]>
Commit | Line | Data |
---|---|---|
26861c7c MH |
1 | /* |
2 | * ARM implementation of KVM hooks, 64 bit specific code | |
3 | * | |
4 | * Copyright Mian-M. Hamayun 2013, Virtual Open Systems | |
e4482ab7 | 5 | * Copyright Alex Bennée 2014, Linaro |
26861c7c MH |
6 | * |
7 | * This work is licensed under the terms of the GNU GPL, version 2 or later. | |
8 | * See the COPYING file in the top-level directory. | |
9 | * | |
10 | */ | |
11 | ||
74c21bd0 | 12 | #include "qemu/osdep.h" |
26861c7c | 13 | #include <sys/ioctl.h> |
e4482ab7 | 14 | #include <sys/ptrace.h> |
26861c7c | 15 | |
e4482ab7 | 16 | #include <linux/elf.h> |
26861c7c MH |
17 | #include <linux/kvm.h> |
18 | ||
19 | #include "qemu-common.h" | |
33c11879 | 20 | #include "cpu.h" |
26861c7c | 21 | #include "qemu/timer.h" |
2ecb2027 | 22 | #include "qemu/error-report.h" |
e4482ab7 AB |
23 | #include "qemu/host-utils.h" |
24 | #include "exec/gdbstub.h" | |
26861c7c MH |
25 | #include "sysemu/sysemu.h" |
26 | #include "sysemu/kvm.h" | |
27 | #include "kvm_arm.h" | |
9208b961 | 28 | #include "internals.h" |
26861c7c MH |
29 | #include "hw/arm/arm.h" |
30 | ||
29eb3d9a AB |
31 | static bool have_guest_debug; |
32 | ||
e4482ab7 AB |
33 | /* |
34 | * Although the ARM implementation of hardware assisted debugging | |
35 | * allows for different breakpoints per-core, the current GDB | |
36 | * interface treats them as a global pool of registers (which seems to | |
37 | * be the case for x86, ppc and s390). As a result we store one copy | |
38 | * of registers which is used for all active cores. | |
39 | * | |
40 | * Write access is serialised by virtue of the GDB protocol which | |
41 | * updates things. Read access (i.e. when the values are copied to the | |
42 | * vCPU) is also gated by GDB's run control. | |
43 | * | |
44 | * This is not unreasonable as most of the time debugging kernels you | |
45 | * never know which core will eventually execute your function. | |
46 | */ | |
47 | ||
48 | typedef struct { | |
49 | uint64_t bcr; | |
50 | uint64_t bvr; | |
51 | } HWBreakpoint; | |
52 | ||
53 | /* The watchpoint registers can cover more area than the requested | |
54 | * watchpoint so we need to store the additional information | |
55 | * somewhere. We also need to supply a CPUWatchpoint to the GDB stub | |
56 | * when the watchpoint is hit. | |
57 | */ | |
58 | typedef struct { | |
59 | uint64_t wcr; | |
60 | uint64_t wvr; | |
61 | CPUWatchpoint details; | |
62 | } HWWatchpoint; | |
63 | ||
64 | /* Maximum and current break/watch point counts */ | |
65 | int max_hw_bps, max_hw_wps; | |
66 | GArray *hw_breakpoints, *hw_watchpoints; | |
67 | ||
68 | #define cur_hw_wps (hw_watchpoints->len) | |
69 | #define cur_hw_bps (hw_breakpoints->len) | |
70 | #define get_hw_bp(i) (&g_array_index(hw_breakpoints, HWBreakpoint, i)) | |
71 | #define get_hw_wp(i) (&g_array_index(hw_watchpoints, HWWatchpoint, i)) | |
72 | ||
29eb3d9a | 73 | /** |
e4482ab7 | 74 | * kvm_arm_init_debug() - check for guest debug capabilities |
29eb3d9a AB |
75 | * @cs: CPUState |
76 | * | |
e4482ab7 AB |
77 | * kvm_check_extension returns the number of debug registers we have |
78 | * or 0 if we have none. | |
29eb3d9a AB |
79 | * |
80 | */ | |
81 | static void kvm_arm_init_debug(CPUState *cs) | |
82 | { | |
83 | have_guest_debug = kvm_check_extension(cs->kvm_state, | |
84 | KVM_CAP_SET_GUEST_DEBUG); | |
e4482ab7 AB |
85 | |
86 | max_hw_wps = kvm_check_extension(cs->kvm_state, KVM_CAP_GUEST_DEBUG_HW_WPS); | |
87 | hw_watchpoints = g_array_sized_new(true, true, | |
88 | sizeof(HWWatchpoint), max_hw_wps); | |
89 | ||
90 | max_hw_bps = kvm_check_extension(cs->kvm_state, KVM_CAP_GUEST_DEBUG_HW_BPS); | |
91 | hw_breakpoints = g_array_sized_new(true, true, | |
92 | sizeof(HWBreakpoint), max_hw_bps); | |
29eb3d9a AB |
93 | return; |
94 | } | |
95 | ||
e4482ab7 AB |
96 | /** |
97 | * insert_hw_breakpoint() | |
98 | * @addr: address of breakpoint | |
99 | * | |
100 | * See ARM ARM D2.9.1 for details but here we are only going to create | |
101 | * simple un-linked breakpoints (i.e. we don't chain breakpoints | |
102 | * together to match address and context or vmid). The hardware is | |
103 | * capable of fancier matching but that will require exposing that | |
104 | * fanciness to GDB's interface | |
105 | * | |
106 | * D7.3.2 DBGBCR<n>_EL1, Debug Breakpoint Control Registers | |
107 | * | |
108 | * 31 24 23 20 19 16 15 14 13 12 9 8 5 4 3 2 1 0 | |
109 | * +------+------+-------+-----+----+------+-----+------+-----+---+ | |
110 | * | RES0 | BT | LBN | SSC | HMC| RES0 | BAS | RES0 | PMC | E | | |
111 | * +------+------+-------+-----+----+------+-----+------+-----+---+ | |
112 | * | |
113 | * BT: Breakpoint type (0 = unlinked address match) | |
114 | * LBN: Linked BP number (0 = unused) | |
115 | * SSC/HMC/PMC: Security, Higher and Priv access control (Table D-12) | |
116 | * BAS: Byte Address Select (RES1 for AArch64) | |
117 | * E: Enable bit | |
118 | */ | |
119 | static int insert_hw_breakpoint(target_ulong addr) | |
120 | { | |
121 | HWBreakpoint brk = { | |
122 | .bcr = 0x1, /* BCR E=1, enable */ | |
123 | .bvr = addr | |
124 | }; | |
125 | ||
126 | if (cur_hw_bps >= max_hw_bps) { | |
127 | return -ENOBUFS; | |
128 | } | |
129 | ||
130 | brk.bcr = deposit32(brk.bcr, 1, 2, 0x3); /* PMC = 11 */ | |
131 | brk.bcr = deposit32(brk.bcr, 5, 4, 0xf); /* BAS = RES1 */ | |
132 | ||
133 | g_array_append_val(hw_breakpoints, brk); | |
134 | ||
135 | return 0; | |
136 | } | |
137 | ||
138 | /** | |
139 | * delete_hw_breakpoint() | |
140 | * @pc: address of breakpoint | |
141 | * | |
142 | * Delete a breakpoint and shuffle any above down | |
143 | */ | |
144 | ||
145 | static int delete_hw_breakpoint(target_ulong pc) | |
146 | { | |
147 | int i; | |
148 | for (i = 0; i < hw_breakpoints->len; i++) { | |
149 | HWBreakpoint *brk = get_hw_bp(i); | |
150 | if (brk->bvr == pc) { | |
151 | g_array_remove_index(hw_breakpoints, i); | |
152 | return 0; | |
153 | } | |
154 | } | |
155 | return -ENOENT; | |
156 | } | |
157 | ||
158 | /** | |
159 | * insert_hw_watchpoint() | |
160 | * @addr: address of watch point | |
161 | * @len: size of area | |
162 | * @type: type of watch point | |
163 | * | |
164 | * See ARM ARM D2.10. As with the breakpoints we can do some advanced | |
165 | * stuff if we want to. The watch points can be linked with the break | |
166 | * points above to make them context aware. However for simplicity | |
167 | * currently we only deal with simple read/write watch points. | |
168 | * | |
169 | * D7.3.11 DBGWCR<n>_EL1, Debug Watchpoint Control Registers | |
170 | * | |
171 | * 31 29 28 24 23 21 20 19 16 15 14 13 12 5 4 3 2 1 0 | |
172 | * +------+-------+------+----+-----+-----+-----+-----+-----+-----+---+ | |
173 | * | RES0 | MASK | RES0 | WT | LBN | SSC | HMC | BAS | LSC | PAC | E | | |
174 | * +------+-------+------+----+-----+-----+-----+-----+-----+-----+---+ | |
175 | * | |
176 | * MASK: num bits addr mask (0=none,01/10=res,11=3 bits (8 bytes)) | |
177 | * WT: 0 - unlinked, 1 - linked (not currently used) | |
178 | * LBN: Linked BP number (not currently used) | |
179 | * SSC/HMC/PAC: Security, Higher and Priv access control (Table D2-11) | |
180 | * BAS: Byte Address Select | |
181 | * LSC: Load/Store control (01: load, 10: store, 11: both) | |
182 | * E: Enable | |
183 | * | |
184 | * The bottom 2 bits of the value register are masked. Therefore to | |
185 | * break on any sizes smaller than an unaligned word you need to set | |
186 | * MASK=0, BAS=bit per byte in question. For larger regions (^2) you | |
187 | * need to ensure you mask the address as required and set BAS=0xff | |
188 | */ | |
189 | ||
190 | static int insert_hw_watchpoint(target_ulong addr, | |
191 | target_ulong len, int type) | |
192 | { | |
193 | HWWatchpoint wp = { | |
194 | .wcr = 1, /* E=1, enable */ | |
195 | .wvr = addr & (~0x7ULL), | |
196 | .details = { .vaddr = addr, .len = len } | |
197 | }; | |
198 | ||
199 | if (cur_hw_wps >= max_hw_wps) { | |
200 | return -ENOBUFS; | |
201 | } | |
202 | ||
203 | /* | |
204 | * HMC=0 SSC=0 PAC=3 will hit EL0 or EL1, any security state, | |
205 | * valid whether EL3 is implemented or not | |
206 | */ | |
207 | wp.wcr = deposit32(wp.wcr, 1, 2, 3); | |
208 | ||
209 | switch (type) { | |
210 | case GDB_WATCHPOINT_READ: | |
211 | wp.wcr = deposit32(wp.wcr, 3, 2, 1); | |
212 | wp.details.flags = BP_MEM_READ; | |
213 | break; | |
214 | case GDB_WATCHPOINT_WRITE: | |
215 | wp.wcr = deposit32(wp.wcr, 3, 2, 2); | |
216 | wp.details.flags = BP_MEM_WRITE; | |
217 | break; | |
218 | case GDB_WATCHPOINT_ACCESS: | |
219 | wp.wcr = deposit32(wp.wcr, 3, 2, 3); | |
220 | wp.details.flags = BP_MEM_ACCESS; | |
221 | break; | |
222 | default: | |
223 | g_assert_not_reached(); | |
224 | break; | |
225 | } | |
226 | if (len <= 8) { | |
227 | /* we align the address and set the bits in BAS */ | |
228 | int off = addr & 0x7; | |
229 | int bas = (1 << len) - 1; | |
230 | ||
231 | wp.wcr = deposit32(wp.wcr, 5 + off, 8 - off, bas); | |
232 | } else { | |
233 | /* For ranges above 8 bytes we need to be a power of 2 */ | |
234 | if (is_power_of_2(len)) { | |
235 | int bits = ctz64(len); | |
236 | ||
237 | wp.wvr &= ~((1 << bits) - 1); | |
238 | wp.wcr = deposit32(wp.wcr, 24, 4, bits); | |
239 | wp.wcr = deposit32(wp.wcr, 5, 8, 0xff); | |
240 | } else { | |
241 | return -ENOBUFS; | |
242 | } | |
243 | } | |
244 | ||
245 | g_array_append_val(hw_watchpoints, wp); | |
246 | return 0; | |
247 | } | |
248 | ||
249 | ||
250 | static bool check_watchpoint_in_range(int i, target_ulong addr) | |
251 | { | |
252 | HWWatchpoint *wp = get_hw_wp(i); | |
253 | uint64_t addr_top, addr_bottom = wp->wvr; | |
254 | int bas = extract32(wp->wcr, 5, 8); | |
255 | int mask = extract32(wp->wcr, 24, 4); | |
256 | ||
257 | if (mask) { | |
258 | addr_top = addr_bottom + (1 << mask); | |
259 | } else { | |
260 | /* BAS must be contiguous but can offset against the base | |
261 | * address in DBGWVR */ | |
262 | addr_bottom = addr_bottom + ctz32(bas); | |
263 | addr_top = addr_bottom + clo32(bas); | |
264 | } | |
265 | ||
266 | if (addr >= addr_bottom && addr <= addr_top) { | |
267 | return true; | |
268 | } | |
269 | ||
270 | return false; | |
271 | } | |
272 | ||
273 | /** | |
274 | * delete_hw_watchpoint() | |
275 | * @addr: address of breakpoint | |
276 | * | |
277 | * Delete a breakpoint and shuffle any above down | |
278 | */ | |
279 | ||
280 | static int delete_hw_watchpoint(target_ulong addr, | |
281 | target_ulong len, int type) | |
282 | { | |
283 | int i; | |
284 | for (i = 0; i < cur_hw_wps; i++) { | |
285 | if (check_watchpoint_in_range(i, addr)) { | |
286 | g_array_remove_index(hw_watchpoints, i); | |
287 | return 0; | |
288 | } | |
289 | } | |
290 | return -ENOENT; | |
291 | } | |
292 | ||
293 | ||
294 | int kvm_arch_insert_hw_breakpoint(target_ulong addr, | |
295 | target_ulong len, int type) | |
296 | { | |
297 | switch (type) { | |
298 | case GDB_BREAKPOINT_HW: | |
299 | return insert_hw_breakpoint(addr); | |
300 | break; | |
301 | case GDB_WATCHPOINT_READ: | |
302 | case GDB_WATCHPOINT_WRITE: | |
303 | case GDB_WATCHPOINT_ACCESS: | |
304 | return insert_hw_watchpoint(addr, len, type); | |
305 | default: | |
306 | return -ENOSYS; | |
307 | } | |
308 | } | |
309 | ||
310 | int kvm_arch_remove_hw_breakpoint(target_ulong addr, | |
311 | target_ulong len, int type) | |
312 | { | |
313 | switch (type) { | |
314 | case GDB_BREAKPOINT_HW: | |
315 | return delete_hw_breakpoint(addr); | |
316 | break; | |
317 | case GDB_WATCHPOINT_READ: | |
318 | case GDB_WATCHPOINT_WRITE: | |
319 | case GDB_WATCHPOINT_ACCESS: | |
320 | return delete_hw_watchpoint(addr, len, type); | |
321 | default: | |
322 | return -ENOSYS; | |
323 | } | |
324 | } | |
325 | ||
326 | ||
327 | void kvm_arch_remove_all_hw_breakpoints(void) | |
328 | { | |
329 | if (cur_hw_wps > 0) { | |
330 | g_array_remove_range(hw_watchpoints, 0, cur_hw_wps); | |
331 | } | |
332 | if (cur_hw_bps > 0) { | |
333 | g_array_remove_range(hw_breakpoints, 0, cur_hw_bps); | |
334 | } | |
335 | } | |
336 | ||
337 | void kvm_arm_copy_hw_debug_data(struct kvm_guest_debug_arch *ptr) | |
338 | { | |
339 | int i; | |
340 | memset(ptr, 0, sizeof(struct kvm_guest_debug_arch)); | |
341 | ||
342 | for (i = 0; i < max_hw_wps; i++) { | |
343 | HWWatchpoint *wp = get_hw_wp(i); | |
344 | ptr->dbg_wcr[i] = wp->wcr; | |
345 | ptr->dbg_wvr[i] = wp->wvr; | |
346 | } | |
347 | for (i = 0; i < max_hw_bps; i++) { | |
348 | HWBreakpoint *bp = get_hw_bp(i); | |
349 | ptr->dbg_bcr[i] = bp->bcr; | |
350 | ptr->dbg_bvr[i] = bp->bvr; | |
351 | } | |
352 | } | |
353 | ||
354 | bool kvm_arm_hw_debug_active(CPUState *cs) | |
355 | { | |
356 | return ((cur_hw_wps > 0) || (cur_hw_bps > 0)); | |
357 | } | |
358 | ||
359 | static bool find_hw_breakpoint(CPUState *cpu, target_ulong pc) | |
360 | { | |
361 | int i; | |
362 | ||
363 | for (i = 0; i < cur_hw_bps; i++) { | |
364 | HWBreakpoint *bp = get_hw_bp(i); | |
365 | if (bp->bvr == pc) { | |
366 | return true; | |
367 | } | |
368 | } | |
369 | return false; | |
370 | } | |
371 | ||
372 | static CPUWatchpoint *find_hw_watchpoint(CPUState *cpu, target_ulong addr) | |
373 | { | |
374 | int i; | |
375 | ||
376 | for (i = 0; i < cur_hw_wps; i++) { | |
377 | if (check_watchpoint_in_range(i, addr)) { | |
378 | return &get_hw_wp(i)->details; | |
379 | } | |
380 | } | |
381 | return NULL; | |
382 | } | |
383 | ||
3f07cb2a | 384 | static bool kvm_arm_pmu_set_attr(CPUState *cs, struct kvm_device_attr *attr) |
01fe6b60 SZ |
385 | { |
386 | int err; | |
387 | ||
3f07cb2a AJ |
388 | err = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr); |
389 | if (err != 0) { | |
b2bfe9f7 | 390 | error_report("PMU: KVM_HAS_DEVICE_ATTR: %s", strerror(-err)); |
3f07cb2a | 391 | return false; |
01fe6b60 SZ |
392 | } |
393 | ||
3f07cb2a | 394 | err = kvm_vcpu_ioctl(cs, KVM_SET_DEVICE_ATTR, attr); |
b2bfe9f7 AJ |
395 | if (err != 0) { |
396 | error_report("PMU: KVM_SET_DEVICE_ATTR: %s", strerror(-err)); | |
397 | return false; | |
01fe6b60 SZ |
398 | } |
399 | ||
3f07cb2a AJ |
400 | return true; |
401 | } | |
01fe6b60 | 402 | |
b2bfe9f7 | 403 | void kvm_arm_pmu_init(CPUState *cs) |
3f07cb2a AJ |
404 | { |
405 | struct kvm_device_attr attr = { | |
406 | .group = KVM_ARM_VCPU_PMU_V3_CTRL, | |
407 | .attr = KVM_ARM_VCPU_PMU_V3_INIT, | |
408 | }; | |
409 | ||
b2bfe9f7 AJ |
410 | if (!ARM_CPU(cs)->has_pmu) { |
411 | return; | |
412 | } | |
413 | if (!kvm_arm_pmu_set_attr(cs, &attr)) { | |
414 | error_report("failed to init PMU"); | |
415 | abort(); | |
416 | } | |
3f07cb2a AJ |
417 | } |
418 | ||
b2bfe9f7 | 419 | void kvm_arm_pmu_set_irq(CPUState *cs, int irq) |
3f07cb2a AJ |
420 | { |
421 | struct kvm_device_attr attr = { | |
422 | .group = KVM_ARM_VCPU_PMU_V3_CTRL, | |
423 | .addr = (intptr_t)&irq, | |
424 | .attr = KVM_ARM_VCPU_PMU_V3_IRQ, | |
425 | }; | |
01fe6b60 | 426 | |
b2bfe9f7 AJ |
427 | if (!ARM_CPU(cs)->has_pmu) { |
428 | return; | |
429 | } | |
430 | if (!kvm_arm_pmu_set_attr(cs, &attr)) { | |
431 | error_report("failed to set irq for PMU"); | |
432 | abort(); | |
433 | } | |
01fe6b60 | 434 | } |
e4482ab7 | 435 | |
26861c7c MH |
436 | static inline void set_feature(uint64_t *features, int feature) |
437 | { | |
438 | *features |= 1ULL << feature; | |
439 | } | |
440 | ||
929e754d WH |
441 | static inline void unset_feature(uint64_t *features, int feature) |
442 | { | |
443 | *features &= ~(1ULL << feature); | |
444 | } | |
445 | ||
26861c7c MH |
446 | bool kvm_arm_get_host_cpu_features(ARMHostCPUClass *ahcc) |
447 | { | |
448 | /* Identify the feature bits corresponding to the host CPU, and | |
449 | * fill out the ARMHostCPUClass fields accordingly. To do this | |
450 | * we have to create a scratch VM, create a single CPU inside it, | |
451 | * and then query that CPU for the relevant ID registers. | |
452 | * For AArch64 we currently don't care about ID registers at | |
453 | * all; we just want to know the CPU type. | |
454 | */ | |
455 | int fdarray[3]; | |
456 | uint64_t features = 0; | |
457 | /* Old kernels may not know about the PREFERRED_TARGET ioctl: however | |
458 | * we know these will only support creating one kind of guest CPU, | |
459 | * which is its preferred CPU type. Fortunately these old kernels | |
460 | * support only a very limited number of CPUs. | |
461 | */ | |
462 | static const uint32_t cpus_to_try[] = { | |
463 | KVM_ARM_TARGET_AEM_V8, | |
464 | KVM_ARM_TARGET_FOUNDATION_V8, | |
465 | KVM_ARM_TARGET_CORTEX_A57, | |
466 | QEMU_KVM_ARM_TARGET_NONE | |
467 | }; | |
468 | struct kvm_vcpu_init init; | |
469 | ||
470 | if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) { | |
471 | return false; | |
472 | } | |
473 | ||
474 | ahcc->target = init.target; | |
475 | ahcc->dtb_compatible = "arm,arm-v8"; | |
476 | ||
477 | kvm_arm_destroy_scratch_host_vcpu(fdarray); | |
478 | ||
479 | /* We can assume any KVM supporting CPU is at least a v8 | |
480 | * with VFPv4+Neon; this in turn implies most of the other | |
481 | * feature bits. | |
482 | */ | |
483 | set_feature(&features, ARM_FEATURE_V8); | |
484 | set_feature(&features, ARM_FEATURE_VFP4); | |
485 | set_feature(&features, ARM_FEATURE_NEON); | |
486 | set_feature(&features, ARM_FEATURE_AARCH64); | |
929e754d | 487 | set_feature(&features, ARM_FEATURE_PMU); |
26861c7c MH |
488 | |
489 | ahcc->features = features; | |
490 | ||
491 | return true; | |
492 | } | |
493 | ||
eb5e1d3c PF |
494 | #define ARM_CPU_ID_MPIDR 3, 0, 0, 0, 5 |
495 | ||
26861c7c MH |
496 | int kvm_arch_init_vcpu(CPUState *cs) |
497 | { | |
26861c7c | 498 | int ret; |
eb5e1d3c | 499 | uint64_t mpidr; |
228d5e04 | 500 | ARMCPU *cpu = ARM_CPU(cs); |
929e754d | 501 | CPUARMState *env = &cpu->env; |
26861c7c MH |
502 | |
503 | if (cpu->kvm_target == QEMU_KVM_ARM_TARGET_NONE || | |
56073970 | 504 | !object_dynamic_cast(OBJECT(cpu), TYPE_AARCH64_CPU)) { |
26861c7c MH |
505 | fprintf(stderr, "KVM is not supported for this guest CPU type\n"); |
506 | return -EINVAL; | |
507 | } | |
508 | ||
228d5e04 PS |
509 | /* Determine init features for this CPU */ |
510 | memset(cpu->kvm_init_features, 0, sizeof(cpu->kvm_init_features)); | |
26861c7c | 511 | if (cpu->start_powered_off) { |
228d5e04 PS |
512 | cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_POWER_OFF; |
513 | } | |
7cd62e53 | 514 | if (kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PSCI_0_2)) { |
dd032e34 | 515 | cpu->psci_version = 2; |
7cd62e53 PS |
516 | cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PSCI_0_2; |
517 | } | |
56073970 GB |
518 | if (!arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) { |
519 | cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_EL1_32BIT; | |
520 | } | |
b1659527 | 521 | if (!kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PMU_V3)) { |
929e754d WH |
522 | cpu->has_pmu = false; |
523 | } | |
524 | if (cpu->has_pmu) { | |
5c0a3819 | 525 | cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PMU_V3; |
929e754d WH |
526 | } else { |
527 | unset_feature(&env->features, ARM_FEATURE_PMU); | |
5c0a3819 | 528 | } |
228d5e04 PS |
529 | |
530 | /* Do KVM_ARM_VCPU_INIT ioctl */ | |
531 | ret = kvm_arm_vcpu_init(cs); | |
532 | if (ret) { | |
533 | return ret; | |
26861c7c | 534 | } |
26861c7c | 535 | |
eb5e1d3c PF |
536 | /* |
537 | * When KVM is in use, PSCI is emulated in-kernel and not by qemu. | |
538 | * Currently KVM has its own idea about MPIDR assignment, so we | |
539 | * override our defaults with what we get from KVM. | |
540 | */ | |
541 | ret = kvm_get_one_reg(cs, ARM64_SYS_REG(ARM_CPU_ID_MPIDR), &mpidr); | |
542 | if (ret) { | |
543 | return ret; | |
544 | } | |
0f4a9e45 | 545 | cpu->mp_affinity = mpidr & ARM64_AFFINITY_MASK; |
eb5e1d3c | 546 | |
29eb3d9a AB |
547 | kvm_arm_init_debug(cs); |
548 | ||
38df27c8 AB |
549 | return kvm_arm_init_cpreg_list(cpu); |
550 | } | |
26861c7c | 551 | |
38df27c8 AB |
552 | bool kvm_arm_reg_syncs_via_cpreg_list(uint64_t regidx) |
553 | { | |
554 | /* Return true if the regidx is a register we should synchronize | |
555 | * via the cpreg_tuples array (ie is not a core reg we sync by | |
556 | * hand in kvm_arch_get/put_registers()) | |
557 | */ | |
558 | switch (regidx & KVM_REG_ARM_COPROC_MASK) { | |
559 | case KVM_REG_ARM_CORE: | |
560 | return false; | |
561 | default: | |
562 | return true; | |
563 | } | |
26861c7c MH |
564 | } |
565 | ||
4b7a6bf4 CD |
566 | typedef struct CPRegStateLevel { |
567 | uint64_t regidx; | |
568 | int level; | |
569 | } CPRegStateLevel; | |
570 | ||
571 | /* All system registers not listed in the following table are assumed to be | |
572 | * of the level KVM_PUT_RUNTIME_STATE. If a register should be written less | |
573 | * often, you must add it to this table with a state of either | |
574 | * KVM_PUT_RESET_STATE or KVM_PUT_FULL_STATE. | |
575 | */ | |
576 | static const CPRegStateLevel non_runtime_cpregs[] = { | |
577 | { KVM_REG_ARM_TIMER_CNT, KVM_PUT_FULL_STATE }, | |
578 | }; | |
579 | ||
580 | int kvm_arm_cpreg_level(uint64_t regidx) | |
581 | { | |
582 | int i; | |
583 | ||
584 | for (i = 0; i < ARRAY_SIZE(non_runtime_cpregs); i++) { | |
585 | const CPRegStateLevel *l = &non_runtime_cpregs[i]; | |
586 | if (l->regidx == regidx) { | |
587 | return l->level; | |
588 | } | |
589 | } | |
590 | ||
591 | return KVM_PUT_RUNTIME_STATE; | |
592 | } | |
593 | ||
26861c7c MH |
594 | #define AARCH64_CORE_REG(x) (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \ |
595 | KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x)) | |
596 | ||
0e4b5869 AB |
597 | #define AARCH64_SIMD_CORE_REG(x) (KVM_REG_ARM64 | KVM_REG_SIZE_U128 | \ |
598 | KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x)) | |
599 | ||
600 | #define AARCH64_SIMD_CTRL_REG(x) (KVM_REG_ARM64 | KVM_REG_SIZE_U32 | \ | |
601 | KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x)) | |
602 | ||
26861c7c MH |
603 | int kvm_arch_put_registers(CPUState *cs, int level) |
604 | { | |
605 | struct kvm_one_reg reg; | |
0e4b5869 | 606 | uint32_t fpr; |
26861c7c MH |
607 | uint64_t val; |
608 | int i; | |
609 | int ret; | |
25b9fb10 | 610 | unsigned int el; |
26861c7c MH |
611 | |
612 | ARMCPU *cpu = ARM_CPU(cs); | |
613 | CPUARMState *env = &cpu->env; | |
614 | ||
56073970 GB |
615 | /* If we are in AArch32 mode then we need to copy the AArch32 regs to the |
616 | * AArch64 registers before pushing them out to 64-bit KVM. | |
617 | */ | |
618 | if (!is_a64(env)) { | |
619 | aarch64_sync_32_to_64(env); | |
620 | } | |
621 | ||
26861c7c MH |
622 | for (i = 0; i < 31; i++) { |
623 | reg.id = AARCH64_CORE_REG(regs.regs[i]); | |
624 | reg.addr = (uintptr_t) &env->xregs[i]; | |
625 | ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, ®); | |
626 | if (ret) { | |
627 | return ret; | |
628 | } | |
629 | } | |
630 | ||
f502cfc2 PM |
631 | /* KVM puts SP_EL0 in regs.sp and SP_EL1 in regs.sp_el1. On the |
632 | * QEMU side we keep the current SP in xregs[31] as well. | |
633 | */ | |
9208b961 | 634 | aarch64_save_sp(env, 1); |
f502cfc2 | 635 | |
26861c7c | 636 | reg.id = AARCH64_CORE_REG(regs.sp); |
f502cfc2 PM |
637 | reg.addr = (uintptr_t) &env->sp_el[0]; |
638 | ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, ®); | |
639 | if (ret) { | |
640 | return ret; | |
641 | } | |
642 | ||
643 | reg.id = AARCH64_CORE_REG(sp_el1); | |
644 | reg.addr = (uintptr_t) &env->sp_el[1]; | |
26861c7c MH |
645 | ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, ®); |
646 | if (ret) { | |
647 | return ret; | |
648 | } | |
649 | ||
650 | /* Note that KVM thinks pstate is 64 bit but we use a uint32_t */ | |
56073970 GB |
651 | if (is_a64(env)) { |
652 | val = pstate_read(env); | |
653 | } else { | |
654 | val = cpsr_read(env); | |
655 | } | |
26861c7c MH |
656 | reg.id = AARCH64_CORE_REG(regs.pstate); |
657 | reg.addr = (uintptr_t) &val; | |
658 | ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, ®); | |
659 | if (ret) { | |
660 | return ret; | |
661 | } | |
662 | ||
663 | reg.id = AARCH64_CORE_REG(regs.pc); | |
664 | reg.addr = (uintptr_t) &env->pc; | |
665 | ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, ®); | |
666 | if (ret) { | |
667 | return ret; | |
668 | } | |
669 | ||
a0618a19 | 670 | reg.id = AARCH64_CORE_REG(elr_el1); |
6947f059 | 671 | reg.addr = (uintptr_t) &env->elr_el[1]; |
a0618a19 PM |
672 | ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, ®); |
673 | if (ret) { | |
674 | return ret; | |
675 | } | |
676 | ||
25b9fb10 AB |
677 | /* Saved Program State Registers |
678 | * | |
679 | * Before we restore from the banked_spsr[] array we need to | |
680 | * ensure that any modifications to env->spsr are correctly | |
681 | * reflected in the banks. | |
682 | */ | |
683 | el = arm_current_el(env); | |
684 | if (el > 0 && !is_a64(env)) { | |
685 | i = bank_number(env->uncached_cpsr & CPSR_M); | |
686 | env->banked_spsr[i] = env->spsr; | |
687 | } | |
688 | ||
689 | /* KVM 0-4 map to QEMU banks 1-5 */ | |
a65f1de9 PM |
690 | for (i = 0; i < KVM_NR_SPSR; i++) { |
691 | reg.id = AARCH64_CORE_REG(spsr[i]); | |
25b9fb10 | 692 | reg.addr = (uintptr_t) &env->banked_spsr[i + 1]; |
a65f1de9 PM |
693 | ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, ®); |
694 | if (ret) { | |
695 | return ret; | |
696 | } | |
697 | } | |
698 | ||
0e4b5869 AB |
699 | /* Advanced SIMD and FP registers |
700 | * We map Qn = regs[2n+1]:regs[2n] | |
701 | */ | |
702 | for (i = 0; i < 32; i++) { | |
703 | int rd = i << 1; | |
704 | uint64_t fp_val[2]; | |
705 | #ifdef HOST_WORDS_BIGENDIAN | |
706 | fp_val[0] = env->vfp.regs[rd + 1]; | |
707 | fp_val[1] = env->vfp.regs[rd]; | |
708 | #else | |
709 | fp_val[1] = env->vfp.regs[rd + 1]; | |
710 | fp_val[0] = env->vfp.regs[rd]; | |
711 | #endif | |
712 | reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]); | |
713 | reg.addr = (uintptr_t)(&fp_val); | |
714 | ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, ®); | |
715 | if (ret) { | |
716 | return ret; | |
717 | } | |
718 | } | |
719 | ||
720 | reg.addr = (uintptr_t)(&fpr); | |
721 | fpr = vfp_get_fpsr(env); | |
722 | reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr); | |
723 | ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, ®); | |
724 | if (ret) { | |
725 | return ret; | |
726 | } | |
727 | ||
728 | fpr = vfp_get_fpcr(env); | |
729 | reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr); | |
730 | ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, ®); | |
731 | if (ret) { | |
732 | return ret; | |
733 | } | |
734 | ||
4b7a6bf4 | 735 | if (!write_list_to_kvmstate(cpu, level)) { |
568bab1f PS |
736 | return EINVAL; |
737 | } | |
738 | ||
1a1753f7 AB |
739 | kvm_arm_sync_mpstate_to_kvm(cpu); |
740 | ||
26861c7c MH |
741 | return ret; |
742 | } | |
743 | ||
744 | int kvm_arch_get_registers(CPUState *cs) | |
745 | { | |
746 | struct kvm_one_reg reg; | |
747 | uint64_t val; | |
0e4b5869 | 748 | uint32_t fpr; |
25b9fb10 | 749 | unsigned int el; |
26861c7c MH |
750 | int i; |
751 | int ret; | |
752 | ||
753 | ARMCPU *cpu = ARM_CPU(cs); | |
754 | CPUARMState *env = &cpu->env; | |
755 | ||
756 | for (i = 0; i < 31; i++) { | |
757 | reg.id = AARCH64_CORE_REG(regs.regs[i]); | |
758 | reg.addr = (uintptr_t) &env->xregs[i]; | |
759 | ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, ®); | |
760 | if (ret) { | |
761 | return ret; | |
762 | } | |
763 | } | |
764 | ||
765 | reg.id = AARCH64_CORE_REG(regs.sp); | |
f502cfc2 PM |
766 | reg.addr = (uintptr_t) &env->sp_el[0]; |
767 | ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, ®); | |
768 | if (ret) { | |
769 | return ret; | |
770 | } | |
771 | ||
772 | reg.id = AARCH64_CORE_REG(sp_el1); | |
773 | reg.addr = (uintptr_t) &env->sp_el[1]; | |
26861c7c MH |
774 | ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, ®); |
775 | if (ret) { | |
776 | return ret; | |
777 | } | |
778 | ||
779 | reg.id = AARCH64_CORE_REG(regs.pstate); | |
780 | reg.addr = (uintptr_t) &val; | |
781 | ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, ®); | |
782 | if (ret) { | |
783 | return ret; | |
784 | } | |
56073970 GB |
785 | |
786 | env->aarch64 = ((val & PSTATE_nRW) == 0); | |
787 | if (is_a64(env)) { | |
788 | pstate_write(env, val); | |
789 | } else { | |
50866ba5 | 790 | cpsr_write(env, val, 0xffffffff, CPSRWriteRaw); |
56073970 | 791 | } |
26861c7c | 792 | |
f502cfc2 PM |
793 | /* KVM puts SP_EL0 in regs.sp and SP_EL1 in regs.sp_el1. On the |
794 | * QEMU side we keep the current SP in xregs[31] as well. | |
795 | */ | |
9208b961 | 796 | aarch64_restore_sp(env, 1); |
f502cfc2 | 797 | |
26861c7c MH |
798 | reg.id = AARCH64_CORE_REG(regs.pc); |
799 | reg.addr = (uintptr_t) &env->pc; | |
800 | ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, ®); | |
801 | if (ret) { | |
802 | return ret; | |
803 | } | |
804 | ||
56073970 GB |
805 | /* If we are in AArch32 mode then we need to sync the AArch32 regs with the |
806 | * incoming AArch64 regs received from 64-bit KVM. | |
807 | * We must perform this after all of the registers have been acquired from | |
808 | * the kernel. | |
809 | */ | |
810 | if (!is_a64(env)) { | |
811 | aarch64_sync_64_to_32(env); | |
812 | } | |
813 | ||
a0618a19 | 814 | reg.id = AARCH64_CORE_REG(elr_el1); |
6947f059 | 815 | reg.addr = (uintptr_t) &env->elr_el[1]; |
a0618a19 PM |
816 | ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, ®); |
817 | if (ret) { | |
818 | return ret; | |
819 | } | |
820 | ||
25b9fb10 AB |
821 | /* Fetch the SPSR registers |
822 | * | |
823 | * KVM SPSRs 0-4 map to QEMU banks 1-5 | |
824 | */ | |
a65f1de9 PM |
825 | for (i = 0; i < KVM_NR_SPSR; i++) { |
826 | reg.id = AARCH64_CORE_REG(spsr[i]); | |
25b9fb10 | 827 | reg.addr = (uintptr_t) &env->banked_spsr[i + 1]; |
a65f1de9 PM |
828 | ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, ®); |
829 | if (ret) { | |
830 | return ret; | |
831 | } | |
832 | } | |
833 | ||
25b9fb10 AB |
834 | el = arm_current_el(env); |
835 | if (el > 0 && !is_a64(env)) { | |
836 | i = bank_number(env->uncached_cpsr & CPSR_M); | |
837 | env->spsr = env->banked_spsr[i]; | |
838 | } | |
839 | ||
0e4b5869 AB |
840 | /* Advanced SIMD and FP registers |
841 | * We map Qn = regs[2n+1]:regs[2n] | |
842 | */ | |
843 | for (i = 0; i < 32; i++) { | |
844 | uint64_t fp_val[2]; | |
845 | reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]); | |
846 | reg.addr = (uintptr_t)(&fp_val); | |
847 | ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, ®); | |
848 | if (ret) { | |
849 | return ret; | |
850 | } else { | |
851 | int rd = i << 1; | |
852 | #ifdef HOST_WORDS_BIGENDIAN | |
853 | env->vfp.regs[rd + 1] = fp_val[0]; | |
854 | env->vfp.regs[rd] = fp_val[1]; | |
855 | #else | |
856 | env->vfp.regs[rd + 1] = fp_val[1]; | |
857 | env->vfp.regs[rd] = fp_val[0]; | |
858 | #endif | |
859 | } | |
860 | } | |
861 | ||
862 | reg.addr = (uintptr_t)(&fpr); | |
863 | reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr); | |
864 | ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, ®); | |
865 | if (ret) { | |
866 | return ret; | |
867 | } | |
868 | vfp_set_fpsr(env, fpr); | |
869 | ||
870 | reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr); | |
871 | ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, ®); | |
872 | if (ret) { | |
873 | return ret; | |
874 | } | |
875 | vfp_set_fpcr(env, fpr); | |
876 | ||
568bab1f PS |
877 | if (!write_kvmstate_to_list(cpu)) { |
878 | return EINVAL; | |
879 | } | |
880 | /* Note that it's OK to have registers which aren't in CPUState, | |
881 | * so we can ignore a failure return here. | |
882 | */ | |
883 | write_list_to_cpustate(cpu); | |
884 | ||
1a1753f7 AB |
885 | kvm_arm_sync_mpstate_to_qemu(cpu); |
886 | ||
26861c7c MH |
887 | /* TODO: other registers */ |
888 | return ret; | |
889 | } | |
2ecb2027 AB |
890 | |
891 | /* C6.6.29 BRK instruction */ | |
892 | static const uint32_t brk_insn = 0xd4200000; | |
893 | ||
894 | int kvm_arch_insert_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp) | |
895 | { | |
896 | if (have_guest_debug) { | |
897 | if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 4, 0) || | |
898 | cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&brk_insn, 4, 1)) { | |
899 | return -EINVAL; | |
900 | } | |
901 | return 0; | |
902 | } else { | |
903 | error_report("guest debug not supported on this kernel"); | |
904 | return -EINVAL; | |
905 | } | |
906 | } | |
907 | ||
908 | int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp) | |
909 | { | |
910 | static uint32_t brk; | |
911 | ||
912 | if (have_guest_debug) { | |
913 | if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&brk, 4, 0) || | |
914 | brk != brk_insn || | |
915 | cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 4, 1)) { | |
916 | return -EINVAL; | |
917 | } | |
918 | return 0; | |
919 | } else { | |
920 | error_report("guest debug not supported on this kernel"); | |
921 | return -EINVAL; | |
922 | } | |
923 | } | |
924 | ||
925 | /* See v8 ARM ARM D7.2.27 ESR_ELx, Exception Syndrome Register | |
926 | * | |
927 | * To minimise translating between kernel and user-space the kernel | |
928 | * ABI just provides user-space with the full exception syndrome | |
929 | * register value to be decoded in QEMU. | |
930 | */ | |
931 | ||
932 | bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit) | |
933 | { | |
934 | int hsr_ec = debug_exit->hsr >> ARM_EL_EC_SHIFT; | |
935 | ARMCPU *cpu = ARM_CPU(cs); | |
34c45d53 | 936 | CPUClass *cc = CPU_GET_CLASS(cs); |
2ecb2027 AB |
937 | CPUARMState *env = &cpu->env; |
938 | ||
939 | /* Ensure PC is synchronised */ | |
940 | kvm_cpu_synchronize_state(cs); | |
941 | ||
942 | switch (hsr_ec) { | |
26ae5934 AB |
943 | case EC_SOFTWARESTEP: |
944 | if (cs->singlestep_enabled) { | |
945 | return true; | |
946 | } else { | |
34c45d53 AB |
947 | /* |
948 | * The kernel should have suppressed the guest's ability to | |
949 | * single step at this point so something has gone wrong. | |
950 | */ | |
951 | error_report("%s: guest single-step while debugging unsupported" | |
dffc5851 | 952 | " (%"PRIx64", %"PRIx32")", |
34c45d53 AB |
953 | __func__, env->pc, debug_exit->hsr); |
954 | return false; | |
26ae5934 AB |
955 | } |
956 | break; | |
2ecb2027 AB |
957 | case EC_AA64_BKPT: |
958 | if (kvm_find_sw_breakpoint(cs, env->pc)) { | |
959 | return true; | |
960 | } | |
961 | break; | |
e4482ab7 AB |
962 | case EC_BREAKPOINT: |
963 | if (find_hw_breakpoint(cs, env->pc)) { | |
964 | return true; | |
965 | } | |
966 | break; | |
967 | case EC_WATCHPOINT: | |
968 | { | |
969 | CPUWatchpoint *wp = find_hw_watchpoint(cs, debug_exit->far); | |
970 | if (wp) { | |
971 | cs->watchpoint_hit = wp; | |
972 | return true; | |
973 | } | |
974 | break; | |
975 | } | |
2ecb2027 | 976 | default: |
dffc5851 | 977 | error_report("%s: unhandled debug exit (%"PRIx32", %"PRIx64")", |
2ecb2027 AB |
978 | __func__, debug_exit->hsr, env->pc); |
979 | } | |
980 | ||
34c45d53 AB |
981 | /* If we are not handling the debug exception it must belong to |
982 | * the guest. Let's re-use the existing TCG interrupt code to set | |
983 | * everything up properly. | |
984 | */ | |
985 | cs->exception_index = EXCP_BKPT; | |
986 | env->exception.syndrome = debug_exit->hsr; | |
987 | env->exception.vaddress = debug_exit->far; | |
988 | cc->do_interrupt(cs); | |
2ecb2027 AB |
989 | |
990 | return false; | |
991 | } |