xref: /linux/arch/arm64/kvm/hyp/nvhe/hyp-main.c (revision 6f7e6393d1ce636bb7ec77a7fe7b77458fddf701)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2020 - Google Inc
4  * Author: Andrew Scull <ascull@google.com>
5  */
6 
7 #include <hyp/adjust_pc.h>
8 #include <hyp/switch.h>
9 
10 #include <asm/pgtable-types.h>
11 #include <asm/kvm_asm.h>
12 #include <asm/kvm_emulate.h>
13 #include <asm/kvm_host.h>
14 #include <asm/kvm_hyp.h>
15 #include <asm/kvm_mmu.h>
16 
17 #include <nvhe/ffa.h>
18 #include <nvhe/mem_protect.h>
19 #include <nvhe/mm.h>
20 #include <nvhe/pkvm.h>
21 #include <nvhe/trap_handler.h>
22 
23 DEFINE_PER_CPU(struct kvm_nvhe_init_params, kvm_init_params);
24 
25 void __kvm_hyp_host_forward_smc(struct kvm_cpu_context *host_ctxt);
26 
27 static void __hyp_sve_save_guest(struct kvm_vcpu *vcpu)
28 {
29 	__vcpu_assign_sys_reg(vcpu, ZCR_EL1, read_sysreg_el1(SYS_ZCR));
30 	/*
31 	 * On saving/restoring guest sve state, always use the maximum VL for
32 	 * the guest. The layout of the data when saving the sve state depends
33 	 * on the VL, so use a consistent (i.e., the maximum) guest VL.
34 	 */
35 	sve_cond_update_zcr_vq(vcpu_sve_max_vq(vcpu) - 1, SYS_ZCR_EL2);
36 	__sve_save_state(vcpu_sve_pffr(vcpu), &vcpu->arch.ctxt.fp_regs.fpsr, true);
37 	write_sysreg_s(sve_vq_from_vl(kvm_host_sve_max_vl) - 1, SYS_ZCR_EL2);
38 }
39 
40 static void __hyp_sve_restore_host(void)
41 {
42 	struct cpu_sve_state *sve_state = *host_data_ptr(sve_state);
43 
44 	/*
45 	 * On saving/restoring host sve state, always use the maximum VL for
46 	 * the host. The layout of the data when saving the sve state depends
47 	 * on the VL, so use a consistent (i.e., the maximum) host VL.
48 	 *
49 	 * Note that this constrains the PE to the maximum shared VL
50 	 * that was discovered, if we wish to use larger VLs this will
51 	 * need to be revisited.
52 	 */
53 	write_sysreg_s(sve_vq_from_vl(kvm_host_sve_max_vl) - 1, SYS_ZCR_EL2);
54 	__sve_restore_state(sve_state->sve_regs + sve_ffr_offset(kvm_host_sve_max_vl),
55 			    &sve_state->fpsr,
56 			    true);
57 	write_sysreg_el1(sve_state->zcr_el1, SYS_ZCR);
58 }
59 
60 static void fpsimd_sve_flush(void)
61 {
62 	*host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED;
63 }
64 
65 static void fpsimd_sve_sync(struct kvm_vcpu *vcpu)
66 {
67 	bool has_fpmr;
68 
69 	if (!guest_owns_fp_regs())
70 		return;
71 
72 	/*
73 	 * Traps have been disabled by __deactivate_cptr_traps(), but there
74 	 * hasn't necessarily been a context synchronization event yet.
75 	 */
76 	isb();
77 
78 	if (vcpu_has_sve(vcpu))
79 		__hyp_sve_save_guest(vcpu);
80 	else
81 		__fpsimd_save_state(&vcpu->arch.ctxt.fp_regs);
82 
83 	has_fpmr = kvm_has_fpmr(kern_hyp_va(vcpu->kvm));
84 	if (has_fpmr)
85 		__vcpu_assign_sys_reg(vcpu, FPMR, read_sysreg_s(SYS_FPMR));
86 
87 	if (system_supports_sve())
88 		__hyp_sve_restore_host();
89 	else
90 		__fpsimd_restore_state(host_data_ptr(host_ctxt.fp_regs));
91 
92 	if (has_fpmr)
93 		write_sysreg_s(*host_data_ptr(fpmr), SYS_FPMR);
94 
95 	*host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED;
96 }
97 
98 static void flush_debug_state(struct pkvm_hyp_vcpu *hyp_vcpu)
99 {
100 	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
101 
102 	hyp_vcpu->vcpu.arch.debug_owner = host_vcpu->arch.debug_owner;
103 
104 	if (kvm_guest_owns_debug_regs(&hyp_vcpu->vcpu))
105 		hyp_vcpu->vcpu.arch.vcpu_debug_state = host_vcpu->arch.vcpu_debug_state;
106 	else if (kvm_host_owns_debug_regs(&hyp_vcpu->vcpu))
107 		hyp_vcpu->vcpu.arch.external_debug_state = host_vcpu->arch.external_debug_state;
108 }
109 
110 static void sync_debug_state(struct pkvm_hyp_vcpu *hyp_vcpu)
111 {
112 	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
113 
114 	if (kvm_guest_owns_debug_regs(&hyp_vcpu->vcpu))
115 		host_vcpu->arch.vcpu_debug_state = hyp_vcpu->vcpu.arch.vcpu_debug_state;
116 	else if (kvm_host_owns_debug_regs(&hyp_vcpu->vcpu))
117 		host_vcpu->arch.external_debug_state = hyp_vcpu->vcpu.arch.external_debug_state;
118 }
119 
120 static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
121 {
122 	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
123 
124 	fpsimd_sve_flush();
125 	flush_debug_state(hyp_vcpu);
126 
127 	hyp_vcpu->vcpu.arch.ctxt	= host_vcpu->arch.ctxt;
128 
129 	hyp_vcpu->vcpu.arch.mdcr_el2	= host_vcpu->arch.mdcr_el2;
130 	hyp_vcpu->vcpu.arch.hcr_el2 &= ~(HCR_TWI | HCR_TWE);
131 	hyp_vcpu->vcpu.arch.hcr_el2 |= READ_ONCE(host_vcpu->arch.hcr_el2) &
132 						 (HCR_TWI | HCR_TWE);
133 
134 	hyp_vcpu->vcpu.arch.iflags	= host_vcpu->arch.iflags;
135 
136 	hyp_vcpu->vcpu.arch.vsesr_el2	= host_vcpu->arch.vsesr_el2;
137 
138 	hyp_vcpu->vcpu.arch.vgic_cpu.vgic_v3 = host_vcpu->arch.vgic_cpu.vgic_v3;
139 }
140 
141 static void sync_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
142 {
143 	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
144 	struct vgic_v3_cpu_if *hyp_cpu_if = &hyp_vcpu->vcpu.arch.vgic_cpu.vgic_v3;
145 	struct vgic_v3_cpu_if *host_cpu_if = &host_vcpu->arch.vgic_cpu.vgic_v3;
146 	unsigned int i;
147 
148 	fpsimd_sve_sync(&hyp_vcpu->vcpu);
149 	sync_debug_state(hyp_vcpu);
150 
151 	host_vcpu->arch.ctxt		= hyp_vcpu->vcpu.arch.ctxt;
152 
153 	host_vcpu->arch.hcr_el2		= hyp_vcpu->vcpu.arch.hcr_el2;
154 
155 	host_vcpu->arch.fault		= hyp_vcpu->vcpu.arch.fault;
156 
157 	host_vcpu->arch.iflags		= hyp_vcpu->vcpu.arch.iflags;
158 
159 	host_cpu_if->vgic_hcr		= hyp_cpu_if->vgic_hcr;
160 	host_cpu_if->vgic_vmcr		= hyp_cpu_if->vgic_vmcr;
161 	for (i = 0; i < hyp_cpu_if->used_lrs; ++i)
162 		host_cpu_if->vgic_lr[i] = hyp_cpu_if->vgic_lr[i];
163 }
164 
165 static void handle___pkvm_vcpu_load(struct kvm_cpu_context *host_ctxt)
166 {
167 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
168 	DECLARE_REG(unsigned int, vcpu_idx, host_ctxt, 2);
169 	DECLARE_REG(u64, hcr_el2, host_ctxt, 3);
170 	struct pkvm_hyp_vcpu *hyp_vcpu;
171 
172 	if (!is_protected_kvm_enabled())
173 		return;
174 
175 	hyp_vcpu = pkvm_load_hyp_vcpu(handle, vcpu_idx);
176 	if (!hyp_vcpu)
177 		return;
178 
179 	if (pkvm_hyp_vcpu_is_protected(hyp_vcpu)) {
180 		/* Propagate WFx trapping flags */
181 		hyp_vcpu->vcpu.arch.hcr_el2 &= ~(HCR_TWE | HCR_TWI);
182 		hyp_vcpu->vcpu.arch.hcr_el2 |= hcr_el2 & (HCR_TWE | HCR_TWI);
183 	} else {
184 		memcpy(&hyp_vcpu->vcpu.arch.fgt, hyp_vcpu->host_vcpu->arch.fgt,
185 		       sizeof(hyp_vcpu->vcpu.arch.fgt));
186 	}
187 }
188 
189 static void handle___pkvm_vcpu_put(struct kvm_cpu_context *host_ctxt)
190 {
191 	struct pkvm_hyp_vcpu *hyp_vcpu;
192 
193 	if (!is_protected_kvm_enabled())
194 		return;
195 
196 	hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
197 	if (hyp_vcpu)
198 		pkvm_put_hyp_vcpu(hyp_vcpu);
199 }
200 
201 static void handle___kvm_vcpu_run(struct kvm_cpu_context *host_ctxt)
202 {
203 	DECLARE_REG(struct kvm_vcpu *, host_vcpu, host_ctxt, 1);
204 	int ret;
205 
206 	if (unlikely(is_protected_kvm_enabled())) {
207 		struct pkvm_hyp_vcpu *hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
208 
209 		/*
210 		 * KVM (and pKVM) doesn't support SME guests for now, and
211 		 * ensures that SME features aren't enabled in pstate when
212 		 * loading a vcpu. Therefore, if SME features enabled the host
213 		 * is misbehaving.
214 		 */
215 		if (unlikely(system_supports_sme() && read_sysreg_s(SYS_SVCR))) {
216 			ret = -EINVAL;
217 			goto out;
218 		}
219 
220 		if (!hyp_vcpu) {
221 			ret = -EINVAL;
222 			goto out;
223 		}
224 
225 		flush_hyp_vcpu(hyp_vcpu);
226 
227 		ret = __kvm_vcpu_run(&hyp_vcpu->vcpu);
228 
229 		sync_hyp_vcpu(hyp_vcpu);
230 	} else {
231 		struct kvm_vcpu *vcpu = kern_hyp_va(host_vcpu);
232 
233 		/* The host is fully trusted, run its vCPU directly. */
234 		fpsimd_lazy_switch_to_guest(vcpu);
235 		ret = __kvm_vcpu_run(vcpu);
236 		fpsimd_lazy_switch_to_host(vcpu);
237 	}
238 out:
239 	cpu_reg(host_ctxt, 1) =  ret;
240 }
241 
242 static int pkvm_refill_memcache(struct pkvm_hyp_vcpu *hyp_vcpu)
243 {
244 	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
245 
246 	return refill_memcache(&hyp_vcpu->vcpu.arch.pkvm_memcache,
247 			       host_vcpu->arch.pkvm_memcache.nr_pages,
248 			       &host_vcpu->arch.pkvm_memcache);
249 }
250 
251 static void handle___pkvm_host_share_guest(struct kvm_cpu_context *host_ctxt)
252 {
253 	DECLARE_REG(u64, pfn, host_ctxt, 1);
254 	DECLARE_REG(u64, gfn, host_ctxt, 2);
255 	DECLARE_REG(u64, nr_pages, host_ctxt, 3);
256 	DECLARE_REG(enum kvm_pgtable_prot, prot, host_ctxt, 4);
257 	struct pkvm_hyp_vcpu *hyp_vcpu;
258 	int ret = -EINVAL;
259 
260 	if (!is_protected_kvm_enabled())
261 		goto out;
262 
263 	hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
264 	if (!hyp_vcpu || pkvm_hyp_vcpu_is_protected(hyp_vcpu))
265 		goto out;
266 
267 	ret = pkvm_refill_memcache(hyp_vcpu);
268 	if (ret)
269 		goto out;
270 
271 	ret = __pkvm_host_share_guest(pfn, gfn, nr_pages, hyp_vcpu, prot);
272 out:
273 	cpu_reg(host_ctxt, 1) =  ret;
274 }
275 
276 static void handle___pkvm_host_unshare_guest(struct kvm_cpu_context *host_ctxt)
277 {
278 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
279 	DECLARE_REG(u64, gfn, host_ctxt, 2);
280 	DECLARE_REG(u64, nr_pages, host_ctxt, 3);
281 	struct pkvm_hyp_vm *hyp_vm;
282 	int ret = -EINVAL;
283 
284 	if (!is_protected_kvm_enabled())
285 		goto out;
286 
287 	hyp_vm = get_np_pkvm_hyp_vm(handle);
288 	if (!hyp_vm)
289 		goto out;
290 
291 	ret = __pkvm_host_unshare_guest(gfn, nr_pages, hyp_vm);
292 	put_pkvm_hyp_vm(hyp_vm);
293 out:
294 	cpu_reg(host_ctxt, 1) =  ret;
295 }
296 
297 static void handle___pkvm_host_relax_perms_guest(struct kvm_cpu_context *host_ctxt)
298 {
299 	DECLARE_REG(u64, gfn, host_ctxt, 1);
300 	DECLARE_REG(enum kvm_pgtable_prot, prot, host_ctxt, 2);
301 	struct pkvm_hyp_vcpu *hyp_vcpu;
302 	int ret = -EINVAL;
303 
304 	if (!is_protected_kvm_enabled())
305 		goto out;
306 
307 	hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
308 	if (!hyp_vcpu || pkvm_hyp_vcpu_is_protected(hyp_vcpu))
309 		goto out;
310 
311 	ret = __pkvm_host_relax_perms_guest(gfn, hyp_vcpu, prot);
312 out:
313 	cpu_reg(host_ctxt, 1) = ret;
314 }
315 
316 static void handle___pkvm_host_wrprotect_guest(struct kvm_cpu_context *host_ctxt)
317 {
318 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
319 	DECLARE_REG(u64, gfn, host_ctxt, 2);
320 	DECLARE_REG(u64, nr_pages, host_ctxt, 3);
321 	struct pkvm_hyp_vm *hyp_vm;
322 	int ret = -EINVAL;
323 
324 	if (!is_protected_kvm_enabled())
325 		goto out;
326 
327 	hyp_vm = get_np_pkvm_hyp_vm(handle);
328 	if (!hyp_vm)
329 		goto out;
330 
331 	ret = __pkvm_host_wrprotect_guest(gfn, nr_pages, hyp_vm);
332 	put_pkvm_hyp_vm(hyp_vm);
333 out:
334 	cpu_reg(host_ctxt, 1) = ret;
335 }
336 
337 static void handle___pkvm_host_test_clear_young_guest(struct kvm_cpu_context *host_ctxt)
338 {
339 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
340 	DECLARE_REG(u64, gfn, host_ctxt, 2);
341 	DECLARE_REG(u64, nr_pages, host_ctxt, 3);
342 	DECLARE_REG(bool, mkold, host_ctxt, 4);
343 	struct pkvm_hyp_vm *hyp_vm;
344 	int ret = -EINVAL;
345 
346 	if (!is_protected_kvm_enabled())
347 		goto out;
348 
349 	hyp_vm = get_np_pkvm_hyp_vm(handle);
350 	if (!hyp_vm)
351 		goto out;
352 
353 	ret = __pkvm_host_test_clear_young_guest(gfn, nr_pages, mkold, hyp_vm);
354 	put_pkvm_hyp_vm(hyp_vm);
355 out:
356 	cpu_reg(host_ctxt, 1) = ret;
357 }
358 
359 static void handle___pkvm_host_mkyoung_guest(struct kvm_cpu_context *host_ctxt)
360 {
361 	DECLARE_REG(u64, gfn, host_ctxt, 1);
362 	struct pkvm_hyp_vcpu *hyp_vcpu;
363 	int ret = -EINVAL;
364 
365 	if (!is_protected_kvm_enabled())
366 		goto out;
367 
368 	hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
369 	if (!hyp_vcpu || pkvm_hyp_vcpu_is_protected(hyp_vcpu))
370 		goto out;
371 
372 	ret = __pkvm_host_mkyoung_guest(gfn, hyp_vcpu);
373 out:
374 	cpu_reg(host_ctxt, 1) =  ret;
375 }
376 
377 static void handle___kvm_adjust_pc(struct kvm_cpu_context *host_ctxt)
378 {
379 	DECLARE_REG(struct kvm_vcpu *, vcpu, host_ctxt, 1);
380 
381 	__kvm_adjust_pc(kern_hyp_va(vcpu));
382 }
383 
384 static void handle___kvm_flush_vm_context(struct kvm_cpu_context *host_ctxt)
385 {
386 	__kvm_flush_vm_context();
387 }
388 
389 static void handle___kvm_tlb_flush_vmid_ipa(struct kvm_cpu_context *host_ctxt)
390 {
391 	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);
392 	DECLARE_REG(phys_addr_t, ipa, host_ctxt, 2);
393 	DECLARE_REG(int, level, host_ctxt, 3);
394 
395 	__kvm_tlb_flush_vmid_ipa(kern_hyp_va(mmu), ipa, level);
396 }
397 
398 static void handle___kvm_tlb_flush_vmid_ipa_nsh(struct kvm_cpu_context *host_ctxt)
399 {
400 	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);
401 	DECLARE_REG(phys_addr_t, ipa, host_ctxt, 2);
402 	DECLARE_REG(int, level, host_ctxt, 3);
403 
404 	__kvm_tlb_flush_vmid_ipa_nsh(kern_hyp_va(mmu), ipa, level);
405 }
406 
407 static void
408 handle___kvm_tlb_flush_vmid_range(struct kvm_cpu_context *host_ctxt)
409 {
410 	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);
411 	DECLARE_REG(phys_addr_t, start, host_ctxt, 2);
412 	DECLARE_REG(unsigned long, pages, host_ctxt, 3);
413 
414 	__kvm_tlb_flush_vmid_range(kern_hyp_va(mmu), start, pages);
415 }
416 
417 static void handle___kvm_tlb_flush_vmid(struct kvm_cpu_context *host_ctxt)
418 {
419 	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);
420 
421 	__kvm_tlb_flush_vmid(kern_hyp_va(mmu));
422 }
423 
424 static void handle___pkvm_tlb_flush_vmid(struct kvm_cpu_context *host_ctxt)
425 {
426 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
427 	struct pkvm_hyp_vm *hyp_vm;
428 
429 	if (!is_protected_kvm_enabled())
430 		return;
431 
432 	hyp_vm = get_np_pkvm_hyp_vm(handle);
433 	if (!hyp_vm)
434 		return;
435 
436 	__kvm_tlb_flush_vmid(&hyp_vm->kvm.arch.mmu);
437 	put_pkvm_hyp_vm(hyp_vm);
438 }
439 
440 static void handle___kvm_flush_cpu_context(struct kvm_cpu_context *host_ctxt)
441 {
442 	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);
443 
444 	__kvm_flush_cpu_context(kern_hyp_va(mmu));
445 }
446 
447 static void handle___kvm_timer_set_cntvoff(struct kvm_cpu_context *host_ctxt)
448 {
449 	__kvm_timer_set_cntvoff(cpu_reg(host_ctxt, 1));
450 }
451 
452 static void handle___kvm_enable_ssbs(struct kvm_cpu_context *host_ctxt)
453 {
454 	u64 tmp;
455 
456 	tmp = read_sysreg_el2(SYS_SCTLR);
457 	tmp |= SCTLR_ELx_DSSBS;
458 	write_sysreg_el2(tmp, SYS_SCTLR);
459 }
460 
461 static void handle___vgic_v3_get_gic_config(struct kvm_cpu_context *host_ctxt)
462 {
463 	cpu_reg(host_ctxt, 1) = __vgic_v3_get_gic_config();
464 }
465 
466 static void handle___vgic_v3_init_lrs(struct kvm_cpu_context *host_ctxt)
467 {
468 	__vgic_v3_init_lrs();
469 }
470 
471 static void handle___vgic_v3_save_aprs(struct kvm_cpu_context *host_ctxt)
472 {
473 	DECLARE_REG(struct vgic_v3_cpu_if *, cpu_if, host_ctxt, 1);
474 
475 	__vgic_v3_save_aprs(kern_hyp_va(cpu_if));
476 }
477 
478 static void handle___vgic_v3_restore_vmcr_aprs(struct kvm_cpu_context *host_ctxt)
479 {
480 	DECLARE_REG(struct vgic_v3_cpu_if *, cpu_if, host_ctxt, 1);
481 
482 	__vgic_v3_restore_vmcr_aprs(kern_hyp_va(cpu_if));
483 }
484 
485 static void handle___pkvm_init(struct kvm_cpu_context *host_ctxt)
486 {
487 	DECLARE_REG(phys_addr_t, phys, host_ctxt, 1);
488 	DECLARE_REG(unsigned long, size, host_ctxt, 2);
489 	DECLARE_REG(unsigned long, nr_cpus, host_ctxt, 3);
490 	DECLARE_REG(unsigned long *, per_cpu_base, host_ctxt, 4);
491 	DECLARE_REG(u32, hyp_va_bits, host_ctxt, 5);
492 
493 	/*
494 	 * __pkvm_init() will return only if an error occurred, otherwise it
495 	 * will tail-call in __pkvm_init_finalise() which will have to deal
496 	 * with the host context directly.
497 	 */
498 	cpu_reg(host_ctxt, 1) = __pkvm_init(phys, size, nr_cpus, per_cpu_base,
499 					    hyp_va_bits);
500 }
501 
502 static void handle___pkvm_cpu_set_vector(struct kvm_cpu_context *host_ctxt)
503 {
504 	DECLARE_REG(enum arm64_hyp_spectre_vector, slot, host_ctxt, 1);
505 
506 	cpu_reg(host_ctxt, 1) = pkvm_cpu_set_vector(slot);
507 }
508 
509 static void handle___pkvm_host_share_hyp(struct kvm_cpu_context *host_ctxt)
510 {
511 	DECLARE_REG(u64, pfn, host_ctxt, 1);
512 
513 	cpu_reg(host_ctxt, 1) = __pkvm_host_share_hyp(pfn);
514 }
515 
516 static void handle___pkvm_host_unshare_hyp(struct kvm_cpu_context *host_ctxt)
517 {
518 	DECLARE_REG(u64, pfn, host_ctxt, 1);
519 
520 	cpu_reg(host_ctxt, 1) = __pkvm_host_unshare_hyp(pfn);
521 }
522 
523 static void handle___pkvm_create_private_mapping(struct kvm_cpu_context *host_ctxt)
524 {
525 	DECLARE_REG(phys_addr_t, phys, host_ctxt, 1);
526 	DECLARE_REG(size_t, size, host_ctxt, 2);
527 	DECLARE_REG(enum kvm_pgtable_prot, prot, host_ctxt, 3);
528 
529 	/*
530 	 * __pkvm_create_private_mapping() populates a pointer with the
531 	 * hypervisor start address of the allocation.
532 	 *
533 	 * However, handle___pkvm_create_private_mapping() hypercall crosses the
534 	 * EL1/EL2 boundary so the pointer would not be valid in this context.
535 	 *
536 	 * Instead pass the allocation address as the return value (or return
537 	 * ERR_PTR() on failure).
538 	 */
539 	unsigned long haddr;
540 	int err = __pkvm_create_private_mapping(phys, size, prot, &haddr);
541 
542 	if (err)
543 		haddr = (unsigned long)ERR_PTR(err);
544 
545 	cpu_reg(host_ctxt, 1) = haddr;
546 }
547 
548 static void handle___pkvm_prot_finalize(struct kvm_cpu_context *host_ctxt)
549 {
550 	cpu_reg(host_ctxt, 1) = __pkvm_prot_finalize();
551 }
552 
553 static void handle___pkvm_reserve_vm(struct kvm_cpu_context *host_ctxt)
554 {
555 	cpu_reg(host_ctxt, 1) = __pkvm_reserve_vm();
556 }
557 
558 static void handle___pkvm_unreserve_vm(struct kvm_cpu_context *host_ctxt)
559 {
560 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
561 
562 	__pkvm_unreserve_vm(handle);
563 }
564 
565 static void handle___pkvm_init_vm(struct kvm_cpu_context *host_ctxt)
566 {
567 	DECLARE_REG(struct kvm *, host_kvm, host_ctxt, 1);
568 	DECLARE_REG(unsigned long, vm_hva, host_ctxt, 2);
569 	DECLARE_REG(unsigned long, pgd_hva, host_ctxt, 3);
570 
571 	host_kvm = kern_hyp_va(host_kvm);
572 	cpu_reg(host_ctxt, 1) = __pkvm_init_vm(host_kvm, vm_hva, pgd_hva);
573 }
574 
575 static void handle___pkvm_init_vcpu(struct kvm_cpu_context *host_ctxt)
576 {
577 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
578 	DECLARE_REG(struct kvm_vcpu *, host_vcpu, host_ctxt, 2);
579 	DECLARE_REG(unsigned long, vcpu_hva, host_ctxt, 3);
580 
581 	host_vcpu = kern_hyp_va(host_vcpu);
582 	cpu_reg(host_ctxt, 1) = __pkvm_init_vcpu(handle, host_vcpu, vcpu_hva);
583 }
584 
585 static void handle___pkvm_teardown_vm(struct kvm_cpu_context *host_ctxt)
586 {
587 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
588 
589 	cpu_reg(host_ctxt, 1) = __pkvm_teardown_vm(handle);
590 }
591 
592 typedef void (*hcall_t)(struct kvm_cpu_context *);
593 
594 #define HANDLE_FUNC(x)	[__KVM_HOST_SMCCC_FUNC_##x] = (hcall_t)handle_##x
595 
596 static const hcall_t host_hcall[] = {
597 	/* ___kvm_hyp_init */
598 	HANDLE_FUNC(__pkvm_init),
599 	HANDLE_FUNC(__pkvm_create_private_mapping),
600 	HANDLE_FUNC(__pkvm_cpu_set_vector),
601 	HANDLE_FUNC(__kvm_enable_ssbs),
602 	HANDLE_FUNC(__vgic_v3_init_lrs),
603 	HANDLE_FUNC(__vgic_v3_get_gic_config),
604 	HANDLE_FUNC(__pkvm_prot_finalize),
605 
606 	HANDLE_FUNC(__pkvm_host_share_hyp),
607 	HANDLE_FUNC(__pkvm_host_unshare_hyp),
608 	HANDLE_FUNC(__pkvm_host_share_guest),
609 	HANDLE_FUNC(__pkvm_host_unshare_guest),
610 	HANDLE_FUNC(__pkvm_host_relax_perms_guest),
611 	HANDLE_FUNC(__pkvm_host_wrprotect_guest),
612 	HANDLE_FUNC(__pkvm_host_test_clear_young_guest),
613 	HANDLE_FUNC(__pkvm_host_mkyoung_guest),
614 	HANDLE_FUNC(__kvm_adjust_pc),
615 	HANDLE_FUNC(__kvm_vcpu_run),
616 	HANDLE_FUNC(__kvm_flush_vm_context),
617 	HANDLE_FUNC(__kvm_tlb_flush_vmid_ipa),
618 	HANDLE_FUNC(__kvm_tlb_flush_vmid_ipa_nsh),
619 	HANDLE_FUNC(__kvm_tlb_flush_vmid),
620 	HANDLE_FUNC(__kvm_tlb_flush_vmid_range),
621 	HANDLE_FUNC(__kvm_flush_cpu_context),
622 	HANDLE_FUNC(__kvm_timer_set_cntvoff),
623 	HANDLE_FUNC(__vgic_v3_save_aprs),
624 	HANDLE_FUNC(__vgic_v3_restore_vmcr_aprs),
625 	HANDLE_FUNC(__pkvm_reserve_vm),
626 	HANDLE_FUNC(__pkvm_unreserve_vm),
627 	HANDLE_FUNC(__pkvm_init_vm),
628 	HANDLE_FUNC(__pkvm_init_vcpu),
629 	HANDLE_FUNC(__pkvm_teardown_vm),
630 	HANDLE_FUNC(__pkvm_vcpu_load),
631 	HANDLE_FUNC(__pkvm_vcpu_put),
632 	HANDLE_FUNC(__pkvm_tlb_flush_vmid),
633 };
634 
635 static void handle_host_hcall(struct kvm_cpu_context *host_ctxt)
636 {
637 	DECLARE_REG(unsigned long, id, host_ctxt, 0);
638 	unsigned long hcall_min = 0;
639 	hcall_t hfn;
640 
641 	/*
642 	 * If pKVM has been initialised then reject any calls to the
643 	 * early "privileged" hypercalls. Note that we cannot reject
644 	 * calls to __pkvm_prot_finalize for two reasons: (1) The static
645 	 * key used to determine initialisation must be toggled prior to
646 	 * finalisation and (2) finalisation is performed on a per-CPU
647 	 * basis. This is all fine, however, since __pkvm_prot_finalize
648 	 * returns -EPERM after the first call for a given CPU.
649 	 */
650 	if (static_branch_unlikely(&kvm_protected_mode_initialized))
651 		hcall_min = __KVM_HOST_SMCCC_FUNC___pkvm_prot_finalize;
652 
653 	id &= ~ARM_SMCCC_CALL_HINTS;
654 	id -= KVM_HOST_SMCCC_ID(0);
655 
656 	if (unlikely(id < hcall_min || id >= ARRAY_SIZE(host_hcall)))
657 		goto inval;
658 
659 	hfn = host_hcall[id];
660 	if (unlikely(!hfn))
661 		goto inval;
662 
663 	cpu_reg(host_ctxt, 0) = SMCCC_RET_SUCCESS;
664 	hfn(host_ctxt);
665 
666 	return;
667 inval:
668 	cpu_reg(host_ctxt, 0) = SMCCC_RET_NOT_SUPPORTED;
669 }
670 
671 static void default_host_smc_handler(struct kvm_cpu_context *host_ctxt)
672 {
673 	__kvm_hyp_host_forward_smc(host_ctxt);
674 }
675 
676 static void handle_host_smc(struct kvm_cpu_context *host_ctxt)
677 {
678 	DECLARE_REG(u64, func_id, host_ctxt, 0);
679 	bool handled;
680 
681 	func_id &= ~ARM_SMCCC_CALL_HINTS;
682 
683 	handled = kvm_host_psci_handler(host_ctxt, func_id);
684 	if (!handled)
685 		handled = kvm_host_ffa_handler(host_ctxt, func_id);
686 	if (!handled)
687 		default_host_smc_handler(host_ctxt);
688 
689 	/* SMC was trapped, move ELR past the current PC. */
690 	kvm_skip_host_instr();
691 }
692 
693 void handle_trap(struct kvm_cpu_context *host_ctxt)
694 {
695 	u64 esr = read_sysreg_el2(SYS_ESR);
696 
697 	switch (ESR_ELx_EC(esr)) {
698 	case ESR_ELx_EC_HVC64:
699 		handle_host_hcall(host_ctxt);
700 		break;
701 	case ESR_ELx_EC_SMC64:
702 		handle_host_smc(host_ctxt);
703 		break;
704 	case ESR_ELx_EC_IABT_LOW:
705 	case ESR_ELx_EC_DABT_LOW:
706 		handle_host_mem_abort(host_ctxt);
707 		break;
708 	default:
709 		BUG();
710 	}
711 }
712