xref: /openbmc/qemu/target/arm/kvm.c (revision 30ca689900c8c47bc4ca46be00ec9a7f1a78ccda)
1 /*
2  * ARM implementation of KVM hooks
3  *
4  * Copyright Christoffer Dall 2009-2010
5  * Copyright Mian-M. Hamayun 2013, Virtual Open Systems
6  * Copyright Alex Bennée 2014, Linaro
7  *
8  * This work is licensed under the terms of the GNU GPL, version 2 or later.
9  * See the COPYING file in the top-level directory.
10  *
11  */
12 
13 #include "qemu/osdep.h"
14 #include <sys/ioctl.h>
15 
16 #include <linux/kvm.h>
17 
18 #include "qemu/timer.h"
19 #include "qemu/error-report.h"
20 #include "qemu/main-loop.h"
21 #include "qom/object.h"
22 #include "qapi/error.h"
23 #include "system/system.h"
24 #include "system/runstate.h"
25 #include "system/kvm.h"
26 #include "system/kvm_int.h"
27 #include "kvm_arm.h"
28 #include "cpu.h"
29 #include "cpu-sysregs.h"
30 #include "trace.h"
31 #include "internals.h"
32 #include "hw/pci/pci.h"
33 #include "exec/memattrs.h"
34 #include "system/address-spaces.h"
35 #include "gdbstub/enums.h"
36 #include "hw/boards.h"
37 #include "hw/irq.h"
38 #include "qapi/visitor.h"
39 #include "qemu/log.h"
40 #include "hw/acpi/acpi.h"
41 #include "hw/acpi/ghes.h"
42 #include "target/arm/gtimer.h"
43 #include "migration/blocker.h"
44 
45 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
46     KVM_CAP_INFO(DEVICE_CTRL),
47     KVM_CAP_LAST_INFO
48 };
49 
50 static bool cap_has_mp_state;
51 static bool cap_has_inject_serror_esr;
52 static bool cap_has_inject_ext_dabt;
53 
54 /**
55  * ARMHostCPUFeatures: information about the host CPU (identified
56  * by asking the host kernel)
57  */
58 typedef struct ARMHostCPUFeatures {
59     ARMISARegisters isar;
60     uint64_t features;
61     uint32_t target;
62     const char *dtb_compatible;
63 } ARMHostCPUFeatures;
64 
65 static ARMHostCPUFeatures arm_host_cpu_features;
66 
67 /**
68  * kvm_arm_vcpu_init:
69  * @cpu: ARMCPU
70  *
71  * Initialize (or reinitialize) the VCPU by invoking the
72  * KVM_ARM_VCPU_INIT ioctl with the CPU type and feature
73  * bitmask specified in the CPUState.
74  *
75  * Returns: 0 if success else < 0 error code
76  */
77 static int kvm_arm_vcpu_init(ARMCPU *cpu)
78 {
79     struct kvm_vcpu_init init;
80 
81     init.target = cpu->kvm_target;
82     memcpy(init.features, cpu->kvm_init_features, sizeof(init.features));
83 
84     return kvm_vcpu_ioctl(CPU(cpu), KVM_ARM_VCPU_INIT, &init);
85 }
86 
87 /**
88  * kvm_arm_vcpu_finalize:
89  * @cpu: ARMCPU
90  * @feature: feature to finalize
91  *
92  * Finalizes the configuration of the specified VCPU feature by
93  * invoking the KVM_ARM_VCPU_FINALIZE ioctl. Features requiring
94  * this are documented in the "KVM_ARM_VCPU_FINALIZE" section of
95  * KVM's API documentation.
96  *
97  * Returns: 0 if success else < 0 error code
98  */
99 static int kvm_arm_vcpu_finalize(ARMCPU *cpu, int feature)
100 {
101     return kvm_vcpu_ioctl(CPU(cpu), KVM_ARM_VCPU_FINALIZE, &feature);
102 }
103 
104 bool kvm_arm_create_scratch_host_vcpu(int *fdarray,
105                                       struct kvm_vcpu_init *init)
106 {
107     int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
108     int max_vm_pa_size;
109 
110     kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
111     if (kvmfd < 0) {
112         goto err;
113     }
114     max_vm_pa_size = ioctl(kvmfd, KVM_CHECK_EXTENSION, KVM_CAP_ARM_VM_IPA_SIZE);
115     if (max_vm_pa_size < 0) {
116         max_vm_pa_size = 0;
117     }
118     do {
119         vmfd = ioctl(kvmfd, KVM_CREATE_VM, max_vm_pa_size);
120     } while (vmfd == -1 && errno == EINTR);
121     if (vmfd < 0) {
122         goto err;
123     }
124 
125     /*
126      * The MTE capability must be enabled by the VMM before creating
127      * any VCPUs in order to allow the MTE bits of the ID_AA64PFR1
128      * register to be probed correctly, as they are masked if MTE
129      * is not enabled.
130      */
131     if (kvm_arm_mte_supported()) {
132         KVMState kvm_state;
133 
134         kvm_state.fd = kvmfd;
135         kvm_state.vmfd = vmfd;
136         kvm_vm_enable_cap(&kvm_state, KVM_CAP_ARM_MTE, 0);
137     }
138 
139     cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
140     if (cpufd < 0) {
141         goto err;
142     }
143 
144     if (!init) {
145         /* Caller doesn't want the VCPU to be initialized, so skip it */
146         goto finish;
147     }
148 
149     if (init->target == -1) {
150         struct kvm_vcpu_init preferred;
151 
152         ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, &preferred);
153         if (ret < 0) {
154             goto err;
155         }
156         init->target = preferred.target;
157     }
158     ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
159     if (ret < 0) {
160         goto err;
161     }
162 
163 finish:
164     fdarray[0] = kvmfd;
165     fdarray[1] = vmfd;
166     fdarray[2] = cpufd;
167 
168     return true;
169 
170 err:
171     if (cpufd >= 0) {
172         close(cpufd);
173     }
174     if (vmfd >= 0) {
175         close(vmfd);
176     }
177     if (kvmfd >= 0) {
178         close(kvmfd);
179     }
180 
181     return false;
182 }
183 
184 void kvm_arm_destroy_scratch_host_vcpu(int *fdarray)
185 {
186     int i;
187 
188     for (i = 2; i >= 0; i--) {
189         close(fdarray[i]);
190     }
191 }
192 
193 static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
194 {
195     uint64_t ret;
196     struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)&ret };
197     int err;
198 
199     assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
200     err = ioctl(fd, KVM_GET_ONE_REG, &idreg);
201     if (err < 0) {
202         return -1;
203     }
204     *pret = ret;
205     return 0;
206 }
207 
208 static int read_sys_reg64(int fd, uint64_t *pret, uint64_t id)
209 {
210     struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
211 
212     assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
213     return ioctl(fd, KVM_GET_ONE_REG, &idreg);
214 }
215 
216 static bool kvm_arm_pauth_supported(void)
217 {
218     return (kvm_check_extension(kvm_state, KVM_CAP_ARM_PTRAUTH_ADDRESS) &&
219             kvm_check_extension(kvm_state, KVM_CAP_ARM_PTRAUTH_GENERIC));
220 }
221 
222 
223 static uint64_t idregs_sysreg_to_kvm_reg(ARMSysRegs sysreg)
224 {
225     return ARM64_SYS_REG((sysreg & CP_REG_ARM64_SYSREG_OP0_MASK) >> CP_REG_ARM64_SYSREG_OP0_SHIFT,
226                          (sysreg & CP_REG_ARM64_SYSREG_OP1_MASK) >> CP_REG_ARM64_SYSREG_OP1_SHIFT,
227                          (sysreg & CP_REG_ARM64_SYSREG_CRN_MASK) >> CP_REG_ARM64_SYSREG_CRN_SHIFT,
228                          (sysreg & CP_REG_ARM64_SYSREG_CRM_MASK) >> CP_REG_ARM64_SYSREG_CRM_SHIFT,
229                          (sysreg & CP_REG_ARM64_SYSREG_OP2_MASK) >> CP_REG_ARM64_SYSREG_OP2_SHIFT);
230 }
231 
232 /* read a sysreg value and store it in the idregs */
233 static int get_host_cpu_reg(int fd, ARMHostCPUFeatures *ahcf, ARMIDRegisterIdx index)
234 {
235     uint64_t *reg;
236     int ret;
237 
238     reg = &ahcf->isar.idregs[index];
239     ret = read_sys_reg64(fd, reg,
240                          idregs_sysreg_to_kvm_reg(id_register_sysreg[index]));
241     return ret;
242 }
243 
244 static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
245 {
246     /* Identify the feature bits corresponding to the host CPU, and
247      * fill out the ARMHostCPUClass fields accordingly. To do this
248      * we have to create a scratch VM, create a single CPU inside it,
249      * and then query that CPU for the relevant ID registers.
250      */
251     int fdarray[3];
252     bool sve_supported;
253     bool pmu_supported = false;
254     uint64_t features = 0;
255     int err;
256 
257     /*
258      * target = -1 informs kvm_arm_create_scratch_host_vcpu()
259      * to use the preferred target
260      */
261     struct kvm_vcpu_init init = { .target = -1, };
262 
263     /*
264      * Ask for SVE if supported, so that we can query ID_AA64ZFR0,
265      * which is otherwise RAZ.
266      */
267     sve_supported = kvm_arm_sve_supported();
268     if (sve_supported) {
269         init.features[0] |= 1 << KVM_ARM_VCPU_SVE;
270     }
271 
272     /*
273      * Ask for Pointer Authentication if supported, so that we get
274      * the unsanitized field values for AA64ISAR1_EL1.
275      */
276     if (kvm_arm_pauth_supported()) {
277         init.features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS |
278                              1 << KVM_ARM_VCPU_PTRAUTH_GENERIC);
279     }
280 
281     if (kvm_arm_pmu_supported()) {
282         init.features[0] |= 1 << KVM_ARM_VCPU_PMU_V3;
283         pmu_supported = true;
284         features |= 1ULL << ARM_FEATURE_PMU;
285     }
286 
287     if (!kvm_arm_create_scratch_host_vcpu(fdarray, &init)) {
288         return false;
289     }
290 
291     ahcf->target = init.target;
292     ahcf->dtb_compatible = "arm,arm-v8";
293     int fd = fdarray[2];
294 
295     err = get_host_cpu_reg(fd, ahcf, ID_AA64PFR0_EL1_IDX);
296     if (unlikely(err < 0)) {
297         /*
298          * Before v4.15, the kernel only exposed a limited number of system
299          * registers, not including any of the interesting AArch64 ID regs.
300          * For the most part we could leave these fields as zero with minimal
301          * effect, since this does not affect the values seen by the guest.
302          *
303          * However, it could cause problems down the line for QEMU,
304          * so provide a minimal v8.0 default.
305          *
306          * ??? Could read MIDR and use knowledge from cpu64.c.
307          * ??? Could map a page of memory into our temp guest and
308          *     run the tiniest of hand-crafted kernels to extract
309          *     the values seen by the guest.
310          * ??? Either of these sounds like too much effort just
311          *     to work around running a modern host kernel.
312          */
313         SET_IDREG(&ahcf->isar, ID_AA64PFR0, 0x00000011); /* EL1&0, AArch64 only */
314         err = 0;
315     } else {
316         err |= get_host_cpu_reg(fd, ahcf, ID_AA64PFR1_EL1_IDX);
317         err |= get_host_cpu_reg(fd, ahcf, ID_AA64SMFR0_EL1_IDX);
318         err |= get_host_cpu_reg(fd, ahcf, ID_AA64DFR0_EL1_IDX);
319         err |= get_host_cpu_reg(fd, ahcf, ID_AA64DFR1_EL1_IDX);
320         err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR0_EL1_IDX);
321         err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR1_EL1_IDX);
322         err |= get_host_cpu_reg(fd, ahcf, ID_AA64ISAR2_EL1_IDX);
323         err |= get_host_cpu_reg(fd, ahcf, ID_AA64MMFR0_EL1_IDX);
324         err |= get_host_cpu_reg(fd, ahcf, ID_AA64MMFR1_EL1_IDX);
325         err |= get_host_cpu_reg(fd, ahcf, ID_AA64MMFR2_EL1_IDX);
326         err |= get_host_cpu_reg(fd, ahcf, ID_AA64MMFR3_EL1_IDX);
327 
328         /*
329          * Note that if AArch32 support is not present in the host,
330          * the AArch32 sysregs are present to be read, but will
331          * return UNKNOWN values.  This is neither better nor worse
332          * than skipping the reads and leaving 0, as we must avoid
333          * considering the values in every case.
334          */
335         err |= get_host_cpu_reg(fd, ahcf, ID_PFR0_EL1_IDX);
336         err |= get_host_cpu_reg(fd, ahcf, ID_PFR1_EL1_IDX);
337         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
338                               ARM64_SYS_REG(3, 0, 0, 1, 2));
339         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
340                               ARM64_SYS_REG(3, 0, 0, 1, 4));
341         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr1,
342                               ARM64_SYS_REG(3, 0, 0, 1, 5));
343         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr2,
344                               ARM64_SYS_REG(3, 0, 0, 1, 6));
345         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr3,
346                               ARM64_SYS_REG(3, 0, 0, 1, 7));
347         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR0_EL1_IDX);
348         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR1_EL1_IDX);
349         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR2_EL1_IDX);
350         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR3_EL1_IDX);
351         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR4_EL1_IDX);
352         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR5_EL1_IDX);
353         err |= get_host_cpu_reg(fd, ahcf, ID_ISAR6_EL1_IDX);
354         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr4,
355                               ARM64_SYS_REG(3, 0, 0, 2, 6));
356 
357         err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
358                               ARM64_SYS_REG(3, 0, 0, 3, 0));
359         err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
360                               ARM64_SYS_REG(3, 0, 0, 3, 1));
361         err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr2,
362                               ARM64_SYS_REG(3, 0, 0, 3, 2));
363         err |= get_host_cpu_reg(fd, ahcf, ID_PFR2_EL1_IDX);
364         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr1,
365                               ARM64_SYS_REG(3, 0, 0, 3, 5));
366         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr5,
367                               ARM64_SYS_REG(3, 0, 0, 3, 6));
368 
369         /*
370          * DBGDIDR is a bit complicated because the kernel doesn't
371          * provide an accessor for it in 64-bit mode, which is what this
372          * scratch VM is in, and there's no architected "64-bit sysreg
373          * which reads the same as the 32-bit register" the way there is
374          * for other ID registers. Instead we synthesize a value from the
375          * AArch64 ID_AA64DFR0, the same way the kernel code in
376          * arch/arm64/kvm/sys_regs.c:trap_dbgidr() does.
377          * We only do this if the CPU supports AArch32 at EL1.
378          */
379         if (FIELD_EX32_IDREG(&ahcf->isar, ID_AA64PFR0, EL1) >= 2) {
380             int wrps = FIELD_EX64_IDREG(&ahcf->isar, ID_AA64DFR0, WRPS);
381             int brps = FIELD_EX64_IDREG(&ahcf->isar, ID_AA64DFR0, BRPS);
382             int ctx_cmps =
383                 FIELD_EX64_IDREG(&ahcf->isar, ID_AA64DFR0, CTX_CMPS);
384             int version = 6; /* ARMv8 debug architecture */
385             bool has_el3 =
386                 !!FIELD_EX32_IDREG(&ahcf->isar, ID_AA64PFR0, EL3);
387             uint32_t dbgdidr = 0;
388 
389             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, WRPS, wrps);
390             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, BRPS, brps);
391             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, CTX_CMPS, ctx_cmps);
392             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, VERSION, version);
393             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, NSUHD_IMP, has_el3);
394             dbgdidr = FIELD_DP32(dbgdidr, DBGDIDR, SE_IMP, has_el3);
395             dbgdidr |= (1 << 15); /* RES1 bit */
396             ahcf->isar.dbgdidr = dbgdidr;
397         }
398 
399         if (pmu_supported) {
400             /* PMCR_EL0 is only accessible if the vCPU has feature PMU_V3 */
401             err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
402                                   ARM64_SYS_REG(3, 3, 9, 12, 0));
403         }
404 
405         if (sve_supported) {
406             /*
407              * There is a range of kernels between kernel commit 73433762fcae
408              * and f81cb2c3ad41 which have a bug where the kernel doesn't
409              * expose SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has
410              * enabled SVE support, which resulted in an error rather than RAZ.
411              * So only read the register if we set KVM_ARM_VCPU_SVE above.
412              */
413             err |= get_host_cpu_reg(fd, ahcf, ID_AA64ZFR0_EL1_IDX);
414         }
415     }
416 
417     kvm_arm_destroy_scratch_host_vcpu(fdarray);
418 
419     if (err < 0) {
420         return false;
421     }
422 
423     /*
424      * We can assume any KVM supporting CPU is at least a v8
425      * with VFPv4+Neon; this in turn implies most of the other
426      * feature bits.
427      */
428     features |= 1ULL << ARM_FEATURE_V8;
429     features |= 1ULL << ARM_FEATURE_NEON;
430     features |= 1ULL << ARM_FEATURE_AARCH64;
431     features |= 1ULL << ARM_FEATURE_GENERIC_TIMER;
432 
433     ahcf->features = features;
434 
435     return true;
436 }
437 
438 void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
439 {
440     CPUARMState *env = &cpu->env;
441 
442     if (!arm_host_cpu_features.dtb_compatible) {
443         if (!kvm_enabled() ||
444             !kvm_arm_get_host_cpu_features(&arm_host_cpu_features)) {
445             /* We can't report this error yet, so flag that we need to
446              * in arm_cpu_realizefn().
447              */
448             cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
449             cpu->host_cpu_probe_failed = true;
450             return;
451         }
452     }
453 
454     cpu->kvm_target = arm_host_cpu_features.target;
455     cpu->dtb_compatible = arm_host_cpu_features.dtb_compatible;
456     cpu->isar = arm_host_cpu_features.isar;
457     env->features = arm_host_cpu_features.features;
458 }
459 
460 static bool kvm_no_adjvtime_get(Object *obj, Error **errp)
461 {
462     return !ARM_CPU(obj)->kvm_adjvtime;
463 }
464 
465 static void kvm_no_adjvtime_set(Object *obj, bool value, Error **errp)
466 {
467     ARM_CPU(obj)->kvm_adjvtime = !value;
468 }
469 
470 static bool kvm_steal_time_get(Object *obj, Error **errp)
471 {
472     return ARM_CPU(obj)->kvm_steal_time != ON_OFF_AUTO_OFF;
473 }
474 
475 static void kvm_steal_time_set(Object *obj, bool value, Error **errp)
476 {
477     ARM_CPU(obj)->kvm_steal_time = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
478 }
479 
480 /* KVM VCPU properties should be prefixed with "kvm-". */
481 void kvm_arm_add_vcpu_properties(ARMCPU *cpu)
482 {
483     CPUARMState *env = &cpu->env;
484     Object *obj = OBJECT(cpu);
485 
486     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
487         cpu->kvm_adjvtime = true;
488         object_property_add_bool(obj, "kvm-no-adjvtime", kvm_no_adjvtime_get,
489                                  kvm_no_adjvtime_set);
490         object_property_set_description(obj, "kvm-no-adjvtime",
491                                         "Set on to disable the adjustment of "
492                                         "the virtual counter. VM stopped time "
493                                         "will be counted.");
494     }
495 
496     cpu->kvm_steal_time = ON_OFF_AUTO_AUTO;
497     object_property_add_bool(obj, "kvm-steal-time", kvm_steal_time_get,
498                              kvm_steal_time_set);
499     object_property_set_description(obj, "kvm-steal-time",
500                                     "Set off to disable KVM steal time.");
501 }
502 
503 bool kvm_arm_pmu_supported(void)
504 {
505     return kvm_check_extension(kvm_state, KVM_CAP_ARM_PMU_V3);
506 }
507 
508 int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa)
509 {
510     KVMState *s = KVM_STATE(ms->accelerator);
511     int ret;
512 
513     ret = kvm_check_extension(s, KVM_CAP_ARM_VM_IPA_SIZE);
514     *fixed_ipa = ret <= 0;
515 
516     return ret > 0 ? ret : 40;
517 }
518 
519 int kvm_arch_get_default_type(MachineState *ms)
520 {
521     bool fixed_ipa;
522     int size = kvm_arm_get_max_vm_ipa_size(ms, &fixed_ipa);
523     return fixed_ipa ? 0 : size;
524 }
525 
526 int kvm_arch_init(MachineState *ms, KVMState *s)
527 {
528     int ret = 0;
529     /* For ARM interrupt delivery is always asynchronous,
530      * whether we are using an in-kernel VGIC or not.
531      */
532     kvm_async_interrupts_allowed = true;
533 
534     /*
535      * PSCI wakes up secondary cores, so we always need to
536      * have vCPUs waiting in kernel space
537      */
538     kvm_halt_in_kernel_allowed = true;
539 
540     cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
541 
542     /* Check whether user space can specify guest syndrome value */
543     cap_has_inject_serror_esr =
544         kvm_check_extension(s, KVM_CAP_ARM_INJECT_SERROR_ESR);
545 
546     if (ms->smp.cpus > 256 &&
547         !kvm_check_extension(s, KVM_CAP_ARM_IRQ_LINE_LAYOUT_2)) {
548         error_report("Using more than 256 vcpus requires a host kernel "
549                      "with KVM_CAP_ARM_IRQ_LINE_LAYOUT_2");
550         ret = -EINVAL;
551     }
552 
553     if (kvm_check_extension(s, KVM_CAP_ARM_NISV_TO_USER)) {
554         if (kvm_vm_enable_cap(s, KVM_CAP_ARM_NISV_TO_USER, 0)) {
555             error_report("Failed to enable KVM_CAP_ARM_NISV_TO_USER cap");
556         } else {
557             /* Set status for supporting the external dabt injection */
558             cap_has_inject_ext_dabt = kvm_check_extension(s,
559                                     KVM_CAP_ARM_INJECT_EXT_DABT);
560         }
561     }
562 
563     if (s->kvm_eager_split_size) {
564         uint32_t sizes;
565 
566         sizes = kvm_vm_check_extension(s, KVM_CAP_ARM_SUPPORTED_BLOCK_SIZES);
567         if (!sizes) {
568             s->kvm_eager_split_size = 0;
569             warn_report("Eager Page Split support not available");
570         } else if (!(s->kvm_eager_split_size & sizes)) {
571             error_report("Eager Page Split requested chunk size not valid");
572             ret = -EINVAL;
573         } else {
574             ret = kvm_vm_enable_cap(s, KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE, 0,
575                                     s->kvm_eager_split_size);
576             if (ret < 0) {
577                 error_report("Enabling of Eager Page Split failed: %s",
578                              strerror(-ret));
579             }
580         }
581     }
582 
583     max_hw_wps = kvm_check_extension(s, KVM_CAP_GUEST_DEBUG_HW_WPS);
584     hw_watchpoints = g_array_sized_new(true, true,
585                                        sizeof(HWWatchpoint), max_hw_wps);
586 
587     max_hw_bps = kvm_check_extension(s, KVM_CAP_GUEST_DEBUG_HW_BPS);
588     hw_breakpoints = g_array_sized_new(true, true,
589                                        sizeof(HWBreakpoint), max_hw_bps);
590 
591     return ret;
592 }
593 
594 unsigned long kvm_arch_vcpu_id(CPUState *cpu)
595 {
596     return cpu->cpu_index;
597 }
598 
599 /* We track all the KVM devices which need their memory addresses
600  * passing to the kernel in a list of these structures.
601  * When board init is complete we run through the list and
602  * tell the kernel the base addresses of the memory regions.
603  * We use a MemoryListener to track mapping and unmapping of
604  * the regions during board creation, so the board models don't
605  * need to do anything special for the KVM case.
606  *
607  * Sometimes the address must be OR'ed with some other fields
608  * (for example for KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION).
609  * @kda_addr_ormask aims at storing the value of those fields.
610  */
611 typedef struct KVMDevice {
612     struct kvm_arm_device_addr kda;
613     struct kvm_device_attr kdattr;
614     uint64_t kda_addr_ormask;
615     MemoryRegion *mr;
616     QSLIST_ENTRY(KVMDevice) entries;
617     int dev_fd;
618 } KVMDevice;
619 
620 static QSLIST_HEAD(, KVMDevice) kvm_devices_head;
621 
622 static void kvm_arm_devlistener_add(MemoryListener *listener,
623                                     MemoryRegionSection *section)
624 {
625     KVMDevice *kd;
626 
627     QSLIST_FOREACH(kd, &kvm_devices_head, entries) {
628         if (section->mr == kd->mr) {
629             kd->kda.addr = section->offset_within_address_space;
630         }
631     }
632 }
633 
634 static void kvm_arm_devlistener_del(MemoryListener *listener,
635                                     MemoryRegionSection *section)
636 {
637     KVMDevice *kd;
638 
639     QSLIST_FOREACH(kd, &kvm_devices_head, entries) {
640         if (section->mr == kd->mr) {
641             kd->kda.addr = -1;
642         }
643     }
644 }
645 
646 static MemoryListener devlistener = {
647     .name = "kvm-arm",
648     .region_add = kvm_arm_devlistener_add,
649     .region_del = kvm_arm_devlistener_del,
650     .priority = MEMORY_LISTENER_PRIORITY_MIN,
651 };
652 
653 static void kvm_arm_set_device_addr(KVMDevice *kd)
654 {
655     struct kvm_device_attr *attr = &kd->kdattr;
656     int ret;
657     uint64_t addr = kd->kda.addr;
658 
659     addr |= kd->kda_addr_ormask;
660     attr->addr = (uintptr_t)&addr;
661     ret = kvm_device_ioctl(kd->dev_fd, KVM_SET_DEVICE_ATTR, attr);
662 
663     if (ret < 0) {
664         fprintf(stderr, "Failed to set device address: %s\n",
665                 strerror(-ret));
666         abort();
667     }
668 }
669 
670 static void kvm_arm_machine_init_done(Notifier *notifier, void *data)
671 {
672     KVMDevice *kd, *tkd;
673 
674     QSLIST_FOREACH_SAFE(kd, &kvm_devices_head, entries, tkd) {
675         if (kd->kda.addr != -1) {
676             kvm_arm_set_device_addr(kd);
677         }
678         memory_region_unref(kd->mr);
679         QSLIST_REMOVE_HEAD(&kvm_devices_head, entries);
680         g_free(kd);
681     }
682     memory_listener_unregister(&devlistener);
683 }
684 
685 static Notifier notify = {
686     .notify = kvm_arm_machine_init_done,
687 };
688 
689 void kvm_arm_register_device(MemoryRegion *mr, uint64_t devid, uint64_t group,
690                              uint64_t attr, int dev_fd, uint64_t addr_ormask)
691 {
692     KVMDevice *kd;
693 
694     if (!kvm_irqchip_in_kernel()) {
695         return;
696     }
697 
698     if (QSLIST_EMPTY(&kvm_devices_head)) {
699         memory_listener_register(&devlistener, &address_space_memory);
700         qemu_add_machine_init_done_notifier(&notify);
701     }
702     kd = g_new0(KVMDevice, 1);
703     kd->mr = mr;
704     kd->kda.id = devid;
705     kd->kda.addr = -1;
706     kd->kdattr.flags = 0;
707     kd->kdattr.group = group;
708     kd->kdattr.attr = attr;
709     kd->dev_fd = dev_fd;
710     kd->kda_addr_ormask = addr_ormask;
711     QSLIST_INSERT_HEAD(&kvm_devices_head, kd, entries);
712     memory_region_ref(kd->mr);
713 }
714 
715 static int compare_u64(const void *a, const void *b)
716 {
717     if (*(uint64_t *)a > *(uint64_t *)b) {
718         return 1;
719     }
720     if (*(uint64_t *)a < *(uint64_t *)b) {
721         return -1;
722     }
723     return 0;
724 }
725 
726 /*
727  * cpreg_values are sorted in ascending order by KVM register ID
728  * (see kvm_arm_init_cpreg_list). This allows us to cheaply find
729  * the storage for a KVM register by ID with a binary search.
730  */
731 static uint64_t *kvm_arm_get_cpreg_ptr(ARMCPU *cpu, uint64_t regidx)
732 {
733     uint64_t *res;
734 
735     res = bsearch(&regidx, cpu->cpreg_indexes, cpu->cpreg_array_len,
736                   sizeof(uint64_t), compare_u64);
737     assert(res);
738 
739     return &cpu->cpreg_values[res - cpu->cpreg_indexes];
740 }
741 
742 /**
743  * kvm_arm_reg_syncs_via_cpreg_list:
744  * @regidx: KVM register index
745  *
746  * Return true if this KVM register should be synchronized via the
747  * cpreg list of arbitrary system registers, false if it is synchronized
748  * by hand using code in kvm_arch_get/put_registers().
749  */
750 static bool kvm_arm_reg_syncs_via_cpreg_list(uint64_t regidx)
751 {
752     switch (regidx & KVM_REG_ARM_COPROC_MASK) {
753     case KVM_REG_ARM_CORE:
754     case KVM_REG_ARM64_SVE:
755         return false;
756     default:
757         return true;
758     }
759 }
760 
761 /**
762  * kvm_arm_init_cpreg_list:
763  * @cpu: ARMCPU
764  *
765  * Initialize the ARMCPU cpreg list according to the kernel's
766  * definition of what CPU registers it knows about (and throw away
767  * the previous TCG-created cpreg list).
768  *
769  * Returns: 0 if success, else < 0 error code
770  */
771 static int kvm_arm_init_cpreg_list(ARMCPU *cpu)
772 {
773     struct kvm_reg_list rl;
774     struct kvm_reg_list *rlp;
775     int i, ret, arraylen;
776     CPUState *cs = CPU(cpu);
777 
778     rl.n = 0;
779     ret = kvm_vcpu_ioctl(cs, KVM_GET_REG_LIST, &rl);
780     if (ret != -E2BIG) {
781         return ret;
782     }
783     rlp = g_malloc(sizeof(struct kvm_reg_list) + rl.n * sizeof(uint64_t));
784     rlp->n = rl.n;
785     ret = kvm_vcpu_ioctl(cs, KVM_GET_REG_LIST, rlp);
786     if (ret) {
787         goto out;
788     }
789     /* Sort the list we get back from the kernel, since cpreg_tuples
790      * must be in strictly ascending order.
791      */
792     qsort(&rlp->reg, rlp->n, sizeof(rlp->reg[0]), compare_u64);
793 
794     for (i = 0, arraylen = 0; i < rlp->n; i++) {
795         if (!kvm_arm_reg_syncs_via_cpreg_list(rlp->reg[i])) {
796             continue;
797         }
798         switch (rlp->reg[i] & KVM_REG_SIZE_MASK) {
799         case KVM_REG_SIZE_U32:
800         case KVM_REG_SIZE_U64:
801             break;
802         default:
803             fprintf(stderr, "Can't handle size of register in kernel list\n");
804             ret = -EINVAL;
805             goto out;
806         }
807 
808         arraylen++;
809     }
810 
811     cpu->cpreg_indexes = g_renew(uint64_t, cpu->cpreg_indexes, arraylen);
812     cpu->cpreg_values = g_renew(uint64_t, cpu->cpreg_values, arraylen);
813     cpu->cpreg_vmstate_indexes = g_renew(uint64_t, cpu->cpreg_vmstate_indexes,
814                                          arraylen);
815     cpu->cpreg_vmstate_values = g_renew(uint64_t, cpu->cpreg_vmstate_values,
816                                         arraylen);
817     cpu->cpreg_array_len = arraylen;
818     cpu->cpreg_vmstate_array_len = arraylen;
819 
820     for (i = 0, arraylen = 0; i < rlp->n; i++) {
821         uint64_t regidx = rlp->reg[i];
822         if (!kvm_arm_reg_syncs_via_cpreg_list(regidx)) {
823             continue;
824         }
825         cpu->cpreg_indexes[arraylen] = regidx;
826         arraylen++;
827     }
828     assert(cpu->cpreg_array_len == arraylen);
829 
830     if (!write_kvmstate_to_list(cpu)) {
831         /* Shouldn't happen unless kernel is inconsistent about
832          * what registers exist.
833          */
834         fprintf(stderr, "Initial read of kernel register state failed\n");
835         ret = -EINVAL;
836         goto out;
837     }
838 
839 out:
840     g_free(rlp);
841     return ret;
842 }
843 
844 /**
845  * kvm_arm_cpreg_level:
846  * @regidx: KVM register index
847  *
848  * Return the level of this coprocessor/system register.  Return value is
849  * either KVM_PUT_RUNTIME_STATE, KVM_PUT_RESET_STATE, or KVM_PUT_FULL_STATE.
850  */
851 static int kvm_arm_cpreg_level(uint64_t regidx)
852 {
853     /*
854      * All system registers are assumed to be level KVM_PUT_RUNTIME_STATE.
855      * If a register should be written less often, you must add it here
856      * with a state of either KVM_PUT_RESET_STATE or KVM_PUT_FULL_STATE.
857      */
858     switch (regidx) {
859     case KVM_REG_ARM_TIMER_CNT:
860     case KVM_REG_ARM_PTIMER_CNT:
861         return KVM_PUT_FULL_STATE;
862     }
863     return KVM_PUT_RUNTIME_STATE;
864 }
865 
866 bool write_kvmstate_to_list(ARMCPU *cpu)
867 {
868     CPUState *cs = CPU(cpu);
869     int i;
870     bool ok = true;
871 
872     for (i = 0; i < cpu->cpreg_array_len; i++) {
873         uint64_t regidx = cpu->cpreg_indexes[i];
874         uint32_t v32;
875         int ret;
876 
877         switch (regidx & KVM_REG_SIZE_MASK) {
878         case KVM_REG_SIZE_U32:
879             ret = kvm_get_one_reg(cs, regidx, &v32);
880             if (!ret) {
881                 cpu->cpreg_values[i] = v32;
882             }
883             break;
884         case KVM_REG_SIZE_U64:
885             ret = kvm_get_one_reg(cs, regidx, cpu->cpreg_values + i);
886             break;
887         default:
888             g_assert_not_reached();
889         }
890         if (ret) {
891             ok = false;
892         }
893     }
894     return ok;
895 }
896 
897 bool write_list_to_kvmstate(ARMCPU *cpu, int level)
898 {
899     CPUState *cs = CPU(cpu);
900     int i;
901     bool ok = true;
902 
903     for (i = 0; i < cpu->cpreg_array_len; i++) {
904         uint64_t regidx = cpu->cpreg_indexes[i];
905         uint32_t v32;
906         int ret;
907 
908         if (kvm_arm_cpreg_level(regidx) > level) {
909             continue;
910         }
911 
912         switch (regidx & KVM_REG_SIZE_MASK) {
913         case KVM_REG_SIZE_U32:
914             v32 = cpu->cpreg_values[i];
915             ret = kvm_set_one_reg(cs, regidx, &v32);
916             break;
917         case KVM_REG_SIZE_U64:
918             ret = kvm_set_one_reg(cs, regidx, cpu->cpreg_values + i);
919             break;
920         default:
921             g_assert_not_reached();
922         }
923         if (ret) {
924             /* We might fail for "unknown register" and also for
925              * "you tried to set a register which is constant with
926              * a different value from what it actually contains".
927              */
928             ok = false;
929         }
930     }
931     return ok;
932 }
933 
934 void kvm_arm_cpu_pre_save(ARMCPU *cpu)
935 {
936     /* KVM virtual time adjustment */
937     if (cpu->kvm_vtime_dirty) {
938         *kvm_arm_get_cpreg_ptr(cpu, KVM_REG_ARM_TIMER_CNT) = cpu->kvm_vtime;
939     }
940 }
941 
942 bool kvm_arm_cpu_post_load(ARMCPU *cpu)
943 {
944     if (!write_list_to_kvmstate(cpu, KVM_PUT_FULL_STATE)) {
945         return false;
946     }
947     /* Note that it's OK for the TCG side not to know about
948      * every register in the list; KVM is authoritative if
949      * we're using it.
950      */
951     write_list_to_cpustate(cpu);
952 
953     /* KVM virtual time adjustment */
954     if (cpu->kvm_adjvtime) {
955         cpu->kvm_vtime = *kvm_arm_get_cpreg_ptr(cpu, KVM_REG_ARM_TIMER_CNT);
956         cpu->kvm_vtime_dirty = true;
957     }
958 
959     return true;
960 }
961 
962 void kvm_arm_reset_vcpu(ARMCPU *cpu)
963 {
964     int ret;
965 
966     /* Re-init VCPU so that all registers are set to
967      * their respective reset values.
968      */
969     ret = kvm_arm_vcpu_init(cpu);
970     if (ret < 0) {
971         fprintf(stderr, "kvm_arm_vcpu_init failed: %s\n", strerror(-ret));
972         abort();
973     }
974     if (!write_kvmstate_to_list(cpu)) {
975         fprintf(stderr, "write_kvmstate_to_list failed\n");
976         abort();
977     }
978     /*
979      * Sync the reset values also into the CPUState. This is necessary
980      * because the next thing we do will be a kvm_arch_put_registers()
981      * which will update the list values from the CPUState before copying
982      * the list values back to KVM. It's OK to ignore failure returns here
983      * for the same reason we do so in kvm_arch_get_registers().
984      */
985     write_list_to_cpustate(cpu);
986 }
987 
988 /*
989  * Update KVM's MP_STATE based on what QEMU thinks it is
990  */
991 static int kvm_arm_sync_mpstate_to_kvm(ARMCPU *cpu)
992 {
993     if (cap_has_mp_state) {
994         struct kvm_mp_state mp_state = {
995             .mp_state = (cpu->power_state == PSCI_OFF) ?
996             KVM_MP_STATE_STOPPED : KVM_MP_STATE_RUNNABLE
997         };
998         return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MP_STATE, &mp_state);
999     }
1000     return 0;
1001 }
1002 
1003 /*
1004  * Sync the KVM MP_STATE into QEMU
1005  */
1006 static int kvm_arm_sync_mpstate_to_qemu(ARMCPU *cpu)
1007 {
1008     if (cap_has_mp_state) {
1009         struct kvm_mp_state mp_state;
1010         int ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MP_STATE, &mp_state);
1011         if (ret) {
1012             return ret;
1013         }
1014         cpu->power_state = (mp_state.mp_state == KVM_MP_STATE_STOPPED) ?
1015             PSCI_OFF : PSCI_ON;
1016     }
1017     return 0;
1018 }
1019 
1020 /**
1021  * kvm_arm_get_virtual_time:
1022  * @cpu: ARMCPU
1023  *
1024  * Gets the VCPU's virtual counter and stores it in the KVM CPU state.
1025  */
1026 static void kvm_arm_get_virtual_time(ARMCPU *cpu)
1027 {
1028     int ret;
1029 
1030     if (cpu->kvm_vtime_dirty) {
1031         return;
1032     }
1033 
1034     ret = kvm_get_one_reg(CPU(cpu), KVM_REG_ARM_TIMER_CNT, &cpu->kvm_vtime);
1035     if (ret) {
1036         error_report("Failed to get KVM_REG_ARM_TIMER_CNT");
1037         abort();
1038     }
1039 
1040     cpu->kvm_vtime_dirty = true;
1041 }
1042 
1043 /**
1044  * kvm_arm_put_virtual_time:
1045  * @cpu: ARMCPU
1046  *
1047  * Sets the VCPU's virtual counter to the value stored in the KVM CPU state.
1048  */
1049 static void kvm_arm_put_virtual_time(ARMCPU *cpu)
1050 {
1051     int ret;
1052 
1053     if (!cpu->kvm_vtime_dirty) {
1054         return;
1055     }
1056 
1057     ret = kvm_set_one_reg(CPU(cpu), KVM_REG_ARM_TIMER_CNT, &cpu->kvm_vtime);
1058     if (ret) {
1059         error_report("Failed to set KVM_REG_ARM_TIMER_CNT");
1060         abort();
1061     }
1062 
1063     cpu->kvm_vtime_dirty = false;
1064 }
1065 
1066 /**
1067  * kvm_put_vcpu_events:
1068  * @cpu: ARMCPU
1069  *
1070  * Put VCPU related state to kvm.
1071  *
1072  * Returns: 0 if success else < 0 error code
1073  */
1074 static int kvm_put_vcpu_events(ARMCPU *cpu)
1075 {
1076     CPUARMState *env = &cpu->env;
1077     struct kvm_vcpu_events events;
1078     int ret;
1079 
1080     if (!kvm_has_vcpu_events()) {
1081         return 0;
1082     }
1083 
1084     memset(&events, 0, sizeof(events));
1085     events.exception.serror_pending = env->serror.pending;
1086 
1087     /* Inject SError to guest with specified syndrome if host kernel
1088      * supports it, otherwise inject SError without syndrome.
1089      */
1090     if (cap_has_inject_serror_esr) {
1091         events.exception.serror_has_esr = env->serror.has_esr;
1092         events.exception.serror_esr = env->serror.esr;
1093     }
1094 
1095     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_VCPU_EVENTS, &events);
1096     if (ret) {
1097         error_report("failed to put vcpu events");
1098     }
1099 
1100     return ret;
1101 }
1102 
1103 /**
1104  * kvm_get_vcpu_events:
1105  * @cpu: ARMCPU
1106  *
1107  * Get VCPU related state from kvm.
1108  *
1109  * Returns: 0 if success else < 0 error code
1110  */
1111 static int kvm_get_vcpu_events(ARMCPU *cpu)
1112 {
1113     CPUARMState *env = &cpu->env;
1114     struct kvm_vcpu_events events;
1115     int ret;
1116 
1117     if (!kvm_has_vcpu_events()) {
1118         return 0;
1119     }
1120 
1121     memset(&events, 0, sizeof(events));
1122     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_VCPU_EVENTS, &events);
1123     if (ret) {
1124         error_report("failed to get vcpu events");
1125         return ret;
1126     }
1127 
1128     env->serror.pending = events.exception.serror_pending;
1129     env->serror.has_esr = events.exception.serror_has_esr;
1130     env->serror.esr = events.exception.serror_esr;
1131 
1132     return 0;
1133 }
1134 
1135 #define ARM64_REG_ESR_EL1 ARM64_SYS_REG(3, 0, 5, 2, 0)
1136 #define ARM64_REG_TCR_EL1 ARM64_SYS_REG(3, 0, 2, 0, 2)
1137 
1138 /*
1139  * ESR_EL1
1140  * ISS encoding
1141  * AARCH64: DFSC,   bits [5:0]
1142  * AARCH32:
1143  *      TTBCR.EAE == 0
1144  *          FS[4]   - DFSR[10]
1145  *          FS[3:0] - DFSR[3:0]
1146  *      TTBCR.EAE == 1
1147  *          FS, bits [5:0]
1148  */
1149 #define ESR_DFSC(aarch64, lpae, v)        \
1150     ((aarch64 || (lpae)) ? ((v) & 0x3F)   \
1151                : (((v) >> 6) | ((v) & 0x1F)))
1152 
1153 #define ESR_DFSC_EXTABT(aarch64, lpae) \
1154     ((aarch64) ? 0x10 : (lpae) ? 0x10 : 0x8)
1155 
1156 /**
1157  * kvm_arm_verify_ext_dabt_pending:
1158  * @cpu: ARMCPU
1159  *
1160  * Verify the fault status code wrt the Ext DABT injection
1161  *
1162  * Returns: true if the fault status code is as expected, false otherwise
1163  */
1164 static bool kvm_arm_verify_ext_dabt_pending(ARMCPU *cpu)
1165 {
1166     CPUState *cs = CPU(cpu);
1167     uint64_t dfsr_val;
1168 
1169     if (!kvm_get_one_reg(cs, ARM64_REG_ESR_EL1, &dfsr_val)) {
1170         CPUARMState *env = &cpu->env;
1171         int aarch64_mode = arm_feature(env, ARM_FEATURE_AARCH64);
1172         int lpae = 0;
1173 
1174         if (!aarch64_mode) {
1175             uint64_t ttbcr;
1176 
1177             if (!kvm_get_one_reg(cs, ARM64_REG_TCR_EL1, &ttbcr)) {
1178                 lpae = arm_feature(env, ARM_FEATURE_LPAE)
1179                         && (ttbcr & TTBCR_EAE);
1180             }
1181         }
1182         /*
1183          * The verification here is based on the DFSC bits
1184          * of the ESR_EL1 reg only
1185          */
1186          return (ESR_DFSC(aarch64_mode, lpae, dfsr_val) ==
1187                 ESR_DFSC_EXTABT(aarch64_mode, lpae));
1188     }
1189     return false;
1190 }
1191 
1192 void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
1193 {
1194     ARMCPU *cpu = ARM_CPU(cs);
1195     CPUARMState *env = &cpu->env;
1196 
1197     if (unlikely(env->ext_dabt_raised)) {
1198         /*
1199          * Verifying that the ext DABT has been properly injected,
1200          * otherwise risking indefinitely re-running the faulting instruction
1201          * Covering a very narrow case for kernels 5.5..5.5.4
1202          * when injected abort was misconfigured to be
1203          * an IMPLEMENTATION DEFINED exception (for 32-bit EL1)
1204          */
1205         if (!arm_feature(env, ARM_FEATURE_AARCH64) &&
1206             unlikely(!kvm_arm_verify_ext_dabt_pending(cpu))) {
1207 
1208             error_report("Data abort exception with no valid ISS generated by "
1209                    "guest memory access. KVM unable to emulate faulting "
1210                    "instruction. Failed to inject an external data abort "
1211                    "into the guest.");
1212             abort();
1213        }
1214        /* Clear the status */
1215        env->ext_dabt_raised = 0;
1216     }
1217 }
1218 
1219 MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
1220 {
1221     ARMCPU *cpu;
1222     uint32_t switched_level;
1223 
1224     if (kvm_irqchip_in_kernel()) {
1225         /*
1226          * We only need to sync timer states with user-space interrupt
1227          * controllers, so return early and save cycles if we don't.
1228          */
1229         return MEMTXATTRS_UNSPECIFIED;
1230     }
1231 
1232     cpu = ARM_CPU(cs);
1233 
1234     /* Synchronize our shadowed in-kernel device irq lines with the kvm ones */
1235     if (run->s.regs.device_irq_level != cpu->device_irq_level) {
1236         switched_level = cpu->device_irq_level ^ run->s.regs.device_irq_level;
1237 
1238         bql_lock();
1239 
1240         if (switched_level & KVM_ARM_DEV_EL1_VTIMER) {
1241             qemu_set_irq(cpu->gt_timer_outputs[GTIMER_VIRT],
1242                          !!(run->s.regs.device_irq_level &
1243                             KVM_ARM_DEV_EL1_VTIMER));
1244             switched_level &= ~KVM_ARM_DEV_EL1_VTIMER;
1245         }
1246 
1247         if (switched_level & KVM_ARM_DEV_EL1_PTIMER) {
1248             qemu_set_irq(cpu->gt_timer_outputs[GTIMER_PHYS],
1249                          !!(run->s.regs.device_irq_level &
1250                             KVM_ARM_DEV_EL1_PTIMER));
1251             switched_level &= ~KVM_ARM_DEV_EL1_PTIMER;
1252         }
1253 
1254         if (switched_level & KVM_ARM_DEV_PMU) {
1255             qemu_set_irq(cpu->pmu_interrupt,
1256                          !!(run->s.regs.device_irq_level & KVM_ARM_DEV_PMU));
1257             switched_level &= ~KVM_ARM_DEV_PMU;
1258         }
1259 
1260         if (switched_level) {
1261             qemu_log_mask(LOG_UNIMP, "%s: unhandled in-kernel device IRQ %x\n",
1262                           __func__, switched_level);
1263         }
1264 
1265         /* We also mark unknown levels as processed to not waste cycles */
1266         cpu->device_irq_level = run->s.regs.device_irq_level;
1267         bql_unlock();
1268     }
1269 
1270     return MEMTXATTRS_UNSPECIFIED;
1271 }
1272 
1273 static void kvm_arm_vm_state_change(void *opaque, bool running, RunState state)
1274 {
1275     ARMCPU *cpu = opaque;
1276 
1277     if (running) {
1278         if (cpu->kvm_adjvtime) {
1279             kvm_arm_put_virtual_time(cpu);
1280         }
1281     } else {
1282         if (cpu->kvm_adjvtime) {
1283             kvm_arm_get_virtual_time(cpu);
1284         }
1285     }
1286 }
1287 
1288 /**
1289  * kvm_arm_handle_dabt_nisv:
1290  * @cpu: ARMCPU
1291  * @esr_iss: ISS encoding (limited) for the exception from Data Abort
1292  *           ISV bit set to '0b0' -> no valid instruction syndrome
1293  * @fault_ipa: faulting address for the synchronous data abort
1294  *
1295  * Returns: 0 if the exception has been handled, < 0 otherwise
1296  */
1297 static int kvm_arm_handle_dabt_nisv(ARMCPU *cpu, uint64_t esr_iss,
1298                                     uint64_t fault_ipa)
1299 {
1300     CPUARMState *env = &cpu->env;
1301     /*
1302      * Request KVM to inject the external data abort into the guest
1303      */
1304     if (cap_has_inject_ext_dabt) {
1305         struct kvm_vcpu_events events = { };
1306         /*
1307          * The external data abort event will be handled immediately by KVM
1308          * using the address fault that triggered the exit on given VCPU.
1309          * Requesting injection of the external data abort does not rely
1310          * on any other VCPU state. Therefore, in this particular case, the VCPU
1311          * synchronization can be exceptionally skipped.
1312          */
1313         events.exception.ext_dabt_pending = 1;
1314         /* KVM_CAP_ARM_INJECT_EXT_DABT implies KVM_CAP_VCPU_EVENTS */
1315         if (!kvm_vcpu_ioctl(CPU(cpu), KVM_SET_VCPU_EVENTS, &events)) {
1316             env->ext_dabt_raised = 1;
1317             return 0;
1318         }
1319     } else {
1320         error_report("Data abort exception triggered by guest memory access "
1321                      "at physical address: 0x"  TARGET_FMT_lx,
1322                      (target_ulong)fault_ipa);
1323         error_printf("KVM unable to emulate faulting instruction.\n");
1324     }
1325     return -1;
1326 }
1327 
1328 /**
1329  * kvm_arm_handle_debug:
1330  * @cpu: ARMCPU
1331  * @debug_exit: debug part of the KVM exit structure
1332  *
1333  * Returns: TRUE if the debug exception was handled.
1334  *
1335  * See v8 ARM ARM D7.2.27 ESR_ELx, Exception Syndrome Register
1336  *
1337  * To minimise translating between kernel and user-space the kernel
1338  * ABI just provides user-space with the full exception syndrome
1339  * register value to be decoded in QEMU.
1340  */
1341 static bool kvm_arm_handle_debug(ARMCPU *cpu,
1342                                  struct kvm_debug_exit_arch *debug_exit)
1343 {
1344     int hsr_ec = syn_get_ec(debug_exit->hsr);
1345     CPUState *cs = CPU(cpu);
1346     CPUARMState *env = &cpu->env;
1347 
1348     /* Ensure PC is synchronised */
1349     kvm_cpu_synchronize_state(cs);
1350 
1351     switch (hsr_ec) {
1352     case EC_SOFTWARESTEP:
1353         if (cs->singlestep_enabled) {
1354             return true;
1355         } else {
1356             /*
1357              * The kernel should have suppressed the guest's ability to
1358              * single step at this point so something has gone wrong.
1359              */
1360             error_report("%s: guest single-step while debugging unsupported"
1361                          " (%"PRIx64", %"PRIx32")",
1362                          __func__, env->pc, debug_exit->hsr);
1363             return false;
1364         }
1365         break;
1366     case EC_AA64_BKPT:
1367         if (kvm_find_sw_breakpoint(cs, env->pc)) {
1368             return true;
1369         }
1370         break;
1371     case EC_BREAKPOINT:
1372         if (find_hw_breakpoint(cs, env->pc)) {
1373             return true;
1374         }
1375         break;
1376     case EC_WATCHPOINT:
1377     {
1378         CPUWatchpoint *wp = find_hw_watchpoint(cs, debug_exit->far);
1379         if (wp) {
1380             cs->watchpoint_hit = wp;
1381             return true;
1382         }
1383         break;
1384     }
1385     default:
1386         error_report("%s: unhandled debug exit (%"PRIx32", %"PRIx64")",
1387                      __func__, debug_exit->hsr, env->pc);
1388     }
1389 
1390     /* If we are not handling the debug exception it must belong to
1391      * the guest. Let's re-use the existing TCG interrupt code to set
1392      * everything up properly.
1393      */
1394     cs->exception_index = EXCP_BKPT;
1395     env->exception.syndrome = debug_exit->hsr;
1396     env->exception.vaddress = debug_exit->far;
1397     env->exception.target_el = 1;
1398     bql_lock();
1399     arm_cpu_do_interrupt(cs);
1400     bql_unlock();
1401 
1402     return false;
1403 }
1404 
1405 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
1406 {
1407     ARMCPU *cpu = ARM_CPU(cs);
1408     int ret = 0;
1409 
1410     switch (run->exit_reason) {
1411     case KVM_EXIT_DEBUG:
1412         if (kvm_arm_handle_debug(cpu, &run->debug.arch)) {
1413             ret = EXCP_DEBUG;
1414         } /* otherwise return to guest */
1415         break;
1416     case KVM_EXIT_ARM_NISV:
1417         /* External DABT with no valid iss to decode */
1418         ret = kvm_arm_handle_dabt_nisv(cpu, run->arm_nisv.esr_iss,
1419                                        run->arm_nisv.fault_ipa);
1420         break;
1421     default:
1422         qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",
1423                       __func__, run->exit_reason);
1424         break;
1425     }
1426     return ret;
1427 }
1428 
1429 bool kvm_arch_stop_on_emulation_error(CPUState *cs)
1430 {
1431     return true;
1432 }
1433 
1434 int kvm_arch_process_async_events(CPUState *cs)
1435 {
1436     return 0;
1437 }
1438 
1439 /**
1440  * kvm_arm_hw_debug_active:
1441  * @cpu: ARMCPU
1442  *
1443  * Return: TRUE if any hardware breakpoints in use.
1444  */
1445 static bool kvm_arm_hw_debug_active(ARMCPU *cpu)
1446 {
1447     return ((cur_hw_wps > 0) || (cur_hw_bps > 0));
1448 }
1449 
1450 /**
1451  * kvm_arm_copy_hw_debug_data:
1452  * @ptr: kvm_guest_debug_arch structure
1453  *
1454  * Copy the architecture specific debug registers into the
1455  * kvm_guest_debug ioctl structure.
1456  */
1457 static void kvm_arm_copy_hw_debug_data(struct kvm_guest_debug_arch *ptr)
1458 {
1459     int i;
1460     memset(ptr, 0, sizeof(struct kvm_guest_debug_arch));
1461 
1462     for (i = 0; i < max_hw_wps; i++) {
1463         HWWatchpoint *wp = get_hw_wp(i);
1464         ptr->dbg_wcr[i] = wp->wcr;
1465         ptr->dbg_wvr[i] = wp->wvr;
1466     }
1467     for (i = 0; i < max_hw_bps; i++) {
1468         HWBreakpoint *bp = get_hw_bp(i);
1469         ptr->dbg_bcr[i] = bp->bcr;
1470         ptr->dbg_bvr[i] = bp->bvr;
1471     }
1472 }
1473 
1474 void kvm_arch_update_guest_debug(CPUState *cs, struct kvm_guest_debug *dbg)
1475 {
1476     if (kvm_sw_breakpoints_active(cs)) {
1477         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP;
1478     }
1479     if (kvm_arm_hw_debug_active(ARM_CPU(cs))) {
1480         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_HW;
1481         kvm_arm_copy_hw_debug_data(&dbg->arch);
1482     }
1483 }
1484 
1485 void kvm_arch_init_irq_routing(KVMState *s)
1486 {
1487 }
1488 
1489 int kvm_arch_irqchip_create(KVMState *s)
1490 {
1491     if (kvm_kernel_irqchip_split()) {
1492         error_report("-machine kernel_irqchip=split is not supported on ARM.");
1493         exit(1);
1494     }
1495 
1496     /* If we can create the VGIC using the newer device control API, we
1497      * let the device do this when it initializes itself, otherwise we
1498      * fall back to the old API */
1499     return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
1500 }
1501 
1502 int kvm_arm_vgic_probe(void)
1503 {
1504     int val = 0;
1505 
1506     if (kvm_create_device(kvm_state,
1507                           KVM_DEV_TYPE_ARM_VGIC_V3, true) == 0) {
1508         val |= KVM_ARM_VGIC_V3;
1509     }
1510     if (kvm_create_device(kvm_state,
1511                           KVM_DEV_TYPE_ARM_VGIC_V2, true) == 0) {
1512         val |= KVM_ARM_VGIC_V2;
1513     }
1514     return val;
1515 }
1516 
1517 int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level)
1518 {
1519     int kvm_irq = (irqtype << KVM_ARM_IRQ_TYPE_SHIFT) | irq;
1520     int cpu_idx1 = cpu % 256;
1521     int cpu_idx2 = cpu / 256;
1522 
1523     kvm_irq |= (cpu_idx1 << KVM_ARM_IRQ_VCPU_SHIFT) |
1524                (cpu_idx2 << KVM_ARM_IRQ_VCPU2_SHIFT);
1525 
1526     return kvm_set_irq(kvm_state, kvm_irq, !!level);
1527 }
1528 
1529 int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
1530                              uint64_t address, uint32_t data, PCIDevice *dev)
1531 {
1532     AddressSpace *as = pci_device_iommu_address_space(dev);
1533     hwaddr xlat, len, doorbell_gpa;
1534     MemoryRegionSection mrs;
1535     MemoryRegion *mr;
1536 
1537     if (as == &address_space_memory) {
1538         return 0;
1539     }
1540 
1541     /* MSI doorbell address is translated by an IOMMU */
1542 
1543     RCU_READ_LOCK_GUARD();
1544 
1545     mr = address_space_translate(as, address, &xlat, &len, true,
1546                                  MEMTXATTRS_UNSPECIFIED);
1547 
1548     if (!mr) {
1549         return 1;
1550     }
1551 
1552     mrs = memory_region_find(mr, xlat, 1);
1553 
1554     if (!mrs.mr) {
1555         return 1;
1556     }
1557 
1558     doorbell_gpa = mrs.offset_within_address_space;
1559     memory_region_unref(mrs.mr);
1560 
1561     route->u.msi.address_lo = doorbell_gpa;
1562     route->u.msi.address_hi = doorbell_gpa >> 32;
1563 
1564     trace_kvm_arm_fixup_msi_route(address, doorbell_gpa);
1565 
1566     return 0;
1567 }
1568 
1569 int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
1570                                 int vector, PCIDevice *dev)
1571 {
1572     return 0;
1573 }
1574 
1575 int kvm_arch_release_virq_post(int virq)
1576 {
1577     return 0;
1578 }
1579 
1580 int kvm_arch_msi_data_to_gsi(uint32_t data)
1581 {
1582     return (data - 32) & 0xffff;
1583 }
1584 
1585 static void kvm_arch_get_eager_split_size(Object *obj, Visitor *v,
1586                                           const char *name, void *opaque,
1587                                           Error **errp)
1588 {
1589     KVMState *s = KVM_STATE(obj);
1590     uint64_t value = s->kvm_eager_split_size;
1591 
1592     visit_type_size(v, name, &value, errp);
1593 }
1594 
1595 static void kvm_arch_set_eager_split_size(Object *obj, Visitor *v,
1596                                           const char *name, void *opaque,
1597                                           Error **errp)
1598 {
1599     KVMState *s = KVM_STATE(obj);
1600     uint64_t value;
1601 
1602     if (s->fd != -1) {
1603         error_setg(errp, "Unable to set early-split-size after KVM has been initialized");
1604         return;
1605     }
1606 
1607     if (!visit_type_size(v, name, &value, errp)) {
1608         return;
1609     }
1610 
1611     if (value && !is_power_of_2(value)) {
1612         error_setg(errp, "early-split-size must be a power of two");
1613         return;
1614     }
1615 
1616     s->kvm_eager_split_size = value;
1617 }
1618 
1619 void kvm_arch_accel_class_init(ObjectClass *oc)
1620 {
1621     object_class_property_add(oc, "eager-split-size", "size",
1622                               kvm_arch_get_eager_split_size,
1623                               kvm_arch_set_eager_split_size, NULL, NULL);
1624 
1625     object_class_property_set_description(oc, "eager-split-size",
1626         "Eager Page Split chunk size for hugepages. (default: 0, disabled)");
1627 }
1628 
1629 int kvm_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
1630 {
1631     switch (type) {
1632     case GDB_BREAKPOINT_HW:
1633         return insert_hw_breakpoint(addr);
1634         break;
1635     case GDB_WATCHPOINT_READ:
1636     case GDB_WATCHPOINT_WRITE:
1637     case GDB_WATCHPOINT_ACCESS:
1638         return insert_hw_watchpoint(addr, len, type);
1639     default:
1640         return -ENOSYS;
1641     }
1642 }
1643 
1644 int kvm_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
1645 {
1646     switch (type) {
1647     case GDB_BREAKPOINT_HW:
1648         return delete_hw_breakpoint(addr);
1649     case GDB_WATCHPOINT_READ:
1650     case GDB_WATCHPOINT_WRITE:
1651     case GDB_WATCHPOINT_ACCESS:
1652         return delete_hw_watchpoint(addr, len, type);
1653     default:
1654         return -ENOSYS;
1655     }
1656 }
1657 
1658 void kvm_arch_remove_all_hw_breakpoints(void)
1659 {
1660     if (cur_hw_wps > 0) {
1661         g_array_remove_range(hw_watchpoints, 0, cur_hw_wps);
1662     }
1663     if (cur_hw_bps > 0) {
1664         g_array_remove_range(hw_breakpoints, 0, cur_hw_bps);
1665     }
1666 }
1667 
1668 static bool kvm_arm_set_device_attr(ARMCPU *cpu, struct kvm_device_attr *attr,
1669                                     const char *name)
1670 {
1671     int err;
1672 
1673     err = kvm_vcpu_ioctl(CPU(cpu), KVM_HAS_DEVICE_ATTR, attr);
1674     if (err != 0) {
1675         error_report("%s: KVM_HAS_DEVICE_ATTR: %s", name, strerror(-err));
1676         return false;
1677     }
1678 
1679     err = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_DEVICE_ATTR, attr);
1680     if (err != 0) {
1681         error_report("%s: KVM_SET_DEVICE_ATTR: %s", name, strerror(-err));
1682         return false;
1683     }
1684 
1685     return true;
1686 }
1687 
1688 void kvm_arm_pmu_init(ARMCPU *cpu)
1689 {
1690     struct kvm_device_attr attr = {
1691         .group = KVM_ARM_VCPU_PMU_V3_CTRL,
1692         .attr = KVM_ARM_VCPU_PMU_V3_INIT,
1693     };
1694 
1695     if (!cpu->has_pmu) {
1696         return;
1697     }
1698     if (!kvm_arm_set_device_attr(cpu, &attr, "PMU")) {
1699         error_report("failed to init PMU");
1700         abort();
1701     }
1702 }
1703 
1704 void kvm_arm_pmu_set_irq(ARMCPU *cpu, int irq)
1705 {
1706     struct kvm_device_attr attr = {
1707         .group = KVM_ARM_VCPU_PMU_V3_CTRL,
1708         .addr = (intptr_t)&irq,
1709         .attr = KVM_ARM_VCPU_PMU_V3_IRQ,
1710     };
1711 
1712     if (!cpu->has_pmu) {
1713         return;
1714     }
1715     if (!kvm_arm_set_device_attr(cpu, &attr, "PMU")) {
1716         error_report("failed to set irq for PMU");
1717         abort();
1718     }
1719 }
1720 
1721 void kvm_arm_pvtime_init(ARMCPU *cpu, uint64_t ipa)
1722 {
1723     struct kvm_device_attr attr = {
1724         .group = KVM_ARM_VCPU_PVTIME_CTRL,
1725         .attr = KVM_ARM_VCPU_PVTIME_IPA,
1726         .addr = (uint64_t)&ipa,
1727     };
1728 
1729     if (cpu->kvm_steal_time == ON_OFF_AUTO_OFF) {
1730         return;
1731     }
1732     if (!kvm_arm_set_device_attr(cpu, &attr, "PVTIME IPA")) {
1733         error_report("failed to init PVTIME IPA");
1734         abort();
1735     }
1736 }
1737 
1738 void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
1739 {
1740     bool has_steal_time = kvm_check_extension(kvm_state, KVM_CAP_STEAL_TIME);
1741 
1742     if (cpu->kvm_steal_time == ON_OFF_AUTO_AUTO) {
1743         if (!has_steal_time || !arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
1744             cpu->kvm_steal_time = ON_OFF_AUTO_OFF;
1745         } else {
1746             cpu->kvm_steal_time = ON_OFF_AUTO_ON;
1747         }
1748     } else if (cpu->kvm_steal_time == ON_OFF_AUTO_ON) {
1749         if (!has_steal_time) {
1750             error_setg(errp, "'kvm-steal-time' cannot be enabled "
1751                              "on this host");
1752             return;
1753         } else if (!arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
1754             /*
1755              * DEN0057A chapter 2 says "This specification only covers
1756              * systems in which the Execution state of the hypervisor
1757              * as well as EL1 of virtual machines is AArch64.". And,
1758              * to ensure that, the smc/hvc calls are only specified as
1759              * smc64/hvc64.
1760              */
1761             error_setg(errp, "'kvm-steal-time' cannot be enabled "
1762                              "for AArch32 guests");
1763             return;
1764         }
1765     }
1766 }
1767 
1768 bool kvm_arm_aarch32_supported(void)
1769 {
1770     return kvm_check_extension(kvm_state, KVM_CAP_ARM_EL1_32BIT);
1771 }
1772 
1773 bool kvm_arm_sve_supported(void)
1774 {
1775     return kvm_check_extension(kvm_state, KVM_CAP_ARM_SVE);
1776 }
1777 
1778 bool kvm_arm_mte_supported(void)
1779 {
1780     return kvm_check_extension(kvm_state, KVM_CAP_ARM_MTE);
1781 }
1782 
1783 QEMU_BUILD_BUG_ON(KVM_ARM64_SVE_VQ_MIN != 1);
1784 
1785 uint32_t kvm_arm_sve_get_vls(ARMCPU *cpu)
1786 {
1787     /* Only call this function if kvm_arm_sve_supported() returns true. */
1788     static uint64_t vls[KVM_ARM64_SVE_VLS_WORDS];
1789     static bool probed;
1790     uint32_t vq = 0;
1791     int i;
1792 
1793     /*
1794      * KVM ensures all host CPUs support the same set of vector lengths.
1795      * So we only need to create the scratch VCPUs once and then cache
1796      * the results.
1797      */
1798     if (!probed) {
1799         struct kvm_vcpu_init init = {
1800             .target = -1,
1801             .features[0] = (1 << KVM_ARM_VCPU_SVE),
1802         };
1803         struct kvm_one_reg reg = {
1804             .id = KVM_REG_ARM64_SVE_VLS,
1805             .addr = (uint64_t)&vls[0],
1806         };
1807         int fdarray[3], ret;
1808 
1809         probed = true;
1810 
1811         if (!kvm_arm_create_scratch_host_vcpu(fdarray, &init)) {
1812             error_report("failed to create scratch VCPU with SVE enabled");
1813             abort();
1814         }
1815         ret = ioctl(fdarray[2], KVM_GET_ONE_REG, &reg);
1816         kvm_arm_destroy_scratch_host_vcpu(fdarray);
1817         if (ret) {
1818             error_report("failed to get KVM_REG_ARM64_SVE_VLS: %s",
1819                          strerror(errno));
1820             abort();
1821         }
1822 
1823         for (i = KVM_ARM64_SVE_VLS_WORDS - 1; i >= 0; --i) {
1824             if (vls[i]) {
1825                 vq = 64 - clz64(vls[i]) + i * 64;
1826                 break;
1827             }
1828         }
1829         if (vq > ARM_MAX_VQ) {
1830             warn_report("KVM supports vector lengths larger than "
1831                         "QEMU can enable");
1832             vls[0] &= MAKE_64BIT_MASK(0, ARM_MAX_VQ);
1833         }
1834     }
1835 
1836     return vls[0];
1837 }
1838 
1839 static int kvm_arm_sve_set_vls(ARMCPU *cpu)
1840 {
1841     uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq.map };
1842 
1843     assert(cpu->sve_max_vq <= KVM_ARM64_SVE_VQ_MAX);
1844 
1845     return kvm_set_one_reg(CPU(cpu), KVM_REG_ARM64_SVE_VLS, &vls[0]);
1846 }
1847 
1848 #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
1849 
1850 int kvm_arch_pre_create_vcpu(CPUState *cpu, Error **errp)
1851 {
1852     return 0;
1853 }
1854 
1855 int kvm_arch_init_vcpu(CPUState *cs)
1856 {
1857     int ret;
1858     uint64_t mpidr;
1859     ARMCPU *cpu = ARM_CPU(cs);
1860     CPUARMState *env = &cpu->env;
1861     uint64_t psciver;
1862 
1863     if (cpu->kvm_target == QEMU_KVM_ARM_TARGET_NONE) {
1864         error_report("KVM is not supported for this guest CPU type");
1865         return -EINVAL;
1866     }
1867 
1868     qemu_add_vm_change_state_handler(kvm_arm_vm_state_change, cpu);
1869 
1870     /* Determine init features for this CPU */
1871     memset(cpu->kvm_init_features, 0, sizeof(cpu->kvm_init_features));
1872     if (cs->start_powered_off) {
1873         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_POWER_OFF;
1874     }
1875     if (kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PSCI_0_2)) {
1876         cpu->psci_version = QEMU_PSCI_VERSION_0_2;
1877         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PSCI_0_2;
1878     }
1879     if (!arm_feature(env, ARM_FEATURE_AARCH64)) {
1880         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_EL1_32BIT;
1881     }
1882     if (cpu->has_pmu) {
1883         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PMU_V3;
1884     }
1885     if (cpu_isar_feature(aa64_sve, cpu)) {
1886         assert(kvm_arm_sve_supported());
1887         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_SVE;
1888     }
1889     if (cpu_isar_feature(aa64_pauth, cpu)) {
1890         cpu->kvm_init_features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS |
1891                                       1 << KVM_ARM_VCPU_PTRAUTH_GENERIC);
1892     }
1893 
1894     /* Do KVM_ARM_VCPU_INIT ioctl */
1895     ret = kvm_arm_vcpu_init(cpu);
1896     if (ret) {
1897         return ret;
1898     }
1899 
1900     if (cpu_isar_feature(aa64_sve, cpu)) {
1901         ret = kvm_arm_sve_set_vls(cpu);
1902         if (ret) {
1903             return ret;
1904         }
1905         ret = kvm_arm_vcpu_finalize(cpu, KVM_ARM_VCPU_SVE);
1906         if (ret) {
1907             return ret;
1908         }
1909     }
1910 
1911     /*
1912      * KVM reports the exact PSCI version it is implementing via a
1913      * special sysreg. If it is present, use its contents to determine
1914      * what to report to the guest in the dtb (it is the PSCI version,
1915      * in the same 15-bits major 16-bits minor format that PSCI_VERSION
1916      * returns).
1917      */
1918     if (!kvm_get_one_reg(cs, KVM_REG_ARM_PSCI_VERSION, &psciver)) {
1919         cpu->psci_version = psciver;
1920     }
1921 
1922     /*
1923      * When KVM is in use, PSCI is emulated in-kernel and not by qemu.
1924      * Currently KVM has its own idea about MPIDR assignment, so we
1925      * override our defaults with what we get from KVM.
1926      */
1927     ret = kvm_get_one_reg(cs, ARM64_SYS_REG(ARM_CPU_ID_MPIDR), &mpidr);
1928     if (ret) {
1929         return ret;
1930     }
1931     cpu->mp_affinity = mpidr & ARM64_AFFINITY_MASK;
1932 
1933     return kvm_arm_init_cpreg_list(cpu);
1934 }
1935 
1936 int kvm_arch_destroy_vcpu(CPUState *cs)
1937 {
1938     return 0;
1939 }
1940 
1941 /* Callers must hold the iothread mutex lock */
1942 static void kvm_inject_arm_sea(CPUState *c)
1943 {
1944     ARMCPU *cpu = ARM_CPU(c);
1945     CPUARMState *env = &cpu->env;
1946     uint32_t esr;
1947     bool same_el;
1948 
1949     c->exception_index = EXCP_DATA_ABORT;
1950     env->exception.target_el = 1;
1951 
1952     /*
1953      * Set the DFSC to synchronous external abort and set FnV to not valid,
1954      * this will tell guest the FAR_ELx is UNKNOWN for this abort.
1955      */
1956     same_el = arm_current_el(env) == env->exception.target_el;
1957     esr = syn_data_abort_no_iss(same_el, 1, 0, 0, 0, 0, 0x10);
1958 
1959     env->exception.syndrome = esr;
1960 
1961     arm_cpu_do_interrupt(c);
1962 }
1963 
1964 #define AARCH64_CORE_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
1965                  KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x))
1966 
1967 #define AARCH64_SIMD_CORE_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U128 | \
1968                  KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x))
1969 
1970 #define AARCH64_SIMD_CTRL_REG(x)   (KVM_REG_ARM64 | KVM_REG_SIZE_U32 | \
1971                  KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x))
1972 
1973 static int kvm_arch_put_fpsimd(CPUState *cs)
1974 {
1975     CPUARMState *env = &ARM_CPU(cs)->env;
1976     int i, ret;
1977 
1978     for (i = 0; i < 32; i++) {
1979         uint64_t *q = aa64_vfp_qreg(env, i);
1980 #if HOST_BIG_ENDIAN
1981         uint64_t fp_val[2] = { q[1], q[0] };
1982         ret = kvm_set_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]),
1983                                                         fp_val);
1984 #else
1985         ret = kvm_set_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]), q);
1986 #endif
1987         if (ret) {
1988             return ret;
1989         }
1990     }
1991 
1992     return 0;
1993 }
1994 
1995 /*
1996  * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
1997  * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
1998  * code the slice index to zero for now as it's unlikely we'll need more than
1999  * one slice for quite some time.
2000  */
2001 static int kvm_arch_put_sve(CPUState *cs)
2002 {
2003     ARMCPU *cpu = ARM_CPU(cs);
2004     CPUARMState *env = &cpu->env;
2005     uint64_t tmp[ARM_MAX_VQ * 2];
2006     uint64_t *r;
2007     int n, ret;
2008 
2009     for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
2010         r = sve_bswap64(tmp, &env->vfp.zregs[n].d[0], cpu->sve_max_vq * 2);
2011         ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_ZREG(n, 0), r);
2012         if (ret) {
2013             return ret;
2014         }
2015     }
2016 
2017     for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
2018         r = sve_bswap64(tmp, r = &env->vfp.pregs[n].p[0],
2019                         DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
2020         ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_PREG(n, 0), r);
2021         if (ret) {
2022             return ret;
2023         }
2024     }
2025 
2026     r = sve_bswap64(tmp, &env->vfp.pregs[FFR_PRED_NUM].p[0],
2027                     DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
2028     ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_FFR(0), r);
2029     if (ret) {
2030         return ret;
2031     }
2032 
2033     return 0;
2034 }
2035 
2036 int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
2037 {
2038     uint64_t val;
2039     uint32_t fpr;
2040     int i, ret;
2041     unsigned int el;
2042 
2043     ARMCPU *cpu = ARM_CPU(cs);
2044     CPUARMState *env = &cpu->env;
2045 
2046     /* If we are in AArch32 mode then we need to copy the AArch32 regs to the
2047      * AArch64 registers before pushing them out to 64-bit KVM.
2048      */
2049     if (!is_a64(env)) {
2050         aarch64_sync_32_to_64(env);
2051     }
2052 
2053     for (i = 0; i < 31; i++) {
2054         ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.regs[i]),
2055                               &env->xregs[i]);
2056         if (ret) {
2057             return ret;
2058         }
2059     }
2060 
2061     /* KVM puts SP_EL0 in regs.sp and SP_EL1 in regs.sp_el1. On the
2062      * QEMU side we keep the current SP in xregs[31] as well.
2063      */
2064     aarch64_save_sp(env, 1);
2065 
2066     ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.sp), &env->sp_el[0]);
2067     if (ret) {
2068         return ret;
2069     }
2070 
2071     ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(sp_el1), &env->sp_el[1]);
2072     if (ret) {
2073         return ret;
2074     }
2075 
2076     /* Note that KVM thinks pstate is 64 bit but we use a uint32_t */
2077     if (is_a64(env)) {
2078         val = pstate_read(env);
2079     } else {
2080         val = cpsr_read(env);
2081     }
2082     ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.pstate), &val);
2083     if (ret) {
2084         return ret;
2085     }
2086 
2087     ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.pc), &env->pc);
2088     if (ret) {
2089         return ret;
2090     }
2091 
2092     ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(elr_el1), &env->elr_el[1]);
2093     if (ret) {
2094         return ret;
2095     }
2096 
2097     /* Saved Program State Registers
2098      *
2099      * Before we restore from the banked_spsr[] array we need to
2100      * ensure that any modifications to env->spsr are correctly
2101      * reflected in the banks.
2102      */
2103     el = arm_current_el(env);
2104     if (el > 0 && !is_a64(env)) {
2105         i = bank_number(env->uncached_cpsr & CPSR_M);
2106         env->banked_spsr[i] = env->spsr;
2107     }
2108 
2109     /* KVM 0-4 map to QEMU banks 1-5 */
2110     for (i = 0; i < KVM_NR_SPSR; i++) {
2111         ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(spsr[i]),
2112                               &env->banked_spsr[i + 1]);
2113         if (ret) {
2114             return ret;
2115         }
2116     }
2117 
2118     if (cpu_isar_feature(aa64_sve, cpu)) {
2119         ret = kvm_arch_put_sve(cs);
2120     } else {
2121         ret = kvm_arch_put_fpsimd(cs);
2122     }
2123     if (ret) {
2124         return ret;
2125     }
2126 
2127     fpr = vfp_get_fpsr(env);
2128     ret = kvm_set_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpsr), &fpr);
2129     if (ret) {
2130         return ret;
2131     }
2132 
2133     fpr = vfp_get_fpcr(env);
2134     ret = kvm_set_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpcr), &fpr);
2135     if (ret) {
2136         return ret;
2137     }
2138 
2139     write_cpustate_to_list(cpu, true);
2140 
2141     if (!write_list_to_kvmstate(cpu, level)) {
2142         return -EINVAL;
2143     }
2144 
2145    /*
2146     * Setting VCPU events should be triggered after syncing the registers
2147     * to avoid overwriting potential changes made by KVM upon calling
2148     * KVM_SET_VCPU_EVENTS ioctl
2149     */
2150     ret = kvm_put_vcpu_events(cpu);
2151     if (ret) {
2152         return ret;
2153     }
2154 
2155     return kvm_arm_sync_mpstate_to_kvm(cpu);
2156 }
2157 
2158 static int kvm_arch_get_fpsimd(CPUState *cs)
2159 {
2160     CPUARMState *env = &ARM_CPU(cs)->env;
2161     int i, ret;
2162 
2163     for (i = 0; i < 32; i++) {
2164         uint64_t *q = aa64_vfp_qreg(env, i);
2165         ret = kvm_get_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]), q);
2166         if (ret) {
2167             return ret;
2168         } else {
2169 #if HOST_BIG_ENDIAN
2170             uint64_t t;
2171             t = q[0], q[0] = q[1], q[1] = t;
2172 #endif
2173         }
2174     }
2175 
2176     return 0;
2177 }
2178 
2179 /*
2180  * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
2181  * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
2182  * code the slice index to zero for now as it's unlikely we'll need more than
2183  * one slice for quite some time.
2184  */
2185 static int kvm_arch_get_sve(CPUState *cs)
2186 {
2187     ARMCPU *cpu = ARM_CPU(cs);
2188     CPUARMState *env = &cpu->env;
2189     uint64_t *r;
2190     int n, ret;
2191 
2192     for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
2193         r = &env->vfp.zregs[n].d[0];
2194         ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_ZREG(n, 0), r);
2195         if (ret) {
2196             return ret;
2197         }
2198         sve_bswap64(r, r, cpu->sve_max_vq * 2);
2199     }
2200 
2201     for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
2202         r = &env->vfp.pregs[n].p[0];
2203         ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_PREG(n, 0), r);
2204         if (ret) {
2205             return ret;
2206         }
2207         sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
2208     }
2209 
2210     r = &env->vfp.pregs[FFR_PRED_NUM].p[0];
2211     ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_FFR(0), r);
2212     if (ret) {
2213         return ret;
2214     }
2215     sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
2216 
2217     return 0;
2218 }
2219 
2220 int kvm_arch_get_registers(CPUState *cs, Error **errp)
2221 {
2222     uint64_t val;
2223     unsigned int el;
2224     uint32_t fpr;
2225     int i, ret;
2226 
2227     ARMCPU *cpu = ARM_CPU(cs);
2228     CPUARMState *env = &cpu->env;
2229 
2230     for (i = 0; i < 31; i++) {
2231         ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.regs[i]),
2232                               &env->xregs[i]);
2233         if (ret) {
2234             return ret;
2235         }
2236     }
2237 
2238     ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.sp), &env->sp_el[0]);
2239     if (ret) {
2240         return ret;
2241     }
2242 
2243     ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(sp_el1), &env->sp_el[1]);
2244     if (ret) {
2245         return ret;
2246     }
2247 
2248     ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.pstate), &val);
2249     if (ret) {
2250         return ret;
2251     }
2252 
2253     env->aarch64 = ((val & PSTATE_nRW) == 0);
2254     if (is_a64(env)) {
2255         pstate_write(env, val);
2256     } else {
2257         cpsr_write(env, val, 0xffffffff, CPSRWriteRaw);
2258     }
2259 
2260     /* KVM puts SP_EL0 in regs.sp and SP_EL1 in regs.sp_el1. On the
2261      * QEMU side we keep the current SP in xregs[31] as well.
2262      */
2263     aarch64_restore_sp(env, 1);
2264 
2265     ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.pc), &env->pc);
2266     if (ret) {
2267         return ret;
2268     }
2269 
2270     /* If we are in AArch32 mode then we need to sync the AArch32 regs with the
2271      * incoming AArch64 regs received from 64-bit KVM.
2272      * We must perform this after all of the registers have been acquired from
2273      * the kernel.
2274      */
2275     if (!is_a64(env)) {
2276         aarch64_sync_64_to_32(env);
2277     }
2278 
2279     ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(elr_el1), &env->elr_el[1]);
2280     if (ret) {
2281         return ret;
2282     }
2283 
2284     /* Fetch the SPSR registers
2285      *
2286      * KVM SPSRs 0-4 map to QEMU banks 1-5
2287      */
2288     for (i = 0; i < KVM_NR_SPSR; i++) {
2289         ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(spsr[i]),
2290                               &env->banked_spsr[i + 1]);
2291         if (ret) {
2292             return ret;
2293         }
2294     }
2295 
2296     el = arm_current_el(env);
2297     if (el > 0 && !is_a64(env)) {
2298         i = bank_number(env->uncached_cpsr & CPSR_M);
2299         env->spsr = env->banked_spsr[i];
2300     }
2301 
2302     if (cpu_isar_feature(aa64_sve, cpu)) {
2303         ret = kvm_arch_get_sve(cs);
2304     } else {
2305         ret = kvm_arch_get_fpsimd(cs);
2306     }
2307     if (ret) {
2308         return ret;
2309     }
2310 
2311     ret = kvm_get_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpsr), &fpr);
2312     if (ret) {
2313         return ret;
2314     }
2315     vfp_set_fpsr(env, fpr);
2316 
2317     ret = kvm_get_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpcr), &fpr);
2318     if (ret) {
2319         return ret;
2320     }
2321     vfp_set_fpcr(env, fpr);
2322 
2323     ret = kvm_get_vcpu_events(cpu);
2324     if (ret) {
2325         return ret;
2326     }
2327 
2328     if (!write_kvmstate_to_list(cpu)) {
2329         return -EINVAL;
2330     }
2331     /* Note that it's OK to have registers which aren't in CPUState,
2332      * so we can ignore a failure return here.
2333      */
2334     write_list_to_cpustate(cpu);
2335 
2336     ret = kvm_arm_sync_mpstate_to_qemu(cpu);
2337 
2338     /* TODO: other registers */
2339     return ret;
2340 }
2341 
2342 void kvm_arch_on_sigbus_vcpu(CPUState *c, int code, void *addr)
2343 {
2344     ram_addr_t ram_addr;
2345     hwaddr paddr;
2346 
2347     assert(code == BUS_MCEERR_AR || code == BUS_MCEERR_AO);
2348 
2349     if (acpi_ghes_present() && addr) {
2350         ram_addr = qemu_ram_addr_from_host(addr);
2351         if (ram_addr != RAM_ADDR_INVALID &&
2352             kvm_physical_memory_addr_from_host(c->kvm_state, addr, &paddr)) {
2353             kvm_hwpoison_page_add(ram_addr);
2354             /*
2355              * If this is a BUS_MCEERR_AR, we know we have been called
2356              * synchronously from the vCPU thread, so we can easily
2357              * synchronize the state and inject an error.
2358              *
2359              * TODO: we currently don't tell the guest at all about
2360              * BUS_MCEERR_AO. In that case we might either be being
2361              * called synchronously from the vCPU thread, or a bit
2362              * later from the main thread, so doing the injection of
2363              * the error would be more complicated.
2364              */
2365             if (code == BUS_MCEERR_AR) {
2366                 kvm_cpu_synchronize_state(c);
2367                 if (!acpi_ghes_memory_errors(ACPI_HEST_SRC_ID_SEA, paddr)) {
2368                     kvm_inject_arm_sea(c);
2369                 } else {
2370                     error_report("failed to record the error");
2371                     abort();
2372                 }
2373             }
2374             return;
2375         }
2376         if (code == BUS_MCEERR_AO) {
2377             error_report("Hardware memory error at addr %p for memory used by "
2378                 "QEMU itself instead of guest system!", addr);
2379         }
2380     }
2381 
2382     if (code == BUS_MCEERR_AR) {
2383         error_report("Hardware memory error!");
2384         exit(1);
2385     }
2386 }
2387 
2388 /* C6.6.29 BRK instruction */
2389 static const uint32_t brk_insn = 0xd4200000;
2390 
2391 int kvm_arch_insert_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
2392 {
2393     if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 4, 0) ||
2394         cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&brk_insn, 4, 1)) {
2395         return -EINVAL;
2396     }
2397     return 0;
2398 }
2399 
2400 int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
2401 {
2402     static uint32_t brk;
2403 
2404     if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&brk, 4, 0) ||
2405         brk != brk_insn ||
2406         cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 4, 1)) {
2407         return -EINVAL;
2408     }
2409     return 0;
2410 }
2411 
2412 void kvm_arm_enable_mte(Object *cpuobj, Error **errp)
2413 {
2414     static bool tried_to_enable;
2415     static bool succeeded_to_enable;
2416     Error *mte_migration_blocker = NULL;
2417     ARMCPU *cpu = ARM_CPU(cpuobj);
2418     int ret;
2419 
2420     if (!tried_to_enable) {
2421         /*
2422          * MTE on KVM is enabled on a per-VM basis (and retrying doesn't make
2423          * sense), and we only want a single migration blocker as well.
2424          */
2425         tried_to_enable = true;
2426 
2427         ret = kvm_vm_enable_cap(kvm_state, KVM_CAP_ARM_MTE, 0);
2428         if (ret) {
2429             error_setg_errno(errp, -ret, "Failed to enable KVM_CAP_ARM_MTE");
2430             return;
2431         }
2432 
2433         /* TODO: Add migration support with MTE enabled */
2434         error_setg(&mte_migration_blocker,
2435                    "Live migration disabled due to MTE enabled");
2436         if (migrate_add_blocker(&mte_migration_blocker, errp)) {
2437             error_free(mte_migration_blocker);
2438             return;
2439         }
2440 
2441         succeeded_to_enable = true;
2442     }
2443 
2444     if (succeeded_to_enable) {
2445         cpu->kvm_mte = true;
2446     }
2447 }
2448 
2449 void arm_cpu_kvm_set_irq(void *arm_cpu, int irq, int level)
2450 {
2451     ARMCPU *cpu = arm_cpu;
2452     CPUARMState *env = &cpu->env;
2453     CPUState *cs = CPU(cpu);
2454     uint32_t linestate_bit;
2455     int irq_id;
2456 
2457     switch (irq) {
2458     case ARM_CPU_IRQ:
2459         irq_id = KVM_ARM_IRQ_CPU_IRQ;
2460         linestate_bit = CPU_INTERRUPT_HARD;
2461         break;
2462     case ARM_CPU_FIQ:
2463         irq_id = KVM_ARM_IRQ_CPU_FIQ;
2464         linestate_bit = CPU_INTERRUPT_FIQ;
2465         break;
2466     default:
2467         g_assert_not_reached();
2468     }
2469 
2470     if (level) {
2471         env->irq_line_state |= linestate_bit;
2472     } else {
2473         env->irq_line_state &= ~linestate_bit;
2474     }
2475     kvm_arm_set_irq(cs->cpu_index, KVM_ARM_IRQ_TYPE_CPU, irq_id, !!level);
2476 }
2477