2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License, version 2, as
4 * published by the Free Software Foundation.
6 * This program is distributed in the hope that it will be useful,
7 * but WITHOUT ANY WARRANTY; without even the implied warranty of
8 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
9 * GNU General Public License for more details.
11 * You should have received a copy of the GNU General Public License
12 * along with this program; if not, write to the Free Software
13 * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
15 * Copyright IBM Corp. 2007
17 * Authors: Hollis Blanchard <hollisb@us.ibm.com>
20 #include <linux/jiffies.h>
21 #include <linux/timer.h>
22 #include <linux/types.h>
23 #include <linux/string.h>
24 #include <linux/kvm_host.h>
27 #include <asm/dcr-regs.h>
29 #include <asm/byteorder.h>
30 #include <asm/kvm_ppc.h>
34 /* Instruction decoding */
35 static inline unsigned int get_op(u32 inst
)
40 static inline unsigned int get_xop(u32 inst
)
42 return (inst
>> 1) & 0x3ff;
45 static inline unsigned int get_sprn(u32 inst
)
47 return ((inst
>> 16) & 0x1f) | ((inst
>> 6) & 0x3e0);
50 static inline unsigned int get_dcrn(u32 inst
)
52 return ((inst
>> 16) & 0x1f) | ((inst
>> 6) & 0x3e0);
55 static inline unsigned int get_rt(u32 inst
)
57 return (inst
>> 21) & 0x1f;
60 static inline unsigned int get_rs(u32 inst
)
62 return (inst
>> 21) & 0x1f;
65 static inline unsigned int get_ra(u32 inst
)
67 return (inst
>> 16) & 0x1f;
70 static inline unsigned int get_rb(u32 inst
)
72 return (inst
>> 11) & 0x1f;
75 static inline unsigned int get_rc(u32 inst
)
80 static inline unsigned int get_ws(u32 inst
)
82 return (inst
>> 11) & 0x1f;
85 static inline unsigned int get_d(u32 inst
)
90 static int tlbe_is_host_safe(const struct kvm_vcpu
*vcpu
,
91 const struct tlbe
*tlbe
)
98 /* Does it match current guest AS? */
99 /* XXX what about IS != DS? */
100 if (get_tlb_ts(tlbe
) != !!(vcpu
->arch
.msr
& MSR_IS
))
103 gpa
= get_tlb_raddr(tlbe
);
104 if (!gfn_to_memslot(vcpu
->kvm
, gpa
>> PAGE_SHIFT
))
105 /* Mapping is not for RAM. */
111 static int kvmppc_emul_tlbwe(struct kvm_vcpu
*vcpu
, u32 inst
)
127 index
= vcpu
->arch
.gpr
[ra
];
128 if (index
> PPC44x_TLB_SIZE
) {
129 printk("%s: index %d\n", __func__
, index
);
130 kvmppc_dump_vcpu(vcpu
);
134 tlbe
= &vcpu
->arch
.guest_tlb
[index
];
136 /* Invalidate shadow mappings for the about-to-be-clobbered TLBE. */
137 if (tlbe
->word0
& PPC44x_TLB_VALID
) {
138 eaddr
= get_tlb_eaddr(tlbe
);
139 asid
= (tlbe
->word0
& PPC44x_TLB_TS
) | tlbe
->tid
;
140 kvmppc_mmu_invalidate(vcpu
, eaddr
, get_tlb_end(tlbe
), asid
);
144 case PPC44x_TLB_PAGEID
:
145 tlbe
->tid
= vcpu
->arch
.mmucr
& 0xff;
146 tlbe
->word0
= vcpu
->arch
.gpr
[rs
];
149 case PPC44x_TLB_XLAT
:
150 tlbe
->word1
= vcpu
->arch
.gpr
[rs
];
153 case PPC44x_TLB_ATTRIB
:
154 tlbe
->word2
= vcpu
->arch
.gpr
[rs
];
161 if (tlbe_is_host_safe(vcpu
, tlbe
)) {
162 eaddr
= get_tlb_eaddr(tlbe
);
163 raddr
= get_tlb_raddr(tlbe
);
164 asid
= (tlbe
->word0
& PPC44x_TLB_TS
) | tlbe
->tid
;
165 flags
= tlbe
->word2
& 0xffff;
167 /* Create a 4KB mapping on the host. If the guest wanted a
168 * large page, only the first 4KB is mapped here and the rest
169 * are mapped on the fly. */
170 kvmppc_mmu_map(vcpu
, eaddr
, raddr
>> PAGE_SHIFT
, asid
, flags
);
173 KVMTRACE_5D(GTLB_WRITE
, vcpu
, index
,
174 tlbe
->tid
, tlbe
->word0
, tlbe
->word1
, tlbe
->word2
,
180 static void kvmppc_emulate_dec(struct kvm_vcpu
*vcpu
)
182 if (vcpu
->arch
.tcr
& TCR_DIE
) {
183 /* The decrementer ticks at the same rate as the timebase, so
184 * that's how we convert the guest DEC value to the number of
186 unsigned long nr_jiffies
;
188 nr_jiffies
= vcpu
->arch
.dec
/ tb_ticks_per_jiffy
;
189 mod_timer(&vcpu
->arch
.dec_timer
,
190 get_jiffies_64() + nr_jiffies
);
192 del_timer(&vcpu
->arch
.dec_timer
);
196 static void kvmppc_emul_rfi(struct kvm_vcpu
*vcpu
)
198 vcpu
->arch
.pc
= vcpu
->arch
.srr0
;
199 kvmppc_set_msr(vcpu
, vcpu
->arch
.srr1
);
214 * XXX is_bigendian should depend on MMU mapping or MSR[LE]
216 int kvmppc_emulate_instruction(struct kvm_run
*run
, struct kvm_vcpu
*vcpu
)
218 u32 inst
= vcpu
->arch
.last_inst
;
227 enum emulation_result emulated
= EMULATE_DONE
;
230 switch (get_op(inst
)) {
233 kvmppc_queue_exception(vcpu
, BOOKE_INTERRUPT_PROGRAM
);
238 switch (get_xop(inst
)) {
240 kvmppc_emul_rfi(vcpu
);
245 emulated
= EMULATE_FAIL
;
251 switch (get_xop(inst
)) {
255 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 4, 1);
260 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.msr
;
265 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 1, 1);
268 case 131: /* wrtee */
270 vcpu
->arch
.msr
= (vcpu
->arch
.msr
& ~MSR_EE
)
271 | (vcpu
->arch
.gpr
[rs
] & MSR_EE
);
274 case 146: /* mtmsr */
276 kvmppc_set_msr(vcpu
, vcpu
->arch
.gpr
[rs
]);
281 emulated
= kvmppc_handle_store(run
, vcpu
,
286 case 163: /* wrteei */
287 vcpu
->arch
.msr
= (vcpu
->arch
.msr
& ~MSR_EE
)
293 emulated
= kvmppc_handle_store(run
, vcpu
,
298 case 247: /* stbux */
303 ea
= vcpu
->arch
.gpr
[rb
];
305 ea
+= vcpu
->arch
.gpr
[ra
];
307 emulated
= kvmppc_handle_store(run
, vcpu
,
310 vcpu
->arch
.gpr
[rs
] = ea
;
315 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 2, 1);
318 case 311: /* lhzux */
323 ea
= vcpu
->arch
.gpr
[rb
];
325 ea
+= vcpu
->arch
.gpr
[ra
];
327 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 2, 1);
328 vcpu
->arch
.gpr
[ra
] = ea
;
331 case 323: /* mfdcr */
332 dcrn
= get_dcrn(inst
);
335 /* The guest may access CPR0 registers to determine the timebase
336 * frequency, and it must know the real host frequency because it
337 * can directly access the timebase registers.
339 * It would be possible to emulate those accesses in userspace,
340 * but userspace can really only figure out the end frequency.
341 * We could decompose that into the factors that compute it, but
342 * that's tricky math, and it's easier to just report the real
346 case DCRN_CPR0_CONFIG_ADDR
:
347 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.cpr0_cfgaddr
;
349 case DCRN_CPR0_CONFIG_DATA
:
351 mtdcr(DCRN_CPR0_CONFIG_ADDR
,
352 vcpu
->arch
.cpr0_cfgaddr
);
353 vcpu
->arch
.gpr
[rt
] = mfdcr(DCRN_CPR0_CONFIG_DATA
);
357 run
->dcr
.dcrn
= dcrn
;
359 run
->dcr
.is_write
= 0;
360 vcpu
->arch
.io_gpr
= rt
;
361 vcpu
->arch
.dcr_needed
= 1;
362 emulated
= EMULATE_DO_DCR
;
367 case 339: /* mfspr */
368 sprn
= get_sprn(inst
);
373 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.srr0
; break;
375 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.srr1
; break;
377 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.mmucr
; break;
379 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.pid
; break;
381 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivpr
; break;
383 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ccr0
; break;
385 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ccr1
; break;
387 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.pvr
; break;
389 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.dear
; break;
391 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.esr
; break;
393 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.dbcr0
; break;
395 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.dbcr1
; break;
397 /* Note: mftb and TBRL/TBWL are user-accessible, so
398 * the guest can always access the real TB anyways.
399 * In fact, we probably will never see these traps. */
401 vcpu
->arch
.gpr
[rt
] = mftbl(); break;
403 vcpu
->arch
.gpr
[rt
] = mftbu(); break;
406 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.sprg0
; break;
408 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.sprg1
; break;
410 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.sprg2
; break;
412 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.sprg3
; break;
413 /* Note: SPRG4-7 are user-readable, so we don't get
417 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[0]; break;
419 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[1]; break;
421 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[2]; break;
423 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[3]; break;
425 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[4]; break;
427 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[5]; break;
429 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[6]; break;
431 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[7]; break;
433 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[8]; break;
435 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[9]; break;
437 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[10]; break;
439 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[11]; break;
441 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[12]; break;
443 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[13]; break;
445 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[14]; break;
447 vcpu
->arch
.gpr
[rt
] = vcpu
->arch
.ivor
[15]; break;
450 printk("mfspr: unknown spr %x\n", sprn
);
451 vcpu
->arch
.gpr
[rt
] = 0;
461 emulated
= kvmppc_handle_store(run
, vcpu
,
466 case 439: /* sthux */
471 ea
= vcpu
->arch
.gpr
[rb
];
473 ea
+= vcpu
->arch
.gpr
[ra
];
475 emulated
= kvmppc_handle_store(run
, vcpu
,
478 vcpu
->arch
.gpr
[ra
] = ea
;
481 case 451: /* mtdcr */
482 dcrn
= get_dcrn(inst
);
485 /* emulate some access in kernel */
487 case DCRN_CPR0_CONFIG_ADDR
:
488 vcpu
->arch
.cpr0_cfgaddr
= vcpu
->arch
.gpr
[rs
];
491 run
->dcr
.dcrn
= dcrn
;
492 run
->dcr
.data
= vcpu
->arch
.gpr
[rs
];
493 run
->dcr
.is_write
= 1;
494 vcpu
->arch
.dcr_needed
= 1;
495 emulated
= EMULATE_DO_DCR
;
500 case 467: /* mtspr */
501 sprn
= get_sprn(inst
);
505 vcpu
->arch
.srr0
= vcpu
->arch
.gpr
[rs
]; break;
507 vcpu
->arch
.srr1
= vcpu
->arch
.gpr
[rs
]; break;
509 vcpu
->arch
.mmucr
= vcpu
->arch
.gpr
[rs
]; break;
511 kvmppc_set_pid(vcpu
, vcpu
->arch
.gpr
[rs
]); break;
513 vcpu
->arch
.ccr0
= vcpu
->arch
.gpr
[rs
]; break;
515 vcpu
->arch
.ccr1
= vcpu
->arch
.gpr
[rs
]; break;
517 vcpu
->arch
.dear
= vcpu
->arch
.gpr
[rs
]; break;
519 vcpu
->arch
.esr
= vcpu
->arch
.gpr
[rs
]; break;
521 vcpu
->arch
.dbcr0
= vcpu
->arch
.gpr
[rs
]; break;
523 vcpu
->arch
.dbcr1
= vcpu
->arch
.gpr
[rs
]; break;
525 /* XXX We need to context-switch the timebase for
526 * watchdog and FIT. */
527 case SPRN_TBWL
: break;
528 case SPRN_TBWU
: break;
531 vcpu
->arch
.dec
= vcpu
->arch
.gpr
[rs
];
532 kvmppc_emulate_dec(vcpu
);
536 vcpu
->arch
.tsr
&= ~vcpu
->arch
.gpr
[rs
]; break;
539 vcpu
->arch
.tcr
= vcpu
->arch
.gpr
[rs
];
540 kvmppc_emulate_dec(vcpu
);
544 vcpu
->arch
.sprg0
= vcpu
->arch
.gpr
[rs
]; break;
546 vcpu
->arch
.sprg1
= vcpu
->arch
.gpr
[rs
]; break;
548 vcpu
->arch
.sprg2
= vcpu
->arch
.gpr
[rs
]; break;
550 vcpu
->arch
.sprg3
= vcpu
->arch
.gpr
[rs
]; break;
552 /* Note: SPRG4-7 are user-readable. These values are
553 * loaded into the real SPRGs when resuming the
556 vcpu
->arch
.sprg4
= vcpu
->arch
.gpr
[rs
]; break;
558 vcpu
->arch
.sprg5
= vcpu
->arch
.gpr
[rs
]; break;
560 vcpu
->arch
.sprg6
= vcpu
->arch
.gpr
[rs
]; break;
562 vcpu
->arch
.sprg7
= vcpu
->arch
.gpr
[rs
]; break;
565 vcpu
->arch
.ivpr
= vcpu
->arch
.gpr
[rs
]; break;
567 vcpu
->arch
.ivor
[0] = vcpu
->arch
.gpr
[rs
]; break;
569 vcpu
->arch
.ivor
[1] = vcpu
->arch
.gpr
[rs
]; break;
571 vcpu
->arch
.ivor
[2] = vcpu
->arch
.gpr
[rs
]; break;
573 vcpu
->arch
.ivor
[3] = vcpu
->arch
.gpr
[rs
]; break;
575 vcpu
->arch
.ivor
[4] = vcpu
->arch
.gpr
[rs
]; break;
577 vcpu
->arch
.ivor
[5] = vcpu
->arch
.gpr
[rs
]; break;
579 vcpu
->arch
.ivor
[6] = vcpu
->arch
.gpr
[rs
]; break;
581 vcpu
->arch
.ivor
[7] = vcpu
->arch
.gpr
[rs
]; break;
583 vcpu
->arch
.ivor
[8] = vcpu
->arch
.gpr
[rs
]; break;
585 vcpu
->arch
.ivor
[9] = vcpu
->arch
.gpr
[rs
]; break;
587 vcpu
->arch
.ivor
[10] = vcpu
->arch
.gpr
[rs
]; break;
589 vcpu
->arch
.ivor
[11] = vcpu
->arch
.gpr
[rs
]; break;
591 vcpu
->arch
.ivor
[12] = vcpu
->arch
.gpr
[rs
]; break;
593 vcpu
->arch
.ivor
[13] = vcpu
->arch
.gpr
[rs
]; break;
595 vcpu
->arch
.ivor
[14] = vcpu
->arch
.gpr
[rs
]; break;
597 vcpu
->arch
.ivor
[15] = vcpu
->arch
.gpr
[rs
]; break;
600 printk("mtspr: unknown spr %x\n", sprn
);
601 emulated
= EMULATE_FAIL
;
607 /* Do nothing. The guest is performing dcbi because
608 * hardware DMA is not snooped by the dcache, but
609 * emulated DMA either goes through the dcache as
610 * normal writes, or the host kernel has handled dcache
614 case 534: /* lwbrx */
616 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 4, 0);
619 case 566: /* tlbsync */
622 case 662: /* stwbrx */
627 emulated
= kvmppc_handle_store(run
, vcpu
,
632 case 978: /* tlbwe */
633 emulated
= kvmppc_emul_tlbwe(vcpu
, inst
);
636 case 914: { /* tlbsx */
638 unsigned int as
= get_mmucr_sts(vcpu
);
639 unsigned int pid
= get_mmucr_stid(vcpu
);
646 ea
= vcpu
->arch
.gpr
[rb
];
648 ea
+= vcpu
->arch
.gpr
[ra
];
650 index
= kvmppc_44x_tlb_index(vcpu
, ea
, pid
, as
);
653 vcpu
->arch
.cr
&= ~0x20000000;
655 vcpu
->arch
.cr
|= 0x20000000;
657 vcpu
->arch
.gpr
[rt
] = index
;
662 case 790: /* lhbrx */
664 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 2, 0);
667 case 918: /* sthbrx */
672 emulated
= kvmppc_handle_store(run
, vcpu
,
677 case 966: /* iccci */
681 printk("unknown: op %d xop %d\n", get_op(inst
),
683 emulated
= EMULATE_FAIL
;
690 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 4, 1);
696 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 4, 1);
697 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
702 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 1, 1);
708 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 1, 1);
709 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
714 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
721 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
723 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
728 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
735 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
737 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
742 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 2, 1);
748 emulated
= kvmppc_handle_load(run
, vcpu
, rt
, 2, 1);
749 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
754 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
761 emulated
= kvmppc_handle_store(run
, vcpu
, vcpu
->arch
.gpr
[rs
],
763 vcpu
->arch
.gpr
[ra
] = vcpu
->arch
.paddr_accessed
;
767 printk("unknown op %d\n", get_op(inst
));
768 emulated
= EMULATE_FAIL
;
772 KVMTRACE_3D(PPC_INSTR
, vcpu
, inst
, vcpu
->arch
.pc
, emulated
, entryexit
);
775 vcpu
->arch
.pc
+= 4; /* Advance past emulated instruction. */