1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * Hosting Protected Virtual Machines
  4 *
  5 * Copyright IBM Corp. 2019, 2020
  6 *    Author(s): Janosch Frank <frankja@linux.ibm.com>
  7 */
  8#include <linux/kvm.h>
  9#include <linux/kvm_host.h>
 10#include <linux/pagemap.h>
 11#include <linux/sched/signal.h>
 12#include <asm/gmap.h>
 13#include <asm/uv.h>
 14#include <asm/mman.h>
 15#include "kvm-s390.h"
 16
 17int kvm_s390_pv_destroy_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc)
 18{
 19	int cc = 0;
 20
 21	if (kvm_s390_pv_cpu_get_handle(vcpu)) {
 22		cc = uv_cmd_nodata(kvm_s390_pv_cpu_get_handle(vcpu),
 23				   UVC_CMD_DESTROY_SEC_CPU, rc, rrc);
 24
 25		KVM_UV_EVENT(vcpu->kvm, 3,
 26			     "PROTVIRT DESTROY VCPU %d: rc %x rrc %x",
 27			     vcpu->vcpu_id, *rc, *rrc);
 28		WARN_ONCE(cc, "protvirt destroy cpu failed rc %x rrc %x",
 29			  *rc, *rrc);
 30	}
 31	/* Intended memory leak for something that should never happen. */
 32	if (!cc)
 33		free_pages(vcpu->arch.pv.stor_base,
 34			   get_order(uv_info.guest_cpu_stor_len));
 35
 36	free_page(sida_origin(vcpu->arch.sie_block));
 37	vcpu->arch.sie_block->pv_handle_cpu = 0;
 38	vcpu->arch.sie_block->pv_handle_config = 0;
 39	memset(&vcpu->arch.pv, 0, sizeof(vcpu->arch.pv));
 40	vcpu->arch.sie_block->sdf = 0;
 41	/*
 42	 * The sidad field (for sdf == 2) is now the gbea field (for sdf == 0).
 43	 * Use the reset value of gbea to avoid leaking the kernel pointer of
 44	 * the just freed sida.
 45	 */
 46	vcpu->arch.sie_block->gbea = 1;
 47	kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
 48
 49	return cc ? EIO : 0;
 50}
 51
 52int kvm_s390_pv_create_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc)
 53{
 54	struct uv_cb_csc uvcb = {
 55		.header.cmd = UVC_CMD_CREATE_SEC_CPU,
 56		.header.len = sizeof(uvcb),
 57	};
 58	int cc;
 59
 60	if (kvm_s390_pv_cpu_get_handle(vcpu))
 61		return -EINVAL;
 62
 63	vcpu->arch.pv.stor_base = __get_free_pages(GFP_KERNEL_ACCOUNT,
 64						   get_order(uv_info.guest_cpu_stor_len));
 65	if (!vcpu->arch.pv.stor_base)
 66		return -ENOMEM;
 67
 68	/* Input */
 69	uvcb.guest_handle = kvm_s390_pv_get_handle(vcpu->kvm);
 70	uvcb.num = vcpu->arch.sie_block->icpua;
 71	uvcb.state_origin = (u64)vcpu->arch.sie_block;
 72	uvcb.stor_origin = (u64)vcpu->arch.pv.stor_base;
 73
 74	/* Alloc Secure Instruction Data Area Designation */
 75	vcpu->arch.sie_block->sidad = __get_free_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
 76	if (!vcpu->arch.sie_block->sidad) {
 77		free_pages(vcpu->arch.pv.stor_base,
 78			   get_order(uv_info.guest_cpu_stor_len));
 79		return -ENOMEM;
 80	}
 81
 82	cc = uv_call(0, (u64)&uvcb);
 83	*rc = uvcb.header.rc;
 84	*rrc = uvcb.header.rrc;
 85	KVM_UV_EVENT(vcpu->kvm, 3,
 86		     "PROTVIRT CREATE VCPU: cpu %d handle %llx rc %x rrc %x",
 87		     vcpu->vcpu_id, uvcb.cpu_handle, uvcb.header.rc,
 88		     uvcb.header.rrc);
 89
 90	if (cc) {
 91		u16 dummy;
 92
 93		kvm_s390_pv_destroy_cpu(vcpu, &dummy, &dummy);
 94		return -EIO;
 95	}
 96
 97	/* Output */
 98	vcpu->arch.pv.handle = uvcb.cpu_handle;
 99	vcpu->arch.sie_block->pv_handle_cpu = uvcb.cpu_handle;
100	vcpu->arch.sie_block->pv_handle_config = kvm_s390_pv_get_handle(vcpu->kvm);
101	vcpu->arch.sie_block->sdf = 2;
102	kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
103	return 0;
104}
105
106/* only free resources when the destroy was successful */
107static void kvm_s390_pv_dealloc_vm(struct kvm *kvm)
108{
109	vfree(kvm->arch.pv.stor_var);
110	free_pages(kvm->arch.pv.stor_base,
111		   get_order(uv_info.guest_base_stor_len));
112	memset(&kvm->arch.pv, 0, sizeof(kvm->arch.pv));
113}
114
115static int kvm_s390_pv_alloc_vm(struct kvm *kvm)
116{
117	unsigned long base = uv_info.guest_base_stor_len;
118	unsigned long virt = uv_info.guest_virt_var_stor_len;
119	unsigned long npages = 0, vlen = 0;
120	struct kvm_memory_slot *memslot;
121
122	kvm->arch.pv.stor_var = NULL;
123	kvm->arch.pv.stor_base = __get_free_pages(GFP_KERNEL_ACCOUNT, get_order(base));
124	if (!kvm->arch.pv.stor_base)
125		return -ENOMEM;
126
127	/*
128	 * Calculate current guest storage for allocation of the
129	 * variable storage, which is based on the length in MB.
130	 *
131	 * Slots are sorted by GFN
132	 */
133	mutex_lock(&kvm->slots_lock);
134	memslot = kvm_memslots(kvm)->memslots;
135	npages = memslot->base_gfn + memslot->npages;
136	mutex_unlock(&kvm->slots_lock);
137
138	kvm->arch.pv.guest_len = npages * PAGE_SIZE;
139
140	/* Allocate variable storage */
141	vlen = ALIGN(virt * ((npages * PAGE_SIZE) / HPAGE_SIZE), PAGE_SIZE);
142	vlen += uv_info.guest_virt_base_stor_len;
143	/*
144	 * The Create Secure Configuration Ultravisor Call does not support
145	 * using large pages for the virtual memory area.
146	 * This is a hardware limitation.
147	 */
148	kvm->arch.pv.stor_var = vmalloc_no_huge(vlen);
149	if (!kvm->arch.pv.stor_var)
150		goto out_err;
151	return 0;
152
153out_err:
154	kvm_s390_pv_dealloc_vm(kvm);
155	return -ENOMEM;
156}
157
158/* this should not fail, but if it does, we must not free the donated memory */
159int kvm_s390_pv_deinit_vm(struct kvm *kvm, u16 *rc, u16 *rrc)
160{
161	int cc;
162
163	/* make all pages accessible before destroying the guest */
164	s390_reset_acc(kvm->mm);
165
166	cc = uv_cmd_nodata(kvm_s390_pv_get_handle(kvm),
167			   UVC_CMD_DESTROY_SEC_CONF, rc, rrc);
168	WRITE_ONCE(kvm->arch.gmap->guest_handle, 0);
169	atomic_set(&kvm->mm->context.is_protected, 0);
170	KVM_UV_EVENT(kvm, 3, "PROTVIRT DESTROY VM: rc %x rrc %x", *rc, *rrc);
171	WARN_ONCE(cc, "protvirt destroy vm failed rc %x rrc %x", *rc, *rrc);
172	/* Inteded memory leak on "impossible" error */
173	if (!cc)
174		kvm_s390_pv_dealloc_vm(kvm);
175	return cc ? -EIO : 0;
176}
177
178int kvm_s390_pv_init_vm(struct kvm *kvm, u16 *rc, u16 *rrc)
179{
180	struct uv_cb_cgc uvcb = {
181		.header.cmd = UVC_CMD_CREATE_SEC_CONF,
182		.header.len = sizeof(uvcb)
183	};
184	int cc, ret;
185	u16 dummy;
186
187	ret = kvm_s390_pv_alloc_vm(kvm);
188	if (ret)
189		return ret;
190
191	/* Inputs */
192	uvcb.guest_stor_origin = 0; /* MSO is 0 for KVM */
193	uvcb.guest_stor_len = kvm->arch.pv.guest_len;
194	uvcb.guest_asce = kvm->arch.gmap->asce;
195	uvcb.guest_sca = (unsigned long)kvm->arch.sca;
196	uvcb.conf_base_stor_origin = (u64)kvm->arch.pv.stor_base;
197	uvcb.conf_virt_stor_origin = (u64)kvm->arch.pv.stor_var;
198
199	cc = uv_call(0, (u64)&uvcb);
200	*rc = uvcb.header.rc;
201	*rrc = uvcb.header.rrc;
202	KVM_UV_EVENT(kvm, 3, "PROTVIRT CREATE VM: handle %llx len %llx rc %x rrc %x",
203		     uvcb.guest_handle, uvcb.guest_stor_len, *rc, *rrc);
204
205	/* Outputs */
206	kvm->arch.pv.handle = uvcb.guest_handle;
207
208	if (cc) {
209		if (uvcb.header.rc & UVC_RC_NEED_DESTROY)
210			kvm_s390_pv_deinit_vm(kvm, &dummy, &dummy);
211		else
212			kvm_s390_pv_dealloc_vm(kvm);
213		return -EIO;
214	}
215	kvm->arch.gmap->guest_handle = uvcb.guest_handle;
216	return 0;
217}
218
219int kvm_s390_pv_set_sec_parms(struct kvm *kvm, void *hdr, u64 length, u16 *rc,
220			      u16 *rrc)
221{
222	struct uv_cb_ssc uvcb = {
223		.header.cmd = UVC_CMD_SET_SEC_CONF_PARAMS,
224		.header.len = sizeof(uvcb),
225		.sec_header_origin = (u64)hdr,
226		.sec_header_len = length,
227		.guest_handle = kvm_s390_pv_get_handle(kvm),
228	};
229	int cc = uv_call(0, (u64)&uvcb);
230
231	*rc = uvcb.header.rc;
232	*rrc = uvcb.header.rrc;
233	KVM_UV_EVENT(kvm, 3, "PROTVIRT VM SET PARMS: rc %x rrc %x",
234		     *rc, *rrc);
235	if (!cc)
236		atomic_set(&kvm->mm->context.is_protected, 1);
237	return cc ? -EINVAL : 0;
238}
239
240static int unpack_one(struct kvm *kvm, unsigned long addr, u64 tweak,
241		      u64 offset, u16 *rc, u16 *rrc)
242{
243	struct uv_cb_unp uvcb = {
244		.header.cmd = UVC_CMD_UNPACK_IMG,
245		.header.len = sizeof(uvcb),
246		.guest_handle = kvm_s390_pv_get_handle(kvm),
247		.gaddr = addr,
248		.tweak[0] = tweak,
249		.tweak[1] = offset,
250	};
251	int ret = gmap_make_secure(kvm->arch.gmap, addr, &uvcb);
252
253	*rc = uvcb.header.rc;
254	*rrc = uvcb.header.rrc;
255
256	if (ret && ret != -EAGAIN)
257		KVM_UV_EVENT(kvm, 3, "PROTVIRT VM UNPACK: failed addr %llx with rc %x rrc %x",
258			     uvcb.gaddr, *rc, *rrc);
259	return ret;
260}
261
262int kvm_s390_pv_unpack(struct kvm *kvm, unsigned long addr, unsigned long size,
263		       unsigned long tweak, u16 *rc, u16 *rrc)
264{
265	u64 offset = 0;
266	int ret = 0;
267
268	if (addr & ~PAGE_MASK || !size || size & ~PAGE_MASK)
269		return -EINVAL;
270
271	KVM_UV_EVENT(kvm, 3, "PROTVIRT VM UNPACK: start addr %lx size %lx",
272		     addr, size);
273
274	while (offset < size) {
275		ret = unpack_one(kvm, addr, tweak, offset, rc, rrc);
276		if (ret == -EAGAIN) {
277			cond_resched();
278			if (fatal_signal_pending(current))
279				break;
280			continue;
281		}
282		if (ret)
283			break;
284		addr += PAGE_SIZE;
285		offset += PAGE_SIZE;
286	}
287	if (!ret)
288		KVM_UV_EVENT(kvm, 3, "%s", "PROTVIRT VM UNPACK: successful");
289	return ret;
290}
291
292int kvm_s390_pv_set_cpu_state(struct kvm_vcpu *vcpu, u8 state)
293{
294	struct uv_cb_cpu_set_state uvcb = {
295		.header.cmd	= UVC_CMD_CPU_SET_STATE,
296		.header.len	= sizeof(uvcb),
297		.cpu_handle	= kvm_s390_pv_cpu_get_handle(vcpu),
298		.state		= state,
299	};
300	int cc;
301
302	cc = uv_call(0, (u64)&uvcb);
303	KVM_UV_EVENT(vcpu->kvm, 3, "PROTVIRT SET CPU %d STATE %d rc %x rrc %x",
304		     vcpu->vcpu_id, state, uvcb.header.rc, uvcb.header.rrc);
305	if (cc)
306		return -EINVAL;
307	return 0;
308}