1 /* 2 * This program is free software; you can redistribute it and/or modify 3 * it under the terms of the GNU General Public License, version 2, as 4 * published by the Free Software Foundation. 5 * 6 * This program is distributed in the hope that it will be useful, 7 * but WITHOUT ANY WARRANTY; without even the implied warranty of 8 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 9 * GNU General Public License for more details. 10 * 11 * You should have received a copy of the GNU General Public License 12 * along with this program; if not, write to the Free Software 13 * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. 14 * 15 * Copyright 2010 Paul Mackerras, IBM Corp. <paulus@au1.ibm.com> 16 */ 17 18 #include <linux/types.h> 19 #include <linux/string.h> 20 #include <linux/kvm.h> 21 #include <linux/kvm_host.h> 22 #include <linux/highmem.h> 23 #include <linux/gfp.h> 24 #include <linux/slab.h> 25 #include <linux/hugetlb.h> 26 #include <linux/vmalloc.h> 27 #include <linux/srcu.h> 28 #include <linux/anon_inodes.h> 29 #include <linux/file.h> 30 31 #include <asm/tlbflush.h> 32 #include <asm/kvm_ppc.h> 33 #include <asm/kvm_book3s.h> 34 #include <asm/mmu-hash64.h> 35 #include <asm/hvcall.h> 36 #include <asm/synch.h> 37 #include <asm/ppc-opcode.h> 38 #include <asm/cputable.h> 39 40 /* POWER7 has 10-bit LPIDs, PPC970 has 6-bit LPIDs */ 41 #define MAX_LPID_970 63 42 43 /* Power architecture requires HPT is at least 256kB */ 44 #define PPC_MIN_HPT_ORDER 18 45 46 static long kvmppc_virtmode_do_h_enter(struct kvm *kvm, unsigned long flags, 47 long pte_index, unsigned long pteh, 48 unsigned long ptel, unsigned long *pte_idx_ret); 49 static void kvmppc_rmap_reset(struct kvm *kvm); 50 51 long kvmppc_alloc_hpt(struct kvm *kvm, u32 *htab_orderp) 52 { 53 unsigned long hpt = 0; 54 struct revmap_entry *rev; 55 struct page *page = NULL; 56 long order = KVM_DEFAULT_HPT_ORDER; 57 58 if (htab_orderp) { 59 order = *htab_orderp; 60 if (order < PPC_MIN_HPT_ORDER) 61 order = PPC_MIN_HPT_ORDER; 62 } 63 64 kvm->arch.hpt_cma_alloc = 0; 65 page = kvm_alloc_hpt(1ul << (order - PAGE_SHIFT)); 66 if (page) { 67 hpt = (unsigned long)pfn_to_kaddr(page_to_pfn(page)); 68 memset((void *)hpt, 0, (1ul << order)); 69 kvm->arch.hpt_cma_alloc = 1; 70 } 71 72 /* Lastly try successively smaller sizes from the page allocator */ 73 while (!hpt && order > PPC_MIN_HPT_ORDER) { 74 hpt = __get_free_pages(GFP_KERNEL|__GFP_ZERO|__GFP_REPEAT| 75 __GFP_NOWARN, order - PAGE_SHIFT); 76 if (!hpt) 77 --order; 78 } 79 80 if (!hpt) 81 return -ENOMEM; 82 83 kvm->arch.hpt_virt = hpt; 84 kvm->arch.hpt_order = order; 85 /* HPTEs are 2**4 bytes long */ 86 kvm->arch.hpt_npte = 1ul << (order - 4); 87 /* 128 (2**7) bytes in each HPTEG */ 88 kvm->arch.hpt_mask = (1ul << (order - 7)) - 1; 89 90 /* Allocate reverse map array */ 91 rev = vmalloc(sizeof(struct revmap_entry) * kvm->arch.hpt_npte); 92 if (!rev) { 93 pr_err("kvmppc_alloc_hpt: Couldn't alloc reverse map array\n"); 94 goto out_freehpt; 95 } 96 kvm->arch.revmap = rev; 97 kvm->arch.sdr1 = __pa(hpt) | (order - 18); 98 99 pr_info("KVM guest htab at %lx (order %ld), LPID %x\n", 100 hpt, order, kvm->arch.lpid); 101 102 if (htab_orderp) 103 *htab_orderp = order; 104 return 0; 105 106 out_freehpt: 107 if (kvm->arch.hpt_cma_alloc) 108 kvm_release_hpt(page, 1 << (order - PAGE_SHIFT)); 109 else 110 free_pages(hpt, order - PAGE_SHIFT); 111 return -ENOMEM; 112 } 113 114 long kvmppc_alloc_reset_hpt(struct kvm *kvm, u32 *htab_orderp) 115 { 116 long err = -EBUSY; 117 long order; 118 119 mutex_lock(&kvm->lock); 120 if (kvm->arch.rma_setup_done) { 121 kvm->arch.rma_setup_done = 0; 122 /* order rma_setup_done vs. vcpus_running */ 123 smp_mb(); 124 if (atomic_read(&kvm->arch.vcpus_running)) { 125 kvm->arch.rma_setup_done = 1; 126 goto out; 127 } 128 } 129 if (kvm->arch.hpt_virt) { 130 order = kvm->arch.hpt_order; 131 /* Set the entire HPT to 0, i.e. invalid HPTEs */ 132 memset((void *)kvm->arch.hpt_virt, 0, 1ul << order); 133 /* 134 * Reset all the reverse-mapping chains for all memslots 135 */ 136 kvmppc_rmap_reset(kvm); 137 /* Ensure that each vcpu will flush its TLB on next entry. */ 138 cpumask_setall(&kvm->arch.need_tlb_flush); 139 *htab_orderp = order; 140 err = 0; 141 } else { 142 err = kvmppc_alloc_hpt(kvm, htab_orderp); 143 order = *htab_orderp; 144 } 145 out: 146 mutex_unlock(&kvm->lock); 147 return err; 148 } 149 150 void kvmppc_free_hpt(struct kvm *kvm) 151 { 152 kvmppc_free_lpid(kvm->arch.lpid); 153 vfree(kvm->arch.revmap); 154 if (kvm->arch.hpt_cma_alloc) 155 kvm_release_hpt(virt_to_page(kvm->arch.hpt_virt), 156 1 << (kvm->arch.hpt_order - PAGE_SHIFT)); 157 else 158 free_pages(kvm->arch.hpt_virt, 159 kvm->arch.hpt_order - PAGE_SHIFT); 160 } 161 162 /* Bits in first HPTE dword for pagesize 4k, 64k or 16M */ 163 static inline unsigned long hpte0_pgsize_encoding(unsigned long pgsize) 164 { 165 return (pgsize > 0x1000) ? HPTE_V_LARGE : 0; 166 } 167 168 /* Bits in second HPTE dword for pagesize 4k, 64k or 16M */ 169 static inline unsigned long hpte1_pgsize_encoding(unsigned long pgsize) 170 { 171 return (pgsize == 0x10000) ? 0x1000 : 0; 172 } 173 174 void kvmppc_map_vrma(struct kvm_vcpu *vcpu, struct kvm_memory_slot *memslot, 175 unsigned long porder) 176 { 177 unsigned long i; 178 unsigned long npages; 179 unsigned long hp_v, hp_r; 180 unsigned long addr, hash; 181 unsigned long psize; 182 unsigned long hp0, hp1; 183 unsigned long idx_ret; 184 long ret; 185 struct kvm *kvm = vcpu->kvm; 186 187 psize = 1ul << porder; 188 npages = memslot->npages >> (porder - PAGE_SHIFT); 189 190 /* VRMA can't be > 1TB */ 191 if (npages > 1ul << (40 - porder)) 192 npages = 1ul << (40 - porder); 193 /* Can't use more than 1 HPTE per HPTEG */ 194 if (npages > kvm->arch.hpt_mask + 1) 195 npages = kvm->arch.hpt_mask + 1; 196 197 hp0 = HPTE_V_1TB_SEG | (VRMA_VSID << (40 - 16)) | 198 HPTE_V_BOLTED | hpte0_pgsize_encoding(psize); 199 hp1 = hpte1_pgsize_encoding(psize) | 200 HPTE_R_R | HPTE_R_C | HPTE_R_M | PP_RWXX; 201 202 for (i = 0; i < npages; ++i) { 203 addr = i << porder; 204 /* can't use hpt_hash since va > 64 bits */ 205 hash = (i ^ (VRMA_VSID ^ (VRMA_VSID << 25))) & kvm->arch.hpt_mask; 206 /* 207 * We assume that the hash table is empty and no 208 * vcpus are using it at this stage. Since we create 209 * at most one HPTE per HPTEG, we just assume entry 7 210 * is available and use it. 211 */ 212 hash = (hash << 3) + 7; 213 hp_v = hp0 | ((addr >> 16) & ~0x7fUL); 214 hp_r = hp1 | addr; 215 ret = kvmppc_virtmode_do_h_enter(kvm, H_EXACT, hash, hp_v, hp_r, 216 &idx_ret); 217 if (ret != H_SUCCESS) { 218 pr_err("KVM: map_vrma at %lx failed, ret=%ld\n", 219 addr, ret); 220 break; 221 } 222 } 223 } 224 225 int kvmppc_mmu_hv_init(void) 226 { 227 unsigned long host_lpid, rsvd_lpid; 228 229 if (!cpu_has_feature(CPU_FTR_HVMODE)) 230 return -EINVAL; 231 232 /* POWER7 has 10-bit LPIDs, PPC970 and e500mc have 6-bit LPIDs */ 233 if (cpu_has_feature(CPU_FTR_ARCH_206)) { 234 host_lpid = mfspr(SPRN_LPID); /* POWER7 */ 235 rsvd_lpid = LPID_RSVD; 236 } else { 237 host_lpid = 0; /* PPC970 */ 238 rsvd_lpid = MAX_LPID_970; 239 } 240 241 kvmppc_init_lpid(rsvd_lpid + 1); 242 243 kvmppc_claim_lpid(host_lpid); 244 /* rsvd_lpid is reserved for use in partition switching */ 245 kvmppc_claim_lpid(rsvd_lpid); 246 247 return 0; 248 } 249 250 static void kvmppc_mmu_book3s_64_hv_reset_msr(struct kvm_vcpu *vcpu) 251 { 252 unsigned long msr = vcpu->arch.intr_msr; 253 254 /* If transactional, change to suspend mode on IRQ delivery */ 255 if (MSR_TM_TRANSACTIONAL(vcpu->arch.shregs.msr)) 256 msr |= MSR_TS_S; 257 else 258 msr |= vcpu->arch.shregs.msr & MSR_TS_MASK; 259 kvmppc_set_msr(vcpu, msr); 260 } 261 262 /* 263 * This is called to get a reference to a guest page if there isn't 264 * one already in the memslot->arch.slot_phys[] array. 265 */ 266 static long kvmppc_get_guest_page(struct kvm *kvm, unsigned long gfn, 267 struct kvm_memory_slot *memslot, 268 unsigned long psize) 269 { 270 unsigned long start; 271 long np, err; 272 struct page *page, *hpage, *pages[1]; 273 unsigned long s, pgsize; 274 unsigned long *physp; 275 unsigned int is_io, got, pgorder; 276 struct vm_area_struct *vma; 277 unsigned long pfn, i, npages; 278 279 physp = memslot->arch.slot_phys; 280 if (!physp) 281 return -EINVAL; 282 if (physp[gfn - memslot->base_gfn]) 283 return 0; 284 285 is_io = 0; 286 got = 0; 287 page = NULL; 288 pgsize = psize; 289 err = -EINVAL; 290 start = gfn_to_hva_memslot(memslot, gfn); 291 292 /* Instantiate and get the page we want access to */ 293 np = get_user_pages_fast(start, 1, 1, pages); 294 if (np != 1) { 295 /* Look up the vma for the page */ 296 down_read(¤t->mm->mmap_sem); 297 vma = find_vma(current->mm, start); 298 if (!vma || vma->vm_start > start || 299 start + psize > vma->vm_end || 300 !(vma->vm_flags & VM_PFNMAP)) 301 goto up_err; 302 is_io = hpte_cache_bits(pgprot_val(vma->vm_page_prot)); 303 pfn = vma->vm_pgoff + ((start - vma->vm_start) >> PAGE_SHIFT); 304 /* check alignment of pfn vs. requested page size */ 305 if (psize > PAGE_SIZE && (pfn & ((psize >> PAGE_SHIFT) - 1))) 306 goto up_err; 307 up_read(¤t->mm->mmap_sem); 308 309 } else { 310 page = pages[0]; 311 got = KVMPPC_GOT_PAGE; 312 313 /* See if this is a large page */ 314 s = PAGE_SIZE; 315 if (PageHuge(page)) { 316 hpage = compound_head(page); 317 s <<= compound_order(hpage); 318 /* Get the whole large page if slot alignment is ok */ 319 if (s > psize && slot_is_aligned(memslot, s) && 320 !(memslot->userspace_addr & (s - 1))) { 321 start &= ~(s - 1); 322 pgsize = s; 323 get_page(hpage); 324 put_page(page); 325 page = hpage; 326 } 327 } 328 if (s < psize) 329 goto out; 330 pfn = page_to_pfn(page); 331 } 332 333 npages = pgsize >> PAGE_SHIFT; 334 pgorder = __ilog2(npages); 335 physp += (gfn - memslot->base_gfn) & ~(npages - 1); 336 spin_lock(&kvm->arch.slot_phys_lock); 337 for (i = 0; i < npages; ++i) { 338 if (!physp[i]) { 339 physp[i] = ((pfn + i) << PAGE_SHIFT) + 340 got + is_io + pgorder; 341 got = 0; 342 } 343 } 344 spin_unlock(&kvm->arch.slot_phys_lock); 345 err = 0; 346 347 out: 348 if (got) 349 put_page(page); 350 return err; 351 352 up_err: 353 up_read(¤t->mm->mmap_sem); 354 return err; 355 } 356 357 long kvmppc_virtmode_do_h_enter(struct kvm *kvm, unsigned long flags, 358 long pte_index, unsigned long pteh, 359 unsigned long ptel, unsigned long *pte_idx_ret) 360 { 361 unsigned long psize, gpa, gfn; 362 struct kvm_memory_slot *memslot; 363 long ret; 364 365 if (kvm->arch.using_mmu_notifiers) 366 goto do_insert; 367 368 psize = hpte_page_size(pteh, ptel); 369 if (!psize) 370 return H_PARAMETER; 371 372 pteh &= ~(HPTE_V_HVLOCK | HPTE_V_ABSENT | HPTE_V_VALID); 373 374 /* Find the memslot (if any) for this address */ 375 gpa = (ptel & HPTE_R_RPN) & ~(psize - 1); 376 gfn = gpa >> PAGE_SHIFT; 377 memslot = gfn_to_memslot(kvm, gfn); 378 if (memslot && !(memslot->flags & KVM_MEMSLOT_INVALID)) { 379 if (!slot_is_aligned(memslot, psize)) 380 return H_PARAMETER; 381 if (kvmppc_get_guest_page(kvm, gfn, memslot, psize) < 0) 382 return H_PARAMETER; 383 } 384 385 do_insert: 386 /* Protect linux PTE lookup from page table destruction */ 387 rcu_read_lock_sched(); /* this disables preemption too */ 388 ret = kvmppc_do_h_enter(kvm, flags, pte_index, pteh, ptel, 389 current->mm->pgd, false, pte_idx_ret); 390 rcu_read_unlock_sched(); 391 if (ret == H_TOO_HARD) { 392 /* this can't happen */ 393 pr_err("KVM: Oops, kvmppc_h_enter returned too hard!\n"); 394 ret = H_RESOURCE; /* or something */ 395 } 396 return ret; 397 398 } 399 400 /* 401 * We come here on a H_ENTER call from the guest when we are not 402 * using mmu notifiers and we don't have the requested page pinned 403 * already. 404 */ 405 long kvmppc_virtmode_h_enter(struct kvm_vcpu *vcpu, unsigned long flags, 406 long pte_index, unsigned long pteh, 407 unsigned long ptel) 408 { 409 return kvmppc_virtmode_do_h_enter(vcpu->kvm, flags, pte_index, 410 pteh, ptel, &vcpu->arch.gpr[4]); 411 } 412 413 static struct kvmppc_slb *kvmppc_mmu_book3s_hv_find_slbe(struct kvm_vcpu *vcpu, 414 gva_t eaddr) 415 { 416 u64 mask; 417 int i; 418 419 for (i = 0; i < vcpu->arch.slb_nr; i++) { 420 if (!(vcpu->arch.slb[i].orige & SLB_ESID_V)) 421 continue; 422 423 if (vcpu->arch.slb[i].origv & SLB_VSID_B_1T) 424 mask = ESID_MASK_1T; 425 else 426 mask = ESID_MASK; 427 428 if (((vcpu->arch.slb[i].orige ^ eaddr) & mask) == 0) 429 return &vcpu->arch.slb[i]; 430 } 431 return NULL; 432 } 433 434 static unsigned long kvmppc_mmu_get_real_addr(unsigned long v, unsigned long r, 435 unsigned long ea) 436 { 437 unsigned long ra_mask; 438 439 ra_mask = hpte_page_size(v, r) - 1; 440 return (r & HPTE_R_RPN & ~ra_mask) | (ea & ra_mask); 441 } 442 443 static int kvmppc_mmu_book3s_64_hv_xlate(struct kvm_vcpu *vcpu, gva_t eaddr, 444 struct kvmppc_pte *gpte, bool data, bool iswrite) 445 { 446 struct kvm *kvm = vcpu->kvm; 447 struct kvmppc_slb *slbe; 448 unsigned long slb_v; 449 unsigned long pp, key; 450 unsigned long v, gr; 451 __be64 *hptep; 452 int index; 453 int virtmode = vcpu->arch.shregs.msr & (data ? MSR_DR : MSR_IR); 454 455 /* Get SLB entry */ 456 if (virtmode) { 457 slbe = kvmppc_mmu_book3s_hv_find_slbe(vcpu, eaddr); 458 if (!slbe) 459 return -EINVAL; 460 slb_v = slbe->origv; 461 } else { 462 /* real mode access */ 463 slb_v = vcpu->kvm->arch.vrma_slb_v; 464 } 465 466 preempt_disable(); 467 /* Find the HPTE in the hash table */ 468 index = kvmppc_hv_find_lock_hpte(kvm, eaddr, slb_v, 469 HPTE_V_VALID | HPTE_V_ABSENT); 470 if (index < 0) { 471 preempt_enable(); 472 return -ENOENT; 473 } 474 hptep = (__be64 *)(kvm->arch.hpt_virt + (index << 4)); 475 v = be64_to_cpu(hptep[0]) & ~HPTE_V_HVLOCK; 476 gr = kvm->arch.revmap[index].guest_rpte; 477 478 /* Unlock the HPTE */ 479 asm volatile("lwsync" : : : "memory"); 480 hptep[0] = cpu_to_be64(v); 481 preempt_enable(); 482 483 gpte->eaddr = eaddr; 484 gpte->vpage = ((v & HPTE_V_AVPN) << 4) | ((eaddr >> 12) & 0xfff); 485 486 /* Get PP bits and key for permission check */ 487 pp = gr & (HPTE_R_PP0 | HPTE_R_PP); 488 key = (vcpu->arch.shregs.msr & MSR_PR) ? SLB_VSID_KP : SLB_VSID_KS; 489 key &= slb_v; 490 491 /* Calculate permissions */ 492 gpte->may_read = hpte_read_permission(pp, key); 493 gpte->may_write = hpte_write_permission(pp, key); 494 gpte->may_execute = gpte->may_read && !(gr & (HPTE_R_N | HPTE_R_G)); 495 496 /* Storage key permission check for POWER7 */ 497 if (data && virtmode && cpu_has_feature(CPU_FTR_ARCH_206)) { 498 int amrfield = hpte_get_skey_perm(gr, vcpu->arch.amr); 499 if (amrfield & 1) 500 gpte->may_read = 0; 501 if (amrfield & 2) 502 gpte->may_write = 0; 503 } 504 505 /* Get the guest physical address */ 506 gpte->raddr = kvmppc_mmu_get_real_addr(v, gr, eaddr); 507 return 0; 508 } 509 510 /* 511 * Quick test for whether an instruction is a load or a store. 512 * If the instruction is a load or a store, then this will indicate 513 * which it is, at least on server processors. (Embedded processors 514 * have some external PID instructions that don't follow the rule 515 * embodied here.) If the instruction isn't a load or store, then 516 * this doesn't return anything useful. 517 */ 518 static int instruction_is_store(unsigned int instr) 519 { 520 unsigned int mask; 521 522 mask = 0x10000000; 523 if ((instr & 0xfc000000) == 0x7c000000) 524 mask = 0x100; /* major opcode 31 */ 525 return (instr & mask) != 0; 526 } 527 528 static int kvmppc_hv_emulate_mmio(struct kvm_run *run, struct kvm_vcpu *vcpu, 529 unsigned long gpa, gva_t ea, int is_store) 530 { 531 u32 last_inst; 532 533 /* 534 * If we fail, we just return to the guest and try executing it again. 535 */ 536 if (kvmppc_get_last_inst(vcpu, INST_GENERIC, &last_inst) != 537 EMULATE_DONE) 538 return RESUME_GUEST; 539 540 /* 541 * WARNING: We do not know for sure whether the instruction we just 542 * read from memory is the same that caused the fault in the first 543 * place. If the instruction we read is neither an load or a store, 544 * then it can't access memory, so we don't need to worry about 545 * enforcing access permissions. So, assuming it is a load or 546 * store, we just check that its direction (load or store) is 547 * consistent with the original fault, since that's what we 548 * checked the access permissions against. If there is a mismatch 549 * we just return and retry the instruction. 550 */ 551 552 if (instruction_is_store(last_inst) != !!is_store) 553 return RESUME_GUEST; 554 555 /* 556 * Emulated accesses are emulated by looking at the hash for 557 * translation once, then performing the access later. The 558 * translation could be invalidated in the meantime in which 559 * point performing the subsequent memory access on the old 560 * physical address could possibly be a security hole for the 561 * guest (but not the host). 562 * 563 * This is less of an issue for MMIO stores since they aren't 564 * globally visible. It could be an issue for MMIO loads to 565 * a certain extent but we'll ignore it for now. 566 */ 567 568 vcpu->arch.paddr_accessed = gpa; 569 vcpu->arch.vaddr_accessed = ea; 570 return kvmppc_emulate_mmio(run, vcpu); 571 } 572 573 int kvmppc_book3s_hv_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu, 574 unsigned long ea, unsigned long dsisr) 575 { 576 struct kvm *kvm = vcpu->kvm; 577 unsigned long hpte[3], r; 578 __be64 *hptep; 579 unsigned long mmu_seq, psize, pte_size; 580 unsigned long gpa_base, gfn_base; 581 unsigned long gpa, gfn, hva, pfn; 582 struct kvm_memory_slot *memslot; 583 unsigned long *rmap; 584 struct revmap_entry *rev; 585 struct page *page, *pages[1]; 586 long index, ret, npages; 587 unsigned long is_io; 588 unsigned int writing, write_ok; 589 struct vm_area_struct *vma; 590 unsigned long rcbits; 591 592 /* 593 * Real-mode code has already searched the HPT and found the 594 * entry we're interested in. Lock the entry and check that 595 * it hasn't changed. If it has, just return and re-execute the 596 * instruction. 597 */ 598 if (ea != vcpu->arch.pgfault_addr) 599 return RESUME_GUEST; 600 index = vcpu->arch.pgfault_index; 601 hptep = (__be64 *)(kvm->arch.hpt_virt + (index << 4)); 602 rev = &kvm->arch.revmap[index]; 603 preempt_disable(); 604 while (!try_lock_hpte(hptep, HPTE_V_HVLOCK)) 605 cpu_relax(); 606 hpte[0] = be64_to_cpu(hptep[0]) & ~HPTE_V_HVLOCK; 607 hpte[1] = be64_to_cpu(hptep[1]); 608 hpte[2] = r = rev->guest_rpte; 609 asm volatile("lwsync" : : : "memory"); 610 hptep[0] = cpu_to_be64(hpte[0]); 611 preempt_enable(); 612 613 if (hpte[0] != vcpu->arch.pgfault_hpte[0] || 614 hpte[1] != vcpu->arch.pgfault_hpte[1]) 615 return RESUME_GUEST; 616 617 /* Translate the logical address and get the page */ 618 psize = hpte_page_size(hpte[0], r); 619 gpa_base = r & HPTE_R_RPN & ~(psize - 1); 620 gfn_base = gpa_base >> PAGE_SHIFT; 621 gpa = gpa_base | (ea & (psize - 1)); 622 gfn = gpa >> PAGE_SHIFT; 623 memslot = gfn_to_memslot(kvm, gfn); 624 625 /* No memslot means it's an emulated MMIO region */ 626 if (!memslot || (memslot->flags & KVM_MEMSLOT_INVALID)) 627 return kvmppc_hv_emulate_mmio(run, vcpu, gpa, ea, 628 dsisr & DSISR_ISSTORE); 629 630 if (!kvm->arch.using_mmu_notifiers) 631 return -EFAULT; /* should never get here */ 632 633 /* 634 * This should never happen, because of the slot_is_aligned() 635 * check in kvmppc_do_h_enter(). 636 */ 637 if (gfn_base < memslot->base_gfn) 638 return -EFAULT; 639 640 /* used to check for invalidations in progress */ 641 mmu_seq = kvm->mmu_notifier_seq; 642 smp_rmb(); 643 644 is_io = 0; 645 pfn = 0; 646 page = NULL; 647 pte_size = PAGE_SIZE; 648 writing = (dsisr & DSISR_ISSTORE) != 0; 649 /* If writing != 0, then the HPTE must allow writing, if we get here */ 650 write_ok = writing; 651 hva = gfn_to_hva_memslot(memslot, gfn); 652 npages = get_user_pages_fast(hva, 1, writing, pages); 653 if (npages < 1) { 654 /* Check if it's an I/O mapping */ 655 down_read(¤t->mm->mmap_sem); 656 vma = find_vma(current->mm, hva); 657 if (vma && vma->vm_start <= hva && hva + psize <= vma->vm_end && 658 (vma->vm_flags & VM_PFNMAP)) { 659 pfn = vma->vm_pgoff + 660 ((hva - vma->vm_start) >> PAGE_SHIFT); 661 pte_size = psize; 662 is_io = hpte_cache_bits(pgprot_val(vma->vm_page_prot)); 663 write_ok = vma->vm_flags & VM_WRITE; 664 } 665 up_read(¤t->mm->mmap_sem); 666 if (!pfn) 667 return -EFAULT; 668 } else { 669 page = pages[0]; 670 pfn = page_to_pfn(page); 671 if (PageHuge(page)) { 672 page = compound_head(page); 673 pte_size <<= compound_order(page); 674 } 675 /* if the guest wants write access, see if that is OK */ 676 if (!writing && hpte_is_writable(r)) { 677 unsigned int hugepage_shift; 678 pte_t *ptep, pte; 679 680 /* 681 * We need to protect against page table destruction 682 * while looking up and updating the pte. 683 */ 684 rcu_read_lock_sched(); 685 ptep = find_linux_pte_or_hugepte(current->mm->pgd, 686 hva, &hugepage_shift); 687 if (ptep) { 688 pte = kvmppc_read_update_linux_pte(ptep, 1, 689 hugepage_shift); 690 if (pte_write(pte)) 691 write_ok = 1; 692 } 693 rcu_read_unlock_sched(); 694 } 695 } 696 697 ret = -EFAULT; 698 if (psize > pte_size) 699 goto out_put; 700 701 /* Check WIMG vs. the actual page we're accessing */ 702 if (!hpte_cache_flags_ok(r, is_io)) { 703 if (is_io) 704 return -EFAULT; 705 /* 706 * Allow guest to map emulated device memory as 707 * uncacheable, but actually make it cacheable. 708 */ 709 r = (r & ~(HPTE_R_W|HPTE_R_I|HPTE_R_G)) | HPTE_R_M; 710 } 711 712 /* 713 * Set the HPTE to point to pfn. 714 * Since the pfn is at PAGE_SIZE granularity, make sure we 715 * don't mask out lower-order bits if psize < PAGE_SIZE. 716 */ 717 if (psize < PAGE_SIZE) 718 psize = PAGE_SIZE; 719 r = (r & ~(HPTE_R_PP0 - psize)) | ((pfn << PAGE_SHIFT) & ~(psize - 1)); 720 if (hpte_is_writable(r) && !write_ok) 721 r = hpte_make_readonly(r); 722 ret = RESUME_GUEST; 723 preempt_disable(); 724 while (!try_lock_hpte(hptep, HPTE_V_HVLOCK)) 725 cpu_relax(); 726 if ((be64_to_cpu(hptep[0]) & ~HPTE_V_HVLOCK) != hpte[0] || 727 be64_to_cpu(hptep[1]) != hpte[1] || 728 rev->guest_rpte != hpte[2]) 729 /* HPTE has been changed under us; let the guest retry */ 730 goto out_unlock; 731 hpte[0] = (hpte[0] & ~HPTE_V_ABSENT) | HPTE_V_VALID; 732 733 /* Always put the HPTE in the rmap chain for the page base address */ 734 rmap = &memslot->arch.rmap[gfn_base - memslot->base_gfn]; 735 lock_rmap(rmap); 736 737 /* Check if we might have been invalidated; let the guest retry if so */ 738 ret = RESUME_GUEST; 739 if (mmu_notifier_retry(vcpu->kvm, mmu_seq)) { 740 unlock_rmap(rmap); 741 goto out_unlock; 742 } 743 744 /* Only set R/C in real HPTE if set in both *rmap and guest_rpte */ 745 rcbits = *rmap >> KVMPPC_RMAP_RC_SHIFT; 746 r &= rcbits | ~(HPTE_R_R | HPTE_R_C); 747 748 if (be64_to_cpu(hptep[0]) & HPTE_V_VALID) { 749 /* HPTE was previously valid, so we need to invalidate it */ 750 unlock_rmap(rmap); 751 hptep[0] |= cpu_to_be64(HPTE_V_ABSENT); 752 kvmppc_invalidate_hpte(kvm, hptep, index); 753 /* don't lose previous R and C bits */ 754 r |= be64_to_cpu(hptep[1]) & (HPTE_R_R | HPTE_R_C); 755 } else { 756 kvmppc_add_revmap_chain(kvm, rev, rmap, index, 0); 757 } 758 759 hptep[1] = cpu_to_be64(r); 760 eieio(); 761 hptep[0] = cpu_to_be64(hpte[0]); 762 asm volatile("ptesync" : : : "memory"); 763 preempt_enable(); 764 if (page && hpte_is_writable(r)) 765 SetPageDirty(page); 766 767 out_put: 768 if (page) { 769 /* 770 * We drop pages[0] here, not page because page might 771 * have been set to the head page of a compound, but 772 * we have to drop the reference on the correct tail 773 * page to match the get inside gup() 774 */ 775 put_page(pages[0]); 776 } 777 return ret; 778 779 out_unlock: 780 hptep[0] &= ~cpu_to_be64(HPTE_V_HVLOCK); 781 preempt_enable(); 782 goto out_put; 783 } 784 785 static void kvmppc_rmap_reset(struct kvm *kvm) 786 { 787 struct kvm_memslots *slots; 788 struct kvm_memory_slot *memslot; 789 int srcu_idx; 790 791 srcu_idx = srcu_read_lock(&kvm->srcu); 792 slots = kvm->memslots; 793 kvm_for_each_memslot(memslot, slots) { 794 /* 795 * This assumes it is acceptable to lose reference and 796 * change bits across a reset. 797 */ 798 memset(memslot->arch.rmap, 0, 799 memslot->npages * sizeof(*memslot->arch.rmap)); 800 } 801 srcu_read_unlock(&kvm->srcu, srcu_idx); 802 } 803 804 static int kvm_handle_hva_range(struct kvm *kvm, 805 unsigned long start, 806 unsigned long end, 807 int (*handler)(struct kvm *kvm, 808 unsigned long *rmapp, 809 unsigned long gfn)) 810 { 811 int ret; 812 int retval = 0; 813 struct kvm_memslots *slots; 814 struct kvm_memory_slot *memslot; 815 816 slots = kvm_memslots(kvm); 817 kvm_for_each_memslot(memslot, slots) { 818 unsigned long hva_start, hva_end; 819 gfn_t gfn, gfn_end; 820 821 hva_start = max(start, memslot->userspace_addr); 822 hva_end = min(end, memslot->userspace_addr + 823 (memslot->npages << PAGE_SHIFT)); 824 if (hva_start >= hva_end) 825 continue; 826 /* 827 * {gfn(page) | page intersects with [hva_start, hva_end)} = 828 * {gfn, gfn+1, ..., gfn_end-1}. 829 */ 830 gfn = hva_to_gfn_memslot(hva_start, memslot); 831 gfn_end = hva_to_gfn_memslot(hva_end + PAGE_SIZE - 1, memslot); 832 833 for (; gfn < gfn_end; ++gfn) { 834 gfn_t gfn_offset = gfn - memslot->base_gfn; 835 836 ret = handler(kvm, &memslot->arch.rmap[gfn_offset], gfn); 837 retval |= ret; 838 } 839 } 840 841 return retval; 842 } 843 844 static int kvm_handle_hva(struct kvm *kvm, unsigned long hva, 845 int (*handler)(struct kvm *kvm, unsigned long *rmapp, 846 unsigned long gfn)) 847 { 848 return kvm_handle_hva_range(kvm, hva, hva + 1, handler); 849 } 850 851 static int kvm_unmap_rmapp(struct kvm *kvm, unsigned long *rmapp, 852 unsigned long gfn) 853 { 854 struct revmap_entry *rev = kvm->arch.revmap; 855 unsigned long h, i, j; 856 __be64 *hptep; 857 unsigned long ptel, psize, rcbits; 858 859 for (;;) { 860 lock_rmap(rmapp); 861 if (!(*rmapp & KVMPPC_RMAP_PRESENT)) { 862 unlock_rmap(rmapp); 863 break; 864 } 865 866 /* 867 * To avoid an ABBA deadlock with the HPTE lock bit, 868 * we can't spin on the HPTE lock while holding the 869 * rmap chain lock. 870 */ 871 i = *rmapp & KVMPPC_RMAP_INDEX; 872 hptep = (__be64 *) (kvm->arch.hpt_virt + (i << 4)); 873 if (!try_lock_hpte(hptep, HPTE_V_HVLOCK)) { 874 /* unlock rmap before spinning on the HPTE lock */ 875 unlock_rmap(rmapp); 876 while (be64_to_cpu(hptep[0]) & HPTE_V_HVLOCK) 877 cpu_relax(); 878 continue; 879 } 880 j = rev[i].forw; 881 if (j == i) { 882 /* chain is now empty */ 883 *rmapp &= ~(KVMPPC_RMAP_PRESENT | KVMPPC_RMAP_INDEX); 884 } else { 885 /* remove i from chain */ 886 h = rev[i].back; 887 rev[h].forw = j; 888 rev[j].back = h; 889 rev[i].forw = rev[i].back = i; 890 *rmapp = (*rmapp & ~KVMPPC_RMAP_INDEX) | j; 891 } 892 893 /* Now check and modify the HPTE */ 894 ptel = rev[i].guest_rpte; 895 psize = hpte_page_size(be64_to_cpu(hptep[0]), ptel); 896 if ((be64_to_cpu(hptep[0]) & HPTE_V_VALID) && 897 hpte_rpn(ptel, psize) == gfn) { 898 if (kvm->arch.using_mmu_notifiers) 899 hptep[0] |= cpu_to_be64(HPTE_V_ABSENT); 900 kvmppc_invalidate_hpte(kvm, hptep, i); 901 /* Harvest R and C */ 902 rcbits = be64_to_cpu(hptep[1]) & (HPTE_R_R | HPTE_R_C); 903 *rmapp |= rcbits << KVMPPC_RMAP_RC_SHIFT; 904 if (rcbits & ~rev[i].guest_rpte) { 905 rev[i].guest_rpte = ptel | rcbits; 906 note_hpte_modification(kvm, &rev[i]); 907 } 908 } 909 unlock_rmap(rmapp); 910 hptep[0] &= ~cpu_to_be64(HPTE_V_HVLOCK); 911 } 912 return 0; 913 } 914 915 int kvm_unmap_hva_hv(struct kvm *kvm, unsigned long hva) 916 { 917 if (kvm->arch.using_mmu_notifiers) 918 kvm_handle_hva(kvm, hva, kvm_unmap_rmapp); 919 return 0; 920 } 921 922 int kvm_unmap_hva_range_hv(struct kvm *kvm, unsigned long start, unsigned long end) 923 { 924 if (kvm->arch.using_mmu_notifiers) 925 kvm_handle_hva_range(kvm, start, end, kvm_unmap_rmapp); 926 return 0; 927 } 928 929 void kvmppc_core_flush_memslot_hv(struct kvm *kvm, 930 struct kvm_memory_slot *memslot) 931 { 932 unsigned long *rmapp; 933 unsigned long gfn; 934 unsigned long n; 935 936 rmapp = memslot->arch.rmap; 937 gfn = memslot->base_gfn; 938 for (n = memslot->npages; n; --n) { 939 /* 940 * Testing the present bit without locking is OK because 941 * the memslot has been marked invalid already, and hence 942 * no new HPTEs referencing this page can be created, 943 * thus the present bit can't go from 0 to 1. 944 */ 945 if (*rmapp & KVMPPC_RMAP_PRESENT) 946 kvm_unmap_rmapp(kvm, rmapp, gfn); 947 ++rmapp; 948 ++gfn; 949 } 950 } 951 952 static int kvm_age_rmapp(struct kvm *kvm, unsigned long *rmapp, 953 unsigned long gfn) 954 { 955 struct revmap_entry *rev = kvm->arch.revmap; 956 unsigned long head, i, j; 957 __be64 *hptep; 958 int ret = 0; 959 960 retry: 961 lock_rmap(rmapp); 962 if (*rmapp & KVMPPC_RMAP_REFERENCED) { 963 *rmapp &= ~KVMPPC_RMAP_REFERENCED; 964 ret = 1; 965 } 966 if (!(*rmapp & KVMPPC_RMAP_PRESENT)) { 967 unlock_rmap(rmapp); 968 return ret; 969 } 970 971 i = head = *rmapp & KVMPPC_RMAP_INDEX; 972 do { 973 hptep = (__be64 *) (kvm->arch.hpt_virt + (i << 4)); 974 j = rev[i].forw; 975 976 /* If this HPTE isn't referenced, ignore it */ 977 if (!(be64_to_cpu(hptep[1]) & HPTE_R_R)) 978 continue; 979 980 if (!try_lock_hpte(hptep, HPTE_V_HVLOCK)) { 981 /* unlock rmap before spinning on the HPTE lock */ 982 unlock_rmap(rmapp); 983 while (be64_to_cpu(hptep[0]) & HPTE_V_HVLOCK) 984 cpu_relax(); 985 goto retry; 986 } 987 988 /* Now check and modify the HPTE */ 989 if ((be64_to_cpu(hptep[0]) & HPTE_V_VALID) && 990 (be64_to_cpu(hptep[1]) & HPTE_R_R)) { 991 kvmppc_clear_ref_hpte(kvm, hptep, i); 992 if (!(rev[i].guest_rpte & HPTE_R_R)) { 993 rev[i].guest_rpte |= HPTE_R_R; 994 note_hpte_modification(kvm, &rev[i]); 995 } 996 ret = 1; 997 } 998 hptep[0] &= ~cpu_to_be64(HPTE_V_HVLOCK); 999 } while ((i = j) != head); 1000 1001 unlock_rmap(rmapp); 1002 return ret; 1003 } 1004 1005 int kvm_age_hva_hv(struct kvm *kvm, unsigned long start, unsigned long end) 1006 { 1007 if (!kvm->arch.using_mmu_notifiers) 1008 return 0; 1009 return kvm_handle_hva_range(kvm, start, end, kvm_age_rmapp); 1010 } 1011 1012 static int kvm_test_age_rmapp(struct kvm *kvm, unsigned long *rmapp, 1013 unsigned long gfn) 1014 { 1015 struct revmap_entry *rev = kvm->arch.revmap; 1016 unsigned long head, i, j; 1017 unsigned long *hp; 1018 int ret = 1; 1019 1020 if (*rmapp & KVMPPC_RMAP_REFERENCED) 1021 return 1; 1022 1023 lock_rmap(rmapp); 1024 if (*rmapp & KVMPPC_RMAP_REFERENCED) 1025 goto out; 1026 1027 if (*rmapp & KVMPPC_RMAP_PRESENT) { 1028 i = head = *rmapp & KVMPPC_RMAP_INDEX; 1029 do { 1030 hp = (unsigned long *)(kvm->arch.hpt_virt + (i << 4)); 1031 j = rev[i].forw; 1032 if (be64_to_cpu(hp[1]) & HPTE_R_R) 1033 goto out; 1034 } while ((i = j) != head); 1035 } 1036 ret = 0; 1037 1038 out: 1039 unlock_rmap(rmapp); 1040 return ret; 1041 } 1042 1043 int kvm_test_age_hva_hv(struct kvm *kvm, unsigned long hva) 1044 { 1045 if (!kvm->arch.using_mmu_notifiers) 1046 return 0; 1047 return kvm_handle_hva(kvm, hva, kvm_test_age_rmapp); 1048 } 1049 1050 void kvm_set_spte_hva_hv(struct kvm *kvm, unsigned long hva, pte_t pte) 1051 { 1052 if (!kvm->arch.using_mmu_notifiers) 1053 return; 1054 kvm_handle_hva(kvm, hva, kvm_unmap_rmapp); 1055 } 1056 1057 static int vcpus_running(struct kvm *kvm) 1058 { 1059 return atomic_read(&kvm->arch.vcpus_running) != 0; 1060 } 1061 1062 /* 1063 * Returns the number of system pages that are dirty. 1064 * This can be more than 1 if we find a huge-page HPTE. 1065 */ 1066 static int kvm_test_clear_dirty_npages(struct kvm *kvm, unsigned long *rmapp) 1067 { 1068 struct revmap_entry *rev = kvm->arch.revmap; 1069 unsigned long head, i, j; 1070 unsigned long n; 1071 unsigned long v, r; 1072 __be64 *hptep; 1073 int npages_dirty = 0; 1074 1075 retry: 1076 lock_rmap(rmapp); 1077 if (*rmapp & KVMPPC_RMAP_CHANGED) { 1078 *rmapp &= ~KVMPPC_RMAP_CHANGED; 1079 npages_dirty = 1; 1080 } 1081 if (!(*rmapp & KVMPPC_RMAP_PRESENT)) { 1082 unlock_rmap(rmapp); 1083 return npages_dirty; 1084 } 1085 1086 i = head = *rmapp & KVMPPC_RMAP_INDEX; 1087 do { 1088 unsigned long hptep1; 1089 hptep = (__be64 *) (kvm->arch.hpt_virt + (i << 4)); 1090 j = rev[i].forw; 1091 1092 /* 1093 * Checking the C (changed) bit here is racy since there 1094 * is no guarantee about when the hardware writes it back. 1095 * If the HPTE is not writable then it is stable since the 1096 * page can't be written to, and we would have done a tlbie 1097 * (which forces the hardware to complete any writeback) 1098 * when making the HPTE read-only. 1099 * If vcpus are running then this call is racy anyway 1100 * since the page could get dirtied subsequently, so we 1101 * expect there to be a further call which would pick up 1102 * any delayed C bit writeback. 1103 * Otherwise we need to do the tlbie even if C==0 in 1104 * order to pick up any delayed writeback of C. 1105 */ 1106 hptep1 = be64_to_cpu(hptep[1]); 1107 if (!(hptep1 & HPTE_R_C) && 1108 (!hpte_is_writable(hptep1) || vcpus_running(kvm))) 1109 continue; 1110 1111 if (!try_lock_hpte(hptep, HPTE_V_HVLOCK)) { 1112 /* unlock rmap before spinning on the HPTE lock */ 1113 unlock_rmap(rmapp); 1114 while (hptep[0] & cpu_to_be64(HPTE_V_HVLOCK)) 1115 cpu_relax(); 1116 goto retry; 1117 } 1118 1119 /* Now check and modify the HPTE */ 1120 if (!(hptep[0] & cpu_to_be64(HPTE_V_VALID))) 1121 continue; 1122 1123 /* need to make it temporarily absent so C is stable */ 1124 hptep[0] |= cpu_to_be64(HPTE_V_ABSENT); 1125 kvmppc_invalidate_hpte(kvm, hptep, i); 1126 v = be64_to_cpu(hptep[0]); 1127 r = be64_to_cpu(hptep[1]); 1128 if (r & HPTE_R_C) { 1129 hptep[1] = cpu_to_be64(r & ~HPTE_R_C); 1130 if (!(rev[i].guest_rpte & HPTE_R_C)) { 1131 rev[i].guest_rpte |= HPTE_R_C; 1132 note_hpte_modification(kvm, &rev[i]); 1133 } 1134 n = hpte_page_size(v, r); 1135 n = (n + PAGE_SIZE - 1) >> PAGE_SHIFT; 1136 if (n > npages_dirty) 1137 npages_dirty = n; 1138 eieio(); 1139 } 1140 v &= ~(HPTE_V_ABSENT | HPTE_V_HVLOCK); 1141 v |= HPTE_V_VALID; 1142 hptep[0] = cpu_to_be64(v); 1143 } while ((i = j) != head); 1144 1145 unlock_rmap(rmapp); 1146 return npages_dirty; 1147 } 1148 1149 static void harvest_vpa_dirty(struct kvmppc_vpa *vpa, 1150 struct kvm_memory_slot *memslot, 1151 unsigned long *map) 1152 { 1153 unsigned long gfn; 1154 1155 if (!vpa->dirty || !vpa->pinned_addr) 1156 return; 1157 gfn = vpa->gpa >> PAGE_SHIFT; 1158 if (gfn < memslot->base_gfn || 1159 gfn >= memslot->base_gfn + memslot->npages) 1160 return; 1161 1162 vpa->dirty = false; 1163 if (map) 1164 __set_bit_le(gfn - memslot->base_gfn, map); 1165 } 1166 1167 long kvmppc_hv_get_dirty_log(struct kvm *kvm, struct kvm_memory_slot *memslot, 1168 unsigned long *map) 1169 { 1170 unsigned long i, j; 1171 unsigned long *rmapp; 1172 struct kvm_vcpu *vcpu; 1173 1174 preempt_disable(); 1175 rmapp = memslot->arch.rmap; 1176 for (i = 0; i < memslot->npages; ++i) { 1177 int npages = kvm_test_clear_dirty_npages(kvm, rmapp); 1178 /* 1179 * Note that if npages > 0 then i must be a multiple of npages, 1180 * since we always put huge-page HPTEs in the rmap chain 1181 * corresponding to their page base address. 1182 */ 1183 if (npages && map) 1184 for (j = i; npages; ++j, --npages) 1185 __set_bit_le(j, map); 1186 ++rmapp; 1187 } 1188 1189 /* Harvest dirty bits from VPA and DTL updates */ 1190 /* Note: we never modify the SLB shadow buffer areas */ 1191 kvm_for_each_vcpu(i, vcpu, kvm) { 1192 spin_lock(&vcpu->arch.vpa_update_lock); 1193 harvest_vpa_dirty(&vcpu->arch.vpa, memslot, map); 1194 harvest_vpa_dirty(&vcpu->arch.dtl, memslot, map); 1195 spin_unlock(&vcpu->arch.vpa_update_lock); 1196 } 1197 preempt_enable(); 1198 return 0; 1199 } 1200 1201 void *kvmppc_pin_guest_page(struct kvm *kvm, unsigned long gpa, 1202 unsigned long *nb_ret) 1203 { 1204 struct kvm_memory_slot *memslot; 1205 unsigned long gfn = gpa >> PAGE_SHIFT; 1206 struct page *page, *pages[1]; 1207 int npages; 1208 unsigned long hva, offset; 1209 unsigned long pa; 1210 unsigned long *physp; 1211 int srcu_idx; 1212 1213 srcu_idx = srcu_read_lock(&kvm->srcu); 1214 memslot = gfn_to_memslot(kvm, gfn); 1215 if (!memslot || (memslot->flags & KVM_MEMSLOT_INVALID)) 1216 goto err; 1217 if (!kvm->arch.using_mmu_notifiers) { 1218 physp = memslot->arch.slot_phys; 1219 if (!physp) 1220 goto err; 1221 physp += gfn - memslot->base_gfn; 1222 pa = *physp; 1223 if (!pa) { 1224 if (kvmppc_get_guest_page(kvm, gfn, memslot, 1225 PAGE_SIZE) < 0) 1226 goto err; 1227 pa = *physp; 1228 } 1229 page = pfn_to_page(pa >> PAGE_SHIFT); 1230 get_page(page); 1231 } else { 1232 hva = gfn_to_hva_memslot(memslot, gfn); 1233 npages = get_user_pages_fast(hva, 1, 1, pages); 1234 if (npages < 1) 1235 goto err; 1236 page = pages[0]; 1237 } 1238 srcu_read_unlock(&kvm->srcu, srcu_idx); 1239 1240 offset = gpa & (PAGE_SIZE - 1); 1241 if (nb_ret) 1242 *nb_ret = PAGE_SIZE - offset; 1243 return page_address(page) + offset; 1244 1245 err: 1246 srcu_read_unlock(&kvm->srcu, srcu_idx); 1247 return NULL; 1248 } 1249 1250 void kvmppc_unpin_guest_page(struct kvm *kvm, void *va, unsigned long gpa, 1251 bool dirty) 1252 { 1253 struct page *page = virt_to_page(va); 1254 struct kvm_memory_slot *memslot; 1255 unsigned long gfn; 1256 unsigned long *rmap; 1257 int srcu_idx; 1258 1259 put_page(page); 1260 1261 if (!dirty || !kvm->arch.using_mmu_notifiers) 1262 return; 1263 1264 /* We need to mark this page dirty in the rmap chain */ 1265 gfn = gpa >> PAGE_SHIFT; 1266 srcu_idx = srcu_read_lock(&kvm->srcu); 1267 memslot = gfn_to_memslot(kvm, gfn); 1268 if (memslot) { 1269 rmap = &memslot->arch.rmap[gfn - memslot->base_gfn]; 1270 lock_rmap(rmap); 1271 *rmap |= KVMPPC_RMAP_CHANGED; 1272 unlock_rmap(rmap); 1273 } 1274 srcu_read_unlock(&kvm->srcu, srcu_idx); 1275 } 1276 1277 /* 1278 * Functions for reading and writing the hash table via reads and 1279 * writes on a file descriptor. 1280 * 1281 * Reads return the guest view of the hash table, which has to be 1282 * pieced together from the real hash table and the guest_rpte 1283 * values in the revmap array. 1284 * 1285 * On writes, each HPTE written is considered in turn, and if it 1286 * is valid, it is written to the HPT as if an H_ENTER with the 1287 * exact flag set was done. When the invalid count is non-zero 1288 * in the header written to the stream, the kernel will make 1289 * sure that that many HPTEs are invalid, and invalidate them 1290 * if not. 1291 */ 1292 1293 struct kvm_htab_ctx { 1294 unsigned long index; 1295 unsigned long flags; 1296 struct kvm *kvm; 1297 int first_pass; 1298 }; 1299 1300 #define HPTE_SIZE (2 * sizeof(unsigned long)) 1301 1302 /* 1303 * Returns 1 if this HPT entry has been modified or has pending 1304 * R/C bit changes. 1305 */ 1306 static int hpte_dirty(struct revmap_entry *revp, __be64 *hptp) 1307 { 1308 unsigned long rcbits_unset; 1309 1310 if (revp->guest_rpte & HPTE_GR_MODIFIED) 1311 return 1; 1312 1313 /* Also need to consider changes in reference and changed bits */ 1314 rcbits_unset = ~revp->guest_rpte & (HPTE_R_R | HPTE_R_C); 1315 if ((be64_to_cpu(hptp[0]) & HPTE_V_VALID) && 1316 (be64_to_cpu(hptp[1]) & rcbits_unset)) 1317 return 1; 1318 1319 return 0; 1320 } 1321 1322 static long record_hpte(unsigned long flags, __be64 *hptp, 1323 unsigned long *hpte, struct revmap_entry *revp, 1324 int want_valid, int first_pass) 1325 { 1326 unsigned long v, r; 1327 unsigned long rcbits_unset; 1328 int ok = 1; 1329 int valid, dirty; 1330 1331 /* Unmodified entries are uninteresting except on the first pass */ 1332 dirty = hpte_dirty(revp, hptp); 1333 if (!first_pass && !dirty) 1334 return 0; 1335 1336 valid = 0; 1337 if (be64_to_cpu(hptp[0]) & (HPTE_V_VALID | HPTE_V_ABSENT)) { 1338 valid = 1; 1339 if ((flags & KVM_GET_HTAB_BOLTED_ONLY) && 1340 !(be64_to_cpu(hptp[0]) & HPTE_V_BOLTED)) 1341 valid = 0; 1342 } 1343 if (valid != want_valid) 1344 return 0; 1345 1346 v = r = 0; 1347 if (valid || dirty) { 1348 /* lock the HPTE so it's stable and read it */ 1349 preempt_disable(); 1350 while (!try_lock_hpte(hptp, HPTE_V_HVLOCK)) 1351 cpu_relax(); 1352 v = be64_to_cpu(hptp[0]); 1353 1354 /* re-evaluate valid and dirty from synchronized HPTE value */ 1355 valid = !!(v & HPTE_V_VALID); 1356 dirty = !!(revp->guest_rpte & HPTE_GR_MODIFIED); 1357 1358 /* Harvest R and C into guest view if necessary */ 1359 rcbits_unset = ~revp->guest_rpte & (HPTE_R_R | HPTE_R_C); 1360 if (valid && (rcbits_unset & be64_to_cpu(hptp[1]))) { 1361 revp->guest_rpte |= (be64_to_cpu(hptp[1]) & 1362 (HPTE_R_R | HPTE_R_C)) | HPTE_GR_MODIFIED; 1363 dirty = 1; 1364 } 1365 1366 if (v & HPTE_V_ABSENT) { 1367 v &= ~HPTE_V_ABSENT; 1368 v |= HPTE_V_VALID; 1369 valid = 1; 1370 } 1371 if ((flags & KVM_GET_HTAB_BOLTED_ONLY) && !(v & HPTE_V_BOLTED)) 1372 valid = 0; 1373 1374 r = revp->guest_rpte; 1375 /* only clear modified if this is the right sort of entry */ 1376 if (valid == want_valid && dirty) { 1377 r &= ~HPTE_GR_MODIFIED; 1378 revp->guest_rpte = r; 1379 } 1380 asm volatile(PPC_RELEASE_BARRIER "" : : : "memory"); 1381 hptp[0] &= ~cpu_to_be64(HPTE_V_HVLOCK); 1382 preempt_enable(); 1383 if (!(valid == want_valid && (first_pass || dirty))) 1384 ok = 0; 1385 } 1386 hpte[0] = cpu_to_be64(v); 1387 hpte[1] = cpu_to_be64(r); 1388 return ok; 1389 } 1390 1391 static ssize_t kvm_htab_read(struct file *file, char __user *buf, 1392 size_t count, loff_t *ppos) 1393 { 1394 struct kvm_htab_ctx *ctx = file->private_data; 1395 struct kvm *kvm = ctx->kvm; 1396 struct kvm_get_htab_header hdr; 1397 __be64 *hptp; 1398 struct revmap_entry *revp; 1399 unsigned long i, nb, nw; 1400 unsigned long __user *lbuf; 1401 struct kvm_get_htab_header __user *hptr; 1402 unsigned long flags; 1403 int first_pass; 1404 unsigned long hpte[2]; 1405 1406 if (!access_ok(VERIFY_WRITE, buf, count)) 1407 return -EFAULT; 1408 1409 first_pass = ctx->first_pass; 1410 flags = ctx->flags; 1411 1412 i = ctx->index; 1413 hptp = (__be64 *)(kvm->arch.hpt_virt + (i * HPTE_SIZE)); 1414 revp = kvm->arch.revmap + i; 1415 lbuf = (unsigned long __user *)buf; 1416 1417 nb = 0; 1418 while (nb + sizeof(hdr) + HPTE_SIZE < count) { 1419 /* Initialize header */ 1420 hptr = (struct kvm_get_htab_header __user *)buf; 1421 hdr.n_valid = 0; 1422 hdr.n_invalid = 0; 1423 nw = nb; 1424 nb += sizeof(hdr); 1425 lbuf = (unsigned long __user *)(buf + sizeof(hdr)); 1426 1427 /* Skip uninteresting entries, i.e. clean on not-first pass */ 1428 if (!first_pass) { 1429 while (i < kvm->arch.hpt_npte && 1430 !hpte_dirty(revp, hptp)) { 1431 ++i; 1432 hptp += 2; 1433 ++revp; 1434 } 1435 } 1436 hdr.index = i; 1437 1438 /* Grab a series of valid entries */ 1439 while (i < kvm->arch.hpt_npte && 1440 hdr.n_valid < 0xffff && 1441 nb + HPTE_SIZE < count && 1442 record_hpte(flags, hptp, hpte, revp, 1, first_pass)) { 1443 /* valid entry, write it out */ 1444 ++hdr.n_valid; 1445 if (__put_user(hpte[0], lbuf) || 1446 __put_user(hpte[1], lbuf + 1)) 1447 return -EFAULT; 1448 nb += HPTE_SIZE; 1449 lbuf += 2; 1450 ++i; 1451 hptp += 2; 1452 ++revp; 1453 } 1454 /* Now skip invalid entries while we can */ 1455 while (i < kvm->arch.hpt_npte && 1456 hdr.n_invalid < 0xffff && 1457 record_hpte(flags, hptp, hpte, revp, 0, first_pass)) { 1458 /* found an invalid entry */ 1459 ++hdr.n_invalid; 1460 ++i; 1461 hptp += 2; 1462 ++revp; 1463 } 1464 1465 if (hdr.n_valid || hdr.n_invalid) { 1466 /* write back the header */ 1467 if (__copy_to_user(hptr, &hdr, sizeof(hdr))) 1468 return -EFAULT; 1469 nw = nb; 1470 buf = (char __user *)lbuf; 1471 } else { 1472 nb = nw; 1473 } 1474 1475 /* Check if we've wrapped around the hash table */ 1476 if (i >= kvm->arch.hpt_npte) { 1477 i = 0; 1478 ctx->first_pass = 0; 1479 break; 1480 } 1481 } 1482 1483 ctx->index = i; 1484 1485 return nb; 1486 } 1487 1488 static ssize_t kvm_htab_write(struct file *file, const char __user *buf, 1489 size_t count, loff_t *ppos) 1490 { 1491 struct kvm_htab_ctx *ctx = file->private_data; 1492 struct kvm *kvm = ctx->kvm; 1493 struct kvm_get_htab_header hdr; 1494 unsigned long i, j; 1495 unsigned long v, r; 1496 unsigned long __user *lbuf; 1497 __be64 *hptp; 1498 unsigned long tmp[2]; 1499 ssize_t nb; 1500 long int err, ret; 1501 int rma_setup; 1502 1503 if (!access_ok(VERIFY_READ, buf, count)) 1504 return -EFAULT; 1505 1506 /* lock out vcpus from running while we're doing this */ 1507 mutex_lock(&kvm->lock); 1508 rma_setup = kvm->arch.rma_setup_done; 1509 if (rma_setup) { 1510 kvm->arch.rma_setup_done = 0; /* temporarily */ 1511 /* order rma_setup_done vs. vcpus_running */ 1512 smp_mb(); 1513 if (atomic_read(&kvm->arch.vcpus_running)) { 1514 kvm->arch.rma_setup_done = 1; 1515 mutex_unlock(&kvm->lock); 1516 return -EBUSY; 1517 } 1518 } 1519 1520 err = 0; 1521 for (nb = 0; nb + sizeof(hdr) <= count; ) { 1522 err = -EFAULT; 1523 if (__copy_from_user(&hdr, buf, sizeof(hdr))) 1524 break; 1525 1526 err = 0; 1527 if (nb + hdr.n_valid * HPTE_SIZE > count) 1528 break; 1529 1530 nb += sizeof(hdr); 1531 buf += sizeof(hdr); 1532 1533 err = -EINVAL; 1534 i = hdr.index; 1535 if (i >= kvm->arch.hpt_npte || 1536 i + hdr.n_valid + hdr.n_invalid > kvm->arch.hpt_npte) 1537 break; 1538 1539 hptp = (__be64 *)(kvm->arch.hpt_virt + (i * HPTE_SIZE)); 1540 lbuf = (unsigned long __user *)buf; 1541 for (j = 0; j < hdr.n_valid; ++j) { 1542 err = -EFAULT; 1543 if (__get_user(v, lbuf) || __get_user(r, lbuf + 1)) 1544 goto out; 1545 err = -EINVAL; 1546 if (!(v & HPTE_V_VALID)) 1547 goto out; 1548 lbuf += 2; 1549 nb += HPTE_SIZE; 1550 1551 if (be64_to_cpu(hptp[0]) & (HPTE_V_VALID | HPTE_V_ABSENT)) 1552 kvmppc_do_h_remove(kvm, 0, i, 0, tmp); 1553 err = -EIO; 1554 ret = kvmppc_virtmode_do_h_enter(kvm, H_EXACT, i, v, r, 1555 tmp); 1556 if (ret != H_SUCCESS) { 1557 pr_err("kvm_htab_write ret %ld i=%ld v=%lx " 1558 "r=%lx\n", ret, i, v, r); 1559 goto out; 1560 } 1561 if (!rma_setup && is_vrma_hpte(v)) { 1562 unsigned long psize = hpte_base_page_size(v, r); 1563 unsigned long senc = slb_pgsize_encoding(psize); 1564 unsigned long lpcr; 1565 1566 kvm->arch.vrma_slb_v = senc | SLB_VSID_B_1T | 1567 (VRMA_VSID << SLB_VSID_SHIFT_1T); 1568 lpcr = senc << (LPCR_VRMASD_SH - 4); 1569 kvmppc_update_lpcr(kvm, lpcr, LPCR_VRMASD); 1570 rma_setup = 1; 1571 } 1572 ++i; 1573 hptp += 2; 1574 } 1575 1576 for (j = 0; j < hdr.n_invalid; ++j) { 1577 if (be64_to_cpu(hptp[0]) & (HPTE_V_VALID | HPTE_V_ABSENT)) 1578 kvmppc_do_h_remove(kvm, 0, i, 0, tmp); 1579 ++i; 1580 hptp += 2; 1581 } 1582 err = 0; 1583 } 1584 1585 out: 1586 /* Order HPTE updates vs. rma_setup_done */ 1587 smp_wmb(); 1588 kvm->arch.rma_setup_done = rma_setup; 1589 mutex_unlock(&kvm->lock); 1590 1591 if (err) 1592 return err; 1593 return nb; 1594 } 1595 1596 static int kvm_htab_release(struct inode *inode, struct file *filp) 1597 { 1598 struct kvm_htab_ctx *ctx = filp->private_data; 1599 1600 filp->private_data = NULL; 1601 if (!(ctx->flags & KVM_GET_HTAB_WRITE)) 1602 atomic_dec(&ctx->kvm->arch.hpte_mod_interest); 1603 kvm_put_kvm(ctx->kvm); 1604 kfree(ctx); 1605 return 0; 1606 } 1607 1608 static const struct file_operations kvm_htab_fops = { 1609 .read = kvm_htab_read, 1610 .write = kvm_htab_write, 1611 .llseek = default_llseek, 1612 .release = kvm_htab_release, 1613 }; 1614 1615 int kvm_vm_ioctl_get_htab_fd(struct kvm *kvm, struct kvm_get_htab_fd *ghf) 1616 { 1617 int ret; 1618 struct kvm_htab_ctx *ctx; 1619 int rwflag; 1620 1621 /* reject flags we don't recognize */ 1622 if (ghf->flags & ~(KVM_GET_HTAB_BOLTED_ONLY | KVM_GET_HTAB_WRITE)) 1623 return -EINVAL; 1624 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 1625 if (!ctx) 1626 return -ENOMEM; 1627 kvm_get_kvm(kvm); 1628 ctx->kvm = kvm; 1629 ctx->index = ghf->start_index; 1630 ctx->flags = ghf->flags; 1631 ctx->first_pass = 1; 1632 1633 rwflag = (ghf->flags & KVM_GET_HTAB_WRITE) ? O_WRONLY : O_RDONLY; 1634 ret = anon_inode_getfd("kvm-htab", &kvm_htab_fops, ctx, rwflag | O_CLOEXEC); 1635 if (ret < 0) { 1636 kvm_put_kvm(kvm); 1637 return ret; 1638 } 1639 1640 if (rwflag == O_RDONLY) { 1641 mutex_lock(&kvm->slots_lock); 1642 atomic_inc(&kvm->arch.hpte_mod_interest); 1643 /* make sure kvmppc_do_h_enter etc. see the increment */ 1644 synchronize_srcu_expedited(&kvm->srcu); 1645 mutex_unlock(&kvm->slots_lock); 1646 } 1647 1648 return ret; 1649 } 1650 1651 void kvmppc_mmu_book3s_hv_init(struct kvm_vcpu *vcpu) 1652 { 1653 struct kvmppc_mmu *mmu = &vcpu->arch.mmu; 1654 1655 if (cpu_has_feature(CPU_FTR_ARCH_206)) 1656 vcpu->arch.slb_nr = 32; /* POWER7 */ 1657 else 1658 vcpu->arch.slb_nr = 64; 1659 1660 mmu->xlate = kvmppc_mmu_book3s_64_hv_xlate; 1661 mmu->reset_msr = kvmppc_mmu_book3s_64_hv_reset_msr; 1662 1663 vcpu->arch.hflags |= BOOK3S_HFLAG_SLB; 1664 } 1665