KVM: PPC: fix information leak to userland
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / arch / powerpc / kvm / book3s_32_mmu.c
blobc8cefdd15fd8a2fa03661511e3ca6d2d7c730877
1 /*
2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License, version 2, as
4 * published by the Free Software Foundation.
6 * This program is distributed in the hope that it will be useful,
7 * but WITHOUT ANY WARRANTY; without even the implied warranty of
8 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
9 * GNU General Public License for more details.
11 * You should have received a copy of the GNU General Public License
12 * along with this program; if not, write to the Free Software
13 * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
15 * Copyright SUSE Linux Products GmbH 2009
17 * Authors: Alexander Graf <agraf@suse.de>
20 #include <linux/types.h>
21 #include <linux/string.h>
22 #include <linux/kvm.h>
23 #include <linux/kvm_host.h>
24 #include <linux/highmem.h>
26 #include <asm/tlbflush.h>
27 #include <asm/kvm_ppc.h>
28 #include <asm/kvm_book3s.h>
30 /* #define DEBUG_MMU */
31 /* #define DEBUG_MMU_PTE */
32 /* #define DEBUG_MMU_PTE_IP 0xfff14c40 */
34 #ifdef DEBUG_MMU
35 #define dprintk(X...) printk(KERN_INFO X)
36 #else
37 #define dprintk(X...) do { } while(0)
38 #endif
40 #ifdef DEBUG_MMU_PTE
41 #define dprintk_pte(X...) printk(KERN_INFO X)
42 #else
43 #define dprintk_pte(X...) do { } while(0)
44 #endif
46 #define PTEG_FLAG_ACCESSED 0x00000100
47 #define PTEG_FLAG_DIRTY 0x00000080
48 #ifndef SID_SHIFT
49 #define SID_SHIFT 28
50 #endif
52 static inline bool check_debug_ip(struct kvm_vcpu *vcpu)
54 #ifdef DEBUG_MMU_PTE_IP
55 return vcpu->arch.pc == DEBUG_MMU_PTE_IP;
56 #else
57 return true;
58 #endif
61 static inline u32 sr_vsid(u32 sr_raw)
63 return sr_raw & 0x0fffffff;
66 static inline bool sr_valid(u32 sr_raw)
68 return (sr_raw & 0x80000000) ? false : true;
71 static inline bool sr_ks(u32 sr_raw)
73 return (sr_raw & 0x40000000) ? true: false;
76 static inline bool sr_kp(u32 sr_raw)
78 return (sr_raw & 0x20000000) ? true: false;
81 static inline bool sr_nx(u32 sr_raw)
83 return (sr_raw & 0x10000000) ? true: false;
86 static int kvmppc_mmu_book3s_32_xlate_bat(struct kvm_vcpu *vcpu, gva_t eaddr,
87 struct kvmppc_pte *pte, bool data);
88 static int kvmppc_mmu_book3s_32_esid_to_vsid(struct kvm_vcpu *vcpu, ulong esid,
89 u64 *vsid);
91 static u32 find_sr(struct kvm_vcpu *vcpu, gva_t eaddr)
93 return vcpu->arch.shared->sr[(eaddr >> 28) & 0xf];
96 static u64 kvmppc_mmu_book3s_32_ea_to_vp(struct kvm_vcpu *vcpu, gva_t eaddr,
97 bool data)
99 u64 vsid;
100 struct kvmppc_pte pte;
102 if (!kvmppc_mmu_book3s_32_xlate_bat(vcpu, eaddr, &pte, data))
103 return pte.vpage;
105 kvmppc_mmu_book3s_32_esid_to_vsid(vcpu, eaddr >> SID_SHIFT, &vsid);
106 return (((u64)eaddr >> 12) & 0xffff) | (vsid << 16);
109 static void kvmppc_mmu_book3s_32_reset_msr(struct kvm_vcpu *vcpu)
111 kvmppc_set_msr(vcpu, 0);
114 static hva_t kvmppc_mmu_book3s_32_get_pteg(struct kvmppc_vcpu_book3s *vcpu_book3s,
115 u32 sre, gva_t eaddr,
116 bool primary)
118 u32 page, hash, pteg, htabmask;
119 hva_t r;
121 page = (eaddr & 0x0FFFFFFF) >> 12;
122 htabmask = ((vcpu_book3s->sdr1 & 0x1FF) << 16) | 0xFFC0;
124 hash = ((sr_vsid(sre) ^ page) << 6);
125 if (!primary)
126 hash = ~hash;
127 hash &= htabmask;
129 pteg = (vcpu_book3s->sdr1 & 0xffff0000) | hash;
131 dprintk("MMU: pc=0x%lx eaddr=0x%lx sdr1=0x%llx pteg=0x%x vsid=0x%x\n",
132 kvmppc_get_pc(&vcpu_book3s->vcpu), eaddr, vcpu_book3s->sdr1, pteg,
133 sr_vsid(sre));
135 r = gfn_to_hva(vcpu_book3s->vcpu.kvm, pteg >> PAGE_SHIFT);
136 if (kvm_is_error_hva(r))
137 return r;
138 return r | (pteg & ~PAGE_MASK);
141 static u32 kvmppc_mmu_book3s_32_get_ptem(u32 sre, gva_t eaddr, bool primary)
143 return ((eaddr & 0x0fffffff) >> 22) | (sr_vsid(sre) << 7) |
144 (primary ? 0 : 0x40) | 0x80000000;
147 static int kvmppc_mmu_book3s_32_xlate_bat(struct kvm_vcpu *vcpu, gva_t eaddr,
148 struct kvmppc_pte *pte, bool data)
150 struct kvmppc_vcpu_book3s *vcpu_book3s = to_book3s(vcpu);
151 struct kvmppc_bat *bat;
152 int i;
154 for (i = 0; i < 8; i++) {
155 if (data)
156 bat = &vcpu_book3s->dbat[i];
157 else
158 bat = &vcpu_book3s->ibat[i];
160 if (vcpu->arch.shared->msr & MSR_PR) {
161 if (!bat->vp)
162 continue;
163 } else {
164 if (!bat->vs)
165 continue;
168 if (check_debug_ip(vcpu))
170 dprintk_pte("%cBAT %02d: 0x%lx - 0x%x (0x%x)\n",
171 data ? 'd' : 'i', i, eaddr, bat->bepi,
172 bat->bepi_mask);
174 if ((eaddr & bat->bepi_mask) == bat->bepi) {
175 u64 vsid;
176 kvmppc_mmu_book3s_32_esid_to_vsid(vcpu,
177 eaddr >> SID_SHIFT, &vsid);
178 vsid <<= 16;
179 pte->vpage = (((u64)eaddr >> 12) & 0xffff) | vsid;
181 pte->raddr = bat->brpn | (eaddr & ~bat->bepi_mask);
182 pte->may_read = bat->pp;
183 pte->may_write = bat->pp > 1;
184 pte->may_execute = true;
185 if (!pte->may_read) {
186 printk(KERN_INFO "BAT is not readable!\n");
187 continue;
189 if (!pte->may_write) {
190 /* let's treat r/o BATs as not-readable for now */
191 dprintk_pte("BAT is read-only!\n");
192 continue;
195 return 0;
199 return -ENOENT;
202 static int kvmppc_mmu_book3s_32_xlate_pte(struct kvm_vcpu *vcpu, gva_t eaddr,
203 struct kvmppc_pte *pte, bool data,
204 bool primary)
206 struct kvmppc_vcpu_book3s *vcpu_book3s = to_book3s(vcpu);
207 u32 sre;
208 hva_t ptegp;
209 u32 pteg[16];
210 u32 ptem = 0;
211 int i;
212 int found = 0;
214 sre = find_sr(vcpu, eaddr);
216 dprintk_pte("SR 0x%lx: vsid=0x%x, raw=0x%x\n", eaddr >> 28,
217 sr_vsid(sre), sre);
219 pte->vpage = kvmppc_mmu_book3s_32_ea_to_vp(vcpu, eaddr, data);
221 ptegp = kvmppc_mmu_book3s_32_get_pteg(vcpu_book3s, sre, eaddr, primary);
222 if (kvm_is_error_hva(ptegp)) {
223 printk(KERN_INFO "KVM: Invalid PTEG!\n");
224 goto no_page_found;
227 ptem = kvmppc_mmu_book3s_32_get_ptem(sre, eaddr, primary);
229 if(copy_from_user(pteg, (void __user *)ptegp, sizeof(pteg))) {
230 printk(KERN_ERR "KVM: Can't copy data from 0x%lx!\n", ptegp);
231 goto no_page_found;
234 for (i=0; i<16; i+=2) {
235 if (ptem == pteg[i]) {
236 u8 pp;
238 pte->raddr = (pteg[i+1] & ~(0xFFFULL)) | (eaddr & 0xFFF);
239 pp = pteg[i+1] & 3;
241 if ((sr_kp(sre) && (vcpu->arch.shared->msr & MSR_PR)) ||
242 (sr_ks(sre) && !(vcpu->arch.shared->msr & MSR_PR)))
243 pp |= 4;
245 pte->may_write = false;
246 pte->may_read = false;
247 pte->may_execute = true;
248 switch (pp) {
249 case 0:
250 case 1:
251 case 2:
252 case 6:
253 pte->may_write = true;
254 case 3:
255 case 5:
256 case 7:
257 pte->may_read = true;
258 break;
261 if ( !pte->may_read )
262 continue;
264 dprintk_pte("MMU: Found PTE -> %x %x - %x\n",
265 pteg[i], pteg[i+1], pp);
266 found = 1;
267 break;
271 /* Update PTE C and A bits, so the guest's swapper knows we used the
272 page */
273 if (found) {
274 u32 oldpte = pteg[i+1];
276 if (pte->may_read)
277 pteg[i+1] |= PTEG_FLAG_ACCESSED;
278 if (pte->may_write)
279 pteg[i+1] |= PTEG_FLAG_DIRTY;
280 else
281 dprintk_pte("KVM: Mapping read-only page!\n");
283 /* Write back into the PTEG */
284 if (pteg[i+1] != oldpte)
285 copy_to_user((void __user *)ptegp, pteg, sizeof(pteg));
287 return 0;
290 no_page_found:
292 if (check_debug_ip(vcpu)) {
293 dprintk_pte("KVM MMU: No PTE found (sdr1=0x%llx ptegp=0x%lx)\n",
294 to_book3s(vcpu)->sdr1, ptegp);
295 for (i=0; i<16; i+=2) {
296 dprintk_pte(" %02d: 0x%x - 0x%x (0x%x)\n",
297 i, pteg[i], pteg[i+1], ptem);
301 return -ENOENT;
304 static int kvmppc_mmu_book3s_32_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
305 struct kvmppc_pte *pte, bool data)
307 int r;
308 ulong mp_ea = vcpu->arch.magic_page_ea;
310 pte->eaddr = eaddr;
312 /* Magic page override */
313 if (unlikely(mp_ea) &&
314 unlikely((eaddr & ~0xfffULL) == (mp_ea & ~0xfffULL)) &&
315 !(vcpu->arch.shared->msr & MSR_PR)) {
316 pte->vpage = kvmppc_mmu_book3s_32_ea_to_vp(vcpu, eaddr, data);
317 pte->raddr = vcpu->arch.magic_page_pa | (pte->raddr & 0xfff);
318 pte->raddr &= KVM_PAM;
319 pte->may_execute = true;
320 pte->may_read = true;
321 pte->may_write = true;
323 return 0;
326 r = kvmppc_mmu_book3s_32_xlate_bat(vcpu, eaddr, pte, data);
327 if (r < 0)
328 r = kvmppc_mmu_book3s_32_xlate_pte(vcpu, eaddr, pte, data, true);
329 if (r < 0)
330 r = kvmppc_mmu_book3s_32_xlate_pte(vcpu, eaddr, pte, data, false);
332 return r;
336 static u32 kvmppc_mmu_book3s_32_mfsrin(struct kvm_vcpu *vcpu, u32 srnum)
338 return vcpu->arch.shared->sr[srnum];
341 static void kvmppc_mmu_book3s_32_mtsrin(struct kvm_vcpu *vcpu, u32 srnum,
342 ulong value)
344 vcpu->arch.shared->sr[srnum] = value;
345 kvmppc_mmu_map_segment(vcpu, srnum << SID_SHIFT);
348 static void kvmppc_mmu_book3s_32_tlbie(struct kvm_vcpu *vcpu, ulong ea, bool large)
350 kvmppc_mmu_pte_flush(vcpu, ea, 0x0FFFF000);
353 static int kvmppc_mmu_book3s_32_esid_to_vsid(struct kvm_vcpu *vcpu, ulong esid,
354 u64 *vsid)
356 ulong ea = esid << SID_SHIFT;
357 u32 sr;
358 u64 gvsid = esid;
360 if (vcpu->arch.shared->msr & (MSR_DR|MSR_IR)) {
361 sr = find_sr(vcpu, ea);
362 if (sr_valid(sr))
363 gvsid = sr_vsid(sr);
366 /* In case we only have one of MSR_IR or MSR_DR set, let's put
367 that in the real-mode context (and hope RM doesn't access
368 high memory) */
369 switch (vcpu->arch.shared->msr & (MSR_DR|MSR_IR)) {
370 case 0:
371 *vsid = VSID_REAL | esid;
372 break;
373 case MSR_IR:
374 *vsid = VSID_REAL_IR | gvsid;
375 break;
376 case MSR_DR:
377 *vsid = VSID_REAL_DR | gvsid;
378 break;
379 case MSR_DR|MSR_IR:
380 if (sr_valid(sr))
381 *vsid = sr_vsid(sr);
382 else
383 *vsid = VSID_BAT | gvsid;
384 break;
385 default:
386 BUG();
389 if (vcpu->arch.shared->msr & MSR_PR)
390 *vsid |= VSID_PR;
392 return 0;
395 static bool kvmppc_mmu_book3s_32_is_dcbz32(struct kvm_vcpu *vcpu)
397 return true;
401 void kvmppc_mmu_book3s_32_init(struct kvm_vcpu *vcpu)
403 struct kvmppc_mmu *mmu = &vcpu->arch.mmu;
405 mmu->mtsrin = kvmppc_mmu_book3s_32_mtsrin;
406 mmu->mfsrin = kvmppc_mmu_book3s_32_mfsrin;
407 mmu->xlate = kvmppc_mmu_book3s_32_xlate;
408 mmu->reset_msr = kvmppc_mmu_book3s_32_reset_msr;
409 mmu->tlbie = kvmppc_mmu_book3s_32_tlbie;
410 mmu->esid_to_vsid = kvmppc_mmu_book3s_32_esid_to_vsid;
411 mmu->ea_to_vp = kvmppc_mmu_book3s_32_ea_to_vp;
412 mmu->is_dcbz32 = kvmppc_mmu_book3s_32_is_dcbz32;
414 mmu->slbmte = NULL;
415 mmu->slbmfee = NULL;
416 mmu->slbmfev = NULL;
417 mmu->slbie = NULL;
418 mmu->slbia = NULL;