drivers/char: Eliminate use after free
[pandora-kernel.git] / arch / powerpc / kvm / book3s_64_emulate.c
1 /*
2  * This program is free software; you can redistribute it and/or modify
3  * it under the terms of the GNU General Public License, version 2, as
4  * published by the Free Software Foundation.
5  *
6  * This program is distributed in the hope that it will be useful,
7  * but WITHOUT ANY WARRANTY; without even the implied warranty of
8  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
9  * GNU General Public License for more details.
10  *
11  * You should have received a copy of the GNU General Public License
12  * along with this program; if not, write to the Free Software
13  * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
14  *
15  * Copyright SUSE Linux Products GmbH 2009
16  *
17  * Authors: Alexander Graf <agraf@suse.de>
18  */
19
20 #include <asm/kvm_ppc.h>
21 #include <asm/disassemble.h>
22 #include <asm/kvm_book3s.h>
23 #include <asm/reg.h>
24
25 #define OP_19_XOP_RFID          18
26 #define OP_19_XOP_RFI           50
27
28 #define OP_31_XOP_MFMSR         83
29 #define OP_31_XOP_MTMSR         146
30 #define OP_31_XOP_MTMSRD        178
31 #define OP_31_XOP_MTSRIN        242
32 #define OP_31_XOP_TLBIEL        274
33 #define OP_31_XOP_TLBIE         306
34 #define OP_31_XOP_SLBMTE        402
35 #define OP_31_XOP_SLBIE         434
36 #define OP_31_XOP_SLBIA         498
37 #define OP_31_XOP_MFSRIN        659
38 #define OP_31_XOP_SLBMFEV       851
39 #define OP_31_XOP_EIOIO         854
40 #define OP_31_XOP_SLBMFEE       915
41
42 /* DCBZ is actually 1014, but we patch it to 1010 so we get a trap */
43 #define OP_31_XOP_DCBZ          1010
44
45 int kvmppc_core_emulate_op(struct kvm_run *run, struct kvm_vcpu *vcpu,
46                            unsigned int inst, int *advance)
47 {
48         int emulated = EMULATE_DONE;
49
50         switch (get_op(inst)) {
51         case 19:
52                 switch (get_xop(inst)) {
53                 case OP_19_XOP_RFID:
54                 case OP_19_XOP_RFI:
55                         vcpu->arch.pc = vcpu->arch.srr0;
56                         kvmppc_set_msr(vcpu, vcpu->arch.srr1);
57                         *advance = 0;
58                         break;
59
60                 default:
61                         emulated = EMULATE_FAIL;
62                         break;
63                 }
64                 break;
65         case 31:
66                 switch (get_xop(inst)) {
67                 case OP_31_XOP_MFMSR:
68                         kvmppc_set_gpr(vcpu, get_rt(inst), vcpu->arch.msr);
69                         break;
70                 case OP_31_XOP_MTMSRD:
71                 {
72                         ulong rs = kvmppc_get_gpr(vcpu, get_rs(inst));
73                         if (inst & 0x10000) {
74                                 vcpu->arch.msr &= ~(MSR_RI | MSR_EE);
75                                 vcpu->arch.msr |= rs & (MSR_RI | MSR_EE);
76                         } else
77                                 kvmppc_set_msr(vcpu, rs);
78                         break;
79                 }
80                 case OP_31_XOP_MTMSR:
81                         kvmppc_set_msr(vcpu, kvmppc_get_gpr(vcpu, get_rs(inst)));
82                         break;
83                 case OP_31_XOP_MFSRIN:
84                 {
85                         int srnum;
86
87                         srnum = (kvmppc_get_gpr(vcpu, get_rb(inst)) >> 28) & 0xf;
88                         if (vcpu->arch.mmu.mfsrin) {
89                                 u32 sr;
90                                 sr = vcpu->arch.mmu.mfsrin(vcpu, srnum);
91                                 kvmppc_set_gpr(vcpu, get_rt(inst), sr);
92                         }
93                         break;
94                 }
95                 case OP_31_XOP_MTSRIN:
96                         vcpu->arch.mmu.mtsrin(vcpu,
97                                 (kvmppc_get_gpr(vcpu, get_rb(inst)) >> 28) & 0xf,
98                                 kvmppc_get_gpr(vcpu, get_rs(inst)));
99                         break;
100                 case OP_31_XOP_TLBIE:
101                 case OP_31_XOP_TLBIEL:
102                 {
103                         bool large = (inst & 0x00200000) ? true : false;
104                         ulong addr = kvmppc_get_gpr(vcpu, get_rb(inst));
105                         vcpu->arch.mmu.tlbie(vcpu, addr, large);
106                         break;
107                 }
108                 case OP_31_XOP_EIOIO:
109                         break;
110                 case OP_31_XOP_SLBMTE:
111                         if (!vcpu->arch.mmu.slbmte)
112                                 return EMULATE_FAIL;
113
114                         vcpu->arch.mmu.slbmte(vcpu,
115                                         kvmppc_get_gpr(vcpu, get_rs(inst)),
116                                         kvmppc_get_gpr(vcpu, get_rb(inst)));
117                         break;
118                 case OP_31_XOP_SLBIE:
119                         if (!vcpu->arch.mmu.slbie)
120                                 return EMULATE_FAIL;
121
122                         vcpu->arch.mmu.slbie(vcpu,
123                                         kvmppc_get_gpr(vcpu, get_rb(inst)));
124                         break;
125                 case OP_31_XOP_SLBIA:
126                         if (!vcpu->arch.mmu.slbia)
127                                 return EMULATE_FAIL;
128
129                         vcpu->arch.mmu.slbia(vcpu);
130                         break;
131                 case OP_31_XOP_SLBMFEE:
132                         if (!vcpu->arch.mmu.slbmfee) {
133                                 emulated = EMULATE_FAIL;
134                         } else {
135                                 ulong t, rb;
136
137                                 rb = kvmppc_get_gpr(vcpu, get_rb(inst));
138                                 t = vcpu->arch.mmu.slbmfee(vcpu, rb);
139                                 kvmppc_set_gpr(vcpu, get_rt(inst), t);
140                         }
141                         break;
142                 case OP_31_XOP_SLBMFEV:
143                         if (!vcpu->arch.mmu.slbmfev) {
144                                 emulated = EMULATE_FAIL;
145                         } else {
146                                 ulong t, rb;
147
148                                 rb = kvmppc_get_gpr(vcpu, get_rb(inst));
149                                 t = vcpu->arch.mmu.slbmfev(vcpu, rb);
150                                 kvmppc_set_gpr(vcpu, get_rt(inst), t);
151                         }
152                         break;
153                 case OP_31_XOP_DCBZ:
154                 {
155                         ulong rb = kvmppc_get_gpr(vcpu, get_rb(inst));
156                         ulong ra = 0;
157                         ulong addr;
158                         u32 zeros[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
159
160                         if (get_ra(inst))
161                                 ra = kvmppc_get_gpr(vcpu, get_ra(inst));
162
163                         addr = (ra + rb) & ~31ULL;
164                         if (!(vcpu->arch.msr & MSR_SF))
165                                 addr &= 0xffffffff;
166
167                         if (kvmppc_st(vcpu, addr, 32, zeros)) {
168                                 vcpu->arch.dear = addr;
169                                 vcpu->arch.fault_dear = addr;
170                                 to_book3s(vcpu)->dsisr = DSISR_PROTFAULT |
171                                                       DSISR_ISSTORE;
172                                 kvmppc_book3s_queue_irqprio(vcpu,
173                                         BOOK3S_INTERRUPT_DATA_STORAGE);
174                                 kvmppc_mmu_pte_flush(vcpu, addr, ~0xFFFULL);
175                         }
176
177                         break;
178                 }
179                 default:
180                         emulated = EMULATE_FAIL;
181                 }
182                 break;
183         default:
184                 emulated = EMULATE_FAIL;
185         }
186
187         return emulated;
188 }
189
190 void kvmppc_set_bat(struct kvm_vcpu *vcpu, struct kvmppc_bat *bat, bool upper,
191                     u32 val)
192 {
193         if (upper) {
194                 /* Upper BAT */
195                 u32 bl = (val >> 2) & 0x7ff;
196                 bat->bepi_mask = (~bl << 17);
197                 bat->bepi = val & 0xfffe0000;
198                 bat->vs = (val & 2) ? 1 : 0;
199                 bat->vp = (val & 1) ? 1 : 0;
200                 bat->raw = (bat->raw & 0xffffffff00000000ULL) | val;
201         } else {
202                 /* Lower BAT */
203                 bat->brpn = val & 0xfffe0000;
204                 bat->wimg = (val >> 3) & 0xf;
205                 bat->pp = val & 3;
206                 bat->raw = (bat->raw & 0x00000000ffffffffULL) | ((u64)val << 32);
207         }
208 }
209
210 static void kvmppc_write_bat(struct kvm_vcpu *vcpu, int sprn, u32 val)
211 {
212         struct kvmppc_vcpu_book3s *vcpu_book3s = to_book3s(vcpu);
213         struct kvmppc_bat *bat;
214
215         switch (sprn) {
216         case SPRN_IBAT0U ... SPRN_IBAT3L:
217                 bat = &vcpu_book3s->ibat[(sprn - SPRN_IBAT0U) / 2];
218                 break;
219         case SPRN_IBAT4U ... SPRN_IBAT7L:
220                 bat = &vcpu_book3s->ibat[(sprn - SPRN_IBAT4U) / 2];
221                 break;
222         case SPRN_DBAT0U ... SPRN_DBAT3L:
223                 bat = &vcpu_book3s->dbat[(sprn - SPRN_DBAT0U) / 2];
224                 break;
225         case SPRN_DBAT4U ... SPRN_DBAT7L:
226                 bat = &vcpu_book3s->dbat[(sprn - SPRN_DBAT4U) / 2];
227                 break;
228         default:
229                 BUG();
230         }
231
232         kvmppc_set_bat(vcpu, bat, !(sprn % 2), val);
233 }
234
235 int kvmppc_core_emulate_mtspr(struct kvm_vcpu *vcpu, int sprn, int rs)
236 {
237         int emulated = EMULATE_DONE;
238         ulong spr_val = kvmppc_get_gpr(vcpu, rs);
239
240         switch (sprn) {
241         case SPRN_SDR1:
242                 to_book3s(vcpu)->sdr1 = spr_val;
243                 break;
244         case SPRN_DSISR:
245                 to_book3s(vcpu)->dsisr = spr_val;
246                 break;
247         case SPRN_DAR:
248                 vcpu->arch.dear = spr_val;
249                 break;
250         case SPRN_HIOR:
251                 to_book3s(vcpu)->hior = spr_val;
252                 break;
253         case SPRN_IBAT0U ... SPRN_IBAT3L:
254         case SPRN_IBAT4U ... SPRN_IBAT7L:
255         case SPRN_DBAT0U ... SPRN_DBAT3L:
256         case SPRN_DBAT4U ... SPRN_DBAT7L:
257                 kvmppc_write_bat(vcpu, sprn, (u32)spr_val);
258                 /* BAT writes happen so rarely that we're ok to flush
259                  * everything here */
260                 kvmppc_mmu_pte_flush(vcpu, 0, 0);
261                 break;
262         case SPRN_HID0:
263                 to_book3s(vcpu)->hid[0] = spr_val;
264                 break;
265         case SPRN_HID1:
266                 to_book3s(vcpu)->hid[1] = spr_val;
267                 break;
268         case SPRN_HID2:
269                 to_book3s(vcpu)->hid[2] = spr_val;
270                 break;
271         case SPRN_HID4:
272                 to_book3s(vcpu)->hid[4] = spr_val;
273                 break;
274         case SPRN_HID5:
275                 to_book3s(vcpu)->hid[5] = spr_val;
276                 /* guest HID5 set can change is_dcbz32 */
277                 if (vcpu->arch.mmu.is_dcbz32(vcpu) &&
278                     (mfmsr() & MSR_HV))
279                         vcpu->arch.hflags |= BOOK3S_HFLAG_DCBZ32;
280                 break;
281         case SPRN_ICTC:
282         case SPRN_THRM1:
283         case SPRN_THRM2:
284         case SPRN_THRM3:
285         case SPRN_CTRLF:
286         case SPRN_CTRLT:
287                 break;
288         default:
289                 printk(KERN_INFO "KVM: invalid SPR write: %d\n", sprn);
290 #ifndef DEBUG_SPR
291                 emulated = EMULATE_FAIL;
292 #endif
293                 break;
294         }
295
296         return emulated;
297 }
298
299 int kvmppc_core_emulate_mfspr(struct kvm_vcpu *vcpu, int sprn, int rt)
300 {
301         int emulated = EMULATE_DONE;
302
303         switch (sprn) {
304         case SPRN_SDR1:
305                 kvmppc_set_gpr(vcpu, rt, to_book3s(vcpu)->sdr1);
306                 break;
307         case SPRN_DSISR:
308                 kvmppc_set_gpr(vcpu, rt, to_book3s(vcpu)->dsisr);
309                 break;
310         case SPRN_DAR:
311                 kvmppc_set_gpr(vcpu, rt, vcpu->arch.dear);
312                 break;
313         case SPRN_HIOR:
314                 kvmppc_set_gpr(vcpu, rt, to_book3s(vcpu)->hior);
315                 break;
316         case SPRN_HID0:
317                 kvmppc_set_gpr(vcpu, rt, to_book3s(vcpu)->hid[0]);
318                 break;
319         case SPRN_HID1:
320                 kvmppc_set_gpr(vcpu, rt, to_book3s(vcpu)->hid[1]);
321                 break;
322         case SPRN_HID2:
323                 kvmppc_set_gpr(vcpu, rt, to_book3s(vcpu)->hid[2]);
324                 break;
325         case SPRN_HID4:
326                 kvmppc_set_gpr(vcpu, rt, to_book3s(vcpu)->hid[4]);
327                 break;
328         case SPRN_HID5:
329                 kvmppc_set_gpr(vcpu, rt, to_book3s(vcpu)->hid[5]);
330                 break;
331         case SPRN_THRM1:
332         case SPRN_THRM2:
333         case SPRN_THRM3:
334         case SPRN_CTRLF:
335         case SPRN_CTRLT:
336                 kvmppc_set_gpr(vcpu, rt, 0);
337                 break;
338         default:
339                 printk(KERN_INFO "KVM: invalid SPR read: %d\n", sprn);
340 #ifndef DEBUG_SPR
341                 emulated = EMULATE_FAIL;
342 #endif
343                 break;
344         }
345
346         return emulated;
347 }
348