1
// SPDX-License-Identifier: GPL-2.0-only
2
/*
3
 * Copyright (C) 2015 - ARM Ltd
4
 * Author: Marc Zyngier <[email protected]>
5
 */
6

7
#include <hyp/switch.h>
8

9
#include <linux/arm-smccc.h>
10
#include <linux/kvm_host.h>
11
#include <linux/types.h>
12
#include <linux/jump_label.h>
13
#include <linux/percpu.h>
14
#include <uapi/linux/psci.h>
15

16
#include <kvm/arm_psci.h>
17

18
#include <asm/barrier.h>
19
#include <asm/cpufeature.h>
20
#include <asm/kprobes.h>
21
#include <asm/kvm_asm.h>
22
#include <asm/kvm_emulate.h>
23
#include <asm/kvm_hyp.h>
24
#include <asm/kvm_mmu.h>
25
#include <asm/fpsimd.h>
26
#include <asm/debug-monitors.h>
27
#include <asm/processor.h>
28
#include <asm/thread_info.h>
29
#include <asm/vectors.h>
30

31
/* VHE specific context */
32
DEFINE_PER_CPU(struct kvm_host_data, kvm_host_data);
33
DEFINE_PER_CPU(struct kvm_cpu_context, kvm_hyp_ctxt);
34
DEFINE_PER_CPU(unsigned long, kvm_hyp_vector);
35

36
/*
37
 * HCR_EL2 bits that the NV guest can freely change (no RES0/RES1
38
 * semantics, irrespective of the configuration), but that cannot be
39
 * applied to the actual HW as things would otherwise break badly.
40
 *
41
 * - TGE: we want the guest to use EL1, which is incompatible with
42
 *   this bit being set
43
 *
44
 * - API/APK: they are already accounted for by vcpu_load(), and can
45
 *   only take effect across a load/put cycle (such as ERET)
46
 *
47
 * - FIEN: no way we let a guest have access to the RAS "Common Fault
48
 *   Injection" thing, whatever that does
49
 */
50
#define NV_HCR_GUEST_EXCLUDE	(HCR_TGE | HCR_API | HCR_APK | HCR_FIEN)
51

52
static u64 __compute_hcr(struct kvm_vcpu *vcpu)
53
{
54
	u64 guest_hcr, hcr = vcpu->arch.hcr_el2;
55

56
	if (!vcpu_has_nv(vcpu))
57
		return hcr;
58

59
	/*
60
	 * We rely on the invariant that a vcpu entered from HYP
61
	 * context must also exit in the same context, as only an ERET
62
	 * instruction can kick us out of it, and we obviously trap
63
	 * that sucker. PSTATE.M will get fixed-up on exit.
64
	 */
65
	if (is_hyp_ctxt(vcpu)) {
66
		host_data_set_flag(VCPU_IN_HYP_CONTEXT);
67

68
		hcr |= HCR_NV | HCR_NV2 | HCR_AT | HCR_TTLB;
69

70
		if (!vcpu_el2_e2h_is_set(vcpu))
71
			hcr |= HCR_NV1;
72

73
		/*
74
		 * Nothing in HCR_EL2 should impact running in hypervisor
75
		 * context, apart from bits we have defined as RESx (E2H,
76
		 * HCD and co), or that cannot be set directly (the EXCLUDE
77
		 * bits). Given that we OR the guest's view with the host's,
78
		 * we can use the 0 value as the starting point, and only
79
		 * use the config-driven RES1 bits.
80
		 */
81
		guest_hcr = kvm_vcpu_apply_reg_masks(vcpu, HCR_EL2, 0);
82

83
		write_sysreg_s(vcpu->arch.ctxt.vncr_array, SYS_VNCR_EL2);
84
	} else {
85
		host_data_clear_flag(VCPU_IN_HYP_CONTEXT);
86

87
		guest_hcr = __vcpu_sys_reg(vcpu, HCR_EL2);
88
		if (guest_hcr & HCR_NV) {
89
			u64 va = __fix_to_virt(vncr_fixmap(smp_processor_id()));
90

91
			/* Inherit the low bits from the actual register */
92
			va |= __vcpu_sys_reg(vcpu, VNCR_EL2) & GENMASK(PAGE_SHIFT - 1, 0);
93
			write_sysreg_s(va, SYS_VNCR_EL2);
94

95
			/* Force NV2 in case the guest is forgetful... */
96
			guest_hcr |= HCR_NV2;
97
		}
98

99
		/*
100
		 * Exclude the guest's TWED configuration if it hasn't set TWE
101
		 * to avoid potentially delaying traps for the host.
102
		 */
103
		if (!(guest_hcr & HCR_TWE))
104
			guest_hcr &= ~(HCR_EL2_TWEDEn | HCR_EL2_TWEDEL);
105
	}
106

107
	BUG_ON(host_data_test_flag(VCPU_IN_HYP_CONTEXT) &&
108
	       host_data_test_flag(L1_VNCR_MAPPED));
109

110
	return hcr | (guest_hcr & ~NV_HCR_GUEST_EXCLUDE);
111
}
112

113
static void __activate_traps(struct kvm_vcpu *vcpu)
114
{
115
	u64 val;
116

117
	___activate_traps(vcpu, __compute_hcr(vcpu));
118

119
	if (has_cntpoff()) {
120
		struct timer_map map;
121

122
		get_timer_map(vcpu, &map);
123

124
		/*
125
		 * We're entrering the guest. Reload the correct
126
		 * values from memory now that TGE is clear.
127
		 */
128
		if (map.direct_ptimer == vcpu_ptimer(vcpu))
129
			val = __vcpu_sys_reg(vcpu, CNTP_CVAL_EL0);
130
		if (map.direct_ptimer == vcpu_hptimer(vcpu))
131
			val = __vcpu_sys_reg(vcpu, CNTHP_CVAL_EL2);
132

133
		if (map.direct_ptimer) {
134
			write_sysreg_el0(val, SYS_CNTP_CVAL);
135
			isb();
136
		}
137
	}
138

139
	__activate_cptr_traps(vcpu);
140

141
	write_sysreg(__this_cpu_read(kvm_hyp_vector), vbar_el1);
142
}
143
NOKPROBE_SYMBOL(__activate_traps);
144

145
static void __deactivate_traps(struct kvm_vcpu *vcpu)
146
{
147
	const char *host_vectors = vectors;
148

149
	___deactivate_traps(vcpu);
150

151
	write_sysreg_hcr(HCR_HOST_VHE_FLAGS);
152

153
	if (has_cntpoff()) {
154
		struct timer_map map;
155
		u64 val, offset;
156

157
		get_timer_map(vcpu, &map);
158

159
		/*
160
		 * We're exiting the guest. Save the latest CVAL value
161
		 * to memory and apply the offset now that TGE is set.
162
		 */
163
		val = read_sysreg_el0(SYS_CNTP_CVAL);
164
		if (map.direct_ptimer == vcpu_ptimer(vcpu))
165
			__vcpu_assign_sys_reg(vcpu, CNTP_CVAL_EL0, val);
166
		if (map.direct_ptimer == vcpu_hptimer(vcpu))
167
			__vcpu_assign_sys_reg(vcpu, CNTHP_CVAL_EL2, val);
168

169
		offset = read_sysreg_s(SYS_CNTPOFF_EL2);
170

171
		if (map.direct_ptimer && offset) {
172
			write_sysreg_el0(val + offset, SYS_CNTP_CVAL);
173
			isb();
174
		}
175
	}
176

177
	/*
178
	 * ARM errata 1165522 and 1530923 require the actual execution of the
179
	 * above before we can switch to the EL2/EL0 translation regime used by
180
	 * the host.
181
	 */
182
	asm(ALTERNATIVE("nop", "isb", ARM64_WORKAROUND_SPECULATIVE_AT));
183

184
	__deactivate_cptr_traps(vcpu);
185

186
	if (!arm64_kernel_unmapped_at_el0())
187
		host_vectors = __this_cpu_read(this_cpu_vector);
188
	write_sysreg(host_vectors, vbar_el1);
189
}
190
NOKPROBE_SYMBOL(__deactivate_traps);
191

192
/*
193
 * Disable IRQs in __vcpu_{load,put}_{activate,deactivate}_traps() to
194
 * prevent a race condition between context switching of PMUSERENR_EL0
195
 * in __{activate,deactivate}_traps_common() and IPIs that attempts to
196
 * update PMUSERENR_EL0. See also kvm_set_pmuserenr().
197
 */
198
static void __vcpu_load_activate_traps(struct kvm_vcpu *vcpu)
199
{
200
	unsigned long flags;
201

202
	local_irq_save(flags);
203
	__activate_traps_common(vcpu);
204
	local_irq_restore(flags);
205
}
206

207
static void __vcpu_put_deactivate_traps(struct kvm_vcpu *vcpu)
208
{
209
	unsigned long flags;
210

211
	local_irq_save(flags);
212
	__deactivate_traps_common(vcpu);
213
	local_irq_restore(flags);
214
}
215

216
void kvm_vcpu_load_vhe(struct kvm_vcpu *vcpu)
217
{
218
	host_data_ptr(host_ctxt)->__hyp_running_vcpu = vcpu;
219

220
	__vcpu_load_switch_sysregs(vcpu);
221
	__vcpu_load_activate_traps(vcpu);
222
	__load_stage2(vcpu->arch.hw_mmu, vcpu->arch.hw_mmu->arch);
223
}
224

225
void kvm_vcpu_put_vhe(struct kvm_vcpu *vcpu)
226
{
227
	__vcpu_put_deactivate_traps(vcpu);
228
	__vcpu_put_switch_sysregs(vcpu);
229

230
	host_data_ptr(host_ctxt)->__hyp_running_vcpu = NULL;
231
}
232

233
static u64 compute_emulated_cntx_ctl_el0(struct kvm_vcpu *vcpu,
234
					 enum vcpu_sysreg reg)
235
{
236
	unsigned long ctl;
237
	u64 cval, cnt;
238
	bool stat;
239

240
	switch (reg) {
241
	case CNTP_CTL_EL0:
242
		cval = __vcpu_sys_reg(vcpu, CNTP_CVAL_EL0);
243
		ctl  = __vcpu_sys_reg(vcpu, CNTP_CTL_EL0);
244
		cnt  = compute_counter_value(vcpu_ptimer(vcpu));
245
		break;
246
	case CNTV_CTL_EL0:
247
		cval = __vcpu_sys_reg(vcpu, CNTV_CVAL_EL0);
248
		ctl  = __vcpu_sys_reg(vcpu, CNTV_CTL_EL0);
249
		cnt  = compute_counter_value(vcpu_vtimer(vcpu));
250
		break;
251
	default:
252
		BUG();
253
	}
254

255
	stat = cval <= cnt;
256
	__assign_bit(__ffs(ARCH_TIMER_CTRL_IT_STAT), &ctl, stat);
257

258
	return ctl;
259
}
260

261
static bool kvm_hyp_handle_timer(struct kvm_vcpu *vcpu, u64 *exit_code)
262
{
263
	u64 esr, val;
264

265
	/*
266
	 * Having FEAT_ECV allows for a better quality of timer emulation.
267
	 * However, this comes at a huge cost in terms of traps. Try and
268
	 * satisfy the reads from guest's hypervisor context without
269
	 * returning to the kernel if we can.
270
	 */
271
	if (!is_hyp_ctxt(vcpu))
272
		return false;
273

274
	esr = kvm_vcpu_get_esr(vcpu);
275
	if ((esr & ESR_ELx_SYS64_ISS_DIR_MASK) != ESR_ELx_SYS64_ISS_DIR_READ)
276
		return false;
277

278
	switch (esr_sys64_to_sysreg(esr)) {
279
	case SYS_CNTP_CTL_EL02:
280
		val = compute_emulated_cntx_ctl_el0(vcpu, CNTP_CTL_EL0);
281
		break;
282
	case SYS_CNTP_CTL_EL0:
283
		if (vcpu_el2_e2h_is_set(vcpu))
284
			val = read_sysreg_el0(SYS_CNTP_CTL);
285
		else
286
			val = compute_emulated_cntx_ctl_el0(vcpu, CNTP_CTL_EL0);
287
		break;
288
	case SYS_CNTP_CVAL_EL02:
289
		val = __vcpu_sys_reg(vcpu, CNTP_CVAL_EL0);
290
		break;
291
	case SYS_CNTP_CVAL_EL0:
292
		if (vcpu_el2_e2h_is_set(vcpu)) {
293
			val = read_sysreg_el0(SYS_CNTP_CVAL);
294

295
			if (!has_cntpoff())
296
				val -= timer_get_offset(vcpu_hptimer(vcpu));
297
		} else {
298
			val = __vcpu_sys_reg(vcpu, CNTP_CVAL_EL0);
299
		}
300
		break;
301
	case SYS_CNTPCT_EL0:
302
	case SYS_CNTPCTSS_EL0:
303
		val = compute_counter_value(vcpu_hptimer(vcpu));
304
		break;
305
	case SYS_CNTV_CTL_EL02:
306
		val = compute_emulated_cntx_ctl_el0(vcpu, CNTV_CTL_EL0);
307
		break;
308
	case SYS_CNTV_CTL_EL0:
309
		if (vcpu_el2_e2h_is_set(vcpu))
310
			val = read_sysreg_el0(SYS_CNTV_CTL);
311
		else
312
			val = compute_emulated_cntx_ctl_el0(vcpu, CNTV_CTL_EL0);
313
		break;
314
	case SYS_CNTV_CVAL_EL02:
315
		val = __vcpu_sys_reg(vcpu, CNTV_CVAL_EL0);
316
		break;
317
	case SYS_CNTV_CVAL_EL0:
318
		if (vcpu_el2_e2h_is_set(vcpu))
319
			val = read_sysreg_el0(SYS_CNTV_CVAL);
320
		else
321
			val = __vcpu_sys_reg(vcpu, CNTV_CVAL_EL0);
322
		break;
323
	case SYS_CNTVCT_EL0:
324
	case SYS_CNTVCTSS_EL0:
325
		val = compute_counter_value(vcpu_hvtimer(vcpu));
326
		break;
327
	default:
328
		return false;
329
	}
330

331
	vcpu_set_reg(vcpu, kvm_vcpu_sys_get_rt(vcpu), val);
332
	__kvm_skip_instr(vcpu);
333

334
	return true;
335
}
336

337
static bool kvm_hyp_handle_eret(struct kvm_vcpu *vcpu, u64 *exit_code)
338
{
339
	u64 esr = kvm_vcpu_get_esr(vcpu);
340
	u64 spsr, elr, mode;
341

342
	/*
343
	 * Going through the whole put/load motions is a waste of time
344
	 * if this is a VHE guest hypervisor returning to its own
345
	 * userspace, or the hypervisor performing a local exception
346
	 * return. No need to save/restore registers, no need to
347
	 * switch S2 MMU. Just do the canonical ERET.
348
	 *
349
	 * Unless the trap has to be forwarded further down the line,
350
	 * of course...
351
	 */
352
	if ((__vcpu_sys_reg(vcpu, HCR_EL2) & HCR_NV) ||
353
	    (__vcpu_sys_reg(vcpu, HFGITR_EL2) & HFGITR_EL2_ERET))
354
		return false;
355

356
	spsr = read_sysreg_el1(SYS_SPSR);
357
	mode = spsr & (PSR_MODE_MASK | PSR_MODE32_BIT);
358

359
	switch (mode) {
360
	case PSR_MODE_EL0t:
361
		if (!(vcpu_el2_e2h_is_set(vcpu) && vcpu_el2_tge_is_set(vcpu)))
362
			return false;
363
		break;
364
	case PSR_MODE_EL2t:
365
		mode = PSR_MODE_EL1t;
366
		break;
367
	case PSR_MODE_EL2h:
368
		mode = PSR_MODE_EL1h;
369
		break;
370
	default:
371
		return false;
372
	}
373

374
	/* If ERETAx fails, take the slow path */
375
	if (esr_iss_is_eretax(esr)) {
376
		if (!(vcpu_has_ptrauth(vcpu) && kvm_auth_eretax(vcpu, &elr)))
377
			return false;
378
	} else {
379
		elr = read_sysreg_el1(SYS_ELR);
380
	}
381

382
	spsr = (spsr & ~(PSR_MODE_MASK | PSR_MODE32_BIT)) | mode;
383

384
	write_sysreg_el2(spsr, SYS_SPSR);
385
	write_sysreg_el2(elr, SYS_ELR);
386

387
	return true;
388
}
389

390
static bool kvm_hyp_handle_tlbi_el2(struct kvm_vcpu *vcpu, u64 *exit_code)
391
{
392
	int ret = -EINVAL;
393
	u32 instr;
394
	u64 val;
395

396
	/*
397
	 * Ideally, we would never trap on EL2 S1 TLB invalidations using
398
	 * the EL1 instructions when the guest's HCR_EL2.{E2H,TGE}=={1,1}.
399
	 * But "thanks" to FEAT_NV2, we don't trap writes to HCR_EL2,
400
	 * meaning that we can't track changes to the virtual TGE bit. So we
401
	 * have to leave HCR_EL2.TTLB set on the host. Oopsie...
402
	 *
403
	 * Try and handle these invalidation as quickly as possible, without
404
	 * fully exiting. Note that we don't need to consider any forwarding
405
	 * here, as having E2H+TGE set is the very definition of being
406
	 * InHost.
407
	 *
408
	 * For the lesser hypervisors out there that have failed to get on
409
	 * with the VHE program, we can also handle the nVHE style of EL2
410
	 * invalidation.
411
	 */
412
	if (!(is_hyp_ctxt(vcpu)))
413
		return false;
414

415
	instr = esr_sys64_to_sysreg(kvm_vcpu_get_esr(vcpu));
416
	val = vcpu_get_reg(vcpu, kvm_vcpu_sys_get_rt(vcpu));
417

418
	if ((kvm_supported_tlbi_s1e1_op(vcpu, instr) &&
419
	     vcpu_el2_e2h_is_set(vcpu) && vcpu_el2_tge_is_set(vcpu)) ||
420
	    kvm_supported_tlbi_s1e2_op (vcpu, instr))
421
		ret = __kvm_tlbi_s1e2(NULL, val, instr);
422

423
	if (ret)
424
		return false;
425

426
	/*
427
	 * If we have to check for any VNCR mapping being invalidated,
428
	 * go back to the slow path for further processing.
429
	 */
430
	if (vcpu_el2_e2h_is_set(vcpu) && vcpu_el2_tge_is_set(vcpu) &&
431
	    atomic_read(&vcpu->kvm->arch.vncr_map_count))
432
		return false;
433

434
	__kvm_skip_instr(vcpu);
435

436
	return true;
437
}
438

439
static bool kvm_hyp_handle_cpacr_el1(struct kvm_vcpu *vcpu, u64 *exit_code)
440
{
441
	u64 esr = kvm_vcpu_get_esr(vcpu);
442
	int rt;
443

444
	if (!is_hyp_ctxt(vcpu) || esr_sys64_to_sysreg(esr) != SYS_CPACR_EL1)
445
		return false;
446

447
	rt = kvm_vcpu_sys_get_rt(vcpu);
448

449
	if ((esr & ESR_ELx_SYS64_ISS_DIR_MASK) == ESR_ELx_SYS64_ISS_DIR_READ) {
450
		vcpu_set_reg(vcpu, rt, __vcpu_sys_reg(vcpu, CPTR_EL2));
451
	} else {
452
		vcpu_write_sys_reg(vcpu, vcpu_get_reg(vcpu, rt), CPTR_EL2);
453
		__activate_cptr_traps(vcpu);
454
	}
455

456
	__kvm_skip_instr(vcpu);
457

458
	return true;
459
}
460

461
static bool kvm_hyp_handle_zcr_el2(struct kvm_vcpu *vcpu, u64 *exit_code)
462
{
463
	u32 sysreg = esr_sys64_to_sysreg(kvm_vcpu_get_esr(vcpu));
464

465
	if (!vcpu_has_nv(vcpu))
466
		return false;
467

468
	if (sysreg != SYS_ZCR_EL2)
469
		return false;
470

471
	if (guest_owns_fp_regs())
472
		return false;
473

474
	/*
475
	 * ZCR_EL2 traps are handled in the slow path, with the expectation
476
	 * that the guest's FP context has already been loaded onto the CPU.
477
	 *
478
	 * Load the guest's FP context and unconditionally forward to the
479
	 * slow path for handling (i.e. return false).
480
	 */
481
	kvm_hyp_handle_fpsimd(vcpu, exit_code);
482
	return false;
483
}
484

485
static bool kvm_hyp_handle_sysreg_vhe(struct kvm_vcpu *vcpu, u64 *exit_code)
486
{
487
	if (kvm_hyp_handle_tlbi_el2(vcpu, exit_code))
488
		return true;
489

490
	if (kvm_hyp_handle_timer(vcpu, exit_code))
491
		return true;
492

493
	if (kvm_hyp_handle_cpacr_el1(vcpu, exit_code))
494
		return true;
495

496
	if (kvm_hyp_handle_zcr_el2(vcpu, exit_code))
497
		return true;
498

499
	return kvm_hyp_handle_sysreg(vcpu, exit_code);
500
}
501

502
static bool kvm_hyp_handle_impdef(struct kvm_vcpu *vcpu, u64 *exit_code)
503
{
504
	u64 iss;
505

506
	if (!cpus_have_final_cap(ARM64_WORKAROUND_PMUV3_IMPDEF_TRAPS))
507
		return false;
508

509
	/*
510
	 * Compute a synthetic ESR for a sysreg trap. Conveniently, AFSR1_EL2
511
	 * is populated with a correct ISS for a sysreg trap. These fruity
512
	 * parts are 64bit only, so unconditionally set IL.
513
	 */
514
	iss = ESR_ELx_ISS(read_sysreg_s(SYS_AFSR1_EL2));
515
	vcpu->arch.fault.esr_el2 = FIELD_PREP(ESR_ELx_EC_MASK, ESR_ELx_EC_SYS64) |
516
				   FIELD_PREP(ESR_ELx_ISS_MASK, iss) |
517
				   ESR_ELx_IL;
518
	return false;
519
}
520

521
static const exit_handler_fn hyp_exit_handlers[] = {
522
	[0 ... ESR_ELx_EC_MAX]		= NULL,
523
	[ESR_ELx_EC_CP15_32]		= kvm_hyp_handle_cp15_32,
524
	[ESR_ELx_EC_SYS64]		= kvm_hyp_handle_sysreg_vhe,
525
	[ESR_ELx_EC_SVE]		= kvm_hyp_handle_fpsimd,
526
	[ESR_ELx_EC_FP_ASIMD]		= kvm_hyp_handle_fpsimd,
527
	[ESR_ELx_EC_IABT_LOW]		= kvm_hyp_handle_iabt_low,
528
	[ESR_ELx_EC_DABT_LOW]		= kvm_hyp_handle_dabt_low,
529
	[ESR_ELx_EC_WATCHPT_LOW]	= kvm_hyp_handle_watchpt_low,
530
	[ESR_ELx_EC_ERET]		= kvm_hyp_handle_eret,
531
	[ESR_ELx_EC_MOPS]		= kvm_hyp_handle_mops,
532

533
	/* Apple shenanigans */
534
	[0x3F]				= kvm_hyp_handle_impdef,
535
};
536

537
static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code)
538
{
539
	synchronize_vcpu_pstate(vcpu, exit_code);
540

541
	/*
542
	 * If we were in HYP context on entry, adjust the PSTATE view
543
	 * so that the usual helpers work correctly. This enforces our
544
	 * invariant that the guest's HYP context status is preserved
545
	 * across a run.
546
	 */
547
	if (vcpu_has_nv(vcpu) &&
548
	    unlikely(host_data_test_flag(VCPU_IN_HYP_CONTEXT))) {
549
		u64 mode = *vcpu_cpsr(vcpu) & (PSR_MODE_MASK | PSR_MODE32_BIT);
550

551
		switch (mode) {
552
		case PSR_MODE_EL1t:
553
			mode = PSR_MODE_EL2t;
554
			break;
555
		case PSR_MODE_EL1h:
556
			mode = PSR_MODE_EL2h;
557
			break;
558
		}
559

560
		*vcpu_cpsr(vcpu) &= ~(PSR_MODE_MASK | PSR_MODE32_BIT);
561
		*vcpu_cpsr(vcpu) |= mode;
562
	}
563

564
	/* Apply extreme paranoia! */
565
	BUG_ON(vcpu_has_nv(vcpu) &&
566
	       !!host_data_test_flag(VCPU_IN_HYP_CONTEXT) != is_hyp_ctxt(vcpu));
567

568
	return __fixup_guest_exit(vcpu, exit_code, hyp_exit_handlers);
569
}
570

571
/* Switch to the guest for VHE systems running in EL2 */
572
static int __kvm_vcpu_run_vhe(struct kvm_vcpu *vcpu)
573
{
574
	struct kvm_cpu_context *host_ctxt;
575
	struct kvm_cpu_context *guest_ctxt;
576
	u64 exit_code;
577

578
	host_ctxt = host_data_ptr(host_ctxt);
579
	guest_ctxt = &vcpu->arch.ctxt;
580

581
	fpsimd_lazy_switch_to_guest(vcpu);
582

583
	sysreg_save_host_state_vhe(host_ctxt);
584

585
	/*
586
	 * Note that ARM erratum 1165522 requires us to configure both stage 1
587
	 * and stage 2 translation for the guest context before we clear
588
	 * HCR_EL2.TGE. The stage 1 and stage 2 guest context has already been
589
	 * loaded on the CPU in kvm_vcpu_load_vhe().
590
	 */
591
	__activate_traps(vcpu);
592

593
	__kvm_adjust_pc(vcpu);
594

595
	sysreg_restore_guest_state_vhe(guest_ctxt);
596
	__debug_switch_to_guest(vcpu);
597

598
	do {
599
		/* Jump in the fire! */
600
		exit_code = __guest_enter(vcpu);
601

602
		/* And we're baaack! */
603
	} while (fixup_guest_exit(vcpu, &exit_code));
604

605
	sysreg_save_guest_state_vhe(guest_ctxt);
606

607
	__deactivate_traps(vcpu);
608

609
	sysreg_restore_host_state_vhe(host_ctxt);
610

611
	__debug_switch_to_host(vcpu);
612

613
	/*
614
	 * Ensure that all system register writes above have taken effect
615
	 * before returning to the host. In VHE mode, CPTR traps for
616
	 * FPSIMD/SVE/SME also apply to EL2, so FPSIMD/SVE/SME state must be
617
	 * manipulated after the ISB.
618
	 */
619
	isb();
620

621
	fpsimd_lazy_switch_to_host(vcpu);
622

623
	if (guest_owns_fp_regs())
624
		__fpsimd_save_fpexc32(vcpu);
625

626
	return exit_code;
627
}
628
NOKPROBE_SYMBOL(__kvm_vcpu_run_vhe);
629

630
int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
631
{
632
	int ret;
633

634
	local_daif_mask();
635

636
	/*
637
	 * Having IRQs masked via PMR when entering the guest means the GIC
638
	 * will not signal the CPU of interrupts of lower priority, and the
639
	 * only way to get out will be via guest exceptions.
640
	 * Naturally, we want to avoid this.
641
	 *
642
	 * local_daif_mask() already sets GIC_PRIO_PSR_I_SET, we just need a
643
	 * dsb to ensure the redistributor is forwards EL2 IRQs to the CPU.
644
	 */
645
	pmr_sync();
646

647
	ret = __kvm_vcpu_run_vhe(vcpu);
648

649
	/*
650
	 * local_daif_restore() takes care to properly restore PSTATE.DAIF
651
	 * and the GIC PMR if the host is using IRQ priorities.
652
	 */
653
	local_daif_restore(DAIF_PROCCTX_NOIRQ);
654

655
	return ret;
656
}
657

658
static void __noreturn __hyp_call_panic(u64 spsr, u64 elr, u64 par)
659
{
660
	struct kvm_cpu_context *host_ctxt;
661
	struct kvm_vcpu *vcpu;
662

663
	host_ctxt = host_data_ptr(host_ctxt);
664
	vcpu = host_ctxt->__hyp_running_vcpu;
665

666
	__deactivate_traps(vcpu);
667
	sysreg_restore_host_state_vhe(host_ctxt);
668

669
	panic("HYP panic:\nPS:%08llx PC:%016llx ESR:%08llx\nFAR:%016llx HPFAR:%016llx PAR:%016llx\nVCPU:%p\n",
670
	      spsr, elr,
671
	      read_sysreg_el2(SYS_ESR), read_sysreg_el2(SYS_FAR),
672
	      read_sysreg(hpfar_el2), par, vcpu);
673
}
674
NOKPROBE_SYMBOL(__hyp_call_panic);
675

676
void __noreturn hyp_panic(void)
677
{
678
	u64 spsr = read_sysreg_el2(SYS_SPSR);
679
	u64 elr = read_sysreg_el2(SYS_ELR);
680
	u64 par = read_sysreg_par();
681

682
	__hyp_call_panic(spsr, elr, par);
683
}
684

685
asmlinkage void kvm_unexpected_el2_exception(void)
686
{
687
	__kvm_unexpected_el2_exception();
688
}
689

690