e1000: Avoid infinite loop in processing transmit descriptor (CVE-2015-6815)
[qemu.git] / target-arm / kvm.c
blobb278542085d0cd29dc283990a8444f9871d0fdb4
1 /*
2 * ARM implementation of KVM hooks
4 * Copyright Christoffer Dall 2009-2010
6 * This work is licensed under the terms of the GNU GPL, version 2 or later.
7 * See the COPYING file in the top-level directory.
9 */
11 #include <stdio.h>
12 #include <sys/types.h>
13 #include <sys/ioctl.h>
14 #include <sys/mman.h>
16 #include <linux/kvm.h>
18 #include "qemu-common.h"
19 #include "qemu/timer.h"
20 #include "sysemu/sysemu.h"
21 #include "sysemu/kvm.h"
22 #include "kvm_arm.h"
23 #include "cpu.h"
24 #include "internals.h"
25 #include "hw/arm/arm.h"
26 #include "exec/memattrs.h"
28 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
29 KVM_CAP_LAST_INFO
32 static bool cap_has_mp_state;
34 int kvm_arm_vcpu_init(CPUState *cs)
36 ARMCPU *cpu = ARM_CPU(cs);
37 struct kvm_vcpu_init init;
39 init.target = cpu->kvm_target;
40 memcpy(init.features, cpu->kvm_init_features, sizeof(init.features));
42 return kvm_vcpu_ioctl(cs, KVM_ARM_VCPU_INIT, &init);
45 bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
46 int *fdarray,
47 struct kvm_vcpu_init *init)
49 int ret, kvmfd = -1, vmfd = -1, cpufd = -1;
51 kvmfd = qemu_open("/dev/kvm", O_RDWR);
52 if (kvmfd < 0) {
53 goto err;
55 vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
56 if (vmfd < 0) {
57 goto err;
59 cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
60 if (cpufd < 0) {
61 goto err;
64 ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, init);
65 if (ret >= 0) {
66 ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
67 if (ret < 0) {
68 goto err;
70 } else {
71 /* Old kernel which doesn't know about the
72 * PREFERRED_TARGET ioctl: we know it will only support
73 * creating one kind of guest CPU which is its preferred
74 * CPU type.
76 while (*cpus_to_try != QEMU_KVM_ARM_TARGET_NONE) {
77 init->target = *cpus_to_try++;
78 memset(init->features, 0, sizeof(init->features));
79 ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
80 if (ret >= 0) {
81 break;
84 if (ret < 0) {
85 goto err;
89 fdarray[0] = kvmfd;
90 fdarray[1] = vmfd;
91 fdarray[2] = cpufd;
93 return true;
95 err:
96 if (cpufd >= 0) {
97 close(cpufd);
99 if (vmfd >= 0) {
100 close(vmfd);
102 if (kvmfd >= 0) {
103 close(kvmfd);
106 return false;
109 void kvm_arm_destroy_scratch_host_vcpu(int *fdarray)
111 int i;
113 for (i = 2; i >= 0; i--) {
114 close(fdarray[i]);
118 static void kvm_arm_host_cpu_class_init(ObjectClass *oc, void *data)
120 ARMHostCPUClass *ahcc = ARM_HOST_CPU_CLASS(oc);
122 /* All we really need to set up for the 'host' CPU
123 * is the feature bits -- we rely on the fact that the
124 * various ID register values in ARMCPU are only used for
125 * TCG CPUs.
127 if (!kvm_arm_get_host_cpu_features(ahcc)) {
128 fprintf(stderr, "Failed to retrieve host CPU features!\n");
129 abort();
133 static void kvm_arm_host_cpu_initfn(Object *obj)
135 ARMHostCPUClass *ahcc = ARM_HOST_CPU_GET_CLASS(obj);
136 ARMCPU *cpu = ARM_CPU(obj);
137 CPUARMState *env = &cpu->env;
139 cpu->kvm_target = ahcc->target;
140 cpu->dtb_compatible = ahcc->dtb_compatible;
141 env->features = ahcc->features;
144 static const TypeInfo host_arm_cpu_type_info = {
145 .name = TYPE_ARM_HOST_CPU,
146 #ifdef TARGET_AARCH64
147 .parent = TYPE_AARCH64_CPU,
148 #else
149 .parent = TYPE_ARM_CPU,
150 #endif
151 .instance_init = kvm_arm_host_cpu_initfn,
152 .class_init = kvm_arm_host_cpu_class_init,
153 .class_size = sizeof(ARMHostCPUClass),
156 int kvm_arch_init(MachineState *ms, KVMState *s)
158 /* For ARM interrupt delivery is always asynchronous,
159 * whether we are using an in-kernel VGIC or not.
161 kvm_async_interrupts_allowed = true;
163 cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
165 type_register_static(&host_arm_cpu_type_info);
167 return 0;
170 unsigned long kvm_arch_vcpu_id(CPUState *cpu)
172 return cpu->cpu_index;
175 /* We track all the KVM devices which need their memory addresses
176 * passing to the kernel in a list of these structures.
177 * When board init is complete we run through the list and
178 * tell the kernel the base addresses of the memory regions.
179 * We use a MemoryListener to track mapping and unmapping of
180 * the regions during board creation, so the board models don't
181 * need to do anything special for the KVM case.
183 typedef struct KVMDevice {
184 struct kvm_arm_device_addr kda;
185 struct kvm_device_attr kdattr;
186 MemoryRegion *mr;
187 QSLIST_ENTRY(KVMDevice) entries;
188 int dev_fd;
189 } KVMDevice;
191 static QSLIST_HEAD(kvm_devices_head, KVMDevice) kvm_devices_head;
193 static void kvm_arm_devlistener_add(MemoryListener *listener,
194 MemoryRegionSection *section)
196 KVMDevice *kd;
198 QSLIST_FOREACH(kd, &kvm_devices_head, entries) {
199 if (section->mr == kd->mr) {
200 kd->kda.addr = section->offset_within_address_space;
205 static void kvm_arm_devlistener_del(MemoryListener *listener,
206 MemoryRegionSection *section)
208 KVMDevice *kd;
210 QSLIST_FOREACH(kd, &kvm_devices_head, entries) {
211 if (section->mr == kd->mr) {
212 kd->kda.addr = -1;
217 static MemoryListener devlistener = {
218 .region_add = kvm_arm_devlistener_add,
219 .region_del = kvm_arm_devlistener_del,
222 static void kvm_arm_set_device_addr(KVMDevice *kd)
224 struct kvm_device_attr *attr = &kd->kdattr;
225 int ret;
227 /* If the device control API is available and we have a device fd on the
228 * KVMDevice struct, let's use the newer API
230 if (kd->dev_fd >= 0) {
231 uint64_t addr = kd->kda.addr;
232 attr->addr = (uintptr_t)&addr;
233 ret = kvm_device_ioctl(kd->dev_fd, KVM_SET_DEVICE_ATTR, attr);
234 } else {
235 ret = kvm_vm_ioctl(kvm_state, KVM_ARM_SET_DEVICE_ADDR, &kd->kda);
238 if (ret < 0) {
239 fprintf(stderr, "Failed to set device address: %s\n",
240 strerror(-ret));
241 abort();
245 static void kvm_arm_machine_init_done(Notifier *notifier, void *data)
247 KVMDevice *kd, *tkd;
249 memory_listener_unregister(&devlistener);
250 QSLIST_FOREACH_SAFE(kd, &kvm_devices_head, entries, tkd) {
251 if (kd->kda.addr != -1) {
252 kvm_arm_set_device_addr(kd);
254 memory_region_unref(kd->mr);
255 g_free(kd);
259 static Notifier notify = {
260 .notify = kvm_arm_machine_init_done,
263 void kvm_arm_register_device(MemoryRegion *mr, uint64_t devid, uint64_t group,
264 uint64_t attr, int dev_fd)
266 KVMDevice *kd;
268 if (!kvm_irqchip_in_kernel()) {
269 return;
272 if (QSLIST_EMPTY(&kvm_devices_head)) {
273 memory_listener_register(&devlistener, NULL);
274 qemu_add_machine_init_done_notifier(&notify);
276 kd = g_new0(KVMDevice, 1);
277 kd->mr = mr;
278 kd->kda.id = devid;
279 kd->kda.addr = -1;
280 kd->kdattr.flags = 0;
281 kd->kdattr.group = group;
282 kd->kdattr.attr = attr;
283 kd->dev_fd = dev_fd;
284 QSLIST_INSERT_HEAD(&kvm_devices_head, kd, entries);
285 memory_region_ref(kd->mr);
288 static int compare_u64(const void *a, const void *b)
290 if (*(uint64_t *)a > *(uint64_t *)b) {
291 return 1;
293 if (*(uint64_t *)a < *(uint64_t *)b) {
294 return -1;
296 return 0;
299 /* Initialize the CPUState's cpreg list according to the kernel's
300 * definition of what CPU registers it knows about (and throw away
301 * the previous TCG-created cpreg list).
303 int kvm_arm_init_cpreg_list(ARMCPU *cpu)
305 struct kvm_reg_list rl;
306 struct kvm_reg_list *rlp;
307 int i, ret, arraylen;
308 CPUState *cs = CPU(cpu);
310 rl.n = 0;
311 ret = kvm_vcpu_ioctl(cs, KVM_GET_REG_LIST, &rl);
312 if (ret != -E2BIG) {
313 return ret;
315 rlp = g_malloc(sizeof(struct kvm_reg_list) + rl.n * sizeof(uint64_t));
316 rlp->n = rl.n;
317 ret = kvm_vcpu_ioctl(cs, KVM_GET_REG_LIST, rlp);
318 if (ret) {
319 goto out;
321 /* Sort the list we get back from the kernel, since cpreg_tuples
322 * must be in strictly ascending order.
324 qsort(&rlp->reg, rlp->n, sizeof(rlp->reg[0]), compare_u64);
326 for (i = 0, arraylen = 0; i < rlp->n; i++) {
327 if (!kvm_arm_reg_syncs_via_cpreg_list(rlp->reg[i])) {
328 continue;
330 switch (rlp->reg[i] & KVM_REG_SIZE_MASK) {
331 case KVM_REG_SIZE_U32:
332 case KVM_REG_SIZE_U64:
333 break;
334 default:
335 fprintf(stderr, "Can't handle size of register in kernel list\n");
336 ret = -EINVAL;
337 goto out;
340 arraylen++;
343 cpu->cpreg_indexes = g_renew(uint64_t, cpu->cpreg_indexes, arraylen);
344 cpu->cpreg_values = g_renew(uint64_t, cpu->cpreg_values, arraylen);
345 cpu->cpreg_vmstate_indexes = g_renew(uint64_t, cpu->cpreg_vmstate_indexes,
346 arraylen);
347 cpu->cpreg_vmstate_values = g_renew(uint64_t, cpu->cpreg_vmstate_values,
348 arraylen);
349 cpu->cpreg_array_len = arraylen;
350 cpu->cpreg_vmstate_array_len = arraylen;
352 for (i = 0, arraylen = 0; i < rlp->n; i++) {
353 uint64_t regidx = rlp->reg[i];
354 if (!kvm_arm_reg_syncs_via_cpreg_list(regidx)) {
355 continue;
357 cpu->cpreg_indexes[arraylen] = regidx;
358 arraylen++;
360 assert(cpu->cpreg_array_len == arraylen);
362 if (!write_kvmstate_to_list(cpu)) {
363 /* Shouldn't happen unless kernel is inconsistent about
364 * what registers exist.
366 fprintf(stderr, "Initial read of kernel register state failed\n");
367 ret = -EINVAL;
368 goto out;
371 out:
372 g_free(rlp);
373 return ret;
376 bool write_kvmstate_to_list(ARMCPU *cpu)
378 CPUState *cs = CPU(cpu);
379 int i;
380 bool ok = true;
382 for (i = 0; i < cpu->cpreg_array_len; i++) {
383 struct kvm_one_reg r;
384 uint64_t regidx = cpu->cpreg_indexes[i];
385 uint32_t v32;
386 int ret;
388 r.id = regidx;
390 switch (regidx & KVM_REG_SIZE_MASK) {
391 case KVM_REG_SIZE_U32:
392 r.addr = (uintptr_t)&v32;
393 ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
394 if (!ret) {
395 cpu->cpreg_values[i] = v32;
397 break;
398 case KVM_REG_SIZE_U64:
399 r.addr = (uintptr_t)(cpu->cpreg_values + i);
400 ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
401 break;
402 default:
403 abort();
405 if (ret) {
406 ok = false;
409 return ok;
412 bool write_list_to_kvmstate(ARMCPU *cpu, int level)
414 CPUState *cs = CPU(cpu);
415 int i;
416 bool ok = true;
418 for (i = 0; i < cpu->cpreg_array_len; i++) {
419 struct kvm_one_reg r;
420 uint64_t regidx = cpu->cpreg_indexes[i];
421 uint32_t v32;
422 int ret;
424 if (kvm_arm_cpreg_level(regidx) > level) {
425 continue;
428 r.id = regidx;
429 switch (regidx & KVM_REG_SIZE_MASK) {
430 case KVM_REG_SIZE_U32:
431 v32 = cpu->cpreg_values[i];
432 r.addr = (uintptr_t)&v32;
433 break;
434 case KVM_REG_SIZE_U64:
435 r.addr = (uintptr_t)(cpu->cpreg_values + i);
436 break;
437 default:
438 abort();
440 ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
441 if (ret) {
442 /* We might fail for "unknown register" and also for
443 * "you tried to set a register which is constant with
444 * a different value from what it actually contains".
446 ok = false;
449 return ok;
452 void kvm_arm_reset_vcpu(ARMCPU *cpu)
454 int ret;
456 /* Re-init VCPU so that all registers are set to
457 * their respective reset values.
459 ret = kvm_arm_vcpu_init(CPU(cpu));
460 if (ret < 0) {
461 fprintf(stderr, "kvm_arm_vcpu_init failed: %s\n", strerror(-ret));
462 abort();
464 if (!write_kvmstate_to_list(cpu)) {
465 fprintf(stderr, "write_kvmstate_to_list failed\n");
466 abort();
471 * Update KVM's MP_STATE based on what QEMU thinks it is
473 int kvm_arm_sync_mpstate_to_kvm(ARMCPU *cpu)
475 if (cap_has_mp_state) {
476 struct kvm_mp_state mp_state = {
477 .mp_state =
478 cpu->powered_off ? KVM_MP_STATE_STOPPED : KVM_MP_STATE_RUNNABLE
480 int ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MP_STATE, &mp_state);
481 if (ret) {
482 fprintf(stderr, "%s: failed to set MP_STATE %d/%s\n",
483 __func__, ret, strerror(-ret));
484 return -1;
488 return 0;
492 * Sync the KVM MP_STATE into QEMU
494 int kvm_arm_sync_mpstate_to_qemu(ARMCPU *cpu)
496 if (cap_has_mp_state) {
497 struct kvm_mp_state mp_state;
498 int ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MP_STATE, &mp_state);
499 if (ret) {
500 fprintf(stderr, "%s: failed to get MP_STATE %d/%s\n",
501 __func__, ret, strerror(-ret));
502 abort();
504 cpu->powered_off = (mp_state.mp_state == KVM_MP_STATE_STOPPED);
507 return 0;
510 void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
514 MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
516 return MEMTXATTRS_UNSPECIFIED;
519 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
521 return 0;
524 bool kvm_arch_stop_on_emulation_error(CPUState *cs)
526 return true;
529 int kvm_arch_process_async_events(CPUState *cs)
531 return 0;
534 int kvm_arch_on_sigbus_vcpu(CPUState *cs, int code, void *addr)
536 return 1;
539 int kvm_arch_on_sigbus(int code, void *addr)
541 return 1;
544 void kvm_arch_update_guest_debug(CPUState *cs, struct kvm_guest_debug *dbg)
546 qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__);
549 int kvm_arch_insert_sw_breakpoint(CPUState *cs,
550 struct kvm_sw_breakpoint *bp)
552 qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__);
553 return -EINVAL;
556 int kvm_arch_insert_hw_breakpoint(target_ulong addr,
557 target_ulong len, int type)
559 qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__);
560 return -EINVAL;
563 int kvm_arch_remove_hw_breakpoint(target_ulong addr,
564 target_ulong len, int type)
566 qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__);
567 return -EINVAL;
570 int kvm_arch_remove_sw_breakpoint(CPUState *cs,
571 struct kvm_sw_breakpoint *bp)
573 qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__);
574 return -EINVAL;
577 void kvm_arch_remove_all_hw_breakpoints(void)
579 qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__);
582 void kvm_arch_init_irq_routing(KVMState *s)
586 int kvm_arch_irqchip_create(KVMState *s)
588 int ret;
590 /* If we can create the VGIC using the newer device control API, we
591 * let the device do this when it initializes itself, otherwise we
592 * fall back to the old API */
594 ret = kvm_create_device(s, KVM_DEV_TYPE_ARM_VGIC_V2, true);
595 if (ret == 0) {
596 return 1;
599 return 0;
602 int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
603 uint64_t address, uint32_t data)
605 return 0;
608 int kvm_arch_msi_data_to_gsi(uint32_t data)
610 return (data - 32) & 0xffff;