv_handle_config = 0;
  39        memset(&vcpu->arch.pv, 0, sizeof(vcpu->arch.pv));
  40        vcpu->arch.sie_block->sdf = 0;
  41        /*
  42         * The sidad field (for sdf == 2) is now the gbea field (for sdf == 0).
  43         * Use the reset value of gbea to avoid leaking the kernel pointer of
  44         * the just freed sida.
  45         */
  46        vcpu->arch.sie_block->gbea = 1;
  47        kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
  48
  49        return cc ? EIO : 0;
  50}
  51
  52int kvm_s390_pv_create_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc)
  53{
  54        struct uv_cb_csc uvcb = {
  55                .header.cmd = UVC_CMD_CREATE_SEC_CPU,
  56                .header.len = sizeof(uvcb),
  57        };
  58        int cc;
  59
  60        if (kvm_s390_pv_cpu_get_handle(vcpu))
  61                return -EINVAL;
  62
  63        vcpu->arch.pv.stor_base = __get_free_pages(GFP_KERNEL_ACCOUNT,
  64                                                   get_order(uv_info.guest_cpu_stor_len));
  65        if (!vcpu->arch.pv.stor_base)
  66                return -ENOMEM;
  67
  68        /* Input */
  69        uvcb.guest_handle = kvm_s390_pv_get_handle(vcpu->kvm);
  70        uvcb.num = vcpu->arch.sie_block->icpua;
  71        uvcb.state_origin = (u64)vcpu->arch.sie_block;
  72        uvcb.stor_origin = (u64)vcpu->arch.pv.stor_base;
  73
  74        /* Alloc Secure Instruction Data Area Designation */
  75        vcpu->arch.sie_block->sidad = __get_free_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
  76        if (!vcpu->arch.sie_block->sidad) {
  77                free_pages(vcpu->arch.pv.stor_base,
  78                           get_order(uv_info.guest_cpu_stor_len));
  79                return -ENOMEM;
  80        }
  81
  82        cc = uv_call(0, (u64)&uvcb);
  83        *rc = uvcb.header.rc;
  84        *rrc = uvcb.header.rrc;
  85        KVM_UV_EVENT(vcpu->kvm, 3,
  86                     "PROTVIRT CREATE VCPU: cpu %d handle %llx rc %x rrc %x",
  87                     vcpu->vcpu_id, uvcb.cpu_handle, uvcb.header.rc,
  88                     uvcb.header.rrc);
  89
  90        if (cc) {
  91                u16 dummy;
  92
  93                kvm_s390_pv_destroy_cpu(vcpu, &dummy, &dummy);
  94                return -EIO;
  95        }
  96
  97        /* Output */
  98        vcpu->arch.pv.handle = uvcb.cpu_handle;
  99        vcpu->arch.sie_block->pv_handle_cpu = uvcb.cpu_handle;
 100        vcpu->arch.sie_block->pv_handle_config = kvm_s390_pv_get_handle(vcpu->kvm);
 101        vcpu->arch.sie_block->sdf = 2;
 102        kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
 103        return 0;
 104}
 105
 106/* only free resources when the destroy was successful */
 107static void kvm_s390_pv_dealloc_vm(struct kvm *kvm)
 108{
 109        vfree(kvm->arch.pv.stor_var);
 110        free_pages(kvm->arch.pv.stor_base,
 111                   get_order(uv_info.guest_base_stor_len));
 112        memset(&kvm->arch.pv, 0, sizeof(kvm->arch.pv));
 113}
 114
 115static int kvm_s390_pv_alloc_vm(struct kvm *kvm)
 116{
 117        unsigned long base = uv_info.guest_base_stor_len;
 118        unsigned long virt = uv_info.guest_virt_var_stor_len;
 119        unsigned long npages = 0, vlen = 0;
 120        struct kvm_memory_slot *memslot;
 121
 122        kvm->arch.pv.stor_var = NULL;
 123        kvm->arch.pv.stor_base = __get_free_pages(GFP_KERNEL_ACCOUNT, get_order(base));
 124        if (!kvm->arch.pv.stor_base)
 125                return -ENOMEM;
 126
 127        /*
 128         * Calculate current guest storage for allocation of the
 129         * variable storage, which is based on the length in MB.
 130         *
 131         * Slots are sorted by GFN
 132         */
 133        mutex_lock(&kvm->slots_lock);
 134        memslot = kvm_memslots(kvm)->memslots;
 135        npages = memslot->base_gfn + memslot->npages;
 136        mutex_unlock(&kvm->slots_lock);
 137
 138        kvm->arch.pv.guest_len = npages * PAGE_SIZE;
 139
 140        /* Allocate variable storage */
 141        vlen = ALIGN(virt * ((npages * PAGE_SIZE) / HPAGE_SIZE), PAGE_SIZE);
 142        vlen += uv_info.guest_virt_base_stor_len;
 143        /*
 144         * The Create Secure Configuration Ultravisor Call does not support
 145         * using large pages for the virtual memory area.
 146         * This is a hardware limitation.
 147         */
 148        kvm->arch.pv.stor_var = vmalloc_no_huge(vlen);
 149        if (!kvm->arch.pv.stor_var)
 150                goto out_err;
 151        return 0;
 152
 153out_err:
 154        kvm_s390_pv_dealloc_vm(kvm);
 155        return -ENOMEM;
 156}
 157
 158/* this should not fail, but if it does, we must not free the donated memory */
 159int kvm_s390_pv_deinit_vm(struct kvm *kvm, u16 *rc, u16 *rrc)
 160{
 161        int cc;
 162
 163        /* make all pages accessible before destroying the guest */
 164        s390_reset_acc(kvm->mm);
 165
 166        cc = uv_cmd_nodata(kvm_s390_pv_get_handle(kvm),
 167                           UVC_CMD_DESTROY_SEC_CONF, rc, rrc);
 168        WRITE_ONCE(kvm->arch.gmap->guest_handle, 0);
 169        atomic_set(&kvm->mm->context.is_protected, 0);
 170        KVM_UV_EVENT(kvm, 3, "PROTVIRT DESTROY VM: rc %x rrc %x", *rc, *rrc);
 171        WARN_ONCE(cc, "protvirt destroy vm failed rc %x rrc %x", *rc, *rrc);
 172        /* Inteded memory leak on "impossible" error */
 173        if (!cc)
 174                kvm_s390_pv_dealloc_vm(kvm);
 175        return cc ? -EIO : 0;
 176}
 177
 178int kvm_s390_pv_init_vm(struct kvm *kvm, u16 *rc, u16 *rrc)
 179{
 180        struct uv_cb_cgc uvcb = {
 181                .header.cmd = UVC_CMD_CREATE_SEC_CONF,
 182                .header.len = sizeof(uvcb)
 183        };
 184        int cc, ret;
 185        u16 dummy;
 186
 187        ret = kvm_s390_pv_alloc_vm(kvm);
 188        if (ret)
 189                return ret;
 190
 191        /* Inputs */
 192        uvcb.guest_stor_origin = 0; /* MSO is 0 for KVM */
 193        uvcb.guest_stor_len = kvm->arch.pv.guest_len;
 194        uvcb.guest_asce = kvm->arch.gmap->asce;
 195        uvcb.guest_sca = (unsigned long)kvm->arch.sca;
 196        uvcb.conf_base_stor_origin = (u64)kvm->arch.pv.stor_base;
 197        uvcb.conf_virt_stor_origin = (u64)kvm->arch.pv.stor_var;
 198
 199        cc = uv_call(0, (u64)&uvcb);
 200        *rc = uvcb.header.rc;
 201        *rrc = uvcb.header.rrc;
 202        KVM_UV_EVENT(kvm, 3, "PROTVIRT CREATE VM: handle %llx len %llx rc %x rrc %x",
 203                     uvcb.guest_handle, uvcb.guest_stor_len, *rc, *rrc);
 204
 205        /* Outputs */
 206        kvm->arch.pv.handle = uvcb.guest_handle;
 207
 208        if (cc) {
 209                if (uvcb.header.rc & UVC_RC_NEED_DESTROY)
 210                        kvm_s390_pv_deinit_vm(kvm, &dummy, &dummy);
 211                else
 212                        kvm_s390_pv_dealloc_vm(kvm);
 213                return -EIO;
 214        }
 215        kvm->arch.gmap->guest_handle = uvcb.guest_handle;
 216        return 0;
 217}
 218
 219int kvm_s390_pv_set_sec_parms(struct kvm *kvm, void *hdr, u64 length, u16 *rc,
 220                              u16 *rrc)
 221{
 222        struct uv_cb_ssc uvcb = {
 223                .header.cmd = UVC_CMD_SET_SEC_CONF_PARAMS,
 224                .header.len = sizeof(uvcb),
 225                .sec_header_origin = (u64)hdr,
 226                .sec_header_len = length,
 227                .guest_handle = kvm_s390_pv_get_handle(kvm),
 228        };
 229        int cc = uv_call(0, (u64)&uvcb);
 230
 231        *rc = uvcb.header.rc;
 232        *rrc = uvcb.header.rrc;
 233        KVM_UV_EVENT(kvm, 3, "PROTVIRT VM SET PARMS: rc %x rrc %x",
 234                     *rc, *rrc);
 235        if (!cc)
 236                atomic_set(&kvm->mm->context.is_protected, 1);
 237        return cc ? -EINVAL : 0;
 238}
 239
 240static int unpack_one(struct kvm *kvm, unsigned long addr, u64 tweak,
 241                      u64 offset, u16 *rc, u16 *rrc)
 242{
 243        struct uv_cb_unp uvcb = {
 244                .header.cmd = UVC_CMD_UNPACK_IMG,
 245                .header.len = sizeof(uvcb),
 246                .guest_handle = kvm_s390_pv_get_handle(kvm),
 247                .gaddr = addr,
 248                .tweak[0] = tweak,
 249                .tweak[1] = offset,
 250        };
 251        int ret = gmap_make_secure(kvm->arch.gmap, addr, &uvcb);
 252
 253        *rc = uvcb.header.rc;
 254        *rrc = uvcb.header.rrc;
 255
 256        if (ret && ret != -EAGAIN)
 257                KVM_UV_EVENT(kvm, 3, "PROTVIRT VM UNPACK: failed addr %llx with rc %x rrc %x",
 258                             uvcb.gaddr, *rc, *rrc);
 259        return ret;
 260}
 261
 262int kvm_s390_pv_unpack(struct kvm *kvm, unsigned long addr, unsigned long size,
 263                       unsigned long tweak, u16 *rc, u16 *rrc)
 264{
 265        u64 offset = 0;
 266        int ret = 0;
 267
 268        if (addr & ~PAGE_MASK || !size || size & ~PAGE_MASK)
 269                return -EINVAL;
 270
 271        KVM_UV_EVENT(kvm, 3, "PROTVIRT VM UNPACK: start addr %lx size %lx",
 272                     addr, size);
 273
 274        while (offset < size) {
 275                ret = unpack_one(kvm, addr, tweak, offset, rc, rrc);
 276                if (ret == -EAGAIN) {
 277                        cond_resched();
 278                        if (fatal_signal_pending(current))
 279                                break;
 280                        continue;
 281                }
 282                if (ret)
 283                        break;
 284                addr += PAGE_SIZE;
 285                offset += PAGE_SIZE;
 286        }
 287        if (!ret)
 288                KVM_UV_EVENT(kvm, 3, "%s", "PROTVIRT VM UNPACK: successful");
 289        return ret;
 290}
 291
 292int kvm_s390_pv_set_cpu_state(struct kvm_vcpu *vcpu, u8 state)
 293{
 294        struct uv_cb_cpu_set_state uvcb = {
 295                .header.cmd     = UVC_CMD_CPU_SET_STATE,
 296                .header.len     = sizeof(uvcb),
 297                .cpu_handle     = kvm_s390_pv_cpu_get_handle(vcpu),
 298                .state          = state,
 299        };
 300        int cc;
 301
 302        cc = uv_call(0, (u64)&uvcb);
 303        KVM_UV_EVENT(vcpu->kvm, 3, "PROTVIRT SET CPU %d STATE %d rc %x rrc %x",
 304                     vcpu->vcpu_id, state, uvcb.header.rc, uvcb.header.rrc);
 305        if (cc)
 306                return -EINVAL;
 307        return 0;
 308}
 309