1 /* 2 * QEMU Hypervisor.framework support for Apple Silicon 3 4 * Copyright 2020 Alexander Graf <agraf@csgraf.de> 5 * Copyright 2020 Google LLC 6 * 7 * This work is licensed under the terms of the GNU GPL, version 2 or later. 8 * See the COPYING file in the top-level directory. 9 * 10 */ 11 12 #include "qemu/osdep.h" 13 #include "qemu-common.h" 14 #include "qemu/error-report.h" 15 16 #include "sysemu/runstate.h" 17 #include "sysemu/hvf.h" 18 #include "sysemu/hvf_int.h" 19 #include "sysemu/hw_accel.h" 20 #include "hvf_arm.h" 21 22 #include <mach/mach_time.h> 23 24 #include "exec/address-spaces.h" 25 #include "hw/irq.h" 26 #include "qemu/main-loop.h" 27 #include "sysemu/cpus.h" 28 #include "arm-powerctl.h" 29 #include "target/arm/cpu.h" 30 #include "target/arm/internals.h" 31 #include "trace/trace-target_arm_hvf.h" 32 #include "migration/vmstate.h" 33 34 #define HVF_SYSREG(crn, crm, op0, op1, op2) \ 35 ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2) 36 #define PL1_WRITE_MASK 0x4 37 38 #define SYSREG(op0, op1, crn, crm, op2) \ 39 ((op0 << 20) | (op2 << 17) | (op1 << 14) | (crn << 10) | (crm << 1)) 40 #define SYSREG_MASK SYSREG(0x3, 0x7, 0xf, 0xf, 0x7) 41 #define SYSREG_OSLAR_EL1 SYSREG(2, 0, 1, 0, 4) 42 #define SYSREG_OSLSR_EL1 SYSREG(2, 0, 1, 1, 4) 43 #define SYSREG_OSDLR_EL1 SYSREG(2, 0, 1, 3, 4) 44 #define SYSREG_CNTPCT_EL0 SYSREG(3, 3, 14, 0, 1) 45 #define SYSREG_PMCR_EL0 SYSREG(3, 3, 9, 12, 0) 46 #define SYSREG_PMUSERENR_EL0 SYSREG(3, 3, 9, 14, 0) 47 #define SYSREG_PMCNTENSET_EL0 SYSREG(3, 3, 9, 12, 1) 48 #define SYSREG_PMCNTENCLR_EL0 SYSREG(3, 3, 9, 12, 2) 49 #define SYSREG_PMINTENCLR_EL1 SYSREG(3, 0, 9, 14, 2) 50 #define SYSREG_PMOVSCLR_EL0 SYSREG(3, 3, 9, 12, 3) 51 #define SYSREG_PMSWINC_EL0 SYSREG(3, 3, 9, 12, 4) 52 #define SYSREG_PMSELR_EL0 SYSREG(3, 3, 9, 12, 5) 53 #define SYSREG_PMCEID0_EL0 SYSREG(3, 3, 9, 12, 6) 54 #define SYSREG_PMCEID1_EL0 SYSREG(3, 3, 9, 12, 7) 55 #define SYSREG_PMCCNTR_EL0 SYSREG(3, 3, 9, 13, 0) 56 #define SYSREG_PMCCFILTR_EL0 SYSREG(3, 3, 14, 15, 7) 57 58 #define WFX_IS_WFE (1 << 0) 59 60 #define TMR_CTL_ENABLE (1 << 0) 61 #define TMR_CTL_IMASK (1 << 1) 62 #define TMR_CTL_ISTATUS (1 << 2) 63 64 static void hvf_wfi(CPUState *cpu); 65 66 typedef struct HVFVTimer { 67 /* Vtimer value during migration and paused state */ 68 uint64_t vtimer_val; 69 } HVFVTimer; 70 71 static HVFVTimer vtimer; 72 73 typedef struct ARMHostCPUFeatures { 74 ARMISARegisters isar; 75 uint64_t features; 76 uint64_t midr; 77 uint32_t reset_sctlr; 78 const char *dtb_compatible; 79 } ARMHostCPUFeatures; 80 81 static ARMHostCPUFeatures arm_host_cpu_features; 82 83 struct hvf_reg_match { 84 int reg; 85 uint64_t offset; 86 }; 87 88 static const struct hvf_reg_match hvf_reg_match[] = { 89 { HV_REG_X0, offsetof(CPUARMState, xregs[0]) }, 90 { HV_REG_X1, offsetof(CPUARMState, xregs[1]) }, 91 { HV_REG_X2, offsetof(CPUARMState, xregs[2]) }, 92 { HV_REG_X3, offsetof(CPUARMState, xregs[3]) }, 93 { HV_REG_X4, offsetof(CPUARMState, xregs[4]) }, 94 { HV_REG_X5, offsetof(CPUARMState, xregs[5]) }, 95 { HV_REG_X6, offsetof(CPUARMState, xregs[6]) }, 96 { HV_REG_X7, offsetof(CPUARMState, xregs[7]) }, 97 { HV_REG_X8, offsetof(CPUARMState, xregs[8]) }, 98 { HV_REG_X9, offsetof(CPUARMState, xregs[9]) }, 99 { HV_REG_X10, offsetof(CPUARMState, xregs[10]) }, 100 { HV_REG_X11, offsetof(CPUARMState, xregs[11]) }, 101 { HV_REG_X12, offsetof(CPUARMState, xregs[12]) }, 102 { HV_REG_X13, offsetof(CPUARMState, xregs[13]) }, 103 { HV_REG_X14, offsetof(CPUARMState, xregs[14]) }, 104 { HV_REG_X15, offsetof(CPUARMState, xregs[15]) }, 105 { HV_REG_X16, offsetof(CPUARMState, xregs[16]) }, 106 { HV_REG_X17, offsetof(CPUARMState, xregs[17]) }, 107 { HV_REG_X18, offsetof(CPUARMState, xregs[18]) }, 108 { HV_REG_X19, offsetof(CPUARMState, xregs[19]) }, 109 { HV_REG_X20, offsetof(CPUARMState, xregs[20]) }, 110 { HV_REG_X21, offsetof(CPUARMState, xregs[21]) }, 111 { HV_REG_X22, offsetof(CPUARMState, xregs[22]) }, 112 { HV_REG_X23, offsetof(CPUARMState, xregs[23]) }, 113 { HV_REG_X24, offsetof(CPUARMState, xregs[24]) }, 114 { HV_REG_X25, offsetof(CPUARMState, xregs[25]) }, 115 { HV_REG_X26, offsetof(CPUARMState, xregs[26]) }, 116 { HV_REG_X27, offsetof(CPUARMState, xregs[27]) }, 117 { HV_REG_X28, offsetof(CPUARMState, xregs[28]) }, 118 { HV_REG_X29, offsetof(CPUARMState, xregs[29]) }, 119 { HV_REG_X30, offsetof(CPUARMState, xregs[30]) }, 120 { HV_REG_PC, offsetof(CPUARMState, pc) }, 121 }; 122 123 static const struct hvf_reg_match hvf_fpreg_match[] = { 124 { HV_SIMD_FP_REG_Q0, offsetof(CPUARMState, vfp.zregs[0]) }, 125 { HV_SIMD_FP_REG_Q1, offsetof(CPUARMState, vfp.zregs[1]) }, 126 { HV_SIMD_FP_REG_Q2, offsetof(CPUARMState, vfp.zregs[2]) }, 127 { HV_SIMD_FP_REG_Q3, offsetof(CPUARMState, vfp.zregs[3]) }, 128 { HV_SIMD_FP_REG_Q4, offsetof(CPUARMState, vfp.zregs[4]) }, 129 { HV_SIMD_FP_REG_Q5, offsetof(CPUARMState, vfp.zregs[5]) }, 130 { HV_SIMD_FP_REG_Q6, offsetof(CPUARMState, vfp.zregs[6]) }, 131 { HV_SIMD_FP_REG_Q7, offsetof(CPUARMState, vfp.zregs[7]) }, 132 { HV_SIMD_FP_REG_Q8, offsetof(CPUARMState, vfp.zregs[8]) }, 133 { HV_SIMD_FP_REG_Q9, offsetof(CPUARMState, vfp.zregs[9]) }, 134 { HV_SIMD_FP_REG_Q10, offsetof(CPUARMState, vfp.zregs[10]) }, 135 { HV_SIMD_FP_REG_Q11, offsetof(CPUARMState, vfp.zregs[11]) }, 136 { HV_SIMD_FP_REG_Q12, offsetof(CPUARMState, vfp.zregs[12]) }, 137 { HV_SIMD_FP_REG_Q13, offsetof(CPUARMState, vfp.zregs[13]) }, 138 { HV_SIMD_FP_REG_Q14, offsetof(CPUARMState, vfp.zregs[14]) }, 139 { HV_SIMD_FP_REG_Q15, offsetof(CPUARMState, vfp.zregs[15]) }, 140 { HV_SIMD_FP_REG_Q16, offsetof(CPUARMState, vfp.zregs[16]) }, 141 { HV_SIMD_FP_REG_Q17, offsetof(CPUARMState, vfp.zregs[17]) }, 142 { HV_SIMD_FP_REG_Q18, offsetof(CPUARMState, vfp.zregs[18]) }, 143 { HV_SIMD_FP_REG_Q19, offsetof(CPUARMState, vfp.zregs[19]) }, 144 { HV_SIMD_FP_REG_Q20, offsetof(CPUARMState, vfp.zregs[20]) }, 145 { HV_SIMD_FP_REG_Q21, offsetof(CPUARMState, vfp.zregs[21]) }, 146 { HV_SIMD_FP_REG_Q22, offsetof(CPUARMState, vfp.zregs[22]) }, 147 { HV_SIMD_FP_REG_Q23, offsetof(CPUARMState, vfp.zregs[23]) }, 148 { HV_SIMD_FP_REG_Q24, offsetof(CPUARMState, vfp.zregs[24]) }, 149 { HV_SIMD_FP_REG_Q25, offsetof(CPUARMState, vfp.zregs[25]) }, 150 { HV_SIMD_FP_REG_Q26, offsetof(CPUARMState, vfp.zregs[26]) }, 151 { HV_SIMD_FP_REG_Q27, offsetof(CPUARMState, vfp.zregs[27]) }, 152 { HV_SIMD_FP_REG_Q28, offsetof(CPUARMState, vfp.zregs[28]) }, 153 { HV_SIMD_FP_REG_Q29, offsetof(CPUARMState, vfp.zregs[29]) }, 154 { HV_SIMD_FP_REG_Q30, offsetof(CPUARMState, vfp.zregs[30]) }, 155 { HV_SIMD_FP_REG_Q31, offsetof(CPUARMState, vfp.zregs[31]) }, 156 }; 157 158 struct hvf_sreg_match { 159 int reg; 160 uint32_t key; 161 uint32_t cp_idx; 162 }; 163 164 static struct hvf_sreg_match hvf_sreg_match[] = { 165 { HV_SYS_REG_DBGBVR0_EL1, HVF_SYSREG(0, 0, 14, 0, 4) }, 166 { HV_SYS_REG_DBGBCR0_EL1, HVF_SYSREG(0, 0, 14, 0, 5) }, 167 { HV_SYS_REG_DBGWVR0_EL1, HVF_SYSREG(0, 0, 14, 0, 6) }, 168 { HV_SYS_REG_DBGWCR0_EL1, HVF_SYSREG(0, 0, 14, 0, 7) }, 169 170 { HV_SYS_REG_DBGBVR1_EL1, HVF_SYSREG(0, 1, 14, 0, 4) }, 171 { HV_SYS_REG_DBGBCR1_EL1, HVF_SYSREG(0, 1, 14, 0, 5) }, 172 { HV_SYS_REG_DBGWVR1_EL1, HVF_SYSREG(0, 1, 14, 0, 6) }, 173 { HV_SYS_REG_DBGWCR1_EL1, HVF_SYSREG(0, 1, 14, 0, 7) }, 174 175 { HV_SYS_REG_DBGBVR2_EL1, HVF_SYSREG(0, 2, 14, 0, 4) }, 176 { HV_SYS_REG_DBGBCR2_EL1, HVF_SYSREG(0, 2, 14, 0, 5) }, 177 { HV_SYS_REG_DBGWVR2_EL1, HVF_SYSREG(0, 2, 14, 0, 6) }, 178 { HV_SYS_REG_DBGWCR2_EL1, HVF_SYSREG(0, 2, 14, 0, 7) }, 179 180 { HV_SYS_REG_DBGBVR3_EL1, HVF_SYSREG(0, 3, 14, 0, 4) }, 181 { HV_SYS_REG_DBGBCR3_EL1, HVF_SYSREG(0, 3, 14, 0, 5) }, 182 { HV_SYS_REG_DBGWVR3_EL1, HVF_SYSREG(0, 3, 14, 0, 6) }, 183 { HV_SYS_REG_DBGWCR3_EL1, HVF_SYSREG(0, 3, 14, 0, 7) }, 184 185 { HV_SYS_REG_DBGBVR4_EL1, HVF_SYSREG(0, 4, 14, 0, 4) }, 186 { HV_SYS_REG_DBGBCR4_EL1, HVF_SYSREG(0, 4, 14, 0, 5) }, 187 { HV_SYS_REG_DBGWVR4_EL1, HVF_SYSREG(0, 4, 14, 0, 6) }, 188 { HV_SYS_REG_DBGWCR4_EL1, HVF_SYSREG(0, 4, 14, 0, 7) }, 189 190 { HV_SYS_REG_DBGBVR5_EL1, HVF_SYSREG(0, 5, 14, 0, 4) }, 191 { HV_SYS_REG_DBGBCR5_EL1, HVF_SYSREG(0, 5, 14, 0, 5) }, 192 { HV_SYS_REG_DBGWVR5_EL1, HVF_SYSREG(0, 5, 14, 0, 6) }, 193 { HV_SYS_REG_DBGWCR5_EL1, HVF_SYSREG(0, 5, 14, 0, 7) }, 194 195 { HV_SYS_REG_DBGBVR6_EL1, HVF_SYSREG(0, 6, 14, 0, 4) }, 196 { HV_SYS_REG_DBGBCR6_EL1, HVF_SYSREG(0, 6, 14, 0, 5) }, 197 { HV_SYS_REG_DBGWVR6_EL1, HVF_SYSREG(0, 6, 14, 0, 6) }, 198 { HV_SYS_REG_DBGWCR6_EL1, HVF_SYSREG(0, 6, 14, 0, 7) }, 199 200 { HV_SYS_REG_DBGBVR7_EL1, HVF_SYSREG(0, 7, 14, 0, 4) }, 201 { HV_SYS_REG_DBGBCR7_EL1, HVF_SYSREG(0, 7, 14, 0, 5) }, 202 { HV_SYS_REG_DBGWVR7_EL1, HVF_SYSREG(0, 7, 14, 0, 6) }, 203 { HV_SYS_REG_DBGWCR7_EL1, HVF_SYSREG(0, 7, 14, 0, 7) }, 204 205 { HV_SYS_REG_DBGBVR8_EL1, HVF_SYSREG(0, 8, 14, 0, 4) }, 206 { HV_SYS_REG_DBGBCR8_EL1, HVF_SYSREG(0, 8, 14, 0, 5) }, 207 { HV_SYS_REG_DBGWVR8_EL1, HVF_SYSREG(0, 8, 14, 0, 6) }, 208 { HV_SYS_REG_DBGWCR8_EL1, HVF_SYSREG(0, 8, 14, 0, 7) }, 209 210 { HV_SYS_REG_DBGBVR9_EL1, HVF_SYSREG(0, 9, 14, 0, 4) }, 211 { HV_SYS_REG_DBGBCR9_EL1, HVF_SYSREG(0, 9, 14, 0, 5) }, 212 { HV_SYS_REG_DBGWVR9_EL1, HVF_SYSREG(0, 9, 14, 0, 6) }, 213 { HV_SYS_REG_DBGWCR9_EL1, HVF_SYSREG(0, 9, 14, 0, 7) }, 214 215 { HV_SYS_REG_DBGBVR10_EL1, HVF_SYSREG(0, 10, 14, 0, 4) }, 216 { HV_SYS_REG_DBGBCR10_EL1, HVF_SYSREG(0, 10, 14, 0, 5) }, 217 { HV_SYS_REG_DBGWVR10_EL1, HVF_SYSREG(0, 10, 14, 0, 6) }, 218 { HV_SYS_REG_DBGWCR10_EL1, HVF_SYSREG(0, 10, 14, 0, 7) }, 219 220 { HV_SYS_REG_DBGBVR11_EL1, HVF_SYSREG(0, 11, 14, 0, 4) }, 221 { HV_SYS_REG_DBGBCR11_EL1, HVF_SYSREG(0, 11, 14, 0, 5) }, 222 { HV_SYS_REG_DBGWVR11_EL1, HVF_SYSREG(0, 11, 14, 0, 6) }, 223 { HV_SYS_REG_DBGWCR11_EL1, HVF_SYSREG(0, 11, 14, 0, 7) }, 224 225 { HV_SYS_REG_DBGBVR12_EL1, HVF_SYSREG(0, 12, 14, 0, 4) }, 226 { HV_SYS_REG_DBGBCR12_EL1, HVF_SYSREG(0, 12, 14, 0, 5) }, 227 { HV_SYS_REG_DBGWVR12_EL1, HVF_SYSREG(0, 12, 14, 0, 6) }, 228 { HV_SYS_REG_DBGWCR12_EL1, HVF_SYSREG(0, 12, 14, 0, 7) }, 229 230 { HV_SYS_REG_DBGBVR13_EL1, HVF_SYSREG(0, 13, 14, 0, 4) }, 231 { HV_SYS_REG_DBGBCR13_EL1, HVF_SYSREG(0, 13, 14, 0, 5) }, 232 { HV_SYS_REG_DBGWVR13_EL1, HVF_SYSREG(0, 13, 14, 0, 6) }, 233 { HV_SYS_REG_DBGWCR13_EL1, HVF_SYSREG(0, 13, 14, 0, 7) }, 234 235 { HV_SYS_REG_DBGBVR14_EL1, HVF_SYSREG(0, 14, 14, 0, 4) }, 236 { HV_SYS_REG_DBGBCR14_EL1, HVF_SYSREG(0, 14, 14, 0, 5) }, 237 { HV_SYS_REG_DBGWVR14_EL1, HVF_SYSREG(0, 14, 14, 0, 6) }, 238 { HV_SYS_REG_DBGWCR14_EL1, HVF_SYSREG(0, 14, 14, 0, 7) }, 239 240 { HV_SYS_REG_DBGBVR15_EL1, HVF_SYSREG(0, 15, 14, 0, 4) }, 241 { HV_SYS_REG_DBGBCR15_EL1, HVF_SYSREG(0, 15, 14, 0, 5) }, 242 { HV_SYS_REG_DBGWVR15_EL1, HVF_SYSREG(0, 15, 14, 0, 6) }, 243 { HV_SYS_REG_DBGWCR15_EL1, HVF_SYSREG(0, 15, 14, 0, 7) }, 244 245 #ifdef SYNC_NO_RAW_REGS 246 /* 247 * The registers below are manually synced on init because they are 248 * marked as NO_RAW. We still list them to make number space sync easier. 249 */ 250 { HV_SYS_REG_MDCCINT_EL1, HVF_SYSREG(0, 2, 2, 0, 0) }, 251 { HV_SYS_REG_MIDR_EL1, HVF_SYSREG(0, 0, 3, 0, 0) }, 252 { HV_SYS_REG_MPIDR_EL1, HVF_SYSREG(0, 0, 3, 0, 5) }, 253 { HV_SYS_REG_ID_AA64PFR0_EL1, HVF_SYSREG(0, 4, 3, 0, 0) }, 254 #endif 255 { HV_SYS_REG_ID_AA64PFR1_EL1, HVF_SYSREG(0, 4, 3, 0, 2) }, 256 { HV_SYS_REG_ID_AA64DFR0_EL1, HVF_SYSREG(0, 5, 3, 0, 0) }, 257 { HV_SYS_REG_ID_AA64DFR1_EL1, HVF_SYSREG(0, 5, 3, 0, 1) }, 258 { HV_SYS_REG_ID_AA64ISAR0_EL1, HVF_SYSREG(0, 6, 3, 0, 0) }, 259 { HV_SYS_REG_ID_AA64ISAR1_EL1, HVF_SYSREG(0, 6, 3, 0, 1) }, 260 #ifdef SYNC_NO_MMFR0 261 /* We keep the hardware MMFR0 around. HW limits are there anyway */ 262 { HV_SYS_REG_ID_AA64MMFR0_EL1, HVF_SYSREG(0, 7, 3, 0, 0) }, 263 #endif 264 { HV_SYS_REG_ID_AA64MMFR1_EL1, HVF_SYSREG(0, 7, 3, 0, 1) }, 265 { HV_SYS_REG_ID_AA64MMFR2_EL1, HVF_SYSREG(0, 7, 3, 0, 2) }, 266 267 { HV_SYS_REG_MDSCR_EL1, HVF_SYSREG(0, 2, 2, 0, 2) }, 268 { HV_SYS_REG_SCTLR_EL1, HVF_SYSREG(1, 0, 3, 0, 0) }, 269 { HV_SYS_REG_CPACR_EL1, HVF_SYSREG(1, 0, 3, 0, 2) }, 270 { HV_SYS_REG_TTBR0_EL1, HVF_SYSREG(2, 0, 3, 0, 0) }, 271 { HV_SYS_REG_TTBR1_EL1, HVF_SYSREG(2, 0, 3, 0, 1) }, 272 { HV_SYS_REG_TCR_EL1, HVF_SYSREG(2, 0, 3, 0, 2) }, 273 274 { HV_SYS_REG_APIAKEYLO_EL1, HVF_SYSREG(2, 1, 3, 0, 0) }, 275 { HV_SYS_REG_APIAKEYHI_EL1, HVF_SYSREG(2, 1, 3, 0, 1) }, 276 { HV_SYS_REG_APIBKEYLO_EL1, HVF_SYSREG(2, 1, 3, 0, 2) }, 277 { HV_SYS_REG_APIBKEYHI_EL1, HVF_SYSREG(2, 1, 3, 0, 3) }, 278 { HV_SYS_REG_APDAKEYLO_EL1, HVF_SYSREG(2, 2, 3, 0, 0) }, 279 { HV_SYS_REG_APDAKEYHI_EL1, HVF_SYSREG(2, 2, 3, 0, 1) }, 280 { HV_SYS_REG_APDBKEYLO_EL1, HVF_SYSREG(2, 2, 3, 0, 2) }, 281 { HV_SYS_REG_APDBKEYHI_EL1, HVF_SYSREG(2, 2, 3, 0, 3) }, 282 { HV_SYS_REG_APGAKEYLO_EL1, HVF_SYSREG(2, 3, 3, 0, 0) }, 283 { HV_SYS_REG_APGAKEYHI_EL1, HVF_SYSREG(2, 3, 3, 0, 1) }, 284 285 { HV_SYS_REG_SPSR_EL1, HVF_SYSREG(4, 0, 3, 0, 0) }, 286 { HV_SYS_REG_ELR_EL1, HVF_SYSREG(4, 0, 3, 0, 1) }, 287 { HV_SYS_REG_SP_EL0, HVF_SYSREG(4, 1, 3, 0, 0) }, 288 { HV_SYS_REG_AFSR0_EL1, HVF_SYSREG(5, 1, 3, 0, 0) }, 289 { HV_SYS_REG_AFSR1_EL1, HVF_SYSREG(5, 1, 3, 0, 1) }, 290 { HV_SYS_REG_ESR_EL1, HVF_SYSREG(5, 2, 3, 0, 0) }, 291 { HV_SYS_REG_FAR_EL1, HVF_SYSREG(6, 0, 3, 0, 0) }, 292 { HV_SYS_REG_PAR_EL1, HVF_SYSREG(7, 4, 3, 0, 0) }, 293 { HV_SYS_REG_MAIR_EL1, HVF_SYSREG(10, 2, 3, 0, 0) }, 294 { HV_SYS_REG_AMAIR_EL1, HVF_SYSREG(10, 3, 3, 0, 0) }, 295 { HV_SYS_REG_VBAR_EL1, HVF_SYSREG(12, 0, 3, 0, 0) }, 296 { HV_SYS_REG_CONTEXTIDR_EL1, HVF_SYSREG(13, 0, 3, 0, 1) }, 297 { HV_SYS_REG_TPIDR_EL1, HVF_SYSREG(13, 0, 3, 0, 4) }, 298 { HV_SYS_REG_CNTKCTL_EL1, HVF_SYSREG(14, 1, 3, 0, 0) }, 299 { HV_SYS_REG_CSSELR_EL1, HVF_SYSREG(0, 0, 3, 2, 0) }, 300 { HV_SYS_REG_TPIDR_EL0, HVF_SYSREG(13, 0, 3, 3, 2) }, 301 { HV_SYS_REG_TPIDRRO_EL0, HVF_SYSREG(13, 0, 3, 3, 3) }, 302 { HV_SYS_REG_CNTV_CTL_EL0, HVF_SYSREG(14, 3, 3, 3, 1) }, 303 { HV_SYS_REG_CNTV_CVAL_EL0, HVF_SYSREG(14, 3, 3, 3, 2) }, 304 { HV_SYS_REG_SP_EL1, HVF_SYSREG(4, 1, 3, 4, 0) }, 305 }; 306 307 int hvf_get_registers(CPUState *cpu) 308 { 309 ARMCPU *arm_cpu = ARM_CPU(cpu); 310 CPUARMState *env = &arm_cpu->env; 311 hv_return_t ret; 312 uint64_t val; 313 hv_simd_fp_uchar16_t fpval; 314 int i; 315 316 for (i = 0; i < ARRAY_SIZE(hvf_reg_match); i++) { 317 ret = hv_vcpu_get_reg(cpu->hvf->fd, hvf_reg_match[i].reg, &val); 318 *(uint64_t *)((void *)env + hvf_reg_match[i].offset) = val; 319 assert_hvf_ok(ret); 320 } 321 322 for (i = 0; i < ARRAY_SIZE(hvf_fpreg_match); i++) { 323 ret = hv_vcpu_get_simd_fp_reg(cpu->hvf->fd, hvf_fpreg_match[i].reg, 324 &fpval); 325 memcpy((void *)env + hvf_fpreg_match[i].offset, &fpval, sizeof(fpval)); 326 assert_hvf_ok(ret); 327 } 328 329 val = 0; 330 ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_FPCR, &val); 331 assert_hvf_ok(ret); 332 vfp_set_fpcr(env, val); 333 334 val = 0; 335 ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_FPSR, &val); 336 assert_hvf_ok(ret); 337 vfp_set_fpsr(env, val); 338 339 ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_CPSR, &val); 340 assert_hvf_ok(ret); 341 pstate_write(env, val); 342 343 for (i = 0; i < ARRAY_SIZE(hvf_sreg_match); i++) { 344 if (hvf_sreg_match[i].cp_idx == -1) { 345 continue; 346 } 347 348 ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, hvf_sreg_match[i].reg, &val); 349 assert_hvf_ok(ret); 350 351 arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx] = val; 352 } 353 assert(write_list_to_cpustate(arm_cpu)); 354 355 aarch64_restore_sp(env, arm_current_el(env)); 356 357 return 0; 358 } 359 360 int hvf_put_registers(CPUState *cpu) 361 { 362 ARMCPU *arm_cpu = ARM_CPU(cpu); 363 CPUARMState *env = &arm_cpu->env; 364 hv_return_t ret; 365 uint64_t val; 366 hv_simd_fp_uchar16_t fpval; 367 int i; 368 369 for (i = 0; i < ARRAY_SIZE(hvf_reg_match); i++) { 370 val = *(uint64_t *)((void *)env + hvf_reg_match[i].offset); 371 ret = hv_vcpu_set_reg(cpu->hvf->fd, hvf_reg_match[i].reg, val); 372 assert_hvf_ok(ret); 373 } 374 375 for (i = 0; i < ARRAY_SIZE(hvf_fpreg_match); i++) { 376 memcpy(&fpval, (void *)env + hvf_fpreg_match[i].offset, sizeof(fpval)); 377 ret = hv_vcpu_set_simd_fp_reg(cpu->hvf->fd, hvf_fpreg_match[i].reg, 378 fpval); 379 assert_hvf_ok(ret); 380 } 381 382 ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_FPCR, vfp_get_fpcr(env)); 383 assert_hvf_ok(ret); 384 385 ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_FPSR, vfp_get_fpsr(env)); 386 assert_hvf_ok(ret); 387 388 ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_CPSR, pstate_read(env)); 389 assert_hvf_ok(ret); 390 391 aarch64_save_sp(env, arm_current_el(env)); 392 393 assert(write_cpustate_to_list(arm_cpu, false)); 394 for (i = 0; i < ARRAY_SIZE(hvf_sreg_match); i++) { 395 if (hvf_sreg_match[i].cp_idx == -1) { 396 continue; 397 } 398 399 val = arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx]; 400 ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, hvf_sreg_match[i].reg, val); 401 assert_hvf_ok(ret); 402 } 403 404 ret = hv_vcpu_set_vtimer_offset(cpu->hvf->fd, hvf_state->vtimer_offset); 405 assert_hvf_ok(ret); 406 407 return 0; 408 } 409 410 static void flush_cpu_state(CPUState *cpu) 411 { 412 if (cpu->vcpu_dirty) { 413 hvf_put_registers(cpu); 414 cpu->vcpu_dirty = false; 415 } 416 } 417 418 static void hvf_set_reg(CPUState *cpu, int rt, uint64_t val) 419 { 420 hv_return_t r; 421 422 flush_cpu_state(cpu); 423 424 if (rt < 31) { 425 r = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_X0 + rt, val); 426 assert_hvf_ok(r); 427 } 428 } 429 430 static uint64_t hvf_get_reg(CPUState *cpu, int rt) 431 { 432 uint64_t val = 0; 433 hv_return_t r; 434 435 flush_cpu_state(cpu); 436 437 if (rt < 31) { 438 r = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_X0 + rt, &val); 439 assert_hvf_ok(r); 440 } 441 442 return val; 443 } 444 445 static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf) 446 { 447 ARMISARegisters host_isar = {}; 448 const struct isar_regs { 449 int reg; 450 uint64_t *val; 451 } regs[] = { 452 { HV_SYS_REG_ID_AA64PFR0_EL1, &host_isar.id_aa64pfr0 }, 453 { HV_SYS_REG_ID_AA64PFR1_EL1, &host_isar.id_aa64pfr1 }, 454 { HV_SYS_REG_ID_AA64DFR0_EL1, &host_isar.id_aa64dfr0 }, 455 { HV_SYS_REG_ID_AA64DFR1_EL1, &host_isar.id_aa64dfr1 }, 456 { HV_SYS_REG_ID_AA64ISAR0_EL1, &host_isar.id_aa64isar0 }, 457 { HV_SYS_REG_ID_AA64ISAR1_EL1, &host_isar.id_aa64isar1 }, 458 { HV_SYS_REG_ID_AA64MMFR0_EL1, &host_isar.id_aa64mmfr0 }, 459 { HV_SYS_REG_ID_AA64MMFR1_EL1, &host_isar.id_aa64mmfr1 }, 460 { HV_SYS_REG_ID_AA64MMFR2_EL1, &host_isar.id_aa64mmfr2 }, 461 }; 462 hv_vcpu_t fd; 463 hv_return_t r = HV_SUCCESS; 464 hv_vcpu_exit_t *exit; 465 int i; 466 467 ahcf->dtb_compatible = "arm,arm-v8"; 468 ahcf->features = (1ULL << ARM_FEATURE_V8) | 469 (1ULL << ARM_FEATURE_NEON) | 470 (1ULL << ARM_FEATURE_AARCH64) | 471 (1ULL << ARM_FEATURE_PMU) | 472 (1ULL << ARM_FEATURE_GENERIC_TIMER); 473 474 /* We set up a small vcpu to extract host registers */ 475 476 if (hv_vcpu_create(&fd, &exit, NULL) != HV_SUCCESS) { 477 return false; 478 } 479 480 for (i = 0; i < ARRAY_SIZE(regs); i++) { 481 r |= hv_vcpu_get_sys_reg(fd, regs[i].reg, regs[i].val); 482 } 483 r |= hv_vcpu_get_sys_reg(fd, HV_SYS_REG_MIDR_EL1, &ahcf->midr); 484 r |= hv_vcpu_destroy(fd); 485 486 ahcf->isar = host_isar; 487 488 /* 489 * A scratch vCPU returns SCTLR 0, so let's fill our default with the M1 490 * boot SCTLR from https://github.com/AsahiLinux/m1n1/issues/97 491 */ 492 ahcf->reset_sctlr = 0x30100180; 493 /* 494 * SPAN is disabled by default when SCTLR.SPAN=1. To improve compatibility, 495 * let's disable it on boot and then allow guest software to turn it on by 496 * setting it to 0. 497 */ 498 ahcf->reset_sctlr |= 0x00800000; 499 500 /* Make sure we don't advertise AArch32 support for EL0/EL1 */ 501 if ((host_isar.id_aa64pfr0 & 0xff) != 0x11) { 502 return false; 503 } 504 505 return r == HV_SUCCESS; 506 } 507 508 void hvf_arm_set_cpu_features_from_host(ARMCPU *cpu) 509 { 510 if (!arm_host_cpu_features.dtb_compatible) { 511 if (!hvf_enabled() || 512 !hvf_arm_get_host_cpu_features(&arm_host_cpu_features)) { 513 /* 514 * We can't report this error yet, so flag that we need to 515 * in arm_cpu_realizefn(). 516 */ 517 cpu->host_cpu_probe_failed = true; 518 return; 519 } 520 } 521 522 cpu->dtb_compatible = arm_host_cpu_features.dtb_compatible; 523 cpu->isar = arm_host_cpu_features.isar; 524 cpu->env.features = arm_host_cpu_features.features; 525 cpu->midr = arm_host_cpu_features.midr; 526 cpu->reset_sctlr = arm_host_cpu_features.reset_sctlr; 527 } 528 529 void hvf_arch_vcpu_destroy(CPUState *cpu) 530 { 531 } 532 533 int hvf_arch_init_vcpu(CPUState *cpu) 534 { 535 ARMCPU *arm_cpu = ARM_CPU(cpu); 536 CPUARMState *env = &arm_cpu->env; 537 uint32_t sregs_match_len = ARRAY_SIZE(hvf_sreg_match); 538 uint32_t sregs_cnt = 0; 539 uint64_t pfr; 540 hv_return_t ret; 541 int i; 542 543 env->aarch64 = 1; 544 asm volatile("mrs %0, cntfrq_el0" : "=r"(arm_cpu->gt_cntfrq_hz)); 545 546 /* Allocate enough space for our sysreg sync */ 547 arm_cpu->cpreg_indexes = g_renew(uint64_t, arm_cpu->cpreg_indexes, 548 sregs_match_len); 549 arm_cpu->cpreg_values = g_renew(uint64_t, arm_cpu->cpreg_values, 550 sregs_match_len); 551 arm_cpu->cpreg_vmstate_indexes = g_renew(uint64_t, 552 arm_cpu->cpreg_vmstate_indexes, 553 sregs_match_len); 554 arm_cpu->cpreg_vmstate_values = g_renew(uint64_t, 555 arm_cpu->cpreg_vmstate_values, 556 sregs_match_len); 557 558 memset(arm_cpu->cpreg_values, 0, sregs_match_len * sizeof(uint64_t)); 559 560 /* Populate cp list for all known sysregs */ 561 for (i = 0; i < sregs_match_len; i++) { 562 const ARMCPRegInfo *ri; 563 uint32_t key = hvf_sreg_match[i].key; 564 565 ri = get_arm_cp_reginfo(arm_cpu->cp_regs, key); 566 if (ri) { 567 assert(!(ri->type & ARM_CP_NO_RAW)); 568 hvf_sreg_match[i].cp_idx = sregs_cnt; 569 arm_cpu->cpreg_indexes[sregs_cnt++] = cpreg_to_kvm_id(key); 570 } else { 571 hvf_sreg_match[i].cp_idx = -1; 572 } 573 } 574 arm_cpu->cpreg_array_len = sregs_cnt; 575 arm_cpu->cpreg_vmstate_array_len = sregs_cnt; 576 577 assert(write_cpustate_to_list(arm_cpu, false)); 578 579 /* Set CP_NO_RAW system registers on init */ 580 ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_MIDR_EL1, 581 arm_cpu->midr); 582 assert_hvf_ok(ret); 583 584 ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_MPIDR_EL1, 585 arm_cpu->mp_affinity); 586 assert_hvf_ok(ret); 587 588 ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64PFR0_EL1, &pfr); 589 assert_hvf_ok(ret); 590 pfr |= env->gicv3state ? (1 << 24) : 0; 591 ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64PFR0_EL1, pfr); 592 assert_hvf_ok(ret); 593 594 /* We're limited to underlying hardware caps, override internal versions */ 595 ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64MMFR0_EL1, 596 &arm_cpu->isar.id_aa64mmfr0); 597 assert_hvf_ok(ret); 598 599 return 0; 600 } 601 602 void hvf_kick_vcpu_thread(CPUState *cpu) 603 { 604 cpus_kick_thread(cpu); 605 hv_vcpus_exit(&cpu->hvf->fd, 1); 606 } 607 608 static void hvf_raise_exception(CPUState *cpu, uint32_t excp, 609 uint32_t syndrome) 610 { 611 ARMCPU *arm_cpu = ARM_CPU(cpu); 612 CPUARMState *env = &arm_cpu->env; 613 614 cpu->exception_index = excp; 615 env->exception.target_el = 1; 616 env->exception.syndrome = syndrome; 617 618 arm_cpu_do_interrupt(cpu); 619 } 620 621 static void hvf_psci_cpu_off(ARMCPU *arm_cpu) 622 { 623 int32_t ret = arm_set_cpu_off(arm_cpu->mp_affinity); 624 assert(ret == QEMU_ARM_POWERCTL_RET_SUCCESS); 625 } 626 627 /* 628 * Handle a PSCI call. 629 * 630 * Returns 0 on success 631 * -1 when the PSCI call is unknown, 632 */ 633 static bool hvf_handle_psci_call(CPUState *cpu) 634 { 635 ARMCPU *arm_cpu = ARM_CPU(cpu); 636 CPUARMState *env = &arm_cpu->env; 637 uint64_t param[4] = { 638 env->xregs[0], 639 env->xregs[1], 640 env->xregs[2], 641 env->xregs[3] 642 }; 643 uint64_t context_id, mpidr; 644 bool target_aarch64 = true; 645 CPUState *target_cpu_state; 646 ARMCPU *target_cpu; 647 target_ulong entry; 648 int target_el = 1; 649 int32_t ret = 0; 650 651 trace_hvf_psci_call(param[0], param[1], param[2], param[3], 652 arm_cpu->mp_affinity); 653 654 switch (param[0]) { 655 case QEMU_PSCI_0_2_FN_PSCI_VERSION: 656 ret = QEMU_PSCI_0_2_RET_VERSION_0_2; 657 break; 658 case QEMU_PSCI_0_2_FN_MIGRATE_INFO_TYPE: 659 ret = QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED; /* No trusted OS */ 660 break; 661 case QEMU_PSCI_0_2_FN_AFFINITY_INFO: 662 case QEMU_PSCI_0_2_FN64_AFFINITY_INFO: 663 mpidr = param[1]; 664 665 switch (param[2]) { 666 case 0: 667 target_cpu_state = arm_get_cpu_by_id(mpidr); 668 if (!target_cpu_state) { 669 ret = QEMU_PSCI_RET_INVALID_PARAMS; 670 break; 671 } 672 target_cpu = ARM_CPU(target_cpu_state); 673 674 ret = target_cpu->power_state; 675 break; 676 default: 677 /* Everything above affinity level 0 is always on. */ 678 ret = 0; 679 } 680 break; 681 case QEMU_PSCI_0_2_FN_SYSTEM_RESET: 682 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); 683 /* 684 * QEMU reset and shutdown are async requests, but PSCI 685 * mandates that we never return from the reset/shutdown 686 * call, so power the CPU off now so it doesn't execute 687 * anything further. 688 */ 689 hvf_psci_cpu_off(arm_cpu); 690 break; 691 case QEMU_PSCI_0_2_FN_SYSTEM_OFF: 692 qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN); 693 hvf_psci_cpu_off(arm_cpu); 694 break; 695 case QEMU_PSCI_0_1_FN_CPU_ON: 696 case QEMU_PSCI_0_2_FN_CPU_ON: 697 case QEMU_PSCI_0_2_FN64_CPU_ON: 698 mpidr = param[1]; 699 entry = param[2]; 700 context_id = param[3]; 701 ret = arm_set_cpu_on(mpidr, entry, context_id, 702 target_el, target_aarch64); 703 break; 704 case QEMU_PSCI_0_1_FN_CPU_OFF: 705 case QEMU_PSCI_0_2_FN_CPU_OFF: 706 hvf_psci_cpu_off(arm_cpu); 707 break; 708 case QEMU_PSCI_0_1_FN_CPU_SUSPEND: 709 case QEMU_PSCI_0_2_FN_CPU_SUSPEND: 710 case QEMU_PSCI_0_2_FN64_CPU_SUSPEND: 711 /* Affinity levels are not supported in QEMU */ 712 if (param[1] & 0xfffe0000) { 713 ret = QEMU_PSCI_RET_INVALID_PARAMS; 714 break; 715 } 716 /* Powerdown is not supported, we always go into WFI */ 717 env->xregs[0] = 0; 718 hvf_wfi(cpu); 719 break; 720 case QEMU_PSCI_0_1_FN_MIGRATE: 721 case QEMU_PSCI_0_2_FN_MIGRATE: 722 ret = QEMU_PSCI_RET_NOT_SUPPORTED; 723 break; 724 default: 725 return false; 726 } 727 728 env->xregs[0] = ret; 729 return true; 730 } 731 732 static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint32_t rt) 733 { 734 ARMCPU *arm_cpu = ARM_CPU(cpu); 735 CPUARMState *env = &arm_cpu->env; 736 uint64_t val = 0; 737 738 switch (reg) { 739 case SYSREG_CNTPCT_EL0: 740 val = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / 741 gt_cntfrq_period_ns(arm_cpu); 742 break; 743 case SYSREG_PMCR_EL0: 744 val = env->cp15.c9_pmcr; 745 break; 746 case SYSREG_PMCCNTR_EL0: 747 pmu_op_start(env); 748 val = env->cp15.c15_ccnt; 749 pmu_op_finish(env); 750 break; 751 case SYSREG_PMCNTENCLR_EL0: 752 val = env->cp15.c9_pmcnten; 753 break; 754 case SYSREG_PMOVSCLR_EL0: 755 val = env->cp15.c9_pmovsr; 756 break; 757 case SYSREG_PMSELR_EL0: 758 val = env->cp15.c9_pmselr; 759 break; 760 case SYSREG_PMINTENCLR_EL1: 761 val = env->cp15.c9_pminten; 762 break; 763 case SYSREG_PMCCFILTR_EL0: 764 val = env->cp15.pmccfiltr_el0; 765 break; 766 case SYSREG_PMCNTENSET_EL0: 767 val = env->cp15.c9_pmcnten; 768 break; 769 case SYSREG_PMUSERENR_EL0: 770 val = env->cp15.c9_pmuserenr; 771 break; 772 case SYSREG_PMCEID0_EL0: 773 case SYSREG_PMCEID1_EL0: 774 /* We can't really count anything yet, declare all events invalid */ 775 val = 0; 776 break; 777 case SYSREG_OSLSR_EL1: 778 val = env->cp15.oslsr_el1; 779 break; 780 case SYSREG_OSDLR_EL1: 781 /* Dummy register */ 782 break; 783 default: 784 cpu_synchronize_state(cpu); 785 trace_hvf_unhandled_sysreg_read(env->pc, reg, 786 (reg >> 20) & 0x3, 787 (reg >> 14) & 0x7, 788 (reg >> 10) & 0xf, 789 (reg >> 1) & 0xf, 790 (reg >> 17) & 0x7); 791 hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized()); 792 return 1; 793 } 794 795 trace_hvf_sysreg_read(reg, 796 (reg >> 20) & 0x3, 797 (reg >> 14) & 0x7, 798 (reg >> 10) & 0xf, 799 (reg >> 1) & 0xf, 800 (reg >> 17) & 0x7, 801 val); 802 hvf_set_reg(cpu, rt, val); 803 804 return 0; 805 } 806 807 static void pmu_update_irq(CPUARMState *env) 808 { 809 ARMCPU *cpu = env_archcpu(env); 810 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) && 811 (env->cp15.c9_pminten & env->cp15.c9_pmovsr)); 812 } 813 814 static bool pmu_event_supported(uint16_t number) 815 { 816 return false; 817 } 818 819 /* Returns true if the counter (pass 31 for PMCCNTR) should count events using 820 * the current EL, security state, and register configuration. 821 */ 822 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter) 823 { 824 uint64_t filter; 825 bool enabled, filtered = true; 826 int el = arm_current_el(env); 827 828 enabled = (env->cp15.c9_pmcr & PMCRE) && 829 (env->cp15.c9_pmcnten & (1 << counter)); 830 831 if (counter == 31) { 832 filter = env->cp15.pmccfiltr_el0; 833 } else { 834 filter = env->cp15.c14_pmevtyper[counter]; 835 } 836 837 if (el == 0) { 838 filtered = filter & PMXEVTYPER_U; 839 } else if (el == 1) { 840 filtered = filter & PMXEVTYPER_P; 841 } 842 843 if (counter != 31) { 844 /* 845 * If not checking PMCCNTR, ensure the counter is setup to an event we 846 * support 847 */ 848 uint16_t event = filter & PMXEVTYPER_EVTCOUNT; 849 if (!pmu_event_supported(event)) { 850 return false; 851 } 852 } 853 854 return enabled && !filtered; 855 } 856 857 static void pmswinc_write(CPUARMState *env, uint64_t value) 858 { 859 unsigned int i; 860 for (i = 0; i < pmu_num_counters(env); i++) { 861 /* Increment a counter's count iff: */ 862 if ((value & (1 << i)) && /* counter's bit is set */ 863 /* counter is enabled and not filtered */ 864 pmu_counter_enabled(env, i) && 865 /* counter is SW_INCR */ 866 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) { 867 /* 868 * Detect if this write causes an overflow since we can't predict 869 * PMSWINC overflows like we can for other events 870 */ 871 uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1; 872 873 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) { 874 env->cp15.c9_pmovsr |= (1 << i); 875 pmu_update_irq(env); 876 } 877 878 env->cp15.c14_pmevcntr[i] = new_pmswinc; 879 } 880 } 881 } 882 883 static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val) 884 { 885 ARMCPU *arm_cpu = ARM_CPU(cpu); 886 CPUARMState *env = &arm_cpu->env; 887 888 trace_hvf_sysreg_write(reg, 889 (reg >> 20) & 0x3, 890 (reg >> 14) & 0x7, 891 (reg >> 10) & 0xf, 892 (reg >> 1) & 0xf, 893 (reg >> 17) & 0x7, 894 val); 895 896 switch (reg) { 897 case SYSREG_PMCCNTR_EL0: 898 pmu_op_start(env); 899 env->cp15.c15_ccnt = val; 900 pmu_op_finish(env); 901 break; 902 case SYSREG_PMCR_EL0: 903 pmu_op_start(env); 904 905 if (val & PMCRC) { 906 /* The counter has been reset */ 907 env->cp15.c15_ccnt = 0; 908 } 909 910 if (val & PMCRP) { 911 unsigned int i; 912 for (i = 0; i < pmu_num_counters(env); i++) { 913 env->cp15.c14_pmevcntr[i] = 0; 914 } 915 } 916 917 env->cp15.c9_pmcr &= ~PMCR_WRITEABLE_MASK; 918 env->cp15.c9_pmcr |= (val & PMCR_WRITEABLE_MASK); 919 920 pmu_op_finish(env); 921 break; 922 case SYSREG_PMUSERENR_EL0: 923 env->cp15.c9_pmuserenr = val & 0xf; 924 break; 925 case SYSREG_PMCNTENSET_EL0: 926 env->cp15.c9_pmcnten |= (val & pmu_counter_mask(env)); 927 break; 928 case SYSREG_PMCNTENCLR_EL0: 929 env->cp15.c9_pmcnten &= ~(val & pmu_counter_mask(env)); 930 break; 931 case SYSREG_PMINTENCLR_EL1: 932 pmu_op_start(env); 933 env->cp15.c9_pminten |= val; 934 pmu_op_finish(env); 935 break; 936 case SYSREG_PMOVSCLR_EL0: 937 pmu_op_start(env); 938 env->cp15.c9_pmovsr &= ~val; 939 pmu_op_finish(env); 940 break; 941 case SYSREG_PMSWINC_EL0: 942 pmu_op_start(env); 943 pmswinc_write(env, val); 944 pmu_op_finish(env); 945 break; 946 case SYSREG_PMSELR_EL0: 947 env->cp15.c9_pmselr = val & 0x1f; 948 break; 949 case SYSREG_PMCCFILTR_EL0: 950 pmu_op_start(env); 951 env->cp15.pmccfiltr_el0 = val & PMCCFILTR_EL0; 952 pmu_op_finish(env); 953 break; 954 case SYSREG_OSLAR_EL1: 955 env->cp15.oslsr_el1 = val & 1; 956 break; 957 case SYSREG_OSDLR_EL1: 958 /* Dummy register */ 959 break; 960 default: 961 cpu_synchronize_state(cpu); 962 trace_hvf_unhandled_sysreg_write(env->pc, reg, 963 (reg >> 20) & 0x3, 964 (reg >> 14) & 0x7, 965 (reg >> 10) & 0xf, 966 (reg >> 1) & 0xf, 967 (reg >> 17) & 0x7); 968 hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized()); 969 return 1; 970 } 971 972 return 0; 973 } 974 975 static int hvf_inject_interrupts(CPUState *cpu) 976 { 977 if (cpu->interrupt_request & CPU_INTERRUPT_FIQ) { 978 trace_hvf_inject_fiq(); 979 hv_vcpu_set_pending_interrupt(cpu->hvf->fd, HV_INTERRUPT_TYPE_FIQ, 980 true); 981 } 982 983 if (cpu->interrupt_request & CPU_INTERRUPT_HARD) { 984 trace_hvf_inject_irq(); 985 hv_vcpu_set_pending_interrupt(cpu->hvf->fd, HV_INTERRUPT_TYPE_IRQ, 986 true); 987 } 988 989 return 0; 990 } 991 992 static uint64_t hvf_vtimer_val_raw(void) 993 { 994 /* 995 * mach_absolute_time() returns the vtimer value without the VM 996 * offset that we define. Add our own offset on top. 997 */ 998 return mach_absolute_time() - hvf_state->vtimer_offset; 999 } 1000 1001 static uint64_t hvf_vtimer_val(void) 1002 { 1003 if (!runstate_is_running()) { 1004 /* VM is paused, the vtimer value is in vtimer.vtimer_val */ 1005 return vtimer.vtimer_val; 1006 } 1007 1008 return hvf_vtimer_val_raw(); 1009 } 1010 1011 static void hvf_wait_for_ipi(CPUState *cpu, struct timespec *ts) 1012 { 1013 /* 1014 * Use pselect to sleep so that other threads can IPI us while we're 1015 * sleeping. 1016 */ 1017 qatomic_mb_set(&cpu->thread_kicked, false); 1018 qemu_mutex_unlock_iothread(); 1019 pselect(0, 0, 0, 0, ts, &cpu->hvf->unblock_ipi_mask); 1020 qemu_mutex_lock_iothread(); 1021 } 1022 1023 static void hvf_wfi(CPUState *cpu) 1024 { 1025 ARMCPU *arm_cpu = ARM_CPU(cpu); 1026 struct timespec ts; 1027 hv_return_t r; 1028 uint64_t ctl; 1029 uint64_t cval; 1030 int64_t ticks_to_sleep; 1031 uint64_t seconds; 1032 uint64_t nanos; 1033 uint32_t cntfrq; 1034 1035 if (cpu->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIQ)) { 1036 /* Interrupt pending, no need to wait */ 1037 return; 1038 } 1039 1040 r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CTL_EL0, &ctl); 1041 assert_hvf_ok(r); 1042 1043 if (!(ctl & 1) || (ctl & 2)) { 1044 /* Timer disabled or masked, just wait for an IPI. */ 1045 hvf_wait_for_ipi(cpu, NULL); 1046 return; 1047 } 1048 1049 r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CVAL_EL0, &cval); 1050 assert_hvf_ok(r); 1051 1052 ticks_to_sleep = cval - hvf_vtimer_val(); 1053 if (ticks_to_sleep < 0) { 1054 return; 1055 } 1056 1057 cntfrq = gt_cntfrq_period_ns(arm_cpu); 1058 seconds = muldiv64(ticks_to_sleep, cntfrq, NANOSECONDS_PER_SECOND); 1059 ticks_to_sleep -= muldiv64(seconds, NANOSECONDS_PER_SECOND, cntfrq); 1060 nanos = ticks_to_sleep * cntfrq; 1061 1062 /* 1063 * Don't sleep for less than the time a context switch would take, 1064 * so that we can satisfy fast timer requests on the same CPU. 1065 * Measurements on M1 show the sweet spot to be ~2ms. 1066 */ 1067 if (!seconds && nanos < (2 * SCALE_MS)) { 1068 return; 1069 } 1070 1071 ts = (struct timespec) { seconds, nanos }; 1072 hvf_wait_for_ipi(cpu, &ts); 1073 } 1074 1075 static void hvf_sync_vtimer(CPUState *cpu) 1076 { 1077 ARMCPU *arm_cpu = ARM_CPU(cpu); 1078 hv_return_t r; 1079 uint64_t ctl; 1080 bool irq_state; 1081 1082 if (!cpu->hvf->vtimer_masked) { 1083 /* We will get notified on vtimer changes by hvf, nothing to do */ 1084 return; 1085 } 1086 1087 r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CTL_EL0, &ctl); 1088 assert_hvf_ok(r); 1089 1090 irq_state = (ctl & (TMR_CTL_ENABLE | TMR_CTL_IMASK | TMR_CTL_ISTATUS)) == 1091 (TMR_CTL_ENABLE | TMR_CTL_ISTATUS); 1092 qemu_set_irq(arm_cpu->gt_timer_outputs[GTIMER_VIRT], irq_state); 1093 1094 if (!irq_state) { 1095 /* Timer no longer asserting, we can unmask it */ 1096 hv_vcpu_set_vtimer_mask(cpu->hvf->fd, false); 1097 cpu->hvf->vtimer_masked = false; 1098 } 1099 } 1100 1101 int hvf_vcpu_exec(CPUState *cpu) 1102 { 1103 ARMCPU *arm_cpu = ARM_CPU(cpu); 1104 CPUARMState *env = &arm_cpu->env; 1105 hv_vcpu_exit_t *hvf_exit = cpu->hvf->exit; 1106 hv_return_t r; 1107 bool advance_pc = false; 1108 1109 if (hvf_inject_interrupts(cpu)) { 1110 return EXCP_INTERRUPT; 1111 } 1112 1113 if (cpu->halted) { 1114 return EXCP_HLT; 1115 } 1116 1117 flush_cpu_state(cpu); 1118 1119 qemu_mutex_unlock_iothread(); 1120 assert_hvf_ok(hv_vcpu_run(cpu->hvf->fd)); 1121 1122 /* handle VMEXIT */ 1123 uint64_t exit_reason = hvf_exit->reason; 1124 uint64_t syndrome = hvf_exit->exception.syndrome; 1125 uint32_t ec = syn_get_ec(syndrome); 1126 1127 qemu_mutex_lock_iothread(); 1128 switch (exit_reason) { 1129 case HV_EXIT_REASON_EXCEPTION: 1130 /* This is the main one, handle below. */ 1131 break; 1132 case HV_EXIT_REASON_VTIMER_ACTIVATED: 1133 qemu_set_irq(arm_cpu->gt_timer_outputs[GTIMER_VIRT], 1); 1134 cpu->hvf->vtimer_masked = true; 1135 return 0; 1136 case HV_EXIT_REASON_CANCELED: 1137 /* we got kicked, no exit to process */ 1138 return 0; 1139 default: 1140 assert(0); 1141 } 1142 1143 hvf_sync_vtimer(cpu); 1144 1145 switch (ec) { 1146 case EC_DATAABORT: { 1147 bool isv = syndrome & ARM_EL_ISV; 1148 bool iswrite = (syndrome >> 6) & 1; 1149 bool s1ptw = (syndrome >> 7) & 1; 1150 uint32_t sas = (syndrome >> 22) & 3; 1151 uint32_t len = 1 << sas; 1152 uint32_t srt = (syndrome >> 16) & 0x1f; 1153 uint32_t cm = (syndrome >> 8) & 0x1; 1154 uint64_t val = 0; 1155 1156 trace_hvf_data_abort(env->pc, hvf_exit->exception.virtual_address, 1157 hvf_exit->exception.physical_address, isv, 1158 iswrite, s1ptw, len, srt); 1159 1160 if (cm) { 1161 /* We don't cache MMIO regions */ 1162 advance_pc = true; 1163 break; 1164 } 1165 1166 assert(isv); 1167 1168 if (iswrite) { 1169 val = hvf_get_reg(cpu, srt); 1170 address_space_write(&address_space_memory, 1171 hvf_exit->exception.physical_address, 1172 MEMTXATTRS_UNSPECIFIED, &val, len); 1173 } else { 1174 address_space_read(&address_space_memory, 1175 hvf_exit->exception.physical_address, 1176 MEMTXATTRS_UNSPECIFIED, &val, len); 1177 hvf_set_reg(cpu, srt, val); 1178 } 1179 1180 advance_pc = true; 1181 break; 1182 } 1183 case EC_SYSTEMREGISTERTRAP: { 1184 bool isread = (syndrome >> 0) & 1; 1185 uint32_t rt = (syndrome >> 5) & 0x1f; 1186 uint32_t reg = syndrome & SYSREG_MASK; 1187 uint64_t val; 1188 int ret = 0; 1189 1190 if (isread) { 1191 ret = hvf_sysreg_read(cpu, reg, rt); 1192 } else { 1193 val = hvf_get_reg(cpu, rt); 1194 ret = hvf_sysreg_write(cpu, reg, val); 1195 } 1196 1197 advance_pc = !ret; 1198 break; 1199 } 1200 case EC_WFX_TRAP: 1201 advance_pc = true; 1202 if (!(syndrome & WFX_IS_WFE)) { 1203 hvf_wfi(cpu); 1204 } 1205 break; 1206 case EC_AA64_HVC: 1207 cpu_synchronize_state(cpu); 1208 if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_HVC) { 1209 if (!hvf_handle_psci_call(cpu)) { 1210 trace_hvf_unknown_hvc(env->xregs[0]); 1211 /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */ 1212 env->xregs[0] = -1; 1213 } 1214 } else { 1215 trace_hvf_unknown_hvc(env->xregs[0]); 1216 hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized()); 1217 } 1218 break; 1219 case EC_AA64_SMC: 1220 cpu_synchronize_state(cpu); 1221 if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_SMC) { 1222 advance_pc = true; 1223 1224 if (!hvf_handle_psci_call(cpu)) { 1225 trace_hvf_unknown_smc(env->xregs[0]); 1226 /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */ 1227 env->xregs[0] = -1; 1228 } 1229 } else { 1230 trace_hvf_unknown_smc(env->xregs[0]); 1231 hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized()); 1232 } 1233 break; 1234 default: 1235 cpu_synchronize_state(cpu); 1236 trace_hvf_exit(syndrome, ec, env->pc); 1237 error_report("0x%llx: unhandled exception ec=0x%x", env->pc, ec); 1238 } 1239 1240 if (advance_pc) { 1241 uint64_t pc; 1242 1243 flush_cpu_state(cpu); 1244 1245 r = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_PC, &pc); 1246 assert_hvf_ok(r); 1247 pc += 4; 1248 r = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_PC, pc); 1249 assert_hvf_ok(r); 1250 } 1251 1252 return 0; 1253 } 1254 1255 static const VMStateDescription vmstate_hvf_vtimer = { 1256 .name = "hvf-vtimer", 1257 .version_id = 1, 1258 .minimum_version_id = 1, 1259 .fields = (VMStateField[]) { 1260 VMSTATE_UINT64(vtimer_val, HVFVTimer), 1261 VMSTATE_END_OF_LIST() 1262 }, 1263 }; 1264 1265 static void hvf_vm_state_change(void *opaque, bool running, RunState state) 1266 { 1267 HVFVTimer *s = opaque; 1268 1269 if (running) { 1270 /* Update vtimer offset on all CPUs */ 1271 hvf_state->vtimer_offset = mach_absolute_time() - s->vtimer_val; 1272 cpu_synchronize_all_states(); 1273 } else { 1274 /* Remember vtimer value on every pause */ 1275 s->vtimer_val = hvf_vtimer_val_raw(); 1276 } 1277 } 1278 1279 int hvf_arch_init(void) 1280 { 1281 hvf_state->vtimer_offset = mach_absolute_time(); 1282 vmstate_register(NULL, 0, &vmstate_hvf_vtimer, &vtimer); 1283 qemu_add_vm_change_state_handler(hvf_vm_state_change, &vtimer); 1284 return 0; 1285 } 1286