1 // SPDX-License-Identifier: GPL-2.0
2 // Copyright (C) 2019 Arm Ltd.
4 #include <linux/arm-smccc.h>
5 #include <linux/kvm_host.h>
7 #include <asm/kvm_emulate.h>
9 #include <kvm/arm_hypercalls.h>
10 #include <kvm/arm_psci.h>
12 #define KVM_ARM_SMCCC_STD_FEATURES \
13 GENMASK(KVM_REG_ARM_STD_BMAP_BIT_COUNT - 1, 0)
14 #define KVM_ARM_SMCCC_STD_HYP_FEATURES \
15 GENMASK(KVM_REG_ARM_STD_HYP_BMAP_BIT_COUNT - 1, 0)
16 #define KVM_ARM_SMCCC_VENDOR_HYP_FEATURES \
17 GENMASK(KVM_REG_ARM_VENDOR_HYP_BMAP_BIT_COUNT - 1, 0)
19 static void kvm_ptp_get_time(struct kvm_vcpu *vcpu, u64 *val)
21 struct system_time_snapshot systime_snapshot;
26 * system time and counter value must captured at the same
27 * time to keep consistency and precision.
29 ktime_get_snapshot(&systime_snapshot);
32 * This is only valid if the current clocksource is the
33 * architected counter, as this is the only one the guest
36 if (systime_snapshot.cs_id != CSID_ARM_ARCH_COUNTER)
40 * The guest selects one of the two reference counters
41 * (virtual or physical) with the first argument of the SMCCC
42 * call. In case the identifier is not supported, error out.
44 feature = smccc_get_arg1(vcpu);
46 case KVM_PTP_VIRT_COUNTER:
47 cycles = systime_snapshot.cycles - vcpu_read_sys_reg(vcpu, CNTVOFF_EL2);
49 case KVM_PTP_PHYS_COUNTER:
50 cycles = systime_snapshot.cycles;
57 * This relies on the top bit of val[0] never being set for
58 * valid values of system time, because that is *really* far
59 * in the future (about 292 years from 1970, and at that stage
60 * nobody will give a damn about it).
62 val[0] = upper_32_bits(systime_snapshot.real);
63 val[1] = lower_32_bits(systime_snapshot.real);
64 val[2] = upper_32_bits(cycles);
65 val[3] = lower_32_bits(cycles);
68 static bool kvm_hvc_call_default_allowed(u32 func_id)
72 * List of function-ids that are not gated with the bitmapped
73 * feature firmware registers, and are to be allowed for
74 * servicing the call by default.
76 case ARM_SMCCC_VERSION_FUNC_ID:
77 case ARM_SMCCC_ARCH_FEATURES_FUNC_ID:
80 /* PSCI 0.2 and up is in the 0:0x1f range */
81 if (ARM_SMCCC_OWNER_NUM(func_id) == ARM_SMCCC_OWNER_STANDARD &&
82 ARM_SMCCC_FUNC_NUM(func_id) <= 0x1f)
86 * KVM's PSCI 0.1 doesn't comply with SMCCC, and has
87 * its own function-id base and range
89 if (func_id >= KVM_PSCI_FN(0) && func_id <= KVM_PSCI_FN(3))
96 static bool kvm_hvc_call_allowed(struct kvm_vcpu *vcpu, u32 func_id)
98 struct kvm_smccc_features *smccc_feat = &vcpu->kvm->arch.smccc_feat;
101 case ARM_SMCCC_TRNG_VERSION:
102 case ARM_SMCCC_TRNG_FEATURES:
103 case ARM_SMCCC_TRNG_GET_UUID:
104 case ARM_SMCCC_TRNG_RND32:
105 case ARM_SMCCC_TRNG_RND64:
106 return test_bit(KVM_REG_ARM_STD_BIT_TRNG_V1_0,
107 &smccc_feat->std_bmap);
108 case ARM_SMCCC_HV_PV_TIME_FEATURES:
109 case ARM_SMCCC_HV_PV_TIME_ST:
110 return test_bit(KVM_REG_ARM_STD_HYP_BIT_PV_TIME,
111 &smccc_feat->std_hyp_bmap);
112 case ARM_SMCCC_VENDOR_HYP_KVM_FEATURES_FUNC_ID:
113 case ARM_SMCCC_VENDOR_HYP_CALL_UID_FUNC_ID:
114 return test_bit(KVM_REG_ARM_VENDOR_HYP_BIT_FUNC_FEAT,
115 &smccc_feat->vendor_hyp_bmap);
116 case ARM_SMCCC_VENDOR_HYP_KVM_PTP_FUNC_ID:
117 return test_bit(KVM_REG_ARM_VENDOR_HYP_BIT_PTP,
118 &smccc_feat->vendor_hyp_bmap);
120 return kvm_hvc_call_default_allowed(func_id);
124 int kvm_hvc_call_handler(struct kvm_vcpu *vcpu)
126 struct kvm_smccc_features *smccc_feat = &vcpu->kvm->arch.smccc_feat;
127 u32 func_id = smccc_get_function(vcpu);
128 u64 val[4] = {SMCCC_RET_NOT_SUPPORTED};
132 if (!kvm_hvc_call_allowed(vcpu, func_id))
136 case ARM_SMCCC_VERSION_FUNC_ID:
137 val[0] = ARM_SMCCC_VERSION_1_1;
139 case ARM_SMCCC_ARCH_FEATURES_FUNC_ID:
140 feature = smccc_get_arg1(vcpu);
142 case ARM_SMCCC_ARCH_WORKAROUND_1:
143 switch (arm64_get_spectre_v2_state()) {
144 case SPECTRE_VULNERABLE:
146 case SPECTRE_MITIGATED:
147 val[0] = SMCCC_RET_SUCCESS;
149 case SPECTRE_UNAFFECTED:
150 val[0] = SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED;
154 case ARM_SMCCC_ARCH_WORKAROUND_2:
155 switch (arm64_get_spectre_v4_state()) {
156 case SPECTRE_VULNERABLE:
158 case SPECTRE_MITIGATED:
160 * SSBS everywhere: Indicate no firmware
161 * support, as the SSBS support will be
162 * indicated to the guest and the default is
165 * Otherwise, expose a permanent mitigation
166 * to the guest, and hide SSBS so that the
167 * guest stays protected.
169 if (cpus_have_final_cap(ARM64_SSBS))
172 case SPECTRE_UNAFFECTED:
173 val[0] = SMCCC_RET_NOT_REQUIRED;
177 case ARM_SMCCC_ARCH_WORKAROUND_3:
178 switch (arm64_get_spectre_bhb_state()) {
179 case SPECTRE_VULNERABLE:
181 case SPECTRE_MITIGATED:
182 val[0] = SMCCC_RET_SUCCESS;
184 case SPECTRE_UNAFFECTED:
185 val[0] = SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED;
189 case ARM_SMCCC_HV_PV_TIME_FEATURES:
190 if (test_bit(KVM_REG_ARM_STD_HYP_BIT_PV_TIME,
191 &smccc_feat->std_hyp_bmap))
192 val[0] = SMCCC_RET_SUCCESS;
196 case ARM_SMCCC_HV_PV_TIME_FEATURES:
197 val[0] = kvm_hypercall_pv_features(vcpu);
199 case ARM_SMCCC_HV_PV_TIME_ST:
200 gpa = kvm_init_stolen_time(vcpu);
201 if (gpa != GPA_INVALID)
204 case ARM_SMCCC_VENDOR_HYP_CALL_UID_FUNC_ID:
205 val[0] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_0;
206 val[1] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_1;
207 val[2] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_2;
208 val[3] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_3;
210 case ARM_SMCCC_VENDOR_HYP_KVM_FEATURES_FUNC_ID:
211 val[0] = smccc_feat->vendor_hyp_bmap;
213 case ARM_SMCCC_VENDOR_HYP_KVM_PTP_FUNC_ID:
214 kvm_ptp_get_time(vcpu, val);
216 case ARM_SMCCC_TRNG_VERSION:
217 case ARM_SMCCC_TRNG_FEATURES:
218 case ARM_SMCCC_TRNG_GET_UUID:
219 case ARM_SMCCC_TRNG_RND32:
220 case ARM_SMCCC_TRNG_RND64:
221 return kvm_trng_call(vcpu);
223 return kvm_psci_call(vcpu);
227 smccc_set_retval(vcpu, val[0], val[1], val[2], val[3]);
231 static const u64 kvm_arm_fw_reg_ids[] = {
232 KVM_REG_ARM_PSCI_VERSION,
233 KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1,
234 KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2,
235 KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3,
236 KVM_REG_ARM_STD_BMAP,
237 KVM_REG_ARM_STD_HYP_BMAP,
238 KVM_REG_ARM_VENDOR_HYP_BMAP,
241 void kvm_arm_init_hypercalls(struct kvm *kvm)
243 struct kvm_smccc_features *smccc_feat = &kvm->arch.smccc_feat;
245 smccc_feat->std_bmap = KVM_ARM_SMCCC_STD_FEATURES;
246 smccc_feat->std_hyp_bmap = KVM_ARM_SMCCC_STD_HYP_FEATURES;
247 smccc_feat->vendor_hyp_bmap = KVM_ARM_SMCCC_VENDOR_HYP_FEATURES;
250 int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu)
252 return ARRAY_SIZE(kvm_arm_fw_reg_ids);
255 int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices)
259 for (i = 0; i < ARRAY_SIZE(kvm_arm_fw_reg_ids); i++) {
260 if (put_user(kvm_arm_fw_reg_ids[i], uindices++))
267 #define KVM_REG_FEATURE_LEVEL_MASK GENMASK(3, 0)
270 * Convert the workaround level into an easy-to-compare number, where higher
271 * values mean better protection.
273 static int get_kernel_wa_level(u64 regid)
276 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1:
277 switch (arm64_get_spectre_v2_state()) {
278 case SPECTRE_VULNERABLE:
279 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL;
280 case SPECTRE_MITIGATED:
281 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL;
282 case SPECTRE_UNAFFECTED:
283 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_REQUIRED;
285 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL;
286 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2:
287 switch (arm64_get_spectre_v4_state()) {
288 case SPECTRE_MITIGATED:
290 * As for the hypercall discovery, we pretend we
291 * don't have any FW mitigation if SSBS is there at
294 if (cpus_have_final_cap(ARM64_SSBS))
295 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL;
297 case SPECTRE_UNAFFECTED:
298 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED;
299 case SPECTRE_VULNERABLE:
300 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL;
303 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3:
304 switch (arm64_get_spectre_bhb_state()) {
305 case SPECTRE_VULNERABLE:
306 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL;
307 case SPECTRE_MITIGATED:
308 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_AVAIL;
309 case SPECTRE_UNAFFECTED:
310 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_REQUIRED;
312 return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL;
318 int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
320 struct kvm_smccc_features *smccc_feat = &vcpu->kvm->arch.smccc_feat;
321 void __user *uaddr = (void __user *)(long)reg->addr;
325 case KVM_REG_ARM_PSCI_VERSION:
326 val = kvm_psci_version(vcpu);
328 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1:
329 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2:
330 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3:
331 val = get_kernel_wa_level(reg->id) & KVM_REG_FEATURE_LEVEL_MASK;
333 case KVM_REG_ARM_STD_BMAP:
334 val = READ_ONCE(smccc_feat->std_bmap);
336 case KVM_REG_ARM_STD_HYP_BMAP:
337 val = READ_ONCE(smccc_feat->std_hyp_bmap);
339 case KVM_REG_ARM_VENDOR_HYP_BMAP:
340 val = READ_ONCE(smccc_feat->vendor_hyp_bmap);
346 if (copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)))
352 static int kvm_arm_set_fw_reg_bmap(struct kvm_vcpu *vcpu, u64 reg_id, u64 val)
355 struct kvm *kvm = vcpu->kvm;
356 struct kvm_smccc_features *smccc_feat = &kvm->arch.smccc_feat;
357 unsigned long *fw_reg_bmap, fw_reg_features;
360 case KVM_REG_ARM_STD_BMAP:
361 fw_reg_bmap = &smccc_feat->std_bmap;
362 fw_reg_features = KVM_ARM_SMCCC_STD_FEATURES;
364 case KVM_REG_ARM_STD_HYP_BMAP:
365 fw_reg_bmap = &smccc_feat->std_hyp_bmap;
366 fw_reg_features = KVM_ARM_SMCCC_STD_HYP_FEATURES;
368 case KVM_REG_ARM_VENDOR_HYP_BMAP:
369 fw_reg_bmap = &smccc_feat->vendor_hyp_bmap;
370 fw_reg_features = KVM_ARM_SMCCC_VENDOR_HYP_FEATURES;
376 /* Check for unsupported bit */
377 if (val & ~fw_reg_features)
380 mutex_lock(&kvm->lock);
382 if (test_bit(KVM_ARCH_FLAG_HAS_RAN_ONCE, &kvm->arch.flags) &&
383 val != *fw_reg_bmap) {
388 WRITE_ONCE(*fw_reg_bmap, val);
390 mutex_unlock(&kvm->lock);
394 int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
396 void __user *uaddr = (void __user *)(long)reg->addr;
400 if (copy_from_user(&val, uaddr, KVM_REG_SIZE(reg->id)))
404 case KVM_REG_ARM_PSCI_VERSION:
408 wants_02 = test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features);
411 case KVM_ARM_PSCI_0_1:
414 vcpu->kvm->arch.psci_version = val;
416 case KVM_ARM_PSCI_0_2:
417 case KVM_ARM_PSCI_1_0:
418 case KVM_ARM_PSCI_1_1:
421 vcpu->kvm->arch.psci_version = val;
427 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1:
428 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3:
429 if (val & ~KVM_REG_FEATURE_LEVEL_MASK)
432 if (get_kernel_wa_level(reg->id) < val)
437 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2:
438 if (val & ~(KVM_REG_FEATURE_LEVEL_MASK |
439 KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED))
442 /* The enabled bit must not be set unless the level is AVAIL. */
443 if ((val & KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED) &&
444 (val & KVM_REG_FEATURE_LEVEL_MASK) != KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL)
448 * Map all the possible incoming states to the only two we
449 * really want to deal with.
451 switch (val & KVM_REG_FEATURE_LEVEL_MASK) {
452 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL:
453 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN:
454 wa_level = KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL;
456 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL:
457 case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED:
458 wa_level = KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED;
465 * We can deal with NOT_AVAIL on NOT_REQUIRED, but not the
468 if (get_kernel_wa_level(reg->id) < wa_level)
472 case KVM_REG_ARM_STD_BMAP:
473 case KVM_REG_ARM_STD_HYP_BMAP:
474 case KVM_REG_ARM_VENDOR_HYP_BMAP:
475 return kvm_arm_set_fw_reg_bmap(vcpu, reg->id, val);