xref: /linux/arch/arm64/kvm/sys_regs.c (revision 3a2c4d55e32ad65efebdb6de44eef3bfa08bb49d)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2012,2013 - ARM Ltd
4  * Author: Marc Zyngier <marc.zyngier@arm.com>
5  *
6  * Derived from arch/arm/kvm/coproc.c:
7  * Copyright (C) 2012 - Virtual Open Systems and Columbia University
8  * Authors: Rusty Russell <rusty@rustcorp.com.au>
9  *          Christoffer Dall <c.dall@virtualopensystems.com>
10  */
11 
12 #include <linux/bitfield.h>
13 #include <linux/bsearch.h>
14 #include <linux/cacheinfo.h>
15 #include <linux/debugfs.h>
16 #include <linux/kvm_host.h>
17 #include <linux/mm.h>
18 #include <linux/printk.h>
19 #include <linux/uaccess.h>
20 #include <linux/irqchip/arm-gic-v3.h>
21 
22 #include <asm/arm_pmuv3.h>
23 #include <asm/cacheflush.h>
24 #include <asm/cputype.h>
25 #include <asm/debug-monitors.h>
26 #include <asm/esr.h>
27 #include <asm/kvm_arm.h>
28 #include <asm/kvm_emulate.h>
29 #include <asm/kvm_hyp.h>
30 #include <asm/kvm_mmu.h>
31 #include <asm/kvm_nested.h>
32 #include <asm/perf_event.h>
33 #include <asm/sysreg.h>
34 
35 #include <trace/events/kvm.h>
36 
37 #include "sys_regs.h"
38 #include "vgic/vgic.h"
39 
40 #include "trace.h"
41 
42 /*
43  * For AArch32, we only take care of what is being trapped. Anything
44  * that has to do with init and userspace access has to go via the
45  * 64bit interface.
46  */
47 
48 static u64 sys_reg_to_index(const struct sys_reg_desc *reg);
49 static int set_id_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
50 		      u64 val);
51 
52 static bool undef_access(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
53 			 const struct sys_reg_desc *r)
54 {
55 	kvm_inject_undefined(vcpu);
56 	return false;
57 }
58 
59 static bool bad_trap(struct kvm_vcpu *vcpu,
60 		     struct sys_reg_params *params,
61 		     const struct sys_reg_desc *r,
62 		     const char *msg)
63 {
64 	WARN_ONCE(1, "Unexpected %s\n", msg);
65 	print_sys_reg_instr(params);
66 	return undef_access(vcpu, params, r);
67 }
68 
69 static bool read_from_write_only(struct kvm_vcpu *vcpu,
70 				 struct sys_reg_params *params,
71 				 const struct sys_reg_desc *r)
72 {
73 	return bad_trap(vcpu, params, r,
74 			"sys_reg read to write-only register");
75 }
76 
77 static bool write_to_read_only(struct kvm_vcpu *vcpu,
78 			       struct sys_reg_params *params,
79 			       const struct sys_reg_desc *r)
80 {
81 	return bad_trap(vcpu, params, r,
82 			"sys_reg write to read-only register");
83 }
84 
85 enum sr_loc_attr {
86 	SR_LOC_MEMORY	= 0,	  /* Register definitely in memory */
87 	SR_LOC_LOADED	= BIT(0), /* Register on CPU, unless it cannot */
88 	SR_LOC_MAPPED	= BIT(1), /* Register in a different CPU register */
89 	SR_LOC_XLATED	= BIT(2), /* Register translated to fit another reg */
90 	SR_LOC_SPECIAL	= BIT(3), /* Demanding register, implies loaded */
91 };
92 
93 struct sr_loc {
94 	enum sr_loc_attr loc;
95 	enum vcpu_sysreg map_reg;
96 	u64		 (*xlate)(u64);
97 };
98 
99 static enum sr_loc_attr locate_direct_register(const struct kvm_vcpu *vcpu,
100 					       enum vcpu_sysreg reg)
101 {
102 	switch (reg) {
103 	case SCTLR_EL1:
104 	case CPACR_EL1:
105 	case TTBR0_EL1:
106 	case TTBR1_EL1:
107 	case TCR_EL1:
108 	case TCR2_EL1:
109 	case PIR_EL1:
110 	case PIRE0_EL1:
111 	case POR_EL1:
112 	case ESR_EL1:
113 	case AFSR0_EL1:
114 	case AFSR1_EL1:
115 	case FAR_EL1:
116 	case MAIR_EL1:
117 	case VBAR_EL1:
118 	case CONTEXTIDR_EL1:
119 	case AMAIR_EL1:
120 	case CNTKCTL_EL1:
121 	case ELR_EL1:
122 	case SPSR_EL1:
123 	case ZCR_EL1:
124 	case SCTLR2_EL1:
125 		/*
126 		 * EL1 registers which have an ELx2 mapping are loaded if
127 		 * we're not in hypervisor context.
128 		 */
129 		return is_hyp_ctxt(vcpu) ? SR_LOC_MEMORY : SR_LOC_LOADED;
130 
131 	case TPIDR_EL0:
132 	case TPIDRRO_EL0:
133 	case TPIDR_EL1:
134 	case PAR_EL1:
135 	case DACR32_EL2:
136 	case IFSR32_EL2:
137 	case DBGVCR32_EL2:
138 		/* These registers are always loaded, no matter what */
139 		return SR_LOC_LOADED;
140 
141 	default:
142 		/* Non-mapped EL2 registers are by definition in memory. */
143 		return SR_LOC_MEMORY;
144 	}
145 }
146 
147 static void locate_mapped_el2_register(const struct kvm_vcpu *vcpu,
148 				       enum vcpu_sysreg reg,
149 				       enum vcpu_sysreg map_reg,
150 				       u64 (*xlate)(u64),
151 				       struct sr_loc *loc)
152 {
153 	if (!is_hyp_ctxt(vcpu)) {
154 		loc->loc = SR_LOC_MEMORY;
155 		return;
156 	}
157 
158 	loc->loc = SR_LOC_LOADED | SR_LOC_MAPPED;
159 	loc->map_reg = map_reg;
160 
161 	WARN_ON(locate_direct_register(vcpu, map_reg) != SR_LOC_MEMORY);
162 
163 	if (xlate != NULL && !vcpu_el2_e2h_is_set(vcpu)) {
164 		loc->loc |= SR_LOC_XLATED;
165 		loc->xlate = xlate;
166 	}
167 }
168 
169 #define MAPPED_EL2_SYSREG(r, m, t)					\
170 	case r:	{							\
171 		locate_mapped_el2_register(vcpu, r, m, t, loc);		\
172 		break;							\
173 	}
174 
175 static void locate_register(const struct kvm_vcpu *vcpu, enum vcpu_sysreg reg,
176 			    struct sr_loc *loc)
177 {
178 	if (!vcpu_get_flag(vcpu, SYSREGS_ON_CPU)) {
179 		loc->loc = SR_LOC_MEMORY;
180 		return;
181 	}
182 
183 	switch (reg) {
184 		MAPPED_EL2_SYSREG(SCTLR_EL2,   SCTLR_EL1,
185 				  translate_sctlr_el2_to_sctlr_el1	     );
186 		MAPPED_EL2_SYSREG(TTBR0_EL2,   TTBR0_EL1,
187 				  translate_ttbr0_el2_to_ttbr0_el1	     );
188 		MAPPED_EL2_SYSREG(TTBR1_EL2,   TTBR1_EL1,   NULL	     );
189 		MAPPED_EL2_SYSREG(TCR_EL2,     TCR_EL1,
190 				  translate_tcr_el2_to_tcr_el1		     );
191 		MAPPED_EL2_SYSREG(VBAR_EL2,    VBAR_EL1,    NULL	     );
192 		MAPPED_EL2_SYSREG(AFSR0_EL2,   AFSR0_EL1,   NULL	     );
193 		MAPPED_EL2_SYSREG(AFSR1_EL2,   AFSR1_EL1,   NULL	     );
194 		MAPPED_EL2_SYSREG(ESR_EL2,     ESR_EL1,     NULL	     );
195 		MAPPED_EL2_SYSREG(FAR_EL2,     FAR_EL1,     NULL	     );
196 		MAPPED_EL2_SYSREG(MAIR_EL2,    MAIR_EL1,    NULL	     );
197 		MAPPED_EL2_SYSREG(TCR2_EL2,    TCR2_EL1,    NULL	     );
198 		MAPPED_EL2_SYSREG(PIR_EL2,     PIR_EL1,     NULL	     );
199 		MAPPED_EL2_SYSREG(PIRE0_EL2,   PIRE0_EL1,   NULL	     );
200 		MAPPED_EL2_SYSREG(POR_EL2,     POR_EL1,     NULL	     );
201 		MAPPED_EL2_SYSREG(AMAIR_EL2,   AMAIR_EL1,   NULL	     );
202 		MAPPED_EL2_SYSREG(ELR_EL2,     ELR_EL1,	    NULL	     );
203 		MAPPED_EL2_SYSREG(SPSR_EL2,    SPSR_EL1,    NULL	     );
204 		MAPPED_EL2_SYSREG(CONTEXTIDR_EL2, CONTEXTIDR_EL1, NULL	     );
205 		MAPPED_EL2_SYSREG(SCTLR2_EL2,  SCTLR2_EL1,  NULL	     );
206 	case CNTHCTL_EL2:
207 		/* CNTHCTL_EL2 is super special, until we support NV2.1 */
208 		loc->loc = ((is_hyp_ctxt(vcpu) && vcpu_el2_e2h_is_set(vcpu)) ?
209 			    SR_LOC_SPECIAL : SR_LOC_MEMORY);
210 		break;
211 	case CPTR_EL2:
212 		/*
213 		 * CPTR_EL2 is just as special, and needs a certain amount
214 		 * of handholding. It always lives in memory, due to being
215 		 * heavily trapped thanks to CPACR_EL1.TCPAC being RES0.
216 		 * FEAT_NV2p1 fixes this.
217 		 */
218 		locate_mapped_el2_register(vcpu, CPTR_EL2, CPACR_EL1,
219 					   translate_cptr_el2_to_cpacr_el1,
220 					   loc);
221 		if (is_hyp_ctxt(vcpu) && vcpu_el2_e2h_is_set(vcpu))
222 			loc->loc = SR_LOC_SPECIAL;
223 		break;
224 	case NVHCR_EL2:
225 		/*
226 		 * Yes, NVHCR_EL2 maps to itself when loaded in nested
227 		 * context. If you feel like the architecture is double
228 		 * backing on itself upside down, you're not alone.
229 		 */
230 		WARN_ON_ONCE(!kvm_has_nv3(vcpu->kvm));
231 		if (is_hyp_ctxt(vcpu)) {
232 			loc->loc = SR_LOC_MEMORY;
233 		} else {
234 			loc->loc = SR_LOC_LOADED | SR_LOC_MAPPED;
235 			loc->map_reg = NVHCR_EL2;
236 		}
237 		break;
238 	default:
239 		loc->loc = locate_direct_register(vcpu, reg);
240 	}
241 }
242 
243 static u64 read_sr_from_cpu(enum vcpu_sysreg reg)
244 {
245 	u64 val = 0x8badf00d8badf00d;
246 
247 	switch (reg) {
248 	case SCTLR_EL1:		val = read_sysreg_s(SYS_SCTLR_EL12);	break;
249 	case CPACR_EL1:		val = read_sysreg_s(SYS_CPACR_EL12);	break;
250 	case TTBR0_EL1:		val = read_sysreg_s(SYS_TTBR0_EL12);	break;
251 	case TTBR1_EL1:		val = read_sysreg_s(SYS_TTBR1_EL12);	break;
252 	case TCR_EL1:		val = read_sysreg_s(SYS_TCR_EL12);	break;
253 	case TCR2_EL1:		val = read_sysreg_s(SYS_TCR2_EL12);	break;
254 	case PIR_EL1:		val = read_sysreg_s(SYS_PIR_EL12);	break;
255 	case PIRE0_EL1:		val = read_sysreg_s(SYS_PIRE0_EL12);	break;
256 	case POR_EL1:		val = read_sysreg_s(SYS_POR_EL12);	break;
257 	case ESR_EL1:		val = read_sysreg_s(SYS_ESR_EL12);	break;
258 	case AFSR0_EL1:		val = read_sysreg_s(SYS_AFSR0_EL12);	break;
259 	case AFSR1_EL1:		val = read_sysreg_s(SYS_AFSR1_EL12);	break;
260 	case FAR_EL1:		val = read_sysreg_s(SYS_FAR_EL12);	break;
261 	case MAIR_EL1:		val = read_sysreg_s(SYS_MAIR_EL12);	break;
262 	case VBAR_EL1:		val = read_sysreg_s(SYS_VBAR_EL12);	break;
263 	case CONTEXTIDR_EL1:	val = read_sysreg_s(SYS_CONTEXTIDR_EL12);break;
264 	case AMAIR_EL1:		val = read_sysreg_s(SYS_AMAIR_EL12);	break;
265 	case CNTKCTL_EL1:	val = read_sysreg_s(SYS_CNTKCTL_EL12);	break;
266 	case ELR_EL1:		val = read_sysreg_s(SYS_ELR_EL12);	break;
267 	case SPSR_EL1:		val = read_sysreg_s(SYS_SPSR_EL12);	break;
268 	case ZCR_EL1:		val = read_sysreg_s(SYS_ZCR_EL12);	break;
269 	case SCTLR2_EL1:	val = read_sysreg_s(SYS_SCTLR2_EL12);	break;
270 	case TPIDR_EL0:		val = read_sysreg_s(SYS_TPIDR_EL0);	break;
271 	case TPIDRRO_EL0:	val = read_sysreg_s(SYS_TPIDRRO_EL0);	break;
272 	case TPIDR_EL1:		val = read_sysreg_s(SYS_TPIDR_EL1);	break;
273 	case PAR_EL1:		val = read_sysreg_par();		break;
274 	case DACR32_EL2:	val = read_sysreg_s(SYS_DACR32_EL2);	break;
275 	case IFSR32_EL2:	val = read_sysreg_s(SYS_IFSR32_EL2);	break;
276 	case DBGVCR32_EL2:	val = read_sysreg_s(SYS_DBGVCR32_EL2);	break;
277 	case NVHCR_EL2:		val = read_sysreg_s(SYS_NVHCR_EL2);	break;
278 	default:		WARN_ON_ONCE(1);
279 	}
280 
281 	return val;
282 }
283 
284 static void write_sr_to_cpu(enum vcpu_sysreg reg, u64 val)
285 {
286 	switch (reg) {
287 	case SCTLR_EL1:		write_sysreg_s(val, SYS_SCTLR_EL12);	break;
288 	case CPACR_EL1:		write_sysreg_s(val, SYS_CPACR_EL12);	break;
289 	case TTBR0_EL1:		write_sysreg_s(val, SYS_TTBR0_EL12);	break;
290 	case TTBR1_EL1:		write_sysreg_s(val, SYS_TTBR1_EL12);	break;
291 	case TCR_EL1:		write_sysreg_s(val, SYS_TCR_EL12);	break;
292 	case TCR2_EL1:		write_sysreg_s(val, SYS_TCR2_EL12);	break;
293 	case PIR_EL1:		write_sysreg_s(val, SYS_PIR_EL12);	break;
294 	case PIRE0_EL1:		write_sysreg_s(val, SYS_PIRE0_EL12);	break;
295 	case POR_EL1:		write_sysreg_s(val, SYS_POR_EL12);	break;
296 	case ESR_EL1:		write_sysreg_s(val, SYS_ESR_EL12);	break;
297 	case AFSR0_EL1:		write_sysreg_s(val, SYS_AFSR0_EL12);	break;
298 	case AFSR1_EL1:		write_sysreg_s(val, SYS_AFSR1_EL12);	break;
299 	case FAR_EL1:		write_sysreg_s(val, SYS_FAR_EL12);	break;
300 	case MAIR_EL1:		write_sysreg_s(val, SYS_MAIR_EL12);	break;
301 	case VBAR_EL1:		write_sysreg_s(val, SYS_VBAR_EL12);	break;
302 	case CONTEXTIDR_EL1:	write_sysreg_s(val, SYS_CONTEXTIDR_EL12);break;
303 	case AMAIR_EL1:		write_sysreg_s(val, SYS_AMAIR_EL12);	break;
304 	case CNTKCTL_EL1:	write_sysreg_s(val, SYS_CNTKCTL_EL12);	break;
305 	case ELR_EL1:		write_sysreg_s(val, SYS_ELR_EL12);	break;
306 	case SPSR_EL1:		write_sysreg_s(val, SYS_SPSR_EL12);	break;
307 	case ZCR_EL1:		write_sysreg_s(val, SYS_ZCR_EL12);	break;
308 	case SCTLR2_EL1:	write_sysreg_s(val, SYS_SCTLR2_EL12);	break;
309 	case TPIDR_EL0:		write_sysreg_s(val, SYS_TPIDR_EL0);	break;
310 	case TPIDRRO_EL0:	write_sysreg_s(val, SYS_TPIDRRO_EL0);	break;
311 	case TPIDR_EL1:		write_sysreg_s(val, SYS_TPIDR_EL1);	break;
312 	case PAR_EL1:		write_sysreg_s(val, SYS_PAR_EL1);	break;
313 	case DACR32_EL2:	write_sysreg_s(val, SYS_DACR32_EL2);	break;
314 	case IFSR32_EL2:	write_sysreg_s(val, SYS_IFSR32_EL2);	break;
315 	case DBGVCR32_EL2:	write_sysreg_s(val, SYS_DBGVCR32_EL2);	break;
316 	case NVHCR_EL2:		write_sysreg_s(val, SYS_NVHCR_EL2);	break;
317 	default:		WARN_ON_ONCE(1);
318 	}
319 }
320 
321 u64 vcpu_read_sys_reg(const struct kvm_vcpu *vcpu, enum vcpu_sysreg reg)
322 {
323 	struct sr_loc loc = {};
324 
325 	locate_register(vcpu, reg, &loc);
326 
327 	WARN_ON_ONCE(!has_vhe() && loc.loc != SR_LOC_MEMORY);
328 
329 	if (loc.loc & SR_LOC_SPECIAL) {
330 		u64 val;
331 
332 		WARN_ON_ONCE(loc.loc & ~SR_LOC_SPECIAL);
333 
334 		/*
335 		 * CNTHCTL_EL2 requires some special treatment to account
336 		 * for the bits that can be set via CNTKCTL_EL1 when E2H==1.
337 		 */
338 		switch (reg) {
339 		case CNTHCTL_EL2:
340 			val = read_sysreg_el1(SYS_CNTKCTL);
341 			if (!cpus_have_final_cap(ARM64_HAS_NV2P1)) {
342 				val &= CNTKCTL_VALID_BITS;
343 				val |= __vcpu_sys_reg(vcpu, reg) & ~CNTKCTL_VALID_BITS;
344 			}
345 			return val;
346 		case CPTR_EL2:
347 			if (cpus_have_final_cap(ARM64_HAS_NV2P1))
348 				return read_sysreg_el1(SYS_CPACR);
349 			else
350 				return __vcpu_sys_reg(vcpu, reg);
351 		default:
352 			WARN_ON_ONCE(1);
353 		}
354 	}
355 
356 	if (loc.loc & SR_LOC_LOADED) {
357 		enum vcpu_sysreg map_reg = reg;
358 
359 		if (loc.loc & SR_LOC_MAPPED)
360 			map_reg = loc.map_reg;
361 
362 		if (!(loc.loc & SR_LOC_XLATED)) {
363 			u64 val = read_sr_from_cpu(map_reg);
364 
365 			if (reg >= __SANITISED_REG_START__)
366 				val = kvm_vcpu_apply_reg_masks(vcpu, reg, val);
367 
368 			return val;
369 		}
370 	}
371 
372 	return __vcpu_sys_reg(vcpu, reg);
373 }
374 
375 void vcpu_write_sys_reg(struct kvm_vcpu *vcpu, u64 val, enum vcpu_sysreg reg)
376 {
377 	struct sr_loc loc = {};
378 
379 	locate_register(vcpu, reg, &loc);
380 
381 	WARN_ON_ONCE(!has_vhe() && loc.loc != SR_LOC_MEMORY);
382 
383 	if (loc.loc & SR_LOC_SPECIAL) {
384 
385 		WARN_ON_ONCE(loc.loc & ~SR_LOC_SPECIAL);
386 
387 		switch (reg) {
388 		case CNTHCTL_EL2:
389 			/*
390 			 * If E2H=1, some of the bits are backed by
391 			 * CNTKCTL_EL1, while the rest is kept in memory.
392 			 * Yes, this is fun stuff.
393 			 */
394 			write_sysreg_el1(val, SYS_CNTKCTL);
395 			break;
396 		case CPTR_EL2:
397 			write_sysreg_el1(val, SYS_CPACR);
398 			break;
399 		default:
400 			WARN_ON_ONCE(1);
401 		}
402 	}
403 
404 	if (loc.loc & SR_LOC_LOADED) {
405 		enum vcpu_sysreg map_reg = reg;
406 		u64 xlated_val;
407 
408 		if (reg >= __SANITISED_REG_START__)
409 			val = kvm_vcpu_apply_reg_masks(vcpu, reg, val);
410 
411 		if (loc.loc & SR_LOC_MAPPED)
412 			map_reg = loc.map_reg;
413 
414 		if (loc.loc & SR_LOC_XLATED)
415 			xlated_val = loc.xlate(val);
416 		else
417 			xlated_val = val;
418 
419 		write_sr_to_cpu(map_reg, xlated_val);
420 
421 		/*
422 		 * Fall through to write the backing store anyway, which
423 		 * allows translated registers to be directly read without a
424 		 * reverse translation.
425 		 */
426 	}
427 
428 	__vcpu_assign_sys_reg(vcpu, reg, val);
429 }
430 
431 /* CSSELR values; used to index KVM_REG_ARM_DEMUX_ID_CCSIDR */
432 #define CSSELR_MAX 14
433 
434 /*
435  * Returns the minimum line size for the selected cache, expressed as
436  * Log2(bytes).
437  */
438 static u8 get_min_cache_line_size(bool icache)
439 {
440 	u64 ctr = read_sanitised_ftr_reg(SYS_CTR_EL0);
441 	u8 field;
442 
443 	if (icache)
444 		field = SYS_FIELD_GET(CTR_EL0, IminLine, ctr);
445 	else
446 		field = SYS_FIELD_GET(CTR_EL0, DminLine, ctr);
447 
448 	/*
449 	 * Cache line size is represented as Log2(words) in CTR_EL0.
450 	 * Log2(bytes) can be derived with the following:
451 	 *
452 	 * Log2(words) + 2 = Log2(bytes / 4) + 2
453 	 * 		   = Log2(bytes) - 2 + 2
454 	 * 		   = Log2(bytes)
455 	 */
456 	return field + 2;
457 }
458 
459 /* Which cache CCSIDR represents depends on CSSELR value. */
460 static u32 get_ccsidr(struct kvm_vcpu *vcpu, u32 csselr)
461 {
462 	u8 line_size;
463 
464 	if (vcpu->arch.ccsidr)
465 		return vcpu->arch.ccsidr[csselr];
466 
467 	line_size = get_min_cache_line_size(csselr & CSSELR_EL1_InD);
468 
469 	/*
470 	 * Fabricate a CCSIDR value as the overriding value does not exist.
471 	 * The real CCSIDR value will not be used as it can vary by the
472 	 * physical CPU which the vcpu currently resides in.
473 	 *
474 	 * The line size is determined with get_min_cache_line_size(), which
475 	 * should be valid for all CPUs even if they have different cache
476 	 * configuration.
477 	 *
478 	 * The associativity bits are cleared, meaning the geometry of all data
479 	 * and unified caches (which are guaranteed to be PIPT and thus
480 	 * non-aliasing) are 1 set and 1 way.
481 	 * Guests should not be doing cache operations by set/way at all, and
482 	 * for this reason, we trap them and attempt to infer the intent, so
483 	 * that we can flush the entire guest's address space at the appropriate
484 	 * time. The exposed geometry minimizes the number of the traps.
485 	 * [If guests should attempt to infer aliasing properties from the
486 	 * geometry (which is not permitted by the architecture), they would
487 	 * only do so for virtually indexed caches.]
488 	 *
489 	 * We don't check if the cache level exists as it is allowed to return
490 	 * an UNKNOWN value if not.
491 	 */
492 	return SYS_FIELD_PREP(CCSIDR_EL1, LineSize, line_size - 4);
493 }
494 
495 static int set_ccsidr(struct kvm_vcpu *vcpu, u32 csselr, u32 val)
496 {
497 	u8 line_size = FIELD_GET(CCSIDR_EL1_LineSize, val) + 4;
498 	u32 *ccsidr = vcpu->arch.ccsidr;
499 	u32 i;
500 
501 	if ((val & CCSIDR_EL1_RES0) ||
502 	    line_size < get_min_cache_line_size(csselr & CSSELR_EL1_InD))
503 		return -EINVAL;
504 
505 	if (!ccsidr) {
506 		if (val == get_ccsidr(vcpu, csselr))
507 			return 0;
508 
509 		ccsidr = kmalloc_array(CSSELR_MAX, sizeof(u32), GFP_KERNEL_ACCOUNT);
510 		if (!ccsidr)
511 			return -ENOMEM;
512 
513 		for (i = 0; i < CSSELR_MAX; i++)
514 			ccsidr[i] = get_ccsidr(vcpu, i);
515 
516 		vcpu->arch.ccsidr = ccsidr;
517 	}
518 
519 	ccsidr[csselr] = val;
520 
521 	return 0;
522 }
523 
524 static bool access_rw(struct kvm_vcpu *vcpu,
525 		      struct sys_reg_params *p,
526 		      const struct sys_reg_desc *r)
527 {
528 	if (p->is_write)
529 		vcpu_write_sys_reg(vcpu, p->regval, r->reg);
530 	else
531 		p->regval = vcpu_read_sys_reg(vcpu, r->reg);
532 
533 	return true;
534 }
535 
536 /*
537  * See note at ARMv7 ARM B1.14.4 (TL;DR: S/W ops are not easily virtualized).
538  */
539 static bool access_dcsw(struct kvm_vcpu *vcpu,
540 			struct sys_reg_params *p,
541 			const struct sys_reg_desc *r)
542 {
543 	if (!p->is_write)
544 		return read_from_write_only(vcpu, p, r);
545 
546 	/*
547 	 * Only track S/W ops if we don't have FWB. It still indicates
548 	 * that the guest is a bit broken (S/W operations should only
549 	 * be done by firmware, knowing that there is only a single
550 	 * CPU left in the system, and certainly not from non-secure
551 	 * software).
552 	 */
553 	if (!cpus_have_final_cap(ARM64_HAS_STAGE2_FWB))
554 		kvm_set_way_flush(vcpu);
555 
556 	return true;
557 }
558 
559 static bool access_dcgsw(struct kvm_vcpu *vcpu,
560 			 struct sys_reg_params *p,
561 			 const struct sys_reg_desc *r)
562 {
563 	if (!kvm_has_mte(vcpu->kvm))
564 		return undef_access(vcpu, p, r);
565 
566 	/* Treat MTE S/W ops as we treat the classic ones: with contempt */
567 	return access_dcsw(vcpu, p, r);
568 }
569 
570 static void get_access_mask(const struct sys_reg_desc *r, u64 *mask, u64 *shift)
571 {
572 	switch (r->aarch32_map) {
573 	case AA32_LO:
574 		*mask = GENMASK_ULL(31, 0);
575 		*shift = 0;
576 		break;
577 	case AA32_HI:
578 		*mask = GENMASK_ULL(63, 32);
579 		*shift = 32;
580 		break;
581 	default:
582 		*mask = GENMASK_ULL(63, 0);
583 		*shift = 0;
584 		break;
585 	}
586 }
587 
588 /*
589  * Generic accessor for VM registers. Only called as long as HCR_TVM
590  * is set. If the guest enables the MMU, we stop trapping the VM
591  * sys_regs and leave it in complete control of the caches.
592  */
593 static bool access_vm_reg(struct kvm_vcpu *vcpu,
594 			  struct sys_reg_params *p,
595 			  const struct sys_reg_desc *r)
596 {
597 	bool was_enabled = vcpu_has_cache_enabled(vcpu);
598 	u64 val, mask, shift;
599 
600 	BUG_ON(!p->is_write);
601 
602 	get_access_mask(r, &mask, &shift);
603 
604 	if (~mask) {
605 		val = vcpu_read_sys_reg(vcpu, r->reg);
606 		val &= ~mask;
607 	} else {
608 		val = 0;
609 	}
610 
611 	val |= (p->regval & (mask >> shift)) << shift;
612 	vcpu_write_sys_reg(vcpu, val, r->reg);
613 
614 	kvm_toggle_cache(vcpu, was_enabled);
615 	return true;
616 }
617 
618 static bool access_actlr(struct kvm_vcpu *vcpu,
619 			 struct sys_reg_params *p,
620 			 const struct sys_reg_desc *r)
621 {
622 	u64 mask, shift;
623 
624 	if (p->is_write)
625 		return ignore_write(vcpu, p);
626 
627 	get_access_mask(r, &mask, &shift);
628 	p->regval = (vcpu_read_sys_reg(vcpu, r->reg) & mask) >> shift;
629 
630 	return true;
631 }
632 
633 /*
634  * Trap handler for the GICv3 SGI generation system register.
635  * Forward the request to the VGIC emulation.
636  * The cp15_64 code makes sure this automatically works
637  * for both AArch64 and AArch32 accesses.
638  */
639 static bool access_gic_sgi(struct kvm_vcpu *vcpu,
640 			   struct sys_reg_params *p,
641 			   const struct sys_reg_desc *r)
642 {
643 	bool g1;
644 
645 	if (!kvm_has_gicv3(vcpu->kvm))
646 		return undef_access(vcpu, p, r);
647 
648 	if (!p->is_write)
649 		return read_from_write_only(vcpu, p, r);
650 
651 	/*
652 	 * In a system where GICD_CTLR.DS=1, a ICC_SGI0R_EL1 access generates
653 	 * Group0 SGIs only, while ICC_SGI1R_EL1 can generate either group,
654 	 * depending on the SGI configuration. ICC_ASGI1R_EL1 is effectively
655 	 * equivalent to ICC_SGI0R_EL1, as there is no "alternative" secure
656 	 * group.
657 	 */
658 	if (p->Op0 == 0) {		/* AArch32 */
659 		switch (p->Op1) {
660 		default:		/* Keep GCC quiet */
661 		case 0:			/* ICC_SGI1R */
662 			g1 = true;
663 			break;
664 		case 1:			/* ICC_ASGI1R */
665 		case 2:			/* ICC_SGI0R */
666 			g1 = false;
667 			break;
668 		}
669 	} else {			/* AArch64 */
670 		switch (p->Op2) {
671 		default:		/* Keep GCC quiet */
672 		case 5:			/* ICC_SGI1R_EL1 */
673 			g1 = true;
674 			break;
675 		case 6:			/* ICC_ASGI1R_EL1 */
676 		case 7:			/* ICC_SGI0R_EL1 */
677 			g1 = false;
678 			break;
679 		}
680 	}
681 
682 	vgic_v3_dispatch_sgi(vcpu, p->regval, g1);
683 
684 	return true;
685 }
686 
687 static bool access_gic_sre(struct kvm_vcpu *vcpu,
688 			   struct sys_reg_params *p,
689 			   const struct sys_reg_desc *r)
690 {
691 	if (!kvm_has_gicv3(vcpu->kvm))
692 		return undef_access(vcpu, p, r);
693 
694 	if (p->is_write)
695 		return ignore_write(vcpu, p);
696 
697 	if (p->Op1 == 4) {	/* ICC_SRE_EL2 */
698 		p->regval = KVM_ICC_SRE_EL2;
699 	} else {		/* ICC_SRE_EL1 */
700 		p->regval = vcpu->arch.vgic_cpu.vgic_v3.vgic_sre;
701 	}
702 
703 	return true;
704 }
705 
706 static bool access_gic_dir(struct kvm_vcpu *vcpu,
707 			   struct sys_reg_params *p,
708 			   const struct sys_reg_desc *r)
709 {
710 	if (!kvm_has_gicv3(vcpu->kvm))
711 		return undef_access(vcpu, p, r);
712 
713 	if (!p->is_write)
714 		return undef_access(vcpu, p, r);
715 
716 	vgic_v3_deactivate(vcpu, p->regval);
717 
718 	return true;
719 }
720 
721 static bool access_gicv5_idr0(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
722 			      const struct sys_reg_desc *r)
723 {
724 	if (p->is_write)
725 		return undef_access(vcpu, p, r);
726 
727 	/*
728 	 * Expose KVM's priority- and ID-bits to the guest, but not GCIE_LEGACY.
729 	 *
730 	 * Note: for GICv5 the mimic the way that the num_pri_bits and
731 	 * num_id_bits fields are used with GICv3:
732 	 * - num_pri_bits stores the actual number of priority bits, whereas the
733 	 *   register field stores num_pri_bits - 1.
734 	 * - num_id_bits stores the raw field value, which is 0b0000 for 16 bits
735 	 *   and 0b0001 for 24 bits.
736 	 */
737 	p->regval = FIELD_PREP(ICC_IDR0_EL1_PRI_BITS, vcpu->arch.vgic_cpu.num_pri_bits - 1) |
738 		    FIELD_PREP(ICC_IDR0_EL1_ID_BITS, vcpu->arch.vgic_cpu.num_id_bits);
739 
740 	return true;
741 }
742 
743 static bool access_gicv5_iaffid(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
744 				const struct sys_reg_desc *r)
745 {
746 	if (p->is_write)
747 		return undef_access(vcpu, p, r);
748 
749 	/*
750 	 * For GICv5 VMs, the IAFFID value is the same as the VPE ID. The VPE ID
751 	 * is the same as the VCPU's ID.
752 	 */
753 	p->regval = FIELD_PREP(ICC_IAFFIDR_EL1_IAFFID, vcpu->vcpu_id);
754 
755 	return true;
756 }
757 
758 static bool access_gicv5_ppi_enabler(struct kvm_vcpu *vcpu,
759 				     struct sys_reg_params *p,
760 				     const struct sys_reg_desc *r)
761 {
762 	unsigned long *mask = vcpu->kvm->arch.vgic.gicv5_vm.vgic_ppi_mask;
763 	struct vgic_v5_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v5;
764 	unsigned long reg = p->regval;
765 	int i;
766 
767 	/* We never expect to get here with a read! */
768 	if (WARN_ON_ONCE(!p->is_write))
769 		return undef_access(vcpu, p, r);
770 
771 	/*
772 	 * As we're only handling architected PPIs, the guest writes to the
773 	 * enable for the non-architected PPIs just return as there's
774 	 * nothing to do at all. We don't even allocate the storage for them.
775 	 */
776 	if (p->Op2 % 2)
777 		return true;
778 
779 	/*
780 	 * Merge the raw guest write into out bitmap, anded with our PPI mask.
781 	 */
782 	bitmap_and(cpu_if->vgic_ppi_enabler, &reg, mask, VGIC_V5_NR_PRIVATE_IRQS);
783 
784 	/*
785 	 * Sync the change in enable states to the vgic_irqs. We consider all
786 	 * PPIs as we don't expose many to the guest.
787 	 */
788 	for_each_visible_v5_ppi(i, vcpu->kvm) {
789 		u32 intid = vgic_v5_make_ppi(i);
790 		struct vgic_irq *irq;
791 
792 		irq = vgic_get_vcpu_irq(vcpu, intid);
793 
794 		scoped_guard(raw_spinlock_irqsave, &irq->irq_lock)
795 			irq->enabled = test_bit(i, cpu_if->vgic_ppi_enabler);
796 
797 		vgic_put_irq(vcpu->kvm, irq);
798 	}
799 
800 	return true;
801 }
802 
803 static bool trap_raz_wi(struct kvm_vcpu *vcpu,
804 			struct sys_reg_params *p,
805 			const struct sys_reg_desc *r)
806 {
807 	if (p->is_write)
808 		return ignore_write(vcpu, p);
809 	else
810 		return read_zero(vcpu, p);
811 }
812 
813 /*
814  * ARMv8.1 mandates at least a trivial LORegion implementation, where all the
815  * RW registers are RES0 (which we can implement as RAZ/WI). On an ARMv8.0
816  * system, these registers should UNDEF. LORID_EL1 being a RO register, we
817  * treat it separately.
818  */
819 static bool trap_loregion(struct kvm_vcpu *vcpu,
820 			  struct sys_reg_params *p,
821 			  const struct sys_reg_desc *r)
822 {
823 	u32 sr = reg_to_encoding(r);
824 
825 	if (!kvm_has_feat(vcpu->kvm, ID_AA64MMFR1_EL1, LO, IMP))
826 		return undef_access(vcpu, p, r);
827 
828 	if (p->is_write && sr == SYS_LORID_EL1)
829 		return write_to_read_only(vcpu, p, r);
830 
831 	return trap_raz_wi(vcpu, p, r);
832 }
833 
834 static bool trap_oslar_el1(struct kvm_vcpu *vcpu,
835 			   struct sys_reg_params *p,
836 			   const struct sys_reg_desc *r)
837 {
838 	if (!p->is_write)
839 		return read_from_write_only(vcpu, p, r);
840 
841 	kvm_debug_handle_oslar(vcpu, p->regval);
842 	return true;
843 }
844 
845 static bool trap_oslsr_el1(struct kvm_vcpu *vcpu,
846 			   struct sys_reg_params *p,
847 			   const struct sys_reg_desc *r)
848 {
849 	if (p->is_write)
850 		return write_to_read_only(vcpu, p, r);
851 
852 	p->regval = __vcpu_sys_reg(vcpu, r->reg);
853 	return true;
854 }
855 
856 static int set_oslsr_el1(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
857 			 u64 val)
858 {
859 	/*
860 	 * The only modifiable bit is the OSLK bit. Refuse the write if
861 	 * userspace attempts to change any other bit in the register.
862 	 */
863 	if ((val ^ rd->val) & ~OSLSR_EL1_OSLK)
864 		return -EINVAL;
865 
866 	__vcpu_assign_sys_reg(vcpu, rd->reg, val);
867 	return 0;
868 }
869 
870 static bool trap_dbgauthstatus_el1(struct kvm_vcpu *vcpu,
871 				   struct sys_reg_params *p,
872 				   const struct sys_reg_desc *r)
873 {
874 	if (p->is_write) {
875 		return ignore_write(vcpu, p);
876 	} else {
877 		p->regval = read_sysreg(dbgauthstatus_el1);
878 		return true;
879 	}
880 }
881 
882 static bool trap_debug_regs(struct kvm_vcpu *vcpu,
883 			    struct sys_reg_params *p,
884 			    const struct sys_reg_desc *r)
885 {
886 	access_rw(vcpu, p, r);
887 
888 	kvm_debug_set_guest_ownership(vcpu);
889 	return true;
890 }
891 
892 /*
893  * reg_to_dbg/dbg_to_reg
894  *
895  * A 32 bit write to a debug register leave top bits alone
896  * A 32 bit read from a debug register only returns the bottom bits
897  */
898 static void reg_to_dbg(struct kvm_vcpu *vcpu,
899 		       struct sys_reg_params *p,
900 		       const struct sys_reg_desc *rd,
901 		       u64 *dbg_reg)
902 {
903 	u64 mask, shift, val;
904 
905 	get_access_mask(rd, &mask, &shift);
906 
907 	val = *dbg_reg;
908 	val &= ~mask;
909 	val |= (p->regval & (mask >> shift)) << shift;
910 	*dbg_reg = val;
911 }
912 
913 static void dbg_to_reg(struct kvm_vcpu *vcpu,
914 		       struct sys_reg_params *p,
915 		       const struct sys_reg_desc *rd,
916 		       u64 *dbg_reg)
917 {
918 	u64 mask, shift;
919 
920 	get_access_mask(rd, &mask, &shift);
921 	p->regval = (*dbg_reg & mask) >> shift;
922 }
923 
924 static u64 *demux_wb_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd)
925 {
926 	struct kvm_guest_debug_arch *dbg = &vcpu->arch.vcpu_debug_state;
927 
928 	switch (rd->Op2) {
929 	case 0b100:
930 		return &dbg->dbg_bvr[rd->CRm];
931 	case 0b101:
932 		return &dbg->dbg_bcr[rd->CRm];
933 	case 0b110:
934 		return &dbg->dbg_wvr[rd->CRm];
935 	case 0b111:
936 		return &dbg->dbg_wcr[rd->CRm];
937 	default:
938 		KVM_BUG_ON(1, vcpu->kvm);
939 		return NULL;
940 	}
941 }
942 
943 static bool trap_dbg_wb_reg(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
944 			    const struct sys_reg_desc *rd)
945 {
946 	u64 *reg = demux_wb_reg(vcpu, rd);
947 
948 	if (!reg)
949 		return false;
950 
951 	if (p->is_write)
952 		reg_to_dbg(vcpu, p, rd, reg);
953 	else
954 		dbg_to_reg(vcpu, p, rd, reg);
955 
956 	kvm_debug_set_guest_ownership(vcpu);
957 	return true;
958 }
959 
960 static int set_dbg_wb_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
961 			  u64 val)
962 {
963 	u64 *reg = demux_wb_reg(vcpu, rd);
964 
965 	if (!reg)
966 		return -EINVAL;
967 
968 	*reg = val;
969 	return 0;
970 }
971 
972 static int get_dbg_wb_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
973 			  u64 *val)
974 {
975 	u64 *reg = demux_wb_reg(vcpu, rd);
976 
977 	if (!reg)
978 		return -EINVAL;
979 
980 	*val = *reg;
981 	return 0;
982 }
983 
984 static u64 reset_dbg_wb_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd)
985 {
986 	u64 *reg = demux_wb_reg(vcpu, rd);
987 
988 	/*
989 	 * Bail early if we couldn't find storage for the register, the
990 	 * KVM_BUG_ON() in demux_wb_reg() will prevent this VM from ever
991 	 * being run.
992 	 */
993 	if (!reg)
994 		return 0;
995 
996 	*reg = rd->val;
997 	return rd->val;
998 }
999 
1000 static u64 reset_amair_el1(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
1001 {
1002 	u64 amair = read_sysreg(amair_el1);
1003 	vcpu_write_sys_reg(vcpu, amair, AMAIR_EL1);
1004 	return amair;
1005 }
1006 
1007 static u64 reset_actlr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
1008 {
1009 	u64 actlr = read_sysreg(actlr_el1);
1010 	vcpu_write_sys_reg(vcpu, actlr, ACTLR_EL1);
1011 	return actlr;
1012 }
1013 
1014 static u64 reset_mpidr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
1015 {
1016 	u64 mpidr = kvm_calculate_mpidr(vcpu);
1017 
1018 	vcpu_write_sys_reg(vcpu, mpidr, MPIDR_EL1);
1019 	return mpidr;
1020 }
1021 
1022 static unsigned int hidden_visibility(const struct kvm_vcpu *vcpu,
1023 				      const struct sys_reg_desc *r)
1024 {
1025 	return REG_HIDDEN;
1026 }
1027 
1028 static unsigned int pmu_visibility(const struct kvm_vcpu *vcpu,
1029 				   const struct sys_reg_desc *r)
1030 {
1031 	if (kvm_vcpu_has_pmu(vcpu))
1032 		return 0;
1033 
1034 	return REG_HIDDEN;
1035 }
1036 
1037 static u64 reset_pmu_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
1038 {
1039 	u64 mask = BIT(ARMV8_PMU_CYCLE_IDX);
1040 	u8 n = vcpu->kvm->arch.nr_pmu_counters;
1041 
1042 	if (n)
1043 		mask |= GENMASK(n - 1, 0);
1044 
1045 	reset_unknown(vcpu, r);
1046 	__vcpu_rmw_sys_reg(vcpu, r->reg, &=, mask);
1047 
1048 	return __vcpu_sys_reg(vcpu, r->reg);
1049 }
1050 
1051 static u64 reset_pmevcntr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
1052 {
1053 	reset_unknown(vcpu, r);
1054 	__vcpu_rmw_sys_reg(vcpu, r->reg, &=, GENMASK(31, 0));
1055 
1056 	return __vcpu_sys_reg(vcpu, r->reg);
1057 }
1058 
1059 static u64 reset_pmevtyper(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
1060 {
1061 	/* This thing will UNDEF, who cares about the reset value? */
1062 	if (!kvm_vcpu_has_pmu(vcpu))
1063 		return 0;
1064 
1065 	reset_unknown(vcpu, r);
1066 	__vcpu_rmw_sys_reg(vcpu, r->reg, &=, kvm_pmu_evtyper_mask(vcpu->kvm));
1067 
1068 	return __vcpu_sys_reg(vcpu, r->reg);
1069 }
1070 
1071 static u64 reset_pmselr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
1072 {
1073 	reset_unknown(vcpu, r);
1074 	__vcpu_rmw_sys_reg(vcpu, r->reg, &=, PMSELR_EL0_SEL_MASK);
1075 
1076 	return __vcpu_sys_reg(vcpu, r->reg);
1077 }
1078 
1079 static u64 reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
1080 {
1081 	u64 pmcr = 0;
1082 
1083 	if (!kvm_supports_32bit_el0())
1084 		pmcr |= ARMV8_PMU_PMCR_LC;
1085 
1086 	/*
1087 	 * The value of PMCR.N field is included when the
1088 	 * vCPU register is read via kvm_vcpu_read_pmcr().
1089 	 */
1090 	__vcpu_assign_sys_reg(vcpu, r->reg, pmcr);
1091 
1092 	return __vcpu_sys_reg(vcpu, r->reg);
1093 }
1094 
1095 static bool check_pmu_access_disabled(struct kvm_vcpu *vcpu, u64 flags)
1096 {
1097 	u64 reg = __vcpu_sys_reg(vcpu, PMUSERENR_EL0);
1098 	bool enabled = (reg & flags) || vcpu_mode_priv(vcpu);
1099 
1100 	if (!enabled)
1101 		kvm_inject_undefined(vcpu);
1102 
1103 	return !enabled;
1104 }
1105 
1106 static bool pmu_access_el0_disabled(struct kvm_vcpu *vcpu)
1107 {
1108 	return check_pmu_access_disabled(vcpu, ARMV8_PMU_USERENR_EN);
1109 }
1110 
1111 static bool pmu_write_swinc_el0_disabled(struct kvm_vcpu *vcpu)
1112 {
1113 	return check_pmu_access_disabled(vcpu, ARMV8_PMU_USERENR_SW | ARMV8_PMU_USERENR_EN);
1114 }
1115 
1116 static bool pmu_access_cycle_counter_el0_disabled(struct kvm_vcpu *vcpu)
1117 {
1118 	return check_pmu_access_disabled(vcpu, ARMV8_PMU_USERENR_CR | ARMV8_PMU_USERENR_EN);
1119 }
1120 
1121 static bool pmu_access_event_counter_el0_disabled(struct kvm_vcpu *vcpu)
1122 {
1123 	return check_pmu_access_disabled(vcpu, ARMV8_PMU_USERENR_ER | ARMV8_PMU_USERENR_EN);
1124 }
1125 
1126 static bool access_pmcr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
1127 			const struct sys_reg_desc *r)
1128 {
1129 	u64 val;
1130 
1131 	if (pmu_access_el0_disabled(vcpu))
1132 		return false;
1133 
1134 	if (p->is_write) {
1135 		/*
1136 		 * Only update writeable bits of PMCR (continuing into
1137 		 * kvm_pmu_handle_pmcr() as well)
1138 		 */
1139 		val = kvm_vcpu_read_pmcr(vcpu);
1140 		val &= ~ARMV8_PMU_PMCR_MASK;
1141 		val |= p->regval & ARMV8_PMU_PMCR_MASK;
1142 		if (!kvm_supports_32bit_el0())
1143 			val |= ARMV8_PMU_PMCR_LC;
1144 		kvm_pmu_handle_pmcr(vcpu, val);
1145 	} else {
1146 		/* PMCR.P & PMCR.C are RAZ */
1147 		val = kvm_vcpu_read_pmcr(vcpu)
1148 		      & ~(ARMV8_PMU_PMCR_P | ARMV8_PMU_PMCR_C);
1149 		p->regval = val;
1150 	}
1151 
1152 	return true;
1153 }
1154 
1155 static bool access_pmselr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
1156 			  const struct sys_reg_desc *r)
1157 {
1158 	if (pmu_access_event_counter_el0_disabled(vcpu))
1159 		return false;
1160 
1161 	if (p->is_write)
1162 		__vcpu_assign_sys_reg(vcpu, PMSELR_EL0, p->regval);
1163 	else
1164 		/* return PMSELR.SEL field */
1165 		p->regval = __vcpu_sys_reg(vcpu, PMSELR_EL0)
1166 			    & PMSELR_EL0_SEL_MASK;
1167 
1168 	return true;
1169 }
1170 
1171 static bool access_pmceid(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
1172 			  const struct sys_reg_desc *r)
1173 {
1174 	u64 pmceid, mask, shift;
1175 
1176 	BUG_ON(p->is_write);
1177 
1178 	if (pmu_access_el0_disabled(vcpu))
1179 		return false;
1180 
1181 	get_access_mask(r, &mask, &shift);
1182 
1183 	pmceid = kvm_pmu_get_pmceid(vcpu, (p->Op2 & 1));
1184 	pmceid &= mask;
1185 	pmceid >>= shift;
1186 
1187 	p->regval = pmceid;
1188 
1189 	return true;
1190 }
1191 
1192 static bool pmu_counter_idx_valid(struct kvm_vcpu *vcpu, u64 idx)
1193 {
1194 	u64 pmcr, val;
1195 
1196 	pmcr = kvm_vcpu_read_pmcr(vcpu);
1197 	val = FIELD_GET(ARMV8_PMU_PMCR_N, pmcr);
1198 	if (idx >= val && idx != ARMV8_PMU_CYCLE_IDX) {
1199 		kvm_inject_undefined(vcpu);
1200 		return false;
1201 	}
1202 
1203 	return true;
1204 }
1205 
1206 static int get_pmu_evcntr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r,
1207 			  u64 *val)
1208 {
1209 	u64 idx;
1210 
1211 	if (r->CRn == 9 && r->CRm == 13 && r->Op2 == 0)
1212 		/* PMCCNTR_EL0 */
1213 		idx = ARMV8_PMU_CYCLE_IDX;
1214 	else
1215 		/* PMEVCNTRn_EL0 */
1216 		idx = ((r->CRm & 3) << 3) | (r->Op2 & 7);
1217 
1218 	*val = kvm_pmu_get_counter_value(vcpu, idx);
1219 	return 0;
1220 }
1221 
1222 static int set_pmu_evcntr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r,
1223 			  u64 val)
1224 {
1225 	u64 idx;
1226 
1227 	if (r->CRn == 9 && r->CRm == 13 && r->Op2 == 0)
1228 		/* PMCCNTR_EL0 */
1229 		idx = ARMV8_PMU_CYCLE_IDX;
1230 	else
1231 		/* PMEVCNTRn_EL0 */
1232 		idx = ((r->CRm & 3) << 3) | (r->Op2 & 7);
1233 
1234 	kvm_pmu_set_counter_value_user(vcpu, idx, val);
1235 	return 0;
1236 }
1237 
1238 static bool access_pmu_evcntr(struct kvm_vcpu *vcpu,
1239 			      struct sys_reg_params *p,
1240 			      const struct sys_reg_desc *r)
1241 {
1242 	u64 idx = ~0UL;
1243 
1244 	if (r->CRn == 9 && r->CRm == 13) {
1245 		if (r->Op2 == 2) {
1246 			/* PMXEVCNTR_EL0 */
1247 			if (pmu_access_event_counter_el0_disabled(vcpu))
1248 				return false;
1249 
1250 			idx = SYS_FIELD_GET(PMSELR_EL0, SEL,
1251 					    __vcpu_sys_reg(vcpu, PMSELR_EL0));
1252 		} else if (r->Op2 == 0) {
1253 			/* PMCCNTR_EL0 */
1254 			if (pmu_access_cycle_counter_el0_disabled(vcpu))
1255 				return false;
1256 
1257 			idx = ARMV8_PMU_CYCLE_IDX;
1258 		}
1259 	} else if (r->CRn == 0 && r->CRm == 9) {
1260 		/* PMCCNTR */
1261 		if (pmu_access_event_counter_el0_disabled(vcpu))
1262 			return false;
1263 
1264 		idx = ARMV8_PMU_CYCLE_IDX;
1265 	} else if (r->CRn == 14 && (r->CRm & 12) == 8) {
1266 		/* PMEVCNTRn_EL0 */
1267 		if (pmu_access_event_counter_el0_disabled(vcpu))
1268 			return false;
1269 
1270 		idx = ((r->CRm & 3) << 3) | (r->Op2 & 7);
1271 	}
1272 
1273 	/* Catch any decoding mistake */
1274 	WARN_ON(idx == ~0UL);
1275 
1276 	if (!pmu_counter_idx_valid(vcpu, idx))
1277 		return false;
1278 
1279 	if (p->is_write) {
1280 		if (pmu_access_el0_disabled(vcpu))
1281 			return false;
1282 
1283 		kvm_pmu_set_counter_value(vcpu, idx, p->regval);
1284 	} else {
1285 		p->regval = kvm_pmu_get_counter_value(vcpu, idx);
1286 	}
1287 
1288 	return true;
1289 }
1290 
1291 static bool access_pmu_evtyper(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
1292 			       const struct sys_reg_desc *r)
1293 {
1294 	u64 idx, reg;
1295 
1296 	if (pmu_access_el0_disabled(vcpu))
1297 		return false;
1298 
1299 	if (r->CRn == 9 && r->CRm == 13 && r->Op2 == 1) {
1300 		/* PMXEVTYPER_EL0 */
1301 		idx = SYS_FIELD_GET(PMSELR_EL0, SEL, __vcpu_sys_reg(vcpu, PMSELR_EL0));
1302 		reg = PMEVTYPER0_EL0 + idx;
1303 	} else if (r->CRn == 14 && (r->CRm & 12) == 12) {
1304 		idx = ((r->CRm & 3) << 3) | (r->Op2 & 7);
1305 		if (idx == ARMV8_PMU_CYCLE_IDX)
1306 			reg = PMCCFILTR_EL0;
1307 		else
1308 			/* PMEVTYPERn_EL0 */
1309 			reg = PMEVTYPER0_EL0 + idx;
1310 	} else {
1311 		BUG();
1312 	}
1313 
1314 	if (!pmu_counter_idx_valid(vcpu, idx))
1315 		return false;
1316 
1317 	if (p->is_write) {
1318 		kvm_pmu_set_counter_event_type(vcpu, p->regval, idx);
1319 		kvm_vcpu_pmu_restore_guest(vcpu);
1320 	} else {
1321 		p->regval = __vcpu_sys_reg(vcpu, reg);
1322 	}
1323 
1324 	return true;
1325 }
1326 
1327 static int set_pmreg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r, u64 val)
1328 {
1329 	u64 mask = kvm_pmu_accessible_counter_mask(vcpu);
1330 
1331 	__vcpu_assign_sys_reg(vcpu, r->reg, val & mask);
1332 	kvm_make_request(KVM_REQ_RELOAD_PMU, vcpu);
1333 
1334 	return 0;
1335 }
1336 
1337 static int get_pmreg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r, u64 *val)
1338 {
1339 	u64 mask = kvm_pmu_accessible_counter_mask(vcpu);
1340 
1341 	*val = __vcpu_sys_reg(vcpu, r->reg) & mask;
1342 	return 0;
1343 }
1344 
1345 static bool access_pmcnten(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
1346 			   const struct sys_reg_desc *r)
1347 {
1348 	u64 val, mask;
1349 
1350 	if (pmu_access_el0_disabled(vcpu))
1351 		return false;
1352 
1353 	mask = kvm_pmu_accessible_counter_mask(vcpu);
1354 	if (p->is_write) {
1355 		val = p->regval & mask;
1356 		if (r->Op2 & 0x1)
1357 			/* accessing PMCNTENSET_EL0 */
1358 			__vcpu_rmw_sys_reg(vcpu, PMCNTENSET_EL0, |=, val);
1359 		else
1360 			/* accessing PMCNTENCLR_EL0 */
1361 			__vcpu_rmw_sys_reg(vcpu, PMCNTENSET_EL0, &=, ~val);
1362 
1363 		kvm_pmu_reprogram_counter_mask(vcpu, val);
1364 	} else {
1365 		p->regval = __vcpu_sys_reg(vcpu, PMCNTENSET_EL0);
1366 	}
1367 
1368 	return true;
1369 }
1370 
1371 static bool access_pminten(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
1372 			   const struct sys_reg_desc *r)
1373 {
1374 	u64 mask = kvm_pmu_accessible_counter_mask(vcpu);
1375 
1376 	if (check_pmu_access_disabled(vcpu, 0))
1377 		return false;
1378 
1379 	if (p->is_write) {
1380 		u64 val = p->regval & mask;
1381 
1382 		if (r->Op2 & 0x1)
1383 			/* accessing PMINTENSET_EL1 */
1384 			__vcpu_rmw_sys_reg(vcpu, PMINTENSET_EL1, |=, val);
1385 		else
1386 			/* accessing PMINTENCLR_EL1 */
1387 			__vcpu_rmw_sys_reg(vcpu, PMINTENSET_EL1, &=, ~val);
1388 	} else {
1389 		p->regval = __vcpu_sys_reg(vcpu, PMINTENSET_EL1);
1390 	}
1391 
1392 	return true;
1393 }
1394 
1395 static bool access_pmmir(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
1396 			 const struct sys_reg_desc *r)
1397 {
1398 	if (p->is_write)
1399 		return write_to_read_only(vcpu, p, r);
1400 
1401 	/*
1402 	 * If KVM_ARM_VCPU_PMU_V3_STRICT is set and PMU was explicitly
1403 	 * selected, the underlying hardware SLOTS value was read into this
1404 	 * field. Otherwise, it stays 0. All other PMMIR_EL1 fields are RAZ.
1405 	 */
1406 	p->regval = FIELD_PREP(ARMV8_PMU_SLOTS, vcpu->kvm->arch.pmmir_slots);
1407 	return true;
1408 }
1409 
1410 static int get_pmmir(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r,
1411 		     u64 *val)
1412 {
1413 	*val = FIELD_PREP(ARMV8_PMU_SLOTS, vcpu->kvm->arch.pmmir_slots);
1414 	return 0;
1415 }
1416 
1417 static int set_pmmir(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r,
1418 		     u64 val)
1419 {
1420 	struct kvm *kvm = vcpu->kvm;
1421 	u8 slots = FIELD_GET(ARMV8_PMU_SLOTS, val);
1422 
1423 	/*
1424 	 * Only the SLOTS field is exposed (get_pmmir returns just that field),
1425 	 * so reject a write that sets any other bit rather than silently
1426 	 * masking it.
1427 	 */
1428 	if (val & ~(u64)ARMV8_PMU_SLOTS)
1429 		return -EINVAL;
1430 
1431 	guard(mutex)(&kvm->arch.config_lock);
1432 
1433 	/*
1434 	 * Once the VM has started PMMIR_EL1 is immutable. Reject any write
1435 	 * that does not match the current value.
1436 	 */
1437 	if (kvm_vm_has_ran_once(kvm))
1438 		return slots == kvm->arch.pmmir_slots ? 0 : -EBUSY;
1439 
1440 	/*
1441 	 * Only SLOTS = 0 is honored for backwards compatibility with the
1442 	 * old RAZ behavior. Reject any non-zero write that does not match
1443 	 * the current value.
1444 	 */
1445 	if (!slots)
1446 		kvm->arch.pmmir_slots = 0;
1447 	else if (slots != kvm->arch.pmmir_slots)
1448 		return -EINVAL;
1449 
1450 	return 0;
1451 }
1452 
1453 static bool access_pmovs(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
1454 			 const struct sys_reg_desc *r)
1455 {
1456 	u64 mask = kvm_pmu_accessible_counter_mask(vcpu);
1457 
1458 	if (pmu_access_el0_disabled(vcpu))
1459 		return false;
1460 
1461 	if (p->is_write) {
1462 		if (r->CRm & 0x2)
1463 			/* accessing PMOVSSET_EL0 */
1464 			__vcpu_rmw_sys_reg(vcpu, PMOVSSET_EL0, |=, (p->regval & mask));
1465 		else
1466 			/* accessing PMOVSCLR_EL0 */
1467 			__vcpu_rmw_sys_reg(vcpu, PMOVSSET_EL0, &=, ~(p->regval & mask));
1468 	} else {
1469 		p->regval = __vcpu_sys_reg(vcpu, PMOVSSET_EL0);
1470 	}
1471 
1472 	return true;
1473 }
1474 
1475 static bool access_pmswinc(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
1476 			   const struct sys_reg_desc *r)
1477 {
1478 	u64 mask;
1479 
1480 	if (!p->is_write)
1481 		return read_from_write_only(vcpu, p, r);
1482 
1483 	if (pmu_write_swinc_el0_disabled(vcpu))
1484 		return false;
1485 
1486 	mask = kvm_pmu_accessible_counter_mask(vcpu);
1487 	kvm_pmu_software_increment(vcpu, p->regval & mask);
1488 	return true;
1489 }
1490 
1491 static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
1492 			     const struct sys_reg_desc *r)
1493 {
1494 	if (p->is_write) {
1495 		if (!vcpu_mode_priv(vcpu))
1496 			return undef_access(vcpu, p, r);
1497 
1498 		__vcpu_assign_sys_reg(vcpu, PMUSERENR_EL0,
1499 				      (p->regval & ARMV8_PMU_USERENR_MASK));
1500 	} else {
1501 		p->regval = __vcpu_sys_reg(vcpu, PMUSERENR_EL0)
1502 			    & ARMV8_PMU_USERENR_MASK;
1503 	}
1504 
1505 	return true;
1506 }
1507 
1508 static int get_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r,
1509 		    u64 *val)
1510 {
1511 	*val = kvm_vcpu_read_pmcr(vcpu);
1512 	return 0;
1513 }
1514 
1515 static int set_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r,
1516 		    u64 val)
1517 {
1518 	u8 new_n = FIELD_GET(ARMV8_PMU_PMCR_N, val);
1519 	struct kvm *kvm = vcpu->kvm;
1520 
1521 	mutex_lock(&kvm->arch.config_lock);
1522 
1523 	/*
1524 	 * The vCPU can't have more counters than the PMU hardware
1525 	 * implements. Ignore this error to maintain compatibility
1526 	 * with the existing KVM behavior.
1527 	 */
1528 	if (!kvm_vm_has_ran_once(kvm) &&
1529 	    !vcpu_has_nv(vcpu)	      &&
1530 	    !kvm_vcpu_has_pmuv3_strict(vcpu) &&
1531 	    new_n <= kvm_arm_pmu_get_max_counters(kvm))
1532 		kvm->arch.nr_pmu_counters = new_n;
1533 
1534 	mutex_unlock(&kvm->arch.config_lock);
1535 
1536 	/*
1537 	 * Ignore writes to RES0 bits, read only bits that are cleared on
1538 	 * vCPU reset, and writable bits that KVM doesn't support yet.
1539 	 * (i.e. only PMCR.N and bits [7:0] are mutable from userspace)
1540 	 * The LP bit is RES0 when FEAT_PMUv3p5 is not supported on the vCPU.
1541 	 * But, we leave the bit as it is here, as the vCPU's PMUver might
1542 	 * be changed later (NOTE: the bit will be cleared on first vCPU run
1543 	 * if necessary).
1544 	 */
1545 	val &= ARMV8_PMU_PMCR_MASK;
1546 
1547 	/* The LC bit is RES1 when AArch32 is not supported */
1548 	if (!kvm_supports_32bit_el0())
1549 		val |= ARMV8_PMU_PMCR_LC;
1550 
1551 	__vcpu_assign_sys_reg(vcpu, r->reg, val);
1552 	kvm_make_request(KVM_REQ_RELOAD_PMU, vcpu);
1553 
1554 	return 0;
1555 }
1556 
1557 /* Silly macro to expand the DBG{BCR,BVR,WVR,WCR}n_EL1 registers in one go */
1558 #define DBG_BCR_BVR_WCR_WVR_EL1(n)					\
1559 	{ SYS_DESC(SYS_DBGBVRn_EL1(n)),					\
1560 	  trap_dbg_wb_reg, reset_dbg_wb_reg, 0, 0,			\
1561 	  get_dbg_wb_reg, set_dbg_wb_reg },				\
1562 	{ SYS_DESC(SYS_DBGBCRn_EL1(n)),					\
1563 	  trap_dbg_wb_reg, reset_dbg_wb_reg, 0, 0,			\
1564 	  get_dbg_wb_reg, set_dbg_wb_reg },				\
1565 	{ SYS_DESC(SYS_DBGWVRn_EL1(n)),					\
1566 	  trap_dbg_wb_reg, reset_dbg_wb_reg, 0, 0,			\
1567 	  get_dbg_wb_reg, set_dbg_wb_reg },				\
1568 	{ SYS_DESC(SYS_DBGWCRn_EL1(n)),					\
1569 	  trap_dbg_wb_reg, reset_dbg_wb_reg, 0, 0,			\
1570 	  get_dbg_wb_reg, set_dbg_wb_reg }
1571 
1572 #define PMU_SYS_REG(name)						\
1573 	SYS_DESC(SYS_##name), .reset = reset_pmu_reg,			\
1574 	.visibility = pmu_visibility
1575 
1576 /* Macro to expand the PMEVCNTRn_EL0 register */
1577 #define PMU_PMEVCNTR_EL0(n)						\
1578 	{ PMU_SYS_REG(PMEVCNTRn_EL0(n)),				\
1579 	  .reset = reset_pmevcntr, .get_user = get_pmu_evcntr,		\
1580 	  .set_user = set_pmu_evcntr,					\
1581 	  .access = access_pmu_evcntr, .reg = (PMEVCNTR0_EL0 + n), }
1582 
1583 /* Macro to expand the PMEVTYPERn_EL0 register */
1584 #define PMU_PMEVTYPER_EL0(n)						\
1585 	{ PMU_SYS_REG(PMEVTYPERn_EL0(n)),				\
1586 	  .reset = reset_pmevtyper,					\
1587 	  .access = access_pmu_evtyper, .reg = (PMEVTYPER0_EL0 + n), }
1588 
1589 /* Macro to expand the AMU counter and type registers*/
1590 #define AMU_AMEVCNTR0_EL0(n) { SYS_DESC(SYS_AMEVCNTR0_EL0(n)), undef_access }
1591 #define AMU_AMEVTYPER0_EL0(n) { SYS_DESC(SYS_AMEVTYPER0_EL0(n)), undef_access }
1592 #define AMU_AMEVCNTR1_EL0(n) { SYS_DESC(SYS_AMEVCNTR1_EL0(n)), undef_access }
1593 #define AMU_AMEVTYPER1_EL0(n) { SYS_DESC(SYS_AMEVTYPER1_EL0(n)), undef_access }
1594 
1595 static unsigned int ptrauth_visibility(const struct kvm_vcpu *vcpu,
1596 			const struct sys_reg_desc *rd)
1597 {
1598 	return vcpu_has_ptrauth(vcpu) ? 0 : REG_HIDDEN;
1599 }
1600 
1601 /*
1602  * If we land here on a PtrAuth access, that is because we didn't
1603  * fixup the access on exit by allowing the PtrAuth sysregs. The only
1604  * way this happens is when the guest does not have PtrAuth support
1605  * enabled.
1606  */
1607 #define __PTRAUTH_KEY(k)						\
1608 	{ SYS_DESC(SYS_## k), undef_access, reset_unknown, k,		\
1609 	.visibility = ptrauth_visibility}
1610 
1611 #define PTRAUTH_KEY(k)							\
1612 	__PTRAUTH_KEY(k ## KEYLO_EL1),					\
1613 	__PTRAUTH_KEY(k ## KEYHI_EL1)
1614 
1615 static bool access_arch_timer(struct kvm_vcpu *vcpu,
1616 			      struct sys_reg_params *p,
1617 			      const struct sys_reg_desc *r)
1618 {
1619 	enum kvm_arch_timers tmr;
1620 	enum kvm_arch_timer_regs treg;
1621 	u64 reg = reg_to_encoding(r);
1622 
1623 	switch (reg) {
1624 	case SYS_CNTP_TVAL_EL0:
1625 		if (is_hyp_ctxt(vcpu) && vcpu_el2_e2h_is_set(vcpu))
1626 			tmr = TIMER_HPTIMER;
1627 		else
1628 			tmr = TIMER_PTIMER;
1629 		treg = TIMER_REG_TVAL;
1630 		break;
1631 
1632 	case SYS_CNTV_TVAL_EL0:
1633 		if (is_hyp_ctxt(vcpu) && vcpu_el2_e2h_is_set(vcpu))
1634 			tmr = TIMER_HVTIMER;
1635 		else
1636 			tmr = TIMER_VTIMER;
1637 		treg = TIMER_REG_TVAL;
1638 		break;
1639 
1640 	case SYS_AARCH32_CNTP_TVAL:
1641 	case SYS_CNTP_TVAL_EL02:
1642 		tmr = TIMER_PTIMER;
1643 		treg = TIMER_REG_TVAL;
1644 		break;
1645 
1646 	case SYS_CNTV_TVAL_EL02:
1647 		tmr = TIMER_VTIMER;
1648 		treg = TIMER_REG_TVAL;
1649 		break;
1650 
1651 	case SYS_CNTHP_TVAL_EL2:
1652 		tmr = TIMER_HPTIMER;
1653 		treg = TIMER_REG_TVAL;
1654 		break;
1655 
1656 	case SYS_CNTHV_TVAL_EL2:
1657 		tmr = TIMER_HVTIMER;
1658 		treg = TIMER_REG_TVAL;
1659 		break;
1660 
1661 	case SYS_CNTP_CTL_EL0:
1662 		if (is_hyp_ctxt(vcpu) && vcpu_el2_e2h_is_set(vcpu))
1663 			tmr = TIMER_HPTIMER;
1664 		else
1665 			tmr = TIMER_PTIMER;
1666 		treg = TIMER_REG_CTL;
1667 		break;
1668 
1669 	case SYS_CNTV_CTL_EL0:
1670 		if (is_hyp_ctxt(vcpu) && vcpu_el2_e2h_is_set(vcpu))
1671 			tmr = TIMER_HVTIMER;
1672 		else
1673 			tmr = TIMER_VTIMER;
1674 		treg = TIMER_REG_CTL;
1675 		break;
1676 
1677 	case SYS_AARCH32_CNTP_CTL:
1678 	case SYS_CNTP_CTL_EL02:
1679 		tmr = TIMER_PTIMER;
1680 		treg = TIMER_REG_CTL;
1681 		break;
1682 
1683 	case SYS_CNTV_CTL_EL02:
1684 		tmr = TIMER_VTIMER;
1685 		treg = TIMER_REG_CTL;
1686 		break;
1687 
1688 	case SYS_CNTHP_CTL_EL2:
1689 		tmr = TIMER_HPTIMER;
1690 		treg = TIMER_REG_CTL;
1691 		break;
1692 
1693 	case SYS_CNTHV_CTL_EL2:
1694 		tmr = TIMER_HVTIMER;
1695 		treg = TIMER_REG_CTL;
1696 		break;
1697 
1698 	case SYS_CNTP_CVAL_EL0:
1699 		if (is_hyp_ctxt(vcpu) && vcpu_el2_e2h_is_set(vcpu))
1700 			tmr = TIMER_HPTIMER;
1701 		else
1702 			tmr = TIMER_PTIMER;
1703 		treg = TIMER_REG_CVAL;
1704 		break;
1705 
1706 	case SYS_CNTV_CVAL_EL0:
1707 		if (is_hyp_ctxt(vcpu) && vcpu_el2_e2h_is_set(vcpu))
1708 			tmr = TIMER_HVTIMER;
1709 		else
1710 			tmr = TIMER_VTIMER;
1711 		treg = TIMER_REG_CVAL;
1712 		break;
1713 
1714 	case SYS_AARCH32_CNTP_CVAL:
1715 	case SYS_CNTP_CVAL_EL02:
1716 		tmr = TIMER_PTIMER;
1717 		treg = TIMER_REG_CVAL;
1718 		break;
1719 
1720 	case SYS_CNTV_CVAL_EL02:
1721 		tmr = TIMER_VTIMER;
1722 		treg = TIMER_REG_CVAL;
1723 		break;
1724 
1725 	case SYS_CNTHP_CVAL_EL2:
1726 		tmr = TIMER_HPTIMER;
1727 		treg = TIMER_REG_CVAL;
1728 		break;
1729 
1730 	case SYS_CNTHV_CVAL_EL2:
1731 		tmr = TIMER_HVTIMER;
1732 		treg = TIMER_REG_CVAL;
1733 		break;
1734 
1735 	case SYS_CNTPCT_EL0:
1736 	case SYS_CNTPCTSS_EL0:
1737 		if (is_hyp_ctxt(vcpu))
1738 			tmr = TIMER_HPTIMER;
1739 		else
1740 			tmr = TIMER_PTIMER;
1741 		treg = TIMER_REG_CNT;
1742 		break;
1743 
1744 	case SYS_AARCH32_CNTPCT:
1745 	case SYS_AARCH32_CNTPCTSS:
1746 		tmr = TIMER_PTIMER;
1747 		treg = TIMER_REG_CNT;
1748 		break;
1749 
1750 	case SYS_CNTVCT_EL0:
1751 	case SYS_CNTVCTSS_EL0:
1752 		if (is_hyp_ctxt(vcpu))
1753 			tmr = TIMER_HVTIMER;
1754 		else
1755 			tmr = TIMER_VTIMER;
1756 		treg = TIMER_REG_CNT;
1757 		break;
1758 
1759 	case SYS_AARCH32_CNTVCT:
1760 	case SYS_AARCH32_CNTVCTSS:
1761 		tmr = TIMER_VTIMER;
1762 		treg = TIMER_REG_CNT;
1763 		break;
1764 
1765 	default:
1766 		print_sys_reg_msg(p, "%s", "Unhandled trapped timer register");
1767 		return undef_access(vcpu, p, r);
1768 	}
1769 
1770 	if (p->is_write)
1771 		kvm_arm_timer_write_sysreg(vcpu, tmr, treg, p->regval);
1772 	else
1773 		p->regval = kvm_arm_timer_read_sysreg(vcpu, tmr, treg);
1774 
1775 	return true;
1776 }
1777 
1778 static int arch_timer_set_user(struct kvm_vcpu *vcpu,
1779 			       const struct sys_reg_desc *rd,
1780 			       u64 val)
1781 {
1782 	switch (reg_to_encoding(rd)) {
1783 	case SYS_CNTV_CTL_EL0:
1784 	case SYS_CNTP_CTL_EL0:
1785 	case SYS_CNTHV_CTL_EL2:
1786 	case SYS_CNTHP_CTL_EL2:
1787 		val &= ~ARCH_TIMER_CTRL_IT_STAT;
1788 		break;
1789 	case SYS_CNTVCT_EL0:
1790 		if (!test_bit(KVM_ARCH_FLAG_VM_COUNTER_OFFSET, &vcpu->kvm->arch.flags))
1791 			timer_set_offset(vcpu_vtimer(vcpu), kvm_phys_timer_read() - val);
1792 		return 0;
1793 	case SYS_CNTPCT_EL0:
1794 		if (!test_bit(KVM_ARCH_FLAG_VM_COUNTER_OFFSET, &vcpu->kvm->arch.flags))
1795 			timer_set_offset(vcpu_ptimer(vcpu), kvm_phys_timer_read() - val);
1796 		return 0;
1797 	}
1798 
1799 	__vcpu_assign_sys_reg(vcpu, rd->reg, val);
1800 	return 0;
1801 }
1802 
1803 static int arch_timer_get_user(struct kvm_vcpu *vcpu,
1804 			       const struct sys_reg_desc *rd,
1805 			       u64 *val)
1806 {
1807 	switch (reg_to_encoding(rd)) {
1808 	case SYS_CNTVCT_EL0:
1809 		*val = kvm_phys_timer_read() - timer_get_offset(vcpu_vtimer(vcpu));
1810 		break;
1811 	case SYS_CNTPCT_EL0:
1812 		*val = kvm_phys_timer_read() - timer_get_offset(vcpu_ptimer(vcpu));
1813 		break;
1814 	default:
1815 		*val = __vcpu_sys_reg(vcpu, rd->reg);
1816 	}
1817 
1818 	return 0;
1819 }
1820 
1821 static s64 kvm_arm64_ftr_safe_value(u32 id, const struct arm64_ftr_bits *ftrp,
1822 				    s64 new, s64 cur)
1823 {
1824 	struct arm64_ftr_bits kvm_ftr = *ftrp;
1825 
1826 	/* Some features have different safe value type in KVM than host features */
1827 	switch (id) {
1828 	case SYS_ID_AA64DFR0_EL1:
1829 		switch (kvm_ftr.shift) {
1830 		case ID_AA64DFR0_EL1_PMUVer_SHIFT:
1831 			kvm_ftr.type = FTR_LOWER_SAFE;
1832 			break;
1833 		case ID_AA64DFR0_EL1_DebugVer_SHIFT:
1834 			kvm_ftr.type = FTR_LOWER_SAFE;
1835 			break;
1836 		}
1837 		break;
1838 	case SYS_ID_DFR0_EL1:
1839 		if (kvm_ftr.shift == ID_DFR0_EL1_PerfMon_SHIFT)
1840 			kvm_ftr.type = FTR_LOWER_SAFE;
1841 		break;
1842 	}
1843 
1844 	return arm64_ftr_safe_value(&kvm_ftr, new, cur);
1845 }
1846 
1847 /*
1848  * arm64_check_features() - Check if a feature register value constitutes
1849  * a subset of features indicated by the idreg's KVM sanitised limit.
1850  *
1851  * This function will check if each feature field of @val is the "safe" value
1852  * against idreg's KVM sanitised limit return from reset() callback.
1853  * If a field value in @val is the same as the one in limit, it is always
1854  * considered the safe value regardless For register fields that are not in
1855  * writable, only the value in limit is considered the safe value.
1856  *
1857  * Return: 0 if all the fields are safe. Otherwise, return negative errno.
1858  */
1859 static int arm64_check_features(struct kvm_vcpu *vcpu,
1860 				const struct sys_reg_desc *rd,
1861 				u64 val)
1862 {
1863 	const struct arm64_ftr_reg *ftr_reg;
1864 	const struct arm64_ftr_bits *ftrp = NULL;
1865 	u32 id = reg_to_encoding(rd);
1866 	u64 writable_mask = rd->val;
1867 	u64 limit = rd->reset(vcpu, rd);
1868 	u64 mask = 0;
1869 
1870 	/*
1871 	 * Hidden and unallocated ID registers may not have a corresponding
1872 	 * struct arm64_ftr_reg. Of course, if the register is RAZ we know the
1873 	 * only safe value is 0.
1874 	 */
1875 	if (sysreg_visible_as_raz(vcpu, rd))
1876 		return val ? -E2BIG : 0;
1877 
1878 	ftr_reg = get_arm64_ftr_reg(id);
1879 	if (!ftr_reg)
1880 		return -EINVAL;
1881 
1882 	ftrp = ftr_reg->ftr_bits;
1883 
1884 	for (; ftrp && ftrp->width; ftrp++) {
1885 		s64 f_val, f_lim, safe_val;
1886 		u64 ftr_mask;
1887 
1888 		ftr_mask = arm64_ftr_mask(ftrp);
1889 		if ((ftr_mask & writable_mask) != ftr_mask)
1890 			continue;
1891 
1892 		f_val = arm64_ftr_value(ftrp, val);
1893 		f_lim = arm64_ftr_value(ftrp, limit);
1894 		mask |= ftr_mask;
1895 
1896 		if (f_val == f_lim)
1897 			safe_val = f_val;
1898 		else
1899 			safe_val = kvm_arm64_ftr_safe_value(id, ftrp, f_val, f_lim);
1900 
1901 		if (safe_val != f_val)
1902 			return -E2BIG;
1903 	}
1904 
1905 	/* For fields that are not writable, values in limit are the safe values. */
1906 	if ((val & ~mask) != (limit & ~mask))
1907 		return -E2BIG;
1908 
1909 	return 0;
1910 }
1911 
1912 static u8 pmuver_to_perfmon(u8 pmuver)
1913 {
1914 	switch (pmuver) {
1915 	case ID_AA64DFR0_EL1_PMUVer_IMP:
1916 		return ID_DFR0_EL1_PerfMon_PMUv3;
1917 	case ID_AA64DFR0_EL1_PMUVer_IMP_DEF:
1918 		return ID_DFR0_EL1_PerfMon_IMPDEF;
1919 	default:
1920 		/* Anything ARMv8.1+ and NI have the same value. For now. */
1921 		return pmuver;
1922 	}
1923 }
1924 
1925 static u64 sanitise_id_aa64pfr0_el1(const struct kvm_vcpu *vcpu, u64 val);
1926 static u64 sanitise_id_aa64pfr1_el1(const struct kvm_vcpu *vcpu, u64 val);
1927 static u64 sanitise_id_aa64pfr2_el1(const struct kvm_vcpu *vcpu, u64 val);
1928 static u64 sanitise_id_aa64dfr0_el1(const struct kvm_vcpu *vcpu, u64 val);
1929 
1930 /* Read a sanitised cpufeature ID register by sys_reg_desc */
1931 static u64 __kvm_read_sanitised_id_reg(const struct kvm_vcpu *vcpu,
1932 				       const struct sys_reg_desc *r)
1933 {
1934 	u32 id = reg_to_encoding(r);
1935 	u64 val;
1936 
1937 	if (sysreg_visible_as_raz(vcpu, r))
1938 		return 0;
1939 
1940 	val = read_sanitised_ftr_reg(id);
1941 
1942 	switch (id) {
1943 	case SYS_ID_AA64DFR0_EL1:
1944 		val = sanitise_id_aa64dfr0_el1(vcpu, val);
1945 		break;
1946 	case SYS_ID_AA64PFR0_EL1:
1947 		val = sanitise_id_aa64pfr0_el1(vcpu, val);
1948 		break;
1949 	case SYS_ID_AA64PFR1_EL1:
1950 		val = sanitise_id_aa64pfr1_el1(vcpu, val);
1951 		break;
1952 	case SYS_ID_AA64PFR2_EL1:
1953 		val = sanitise_id_aa64pfr2_el1(vcpu, val);
1954 		break;
1955 	case SYS_ID_AA64ISAR1_EL1:
1956 		if (!vcpu_has_ptrauth(vcpu))
1957 			val &= ~(ID_AA64ISAR1_EL1_APA |
1958 				 ID_AA64ISAR1_EL1_API |
1959 				 ID_AA64ISAR1_EL1_GPA |
1960 				 ID_AA64ISAR1_EL1_GPI);
1961 		break;
1962 	case SYS_ID_AA64ISAR2_EL1:
1963 		if (!vcpu_has_ptrauth(vcpu))
1964 			val &= ~(ID_AA64ISAR2_EL1_APA3 |
1965 				 ID_AA64ISAR2_EL1_GPA3);
1966 		if (!cpus_have_final_cap(ARM64_HAS_WFXT) ||
1967 		    has_broken_cntvoff())
1968 			val &= ~ID_AA64ISAR2_EL1_WFxT;
1969 		break;
1970 	case SYS_ID_AA64ISAR3_EL1:
1971 		val &= ID_AA64ISAR3_EL1_FPRCVT | ID_AA64ISAR3_EL1_LSFE |
1972 			ID_AA64ISAR3_EL1_FAMINMAX | ID_AA64ISAR3_EL1_LSUI;
1973 		break;
1974 	case SYS_ID_AA64MMFR2_EL1:
1975 		val &= ~ID_AA64MMFR2_EL1_CCIDX_MASK;
1976 		val &= ~ID_AA64MMFR2_EL1_NV;
1977 		break;
1978 	case SYS_ID_AA64MMFR3_EL1:
1979 		val &= ID_AA64MMFR3_EL1_TCRX |
1980 		       ID_AA64MMFR3_EL1_SCTLRX |
1981 		       ID_AA64MMFR3_EL1_S1POE |
1982 		       ID_AA64MMFR3_EL1_S1PIE;
1983 
1984 		if (!system_supports_poe())
1985 			val &= ~ID_AA64MMFR3_EL1_S1POE;
1986 		break;
1987 	case SYS_ID_MMFR4_EL1:
1988 		val &= ~ID_MMFR4_EL1_CCIDX;
1989 		break;
1990 	}
1991 
1992 	if (vcpu_has_nv(vcpu))
1993 		val = limit_nv_id_reg(vcpu->kvm, id, val);
1994 
1995 	return val;
1996 }
1997 
1998 static u64 kvm_read_sanitised_id_reg(struct kvm_vcpu *vcpu,
1999 				     const struct sys_reg_desc *r)
2000 {
2001 	return __kvm_read_sanitised_id_reg(vcpu, r);
2002 }
2003 
2004 static u64 read_id_reg(const struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
2005 {
2006 	return kvm_read_vm_id_reg(vcpu->kvm, reg_to_encoding(r));
2007 }
2008 
2009 static bool is_feature_id_reg(u32 encoding)
2010 {
2011 	return (sys_reg_Op0(encoding) == 3 &&
2012 		(sys_reg_Op1(encoding) < 2 || sys_reg_Op1(encoding) == 3) &&
2013 		sys_reg_CRn(encoding) == 0 &&
2014 		sys_reg_CRm(encoding) <= 7);
2015 }
2016 
2017 /*
2018  * Return true if the register's (Op0, Op1, CRn, CRm, Op2) is
2019  * (3, 0, 0, crm, op2), where 1<=crm<8, 0<=op2<8, which is the range of ID
2020  * registers KVM maintains on a per-VM basis.
2021  *
2022  * Additionally, the implementation ID registers and CTR_EL0 are handled as
2023  * per-VM registers.
2024  */
2025 static inline bool is_vm_ftr_id_reg(u32 id)
2026 {
2027 	switch (id) {
2028 	case SYS_CTR_EL0:
2029 	case SYS_MIDR_EL1:
2030 	case SYS_REVIDR_EL1:
2031 	case SYS_AIDR_EL1:
2032 		return true;
2033 	default:
2034 		return (sys_reg_Op0(id) == 3 && sys_reg_Op1(id) == 0 &&
2035 			sys_reg_CRn(id) == 0 && sys_reg_CRm(id) >= 1 &&
2036 			sys_reg_CRm(id) < 8);
2037 
2038 	}
2039 }
2040 
2041 static inline bool is_vcpu_ftr_id_reg(u32 id)
2042 {
2043 	return is_feature_id_reg(id) && !is_vm_ftr_id_reg(id);
2044 }
2045 
2046 static inline bool is_aa32_id_reg(u32 id)
2047 {
2048 	return (sys_reg_Op0(id) == 3 && sys_reg_Op1(id) == 0 &&
2049 		sys_reg_CRn(id) == 0 && sys_reg_CRm(id) >= 1 &&
2050 		sys_reg_CRm(id) <= 3);
2051 }
2052 
2053 static unsigned int id_visibility(const struct kvm_vcpu *vcpu,
2054 				  const struct sys_reg_desc *r)
2055 {
2056 	u32 id = reg_to_encoding(r);
2057 
2058 	switch (id) {
2059 	case SYS_ID_AA64ZFR0_EL1:
2060 		if (!vcpu_has_sve(vcpu))
2061 			return REG_RAZ;
2062 		break;
2063 	}
2064 
2065 	return 0;
2066 }
2067 
2068 static unsigned int aa32_id_visibility(const struct kvm_vcpu *vcpu,
2069 				       const struct sys_reg_desc *r)
2070 {
2071 	/*
2072 	 * AArch32 ID registers are UNKNOWN if AArch32 isn't implemented at any
2073 	 * EL. Promote to RAZ/WI in order to guarantee consistency between
2074 	 * systems.
2075 	 */
2076 	if (!kvm_supports_32bit_el0())
2077 		return REG_RAZ | REG_USER_WI;
2078 
2079 	return id_visibility(vcpu, r);
2080 }
2081 
2082 static unsigned int raz_visibility(const struct kvm_vcpu *vcpu,
2083 				   const struct sys_reg_desc *r)
2084 {
2085 	return REG_RAZ;
2086 }
2087 
2088 /* cpufeature ID register access trap handlers */
2089 
2090 static bool access_id_reg(struct kvm_vcpu *vcpu,
2091 			  struct sys_reg_params *p,
2092 			  const struct sys_reg_desc *r)
2093 {
2094 	if (p->is_write)
2095 		return write_to_read_only(vcpu, p, r);
2096 
2097 	p->regval = read_id_reg(vcpu, r);
2098 
2099 	return true;
2100 }
2101 
2102 /* Visibility overrides for SVE-specific control registers */
2103 static unsigned int sve_visibility(const struct kvm_vcpu *vcpu,
2104 				   const struct sys_reg_desc *rd)
2105 {
2106 	if (vcpu_has_sve(vcpu))
2107 		return 0;
2108 
2109 	return REG_HIDDEN;
2110 }
2111 
2112 static unsigned int sme_visibility(const struct kvm_vcpu *vcpu,
2113 				   const struct sys_reg_desc *rd)
2114 {
2115 	if (kvm_has_feat(vcpu->kvm, ID_AA64PFR1_EL1, SME, IMP))
2116 		return 0;
2117 
2118 	return REG_HIDDEN;
2119 }
2120 
2121 static unsigned int fp8_visibility(const struct kvm_vcpu *vcpu,
2122 				   const struct sys_reg_desc *rd)
2123 {
2124 	if (kvm_has_fpmr(vcpu->kvm))
2125 		return 0;
2126 
2127 	return REG_HIDDEN;
2128 }
2129 
2130 static u64 sanitise_id_aa64pfr0_el1(const struct kvm_vcpu *vcpu, u64 val)
2131 {
2132 	if (!vcpu_has_sve(vcpu))
2133 		val &= ~ID_AA64PFR0_EL1_SVE_MASK;
2134 
2135 	/*
2136 	 * The default is to expose CSV2 == 1 if the HW isn't affected.
2137 	 * Although this is a per-CPU feature, we make it global because
2138 	 * asymmetric systems are just a nuisance.
2139 	 *
2140 	 * Userspace can override this as long as it doesn't promise
2141 	 * the impossible.
2142 	 */
2143 	if (arm64_get_spectre_v2_state() == SPECTRE_UNAFFECTED) {
2144 		val &= ~ID_AA64PFR0_EL1_CSV2_MASK;
2145 		val |= SYS_FIELD_PREP_ENUM(ID_AA64PFR0_EL1, CSV2, IMP);
2146 	}
2147 	if (arm64_get_meltdown_state() == SPECTRE_UNAFFECTED) {
2148 		val &= ~ID_AA64PFR0_EL1_CSV3_MASK;
2149 		val |= SYS_FIELD_PREP_ENUM(ID_AA64PFR0_EL1, CSV3, IMP);
2150 	}
2151 
2152 	if (vgic_host_has_gicv3()) {
2153 		val &= ~ID_AA64PFR0_EL1_GIC_MASK;
2154 		val |= SYS_FIELD_PREP_ENUM(ID_AA64PFR0_EL1, GIC, IMP);
2155 	}
2156 
2157 	val &= ~ID_AA64PFR0_EL1_AMU_MASK;
2158 
2159 	/*
2160 	 * MPAM is disabled by default as KVM also needs a set of PARTID to
2161 	 * program the MPAMVPMx_EL2 PARTID remapping registers with. But some
2162 	 * older kernels let the guest see the ID bit.
2163 	 */
2164 	val &= ~ID_AA64PFR0_EL1_MPAM_MASK;
2165 
2166 	return val;
2167 }
2168 
2169 static u64 sanitise_id_aa64pfr1_el1(const struct kvm_vcpu *vcpu, u64 val)
2170 {
2171 	u64 pfr0 = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1);
2172 
2173 	if (!kvm_has_mte(vcpu->kvm)) {
2174 		val &= ~ID_AA64PFR1_EL1_MTE;
2175 		val &= ~ID_AA64PFR1_EL1_MTE_frac;
2176 	}
2177 
2178 	if (!(cpus_have_final_cap(ARM64_HAS_RASV1P1_EXTN) &&
2179 	      SYS_FIELD_GET(ID_AA64PFR0_EL1, RAS, pfr0) == ID_AA64PFR0_EL1_RAS_IMP))
2180 		val &= ~ID_AA64PFR1_EL1_RAS_frac;
2181 
2182 	val &= ~ID_AA64PFR1_EL1_SME;
2183 	val &= ~ID_AA64PFR1_EL1_RNDR_trap;
2184 	val &= ~ID_AA64PFR1_EL1_NMI;
2185 	val &= ~ID_AA64PFR1_EL1_GCS;
2186 	val &= ~ID_AA64PFR1_EL1_THE;
2187 	val &= ~ID_AA64PFR1_EL1_MTEX;
2188 	val &= ~ID_AA64PFR1_EL1_PFAR;
2189 	val &= ~ID_AA64PFR1_EL1_MPAM_frac;
2190 
2191 	return val;
2192 }
2193 
2194 static u64 sanitise_id_aa64pfr2_el1(const struct kvm_vcpu *vcpu, u64 val)
2195 {
2196 	val &= ID_AA64PFR2_EL1_FPMR |
2197 	       ID_AA64PFR2_EL1_MTEFAR |
2198 	       ID_AA64PFR2_EL1_MTESTOREONLY;
2199 
2200 	if (!kvm_has_mte(vcpu->kvm)) {
2201 		val &= ~ID_AA64PFR2_EL1_MTEFAR;
2202 		val &= ~ID_AA64PFR2_EL1_MTESTOREONLY;
2203 	}
2204 
2205 	if (vgic_host_has_gicv5())
2206 		val |= SYS_FIELD_PREP_ENUM(ID_AA64PFR2_EL1, GCIE, IMP);
2207 
2208 	return val;
2209 }
2210 
2211 static u64 sanitise_id_aa64dfr0_el1(const struct kvm_vcpu *vcpu, u64 val)
2212 {
2213 	val = ID_REG_LIMIT_FIELD_ENUM(val, ID_AA64DFR0_EL1, DebugVer, V8P8);
2214 
2215 	/*
2216 	 * Only initialize the PMU version if the vCPU was configured with one.
2217 	 */
2218 	val &= ~ID_AA64DFR0_EL1_PMUVer_MASK;
2219 	if (kvm_vcpu_has_pmu(vcpu))
2220 		val |= SYS_FIELD_PREP(ID_AA64DFR0_EL1, PMUVer,
2221 				      kvm_arm_pmu_get_pmuver_limit());
2222 
2223 	/* Hide SPE from guests */
2224 	val &= ~ID_AA64DFR0_EL1_PMSVer_MASK;
2225 
2226 	/* Hide BRBE from guests */
2227 	val &= ~ID_AA64DFR0_EL1_BRBE_MASK;
2228 
2229 	return val;
2230 }
2231 
2232 /*
2233  * Older versions of KVM erroneously claim support for FEAT_DoubleLock with
2234  * NV-enabled VMs on unsupporting hardware. Silently ignore the incorrect
2235  * value if it is consistent with the bug.
2236  */
2237 static bool ignore_feat_doublelock(struct kvm_vcpu *vcpu, u64 val)
2238 {
2239 	u8 host, user;
2240 
2241 	if (!vcpu_has_nv(vcpu))
2242 		return false;
2243 
2244 	host = SYS_FIELD_GET(ID_AA64DFR0_EL1, DoubleLock,
2245 			     read_sanitised_ftr_reg(SYS_ID_AA64DFR0_EL1));
2246 	user = SYS_FIELD_GET(ID_AA64DFR0_EL1, DoubleLock, val);
2247 
2248 	return host == ID_AA64DFR0_EL1_DoubleLock_NI &&
2249 	       user == ID_AA64DFR0_EL1_DoubleLock_IMP;
2250 }
2251 
2252 static int set_id_aa64dfr0_el1(struct kvm_vcpu *vcpu,
2253 			       const struct sys_reg_desc *rd,
2254 			       u64 val)
2255 {
2256 	u8 debugver = SYS_FIELD_GET(ID_AA64DFR0_EL1, DebugVer, val);
2257 	u8 pmuver = SYS_FIELD_GET(ID_AA64DFR0_EL1, PMUVer, val);
2258 
2259 	/*
2260 	 * Prior to commit 3d0dba5764b9 ("KVM: arm64: PMU: Move the
2261 	 * ID_AA64DFR0_EL1.PMUver limit to VM creation"), KVM erroneously
2262 	 * exposed an IMP_DEF PMU to userspace and the guest on systems w/
2263 	 * non-architectural PMUs. Of course, PMUv3 is the only game in town for
2264 	 * PMU virtualization, so the IMP_DEF value was rather user-hostile.
2265 	 *
2266 	 * At minimum, we're on the hook to allow values that were given to
2267 	 * userspace by KVM. Cover our tracks here and replace the IMP_DEF value
2268 	 * with a more sensible NI. The value of an ID register changing under
2269 	 * the nose of the guest is unfortunate, but is certainly no more
2270 	 * surprising than an ill-guided PMU driver poking at impdef system
2271 	 * registers that end in an UNDEF...
2272 	 */
2273 	if (pmuver == ID_AA64DFR0_EL1_PMUVer_IMP_DEF)
2274 		val &= ~ID_AA64DFR0_EL1_PMUVer_MASK;
2275 
2276 	/*
2277 	 * ID_AA64DFR0_EL1.DebugVer is one of those awkward fields with a
2278 	 * nonzero minimum safe value.
2279 	 */
2280 	if (debugver < ID_AA64DFR0_EL1_DebugVer_IMP)
2281 		return -EINVAL;
2282 
2283 	if (ignore_feat_doublelock(vcpu, val)) {
2284 		val &= ~ID_AA64DFR0_EL1_DoubleLock;
2285 		val |= SYS_FIELD_PREP_ENUM(ID_AA64DFR0_EL1, DoubleLock, NI);
2286 	}
2287 
2288 	return set_id_reg(vcpu, rd, val);
2289 }
2290 
2291 static u64 read_sanitised_id_dfr0_el1(struct kvm_vcpu *vcpu,
2292 				      const struct sys_reg_desc *rd)
2293 {
2294 	u8 perfmon;
2295 	u64 val = read_sanitised_ftr_reg(SYS_ID_DFR0_EL1);
2296 
2297 	val &= ~ID_DFR0_EL1_PerfMon_MASK;
2298 	if (kvm_vcpu_has_pmu(vcpu)) {
2299 		perfmon = pmuver_to_perfmon(kvm_arm_pmu_get_pmuver_limit());
2300 		val |= SYS_FIELD_PREP(ID_DFR0_EL1, PerfMon, perfmon);
2301 	}
2302 
2303 	val = ID_REG_LIMIT_FIELD_ENUM(val, ID_DFR0_EL1, CopDbg, Debugv8p8);
2304 
2305 	return val;
2306 }
2307 
2308 static int set_id_dfr0_el1(struct kvm_vcpu *vcpu,
2309 			   const struct sys_reg_desc *rd,
2310 			   u64 val)
2311 {
2312 	u8 perfmon = SYS_FIELD_GET(ID_DFR0_EL1, PerfMon, val);
2313 	u8 copdbg = SYS_FIELD_GET(ID_DFR0_EL1, CopDbg, val);
2314 
2315 	if (perfmon == ID_DFR0_EL1_PerfMon_IMPDEF) {
2316 		val &= ~ID_DFR0_EL1_PerfMon_MASK;
2317 		perfmon = 0;
2318 	}
2319 
2320 	/*
2321 	 * Allow DFR0_EL1.PerfMon to be set from userspace as long as
2322 	 * it doesn't promise more than what the HW gives us on the
2323 	 * AArch64 side (as everything is emulated with that), and
2324 	 * that this is a PMUv3.
2325 	 */
2326 	if (perfmon != 0 && perfmon < ID_DFR0_EL1_PerfMon_PMUv3)
2327 		return -EINVAL;
2328 
2329 	if (copdbg < ID_DFR0_EL1_CopDbg_Armv8)
2330 		return -EINVAL;
2331 
2332 	return set_id_reg(vcpu, rd, val);
2333 }
2334 
2335 static int set_id_aa64pfr0_el1(struct kvm_vcpu *vcpu,
2336 			       const struct sys_reg_desc *rd, u64 user_val)
2337 {
2338 	u64 hw_val = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1);
2339 	u64 mpam_mask = ID_AA64PFR0_EL1_MPAM_MASK;
2340 
2341 	/*
2342 	 * Commit 011e5f5bf529f ("arm64/cpufeature: Add remaining feature bits
2343 	 * in ID_AA64PFR0 register") exposed the MPAM field of AA64PFR0_EL1 to
2344 	 * guests, but didn't add trap handling. KVM doesn't support MPAM and
2345 	 * always returns an UNDEF for these registers. The guest must see 0
2346 	 * for this field.
2347 	 *
2348 	 * But KVM must also accept values from user-space that were provided
2349 	 * by KVM. On CPUs that support MPAM, permit user-space to write
2350 	 * the sanitizied value to ID_AA64PFR0_EL1.MPAM, but ignore this field.
2351 	 */
2352 	if ((hw_val & mpam_mask) == (user_val & mpam_mask))
2353 		user_val &= ~ID_AA64PFR0_EL1_MPAM_MASK;
2354 
2355 	/* Fail the guest's request to disable the AA64 ISA at EL{0,1,2} */
2356 	if (!FIELD_GET(ID_AA64PFR0_EL1_EL0, user_val) ||
2357 	    !FIELD_GET(ID_AA64PFR0_EL1_EL1, user_val) ||
2358 	    (vcpu_has_nv(vcpu) && !FIELD_GET(ID_AA64PFR0_EL1_EL2, user_val)))
2359 		return -EINVAL;
2360 
2361 	return set_id_reg(vcpu, rd, user_val);
2362 }
2363 
2364 static int set_id_aa64pfr1_el1(struct kvm_vcpu *vcpu,
2365 			       const struct sys_reg_desc *rd, u64 user_val)
2366 {
2367 	u64 hw_val = read_sanitised_ftr_reg(SYS_ID_AA64PFR1_EL1);
2368 	u64 mpam_mask = ID_AA64PFR1_EL1_MPAM_frac_MASK;
2369 	u8 mte = SYS_FIELD_GET(ID_AA64PFR1_EL1, MTE, hw_val);
2370 	u8 user_mte_frac = SYS_FIELD_GET(ID_AA64PFR1_EL1, MTE_frac, user_val);
2371 	u8 hw_mte_frac = SYS_FIELD_GET(ID_AA64PFR1_EL1, MTE_frac, hw_val);
2372 
2373 	/* See set_id_aa64pfr0_el1 for comment about MPAM */
2374 	if ((hw_val & mpam_mask) == (user_val & mpam_mask))
2375 		user_val &= ~ID_AA64PFR1_EL1_MPAM_frac_MASK;
2376 
2377 	/*
2378 	 * Previously MTE_frac was hidden from guest. However, if the
2379 	 * hardware supports MTE2 but not MTE_ASYM_FAULT then a value
2380 	 * of 0 for this field indicates that the hardware supports
2381 	 * MTE_ASYNC. Whereas, 0xf indicates MTE_ASYNC is not supported.
2382 	 *
2383 	 * As KVM must accept values from KVM provided by user-space,
2384 	 * when ID_AA64PFR1_EL1.MTE is 2 allow user-space to set
2385 	 * ID_AA64PFR1_EL1.MTE_frac to 0. However, ignore it to avoid
2386 	 * incorrectly claiming hardware support for MTE_ASYNC in the
2387 	 * guest.
2388 	 */
2389 
2390 	if (mte == ID_AA64PFR1_EL1_MTE_MTE2 &&
2391 	    hw_mte_frac == ID_AA64PFR1_EL1_MTE_frac_NI &&
2392 	    user_mte_frac == ID_AA64PFR1_EL1_MTE_frac_ASYNC) {
2393 		user_val &= ~ID_AA64PFR1_EL1_MTE_frac_MASK;
2394 		user_val |= hw_val & ID_AA64PFR1_EL1_MTE_frac_MASK;
2395 	}
2396 
2397 	return set_id_reg(vcpu, rd, user_val);
2398 }
2399 
2400 static int set_id_aa64pfr2_el1(struct kvm_vcpu *vcpu,
2401 			       const struct sys_reg_desc *rd, u64 user_val)
2402 {
2403 	return set_id_reg(vcpu, rd, user_val);
2404 }
2405 
2406 /*
2407  * Allow userspace to de-feature a stage-2 translation granule but prevent it
2408  * from claiming the impossible.
2409  */
2410 #define tgran2_val_allowed(tg, safe, user)			\
2411 ({								\
2412 	u8 __s = SYS_FIELD_GET(ID_AA64MMFR0_EL1, tg, safe);	\
2413 	u8 __u = SYS_FIELD_GET(ID_AA64MMFR0_EL1, tg, user);	\
2414 								\
2415 	__s == __u || __u == ID_AA64MMFR0_EL1_##tg##_NI;	\
2416 })
2417 
2418 static int set_id_aa64mmfr0_el1(struct kvm_vcpu *vcpu,
2419 				const struct sys_reg_desc *rd, u64 user_val)
2420 {
2421 	u64 sanitized_val = kvm_read_sanitised_id_reg(vcpu, rd);
2422 
2423 	if (!vcpu_has_nv(vcpu))
2424 		return set_id_reg(vcpu, rd, user_val);
2425 
2426 	if (!tgran2_val_allowed(TGRAN4_2, sanitized_val, user_val) ||
2427 	    !tgran2_val_allowed(TGRAN16_2, sanitized_val, user_val) ||
2428 	    !tgran2_val_allowed(TGRAN64_2, sanitized_val, user_val))
2429 		return -EINVAL;
2430 
2431 	return set_id_reg(vcpu, rd, user_val);
2432 }
2433 
2434 static int set_id_aa64mmfr2_el1(struct kvm_vcpu *vcpu,
2435 				const struct sys_reg_desc *rd, u64 user_val)
2436 {
2437 	u64 hw_val = read_sanitised_ftr_reg(SYS_ID_AA64MMFR2_EL1);
2438 	u64 nv_mask = ID_AA64MMFR2_EL1_NV_MASK;
2439 
2440 	/*
2441 	 * We made the mistake to expose the now deprecated NV field,
2442 	 * so allow userspace to write it, but silently ignore it.
2443 	 */
2444 	if ((hw_val & nv_mask) == (user_val & nv_mask))
2445 		user_val &= ~nv_mask;
2446 
2447 	return set_id_reg(vcpu, rd, user_val);
2448 }
2449 
2450 static int set_ctr_el0(struct kvm_vcpu *vcpu,
2451 		       const struct sys_reg_desc *rd, u64 user_val)
2452 {
2453 	u8 user_L1Ip = SYS_FIELD_GET(CTR_EL0, L1Ip, user_val);
2454 
2455 	/*
2456 	 * Both AIVIVT (0b01) and VPIPT (0b00) are documented as reserved.
2457 	 * Hence only allow to set VIPT(0b10) or PIPT(0b11) for L1Ip based
2458 	 * on what hardware reports.
2459 	 *
2460 	 * Using a VIPT software model on PIPT will lead to over invalidation,
2461 	 * but still correct. Hence, we can allow downgrading PIPT to VIPT,
2462 	 * but not the other way around. This is handled via arm64_ftr_safe_value()
2463 	 * as CTR_EL0 ftr_bits has L1Ip field with type FTR_EXACT and safe value
2464 	 * set as VIPT.
2465 	 */
2466 	switch (user_L1Ip) {
2467 	case CTR_EL0_L1Ip_RESERVED_VPIPT:
2468 	case CTR_EL0_L1Ip_RESERVED_AIVIVT:
2469 		return -EINVAL;
2470 	case CTR_EL0_L1Ip_VIPT:
2471 	case CTR_EL0_L1Ip_PIPT:
2472 		return set_id_reg(vcpu, rd, user_val);
2473 	default:
2474 		return -ENOENT;
2475 	}
2476 }
2477 
2478 /*
2479  * cpufeature ID register user accessors
2480  *
2481  * For now, these registers are immutable for userspace, so no values
2482  * are stored, and for set_id_reg() we don't allow the effective value
2483  * to be changed.
2484  */
2485 static int get_id_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
2486 		      u64 *val)
2487 {
2488 	/*
2489 	 * Avoid locking if the VM has already started, as the ID registers are
2490 	 * guaranteed to be invariant at that point.
2491 	 */
2492 	if (kvm_vm_has_ran_once(vcpu->kvm)) {
2493 		*val = read_id_reg(vcpu, rd);
2494 		return 0;
2495 	}
2496 
2497 	mutex_lock(&vcpu->kvm->arch.config_lock);
2498 	*val = read_id_reg(vcpu, rd);
2499 	mutex_unlock(&vcpu->kvm->arch.config_lock);
2500 
2501 	return 0;
2502 }
2503 
2504 static int set_id_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
2505 		      u64 val)
2506 {
2507 	u32 id = reg_to_encoding(rd);
2508 	int ret;
2509 
2510 	mutex_lock(&vcpu->kvm->arch.config_lock);
2511 
2512 	/*
2513 	 * Once the VM has started the ID registers are immutable. Reject any
2514 	 * write that does not match the final register value.
2515 	 */
2516 	if (kvm_vm_has_ran_once(vcpu->kvm)) {
2517 		if (val != read_id_reg(vcpu, rd))
2518 			ret = -EBUSY;
2519 		else
2520 			ret = 0;
2521 
2522 		mutex_unlock(&vcpu->kvm->arch.config_lock);
2523 		return ret;
2524 	}
2525 
2526 	ret = arm64_check_features(vcpu, rd, val);
2527 	if (!ret)
2528 		kvm_set_vm_id_reg(vcpu->kvm, id, val);
2529 
2530 	mutex_unlock(&vcpu->kvm->arch.config_lock);
2531 
2532 	/*
2533 	 * arm64_check_features() returns -E2BIG to indicate the register's
2534 	 * feature set is a superset of the maximally-allowed register value.
2535 	 * While it would be nice to precisely describe this to userspace, the
2536 	 * existing UAPI for KVM_SET_ONE_REG has it that invalid register
2537 	 * writes return -EINVAL.
2538 	 */
2539 	if (ret == -E2BIG)
2540 		ret = -EINVAL;
2541 	return ret;
2542 }
2543 
2544 void kvm_set_vm_id_reg(struct kvm *kvm, u32 reg, u64 val)
2545 {
2546 	u64 *p = __vm_id_reg(&kvm->arch, reg);
2547 
2548 	lockdep_assert_held(&kvm->arch.config_lock);
2549 
2550 	if (KVM_BUG_ON(kvm_vm_has_ran_once(kvm) || !p, kvm))
2551 		return;
2552 
2553 	*p = val;
2554 }
2555 
2556 static int get_raz_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
2557 		       u64 *val)
2558 {
2559 	*val = 0;
2560 	return 0;
2561 }
2562 
2563 static int set_wi_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
2564 		      u64 val)
2565 {
2566 	return 0;
2567 }
2568 
2569 static bool access_ctr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
2570 		       const struct sys_reg_desc *r)
2571 {
2572 	if (p->is_write)
2573 		return write_to_read_only(vcpu, p, r);
2574 
2575 	p->regval = kvm_read_vm_id_reg(vcpu->kvm, SYS_CTR_EL0);
2576 	return true;
2577 }
2578 
2579 static bool access_clidr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
2580 			 const struct sys_reg_desc *r)
2581 {
2582 	if (p->is_write)
2583 		return write_to_read_only(vcpu, p, r);
2584 
2585 	p->regval = __vcpu_sys_reg(vcpu, r->reg);
2586 	return true;
2587 }
2588 
2589 /*
2590  * Fabricate a CLIDR_EL1 value instead of using the real value, which can vary
2591  * by the physical CPU which the vcpu currently resides in.
2592  */
2593 static u64 reset_clidr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
2594 {
2595 	u64 ctr_el0 = read_sanitised_ftr_reg(SYS_CTR_EL0);
2596 	u64 clidr;
2597 	u8 loc;
2598 
2599 	if ((ctr_el0 & CTR_EL0_IDC)) {
2600 		/*
2601 		 * Data cache clean to the PoU is not required so LoUU and LoUIS
2602 		 * will not be set and a unified cache, which will be marked as
2603 		 * LoC, will be added.
2604 		 *
2605 		 * If not DIC, let the unified cache L2 so that an instruction
2606 		 * cache can be added as L1 later.
2607 		 */
2608 		loc = (ctr_el0 & CTR_EL0_DIC) ? 1 : 2;
2609 		clidr = CACHE_TYPE_UNIFIED << CLIDR_CTYPE_SHIFT(loc);
2610 	} else {
2611 		/*
2612 		 * Data cache clean to the PoU is required so let L1 have a data
2613 		 * cache and mark it as LoUU and LoUIS. As L1 has a data cache,
2614 		 * it can be marked as LoC too.
2615 		 */
2616 		loc = 1;
2617 		clidr = 1 << CLIDR_LOUU_SHIFT;
2618 		clidr |= 1 << CLIDR_LOUIS_SHIFT;
2619 		clidr |= CACHE_TYPE_DATA << CLIDR_CTYPE_SHIFT(1);
2620 	}
2621 
2622 	/*
2623 	 * Instruction cache invalidation to the PoU is required so let L1 have
2624 	 * an instruction cache. If L1 already has a data cache, it will be
2625 	 * CACHE_TYPE_SEPARATE.
2626 	 */
2627 	if (!(ctr_el0 & CTR_EL0_DIC))
2628 		clidr |= CACHE_TYPE_INST << CLIDR_CTYPE_SHIFT(1);
2629 
2630 	clidr |= loc << CLIDR_LOC_SHIFT;
2631 
2632 	/*
2633 	 * Add tag cache unified to data cache. Allocation tags and data are
2634 	 * unified in a cache line so that it looks valid even if there is only
2635 	 * one cache line.
2636 	 */
2637 	if (kvm_has_mte(vcpu->kvm))
2638 		clidr |= 2ULL << CLIDR_TTYPE_SHIFT(loc);
2639 
2640 	__vcpu_assign_sys_reg(vcpu, r->reg, clidr);
2641 
2642 	return __vcpu_sys_reg(vcpu, r->reg);
2643 }
2644 
2645 static int set_clidr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
2646 		      u64 val)
2647 {
2648 	u64 ctr_el0 = read_sanitised_ftr_reg(SYS_CTR_EL0);
2649 	u64 idc = !CLIDR_LOC(val) || (!CLIDR_LOUIS(val) && !CLIDR_LOUU(val));
2650 
2651 	if ((val & CLIDR_EL1_RES0) || (!(ctr_el0 & CTR_EL0_IDC) && idc))
2652 		return -EINVAL;
2653 
2654 	__vcpu_assign_sys_reg(vcpu, rd->reg, val);
2655 
2656 	return 0;
2657 }
2658 
2659 static bool access_csselr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
2660 			  const struct sys_reg_desc *r)
2661 {
2662 	int reg = r->reg;
2663 
2664 	if (p->is_write)
2665 		vcpu_write_sys_reg(vcpu, p->regval, reg);
2666 	else
2667 		p->regval = vcpu_read_sys_reg(vcpu, reg);
2668 	return true;
2669 }
2670 
2671 static bool access_ccsidr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
2672 			  const struct sys_reg_desc *r)
2673 {
2674 	u32 csselr;
2675 
2676 	if (p->is_write)
2677 		return write_to_read_only(vcpu, p, r);
2678 
2679 	csselr = vcpu_read_sys_reg(vcpu, CSSELR_EL1);
2680 	csselr &= CSSELR_EL1_Level | CSSELR_EL1_InD;
2681 	if (csselr < CSSELR_MAX)
2682 		p->regval = get_ccsidr(vcpu, csselr);
2683 
2684 	return true;
2685 }
2686 
2687 static unsigned int mte_visibility(const struct kvm_vcpu *vcpu,
2688 				   const struct sys_reg_desc *rd)
2689 {
2690 	if (kvm_has_mte(vcpu->kvm))
2691 		return 0;
2692 
2693 	return REG_HIDDEN;
2694 }
2695 
2696 #define MTE_REG(name) {				\
2697 	SYS_DESC(SYS_##name),			\
2698 	.access = undef_access,			\
2699 	.reset = reset_unknown,			\
2700 	.reg = name,				\
2701 	.visibility = mte_visibility,		\
2702 }
2703 
2704 static unsigned int el2_visibility(const struct kvm_vcpu *vcpu,
2705 				   const struct sys_reg_desc *rd)
2706 {
2707 	if (vcpu_has_nv(vcpu))
2708 		return 0;
2709 
2710 	return REG_HIDDEN;
2711 }
2712 
2713 static bool bad_vncr_trap(struct kvm_vcpu *vcpu,
2714 			  struct sys_reg_params *p,
2715 			  const struct sys_reg_desc *r)
2716 {
2717 	/*
2718 	 * We really shouldn't be here, and this is likely the result
2719 	 * of a misconfigured trap, as this register should target the
2720 	 * VNCR page, and nothing else.
2721 	 */
2722 	return bad_trap(vcpu, p, r,
2723 			"trap of VNCR-backed register");
2724 }
2725 
2726 static bool bad_redir_trap(struct kvm_vcpu *vcpu,
2727 			   struct sys_reg_params *p,
2728 			   const struct sys_reg_desc *r)
2729 {
2730 	/*
2731 	 * We really shouldn't be here, and this is likely the result
2732 	 * of a misconfigured trap, as this register should target the
2733 	 * corresponding EL1, and nothing else.
2734 	 */
2735 	return bad_trap(vcpu, p, r,
2736 			"trap of EL2 register redirected to EL1");
2737 }
2738 
2739 #define SYS_REG_USER_FILTER(name, acc, rst, v, gu, su, filter) { \
2740 	SYS_DESC(SYS_##name),			\
2741 	.access = acc,				\
2742 	.reset = rst,				\
2743 	.reg = name,				\
2744 	.get_user = gu,				\
2745 	.set_user = su,				\
2746 	.visibility = filter,			\
2747 	.val = v,				\
2748 }
2749 
2750 #define EL2_REG_FILTERED(name, acc, rst, v, filter)	\
2751 	SYS_REG_USER_FILTER(name, acc, rst, v, NULL, NULL, filter)
2752 
2753 #define EL2_REG(name, acc, rst, v)			\
2754 	EL2_REG_FILTERED(name, acc, rst, v, el2_visibility)
2755 
2756 #define EL2_REG_VNCR(name, rst, v)	EL2_REG(name, bad_vncr_trap, rst, v)
2757 #define EL2_REG_VNCR_FILT(name, vis)			\
2758 	EL2_REG_FILTERED(name, bad_vncr_trap, reset_val, 0, vis)
2759 #define EL2_REG_VNCR_GICv3(name)			\
2760 	EL2_REG_VNCR_FILT(name, hidden_visibility)
2761 #define EL2_REG_REDIR(name, rst, v)	EL2_REG(name, bad_redir_trap, rst, v)
2762 
2763 #define TIMER_REG(name, vis)					   \
2764 	SYS_REG_USER_FILTER(name, access_arch_timer, reset_val, 0, \
2765 			    arch_timer_get_user, arch_timer_set_user, vis)
2766 
2767 /*
2768  * Since reset() callback and field val are not used for idregs, they will be
2769  * used for specific purposes for idregs.
2770  * The reset() would return KVM sanitised register value. The value would be the
2771  * same as the host kernel sanitised value if there is no KVM sanitisation.
2772  * The val would be used as a mask indicating writable fields for the idreg.
2773  * Only bits with 1 are writable from userspace. This mask might not be
2774  * necessary in the future whenever all ID registers are enabled as writable
2775  * from userspace.
2776  */
2777 
2778 #define ID_DESC_DEFAULT_CALLBACKS		\
2779 	.access	= access_id_reg,		\
2780 	.get_user = get_id_reg,			\
2781 	.set_user = set_id_reg,			\
2782 	.visibility = id_visibility,		\
2783 	.reset = kvm_read_sanitised_id_reg
2784 
2785 #define ID_DESC(name)				\
2786 	SYS_DESC(SYS_##name),			\
2787 	ID_DESC_DEFAULT_CALLBACKS
2788 
2789 /* sys_reg_desc initialiser for known cpufeature ID registers */
2790 #define ID_SANITISED(name) {			\
2791 	ID_DESC(name),				\
2792 	.val = 0,				\
2793 }
2794 
2795 /* sys_reg_desc initialiser for writable ID registers */
2796 #define ID_WRITABLE(name, mask) {		\
2797 	ID_DESC(name),				\
2798 	.val = mask,				\
2799 }
2800 
2801 /*
2802  * 32bit ID regs are fully writable when the guest is 32bit
2803  * capable. Nothing in the KVM code should rely on 32bit features
2804  * anyway, only 64bit, so let the VMM do its worse.
2805  */
2806 #define AA32_ID_WRITABLE(name) {		\
2807 	ID_DESC(name),				\
2808 	.visibility = aa32_id_visibility,	\
2809 	.val = GENMASK(31, 0),			\
2810 }
2811 
2812 /* sys_reg_desc initialiser for cpufeature ID registers that need filtering */
2813 #define ID_FILTERED(sysreg, name, mask) {	\
2814 	ID_DESC(sysreg),				\
2815 	.set_user = set_##name,				\
2816 	.val = (mask),					\
2817 }
2818 
2819 /*
2820  * sys_reg_desc initialiser for architecturally unallocated cpufeature ID
2821  * register with encoding Op0=3, Op1=0, CRn=0, CRm=crm, Op2=op2
2822  * (1 <= crm < 8, 0 <= Op2 < 8).
2823  */
2824 #define ID_UNALLOCATED(crm, op2) {			\
2825 	.name = "S3_0_0_" #crm "_" #op2,		\
2826 	Op0(3), Op1(0), CRn(0), CRm(crm), Op2(op2),	\
2827 	ID_DESC_DEFAULT_CALLBACKS,			\
2828 	.visibility = raz_visibility,			\
2829 	.val = 0,					\
2830 }
2831 
2832 /*
2833  * sys_reg_desc initialiser for known ID registers that we hide from guests.
2834  * For now, these are exposed just like unallocated ID regs: they appear
2835  * RAZ for the guest.
2836  */
2837 #define ID_HIDDEN(name) {			\
2838 	ID_DESC(name),				\
2839 	.visibility = raz_visibility,		\
2840 	.val = 0,				\
2841 }
2842 
2843 static bool access_sp_el1(struct kvm_vcpu *vcpu,
2844 			  struct sys_reg_params *p,
2845 			  const struct sys_reg_desc *r)
2846 {
2847 	if (p->is_write)
2848 		__vcpu_assign_sys_reg(vcpu, SP_EL1, p->regval);
2849 	else
2850 		p->regval = __vcpu_sys_reg(vcpu, SP_EL1);
2851 
2852 	return true;
2853 }
2854 
2855 static bool access_elr(struct kvm_vcpu *vcpu,
2856 		       struct sys_reg_params *p,
2857 		       const struct sys_reg_desc *r)
2858 {
2859 	if (p->is_write)
2860 		vcpu_write_sys_reg(vcpu, p->regval, ELR_EL1);
2861 	else
2862 		p->regval = vcpu_read_sys_reg(vcpu, ELR_EL1);
2863 
2864 	return true;
2865 }
2866 
2867 static bool access_spsr(struct kvm_vcpu *vcpu,
2868 			struct sys_reg_params *p,
2869 			const struct sys_reg_desc *r)
2870 {
2871 	if (p->is_write)
2872 		__vcpu_assign_sys_reg(vcpu, SPSR_EL1, p->regval);
2873 	else
2874 		p->regval = __vcpu_sys_reg(vcpu, SPSR_EL1);
2875 
2876 	return true;
2877 }
2878 
2879 static bool access_cntkctl_el12(struct kvm_vcpu *vcpu,
2880 				struct sys_reg_params *p,
2881 				const struct sys_reg_desc *r)
2882 {
2883 	if (p->is_write)
2884 		__vcpu_assign_sys_reg(vcpu, CNTKCTL_EL1, p->regval);
2885 	else
2886 		p->regval = __vcpu_sys_reg(vcpu, CNTKCTL_EL1);
2887 
2888 	return true;
2889 }
2890 
2891 static u64 reset_hcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
2892 {
2893 	u64 val = r->val;
2894 
2895 	if (!cpus_have_final_cap(ARM64_HAS_HCR_NV1))
2896 		val |= HCR_E2H;
2897 
2898 	__vcpu_assign_sys_reg(vcpu, r->reg, val);
2899 
2900 	return __vcpu_sys_reg(vcpu, r->reg);
2901 }
2902 
2903 static unsigned int __el2_visibility(const struct kvm_vcpu *vcpu,
2904 				     const struct sys_reg_desc *rd,
2905 				     unsigned int (*fn)(const struct kvm_vcpu *,
2906 							const struct sys_reg_desc *))
2907 {
2908 	return el2_visibility(vcpu, rd) ?: fn(vcpu, rd);
2909 }
2910 
2911 static unsigned int sve_el2_visibility(const struct kvm_vcpu *vcpu,
2912 				       const struct sys_reg_desc *rd)
2913 {
2914 	return __el2_visibility(vcpu, rd, sve_visibility);
2915 }
2916 
2917 static unsigned int vncr_el2_visibility(const struct kvm_vcpu *vcpu,
2918 					const struct sys_reg_desc *rd)
2919 {
2920 	if (el2_visibility(vcpu, rd) == 0 &&
2921 	    kvm_has_feat(vcpu->kvm, ID_AA64MMFR4_EL1, NV_frac, NV2_ONLY))
2922 		return 0;
2923 
2924 	return REG_HIDDEN;
2925 }
2926 
2927 static unsigned int nvhcr_el2_visibility(const struct kvm_vcpu *vcpu,
2928 					const struct sys_reg_desc *rd)
2929 {
2930 	if (el2_visibility(vcpu, rd) == 0 &&
2931 	    kvm_has_feat(vcpu->kvm, ID_AA64MMFR4_EL1, NV_frac, NV3))
2932 		return 0;
2933 
2934 	return REG_HIDDEN;
2935 }
2936 
2937 static unsigned int sctlr2_visibility(const struct kvm_vcpu *vcpu,
2938 				      const struct sys_reg_desc *rd)
2939 {
2940 	if (kvm_has_sctlr2(vcpu->kvm))
2941 		return 0;
2942 
2943 	return REG_HIDDEN;
2944 }
2945 
2946 static unsigned int sctlr2_el2_visibility(const struct kvm_vcpu *vcpu,
2947 					  const struct sys_reg_desc *rd)
2948 {
2949 	return __el2_visibility(vcpu, rd, sctlr2_visibility);
2950 }
2951 
2952 static bool access_zcr_el2(struct kvm_vcpu *vcpu,
2953 			   struct sys_reg_params *p,
2954 			   const struct sys_reg_desc *r)
2955 {
2956 	if (guest_hyp_sve_traps_enabled(vcpu)) {
2957 		kvm_inject_nested_sve_trap(vcpu);
2958 		return false;
2959 	}
2960 
2961 	if (!p->is_write)
2962 		p->regval = __vcpu_sys_reg(vcpu, ZCR_EL2);
2963 	else
2964 		__vcpu_assign_sys_reg(vcpu, ZCR_EL2, p->regval);
2965 
2966 	return true;
2967 }
2968 
2969 static bool access_gic_vtr(struct kvm_vcpu *vcpu,
2970 			   struct sys_reg_params *p,
2971 			   const struct sys_reg_desc *r)
2972 {
2973 	if (p->is_write)
2974 		return write_to_read_only(vcpu, p, r);
2975 
2976 	p->regval = kvm_get_guest_vtr_el2();
2977 
2978 	return true;
2979 }
2980 
2981 static bool access_gic_misr(struct kvm_vcpu *vcpu,
2982 			    struct sys_reg_params *p,
2983 			    const struct sys_reg_desc *r)
2984 {
2985 	if (p->is_write)
2986 		return write_to_read_only(vcpu, p, r);
2987 
2988 	p->regval = vgic_v3_get_misr(vcpu);
2989 
2990 	return true;
2991 }
2992 
2993 static bool access_gic_eisr(struct kvm_vcpu *vcpu,
2994 			    struct sys_reg_params *p,
2995 			    const struct sys_reg_desc *r)
2996 {
2997 	if (p->is_write)
2998 		return write_to_read_only(vcpu, p, r);
2999 
3000 	p->regval = vgic_v3_get_eisr(vcpu);
3001 
3002 	return true;
3003 }
3004 
3005 static bool access_gic_elrsr(struct kvm_vcpu *vcpu,
3006 			     struct sys_reg_params *p,
3007 			     const struct sys_reg_desc *r)
3008 {
3009 	if (p->is_write)
3010 		return write_to_read_only(vcpu, p, r);
3011 
3012 	p->regval = vgic_v3_get_elrsr(vcpu);
3013 
3014 	return true;
3015 }
3016 
3017 static unsigned int s1poe_visibility(const struct kvm_vcpu *vcpu,
3018 				     const struct sys_reg_desc *rd)
3019 {
3020 	if (kvm_has_s1poe(vcpu->kvm))
3021 		return 0;
3022 
3023 	return REG_HIDDEN;
3024 }
3025 
3026 static unsigned int s1poe_el2_visibility(const struct kvm_vcpu *vcpu,
3027 					 const struct sys_reg_desc *rd)
3028 {
3029 	return __el2_visibility(vcpu, rd, s1poe_visibility);
3030 }
3031 
3032 static unsigned int tcr2_visibility(const struct kvm_vcpu *vcpu,
3033 				    const struct sys_reg_desc *rd)
3034 {
3035 	if (kvm_has_tcr2(vcpu->kvm))
3036 		return 0;
3037 
3038 	return REG_HIDDEN;
3039 }
3040 
3041 static unsigned int tcr2_el2_visibility(const struct kvm_vcpu *vcpu,
3042 				    const struct sys_reg_desc *rd)
3043 {
3044 	return __el2_visibility(vcpu, rd, tcr2_visibility);
3045 }
3046 
3047 static unsigned int fgt2_visibility(const struct kvm_vcpu *vcpu,
3048 				    const struct sys_reg_desc *rd)
3049 {
3050 	if (el2_visibility(vcpu, rd) == 0 &&
3051 	    kvm_has_feat(vcpu->kvm, ID_AA64MMFR0_EL1, FGT, FGT2))
3052 		return 0;
3053 
3054 	return REG_HIDDEN;
3055 }
3056 
3057 static unsigned int fgt_visibility(const struct kvm_vcpu *vcpu,
3058 				   const struct sys_reg_desc *rd)
3059 {
3060 	if (el2_visibility(vcpu, rd) == 0 &&
3061 	    kvm_has_feat(vcpu->kvm, ID_AA64MMFR0_EL1, FGT, IMP))
3062 		return 0;
3063 
3064 	return REG_HIDDEN;
3065 }
3066 
3067 static unsigned int s1pie_visibility(const struct kvm_vcpu *vcpu,
3068 				     const struct sys_reg_desc *rd)
3069 {
3070 	if (kvm_has_s1pie(vcpu->kvm))
3071 		return 0;
3072 
3073 	return REG_HIDDEN;
3074 }
3075 
3076 static unsigned int s1pie_el2_visibility(const struct kvm_vcpu *vcpu,
3077 					 const struct sys_reg_desc *rd)
3078 {
3079 	return __el2_visibility(vcpu, rd, s1pie_visibility);
3080 }
3081 
3082 static unsigned int cnthv_visibility(const struct kvm_vcpu *vcpu,
3083 				     const struct sys_reg_desc *rd)
3084 {
3085 	if (vcpu_has_nv(vcpu) &&
3086 	    !vcpu_has_feature(vcpu, KVM_ARM_VCPU_HAS_EL2_E2H0))
3087 		return 0;
3088 
3089 	return REG_HIDDEN;
3090 }
3091 
3092 static bool access_mdcr(struct kvm_vcpu *vcpu,
3093 			struct sys_reg_params *p,
3094 			const struct sys_reg_desc *r)
3095 {
3096 	u64 hpmn, val, old = __vcpu_sys_reg(vcpu, MDCR_EL2);
3097 
3098 	if (!p->is_write) {
3099 		p->regval = old;
3100 		return true;
3101 	}
3102 
3103 	val = p->regval;
3104 	hpmn = FIELD_GET(MDCR_EL2_HPMN, val);
3105 
3106 	/*
3107 	 * If HPMN is out of bounds, limit it to what we actually
3108 	 * support. This matches the UNKNOWN definition of the field
3109 	 * in that case, and keeps the emulation simple. Sort of.
3110 	 */
3111 	if (hpmn > vcpu->kvm->arch.nr_pmu_counters) {
3112 		hpmn = vcpu->kvm->arch.nr_pmu_counters;
3113 		u64p_replace_bits(&val, hpmn, MDCR_EL2_HPMN);
3114 	}
3115 
3116 	__vcpu_assign_sys_reg(vcpu, MDCR_EL2, val);
3117 
3118 	/*
3119 	 * Request a reload of the PMU to enable/disable the counters
3120 	 * affected by HPME.
3121 	 */
3122 	if ((old ^ val) & MDCR_EL2_HPME)
3123 		kvm_make_request(KVM_REQ_RELOAD_PMU, vcpu);
3124 
3125 	return true;
3126 }
3127 
3128 static bool access_ras(struct kvm_vcpu *vcpu,
3129 		       struct sys_reg_params *p,
3130 		       const struct sys_reg_desc *r)
3131 {
3132 	struct kvm *kvm = vcpu->kvm;
3133 
3134 	switch(reg_to_encoding(r)) {
3135 	case SYS_ERXPFGCDN_EL1:
3136 	case SYS_ERXPFGCTL_EL1:
3137 	case SYS_ERXPFGF_EL1:
3138 	case SYS_ERXMISC2_EL1:
3139 	case SYS_ERXMISC3_EL1:
3140 		if (!(kvm_has_feat(kvm, ID_AA64PFR0_EL1, RAS, V1P1) ||
3141 		      (kvm_has_feat_enum(kvm, ID_AA64PFR0_EL1, RAS, IMP) &&
3142 		       kvm_has_feat(kvm, ID_AA64PFR1_EL1, RAS_frac, RASv1p1)))) {
3143 			kvm_inject_undefined(vcpu);
3144 			return false;
3145 		}
3146 		break;
3147 	default:
3148 		if (!kvm_has_feat(kvm, ID_AA64PFR0_EL1, RAS, IMP)) {
3149 			kvm_inject_undefined(vcpu);
3150 			return false;
3151 		}
3152 	}
3153 
3154 	return trap_raz_wi(vcpu, p, r);
3155 }
3156 
3157 /*
3158  * For historical (ahem ABI) reasons, KVM treated MIDR_EL1, REVIDR_EL1, and
3159  * AIDR_EL1 as "invariant" registers, meaning userspace cannot change them.
3160  * The values made visible to userspace were the register values of the boot
3161  * CPU.
3162  *
3163  * At the same time, reads from these registers at EL1 previously were not
3164  * trapped, allowing the guest to read the actual hardware value. On big-little
3165  * machines, this means the VM can see different values depending on where a
3166  * given vCPU got scheduled.
3167  *
3168  * These registers are now trapped as collateral damage from SME, and what
3169  * follows attempts to give a user / guest view consistent with the existing
3170  * ABI.
3171  */
3172 static bool access_imp_id_reg(struct kvm_vcpu *vcpu,
3173 			      struct sys_reg_params *p,
3174 			      const struct sys_reg_desc *r)
3175 {
3176 	if (p->is_write)
3177 		return write_to_read_only(vcpu, p, r);
3178 
3179 	/*
3180 	 * Return the VM-scoped implementation ID register values if userspace
3181 	 * has made them writable.
3182 	 */
3183 	if (test_bit(KVM_ARCH_FLAG_WRITABLE_IMP_ID_REGS, &vcpu->kvm->arch.flags))
3184 		return access_id_reg(vcpu, p, r);
3185 
3186 	/*
3187 	 * Otherwise, fall back to the old behavior of returning the value of
3188 	 * the current CPU.
3189 	 */
3190 	switch (reg_to_encoding(r)) {
3191 	case SYS_REVIDR_EL1:
3192 		p->regval = read_sysreg(revidr_el1);
3193 		break;
3194 	case SYS_AIDR_EL1:
3195 		p->regval = read_sysreg(aidr_el1);
3196 		break;
3197 	default:
3198 		WARN_ON_ONCE(1);
3199 	}
3200 
3201 	return true;
3202 }
3203 
3204 static u64 __ro_after_init boot_cpu_midr_val;
3205 static u64 __ro_after_init boot_cpu_revidr_val;
3206 static u64 __ro_after_init boot_cpu_aidr_val;
3207 
3208 static void init_imp_id_regs(void)
3209 {
3210 	boot_cpu_midr_val = read_sysreg(midr_el1);
3211 	boot_cpu_revidr_val = read_sysreg(revidr_el1);
3212 	boot_cpu_aidr_val = read_sysreg(aidr_el1);
3213 }
3214 
3215 static u64 reset_imp_id_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
3216 {
3217 	switch (reg_to_encoding(r)) {
3218 	case SYS_MIDR_EL1:
3219 		return boot_cpu_midr_val;
3220 	case SYS_REVIDR_EL1:
3221 		return boot_cpu_revidr_val;
3222 	case SYS_AIDR_EL1:
3223 		return boot_cpu_aidr_val;
3224 	default:
3225 		KVM_BUG_ON(1, vcpu->kvm);
3226 		return 0;
3227 	}
3228 }
3229 
3230 static int set_imp_id_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r,
3231 			  u64 val)
3232 {
3233 	struct kvm *kvm = vcpu->kvm;
3234 	u64 expected;
3235 
3236 	guard(mutex)(&kvm->arch.config_lock);
3237 
3238 	expected = read_id_reg(vcpu, r);
3239 	if (expected == val)
3240 		return 0;
3241 
3242 	if (!test_bit(KVM_ARCH_FLAG_WRITABLE_IMP_ID_REGS, &kvm->arch.flags))
3243 		return -EINVAL;
3244 
3245 	/*
3246 	 * Once the VM has started the ID registers are immutable. Reject the
3247 	 * write if userspace tries to change it.
3248 	 */
3249 	if (kvm_vm_has_ran_once(kvm))
3250 		return -EBUSY;
3251 
3252 	/*
3253 	 * Any value is allowed for the implementation ID registers so long as
3254 	 * it is within the writable mask.
3255 	 */
3256 	if ((val & r->val) != val)
3257 		return -EINVAL;
3258 
3259 	kvm_set_vm_id_reg(kvm, reg_to_encoding(r), val);
3260 	return 0;
3261 }
3262 
3263 #define IMPLEMENTATION_ID(reg, mask) {			\
3264 	SYS_DESC(SYS_##reg),				\
3265 	.access = access_imp_id_reg,			\
3266 	.get_user = get_id_reg,				\
3267 	.set_user = set_imp_id_reg,			\
3268 	.reset = reset_imp_id_reg,			\
3269 	.val = mask,					\
3270 	}
3271 
3272 static u64 reset_mdcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
3273 {
3274 	__vcpu_assign_sys_reg(vcpu, r->reg, vcpu->kvm->arch.nr_pmu_counters);
3275 	return vcpu->kvm->arch.nr_pmu_counters;
3276 }
3277 
3278 /*
3279  * Architected system registers.
3280  * Important: Must be sorted ascending by Op0, Op1, CRn, CRm, Op2
3281  *
3282  * Debug handling: We do trap most, if not all debug related system
3283  * registers. The implementation is good enough to ensure that a guest
3284  * can use these with minimal performance degradation. The drawback is
3285  * that we don't implement any of the external debug architecture.
3286  * This should be revisited if we ever encounter a more demanding
3287  * guest...
3288  */
3289 static const struct sys_reg_desc sys_reg_descs[] = {
3290 	DBG_BCR_BVR_WCR_WVR_EL1(0),
3291 	DBG_BCR_BVR_WCR_WVR_EL1(1),
3292 	{ SYS_DESC(SYS_MDCCINT_EL1), trap_debug_regs, reset_val, MDCCINT_EL1, 0 },
3293 	{ SYS_DESC(SYS_MDSCR_EL1), trap_debug_regs, reset_val, MDSCR_EL1, 0 },
3294 	DBG_BCR_BVR_WCR_WVR_EL1(2),
3295 	DBG_BCR_BVR_WCR_WVR_EL1(3),
3296 	DBG_BCR_BVR_WCR_WVR_EL1(4),
3297 	DBG_BCR_BVR_WCR_WVR_EL1(5),
3298 	DBG_BCR_BVR_WCR_WVR_EL1(6),
3299 	DBG_BCR_BVR_WCR_WVR_EL1(7),
3300 	DBG_BCR_BVR_WCR_WVR_EL1(8),
3301 	DBG_BCR_BVR_WCR_WVR_EL1(9),
3302 	DBG_BCR_BVR_WCR_WVR_EL1(10),
3303 	DBG_BCR_BVR_WCR_WVR_EL1(11),
3304 	DBG_BCR_BVR_WCR_WVR_EL1(12),
3305 	DBG_BCR_BVR_WCR_WVR_EL1(13),
3306 	DBG_BCR_BVR_WCR_WVR_EL1(14),
3307 	DBG_BCR_BVR_WCR_WVR_EL1(15),
3308 
3309 	{ SYS_DESC(SYS_MDRAR_EL1), trap_raz_wi },
3310 	{ SYS_DESC(SYS_OSLAR_EL1), trap_oslar_el1 },
3311 	{ SYS_DESC(SYS_OSLSR_EL1), trap_oslsr_el1, reset_val, OSLSR_EL1,
3312 		OSLSR_EL1_OSLM_IMPLEMENTED, .set_user = set_oslsr_el1, },
3313 	{ SYS_DESC(SYS_OSDLR_EL1), trap_raz_wi },
3314 	{ SYS_DESC(SYS_DBGPRCR_EL1), trap_raz_wi },
3315 	{ SYS_DESC(SYS_DBGCLAIMSET_EL1), trap_raz_wi },
3316 	{ SYS_DESC(SYS_DBGCLAIMCLR_EL1), trap_raz_wi },
3317 	{ SYS_DESC(SYS_DBGAUTHSTATUS_EL1), trap_dbgauthstatus_el1 },
3318 
3319 	{ SYS_DESC(SYS_MDCCSR_EL0), trap_raz_wi },
3320 	{ SYS_DESC(SYS_DBGDTR_EL0), trap_raz_wi },
3321 	// DBGDTR[TR]X_EL0 share the same encoding
3322 	{ SYS_DESC(SYS_DBGDTRTX_EL0), trap_raz_wi },
3323 
3324 	{ SYS_DESC(SYS_DBGVCR32_EL2), undef_access, reset_val, DBGVCR32_EL2, 0 },
3325 
3326 	IMPLEMENTATION_ID(MIDR_EL1, GENMASK_ULL(31, 0)),
3327 	{ SYS_DESC(SYS_MPIDR_EL1), NULL, reset_mpidr, MPIDR_EL1 },
3328 	IMPLEMENTATION_ID(REVIDR_EL1, GENMASK_ULL(63, 0)),
3329 
3330 	/*
3331 	 * ID regs: all ID_SANITISED() entries here must have corresponding
3332 	 * entries in arm64_ftr_regs[].
3333 	 */
3334 
3335 	/* AArch64 mappings of the AArch32 ID registers */
3336 	/* CRm=1 */
3337 	AA32_ID_WRITABLE(ID_PFR0_EL1),
3338 	AA32_ID_WRITABLE(ID_PFR1_EL1),
3339 	{ SYS_DESC(SYS_ID_DFR0_EL1),
3340 	  .access = access_id_reg,
3341 	  .get_user = get_id_reg,
3342 	  .set_user = set_id_dfr0_el1,
3343 	  .visibility = aa32_id_visibility,
3344 	  .reset = read_sanitised_id_dfr0_el1,
3345 	  .val = GENMASK(31, 0) },
3346 	ID_HIDDEN(ID_AFR0_EL1),
3347 	AA32_ID_WRITABLE(ID_MMFR0_EL1),
3348 	AA32_ID_WRITABLE(ID_MMFR1_EL1),
3349 	AA32_ID_WRITABLE(ID_MMFR2_EL1),
3350 	AA32_ID_WRITABLE(ID_MMFR3_EL1),
3351 
3352 	/* CRm=2 */
3353 	AA32_ID_WRITABLE(ID_ISAR0_EL1),
3354 	AA32_ID_WRITABLE(ID_ISAR1_EL1),
3355 	AA32_ID_WRITABLE(ID_ISAR2_EL1),
3356 	AA32_ID_WRITABLE(ID_ISAR3_EL1),
3357 	AA32_ID_WRITABLE(ID_ISAR4_EL1),
3358 	AA32_ID_WRITABLE(ID_ISAR5_EL1),
3359 	AA32_ID_WRITABLE(ID_MMFR4_EL1),
3360 	AA32_ID_WRITABLE(ID_ISAR6_EL1),
3361 
3362 	/* CRm=3 */
3363 	AA32_ID_WRITABLE(MVFR0_EL1),
3364 	AA32_ID_WRITABLE(MVFR1_EL1),
3365 	AA32_ID_WRITABLE(MVFR2_EL1),
3366 	ID_UNALLOCATED(3,3),
3367 	AA32_ID_WRITABLE(ID_PFR2_EL1),
3368 	ID_HIDDEN(ID_DFR1_EL1),
3369 	AA32_ID_WRITABLE(ID_MMFR5_EL1),
3370 	ID_UNALLOCATED(3,7),
3371 
3372 	/* AArch64 ID registers */
3373 	/* CRm=4 */
3374 	ID_FILTERED(ID_AA64PFR0_EL1, id_aa64pfr0_el1,
3375 		    ~(ID_AA64PFR0_EL1_AMU |
3376 		      ID_AA64PFR0_EL1_MPAM |
3377 		      ID_AA64PFR0_EL1_SVE |
3378 		      ID_AA64PFR0_EL1_AdvSIMD |
3379 		      ID_AA64PFR0_EL1_FP)),
3380 	ID_FILTERED(ID_AA64PFR1_EL1, id_aa64pfr1_el1,
3381 				     ~(ID_AA64PFR1_EL1_PFAR |
3382 				       ID_AA64PFR1_EL1_MTEX |
3383 				       ID_AA64PFR1_EL1_THE |
3384 				       ID_AA64PFR1_EL1_GCS |
3385 				       ID_AA64PFR1_EL1_MTE_frac |
3386 				       ID_AA64PFR1_EL1_NMI |
3387 				       ID_AA64PFR1_EL1_RNDR_trap |
3388 				       ID_AA64PFR1_EL1_SME |
3389 				       ID_AA64PFR1_EL1_RES0 |
3390 				       ID_AA64PFR1_EL1_MPAM_frac |
3391 				       ID_AA64PFR1_EL1_MTE)),
3392 	ID_FILTERED(ID_AA64PFR2_EL1, id_aa64pfr2_el1,
3393 		    (ID_AA64PFR2_EL1_FPMR		|
3394 		     ID_AA64PFR2_EL1_MTEFAR		|
3395 		     ID_AA64PFR2_EL1_MTESTOREONLY	|
3396 		     ID_AA64PFR2_EL1_GCIE)),
3397 	ID_UNALLOCATED(4,3),
3398 	ID_WRITABLE(ID_AA64ZFR0_EL1, ~ID_AA64ZFR0_EL1_RES0),
3399 	ID_HIDDEN(ID_AA64SMFR0_EL1),
3400 	ID_UNALLOCATED(4,6),
3401 	ID_WRITABLE(ID_AA64FPFR0_EL1, ~ID_AA64FPFR0_EL1_RES0),
3402 
3403 	/* CRm=5 */
3404 	/*
3405 	 * Prior to FEAT_Debugv8.9, the architecture defines context-aware
3406 	 * breakpoints (CTX_CMPs) as the highest numbered breakpoints (BRPs).
3407 	 * KVM does not trap + emulate the breakpoint registers, and as such
3408 	 * cannot support a layout that misaligns with the underlying hardware.
3409 	 * While it may be possible to describe a subset that aligns with
3410 	 * hardware, just prevent changes to BRPs and CTX_CMPs altogether for
3411 	 * simplicity.
3412 	 *
3413 	 * See DDI0487K.a, section D2.8.3 Breakpoint types and linking
3414 	 * of breakpoints for more details.
3415 	 */
3416 	ID_FILTERED(ID_AA64DFR0_EL1, id_aa64dfr0_el1,
3417 		    ID_AA64DFR0_EL1_DoubleLock_MASK |
3418 		    ID_AA64DFR0_EL1_WRPs_MASK |
3419 		    ID_AA64DFR0_EL1_PMUVer_MASK |
3420 		    ID_AA64DFR0_EL1_DebugVer_MASK),
3421 	ID_SANITISED(ID_AA64DFR1_EL1),
3422 	ID_UNALLOCATED(5,2),
3423 	ID_UNALLOCATED(5,3),
3424 	ID_HIDDEN(ID_AA64AFR0_EL1),
3425 	ID_HIDDEN(ID_AA64AFR1_EL1),
3426 	ID_UNALLOCATED(5,6),
3427 	ID_UNALLOCATED(5,7),
3428 
3429 	/* CRm=6 */
3430 	ID_WRITABLE(ID_AA64ISAR0_EL1, ~ID_AA64ISAR0_EL1_RES0),
3431 	ID_WRITABLE(ID_AA64ISAR1_EL1, ~(ID_AA64ISAR1_EL1_GPI |
3432 					ID_AA64ISAR1_EL1_GPA |
3433 					ID_AA64ISAR1_EL1_API |
3434 					ID_AA64ISAR1_EL1_APA)),
3435 	ID_WRITABLE(ID_AA64ISAR2_EL1, ~(ID_AA64ISAR2_EL1_RES0 |
3436 					ID_AA64ISAR2_EL1_APA3 |
3437 					ID_AA64ISAR2_EL1_GPA3)),
3438 	ID_WRITABLE(ID_AA64ISAR3_EL1, (ID_AA64ISAR3_EL1_FPRCVT |
3439 				       ID_AA64ISAR3_EL1_LSFE |
3440 				       ID_AA64ISAR3_EL1_LSUI |
3441 				       ID_AA64ISAR3_EL1_FAMINMAX)),
3442 	ID_UNALLOCATED(6,4),
3443 	ID_UNALLOCATED(6,5),
3444 	ID_UNALLOCATED(6,6),
3445 	ID_UNALLOCATED(6,7),
3446 
3447 	/* CRm=7 */
3448 	ID_FILTERED(ID_AA64MMFR0_EL1, id_aa64mmfr0_el1,
3449 				      ~(ID_AA64MMFR0_EL1_RES0 |
3450 					ID_AA64MMFR0_EL1_ASIDBITS)),
3451 	ID_WRITABLE(ID_AA64MMFR1_EL1, ~(ID_AA64MMFR1_EL1_RES0 |
3452 					ID_AA64MMFR1_EL1_XNX |
3453 					ID_AA64MMFR1_EL1_VH |
3454 					ID_AA64MMFR1_EL1_VMIDBits)),
3455 	ID_FILTERED(ID_AA64MMFR2_EL1,
3456 		    id_aa64mmfr2_el1, ~(ID_AA64MMFR2_EL1_RES0 |
3457 					ID_AA64MMFR2_EL1_EVT |
3458 					ID_AA64MMFR2_EL1_FWB |
3459 					ID_AA64MMFR2_EL1_IDS |
3460 					ID_AA64MMFR2_EL1_NV |
3461 					ID_AA64MMFR2_EL1_CCIDX)),
3462 	ID_WRITABLE(ID_AA64MMFR3_EL1, (ID_AA64MMFR3_EL1_TCRX	|
3463 				       ID_AA64MMFR3_EL1_SCTLRX	|
3464 				       ID_AA64MMFR3_EL1_S1PIE   |
3465 				       ID_AA64MMFR3_EL1_S1POE)),
3466 	ID_WRITABLE(ID_AA64MMFR4_EL1, ID_AA64MMFR4_EL1_NV_frac),
3467 	ID_UNALLOCATED(7,5),
3468 	ID_UNALLOCATED(7,6),
3469 	ID_UNALLOCATED(7,7),
3470 
3471 	{ SYS_DESC(SYS_SCTLR_EL1), access_vm_reg, reset_val, SCTLR_EL1, 0x00C50078 },
3472 	{ SYS_DESC(SYS_ACTLR_EL1), access_actlr, reset_actlr, ACTLR_EL1 },
3473 	{ SYS_DESC(SYS_CPACR_EL1), NULL, reset_val, CPACR_EL1, 0 },
3474 	{ SYS_DESC(SYS_SCTLR2_EL1), access_vm_reg, reset_val, SCTLR2_EL1, 0,
3475 	  .visibility = sctlr2_visibility },
3476 
3477 	MTE_REG(RGSR_EL1),
3478 	MTE_REG(GCR_EL1),
3479 
3480 	{ SYS_DESC(SYS_ZCR_EL1), NULL, reset_val, ZCR_EL1, 0, .visibility = sve_visibility },
3481 	{ SYS_DESC(SYS_TRFCR_EL1), undef_access },
3482 	{ SYS_DESC(SYS_SMPRI_EL1), undef_access },
3483 	{ SYS_DESC(SYS_SMCR_EL1), undef_access },
3484 	{ SYS_DESC(SYS_TTBR0_EL1), access_vm_reg, reset_unknown, TTBR0_EL1 },
3485 	{ SYS_DESC(SYS_TTBR1_EL1), access_vm_reg, reset_unknown, TTBR1_EL1 },
3486 	{ SYS_DESC(SYS_TCR_EL1), access_vm_reg, reset_val, TCR_EL1, 0 },
3487 	{ SYS_DESC(SYS_TCR2_EL1), access_vm_reg, reset_val, TCR2_EL1, 0,
3488 	  .visibility = tcr2_visibility },
3489 
3490 	PTRAUTH_KEY(APIA),
3491 	PTRAUTH_KEY(APIB),
3492 	PTRAUTH_KEY(APDA),
3493 	PTRAUTH_KEY(APDB),
3494 	PTRAUTH_KEY(APGA),
3495 
3496 	{ SYS_DESC(SYS_SPSR_EL1), access_spsr},
3497 	{ SYS_DESC(SYS_ELR_EL1), access_elr},
3498 
3499 	{ SYS_DESC(SYS_ICC_PMR_EL1), undef_access },
3500 
3501 	{ SYS_DESC(SYS_AFSR0_EL1), access_vm_reg, reset_unknown, AFSR0_EL1 },
3502 	{ SYS_DESC(SYS_AFSR1_EL1), access_vm_reg, reset_unknown, AFSR1_EL1 },
3503 	{ SYS_DESC(SYS_ESR_EL1), access_vm_reg, reset_unknown, ESR_EL1 },
3504 
3505 	{ SYS_DESC(SYS_ERRIDR_EL1), access_ras },
3506 	{ SYS_DESC(SYS_ERRSELR_EL1), access_ras },
3507 	{ SYS_DESC(SYS_ERXFR_EL1), access_ras },
3508 	{ SYS_DESC(SYS_ERXCTLR_EL1), access_ras },
3509 	{ SYS_DESC(SYS_ERXSTATUS_EL1), access_ras },
3510 	{ SYS_DESC(SYS_ERXADDR_EL1), access_ras },
3511 	{ SYS_DESC(SYS_ERXPFGF_EL1), access_ras },
3512 	{ SYS_DESC(SYS_ERXPFGCTL_EL1), access_ras },
3513 	{ SYS_DESC(SYS_ERXPFGCDN_EL1), access_ras },
3514 	{ SYS_DESC(SYS_ERXMISC0_EL1), access_ras },
3515 	{ SYS_DESC(SYS_ERXMISC1_EL1), access_ras },
3516 	{ SYS_DESC(SYS_ERXMISC2_EL1), access_ras },
3517 	{ SYS_DESC(SYS_ERXMISC3_EL1), access_ras },
3518 
3519 	MTE_REG(TFSR_EL1),
3520 	MTE_REG(TFSRE0_EL1),
3521 
3522 	{ SYS_DESC(SYS_FAR_EL1), access_vm_reg, reset_unknown, FAR_EL1 },
3523 	{ SYS_DESC(SYS_PAR_EL1), NULL, reset_unknown, PAR_EL1 },
3524 
3525 	{ SYS_DESC(SYS_PMSCR_EL1), undef_access },
3526 	{ SYS_DESC(SYS_PMSNEVFR_EL1), undef_access },
3527 	{ SYS_DESC(SYS_PMSICR_EL1), undef_access },
3528 	{ SYS_DESC(SYS_PMSIRR_EL1), undef_access },
3529 	{ SYS_DESC(SYS_PMSFCR_EL1), undef_access },
3530 	{ SYS_DESC(SYS_PMSEVFR_EL1), undef_access },
3531 	{ SYS_DESC(SYS_PMSLATFR_EL1), undef_access },
3532 	{ SYS_DESC(SYS_PMSIDR_EL1), undef_access },
3533 	{ SYS_DESC(SYS_PMBLIMITR_EL1), undef_access },
3534 	{ SYS_DESC(SYS_PMBPTR_EL1), undef_access },
3535 	{ SYS_DESC(SYS_PMBSR_EL1), undef_access },
3536 	{ SYS_DESC(SYS_PMSDSFR_EL1), undef_access },
3537 	/* PMBIDR_EL1 is not trapped */
3538 
3539 	{ PMU_SYS_REG(PMINTENSET_EL1),
3540 	  .access = access_pminten, .reg = PMINTENSET_EL1,
3541 	  .get_user = get_pmreg, .set_user = set_pmreg },
3542 	{ PMU_SYS_REG(PMINTENCLR_EL1),
3543 	  .access = access_pminten, .reg = PMINTENSET_EL1,
3544 	  .get_user = get_pmreg, .set_user = set_pmreg },
3545 	{ PMU_SYS_REG(PMMIR_EL1), .access = access_pmmir, .reset = NULL,
3546 	  .get_user = get_pmmir, .set_user = set_pmmir },
3547 
3548 	{ SYS_DESC(SYS_MAIR_EL1), access_vm_reg, reset_unknown, MAIR_EL1 },
3549 	{ SYS_DESC(SYS_PIRE0_EL1), NULL, reset_unknown, PIRE0_EL1,
3550 	  .visibility = s1pie_visibility },
3551 	{ SYS_DESC(SYS_PIR_EL1), NULL, reset_unknown, PIR_EL1,
3552 	  .visibility = s1pie_visibility },
3553 	{ SYS_DESC(SYS_POR_EL1), NULL, reset_unknown, POR_EL1,
3554 	  .visibility = s1poe_visibility },
3555 	{ SYS_DESC(SYS_AMAIR_EL1), access_vm_reg, reset_amair_el1, AMAIR_EL1 },
3556 
3557 	{ SYS_DESC(SYS_LORSA_EL1), trap_loregion },
3558 	{ SYS_DESC(SYS_LOREA_EL1), trap_loregion },
3559 	{ SYS_DESC(SYS_LORN_EL1), trap_loregion },
3560 	{ SYS_DESC(SYS_LORC_EL1), trap_loregion },
3561 	{ SYS_DESC(SYS_MPAMIDR_EL1), undef_access },
3562 	{ SYS_DESC(SYS_LORID_EL1), trap_loregion },
3563 
3564 	{ SYS_DESC(SYS_MPAM1_EL1), undef_access },
3565 	{ SYS_DESC(SYS_MPAM0_EL1), undef_access },
3566 	{ SYS_DESC(SYS_MPAMSM_EL1), undef_access },
3567 
3568 	{ SYS_DESC(SYS_VBAR_EL1), access_rw, reset_val, VBAR_EL1, 0 },
3569 	{ SYS_DESC(SYS_DISR_EL1), NULL, reset_val, DISR_EL1, 0 },
3570 
3571 	{ SYS_DESC(SYS_ICC_IAR0_EL1), undef_access },
3572 	{ SYS_DESC(SYS_ICC_EOIR0_EL1), undef_access },
3573 	{ SYS_DESC(SYS_ICC_HPPIR0_EL1), undef_access },
3574 	{ SYS_DESC(SYS_ICC_BPR0_EL1), undef_access },
3575 	{ SYS_DESC(SYS_ICC_AP0R0_EL1), undef_access },
3576 	{ SYS_DESC(SYS_ICC_AP0R1_EL1), undef_access },
3577 	{ SYS_DESC(SYS_ICC_AP0R2_EL1), undef_access },
3578 	{ SYS_DESC(SYS_ICC_AP0R3_EL1), undef_access },
3579 	{ SYS_DESC(SYS_ICC_AP1R0_EL1), undef_access },
3580 	{ SYS_DESC(SYS_ICC_AP1R1_EL1), undef_access },
3581 	{ SYS_DESC(SYS_ICC_AP1R2_EL1), undef_access },
3582 	{ SYS_DESC(SYS_ICC_AP1R3_EL1), undef_access },
3583 	{ SYS_DESC(SYS_ICC_IDR0_EL1), access_gicv5_idr0 },
3584 	{ SYS_DESC(SYS_ICC_IAFFIDR_EL1), access_gicv5_iaffid },
3585 	{ SYS_DESC(SYS_ICC_PPI_ENABLER0_EL1), access_gicv5_ppi_enabler },
3586 	{ SYS_DESC(SYS_ICC_PPI_ENABLER1_EL1), access_gicv5_ppi_enabler },
3587 	{ SYS_DESC(SYS_ICC_DIR_EL1), access_gic_dir },
3588 	{ SYS_DESC(SYS_ICC_RPR_EL1), undef_access },
3589 	{ SYS_DESC(SYS_ICC_SGI1R_EL1), access_gic_sgi },
3590 	{ SYS_DESC(SYS_ICC_ASGI1R_EL1), access_gic_sgi },
3591 	{ SYS_DESC(SYS_ICC_SGI0R_EL1), access_gic_sgi },
3592 	{ SYS_DESC(SYS_ICC_IAR1_EL1), undef_access },
3593 	{ SYS_DESC(SYS_ICC_EOIR1_EL1), undef_access },
3594 	{ SYS_DESC(SYS_ICC_HPPIR1_EL1), undef_access },
3595 	{ SYS_DESC(SYS_ICC_BPR1_EL1), undef_access },
3596 	{ SYS_DESC(SYS_ICC_CTLR_EL1), undef_access },
3597 	{ SYS_DESC(SYS_ICC_SRE_EL1), access_gic_sre },
3598 	{ SYS_DESC(SYS_ICC_IGRPEN0_EL1), undef_access },
3599 	{ SYS_DESC(SYS_ICC_IGRPEN1_EL1), undef_access },
3600 
3601 	{ SYS_DESC(SYS_CONTEXTIDR_EL1), access_vm_reg, reset_val, CONTEXTIDR_EL1, 0 },
3602 	{ SYS_DESC(SYS_TPIDR_EL1), NULL, reset_unknown, TPIDR_EL1 },
3603 
3604 	{ SYS_DESC(SYS_ACCDATA_EL1), undef_access },
3605 
3606 	{ SYS_DESC(SYS_SCXTNUM_EL1), undef_access },
3607 
3608 	{ SYS_DESC(SYS_CNTKCTL_EL1), NULL, reset_val, CNTKCTL_EL1, 0},
3609 
3610 	{ SYS_DESC(SYS_CCSIDR_EL1), access_ccsidr },
3611 	{ SYS_DESC(SYS_CLIDR_EL1), access_clidr, reset_clidr, CLIDR_EL1,
3612 	  .set_user = set_clidr, .val = ~CLIDR_EL1_RES0 },
3613 	IMPLEMENTATION_ID(AIDR_EL1, GENMASK_ULL(63, 0)),
3614 	{ SYS_DESC(SYS_CSSELR_EL1), access_csselr, reset_unknown, CSSELR_EL1 },
3615 	ID_FILTERED(CTR_EL0, ctr_el0,
3616 		    CTR_EL0_DIC_MASK |
3617 		    CTR_EL0_IDC_MASK |
3618 		    CTR_EL0_DminLine_MASK |
3619 		    CTR_EL0_L1Ip_MASK |
3620 		    CTR_EL0_IminLine_MASK),
3621 	{ SYS_DESC(SYS_SVCR), undef_access, reset_val, SVCR, 0, .visibility = sme_visibility  },
3622 	{ SYS_DESC(SYS_FPMR), undef_access, reset_val, FPMR, 0, .visibility = fp8_visibility },
3623 
3624 	{ PMU_SYS_REG(PMCR_EL0), .access = access_pmcr, .reset = reset_pmcr,
3625 	  .reg = PMCR_EL0, .get_user = get_pmcr, .set_user = set_pmcr },
3626 	{ PMU_SYS_REG(PMCNTENSET_EL0),
3627 	  .access = access_pmcnten, .reg = PMCNTENSET_EL0,
3628 	  .get_user = get_pmreg, .set_user = set_pmreg },
3629 	{ PMU_SYS_REG(PMCNTENCLR_EL0),
3630 	  .access = access_pmcnten, .reg = PMCNTENSET_EL0,
3631 	  .get_user = get_pmreg, .set_user = set_pmreg },
3632 	{ PMU_SYS_REG(PMOVSCLR_EL0),
3633 	  .access = access_pmovs, .reg = PMOVSSET_EL0,
3634 	  .get_user = get_pmreg, .set_user = set_pmreg },
3635 	/*
3636 	 * PM_SWINC_EL0 is exposed to userspace as RAZ/WI, as it was
3637 	 * previously (and pointlessly) advertised in the past...
3638 	 */
3639 	{ PMU_SYS_REG(PMSWINC_EL0),
3640 	  .get_user = get_raz_reg, .set_user = set_wi_reg,
3641 	  .access = access_pmswinc, .reset = NULL },
3642 	{ PMU_SYS_REG(PMSELR_EL0),
3643 	  .access = access_pmselr, .reset = reset_pmselr, .reg = PMSELR_EL0 },
3644 	{ PMU_SYS_REG(PMCEID0_EL0),
3645 	  .access = access_pmceid, .reset = NULL },
3646 	{ PMU_SYS_REG(PMCEID1_EL0),
3647 	  .access = access_pmceid, .reset = NULL },
3648 	{ PMU_SYS_REG(PMCCNTR_EL0),
3649 	  .access = access_pmu_evcntr, .reset = reset_unknown,
3650 	  .reg = PMCCNTR_EL0, .get_user = get_pmu_evcntr,
3651 	  .set_user = set_pmu_evcntr },
3652 	{ PMU_SYS_REG(PMXEVTYPER_EL0),
3653 	  .access = access_pmu_evtyper, .reset = NULL },
3654 	{ PMU_SYS_REG(PMXEVCNTR_EL0),
3655 	  .access = access_pmu_evcntr, .reset = NULL },
3656 	/*
3657 	 * PMUSERENR_EL0 resets as unknown in 64bit mode while it resets as zero
3658 	 * in 32bit mode. Here we choose to reset it as zero for consistency.
3659 	 */
3660 	{ PMU_SYS_REG(PMUSERENR_EL0), .access = access_pmuserenr,
3661 	  .reset = reset_val, .reg = PMUSERENR_EL0, .val = 0 },
3662 	{ PMU_SYS_REG(PMOVSSET_EL0),
3663 	  .access = access_pmovs, .reg = PMOVSSET_EL0,
3664 	  .get_user = get_pmreg, .set_user = set_pmreg },
3665 
3666 	{ SYS_DESC(SYS_POR_EL0), NULL, reset_unknown, POR_EL0,
3667 	  .visibility = s1poe_visibility },
3668 	{ SYS_DESC(SYS_TPIDR_EL0), NULL, reset_unknown, TPIDR_EL0 },
3669 	{ SYS_DESC(SYS_TPIDRRO_EL0), NULL, reset_unknown, TPIDRRO_EL0 },
3670 	{ SYS_DESC(SYS_TPIDR2_EL0), undef_access },
3671 
3672 	{ SYS_DESC(SYS_SCXTNUM_EL0), undef_access },
3673 
3674 	{ SYS_DESC(SYS_AMCR_EL0), undef_access },
3675 	{ SYS_DESC(SYS_AMCFGR_EL0), undef_access },
3676 	{ SYS_DESC(SYS_AMCGCR_EL0), undef_access },
3677 	{ SYS_DESC(SYS_AMUSERENR_EL0), undef_access },
3678 	{ SYS_DESC(SYS_AMCNTENCLR0_EL0), undef_access },
3679 	{ SYS_DESC(SYS_AMCNTENSET0_EL0), undef_access },
3680 	{ SYS_DESC(SYS_AMCNTENCLR1_EL0), undef_access },
3681 	{ SYS_DESC(SYS_AMCNTENSET1_EL0), undef_access },
3682 	AMU_AMEVCNTR0_EL0(0),
3683 	AMU_AMEVCNTR0_EL0(1),
3684 	AMU_AMEVCNTR0_EL0(2),
3685 	AMU_AMEVCNTR0_EL0(3),
3686 	AMU_AMEVCNTR0_EL0(4),
3687 	AMU_AMEVCNTR0_EL0(5),
3688 	AMU_AMEVCNTR0_EL0(6),
3689 	AMU_AMEVCNTR0_EL0(7),
3690 	AMU_AMEVCNTR0_EL0(8),
3691 	AMU_AMEVCNTR0_EL0(9),
3692 	AMU_AMEVCNTR0_EL0(10),
3693 	AMU_AMEVCNTR0_EL0(11),
3694 	AMU_AMEVCNTR0_EL0(12),
3695 	AMU_AMEVCNTR0_EL0(13),
3696 	AMU_AMEVCNTR0_EL0(14),
3697 	AMU_AMEVCNTR0_EL0(15),
3698 	AMU_AMEVTYPER0_EL0(0),
3699 	AMU_AMEVTYPER0_EL0(1),
3700 	AMU_AMEVTYPER0_EL0(2),
3701 	AMU_AMEVTYPER0_EL0(3),
3702 	AMU_AMEVTYPER0_EL0(4),
3703 	AMU_AMEVTYPER0_EL0(5),
3704 	AMU_AMEVTYPER0_EL0(6),
3705 	AMU_AMEVTYPER0_EL0(7),
3706 	AMU_AMEVTYPER0_EL0(8),
3707 	AMU_AMEVTYPER0_EL0(9),
3708 	AMU_AMEVTYPER0_EL0(10),
3709 	AMU_AMEVTYPER0_EL0(11),
3710 	AMU_AMEVTYPER0_EL0(12),
3711 	AMU_AMEVTYPER0_EL0(13),
3712 	AMU_AMEVTYPER0_EL0(14),
3713 	AMU_AMEVTYPER0_EL0(15),
3714 	AMU_AMEVCNTR1_EL0(0),
3715 	AMU_AMEVCNTR1_EL0(1),
3716 	AMU_AMEVCNTR1_EL0(2),
3717 	AMU_AMEVCNTR1_EL0(3),
3718 	AMU_AMEVCNTR1_EL0(4),
3719 	AMU_AMEVCNTR1_EL0(5),
3720 	AMU_AMEVCNTR1_EL0(6),
3721 	AMU_AMEVCNTR1_EL0(7),
3722 	AMU_AMEVCNTR1_EL0(8),
3723 	AMU_AMEVCNTR1_EL0(9),
3724 	AMU_AMEVCNTR1_EL0(10),
3725 	AMU_AMEVCNTR1_EL0(11),
3726 	AMU_AMEVCNTR1_EL0(12),
3727 	AMU_AMEVCNTR1_EL0(13),
3728 	AMU_AMEVCNTR1_EL0(14),
3729 	AMU_AMEVCNTR1_EL0(15),
3730 	AMU_AMEVTYPER1_EL0(0),
3731 	AMU_AMEVTYPER1_EL0(1),
3732 	AMU_AMEVTYPER1_EL0(2),
3733 	AMU_AMEVTYPER1_EL0(3),
3734 	AMU_AMEVTYPER1_EL0(4),
3735 	AMU_AMEVTYPER1_EL0(5),
3736 	AMU_AMEVTYPER1_EL0(6),
3737 	AMU_AMEVTYPER1_EL0(7),
3738 	AMU_AMEVTYPER1_EL0(8),
3739 	AMU_AMEVTYPER1_EL0(9),
3740 	AMU_AMEVTYPER1_EL0(10),
3741 	AMU_AMEVTYPER1_EL0(11),
3742 	AMU_AMEVTYPER1_EL0(12),
3743 	AMU_AMEVTYPER1_EL0(13),
3744 	AMU_AMEVTYPER1_EL0(14),
3745 	AMU_AMEVTYPER1_EL0(15),
3746 
3747 	{ SYS_DESC(SYS_CNTPCT_EL0), .access = access_arch_timer,
3748 	  .get_user = arch_timer_get_user, .set_user = arch_timer_set_user },
3749 	{ SYS_DESC(SYS_CNTVCT_EL0), .access = access_arch_timer,
3750 	  .get_user = arch_timer_get_user, .set_user = arch_timer_set_user },
3751 	{ SYS_DESC(SYS_CNTPCTSS_EL0), access_arch_timer },
3752 	{ SYS_DESC(SYS_CNTVCTSS_EL0), access_arch_timer },
3753 	{ SYS_DESC(SYS_CNTP_TVAL_EL0), access_arch_timer },
3754 	TIMER_REG(CNTP_CTL_EL0, NULL),
3755 	TIMER_REG(CNTP_CVAL_EL0, NULL),
3756 
3757 	{ SYS_DESC(SYS_CNTV_TVAL_EL0), access_arch_timer },
3758 	TIMER_REG(CNTV_CTL_EL0, NULL),
3759 	TIMER_REG(CNTV_CVAL_EL0, NULL),
3760 
3761 	/* PMEVCNTRn_EL0 */
3762 	PMU_PMEVCNTR_EL0(0),
3763 	PMU_PMEVCNTR_EL0(1),
3764 	PMU_PMEVCNTR_EL0(2),
3765 	PMU_PMEVCNTR_EL0(3),
3766 	PMU_PMEVCNTR_EL0(4),
3767 	PMU_PMEVCNTR_EL0(5),
3768 	PMU_PMEVCNTR_EL0(6),
3769 	PMU_PMEVCNTR_EL0(7),
3770 	PMU_PMEVCNTR_EL0(8),
3771 	PMU_PMEVCNTR_EL0(9),
3772 	PMU_PMEVCNTR_EL0(10),
3773 	PMU_PMEVCNTR_EL0(11),
3774 	PMU_PMEVCNTR_EL0(12),
3775 	PMU_PMEVCNTR_EL0(13),
3776 	PMU_PMEVCNTR_EL0(14),
3777 	PMU_PMEVCNTR_EL0(15),
3778 	PMU_PMEVCNTR_EL0(16),
3779 	PMU_PMEVCNTR_EL0(17),
3780 	PMU_PMEVCNTR_EL0(18),
3781 	PMU_PMEVCNTR_EL0(19),
3782 	PMU_PMEVCNTR_EL0(20),
3783 	PMU_PMEVCNTR_EL0(21),
3784 	PMU_PMEVCNTR_EL0(22),
3785 	PMU_PMEVCNTR_EL0(23),
3786 	PMU_PMEVCNTR_EL0(24),
3787 	PMU_PMEVCNTR_EL0(25),
3788 	PMU_PMEVCNTR_EL0(26),
3789 	PMU_PMEVCNTR_EL0(27),
3790 	PMU_PMEVCNTR_EL0(28),
3791 	PMU_PMEVCNTR_EL0(29),
3792 	PMU_PMEVCNTR_EL0(30),
3793 	/* PMEVTYPERn_EL0 */
3794 	PMU_PMEVTYPER_EL0(0),
3795 	PMU_PMEVTYPER_EL0(1),
3796 	PMU_PMEVTYPER_EL0(2),
3797 	PMU_PMEVTYPER_EL0(3),
3798 	PMU_PMEVTYPER_EL0(4),
3799 	PMU_PMEVTYPER_EL0(5),
3800 	PMU_PMEVTYPER_EL0(6),
3801 	PMU_PMEVTYPER_EL0(7),
3802 	PMU_PMEVTYPER_EL0(8),
3803 	PMU_PMEVTYPER_EL0(9),
3804 	PMU_PMEVTYPER_EL0(10),
3805 	PMU_PMEVTYPER_EL0(11),
3806 	PMU_PMEVTYPER_EL0(12),
3807 	PMU_PMEVTYPER_EL0(13),
3808 	PMU_PMEVTYPER_EL0(14),
3809 	PMU_PMEVTYPER_EL0(15),
3810 	PMU_PMEVTYPER_EL0(16),
3811 	PMU_PMEVTYPER_EL0(17),
3812 	PMU_PMEVTYPER_EL0(18),
3813 	PMU_PMEVTYPER_EL0(19),
3814 	PMU_PMEVTYPER_EL0(20),
3815 	PMU_PMEVTYPER_EL0(21),
3816 	PMU_PMEVTYPER_EL0(22),
3817 	PMU_PMEVTYPER_EL0(23),
3818 	PMU_PMEVTYPER_EL0(24),
3819 	PMU_PMEVTYPER_EL0(25),
3820 	PMU_PMEVTYPER_EL0(26),
3821 	PMU_PMEVTYPER_EL0(27),
3822 	PMU_PMEVTYPER_EL0(28),
3823 	PMU_PMEVTYPER_EL0(29),
3824 	PMU_PMEVTYPER_EL0(30),
3825 	/*
3826 	 * PMCCFILTR_EL0 resets as unknown in 64bit mode while it resets as zero
3827 	 * in 32bit mode. Here we choose to reset it as zero for consistency.
3828 	 */
3829 	{ PMU_SYS_REG(PMCCFILTR_EL0), .access = access_pmu_evtyper,
3830 	  .reset = reset_val, .reg = PMCCFILTR_EL0, .val = 0 },
3831 
3832 	EL2_REG_VNCR(VPIDR_EL2, reset_unknown, 0),
3833 	EL2_REG_VNCR(VMPIDR_EL2, reset_unknown, 0),
3834 	EL2_REG(SCTLR_EL2, access_rw, reset_val, SCTLR_EL2_RES1),
3835 	EL2_REG(ACTLR_EL2, access_rw, reset_val, 0),
3836 	EL2_REG_FILTERED(SCTLR2_EL2, access_vm_reg, reset_val, 0,
3837 			 sctlr2_el2_visibility),
3838 	EL2_REG_VNCR(HCR_EL2, reset_hcr, 0),
3839 	EL2_REG(MDCR_EL2, access_mdcr, reset_mdcr, 0),
3840 	EL2_REG(CPTR_EL2, access_rw, reset_val, CPTR_NVHE_EL2_RES1),
3841 	EL2_REG_VNCR(HSTR_EL2, reset_val, 0),
3842 	EL2_REG_VNCR_FILT(HFGRTR_EL2, fgt_visibility),
3843 	EL2_REG_VNCR_FILT(HFGWTR_EL2, fgt_visibility),
3844 	EL2_REG_VNCR(HFGITR_EL2, reset_val, 0),
3845 	EL2_REG_VNCR(HACR_EL2, reset_val, 0),
3846 
3847 	EL2_REG_FILTERED(ZCR_EL2, access_zcr_el2, reset_val, 0,
3848 			 sve_el2_visibility),
3849 
3850 	EL2_REG_VNCR(HCRX_EL2, reset_val, 0),
3851 	EL2_REG_FILTERED(NVHCR_EL2, undef_access, reset_val, 0,
3852 			 nvhcr_el2_visibility),
3853 
3854 	EL2_REG(TTBR0_EL2, access_rw, reset_val, 0),
3855 	EL2_REG(TTBR1_EL2, access_rw, reset_val, 0),
3856 	EL2_REG(TCR_EL2, access_rw, reset_val, TCR_EL2_RES1),
3857 	EL2_REG_FILTERED(TCR2_EL2, access_rw, reset_val, TCR2_EL2_RES1,
3858 			 tcr2_el2_visibility),
3859 	EL2_REG_VNCR(VTTBR_EL2, reset_val, 0),
3860 	EL2_REG_VNCR(VTCR_EL2, reset_val, 0),
3861 	EL2_REG_FILTERED(VNCR_EL2, bad_vncr_trap, reset_val, 0,
3862 			 vncr_el2_visibility),
3863 
3864 	{ SYS_DESC(SYS_DACR32_EL2), undef_access, reset_unknown, DACR32_EL2 },
3865 	EL2_REG_VNCR_FILT(HDFGRTR2_EL2, fgt2_visibility),
3866 	EL2_REG_VNCR_FILT(HDFGWTR2_EL2, fgt2_visibility),
3867 	EL2_REG_VNCR_FILT(HFGRTR2_EL2, fgt2_visibility),
3868 	EL2_REG_VNCR_FILT(HFGWTR2_EL2, fgt2_visibility),
3869 	EL2_REG_VNCR_FILT(HDFGRTR_EL2, fgt_visibility),
3870 	EL2_REG_VNCR_FILT(HDFGWTR_EL2, fgt_visibility),
3871 	EL2_REG_VNCR_FILT(HAFGRTR_EL2, fgt_visibility),
3872 	EL2_REG_VNCR_FILT(HFGITR2_EL2, fgt2_visibility),
3873 	EL2_REG_REDIR(SPSR_EL2, reset_val, 0),
3874 	EL2_REG_REDIR(ELR_EL2, reset_val, 0),
3875 	{ SYS_DESC(SYS_SP_EL1), access_sp_el1},
3876 
3877 	/* AArch32 SPSR_* are RES0 if trapped from a NV guest */
3878 	{ SYS_DESC(SYS_SPSR_irq), .access = trap_raz_wi },
3879 	{ SYS_DESC(SYS_SPSR_abt), .access = trap_raz_wi },
3880 	{ SYS_DESC(SYS_SPSR_und), .access = trap_raz_wi },
3881 	{ SYS_DESC(SYS_SPSR_fiq), .access = trap_raz_wi },
3882 
3883 	{ SYS_DESC(SYS_IFSR32_EL2), undef_access, reset_unknown, IFSR32_EL2 },
3884 	EL2_REG(AFSR0_EL2, access_rw, reset_val, 0),
3885 	EL2_REG(AFSR1_EL2, access_rw, reset_val, 0),
3886 	EL2_REG_REDIR(ESR_EL2, reset_val, 0),
3887 	EL2_REG_VNCR(VSESR_EL2, reset_unknown, 0),
3888 	{ SYS_DESC(SYS_FPEXC32_EL2), undef_access, reset_val, FPEXC32_EL2, 0x700 },
3889 
3890 	EL2_REG_REDIR(FAR_EL2, reset_val, 0),
3891 	EL2_REG(HPFAR_EL2, access_rw, reset_val, 0),
3892 
3893 	EL2_REG(MAIR_EL2, access_rw, reset_val, 0),
3894 	EL2_REG_FILTERED(PIRE0_EL2, access_rw, reset_val, 0,
3895 			 s1pie_el2_visibility),
3896 	EL2_REG_FILTERED(PIR_EL2, access_rw, reset_val, 0,
3897 			 s1pie_el2_visibility),
3898 	EL2_REG_FILTERED(POR_EL2, access_rw, reset_val, 0,
3899 			 s1poe_el2_visibility),
3900 	EL2_REG(AMAIR_EL2, access_rw, reset_val, 0),
3901 	{ SYS_DESC(SYS_MPAMHCR_EL2), undef_access },
3902 	{ SYS_DESC(SYS_MPAMVPMV_EL2), undef_access },
3903 	{ SYS_DESC(SYS_MPAM2_EL2), undef_access },
3904 	{ SYS_DESC(SYS_MPAMVPM0_EL2), undef_access },
3905 	{ SYS_DESC(SYS_MPAMVPM1_EL2), undef_access },
3906 	{ SYS_DESC(SYS_MPAMVPM2_EL2), undef_access },
3907 	{ SYS_DESC(SYS_MPAMVPM3_EL2), undef_access },
3908 	{ SYS_DESC(SYS_MPAMVPM4_EL2), undef_access },
3909 	{ SYS_DESC(SYS_MPAMVPM5_EL2), undef_access },
3910 	{ SYS_DESC(SYS_MPAMVPM6_EL2), undef_access },
3911 	{ SYS_DESC(SYS_MPAMVPM7_EL2), undef_access },
3912 
3913 	EL2_REG(VBAR_EL2, access_rw, reset_val, 0),
3914 	{ SYS_DESC(SYS_RVBAR_EL2), undef_access },
3915 	{ SYS_DESC(SYS_RMR_EL2), undef_access },
3916 	EL2_REG_VNCR(VDISR_EL2, reset_unknown, 0),
3917 
3918 	EL2_REG_VNCR_GICv3(ICH_AP0R0_EL2),
3919 	EL2_REG_VNCR_GICv3(ICH_AP0R1_EL2),
3920 	EL2_REG_VNCR_GICv3(ICH_AP0R2_EL2),
3921 	EL2_REG_VNCR_GICv3(ICH_AP0R3_EL2),
3922 	EL2_REG_VNCR_GICv3(ICH_AP1R0_EL2),
3923 	EL2_REG_VNCR_GICv3(ICH_AP1R1_EL2),
3924 	EL2_REG_VNCR_GICv3(ICH_AP1R2_EL2),
3925 	EL2_REG_VNCR_GICv3(ICH_AP1R3_EL2),
3926 
3927 	{ SYS_DESC(SYS_ICC_SRE_EL2), access_gic_sre },
3928 
3929 	EL2_REG_VNCR_GICv3(ICH_HCR_EL2),
3930 	{ SYS_DESC(SYS_ICH_VTR_EL2), access_gic_vtr },
3931 	{ SYS_DESC(SYS_ICH_MISR_EL2), access_gic_misr },
3932 	{ SYS_DESC(SYS_ICH_EISR_EL2), access_gic_eisr },
3933 	{ SYS_DESC(SYS_ICH_ELRSR_EL2), access_gic_elrsr },
3934 	EL2_REG_VNCR_GICv3(ICH_VMCR_EL2),
3935 
3936 	EL2_REG_VNCR_GICv3(ICH_LR0_EL2),
3937 	EL2_REG_VNCR_GICv3(ICH_LR1_EL2),
3938 	EL2_REG_VNCR_GICv3(ICH_LR2_EL2),
3939 	EL2_REG_VNCR_GICv3(ICH_LR3_EL2),
3940 	EL2_REG_VNCR_GICv3(ICH_LR4_EL2),
3941 	EL2_REG_VNCR_GICv3(ICH_LR5_EL2),
3942 	EL2_REG_VNCR_GICv3(ICH_LR6_EL2),
3943 	EL2_REG_VNCR_GICv3(ICH_LR7_EL2),
3944 	EL2_REG_VNCR_GICv3(ICH_LR8_EL2),
3945 	EL2_REG_VNCR_GICv3(ICH_LR9_EL2),
3946 	EL2_REG_VNCR_GICv3(ICH_LR10_EL2),
3947 	EL2_REG_VNCR_GICv3(ICH_LR11_EL2),
3948 	EL2_REG_VNCR_GICv3(ICH_LR12_EL2),
3949 	EL2_REG_VNCR_GICv3(ICH_LR13_EL2),
3950 	EL2_REG_VNCR_GICv3(ICH_LR14_EL2),
3951 	EL2_REG_VNCR_GICv3(ICH_LR15_EL2),
3952 
3953 	EL2_REG(CONTEXTIDR_EL2, access_rw, reset_val, 0),
3954 	EL2_REG(TPIDR_EL2, access_rw, reset_val, 0),
3955 
3956 	EL2_REG_VNCR(CNTVOFF_EL2, reset_val, 0),
3957 	EL2_REG(CNTHCTL_EL2, access_rw, reset_val, 0),
3958 	{ SYS_DESC(SYS_CNTHP_TVAL_EL2), access_arch_timer },
3959 	TIMER_REG(CNTHP_CTL_EL2, el2_visibility),
3960 	TIMER_REG(CNTHP_CVAL_EL2, el2_visibility),
3961 
3962 	{ SYS_DESC(SYS_CNTHV_TVAL_EL2), access_arch_timer, .visibility = cnthv_visibility },
3963 	TIMER_REG(CNTHV_CTL_EL2, cnthv_visibility),
3964 	TIMER_REG(CNTHV_CVAL_EL2, cnthv_visibility),
3965 
3966 	{ SYS_DESC(SYS_CNTKCTL_EL12), access_cntkctl_el12 },
3967 
3968 	{ SYS_DESC(SYS_CNTP_TVAL_EL02), access_arch_timer },
3969 	{ SYS_DESC(SYS_CNTP_CTL_EL02), access_arch_timer },
3970 	{ SYS_DESC(SYS_CNTP_CVAL_EL02), access_arch_timer },
3971 
3972 	{ SYS_DESC(SYS_CNTV_TVAL_EL02), access_arch_timer },
3973 	{ SYS_DESC(SYS_CNTV_CTL_EL02), access_arch_timer },
3974 	{ SYS_DESC(SYS_CNTV_CVAL_EL02), access_arch_timer },
3975 
3976 	EL2_REG(SP_EL2, NULL, reset_unknown, 0),
3977 };
3978 
3979 static bool handle_at_s1e01(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
3980 			    const struct sys_reg_desc *r)
3981 {
3982 	u32 op = sys_insn(p->Op0, p->Op1, p->CRn, p->CRm, p->Op2);
3983 
3984 	if (__kvm_at_s1e01(vcpu, op, p->regval))
3985 		return false;
3986 
3987 	return true;
3988 }
3989 
3990 static bool handle_at_s1e2(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
3991 			   const struct sys_reg_desc *r)
3992 {
3993 	u32 op = sys_insn(p->Op0, p->Op1, p->CRn, p->CRm, p->Op2);
3994 
3995 	/* There is no FGT associated with AT S1E2A :-( */
3996 	if (op == OP_AT_S1E2A &&
3997 	    !kvm_has_feat(vcpu->kvm, ID_AA64ISAR2_EL1, ATS1A, IMP)) {
3998 		kvm_inject_undefined(vcpu);
3999 		return false;
4000 	}
4001 
4002 	if (__kvm_at_s1e2(vcpu, op, p->regval))
4003 		return false;
4004 
4005 	return true;
4006 }
4007 
4008 static bool handle_at_s12(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
4009 			  const struct sys_reg_desc *r)
4010 {
4011 	u32 op = sys_insn(p->Op0, p->Op1, p->CRn, p->CRm, p->Op2);
4012 
4013 	if (__kvm_at_s12(vcpu, op, p->regval))
4014 		return false;
4015 
4016 	return true;
4017 }
4018 
4019 static bool kvm_supported_tlbi_s12_op(struct kvm_vcpu *vpcu, u32 instr)
4020 {
4021 	struct kvm *kvm = vpcu->kvm;
4022 	u8 CRm = sys_reg_CRm(instr);
4023 
4024 	if (sys_reg_CRn(instr) == TLBI_CRn_nXS &&
4025 	    !kvm_has_feat(kvm, ID_AA64ISAR1_EL1, XS, IMP))
4026 		return false;
4027 
4028 	if (CRm == TLBI_CRm_nROS &&
4029 	    !kvm_has_feat(kvm, ID_AA64ISAR0_EL1, TLB, OS))
4030 		return false;
4031 
4032 	return true;
4033 }
4034 
4035 static bool handle_alle1is(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
4036 			   const struct sys_reg_desc *r)
4037 {
4038 	u32 sys_encoding = sys_insn(p->Op0, p->Op1, p->CRn, p->CRm, p->Op2);
4039 
4040 	if (!kvm_supported_tlbi_s12_op(vcpu, sys_encoding))
4041 		return undef_access(vcpu, p, r);
4042 
4043 	write_lock(&vcpu->kvm->mmu_lock);
4044 
4045 	/*
4046 	 * Drop all shadow S2s, resulting in S1/S2 TLBIs for each of the
4047 	 * corresponding VMIDs.
4048 	 */
4049 	kvm_nested_s2_unmap(vcpu->kvm, true);
4050 
4051 	write_unlock(&vcpu->kvm->mmu_lock);
4052 
4053 	return true;
4054 }
4055 
4056 static bool kvm_supported_tlbi_ipas2_op(struct kvm_vcpu *vpcu, u32 instr)
4057 {
4058 	struct kvm *kvm = vpcu->kvm;
4059 	u8 CRm = sys_reg_CRm(instr);
4060 	u8 Op2 = sys_reg_Op2(instr);
4061 
4062 	if (sys_reg_CRn(instr) == TLBI_CRn_nXS &&
4063 	    !kvm_has_feat(kvm, ID_AA64ISAR1_EL1, XS, IMP))
4064 		return false;
4065 
4066 	if (CRm == TLBI_CRm_IPAIS && (Op2 == 2 || Op2 == 6) &&
4067 	    !kvm_has_feat(kvm, ID_AA64ISAR0_EL1, TLB, RANGE))
4068 		return false;
4069 
4070 	if (CRm == TLBI_CRm_IPAONS && (Op2 == 0 || Op2 == 4) &&
4071 	    !kvm_has_feat(kvm, ID_AA64ISAR0_EL1, TLB, OS))
4072 		return false;
4073 
4074 	if (CRm == TLBI_CRm_IPAONS && (Op2 == 3 || Op2 == 7) &&
4075 	    !kvm_has_feat(kvm, ID_AA64ISAR0_EL1, TLB, RANGE))
4076 		return false;
4077 
4078 	return true;
4079 }
4080 
4081 /* Only defined here as this is an internal "abstraction" */
4082 union tlbi_info {
4083 	struct {
4084 		u64	start;
4085 		u64	size;
4086 	} range;
4087 
4088 	struct {
4089 		u64	addr;
4090 	} ipa;
4091 
4092 	struct {
4093 		u64	addr;
4094 		u32	encoding;
4095 	} va;
4096 };
4097 
4098 static void s2_mmu_unmap_range(struct kvm_s2_mmu *mmu,
4099 			       const union tlbi_info *info)
4100 {
4101 	/*
4102 	 * The unmap operation is allowed to drop the MMU lock and block, which
4103 	 * means that @mmu could be used for a different context than the one
4104 	 * currently being invalidated.
4105 	 *
4106 	 * This behavior is still safe, as:
4107 	 *
4108 	 *  1) The vCPU(s) that recycled the MMU are responsible for invalidating
4109 	 *     the entire MMU before reusing it, which still honors the intent
4110 	 *     of a TLBI.
4111 	 *
4112 	 *  2) Until the guest TLBI instruction is 'retired' (i.e. increment PC
4113 	 *     and ERET to the guest), other vCPUs are allowed to use stale
4114 	 *     translations.
4115 	 *
4116 	 *  3) Accidentally unmapping an unrelated MMU context is nonfatal, and
4117 	 *     at worst may cause more aborts for shadow stage-2 fills.
4118 	 *
4119 	 * Dropping the MMU lock also implies that shadow stage-2 fills could
4120 	 * happen behind the back of the TLBI. This is still safe, though, as
4121 	 * the L1 needs to put its stage-2 in a consistent state before doing
4122 	 * the TLBI.
4123 	 */
4124 	kvm_stage2_unmap_range(mmu, info->range.start, info->range.size, true);
4125 }
4126 
4127 static bool handle_vmalls12e1is(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
4128 				const struct sys_reg_desc *r)
4129 {
4130 	u32 sys_encoding = sys_insn(p->Op0, p->Op1, p->CRn, p->CRm, p->Op2);
4131 	u64 limit, vttbr;
4132 
4133 	if (!kvm_supported_tlbi_s12_op(vcpu, sys_encoding))
4134 		return undef_access(vcpu, p, r);
4135 
4136 	vttbr = vcpu_read_sys_reg(vcpu, VTTBR_EL2);
4137 	limit = BIT_ULL(kvm_get_pa_bits(vcpu->kvm));
4138 
4139 	kvm_s2_mmu_iterate_by_vmid(vcpu->kvm, get_vmid(vttbr),
4140 				   &(union tlbi_info) {
4141 					   .range = {
4142 						   .start = 0,
4143 						   .size = limit,
4144 					   },
4145 				   },
4146 				   s2_mmu_unmap_range);
4147 
4148 	return true;
4149 }
4150 
4151 static bool handle_ripas2e1is(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
4152 			      const struct sys_reg_desc *r)
4153 {
4154 	u32 sys_encoding = sys_insn(p->Op0, p->Op1, p->CRn, p->CRm, p->Op2);
4155 	u64 vttbr = vcpu_read_sys_reg(vcpu, VTTBR_EL2);
4156 	u64 base, range;
4157 	int pa_bits;
4158 
4159 	if (!kvm_supported_tlbi_ipas2_op(vcpu, sys_encoding))
4160 		return undef_access(vcpu, p, r);
4161 
4162 	/*
4163 	 * Because the shadow S2 structure doesn't necessarily reflect that
4164 	 * of the guest's S2 (different base granule size, for example), we
4165 	 * decide to ignore TTL and only use the described range.
4166 	 */
4167 	base = decode_range_tlbi(p->regval, &range, NULL);
4168 
4169 	/*
4170 	 * Ignore TLBIs that start out of PA_bits range, and cap the
4171 	 * invalidation to the [base:bit(PA_bits)] interval.
4172 	 */
4173 	pa_bits = kvm_get_pa_bits(vcpu->kvm);
4174 	if (fls64(base) > pa_bits)
4175 		return true;
4176 
4177 	range = min(range, BIT_ULL(pa_bits) - base);
4178 
4179 	kvm_s2_mmu_iterate_by_vmid(vcpu->kvm, get_vmid(vttbr),
4180 				   &(union tlbi_info) {
4181 					   .range = {
4182 						   .start = base,
4183 						   .size = range,
4184 					   },
4185 				   },
4186 				   s2_mmu_unmap_range);
4187 
4188 	return true;
4189 }
4190 
4191 static void s2_mmu_unmap_ipa(struct kvm_s2_mmu *mmu,
4192 			     const union tlbi_info *info)
4193 {
4194 	unsigned long max_size;
4195 	u64 base_addr;
4196 
4197 	/*
4198 	 * We drop a number of things from the supplied value:
4199 	 *
4200 	 * - NS bit: we're non-secure only.
4201 	 *
4202 	 * - IPA[51:48]: We don't support 52bit IPA just yet...
4203 	 *
4204 	 * And of course, adjust the IPA to be on an actual address.
4205 	 */
4206 	base_addr = (info->ipa.addr & GENMASK_ULL(35, 0)) << 12;
4207 	max_size = compute_tlb_inval_range(mmu, info->ipa.addr);
4208 	base_addr &= ~(max_size - 1);
4209 
4210 	/*
4211 	 * See comment in s2_mmu_unmap_range() for why this is allowed to
4212 	 * reschedule.
4213 	 */
4214 	kvm_stage2_unmap_range(mmu, base_addr, max_size, true);
4215 }
4216 
4217 static bool handle_ipas2e1is(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
4218 			     const struct sys_reg_desc *r)
4219 {
4220 	u32 sys_encoding = sys_insn(p->Op0, p->Op1, p->CRn, p->CRm, p->Op2);
4221 	u64 vttbr = vcpu_read_sys_reg(vcpu, VTTBR_EL2);
4222 
4223 	if (!kvm_supported_tlbi_ipas2_op(vcpu, sys_encoding))
4224 		return undef_access(vcpu, p, r);
4225 
4226 	kvm_s2_mmu_iterate_by_vmid(vcpu->kvm, get_vmid(vttbr),
4227 				   &(union tlbi_info) {
4228 					   .ipa = {
4229 						   .addr = p->regval,
4230 					   },
4231 				   },
4232 				   s2_mmu_unmap_ipa);
4233 
4234 	return true;
4235 }
4236 
4237 static void s2_mmu_tlbi_s1e1(struct kvm_s2_mmu *mmu,
4238 			     const union tlbi_info *info)
4239 {
4240 	WARN_ON(__kvm_tlbi_s1e2(mmu, info->va.addr, info->va.encoding));
4241 }
4242 
4243 static bool handle_tlbi_el2(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
4244 			    const struct sys_reg_desc *r)
4245 {
4246 	u32 sys_encoding = sys_insn(p->Op0, p->Op1, p->CRn, p->CRm, p->Op2);
4247 
4248 	if (!kvm_supported_tlbi_s1e2_op(vcpu, sys_encoding))
4249 		return undef_access(vcpu, p, r);
4250 
4251 	kvm_handle_s1e2_tlbi(vcpu, sys_encoding, p->regval);
4252 	return true;
4253 }
4254 
4255 static bool handle_tlbi_el1(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
4256 			    const struct sys_reg_desc *r)
4257 {
4258 	u32 sys_encoding = sys_insn(p->Op0, p->Op1, p->CRn, p->CRm, p->Op2);
4259 
4260 	/*
4261 	 * If we're here, this is because we've trapped on a EL1 TLBI
4262 	 * instruction that affects the EL1 translation regime while
4263 	 * we're running in a context that doesn't allow us to let the
4264 	 * HW do its thing (aka vEL2):
4265 	 *
4266 	 * - HCR_EL2.E2H == 0 : a non-VHE guest
4267 	 * - HCR_EL2.{E2H,TGE} == { 1, 0 } : a VHE guest in guest mode
4268 	 *
4269 	 * Another possibility is that we are invalidating the EL2 context
4270 	 * using EL1 instructions, but that we landed here because we need
4271 	 * additional invalidation for structures that are not held in the
4272 	 * CPU TLBs (such as the VNCR pseudo-TLB and its EL2 mapping). In
4273 	 * that case, we are guaranteed that HCR_EL2.{E2H,TGE} == { 1, 1 }
4274 	 * as we don't allow an NV-capable L1 in a nVHE configuration.
4275 	 *
4276 	 * We don't expect these helpers to ever be called when running
4277 	 * in a vEL1 context.
4278 	 */
4279 
4280 	WARN_ON(!vcpu_is_el2(vcpu));
4281 
4282 	if (!kvm_supported_tlbi_s1e1_op(vcpu, sys_encoding))
4283 		return undef_access(vcpu, p, r);
4284 
4285 	if (vcpu_el2_e2h_is_set(vcpu) && vcpu_el2_tge_is_set(vcpu)) {
4286 		kvm_handle_s1e2_tlbi(vcpu, sys_encoding, p->regval);
4287 		return true;
4288 	}
4289 
4290 	kvm_s2_mmu_iterate_by_vmid(vcpu->kvm,
4291 				   get_vmid(__vcpu_sys_reg(vcpu, VTTBR_EL2)),
4292 				   &(union tlbi_info) {
4293 					   .va = {
4294 						   .addr = p->regval,
4295 						   .encoding = sys_encoding,
4296 					   },
4297 				   },
4298 				   s2_mmu_tlbi_s1e1);
4299 
4300 	return true;
4301 }
4302 
4303 #define SYS_INSN(insn, access_fn)					\
4304 	{								\
4305 		SYS_DESC(OP_##insn),					\
4306 		.access = (access_fn),					\
4307 	}
4308 
4309 static struct sys_reg_desc sys_insn_descs[] = {
4310 	{ SYS_DESC(SYS_DC_ISW), access_dcsw },
4311 	{ SYS_DESC(SYS_DC_IGSW), access_dcgsw },
4312 	{ SYS_DESC(SYS_DC_IGDSW), access_dcgsw },
4313 
4314 	SYS_INSN(AT_S1E1R, handle_at_s1e01),
4315 	SYS_INSN(AT_S1E1W, handle_at_s1e01),
4316 	SYS_INSN(AT_S1E0R, handle_at_s1e01),
4317 	SYS_INSN(AT_S1E0W, handle_at_s1e01),
4318 	SYS_INSN(AT_S1E1RP, handle_at_s1e01),
4319 	SYS_INSN(AT_S1E1WP, handle_at_s1e01),
4320 	SYS_INSN(AT_S1E1A, handle_at_s1e01),
4321 
4322 	{ SYS_DESC(SYS_DC_CSW), access_dcsw },
4323 	{ SYS_DESC(SYS_DC_CGSW), access_dcgsw },
4324 	{ SYS_DESC(SYS_DC_CGDSW), access_dcgsw },
4325 	{ SYS_DESC(SYS_DC_CISW), access_dcsw },
4326 	{ SYS_DESC(SYS_DC_CIGSW), access_dcgsw },
4327 	{ SYS_DESC(SYS_DC_CIGDSW), access_dcgsw },
4328 
4329 	SYS_INSN(TLBI_VMALLE1OS, handle_tlbi_el1),
4330 	SYS_INSN(TLBI_VAE1OS, handle_tlbi_el1),
4331 	SYS_INSN(TLBI_ASIDE1OS, handle_tlbi_el1),
4332 	SYS_INSN(TLBI_VAAE1OS, handle_tlbi_el1),
4333 	SYS_INSN(TLBI_VALE1OS, handle_tlbi_el1),
4334 	SYS_INSN(TLBI_VAALE1OS, handle_tlbi_el1),
4335 
4336 	SYS_INSN(TLBI_RVAE1IS, handle_tlbi_el1),
4337 	SYS_INSN(TLBI_RVAAE1IS, handle_tlbi_el1),
4338 	SYS_INSN(TLBI_RVALE1IS, handle_tlbi_el1),
4339 	SYS_INSN(TLBI_RVAALE1IS, handle_tlbi_el1),
4340 
4341 	SYS_INSN(TLBI_VMALLE1IS, handle_tlbi_el1),
4342 	SYS_INSN(TLBI_VAE1IS, handle_tlbi_el1),
4343 	SYS_INSN(TLBI_ASIDE1IS, handle_tlbi_el1),
4344 	SYS_INSN(TLBI_VAAE1IS, handle_tlbi_el1),
4345 	SYS_INSN(TLBI_VALE1IS, handle_tlbi_el1),
4346 	SYS_INSN(TLBI_VAALE1IS, handle_tlbi_el1),
4347 
4348 	SYS_INSN(TLBI_RVAE1OS, handle_tlbi_el1),
4349 	SYS_INSN(TLBI_RVAAE1OS, handle_tlbi_el1),
4350 	SYS_INSN(TLBI_RVALE1OS, handle_tlbi_el1),
4351 	SYS_INSN(TLBI_RVAALE1OS, handle_tlbi_el1),
4352 
4353 	SYS_INSN(TLBI_RVAE1, handle_tlbi_el1),
4354 	SYS_INSN(TLBI_RVAAE1, handle_tlbi_el1),
4355 	SYS_INSN(TLBI_RVALE1, handle_tlbi_el1),
4356 	SYS_INSN(TLBI_RVAALE1, handle_tlbi_el1),
4357 
4358 	SYS_INSN(TLBI_VMALLE1, handle_tlbi_el1),
4359 	SYS_INSN(TLBI_VAE1, handle_tlbi_el1),
4360 	SYS_INSN(TLBI_ASIDE1, handle_tlbi_el1),
4361 	SYS_INSN(TLBI_VAAE1, handle_tlbi_el1),
4362 	SYS_INSN(TLBI_VALE1, handle_tlbi_el1),
4363 	SYS_INSN(TLBI_VAALE1, handle_tlbi_el1),
4364 
4365 	SYS_INSN(TLBI_VMALLE1OSNXS, handle_tlbi_el1),
4366 	SYS_INSN(TLBI_VAE1OSNXS, handle_tlbi_el1),
4367 	SYS_INSN(TLBI_ASIDE1OSNXS, handle_tlbi_el1),
4368 	SYS_INSN(TLBI_VAAE1OSNXS, handle_tlbi_el1),
4369 	SYS_INSN(TLBI_VALE1OSNXS, handle_tlbi_el1),
4370 	SYS_INSN(TLBI_VAALE1OSNXS, handle_tlbi_el1),
4371 
4372 	SYS_INSN(TLBI_RVAE1ISNXS, handle_tlbi_el1),
4373 	SYS_INSN(TLBI_RVAAE1ISNXS, handle_tlbi_el1),
4374 	SYS_INSN(TLBI_RVALE1ISNXS, handle_tlbi_el1),
4375 	SYS_INSN(TLBI_RVAALE1ISNXS, handle_tlbi_el1),
4376 
4377 	SYS_INSN(TLBI_VMALLE1ISNXS, handle_tlbi_el1),
4378 	SYS_INSN(TLBI_VAE1ISNXS, handle_tlbi_el1),
4379 	SYS_INSN(TLBI_ASIDE1ISNXS, handle_tlbi_el1),
4380 	SYS_INSN(TLBI_VAAE1ISNXS, handle_tlbi_el1),
4381 	SYS_INSN(TLBI_VALE1ISNXS, handle_tlbi_el1),
4382 	SYS_INSN(TLBI_VAALE1ISNXS, handle_tlbi_el1),
4383 
4384 	SYS_INSN(TLBI_RVAE1OSNXS, handle_tlbi_el1),
4385 	SYS_INSN(TLBI_RVAAE1OSNXS, handle_tlbi_el1),
4386 	SYS_INSN(TLBI_RVALE1OSNXS, handle_tlbi_el1),
4387 	SYS_INSN(TLBI_RVAALE1OSNXS, handle_tlbi_el1),
4388 
4389 	SYS_INSN(TLBI_RVAE1NXS, handle_tlbi_el1),
4390 	SYS_INSN(TLBI_RVAAE1NXS, handle_tlbi_el1),
4391 	SYS_INSN(TLBI_RVALE1NXS, handle_tlbi_el1),
4392 	SYS_INSN(TLBI_RVAALE1NXS, handle_tlbi_el1),
4393 
4394 	SYS_INSN(TLBI_VMALLE1NXS, handle_tlbi_el1),
4395 	SYS_INSN(TLBI_VAE1NXS, handle_tlbi_el1),
4396 	SYS_INSN(TLBI_ASIDE1NXS, handle_tlbi_el1),
4397 	SYS_INSN(TLBI_VAAE1NXS, handle_tlbi_el1),
4398 	SYS_INSN(TLBI_VALE1NXS, handle_tlbi_el1),
4399 	SYS_INSN(TLBI_VAALE1NXS, handle_tlbi_el1),
4400 
4401 	SYS_INSN(AT_S1E2R, handle_at_s1e2),
4402 	SYS_INSN(AT_S1E2W, handle_at_s1e2),
4403 	SYS_INSN(AT_S12E1R, handle_at_s12),
4404 	SYS_INSN(AT_S12E1W, handle_at_s12),
4405 	SYS_INSN(AT_S12E0R, handle_at_s12),
4406 	SYS_INSN(AT_S12E0W, handle_at_s12),
4407 	SYS_INSN(AT_S1E2A, handle_at_s1e2),
4408 
4409 	SYS_INSN(TLBI_IPAS2E1IS, handle_ipas2e1is),
4410 	SYS_INSN(TLBI_RIPAS2E1IS, handle_ripas2e1is),
4411 	SYS_INSN(TLBI_IPAS2LE1IS, handle_ipas2e1is),
4412 	SYS_INSN(TLBI_RIPAS2LE1IS, handle_ripas2e1is),
4413 
4414 	SYS_INSN(TLBI_ALLE2OS, handle_tlbi_el2),
4415 	SYS_INSN(TLBI_VAE2OS, handle_tlbi_el2),
4416 	SYS_INSN(TLBI_ALLE1OS, handle_alle1is),
4417 	SYS_INSN(TLBI_VALE2OS, handle_tlbi_el2),
4418 	SYS_INSN(TLBI_VMALLS12E1OS, handle_vmalls12e1is),
4419 
4420 	SYS_INSN(TLBI_RVAE2IS, handle_tlbi_el2),
4421 	SYS_INSN(TLBI_RVALE2IS, handle_tlbi_el2),
4422 	SYS_INSN(TLBI_ALLE2IS, handle_tlbi_el2),
4423 	SYS_INSN(TLBI_VAE2IS, handle_tlbi_el2),
4424 
4425 	SYS_INSN(TLBI_ALLE1IS, handle_alle1is),
4426 
4427 	SYS_INSN(TLBI_VALE2IS, handle_tlbi_el2),
4428 
4429 	SYS_INSN(TLBI_VMALLS12E1IS, handle_vmalls12e1is),
4430 	SYS_INSN(TLBI_IPAS2E1OS, handle_ipas2e1is),
4431 	SYS_INSN(TLBI_IPAS2E1, handle_ipas2e1is),
4432 	SYS_INSN(TLBI_RIPAS2E1, handle_ripas2e1is),
4433 	SYS_INSN(TLBI_RIPAS2E1OS, handle_ripas2e1is),
4434 	SYS_INSN(TLBI_IPAS2LE1OS, handle_ipas2e1is),
4435 	SYS_INSN(TLBI_IPAS2LE1, handle_ipas2e1is),
4436 	SYS_INSN(TLBI_RIPAS2LE1, handle_ripas2e1is),
4437 	SYS_INSN(TLBI_RIPAS2LE1OS, handle_ripas2e1is),
4438 	SYS_INSN(TLBI_RVAE2OS, handle_tlbi_el2),
4439 	SYS_INSN(TLBI_RVALE2OS, handle_tlbi_el2),
4440 	SYS_INSN(TLBI_RVAE2, handle_tlbi_el2),
4441 	SYS_INSN(TLBI_RVALE2, handle_tlbi_el2),
4442 	SYS_INSN(TLBI_ALLE2, handle_tlbi_el2),
4443 	SYS_INSN(TLBI_VAE2, handle_tlbi_el2),
4444 
4445 	SYS_INSN(TLBI_ALLE1, handle_alle1is),
4446 
4447 	SYS_INSN(TLBI_VALE2, handle_tlbi_el2),
4448 
4449 	SYS_INSN(TLBI_VMALLS12E1, handle_vmalls12e1is),
4450 
4451 	SYS_INSN(TLBI_IPAS2E1ISNXS, handle_ipas2e1is),
4452 	SYS_INSN(TLBI_RIPAS2E1ISNXS, handle_ripas2e1is),
4453 	SYS_INSN(TLBI_IPAS2LE1ISNXS, handle_ipas2e1is),
4454 	SYS_INSN(TLBI_RIPAS2LE1ISNXS, handle_ripas2e1is),
4455 
4456 	SYS_INSN(TLBI_ALLE2OSNXS, handle_tlbi_el2),
4457 	SYS_INSN(TLBI_VAE2OSNXS, handle_tlbi_el2),
4458 	SYS_INSN(TLBI_ALLE1OSNXS, handle_alle1is),
4459 	SYS_INSN(TLBI_VALE2OSNXS, handle_tlbi_el2),
4460 	SYS_INSN(TLBI_VMALLS12E1OSNXS, handle_vmalls12e1is),
4461 
4462 	SYS_INSN(TLBI_RVAE2ISNXS, handle_tlbi_el2),
4463 	SYS_INSN(TLBI_RVALE2ISNXS, handle_tlbi_el2),
4464 	SYS_INSN(TLBI_ALLE2ISNXS, handle_tlbi_el2),
4465 	SYS_INSN(TLBI_VAE2ISNXS, handle_tlbi_el2),
4466 
4467 	SYS_INSN(TLBI_ALLE1ISNXS, handle_alle1is),
4468 	SYS_INSN(TLBI_VALE2ISNXS, handle_tlbi_el2),
4469 	SYS_INSN(TLBI_VMALLS12E1ISNXS, handle_vmalls12e1is),
4470 	SYS_INSN(TLBI_IPAS2E1OSNXS, handle_ipas2e1is),
4471 	SYS_INSN(TLBI_IPAS2E1NXS, handle_ipas2e1is),
4472 	SYS_INSN(TLBI_RIPAS2E1NXS, handle_ripas2e1is),
4473 	SYS_INSN(TLBI_RIPAS2E1OSNXS, handle_ripas2e1is),
4474 	SYS_INSN(TLBI_IPAS2LE1OSNXS, handle_ipas2e1is),
4475 	SYS_INSN(TLBI_IPAS2LE1NXS, handle_ipas2e1is),
4476 	SYS_INSN(TLBI_RIPAS2LE1NXS, handle_ripas2e1is),
4477 	SYS_INSN(TLBI_RIPAS2LE1OSNXS, handle_ripas2e1is),
4478 	SYS_INSN(TLBI_RVAE2OSNXS, handle_tlbi_el2),
4479 	SYS_INSN(TLBI_RVALE2OSNXS, handle_tlbi_el2),
4480 	SYS_INSN(TLBI_RVAE2NXS, handle_tlbi_el2),
4481 	SYS_INSN(TLBI_RVALE2NXS, handle_tlbi_el2),
4482 	SYS_INSN(TLBI_ALLE2NXS, handle_tlbi_el2),
4483 	SYS_INSN(TLBI_VAE2NXS, handle_tlbi_el2),
4484 	SYS_INSN(TLBI_ALLE1NXS, handle_alle1is),
4485 	SYS_INSN(TLBI_VALE2NXS, handle_tlbi_el2),
4486 	SYS_INSN(TLBI_VMALLS12E1NXS, handle_vmalls12e1is),
4487 };
4488 
4489 static bool trap_dbgdidr(struct kvm_vcpu *vcpu,
4490 			struct sys_reg_params *p,
4491 			const struct sys_reg_desc *r)
4492 {
4493 	if (p->is_write) {
4494 		return ignore_write(vcpu, p);
4495 	} else {
4496 		u64 dfr = kvm_read_vm_id_reg(vcpu->kvm, SYS_ID_AA64DFR0_EL1);
4497 		u32 el3 = kvm_has_feat(vcpu->kvm, ID_AA64PFR0_EL1, EL3, IMP);
4498 
4499 		p->regval = ((SYS_FIELD_GET(ID_AA64DFR0_EL1, WRPs, dfr) << 28) |
4500 			     (SYS_FIELD_GET(ID_AA64DFR0_EL1, BRPs, dfr) << 24) |
4501 			     (SYS_FIELD_GET(ID_AA64DFR0_EL1, CTX_CMPs, dfr) << 20) |
4502 			     (SYS_FIELD_GET(ID_AA64DFR0_EL1, DebugVer, dfr) << 16) |
4503 			     (1 << 15) | (el3 << 14) | (el3 << 12));
4504 		return true;
4505 	}
4506 }
4507 
4508 /*
4509  * AArch32 debug register mappings
4510  *
4511  * AArch32 DBGBVRn is mapped to DBGBVRn_EL1[31:0]
4512  * AArch32 DBGBXVRn is mapped to DBGBVRn_EL1[63:32]
4513  *
4514  * None of the other registers share their location, so treat them as
4515  * if they were 64bit.
4516  */
4517 #define DBG_BCR_BVR_WCR_WVR(n)							\
4518 	/* DBGBVRn */								\
4519 	{ AA32(LO), Op1( 0), CRn( 0), CRm((n)), Op2( 4),			\
4520 	  trap_dbg_wb_reg, NULL, n },						\
4521 	/* DBGBCRn */								\
4522 	{ Op1( 0), CRn( 0), CRm((n)), Op2( 5), trap_dbg_wb_reg, NULL, n },	\
4523 	/* DBGWVRn */								\
4524 	{ Op1( 0), CRn( 0), CRm((n)), Op2( 6), trap_dbg_wb_reg, NULL, n },	\
4525 	/* DBGWCRn */								\
4526 	{ Op1( 0), CRn( 0), CRm((n)), Op2( 7), trap_dbg_wb_reg, NULL, n }
4527 
4528 #define DBGBXVR(n)								\
4529 	{ AA32(HI), Op1( 0), CRn( 1), CRm((n)), Op2( 1),			\
4530 	  trap_dbg_wb_reg, NULL, n }
4531 
4532 /*
4533  * Trapped cp14 registers. We generally ignore most of the external
4534  * debug, on the principle that they don't really make sense to a
4535  * guest. Revisit this one day, would this principle change.
4536  */
4537 static const struct sys_reg_desc cp14_regs[] = {
4538 	/* DBGDIDR */
4539 	{ Op1( 0), CRn( 0), CRm( 0), Op2( 0), trap_dbgdidr },
4540 	/* DBGDTRRXext */
4541 	{ Op1( 0), CRn( 0), CRm( 0), Op2( 2), trap_raz_wi },
4542 
4543 	DBG_BCR_BVR_WCR_WVR(0),
4544 	/* DBGDSCRint */
4545 	{ Op1( 0), CRn( 0), CRm( 1), Op2( 0), trap_raz_wi },
4546 	DBG_BCR_BVR_WCR_WVR(1),
4547 	/* DBGDCCINT */
4548 	{ Op1( 0), CRn( 0), CRm( 2), Op2( 0), trap_debug_regs, NULL, MDCCINT_EL1 },
4549 	/* DBGDSCRext */
4550 	{ Op1( 0), CRn( 0), CRm( 2), Op2( 2), trap_debug_regs, NULL, MDSCR_EL1 },
4551 	DBG_BCR_BVR_WCR_WVR(2),
4552 	/* DBGDTR[RT]Xint */
4553 	{ Op1( 0), CRn( 0), CRm( 3), Op2( 0), trap_raz_wi },
4554 	/* DBGDTR[RT]Xext */
4555 	{ Op1( 0), CRn( 0), CRm( 3), Op2( 2), trap_raz_wi },
4556 	DBG_BCR_BVR_WCR_WVR(3),
4557 	DBG_BCR_BVR_WCR_WVR(4),
4558 	DBG_BCR_BVR_WCR_WVR(5),
4559 	/* DBGWFAR */
4560 	{ Op1( 0), CRn( 0), CRm( 6), Op2( 0), trap_raz_wi },
4561 	/* DBGOSECCR */
4562 	{ Op1( 0), CRn( 0), CRm( 6), Op2( 2), trap_raz_wi },
4563 	DBG_BCR_BVR_WCR_WVR(6),
4564 	/* DBGVCR */
4565 	{ Op1( 0), CRn( 0), CRm( 7), Op2( 0), trap_debug_regs, NULL, DBGVCR32_EL2 },
4566 	DBG_BCR_BVR_WCR_WVR(7),
4567 	DBG_BCR_BVR_WCR_WVR(8),
4568 	DBG_BCR_BVR_WCR_WVR(9),
4569 	DBG_BCR_BVR_WCR_WVR(10),
4570 	DBG_BCR_BVR_WCR_WVR(11),
4571 	DBG_BCR_BVR_WCR_WVR(12),
4572 	DBG_BCR_BVR_WCR_WVR(13),
4573 	DBG_BCR_BVR_WCR_WVR(14),
4574 	DBG_BCR_BVR_WCR_WVR(15),
4575 
4576 	/* DBGDRAR (32bit) */
4577 	{ Op1( 0), CRn( 1), CRm( 0), Op2( 0), trap_raz_wi },
4578 
4579 	DBGBXVR(0),
4580 	/* DBGOSLAR */
4581 	{ Op1( 0), CRn( 1), CRm( 0), Op2( 4), trap_oslar_el1 },
4582 	DBGBXVR(1),
4583 	/* DBGOSLSR */
4584 	{ Op1( 0), CRn( 1), CRm( 1), Op2( 4), trap_oslsr_el1, NULL, OSLSR_EL1 },
4585 	DBGBXVR(2),
4586 	DBGBXVR(3),
4587 	/* DBGOSDLR */
4588 	{ Op1( 0), CRn( 1), CRm( 3), Op2( 4), trap_raz_wi },
4589 	DBGBXVR(4),
4590 	/* DBGPRCR */
4591 	{ Op1( 0), CRn( 1), CRm( 4), Op2( 4), trap_raz_wi },
4592 	DBGBXVR(5),
4593 	DBGBXVR(6),
4594 	DBGBXVR(7),
4595 	DBGBXVR(8),
4596 	DBGBXVR(9),
4597 	DBGBXVR(10),
4598 	DBGBXVR(11),
4599 	DBGBXVR(12),
4600 	DBGBXVR(13),
4601 	DBGBXVR(14),
4602 	DBGBXVR(15),
4603 
4604 	/* DBGDSAR (32bit) */
4605 	{ Op1( 0), CRn( 2), CRm( 0), Op2( 0), trap_raz_wi },
4606 
4607 	/* DBGDEVID2 */
4608 	{ Op1( 0), CRn( 7), CRm( 0), Op2( 7), trap_raz_wi },
4609 	/* DBGDEVID1 */
4610 	{ Op1( 0), CRn( 7), CRm( 1), Op2( 7), trap_raz_wi },
4611 	/* DBGDEVID */
4612 	{ Op1( 0), CRn( 7), CRm( 2), Op2( 7), trap_raz_wi },
4613 	/* DBGCLAIMSET */
4614 	{ Op1( 0), CRn( 7), CRm( 8), Op2( 6), trap_raz_wi },
4615 	/* DBGCLAIMCLR */
4616 	{ Op1( 0), CRn( 7), CRm( 9), Op2( 6), trap_raz_wi },
4617 	/* DBGAUTHSTATUS */
4618 	{ Op1( 0), CRn( 7), CRm(14), Op2( 6), trap_dbgauthstatus_el1 },
4619 };
4620 
4621 /* Trapped cp14 64bit registers */
4622 static const struct sys_reg_desc cp14_64_regs[] = {
4623 	/* DBGDRAR (64bit) */
4624 	{ Op1( 0), CRm( 1), .access = trap_raz_wi },
4625 
4626 	/* DBGDSAR (64bit) */
4627 	{ Op1( 0), CRm( 2), .access = trap_raz_wi },
4628 };
4629 
4630 #define CP15_PMU_SYS_REG(_map, _Op1, _CRn, _CRm, _Op2)			\
4631 	AA32(_map),							\
4632 	Op1(_Op1), CRn(_CRn), CRm(_CRm), Op2(_Op2),			\
4633 	.visibility = pmu_visibility
4634 
4635 /* Macro to expand the PMEVCNTRn register */
4636 #define PMU_PMEVCNTR(n)							\
4637 	{ CP15_PMU_SYS_REG(DIRECT, 0, 0b1110,				\
4638 	  (0b1000 | (((n) >> 3) & 0x3)), ((n) & 0x7)),			\
4639 	  .access = access_pmu_evcntr }
4640 
4641 /* Macro to expand the PMEVTYPERn register */
4642 #define PMU_PMEVTYPER(n)						\
4643 	{ CP15_PMU_SYS_REG(DIRECT, 0, 0b1110,				\
4644 	  (0b1100 | (((n) >> 3) & 0x3)), ((n) & 0x7)),			\
4645 	  .access = access_pmu_evtyper }
4646 /*
4647  * Trapped cp15 registers. TTBR0/TTBR1 get a double encoding,
4648  * depending on the way they are accessed (as a 32bit or a 64bit
4649  * register).
4650  */
4651 static const struct sys_reg_desc cp15_regs[] = {
4652 	{ Op1( 0), CRn( 0), CRm( 0), Op2( 1), access_ctr },
4653 	{ Op1( 0), CRn( 1), CRm( 0), Op2( 0), access_vm_reg, NULL, SCTLR_EL1 },
4654 	/* ACTLR */
4655 	{ AA32(LO), Op1( 0), CRn( 1), CRm( 0), Op2( 1), access_actlr, NULL, ACTLR_EL1 },
4656 	/* ACTLR2 */
4657 	{ AA32(HI), Op1( 0), CRn( 1), CRm( 0), Op2( 3), access_actlr, NULL, ACTLR_EL1 },
4658 	{ Op1( 0), CRn( 2), CRm( 0), Op2( 0), access_vm_reg, NULL, TTBR0_EL1 },
4659 	{ Op1( 0), CRn( 2), CRm( 0), Op2( 1), access_vm_reg, NULL, TTBR1_EL1 },
4660 	/* TTBCR */
4661 	{ AA32(LO), Op1( 0), CRn( 2), CRm( 0), Op2( 2), access_vm_reg, NULL, TCR_EL1 },
4662 	/* TTBCR2 */
4663 	{ AA32(HI), Op1( 0), CRn( 2), CRm( 0), Op2( 3), access_vm_reg, NULL, TCR_EL1 },
4664 	{ Op1( 0), CRn( 3), CRm( 0), Op2( 0), access_vm_reg, NULL, DACR32_EL2 },
4665 	{ CP15_SYS_DESC(SYS_ICC_PMR_EL1), undef_access },
4666 	/* DFSR */
4667 	{ Op1( 0), CRn( 5), CRm( 0), Op2( 0), access_vm_reg, NULL, ESR_EL1 },
4668 	{ Op1( 0), CRn( 5), CRm( 0), Op2( 1), access_vm_reg, NULL, IFSR32_EL2 },
4669 	/* ADFSR */
4670 	{ Op1( 0), CRn( 5), CRm( 1), Op2( 0), access_vm_reg, NULL, AFSR0_EL1 },
4671 	/* AIFSR */
4672 	{ Op1( 0), CRn( 5), CRm( 1), Op2( 1), access_vm_reg, NULL, AFSR1_EL1 },
4673 	/* DFAR */
4674 	{ AA32(LO), Op1( 0), CRn( 6), CRm( 0), Op2( 0), access_vm_reg, NULL, FAR_EL1 },
4675 	/* IFAR */
4676 	{ AA32(HI), Op1( 0), CRn( 6), CRm( 0), Op2( 2), access_vm_reg, NULL, FAR_EL1 },
4677 
4678 	/*
4679 	 * DC{C,I,CI}SW operations:
4680 	 */
4681 	{ Op1( 0), CRn( 7), CRm( 6), Op2( 2), access_dcsw },
4682 	{ Op1( 0), CRn( 7), CRm(10), Op2( 2), access_dcsw },
4683 	{ Op1( 0), CRn( 7), CRm(14), Op2( 2), access_dcsw },
4684 
4685 	/* PMU */
4686 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 12, 0), .access = access_pmcr },
4687 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 12, 1), .access = access_pmcnten },
4688 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 12, 2), .access = access_pmcnten },
4689 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 12, 3), .access = access_pmovs },
4690 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 12, 4), .access = access_pmswinc },
4691 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 12, 5), .access = access_pmselr },
4692 	{ CP15_PMU_SYS_REG(LO,     0, 9, 12, 6), .access = access_pmceid },
4693 	{ CP15_PMU_SYS_REG(LO,     0, 9, 12, 7), .access = access_pmceid },
4694 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 13, 0), .access = access_pmu_evcntr },
4695 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 13, 1), .access = access_pmu_evtyper },
4696 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 13, 2), .access = access_pmu_evcntr },
4697 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 14, 0), .access = access_pmuserenr },
4698 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 14, 1), .access = access_pminten },
4699 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 14, 2), .access = access_pminten },
4700 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 14, 3), .access = access_pmovs },
4701 	{ CP15_PMU_SYS_REG(HI,     0, 9, 14, 4), .access = access_pmceid },
4702 	{ CP15_PMU_SYS_REG(HI,     0, 9, 14, 5), .access = access_pmceid },
4703 	/* PMMIR */
4704 	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 14, 6), .access = access_pmmir },
4705 
4706 	/* PRRR/MAIR0 */
4707 	{ AA32(LO), Op1( 0), CRn(10), CRm( 2), Op2( 0), access_vm_reg, NULL, MAIR_EL1 },
4708 	/* NMRR/MAIR1 */
4709 	{ AA32(HI), Op1( 0), CRn(10), CRm( 2), Op2( 1), access_vm_reg, NULL, MAIR_EL1 },
4710 	/* AMAIR0 */
4711 	{ AA32(LO), Op1( 0), CRn(10), CRm( 3), Op2( 0), access_vm_reg, NULL, AMAIR_EL1 },
4712 	/* AMAIR1 */
4713 	{ AA32(HI), Op1( 0), CRn(10), CRm( 3), Op2( 1), access_vm_reg, NULL, AMAIR_EL1 },
4714 
4715 	{ CP15_SYS_DESC(SYS_ICC_IAR0_EL1), undef_access },
4716 	{ CP15_SYS_DESC(SYS_ICC_EOIR0_EL1), undef_access },
4717 	{ CP15_SYS_DESC(SYS_ICC_HPPIR0_EL1), undef_access },
4718 	{ CP15_SYS_DESC(SYS_ICC_BPR0_EL1), undef_access },
4719 	{ CP15_SYS_DESC(SYS_ICC_AP0R0_EL1), undef_access },
4720 	{ CP15_SYS_DESC(SYS_ICC_AP0R1_EL1), undef_access },
4721 	{ CP15_SYS_DESC(SYS_ICC_AP0R2_EL1), undef_access },
4722 	{ CP15_SYS_DESC(SYS_ICC_AP0R3_EL1), undef_access },
4723 	{ CP15_SYS_DESC(SYS_ICC_AP1R0_EL1), undef_access },
4724 	{ CP15_SYS_DESC(SYS_ICC_AP1R1_EL1), undef_access },
4725 	{ CP15_SYS_DESC(SYS_ICC_AP1R2_EL1), undef_access },
4726 	{ CP15_SYS_DESC(SYS_ICC_AP1R3_EL1), undef_access },
4727 	{ CP15_SYS_DESC(SYS_ICC_DIR_EL1), access_gic_dir },
4728 	{ CP15_SYS_DESC(SYS_ICC_RPR_EL1), undef_access },
4729 	{ CP15_SYS_DESC(SYS_ICC_IAR1_EL1), undef_access },
4730 	{ CP15_SYS_DESC(SYS_ICC_EOIR1_EL1), undef_access },
4731 	{ CP15_SYS_DESC(SYS_ICC_HPPIR1_EL1), undef_access },
4732 	{ CP15_SYS_DESC(SYS_ICC_BPR1_EL1), undef_access },
4733 	{ CP15_SYS_DESC(SYS_ICC_CTLR_EL1), undef_access },
4734 	{ CP15_SYS_DESC(SYS_ICC_SRE_EL1), access_gic_sre },
4735 	{ CP15_SYS_DESC(SYS_ICC_IGRPEN0_EL1), undef_access },
4736 	{ CP15_SYS_DESC(SYS_ICC_IGRPEN1_EL1), undef_access },
4737 
4738 	{ Op1( 0), CRn(13), CRm( 0), Op2( 1), access_vm_reg, NULL, CONTEXTIDR_EL1 },
4739 
4740 	/* Arch Tmers */
4741 	{ SYS_DESC(SYS_AARCH32_CNTP_TVAL), access_arch_timer },
4742 	{ SYS_DESC(SYS_AARCH32_CNTP_CTL), access_arch_timer },
4743 
4744 	/* PMEVCNTRn */
4745 	PMU_PMEVCNTR(0),
4746 	PMU_PMEVCNTR(1),
4747 	PMU_PMEVCNTR(2),
4748 	PMU_PMEVCNTR(3),
4749 	PMU_PMEVCNTR(4),
4750 	PMU_PMEVCNTR(5),
4751 	PMU_PMEVCNTR(6),
4752 	PMU_PMEVCNTR(7),
4753 	PMU_PMEVCNTR(8),
4754 	PMU_PMEVCNTR(9),
4755 	PMU_PMEVCNTR(10),
4756 	PMU_PMEVCNTR(11),
4757 	PMU_PMEVCNTR(12),
4758 	PMU_PMEVCNTR(13),
4759 	PMU_PMEVCNTR(14),
4760 	PMU_PMEVCNTR(15),
4761 	PMU_PMEVCNTR(16),
4762 	PMU_PMEVCNTR(17),
4763 	PMU_PMEVCNTR(18),
4764 	PMU_PMEVCNTR(19),
4765 	PMU_PMEVCNTR(20),
4766 	PMU_PMEVCNTR(21),
4767 	PMU_PMEVCNTR(22),
4768 	PMU_PMEVCNTR(23),
4769 	PMU_PMEVCNTR(24),
4770 	PMU_PMEVCNTR(25),
4771 	PMU_PMEVCNTR(26),
4772 	PMU_PMEVCNTR(27),
4773 	PMU_PMEVCNTR(28),
4774 	PMU_PMEVCNTR(29),
4775 	PMU_PMEVCNTR(30),
4776 	/* PMEVTYPERn */
4777 	PMU_PMEVTYPER(0),
4778 	PMU_PMEVTYPER(1),
4779 	PMU_PMEVTYPER(2),
4780 	PMU_PMEVTYPER(3),
4781 	PMU_PMEVTYPER(4),
4782 	PMU_PMEVTYPER(5),
4783 	PMU_PMEVTYPER(6),
4784 	PMU_PMEVTYPER(7),
4785 	PMU_PMEVTYPER(8),
4786 	PMU_PMEVTYPER(9),
4787 	PMU_PMEVTYPER(10),
4788 	PMU_PMEVTYPER(11),
4789 	PMU_PMEVTYPER(12),
4790 	PMU_PMEVTYPER(13),
4791 	PMU_PMEVTYPER(14),
4792 	PMU_PMEVTYPER(15),
4793 	PMU_PMEVTYPER(16),
4794 	PMU_PMEVTYPER(17),
4795 	PMU_PMEVTYPER(18),
4796 	PMU_PMEVTYPER(19),
4797 	PMU_PMEVTYPER(20),
4798 	PMU_PMEVTYPER(21),
4799 	PMU_PMEVTYPER(22),
4800 	PMU_PMEVTYPER(23),
4801 	PMU_PMEVTYPER(24),
4802 	PMU_PMEVTYPER(25),
4803 	PMU_PMEVTYPER(26),
4804 	PMU_PMEVTYPER(27),
4805 	PMU_PMEVTYPER(28),
4806 	PMU_PMEVTYPER(29),
4807 	PMU_PMEVTYPER(30),
4808 	/* PMCCFILTR */
4809 	{ CP15_PMU_SYS_REG(DIRECT, 0, 14, 15, 7), .access = access_pmu_evtyper },
4810 
4811 	{ Op1(1), CRn( 0), CRm( 0), Op2(0), access_ccsidr },
4812 	{ Op1(1), CRn( 0), CRm( 0), Op2(1), access_clidr },
4813 
4814 	/* CCSIDR2 */
4815 	{ Op1(1), CRn( 0), CRm( 0),  Op2(2), undef_access },
4816 
4817 	{ Op1(2), CRn( 0), CRm( 0), Op2(0), access_csselr, NULL, CSSELR_EL1 },
4818 };
4819 
4820 static const struct sys_reg_desc cp15_64_regs[] = {
4821 	{ Op1( 0), CRn( 0), CRm( 2), Op2( 0), access_vm_reg, NULL, TTBR0_EL1 },
4822 	{ CP15_PMU_SYS_REG(DIRECT, 0, 0, 9, 0), .access = access_pmu_evcntr },
4823 	{ Op1( 0), CRn( 0), CRm(12), Op2( 0), access_gic_sgi }, /* ICC_SGI1R */
4824 	{ SYS_DESC(SYS_AARCH32_CNTPCT),	      access_arch_timer },
4825 	{ Op1( 1), CRn( 0), CRm( 2), Op2( 0), access_vm_reg, NULL, TTBR1_EL1 },
4826 	{ Op1( 1), CRn( 0), CRm(12), Op2( 0), access_gic_sgi }, /* ICC_ASGI1R */
4827 	{ SYS_DESC(SYS_AARCH32_CNTVCT),	      access_arch_timer },
4828 	{ Op1( 2), CRn( 0), CRm(12), Op2( 0), access_gic_sgi }, /* ICC_SGI0R */
4829 	{ SYS_DESC(SYS_AARCH32_CNTP_CVAL),    access_arch_timer },
4830 	{ SYS_DESC(SYS_AARCH32_CNTPCTSS),     access_arch_timer },
4831 	{ SYS_DESC(SYS_AARCH32_CNTVCTSS),     access_arch_timer },
4832 };
4833 
4834 static bool check_sysreg_table(const struct sys_reg_desc *table, unsigned int n,
4835 			       bool reset_check)
4836 {
4837 	unsigned int i;
4838 
4839 	for (i = 0; i < n; i++) {
4840 		if (reset_check && table[i].reg && !table[i].reset) {
4841 			kvm_err("sys_reg table %pS entry %d (%s) lacks reset\n",
4842 				&table[i], i, table[i].name);
4843 			return false;
4844 		}
4845 
4846 		if (i && cmp_sys_reg(&table[i-1], &table[i]) >= 0) {
4847 			kvm_err("sys_reg table %pS entry %d (%s -> %s) out of order\n",
4848 				&table[i], i, table[i - 1].name, table[i].name);
4849 			return false;
4850 		}
4851 	}
4852 
4853 	return true;
4854 }
4855 
4856 int kvm_handle_cp14_load_store(struct kvm_vcpu *vcpu)
4857 {
4858 	kvm_inject_undefined(vcpu);
4859 	return 1;
4860 }
4861 
4862 static void perform_access(struct kvm_vcpu *vcpu,
4863 			   struct sys_reg_params *params,
4864 			   const struct sys_reg_desc *r)
4865 {
4866 	trace_kvm_sys_access(*vcpu_pc(vcpu), params, r);
4867 
4868 	/* Check for regs disabled by runtime config */
4869 	if (sysreg_hidden(vcpu, r)) {
4870 		kvm_inject_undefined(vcpu);
4871 		return;
4872 	}
4873 
4874 	/*
4875 	 * Not having an accessor means that we have configured a trap
4876 	 * that we don't know how to handle. This certainly qualifies
4877 	 * as a gross bug that should be fixed right away.
4878 	 */
4879 	if (!r->access) {
4880 		bad_trap(vcpu, params, r, "register access");
4881 		return;
4882 	}
4883 
4884 	/* Skip instruction if instructed so */
4885 	if (likely(r->access(vcpu, params, r)))
4886 		kvm_incr_pc(vcpu);
4887 }
4888 
4889 /*
4890  * emulate_cp --  tries to match a sys_reg access in a handling table, and
4891  *                call the corresponding trap handler.
4892  *
4893  * @params: pointer to the descriptor of the access
4894  * @table: array of trap descriptors
4895  * @num: size of the trap descriptor array
4896  *
4897  * Return true if the access has been handled, false if not.
4898  */
4899 static bool emulate_cp(struct kvm_vcpu *vcpu,
4900 		       struct sys_reg_params *params,
4901 		       const struct sys_reg_desc *table,
4902 		       size_t num)
4903 {
4904 	const struct sys_reg_desc *r;
4905 
4906 	if (!table)
4907 		return false;	/* Not handled */
4908 
4909 	r = find_reg(params, table, num);
4910 
4911 	if (r) {
4912 		perform_access(vcpu, params, r);
4913 		return true;
4914 	}
4915 
4916 	/* Not handled */
4917 	return false;
4918 }
4919 
4920 static void unhandled_cp_access(struct kvm_vcpu *vcpu,
4921 				struct sys_reg_params *params)
4922 {
4923 	u8 esr_ec = kvm_vcpu_trap_get_class(vcpu);
4924 	int cp = -1;
4925 
4926 	switch (esr_ec) {
4927 	case ESR_ELx_EC_CP15_32:
4928 	case ESR_ELx_EC_CP15_64:
4929 		cp = 15;
4930 		break;
4931 	case ESR_ELx_EC_CP14_MR:
4932 	case ESR_ELx_EC_CP14_64:
4933 		cp = 14;
4934 		break;
4935 	default:
4936 		WARN_ON(1);
4937 	}
4938 
4939 	print_sys_reg_msg(params,
4940 			  "Unsupported guest CP%d access at: %08lx [%08lx]\n",
4941 			  cp, *vcpu_pc(vcpu), *vcpu_cpsr(vcpu));
4942 	kvm_inject_undefined(vcpu);
4943 }
4944 
4945 /**
4946  * kvm_handle_cp_64 -- handles a mrrc/mcrr trap on a guest CP14/CP15 access
4947  * @vcpu: The VCPU pointer
4948  * @global: &struct sys_reg_desc
4949  * @nr_global: size of the @global array
4950  */
4951 static int kvm_handle_cp_64(struct kvm_vcpu *vcpu,
4952 			    const struct sys_reg_desc *global,
4953 			    size_t nr_global)
4954 {
4955 	struct sys_reg_params params;
4956 	u64 esr = kvm_vcpu_get_esr(vcpu);
4957 	int Rt = kvm_vcpu_sys_get_rt(vcpu);
4958 	int Rt2 = (esr >> 10) & 0x1f;
4959 
4960 	params.CRm = (esr >> 1) & 0xf;
4961 	params.is_write = ((esr & 1) == 0);
4962 
4963 	params.Op0 = 0;
4964 	params.Op1 = (esr >> 16) & 0xf;
4965 	params.Op2 = 0;
4966 	params.CRn = 0;
4967 
4968 	/*
4969 	 * Make a 64-bit value out of Rt and Rt2. As we use the same trap
4970 	 * backends between AArch32 and AArch64, we get away with it.
4971 	 */
4972 	params.regval = vcpu_get_reg(vcpu, Rt) & 0xffffffff;
4973 	params.regval |= vcpu_get_reg(vcpu, Rt2) << 32;
4974 
4975 	/*
4976 	 * If the table contains a handler, handle the
4977 	 * potential register operation in the case of a read and return
4978 	 * with success.
4979 	 */
4980 	if (emulate_cp(vcpu, &params, global, nr_global)) {
4981 		/* Split up the value between registers for the read side */
4982 		if (!params.is_write) {
4983 			vcpu_set_reg(vcpu, Rt, lower_32_bits(params.regval));
4984 			vcpu_set_reg(vcpu, Rt2, upper_32_bits(params.regval));
4985 		}
4986 
4987 		return 1;
4988 	}
4989 
4990 	unhandled_cp_access(vcpu, &params);
4991 	return 1;
4992 }
4993 
4994 static bool emulate_sys_reg(struct kvm_vcpu *vcpu, struct sys_reg_params *params);
4995 
4996 /*
4997  * The CP10 ID registers are architecturally mapped to AArch64 feature
4998  * registers. Abuse that fact so we can rely on the AArch64 handler for accesses
4999  * from AArch32.
5000  */
5001 static bool kvm_esr_cp10_id_to_sys64(u64 esr, struct sys_reg_params *params)
5002 {
5003 	u8 reg_id = (esr >> 10) & 0xf;
5004 	bool valid;
5005 
5006 	params->is_write = ((esr & 1) == 0);
5007 	params->Op0 = 3;
5008 	params->Op1 = 0;
5009 	params->CRn = 0;
5010 	params->CRm = 3;
5011 
5012 	/* CP10 ID registers are read-only */
5013 	valid = !params->is_write;
5014 
5015 	switch (reg_id) {
5016 	/* MVFR0 */
5017 	case 0b0111:
5018 		params->Op2 = 0;
5019 		break;
5020 	/* MVFR1 */
5021 	case 0b0110:
5022 		params->Op2 = 1;
5023 		break;
5024 	/* MVFR2 */
5025 	case 0b0101:
5026 		params->Op2 = 2;
5027 		break;
5028 	default:
5029 		valid = false;
5030 	}
5031 
5032 	if (valid)
5033 		return true;
5034 
5035 	kvm_pr_unimpl("Unhandled cp10 register %s: %u\n",
5036 		      str_write_read(params->is_write), reg_id);
5037 	return false;
5038 }
5039 
5040 /**
5041  * kvm_handle_cp10_id() - Handles a VMRS trap on guest access to a 'Media and
5042  *			  VFP Register' from AArch32.
5043  * @vcpu: The vCPU pointer
5044  *
5045  * MVFR{0-2} are architecturally mapped to the AArch64 MVFR{0-2}_EL1 registers.
5046  * Work out the correct AArch64 system register encoding and reroute to the
5047  * AArch64 system register emulation.
5048  */
5049 int kvm_handle_cp10_id(struct kvm_vcpu *vcpu)
5050 {
5051 	int Rt = kvm_vcpu_sys_get_rt(vcpu);
5052 	u64 esr = kvm_vcpu_get_esr(vcpu);
5053 	struct sys_reg_params params;
5054 
5055 	/* UNDEF on any unhandled register access */
5056 	if (!kvm_esr_cp10_id_to_sys64(esr, &params)) {
5057 		kvm_inject_undefined(vcpu);
5058 		return 1;
5059 	}
5060 
5061 	if (emulate_sys_reg(vcpu, &params))
5062 		vcpu_set_reg(vcpu, Rt, params.regval);
5063 
5064 	return 1;
5065 }
5066 
5067 /**
5068  * kvm_emulate_cp15_id_reg() - Handles an MRC trap on a guest CP15 access where
5069  *			       CRn=0, which corresponds to the AArch32 feature
5070  *			       registers.
5071  * @vcpu: the vCPU pointer
5072  * @params: the system register access parameters.
5073  *
5074  * Our cp15 system register tables do not enumerate the AArch32 feature
5075  * registers. Conveniently, our AArch64 table does, and the AArch32 system
5076  * register encoding can be trivially remapped into the AArch64 for the feature
5077  * registers: Append op0=3, leaving op1, CRn, CRm, and op2 the same.
5078  *
5079  * According to DDI0487G.b G7.3.1, paragraph "Behavior of VMSAv8-32 32-bit
5080  * System registers with (coproc=0b1111, CRn==c0)", read accesses from this
5081  * range are either UNKNOWN or RES0. Rerouting remains architectural as we
5082  * treat undefined registers in this range as RAZ.
5083  */
5084 static int kvm_emulate_cp15_id_reg(struct kvm_vcpu *vcpu,
5085 				   struct sys_reg_params *params)
5086 {
5087 	int Rt = kvm_vcpu_sys_get_rt(vcpu);
5088 
5089 	/* Treat impossible writes to RO registers as UNDEFINED */
5090 	if (params->is_write) {
5091 		unhandled_cp_access(vcpu, params);
5092 		return 1;
5093 	}
5094 
5095 	params->Op0 = 3;
5096 
5097 	/*
5098 	 * All registers where CRm > 3 are known to be UNKNOWN/RAZ from AArch32.
5099 	 * Avoid conflicting with future expansion of AArch64 feature registers
5100 	 * and simply treat them as RAZ here.
5101 	 */
5102 	if (params->CRm > 3)
5103 		params->regval = 0;
5104 	else if (!emulate_sys_reg(vcpu, params))
5105 		return 1;
5106 
5107 	vcpu_set_reg(vcpu, Rt, params->regval);
5108 	return 1;
5109 }
5110 
5111 /**
5112  * kvm_handle_cp_32 -- handles a mrc/mcr trap on a guest CP14/CP15 access
5113  * @vcpu: The VCPU pointer
5114  * @params: &struct sys_reg_params
5115  * @global: &struct sys_reg_desc
5116  * @nr_global: size of the @global array
5117  */
5118 static int kvm_handle_cp_32(struct kvm_vcpu *vcpu,
5119 			    struct sys_reg_params *params,
5120 			    const struct sys_reg_desc *global,
5121 			    size_t nr_global)
5122 {
5123 	int Rt  = kvm_vcpu_sys_get_rt(vcpu);
5124 
5125 	params->regval = vcpu_get_reg(vcpu, Rt);
5126 
5127 	if (emulate_cp(vcpu, params, global, nr_global)) {
5128 		if (!params->is_write)
5129 			vcpu_set_reg(vcpu, Rt, params->regval);
5130 		return 1;
5131 	}
5132 
5133 	unhandled_cp_access(vcpu, params);
5134 	return 1;
5135 }
5136 
5137 int kvm_handle_cp15_64(struct kvm_vcpu *vcpu)
5138 {
5139 	return kvm_handle_cp_64(vcpu, cp15_64_regs, ARRAY_SIZE(cp15_64_regs));
5140 }
5141 
5142 int kvm_handle_cp15_32(struct kvm_vcpu *vcpu)
5143 {
5144 	struct sys_reg_params params;
5145 
5146 	params = esr_cp1x_32_to_params(kvm_vcpu_get_esr(vcpu));
5147 
5148 	/*
5149 	 * Certain AArch32 ID registers are handled by rerouting to the AArch64
5150 	 * system register table. Registers in the ID range where CRm=0 are
5151 	 * excluded from this scheme as they do not trivially map into AArch64
5152 	 * system register encodings, except for AIDR/REVIDR.
5153 	 */
5154 	if (params.Op1 == 0 && params.CRn == 0 &&
5155 	    (params.CRm || params.Op2 == 6 /* REVIDR */))
5156 		return kvm_emulate_cp15_id_reg(vcpu, &params);
5157 	if (params.Op1 == 1 && params.CRn == 0 &&
5158 	    params.CRm == 0 && params.Op2 == 7 /* AIDR */)
5159 		return kvm_emulate_cp15_id_reg(vcpu, &params);
5160 
5161 	return kvm_handle_cp_32(vcpu, &params, cp15_regs, ARRAY_SIZE(cp15_regs));
5162 }
5163 
5164 int kvm_handle_cp14_64(struct kvm_vcpu *vcpu)
5165 {
5166 	return kvm_handle_cp_64(vcpu, cp14_64_regs, ARRAY_SIZE(cp14_64_regs));
5167 }
5168 
5169 int kvm_handle_cp14_32(struct kvm_vcpu *vcpu)
5170 {
5171 	struct sys_reg_params params;
5172 
5173 	params = esr_cp1x_32_to_params(kvm_vcpu_get_esr(vcpu));
5174 
5175 	return kvm_handle_cp_32(vcpu, &params, cp14_regs, ARRAY_SIZE(cp14_regs));
5176 }
5177 
5178 /**
5179  * emulate_sys_reg - Emulate a guest access to an AArch64 system register
5180  * @vcpu: The VCPU pointer
5181  * @params: Decoded system register parameters
5182  *
5183  * Return: true if the system register access was successful, false otherwise.
5184  */
5185 static bool emulate_sys_reg(struct kvm_vcpu *vcpu,
5186 			    struct sys_reg_params *params)
5187 {
5188 	const struct sys_reg_desc *r;
5189 
5190 	r = find_reg(params, sys_reg_descs, ARRAY_SIZE(sys_reg_descs));
5191 	if (likely(r)) {
5192 		perform_access(vcpu, params, r);
5193 		return true;
5194 	}
5195 
5196 	print_sys_reg_msg(params,
5197 			  "Unsupported guest sys_reg access at: %lx [%08lx]\n",
5198 			  *vcpu_pc(vcpu), *vcpu_cpsr(vcpu));
5199 	kvm_inject_undefined(vcpu);
5200 
5201 	return false;
5202 }
5203 
5204 static const struct sys_reg_desc *idregs_debug_find(struct kvm *kvm, loff_t pos)
5205 {
5206 	unsigned long i, idreg_idx = 0;
5207 
5208 	for (i = 0; i < ARRAY_SIZE(sys_reg_descs); i++) {
5209 		const struct sys_reg_desc *r = &sys_reg_descs[i];
5210 
5211 		if (!is_vm_ftr_id_reg(reg_to_encoding(r)))
5212 			continue;
5213 
5214 		if (idreg_idx++ == pos)
5215 			return r;
5216 	}
5217 
5218 	return NULL;
5219 }
5220 
5221 static void *idregs_debug_start(struct seq_file *s, loff_t *pos)
5222 {
5223 	struct kvm *kvm = s->private;
5224 
5225 	if (!test_bit(KVM_ARCH_FLAG_ID_REGS_INITIALIZED, &kvm->arch.flags))
5226 		return NULL;
5227 
5228 	return (void *)idregs_debug_find(kvm, *pos);
5229 }
5230 
5231 static void *idregs_debug_next(struct seq_file *s, void *v, loff_t *pos)
5232 {
5233 	struct kvm *kvm = s->private;
5234 
5235 	(*pos)++;
5236 
5237 	return (void *)idregs_debug_find(kvm, *pos);
5238 }
5239 
5240 static void idregs_debug_stop(struct seq_file *s, void *v)
5241 {
5242 }
5243 
5244 static int idregs_debug_show(struct seq_file *s, void *v)
5245 {
5246 	const struct sys_reg_desc *desc = v;
5247 	struct kvm *kvm = s->private;
5248 
5249 	if (!desc)
5250 		return 0;
5251 
5252 	seq_printf(s, "%20s:\t%016llx\n",
5253 		   desc->name, kvm_read_vm_id_reg(kvm, reg_to_encoding(desc)));
5254 
5255 	return 0;
5256 }
5257 
5258 static const struct seq_operations idregs_debug_sops = {
5259 	.start	= idregs_debug_start,
5260 	.next	= idregs_debug_next,
5261 	.stop	= idregs_debug_stop,
5262 	.show	= idregs_debug_show,
5263 };
5264 
5265 DEFINE_SEQ_ATTRIBUTE(idregs_debug);
5266 
5267 static const struct sys_reg_desc *sr_resx_find(struct kvm *kvm, loff_t pos)
5268 {
5269 	unsigned long i, sr_idx = 0;
5270 
5271 	for (i = 0; i < ARRAY_SIZE(sys_reg_descs); i++) {
5272 		const struct sys_reg_desc *r = &sys_reg_descs[i];
5273 
5274 		if (r->reg < __SANITISED_REG_START__)
5275 			continue;
5276 
5277 		if (sr_idx++ == pos)
5278 			return r;
5279 	}
5280 
5281 	return NULL;
5282 }
5283 
5284 static void *sr_resx_start(struct seq_file *s, loff_t *pos)
5285 {
5286 	struct kvm *kvm = s->private;
5287 
5288 	if (!kvm->arch.sysreg_masks)
5289 		return NULL;
5290 
5291 	return (void *)sr_resx_find(kvm, *pos);
5292 }
5293 
5294 static void *sr_resx_next(struct seq_file *s, void *v, loff_t *pos)
5295 {
5296 	struct kvm *kvm = s->private;
5297 
5298 	(*pos)++;
5299 
5300 	return (void *)sr_resx_find(kvm, *pos);
5301 }
5302 
5303 static void sr_resx_stop(struct seq_file *s, void *v)
5304 {
5305 }
5306 
5307 static int sr_resx_show(struct seq_file *s, void *v)
5308 {
5309 	const struct sys_reg_desc *desc = v;
5310 	struct kvm *kvm = s->private;
5311 	struct resx resx;
5312 
5313 	if (!desc)
5314 		return 0;
5315 
5316 	resx = kvm_get_sysreg_resx(kvm, desc->reg);
5317 
5318 	seq_printf(s, "%20s:\tRES0:%016llx\tRES1:%016llx\n",
5319 		   desc->name, resx.res0, resx.res1);
5320 
5321 	return 0;
5322 }
5323 
5324 static const struct seq_operations sr_resx_sops = {
5325 	.start	= sr_resx_start,
5326 	.next	= sr_resx_next,
5327 	.stop	= sr_resx_stop,
5328 	.show	= sr_resx_show,
5329 };
5330 
5331 DEFINE_SEQ_ATTRIBUTE(sr_resx);
5332 
5333 void kvm_sys_regs_create_debugfs(struct kvm *kvm)
5334 {
5335 	debugfs_create_file("idregs", 0444, kvm->debugfs_dentry, kvm,
5336 			    &idregs_debug_fops);
5337 	debugfs_create_file("resx", 0444, kvm->debugfs_dentry, kvm,
5338 			    &sr_resx_fops);
5339 }
5340 
5341 static void reset_vm_ftr_id_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *reg)
5342 {
5343 	u32 id = reg_to_encoding(reg);
5344 	struct kvm *kvm = vcpu->kvm;
5345 
5346 	if (test_bit(KVM_ARCH_FLAG_ID_REGS_INITIALIZED, &kvm->arch.flags))
5347 		return;
5348 
5349 	kvm_set_vm_id_reg(kvm, id, reg->reset(vcpu, reg));
5350 }
5351 
5352 static void reset_vcpu_ftr_id_reg(struct kvm_vcpu *vcpu,
5353 				  const struct sys_reg_desc *reg)
5354 {
5355 	if (kvm_vcpu_initialized(vcpu))
5356 		return;
5357 
5358 	reg->reset(vcpu, reg);
5359 }
5360 
5361 /**
5362  * kvm_reset_sys_regs - sets system registers to reset value
5363  * @vcpu: The VCPU pointer
5364  *
5365  * This function finds the right table above and sets the registers on the
5366  * virtual CPU struct to their architecturally defined reset values.
5367  */
5368 void kvm_reset_sys_regs(struct kvm_vcpu *vcpu)
5369 {
5370 	struct kvm *kvm = vcpu->kvm;
5371 	unsigned long i;
5372 
5373 	for (i = 0; i < ARRAY_SIZE(sys_reg_descs); i++) {
5374 		const struct sys_reg_desc *r = &sys_reg_descs[i];
5375 
5376 		if (!r->reset)
5377 			continue;
5378 
5379 		if (is_vm_ftr_id_reg(reg_to_encoding(r)))
5380 			reset_vm_ftr_id_reg(vcpu, r);
5381 		else if (is_vcpu_ftr_id_reg(reg_to_encoding(r)))
5382 			reset_vcpu_ftr_id_reg(vcpu, r);
5383 		else
5384 			r->reset(vcpu, r);
5385 
5386 		if (r->reg >= __SANITISED_REG_START__ && r->reg < NR_SYS_REGS)
5387 			__vcpu_rmw_sys_reg(vcpu, r->reg, |=, 0);
5388 	}
5389 
5390 	set_bit(KVM_ARCH_FLAG_ID_REGS_INITIALIZED, &kvm->arch.flags);
5391 
5392 	if (kvm_vcpu_has_pmu(vcpu))
5393 		kvm_make_request(KVM_REQ_RELOAD_PMU, vcpu);
5394 }
5395 
5396 /**
5397  * kvm_handle_sys_reg -- handles a system instruction or mrs/msr instruction
5398  *			 trap on a guest execution
5399  * @vcpu: The VCPU pointer
5400  */
5401 int kvm_handle_sys_reg(struct kvm_vcpu *vcpu)
5402 {
5403 	const struct sys_reg_desc *desc = NULL;
5404 	struct sys_reg_params params;
5405 	unsigned long esr = kvm_vcpu_get_esr(vcpu);
5406 	int Rt = kvm_vcpu_sys_get_rt(vcpu);
5407 	int sr_idx;
5408 
5409 	trace_kvm_handle_sys_reg(esr);
5410 
5411 	if (triage_sysreg_trap(vcpu, &sr_idx))
5412 		return 1;
5413 
5414 	params = esr_sys64_to_params(esr);
5415 	params.regval = vcpu_get_reg(vcpu, Rt);
5416 
5417 	/* System registers have Op0=={2,3}, as per DDI487 J.a C5.1.2 */
5418 	if (params.Op0 == 2 || params.Op0 == 3)
5419 		desc = &sys_reg_descs[sr_idx];
5420 	else
5421 		desc = &sys_insn_descs[sr_idx];
5422 
5423 	perform_access(vcpu, &params, desc);
5424 
5425 	/* Read from system register? */
5426 	if (!params.is_write &&
5427 	    (params.Op0 == 2 || params.Op0 == 3))
5428 		vcpu_set_reg(vcpu, Rt, params.regval);
5429 
5430 	return 1;
5431 }
5432 
5433 /******************************************************************************
5434  * Userspace API
5435  *****************************************************************************/
5436 
5437 static bool index_to_params(u64 id, struct sys_reg_params *params)
5438 {
5439 	switch (id & KVM_REG_SIZE_MASK) {
5440 	case KVM_REG_SIZE_U64:
5441 		/* Any unused index bits means it's not valid. */
5442 		if (id & ~(KVM_REG_ARCH_MASK | KVM_REG_SIZE_MASK
5443 			      | KVM_REG_ARM_COPROC_MASK
5444 			      | KVM_REG_ARM64_SYSREG_OP0_MASK
5445 			      | KVM_REG_ARM64_SYSREG_OP1_MASK
5446 			      | KVM_REG_ARM64_SYSREG_CRN_MASK
5447 			      | KVM_REG_ARM64_SYSREG_CRM_MASK
5448 			      | KVM_REG_ARM64_SYSREG_OP2_MASK))
5449 			return false;
5450 		params->Op0 = ((id & KVM_REG_ARM64_SYSREG_OP0_MASK)
5451 			       >> KVM_REG_ARM64_SYSREG_OP0_SHIFT);
5452 		params->Op1 = ((id & KVM_REG_ARM64_SYSREG_OP1_MASK)
5453 			       >> KVM_REG_ARM64_SYSREG_OP1_SHIFT);
5454 		params->CRn = ((id & KVM_REG_ARM64_SYSREG_CRN_MASK)
5455 			       >> KVM_REG_ARM64_SYSREG_CRN_SHIFT);
5456 		params->CRm = ((id & KVM_REG_ARM64_SYSREG_CRM_MASK)
5457 			       >> KVM_REG_ARM64_SYSREG_CRM_SHIFT);
5458 		params->Op2 = ((id & KVM_REG_ARM64_SYSREG_OP2_MASK)
5459 			       >> KVM_REG_ARM64_SYSREG_OP2_SHIFT);
5460 		return true;
5461 	default:
5462 		return false;
5463 	}
5464 }
5465 
5466 const struct sys_reg_desc *get_reg_by_id(u64 id,
5467 					 const struct sys_reg_desc table[],
5468 					 unsigned int num)
5469 {
5470 	struct sys_reg_params params;
5471 
5472 	if (!index_to_params(id, &params))
5473 		return NULL;
5474 
5475 	return find_reg(&params, table, num);
5476 }
5477 
5478 /* Decode an index value, and find the sys_reg_desc entry. */
5479 static const struct sys_reg_desc *
5480 id_to_sys_reg_desc(struct kvm_vcpu *vcpu, u64 id,
5481 		   const struct sys_reg_desc table[], unsigned int num)
5482 
5483 {
5484 	const struct sys_reg_desc *r;
5485 
5486 	/* We only do sys_reg for now. */
5487 	if ((id & KVM_REG_ARM_COPROC_MASK) != KVM_REG_ARM64_SYSREG)
5488 		return NULL;
5489 
5490 	r = get_reg_by_id(id, table, num);
5491 
5492 	/* Not saved in the sys_reg array and not otherwise accessible? */
5493 	if (r && (!(r->reg || r->get_user) || sysreg_hidden(vcpu, r)))
5494 		r = NULL;
5495 
5496 	return r;
5497 }
5498 
5499 static int demux_c15_get(struct kvm_vcpu *vcpu, u64 id, void __user *uaddr)
5500 {
5501 	u32 val;
5502 	u32 __user *uval = uaddr;
5503 
5504 	/* Fail if we have unknown bits set. */
5505 	if (id & ~(KVM_REG_ARCH_MASK|KVM_REG_SIZE_MASK|KVM_REG_ARM_COPROC_MASK
5506 		   | ((1 << KVM_REG_ARM_COPROC_SHIFT)-1)))
5507 		return -ENOENT;
5508 
5509 	switch (id & KVM_REG_ARM_DEMUX_ID_MASK) {
5510 	case KVM_REG_ARM_DEMUX_ID_CCSIDR:
5511 		if (KVM_REG_SIZE(id) != 4)
5512 			return -ENOENT;
5513 		val = (id & KVM_REG_ARM_DEMUX_VAL_MASK)
5514 			>> KVM_REG_ARM_DEMUX_VAL_SHIFT;
5515 		if (val >= CSSELR_MAX)
5516 			return -ENOENT;
5517 
5518 		return put_user(get_ccsidr(vcpu, val), uval);
5519 	default:
5520 		return -ENOENT;
5521 	}
5522 }
5523 
5524 static int demux_c15_set(struct kvm_vcpu *vcpu, u64 id, void __user *uaddr)
5525 {
5526 	u32 val, newval;
5527 	u32 __user *uval = uaddr;
5528 
5529 	/* Fail if we have unknown bits set. */
5530 	if (id & ~(KVM_REG_ARCH_MASK|KVM_REG_SIZE_MASK|KVM_REG_ARM_COPROC_MASK
5531 		   | ((1 << KVM_REG_ARM_COPROC_SHIFT)-1)))
5532 		return -ENOENT;
5533 
5534 	switch (id & KVM_REG_ARM_DEMUX_ID_MASK) {
5535 	case KVM_REG_ARM_DEMUX_ID_CCSIDR:
5536 		if (KVM_REG_SIZE(id) != 4)
5537 			return -ENOENT;
5538 		val = (id & KVM_REG_ARM_DEMUX_VAL_MASK)
5539 			>> KVM_REG_ARM_DEMUX_VAL_SHIFT;
5540 		if (val >= CSSELR_MAX)
5541 			return -ENOENT;
5542 
5543 		if (get_user(newval, uval))
5544 			return -EFAULT;
5545 
5546 		return set_ccsidr(vcpu, val, newval);
5547 	default:
5548 		return -ENOENT;
5549 	}
5550 }
5551 
5552 static u64 kvm_one_reg_to_id(const struct kvm_one_reg *reg)
5553 {
5554 	switch(reg->id) {
5555 	case KVM_REG_ARM_TIMER_CVAL:
5556 		return TO_ARM64_SYS_REG(CNTV_CVAL_EL0);
5557 	case KVM_REG_ARM_TIMER_CNT:
5558 		return TO_ARM64_SYS_REG(CNTVCT_EL0);
5559 	default:
5560 		return reg->id;
5561 	}
5562 }
5563 
5564 int kvm_sys_reg_get_user(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg,
5565 			 const struct sys_reg_desc table[], unsigned int num)
5566 {
5567 	u64 __user *uaddr = (u64 __user *)(unsigned long)reg->addr;
5568 	const struct sys_reg_desc *r;
5569 	u64 id = kvm_one_reg_to_id(reg);
5570 	u64 val;
5571 	int ret;
5572 
5573 	r = id_to_sys_reg_desc(vcpu, id, table, num);
5574 	if (!r || sysreg_hidden(vcpu, r))
5575 		return -ENOENT;
5576 
5577 	if (r->get_user) {
5578 		ret = (r->get_user)(vcpu, r, &val);
5579 	} else {
5580 		val = __vcpu_sys_reg(vcpu, r->reg);
5581 		ret = 0;
5582 	}
5583 
5584 	if (!ret)
5585 		ret = put_user(val, uaddr);
5586 
5587 	return ret;
5588 }
5589 
5590 int kvm_arm_sys_reg_get_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
5591 {
5592 	void __user *uaddr = (void __user *)(unsigned long)reg->addr;
5593 
5594 	if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_DEMUX)
5595 		return demux_c15_get(vcpu, reg->id, uaddr);
5596 
5597 	return kvm_sys_reg_get_user(vcpu, reg,
5598 				    sys_reg_descs, ARRAY_SIZE(sys_reg_descs));
5599 }
5600 
5601 int kvm_sys_reg_set_user(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg,
5602 			 const struct sys_reg_desc table[], unsigned int num)
5603 {
5604 	u64 __user *uaddr = (u64 __user *)(unsigned long)reg->addr;
5605 	const struct sys_reg_desc *r;
5606 	u64 id = kvm_one_reg_to_id(reg);
5607 	u64 val;
5608 	int ret;
5609 
5610 	if (get_user(val, uaddr))
5611 		return -EFAULT;
5612 
5613 	r = id_to_sys_reg_desc(vcpu, id, table, num);
5614 	if (!r || sysreg_hidden(vcpu, r))
5615 		return -ENOENT;
5616 
5617 	if (sysreg_user_write_ignore(vcpu, r))
5618 		return 0;
5619 
5620 	if (r->set_user) {
5621 		ret = (r->set_user)(vcpu, r, val);
5622 	} else {
5623 		__vcpu_assign_sys_reg(vcpu, r->reg, val);
5624 		ret = 0;
5625 	}
5626 
5627 	return ret;
5628 }
5629 
5630 int kvm_arm_sys_reg_set_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
5631 {
5632 	void __user *uaddr = (void __user *)(unsigned long)reg->addr;
5633 
5634 	if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_DEMUX)
5635 		return demux_c15_set(vcpu, reg->id, uaddr);
5636 
5637 	return kvm_sys_reg_set_user(vcpu, reg,
5638 				    sys_reg_descs, ARRAY_SIZE(sys_reg_descs));
5639 }
5640 
5641 static unsigned int num_demux_regs(void)
5642 {
5643 	return CSSELR_MAX;
5644 }
5645 
5646 static int write_demux_regids(u64 __user *uindices)
5647 {
5648 	u64 val = KVM_REG_ARM64 | KVM_REG_SIZE_U32 | KVM_REG_ARM_DEMUX;
5649 	unsigned int i;
5650 
5651 	val |= KVM_REG_ARM_DEMUX_ID_CCSIDR;
5652 	for (i = 0; i < CSSELR_MAX; i++) {
5653 		if (put_user(val | i, uindices))
5654 			return -EFAULT;
5655 		uindices++;
5656 	}
5657 	return 0;
5658 }
5659 
5660 static u64 sys_reg_to_index(const struct sys_reg_desc *reg)
5661 {
5662 	return (KVM_REG_ARM64 | KVM_REG_SIZE_U64 |
5663 		KVM_REG_ARM64_SYSREG |
5664 		(reg->Op0 << KVM_REG_ARM64_SYSREG_OP0_SHIFT) |
5665 		(reg->Op1 << KVM_REG_ARM64_SYSREG_OP1_SHIFT) |
5666 		(reg->CRn << KVM_REG_ARM64_SYSREG_CRN_SHIFT) |
5667 		(reg->CRm << KVM_REG_ARM64_SYSREG_CRM_SHIFT) |
5668 		(reg->Op2 << KVM_REG_ARM64_SYSREG_OP2_SHIFT));
5669 }
5670 
5671 static bool copy_reg_to_user(const struct sys_reg_desc *reg, u64 __user **uind)
5672 {
5673 	u64 idx;
5674 
5675 	if (!*uind)
5676 		return true;
5677 
5678 	switch (reg_to_encoding(reg)) {
5679 	case SYS_CNTV_CVAL_EL0:
5680 		idx = KVM_REG_ARM_TIMER_CVAL;
5681 		break;
5682 	case SYS_CNTVCT_EL0:
5683 		idx = KVM_REG_ARM_TIMER_CNT;
5684 		break;
5685 	default:
5686 		idx = sys_reg_to_index(reg);
5687 	}
5688 
5689 	if (put_user(idx, *uind))
5690 		return false;
5691 
5692 	(*uind)++;
5693 	return true;
5694 }
5695 
5696 static int walk_one_sys_reg(const struct kvm_vcpu *vcpu,
5697 			    const struct sys_reg_desc *rd,
5698 			    u64 __user **uind,
5699 			    unsigned int *total)
5700 {
5701 	/*
5702 	 * Ignore registers we trap but don't save,
5703 	 * and for which no custom user accessor is provided.
5704 	 */
5705 	if (!(rd->reg || rd->get_user))
5706 		return 0;
5707 
5708 	if (sysreg_hidden(vcpu, rd))
5709 		return 0;
5710 
5711 	if (!copy_reg_to_user(rd, uind))
5712 		return -EFAULT;
5713 
5714 	(*total)++;
5715 	return 0;
5716 }
5717 
5718 /* Assumed ordered tables, see kvm_sys_reg_table_init. */
5719 static int walk_sys_regs(struct kvm_vcpu *vcpu, u64 __user *uind)
5720 {
5721 	const struct sys_reg_desc *i2, *end2;
5722 	unsigned int total = 0;
5723 	int err;
5724 
5725 	i2 = sys_reg_descs;
5726 	end2 = sys_reg_descs + ARRAY_SIZE(sys_reg_descs);
5727 
5728 	while (i2 != end2) {
5729 		err = walk_one_sys_reg(vcpu, i2++, &uind, &total);
5730 		if (err)
5731 			return err;
5732 	}
5733 	return total;
5734 }
5735 
5736 unsigned long kvm_arm_num_sys_reg_descs(struct kvm_vcpu *vcpu)
5737 {
5738 	return num_demux_regs()
5739 		+ walk_sys_regs(vcpu, (u64 __user *)NULL);
5740 }
5741 
5742 int kvm_arm_copy_sys_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices)
5743 {
5744 	int err;
5745 
5746 	err = walk_sys_regs(vcpu, uindices);
5747 	if (err < 0)
5748 		return err;
5749 	uindices += err;
5750 
5751 	return write_demux_regids(uindices);
5752 }
5753 
5754 #define KVM_ARM_FEATURE_ID_RANGE_INDEX(r)			\
5755 	KVM_ARM_FEATURE_ID_RANGE_IDX(sys_reg_Op0(r),		\
5756 		sys_reg_Op1(r),					\
5757 		sys_reg_CRn(r),					\
5758 		sys_reg_CRm(r),					\
5759 		sys_reg_Op2(r))
5760 
5761 int kvm_vm_ioctl_get_reg_writable_masks(struct kvm *kvm, struct reg_mask_range *range)
5762 {
5763 	const void *zero_page = page_to_virt(ZERO_PAGE(0));
5764 	u64 __user *masks = (u64 __user *)range->addr;
5765 
5766 	/* Only feature id range is supported, reserved[13] must be zero. */
5767 	if (range->range ||
5768 	    memcmp(range->reserved, zero_page, sizeof(range->reserved)))
5769 		return -EINVAL;
5770 
5771 	/* Wipe the whole thing first */
5772 	if (clear_user(masks, KVM_ARM_FEATURE_ID_RANGE_SIZE * sizeof(__u64)))
5773 		return -EFAULT;
5774 
5775 	for (int i = 0; i < ARRAY_SIZE(sys_reg_descs); i++) {
5776 		const struct sys_reg_desc *reg = &sys_reg_descs[i];
5777 		u32 encoding = reg_to_encoding(reg);
5778 		u64 val;
5779 
5780 		if (!is_feature_id_reg(encoding) || !reg->set_user)
5781 			continue;
5782 
5783 		if (!reg->val ||
5784 		    (is_aa32_id_reg(encoding) && !kvm_supports_32bit_el0())) {
5785 			continue;
5786 		}
5787 		val = reg->val;
5788 
5789 		if (put_user(val, (masks + KVM_ARM_FEATURE_ID_RANGE_INDEX(encoding))))
5790 			return -EFAULT;
5791 	}
5792 
5793 	return 0;
5794 }
5795 
5796 static void vcpu_set_hcr(struct kvm_vcpu *vcpu)
5797 {
5798 	struct kvm *kvm = vcpu->kvm;
5799 
5800 	if (has_vhe() || has_hvhe())
5801 		vcpu->arch.hcr_el2 |= HCR_E2H;
5802 	if (cpus_have_final_cap(ARM64_HAS_RAS_EXTN)) {
5803 		/* route synchronous external abort exceptions to EL2 */
5804 		vcpu->arch.hcr_el2 |= HCR_TEA;
5805 		/* trap error record accesses */
5806 		vcpu->arch.hcr_el2 |= HCR_TERR;
5807 	}
5808 
5809 	if (cpus_have_final_cap(ARM64_HAS_STAGE2_FWB))
5810 		vcpu->arch.hcr_el2 |= HCR_FWB;
5811 
5812 	if (cpus_have_final_cap(ARM64_HAS_EVT) &&
5813 	    !cpus_have_final_cap(ARM64_MISMATCHED_CACHE_TYPE) &&
5814 	    kvm_read_vm_id_reg(kvm, SYS_CTR_EL0) == read_sanitised_ftr_reg(SYS_CTR_EL0))
5815 		vcpu->arch.hcr_el2 |= HCR_TID4;
5816 	else
5817 		vcpu->arch.hcr_el2 |= HCR_TID2;
5818 
5819 	if (vcpu_el1_is_32bit(vcpu))
5820 		vcpu->arch.hcr_el2 &= ~HCR_RW;
5821 
5822 	if (kvm_has_mte(vcpu->kvm))
5823 		vcpu->arch.hcr_el2 |= HCR_ATA;
5824 	else
5825 		vcpu->arch.hcr_el2 |= HCR_TID5;
5826 
5827 	/*
5828 	 * In the absence of FGT, we cannot independently trap TLBI
5829 	 * Range instructions. This isn't great, but trapping all
5830 	 * TLBIs would be far worse. Live with it...
5831 	 */
5832 	if (!kvm_has_feat(kvm, ID_AA64ISAR0_EL1, TLB, OS))
5833 		vcpu->arch.hcr_el2 |= HCR_TTLBOS;
5834 }
5835 
5836 void kvm_calculate_traps(struct kvm_vcpu *vcpu)
5837 {
5838 	struct kvm *kvm = vcpu->kvm;
5839 
5840 	mutex_lock(&kvm->arch.config_lock);
5841 	vcpu_set_hcr(vcpu);
5842 	vcpu_set_ich_hcr(vcpu);
5843 	vcpu_set_hcrx(vcpu);
5844 
5845 	if (test_bit(KVM_ARCH_FLAG_FGU_INITIALIZED, &kvm->arch.flags))
5846 		goto out;
5847 
5848 	compute_fgu(kvm, HFGRTR_GROUP);
5849 	compute_fgu(kvm, HFGITR_GROUP);
5850 	compute_fgu(kvm, HDFGRTR_GROUP);
5851 	compute_fgu(kvm, HAFGRTR_GROUP);
5852 	compute_fgu(kvm, HFGRTR2_GROUP);
5853 	compute_fgu(kvm, HFGITR2_GROUP);
5854 	compute_fgu(kvm, HDFGRTR2_GROUP);
5855 	compute_fgu(kvm, ICH_HFGRTR_GROUP);
5856 	compute_fgu(kvm, ICH_HFGITR_GROUP);
5857 
5858 	set_bit(KVM_ARCH_FLAG_FGU_INITIALIZED, &kvm->arch.flags);
5859 out:
5860 	mutex_unlock(&kvm->arch.config_lock);
5861 }
5862 
5863 /*
5864  * Perform last adjustments to the ID registers that are implied by the
5865  * configuration outside of the ID regs themselves, as well as any
5866  * initialisation that directly depend on these ID registers (such as
5867  * RES0/RES1 behaviours). This is not the place to configure traps though.
5868  *
5869  * Because this can be called once per CPU, changes must be idempotent.
5870  */
5871 int kvm_finalize_sys_regs(struct kvm_vcpu *vcpu)
5872 {
5873 	struct kvm *kvm = vcpu->kvm;
5874 
5875 	guard(mutex)(&kvm->arch.config_lock);
5876 
5877 	if (vcpu_has_nv(vcpu)) {
5878 		int ret = kvm_init_nv_sysregs(vcpu);
5879 		if (ret)
5880 			return ret;
5881 	}
5882 
5883 	if (kvm_vm_has_ran_once(kvm))
5884 		return 0;
5885 
5886 	/*
5887 	 * This hacks into the ID registers, so only perform it when the
5888 	 * first vcpu runs, or the kvm_set_vm_id_reg() helper will scream.
5889 	 */
5890 	if (!irqchip_in_kernel(kvm)) {
5891 		u64 val;
5892 
5893 		val = kvm_read_vm_id_reg(kvm, SYS_ID_AA64PFR0_EL1) & ~ID_AA64PFR0_EL1_GIC;
5894 		kvm_set_vm_id_reg(kvm, SYS_ID_AA64PFR0_EL1, val);
5895 		val = kvm_read_vm_id_reg(kvm, SYS_ID_AA64PFR2_EL1) & ~ID_AA64PFR2_EL1_GCIE;
5896 		kvm_set_vm_id_reg(kvm, SYS_ID_AA64PFR2_EL1, val);
5897 		val = kvm_read_vm_id_reg(kvm, SYS_ID_PFR1_EL1) & ~ID_PFR1_EL1_GIC;
5898 		kvm_set_vm_id_reg(kvm, SYS_ID_PFR1_EL1, val);
5899 	} else {
5900 		/*
5901 		 * Certain userspace software - QEMU - samples the system
5902 		 * register state without creating an irqchip, then blindly
5903 		 * restores the state prior to running the final guest. This
5904 		 * means that it restores the virtualization & emulation
5905 		 * capabilities of the host system, rather than something that
5906 		 * reflects the final guest state. Moreover, it checks that the
5907 		 * state was "correctly" restored (i.e., verbatim), bailing if
5908 		 * it isn't, so masking off invalid state isn't an option.
5909 		 *
5910 		 * On GICv5 hardware that supports FEAT_GCIE_LEGACY we can run
5911 		 * both GICv3- and GICv5-based guests. Therefore, we initially
5912 		 * present both ID_AA64PFR0.GIC and ID_AA64PFR2.GCIE as IMP to
5913 		 * reflect that userspace can create EITHER a vGICv3 or a
5914 		 * vGICv5. This is an architecturally invalid combination, of
5915 		 * course. Once an in-kernel GIC is created, the sysreg state is
5916 		 * updated to reflect the actual, valid configuration.
5917 		 *
5918 		 * Setting both the GIC and GCIE features to IMP unsurprisingly
5919 		 * results in guests falling over, and hence we need to fix up
5920 		 * this mess in KVM. Before running for the first time we yet
5921 		 * again ensure that the GIC and GCIE fields accurately reflect
5922 		 * the actual hardware the guest should see.
5923 		 *
5924 		 * This hack allows legacy QEMU-based GICv3 guests to run
5925 		 * unmodified on compatible GICv5 hosts, and avoids the inverse
5926 		 * problem for GICv5-based guests in the future.
5927 		 */
5928 		kvm_vgic_finalize_idregs(kvm);
5929 	}
5930 
5931 	return 0;
5932 }
5933 
5934 int __init kvm_sys_reg_table_init(void)
5935 {
5936 	const struct sys_reg_desc *gicv3_regs;
5937 	bool valid = true;
5938 	unsigned int i, sz;
5939 	int ret = 0;
5940 
5941 	/* Make sure tables are unique and in order. */
5942 	valid &= check_sysreg_table(sys_reg_descs, ARRAY_SIZE(sys_reg_descs), true);
5943 	valid &= check_sysreg_table(cp14_regs, ARRAY_SIZE(cp14_regs), false);
5944 	valid &= check_sysreg_table(cp14_64_regs, ARRAY_SIZE(cp14_64_regs), false);
5945 	valid &= check_sysreg_table(cp15_regs, ARRAY_SIZE(cp15_regs), false);
5946 	valid &= check_sysreg_table(cp15_64_regs, ARRAY_SIZE(cp15_64_regs), false);
5947 	valid &= check_sysreg_table(sys_insn_descs, ARRAY_SIZE(sys_insn_descs), false);
5948 
5949 	gicv3_regs = vgic_v3_get_sysreg_table(&sz);
5950 	valid &= check_sysreg_table(gicv3_regs, sz, false);
5951 
5952 	if (!valid)
5953 		return -EINVAL;
5954 
5955 	init_imp_id_regs();
5956 
5957 	ret = populate_nv_trap_config();
5958 
5959 	check_feature_map();
5960 
5961 	for (i = 0; !ret && i < ARRAY_SIZE(sys_reg_descs); i++)
5962 		ret = populate_sysreg_config(sys_reg_descs + i, i);
5963 
5964 	for (i = 0; !ret && i < ARRAY_SIZE(sys_insn_descs); i++)
5965 		ret = populate_sysreg_config(sys_insn_descs + i, i);
5966 
5967 	return ret;
5968 }
5969