249 lines
7.1 KiB
C
249 lines
7.1 KiB
C
/*
|
|
* Fault injection for both 32 and 64bit guests.
|
|
*
|
|
* Copyright (C) 2012,2013 - ARM Ltd
|
|
* Author: Marc Zyngier <marc.zyngier@arm.com>
|
|
*
|
|
* Based on arch/arm/kvm/emulate.c
|
|
* Copyright (C) 2012 - Virtual Open Systems and Columbia University
|
|
* Author: Christoffer Dall <c.dall@virtualopensystems.com>
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include <linux/kvm_host.h>
|
|
#include <asm/kvm_emulate.h>
|
|
#include <asm/esr.h>
|
|
|
|
#define CURRENT_EL_SP_EL0_VECTOR 0x0
|
|
#define CURRENT_EL_SP_ELx_VECTOR 0x200
|
|
#define LOWER_EL_AArch64_VECTOR 0x400
|
|
#define LOWER_EL_AArch32_VECTOR 0x600
|
|
|
|
enum exception_type {
|
|
except_type_sync = 0,
|
|
except_type_irq = 0x80,
|
|
except_type_fiq = 0x100,
|
|
except_type_serror = 0x180,
|
|
};
|
|
|
|
static u64 get_except_vector(struct kvm_vcpu *vcpu, enum exception_type type)
|
|
{
|
|
u64 exc_offset;
|
|
|
|
switch (*vcpu_cpsr(vcpu) & (PSR_MODE_MASK | PSR_MODE32_BIT)) {
|
|
case PSR_MODE_EL1t:
|
|
exc_offset = CURRENT_EL_SP_EL0_VECTOR;
|
|
break;
|
|
case PSR_MODE_EL1h:
|
|
exc_offset = CURRENT_EL_SP_ELx_VECTOR;
|
|
break;
|
|
case PSR_MODE_EL0t:
|
|
exc_offset = LOWER_EL_AArch64_VECTOR;
|
|
break;
|
|
default:
|
|
exc_offset = LOWER_EL_AArch32_VECTOR;
|
|
}
|
|
|
|
return vcpu_read_sys_reg(vcpu, VBAR_EL1) + exc_offset + type;
|
|
}
|
|
|
|
/*
|
|
* When an exception is taken, most PSTATE fields are left unchanged in the
|
|
* handler. However, some are explicitly overridden (e.g. M[4:0]). Luckily all
|
|
* of the inherited bits have the same position in the AArch64/AArch32 SPSR_ELx
|
|
* layouts, so we don't need to shuffle these for exceptions from AArch32 EL0.
|
|
*
|
|
* For the SPSR_ELx layout for AArch64, see ARM DDI 0487E.a page C5-429.
|
|
* For the SPSR_ELx layout for AArch32, see ARM DDI 0487E.a page C5-426.
|
|
*
|
|
* Here we manipulate the fields in order of the AArch64 SPSR_ELx layout, from
|
|
* MSB to LSB.
|
|
*/
|
|
static unsigned long get_except64_pstate(struct kvm_vcpu *vcpu)
|
|
{
|
|
unsigned long sctlr = vcpu_read_sys_reg(vcpu, SCTLR_EL1);
|
|
unsigned long old, new;
|
|
|
|
old = *vcpu_cpsr(vcpu);
|
|
new = 0;
|
|
|
|
new |= (old & PSR_N_BIT);
|
|
new |= (old & PSR_Z_BIT);
|
|
new |= (old & PSR_C_BIT);
|
|
new |= (old & PSR_V_BIT);
|
|
|
|
// TODO: TCO (if/when ARMv8.5-MemTag is exposed to guests)
|
|
|
|
new |= (old & PSR_DIT_BIT);
|
|
|
|
// PSTATE.UAO is set to zero upon any exception to AArch64
|
|
// See ARM DDI 0487E.a, page D5-2579.
|
|
|
|
// PSTATE.PAN is unchanged unless SCTLR_ELx.SPAN == 0b0
|
|
// SCTLR_ELx.SPAN is RES1 when ARMv8.1-PAN is not implemented
|
|
// See ARM DDI 0487E.a, page D5-2578.
|
|
new |= (old & PSR_PAN_BIT);
|
|
if (!(sctlr & SCTLR_EL1_SPAN))
|
|
new |= PSR_PAN_BIT;
|
|
|
|
// PSTATE.SS is set to zero upon any exception to AArch64
|
|
// See ARM DDI 0487E.a, page D2-2452.
|
|
|
|
// PSTATE.IL is set to zero upon any exception to AArch64
|
|
// See ARM DDI 0487E.a, page D1-2306.
|
|
|
|
// PSTATE.SSBS is set to SCTLR_ELx.DSSBS upon any exception to AArch64
|
|
// See ARM DDI 0487E.a, page D13-3258
|
|
if (sctlr & SCTLR_ELx_DSSBS)
|
|
new |= PSR_SSBS_BIT;
|
|
|
|
// PSTATE.BTYPE is set to zero upon any exception to AArch64
|
|
// See ARM DDI 0487E.a, pages D1-2293 to D1-2294.
|
|
|
|
new |= PSR_D_BIT;
|
|
new |= PSR_A_BIT;
|
|
new |= PSR_I_BIT;
|
|
new |= PSR_F_BIT;
|
|
|
|
new |= PSR_MODE_EL1h;
|
|
|
|
return new;
|
|
}
|
|
|
|
static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr)
|
|
{
|
|
unsigned long cpsr = *vcpu_cpsr(vcpu);
|
|
bool is_aarch32 = vcpu_mode_is_32bit(vcpu);
|
|
u32 esr = 0;
|
|
|
|
vcpu_write_elr_el1(vcpu, *vcpu_pc(vcpu));
|
|
*vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync);
|
|
|
|
*vcpu_cpsr(vcpu) = get_except64_pstate(vcpu);
|
|
vcpu_write_spsr(vcpu, cpsr);
|
|
|
|
vcpu_write_sys_reg(vcpu, addr, FAR_EL1);
|
|
|
|
/*
|
|
* Build an {i,d}abort, depending on the level and the
|
|
* instruction set. Report an external synchronous abort.
|
|
*/
|
|
if (kvm_vcpu_trap_il_is32bit(vcpu))
|
|
esr |= ESR_ELx_IL;
|
|
|
|
/*
|
|
* Here, the guest runs in AArch64 mode when in EL1. If we get
|
|
* an AArch32 fault, it means we managed to trap an EL0 fault.
|
|
*/
|
|
if (is_aarch32 || (cpsr & PSR_MODE_MASK) == PSR_MODE_EL0t)
|
|
esr |= (ESR_ELx_EC_IABT_LOW << ESR_ELx_EC_SHIFT);
|
|
else
|
|
esr |= (ESR_ELx_EC_IABT_CUR << ESR_ELx_EC_SHIFT);
|
|
|
|
if (!is_iabt)
|
|
esr |= ESR_ELx_EC_DABT_LOW << ESR_ELx_EC_SHIFT;
|
|
|
|
vcpu_write_sys_reg(vcpu, esr | ESR_ELx_FSC_EXTABT, ESR_EL1);
|
|
}
|
|
|
|
static void inject_undef64(struct kvm_vcpu *vcpu)
|
|
{
|
|
unsigned long cpsr = *vcpu_cpsr(vcpu);
|
|
u32 esr = (ESR_ELx_EC_UNKNOWN << ESR_ELx_EC_SHIFT);
|
|
|
|
vcpu_write_elr_el1(vcpu, *vcpu_pc(vcpu));
|
|
*vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync);
|
|
|
|
*vcpu_cpsr(vcpu) = get_except64_pstate(vcpu);
|
|
vcpu_write_spsr(vcpu, cpsr);
|
|
|
|
/*
|
|
* Build an unknown exception, depending on the instruction
|
|
* set.
|
|
*/
|
|
if (kvm_vcpu_trap_il_is32bit(vcpu))
|
|
esr |= ESR_ELx_IL;
|
|
|
|
vcpu_write_sys_reg(vcpu, esr, ESR_EL1);
|
|
}
|
|
|
|
/**
|
|
* kvm_inject_dabt - inject a data abort into the guest
|
|
* @vcpu: The VCPU to receive the undefined exception
|
|
* @addr: The address to report in the DFAR
|
|
*
|
|
* It is assumed that this code is called from the VCPU thread and that the
|
|
* VCPU therefore is not currently executing guest code.
|
|
*/
|
|
void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr)
|
|
{
|
|
if (vcpu_el1_is_32bit(vcpu))
|
|
kvm_inject_dabt32(vcpu, addr);
|
|
else
|
|
inject_abt64(vcpu, false, addr);
|
|
}
|
|
|
|
/**
|
|
* kvm_inject_pabt - inject a prefetch abort into the guest
|
|
* @vcpu: The VCPU to receive the undefined exception
|
|
* @addr: The address to report in the DFAR
|
|
*
|
|
* It is assumed that this code is called from the VCPU thread and that the
|
|
* VCPU therefore is not currently executing guest code.
|
|
*/
|
|
void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr)
|
|
{
|
|
if (vcpu_el1_is_32bit(vcpu))
|
|
kvm_inject_pabt32(vcpu, addr);
|
|
else
|
|
inject_abt64(vcpu, true, addr);
|
|
}
|
|
|
|
/**
|
|
* kvm_inject_undefined - inject an undefined instruction into the guest
|
|
*
|
|
* It is assumed that this code is called from the VCPU thread and that the
|
|
* VCPU therefore is not currently executing guest code.
|
|
*/
|
|
void kvm_inject_undefined(struct kvm_vcpu *vcpu)
|
|
{
|
|
if (vcpu_el1_is_32bit(vcpu))
|
|
kvm_inject_undef32(vcpu);
|
|
else
|
|
inject_undef64(vcpu);
|
|
}
|
|
|
|
void kvm_set_sei_esr(struct kvm_vcpu *vcpu, u64 esr)
|
|
{
|
|
vcpu_set_vsesr(vcpu, esr & ESR_ELx_ISS_MASK);
|
|
*vcpu_hcr(vcpu) |= HCR_VSE;
|
|
}
|
|
|
|
/**
|
|
* kvm_inject_vabt - inject an async abort / SError into the guest
|
|
* @vcpu: The VCPU to receive the exception
|
|
*
|
|
* It is assumed that this code is called from the VCPU thread and that the
|
|
* VCPU therefore is not currently executing guest code.
|
|
*
|
|
* Systems with the RAS Extensions specify an imp-def ESR (ISV/IDS = 1) with
|
|
* the remaining ISS all-zeros so that this error is not interpreted as an
|
|
* uncategorized RAS error. Without the RAS Extensions we can't specify an ESR
|
|
* value, so the CPU generates an imp-def value.
|
|
*/
|
|
void kvm_inject_vabt(struct kvm_vcpu *vcpu)
|
|
{
|
|
kvm_set_sei_esr(vcpu, ESR_ELx_ISV);
|
|
}
|