xref: /linux/arch/arm64/kvm/arm.c (revision 9052e9c95d908d6c3d7570aadc8898e1d871c8bb)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2012 - Virtual Open Systems and Columbia University
4  * Author: Christoffer Dall <c.dall@virtualopensystems.com>
5  */
6 
7 #include <linux/bug.h>
8 #include <linux/cpu_pm.h>
9 #include <linux/entry-kvm.h>
10 #include <linux/errno.h>
11 #include <linux/err.h>
12 #include <linux/kvm_host.h>
13 #include <linux/list.h>
14 #include <linux/module.h>
15 #include <linux/vmalloc.h>
16 #include <linux/fs.h>
17 #include <linux/mman.h>
18 #include <linux/sched.h>
19 #include <linux/kmemleak.h>
20 #include <linux/kvm.h>
21 #include <linux/kvm_irqfd.h>
22 #include <linux/irqbypass.h>
23 #include <linux/sched/stat.h>
24 #include <linux/psci.h>
25 #include <trace/events/kvm.h>
26 
27 #define CREATE_TRACE_POINTS
28 #include "trace_arm.h"
29 
30 #include <linux/uaccess.h>
31 #include <asm/ptrace.h>
32 #include <asm/mman.h>
33 #include <asm/tlbflush.h>
34 #include <asm/cacheflush.h>
35 #include <asm/cpufeature.h>
36 #include <asm/virt.h>
37 #include <asm/kvm_arm.h>
38 #include <asm/kvm_asm.h>
39 #include <asm/kvm_mmu.h>
40 #include <asm/kvm_emulate.h>
41 #include <asm/sections.h>
42 
43 #include <kvm/arm_hypercalls.h>
44 #include <kvm/arm_pmu.h>
45 #include <kvm/arm_psci.h>
46 
47 static enum kvm_mode kvm_mode = KVM_MODE_DEFAULT;
48 DEFINE_STATIC_KEY_FALSE(kvm_protected_mode_initialized);
49 
50 DECLARE_KVM_HYP_PER_CPU(unsigned long, kvm_hyp_vector);
51 
52 static DEFINE_PER_CPU(unsigned long, kvm_arm_hyp_stack_page);
53 unsigned long kvm_arm_hyp_percpu_base[NR_CPUS];
54 DECLARE_KVM_NVHE_PER_CPU(struct kvm_nvhe_init_params, kvm_init_params);
55 
56 /* The VMID used in the VTTBR */
57 static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
58 static u32 kvm_next_vmid;
59 static DEFINE_SPINLOCK(kvm_vmid_lock);
60 
61 static bool vgic_present;
62 
63 static DEFINE_PER_CPU(unsigned char, kvm_arm_hardware_enabled);
64 DEFINE_STATIC_KEY_FALSE(userspace_irqchip_in_use);
65 
66 int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu)
67 {
68 	return kvm_vcpu_exiting_guest_mode(vcpu) == IN_GUEST_MODE;
69 }
70 
71 int kvm_arch_hardware_setup(void *opaque)
72 {
73 	return 0;
74 }
75 
76 int kvm_arch_check_processor_compat(void *opaque)
77 {
78 	return 0;
79 }
80 
81 int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
82 			    struct kvm_enable_cap *cap)
83 {
84 	int r;
85 
86 	if (cap->flags)
87 		return -EINVAL;
88 
89 	switch (cap->cap) {
90 	case KVM_CAP_ARM_NISV_TO_USER:
91 		r = 0;
92 		kvm->arch.return_nisv_io_abort_to_user = true;
93 		break;
94 	case KVM_CAP_ARM_MTE:
95 		mutex_lock(&kvm->lock);
96 		if (!system_supports_mte() || kvm->created_vcpus) {
97 			r = -EINVAL;
98 		} else {
99 			r = 0;
100 			kvm->arch.mte_enabled = true;
101 		}
102 		mutex_unlock(&kvm->lock);
103 		break;
104 	default:
105 		r = -EINVAL;
106 		break;
107 	}
108 
109 	return r;
110 }
111 
112 static int kvm_arm_default_max_vcpus(void)
113 {
114 	return vgic_present ? kvm_vgic_get_max_vcpus() : KVM_MAX_VCPUS;
115 }
116 
117 static void set_default_spectre(struct kvm *kvm)
118 {
119 	/*
120 	 * The default is to expose CSV2 == 1 if the HW isn't affected.
121 	 * Although this is a per-CPU feature, we make it global because
122 	 * asymmetric systems are just a nuisance.
123 	 *
124 	 * Userspace can override this as long as it doesn't promise
125 	 * the impossible.
126 	 */
127 	if (arm64_get_spectre_v2_state() == SPECTRE_UNAFFECTED)
128 		kvm->arch.pfr0_csv2 = 1;
129 	if (arm64_get_meltdown_state() == SPECTRE_UNAFFECTED)
130 		kvm->arch.pfr0_csv3 = 1;
131 }
132 
133 /**
134  * kvm_arch_init_vm - initializes a VM data structure
135  * @kvm:	pointer to the KVM struct
136  */
137 int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
138 {
139 	int ret;
140 
141 	ret = kvm_arm_setup_stage2(kvm, type);
142 	if (ret)
143 		return ret;
144 
145 	ret = kvm_init_stage2_mmu(kvm, &kvm->arch.mmu);
146 	if (ret)
147 		return ret;
148 
149 	ret = create_hyp_mappings(kvm, kvm + 1, PAGE_HYP);
150 	if (ret)
151 		goto out_free_stage2_pgd;
152 
153 	kvm_vgic_early_init(kvm);
154 
155 	/* The maximum number of VCPUs is limited by the host's GIC model */
156 	kvm->arch.max_vcpus = kvm_arm_default_max_vcpus();
157 
158 	set_default_spectre(kvm);
159 
160 	return ret;
161 out_free_stage2_pgd:
162 	kvm_free_stage2_pgd(&kvm->arch.mmu);
163 	return ret;
164 }
165 
166 vm_fault_t kvm_arch_vcpu_fault(struct kvm_vcpu *vcpu, struct vm_fault *vmf)
167 {
168 	return VM_FAULT_SIGBUS;
169 }
170 
171 
172 /**
173  * kvm_arch_destroy_vm - destroy the VM data structure
174  * @kvm:	pointer to the KVM struct
175  */
176 void kvm_arch_destroy_vm(struct kvm *kvm)
177 {
178 	int i;
179 
180 	bitmap_free(kvm->arch.pmu_filter);
181 
182 	kvm_vgic_destroy(kvm);
183 
184 	for (i = 0; i < KVM_MAX_VCPUS; ++i) {
185 		if (kvm->vcpus[i]) {
186 			kvm_vcpu_destroy(kvm->vcpus[i]);
187 			kvm->vcpus[i] = NULL;
188 		}
189 	}
190 	atomic_set(&kvm->online_vcpus, 0);
191 }
192 
193 int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
194 {
195 	int r;
196 	switch (ext) {
197 	case KVM_CAP_IRQCHIP:
198 		r = vgic_present;
199 		break;
200 	case KVM_CAP_IOEVENTFD:
201 	case KVM_CAP_DEVICE_CTRL:
202 	case KVM_CAP_USER_MEMORY:
203 	case KVM_CAP_SYNC_MMU:
204 	case KVM_CAP_DESTROY_MEMORY_REGION_WORKS:
205 	case KVM_CAP_ONE_REG:
206 	case KVM_CAP_ARM_PSCI:
207 	case KVM_CAP_ARM_PSCI_0_2:
208 	case KVM_CAP_READONLY_MEM:
209 	case KVM_CAP_MP_STATE:
210 	case KVM_CAP_IMMEDIATE_EXIT:
211 	case KVM_CAP_VCPU_EVENTS:
212 	case KVM_CAP_ARM_IRQ_LINE_LAYOUT_2:
213 	case KVM_CAP_ARM_NISV_TO_USER:
214 	case KVM_CAP_ARM_INJECT_EXT_DABT:
215 	case KVM_CAP_SET_GUEST_DEBUG:
216 	case KVM_CAP_VCPU_ATTRIBUTES:
217 	case KVM_CAP_PTP_KVM:
218 		r = 1;
219 		break;
220 	case KVM_CAP_SET_GUEST_DEBUG2:
221 		return KVM_GUESTDBG_VALID_MASK;
222 	case KVM_CAP_ARM_SET_DEVICE_ADDR:
223 		r = 1;
224 		break;
225 	case KVM_CAP_NR_VCPUS:
226 		r = num_online_cpus();
227 		break;
228 	case KVM_CAP_MAX_VCPUS:
229 	case KVM_CAP_MAX_VCPU_ID:
230 		if (kvm)
231 			r = kvm->arch.max_vcpus;
232 		else
233 			r = kvm_arm_default_max_vcpus();
234 		break;
235 	case KVM_CAP_MSI_DEVID:
236 		if (!kvm)
237 			r = -EINVAL;
238 		else
239 			r = kvm->arch.vgic.msis_require_devid;
240 		break;
241 	case KVM_CAP_ARM_USER_IRQ:
242 		/*
243 		 * 1: EL1_VTIMER, EL1_PTIMER, and PMU.
244 		 * (bump this number if adding more devices)
245 		 */
246 		r = 1;
247 		break;
248 	case KVM_CAP_ARM_MTE:
249 		r = system_supports_mte();
250 		break;
251 	case KVM_CAP_STEAL_TIME:
252 		r = kvm_arm_pvtime_supported();
253 		break;
254 	case KVM_CAP_ARM_EL1_32BIT:
255 		r = cpus_have_const_cap(ARM64_HAS_32BIT_EL1);
256 		break;
257 	case KVM_CAP_GUEST_DEBUG_HW_BPS:
258 		r = get_num_brps();
259 		break;
260 	case KVM_CAP_GUEST_DEBUG_HW_WPS:
261 		r = get_num_wrps();
262 		break;
263 	case KVM_CAP_ARM_PMU_V3:
264 		r = kvm_arm_support_pmu_v3();
265 		break;
266 	case KVM_CAP_ARM_INJECT_SERROR_ESR:
267 		r = cpus_have_const_cap(ARM64_HAS_RAS_EXTN);
268 		break;
269 	case KVM_CAP_ARM_VM_IPA_SIZE:
270 		r = get_kvm_ipa_limit();
271 		break;
272 	case KVM_CAP_ARM_SVE:
273 		r = system_supports_sve();
274 		break;
275 	case KVM_CAP_ARM_PTRAUTH_ADDRESS:
276 	case KVM_CAP_ARM_PTRAUTH_GENERIC:
277 		r = system_has_full_ptr_auth();
278 		break;
279 	default:
280 		r = 0;
281 	}
282 
283 	return r;
284 }
285 
286 long kvm_arch_dev_ioctl(struct file *filp,
287 			unsigned int ioctl, unsigned long arg)
288 {
289 	return -EINVAL;
290 }
291 
292 struct kvm *kvm_arch_alloc_vm(void)
293 {
294 	if (!has_vhe())
295 		return kzalloc(sizeof(struct kvm), GFP_KERNEL);
296 
297 	return vzalloc(sizeof(struct kvm));
298 }
299 
300 void kvm_arch_free_vm(struct kvm *kvm)
301 {
302 	if (!has_vhe())
303 		kfree(kvm);
304 	else
305 		vfree(kvm);
306 }
307 
308 int kvm_arch_vcpu_precreate(struct kvm *kvm, unsigned int id)
309 {
310 	if (irqchip_in_kernel(kvm) && vgic_initialized(kvm))
311 		return -EBUSY;
312 
313 	if (id >= kvm->arch.max_vcpus)
314 		return -EINVAL;
315 
316 	return 0;
317 }
318 
319 int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
320 {
321 	int err;
322 
323 	/* Force users to call KVM_ARM_VCPU_INIT */
324 	vcpu->arch.target = -1;
325 	bitmap_zero(vcpu->arch.features, KVM_VCPU_MAX_FEATURES);
326 
327 	vcpu->arch.mmu_page_cache.gfp_zero = __GFP_ZERO;
328 
329 	/* Set up the timer */
330 	kvm_timer_vcpu_init(vcpu);
331 
332 	kvm_pmu_vcpu_init(vcpu);
333 
334 	kvm_arm_reset_debug_ptr(vcpu);
335 
336 	kvm_arm_pvtime_vcpu_init(&vcpu->arch);
337 
338 	vcpu->arch.hw_mmu = &vcpu->kvm->arch.mmu;
339 
340 	err = kvm_vgic_vcpu_init(vcpu);
341 	if (err)
342 		return err;
343 
344 	return create_hyp_mappings(vcpu, vcpu + 1, PAGE_HYP);
345 }
346 
347 void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu)
348 {
349 }
350 
351 void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
352 {
353 	if (vcpu->arch.has_run_once && unlikely(!irqchip_in_kernel(vcpu->kvm)))
354 		static_branch_dec(&userspace_irqchip_in_use);
355 
356 	kvm_mmu_free_memory_cache(&vcpu->arch.mmu_page_cache);
357 	kvm_timer_vcpu_terminate(vcpu);
358 	kvm_pmu_vcpu_destroy(vcpu);
359 
360 	kvm_arm_vcpu_destroy(vcpu);
361 }
362 
363 int kvm_cpu_has_pending_timer(struct kvm_vcpu *vcpu)
364 {
365 	return kvm_timer_is_pending(vcpu);
366 }
367 
368 void kvm_arch_vcpu_blocking(struct kvm_vcpu *vcpu)
369 {
370 	/*
371 	 * If we're about to block (most likely because we've just hit a
372 	 * WFI), we need to sync back the state of the GIC CPU interface
373 	 * so that we have the latest PMR and group enables. This ensures
374 	 * that kvm_arch_vcpu_runnable has up-to-date data to decide
375 	 * whether we have pending interrupts.
376 	 *
377 	 * For the same reason, we want to tell GICv4 that we need
378 	 * doorbells to be signalled, should an interrupt become pending.
379 	 */
380 	preempt_disable();
381 	kvm_vgic_vmcr_sync(vcpu);
382 	vgic_v4_put(vcpu, true);
383 	preempt_enable();
384 }
385 
386 void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu)
387 {
388 	preempt_disable();
389 	vgic_v4_load(vcpu);
390 	preempt_enable();
391 }
392 
393 void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
394 {
395 	struct kvm_s2_mmu *mmu;
396 	int *last_ran;
397 
398 	mmu = vcpu->arch.hw_mmu;
399 	last_ran = this_cpu_ptr(mmu->last_vcpu_ran);
400 
401 	/*
402 	 * We guarantee that both TLBs and I-cache are private to each
403 	 * vcpu. If detecting that a vcpu from the same VM has
404 	 * previously run on the same physical CPU, call into the
405 	 * hypervisor code to nuke the relevant contexts.
406 	 *
407 	 * We might get preempted before the vCPU actually runs, but
408 	 * over-invalidation doesn't affect correctness.
409 	 */
410 	if (*last_ran != vcpu->vcpu_id) {
411 		kvm_call_hyp(__kvm_flush_cpu_context, mmu);
412 		*last_ran = vcpu->vcpu_id;
413 	}
414 
415 	vcpu->cpu = cpu;
416 
417 	kvm_vgic_load(vcpu);
418 	kvm_timer_vcpu_load(vcpu);
419 	if (has_vhe())
420 		kvm_vcpu_load_sysregs_vhe(vcpu);
421 	kvm_arch_vcpu_load_fp(vcpu);
422 	kvm_vcpu_pmu_restore_guest(vcpu);
423 	if (kvm_arm_is_pvtime_enabled(&vcpu->arch))
424 		kvm_make_request(KVM_REQ_RECORD_STEAL, vcpu);
425 
426 	if (single_task_running())
427 		vcpu_clear_wfx_traps(vcpu);
428 	else
429 		vcpu_set_wfx_traps(vcpu);
430 
431 	if (vcpu_has_ptrauth(vcpu))
432 		vcpu_ptrauth_disable(vcpu);
433 	kvm_arch_vcpu_load_debug_state_flags(vcpu);
434 }
435 
436 void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
437 {
438 	kvm_arch_vcpu_put_debug_state_flags(vcpu);
439 	kvm_arch_vcpu_put_fp(vcpu);
440 	if (has_vhe())
441 		kvm_vcpu_put_sysregs_vhe(vcpu);
442 	kvm_timer_vcpu_put(vcpu);
443 	kvm_vgic_put(vcpu);
444 	kvm_vcpu_pmu_restore_host(vcpu);
445 
446 	vcpu->cpu = -1;
447 }
448 
449 static void vcpu_power_off(struct kvm_vcpu *vcpu)
450 {
451 	vcpu->arch.power_off = true;
452 	kvm_make_request(KVM_REQ_SLEEP, vcpu);
453 	kvm_vcpu_kick(vcpu);
454 }
455 
456 int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu,
457 				    struct kvm_mp_state *mp_state)
458 {
459 	if (vcpu->arch.power_off)
460 		mp_state->mp_state = KVM_MP_STATE_STOPPED;
461 	else
462 		mp_state->mp_state = KVM_MP_STATE_RUNNABLE;
463 
464 	return 0;
465 }
466 
467 int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
468 				    struct kvm_mp_state *mp_state)
469 {
470 	int ret = 0;
471 
472 	switch (mp_state->mp_state) {
473 	case KVM_MP_STATE_RUNNABLE:
474 		vcpu->arch.power_off = false;
475 		break;
476 	case KVM_MP_STATE_STOPPED:
477 		vcpu_power_off(vcpu);
478 		break;
479 	default:
480 		ret = -EINVAL;
481 	}
482 
483 	return ret;
484 }
485 
486 /**
487  * kvm_arch_vcpu_runnable - determine if the vcpu can be scheduled
488  * @v:		The VCPU pointer
489  *
490  * If the guest CPU is not waiting for interrupts or an interrupt line is
491  * asserted, the CPU is by definition runnable.
492  */
493 int kvm_arch_vcpu_runnable(struct kvm_vcpu *v)
494 {
495 	bool irq_lines = *vcpu_hcr(v) & (HCR_VI | HCR_VF);
496 	return ((irq_lines || kvm_vgic_vcpu_pending_irq(v))
497 		&& !v->arch.power_off && !v->arch.pause);
498 }
499 
500 bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
501 {
502 	return vcpu_mode_priv(vcpu);
503 }
504 
505 /* Just ensure a guest exit from a particular CPU */
506 static void exit_vm_noop(void *info)
507 {
508 }
509 
510 void force_vm_exit(const cpumask_t *mask)
511 {
512 	preempt_disable();
513 	smp_call_function_many(mask, exit_vm_noop, NULL, true);
514 	preempt_enable();
515 }
516 
517 /**
518  * need_new_vmid_gen - check that the VMID is still valid
519  * @vmid: The VMID to check
520  *
521  * return true if there is a new generation of VMIDs being used
522  *
523  * The hardware supports a limited set of values with the value zero reserved
524  * for the host, so we check if an assigned value belongs to a previous
525  * generation, which requires us to assign a new value. If we're the first to
526  * use a VMID for the new generation, we must flush necessary caches and TLBs
527  * on all CPUs.
528  */
529 static bool need_new_vmid_gen(struct kvm_vmid *vmid)
530 {
531 	u64 current_vmid_gen = atomic64_read(&kvm_vmid_gen);
532 	smp_rmb(); /* Orders read of kvm_vmid_gen and kvm->arch.vmid */
533 	return unlikely(READ_ONCE(vmid->vmid_gen) != current_vmid_gen);
534 }
535 
536 /**
537  * update_vmid - Update the vmid with a valid VMID for the current generation
538  * @vmid: The stage-2 VMID information struct
539  */
540 static void update_vmid(struct kvm_vmid *vmid)
541 {
542 	if (!need_new_vmid_gen(vmid))
543 		return;
544 
545 	spin_lock(&kvm_vmid_lock);
546 
547 	/*
548 	 * We need to re-check the vmid_gen here to ensure that if another vcpu
549 	 * already allocated a valid vmid for this vm, then this vcpu should
550 	 * use the same vmid.
551 	 */
552 	if (!need_new_vmid_gen(vmid)) {
553 		spin_unlock(&kvm_vmid_lock);
554 		return;
555 	}
556 
557 	/* First user of a new VMID generation? */
558 	if (unlikely(kvm_next_vmid == 0)) {
559 		atomic64_inc(&kvm_vmid_gen);
560 		kvm_next_vmid = 1;
561 
562 		/*
563 		 * On SMP we know no other CPUs can use this CPU's or each
564 		 * other's VMID after force_vm_exit returns since the
565 		 * kvm_vmid_lock blocks them from reentry to the guest.
566 		 */
567 		force_vm_exit(cpu_all_mask);
568 		/*
569 		 * Now broadcast TLB + ICACHE invalidation over the inner
570 		 * shareable domain to make sure all data structures are
571 		 * clean.
572 		 */
573 		kvm_call_hyp(__kvm_flush_vm_context);
574 	}
575 
576 	WRITE_ONCE(vmid->vmid, kvm_next_vmid);
577 	kvm_next_vmid++;
578 	kvm_next_vmid &= (1 << kvm_get_vmid_bits()) - 1;
579 
580 	smp_wmb();
581 	WRITE_ONCE(vmid->vmid_gen, atomic64_read(&kvm_vmid_gen));
582 
583 	spin_unlock(&kvm_vmid_lock);
584 }
585 
586 static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
587 {
588 	struct kvm *kvm = vcpu->kvm;
589 	int ret = 0;
590 
591 	if (likely(vcpu->arch.has_run_once))
592 		return 0;
593 
594 	if (!kvm_arm_vcpu_is_finalized(vcpu))
595 		return -EPERM;
596 
597 	vcpu->arch.has_run_once = true;
598 
599 	kvm_arm_vcpu_init_debug(vcpu);
600 
601 	if (likely(irqchip_in_kernel(kvm))) {
602 		/*
603 		 * Map the VGIC hardware resources before running a vcpu the
604 		 * first time on this VM.
605 		 */
606 		ret = kvm_vgic_map_resources(kvm);
607 		if (ret)
608 			return ret;
609 	} else {
610 		/*
611 		 * Tell the rest of the code that there are userspace irqchip
612 		 * VMs in the wild.
613 		 */
614 		static_branch_inc(&userspace_irqchip_in_use);
615 	}
616 
617 	ret = kvm_timer_enable(vcpu);
618 	if (ret)
619 		return ret;
620 
621 	ret = kvm_arm_pmu_v3_enable(vcpu);
622 
623 	return ret;
624 }
625 
626 bool kvm_arch_intc_initialized(struct kvm *kvm)
627 {
628 	return vgic_initialized(kvm);
629 }
630 
631 void kvm_arm_halt_guest(struct kvm *kvm)
632 {
633 	int i;
634 	struct kvm_vcpu *vcpu;
635 
636 	kvm_for_each_vcpu(i, vcpu, kvm)
637 		vcpu->arch.pause = true;
638 	kvm_make_all_cpus_request(kvm, KVM_REQ_SLEEP);
639 }
640 
641 void kvm_arm_resume_guest(struct kvm *kvm)
642 {
643 	int i;
644 	struct kvm_vcpu *vcpu;
645 
646 	kvm_for_each_vcpu(i, vcpu, kvm) {
647 		vcpu->arch.pause = false;
648 		rcuwait_wake_up(kvm_arch_vcpu_get_wait(vcpu));
649 	}
650 }
651 
652 static void vcpu_req_sleep(struct kvm_vcpu *vcpu)
653 {
654 	struct rcuwait *wait = kvm_arch_vcpu_get_wait(vcpu);
655 
656 	rcuwait_wait_event(wait,
657 			   (!vcpu->arch.power_off) &&(!vcpu->arch.pause),
658 			   TASK_INTERRUPTIBLE);
659 
660 	if (vcpu->arch.power_off || vcpu->arch.pause) {
661 		/* Awaken to handle a signal, request we sleep again later. */
662 		kvm_make_request(KVM_REQ_SLEEP, vcpu);
663 	}
664 
665 	/*
666 	 * Make sure we will observe a potential reset request if we've
667 	 * observed a change to the power state. Pairs with the smp_wmb() in
668 	 * kvm_psci_vcpu_on().
669 	 */
670 	smp_rmb();
671 }
672 
673 static int kvm_vcpu_initialized(struct kvm_vcpu *vcpu)
674 {
675 	return vcpu->arch.target >= 0;
676 }
677 
678 static void check_vcpu_requests(struct kvm_vcpu *vcpu)
679 {
680 	if (kvm_request_pending(vcpu)) {
681 		if (kvm_check_request(KVM_REQ_SLEEP, vcpu))
682 			vcpu_req_sleep(vcpu);
683 
684 		if (kvm_check_request(KVM_REQ_VCPU_RESET, vcpu))
685 			kvm_reset_vcpu(vcpu);
686 
687 		/*
688 		 * Clear IRQ_PENDING requests that were made to guarantee
689 		 * that a VCPU sees new virtual interrupts.
690 		 */
691 		kvm_check_request(KVM_REQ_IRQ_PENDING, vcpu);
692 
693 		if (kvm_check_request(KVM_REQ_RECORD_STEAL, vcpu))
694 			kvm_update_stolen_time(vcpu);
695 
696 		if (kvm_check_request(KVM_REQ_RELOAD_GICv4, vcpu)) {
697 			/* The distributor enable bits were changed */
698 			preempt_disable();
699 			vgic_v4_put(vcpu, false);
700 			vgic_v4_load(vcpu);
701 			preempt_enable();
702 		}
703 
704 		if (kvm_check_request(KVM_REQ_RELOAD_PMU, vcpu))
705 			kvm_pmu_handle_pmcr(vcpu,
706 					    __vcpu_sys_reg(vcpu, PMCR_EL0));
707 	}
708 }
709 
710 static bool vcpu_mode_is_bad_32bit(struct kvm_vcpu *vcpu)
711 {
712 	if (likely(!vcpu_mode_is_32bit(vcpu)))
713 		return false;
714 
715 	return !system_supports_32bit_el0() ||
716 		static_branch_unlikely(&arm64_mismatched_32bit_el0);
717 }
718 
719 /**
720  * kvm_vcpu_exit_request - returns true if the VCPU should *not* enter the guest
721  * @vcpu:	The VCPU pointer
722  * @ret:	Pointer to write optional return code
723  *
724  * Returns: true if the VCPU needs to return to a preemptible + interruptible
725  *	    and skip guest entry.
726  *
727  * This function disambiguates between two different types of exits: exits to a
728  * preemptible + interruptible kernel context and exits to userspace. For an
729  * exit to userspace, this function will write the return code to ret and return
730  * true. For an exit to preemptible + interruptible kernel context (i.e. check
731  * for pending work and re-enter), return true without writing to ret.
732  */
733 static bool kvm_vcpu_exit_request(struct kvm_vcpu *vcpu, int *ret)
734 {
735 	struct kvm_run *run = vcpu->run;
736 
737 	/*
738 	 * If we're using a userspace irqchip, then check if we need
739 	 * to tell a userspace irqchip about timer or PMU level
740 	 * changes and if so, exit to userspace (the actual level
741 	 * state gets updated in kvm_timer_update_run and
742 	 * kvm_pmu_update_run below).
743 	 */
744 	if (static_branch_unlikely(&userspace_irqchip_in_use)) {
745 		if (kvm_timer_should_notify_user(vcpu) ||
746 		    kvm_pmu_should_notify_user(vcpu)) {
747 			*ret = -EINTR;
748 			run->exit_reason = KVM_EXIT_INTR;
749 			return true;
750 		}
751 	}
752 
753 	return kvm_request_pending(vcpu) ||
754 			need_new_vmid_gen(&vcpu->arch.hw_mmu->vmid) ||
755 			xfer_to_guest_mode_work_pending();
756 }
757 
758 /**
759  * kvm_arch_vcpu_ioctl_run - the main VCPU run function to execute guest code
760  * @vcpu:	The VCPU pointer
761  *
762  * This function is called through the VCPU_RUN ioctl called from user space. It
763  * will execute VM code in a loop until the time slice for the process is used
764  * or some emulation is needed from user space in which case the function will
765  * return with return value 0 and with the kvm_run structure filled in with the
766  * required data for the requested emulation.
767  */
768 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
769 {
770 	struct kvm_run *run = vcpu->run;
771 	int ret;
772 
773 	if (unlikely(!kvm_vcpu_initialized(vcpu)))
774 		return -ENOEXEC;
775 
776 	ret = kvm_vcpu_first_run_init(vcpu);
777 	if (ret)
778 		return ret;
779 
780 	if (run->exit_reason == KVM_EXIT_MMIO) {
781 		ret = kvm_handle_mmio_return(vcpu);
782 		if (ret)
783 			return ret;
784 	}
785 
786 	vcpu_load(vcpu);
787 
788 	if (run->immediate_exit) {
789 		ret = -EINTR;
790 		goto out;
791 	}
792 
793 	kvm_sigset_activate(vcpu);
794 
795 	ret = 1;
796 	run->exit_reason = KVM_EXIT_UNKNOWN;
797 	while (ret > 0) {
798 		/*
799 		 * Check conditions before entering the guest
800 		 */
801 		ret = xfer_to_guest_mode_handle_work(vcpu);
802 		if (!ret)
803 			ret = 1;
804 
805 		update_vmid(&vcpu->arch.hw_mmu->vmid);
806 
807 		check_vcpu_requests(vcpu);
808 
809 		/*
810 		 * Preparing the interrupts to be injected also
811 		 * involves poking the GIC, which must be done in a
812 		 * non-preemptible context.
813 		 */
814 		preempt_disable();
815 
816 		kvm_pmu_flush_hwstate(vcpu);
817 
818 		local_irq_disable();
819 
820 		kvm_vgic_flush_hwstate(vcpu);
821 
822 		/*
823 		 * Ensure we set mode to IN_GUEST_MODE after we disable
824 		 * interrupts and before the final VCPU requests check.
825 		 * See the comment in kvm_vcpu_exiting_guest_mode() and
826 		 * Documentation/virt/kvm/vcpu-requests.rst
827 		 */
828 		smp_store_mb(vcpu->mode, IN_GUEST_MODE);
829 
830 		if (ret <= 0 || kvm_vcpu_exit_request(vcpu, &ret)) {
831 			vcpu->mode = OUTSIDE_GUEST_MODE;
832 			isb(); /* Ensure work in x_flush_hwstate is committed */
833 			kvm_pmu_sync_hwstate(vcpu);
834 			if (static_branch_unlikely(&userspace_irqchip_in_use))
835 				kvm_timer_sync_user(vcpu);
836 			kvm_vgic_sync_hwstate(vcpu);
837 			local_irq_enable();
838 			preempt_enable();
839 			continue;
840 		}
841 
842 		kvm_arm_setup_debug(vcpu);
843 
844 		/**************************************************************
845 		 * Enter the guest
846 		 */
847 		trace_kvm_entry(*vcpu_pc(vcpu));
848 		guest_enter_irqoff();
849 
850 		ret = kvm_call_hyp_ret(__kvm_vcpu_run, vcpu);
851 
852 		vcpu->mode = OUTSIDE_GUEST_MODE;
853 		vcpu->stat.exits++;
854 		/*
855 		 * Back from guest
856 		 *************************************************************/
857 
858 		kvm_arm_clear_debug(vcpu);
859 
860 		/*
861 		 * We must sync the PMU state before the vgic state so
862 		 * that the vgic can properly sample the updated state of the
863 		 * interrupt line.
864 		 */
865 		kvm_pmu_sync_hwstate(vcpu);
866 
867 		/*
868 		 * Sync the vgic state before syncing the timer state because
869 		 * the timer code needs to know if the virtual timer
870 		 * interrupts are active.
871 		 */
872 		kvm_vgic_sync_hwstate(vcpu);
873 
874 		/*
875 		 * Sync the timer hardware state before enabling interrupts as
876 		 * we don't want vtimer interrupts to race with syncing the
877 		 * timer virtual interrupt state.
878 		 */
879 		if (static_branch_unlikely(&userspace_irqchip_in_use))
880 			kvm_timer_sync_user(vcpu);
881 
882 		kvm_arch_vcpu_ctxsync_fp(vcpu);
883 
884 		/*
885 		 * We may have taken a host interrupt in HYP mode (ie
886 		 * while executing the guest). This interrupt is still
887 		 * pending, as we haven't serviced it yet!
888 		 *
889 		 * We're now back in SVC mode, with interrupts
890 		 * disabled.  Enabling the interrupts now will have
891 		 * the effect of taking the interrupt again, in SVC
892 		 * mode this time.
893 		 */
894 		local_irq_enable();
895 
896 		/*
897 		 * We do local_irq_enable() before calling guest_exit() so
898 		 * that if a timer interrupt hits while running the guest we
899 		 * account that tick as being spent in the guest.  We enable
900 		 * preemption after calling guest_exit() so that if we get
901 		 * preempted we make sure ticks after that is not counted as
902 		 * guest time.
903 		 */
904 		guest_exit();
905 		trace_kvm_exit(ret, kvm_vcpu_trap_get_class(vcpu), *vcpu_pc(vcpu));
906 
907 		/* Exit types that need handling before we can be preempted */
908 		handle_exit_early(vcpu, ret);
909 
910 		preempt_enable();
911 
912 		/*
913 		 * The ARMv8 architecture doesn't give the hypervisor
914 		 * a mechanism to prevent a guest from dropping to AArch32 EL0
915 		 * if implemented by the CPU. If we spot the guest in such
916 		 * state and that we decided it wasn't supposed to do so (like
917 		 * with the asymmetric AArch32 case), return to userspace with
918 		 * a fatal error.
919 		 */
920 		if (vcpu_mode_is_bad_32bit(vcpu)) {
921 			/*
922 			 * As we have caught the guest red-handed, decide that
923 			 * it isn't fit for purpose anymore by making the vcpu
924 			 * invalid. The VMM can try and fix it by issuing  a
925 			 * KVM_ARM_VCPU_INIT if it really wants to.
926 			 */
927 			vcpu->arch.target = -1;
928 			ret = ARM_EXCEPTION_IL;
929 		}
930 
931 		ret = handle_exit(vcpu, ret);
932 	}
933 
934 	/* Tell userspace about in-kernel device output levels */
935 	if (unlikely(!irqchip_in_kernel(vcpu->kvm))) {
936 		kvm_timer_update_run(vcpu);
937 		kvm_pmu_update_run(vcpu);
938 	}
939 
940 	kvm_sigset_deactivate(vcpu);
941 
942 out:
943 	/*
944 	 * In the unlikely event that we are returning to userspace
945 	 * with pending exceptions or PC adjustment, commit these
946 	 * adjustments in order to give userspace a consistent view of
947 	 * the vcpu state. Note that this relies on __kvm_adjust_pc()
948 	 * being preempt-safe on VHE.
949 	 */
950 	if (unlikely(vcpu->arch.flags & (KVM_ARM64_PENDING_EXCEPTION |
951 					 KVM_ARM64_INCREMENT_PC)))
952 		kvm_call_hyp(__kvm_adjust_pc, vcpu);
953 
954 	vcpu_put(vcpu);
955 	return ret;
956 }
957 
958 static int vcpu_interrupt_line(struct kvm_vcpu *vcpu, int number, bool level)
959 {
960 	int bit_index;
961 	bool set;
962 	unsigned long *hcr;
963 
964 	if (number == KVM_ARM_IRQ_CPU_IRQ)
965 		bit_index = __ffs(HCR_VI);
966 	else /* KVM_ARM_IRQ_CPU_FIQ */
967 		bit_index = __ffs(HCR_VF);
968 
969 	hcr = vcpu_hcr(vcpu);
970 	if (level)
971 		set = test_and_set_bit(bit_index, hcr);
972 	else
973 		set = test_and_clear_bit(bit_index, hcr);
974 
975 	/*
976 	 * If we didn't change anything, no need to wake up or kick other CPUs
977 	 */
978 	if (set == level)
979 		return 0;
980 
981 	/*
982 	 * The vcpu irq_lines field was updated, wake up sleeping VCPUs and
983 	 * trigger a world-switch round on the running physical CPU to set the
984 	 * virtual IRQ/FIQ fields in the HCR appropriately.
985 	 */
986 	kvm_make_request(KVM_REQ_IRQ_PENDING, vcpu);
987 	kvm_vcpu_kick(vcpu);
988 
989 	return 0;
990 }
991 
992 int kvm_vm_ioctl_irq_line(struct kvm *kvm, struct kvm_irq_level *irq_level,
993 			  bool line_status)
994 {
995 	u32 irq = irq_level->irq;
996 	unsigned int irq_type, vcpu_idx, irq_num;
997 	int nrcpus = atomic_read(&kvm->online_vcpus);
998 	struct kvm_vcpu *vcpu = NULL;
999 	bool level = irq_level->level;
1000 
1001 	irq_type = (irq >> KVM_ARM_IRQ_TYPE_SHIFT) & KVM_ARM_IRQ_TYPE_MASK;
1002 	vcpu_idx = (irq >> KVM_ARM_IRQ_VCPU_SHIFT) & KVM_ARM_IRQ_VCPU_MASK;
1003 	vcpu_idx += ((irq >> KVM_ARM_IRQ_VCPU2_SHIFT) & KVM_ARM_IRQ_VCPU2_MASK) * (KVM_ARM_IRQ_VCPU_MASK + 1);
1004 	irq_num = (irq >> KVM_ARM_IRQ_NUM_SHIFT) & KVM_ARM_IRQ_NUM_MASK;
1005 
1006 	trace_kvm_irq_line(irq_type, vcpu_idx, irq_num, irq_level->level);
1007 
1008 	switch (irq_type) {
1009 	case KVM_ARM_IRQ_TYPE_CPU:
1010 		if (irqchip_in_kernel(kvm))
1011 			return -ENXIO;
1012 
1013 		if (vcpu_idx >= nrcpus)
1014 			return -EINVAL;
1015 
1016 		vcpu = kvm_get_vcpu(kvm, vcpu_idx);
1017 		if (!vcpu)
1018 			return -EINVAL;
1019 
1020 		if (irq_num > KVM_ARM_IRQ_CPU_FIQ)
1021 			return -EINVAL;
1022 
1023 		return vcpu_interrupt_line(vcpu, irq_num, level);
1024 	case KVM_ARM_IRQ_TYPE_PPI:
1025 		if (!irqchip_in_kernel(kvm))
1026 			return -ENXIO;
1027 
1028 		if (vcpu_idx >= nrcpus)
1029 			return -EINVAL;
1030 
1031 		vcpu = kvm_get_vcpu(kvm, vcpu_idx);
1032 		if (!vcpu)
1033 			return -EINVAL;
1034 
1035 		if (irq_num < VGIC_NR_SGIS || irq_num >= VGIC_NR_PRIVATE_IRQS)
1036 			return -EINVAL;
1037 
1038 		return kvm_vgic_inject_irq(kvm, vcpu->vcpu_id, irq_num, level, NULL);
1039 	case KVM_ARM_IRQ_TYPE_SPI:
1040 		if (!irqchip_in_kernel(kvm))
1041 			return -ENXIO;
1042 
1043 		if (irq_num < VGIC_NR_PRIVATE_IRQS)
1044 			return -EINVAL;
1045 
1046 		return kvm_vgic_inject_irq(kvm, 0, irq_num, level, NULL);
1047 	}
1048 
1049 	return -EINVAL;
1050 }
1051 
1052 static int kvm_vcpu_set_target(struct kvm_vcpu *vcpu,
1053 			       const struct kvm_vcpu_init *init)
1054 {
1055 	unsigned int i, ret;
1056 	u32 phys_target = kvm_target_cpu();
1057 
1058 	if (init->target != phys_target)
1059 		return -EINVAL;
1060 
1061 	/*
1062 	 * Secondary and subsequent calls to KVM_ARM_VCPU_INIT must
1063 	 * use the same target.
1064 	 */
1065 	if (vcpu->arch.target != -1 && vcpu->arch.target != init->target)
1066 		return -EINVAL;
1067 
1068 	/* -ENOENT for unknown features, -EINVAL for invalid combinations. */
1069 	for (i = 0; i < sizeof(init->features) * 8; i++) {
1070 		bool set = (init->features[i / 32] & (1 << (i % 32)));
1071 
1072 		if (set && i >= KVM_VCPU_MAX_FEATURES)
1073 			return -ENOENT;
1074 
1075 		/*
1076 		 * Secondary and subsequent calls to KVM_ARM_VCPU_INIT must
1077 		 * use the same feature set.
1078 		 */
1079 		if (vcpu->arch.target != -1 && i < KVM_VCPU_MAX_FEATURES &&
1080 		    test_bit(i, vcpu->arch.features) != set)
1081 			return -EINVAL;
1082 
1083 		if (set)
1084 			set_bit(i, vcpu->arch.features);
1085 	}
1086 
1087 	vcpu->arch.target = phys_target;
1088 
1089 	/* Now we know what it is, we can reset it. */
1090 	ret = kvm_reset_vcpu(vcpu);
1091 	if (ret) {
1092 		vcpu->arch.target = -1;
1093 		bitmap_zero(vcpu->arch.features, KVM_VCPU_MAX_FEATURES);
1094 	}
1095 
1096 	return ret;
1097 }
1098 
1099 static int kvm_arch_vcpu_ioctl_vcpu_init(struct kvm_vcpu *vcpu,
1100 					 struct kvm_vcpu_init *init)
1101 {
1102 	int ret;
1103 
1104 	ret = kvm_vcpu_set_target(vcpu, init);
1105 	if (ret)
1106 		return ret;
1107 
1108 	/*
1109 	 * Ensure a rebooted VM will fault in RAM pages and detect if the
1110 	 * guest MMU is turned off and flush the caches as needed.
1111 	 *
1112 	 * S2FWB enforces all memory accesses to RAM being cacheable,
1113 	 * ensuring that the data side is always coherent. We still
1114 	 * need to invalidate the I-cache though, as FWB does *not*
1115 	 * imply CTR_EL0.DIC.
1116 	 */
1117 	if (vcpu->arch.has_run_once) {
1118 		if (!cpus_have_final_cap(ARM64_HAS_STAGE2_FWB))
1119 			stage2_unmap_vm(vcpu->kvm);
1120 		else
1121 			icache_inval_all_pou();
1122 	}
1123 
1124 	vcpu_reset_hcr(vcpu);
1125 	vcpu->arch.cptr_el2 = CPTR_EL2_DEFAULT;
1126 
1127 	/*
1128 	 * Handle the "start in power-off" case.
1129 	 */
1130 	if (test_bit(KVM_ARM_VCPU_POWER_OFF, vcpu->arch.features))
1131 		vcpu_power_off(vcpu);
1132 	else
1133 		vcpu->arch.power_off = false;
1134 
1135 	return 0;
1136 }
1137 
1138 static int kvm_arm_vcpu_set_attr(struct kvm_vcpu *vcpu,
1139 				 struct kvm_device_attr *attr)
1140 {
1141 	int ret = -ENXIO;
1142 
1143 	switch (attr->group) {
1144 	default:
1145 		ret = kvm_arm_vcpu_arch_set_attr(vcpu, attr);
1146 		break;
1147 	}
1148 
1149 	return ret;
1150 }
1151 
1152 static int kvm_arm_vcpu_get_attr(struct kvm_vcpu *vcpu,
1153 				 struct kvm_device_attr *attr)
1154 {
1155 	int ret = -ENXIO;
1156 
1157 	switch (attr->group) {
1158 	default:
1159 		ret = kvm_arm_vcpu_arch_get_attr(vcpu, attr);
1160 		break;
1161 	}
1162 
1163 	return ret;
1164 }
1165 
1166 static int kvm_arm_vcpu_has_attr(struct kvm_vcpu *vcpu,
1167 				 struct kvm_device_attr *attr)
1168 {
1169 	int ret = -ENXIO;
1170 
1171 	switch (attr->group) {
1172 	default:
1173 		ret = kvm_arm_vcpu_arch_has_attr(vcpu, attr);
1174 		break;
1175 	}
1176 
1177 	return ret;
1178 }
1179 
1180 static int kvm_arm_vcpu_get_events(struct kvm_vcpu *vcpu,
1181 				   struct kvm_vcpu_events *events)
1182 {
1183 	memset(events, 0, sizeof(*events));
1184 
1185 	return __kvm_arm_vcpu_get_events(vcpu, events);
1186 }
1187 
1188 static int kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu,
1189 				   struct kvm_vcpu_events *events)
1190 {
1191 	int i;
1192 
1193 	/* check whether the reserved field is zero */
1194 	for (i = 0; i < ARRAY_SIZE(events->reserved); i++)
1195 		if (events->reserved[i])
1196 			return -EINVAL;
1197 
1198 	/* check whether the pad field is zero */
1199 	for (i = 0; i < ARRAY_SIZE(events->exception.pad); i++)
1200 		if (events->exception.pad[i])
1201 			return -EINVAL;
1202 
1203 	return __kvm_arm_vcpu_set_events(vcpu, events);
1204 }
1205 
1206 long kvm_arch_vcpu_ioctl(struct file *filp,
1207 			 unsigned int ioctl, unsigned long arg)
1208 {
1209 	struct kvm_vcpu *vcpu = filp->private_data;
1210 	void __user *argp = (void __user *)arg;
1211 	struct kvm_device_attr attr;
1212 	long r;
1213 
1214 	switch (ioctl) {
1215 	case KVM_ARM_VCPU_INIT: {
1216 		struct kvm_vcpu_init init;
1217 
1218 		r = -EFAULT;
1219 		if (copy_from_user(&init, argp, sizeof(init)))
1220 			break;
1221 
1222 		r = kvm_arch_vcpu_ioctl_vcpu_init(vcpu, &init);
1223 		break;
1224 	}
1225 	case KVM_SET_ONE_REG:
1226 	case KVM_GET_ONE_REG: {
1227 		struct kvm_one_reg reg;
1228 
1229 		r = -ENOEXEC;
1230 		if (unlikely(!kvm_vcpu_initialized(vcpu)))
1231 			break;
1232 
1233 		r = -EFAULT;
1234 		if (copy_from_user(&reg, argp, sizeof(reg)))
1235 			break;
1236 
1237 		/*
1238 		 * We could owe a reset due to PSCI. Handle the pending reset
1239 		 * here to ensure userspace register accesses are ordered after
1240 		 * the reset.
1241 		 */
1242 		if (kvm_check_request(KVM_REQ_VCPU_RESET, vcpu))
1243 			kvm_reset_vcpu(vcpu);
1244 
1245 		if (ioctl == KVM_SET_ONE_REG)
1246 			r = kvm_arm_set_reg(vcpu, &reg);
1247 		else
1248 			r = kvm_arm_get_reg(vcpu, &reg);
1249 		break;
1250 	}
1251 	case KVM_GET_REG_LIST: {
1252 		struct kvm_reg_list __user *user_list = argp;
1253 		struct kvm_reg_list reg_list;
1254 		unsigned n;
1255 
1256 		r = -ENOEXEC;
1257 		if (unlikely(!kvm_vcpu_initialized(vcpu)))
1258 			break;
1259 
1260 		r = -EPERM;
1261 		if (!kvm_arm_vcpu_is_finalized(vcpu))
1262 			break;
1263 
1264 		r = -EFAULT;
1265 		if (copy_from_user(&reg_list, user_list, sizeof(reg_list)))
1266 			break;
1267 		n = reg_list.n;
1268 		reg_list.n = kvm_arm_num_regs(vcpu);
1269 		if (copy_to_user(user_list, &reg_list, sizeof(reg_list)))
1270 			break;
1271 		r = -E2BIG;
1272 		if (n < reg_list.n)
1273 			break;
1274 		r = kvm_arm_copy_reg_indices(vcpu, user_list->reg);
1275 		break;
1276 	}
1277 	case KVM_SET_DEVICE_ATTR: {
1278 		r = -EFAULT;
1279 		if (copy_from_user(&attr, argp, sizeof(attr)))
1280 			break;
1281 		r = kvm_arm_vcpu_set_attr(vcpu, &attr);
1282 		break;
1283 	}
1284 	case KVM_GET_DEVICE_ATTR: {
1285 		r = -EFAULT;
1286 		if (copy_from_user(&attr, argp, sizeof(attr)))
1287 			break;
1288 		r = kvm_arm_vcpu_get_attr(vcpu, &attr);
1289 		break;
1290 	}
1291 	case KVM_HAS_DEVICE_ATTR: {
1292 		r = -EFAULT;
1293 		if (copy_from_user(&attr, argp, sizeof(attr)))
1294 			break;
1295 		r = kvm_arm_vcpu_has_attr(vcpu, &attr);
1296 		break;
1297 	}
1298 	case KVM_GET_VCPU_EVENTS: {
1299 		struct kvm_vcpu_events events;
1300 
1301 		if (kvm_arm_vcpu_get_events(vcpu, &events))
1302 			return -EINVAL;
1303 
1304 		if (copy_to_user(argp, &events, sizeof(events)))
1305 			return -EFAULT;
1306 
1307 		return 0;
1308 	}
1309 	case KVM_SET_VCPU_EVENTS: {
1310 		struct kvm_vcpu_events events;
1311 
1312 		if (copy_from_user(&events, argp, sizeof(events)))
1313 			return -EFAULT;
1314 
1315 		return kvm_arm_vcpu_set_events(vcpu, &events);
1316 	}
1317 	case KVM_ARM_VCPU_FINALIZE: {
1318 		int what;
1319 
1320 		if (!kvm_vcpu_initialized(vcpu))
1321 			return -ENOEXEC;
1322 
1323 		if (get_user(what, (const int __user *)argp))
1324 			return -EFAULT;
1325 
1326 		return kvm_arm_vcpu_finalize(vcpu, what);
1327 	}
1328 	default:
1329 		r = -EINVAL;
1330 	}
1331 
1332 	return r;
1333 }
1334 
1335 void kvm_arch_sync_dirty_log(struct kvm *kvm, struct kvm_memory_slot *memslot)
1336 {
1337 
1338 }
1339 
1340 void kvm_arch_flush_remote_tlbs_memslot(struct kvm *kvm,
1341 					const struct kvm_memory_slot *memslot)
1342 {
1343 	kvm_flush_remote_tlbs(kvm);
1344 }
1345 
1346 static int kvm_vm_ioctl_set_device_addr(struct kvm *kvm,
1347 					struct kvm_arm_device_addr *dev_addr)
1348 {
1349 	unsigned long dev_id, type;
1350 
1351 	dev_id = (dev_addr->id & KVM_ARM_DEVICE_ID_MASK) >>
1352 		KVM_ARM_DEVICE_ID_SHIFT;
1353 	type = (dev_addr->id & KVM_ARM_DEVICE_TYPE_MASK) >>
1354 		KVM_ARM_DEVICE_TYPE_SHIFT;
1355 
1356 	switch (dev_id) {
1357 	case KVM_ARM_DEVICE_VGIC_V2:
1358 		if (!vgic_present)
1359 			return -ENXIO;
1360 		return kvm_vgic_addr(kvm, type, &dev_addr->addr, true);
1361 	default:
1362 		return -ENODEV;
1363 	}
1364 }
1365 
1366 long kvm_arch_vm_ioctl(struct file *filp,
1367 		       unsigned int ioctl, unsigned long arg)
1368 {
1369 	struct kvm *kvm = filp->private_data;
1370 	void __user *argp = (void __user *)arg;
1371 
1372 	switch (ioctl) {
1373 	case KVM_CREATE_IRQCHIP: {
1374 		int ret;
1375 		if (!vgic_present)
1376 			return -ENXIO;
1377 		mutex_lock(&kvm->lock);
1378 		ret = kvm_vgic_create(kvm, KVM_DEV_TYPE_ARM_VGIC_V2);
1379 		mutex_unlock(&kvm->lock);
1380 		return ret;
1381 	}
1382 	case KVM_ARM_SET_DEVICE_ADDR: {
1383 		struct kvm_arm_device_addr dev_addr;
1384 
1385 		if (copy_from_user(&dev_addr, argp, sizeof(dev_addr)))
1386 			return -EFAULT;
1387 		return kvm_vm_ioctl_set_device_addr(kvm, &dev_addr);
1388 	}
1389 	case KVM_ARM_PREFERRED_TARGET: {
1390 		int err;
1391 		struct kvm_vcpu_init init;
1392 
1393 		err = kvm_vcpu_preferred_target(&init);
1394 		if (err)
1395 			return err;
1396 
1397 		if (copy_to_user(argp, &init, sizeof(init)))
1398 			return -EFAULT;
1399 
1400 		return 0;
1401 	}
1402 	case KVM_ARM_MTE_COPY_TAGS: {
1403 		struct kvm_arm_copy_mte_tags copy_tags;
1404 
1405 		if (copy_from_user(&copy_tags, argp, sizeof(copy_tags)))
1406 			return -EFAULT;
1407 		return kvm_vm_ioctl_mte_copy_tags(kvm, &copy_tags);
1408 	}
1409 	default:
1410 		return -EINVAL;
1411 	}
1412 }
1413 
1414 static unsigned long nvhe_percpu_size(void)
1415 {
1416 	return (unsigned long)CHOOSE_NVHE_SYM(__per_cpu_end) -
1417 		(unsigned long)CHOOSE_NVHE_SYM(__per_cpu_start);
1418 }
1419 
1420 static unsigned long nvhe_percpu_order(void)
1421 {
1422 	unsigned long size = nvhe_percpu_size();
1423 
1424 	return size ? get_order(size) : 0;
1425 }
1426 
1427 /* A lookup table holding the hypervisor VA for each vector slot */
1428 static void *hyp_spectre_vector_selector[BP_HARDEN_EL2_SLOTS];
1429 
1430 static void kvm_init_vector_slot(void *base, enum arm64_hyp_spectre_vector slot)
1431 {
1432 	hyp_spectre_vector_selector[slot] = __kvm_vector_slot2addr(base, slot);
1433 }
1434 
1435 static int kvm_init_vector_slots(void)
1436 {
1437 	int err;
1438 	void *base;
1439 
1440 	base = kern_hyp_va(kvm_ksym_ref(__kvm_hyp_vector));
1441 	kvm_init_vector_slot(base, HYP_VECTOR_DIRECT);
1442 
1443 	base = kern_hyp_va(kvm_ksym_ref(__bp_harden_hyp_vecs));
1444 	kvm_init_vector_slot(base, HYP_VECTOR_SPECTRE_DIRECT);
1445 
1446 	if (!cpus_have_const_cap(ARM64_SPECTRE_V3A))
1447 		return 0;
1448 
1449 	if (!has_vhe()) {
1450 		err = create_hyp_exec_mappings(__pa_symbol(__bp_harden_hyp_vecs),
1451 					       __BP_HARDEN_HYP_VECS_SZ, &base);
1452 		if (err)
1453 			return err;
1454 	}
1455 
1456 	kvm_init_vector_slot(base, HYP_VECTOR_INDIRECT);
1457 	kvm_init_vector_slot(base, HYP_VECTOR_SPECTRE_INDIRECT);
1458 	return 0;
1459 }
1460 
1461 static void cpu_prepare_hyp_mode(int cpu)
1462 {
1463 	struct kvm_nvhe_init_params *params = per_cpu_ptr_nvhe_sym(kvm_init_params, cpu);
1464 	unsigned long tcr;
1465 
1466 	/*
1467 	 * Calculate the raw per-cpu offset without a translation from the
1468 	 * kernel's mapping to the linear mapping, and store it in tpidr_el2
1469 	 * so that we can use adr_l to access per-cpu variables in EL2.
1470 	 * Also drop the KASAN tag which gets in the way...
1471 	 */
1472 	params->tpidr_el2 = (unsigned long)kasan_reset_tag(per_cpu_ptr_nvhe_sym(__per_cpu_start, cpu)) -
1473 			    (unsigned long)kvm_ksym_ref(CHOOSE_NVHE_SYM(__per_cpu_start));
1474 
1475 	params->mair_el2 = read_sysreg(mair_el1);
1476 
1477 	/*
1478 	 * The ID map may be configured to use an extended virtual address
1479 	 * range. This is only the case if system RAM is out of range for the
1480 	 * currently configured page size and VA_BITS, in which case we will
1481 	 * also need the extended virtual range for the HYP ID map, or we won't
1482 	 * be able to enable the EL2 MMU.
1483 	 *
1484 	 * However, at EL2, there is only one TTBR register, and we can't switch
1485 	 * between translation tables *and* update TCR_EL2.T0SZ at the same
1486 	 * time. Bottom line: we need to use the extended range with *both* our
1487 	 * translation tables.
1488 	 *
1489 	 * So use the same T0SZ value we use for the ID map.
1490 	 */
1491 	tcr = (read_sysreg(tcr_el1) & TCR_EL2_MASK) | TCR_EL2_RES1;
1492 	tcr &= ~TCR_T0SZ_MASK;
1493 	tcr |= (idmap_t0sz & GENMASK(TCR_TxSZ_WIDTH - 1, 0)) << TCR_T0SZ_OFFSET;
1494 	params->tcr_el2 = tcr;
1495 
1496 	params->stack_hyp_va = kern_hyp_va(per_cpu(kvm_arm_hyp_stack_page, cpu) + PAGE_SIZE);
1497 	params->pgd_pa = kvm_mmu_get_httbr();
1498 	if (is_protected_kvm_enabled())
1499 		params->hcr_el2 = HCR_HOST_NVHE_PROTECTED_FLAGS;
1500 	else
1501 		params->hcr_el2 = HCR_HOST_NVHE_FLAGS;
1502 	params->vttbr = params->vtcr = 0;
1503 
1504 	/*
1505 	 * Flush the init params from the data cache because the struct will
1506 	 * be read while the MMU is off.
1507 	 */
1508 	kvm_flush_dcache_to_poc(params, sizeof(*params));
1509 }
1510 
1511 static void hyp_install_host_vector(void)
1512 {
1513 	struct kvm_nvhe_init_params *params;
1514 	struct arm_smccc_res res;
1515 
1516 	/* Switch from the HYP stub to our own HYP init vector */
1517 	__hyp_set_vectors(kvm_get_idmap_vector());
1518 
1519 	/*
1520 	 * Call initialization code, and switch to the full blown HYP code.
1521 	 * If the cpucaps haven't been finalized yet, something has gone very
1522 	 * wrong, and hyp will crash and burn when it uses any
1523 	 * cpus_have_const_cap() wrapper.
1524 	 */
1525 	BUG_ON(!system_capabilities_finalized());
1526 	params = this_cpu_ptr_nvhe_sym(kvm_init_params);
1527 	arm_smccc_1_1_hvc(KVM_HOST_SMCCC_FUNC(__kvm_hyp_init), virt_to_phys(params), &res);
1528 	WARN_ON(res.a0 != SMCCC_RET_SUCCESS);
1529 }
1530 
1531 static void cpu_init_hyp_mode(void)
1532 {
1533 	hyp_install_host_vector();
1534 
1535 	/*
1536 	 * Disabling SSBD on a non-VHE system requires us to enable SSBS
1537 	 * at EL2.
1538 	 */
1539 	if (this_cpu_has_cap(ARM64_SSBS) &&
1540 	    arm64_get_spectre_v4_state() == SPECTRE_VULNERABLE) {
1541 		kvm_call_hyp_nvhe(__kvm_enable_ssbs);
1542 	}
1543 }
1544 
1545 static void cpu_hyp_reset(void)
1546 {
1547 	if (!is_kernel_in_hyp_mode())
1548 		__hyp_reset_vectors();
1549 }
1550 
1551 /*
1552  * EL2 vectors can be mapped and rerouted in a number of ways,
1553  * depending on the kernel configuration and CPU present:
1554  *
1555  * - If the CPU is affected by Spectre-v2, the hardening sequence is
1556  *   placed in one of the vector slots, which is executed before jumping
1557  *   to the real vectors.
1558  *
1559  * - If the CPU also has the ARM64_SPECTRE_V3A cap, the slot
1560  *   containing the hardening sequence is mapped next to the idmap page,
1561  *   and executed before jumping to the real vectors.
1562  *
1563  * - If the CPU only has the ARM64_SPECTRE_V3A cap, then an
1564  *   empty slot is selected, mapped next to the idmap page, and
1565  *   executed before jumping to the real vectors.
1566  *
1567  * Note that ARM64_SPECTRE_V3A is somewhat incompatible with
1568  * VHE, as we don't have hypervisor-specific mappings. If the system
1569  * is VHE and yet selects this capability, it will be ignored.
1570  */
1571 static void cpu_set_hyp_vector(void)
1572 {
1573 	struct bp_hardening_data *data = this_cpu_ptr(&bp_hardening_data);
1574 	void *vector = hyp_spectre_vector_selector[data->slot];
1575 
1576 	if (!is_protected_kvm_enabled())
1577 		*this_cpu_ptr_hyp_sym(kvm_hyp_vector) = (unsigned long)vector;
1578 	else
1579 		kvm_call_hyp_nvhe(__pkvm_cpu_set_vector, data->slot);
1580 }
1581 
1582 static void cpu_hyp_reinit(void)
1583 {
1584 	kvm_init_host_cpu_context(&this_cpu_ptr_hyp_sym(kvm_host_data)->host_ctxt);
1585 
1586 	cpu_hyp_reset();
1587 
1588 	if (is_kernel_in_hyp_mode())
1589 		kvm_timer_init_vhe();
1590 	else
1591 		cpu_init_hyp_mode();
1592 
1593 	cpu_set_hyp_vector();
1594 
1595 	kvm_arm_init_debug();
1596 
1597 	if (vgic_present)
1598 		kvm_vgic_init_cpu_hardware();
1599 }
1600 
1601 static void _kvm_arch_hardware_enable(void *discard)
1602 {
1603 	if (!__this_cpu_read(kvm_arm_hardware_enabled)) {
1604 		cpu_hyp_reinit();
1605 		__this_cpu_write(kvm_arm_hardware_enabled, 1);
1606 	}
1607 }
1608 
1609 int kvm_arch_hardware_enable(void)
1610 {
1611 	_kvm_arch_hardware_enable(NULL);
1612 	return 0;
1613 }
1614 
1615 static void _kvm_arch_hardware_disable(void *discard)
1616 {
1617 	if (__this_cpu_read(kvm_arm_hardware_enabled)) {
1618 		cpu_hyp_reset();
1619 		__this_cpu_write(kvm_arm_hardware_enabled, 0);
1620 	}
1621 }
1622 
1623 void kvm_arch_hardware_disable(void)
1624 {
1625 	if (!is_protected_kvm_enabled())
1626 		_kvm_arch_hardware_disable(NULL);
1627 }
1628 
1629 #ifdef CONFIG_CPU_PM
1630 static int hyp_init_cpu_pm_notifier(struct notifier_block *self,
1631 				    unsigned long cmd,
1632 				    void *v)
1633 {
1634 	/*
1635 	 * kvm_arm_hardware_enabled is left with its old value over
1636 	 * PM_ENTER->PM_EXIT. It is used to indicate PM_EXIT should
1637 	 * re-enable hyp.
1638 	 */
1639 	switch (cmd) {
1640 	case CPU_PM_ENTER:
1641 		if (__this_cpu_read(kvm_arm_hardware_enabled))
1642 			/*
1643 			 * don't update kvm_arm_hardware_enabled here
1644 			 * so that the hardware will be re-enabled
1645 			 * when we resume. See below.
1646 			 */
1647 			cpu_hyp_reset();
1648 
1649 		return NOTIFY_OK;
1650 	case CPU_PM_ENTER_FAILED:
1651 	case CPU_PM_EXIT:
1652 		if (__this_cpu_read(kvm_arm_hardware_enabled))
1653 			/* The hardware was enabled before suspend. */
1654 			cpu_hyp_reinit();
1655 
1656 		return NOTIFY_OK;
1657 
1658 	default:
1659 		return NOTIFY_DONE;
1660 	}
1661 }
1662 
1663 static struct notifier_block hyp_init_cpu_pm_nb = {
1664 	.notifier_call = hyp_init_cpu_pm_notifier,
1665 };
1666 
1667 static void hyp_cpu_pm_init(void)
1668 {
1669 	if (!is_protected_kvm_enabled())
1670 		cpu_pm_register_notifier(&hyp_init_cpu_pm_nb);
1671 }
1672 static void hyp_cpu_pm_exit(void)
1673 {
1674 	if (!is_protected_kvm_enabled())
1675 		cpu_pm_unregister_notifier(&hyp_init_cpu_pm_nb);
1676 }
1677 #else
1678 static inline void hyp_cpu_pm_init(void)
1679 {
1680 }
1681 static inline void hyp_cpu_pm_exit(void)
1682 {
1683 }
1684 #endif
1685 
1686 static void init_cpu_logical_map(void)
1687 {
1688 	unsigned int cpu;
1689 
1690 	/*
1691 	 * Copy the MPIDR <-> logical CPU ID mapping to hyp.
1692 	 * Only copy the set of online CPUs whose features have been chacked
1693 	 * against the finalized system capabilities. The hypervisor will not
1694 	 * allow any other CPUs from the `possible` set to boot.
1695 	 */
1696 	for_each_online_cpu(cpu)
1697 		hyp_cpu_logical_map[cpu] = cpu_logical_map(cpu);
1698 }
1699 
1700 #define init_psci_0_1_impl_state(config, what)	\
1701 	config.psci_0_1_ ## what ## _implemented = psci_ops.what
1702 
1703 static bool init_psci_relay(void)
1704 {
1705 	/*
1706 	 * If PSCI has not been initialized, protected KVM cannot install
1707 	 * itself on newly booted CPUs.
1708 	 */
1709 	if (!psci_ops.get_version) {
1710 		kvm_err("Cannot initialize protected mode without PSCI\n");
1711 		return false;
1712 	}
1713 
1714 	kvm_host_psci_config.version = psci_ops.get_version();
1715 
1716 	if (kvm_host_psci_config.version == PSCI_VERSION(0, 1)) {
1717 		kvm_host_psci_config.function_ids_0_1 = get_psci_0_1_function_ids();
1718 		init_psci_0_1_impl_state(kvm_host_psci_config, cpu_suspend);
1719 		init_psci_0_1_impl_state(kvm_host_psci_config, cpu_on);
1720 		init_psci_0_1_impl_state(kvm_host_psci_config, cpu_off);
1721 		init_psci_0_1_impl_state(kvm_host_psci_config, migrate);
1722 	}
1723 	return true;
1724 }
1725 
1726 static int init_subsystems(void)
1727 {
1728 	int err = 0;
1729 
1730 	/*
1731 	 * Enable hardware so that subsystem initialisation can access EL2.
1732 	 */
1733 	on_each_cpu(_kvm_arch_hardware_enable, NULL, 1);
1734 
1735 	/*
1736 	 * Register CPU lower-power notifier
1737 	 */
1738 	hyp_cpu_pm_init();
1739 
1740 	/*
1741 	 * Init HYP view of VGIC
1742 	 */
1743 	err = kvm_vgic_hyp_init();
1744 	switch (err) {
1745 	case 0:
1746 		vgic_present = true;
1747 		break;
1748 	case -ENODEV:
1749 	case -ENXIO:
1750 		vgic_present = false;
1751 		err = 0;
1752 		break;
1753 	default:
1754 		goto out;
1755 	}
1756 
1757 	/*
1758 	 * Init HYP architected timer support
1759 	 */
1760 	err = kvm_timer_hyp_init(vgic_present);
1761 	if (err)
1762 		goto out;
1763 
1764 	kvm_perf_init();
1765 	kvm_sys_reg_table_init();
1766 
1767 out:
1768 	if (err || !is_protected_kvm_enabled())
1769 		on_each_cpu(_kvm_arch_hardware_disable, NULL, 1);
1770 
1771 	return err;
1772 }
1773 
1774 static void teardown_hyp_mode(void)
1775 {
1776 	int cpu;
1777 
1778 	free_hyp_pgds();
1779 	for_each_possible_cpu(cpu) {
1780 		free_page(per_cpu(kvm_arm_hyp_stack_page, cpu));
1781 		free_pages(kvm_arm_hyp_percpu_base[cpu], nvhe_percpu_order());
1782 	}
1783 }
1784 
1785 static int do_pkvm_init(u32 hyp_va_bits)
1786 {
1787 	void *per_cpu_base = kvm_ksym_ref(kvm_arm_hyp_percpu_base);
1788 	int ret;
1789 
1790 	preempt_disable();
1791 	hyp_install_host_vector();
1792 	ret = kvm_call_hyp_nvhe(__pkvm_init, hyp_mem_base, hyp_mem_size,
1793 				num_possible_cpus(), kern_hyp_va(per_cpu_base),
1794 				hyp_va_bits);
1795 	preempt_enable();
1796 
1797 	return ret;
1798 }
1799 
1800 static int kvm_hyp_init_protection(u32 hyp_va_bits)
1801 {
1802 	void *addr = phys_to_virt(hyp_mem_base);
1803 	int ret;
1804 
1805 	kvm_nvhe_sym(id_aa64mmfr0_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1);
1806 	kvm_nvhe_sym(id_aa64mmfr1_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64MMFR1_EL1);
1807 
1808 	ret = create_hyp_mappings(addr, addr + hyp_mem_size, PAGE_HYP);
1809 	if (ret)
1810 		return ret;
1811 
1812 	ret = do_pkvm_init(hyp_va_bits);
1813 	if (ret)
1814 		return ret;
1815 
1816 	free_hyp_pgds();
1817 
1818 	return 0;
1819 }
1820 
1821 /**
1822  * Inits Hyp-mode on all online CPUs
1823  */
1824 static int init_hyp_mode(void)
1825 {
1826 	u32 hyp_va_bits;
1827 	int cpu;
1828 	int err = -ENOMEM;
1829 
1830 	/*
1831 	 * The protected Hyp-mode cannot be initialized if the memory pool
1832 	 * allocation has failed.
1833 	 */
1834 	if (is_protected_kvm_enabled() && !hyp_mem_base)
1835 		goto out_err;
1836 
1837 	/*
1838 	 * Allocate Hyp PGD and setup Hyp identity mapping
1839 	 */
1840 	err = kvm_mmu_init(&hyp_va_bits);
1841 	if (err)
1842 		goto out_err;
1843 
1844 	/*
1845 	 * Allocate stack pages for Hypervisor-mode
1846 	 */
1847 	for_each_possible_cpu(cpu) {
1848 		unsigned long stack_page;
1849 
1850 		stack_page = __get_free_page(GFP_KERNEL);
1851 		if (!stack_page) {
1852 			err = -ENOMEM;
1853 			goto out_err;
1854 		}
1855 
1856 		per_cpu(kvm_arm_hyp_stack_page, cpu) = stack_page;
1857 	}
1858 
1859 	/*
1860 	 * Allocate and initialize pages for Hypervisor-mode percpu regions.
1861 	 */
1862 	for_each_possible_cpu(cpu) {
1863 		struct page *page;
1864 		void *page_addr;
1865 
1866 		page = alloc_pages(GFP_KERNEL, nvhe_percpu_order());
1867 		if (!page) {
1868 			err = -ENOMEM;
1869 			goto out_err;
1870 		}
1871 
1872 		page_addr = page_address(page);
1873 		memcpy(page_addr, CHOOSE_NVHE_SYM(__per_cpu_start), nvhe_percpu_size());
1874 		kvm_arm_hyp_percpu_base[cpu] = (unsigned long)page_addr;
1875 	}
1876 
1877 	/*
1878 	 * Map the Hyp-code called directly from the host
1879 	 */
1880 	err = create_hyp_mappings(kvm_ksym_ref(__hyp_text_start),
1881 				  kvm_ksym_ref(__hyp_text_end), PAGE_HYP_EXEC);
1882 	if (err) {
1883 		kvm_err("Cannot map world-switch code\n");
1884 		goto out_err;
1885 	}
1886 
1887 	err = create_hyp_mappings(kvm_ksym_ref(__hyp_rodata_start),
1888 				  kvm_ksym_ref(__hyp_rodata_end), PAGE_HYP_RO);
1889 	if (err) {
1890 		kvm_err("Cannot map .hyp.rodata section\n");
1891 		goto out_err;
1892 	}
1893 
1894 	err = create_hyp_mappings(kvm_ksym_ref(__start_rodata),
1895 				  kvm_ksym_ref(__end_rodata), PAGE_HYP_RO);
1896 	if (err) {
1897 		kvm_err("Cannot map rodata section\n");
1898 		goto out_err;
1899 	}
1900 
1901 	/*
1902 	 * .hyp.bss is guaranteed to be placed at the beginning of the .bss
1903 	 * section thanks to an assertion in the linker script. Map it RW and
1904 	 * the rest of .bss RO.
1905 	 */
1906 	err = create_hyp_mappings(kvm_ksym_ref(__hyp_bss_start),
1907 				  kvm_ksym_ref(__hyp_bss_end), PAGE_HYP);
1908 	if (err) {
1909 		kvm_err("Cannot map hyp bss section: %d\n", err);
1910 		goto out_err;
1911 	}
1912 
1913 	err = create_hyp_mappings(kvm_ksym_ref(__hyp_bss_end),
1914 				  kvm_ksym_ref(__bss_stop), PAGE_HYP_RO);
1915 	if (err) {
1916 		kvm_err("Cannot map bss section\n");
1917 		goto out_err;
1918 	}
1919 
1920 	/*
1921 	 * Map the Hyp stack pages
1922 	 */
1923 	for_each_possible_cpu(cpu) {
1924 		char *stack_page = (char *)per_cpu(kvm_arm_hyp_stack_page, cpu);
1925 		err = create_hyp_mappings(stack_page, stack_page + PAGE_SIZE,
1926 					  PAGE_HYP);
1927 
1928 		if (err) {
1929 			kvm_err("Cannot map hyp stack\n");
1930 			goto out_err;
1931 		}
1932 	}
1933 
1934 	for_each_possible_cpu(cpu) {
1935 		char *percpu_begin = (char *)kvm_arm_hyp_percpu_base[cpu];
1936 		char *percpu_end = percpu_begin + nvhe_percpu_size();
1937 
1938 		/* Map Hyp percpu pages */
1939 		err = create_hyp_mappings(percpu_begin, percpu_end, PAGE_HYP);
1940 		if (err) {
1941 			kvm_err("Cannot map hyp percpu region\n");
1942 			goto out_err;
1943 		}
1944 
1945 		/* Prepare the CPU initialization parameters */
1946 		cpu_prepare_hyp_mode(cpu);
1947 	}
1948 
1949 	if (is_protected_kvm_enabled()) {
1950 		init_cpu_logical_map();
1951 
1952 		if (!init_psci_relay()) {
1953 			err = -ENODEV;
1954 			goto out_err;
1955 		}
1956 	}
1957 
1958 	if (is_protected_kvm_enabled()) {
1959 		err = kvm_hyp_init_protection(hyp_va_bits);
1960 		if (err) {
1961 			kvm_err("Failed to init hyp memory protection\n");
1962 			goto out_err;
1963 		}
1964 	}
1965 
1966 	return 0;
1967 
1968 out_err:
1969 	teardown_hyp_mode();
1970 	kvm_err("error initializing Hyp mode: %d\n", err);
1971 	return err;
1972 }
1973 
1974 static void _kvm_host_prot_finalize(void *discard)
1975 {
1976 	WARN_ON(kvm_call_hyp_nvhe(__pkvm_prot_finalize));
1977 }
1978 
1979 static int finalize_hyp_mode(void)
1980 {
1981 	if (!is_protected_kvm_enabled())
1982 		return 0;
1983 
1984 	/*
1985 	 * Exclude HYP BSS from kmemleak so that it doesn't get peeked
1986 	 * at, which would end badly once the section is inaccessible.
1987 	 * None of other sections should ever be introspected.
1988 	 */
1989 	kmemleak_free_part(__hyp_bss_start, __hyp_bss_end - __hyp_bss_start);
1990 
1991 	/*
1992 	 * Flip the static key upfront as that may no longer be possible
1993 	 * once the host stage 2 is installed.
1994 	 */
1995 	static_branch_enable(&kvm_protected_mode_initialized);
1996 	on_each_cpu(_kvm_host_prot_finalize, NULL, 1);
1997 
1998 	return 0;
1999 }
2000 
2001 struct kvm_vcpu *kvm_mpidr_to_vcpu(struct kvm *kvm, unsigned long mpidr)
2002 {
2003 	struct kvm_vcpu *vcpu;
2004 	int i;
2005 
2006 	mpidr &= MPIDR_HWID_BITMASK;
2007 	kvm_for_each_vcpu(i, vcpu, kvm) {
2008 		if (mpidr == kvm_vcpu_get_mpidr_aff(vcpu))
2009 			return vcpu;
2010 	}
2011 	return NULL;
2012 }
2013 
2014 bool kvm_arch_has_irq_bypass(void)
2015 {
2016 	return true;
2017 }
2018 
2019 int kvm_arch_irq_bypass_add_producer(struct irq_bypass_consumer *cons,
2020 				      struct irq_bypass_producer *prod)
2021 {
2022 	struct kvm_kernel_irqfd *irqfd =
2023 		container_of(cons, struct kvm_kernel_irqfd, consumer);
2024 
2025 	return kvm_vgic_v4_set_forwarding(irqfd->kvm, prod->irq,
2026 					  &irqfd->irq_entry);
2027 }
2028 void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons,
2029 				      struct irq_bypass_producer *prod)
2030 {
2031 	struct kvm_kernel_irqfd *irqfd =
2032 		container_of(cons, struct kvm_kernel_irqfd, consumer);
2033 
2034 	kvm_vgic_v4_unset_forwarding(irqfd->kvm, prod->irq,
2035 				     &irqfd->irq_entry);
2036 }
2037 
2038 void kvm_arch_irq_bypass_stop(struct irq_bypass_consumer *cons)
2039 {
2040 	struct kvm_kernel_irqfd *irqfd =
2041 		container_of(cons, struct kvm_kernel_irqfd, consumer);
2042 
2043 	kvm_arm_halt_guest(irqfd->kvm);
2044 }
2045 
2046 void kvm_arch_irq_bypass_start(struct irq_bypass_consumer *cons)
2047 {
2048 	struct kvm_kernel_irqfd *irqfd =
2049 		container_of(cons, struct kvm_kernel_irqfd, consumer);
2050 
2051 	kvm_arm_resume_guest(irqfd->kvm);
2052 }
2053 
2054 /**
2055  * Initialize Hyp-mode and memory mappings on all CPUs.
2056  */
2057 int kvm_arch_init(void *opaque)
2058 {
2059 	int err;
2060 	bool in_hyp_mode;
2061 
2062 	if (!is_hyp_mode_available()) {
2063 		kvm_info("HYP mode not available\n");
2064 		return -ENODEV;
2065 	}
2066 
2067 	in_hyp_mode = is_kernel_in_hyp_mode();
2068 
2069 	if (cpus_have_final_cap(ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE) ||
2070 	    cpus_have_final_cap(ARM64_WORKAROUND_1508412))
2071 		kvm_info("Guests without required CPU erratum workarounds can deadlock system!\n" \
2072 			 "Only trusted guests should be used on this system.\n");
2073 
2074 	err = kvm_set_ipa_limit();
2075 	if (err)
2076 		return err;
2077 
2078 	err = kvm_arm_init_sve();
2079 	if (err)
2080 		return err;
2081 
2082 	if (!in_hyp_mode) {
2083 		err = init_hyp_mode();
2084 		if (err)
2085 			goto out_err;
2086 	}
2087 
2088 	err = kvm_init_vector_slots();
2089 	if (err) {
2090 		kvm_err("Cannot initialise vector slots\n");
2091 		goto out_err;
2092 	}
2093 
2094 	err = init_subsystems();
2095 	if (err)
2096 		goto out_hyp;
2097 
2098 	if (!in_hyp_mode) {
2099 		err = finalize_hyp_mode();
2100 		if (err) {
2101 			kvm_err("Failed to finalize Hyp protection\n");
2102 			goto out_hyp;
2103 		}
2104 	}
2105 
2106 	if (is_protected_kvm_enabled()) {
2107 		kvm_info("Protected nVHE mode initialized successfully\n");
2108 	} else if (in_hyp_mode) {
2109 		kvm_info("VHE mode initialized successfully\n");
2110 	} else {
2111 		kvm_info("Hyp mode initialized successfully\n");
2112 	}
2113 
2114 	return 0;
2115 
2116 out_hyp:
2117 	hyp_cpu_pm_exit();
2118 	if (!in_hyp_mode)
2119 		teardown_hyp_mode();
2120 out_err:
2121 	return err;
2122 }
2123 
2124 /* NOP: Compiling as a module not supported */
2125 void kvm_arch_exit(void)
2126 {
2127 	kvm_perf_teardown();
2128 }
2129 
2130 static int __init early_kvm_mode_cfg(char *arg)
2131 {
2132 	if (!arg)
2133 		return -EINVAL;
2134 
2135 	if (strcmp(arg, "protected") == 0) {
2136 		kvm_mode = KVM_MODE_PROTECTED;
2137 		return 0;
2138 	}
2139 
2140 	if (strcmp(arg, "nvhe") == 0 && !WARN_ON(is_kernel_in_hyp_mode()))
2141 		return 0;
2142 
2143 	return -EINVAL;
2144 }
2145 early_param("kvm-arm.mode", early_kvm_mode_cfg);
2146 
2147 enum kvm_mode kvm_get_mode(void)
2148 {
2149 	return kvm_mode;
2150 }
2151 
2152 static int arm_init(void)
2153 {
2154 	int rc = kvm_init(NULL, sizeof(struct kvm_vcpu), 0, THIS_MODULE);
2155 	return rc;
2156 }
2157 
2158 module_init(arm_init);
2159