[linux-2.6-block.git] / arch / arm64 / kvm / inject_fault.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Fault injection for both 32 and 64bit guests.
 *
 * Copyright (C) 2012,2013 - ARM Ltd
 * Author: Marc Zyngier <marc.zyngier@arm.com>
 *
 * Based on arch/arm/kvm/emulate.c
 * Copyright (C) 2012 - Virtual Open Systems and Columbia University
 * Author: Christoffer Dall <c.dall@virtualopensystems.com>
 */

#include <linux/kvm_host.h>
#include <asm/kvm_emulate.h>
#include <asm/esr.h>

#define CURRENT_EL_SP_EL0_VECTOR	0x0
#define CURRENT_EL_SP_ELx_VECTOR	0x200
#define LOWER_EL_AArch64_VECTOR		0x400
#define LOWER_EL_AArch32_VECTOR		0x600

enum exception_type {
	except_type_sync	= 0,
	except_type_irq		= 0x80,
	except_type_fiq		= 0x100,
	except_type_serror	= 0x180,
};

/*
 * This performs the exception entry at a given EL (@target_mode), stashing PC
 * and PSTATE into ELR and SPSR respectively, and compute the new PC/PSTATE.
 * The EL passed to this function *must* be a non-secure, privileged mode with
 * bit 0 being set (PSTATE.SP == 1).
 *
 * When an exception is taken, most PSTATE fields are left unchanged in the
 * handler. However, some are explicitly overridden (e.g. M[4:0]). Luckily all
 * of the inherited bits have the same position in the AArch64/AArch32 SPSR_ELx
 * layouts, so we don't need to shuffle these for exceptions from AArch32 EL0.
 *
 * For the SPSR_ELx layout for AArch64, see ARM DDI 0487E.a page C5-429.
 * For the SPSR_ELx layout for AArch32, see ARM DDI 0487E.a page C5-426.
 *
 * Here we manipulate the fields in order of the AArch64 SPSR_ELx layout, from
 * MSB to LSB.
 */
static void enter_exception64(struct kvm_vcpu *vcpu, unsigned long target_mode,
			      enum exception_type type)
{
	unsigned long sctlr, vbar, old, new, mode;
	u64 exc_offset;

	mode = *vcpu_cpsr(vcpu) & (PSR_MODE_MASK | PSR_MODE32_BIT);

	if      (mode == target_mode)
		exc_offset = CURRENT_EL_SP_ELx_VECTOR;
	else if ((mode | PSR_MODE_THREAD_BIT) == target_mode)
		exc_offset = CURRENT_EL_SP_EL0_VECTOR;
	else if (!(mode & PSR_MODE32_BIT))
		exc_offset = LOWER_EL_AArch64_VECTOR;
	else
		exc_offset = LOWER_EL_AArch32_VECTOR;

	switch (target_mode) {
	case PSR_MODE_EL1h:
		vbar = vcpu_read_sys_reg(vcpu, VBAR_EL1);
		sctlr = vcpu_read_sys_reg(vcpu, SCTLR_EL1);
		vcpu_write_sys_reg(vcpu, *vcpu_pc(vcpu), ELR_EL1);
		break;
	default:
		/* Don't do that */
		BUG();
	}

	*vcpu_pc(vcpu) = vbar + exc_offset + type;

	old = *vcpu_cpsr(vcpu);
	new = 0;

	new |= (old & PSR_N_BIT);
	new |= (old & PSR_Z_BIT);
	new |= (old & PSR_C_BIT);
	new |= (old & PSR_V_BIT);

	// TODO: TCO (if/when ARMv8.5-MemTag is exposed to guests)

	new |= (old & PSR_DIT_BIT);

	// PSTATE.UAO is set to zero upon any exception to AArch64
	// See ARM DDI 0487E.a, page D5-2579.

	// PSTATE.PAN is unchanged unless SCTLR_ELx.SPAN == 0b0
	// SCTLR_ELx.SPAN is RES1 when ARMv8.1-PAN is not implemented
	// See ARM DDI 0487E.a, page D5-2578.
	new |= (old & PSR_PAN_BIT);
	if (!(sctlr & SCTLR_EL1_SPAN))
		new |= PSR_PAN_BIT;

	// PSTATE.SS is set to zero upon any exception to AArch64
	// See ARM DDI 0487E.a, page D2-2452.

	// PSTATE.IL is set to zero upon any exception to AArch64
	// See ARM DDI 0487E.a, page D1-2306.

	// PSTATE.SSBS is set to SCTLR_ELx.DSSBS upon any exception to AArch64
	// See ARM DDI 0487E.a, page D13-3258
	if (sctlr & SCTLR_ELx_DSSBS)
		new |= PSR_SSBS_BIT;

	// PSTATE.BTYPE is set to zero upon any exception to AArch64
	// See ARM DDI 0487E.a, pages D1-2293 to D1-2294.

	new |= PSR_D_BIT;
	new |= PSR_A_BIT;
	new |= PSR_I_BIT;
	new |= PSR_F_BIT;

	new |= target_mode;

	*vcpu_cpsr(vcpu) = new;
	vcpu_write_spsr(vcpu, old);
}

static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr)
{
	unsigned long cpsr = *vcpu_cpsr(vcpu);
	bool is_aarch32 = vcpu_mode_is_32bit(vcpu);
	u32 esr = 0;

	enter_exception64(vcpu, PSR_MODE_EL1h, except_type_sync);

	vcpu_write_sys_reg(vcpu, addr, FAR_EL1);

	/*
	 * Build an {i,d}abort, depending on the level and the
	 * instruction set. Report an external synchronous abort.
	 */
	if (kvm_vcpu_trap_il_is32bit(vcpu))
		esr |= ESR_ELx_IL;

	/*
	 * Here, the guest runs in AArch64 mode when in EL1. If we get
	 * an AArch32 fault, it means we managed to trap an EL0 fault.
	 */
	if (is_aarch32 || (cpsr & PSR_MODE_MASK) == PSR_MODE_EL0t)
		esr |= (ESR_ELx_EC_IABT_LOW << ESR_ELx_EC_SHIFT);
	else
		esr |= (ESR_ELx_EC_IABT_CUR << ESR_ELx_EC_SHIFT);

	if (!is_iabt)
		esr |= ESR_ELx_EC_DABT_LOW << ESR_ELx_EC_SHIFT;

	vcpu_write_sys_reg(vcpu, esr | ESR_ELx_FSC_EXTABT, ESR_EL1);
}

static void inject_undef64(struct kvm_vcpu *vcpu)
{
	u32 esr = (ESR_ELx_EC_UNKNOWN << ESR_ELx_EC_SHIFT);

	enter_exception64(vcpu, PSR_MODE_EL1h, except_type_sync);

	/*
	 * Build an unknown exception, depending on the instruction
	 * set.
	 */
	if (kvm_vcpu_trap_il_is32bit(vcpu))
		esr |= ESR_ELx_IL;

	vcpu_write_sys_reg(vcpu, esr, ESR_EL1);
}

/**
 * kvm_inject_dabt - inject a data abort into the guest
 * @vcpu: The VCPU to receive the data abort
 * @addr: The address to report in the DFAR
 *
 * It is assumed that this code is called from the VCPU thread and that the
 * VCPU therefore is not currently executing guest code.
 */
void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr)
{
	if (vcpu_el1_is_32bit(vcpu))
		kvm_inject_dabt32(vcpu, addr);
	else
		inject_abt64(vcpu, false, addr);
}

/**
 * kvm_inject_pabt - inject a prefetch abort into the guest
 * @vcpu: The VCPU to receive the prefetch abort
 * @addr: The address to report in the DFAR
 *
 * It is assumed that this code is called from the VCPU thread and that the
 * VCPU therefore is not currently executing guest code.
 */
void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr)
{
	if (vcpu_el1_is_32bit(vcpu))
		kvm_inject_pabt32(vcpu, addr);
	else
		inject_abt64(vcpu, true, addr);
}

/**
 * kvm_inject_undefined - inject an undefined instruction into the guest
 *
 * It is assumed that this code is called from the VCPU thread and that the
 * VCPU therefore is not currently executing guest code.
 */
void kvm_inject_undefined(struct kvm_vcpu *vcpu)
{
	if (vcpu_el1_is_32bit(vcpu))
		kvm_inject_undef32(vcpu);
	else
		inject_undef64(vcpu);
}

void kvm_set_sei_esr(struct kvm_vcpu *vcpu, u64 esr)
{
	vcpu_set_vsesr(vcpu, esr & ESR_ELx_ISS_MASK);
	*vcpu_hcr(vcpu) |= HCR_VSE;
}

/**
 * kvm_inject_vabt - inject an async abort / SError into the guest
 * @vcpu: The VCPU to receive the exception
 *
 * It is assumed that this code is called from the VCPU thread and that the
 * VCPU therefore is not currently executing guest code.
 *
 * Systems with the RAS Extensions specify an imp-def ESR (ISV/IDS = 1) with
 * the remaining ISS all-zeros so that this error is not interpreted as an
 * uncategorized RAS error. Without the RAS Extensions we can't specify an ESR
 * value, so the CPU generates an imp-def value.
 */
void kvm_inject_vabt(struct kvm_vcpu *vcpu)
{
	kvm_set_sei_esr(vcpu, ESR_ELx_ISV);
}
Commit	Line	Data
caab277b	1	// SPDX-License-Identifier: GPL-2.0-only
aa8eff9b	2	/*
e82e0305	3	* Fault injection for both 32 and 64bit guests.
aa8eff9b MZ	4	*
	5	* Copyright (C) 2012,2013 - ARM Ltd
	6	* Author: Marc Zyngier <marc.zyngier@arm.com>
	7	*
	8	* Based on arch/arm/kvm/emulate.c
	9	* Copyright (C) 2012 - Virtual Open Systems and Columbia University
	10	* Author: Christoffer Dall <c.dall@virtualopensystems.com>
aa8eff9b MZ	11	*/
	12
	13	#include <linux/kvm_host.h>
	14	#include <asm/kvm_emulate.h>
	15	#include <asm/esr.h>
	16
8fc153cd MZ	17	#define CURRENT_EL_SP_EL0_VECTOR 0x0
	18	#define CURRENT_EL_SP_ELx_VECTOR 0x200
	19	#define LOWER_EL_AArch64_VECTOR 0x400
	20	#define LOWER_EL_AArch32_VECTOR 0x600
aa8eff9b	21
8fc153cd MZ	22	enum exception_type {
	23	except_type_sync = 0,
	24	except_type_irq = 0x80,
	25	except_type_fiq = 0x100,
	26	except_type_serror = 0x180,
	27	};
	28
a425372e	29	/*
d9d7d84d MZ	30	* This performs the exception entry at a given EL (@target_mode), stashing PC
	31	* and PSTATE into ELR and SPSR respectively, and compute the new PC/PSTATE.
	32	* The EL passed to this function must be a non-secure, privileged mode with
	33	* bit 0 being set (PSTATE.SP == 1).
	34	*
a425372e MR	35	* When an exception is taken, most PSTATE fields are left unchanged in the
	36	* handler. However, some are explicitly overridden (e.g. M[4:0]). Luckily all
	37	* of the inherited bits have the same position in the AArch64/AArch32 SPSR_ELx
	38	* layouts, so we don't need to shuffle these for exceptions from AArch32 EL0.
	39	*
	40	* For the SPSR_ELx layout for AArch64, see ARM DDI 0487E.a page C5-429.
	41	* For the SPSR_ELx layout for AArch32, see ARM DDI 0487E.a page C5-426.
	42	*
	43	* Here we manipulate the fields in order of the AArch64 SPSR_ELx layout, from
	44	* MSB to LSB.
	45	*/
d9d7d84d MZ	46	static void enter_exception64(struct kvm_vcpu *vcpu, unsigned long target_mode,
d9d7d84d MZ	47	enum exception_type type)
a425372e	48	{
d9d7d84d MZ	49	unsigned long sctlr, vbar, old, new, mode;
	50	u64 exc_offset;
	51
	52	mode = *vcpu_cpsr(vcpu) & (PSR_MODE_MASK \| PSR_MODE32_BIT);
	53
	54	if (mode == target_mode)
	55	exc_offset = CURRENT_EL_SP_ELx_VECTOR;
	56	else if ((mode \| PSR_MODE_THREAD_BIT) == target_mode)
	57	exc_offset = CURRENT_EL_SP_EL0_VECTOR;
	58	else if (!(mode & PSR_MODE32_BIT))
	59	exc_offset = LOWER_EL_AArch64_VECTOR;
	60	else
	61	exc_offset = LOWER_EL_AArch32_VECTOR;
	62
	63	switch (target_mode) {
	64	case PSR_MODE_EL1h:
	65	vbar = vcpu_read_sys_reg(vcpu, VBAR_EL1);
	66	sctlr = vcpu_read_sys_reg(vcpu, SCTLR_EL1);
98909e6d	67	vcpu_write_sys_reg(vcpu, *vcpu_pc(vcpu), ELR_EL1);
d9d7d84d MZ	68	break;
	69	default:
	70	/* Don't do that */
	71	BUG();
	72	}
	73
	74	*vcpu_pc(vcpu) = vbar + exc_offset + type;
a425372e MR	75
	76	old = *vcpu_cpsr(vcpu);
	77	new = 0;
	78
	79	new \|= (old & PSR_N_BIT);
	80	new \|= (old & PSR_Z_BIT);
	81	new \|= (old & PSR_C_BIT);
	82	new \|= (old & PSR_V_BIT);
	83
	84	// TODO: TCO (if/when ARMv8.5-MemTag is exposed to guests)
	85
	86	new \|= (old & PSR_DIT_BIT);
	87
	88	// PSTATE.UAO is set to zero upon any exception to AArch64
	89	// See ARM DDI 0487E.a, page D5-2579.
	90
	91	// PSTATE.PAN is unchanged unless SCTLR_ELx.SPAN == 0b0
	92	// SCTLR_ELx.SPAN is RES1 when ARMv8.1-PAN is not implemented
	93	// See ARM DDI 0487E.a, page D5-2578.
	94	new \|= (old & PSR_PAN_BIT);
	95	if (!(sctlr & SCTLR_EL1_SPAN))
	96	new \|= PSR_PAN_BIT;
	97
	98	// PSTATE.SS is set to zero upon any exception to AArch64
	99	// See ARM DDI 0487E.a, page D2-2452.
	100
	101	// PSTATE.IL is set to zero upon any exception to AArch64
	102	// See ARM DDI 0487E.a, page D1-2306.
	103
	104	// PSTATE.SSBS is set to SCTLR_ELx.DSSBS upon any exception to AArch64
	105	// See ARM DDI 0487E.a, page D13-3258
	106	if (sctlr & SCTLR_ELx_DSSBS)
	107	new \|= PSR_SSBS_BIT;
	108
	109	// PSTATE.BTYPE is set to zero upon any exception to AArch64
	110	// See ARM DDI 0487E.a, pages D1-2293 to D1-2294.
	111
	112	new \|= PSR_D_BIT;
	113	new \|= PSR_A_BIT;
	114	new \|= PSR_I_BIT;
	115	new \|= PSR_F_BIT;
	116
d9d7d84d	117	new \|= target_mode;
a425372e	118
d9d7d84d MZ	119	*vcpu_cpsr(vcpu) = new;
d9d7d84d MZ	120	vcpu_write_spsr(vcpu, old);
a425372e MR	121	}
a425372e MR	122
aa8eff9b MZ	123	static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr)
	124	{
	125	unsigned long cpsr = *vcpu_cpsr(vcpu);
89581f06	126	bool is_aarch32 = vcpu_mode_is_32bit(vcpu);
aa8eff9b MZ	127	u32 esr = 0;
aa8eff9b MZ	128
d9d7d84d	129	enter_exception64(vcpu, PSR_MODE_EL1h, except_type_sync);
aa8eff9b	130
8d404c4c	131	vcpu_write_sys_reg(vcpu, addr, FAR_EL1);
aa8eff9b MZ	132
	133	/*
	134	* Build an {i,d}abort, depending on the level and the
	135	* instruction set. Report an external synchronous abort.
	136	*/
	137	if (kvm_vcpu_trap_il_is32bit(vcpu))
c6d01a94	138	esr \|= ESR_ELx_IL;
aa8eff9b MZ	139
	140	/*
	141	* Here, the guest runs in AArch64 mode when in EL1. If we get
	142	* an AArch32 fault, it means we managed to trap an EL0 fault.
	143	*/
	144	if (is_aarch32 \|\| (cpsr & PSR_MODE_MASK) == PSR_MODE_EL0t)
c6d01a94	145	esr \|= (ESR_ELx_EC_IABT_LOW << ESR_ELx_EC_SHIFT);
aa8eff9b	146	else
c6d01a94	147	esr \|= (ESR_ELx_EC_IABT_CUR << ESR_ELx_EC_SHIFT);
aa8eff9b MZ	148
aa8eff9b MZ	149	if (!is_iabt)
e4fe9e7d	150	esr \|= ESR_ELx_EC_DABT_LOW << ESR_ELx_EC_SHIFT;
aa8eff9b	151
8d404c4c	152	vcpu_write_sys_reg(vcpu, esr \| ESR_ELx_FSC_EXTABT, ESR_EL1);
aa8eff9b MZ	153	}
	154
	155	static void inject_undef64(struct kvm_vcpu *vcpu)
	156	{
c6d01a94	157	u32 esr = (ESR_ELx_EC_UNKNOWN << ESR_ELx_EC_SHIFT);
aa8eff9b	158
d9d7d84d	159	enter_exception64(vcpu, PSR_MODE_EL1h, except_type_sync);
aa8eff9b MZ	160
	161	/*
	162	* Build an unknown exception, depending on the instruction
	163	* set.
	164	*/
	165	if (kvm_vcpu_trap_il_is32bit(vcpu))
c6d01a94	166	esr \|= ESR_ELx_IL;
aa8eff9b	167
8d404c4c	168	vcpu_write_sys_reg(vcpu, esr, ESR_EL1);
aa8eff9b MZ	169	}
	170
	171	/**
	172	* kvm_inject_dabt - inject a data abort into the guest
da345174	173	* @vcpu: The VCPU to receive the data abort
aa8eff9b MZ	174	* @addr: The address to report in the DFAR
	175	*
	176	* It is assumed that this code is called from the VCPU thread and that the
	177	* VCPU therefore is not currently executing guest code.
	178	*/
	179	void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr)
	180	{
e72341c5	181	if (vcpu_el1_is_32bit(vcpu))
74a64a98	182	kvm_inject_dabt32(vcpu, addr);
126c69a0 MZ	183	else
126c69a0 MZ	184	inject_abt64(vcpu, false, addr);
aa8eff9b MZ	185	}
	186
	187	/**
	188	* kvm_inject_pabt - inject a prefetch abort into the guest
da345174	189	* @vcpu: The VCPU to receive the prefetch abort
aa8eff9b MZ	190	* @addr: The address to report in the DFAR
	191	*
	192	* It is assumed that this code is called from the VCPU thread and that the
	193	* VCPU therefore is not currently executing guest code.
	194	*/
	195	void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr)
	196	{
e72341c5	197	if (vcpu_el1_is_32bit(vcpu))
74a64a98	198	kvm_inject_pabt32(vcpu, addr);
126c69a0 MZ	199	else
126c69a0 MZ	200	inject_abt64(vcpu, true, addr);
aa8eff9b MZ	201	}
	202
	203	/**
	204	* kvm_inject_undefined - inject an undefined instruction into the guest
	205	*
	206	* It is assumed that this code is called from the VCPU thread and that the
	207	* VCPU therefore is not currently executing guest code.
	208	*/
	209	void kvm_inject_undefined(struct kvm_vcpu *vcpu)
	210	{
e72341c5	211	if (vcpu_el1_is_32bit(vcpu))
74a64a98	212	kvm_inject_undef32(vcpu);
126c69a0 MZ	213	else
126c69a0 MZ	214	inject_undef64(vcpu);
aa8eff9b	215	}
10cf3390	216
b7b27fac	217	void kvm_set_sei_esr(struct kvm_vcpu *vcpu, u64 esr)
4715c14b	218	{
b7b27fac	219	vcpu_set_vsesr(vcpu, esr & ESR_ELx_ISS_MASK);
3df59d8d	220	*vcpu_hcr(vcpu) \|= HCR_VSE;
4715c14b JM	221	}
4715c14b JM	222
10cf3390 MZ	223	/**
	224	* kvm_inject_vabt - inject an async abort / SError into the guest
	225	* @vcpu: The VCPU to receive the exception
	226	*
	227	* It is assumed that this code is called from the VCPU thread and that the
	228	* VCPU therefore is not currently executing guest code.
4715c14b JM	229	*
	230	* Systems with the RAS Extensions specify an imp-def ESR (ISV/IDS = 1) with
	231	* the remaining ISS all-zeros so that this error is not interpreted as an
	232	* uncategorized RAS error. Without the RAS Extensions we can't specify an ESR
	233	* value, so the CPU generates an imp-def value.
10cf3390 MZ	234	*/
	235	void kvm_inject_vabt(struct kvm_vcpu *vcpu)
	236	{
b7b27fac	237	kvm_set_sei_esr(vcpu, ESR_ELx_ISV);
10cf3390	238	}