[deliverable/linux.git] / arch / powerpc / kvm / 44x_tlb.c

/*
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License, version 2, as
 * published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 *
 * Copyright IBM Corp. 2007
 *
 * Authors: Hollis Blanchard <hollisb@us.ibm.com>
 */

#include <linux/types.h>
#include <linux/string.h>
#include <linux/kvm.h>
#include <linux/kvm_host.h>
#include <linux/highmem.h>

#include <asm/tlbflush.h>
#include <asm/mmu-44x.h>
#include <asm/kvm_ppc.h>
#include <asm/kvm_44x.h>
#include "timing.h"

#include "44x_tlb.h"
#include "trace.h"

#ifndef PPC44x_TLBE_SIZE
#define PPC44x_TLBE_SIZE	PPC44x_TLB_4K
#endif

#define PAGE_SIZE_4K (1<<12)
#define PAGE_MASK_4K (~(PAGE_SIZE_4K - 1))

#define PPC44x_TLB_UATTR_MASK \
	(PPC44x_TLB_U0|PPC44x_TLB_U1|PPC44x_TLB_U2|PPC44x_TLB_U3)
#define PPC44x_TLB_USER_PERM_MASK (PPC44x_TLB_UX|PPC44x_TLB_UR|PPC44x_TLB_UW)
#define PPC44x_TLB_SUPER_PERM_MASK (PPC44x_TLB_SX|PPC44x_TLB_SR|PPC44x_TLB_SW)

#ifdef DEBUG
void kvmppc_dump_tlbs(struct kvm_vcpu *vcpu)
{
	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	struct kvmppc_44x_tlbe *tlbe;
	int i;

	printk("vcpu %d TLB dump:\n", vcpu->vcpu_id);
	printk("| %2s | %3s | %8s | %8s | %8s |\n",
			"nr", "tid", "word0", "word1", "word2");

	for (i = 0; i < ARRAY_SIZE(vcpu_44x->guest_tlb); i++) {
		tlbe = &vcpu_44x->guest_tlb[i];
		if (tlbe->word0 & PPC44x_TLB_VALID)
			printk(" G%2d |  %02X | %08X | %08X | %08X |\n",
			       i, tlbe->tid, tlbe->word0, tlbe->word1,
			       tlbe->word2);
	}
}
#endif

static inline void kvmppc_44x_tlbie(unsigned int index)
{
	/* 0 <= index < 64, so the V bit is clear and we can use the index as
	 * word0. */
	asm volatile(
		"tlbwe %[index], %[index], 0\n"
	:
	: [index] "r"(index)
	);
}

static inline void kvmppc_44x_tlbre(unsigned int index,
                                    struct kvmppc_44x_tlbe *tlbe)
{
	asm volatile(
		"tlbre %[word0], %[index], 0\n"
		"mfspr %[tid], %[sprn_mmucr]\n"
		"andi. %[tid], %[tid], 0xff\n"
		"tlbre %[word1], %[index], 1\n"
		"tlbre %[word2], %[index], 2\n"
		: [word0] "=r"(tlbe->word0),
		  [word1] "=r"(tlbe->word1),
		  [word2] "=r"(tlbe->word2),
		  [tid]   "=r"(tlbe->tid)
		: [index] "r"(index),
		  [sprn_mmucr] "i"(SPRN_MMUCR)
		: "cc"
	);
}

static inline void kvmppc_44x_tlbwe(unsigned int index,
                                    struct kvmppc_44x_tlbe *stlbe)
{
	unsigned long tmp;

	asm volatile(
		"mfspr %[tmp], %[sprn_mmucr]\n"
		"rlwimi %[tmp], %[tid], 0, 0xff\n"
		"mtspr %[sprn_mmucr], %[tmp]\n"
		"tlbwe %[word0], %[index], 0\n"
		"tlbwe %[word1], %[index], 1\n"
		"tlbwe %[word2], %[index], 2\n"
		: [tmp]   "=&r"(tmp)
		: [word0] "r"(stlbe->word0),
		  [word1] "r"(stlbe->word1),
		  [word2] "r"(stlbe->word2),
		  [tid]   "r"(stlbe->tid),
		  [index] "r"(index),
		  [sprn_mmucr] "i"(SPRN_MMUCR)
	);
}

static u32 kvmppc_44x_tlb_shadow_attrib(u32 attrib, int usermode)
{
	/* We only care about the guest's permission and user bits. */
	attrib &= PPC44x_TLB_PERM_MASK|PPC44x_TLB_UATTR_MASK;

	if (!usermode) {
		/* Guest is in supervisor mode, so we need to translate guest
		 * supervisor permissions into user permissions. */
		attrib &= ~PPC44x_TLB_USER_PERM_MASK;
		attrib |= (attrib & PPC44x_TLB_SUPER_PERM_MASK) << 3;
	}

	/* Make sure host can always access this memory. */
	attrib |= PPC44x_TLB_SX|PPC44x_TLB_SR|PPC44x_TLB_SW;

	/* WIMGE = 0b00100 */
	attrib |= PPC44x_TLB_M;

	return attrib;
}

/* Load shadow TLB back into hardware. */
void kvmppc_44x_tlb_load(struct kvm_vcpu *vcpu)
{
	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	int i;

	for (i = 0; i <= tlb_44x_hwater; i++) {
		struct kvmppc_44x_tlbe *stlbe = &vcpu_44x->shadow_tlb[i];

		if (get_tlb_v(stlbe) && get_tlb_ts(stlbe))
			kvmppc_44x_tlbwe(i, stlbe);
	}
}

static void kvmppc_44x_tlbe_set_modified(struct kvmppc_vcpu_44x *vcpu_44x,
                                         unsigned int i)
{
	vcpu_44x->shadow_tlb_mod[i] = 1;
}

/* Save hardware TLB to the vcpu, and invalidate all guest mappings. */
void kvmppc_44x_tlb_put(struct kvm_vcpu *vcpu)
{
	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	int i;

	for (i = 0; i <= tlb_44x_hwater; i++) {
		struct kvmppc_44x_tlbe *stlbe = &vcpu_44x->shadow_tlb[i];

		if (vcpu_44x->shadow_tlb_mod[i])
			kvmppc_44x_tlbre(i, stlbe);

		if (get_tlb_v(stlbe) && get_tlb_ts(stlbe))
			kvmppc_44x_tlbie(i);
	}
}


/* Search the guest TLB for a matching entry. */
int kvmppc_44x_tlb_index(struct kvm_vcpu *vcpu, gva_t eaddr, unsigned int pid,
                         unsigned int as)
{
	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	int i;

	/* XXX Replace loop with fancy data structures. */
	for (i = 0; i < ARRAY_SIZE(vcpu_44x->guest_tlb); i++) {
		struct kvmppc_44x_tlbe *tlbe = &vcpu_44x->guest_tlb[i];
		unsigned int tid;

		if (eaddr < get_tlb_eaddr(tlbe))
			continue;

		if (eaddr > get_tlb_end(tlbe))
			continue;

		tid = get_tlb_tid(tlbe);
		if (tid && (tid != pid))
			continue;

		if (!get_tlb_v(tlbe))
			continue;

		if (get_tlb_ts(tlbe) != as)
			continue;

		return i;
	}

	return -1;
}

gpa_t kvmppc_mmu_xlate(struct kvm_vcpu *vcpu, unsigned int gtlb_index,
                       gva_t eaddr)
{
	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	struct kvmppc_44x_tlbe *gtlbe = &vcpu_44x->guest_tlb[gtlb_index];
	unsigned int pgmask = get_tlb_bytes(gtlbe) - 1;

	return get_tlb_raddr(gtlbe) | (eaddr & pgmask);
}

int kvmppc_mmu_itlb_index(struct kvm_vcpu *vcpu, gva_t eaddr)
{
	unsigned int as = !!(vcpu->arch.shared->msr & MSR_IS);

	return kvmppc_44x_tlb_index(vcpu, eaddr, vcpu->arch.pid, as);
}

int kvmppc_mmu_dtlb_index(struct kvm_vcpu *vcpu, gva_t eaddr)
{
	unsigned int as = !!(vcpu->arch.shared->msr & MSR_DS);

	return kvmppc_44x_tlb_index(vcpu, eaddr, vcpu->arch.pid, as);
}

void kvmppc_mmu_itlb_miss(struct kvm_vcpu *vcpu)
{
}

void kvmppc_mmu_dtlb_miss(struct kvm_vcpu *vcpu)
{
}

static void kvmppc_44x_shadow_release(struct kvmppc_vcpu_44x *vcpu_44x,
                                      unsigned int stlb_index)
{
	struct kvmppc_44x_shadow_ref *ref = &vcpu_44x->shadow_refs[stlb_index];

	if (!ref->page)
		return;

	/* Discard from the TLB. */
	/* Note: we could actually invalidate a host mapping, if the host overwrote
	 * this TLB entry since we inserted a guest mapping. */
	kvmppc_44x_tlbie(stlb_index);

	/* Now release the page. */
	if (ref->writeable)
		kvm_release_page_dirty(ref->page);
	else
		kvm_release_page_clean(ref->page);

	ref->page = NULL;

	/* XXX set tlb_44x_index to stlb_index? */

	trace_kvm_stlb_inval(stlb_index);
}

void kvmppc_mmu_destroy(struct kvm_vcpu *vcpu)
{
	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	int i;

	for (i = 0; i <= tlb_44x_hwater; i++)
		kvmppc_44x_shadow_release(vcpu_44x, i);
}

/**
 * kvmppc_mmu_map -- create a host mapping for guest memory
 *
 * If the guest wanted a larger page than the host supports, only the first
 * host page is mapped here and the rest are demand faulted.
 *
 * If the guest wanted a smaller page than the host page size, we map only the
 * guest-size page (i.e. not a full host page mapping).
 *
 * Caller must ensure that the specified guest TLB entry is safe to insert into
 * the shadow TLB.
 */
void kvmppc_mmu_map(struct kvm_vcpu *vcpu, u64 gvaddr, gpa_t gpaddr,
                    unsigned int gtlb_index)
{
	struct kvmppc_44x_tlbe stlbe;
	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	struct kvmppc_44x_tlbe *gtlbe = &vcpu_44x->guest_tlb[gtlb_index];
	struct kvmppc_44x_shadow_ref *ref;
	struct page *new_page;
	hpa_t hpaddr;
	gfn_t gfn;
	u32 asid = gtlbe->tid;
	u32 flags = gtlbe->word2;
	u32 max_bytes = get_tlb_bytes(gtlbe);
	unsigned int victim;

	/* Select TLB entry to clobber. Indirectly guard against races with the TLB
	 * miss handler by disabling interrupts. */
	local_irq_disable();
	victim = ++tlb_44x_index;
	if (victim > tlb_44x_hwater)
		victim = 0;
	tlb_44x_index = victim;
	local_irq_enable();

	/* Get reference to new page. */
	gfn = gpaddr >> PAGE_SHIFT;
	new_page = gfn_to_page(vcpu->kvm, gfn);
	if (is_error_page(new_page)) {
		printk(KERN_ERR "Couldn't get guest page for gfn %llx!\n",
			(unsigned long long)gfn);
		return;
	}
	hpaddr = page_to_phys(new_page);

	/* Invalidate any previous shadow mappings. */
	kvmppc_44x_shadow_release(vcpu_44x, victim);

	/* XXX Make sure (va, size) doesn't overlap any other
	 * entries. 440x6 user manual says the result would be
	 * "undefined." */

	/* XXX what about AS? */

	/* Force TS=1 for all guest mappings. */
	stlbe.word0 = PPC44x_TLB_VALID | PPC44x_TLB_TS;

	if (max_bytes >= PAGE_SIZE) {
		/* Guest mapping is larger than or equal to host page size. We can use
		 * a "native" host mapping. */
		stlbe.word0 |= (gvaddr & PAGE_MASK) | PPC44x_TLBE_SIZE;
	} else {
		/* Guest mapping is smaller than host page size. We must restrict the
		 * size of the mapping to be at most the smaller of the two, but for
		 * simplicity we fall back to a 4K mapping (this is probably what the
		 * guest is using anyways). */
		stlbe.word0 |= (gvaddr & PAGE_MASK_4K) | PPC44x_TLB_4K;

		/* 'hpaddr' is a host page, which is larger than the mapping we're
		 * inserting here. To compensate, we must add the in-page offset to the
		 * sub-page. */
		hpaddr |= gpaddr & (PAGE_MASK ^ PAGE_MASK_4K);
	}

	stlbe.word1 = (hpaddr & 0xfffffc00) | ((hpaddr >> 32) & 0xf);
	stlbe.word2 = kvmppc_44x_tlb_shadow_attrib(flags,
	                                            vcpu->arch.shared->msr & MSR_PR);
	stlbe.tid = !(asid & 0xff);

	/* Keep track of the reference so we can properly release it later. */
	ref = &vcpu_44x->shadow_refs[victim];
	ref->page = new_page;
	ref->gtlb_index = gtlb_index;
	ref->writeable = !!(stlbe.word2 & PPC44x_TLB_UW);
	ref->tid = stlbe.tid;

	/* Insert shadow mapping into hardware TLB. */
	kvmppc_44x_tlbe_set_modified(vcpu_44x, victim);
	kvmppc_44x_tlbwe(victim, &stlbe);
	trace_kvm_stlb_write(victim, stlbe.tid, stlbe.word0, stlbe.word1,
			     stlbe.word2);
}

/* For a particular guest TLB entry, invalidate the corresponding host TLB
 * mappings and release the host pages. */
static void kvmppc_44x_invalidate(struct kvm_vcpu *vcpu,
                                  unsigned int gtlb_index)
{
	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	int i;

	for (i = 0; i < ARRAY_SIZE(vcpu_44x->shadow_refs); i++) {
		struct kvmppc_44x_shadow_ref *ref = &vcpu_44x->shadow_refs[i];
		if (ref->gtlb_index == gtlb_index)
			kvmppc_44x_shadow_release(vcpu_44x, i);
	}
}

void kvmppc_mmu_msr_notify(struct kvm_vcpu *vcpu, u32 old_msr)
{
	int usermode = vcpu->arch.shared->msr & MSR_PR;

	vcpu->arch.shadow_pid = !usermode;
}

void kvmppc_set_pid(struct kvm_vcpu *vcpu, u32 new_pid)
{
	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	int i;

	if (unlikely(vcpu->arch.pid == new_pid))
		return;

	vcpu->arch.pid = new_pid;

	/* Guest userspace runs with TID=0 mappings and PID=0, to make sure it
	 * can't access guest kernel mappings (TID=1). When we switch to a new
	 * guest PID, which will also use host PID=0, we must discard the old guest
	 * userspace mappings. */
	for (i = 0; i < ARRAY_SIZE(vcpu_44x->shadow_refs); i++) {
		struct kvmppc_44x_shadow_ref *ref = &vcpu_44x->shadow_refs[i];

		if (ref->tid == 0)
			kvmppc_44x_shadow_release(vcpu_44x, i);
	}
}

static int tlbe_is_host_safe(const struct kvm_vcpu *vcpu,
                             const struct kvmppc_44x_tlbe *tlbe)
{
	gpa_t gpa;

	if (!get_tlb_v(tlbe))
		return 0;

	/* Does it match current guest AS? */
	/* XXX what about IS != DS? */
	if (get_tlb_ts(tlbe) != !!(vcpu->arch.shared->msr & MSR_IS))
		return 0;

	gpa = get_tlb_raddr(tlbe);
	if (!gfn_to_memslot(vcpu->kvm, gpa >> PAGE_SHIFT))
		/* Mapping is not for RAM. */
		return 0;

	return 1;
}

int kvmppc_44x_emul_tlbwe(struct kvm_vcpu *vcpu, u8 ra, u8 rs, u8 ws)
{
	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	struct kvmppc_44x_tlbe *tlbe;
	unsigned int gtlb_index;

	gtlb_index = kvmppc_get_gpr(vcpu, ra);
	if (gtlb_index >= KVM44x_GUEST_TLB_SIZE) {
		printk("%s: index %d\n", __func__, gtlb_index);
		kvmppc_dump_vcpu(vcpu);
		return EMULATE_FAIL;
	}

	tlbe = &vcpu_44x->guest_tlb[gtlb_index];

	/* Invalidate shadow mappings for the about-to-be-clobbered TLB entry. */
	if (tlbe->word0 & PPC44x_TLB_VALID)
		kvmppc_44x_invalidate(vcpu, gtlb_index);

	switch (ws) {
	case PPC44x_TLB_PAGEID:
		tlbe->tid = get_mmucr_stid(vcpu);
		tlbe->word0 = kvmppc_get_gpr(vcpu, rs);
		break;

	case PPC44x_TLB_XLAT:
		tlbe->word1 = kvmppc_get_gpr(vcpu, rs);
		break;

	case PPC44x_TLB_ATTRIB:
		tlbe->word2 = kvmppc_get_gpr(vcpu, rs);
		break;

	default:
		return EMULATE_FAIL;
	}

	if (tlbe_is_host_safe(vcpu, tlbe)) {
		gva_t eaddr;
		gpa_t gpaddr;
		u32 bytes;

		eaddr = get_tlb_eaddr(tlbe);
		gpaddr = get_tlb_raddr(tlbe);

		/* Use the advertised page size to mask effective and real addrs. */
		bytes = get_tlb_bytes(tlbe);
		eaddr &= ~(bytes - 1);
		gpaddr &= ~(bytes - 1);

		kvmppc_mmu_map(vcpu, eaddr, gpaddr, gtlb_index);
	}

	trace_kvm_gtlb_write(gtlb_index, tlbe->tid, tlbe->word0, tlbe->word1,
			     tlbe->word2);

	kvmppc_set_exit_type(vcpu, EMULATED_TLBWE_EXITS);
	return EMULATE_DONE;
}

int kvmppc_44x_emul_tlbsx(struct kvm_vcpu *vcpu, u8 rt, u8 ra, u8 rb, u8 rc)
{
	u32 ea;
	int gtlb_index;
	unsigned int as = get_mmucr_sts(vcpu);
	unsigned int pid = get_mmucr_stid(vcpu);

	ea = kvmppc_get_gpr(vcpu, rb);
	if (ra)
		ea += kvmppc_get_gpr(vcpu, ra);

	gtlb_index = kvmppc_44x_tlb_index(vcpu, ea, pid, as);
	if (rc) {
		u32 cr = kvmppc_get_cr(vcpu);

		if (gtlb_index < 0)
			kvmppc_set_cr(vcpu, cr & ~0x20000000);
		else
			kvmppc_set_cr(vcpu, cr | 0x20000000);
	}
	kvmppc_set_gpr(vcpu, rt, gtlb_index);

	kvmppc_set_exit_type(vcpu, EMULATED_TLBSX_EXITS);
	return EMULATE_DONE;
}
Commit	Line	Data
bbf45ba5 HB	1	/*
	2	* This program is free software; you can redistribute it and/or modify
	3	* it under the terms of the GNU General Public License, version 2, as
	4	* published by the Free Software Foundation.
	5	*
	6	* This program is distributed in the hope that it will be useful,
	7	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	8	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	9	* GNU General Public License for more details.
	10	*
	11	* You should have received a copy of the GNU General Public License
	12	* along with this program; if not, write to the Free Software
	13	* Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
	14	*
	15	* Copyright IBM Corp. 2007
	16	*
	17	* Authors: Hollis Blanchard <hollisb@us.ibm.com>
	18	*/
	19
	20	#include <linux/types.h>
	21	#include <linux/string.h>
31711f22	22	#include <linux/kvm.h>
bbf45ba5 HB	23	#include <linux/kvm_host.h>
bbf45ba5 HB	24	#include <linux/highmem.h>
7924bd41 HB	25
7924bd41 HB	26	#include <asm/tlbflush.h>
bbf45ba5 HB	27	#include <asm/mmu-44x.h>
bbf45ba5 HB	28	#include <asm/kvm_ppc.h>
db93f574	29	#include <asm/kvm_44x.h>
73e75b41	30	#include "timing.h"
bbf45ba5 HB	31
bbf45ba5 HB	32	#include "44x_tlb.h"
46f43c6e	33	#include "trace.h"
bbf45ba5	34
89168618 HB	35	#ifndef PPC44x_TLBE_SIZE
	36	#define PPC44x_TLBE_SIZE PPC44x_TLB_4K
	37	#endif
	38
	39	#define PAGE_SIZE_4K (1<<12)
	40	#define PAGE_MASK_4K (~(PAGE_SIZE_4K - 1))
	41
df9b856c HB	42	#define PPC44x_TLB_UATTR_MASK \
df9b856c HB	43	(PPC44x_TLB_U0\|PPC44x_TLB_U1\|PPC44x_TLB_U2\|PPC44x_TLB_U3)
bbf45ba5 HB	44	#define PPC44x_TLB_USER_PERM_MASK (PPC44x_TLB_UX\|PPC44x_TLB_UR\|PPC44x_TLB_UW)
	45	#define PPC44x_TLB_SUPER_PERM_MASK (PPC44x_TLB_SX\|PPC44x_TLB_SR\|PPC44x_TLB_SW)
	46
a0d7b9f2 HB	47	#ifdef DEBUG
	48	void kvmppc_dump_tlbs(struct kvm_vcpu *vcpu)
	49	{
0b3bafc8	50	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
a0d7b9f2 HB	51	struct kvmppc_44x_tlbe *tlbe;
	52	int i;
	53
	54	printk("vcpu %d TLB dump:\n", vcpu->vcpu_id);
	55	printk("\| %2s \| %3s \| %8s \| %8s \| %8s \|\n",
	56	"nr", "tid", "word0", "word1", "word2");
	57
7924bd41	58	for (i = 0; i < ARRAY_SIZE(vcpu_44x->guest_tlb); i++) {
db93f574	59	tlbe = &vcpu_44x->guest_tlb[i];
a0d7b9f2 HB	60	if (tlbe->word0 & PPC44x_TLB_VALID)
	61	printk(" G%2d \| %02X \| %08X \| %08X \| %08X \|\n",
	62	i, tlbe->tid, tlbe->word0, tlbe->word1,
	63	tlbe->word2);
	64	}
a0d7b9f2 HB	65	}
	66	#endif
	67
7924bd41 HB	68	static inline void kvmppc_44x_tlbie(unsigned int index)
	69	{
	70	/* 0 <= index < 64, so the V bit is clear and we can use the index as
	71	* word0. */
	72	asm volatile(
	73	"tlbwe %[index], %[index], 0\n"
	74	:
	75	: [index] "r"(index)
	76	);
	77	}
	78
c5fbdffb HB	79	static inline void kvmppc_44x_tlbre(unsigned int index,
	80	struct kvmppc_44x_tlbe *tlbe)
	81	{
	82	asm volatile(
	83	"tlbre %[word0], %[index], 0\n"
	84	"mfspr %[tid], %[sprn_mmucr]\n"
	85	"andi. %[tid], %[tid], 0xff\n"
	86	"tlbre %[word1], %[index], 1\n"
	87	"tlbre %[word2], %[index], 2\n"
	88	: [word0] "=r"(tlbe->word0),
	89	[word1] "=r"(tlbe->word1),
	90	[word2] "=r"(tlbe->word2),
	91	[tid] "=r"(tlbe->tid)
	92	: [index] "r"(index),
	93	[sprn_mmucr] "i"(SPRN_MMUCR)
	94	: "cc"
	95	);
	96	}
	97
7924bd41 HB	98	static inline void kvmppc_44x_tlbwe(unsigned int index,
	99	struct kvmppc_44x_tlbe *stlbe)
	100	{
	101	unsigned long tmp;
	102
	103	asm volatile(
	104	"mfspr %[tmp], %[sprn_mmucr]\n"
	105	"rlwimi %[tmp], %[tid], 0, 0xff\n"
	106	"mtspr %[sprn_mmucr], %[tmp]\n"
	107	"tlbwe %[word0], %[index], 0\n"
	108	"tlbwe %[word1], %[index], 1\n"
	109	"tlbwe %[word2], %[index], 2\n"
	110	: [tmp] "=&r"(tmp)
	111	: [word0] "r"(stlbe->word0),
	112	[word1] "r"(stlbe->word1),
	113	[word2] "r"(stlbe->word2),
	114	[tid] "r"(stlbe->tid),
	115	[index] "r"(index),
	116	[sprn_mmucr] "i"(SPRN_MMUCR)
	117	);
	118	}
	119
bbf45ba5 HB	120	static u32 kvmppc_44x_tlb_shadow_attrib(u32 attrib, int usermode)
bbf45ba5 HB	121	{
df9b856c HB	122	/* We only care about the guest's permission and user bits. */
df9b856c HB	123	attrib &= PPC44x_TLB_PERM_MASK\|PPC44x_TLB_UATTR_MASK;
bbf45ba5 HB	124
	125	if (!usermode) {
	126	/* Guest is in supervisor mode, so we need to translate guest
	127	* supervisor permissions into user permissions. */
	128	attrib &= ~PPC44x_TLB_USER_PERM_MASK;
	129	attrib \|= (attrib & PPC44x_TLB_SUPER_PERM_MASK) << 3;
	130	}
	131
	132	/* Make sure host can always access this memory. */
	133	attrib \|= PPC44x_TLB_SX\|PPC44x_TLB_SR\|PPC44x_TLB_SW;
	134
df9b856c HB	135	/* WIMGE = 0b00100 */
	136	attrib \|= PPC44x_TLB_M;
	137
bbf45ba5 HB	138	return attrib;
	139	}
	140
c5fbdffb HB	141	/* Load shadow TLB back into hardware. */
	142	void kvmppc_44x_tlb_load(struct kvm_vcpu *vcpu)
	143	{
	144	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	145	int i;
	146
	147	for (i = 0; i <= tlb_44x_hwater; i++) {
	148	struct kvmppc_44x_tlbe *stlbe = &vcpu_44x->shadow_tlb[i];
	149
	150	if (get_tlb_v(stlbe) && get_tlb_ts(stlbe))
	151	kvmppc_44x_tlbwe(i, stlbe);
	152	}
	153	}
	154
	155	static void kvmppc_44x_tlbe_set_modified(struct kvmppc_vcpu_44x *vcpu_44x,
	156	unsigned int i)
	157	{
	158	vcpu_44x->shadow_tlb_mod[i] = 1;
	159	}
	160
	161	/* Save hardware TLB to the vcpu, and invalidate all guest mappings. */
	162	void kvmppc_44x_tlb_put(struct kvm_vcpu *vcpu)
	163	{
	164	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	165	int i;
	166
	167	for (i = 0; i <= tlb_44x_hwater; i++) {
	168	struct kvmppc_44x_tlbe *stlbe = &vcpu_44x->shadow_tlb[i];
	169
	170	if (vcpu_44x->shadow_tlb_mod[i])
	171	kvmppc_44x_tlbre(i, stlbe);
	172
	173	if (get_tlb_v(stlbe) && get_tlb_ts(stlbe))
	174	kvmppc_44x_tlbie(i);
	175	}
	176	}
	177
	178
bbf45ba5 HB	179	/* Search the guest TLB for a matching entry. */
	180	int kvmppc_44x_tlb_index(struct kvm_vcpu *vcpu, gva_t eaddr, unsigned int pid,
	181	unsigned int as)
	182	{
db93f574	183	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
bbf45ba5 HB	184	int i;
	185
	186	/* XXX Replace loop with fancy data structures. */
7924bd41	187	for (i = 0; i < ARRAY_SIZE(vcpu_44x->guest_tlb); i++) {
db93f574	188	struct kvmppc_44x_tlbe *tlbe = &vcpu_44x->guest_tlb[i];
bbf45ba5 HB	189	unsigned int tid;
	190
	191	if (eaddr < get_tlb_eaddr(tlbe))
	192	continue;
	193
	194	if (eaddr > get_tlb_end(tlbe))
	195	continue;
	196
	197	tid = get_tlb_tid(tlbe);
	198	if (tid && (tid != pid))
	199	continue;
	200
	201	if (!get_tlb_v(tlbe))
	202	continue;
	203
	204	if (get_tlb_ts(tlbe) != as)
	205	continue;
	206
	207	return i;
	208	}
	209
	210	return -1;
	211	}
	212
be8d1cae HB	213	gpa_t kvmppc_mmu_xlate(struct kvm_vcpu *vcpu, unsigned int gtlb_index,
	214	gva_t eaddr)
	215	{
	216	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
	217	struct kvmppc_44x_tlbe *gtlbe = &vcpu_44x->guest_tlb[gtlb_index];
	218	unsigned int pgmask = get_tlb_bytes(gtlbe) - 1;
	219
	220	return get_tlb_raddr(gtlbe) \| (eaddr & pgmask);
	221	}
	222
fa86b8dd	223	int kvmppc_mmu_itlb_index(struct kvm_vcpu *vcpu, gva_t eaddr)
bbf45ba5	224	{
666e7252	225	unsigned int as = !!(vcpu->arch.shared->msr & MSR_IS);
bbf45ba5	226
7924bd41	227	return kvmppc_44x_tlb_index(vcpu, eaddr, vcpu->arch.pid, as);
bbf45ba5 HB	228	}
bbf45ba5 HB	229
fa86b8dd	230	int kvmppc_mmu_dtlb_index(struct kvm_vcpu *vcpu, gva_t eaddr)
bbf45ba5	231	{
666e7252	232	unsigned int as = !!(vcpu->arch.shared->msr & MSR_DS);
bbf45ba5	233
7924bd41	234	return kvmppc_44x_tlb_index(vcpu, eaddr, vcpu->arch.pid, as);
bbf45ba5 HB	235	}
bbf45ba5 HB	236
b52a638c HB	237	void kvmppc_mmu_itlb_miss(struct kvm_vcpu *vcpu)
	238	{
	239	}
	240
	241	void kvmppc_mmu_dtlb_miss(struct kvm_vcpu *vcpu)
	242	{
	243	}
	244
7924bd41 HB	245	static void kvmppc_44x_shadow_release(struct kvmppc_vcpu_44x *vcpu_44x,
7924bd41 HB	246	unsigned int stlb_index)
bbf45ba5	247	{
7924bd41	248	struct kvmppc_44x_shadow_ref *ref = &vcpu_44x->shadow_refs[stlb_index];
bbf45ba5	249
7924bd41 HB	250	if (!ref->page)
7924bd41 HB	251	return;
bbf45ba5	252
7924bd41 HB	253	/* Discard from the TLB. */
	254	/* Note: we could actually invalidate a host mapping, if the host overwrote
	255	* this TLB entry since we inserted a guest mapping. */
	256	kvmppc_44x_tlbie(stlb_index);
bbf45ba5	257
7924bd41 HB	258	/* Now release the page. */
	259	if (ref->writeable)
	260	kvm_release_page_dirty(ref->page);
	261	else
	262	kvm_release_page_clean(ref->page);
c30f8a6c	263
7924bd41 HB	264	ref->page = NULL;
	265
	266	/* XXX set tlb_44x_index to stlb_index? */
	267
46f43c6e	268	trace_kvm_stlb_inval(stlb_index);
c30f8a6c HB	269	}
c30f8a6c HB	270
ecc0981f	271	void kvmppc_mmu_destroy(struct kvm_vcpu *vcpu)
83aae4a8	272	{
db93f574	273	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
7924bd41	274	int i;
db93f574	275
7924bd41 HB	276	for (i = 0; i <= tlb_44x_hwater; i++)
7924bd41 HB	277	kvmppc_44x_shadow_release(vcpu_44x, i);
83aae4a8 HB	278	}
83aae4a8 HB	279
89168618 HB	280	/**
	281	* kvmppc_mmu_map -- create a host mapping for guest memory
	282	*
	283	* If the guest wanted a larger page than the host supports, only the first
	284	* host page is mapped here and the rest are demand faulted.
	285	*
	286	* If the guest wanted a smaller page than the host page size, we map only the
	287	* guest-size page (i.e. not a full host page mapping).
	288	*
	289	* Caller must ensure that the specified guest TLB entry is safe to insert into
	290	* the shadow TLB.
	291	*/
58a96214 HB	292	void kvmppc_mmu_map(struct kvm_vcpu *vcpu, u64 gvaddr, gpa_t gpaddr,
58a96214 HB	293	unsigned int gtlb_index)
bbf45ba5	294	{
7924bd41	295	struct kvmppc_44x_tlbe stlbe;
db93f574	296	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
58a96214	297	struct kvmppc_44x_tlbe *gtlbe = &vcpu_44x->guest_tlb[gtlb_index];
7924bd41	298	struct kvmppc_44x_shadow_ref *ref;
bbf45ba5	299	struct page *new_page;
bbf45ba5	300	hpa_t hpaddr;
89168618	301	gfn_t gfn;
58a96214 HB	302	u32 asid = gtlbe->tid;
	303	u32 flags = gtlbe->word2;
	304	u32 max_bytes = get_tlb_bytes(gtlbe);
bbf45ba5 HB	305	unsigned int victim;
bbf45ba5 HB	306
7924bd41 HB	307	/* Select TLB entry to clobber. Indirectly guard against races with the TLB
	308	* miss handler by disabling interrupts. */
	309	local_irq_disable();
	310	victim = ++tlb_44x_index;
	311	if (victim > tlb_44x_hwater)
	312	victim = 0;
	313	tlb_44x_index = victim;
	314	local_irq_enable();
bbf45ba5 HB	315
bbf45ba5 HB	316	/* Get reference to new page. */
89168618	317	gfn = gpaddr >> PAGE_SHIFT;
bbf45ba5 HB	318	new_page = gfn_to_page(vcpu->kvm, gfn);
bbf45ba5 HB	319	if (is_error_page(new_page)) {
5689cc53 JR	320	printk(KERN_ERR "Couldn't get guest page for gfn %llx!\n",
5689cc53 JR	321	(unsigned long long)gfn);
bbf45ba5 HB	322	return;
	323	}
	324	hpaddr = page_to_phys(new_page);
	325
7924bd41 HB	326	/* Invalidate any previous shadow mappings. */
7924bd41 HB	327	kvmppc_44x_shadow_release(vcpu_44x, victim);
bbf45ba5 HB	328
	329	/* XXX Make sure (va, size) doesn't overlap any other
	330	* entries. 440x6 user manual says the result would be
	331	* "undefined." */
	332
	333	/* XXX what about AS? */
	334
bbf45ba5	335	/* Force TS=1 for all guest mappings. */
7924bd41	336	stlbe.word0 = PPC44x_TLB_VALID \| PPC44x_TLB_TS;
89168618 HB	337
	338	if (max_bytes >= PAGE_SIZE) {
	339	/* Guest mapping is larger than or equal to host page size. We can use
	340	* a "native" host mapping. */
7924bd41	341	stlbe.word0 \|= (gvaddr & PAGE_MASK) \| PPC44x_TLBE_SIZE;
89168618 HB	342	} else {
	343	/* Guest mapping is smaller than host page size. We must restrict the
	344	* size of the mapping to be at most the smaller of the two, but for
	345	* simplicity we fall back to a 4K mapping (this is probably what the
	346	* guest is using anyways). */
7924bd41	347	stlbe.word0 \|= (gvaddr & PAGE_MASK_4K) \| PPC44x_TLB_4K;
89168618 HB	348
	349	/* 'hpaddr' is a host page, which is larger than the mapping we're
	350	* inserting here. To compensate, we must add the in-page offset to the
	351	* sub-page. */
	352	hpaddr \|= gpaddr & (PAGE_MASK ^ PAGE_MASK_4K);
	353	}
	354
7924bd41 HB	355	stlbe.word1 = (hpaddr & 0xfffffc00) \| ((hpaddr >> 32) & 0xf);
7924bd41 HB	356	stlbe.word2 = kvmppc_44x_tlb_shadow_attrib(flags,
666e7252	357	vcpu->arch.shared->msr & MSR_PR);
7924bd41 HB	358	stlbe.tid = !(asid & 0xff);
	359
	360	/* Keep track of the reference so we can properly release it later. */
	361	ref = &vcpu_44x->shadow_refs[victim];
	362	ref->page = new_page;
	363	ref->gtlb_index = gtlb_index;
	364	ref->writeable = !!(stlbe.word2 & PPC44x_TLB_UW);
	365	ref->tid = stlbe.tid;
	366
	367	/* Insert shadow mapping into hardware TLB. */
c5fbdffb	368	kvmppc_44x_tlbe_set_modified(vcpu_44x, victim);
7924bd41	369	kvmppc_44x_tlbwe(victim, &stlbe);
46f43c6e MT	370	trace_kvm_stlb_write(victim, stlbe.tid, stlbe.word0, stlbe.word1,
46f43c6e MT	371	stlbe.word2);
bbf45ba5 HB	372	}
bbf45ba5 HB	373
7924bd41 HB	374	/* For a particular guest TLB entry, invalidate the corresponding host TLB
	375	* mappings and release the host pages. */
	376	static void kvmppc_44x_invalidate(struct kvm_vcpu *vcpu,
	377	unsigned int gtlb_index)
bbf45ba5	378	{
db93f574	379	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
bbf45ba5 HB	380	int i;
bbf45ba5 HB	381
7924bd41 HB	382	for (i = 0; i < ARRAY_SIZE(vcpu_44x->shadow_refs); i++) {
	383	struct kvmppc_44x_shadow_ref *ref = &vcpu_44x->shadow_refs[i];
	384	if (ref->gtlb_index == gtlb_index)
	385	kvmppc_44x_shadow_release(vcpu_44x, i);
bbf45ba5	386	}
bbf45ba5 HB	387	}
bbf45ba5 HB	388
dd9ebf1f	389	void kvmppc_mmu_msr_notify(struct kvm_vcpu *vcpu, u32 old_msr)
fe4e771d	390	{
dd9ebf1f LY	391	int usermode = vcpu->arch.shared->msr & MSR_PR;
dd9ebf1f LY	392
fe4e771d HB	393	vcpu->arch.shadow_pid = !usermode;
	394	}
	395
	396	void kvmppc_set_pid(struct kvm_vcpu *vcpu, u32 new_pid)
bbf45ba5	397	{
db93f574	398	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
bbf45ba5 HB	399	int i;
bbf45ba5 HB	400
fe4e771d HB	401	if (unlikely(vcpu->arch.pid == new_pid))
	402	return;
	403
	404	vcpu->arch.pid = new_pid;
	405
	406	/* Guest userspace runs with TID=0 mappings and PID=0, to make sure it
	407	* can't access guest kernel mappings (TID=1). When we switch to a new
	408	* guest PID, which will also use host PID=0, we must discard the old guest
	409	* userspace mappings. */
7924bd41 HB	410	for (i = 0; i < ARRAY_SIZE(vcpu_44x->shadow_refs); i++) {
	411	struct kvmppc_44x_shadow_ref *ref = &vcpu_44x->shadow_refs[i];
	412
	413	if (ref->tid == 0)
	414	kvmppc_44x_shadow_release(vcpu_44x, i);
bbf45ba5	415	}
bbf45ba5	416	}
a0d7b9f2 HB	417
a0d7b9f2 HB	418	static int tlbe_is_host_safe(const struct kvm_vcpu *vcpu,
0f55dc48	419	const struct kvmppc_44x_tlbe *tlbe)
a0d7b9f2 HB	420	{
	421	gpa_t gpa;
	422
	423	if (!get_tlb_v(tlbe))
	424	return 0;
	425
	426	/* Does it match current guest AS? */
	427	/* XXX what about IS != DS? */
666e7252	428	if (get_tlb_ts(tlbe) != !!(vcpu->arch.shared->msr & MSR_IS))
a0d7b9f2 HB	429	return 0;
	430
	431	gpa = get_tlb_raddr(tlbe);
	432	if (!gfn_to_memslot(vcpu->kvm, gpa >> PAGE_SHIFT))
	433	/* Mapping is not for RAM. */
	434	return 0;
	435
	436	return 1;
	437	}
	438
75f74f0d	439	int kvmppc_44x_emul_tlbwe(struct kvm_vcpu *vcpu, u8 ra, u8 rs, u8 ws)
a0d7b9f2	440	{
db93f574	441	struct kvmppc_vcpu_44x *vcpu_44x = to_44x(vcpu);
0f55dc48	442	struct kvmppc_44x_tlbe *tlbe;
7924bd41	443	unsigned int gtlb_index;
a0d7b9f2	444
8e5b26b5	445	gtlb_index = kvmppc_get_gpr(vcpu, ra);
4f018c51	446	if (gtlb_index >= KVM44x_GUEST_TLB_SIZE) {
7924bd41	447	printk("%s: index %d\n", __func__, gtlb_index);
a0d7b9f2 HB	448	kvmppc_dump_vcpu(vcpu);
	449	return EMULATE_FAIL;
	450	}
	451
7924bd41	452	tlbe = &vcpu_44x->guest_tlb[gtlb_index];
a0d7b9f2	453
7924bd41 HB	454	/* Invalidate shadow mappings for the about-to-be-clobbered TLB entry. */
	455	if (tlbe->word0 & PPC44x_TLB_VALID)
	456	kvmppc_44x_invalidate(vcpu, gtlb_index);
a0d7b9f2 HB	457
	458	switch (ws) {
	459	case PPC44x_TLB_PAGEID:
bf5d4025	460	tlbe->tid = get_mmucr_stid(vcpu);
8e5b26b5	461	tlbe->word0 = kvmppc_get_gpr(vcpu, rs);
a0d7b9f2 HB	462	break;
	463
	464	case PPC44x_TLB_XLAT:
8e5b26b5	465	tlbe->word1 = kvmppc_get_gpr(vcpu, rs);
a0d7b9f2 HB	466	break;
	467
	468	case PPC44x_TLB_ATTRIB:
8e5b26b5	469	tlbe->word2 = kvmppc_get_gpr(vcpu, rs);
a0d7b9f2 HB	470	break;
	471
	472	default:
	473	return EMULATE_FAIL;
	474	}
	475
	476	if (tlbe_is_host_safe(vcpu, tlbe)) {
7924bd41	477	gva_t eaddr;
89168618	478	gpa_t gpaddr;
89168618 HB	479	u32 bytes;
89168618 HB	480
a0d7b9f2	481	eaddr = get_tlb_eaddr(tlbe);
89168618 HB	482	gpaddr = get_tlb_raddr(tlbe);
	483
	484	/* Use the advertised page size to mask effective and real addrs. */
	485	bytes = get_tlb_bytes(tlbe);
	486	eaddr &= ~(bytes - 1);
	487	gpaddr &= ~(bytes - 1);
	488
58a96214	489	kvmppc_mmu_map(vcpu, eaddr, gpaddr, gtlb_index);
a0d7b9f2 HB	490	}
a0d7b9f2 HB	491
46f43c6e MT	492	trace_kvm_gtlb_write(gtlb_index, tlbe->tid, tlbe->word0, tlbe->word1,
46f43c6e MT	493	tlbe->word2);
a0d7b9f2	494
73e75b41	495	kvmppc_set_exit_type(vcpu, EMULATED_TLBWE_EXITS);
a0d7b9f2 HB	496	return EMULATE_DONE;
	497	}
	498
75f74f0d	499	int kvmppc_44x_emul_tlbsx(struct kvm_vcpu *vcpu, u8 rt, u8 ra, u8 rb, u8 rc)
a0d7b9f2 HB	500	{
a0d7b9f2 HB	501	u32 ea;
7924bd41	502	int gtlb_index;
a0d7b9f2 HB	503	unsigned int as = get_mmucr_sts(vcpu);
	504	unsigned int pid = get_mmucr_stid(vcpu);
	505
8e5b26b5	506	ea = kvmppc_get_gpr(vcpu, rb);
a0d7b9f2	507	if (ra)
8e5b26b5	508	ea += kvmppc_get_gpr(vcpu, ra);
a0d7b9f2	509
7924bd41	510	gtlb_index = kvmppc_44x_tlb_index(vcpu, ea, pid, as);
a0d7b9f2	511	if (rc) {
992b5b29 AG	512	u32 cr = kvmppc_get_cr(vcpu);
992b5b29 AG	513
7924bd41	514	if (gtlb_index < 0)
992b5b29	515	kvmppc_set_cr(vcpu, cr & ~0x20000000);
a0d7b9f2	516	else
992b5b29	517	kvmppc_set_cr(vcpu, cr \| 0x20000000);
a0d7b9f2	518	}
8e5b26b5	519	kvmppc_set_gpr(vcpu, rt, gtlb_index);
a0d7b9f2	520
73e75b41	521	kvmppc_set_exit_type(vcpu, EMULATED_TLBSX_EXITS);
a0d7b9f2 HB	522	return EMULATE_DONE;
a0d7b9f2 HB	523	}