2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License, version 2, as
4 * published by the Free Software Foundation.
6 * This program is distributed in the hope that it will be useful,
7 * but WITHOUT ANY WARRANTY; without even the implied warranty of
8 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
9 * GNU General Public License for more details.
11 * You should have received a copy of the GNU General Public License
12 * along with this program; if not, write to the Free Software
13 * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
15 * Copyright IBM Corp. 2007
17 * Authors: Hollis Blanchard <hollisb@us.ibm.com>
20 #include <linux/jiffies.h>
21 #include <linux/timer.h>
22 #include <linux/types.h>
23 #include <linux/string.h>
24 #include <linux/kvm_host.h>
27 #include <asm/dcr-regs.h>
29 #include <asm/byteorder.h>
30 #include <asm/kvm_ppc.h>
34 /* Instruction decoding */
35 static inline unsigned int get_op(u32 inst
)
40 static inline unsigned int get_xop(u32 inst
)
42 return (inst
>> 1) & 0x3ff;
45 static inline unsigned int get_sprn(u32 inst
)
47 return ((inst
>> 16) & 0x1f) | ((inst
>> 6) & 0x3e0);
50 static inline unsigned int get_dcrn(u32 inst
)
52 return ((inst
>> 16) & 0x1f) | ((inst
>> 6) & 0x3e0);
55 static inline unsigned int get_rt(u32 inst
)
57 return (inst
>> 21) & 0x1f;
60 static inline unsigned int get_rs(u32 inst
)
62 return (inst
>> 21) & 0x1f;
65 static inline unsigned int get_ra(u32 inst
)
67 return (inst
>> 16) & 0x1f;
70 static inline unsigned int get_rb(u32 inst
)
72 return (inst
>> 11) & 0x1f;
75 static inline unsigned int get_rc(u32 inst
)
80 static inline unsigned int get_ws(u32 inst
)
82 return (inst
>> 11) & 0x1f;
85 static inline unsigned int get_d(u32 inst
)
90 static int tlbe_is_host_safe(const struct kvm_vcpu
*vcpu
,
91 const struct tlbe
*tlbe
)
98 /* Does it match current guest AS? */
99 /* XXX what about IS != DS? */
100 if (get_tlb_ts(tlbe
) != !!(vcpu
->arch
.msr
& MSR_IS
))
103 gpa
= get_tlb_raddr(tlbe
);
104 if (!gfn_to_memslot(vcpu
->kvm
, gpa
>> PAGE_SHIFT
))
105 /* Mapping is not for RAM. */
111 static int kvmppc_emul_tlbwe(struct kvm_vcpu
*vcpu
, u32 inst
)
127 index
= vcpu
->arch
.gpr
[ra
];
128 if (index
> PPC44x_TLB_SIZE
) {
129 printk("%s: index %d\n", __func__
, index
);
130 kvmppc_dump_vcpu(vcpu
);
134 tlbe
= &vcpu
->arch
.guest_tlb
[index
];
136 /* Invalidate shadow mappings for the about-to-be-clobbered TLBE. */
137 if (tlbe
->word0
& PPC44x_TLB_VALID
) {
138 eaddr
= get_tlb_eaddr(tlbe
);
139 asid
= (tlbe
->word0
& PPC44x_TLB_TS
) | tlbe
->tid
;
140 kvmppc_mmu_invalidate(vcpu
, eaddr
, get_tlb_end(tlbe
), asid
);
144 case PPC44x_TLB_PAGEID
:
145 tlbe
->tid
= vcpu
->arch
.mmucr
& 0xff;
146 tlbe
->word0
= vcpu
->arch
.gpr
[rs
];
149 case PPC44x_TLB_XLAT
:
150 tlbe
->word1
= vcpu
->arch
.gpr
[rs
];
153 case PPC44x_TLB_ATTRIB
:
154 tlbe
->word2
= vcpu
->arch
.gpr
[rs
];
161 if (tlbe_is_host_safe(vcpu
, tlbe
)) {
162 eaddr
= get_tlb_eaddr(tlbe
);
163 raddr
= get_tlb_raddr(tlbe
);
164 asid
= (tlbe
->word0
& PPC44x_TLB_TS
) | tlbe
->tid
;
165 flags
= tlbe
->word2
& 0xffff;
167 /* Create a 4KB mapping on the host. If the guest wanted a
168 * large page, only the first 4KB is mapped here and the rest
169 * are mapped on the fly. */
170 kvmppc_mmu_map(vcpu
, eaddr
, raddr
>> PAGE_SHIFT
, asid
, flags
);
176 static void kvmppc_emulate_dec(struct kvm_vcpu
*vcpu
)
178 if (vcpu
->arch
.tcr
& TCR_DIE
) {
179 /* The decrementer ticks at the same rate as the timebase, so
180 * that's how we convert the guest DEC value to the number of
182 unsigned long nr_jiffies
;
184 nr_jiffies
= vcpu
->arch
.dec
/ tb_ticks_per_jiffy
;
185 mod_timer(&vcpu
->arch
.dec_timer
,
186 get_jiffies_64() + nr_jiffies
);
188 del_timer(&vcpu
->arch
.dec_timer
);
192 static void kvmppc_emul_rfi(struct kvm_vcpu
*vcpu
)
194 vcpu
->arch
.pc
= vcpu
->arch
.srr0
;
195 kvmppc_set_msr(vcpu
, vcpu
->arch
.srr1
);
210 * XXX is_bigendian should depend on MMU mapping or MSR[LE]
212 int kvmppc_emulate_instruction(struct kvm_run
*run
, struct kvm_vcpu
*vcpu
)
214 u32 inst
= vcpu
->arch
.last_inst
;
223 enum emulation_result emulated
= EMULATE_DONE
;
226 switch (get_op(inst
)) {
229 kvmppc_queue_exception(vcpu
, BOOKE_INTERRUPT_PROGRAM
);
234 switch (get_xop(inst
)) {
236 kvmppc_emul_rfi(vcpu
);
241 emulated
= EMULATE_FAIL
;
247 switch (get_xop(inst
)) {
251 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 4, 1);
256 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.msr
;
261 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 1, 1);
264 case 131: /* wrtee */
266 vcpu
->arch
.msr
= (vcpu
->arch
.msr
& ~MSR_EE
)
267 | (vcpu
->arch
.gpr
[rs
] & MSR_EE
);
270 case 146: /* mtmsr */
272 kvmppc_set_msr(vcpu
, vcpu
->arch
.gpr
[rs
]);
277 emulated
= kvmppc_handle_store(run
, vcpu
,
282 case 163: /* wrteei */
283 vcpu
->arch
.msr
= (vcpu
->arch
.msr
& ~MSR_EE
)
289 emulated
= kvmppc_handle_store(run
, vcpu
,
294 case 247: /* stbux */
299 ea
= vcpu
->arch
.gpr
[rb
];
301 ea
+= vcpu
->arch
.gpr
[ra
];
303 emulated
= kvmppc_handle_store(run
, vcpu
,
306 vcpu
->arch
.gpr
[rs
] = ea
;
311 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 2, 1);
314 case 311: /* lhzux */
319 ea
= vcpu
->arch
.gpr
[rb
];
321 ea
+= vcpu
->arch
.gpr
[ra
];
323 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 2, 1);
324 vcpu
->arch
.gpr
[ra
] = ea
;
327 case 323: /* mfdcr */
328 dcrn
= get_dcrn(inst
);
331 /* The guest may access CPR0 registers to determine the timebase
332 * frequency, and it must know the real host frequency because it
333 * can directly access the timebase registers.
335 * It would be possible to emulate those accesses in userspace,
336 * but userspace can really only figure out the end frequency.
337 * We could decompose that into the factors that compute it, but
338 * that's tricky math, and it's easier to just report the real
342 case DCRN_CPR0_CONFIG_ADDR
:
343 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.cpr0_cfgaddr
;
345 case DCRN_CPR0_CONFIG_DATA
:
347 mtdcr(DCRN_CPR0_CONFIG_ADDR
,
348 vcpu
->arch
.cpr0_cfgaddr
);
349 vcpu
->arch
.gpr
[rt
] = mfdcr(DCRN_CPR0_CONFIG_DATA
);
353 run
->dcr
.dcrn
= dcrn
;
355 run
->dcr
.is_write
= 0;
356 vcpu
->arch
.io_gpr
= rt
;
357 vcpu
->arch
.dcr_needed
= 1;
358 emulated
= EMULATE_DO_DCR
;
363 case 339: /* mfspr */
364 sprn
= get_sprn(inst
);
369 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.srr0
; break;
371 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.srr1
; break;
373 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.mmucr
; break;
375 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.pid
; break;
377 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivpr
; break;
379 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ccr0
; break;
381 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ccr1
; break;
383 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.pvr
; break;
385 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.dear
; break;
387 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.esr
; break;
389 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.dbcr0
; break;
391 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.dbcr1
; break;
393 /* Note: mftb and TBRL/TBWL are user-accessible, so
394 * the guest can always access the real TB anyways.
395 * In fact, we probably will never see these traps. */
397 vcpu
->arch
.gpr
[rt
] = mftbl(); break;
399 vcpu
->arch
.gpr
[rt
] = mftbu(); break;
402 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.sprg0
; break;
404 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.sprg1
; break;
406 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.sprg2
; break;
408 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.sprg3
; break;
409 /* Note: SPRG4-7 are user-readable, so we don't get
413 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[0]; break;
415 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[1]; break;
417 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[2]; break;
419 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[3]; break;
421 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[4]; break;
423 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[5]; break;
425 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[6]; break;
427 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[7]; break;
429 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[8]; break;
431 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[9]; break;
433 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[10]; break;
435 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[11]; break;
437 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[12]; break;
439 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[13]; break;
441 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[14]; break;
443 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[15]; break;
446 printk("mfspr: unknown spr %x\n", sprn
);
447 vcpu
->arch
.gpr
[rt
] = 0;
457 emulated
= kvmppc_handle_store(run
, vcpu
,
462 case 439: /* sthux */
467 ea
= vcpu
->arch
.gpr
[rb
];
469 ea
+= vcpu
->arch
.gpr
[ra
];
471 emulated
= kvmppc_handle_store(run
, vcpu
,
474 vcpu
->arch
.gpr
[ra
] = ea
;
477 case 451: /* mtdcr */
478 dcrn
= get_dcrn(inst
);
481 /* emulate some access in kernel */
483 case DCRN_CPR0_CONFIG_ADDR
:
484 vcpu
->arch
.cpr0_cfgaddr
= vcpu
->arch
.gpr
[rs
];
487 run
->dcr
.dcrn
= dcrn
;
488 run
->dcr
.data
= vcpu
->arch
.gpr
[rs
];
489 run
->dcr
.is_write
= 1;
490 vcpu
->arch
.dcr_needed
= 1;
491 emulated
= EMULATE_DO_DCR
;
496 case 467: /* mtspr */
497 sprn
= get_sprn(inst
);
501 vcpu
->arch
.srr0
= vcpu
->arch
.gpr
[rs
]; break;
503 vcpu
->arch
.srr1
= vcpu
->arch
.gpr
[rs
]; break;
505 vcpu
->arch
.mmucr
= vcpu
->arch
.gpr
[rs
]; break;
507 vcpu
->arch
.pid
= vcpu
->arch
.gpr
[rs
]; break;
509 vcpu
->arch
.ccr0
= vcpu
->arch
.gpr
[rs
]; break;
511 vcpu
->arch
.ccr1
= vcpu
->arch
.gpr
[rs
]; break;
513 vcpu
->arch
.dear
= vcpu
->arch
.gpr
[rs
]; break;
515 vcpu
->arch
.esr
= vcpu
->arch
.gpr
[rs
]; break;
517 vcpu
->arch
.dbcr0
= vcpu
->arch
.gpr
[rs
]; break;
519 vcpu
->arch
.dbcr1
= vcpu
->arch
.gpr
[rs
]; break;
521 /* XXX We need to context-switch the timebase for
522 * watchdog and FIT. */
523 case SPRN_TBWL
: break;
524 case SPRN_TBWU
: break;
527 vcpu
->arch
.dec
= vcpu
->arch
.gpr
[rs
];
528 kvmppc_emulate_dec(vcpu
);
532 vcpu
->arch
.tsr
&= ~vcpu
->arch
.gpr
[rs
]; break;
535 vcpu
->arch
.tcr
= vcpu
->arch
.gpr
[rs
];
536 kvmppc_emulate_dec(vcpu
);
540 vcpu
->arch
.sprg0
= vcpu
->arch
.gpr
[rs
]; break;
542 vcpu
->arch
.sprg1
= vcpu
->arch
.gpr
[rs
]; break;
544 vcpu
->arch
.sprg2
= vcpu
->arch
.gpr
[rs
]; break;
546 vcpu
->arch
.sprg3
= vcpu
->arch
.gpr
[rs
]; break;
548 /* Note: SPRG4-7 are user-readable. These values are
549 * loaded into the real SPRGs when resuming the
552 vcpu
->arch
.sprg4
= vcpu
->arch
.gpr
[rs
]; break;
554 vcpu
->arch
.sprg5
= vcpu
->arch
.gpr
[rs
]; break;
556 vcpu
->arch
.sprg6
= vcpu
->arch
.gpr
[rs
]; break;
558 vcpu
->arch
.sprg7
= vcpu
->arch
.gpr
[rs
]; break;
561 vcpu
->arch
.ivpr
= vcpu
->arch
.gpr
[rs
]; break;
563 vcpu
->arch
.ivor
[0] = vcpu
->arch
.gpr
[rs
]; break;
565 vcpu
->arch
.ivor
[1] = vcpu
->arch
.gpr
[rs
]; break;
567 vcpu
->arch
.ivor
[2] = vcpu
->arch
.gpr
[rs
]; break;
569 vcpu
->arch
.ivor
[3] = vcpu
->arch
.gpr
[rs
]; break;
571 vcpu
->arch
.ivor
[4] = vcpu
->arch
.gpr
[rs
]; break;
573 vcpu
->arch
.ivor
[5] = vcpu
->arch
.gpr
[rs
]; break;
575 vcpu
->arch
.ivor
[6] = vcpu
->arch
.gpr
[rs
]; break;
577 vcpu
->arch
.ivor
[7] = vcpu
->arch
.gpr
[rs
]; break;
579 vcpu
->arch
.ivor
[8] = vcpu
->arch
.gpr
[rs
]; break;
581 vcpu
->arch
.ivor
[9] = vcpu
->arch
.gpr
[rs
]; break;
583 vcpu
->arch
.ivor
[10] = vcpu
->arch
.gpr
[rs
]; break;
585 vcpu
->arch
.ivor
[11] = vcpu
->arch
.gpr
[rs
]; break;
587 vcpu
->arch
.ivor
[12] = vcpu
->arch
.gpr
[rs
]; break;
589 vcpu
->arch
.ivor
[13] = vcpu
->arch
.gpr
[rs
]; break;
591 vcpu
->arch
.ivor
[14] = vcpu
->arch
.gpr
[rs
]; break;
593 vcpu
->arch
.ivor
[15] = vcpu
->arch
.gpr
[rs
]; break;
596 printk("mtspr: unknown spr %x\n", sprn
);
597 emulated
= EMULATE_FAIL
;
603 /* Do nothing. The guest is performing dcbi because
604 * hardware DMA is not snooped by the dcache, but
605 * emulated DMA either goes through the dcache as
606 * normal writes, or the host kernel has handled dcache
610 case 534: /* lwbrx */
612 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 4, 0);
615 case 566: /* tlbsync */
618 case 662: /* stwbrx */
623 emulated
= kvmppc_handle_store(run
, vcpu
,
628 case 978: /* tlbwe */
629 emulated
= kvmppc_emul_tlbwe(vcpu
, inst
);
632 case 914: { /* tlbsx */
634 unsigned int as
= get_mmucr_sts(vcpu
);
635 unsigned int pid
= get_mmucr_stid(vcpu
);
642 ea
= vcpu
->arch
.gpr
[rb
];
644 ea
+= vcpu
->arch
.gpr
[ra
];
646 index
= kvmppc_44x_tlb_index(vcpu
, ea
, pid
, as
);
649 vcpu
->arch
.cr
&= ~0x20000000;
651 vcpu
->arch
.cr
|= 0x20000000;
653 vcpu
->arch
.gpr
[rt
] = index
;
658 case 790: /* lhbrx */
660 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 2, 0);
663 case 918: /* sthbrx */
668 emulated
= kvmppc_handle_store(run
, vcpu
,
673 case 966: /* iccci */
677 printk("unknown: op %d xop %d\n", get_op(inst
),
679 emulated
= EMULATE_FAIL
;
686 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 4, 1);
692 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 4, 1);
693 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
698 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 1, 1);
704 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 1, 1);
705 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
710 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
717 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
719 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
724 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
731 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
733 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
738 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 2, 1);
744 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 2, 1);
745 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
750 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
757 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
759 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
763 printk("unknown op %d\n", get_op(inst
));
764 emulated
= EMULATE_FAIL
;
769 vcpu
->arch
.pc
+= 4; /* Advance past emulated instruction. */