xref: /linux/arch/arm64/kvm/hyp/nvhe/hyp-main.c (revision e0c0ab04f6785abaa71b9b8dc252cb1a2072c225)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2020 - Google Inc
4  * Author: Andrew Scull <ascull@google.com>
5  */
6 
7 #include <hyp/adjust_pc.h>
8 #include <hyp/switch.h>
9 
10 #include <asm/pgtable-types.h>
11 #include <asm/kvm_asm.h>
12 #include <asm/kvm_emulate.h>
13 #include <asm/kvm_host.h>
14 #include <asm/kvm_hyp.h>
15 #include <asm/kvm_mmu.h>
16 
17 #include <nvhe/ffa.h>
18 #include <nvhe/mem_protect.h>
19 #include <nvhe/mm.h>
20 #include <nvhe/pkvm.h>
21 #include <nvhe/trap_handler.h>
22 
23 DEFINE_PER_CPU(struct kvm_nvhe_init_params, kvm_init_params);
24 
25 void __kvm_hyp_host_forward_smc(struct kvm_cpu_context *host_ctxt);
26 
27 static void __hyp_sve_save_guest(struct kvm_vcpu *vcpu)
28 {
29 	__vcpu_assign_sys_reg(vcpu, ZCR_EL1, read_sysreg_el1(SYS_ZCR));
30 	/*
31 	 * On saving/restoring guest sve state, always use the maximum VL for
32 	 * the guest. The layout of the data when saving the sve state depends
33 	 * on the VL, so use a consistent (i.e., the maximum) guest VL.
34 	 */
35 	sve_cond_update_zcr_vq(vcpu_sve_max_vq(vcpu) - 1, SYS_ZCR_EL2);
36 	__sve_save_state(vcpu_sve_pffr(vcpu), &vcpu->arch.ctxt.fp_regs.fpsr, true);
37 	write_sysreg_s(sve_vq_from_vl(kvm_host_sve_max_vl) - 1, SYS_ZCR_EL2);
38 }
39 
40 static void __hyp_sve_restore_host(void)
41 {
42 	struct cpu_sve_state *sve_state = *host_data_ptr(sve_state);
43 
44 	/*
45 	 * On saving/restoring host sve state, always use the maximum VL for
46 	 * the host. The layout of the data when saving the sve state depends
47 	 * on the VL, so use a consistent (i.e., the maximum) host VL.
48 	 *
49 	 * Note that this constrains the PE to the maximum shared VL
50 	 * that was discovered, if we wish to use larger VLs this will
51 	 * need to be revisited.
52 	 */
53 	write_sysreg_s(sve_vq_from_vl(kvm_host_sve_max_vl) - 1, SYS_ZCR_EL2);
54 	__sve_restore_state(sve_state->sve_regs + sve_ffr_offset(kvm_host_sve_max_vl),
55 			    &sve_state->fpsr,
56 			    true);
57 	write_sysreg_el1(sve_state->zcr_el1, SYS_ZCR);
58 }
59 
60 static void fpsimd_sve_flush(void)
61 {
62 	*host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED;
63 }
64 
65 static void fpsimd_sve_sync(struct kvm_vcpu *vcpu)
66 {
67 	bool has_fpmr;
68 
69 	if (!guest_owns_fp_regs())
70 		return;
71 
72 	cpacr_clear_set(0, CPACR_EL1_FPEN | CPACR_EL1_ZEN);
73 	isb();
74 
75 	if (vcpu_has_sve(vcpu))
76 		__hyp_sve_save_guest(vcpu);
77 	else
78 		__fpsimd_save_state(&vcpu->arch.ctxt.fp_regs);
79 
80 	has_fpmr = kvm_has_fpmr(kern_hyp_va(vcpu->kvm));
81 	if (has_fpmr)
82 		__vcpu_assign_sys_reg(vcpu, FPMR, read_sysreg_s(SYS_FPMR));
83 
84 	if (system_supports_sve())
85 		__hyp_sve_restore_host();
86 	else
87 		__fpsimd_restore_state(host_data_ptr(host_ctxt.fp_regs));
88 
89 	if (has_fpmr)
90 		write_sysreg_s(*host_data_ptr(fpmr), SYS_FPMR);
91 
92 	*host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED;
93 }
94 
95 static void flush_debug_state(struct pkvm_hyp_vcpu *hyp_vcpu)
96 {
97 	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
98 
99 	hyp_vcpu->vcpu.arch.debug_owner = host_vcpu->arch.debug_owner;
100 
101 	if (kvm_guest_owns_debug_regs(&hyp_vcpu->vcpu))
102 		hyp_vcpu->vcpu.arch.vcpu_debug_state = host_vcpu->arch.vcpu_debug_state;
103 	else if (kvm_host_owns_debug_regs(&hyp_vcpu->vcpu))
104 		hyp_vcpu->vcpu.arch.external_debug_state = host_vcpu->arch.external_debug_state;
105 }
106 
107 static void sync_debug_state(struct pkvm_hyp_vcpu *hyp_vcpu)
108 {
109 	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
110 
111 	if (kvm_guest_owns_debug_regs(&hyp_vcpu->vcpu))
112 		host_vcpu->arch.vcpu_debug_state = hyp_vcpu->vcpu.arch.vcpu_debug_state;
113 	else if (kvm_host_owns_debug_regs(&hyp_vcpu->vcpu))
114 		host_vcpu->arch.external_debug_state = hyp_vcpu->vcpu.arch.external_debug_state;
115 }
116 
117 static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
118 {
119 	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
120 
121 	fpsimd_sve_flush();
122 	flush_debug_state(hyp_vcpu);
123 
124 	hyp_vcpu->vcpu.arch.ctxt	= host_vcpu->arch.ctxt;
125 
126 	hyp_vcpu->vcpu.arch.mdcr_el2	= host_vcpu->arch.mdcr_el2;
127 	hyp_vcpu->vcpu.arch.hcr_el2 &= ~(HCR_TWI | HCR_TWE);
128 	hyp_vcpu->vcpu.arch.hcr_el2 |= READ_ONCE(host_vcpu->arch.hcr_el2) &
129 						 (HCR_TWI | HCR_TWE);
130 
131 	hyp_vcpu->vcpu.arch.iflags	= host_vcpu->arch.iflags;
132 
133 	hyp_vcpu->vcpu.arch.vsesr_el2	= host_vcpu->arch.vsesr_el2;
134 
135 	hyp_vcpu->vcpu.arch.vgic_cpu.vgic_v3 = host_vcpu->arch.vgic_cpu.vgic_v3;
136 }
137 
138 static void sync_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
139 {
140 	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
141 	struct vgic_v3_cpu_if *hyp_cpu_if = &hyp_vcpu->vcpu.arch.vgic_cpu.vgic_v3;
142 	struct vgic_v3_cpu_if *host_cpu_if = &host_vcpu->arch.vgic_cpu.vgic_v3;
143 	unsigned int i;
144 
145 	fpsimd_sve_sync(&hyp_vcpu->vcpu);
146 	sync_debug_state(hyp_vcpu);
147 
148 	host_vcpu->arch.ctxt		= hyp_vcpu->vcpu.arch.ctxt;
149 
150 	host_vcpu->arch.hcr_el2		= hyp_vcpu->vcpu.arch.hcr_el2;
151 
152 	host_vcpu->arch.fault		= hyp_vcpu->vcpu.arch.fault;
153 
154 	host_vcpu->arch.iflags		= hyp_vcpu->vcpu.arch.iflags;
155 
156 	host_cpu_if->vgic_hcr		= hyp_cpu_if->vgic_hcr;
157 	for (i = 0; i < hyp_cpu_if->used_lrs; ++i)
158 		host_cpu_if->vgic_lr[i] = hyp_cpu_if->vgic_lr[i];
159 }
160 
161 static void handle___pkvm_vcpu_load(struct kvm_cpu_context *host_ctxt)
162 {
163 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
164 	DECLARE_REG(unsigned int, vcpu_idx, host_ctxt, 2);
165 	DECLARE_REG(u64, hcr_el2, host_ctxt, 3);
166 	struct pkvm_hyp_vcpu *hyp_vcpu;
167 
168 	if (!is_protected_kvm_enabled())
169 		return;
170 
171 	hyp_vcpu = pkvm_load_hyp_vcpu(handle, vcpu_idx);
172 	if (!hyp_vcpu)
173 		return;
174 
175 	if (pkvm_hyp_vcpu_is_protected(hyp_vcpu)) {
176 		/* Propagate WFx trapping flags */
177 		hyp_vcpu->vcpu.arch.hcr_el2 &= ~(HCR_TWE | HCR_TWI);
178 		hyp_vcpu->vcpu.arch.hcr_el2 |= hcr_el2 & (HCR_TWE | HCR_TWI);
179 	}
180 }
181 
182 static void handle___pkvm_vcpu_put(struct kvm_cpu_context *host_ctxt)
183 {
184 	struct pkvm_hyp_vcpu *hyp_vcpu;
185 
186 	if (!is_protected_kvm_enabled())
187 		return;
188 
189 	hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
190 	if (hyp_vcpu)
191 		pkvm_put_hyp_vcpu(hyp_vcpu);
192 }
193 
194 static void handle___kvm_vcpu_run(struct kvm_cpu_context *host_ctxt)
195 {
196 	DECLARE_REG(struct kvm_vcpu *, host_vcpu, host_ctxt, 1);
197 	int ret;
198 
199 	if (unlikely(is_protected_kvm_enabled())) {
200 		struct pkvm_hyp_vcpu *hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
201 
202 		/*
203 		 * KVM (and pKVM) doesn't support SME guests for now, and
204 		 * ensures that SME features aren't enabled in pstate when
205 		 * loading a vcpu. Therefore, if SME features enabled the host
206 		 * is misbehaving.
207 		 */
208 		if (unlikely(system_supports_sme() && read_sysreg_s(SYS_SVCR))) {
209 			ret = -EINVAL;
210 			goto out;
211 		}
212 
213 		if (!hyp_vcpu) {
214 			ret = -EINVAL;
215 			goto out;
216 		}
217 
218 		flush_hyp_vcpu(hyp_vcpu);
219 
220 		ret = __kvm_vcpu_run(&hyp_vcpu->vcpu);
221 
222 		sync_hyp_vcpu(hyp_vcpu);
223 	} else {
224 		struct kvm_vcpu *vcpu = kern_hyp_va(host_vcpu);
225 
226 		/* The host is fully trusted, run its vCPU directly. */
227 		fpsimd_lazy_switch_to_guest(vcpu);
228 		ret = __kvm_vcpu_run(vcpu);
229 		fpsimd_lazy_switch_to_host(vcpu);
230 	}
231 out:
232 	cpu_reg(host_ctxt, 1) =  ret;
233 }
234 
235 static int pkvm_refill_memcache(struct pkvm_hyp_vcpu *hyp_vcpu)
236 {
237 	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
238 
239 	return refill_memcache(&hyp_vcpu->vcpu.arch.pkvm_memcache,
240 			       host_vcpu->arch.pkvm_memcache.nr_pages,
241 			       &host_vcpu->arch.pkvm_memcache);
242 }
243 
244 static void handle___pkvm_host_share_guest(struct kvm_cpu_context *host_ctxt)
245 {
246 	DECLARE_REG(u64, pfn, host_ctxt, 1);
247 	DECLARE_REG(u64, gfn, host_ctxt, 2);
248 	DECLARE_REG(u64, nr_pages, host_ctxt, 3);
249 	DECLARE_REG(enum kvm_pgtable_prot, prot, host_ctxt, 4);
250 	struct pkvm_hyp_vcpu *hyp_vcpu;
251 	int ret = -EINVAL;
252 
253 	if (!is_protected_kvm_enabled())
254 		goto out;
255 
256 	hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
257 	if (!hyp_vcpu || pkvm_hyp_vcpu_is_protected(hyp_vcpu))
258 		goto out;
259 
260 	ret = pkvm_refill_memcache(hyp_vcpu);
261 	if (ret)
262 		goto out;
263 
264 	ret = __pkvm_host_share_guest(pfn, gfn, nr_pages, hyp_vcpu, prot);
265 out:
266 	cpu_reg(host_ctxt, 1) =  ret;
267 }
268 
269 static void handle___pkvm_host_unshare_guest(struct kvm_cpu_context *host_ctxt)
270 {
271 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
272 	DECLARE_REG(u64, gfn, host_ctxt, 2);
273 	DECLARE_REG(u64, nr_pages, host_ctxt, 3);
274 	struct pkvm_hyp_vm *hyp_vm;
275 	int ret = -EINVAL;
276 
277 	if (!is_protected_kvm_enabled())
278 		goto out;
279 
280 	hyp_vm = get_np_pkvm_hyp_vm(handle);
281 	if (!hyp_vm)
282 		goto out;
283 
284 	ret = __pkvm_host_unshare_guest(gfn, nr_pages, hyp_vm);
285 	put_pkvm_hyp_vm(hyp_vm);
286 out:
287 	cpu_reg(host_ctxt, 1) =  ret;
288 }
289 
290 static void handle___pkvm_host_relax_perms_guest(struct kvm_cpu_context *host_ctxt)
291 {
292 	DECLARE_REG(u64, gfn, host_ctxt, 1);
293 	DECLARE_REG(enum kvm_pgtable_prot, prot, host_ctxt, 2);
294 	struct pkvm_hyp_vcpu *hyp_vcpu;
295 	int ret = -EINVAL;
296 
297 	if (!is_protected_kvm_enabled())
298 		goto out;
299 
300 	hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
301 	if (!hyp_vcpu || pkvm_hyp_vcpu_is_protected(hyp_vcpu))
302 		goto out;
303 
304 	ret = __pkvm_host_relax_perms_guest(gfn, hyp_vcpu, prot);
305 out:
306 	cpu_reg(host_ctxt, 1) = ret;
307 }
308 
309 static void handle___pkvm_host_wrprotect_guest(struct kvm_cpu_context *host_ctxt)
310 {
311 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
312 	DECLARE_REG(u64, gfn, host_ctxt, 2);
313 	DECLARE_REG(u64, nr_pages, host_ctxt, 3);
314 	struct pkvm_hyp_vm *hyp_vm;
315 	int ret = -EINVAL;
316 
317 	if (!is_protected_kvm_enabled())
318 		goto out;
319 
320 	hyp_vm = get_np_pkvm_hyp_vm(handle);
321 	if (!hyp_vm)
322 		goto out;
323 
324 	ret = __pkvm_host_wrprotect_guest(gfn, nr_pages, hyp_vm);
325 	put_pkvm_hyp_vm(hyp_vm);
326 out:
327 	cpu_reg(host_ctxt, 1) = ret;
328 }
329 
330 static void handle___pkvm_host_test_clear_young_guest(struct kvm_cpu_context *host_ctxt)
331 {
332 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
333 	DECLARE_REG(u64, gfn, host_ctxt, 2);
334 	DECLARE_REG(u64, nr_pages, host_ctxt, 3);
335 	DECLARE_REG(bool, mkold, host_ctxt, 4);
336 	struct pkvm_hyp_vm *hyp_vm;
337 	int ret = -EINVAL;
338 
339 	if (!is_protected_kvm_enabled())
340 		goto out;
341 
342 	hyp_vm = get_np_pkvm_hyp_vm(handle);
343 	if (!hyp_vm)
344 		goto out;
345 
346 	ret = __pkvm_host_test_clear_young_guest(gfn, nr_pages, mkold, hyp_vm);
347 	put_pkvm_hyp_vm(hyp_vm);
348 out:
349 	cpu_reg(host_ctxt, 1) = ret;
350 }
351 
352 static void handle___pkvm_host_mkyoung_guest(struct kvm_cpu_context *host_ctxt)
353 {
354 	DECLARE_REG(u64, gfn, host_ctxt, 1);
355 	struct pkvm_hyp_vcpu *hyp_vcpu;
356 	int ret = -EINVAL;
357 
358 	if (!is_protected_kvm_enabled())
359 		goto out;
360 
361 	hyp_vcpu = pkvm_get_loaded_hyp_vcpu();
362 	if (!hyp_vcpu || pkvm_hyp_vcpu_is_protected(hyp_vcpu))
363 		goto out;
364 
365 	ret = __pkvm_host_mkyoung_guest(gfn, hyp_vcpu);
366 out:
367 	cpu_reg(host_ctxt, 1) =  ret;
368 }
369 
370 static void handle___kvm_adjust_pc(struct kvm_cpu_context *host_ctxt)
371 {
372 	DECLARE_REG(struct kvm_vcpu *, vcpu, host_ctxt, 1);
373 
374 	__kvm_adjust_pc(kern_hyp_va(vcpu));
375 }
376 
377 static void handle___kvm_flush_vm_context(struct kvm_cpu_context *host_ctxt)
378 {
379 	__kvm_flush_vm_context();
380 }
381 
382 static void handle___kvm_tlb_flush_vmid_ipa(struct kvm_cpu_context *host_ctxt)
383 {
384 	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);
385 	DECLARE_REG(phys_addr_t, ipa, host_ctxt, 2);
386 	DECLARE_REG(int, level, host_ctxt, 3);
387 
388 	__kvm_tlb_flush_vmid_ipa(kern_hyp_va(mmu), ipa, level);
389 }
390 
391 static void handle___kvm_tlb_flush_vmid_ipa_nsh(struct kvm_cpu_context *host_ctxt)
392 {
393 	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);
394 	DECLARE_REG(phys_addr_t, ipa, host_ctxt, 2);
395 	DECLARE_REG(int, level, host_ctxt, 3);
396 
397 	__kvm_tlb_flush_vmid_ipa_nsh(kern_hyp_va(mmu), ipa, level);
398 }
399 
400 static void
401 handle___kvm_tlb_flush_vmid_range(struct kvm_cpu_context *host_ctxt)
402 {
403 	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);
404 	DECLARE_REG(phys_addr_t, start, host_ctxt, 2);
405 	DECLARE_REG(unsigned long, pages, host_ctxt, 3);
406 
407 	__kvm_tlb_flush_vmid_range(kern_hyp_va(mmu), start, pages);
408 }
409 
410 static void handle___kvm_tlb_flush_vmid(struct kvm_cpu_context *host_ctxt)
411 {
412 	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);
413 
414 	__kvm_tlb_flush_vmid(kern_hyp_va(mmu));
415 }
416 
417 static void handle___pkvm_tlb_flush_vmid(struct kvm_cpu_context *host_ctxt)
418 {
419 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
420 	struct pkvm_hyp_vm *hyp_vm;
421 
422 	if (!is_protected_kvm_enabled())
423 		return;
424 
425 	hyp_vm = get_np_pkvm_hyp_vm(handle);
426 	if (!hyp_vm)
427 		return;
428 
429 	__kvm_tlb_flush_vmid(&hyp_vm->kvm.arch.mmu);
430 	put_pkvm_hyp_vm(hyp_vm);
431 }
432 
433 static void handle___kvm_flush_cpu_context(struct kvm_cpu_context *host_ctxt)
434 {
435 	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);
436 
437 	__kvm_flush_cpu_context(kern_hyp_va(mmu));
438 }
439 
440 static void handle___kvm_timer_set_cntvoff(struct kvm_cpu_context *host_ctxt)
441 {
442 	__kvm_timer_set_cntvoff(cpu_reg(host_ctxt, 1));
443 }
444 
445 static void handle___kvm_enable_ssbs(struct kvm_cpu_context *host_ctxt)
446 {
447 	u64 tmp;
448 
449 	tmp = read_sysreg_el2(SYS_SCTLR);
450 	tmp |= SCTLR_ELx_DSSBS;
451 	write_sysreg_el2(tmp, SYS_SCTLR);
452 }
453 
454 static void handle___vgic_v3_get_gic_config(struct kvm_cpu_context *host_ctxt)
455 {
456 	cpu_reg(host_ctxt, 1) = __vgic_v3_get_gic_config();
457 }
458 
459 static void handle___vgic_v3_init_lrs(struct kvm_cpu_context *host_ctxt)
460 {
461 	__vgic_v3_init_lrs();
462 }
463 
464 static void handle___vgic_v3_save_vmcr_aprs(struct kvm_cpu_context *host_ctxt)
465 {
466 	DECLARE_REG(struct vgic_v3_cpu_if *, cpu_if, host_ctxt, 1);
467 
468 	__vgic_v3_save_vmcr_aprs(kern_hyp_va(cpu_if));
469 }
470 
471 static void handle___vgic_v3_restore_vmcr_aprs(struct kvm_cpu_context *host_ctxt)
472 {
473 	DECLARE_REG(struct vgic_v3_cpu_if *, cpu_if, host_ctxt, 1);
474 
475 	__vgic_v3_restore_vmcr_aprs(kern_hyp_va(cpu_if));
476 }
477 
478 static void handle___pkvm_init(struct kvm_cpu_context *host_ctxt)
479 {
480 	DECLARE_REG(phys_addr_t, phys, host_ctxt, 1);
481 	DECLARE_REG(unsigned long, size, host_ctxt, 2);
482 	DECLARE_REG(unsigned long, nr_cpus, host_ctxt, 3);
483 	DECLARE_REG(unsigned long *, per_cpu_base, host_ctxt, 4);
484 	DECLARE_REG(u32, hyp_va_bits, host_ctxt, 5);
485 
486 	/*
487 	 * __pkvm_init() will return only if an error occurred, otherwise it
488 	 * will tail-call in __pkvm_init_finalise() which will have to deal
489 	 * with the host context directly.
490 	 */
491 	cpu_reg(host_ctxt, 1) = __pkvm_init(phys, size, nr_cpus, per_cpu_base,
492 					    hyp_va_bits);
493 }
494 
495 static void handle___pkvm_cpu_set_vector(struct kvm_cpu_context *host_ctxt)
496 {
497 	DECLARE_REG(enum arm64_hyp_spectre_vector, slot, host_ctxt, 1);
498 
499 	cpu_reg(host_ctxt, 1) = pkvm_cpu_set_vector(slot);
500 }
501 
502 static void handle___pkvm_host_share_hyp(struct kvm_cpu_context *host_ctxt)
503 {
504 	DECLARE_REG(u64, pfn, host_ctxt, 1);
505 
506 	cpu_reg(host_ctxt, 1) = __pkvm_host_share_hyp(pfn);
507 }
508 
509 static void handle___pkvm_host_unshare_hyp(struct kvm_cpu_context *host_ctxt)
510 {
511 	DECLARE_REG(u64, pfn, host_ctxt, 1);
512 
513 	cpu_reg(host_ctxt, 1) = __pkvm_host_unshare_hyp(pfn);
514 }
515 
516 static void handle___pkvm_create_private_mapping(struct kvm_cpu_context *host_ctxt)
517 {
518 	DECLARE_REG(phys_addr_t, phys, host_ctxt, 1);
519 	DECLARE_REG(size_t, size, host_ctxt, 2);
520 	DECLARE_REG(enum kvm_pgtable_prot, prot, host_ctxt, 3);
521 
522 	/*
523 	 * __pkvm_create_private_mapping() populates a pointer with the
524 	 * hypervisor start address of the allocation.
525 	 *
526 	 * However, handle___pkvm_create_private_mapping() hypercall crosses the
527 	 * EL1/EL2 boundary so the pointer would not be valid in this context.
528 	 *
529 	 * Instead pass the allocation address as the return value (or return
530 	 * ERR_PTR() on failure).
531 	 */
532 	unsigned long haddr;
533 	int err = __pkvm_create_private_mapping(phys, size, prot, &haddr);
534 
535 	if (err)
536 		haddr = (unsigned long)ERR_PTR(err);
537 
538 	cpu_reg(host_ctxt, 1) = haddr;
539 }
540 
541 static void handle___pkvm_prot_finalize(struct kvm_cpu_context *host_ctxt)
542 {
543 	cpu_reg(host_ctxt, 1) = __pkvm_prot_finalize();
544 }
545 
546 static void handle___pkvm_init_vm(struct kvm_cpu_context *host_ctxt)
547 {
548 	DECLARE_REG(struct kvm *, host_kvm, host_ctxt, 1);
549 	DECLARE_REG(unsigned long, vm_hva, host_ctxt, 2);
550 	DECLARE_REG(unsigned long, pgd_hva, host_ctxt, 3);
551 
552 	host_kvm = kern_hyp_va(host_kvm);
553 	cpu_reg(host_ctxt, 1) = __pkvm_init_vm(host_kvm, vm_hva, pgd_hva);
554 }
555 
556 static void handle___pkvm_init_vcpu(struct kvm_cpu_context *host_ctxt)
557 {
558 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
559 	DECLARE_REG(struct kvm_vcpu *, host_vcpu, host_ctxt, 2);
560 	DECLARE_REG(unsigned long, vcpu_hva, host_ctxt, 3);
561 
562 	host_vcpu = kern_hyp_va(host_vcpu);
563 	cpu_reg(host_ctxt, 1) = __pkvm_init_vcpu(handle, host_vcpu, vcpu_hva);
564 }
565 
566 static void handle___pkvm_teardown_vm(struct kvm_cpu_context *host_ctxt)
567 {
568 	DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1);
569 
570 	cpu_reg(host_ctxt, 1) = __pkvm_teardown_vm(handle);
571 }
572 
573 typedef void (*hcall_t)(struct kvm_cpu_context *);
574 
575 #define HANDLE_FUNC(x)	[__KVM_HOST_SMCCC_FUNC_##x] = (hcall_t)handle_##x
576 
577 static const hcall_t host_hcall[] = {
578 	/* ___kvm_hyp_init */
579 	HANDLE_FUNC(__pkvm_init),
580 	HANDLE_FUNC(__pkvm_create_private_mapping),
581 	HANDLE_FUNC(__pkvm_cpu_set_vector),
582 	HANDLE_FUNC(__kvm_enable_ssbs),
583 	HANDLE_FUNC(__vgic_v3_init_lrs),
584 	HANDLE_FUNC(__vgic_v3_get_gic_config),
585 	HANDLE_FUNC(__pkvm_prot_finalize),
586 
587 	HANDLE_FUNC(__pkvm_host_share_hyp),
588 	HANDLE_FUNC(__pkvm_host_unshare_hyp),
589 	HANDLE_FUNC(__pkvm_host_share_guest),
590 	HANDLE_FUNC(__pkvm_host_unshare_guest),
591 	HANDLE_FUNC(__pkvm_host_relax_perms_guest),
592 	HANDLE_FUNC(__pkvm_host_wrprotect_guest),
593 	HANDLE_FUNC(__pkvm_host_test_clear_young_guest),
594 	HANDLE_FUNC(__pkvm_host_mkyoung_guest),
595 	HANDLE_FUNC(__kvm_adjust_pc),
596 	HANDLE_FUNC(__kvm_vcpu_run),
597 	HANDLE_FUNC(__kvm_flush_vm_context),
598 	HANDLE_FUNC(__kvm_tlb_flush_vmid_ipa),
599 	HANDLE_FUNC(__kvm_tlb_flush_vmid_ipa_nsh),
600 	HANDLE_FUNC(__kvm_tlb_flush_vmid),
601 	HANDLE_FUNC(__kvm_tlb_flush_vmid_range),
602 	HANDLE_FUNC(__kvm_flush_cpu_context),
603 	HANDLE_FUNC(__kvm_timer_set_cntvoff),
604 	HANDLE_FUNC(__vgic_v3_save_vmcr_aprs),
605 	HANDLE_FUNC(__vgic_v3_restore_vmcr_aprs),
606 	HANDLE_FUNC(__pkvm_init_vm),
607 	HANDLE_FUNC(__pkvm_init_vcpu),
608 	HANDLE_FUNC(__pkvm_teardown_vm),
609 	HANDLE_FUNC(__pkvm_vcpu_load),
610 	HANDLE_FUNC(__pkvm_vcpu_put),
611 	HANDLE_FUNC(__pkvm_tlb_flush_vmid),
612 };
613 
614 static void handle_host_hcall(struct kvm_cpu_context *host_ctxt)
615 {
616 	DECLARE_REG(unsigned long, id, host_ctxt, 0);
617 	unsigned long hcall_min = 0;
618 	hcall_t hfn;
619 
620 	/*
621 	 * If pKVM has been initialised then reject any calls to the
622 	 * early "privileged" hypercalls. Note that we cannot reject
623 	 * calls to __pkvm_prot_finalize for two reasons: (1) The static
624 	 * key used to determine initialisation must be toggled prior to
625 	 * finalisation and (2) finalisation is performed on a per-CPU
626 	 * basis. This is all fine, however, since __pkvm_prot_finalize
627 	 * returns -EPERM after the first call for a given CPU.
628 	 */
629 	if (static_branch_unlikely(&kvm_protected_mode_initialized))
630 		hcall_min = __KVM_HOST_SMCCC_FUNC___pkvm_prot_finalize;
631 
632 	id &= ~ARM_SMCCC_CALL_HINTS;
633 	id -= KVM_HOST_SMCCC_ID(0);
634 
635 	if (unlikely(id < hcall_min || id >= ARRAY_SIZE(host_hcall)))
636 		goto inval;
637 
638 	hfn = host_hcall[id];
639 	if (unlikely(!hfn))
640 		goto inval;
641 
642 	cpu_reg(host_ctxt, 0) = SMCCC_RET_SUCCESS;
643 	hfn(host_ctxt);
644 
645 	return;
646 inval:
647 	cpu_reg(host_ctxt, 0) = SMCCC_RET_NOT_SUPPORTED;
648 }
649 
650 static void default_host_smc_handler(struct kvm_cpu_context *host_ctxt)
651 {
652 	__kvm_hyp_host_forward_smc(host_ctxt);
653 }
654 
655 static void handle_host_smc(struct kvm_cpu_context *host_ctxt)
656 {
657 	DECLARE_REG(u64, func_id, host_ctxt, 0);
658 	bool handled;
659 
660 	func_id &= ~ARM_SMCCC_CALL_HINTS;
661 
662 	handled = kvm_host_psci_handler(host_ctxt, func_id);
663 	if (!handled)
664 		handled = kvm_host_ffa_handler(host_ctxt, func_id);
665 	if (!handled)
666 		default_host_smc_handler(host_ctxt);
667 
668 	/* SMC was trapped, move ELR past the current PC. */
669 	kvm_skip_host_instr();
670 }
671 
672 void handle_trap(struct kvm_cpu_context *host_ctxt)
673 {
674 	u64 esr = read_sysreg_el2(SYS_ESR);
675 
676 	switch (ESR_ELx_EC(esr)) {
677 	case ESR_ELx_EC_HVC64:
678 		handle_host_hcall(host_ctxt);
679 		break;
680 	case ESR_ELx_EC_SMC64:
681 		handle_host_smc(host_ctxt);
682 		break;
683 	case ESR_ELx_EC_IABT_LOW:
684 	case ESR_ELx_EC_DABT_LOW:
685 		handle_host_mem_abort(host_ctxt);
686 		break;
687 	default:
688 		BUG();
689 	}
690 }
691