target-s390x/kvm.c

   1 /*
   2  * QEMU S390x KVM implementation
   3  *
   4  * Copyright (c) 2009 Alexander Graf <agraf@suse.de>
   5  * Copyright IBM Corp. 2012
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * Contributions after 2012-10-29 are licensed under the terms of the
  18  * GNU GPL, version 2 or (at your option) any later version.
  19  *
  20  * You should have received a copy of the GNU (Lesser) General Public
  21  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  22  */
  23
  24 #include <sys/types.h>
  25 #include <sys/ioctl.h>
  26 #include <sys/mman.h>
  27
  28 #include <linux/kvm.h>
  29 #include <asm/ptrace.h>
  30
  31 #include "qemu-common.h"
  32 #include "qemu/timer.h"
  33 #include "sysemu/sysemu.h"
  34 #include "sysemu/kvm.h"
  35 #include "cpu.h"
  36 #include "sysemu/device_tree.h"
  37 #include "qapi/qmp/qjson.h"
  38 #include "monitor/monitor.h"
  39 #include "exec/gdbstub.h"
  40 #include "trace.h"
  41
  42 /* #define DEBUG_KVM */
  43
  44 #ifdef DEBUG_KVM
  45 #define DPRINTF(fmt, ...) \
  46     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
  47 #else
  48 #define DPRINTF(fmt, ...) \
  49     do { } while (0)
  50 #endif
  51
  52 #define IPA0_DIAG                       0x8300
  53 #define IPA0_SIGP                       0xae00
  54 #define IPA0_B2                         0xb200
  55 #define IPA0_B9                         0xb900
  56 #define IPA0_EB                         0xeb00
  57
  58 #define PRIV_B2_SCLP_CALL               0x20
  59 #define PRIV_B2_CSCH                    0x30
  60 #define PRIV_B2_HSCH                    0x31
  61 #define PRIV_B2_MSCH                    0x32
  62 #define PRIV_B2_SSCH                    0x33
  63 #define PRIV_B2_STSCH                   0x34
  64 #define PRIV_B2_TSCH                    0x35
  65 #define PRIV_B2_TPI                     0x36
  66 #define PRIV_B2_SAL                     0x37
  67 #define PRIV_B2_RSCH                    0x38
  68 #define PRIV_B2_STCRW                   0x39
  69 #define PRIV_B2_STCPS                   0x3a
  70 #define PRIV_B2_RCHP                    0x3b
  71 #define PRIV_B2_SCHM                    0x3c
  72 #define PRIV_B2_CHSC                    0x5f
  73 #define PRIV_B2_SIGA                    0x74
  74 #define PRIV_B2_XSCH                    0x76
  75
  76 #define PRIV_EB_SQBS                    0x8a
  77
  78 #define PRIV_B9_EQBS                    0x9c
  79
  80 #define DIAG_IPL                        0x308
  81 #define DIAG_KVM_HYPERCALL              0x500
  82 #define DIAG_KVM_BREAKPOINT             0x501
  83
  84 #define ICPT_INSTRUCTION                0x04
  85 #define ICPT_WAITPSW                    0x1c
  86 #define ICPT_SOFT_INTERCEPT             0x24
  87 #define ICPT_CPU_STOP                   0x28
  88 #define ICPT_IO                         0x40
  89
  90 static CPUWatchpoint hw_watchpoint;
  91 /*
  92  * We don't use a list because this structure is also used to transmit the
  93  * hardware breakpoints to the kernel.
  94  */
  95 static struct kvm_hw_breakpoint *hw_breakpoints;
  96 static int nb_hw_breakpoints;
  97
  98 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
  99     KVM_CAP_LAST_INFO
 100 };
 101
 102 static int cap_sync_regs;
 103 static int cap_async_pf;
 104
 105 static void *legacy_s390_alloc(size_t size);
 106
 107 int kvm_arch_init(KVMState *s)
 108 {
 109     cap_sync_regs = kvm_check_extension(s, KVM_CAP_SYNC_REGS);
 110     cap_async_pf = kvm_check_extension(s, KVM_CAP_ASYNC_PF);
 111     if (!kvm_check_extension(s, KVM_CAP_S390_GMAP)
 112         || !kvm_check_extension(s, KVM_CAP_S390_COW)) {
 113         phys_mem_set_alloc(legacy_s390_alloc);
 114     }
 115     return 0;
 116 }
 117
 118 unsigned long kvm_arch_vcpu_id(CPUState *cpu)
 119 {
 120     return cpu->cpu_index;
 121 }
 122
 123 int kvm_arch_init_vcpu(CPUState *cpu)
 124 {
 125     /* nothing todo yet */
 126     return 0;
 127 }
 128
 129 void kvm_s390_reset_vcpu(S390CPU *cpu)
 130 {
 131     CPUState *cs = CPU(cpu);
 132
 133     /* The initial reset call is needed here to reset in-kernel
 134      * vcpu data that we can't access directly from QEMU
 135      * (i.e. with older kernels which don't support sync_regs/ONE_REG).
 136      * Before this ioctl cpu_synchronize_state() is called in common kvm
 137      * code (kvm-all) */
 138     if (kvm_vcpu_ioctl(cs, KVM_S390_INITIAL_RESET, NULL)) {
 139         perror("Can't reset vcpu\n");
 140     }
 141 }
 142
 143 int kvm_arch_put_registers(CPUState *cs, int level)
 144 {
 145     S390CPU *cpu = S390_CPU(cs);
 146     CPUS390XState *env = &cpu->env;
 147     struct kvm_sregs sregs;
 148     struct kvm_regs regs;
 149     int r;
 150     int i;
 151
 152     /* always save the PSW  and the GPRS*/
 153     cs->kvm_run->psw_addr = env->psw.addr;
 154     cs->kvm_run->psw_mask = env->psw.mask;
 155
 156     if (cap_sync_regs && cs->kvm_run->kvm_valid_regs & KVM_SYNC_GPRS) {
 157         for (i = 0; i < 16; i++) {
 158             cs->kvm_run->s.regs.gprs[i] = env->regs[i];
 159             cs->kvm_run->kvm_dirty_regs |= KVM_SYNC_GPRS;
 160         }
 161     } else {
 162         for (i = 0; i < 16; i++) {
 163             regs.gprs[i] = env->regs[i];
 164         }
 165         r = kvm_vcpu_ioctl(cs, KVM_SET_REGS, &regs);
 166         if (r < 0) {
 167             return r;
 168         }
 169     }
 170
 171     /* Do we need to save more than that? */
 172     if (level == KVM_PUT_RUNTIME_STATE) {
 173         return 0;
 174     }
 175
 176     /*
 177      * These ONE_REGS are not protected by a capability. As they are only
 178      * necessary for migration we just trace a possible error, but don't
 179      * return with an error return code.
 180      */
 181     kvm_set_one_reg(cs, KVM_REG_S390_CPU_TIMER, &env->cputm);
 182     kvm_set_one_reg(cs, KVM_REG_S390_CLOCK_COMP, &env->ckc);
 183     kvm_set_one_reg(cs, KVM_REG_S390_TODPR, &env->todpr);
 184     kvm_set_one_reg(cs, KVM_REG_S390_GBEA, &env->gbea);
 185     kvm_set_one_reg(cs, KVM_REG_S390_PP, &env->pp);
 186
 187     if (cap_async_pf) {
 188         r = kvm_set_one_reg(cs, KVM_REG_S390_PFTOKEN, &env->pfault_token);
 189         if (r < 0) {
 190             return r;
 191         }
 192         r = kvm_set_one_reg(cs, KVM_REG_S390_PFCOMPARE, &env->pfault_compare);
 193         if (r < 0) {
 194             return r;
 195         }
 196         r = kvm_set_one_reg(cs, KVM_REG_S390_PFSELECT, &env->pfault_select);
 197         if (r < 0) {
 198             return r;
 199         }
 200     }
 201
 202     if (cap_sync_regs &&
 203         cs->kvm_run->kvm_valid_regs & KVM_SYNC_ACRS &&
 204         cs->kvm_run->kvm_valid_regs & KVM_SYNC_CRS) {
 205         for (i = 0; i < 16; i++) {
 206             cs->kvm_run->s.regs.acrs[i] = env->aregs[i];
 207             cs->kvm_run->s.regs.crs[i] = env->cregs[i];
 208         }
 209         cs->kvm_run->kvm_dirty_regs |= KVM_SYNC_ACRS;
 210         cs->kvm_run->kvm_dirty_regs |= KVM_SYNC_CRS;
 211     } else {
 212         for (i = 0; i < 16; i++) {
 213             sregs.acrs[i] = env->aregs[i];
 214             sregs.crs[i] = env->cregs[i];
 215         }
 216         r = kvm_vcpu_ioctl(cs, KVM_SET_SREGS, &sregs);
 217         if (r < 0) {
 218             return r;
 219         }
 220     }
 221
 222     /* Finally the prefix */
 223     if (cap_sync_regs && cs->kvm_run->kvm_valid_regs & KVM_SYNC_PREFIX) {
 224         cs->kvm_run->s.regs.prefix = env->psa;
 225         cs->kvm_run->kvm_dirty_regs |= KVM_SYNC_PREFIX;
 226     } else {
 227         /* prefix is only supported via sync regs */
 228     }
 229     return 0;
 230 }
 231
 232 int kvm_arch_get_registers(CPUState *cs)
 233 {
 234     S390CPU *cpu = S390_CPU(cs);
 235     CPUS390XState *env = &cpu->env;
 236     struct kvm_sregs sregs;
 237     struct kvm_regs regs;
 238     int i, r;
 239
 240     /* get the PSW */
 241     env->psw.addr = cs->kvm_run->psw_addr;
 242     env->psw.mask = cs->kvm_run->psw_mask;
 243
 244     /* the GPRS */
 245     if (cap_sync_regs && cs->kvm_run->kvm_valid_regs & KVM_SYNC_GPRS) {
 246         for (i = 0; i < 16; i++) {
 247             env->regs[i] = cs->kvm_run->s.regs.gprs[i];
 248         }
 249     } else {
 250         r = kvm_vcpu_ioctl(cs, KVM_GET_REGS, &regs);
 251         if (r < 0) {
 252             return r;
 253         }
 254          for (i = 0; i < 16; i++) {
 255             env->regs[i] = regs.gprs[i];
 256         }
 257     }
 258
 259     /* The ACRS and CRS */
 260     if (cap_sync_regs &&
 261         cs->kvm_run->kvm_valid_regs & KVM_SYNC_ACRS &&
 262         cs->kvm_run->kvm_valid_regs & KVM_SYNC_CRS) {
 263         for (i = 0; i < 16; i++) {
 264             env->aregs[i] = cs->kvm_run->s.regs.acrs[i];
 265             env->cregs[i] = cs->kvm_run->s.regs.crs[i];
 266         }
 267     } else {
 268         r = kvm_vcpu_ioctl(cs, KVM_GET_SREGS, &sregs);
 269         if (r < 0) {
 270             return r;
 271         }
 272          for (i = 0; i < 16; i++) {
 273             env->aregs[i] = sregs.acrs[i];
 274             env->cregs[i] = sregs.crs[i];
 275         }
 276     }
 277
 278     /* The prefix */
 279     if (cap_sync_regs && cs->kvm_run->kvm_valid_regs & KVM_SYNC_PREFIX) {
 280         env->psa = cs->kvm_run->s.regs.prefix;
 281     }
 282
 283     /*
 284      * These ONE_REGS are not protected by a capability. As they are only
 285      * necessary for migration we just trace a possible error, but don't
 286      * return with an error return code.
 287      */
 288     kvm_get_one_reg(cs, KVM_REG_S390_CPU_TIMER, &env->cputm);
 289     kvm_get_one_reg(cs, KVM_REG_S390_CLOCK_COMP, &env->ckc);
 290     kvm_get_one_reg(cs, KVM_REG_S390_TODPR, &env->todpr);
 291     kvm_get_one_reg(cs, KVM_REG_S390_GBEA, &env->gbea);
 292     kvm_get_one_reg(cs, KVM_REG_S390_PP, &env->pp);
 293
 294     if (cap_async_pf) {
 295         r = kvm_get_one_reg(cs, KVM_REG_S390_PFTOKEN, &env->pfault_token);
 296         if (r < 0) {
 297             return r;
 298         }
 299         r = kvm_get_one_reg(cs, KVM_REG_S390_PFCOMPARE, &env->pfault_compare);
 300         if (r < 0) {
 301             return r;
 302         }
 303         r = kvm_get_one_reg(cs, KVM_REG_S390_PFSELECT, &env->pfault_select);
 304         if (r < 0) {
 305             return r;
 306         }
 307     }
 308
 309     return 0;
 310 }
 311
 312 /*
 313  * Legacy layout for s390:
 314  * Older S390 KVM requires the topmost vma of the RAM to be
 315  * smaller than an system defined value, which is at least 256GB.
 316  * Larger systems have larger values. We put the guest between
 317  * the end of data segment (system break) and this value. We
 318  * use 32GB as a base to have enough room for the system break
 319  * to grow. We also have to use MAP parameters that avoid
 320  * read-only mapping of guest pages.
 321  */
 322 static void *legacy_s390_alloc(size_t size)
 323 {
 324     void *mem;
 325
 326     mem = mmap((void *) 0x800000000ULL, size,
 327                PROT_EXEC|PROT_READ|PROT_WRITE,
 328                MAP_SHARED | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
 329     return mem == MAP_FAILED ? NULL : mem;
 330 }
 331
 332 /* DIAG 501 is used for sw breakpoints */
 333 static const uint8_t diag_501[] = {0x83, 0x24, 0x05, 0x01};
 334
 335 int kvm_arch_insert_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
 336 {
 337
 338     if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn,
 339                             sizeof(diag_501), 0) ||
 340         cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)diag_501,
 341                             sizeof(diag_501), 1)) {
 342         return -EINVAL;
 343     }
 344     return 0;
 345 }
 346
 347 int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
 348 {
 349     uint8_t t[sizeof(diag_501)];
 350
 351     if (cpu_memory_rw_debug(cs, bp->pc, t, sizeof(diag_501), 0)) {
 352         return -EINVAL;
 353     } else if (memcmp(t, diag_501, sizeof(diag_501))) {
 354         return -EINVAL;
 355     } else if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn,
 356                                    sizeof(diag_501), 1)) {
 357         return -EINVAL;
 358     }
 359
 360     return 0;
 361 }
 362
 363 static struct kvm_hw_breakpoint *find_hw_breakpoint(target_ulong addr,
 364                                                     int len, int type)
 365 {
 366     int n;
 367
 368     for (n = 0; n < nb_hw_breakpoints; n++) {
 369         if (hw_breakpoints[n].addr == addr && hw_breakpoints[n].type == type &&
 370             (hw_breakpoints[n].len == len || len == -1)) {
 371             return &hw_breakpoints[n];
 372         }
 373     }
 374
 375     return NULL;
 376 }
 377
 378 static int insert_hw_breakpoint(target_ulong addr, int len, int type)
 379 {
 380     int size;
 381
 382     if (find_hw_breakpoint(addr, len, type)) {
 383         return -EEXIST;
 384     }
 385
 386     size = (nb_hw_breakpoints + 1) * sizeof(struct kvm_hw_breakpoint);
 387
 388     if (!hw_breakpoints) {
 389         nb_hw_breakpoints = 0;
 390         hw_breakpoints = (struct kvm_hw_breakpoint *)g_try_malloc(size);
 391     } else {
 392         hw_breakpoints =
 393             (struct kvm_hw_breakpoint *)g_try_realloc(hw_breakpoints, size);
 394     }
 395
 396     if (!hw_breakpoints) {
 397         nb_hw_breakpoints = 0;
 398         return -ENOMEM;
 399     }
 400
 401     hw_breakpoints[nb_hw_breakpoints].addr = addr;
 402     hw_breakpoints[nb_hw_breakpoints].len = len;
 403     hw_breakpoints[nb_hw_breakpoints].type = type;
 404
 405     nb_hw_breakpoints++;
 406
 407     return 0;
 408 }
 409
 410 int kvm_arch_insert_hw_breakpoint(target_ulong addr,
 411                                   target_ulong len, int type)
 412 {
 413     switch (type) {
 414     case GDB_BREAKPOINT_HW:
 415         type = KVM_HW_BP;
 416         break;
 417     case GDB_WATCHPOINT_WRITE:
 418         if (len < 1) {
 419             return -EINVAL;
 420         }
 421         type = KVM_HW_WP_WRITE;
 422         break;
 423     default:
 424         return -ENOSYS;
 425     }
 426     return insert_hw_breakpoint(addr, len, type);
 427 }
 428
 429 int kvm_arch_remove_hw_breakpoint(target_ulong addr,
 430                                   target_ulong len, int type)
 431 {
 432     int size;
 433     struct kvm_hw_breakpoint *bp = find_hw_breakpoint(addr, len, type);
 434
 435     if (bp == NULL) {
 436         return -ENOENT;
 437     }
 438
 439     nb_hw_breakpoints--;
 440     if (nb_hw_breakpoints > 0) {
 441         /*
 442          * In order to trim the array, move the last element to the position to
 443          * be removed - if necessary.
 444          */
 445         if (bp != &hw_breakpoints[nb_hw_breakpoints]) {
 446             *bp = hw_breakpoints[nb_hw_breakpoints];
 447         }
 448         size = nb_hw_breakpoints * sizeof(struct kvm_hw_breakpoint);
 449         hw_breakpoints =
 450              (struct kvm_hw_breakpoint *)g_realloc(hw_breakpoints, size);
 451     } else {
 452         g_free(hw_breakpoints);
 453         hw_breakpoints = NULL;
 454     }
 455
 456     return 0;
 457 }
 458
 459 void kvm_arch_remove_all_hw_breakpoints(void)
 460 {
 461     nb_hw_breakpoints = 0;
 462     g_free(hw_breakpoints);
 463     hw_breakpoints = NULL;
 464 }
 465
 466 void kvm_arch_update_guest_debug(CPUState *cpu, struct kvm_guest_debug *dbg)
 467 {
 468     int i;
 469
 470     if (nb_hw_breakpoints > 0) {
 471         dbg->arch.nr_hw_bp = nb_hw_breakpoints;
 472         dbg->arch.hw_bp = hw_breakpoints;
 473
 474         for (i = 0; i < nb_hw_breakpoints; ++i) {
 475             hw_breakpoints[i].phys_addr = s390_cpu_get_phys_addr_debug(cpu,
 476                                                        hw_breakpoints[i].addr);
 477         }
 478         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_HW_BP;
 479     } else {
 480         dbg->arch.nr_hw_bp = 0;
 481         dbg->arch.hw_bp = NULL;
 482     }
 483 }
 484
 485 void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
 486 {
 487 }
 488
 489 void kvm_arch_post_run(CPUState *cpu, struct kvm_run *run)
 490 {
 491 }
 492
 493 int kvm_arch_process_async_events(CPUState *cs)
 494 {
 495     return cs->halted;
 496 }
 497
 498 void kvm_s390_interrupt_internal(S390CPU *cpu, int type, uint32_t parm,
 499                                  uint64_t parm64, int vm)
 500 {
 501     CPUState *cs = CPU(cpu);
 502     struct kvm_s390_interrupt kvmint;
 503     int r;
 504
 505     if (!cs->kvm_state) {
 506         return;
 507     }
 508
 509     kvmint.type = type;
 510     kvmint.parm = parm;
 511     kvmint.parm64 = parm64;
 512
 513     if (vm) {
 514         r = kvm_vm_ioctl(cs->kvm_state, KVM_S390_INTERRUPT, &kvmint);
 515     } else {
 516         r = kvm_vcpu_ioctl(cs, KVM_S390_INTERRUPT, &kvmint);
 517     }
 518
 519     if (r < 0) {
 520         fprintf(stderr, "KVM failed to inject interrupt\n");
 521         exit(1);
 522     }
 523 }
 524
 525 void kvm_s390_virtio_irq(S390CPU *cpu, int config_change, uint64_t token)
 526 {
 527     kvm_s390_interrupt_internal(cpu, KVM_S390_INT_VIRTIO, config_change,
 528                                 token, 1);
 529 }
 530
 531 void kvm_s390_interrupt(S390CPU *cpu, int type, uint32_t code)
 532 {
 533     kvm_s390_interrupt_internal(cpu, type, code, 0, 0);
 534 }
 535
 536 static void enter_pgmcheck(S390CPU *cpu, uint16_t code)
 537 {
 538     kvm_s390_interrupt(cpu, KVM_S390_PROGRAM_INT, code);
 539 }
 540
 541 static int kvm_sclp_service_call(S390CPU *cpu, struct kvm_run *run,
 542                                  uint16_t ipbh0)
 543 {
 544     CPUS390XState *env = &cpu->env;
 545     uint64_t sccb;
 546     uint32_t code;
 547     int r = 0;
 548
 549     cpu_synchronize_state(CPU(cpu));
 550     sccb = env->regs[ipbh0 & 0xf];
 551     code = env->regs[(ipbh0 & 0xf0) >> 4];
 552
 553     r = sclp_service_call(env, sccb, code);
 554     if (r < 0) {
 555         enter_pgmcheck(cpu, -r);
 556     } else {
 557         setcc(cpu, r);
 558     }
 559
 560     return 0;
 561 }
 562
 563 static int handle_b2(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
 564 {
 565     CPUS390XState *env = &cpu->env;
 566     int rc = 0;
 567     uint16_t ipbh0 = (run->s390_sieic.ipb & 0xffff0000) >> 16;
 568
 569     cpu_synchronize_state(CPU(cpu));
 570
 571     switch (ipa1) {
 572     case PRIV_B2_XSCH:
 573         ioinst_handle_xsch(cpu, env->regs[1]);
 574         break;
 575     case PRIV_B2_CSCH:
 576         ioinst_handle_csch(cpu, env->regs[1]);
 577         break;
 578     case PRIV_B2_HSCH:
 579         ioinst_handle_hsch(cpu, env->regs[1]);
 580         break;
 581     case PRIV_B2_MSCH:
 582         ioinst_handle_msch(cpu, env->regs[1], run->s390_sieic.ipb);
 583         break;
 584     case PRIV_B2_SSCH:
 585         ioinst_handle_ssch(cpu, env->regs[1], run->s390_sieic.ipb);
 586         break;
 587     case PRIV_B2_STCRW:
 588         ioinst_handle_stcrw(cpu, run->s390_sieic.ipb);
 589         break;
 590     case PRIV_B2_STSCH:
 591         ioinst_handle_stsch(cpu, env->regs[1], run->s390_sieic.ipb);
 592         break;
 593     case PRIV_B2_TSCH:
 594         /* We should only get tsch via KVM_EXIT_S390_TSCH. */
 595         fprintf(stderr, "Spurious tsch intercept\n");
 596         break;
 597     case PRIV_B2_CHSC:
 598         ioinst_handle_chsc(cpu, run->s390_sieic.ipb);
 599         break;
 600     case PRIV_B2_TPI:
 601         /* This should have been handled by kvm already. */
 602         fprintf(stderr, "Spurious tpi intercept\n");
 603         break;
 604     case PRIV_B2_SCHM:
 605         ioinst_handle_schm(cpu, env->regs[1], env->regs[2],
 606                            run->s390_sieic.ipb);
 607         break;
 608     case PRIV_B2_RSCH:
 609         ioinst_handle_rsch(cpu, env->regs[1]);
 610         break;
 611     case PRIV_B2_RCHP:
 612         ioinst_handle_rchp(cpu, env->regs[1]);
 613         break;
 614     case PRIV_B2_STCPS:
 615         /* We do not provide this instruction, it is suppressed. */
 616         break;
 617     case PRIV_B2_SAL:
 618         ioinst_handle_sal(cpu, env->regs[1]);
 619         break;
 620     case PRIV_B2_SIGA:
 621         /* Not provided, set CC = 3 for subchannel not operational */
 622         setcc(cpu, 3);
 623         break;
 624     case PRIV_B2_SCLP_CALL:
 625         rc = kvm_sclp_service_call(cpu, run, ipbh0);
 626         break;
 627     default:
 628         rc = -1;
 629         DPRINTF("KVM: unhandled PRIV: 0xb2%x\n", ipa1);
 630         break;
 631     }
 632
 633     return rc;
 634 }
 635
 636 static int handle_b9(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
 637 {
 638     int r = 0;
 639
 640     switch (ipa1) {
 641     case PRIV_B9_EQBS:
 642         /* just inject exception */
 643         r = -1;
 644         break;
 645     default:
 646         r = -1;
 647         DPRINTF("KVM: unhandled PRIV: 0xb9%x\n", ipa1);
 648         break;
 649     }
 650
 651     return r;
 652 }
 653
 654 static int handle_eb(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
 655 {
 656     int r = 0;
 657
 658     switch (ipa1) {
 659     case PRIV_EB_SQBS:
 660         /* just inject exception */
 661         r = -1;
 662         break;
 663     default:
 664         r = -1;
 665         DPRINTF("KVM: unhandled PRIV: 0xeb%x\n", ipa1);
 666         break;
 667     }
 668
 669     return r;
 670 }
 671
 672 static int handle_hypercall(S390CPU *cpu, struct kvm_run *run)
 673 {
 674     CPUS390XState *env = &cpu->env;
 675     int ret;
 676
 677     cpu_synchronize_state(CPU(cpu));
 678     ret = s390_virtio_hypercall(env);
 679     if (ret == -EINVAL) {
 680         enter_pgmcheck(cpu, PGM_SPECIFICATION);
 681         return 0;
 682     }
 683
 684     return ret;
 685 }
 686
 687 static void kvm_handle_diag_308(S390CPU *cpu, struct kvm_run *run)
 688 {
 689     uint64_t r1, r3;
 690
 691     cpu_synchronize_state(CPU(cpu));
 692     r1 = (run->s390_sieic.ipa & 0x00f0) >> 8;
 693     r3 = run->s390_sieic.ipa & 0x000f;
 694     handle_diag_308(&cpu->env, r1, r3);
 695 }
 696
 697 static int handle_sw_breakpoint(S390CPU *cpu, struct kvm_run *run)
 698 {
 699     CPUS390XState *env = &cpu->env;
 700     unsigned long pc;
 701
 702     cpu_synchronize_state(CPU(cpu));
 703
 704     pc = env->psw.addr - 4;
 705     if (kvm_find_sw_breakpoint(CPU(cpu), pc)) {
 706         env->psw.addr = pc;
 707         return EXCP_DEBUG;
 708     }
 709
 710     return -ENOENT;
 711 }
 712
 713 #define DIAG_KVM_CODE_MASK 0x000000000000ffff
 714
 715 static int handle_diag(S390CPU *cpu, struct kvm_run *run, uint32_t ipb)
 716 {
 717     int r = 0;
 718     uint16_t func_code;
 719
 720     /*
 721      * For any diagnose call we support, bits 48-63 of the resulting
 722      * address specify the function code; the remainder is ignored.
 723      */
 724     func_code = decode_basedisp_rs(&cpu->env, ipb) & DIAG_KVM_CODE_MASK;
 725     switch (func_code) {
 726     case DIAG_IPL:
 727         kvm_handle_diag_308(cpu, run);
 728         break;
 729     case DIAG_KVM_HYPERCALL:
 730         r = handle_hypercall(cpu, run);
 731         break;
 732     case DIAG_KVM_BREAKPOINT:
 733         r = handle_sw_breakpoint(cpu, run);
 734         break;
 735     default:
 736         DPRINTF("KVM: unknown DIAG: 0x%x\n", func_code);
 737         r = -1;
 738         break;
 739     }
 740
 741     return r;
 742 }
 743
 744 static int kvm_s390_cpu_start(S390CPU *cpu)
 745 {
 746     s390_add_running_cpu(cpu);
 747     qemu_cpu_kick(CPU(cpu));
 748     DPRINTF("DONE: KVM cpu start: %p\n", &cpu->env);
 749     return 0;
 750 }
 751
 752 int kvm_s390_cpu_restart(S390CPU *cpu)
 753 {
 754     kvm_s390_interrupt(cpu, KVM_S390_RESTART, 0);
 755     s390_add_running_cpu(cpu);
 756     qemu_cpu_kick(CPU(cpu));
 757     DPRINTF("DONE: KVM cpu restart: %p\n", &cpu->env);
 758     return 0;
 759 }
 760
 761 static void sigp_initial_cpu_reset(void *arg)
 762 {
 763     CPUState *cpu = arg;
 764     S390CPUClass *scc = S390_CPU_GET_CLASS(cpu);
 765
 766     cpu_synchronize_state(cpu);
 767     scc->initial_cpu_reset(cpu);
 768 }
 769
 770 static void sigp_cpu_reset(void *arg)
 771 {
 772     CPUState *cpu = arg;
 773     S390CPUClass *scc = S390_CPU_GET_CLASS(cpu);
 774
 775     cpu_synchronize_state(cpu);
 776     scc->cpu_reset(cpu);
 777 }
 778
 779 #define SIGP_ORDER_MASK 0x000000ff
 780
 781 static int handle_sigp(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
 782 {
 783     CPUS390XState *env = &cpu->env;
 784     uint8_t order_code;
 785     uint16_t cpu_addr;
 786     S390CPU *target_cpu;
 787     uint64_t *statusreg = &env->regs[ipa1 >> 4];
 788     int cc;
 789
 790     cpu_synchronize_state(CPU(cpu));
 791
 792     /* get order code */
 793     order_code = decode_basedisp_rs(env, run->s390_sieic.ipb) & SIGP_ORDER_MASK;
 794
 795     cpu_addr = env->regs[ipa1 & 0x0f];
 796     target_cpu = s390_cpu_addr2state(cpu_addr);
 797     if (target_cpu == NULL) {
 798         cc = 3;    /* not operational */
 799         goto out;
 800     }
 801
 802     switch (order_code) {
 803     case SIGP_START:
 804         cc = kvm_s390_cpu_start(target_cpu);
 805         break;
 806     case SIGP_RESTART:
 807         cc = kvm_s390_cpu_restart(target_cpu);
 808         break;
 809     case SIGP_SET_ARCH:
 810         *statusreg &= 0xffffffff00000000UL;
 811         *statusreg |= SIGP_STAT_INVALID_PARAMETER;
 812         cc = 1;   /* status stored */
 813         break;
 814     case SIGP_INITIAL_CPU_RESET:
 815         run_on_cpu(CPU(target_cpu), sigp_initial_cpu_reset, CPU(target_cpu));
 816         cc = 0;
 817         break;
 818     case SIGP_CPU_RESET:
 819         run_on_cpu(CPU(target_cpu), sigp_cpu_reset, CPU(target_cpu));
 820         cc = 0;
 821         break;
 822     default:
 823         DPRINTF("KVM: unknown SIGP: 0x%x\n", order_code);
 824         *statusreg &= 0xffffffff00000000UL;
 825         *statusreg |= SIGP_STAT_INVALID_ORDER;
 826         cc = 1;   /* status stored */
 827         break;
 828     }
 829
 830 out:
 831     setcc(cpu, cc);
 832     return 0;
 833 }
 834
 835 static int handle_instruction(S390CPU *cpu, struct kvm_run *run)
 836 {
 837     unsigned int ipa0 = (run->s390_sieic.ipa & 0xff00);
 838     uint8_t ipa1 = run->s390_sieic.ipa & 0x00ff;
 839     int r = -1;
 840
 841     DPRINTF("handle_instruction 0x%x 0x%x\n",
 842             run->s390_sieic.ipa, run->s390_sieic.ipb);
 843     switch (ipa0) {
 844     case IPA0_B2:
 845         r = handle_b2(cpu, run, ipa1);
 846         break;
 847     case IPA0_B9:
 848         r = handle_b9(cpu, run, ipa1);
 849         break;
 850     case IPA0_EB:
 851         r = handle_eb(cpu, run, ipa1);
 852         break;
 853     case IPA0_DIAG:
 854         r = handle_diag(cpu, run, run->s390_sieic.ipb);
 855         break;
 856     case IPA0_SIGP:
 857         r = handle_sigp(cpu, run, ipa1);
 858         break;
 859     }
 860
 861     if (r < 0) {
 862         r = 0;
 863         enter_pgmcheck(cpu, 0x0001);
 864     }
 865
 866     return r;
 867 }
 868
 869 static bool is_special_wait_psw(CPUState *cs)
 870 {
 871     /* signal quiesce */
 872     return cs->kvm_run->psw_addr == 0xfffUL;
 873 }
 874
 875 static int handle_intercept(S390CPU *cpu)
 876 {
 877     CPUState *cs = CPU(cpu);
 878     struct kvm_run *run = cs->kvm_run;
 879     int icpt_code = run->s390_sieic.icptcode;
 880     int r = 0;
 881
 882     DPRINTF("intercept: 0x%x (at 0x%lx)\n", icpt_code,
 883             (long)cs->kvm_run->psw_addr);
 884     switch (icpt_code) {
 885         case ICPT_INSTRUCTION:
 886             r = handle_instruction(cpu, run);
 887             break;
 888         case ICPT_WAITPSW:
 889             /* disabled wait, since enabled wait is handled in kernel */
 890             if (s390_del_running_cpu(cpu) == 0) {
 891                 if (is_special_wait_psw(cs)) {
 892                     qemu_system_shutdown_request();
 893                 } else {
 894                     QObject *data;
 895
 896                     data = qobject_from_jsonf("{ 'action': %s }", "pause");
 897                     monitor_protocol_event(QEVENT_GUEST_PANICKED, data);
 898                     qobject_decref(data);
 899                     vm_stop(RUN_STATE_GUEST_PANICKED);
 900                 }
 901             }
 902             r = EXCP_HALTED;
 903             break;
 904         case ICPT_CPU_STOP:
 905             if (s390_del_running_cpu(cpu) == 0) {
 906                 qemu_system_shutdown_request();
 907             }
 908             r = EXCP_HALTED;
 909             break;
 910         case ICPT_SOFT_INTERCEPT:
 911             fprintf(stderr, "KVM unimplemented icpt SOFT\n");
 912             exit(1);
 913             break;
 914         case ICPT_IO:
 915             fprintf(stderr, "KVM unimplemented icpt IO\n");
 916             exit(1);
 917             break;
 918         default:
 919             fprintf(stderr, "Unknown intercept code: %d\n", icpt_code);
 920             exit(1);
 921             break;
 922     }
 923
 924     return r;
 925 }
 926
 927 static int handle_tsch(S390CPU *cpu)
 928 {
 929     CPUS390XState *env = &cpu->env;
 930     CPUState *cs = CPU(cpu);
 931     struct kvm_run *run = cs->kvm_run;
 932     int ret;
 933
 934     cpu_synchronize_state(cs);
 935
 936     ret = ioinst_handle_tsch(env, env->regs[1], run->s390_tsch.ipb);
 937     if (ret >= 0) {
 938         /* Success; set condition code. */
 939         setcc(cpu, ret);
 940         ret = 0;
 941     } else if (ret < -1) {
 942         /*
 943          * Failure.
 944          * If an I/O interrupt had been dequeued, we have to reinject it.
 945          */
 946         if (run->s390_tsch.dequeued) {
 947             uint16_t subchannel_id = run->s390_tsch.subchannel_id;
 948             uint16_t subchannel_nr = run->s390_tsch.subchannel_nr;
 949             uint32_t io_int_parm = run->s390_tsch.io_int_parm;
 950             uint32_t io_int_word = run->s390_tsch.io_int_word;
 951             uint32_t type = ((subchannel_id & 0xff00) << 24) |
 952                 ((subchannel_id & 0x00060) << 22) | (subchannel_nr << 16);
 953
 954             kvm_s390_interrupt_internal(cpu, type,
 955                                         ((uint32_t)subchannel_id << 16)
 956                                         | subchannel_nr,
 957                                         ((uint64_t)io_int_parm << 32)
 958                                         | io_int_word, 1);
 959         }
 960         ret = 0;
 961     }
 962     return ret;
 963 }
 964
 965 static int kvm_arch_handle_debug_exit(S390CPU *cpu)
 966 {
 967     CPUState *cs = CPU(cpu);
 968     struct kvm_run *run = cs->kvm_run;
 969
 970     int ret = 0;
 971     struct kvm_debug_exit_arch *arch_info = &run->debug.arch;
 972
 973     switch (arch_info->type) {
 974     case KVM_HW_WP_WRITE:
 975         if (find_hw_breakpoint(arch_info->addr, -1, arch_info->type)) {
 976             cs->watchpoint_hit = &hw_watchpoint;
 977             hw_watchpoint.vaddr = arch_info->addr;
 978             hw_watchpoint.flags = BP_MEM_WRITE;
 979             ret = EXCP_DEBUG;
 980         }
 981         break;
 982     case KVM_HW_BP:
 983         if (find_hw_breakpoint(arch_info->addr, -1, arch_info->type)) {
 984             ret = EXCP_DEBUG;
 985         }
 986         break;
 987     case KVM_SINGLESTEP:
 988         if (cs->singlestep_enabled) {
 989             ret = EXCP_DEBUG;
 990         }
 991         break;
 992     default:
 993         ret = -ENOSYS;
 994     }
 995
 996     return ret;
 997 }
 998
 999 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
1000 {
1001     S390CPU *cpu = S390_CPU(cs);
1002     int ret = 0;
1003
1004     switch (run->exit_reason) {
1005         case KVM_EXIT_S390_SIEIC:
1006             ret = handle_intercept(cpu);
1007             break;
1008         case KVM_EXIT_S390_RESET:
1009             qemu_system_reset_request();
1010             break;
1011         case KVM_EXIT_S390_TSCH:
1012             ret = handle_tsch(cpu);
1013             break;
1014         case KVM_EXIT_DEBUG:
1015             ret = kvm_arch_handle_debug_exit(cpu);
1016             break;
1017         default:
1018             fprintf(stderr, "Unknown KVM exit: %d\n", run->exit_reason);
1019             break;
1020     }
1021
1022     if (ret == 0) {
1023         ret = EXCP_INTERRUPT;
1024     }
1025     return ret;
1026 }
1027
1028 bool kvm_arch_stop_on_emulation_error(CPUState *cpu)
1029 {
1030     return true;
1031 }
1032
1033 int kvm_arch_on_sigbus_vcpu(CPUState *cpu, int code, void *addr)
1034 {
1035     return 1;
1036 }
1037
1038 int kvm_arch_on_sigbus(int code, void *addr)
1039 {
1040     return 1;
1041 }
1042
1043 void kvm_s390_io_interrupt(S390CPU *cpu, uint16_t subchannel_id,
1044                            uint16_t subchannel_nr, uint32_t io_int_parm,
1045                            uint32_t io_int_word)
1046 {
1047     uint32_t type;
1048
1049     if (io_int_word & IO_INT_WORD_AI) {
1050         type = KVM_S390_INT_IO(1, 0, 0, 0);
1051     } else {
1052         type = ((subchannel_id & 0xff00) << 24) |
1053             ((subchannel_id & 0x00060) << 22) | (subchannel_nr << 16);
1054     }
1055     kvm_s390_interrupt_internal(cpu, type,
1056                                 ((uint32_t)subchannel_id << 16) | subchannel_nr,
1057                                 ((uint64_t)io_int_parm << 32) | io_int_word, 1);
1058 }
1059
1060 void kvm_s390_crw_mchk(S390CPU *cpu)
1061 {
1062     kvm_s390_interrupt_internal(cpu, KVM_S390_MCHK, 1 << 28,
1063                                 0x00400f1d40330000, 1);
1064 }
1065
1066 void kvm_s390_enable_css_support(S390CPU *cpu)
1067 {
1068     int r;
1069
1070     /* Activate host kernel channel subsystem support. */
1071     r = kvm_vcpu_enable_cap(CPU(cpu), KVM_CAP_S390_CSS_SUPPORT, 0);
1072     assert(r == 0);
1073 }
1074
1075 void kvm_arch_init_irq_routing(KVMState *s)
1076 {
1077     /*
1078      * Note that while irqchip capabilities generally imply that cpustates
1079      * are handled in-kernel, it is not true for s390 (yet); therefore, we
1080      * have to override the common code kvm_halt_in_kernel_allowed setting.
1081      */
1082     if (kvm_check_extension(s, KVM_CAP_IRQ_ROUTING)) {
1083         kvm_irqfds_allowed = true;
1084         kvm_gsi_routing_allowed = true;
1085         kvm_halt_in_kernel_allowed = false;
1086     }
1087 }
1088
1089 int kvm_s390_assign_subch_ioeventfd(EventNotifier *notifier, uint32_t sch,
1090                                     int vq, bool assign)
1091 {
1092     struct kvm_ioeventfd kick = {
1093         .flags = KVM_IOEVENTFD_FLAG_VIRTIO_CCW_NOTIFY |
1094         KVM_IOEVENTFD_FLAG_DATAMATCH,
1095         .fd = event_notifier_get_fd(notifier),
1096         .datamatch = vq,
1097         .addr = sch,
1098         .len = 8,
1099     };
1100     if (!kvm_check_extension(kvm_state, KVM_CAP_IOEVENTFD)) {
1101         return -ENOSYS;
1102     }
1103     if (!assign) {
1104         kick.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;
1105     }
1106     return kvm_vm_ioctl(kvm_state, KVM_IOEVENTFD, &kick);
1107 }