1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (C) 2012 - ARM Ltd
4 * Author: Marc Zyngier <marc.zyngier@arm.com>
7 #include <linux/arm-smccc.h>
8 #include <linux/preempt.h>
9 #include <linux/kvm_host.h>
10 #include <linux/uaccess.h>
11 #include <linux/wait.h>
13 #include <asm/cputype.h>
14 #include <asm/kvm_emulate.h>
16 #include <kvm/arm_psci.h>
17 #include <kvm/arm_hypercalls.h>
20 * This is an implementation of the Power State Coordination Interface
21 * as described in ARM document number ARM DEN 0022A.
24 #define AFFINITY_MASK(level) ~((0x1UL << ((level) * MPIDR_LEVEL_BITS)) - 1)
26 static unsigned long psci_affinity_mask(unsigned long affinity_level)
28 if (affinity_level <= 3)
29 return MPIDR_HWID_BITMASK & AFFINITY_MASK(affinity_level);
34 static unsigned long kvm_psci_vcpu_suspend(struct kvm_vcpu *vcpu)
37 * NOTE: For simplicity, we make VCPU suspend emulation to be
38 * same-as WFI (Wait-for-interrupt) emulation.
40 * This means for KVM the wakeup events are interrupts and
41 * this is consistent with intended use of StateID as described
42 * in section 5.4.1 of PSCI v0.2 specification (ARM DEN 0022A).
44 * Further, we also treat power-down request to be same as
45 * stand-by request as-per section 5.4.2 clause 3 of PSCI v0.2
46 * specification (ARM DEN 0022A). This means all suspend states
47 * for KVM will preserve the register state.
51 return PSCI_RET_SUCCESS;
54 static void kvm_psci_vcpu_off(struct kvm_vcpu *vcpu)
56 vcpu->arch.power_off = true;
57 kvm_make_request(KVM_REQ_SLEEP, vcpu);
61 static inline bool kvm_psci_valid_affinity(struct kvm_vcpu *vcpu,
62 unsigned long affinity)
64 return !(affinity & ~MPIDR_HWID_BITMASK);
67 static unsigned long kvm_psci_vcpu_on(struct kvm_vcpu *source_vcpu)
69 struct vcpu_reset_state *reset_state;
70 struct kvm *kvm = source_vcpu->kvm;
71 struct kvm_vcpu *vcpu = NULL;
74 cpu_id = smccc_get_arg1(source_vcpu);
75 if (!kvm_psci_valid_affinity(source_vcpu, cpu_id))
76 return PSCI_RET_INVALID_PARAMS;
78 vcpu = kvm_mpidr_to_vcpu(kvm, cpu_id);
81 * Make sure the caller requested a valid CPU and that the CPU is
85 return PSCI_RET_INVALID_PARAMS;
86 if (!vcpu->arch.power_off) {
87 if (kvm_psci_version(source_vcpu) != KVM_ARM_PSCI_0_1)
88 return PSCI_RET_ALREADY_ON;
90 return PSCI_RET_INVALID_PARAMS;
93 reset_state = &vcpu->arch.reset_state;
95 reset_state->pc = smccc_get_arg2(source_vcpu);
97 /* Propagate caller endianness */
98 reset_state->be = kvm_vcpu_is_be(source_vcpu);
101 * NOTE: We always update r0 (or x0) because for PSCI v0.1
102 * the general purpose registers are undefined upon CPU_ON.
104 reset_state->r0 = smccc_get_arg3(source_vcpu);
106 WRITE_ONCE(reset_state->reset, true);
107 kvm_make_request(KVM_REQ_VCPU_RESET, vcpu);
110 * Make sure the reset request is observed if the change to
111 * power_off is observed.
115 vcpu->arch.power_off = false;
116 kvm_vcpu_wake_up(vcpu);
118 return PSCI_RET_SUCCESS;
121 static unsigned long kvm_psci_vcpu_affinity_info(struct kvm_vcpu *vcpu)
123 int matching_cpus = 0;
124 unsigned long i, mpidr;
125 unsigned long target_affinity;
126 unsigned long target_affinity_mask;
127 unsigned long lowest_affinity_level;
128 struct kvm *kvm = vcpu->kvm;
129 struct kvm_vcpu *tmp;
131 target_affinity = smccc_get_arg1(vcpu);
132 lowest_affinity_level = smccc_get_arg2(vcpu);
134 if (!kvm_psci_valid_affinity(vcpu, target_affinity))
135 return PSCI_RET_INVALID_PARAMS;
137 /* Determine target affinity mask */
138 target_affinity_mask = psci_affinity_mask(lowest_affinity_level);
139 if (!target_affinity_mask)
140 return PSCI_RET_INVALID_PARAMS;
142 /* Ignore other bits of target affinity */
143 target_affinity &= target_affinity_mask;
146 * If one or more VCPU matching target affinity are running
149 kvm_for_each_vcpu(i, tmp, kvm) {
150 mpidr = kvm_vcpu_get_mpidr_aff(tmp);
151 if ((mpidr & target_affinity_mask) == target_affinity) {
153 if (!tmp->arch.power_off)
154 return PSCI_0_2_AFFINITY_LEVEL_ON;
159 return PSCI_RET_INVALID_PARAMS;
161 return PSCI_0_2_AFFINITY_LEVEL_OFF;
164 static void kvm_prepare_system_event(struct kvm_vcpu *vcpu, u32 type, u64 flags)
167 struct kvm_vcpu *tmp;
170 * The KVM ABI specifies that a system event exit may call KVM_RUN
171 * again and may perform shutdown/reboot at a later time that when the
172 * actual request is made. Since we are implementing PSCI and a
173 * caller of PSCI reboot and shutdown expects that the system shuts
174 * down or reboots immediately, let's make sure that VCPUs are not run
175 * after this call is handled and before the VCPUs have been
178 kvm_for_each_vcpu(i, tmp, vcpu->kvm)
179 tmp->arch.power_off = true;
180 kvm_make_all_cpus_request(vcpu->kvm, KVM_REQ_SLEEP);
182 memset(&vcpu->run->system_event, 0, sizeof(vcpu->run->system_event));
183 vcpu->run->system_event.type = type;
184 vcpu->run->system_event.flags = flags;
185 vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT;
188 static void kvm_psci_system_off(struct kvm_vcpu *vcpu)
190 kvm_prepare_system_event(vcpu, KVM_SYSTEM_EVENT_SHUTDOWN, 0);
193 static void kvm_psci_system_reset(struct kvm_vcpu *vcpu)
195 kvm_prepare_system_event(vcpu, KVM_SYSTEM_EVENT_RESET, 0);
198 static void kvm_psci_system_reset2(struct kvm_vcpu *vcpu)
200 kvm_prepare_system_event(vcpu, KVM_SYSTEM_EVENT_RESET,
201 KVM_SYSTEM_EVENT_RESET_FLAG_PSCI_RESET2);
204 static void kvm_psci_narrow_to_32bit(struct kvm_vcpu *vcpu)
209 * Zero the input registers' upper 32 bits. They will be fully
210 * zeroed on exit, so we're fine changing them in place.
212 for (i = 1; i < 4; i++)
213 vcpu_set_reg(vcpu, i, lower_32_bits(vcpu_get_reg(vcpu, i)));
216 static unsigned long kvm_psci_check_allowed_function(struct kvm_vcpu *vcpu, u32 fn)
219 * Prevent 32 bit guests from calling 64 bit PSCI functions.
221 if ((fn & PSCI_0_2_64BIT) && vcpu_mode_is_32bit(vcpu))
222 return PSCI_RET_NOT_SUPPORTED;
227 static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu)
229 struct kvm *kvm = vcpu->kvm;
230 u32 psci_fn = smccc_get_function(vcpu);
235 case PSCI_0_2_FN_PSCI_VERSION:
237 * Bits[31:16] = Major Version = 0
238 * Bits[15:0] = Minor Version = 2
240 val = KVM_ARM_PSCI_0_2;
242 case PSCI_0_2_FN_CPU_SUSPEND:
243 case PSCI_0_2_FN64_CPU_SUSPEND:
244 val = kvm_psci_vcpu_suspend(vcpu);
246 case PSCI_0_2_FN_CPU_OFF:
247 kvm_psci_vcpu_off(vcpu);
248 val = PSCI_RET_SUCCESS;
250 case PSCI_0_2_FN_CPU_ON:
251 kvm_psci_narrow_to_32bit(vcpu);
253 case PSCI_0_2_FN64_CPU_ON:
254 mutex_lock(&kvm->lock);
255 val = kvm_psci_vcpu_on(vcpu);
256 mutex_unlock(&kvm->lock);
258 case PSCI_0_2_FN_AFFINITY_INFO:
259 kvm_psci_narrow_to_32bit(vcpu);
261 case PSCI_0_2_FN64_AFFINITY_INFO:
262 val = kvm_psci_vcpu_affinity_info(vcpu);
264 case PSCI_0_2_FN_MIGRATE_INFO_TYPE:
266 * Trusted OS is MP hence does not require migration
268 * Trusted OS is not present
270 val = PSCI_0_2_TOS_MP;
272 case PSCI_0_2_FN_SYSTEM_OFF:
273 kvm_psci_system_off(vcpu);
275 * We shouldn't be going back to guest VCPU after
276 * receiving SYSTEM_OFF request.
278 * If user space accidentally/deliberately resumes
279 * guest VCPU after SYSTEM_OFF request then guest
280 * VCPU should see internal failure from PSCI return
281 * value. To achieve this, we preload r0 (or x0) with
282 * PSCI return value INTERNAL_FAILURE.
284 val = PSCI_RET_INTERNAL_FAILURE;
287 case PSCI_0_2_FN_SYSTEM_RESET:
288 kvm_psci_system_reset(vcpu);
290 * Same reason as SYSTEM_OFF for preloading r0 (or x0)
291 * with PSCI return value INTERNAL_FAILURE.
293 val = PSCI_RET_INTERNAL_FAILURE;
297 val = PSCI_RET_NOT_SUPPORTED;
301 smccc_set_retval(vcpu, val, 0, 0, 0);
305 static int kvm_psci_1_x_call(struct kvm_vcpu *vcpu, u32 minor)
307 u32 psci_fn = smccc_get_function(vcpu);
313 case PSCI_0_2_FN_PSCI_VERSION:
314 val = minor == 0 ? KVM_ARM_PSCI_1_0 : KVM_ARM_PSCI_1_1;
316 case PSCI_1_0_FN_PSCI_FEATURES:
317 arg = smccc_get_arg1(vcpu);
318 val = kvm_psci_check_allowed_function(vcpu, arg);
323 case PSCI_0_2_FN_PSCI_VERSION:
324 case PSCI_0_2_FN_CPU_SUSPEND:
325 case PSCI_0_2_FN64_CPU_SUSPEND:
326 case PSCI_0_2_FN_CPU_OFF:
327 case PSCI_0_2_FN_CPU_ON:
328 case PSCI_0_2_FN64_CPU_ON:
329 case PSCI_0_2_FN_AFFINITY_INFO:
330 case PSCI_0_2_FN64_AFFINITY_INFO:
331 case PSCI_0_2_FN_MIGRATE_INFO_TYPE:
332 case PSCI_0_2_FN_SYSTEM_OFF:
333 case PSCI_0_2_FN_SYSTEM_RESET:
334 case PSCI_1_0_FN_PSCI_FEATURES:
335 case ARM_SMCCC_VERSION_FUNC_ID:
338 case PSCI_1_1_FN_SYSTEM_RESET2:
339 case PSCI_1_1_FN64_SYSTEM_RESET2:
346 val = PSCI_RET_NOT_SUPPORTED;
350 case PSCI_1_1_FN_SYSTEM_RESET2:
351 kvm_psci_narrow_to_32bit(vcpu);
353 case PSCI_1_1_FN64_SYSTEM_RESET2:
355 arg = smccc_get_arg1(vcpu);
357 if (arg <= PSCI_1_1_RESET_TYPE_SYSTEM_WARM_RESET ||
358 arg >= PSCI_1_1_RESET_TYPE_VENDOR_START) {
359 kvm_psci_system_reset2(vcpu);
360 vcpu_set_reg(vcpu, 0, PSCI_RET_INTERNAL_FAILURE);
364 val = PSCI_RET_INVALID_PARAMS;
369 return kvm_psci_0_2_call(vcpu);
372 smccc_set_retval(vcpu, val, 0, 0, 0);
376 static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu)
378 struct kvm *kvm = vcpu->kvm;
379 u32 psci_fn = smccc_get_function(vcpu);
383 case KVM_PSCI_FN_CPU_OFF:
384 kvm_psci_vcpu_off(vcpu);
385 val = PSCI_RET_SUCCESS;
387 case KVM_PSCI_FN_CPU_ON:
388 mutex_lock(&kvm->lock);
389 val = kvm_psci_vcpu_on(vcpu);
390 mutex_unlock(&kvm->lock);
393 val = PSCI_RET_NOT_SUPPORTED;
397 smccc_set_retval(vcpu, val, 0, 0, 0);
402 * kvm_psci_call - handle PSCI call if r0 value is in range
403 * @vcpu: Pointer to the VCPU struct
405 * Handle PSCI calls from guests through traps from HVC instructions.
406 * The calling convention is similar to SMC calls to the secure world
407 * where the function number is placed in r0.
409 * This function returns: > 0 (success), 0 (success but exit to user
410 * space), and < 0 (errors)
413 * -EINVAL: Unrecognized PSCI function
415 int kvm_psci_call(struct kvm_vcpu *vcpu)
417 u32 psci_fn = smccc_get_function(vcpu);
420 val = kvm_psci_check_allowed_function(vcpu, psci_fn);
422 smccc_set_retval(vcpu, val, 0, 0, 0);
426 switch (kvm_psci_version(vcpu)) {
427 case KVM_ARM_PSCI_1_1:
428 return kvm_psci_1_x_call(vcpu, 1);
429 case KVM_ARM_PSCI_1_0:
430 return kvm_psci_1_x_call(vcpu, 0);
431 case KVM_ARM_PSCI_0_2:
432 return kvm_psci_0_2_call(vcpu);
433 case KVM_ARM_PSCI_0_1:
434 return kvm_psci_0_1_call(vcpu);
440 int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu)
442 return 4; /* PSCI version and three workaround registers */
445 int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices)
447 if (put_user(KVM_REG_ARM_PSCI_VERSION, uindices++))
450 if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1, uindices++))
453 if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2, uindices++))
456 if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3, uindices++))
462 #define KVM_REG_FEATURE_LEVEL_WIDTH 4
463 #define KVM_REG_FEATURE_LEVEL_MASK (BIT(KVM_REG_FEATURE_LEVEL_WIDTH) - 1)
466 * Convert the workaround level into an easy-to-compare number, where higher
467 * values mean better protection.
469 static int get_kernel_wa_level(u64 regid)
472 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1:
473 switch (arm64_get_spectre_v2_state()) {
474 case SPECTRE_VULNERABLE:
475 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL;
476 case SPECTRE_MITIGATED:
477 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL;
478 case SPECTRE_UNAFFECTED:
479 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_REQUIRED;
481 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL;
482 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2:
483 switch (arm64_get_spectre_v4_state()) {
484 case SPECTRE_MITIGATED:
486 * As for the hypercall discovery, we pretend we
487 * don't have any FW mitigation if SSBS is there at
490 if (cpus_have_final_cap(ARM64_SSBS))
491 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL;
493 case SPECTRE_UNAFFECTED:
494 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED;
495 case SPECTRE_VULNERABLE:
496 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL;
499 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3:
500 switch (arm64_get_spectre_bhb_state()) {
501 case SPECTRE_VULNERABLE:
502 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL;
503 case SPECTRE_MITIGATED:
504 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_AVAIL;
505 case SPECTRE_UNAFFECTED:
506 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_REQUIRED;
508 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL;
514 int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
516 void __user *uaddr = (void __user *)(long)reg->addr;
520 case KVM_REG_ARM_PSCI_VERSION:
521 val = kvm_psci_version(vcpu);
523 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1:
524 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2:
525 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3:
526 val = get_kernel_wa_level(reg->id) & KVM_REG_FEATURE_LEVEL_MASK;
532 if (copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)))
538 int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
540 void __user *uaddr = (void __user *)(long)reg->addr;
544 if (copy_from_user(&val, uaddr, KVM_REG_SIZE(reg->id)))
548 case KVM_REG_ARM_PSCI_VERSION:
552 wants_02 = test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features);
555 case KVM_ARM_PSCI_0_1:
558 vcpu->kvm->arch.psci_version = val;
560 case KVM_ARM_PSCI_0_2:
561 case KVM_ARM_PSCI_1_0:
562 case KVM_ARM_PSCI_1_1:
565 vcpu->kvm->arch.psci_version = val;
571 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1:
572 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3:
573 if (val & ~KVM_REG_FEATURE_LEVEL_MASK)
576 if (get_kernel_wa_level(reg->id) < val)
581 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2:
582 if (val & ~(KVM_REG_FEATURE_LEVEL_MASK |
583 KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED))
586 /* The enabled bit must not be set unless the level is AVAIL. */
587 if ((val & KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED) &&
588 (val & KVM_REG_FEATURE_LEVEL_MASK) != KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL)
592 * Map all the possible incoming states to the only two we
593 * really want to deal with.
595 switch (val & KVM_REG_FEATURE_LEVEL_MASK) {
596 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL:
597 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN:
598 wa_level = KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL;
600 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL:
601 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED:
602 wa_level = KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED;
609 * We can deal with NOT_AVAIL on NOT_REQUIRED, but not the
612 if (get_kernel_wa_level(reg->id) < wa_level)