m25p80: avoid out of bounds accesses
[qemu.git] / target-arm / kvm.c
blob5c2bd7a10b6e07dacc41de6c12aa11c3e67a43d1
1 /*
2 * ARM implementation of KVM hooks
4 * Copyright Christoffer Dall 2009-2010
6 * This work is licensed under the terms of the GNU GPL, version 2 or later.
7 * See the COPYING file in the top-level directory.
9 */
11 #include "qemu/osdep.h"
12 #include <sys/ioctl.h>
14 #include <linux/kvm.h>
16 #include "qemu-common.h"
17 #include "qemu/timer.h"
18 #include "qemu/error-report.h"
19 #include "sysemu/sysemu.h"
20 #include "sysemu/kvm.h"
21 #include "kvm_arm.h"
22 #include "cpu.h"
23 #include "internals.h"
24 #include "hw/arm/arm.h"
25 #include "exec/memattrs.h"
26 #include "hw/boards.h"
27 #include "qemu/log.h"
29 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
30 KVM_CAP_LAST_INFO
33 static bool cap_has_mp_state;
35 int kvm_arm_vcpu_init(CPUState *cs)
37 ARMCPU *cpu = ARM_CPU(cs);
38 struct kvm_vcpu_init init;
40 init.target = cpu->kvm_target;
41 memcpy(init.features, cpu->kvm_init_features, sizeof(init.features));
43 return kvm_vcpu_ioctl(cs, KVM_ARM_VCPU_INIT, &init);
46 bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
47 int *fdarray,
48 struct kvm_vcpu_init *init)
50 int ret, kvmfd = -1, vmfd = -1, cpufd = -1;
52 kvmfd = qemu_open("/dev/kvm", O_RDWR);
53 if (kvmfd < 0) {
54 goto err;
56 vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
57 if (vmfd < 0) {
58 goto err;
60 cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
61 if (cpufd < 0) {
62 goto err;
65 if (!init) {
66 /* Caller doesn't want the VCPU to be initialized, so skip it */
67 goto finish;
70 ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, init);
71 if (ret >= 0) {
72 ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
73 if (ret < 0) {
74 goto err;
76 } else if (cpus_to_try) {
77 /* Old kernel which doesn't know about the
78 * PREFERRED_TARGET ioctl: we know it will only support
79 * creating one kind of guest CPU which is its preferred
80 * CPU type.
82 while (*cpus_to_try != QEMU_KVM_ARM_TARGET_NONE) {
83 init->target = *cpus_to_try++;
84 memset(init->features, 0, sizeof(init->features));
85 ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
86 if (ret >= 0) {
87 break;
90 if (ret < 0) {
91 goto err;
93 } else {
94 /* Treat a NULL cpus_to_try argument the same as an empty
95 * list, which means we will fail the call since this must
96 * be an old kernel which doesn't support PREFERRED_TARGET.
98 goto err;
101 finish:
102 fdarray[0] = kvmfd;
103 fdarray[1] = vmfd;
104 fdarray[2] = cpufd;
106 return true;
108 err:
109 if (cpufd >= 0) {
110 close(cpufd);
112 if (vmfd >= 0) {
113 close(vmfd);
115 if (kvmfd >= 0) {
116 close(kvmfd);
119 return false;
122 void kvm_arm_destroy_scratch_host_vcpu(int *fdarray)
124 int i;
126 for (i = 2; i >= 0; i--) {
127 close(fdarray[i]);
131 static void kvm_arm_host_cpu_class_init(ObjectClass *oc, void *data)
133 ARMHostCPUClass *ahcc = ARM_HOST_CPU_CLASS(oc);
135 /* All we really need to set up for the 'host' CPU
136 * is the feature bits -- we rely on the fact that the
137 * various ID register values in ARMCPU are only used for
138 * TCG CPUs.
140 if (!kvm_arm_get_host_cpu_features(ahcc)) {
141 fprintf(stderr, "Failed to retrieve host CPU features!\n");
142 abort();
146 static void kvm_arm_host_cpu_initfn(Object *obj)
148 ARMHostCPUClass *ahcc = ARM_HOST_CPU_GET_CLASS(obj);
149 ARMCPU *cpu = ARM_CPU(obj);
150 CPUARMState *env = &cpu->env;
152 cpu->kvm_target = ahcc->target;
153 cpu->dtb_compatible = ahcc->dtb_compatible;
154 env->features = ahcc->features;
157 static const TypeInfo host_arm_cpu_type_info = {
158 .name = TYPE_ARM_HOST_CPU,
159 #ifdef TARGET_AARCH64
160 .parent = TYPE_AARCH64_CPU,
161 #else
162 .parent = TYPE_ARM_CPU,
163 #endif
164 .instance_init = kvm_arm_host_cpu_initfn,
165 .class_init = kvm_arm_host_cpu_class_init,
166 .class_size = sizeof(ARMHostCPUClass),
169 int kvm_arch_init(MachineState *ms, KVMState *s)
171 /* For ARM interrupt delivery is always asynchronous,
172 * whether we are using an in-kernel VGIC or not.
174 kvm_async_interrupts_allowed = true;
176 cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
178 type_register_static(&host_arm_cpu_type_info);
180 return 0;
183 unsigned long kvm_arch_vcpu_id(CPUState *cpu)
185 return cpu->cpu_index;
188 /* We track all the KVM devices which need their memory addresses
189 * passing to the kernel in a list of these structures.
190 * When board init is complete we run through the list and
191 * tell the kernel the base addresses of the memory regions.
192 * We use a MemoryListener to track mapping and unmapping of
193 * the regions during board creation, so the board models don't
194 * need to do anything special for the KVM case.
196 typedef struct KVMDevice {
197 struct kvm_arm_device_addr kda;
198 struct kvm_device_attr kdattr;
199 MemoryRegion *mr;
200 QSLIST_ENTRY(KVMDevice) entries;
201 int dev_fd;
202 } KVMDevice;
204 static QSLIST_HEAD(kvm_devices_head, KVMDevice) kvm_devices_head;
206 static void kvm_arm_devlistener_add(MemoryListener *listener,
207 MemoryRegionSection *section)
209 KVMDevice *kd;
211 QSLIST_FOREACH(kd, &kvm_devices_head, entries) {
212 if (section->mr == kd->mr) {
213 kd->kda.addr = section->offset_within_address_space;
218 static void kvm_arm_devlistener_del(MemoryListener *listener,
219 MemoryRegionSection *section)
221 KVMDevice *kd;
223 QSLIST_FOREACH(kd, &kvm_devices_head, entries) {
224 if (section->mr == kd->mr) {
225 kd->kda.addr = -1;
230 static MemoryListener devlistener = {
231 .region_add = kvm_arm_devlistener_add,
232 .region_del = kvm_arm_devlistener_del,
235 static void kvm_arm_set_device_addr(KVMDevice *kd)
237 struct kvm_device_attr *attr = &kd->kdattr;
238 int ret;
240 /* If the device control API is available and we have a device fd on the
241 * KVMDevice struct, let's use the newer API
243 if (kd->dev_fd >= 0) {
244 uint64_t addr = kd->kda.addr;
245 attr->addr = (uintptr_t)&addr;
246 ret = kvm_device_ioctl(kd->dev_fd, KVM_SET_DEVICE_ATTR, attr);
247 } else {
248 ret = kvm_vm_ioctl(kvm_state, KVM_ARM_SET_DEVICE_ADDR, &kd->kda);
251 if (ret < 0) {
252 fprintf(stderr, "Failed to set device address: %s\n",
253 strerror(-ret));
254 abort();
258 static void kvm_arm_machine_init_done(Notifier *notifier, void *data)
260 KVMDevice *kd, *tkd;
262 memory_listener_unregister(&devlistener);
263 QSLIST_FOREACH_SAFE(kd, &kvm_devices_head, entries, tkd) {
264 if (kd->kda.addr != -1) {
265 kvm_arm_set_device_addr(kd);
267 memory_region_unref(kd->mr);
268 g_free(kd);
272 static Notifier notify = {
273 .notify = kvm_arm_machine_init_done,
276 void kvm_arm_register_device(MemoryRegion *mr, uint64_t devid, uint64_t group,
277 uint64_t attr, int dev_fd)
279 KVMDevice *kd;
281 if (!kvm_irqchip_in_kernel()) {
282 return;
285 if (QSLIST_EMPTY(&kvm_devices_head)) {
286 memory_listener_register(&devlistener, NULL);
287 qemu_add_machine_init_done_notifier(&notify);
289 kd = g_new0(KVMDevice, 1);
290 kd->mr = mr;
291 kd->kda.id = devid;
292 kd->kda.addr = -1;
293 kd->kdattr.flags = 0;
294 kd->kdattr.group = group;
295 kd->kdattr.attr = attr;
296 kd->dev_fd = dev_fd;
297 QSLIST_INSERT_HEAD(&kvm_devices_head, kd, entries);
298 memory_region_ref(kd->mr);
301 static int compare_u64(const void *a, const void *b)
303 if (*(uint64_t *)a > *(uint64_t *)b) {
304 return 1;
306 if (*(uint64_t *)a < *(uint64_t *)b) {
307 return -1;
309 return 0;
312 /* Initialize the CPUState's cpreg list according to the kernel's
313 * definition of what CPU registers it knows about (and throw away
314 * the previous TCG-created cpreg list).
316 int kvm_arm_init_cpreg_list(ARMCPU *cpu)
318 struct kvm_reg_list rl;
319 struct kvm_reg_list *rlp;
320 int i, ret, arraylen;
321 CPUState *cs = CPU(cpu);
323 rl.n = 0;
324 ret = kvm_vcpu_ioctl(cs, KVM_GET_REG_LIST, &rl);
325 if (ret != -E2BIG) {
326 return ret;
328 rlp = g_malloc(sizeof(struct kvm_reg_list) + rl.n * sizeof(uint64_t));
329 rlp->n = rl.n;
330 ret = kvm_vcpu_ioctl(cs, KVM_GET_REG_LIST, rlp);
331 if (ret) {
332 goto out;
334 /* Sort the list we get back from the kernel, since cpreg_tuples
335 * must be in strictly ascending order.
337 qsort(&rlp->reg, rlp->n, sizeof(rlp->reg[0]), compare_u64);
339 for (i = 0, arraylen = 0; i < rlp->n; i++) {
340 if (!kvm_arm_reg_syncs_via_cpreg_list(rlp->reg[i])) {
341 continue;
343 switch (rlp->reg[i] & KVM_REG_SIZE_MASK) {
344 case KVM_REG_SIZE_U32:
345 case KVM_REG_SIZE_U64:
346 break;
347 default:
348 fprintf(stderr, "Can't handle size of register in kernel list\n");
349 ret = -EINVAL;
350 goto out;
353 arraylen++;
356 cpu->cpreg_indexes = g_renew(uint64_t, cpu->cpreg_indexes, arraylen);
357 cpu->cpreg_values = g_renew(uint64_t, cpu->cpreg_values, arraylen);
358 cpu->cpreg_vmstate_indexes = g_renew(uint64_t, cpu->cpreg_vmstate_indexes,
359 arraylen);
360 cpu->cpreg_vmstate_values = g_renew(uint64_t, cpu->cpreg_vmstate_values,
361 arraylen);
362 cpu->cpreg_array_len = arraylen;
363 cpu->cpreg_vmstate_array_len = arraylen;
365 for (i = 0, arraylen = 0; i < rlp->n; i++) {
366 uint64_t regidx = rlp->reg[i];
367 if (!kvm_arm_reg_syncs_via_cpreg_list(regidx)) {
368 continue;
370 cpu->cpreg_indexes[arraylen] = regidx;
371 arraylen++;
373 assert(cpu->cpreg_array_len == arraylen);
375 if (!write_kvmstate_to_list(cpu)) {
376 /* Shouldn't happen unless kernel is inconsistent about
377 * what registers exist.
379 fprintf(stderr, "Initial read of kernel register state failed\n");
380 ret = -EINVAL;
381 goto out;
384 out:
385 g_free(rlp);
386 return ret;
389 bool write_kvmstate_to_list(ARMCPU *cpu)
391 CPUState *cs = CPU(cpu);
392 int i;
393 bool ok = true;
395 for (i = 0; i < cpu->cpreg_array_len; i++) {
396 struct kvm_one_reg r;
397 uint64_t regidx = cpu->cpreg_indexes[i];
398 uint32_t v32;
399 int ret;
401 r.id = regidx;
403 switch (regidx & KVM_REG_SIZE_MASK) {
404 case KVM_REG_SIZE_U32:
405 r.addr = (uintptr_t)&v32;
406 ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
407 if (!ret) {
408 cpu->cpreg_values[i] = v32;
410 break;
411 case KVM_REG_SIZE_U64:
412 r.addr = (uintptr_t)(cpu->cpreg_values + i);
413 ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
414 break;
415 default:
416 abort();
418 if (ret) {
419 ok = false;
422 return ok;
425 bool write_list_to_kvmstate(ARMCPU *cpu, int level)
427 CPUState *cs = CPU(cpu);
428 int i;
429 bool ok = true;
431 for (i = 0; i < cpu->cpreg_array_len; i++) {
432 struct kvm_one_reg r;
433 uint64_t regidx = cpu->cpreg_indexes[i];
434 uint32_t v32;
435 int ret;
437 if (kvm_arm_cpreg_level(regidx) > level) {
438 continue;
441 r.id = regidx;
442 switch (regidx & KVM_REG_SIZE_MASK) {
443 case KVM_REG_SIZE_U32:
444 v32 = cpu->cpreg_values[i];
445 r.addr = (uintptr_t)&v32;
446 break;
447 case KVM_REG_SIZE_U64:
448 r.addr = (uintptr_t)(cpu->cpreg_values + i);
449 break;
450 default:
451 abort();
453 ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
454 if (ret) {
455 /* We might fail for "unknown register" and also for
456 * "you tried to set a register which is constant with
457 * a different value from what it actually contains".
459 ok = false;
462 return ok;
465 void kvm_arm_reset_vcpu(ARMCPU *cpu)
467 int ret;
469 /* Re-init VCPU so that all registers are set to
470 * their respective reset values.
472 ret = kvm_arm_vcpu_init(CPU(cpu));
473 if (ret < 0) {
474 fprintf(stderr, "kvm_arm_vcpu_init failed: %s\n", strerror(-ret));
475 abort();
477 if (!write_kvmstate_to_list(cpu)) {
478 fprintf(stderr, "write_kvmstate_to_list failed\n");
479 abort();
484 * Update KVM's MP_STATE based on what QEMU thinks it is
486 int kvm_arm_sync_mpstate_to_kvm(ARMCPU *cpu)
488 if (cap_has_mp_state) {
489 struct kvm_mp_state mp_state = {
490 .mp_state =
491 cpu->powered_off ? KVM_MP_STATE_STOPPED : KVM_MP_STATE_RUNNABLE
493 int ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MP_STATE, &mp_state);
494 if (ret) {
495 fprintf(stderr, "%s: failed to set MP_STATE %d/%s\n",
496 __func__, ret, strerror(-ret));
497 return -1;
501 return 0;
505 * Sync the KVM MP_STATE into QEMU
507 int kvm_arm_sync_mpstate_to_qemu(ARMCPU *cpu)
509 if (cap_has_mp_state) {
510 struct kvm_mp_state mp_state;
511 int ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MP_STATE, &mp_state);
512 if (ret) {
513 fprintf(stderr, "%s: failed to get MP_STATE %d/%s\n",
514 __func__, ret, strerror(-ret));
515 abort();
517 cpu->powered_off = (mp_state.mp_state == KVM_MP_STATE_STOPPED);
520 return 0;
523 void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
527 MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
529 return MEMTXATTRS_UNSPECIFIED;
533 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
535 int ret = 0;
537 switch (run->exit_reason) {
538 case KVM_EXIT_DEBUG:
539 if (kvm_arm_handle_debug(cs, &run->debug.arch)) {
540 ret = EXCP_DEBUG;
541 } /* otherwise return to guest */
542 break;
543 default:
544 qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",
545 __func__, run->exit_reason);
546 break;
548 return ret;
551 bool kvm_arch_stop_on_emulation_error(CPUState *cs)
553 return true;
556 int kvm_arch_process_async_events(CPUState *cs)
558 return 0;
561 int kvm_arch_on_sigbus_vcpu(CPUState *cs, int code, void *addr)
563 return 1;
566 int kvm_arch_on_sigbus(int code, void *addr)
568 return 1;
571 /* The #ifdef protections are until 32bit headers are imported and can
572 * be removed once both 32 and 64 bit reach feature parity.
574 void kvm_arch_update_guest_debug(CPUState *cs, struct kvm_guest_debug *dbg)
576 #ifdef KVM_GUESTDBG_USE_SW_BP
577 if (kvm_sw_breakpoints_active(cs)) {
578 dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP;
580 #endif
581 #ifdef KVM_GUESTDBG_USE_HW
582 if (kvm_arm_hw_debug_active(cs)) {
583 dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_HW;
584 kvm_arm_copy_hw_debug_data(&dbg->arch);
586 #endif
589 void kvm_arch_init_irq_routing(KVMState *s)
593 int kvm_arch_irqchip_create(MachineState *ms, KVMState *s)
595 if (machine_kernel_irqchip_split(ms)) {
596 perror("-machine kernel_irqchip=split is not supported on ARM.");
597 exit(1);
600 /* If we can create the VGIC using the newer device control API, we
601 * let the device do this when it initializes itself, otherwise we
602 * fall back to the old API */
603 return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
606 int kvm_arm_vgic_probe(void)
608 if (kvm_create_device(kvm_state,
609 KVM_DEV_TYPE_ARM_VGIC_V3, true) == 0) {
610 return 3;
611 } else if (kvm_create_device(kvm_state,
612 KVM_DEV_TYPE_ARM_VGIC_V2, true) == 0) {
613 return 2;
614 } else {
615 return 0;
619 int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
620 uint64_t address, uint32_t data, PCIDevice *dev)
622 return 0;
625 int kvm_arch_msi_data_to_gsi(uint32_t data)
627 return (data - 32) & 0xffff;