1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2012 - ARM Ltd
4 * Author: Marc Zyngier <marc.zyngier@arm.com>
5 */
6
7 #include <linux/arm-smccc.h>
8 #include <linux/preempt.h>
9 #include <linux/kvm_host.h>
10 #include <linux/uaccess.h>
11 #include <linux/wait.h>
12
13 #include <asm/cputype.h>
14 #include <asm/kvm_emulate.h>
15
16 #include <kvm/arm_psci.h>
17 #include <kvm/arm_hypercalls.h>
18
19 /*
20 * This is an implementation of the Power State Coordination Interface
21 * as described in ARM document number ARM DEN 0022A.
22 */
23
24 #define AFFINITY_MASK(level) ~((0x1UL << ((level) * MPIDR_LEVEL_BITS)) - 1)
25
psci_affinity_mask(unsigned long affinity_level)26 static unsigned long psci_affinity_mask(unsigned long affinity_level)
27 {
28 if (affinity_level <= 3)
29 return MPIDR_HWID_BITMASK & AFFINITY_MASK(affinity_level);
30
31 return 0;
32 }
33
kvm_psci_vcpu_suspend(struct kvm_vcpu * vcpu)34 static unsigned long kvm_psci_vcpu_suspend(struct kvm_vcpu *vcpu)
35 {
36 /*
37 * NOTE: For simplicity, we make VCPU suspend emulation to be
38 * same-as WFI (Wait-for-interrupt) emulation.
39 *
40 * This means for KVM the wakeup events are interrupts and
41 * this is consistent with intended use of StateID as described
42 * in section 5.4.1 of PSCI v0.2 specification (ARM DEN 0022A).
43 *
44 * Further, we also treat power-down request to be same as
45 * stand-by request as-per section 5.4.2 clause 3 of PSCI v0.2
46 * specification (ARM DEN 0022A). This means all suspend states
47 * for KVM will preserve the register state.
48 */
49 kvm_vcpu_block(vcpu);
50 kvm_clear_request(KVM_REQ_UNHALT, vcpu);
51
52 return PSCI_RET_SUCCESS;
53 }
54
kvm_psci_vcpu_off(struct kvm_vcpu * vcpu)55 static void kvm_psci_vcpu_off(struct kvm_vcpu *vcpu)
56 {
57 vcpu->arch.power_off = true;
58 kvm_make_request(KVM_REQ_SLEEP, vcpu);
59 kvm_vcpu_kick(vcpu);
60 }
61
kvm_psci_vcpu_on(struct kvm_vcpu * source_vcpu)62 static unsigned long kvm_psci_vcpu_on(struct kvm_vcpu *source_vcpu)
63 {
64 struct vcpu_reset_state *reset_state;
65 struct kvm *kvm = source_vcpu->kvm;
66 struct kvm_vcpu *vcpu = NULL;
67 unsigned long cpu_id;
68
69 cpu_id = smccc_get_arg1(source_vcpu) & MPIDR_HWID_BITMASK;
70 if (vcpu_mode_is_32bit(source_vcpu))
71 cpu_id &= ~((u32) 0);
72
73 vcpu = kvm_mpidr_to_vcpu(kvm, cpu_id);
74
75 /*
76 * Make sure the caller requested a valid CPU and that the CPU is
77 * turned off.
78 */
79 if (!vcpu)
80 return PSCI_RET_INVALID_PARAMS;
81 if (!vcpu->arch.power_off) {
82 if (kvm_psci_version(source_vcpu, kvm) != KVM_ARM_PSCI_0_1)
83 return PSCI_RET_ALREADY_ON;
84 else
85 return PSCI_RET_INVALID_PARAMS;
86 }
87
88 reset_state = &vcpu->arch.reset_state;
89
90 reset_state->pc = smccc_get_arg2(source_vcpu);
91
92 /* Propagate caller endianness */
93 reset_state->be = kvm_vcpu_is_be(source_vcpu);
94
95 /*
96 * NOTE: We always update r0 (or x0) because for PSCI v0.1
97 * the general purpose registers are undefined upon CPU_ON.
98 */
99 reset_state->r0 = smccc_get_arg3(source_vcpu);
100
101 WRITE_ONCE(reset_state->reset, true);
102 kvm_make_request(KVM_REQ_VCPU_RESET, vcpu);
103
104 /*
105 * Make sure the reset request is observed if the change to
106 * power_state is observed.
107 */
108 smp_wmb();
109
110 vcpu->arch.power_off = false;
111 kvm_vcpu_wake_up(vcpu);
112
113 return PSCI_RET_SUCCESS;
114 }
115
kvm_psci_vcpu_affinity_info(struct kvm_vcpu * vcpu)116 static unsigned long kvm_psci_vcpu_affinity_info(struct kvm_vcpu *vcpu)
117 {
118 int i, matching_cpus = 0;
119 unsigned long mpidr;
120 unsigned long target_affinity;
121 unsigned long target_affinity_mask;
122 unsigned long lowest_affinity_level;
123 struct kvm *kvm = vcpu->kvm;
124 struct kvm_vcpu *tmp;
125
126 target_affinity = smccc_get_arg1(vcpu);
127 lowest_affinity_level = smccc_get_arg2(vcpu);
128
129 /* Determine target affinity mask */
130 target_affinity_mask = psci_affinity_mask(lowest_affinity_level);
131 if (!target_affinity_mask)
132 return PSCI_RET_INVALID_PARAMS;
133
134 /* Ignore other bits of target affinity */
135 target_affinity &= target_affinity_mask;
136
137 /*
138 * If one or more VCPU matching target affinity are running
139 * then ON else OFF
140 */
141 kvm_for_each_vcpu(i, tmp, kvm) {
142 mpidr = kvm_vcpu_get_mpidr_aff(tmp);
143 if ((mpidr & target_affinity_mask) == target_affinity) {
144 matching_cpus++;
145 if (!tmp->arch.power_off)
146 return PSCI_0_2_AFFINITY_LEVEL_ON;
147 }
148 }
149
150 if (!matching_cpus)
151 return PSCI_RET_INVALID_PARAMS;
152
153 return PSCI_0_2_AFFINITY_LEVEL_OFF;
154 }
155
kvm_prepare_system_event(struct kvm_vcpu * vcpu,u32 type)156 static void kvm_prepare_system_event(struct kvm_vcpu *vcpu, u32 type)
157 {
158 int i;
159 struct kvm_vcpu *tmp;
160
161 /*
162 * The KVM ABI specifies that a system event exit may call KVM_RUN
163 * again and may perform shutdown/reboot at a later time that when the
164 * actual request is made. Since we are implementing PSCI and a
165 * caller of PSCI reboot and shutdown expects that the system shuts
166 * down or reboots immediately, let's make sure that VCPUs are not run
167 * after this call is handled and before the VCPUs have been
168 * re-initialized.
169 */
170 kvm_for_each_vcpu(i, tmp, vcpu->kvm)
171 tmp->arch.power_off = true;
172 kvm_make_all_cpus_request(vcpu->kvm, KVM_REQ_SLEEP);
173
174 memset(&vcpu->run->system_event, 0, sizeof(vcpu->run->system_event));
175 vcpu->run->system_event.type = type;
176 vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT;
177 }
178
kvm_psci_system_off(struct kvm_vcpu * vcpu)179 static void kvm_psci_system_off(struct kvm_vcpu *vcpu)
180 {
181 kvm_prepare_system_event(vcpu, KVM_SYSTEM_EVENT_SHUTDOWN);
182 }
183
kvm_psci_system_reset(struct kvm_vcpu * vcpu)184 static void kvm_psci_system_reset(struct kvm_vcpu *vcpu)
185 {
186 kvm_prepare_system_event(vcpu, KVM_SYSTEM_EVENT_RESET);
187 }
188
kvm_psci_narrow_to_32bit(struct kvm_vcpu * vcpu)189 static void kvm_psci_narrow_to_32bit(struct kvm_vcpu *vcpu)
190 {
191 int i;
192
193 /*
194 * Zero the input registers' upper 32 bits. They will be fully
195 * zeroed on exit, so we're fine changing them in place.
196 */
197 for (i = 1; i < 4; i++)
198 vcpu_set_reg(vcpu, i, lower_32_bits(vcpu_get_reg(vcpu, i)));
199 }
200
kvm_psci_check_allowed_function(struct kvm_vcpu * vcpu,u32 fn)201 static unsigned long kvm_psci_check_allowed_function(struct kvm_vcpu *vcpu, u32 fn)
202 {
203 switch(fn) {
204 case PSCI_0_2_FN64_CPU_SUSPEND:
205 case PSCI_0_2_FN64_CPU_ON:
206 case PSCI_0_2_FN64_AFFINITY_INFO:
207 /* Disallow these functions for 32bit guests */
208 if (vcpu_mode_is_32bit(vcpu))
209 return PSCI_RET_NOT_SUPPORTED;
210 break;
211 }
212
213 return 0;
214 }
215
kvm_psci_0_2_call(struct kvm_vcpu * vcpu)216 static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu)
217 {
218 struct kvm *kvm = vcpu->kvm;
219 u32 psci_fn = smccc_get_function(vcpu);
220 unsigned long val;
221 int ret = 1;
222
223 val = kvm_psci_check_allowed_function(vcpu, psci_fn);
224 if (val)
225 goto out;
226
227 switch (psci_fn) {
228 case PSCI_0_2_FN_PSCI_VERSION:
229 /*
230 * Bits[31:16] = Major Version = 0
231 * Bits[15:0] = Minor Version = 2
232 */
233 val = KVM_ARM_PSCI_0_2;
234 break;
235 case PSCI_0_2_FN_CPU_SUSPEND:
236 case PSCI_0_2_FN64_CPU_SUSPEND:
237 val = kvm_psci_vcpu_suspend(vcpu);
238 break;
239 case PSCI_0_2_FN_CPU_OFF:
240 kvm_psci_vcpu_off(vcpu);
241 val = PSCI_RET_SUCCESS;
242 break;
243 case PSCI_0_2_FN_CPU_ON:
244 kvm_psci_narrow_to_32bit(vcpu);
245 fallthrough;
246 case PSCI_0_2_FN64_CPU_ON:
247 mutex_lock(&kvm->lock);
248 val = kvm_psci_vcpu_on(vcpu);
249 mutex_unlock(&kvm->lock);
250 break;
251 case PSCI_0_2_FN_AFFINITY_INFO:
252 kvm_psci_narrow_to_32bit(vcpu);
253 fallthrough;
254 case PSCI_0_2_FN64_AFFINITY_INFO:
255 val = kvm_psci_vcpu_affinity_info(vcpu);
256 break;
257 case PSCI_0_2_FN_MIGRATE_INFO_TYPE:
258 /*
259 * Trusted OS is MP hence does not require migration
260 * or
261 * Trusted OS is not present
262 */
263 val = PSCI_0_2_TOS_MP;
264 break;
265 case PSCI_0_2_FN_SYSTEM_OFF:
266 kvm_psci_system_off(vcpu);
267 /*
268 * We shouldn't be going back to guest VCPU after
269 * receiving SYSTEM_OFF request.
270 *
271 * If user space accidentally/deliberately resumes
272 * guest VCPU after SYSTEM_OFF request then guest
273 * VCPU should see internal failure from PSCI return
274 * value. To achieve this, we preload r0 (or x0) with
275 * PSCI return value INTERNAL_FAILURE.
276 */
277 val = PSCI_RET_INTERNAL_FAILURE;
278 ret = 0;
279 break;
280 case PSCI_0_2_FN_SYSTEM_RESET:
281 kvm_psci_system_reset(vcpu);
282 /*
283 * Same reason as SYSTEM_OFF for preloading r0 (or x0)
284 * with PSCI return value INTERNAL_FAILURE.
285 */
286 val = PSCI_RET_INTERNAL_FAILURE;
287 ret = 0;
288 break;
289 default:
290 val = PSCI_RET_NOT_SUPPORTED;
291 break;
292 }
293
294 out:
295 smccc_set_retval(vcpu, val, 0, 0, 0);
296 return ret;
297 }
298
kvm_psci_1_0_call(struct kvm_vcpu * vcpu)299 static int kvm_psci_1_0_call(struct kvm_vcpu *vcpu)
300 {
301 u32 psci_fn = smccc_get_function(vcpu);
302 u32 feature;
303 unsigned long val;
304 int ret = 1;
305
306 switch(psci_fn) {
307 case PSCI_0_2_FN_PSCI_VERSION:
308 val = KVM_ARM_PSCI_1_0;
309 break;
310 case PSCI_1_0_FN_PSCI_FEATURES:
311 feature = smccc_get_arg1(vcpu);
312 val = kvm_psci_check_allowed_function(vcpu, feature);
313 if (val)
314 break;
315
316 switch(feature) {
317 case PSCI_0_2_FN_PSCI_VERSION:
318 case PSCI_0_2_FN_CPU_SUSPEND:
319 case PSCI_0_2_FN64_CPU_SUSPEND:
320 case PSCI_0_2_FN_CPU_OFF:
321 case PSCI_0_2_FN_CPU_ON:
322 case PSCI_0_2_FN64_CPU_ON:
323 case PSCI_0_2_FN_AFFINITY_INFO:
324 case PSCI_0_2_FN64_AFFINITY_INFO:
325 case PSCI_0_2_FN_MIGRATE_INFO_TYPE:
326 case PSCI_0_2_FN_SYSTEM_OFF:
327 case PSCI_0_2_FN_SYSTEM_RESET:
328 case PSCI_1_0_FN_PSCI_FEATURES:
329 case ARM_SMCCC_VERSION_FUNC_ID:
330 val = 0;
331 break;
332 default:
333 val = PSCI_RET_NOT_SUPPORTED;
334 break;
335 }
336 break;
337 default:
338 return kvm_psci_0_2_call(vcpu);
339 }
340
341 smccc_set_retval(vcpu, val, 0, 0, 0);
342 return ret;
343 }
344
kvm_psci_0_1_call(struct kvm_vcpu * vcpu)345 static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu)
346 {
347 struct kvm *kvm = vcpu->kvm;
348 u32 psci_fn = smccc_get_function(vcpu);
349 unsigned long val;
350
351 switch (psci_fn) {
352 case KVM_PSCI_FN_CPU_OFF:
353 kvm_psci_vcpu_off(vcpu);
354 val = PSCI_RET_SUCCESS;
355 break;
356 case KVM_PSCI_FN_CPU_ON:
357 mutex_lock(&kvm->lock);
358 val = kvm_psci_vcpu_on(vcpu);
359 mutex_unlock(&kvm->lock);
360 break;
361 default:
362 val = PSCI_RET_NOT_SUPPORTED;
363 break;
364 }
365
366 smccc_set_retval(vcpu, val, 0, 0, 0);
367 return 1;
368 }
369
370 /**
371 * kvm_psci_call - handle PSCI call if r0 value is in range
372 * @vcpu: Pointer to the VCPU struct
373 *
374 * Handle PSCI calls from guests through traps from HVC instructions.
375 * The calling convention is similar to SMC calls to the secure world
376 * where the function number is placed in r0.
377 *
378 * This function returns: > 0 (success), 0 (success but exit to user
379 * space), and < 0 (errors)
380 *
381 * Errors:
382 * -EINVAL: Unrecognized PSCI function
383 */
kvm_psci_call(struct kvm_vcpu * vcpu)384 int kvm_psci_call(struct kvm_vcpu *vcpu)
385 {
386 switch (kvm_psci_version(vcpu, vcpu->kvm)) {
387 case KVM_ARM_PSCI_1_0:
388 return kvm_psci_1_0_call(vcpu);
389 case KVM_ARM_PSCI_0_2:
390 return kvm_psci_0_2_call(vcpu);
391 case KVM_ARM_PSCI_0_1:
392 return kvm_psci_0_1_call(vcpu);
393 default:
394 return -EINVAL;
395 };
396 }
397
kvm_arm_get_fw_num_regs(struct kvm_vcpu * vcpu)398 int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu)
399 {
400 return 3; /* PSCI version and two workaround registers */
401 }
402
kvm_arm_copy_fw_reg_indices(struct kvm_vcpu * vcpu,u64 __user * uindices)403 int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices)
404 {
405 if (put_user(KVM_REG_ARM_PSCI_VERSION, uindices++))
406 return -EFAULT;
407
408 if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1, uindices++))
409 return -EFAULT;
410
411 if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2, uindices++))
412 return -EFAULT;
413
414 return 0;
415 }
416
417 #define KVM_REG_FEATURE_LEVEL_WIDTH 4
418 #define KVM_REG_FEATURE_LEVEL_MASK (BIT(KVM_REG_FEATURE_LEVEL_WIDTH) - 1)
419
420 /*
421 * Convert the workaround level into an easy-to-compare number, where higher
422 * values mean better protection.
423 */
get_kernel_wa_level(u64 regid)424 static int get_kernel_wa_level(u64 regid)
425 {
426 switch (regid) {
427 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1:
428 switch (arm64_get_spectre_v2_state()) {
429 case SPECTRE_VULNERABLE:
430 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL;
431 case SPECTRE_MITIGATED:
432 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL;
433 case SPECTRE_UNAFFECTED:
434 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_REQUIRED;
435 }
436 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL;
437 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2:
438 switch (arm64_get_spectre_v4_state()) {
439 case SPECTRE_MITIGATED:
440 /*
441 * As for the hypercall discovery, we pretend we
442 * don't have any FW mitigation if SSBS is there at
443 * all times.
444 */
445 if (cpus_have_final_cap(ARM64_SSBS))
446 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL;
447 fallthrough;
448 case SPECTRE_UNAFFECTED:
449 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED;
450 case SPECTRE_VULNERABLE:
451 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL;
452 }
453 }
454
455 return -EINVAL;
456 }
457
kvm_arm_get_fw_reg(struct kvm_vcpu * vcpu,const struct kvm_one_reg * reg)458 int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
459 {
460 void __user *uaddr = (void __user *)(long)reg->addr;
461 u64 val;
462
463 switch (reg->id) {
464 case KVM_REG_ARM_PSCI_VERSION:
465 val = kvm_psci_version(vcpu, vcpu->kvm);
466 break;
467 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1:
468 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2:
469 val = get_kernel_wa_level(reg->id) & KVM_REG_FEATURE_LEVEL_MASK;
470 break;
471 default:
472 return -ENOENT;
473 }
474
475 if (copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)))
476 return -EFAULT;
477
478 return 0;
479 }
480
kvm_arm_set_fw_reg(struct kvm_vcpu * vcpu,const struct kvm_one_reg * reg)481 int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
482 {
483 void __user *uaddr = (void __user *)(long)reg->addr;
484 u64 val;
485 int wa_level;
486
487 if (copy_from_user(&val, uaddr, KVM_REG_SIZE(reg->id)))
488 return -EFAULT;
489
490 switch (reg->id) {
491 case KVM_REG_ARM_PSCI_VERSION:
492 {
493 bool wants_02;
494
495 wants_02 = test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features);
496
497 switch (val) {
498 case KVM_ARM_PSCI_0_1:
499 if (wants_02)
500 return -EINVAL;
501 vcpu->kvm->arch.psci_version = val;
502 return 0;
503 case KVM_ARM_PSCI_0_2:
504 case KVM_ARM_PSCI_1_0:
505 if (!wants_02)
506 return -EINVAL;
507 vcpu->kvm->arch.psci_version = val;
508 return 0;
509 }
510 break;
511 }
512
513 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1:
514 if (val & ~KVM_REG_FEATURE_LEVEL_MASK)
515 return -EINVAL;
516
517 if (get_kernel_wa_level(reg->id) < val)
518 return -EINVAL;
519
520 return 0;
521
522 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2:
523 if (val & ~(KVM_REG_FEATURE_LEVEL_MASK |
524 KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED))
525 return -EINVAL;
526
527 /* The enabled bit must not be set unless the level is AVAIL. */
528 if ((val & KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED) &&
529 (val & KVM_REG_FEATURE_LEVEL_MASK) != KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL)
530 return -EINVAL;
531
532 /*
533 * Map all the possible incoming states to the only two we
534 * really want to deal with.
535 */
536 switch (val & KVM_REG_FEATURE_LEVEL_MASK) {
537 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL:
538 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN:
539 wa_level = KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL;
540 break;
541 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL:
542 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED:
543 wa_level = KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED;
544 break;
545 default:
546 return -EINVAL;
547 }
548
549 /*
550 * We can deal with NOT_AVAIL on NOT_REQUIRED, but not the
551 * other way around.
552 */
553 if (get_kernel_wa_level(reg->id) < wa_level)
554 return -EINVAL;
555
556 return 0;
557 default:
558 return -ENOENT;
559 }
560
561 return -EINVAL;
562 }
563
