1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2017 ARM Ltd.
4 * Author: Marc Zyngier <marc.zyngier@arm.com>
5 */
6
7 #include <linux/interrupt.h>
8 #include <linux/irq.h>
9 #include <linux/irqdomain.h>
10 #include <linux/kvm_host.h>
11 #include <linux/irqchip/arm-gic-v3.h>
12
13 #include "vgic.h"
14
15 /*
16 * How KVM uses GICv4 (insert rude comments here):
17 *
18 * The vgic-v4 layer acts as a bridge between several entities:
19 * - The GICv4 ITS representation offered by the ITS driver
20 * - VFIO, which is in charge of the PCI endpoint
21 * - The virtual ITS, which is the only thing the guest sees
22 *
23 * The configuration of VLPIs is triggered by a callback from VFIO,
24 * instructing KVM that a PCI device has been configured to deliver
25 * MSIs to a vITS.
26 *
27 * kvm_vgic_v4_set_forwarding() is thus called with the routing entry,
28 * and this is used to find the corresponding vITS data structures
29 * (ITS instance, device, event and irq) using a process that is
30 * extremely similar to the injection of an MSI.
31 *
32 * At this stage, we can link the guest's view of an LPI (uniquely
33 * identified by the routing entry) and the host irq, using the GICv4
34 * driver mapping operation. Should the mapping succeed, we've then
35 * successfully upgraded the guest's LPI to a VLPI. We can then start
36 * with updating GICv4's view of the property table and generating an
37 * INValidation in order to kickstart the delivery of this VLPI to the
38 * guest directly, without software intervention. Well, almost.
39 *
40 * When the PCI endpoint is deconfigured, this operation is reversed
41 * with VFIO calling kvm_vgic_v4_unset_forwarding().
42 *
43 * Once the VLPI has been mapped, it needs to follow any change the
44 * guest performs on its LPI through the vITS. For that, a number of
45 * command handlers have hooks to communicate these changes to the HW:
46 * - Any invalidation triggers a call to its_prop_update_vlpi()
47 * - The INT command results in a irq_set_irqchip_state(), which
48 * generates an INT on the corresponding VLPI.
49 * - The CLEAR command results in a irq_set_irqchip_state(), which
50 * generates an CLEAR on the corresponding VLPI.
51 * - DISCARD translates into an unmap, similar to a call to
52 * kvm_vgic_v4_unset_forwarding().
53 * - MOVI is translated by an update of the existing mapping, changing
54 * the target vcpu, resulting in a VMOVI being generated.
55 * - MOVALL is translated by a string of mapping updates (similar to
56 * the handling of MOVI). MOVALL is horrible.
57 *
58 * Note that a DISCARD/MAPTI sequence emitted from the guest without
59 * reprogramming the PCI endpoint after MAPTI does not result in a
60 * VLPI being mapped, as there is no callback from VFIO (the guest
61 * will get the interrupt via the normal SW injection). Fixing this is
62 * not trivial, and requires some horrible messing with the VFIO
63 * internals. Not fun. Don't do that.
64 *
65 * Then there is the scheduling. Each time a vcpu is about to run on a
66 * physical CPU, KVM must tell the corresponding redistributor about
67 * it. And if we've migrated our vcpu from one CPU to another, we must
68 * tell the ITS (so that the messages reach the right redistributor).
69 * This is done in two steps: first issue a irq_set_affinity() on the
70 * irq corresponding to the vcpu, then call its_schedule_vpe(). You
71 * must be in a non-preemptible context. On exit, another call to
72 * its_schedule_vpe() tells the redistributor that we're done with the
73 * vcpu.
74 *
75 * Finally, the doorbell handling: Each vcpu is allocated an interrupt
76 * which will fire each time a VLPI is made pending whilst the vcpu is
77 * not running. Each time the vcpu gets blocked, the doorbell
78 * interrupt gets enabled. When the vcpu is unblocked (for whatever
79 * reason), the doorbell interrupt is disabled.
80 */
81
82 #define DB_IRQ_FLAGS (IRQ_NOAUTOEN | IRQ_DISABLE_UNLAZY | IRQ_NO_BALANCING)
83
84 static irqreturn_t vgic_v4_doorbell_handler(int irq, void *info)
85 {
86 struct kvm_vcpu *vcpu = info;
87
88 vcpu->arch.vgic_cpu.vgic_v3.its_vpe.pending_last = true;
89 kvm_make_request(KVM_REQ_IRQ_PENDING, vcpu);
90 kvm_vcpu_kick(vcpu);
91
92 return IRQ_HANDLED;
93 }
94
95 /**
96 * vgic_v4_init - Initialize the GICv4 data structures
97 * @kvm: Pointer to the VM being initialized
98 *
99 * We may be called each time a vITS is created, or when the
100 * vgic is initialized. This relies on kvm->lock to be
101 * held. In both cases, the number of vcpus should now be
102 * fixed.
103 */
104 int vgic_v4_init(struct kvm *kvm)
105 {
106 struct vgic_dist *dist = &kvm->arch.vgic;
107 struct kvm_vcpu *vcpu;
108 int i, nr_vcpus, ret;
109
110 if (!kvm_vgic_global_state.has_gicv4)
111 return 0; /* Nothing to see here... move along. */
112
113 if (dist->its_vm.vpes)
114 return 0;
115
116 nr_vcpus = atomic_read(&kvm->online_vcpus);
117
118 dist->its_vm.vpes = kcalloc(nr_vcpus, sizeof(*dist->its_vm.vpes),
119 GFP_KERNEL);
120 if (!dist->its_vm.vpes)
121 return -ENOMEM;
122
123 dist->its_vm.nr_vpes = nr_vcpus;
124
125 kvm_for_each_vcpu(i, vcpu, kvm)
126 dist->its_vm.vpes[i] = &vcpu->arch.vgic_cpu.vgic_v3.its_vpe;
127
128 ret = its_alloc_vcpu_irqs(&dist->its_vm);
129 if (ret < 0) {
130 kvm_err("VPE IRQ allocation failure\n");
131 kfree(dist->its_vm.vpes);
132 dist->its_vm.nr_vpes = 0;
133 dist->its_vm.vpes = NULL;
134 return ret;
135 }
136
137 kvm_for_each_vcpu(i, vcpu, kvm) {
138 int irq = dist->its_vm.vpes[i]->irq;
139
140 /*
141 * Don't automatically enable the doorbell, as we're
142 * flipping it back and forth when the vcpu gets
143 * blocked. Also disable the lazy disabling, as the
144 * doorbell could kick us out of the guest too
145 * early...
146 */
147 irq_set_status_flags(irq, DB_IRQ_FLAGS);
148 ret = request_irq(irq, vgic_v4_doorbell_handler,
149 0, "vcpu", vcpu);
150 if (ret) {
151 kvm_err("failed to allocate vcpu IRQ%d\n", irq);
152 /*
153 * Trick: adjust the number of vpes so we know
154 * how many to nuke on teardown...
155 */
156 dist->its_vm.nr_vpes = i;
157 break;
158 }
159 }
160
161 if (ret)
162 vgic_v4_teardown(kvm);
163
164 return ret;
165 }
166
167 /**
168 * vgic_v4_teardown - Free the GICv4 data structures
169 * @kvm: Pointer to the VM being destroyed
170 *
171 * Relies on kvm->lock to be held.
172 */
173 void vgic_v4_teardown(struct kvm *kvm)
174 {
175 struct its_vm *its_vm = &kvm->arch.vgic.its_vm;
176 int i;
177
178 if (!its_vm->vpes)
179 return;
180
181 for (i = 0; i < its_vm->nr_vpes; i++) {
182 struct kvm_vcpu *vcpu = kvm_get_vcpu(kvm, i);
183 int irq = its_vm->vpes[i]->irq;
184
185 irq_clear_status_flags(irq, DB_IRQ_FLAGS);
186 free_irq(irq, vcpu);
187 }
188
189 its_free_vcpu_irqs(its_vm);
190 kfree(its_vm->vpes);
191 its_vm->nr_vpes = 0;
192 its_vm->vpes = NULL;
193 }
194
195 int vgic_v4_sync_hwstate(struct kvm_vcpu *vcpu)
196 {
197 if (!vgic_supports_direct_msis(vcpu->kvm))
198 return 0;
199
200 return its_schedule_vpe(&vcpu->arch.vgic_cpu.vgic_v3.its_vpe, false);
201 }
202
203 int vgic_v4_flush_hwstate(struct kvm_vcpu *vcpu)
204 {
205 int irq = vcpu->arch.vgic_cpu.vgic_v3.its_vpe.irq;
206 int err;
207
208 if (!vgic_supports_direct_msis(vcpu->kvm))
209 return 0;
210
211 /*
212 * Before making the VPE resident, make sure the redistributor
213 * corresponding to our current CPU expects us here. See the
214 * doc in drivers/irqchip/irq-gic-v4.c to understand how this
215 * turns into a VMOVP command at the ITS level.
216 */
217 err = irq_set_affinity(irq, cpumask_of(smp_processor_id()));
218 if (err)
219 return err;
220
221 err = its_schedule_vpe(&vcpu->arch.vgic_cpu.vgic_v3.its_vpe, true);
222 if (err)
223 return err;
224
225 /*
226 * Now that the VPE is resident, let's get rid of a potential
227 * doorbell interrupt that would still be pending.
228 */
229 err = irq_set_irqchip_state(irq, IRQCHIP_STATE_PENDING, false);
230
231 return err;
232 }
233
234 static struct vgic_its *vgic_get_its(struct kvm *kvm,
235 struct kvm_kernel_irq_routing_entry *irq_entry)
236 {
237 struct kvm_msi msi = (struct kvm_msi) {
238 .address_lo = irq_entry->msi.address_lo,
239 .address_hi = irq_entry->msi.address_hi,
240 .data = irq_entry->msi.data,
241 .flags = irq_entry->msi.flags,
242 .devid = irq_entry->msi.devid,
243 };
244
245 return vgic_msi_to_its(kvm, &msi);
246 }
247
248 int kvm_vgic_v4_set_forwarding(struct kvm *kvm, int virq,
249 struct kvm_kernel_irq_routing_entry *irq_entry)
250 {
251 struct vgic_its *its;
252 struct vgic_irq *irq;
253 struct its_vlpi_map map;
254 int ret;
255
256 if (!vgic_supports_direct_msis(kvm))
257 return 0;
258
259 /*
260 * Get the ITS, and escape early on error (not a valid
261 * doorbell for any of our vITSs).
262 */
263 its = vgic_get_its(kvm, irq_entry);
264 if (IS_ERR(its))
265 return 0;
266
267 mutex_lock(&its->its_lock);
268
269 /* Perform then actual DevID/EventID -> LPI translation. */
270 ret = vgic_its_resolve_lpi(kvm, its, irq_entry->msi.devid,
271 irq_entry->msi.data, &irq);
272 if (ret)
273 goto out;
274
275 /*
276 * Emit the mapping request. If it fails, the ITS probably
277 * isn't v4 compatible, so let's silently bail out. Holding
278 * the ITS lock should ensure that nothing can modify the
279 * target vcpu.
280 */
281 map = (struct its_vlpi_map) {
282 .vm = &kvm->arch.vgic.its_vm,
283 .vpe = &irq->target_vcpu->arch.vgic_cpu.vgic_v3.its_vpe,
284 .vintid = irq->intid,
285 .properties = ((irq->priority & 0xfc) |
286 (irq->enabled ? LPI_PROP_ENABLED : 0) |
287 LPI_PROP_GROUP1),
288 .db_enabled = true,
289 };
290
291 ret = its_map_vlpi(virq, &map);
292 if (ret)
293 goto out;
294
295 irq->hw = true;
296 irq->host_irq = virq;
297
298 out:
299 mutex_unlock(&its->its_lock);
300 return ret;
301 }
302
303 int kvm_vgic_v4_unset_forwarding(struct kvm *kvm, int virq,
304 struct kvm_kernel_irq_routing_entry *irq_entry)
305 {
306 struct vgic_its *its;
307 struct vgic_irq *irq;
308 int ret;
309
310 if (!vgic_supports_direct_msis(kvm))
311 return 0;
312
313 /*
314 * Get the ITS, and escape early on error (not a valid
315 * doorbell for any of our vITSs).
316 */
317 its = vgic_get_its(kvm, irq_entry);
318 if (IS_ERR(its))
319 return 0;
320
321 mutex_lock(&its->its_lock);
322
323 ret = vgic_its_resolve_lpi(kvm, its, irq_entry->msi.devid,
324 irq_entry->msi.data, &irq);
325 if (ret)
326 goto out;
327
328 WARN_ON(!(irq->hw && irq->host_irq == virq));
329 if (irq->hw) {
330 irq->hw = false;
331 ret = its_unmap_vlpi(virq);
332 }
333
334 out:
335 mutex_unlock(&its->its_lock);
336 return ret;
337 }
338
339 void kvm_vgic_v4_enable_doorbell(struct kvm_vcpu *vcpu)
340 {
341 if (vgic_supports_direct_msis(vcpu->kvm)) {
342 int irq = vcpu->arch.vgic_cpu.vgic_v3.its_vpe.irq;
343 if (irq)
344 enable_irq(irq);
345 }
346 }
347
348 void kvm_vgic_v4_disable_doorbell(struct kvm_vcpu *vcpu)
349 {
350 if (vgic_supports_direct_msis(vcpu->kvm)) {
351 int irq = vcpu->arch.vgic_cpu.vgic_v3.its_vpe.irq;
352 if (irq)
353 disable_irq(irq);
354 }
355 }