switch.c

  1// SPDX-License-Identifier: GPL-2.0-only
  2/*
  3 * Copyright (C) 2015 - ARM Ltd
  4 * Author: Marc Zyngier <marc.zyngier@arm.com>
  5 */
  6
  7#include <hyp/switch.h>
  8
  9#include <linux/arm-smccc.h>
 10#include <linux/kvm_host.h>
 11#include <linux/types.h>
 12#include <linux/jump_label.h>
 13#include <linux/percpu.h>
 14#include <uapi/linux/psci.h>
 15
 16#include <kvm/arm_psci.h>
 17
 18#include <asm/barrier.h>
 19#include <asm/cpufeature.h>
 20#include <asm/kprobes.h>
 21#include <asm/kvm_asm.h>
 22#include <asm/kvm_emulate.h>
 23#include <asm/kvm_hyp.h>
 24#include <asm/kvm_mmu.h>
 25#include <asm/fpsimd.h>
 26#include <asm/debug-monitors.h>
 27#include <asm/processor.h>
 28#include <asm/thread_info.h>
 29#include <asm/vectors.h>
 30
 31/* VHE specific context */
 32DEFINE_PER_CPU(struct kvm_host_data, kvm_host_data);
 33DEFINE_PER_CPU(struct kvm_cpu_context, kvm_hyp_ctxt);
 34DEFINE_PER_CPU(unsigned long, kvm_hyp_vector);
 35
 36/*
 37 * HCR_EL2 bits that the NV guest can freely change (no RES0/RES1
 38 * semantics, irrespective of the configuration), but that cannot be
 39 * applied to the actual HW as things would otherwise break badly.
 40 *
 41 * - TGE: we want the guest to use EL1, which is incompatible with
 42 *   this bit being set
 43 *
 44 * - API/APK: they are already accounted for by vcpu_load(), and can
 45 *   only take effect across a load/put cycle (such as ERET)
 46 *
 47 * - FIEN: no way we let a guest have access to the RAS "Common Fault
 48 *   Injection" thing, whatever that does
 49 */
 50#define NV_HCR_GUEST_EXCLUDE	(HCR_TGE | HCR_API | HCR_APK | HCR_FIEN)
 51
 52static u64 __compute_hcr(struct kvm_vcpu *vcpu)
 53{
 54	u64 guest_hcr, hcr = vcpu->arch.hcr_el2;
 55
 56	if (!vcpu_has_nv(vcpu))
 57		return hcr;
 58
 59	/*
 60	 * We rely on the invariant that a vcpu entered from HYP
 61	 * context must also exit in the same context, as only an ERET
 62	 * instruction can kick us out of it, and we obviously trap
 63	 * that sucker. PSTATE.M will get fixed-up on exit.
 64	 */
 65	if (is_hyp_ctxt(vcpu)) {
 66		host_data_set_flag(VCPU_IN_HYP_CONTEXT);
 67
 68		hcr |= HCR_NV | HCR_NV2 | HCR_AT | HCR_TTLB;
 69
 70		if (!vcpu_el2_e2h_is_set(vcpu))
 71			hcr |= HCR_NV1;
 72
 73		/*
 74		 * Nothing in HCR_EL2 should impact running in hypervisor
 75		 * context, apart from bits we have defined as RESx (E2H,
 76		 * HCD and co), or that cannot be set directly (the EXCLUDE
 77		 * bits). Given that we OR the guest's view with the host's,
 78		 * we can use the 0 value as the starting point, and only
 79		 * use the config-driven RES1 bits.
 80		 */
 81		guest_hcr = kvm_vcpu_apply_reg_masks(vcpu, HCR_EL2, 0);
 82
 83		write_sysreg_s(vcpu->arch.ctxt.vncr_array, SYS_VNCR_EL2);
 84	} else {
 85		host_data_clear_flag(VCPU_IN_HYP_CONTEXT);
 86
 87		guest_hcr = __vcpu_sys_reg(vcpu, HCR_EL2);
 88		if (guest_hcr & HCR_NV) {
 89			u64 va = __fix_to_virt(vncr_fixmap(smp_processor_id()));
 90
 91			/* Inherit the low bits from the actual register */
 92			va |= __vcpu_sys_reg(vcpu, VNCR_EL2) & GENMASK(PAGE_SHIFT - 1, 0);
 93			write_sysreg_s(va, SYS_VNCR_EL2);
 94
 95			/* Force NV2 in case the guest is forgetful... */
 96			guest_hcr |= HCR_NV2;
 97		}
 98
 99		/*
100		 * Exclude the guest's TWED configuration if it hasn't set TWE
101		 * to avoid potentially delaying traps for the host.
102		 */
103		if (!(guest_hcr & HCR_TWE))
104			guest_hcr &= ~(HCR_EL2_TWEDEn | HCR_EL2_TWEDEL);
105	}
106
107	BUG_ON(host_data_test_flag(VCPU_IN_HYP_CONTEXT) &&
108	       host_data_test_flag(L1_VNCR_MAPPED));
109
110	return hcr | (guest_hcr & ~NV_HCR_GUEST_EXCLUDE);
111}
112
113static void __activate_traps(struct kvm_vcpu *vcpu)
114{
115	u64 val;
116
117	___activate_traps(vcpu, __compute_hcr(vcpu));
118
119	if (has_cntpoff()) {
120		struct timer_map map;
121
122		get_timer_map(vcpu, &map);
123
124		/*
125		 * We're entrering the guest. Reload the correct
126		 * values from memory now that TGE is clear.
127		 */
128		if (map.direct_ptimer == vcpu_ptimer(vcpu))
129			val = __vcpu_sys_reg(vcpu, CNTP_CVAL_EL0);
130		if (map.direct_ptimer == vcpu_hptimer(vcpu))
131			val = __vcpu_sys_reg(vcpu, CNTHP_CVAL_EL2);
132
133		if (map.direct_ptimer) {
134			write_sysreg_el0(val, SYS_CNTP_CVAL);
135			isb();
136		}
137	}
138
139	__activate_cptr_traps(vcpu);
140
141	write_sysreg(__this_cpu_read(kvm_hyp_vector), vbar_el1);
142}
143NOKPROBE_SYMBOL(__activate_traps);
144
145static void __deactivate_traps(struct kvm_vcpu *vcpu)
146{
147	const char *host_vectors = vectors;
148
149	___deactivate_traps(vcpu);
150
151	write_sysreg_hcr(HCR_HOST_VHE_FLAGS);
152
153	if (has_cntpoff()) {
154		struct timer_map map;
155		u64 val, offset;
156
157		get_timer_map(vcpu, &map);
158
159		/*
160		 * We're exiting the guest. Save the latest CVAL value
161		 * to memory and apply the offset now that TGE is set.
162		 */
163		val = read_sysreg_el0(SYS_CNTP_CVAL);
164		if (map.direct_ptimer == vcpu_ptimer(vcpu))
165			__vcpu_assign_sys_reg(vcpu, CNTP_CVAL_EL0, val);
166		if (map.direct_ptimer == vcpu_hptimer(vcpu))
167			__vcpu_assign_sys_reg(vcpu, CNTHP_CVAL_EL2, val);
168
169		offset = read_sysreg_s(SYS_CNTPOFF_EL2);
170
171		if (map.direct_ptimer && offset) {
172			write_sysreg_el0(val + offset, SYS_CNTP_CVAL);
173			isb();
174		}
175	}
176
177	/*
178	 * ARM errata 1165522 and 1530923 require the actual execution of the
179	 * above before we can switch to the EL2/EL0 translation regime used by
180	 * the host.
181	 */
182	asm(ALTERNATIVE("nop", "isb", ARM64_WORKAROUND_SPECULATIVE_AT));
183
184	__deactivate_cptr_traps(vcpu);
185
186	if (!arm64_kernel_unmapped_at_el0())
187		host_vectors = __this_cpu_read(this_cpu_vector);
188	write_sysreg(host_vectors, vbar_el1);
189}
190NOKPROBE_SYMBOL(__deactivate_traps);
191
192/*
193 * Disable IRQs in __vcpu_{load,put}_{activate,deactivate}_traps() to
194 * prevent a race condition between context switching of PMUSERENR_EL0
195 * in __{activate,deactivate}_traps_common() and IPIs that attempts to
196 * update PMUSERENR_EL0. See also kvm_set_pmuserenr().
197 */
198static void __vcpu_load_activate_traps(struct kvm_vcpu *vcpu)
199{
200	unsigned long flags;
201
202	local_irq_save(flags);
203	__activate_traps_common(vcpu);
204	local_irq_restore(flags);
205}
206
207static void __vcpu_put_deactivate_traps(struct kvm_vcpu *vcpu)
208{
209	unsigned long flags;
210
211	local_irq_save(flags);
212	__deactivate_traps_common(vcpu);
213	local_irq_restore(flags);
214}
215
216void kvm_vcpu_load_vhe(struct kvm_vcpu *vcpu)
217{
218	host_data_ptr(host_ctxt)->__hyp_running_vcpu = vcpu;
219
220	__vcpu_load_switch_sysregs(vcpu);
221	__vcpu_load_activate_traps(vcpu);
222	__load_stage2(vcpu->arch.hw_mmu, vcpu->arch.hw_mmu->arch);
223}
224
225void kvm_vcpu_put_vhe(struct kvm_vcpu *vcpu)
226{
227	__vcpu_put_deactivate_traps(vcpu);
228	__vcpu_put_switch_sysregs(vcpu);
229
230	host_data_ptr(host_ctxt)->__hyp_running_vcpu = NULL;
231}
232
233static u64 compute_emulated_cntx_ctl_el0(struct kvm_vcpu *vcpu,
234					 enum vcpu_sysreg reg)
235{
236	unsigned long ctl;
237	u64 cval, cnt;
238	bool stat;
239
240	switch (reg) {
241	case CNTP_CTL_EL0:
242		cval = __vcpu_sys_reg(vcpu, CNTP_CVAL_EL0);
243		ctl  = __vcpu_sys_reg(vcpu, CNTP_CTL_EL0);
244		cnt  = compute_counter_value(vcpu_ptimer(vcpu));
245		break;
246	case CNTV_CTL_EL0:
247		cval = __vcpu_sys_reg(vcpu, CNTV_CVAL_EL0);
248		ctl  = __vcpu_sys_reg(vcpu, CNTV_CTL_EL0);
249		cnt  = compute_counter_value(vcpu_vtimer(vcpu));
250		break;
251	default:
252		BUG();
253	}
254
255	stat = cval <= cnt;
256	__assign_bit(__ffs(ARCH_TIMER_CTRL_IT_STAT), &ctl, stat);
257
258	return ctl;
259}
260
261static bool kvm_hyp_handle_timer(struct kvm_vcpu *vcpu, u64 *exit_code)
262{
263	u64 esr, val;
264
265	/*
266	 * Having FEAT_ECV allows for a better quality of timer emulation.
267	 * However, this comes at a huge cost in terms of traps. Try and
268	 * satisfy the reads from guest's hypervisor context without
269	 * returning to the kernel if we can.
270	 */
271	if (!is_hyp_ctxt(vcpu))
272		return false;
273
274	esr = kvm_vcpu_get_esr(vcpu);
275	if ((esr & ESR_ELx_SYS64_ISS_DIR_MASK) != ESR_ELx_SYS64_ISS_DIR_READ)
276		return false;
277
278	switch (esr_sys64_to_sysreg(esr)) {
279	case SYS_CNTP_CTL_EL02:
280		val = compute_emulated_cntx_ctl_el0(vcpu, CNTP_CTL_EL0);
281		break;
282	case SYS_CNTP_CTL_EL0:
283		if (vcpu_el2_e2h_is_set(vcpu))
284			val = read_sysreg_el0(SYS_CNTP_CTL);
285		else
286			val = compute_emulated_cntx_ctl_el0(vcpu, CNTP_CTL_EL0);
287		break;
288	case SYS_CNTP_CVAL_EL02:
289		val = __vcpu_sys_reg(vcpu, CNTP_CVAL_EL0);
290		break;
291	case SYS_CNTP_CVAL_EL0:
292		if (vcpu_el2_e2h_is_set(vcpu)) {
293			val = read_sysreg_el0(SYS_CNTP_CVAL);
294
295			if (!has_cntpoff())
296				val -= timer_get_offset(vcpu_hptimer(vcpu));
297		} else {
298			val = __vcpu_sys_reg(vcpu, CNTP_CVAL_EL0);
299		}
300		break;
301	case SYS_CNTPCT_EL0:
302	case SYS_CNTPCTSS_EL0:
303		val = compute_counter_value(vcpu_hptimer(vcpu));
304		break;
305	case SYS_CNTV_CTL_EL02:
306		val = compute_emulated_cntx_ctl_el0(vcpu, CNTV_CTL_EL0);
307		break;
308	case SYS_CNTV_CTL_EL0:
309		if (vcpu_el2_e2h_is_set(vcpu))
310			val = read_sysreg_el0(SYS_CNTV_CTL);
311		else
312			val = compute_emulated_cntx_ctl_el0(vcpu, CNTV_CTL_EL0);
313		break;
314	case SYS_CNTV_CVAL_EL02:
315		val = __vcpu_sys_reg(vcpu, CNTV_CVAL_EL0);
316		break;
317	case SYS_CNTV_CVAL_EL0:
318		if (vcpu_el2_e2h_is_set(vcpu))
319			val = read_sysreg_el0(SYS_CNTV_CVAL);
320		else
321			val = __vcpu_sys_reg(vcpu, CNTV_CVAL_EL0);
322		break;
323	case SYS_CNTVCT_EL0:
324	case SYS_CNTVCTSS_EL0:
325		val = compute_counter_value(vcpu_hvtimer(vcpu));
326		break;
327	default:
328		return false;
329	}
330
331	vcpu_set_reg(vcpu, kvm_vcpu_sys_get_rt(vcpu), val);
332	__kvm_skip_instr(vcpu);
333
334	return true;
335}
336
337static bool kvm_hyp_handle_eret(struct kvm_vcpu *vcpu, u64 *exit_code)
338{
339	u64 esr = kvm_vcpu_get_esr(vcpu);
340	u64 spsr, elr, mode;
341
342	/*
343	 * Going through the whole put/load motions is a waste of time
344	 * if this is a VHE guest hypervisor returning to its own
345	 * userspace, or the hypervisor performing a local exception
346	 * return. No need to save/restore registers, no need to
347	 * switch S2 MMU. Just do the canonical ERET.
348	 *
349	 * Unless the trap has to be forwarded further down the line,
350	 * of course...
351	 */
352	if ((__vcpu_sys_reg(vcpu, HCR_EL2) & HCR_NV) ||
353	    (__vcpu_sys_reg(vcpu, HFGITR_EL2) & HFGITR_EL2_ERET))
354		return false;
355
356	spsr = read_sysreg_el1(SYS_SPSR);
357	mode = spsr & (PSR_MODE_MASK | PSR_MODE32_BIT);
358
359	switch (mode) {
360	case PSR_MODE_EL0t:
361		if (!(vcpu_el2_e2h_is_set(vcpu) && vcpu_el2_tge_is_set(vcpu)))
362			return false;
363		break;
364	case PSR_MODE_EL2t:
365		mode = PSR_MODE_EL1t;
366		break;
367	case PSR_MODE_EL2h:
368		mode = PSR_MODE_EL1h;
369		break;
370	default:
371		return false;
372	}
373
374	/* If ERETAx fails, take the slow path */
375	if (esr_iss_is_eretax(esr)) {
376		if (!(vcpu_has_ptrauth(vcpu) && kvm_auth_eretax(vcpu, &elr)))
377			return false;
378	} else {
379		elr = read_sysreg_el1(SYS_ELR);
380	}
381
382	spsr = (spsr & ~(PSR_MODE_MASK | PSR_MODE32_BIT)) | mode;
383
384	write_sysreg_el2(spsr, SYS_SPSR);
385	write_sysreg_el2(elr, SYS_ELR);
386
387	return true;
388}
389
390static bool kvm_hyp_handle_tlbi_el2(struct kvm_vcpu *vcpu, u64 *exit_code)
391{
392	int ret = -EINVAL;
393	u32 instr;
394	u64 val;
395
396	/*
397	 * Ideally, we would never trap on EL2 S1 TLB invalidations using
398	 * the EL1 instructions when the guest's HCR_EL2.{E2H,TGE}=={1,1}.
399	 * But "thanks" to FEAT_NV2, we don't trap writes to HCR_EL2,
400	 * meaning that we can't track changes to the virtual TGE bit. So we
401	 * have to leave HCR_EL2.TTLB set on the host. Oopsie...
402	 *
403	 * Try and handle these invalidation as quickly as possible, without
404	 * fully exiting. Note that we don't need to consider any forwarding
405	 * here, as having E2H+TGE set is the very definition of being
406	 * InHost.
407	 *
408	 * For the lesser hypervisors out there that have failed to get on
409	 * with the VHE program, we can also handle the nVHE style of EL2
410	 * invalidation.
411	 */
412	if (!(is_hyp_ctxt(vcpu)))
413		return false;
414
415	instr = esr_sys64_to_sysreg(kvm_vcpu_get_esr(vcpu));
416	val = vcpu_get_reg(vcpu, kvm_vcpu_sys_get_rt(vcpu));
417
418	if ((kvm_supported_tlbi_s1e1_op(vcpu, instr) &&
419	     vcpu_el2_e2h_is_set(vcpu) && vcpu_el2_tge_is_set(vcpu)) ||
420	    kvm_supported_tlbi_s1e2_op (vcpu, instr))
421		ret = __kvm_tlbi_s1e2(NULL, val, instr);
422
423	if (ret)
424		return false;
425
426	/*
427	 * If we have to check for any VNCR mapping being invalidated,
428	 * go back to the slow path for further processing.
429	 */
430	if (vcpu_el2_e2h_is_set(vcpu) && vcpu_el2_tge_is_set(vcpu) &&
431	    atomic_read(&vcpu->kvm->arch.vncr_map_count))
432		return false;
433
434	__kvm_skip_instr(vcpu);
435
436	return true;
437}
438
439static bool kvm_hyp_handle_cpacr_el1(struct kvm_vcpu *vcpu, u64 *exit_code)
440{
441	u64 esr = kvm_vcpu_get_esr(vcpu);
442	int rt;
443
444	if (!is_hyp_ctxt(vcpu) || esr_sys64_to_sysreg(esr) != SYS_CPACR_EL1)
445		return false;
446
447	rt = kvm_vcpu_sys_get_rt(vcpu);
448
449	if ((esr & ESR_ELx_SYS64_ISS_DIR_MASK) == ESR_ELx_SYS64_ISS_DIR_READ) {
450		vcpu_set_reg(vcpu, rt, __vcpu_sys_reg(vcpu, CPTR_EL2));
451	} else {
452		vcpu_write_sys_reg(vcpu, vcpu_get_reg(vcpu, rt), CPTR_EL2);
453		__activate_cptr_traps(vcpu);
454	}
455
456	__kvm_skip_instr(vcpu);
457
458	return true;
459}
460
461static bool kvm_hyp_handle_zcr_el2(struct kvm_vcpu *vcpu, u64 *exit_code)
462{
463	u32 sysreg = esr_sys64_to_sysreg(kvm_vcpu_get_esr(vcpu));
464
465	if (!vcpu_has_nv(vcpu))
466		return false;
467
468	if (sysreg != SYS_ZCR_EL2)
469		return false;
470
471	if (guest_owns_fp_regs())
472		return false;
473
474	/*
475	 * ZCR_EL2 traps are handled in the slow path, with the expectation
476	 * that the guest's FP context has already been loaded onto the CPU.
477	 *
478	 * Load the guest's FP context and unconditionally forward to the
479	 * slow path for handling (i.e. return false).
480	 */
481	kvm_hyp_handle_fpsimd(vcpu, exit_code);
482	return false;
483}
484
485static bool kvm_hyp_handle_sysreg_vhe(struct kvm_vcpu *vcpu, u64 *exit_code)
486{
487	if (kvm_hyp_handle_tlbi_el2(vcpu, exit_code))
488		return true;
489
490	if (kvm_hyp_handle_timer(vcpu, exit_code))
491		return true;
492
493	if (kvm_hyp_handle_cpacr_el1(vcpu, exit_code))
494		return true;
495
496	if (kvm_hyp_handle_zcr_el2(vcpu, exit_code))
497		return true;
498
499	return kvm_hyp_handle_sysreg(vcpu, exit_code);
500}
501
502static bool kvm_hyp_handle_impdef(struct kvm_vcpu *vcpu, u64 *exit_code)
503{
504	u64 iss;
505
506	if (!cpus_have_final_cap(ARM64_WORKAROUND_PMUV3_IMPDEF_TRAPS))
507		return false;
508
509	/*
510	 * Compute a synthetic ESR for a sysreg trap. Conveniently, AFSR1_EL2
511	 * is populated with a correct ISS for a sysreg trap. These fruity
512	 * parts are 64bit only, so unconditionally set IL.
513	 */
514	iss = ESR_ELx_ISS(read_sysreg_s(SYS_AFSR1_EL2));
515	vcpu->arch.fault.esr_el2 = FIELD_PREP(ESR_ELx_EC_MASK, ESR_ELx_EC_SYS64) |
516				   FIELD_PREP(ESR_ELx_ISS_MASK, iss) |
517				   ESR_ELx_IL;
518	return false;
519}
520
521static const exit_handler_fn hyp_exit_handlers[] = {
522	[0 ... ESR_ELx_EC_MAX]		= NULL,
523	[ESR_ELx_EC_CP15_32]		= kvm_hyp_handle_cp15_32,
524	[ESR_ELx_EC_SYS64]		= kvm_hyp_handle_sysreg_vhe,
525	[ESR_ELx_EC_SVE]		= kvm_hyp_handle_fpsimd,
526	[ESR_ELx_EC_FP_ASIMD]		= kvm_hyp_handle_fpsimd,
527	[ESR_ELx_EC_IABT_LOW]		= kvm_hyp_handle_iabt_low,
528	[ESR_ELx_EC_DABT_LOW]		= kvm_hyp_handle_dabt_low,
529	[ESR_ELx_EC_WATCHPT_LOW]	= kvm_hyp_handle_watchpt_low,
530	[ESR_ELx_EC_ERET]		= kvm_hyp_handle_eret,
531	[ESR_ELx_EC_MOPS]		= kvm_hyp_handle_mops,
532
533	/* Apple shenanigans */
534	[0x3F]				= kvm_hyp_handle_impdef,
535};
536
537static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code)
538{
539	synchronize_vcpu_pstate(vcpu);
540
541	/*
542	 * If we were in HYP context on entry, adjust the PSTATE view
543	 * so that the usual helpers work correctly. This enforces our
544	 * invariant that the guest's HYP context status is preserved
545	 * across a run.
546	 */
547	if (vcpu_has_nv(vcpu) &&
548	    unlikely(host_data_test_flag(VCPU_IN_HYP_CONTEXT))) {
549		u64 mode = *vcpu_cpsr(vcpu) & (PSR_MODE_MASK | PSR_MODE32_BIT);
550
551		switch (mode) {
552		case PSR_MODE_EL1t:
553			mode = PSR_MODE_EL2t;
554			break;
555		case PSR_MODE_EL1h:
556			mode = PSR_MODE_EL2h;
557			break;
558		}
559
560		*vcpu_cpsr(vcpu) &= ~(PSR_MODE_MASK | PSR_MODE32_BIT);
561		*vcpu_cpsr(vcpu) |= mode;
562	}
563
564	/* Apply extreme paranoia! */
565	BUG_ON(vcpu_has_nv(vcpu) &&
566	       !!host_data_test_flag(VCPU_IN_HYP_CONTEXT) != is_hyp_ctxt(vcpu));
567
568	return __fixup_guest_exit(vcpu, exit_code, hyp_exit_handlers);
569}
570
571/* Switch to the guest for VHE systems running in EL2 */
572static int __kvm_vcpu_run_vhe(struct kvm_vcpu *vcpu)
573{
574	struct kvm_cpu_context *host_ctxt;
575	struct kvm_cpu_context *guest_ctxt;
576	u64 exit_code;
577
578	host_ctxt = host_data_ptr(host_ctxt);
579	guest_ctxt = &vcpu->arch.ctxt;
580
581	fpsimd_lazy_switch_to_guest(vcpu);
582
583	sysreg_save_host_state_vhe(host_ctxt);
584
585	/*
586	 * Note that ARM erratum 1165522 requires us to configure both stage 1
587	 * and stage 2 translation for the guest context before we clear
588	 * HCR_EL2.TGE. The stage 1 and stage 2 guest context has already been
589	 * loaded on the CPU in kvm_vcpu_load_vhe().
590	 */
591	__activate_traps(vcpu);
592
593	__kvm_adjust_pc(vcpu);
594
595	sysreg_restore_guest_state_vhe(guest_ctxt);
596	__debug_switch_to_guest(vcpu);
597
598	do {
599		/* Jump in the fire! */
600		exit_code = __guest_enter(vcpu);
601
602		/* And we're baaack! */
603	} while (fixup_guest_exit(vcpu, &exit_code));
604
605	sysreg_save_guest_state_vhe(guest_ctxt);
606
607	__deactivate_traps(vcpu);
608
609	sysreg_restore_host_state_vhe(host_ctxt);
610
611	__debug_switch_to_host(vcpu);
612
613	/*
614	 * Ensure that all system register writes above have taken effect
615	 * before returning to the host. In VHE mode, CPTR traps for
616	 * FPSIMD/SVE/SME also apply to EL2, so FPSIMD/SVE/SME state must be
617	 * manipulated after the ISB.
618	 */
619	isb();
620
621	fpsimd_lazy_switch_to_host(vcpu);
622
623	if (guest_owns_fp_regs())
624		__fpsimd_save_fpexc32(vcpu);
625
626	return exit_code;
627}
628NOKPROBE_SYMBOL(__kvm_vcpu_run_vhe);
629
630int __kvm_vcpu_run(struct kvm_vcpu *vcpu)
631{
632	int ret;
633
634	local_daif_mask();
635
636	/*
637	 * Having IRQs masked via PMR when entering the guest means the GIC
638	 * will not signal the CPU of interrupts of lower priority, and the
639	 * only way to get out will be via guest exceptions.
640	 * Naturally, we want to avoid this.
641	 *
642	 * local_daif_mask() already sets GIC_PRIO_PSR_I_SET, we just need a
643	 * dsb to ensure the redistributor is forwards EL2 IRQs to the CPU.
644	 */
645	pmr_sync();
646
647	ret = __kvm_vcpu_run_vhe(vcpu);
648
649	/*
650	 * local_daif_restore() takes care to properly restore PSTATE.DAIF
651	 * and the GIC PMR if the host is using IRQ priorities.
652	 */
653	local_daif_restore(DAIF_PROCCTX_NOIRQ);
654
655	return ret;
656}
657
658static void __noreturn __hyp_call_panic(u64 spsr, u64 elr, u64 par)
659{
660	struct kvm_cpu_context *host_ctxt;
661	struct kvm_vcpu *vcpu;
662
663	host_ctxt = host_data_ptr(host_ctxt);
664	vcpu = host_ctxt->__hyp_running_vcpu;
665
666	__deactivate_traps(vcpu);
667	sysreg_restore_host_state_vhe(host_ctxt);
668
669	panic("HYP panic:\nPS:%08llx PC:%016llx ESR:%08llx\nFAR:%016llx HPFAR:%016llx PAR:%016llx\nVCPU:%p\n",
670	      spsr, elr,
671	      read_sysreg_el2(SYS_ESR), read_sysreg_el2(SYS_FAR),
672	      read_sysreg(hpfar_el2), par, vcpu);
673}
674NOKPROBE_SYMBOL(__hyp_call_panic);
675
676void __noreturn hyp_panic(void)
677{
678	u64 spsr = read_sysreg_el2(SYS_SPSR);
679	u64 elr = read_sysreg_el2(SYS_ELR);
680	u64 par = read_sysreg_par();
681
682	__hyp_call_panic(spsr, elr, par);
683}
684
685asmlinkage void kvm_unexpected_el2_exception(void)
686{
687	__kvm_unexpected_el2_exception();
688}