target-ppc/mmu-hash32.c

   1 /*
   2  *  PowerPC MMU, TLB and BAT emulation helpers for QEMU.
   3  *
   4  *  Copyright (c) 2003-2007 Jocelyn Mayer
   5  *  Copyright (c) 2013 David Gibson, IBM Corporation
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "cpu.h"
  22 #include "helper.h"
  23 #include "sysemu/kvm.h"
  24 #include "kvm_ppc.h"
  25 #include "mmu-hash32.h"
  26
  27 //#define DEBUG_MMU
  28 //#define DEBUG_BAT
  29
  30 #ifdef DEBUG_MMU
  31 #  define LOG_MMU(...) qemu_log(__VA_ARGS__)
  32 #  define LOG_MMU_STATE(cpu) log_cpu_state((cpu), 0)
  33 #else
  34 #  define LOG_MMU(...) do { } while (0)
  35 #  define LOG_MMU_STATE(cpu) do { } while (0)
  36 #endif
  37
  38 #ifdef DEBUG_BATS
  39 #  define LOG_BATS(...) qemu_log(__VA_ARGS__)
  40 #else
  41 #  define LOG_BATS(...) do { } while (0)
  42 #endif
  43
  44 struct mmu_ctx_hash32 {
  45     hwaddr raddr;      /* Real address              */
  46     int prot;                      /* Protection bits           */
  47     int key;                       /* Access key                */
  48 };
  49
  50 static int ppc_hash32_pp_prot(int key, int pp, int nx)
  51 {
  52     int prot;
  53
  54     if (key == 0) {
  55         switch (pp) {
  56         case 0x0:
  57         case 0x1:
  58         case 0x2:
  59             prot = PAGE_READ | PAGE_WRITE;
  60             break;
  61
  62         case 0x3:
  63             prot = PAGE_READ;
  64             break;
  65
  66         default:
  67             abort();
  68         }
  69     } else {
  70         switch (pp) {
  71         case 0x0:
  72             prot = 0;
  73             break;
  74
  75         case 0x1:
  76         case 0x3:
  77             prot = PAGE_READ;
  78             break;
  79
  80         case 0x2:
  81             prot = PAGE_READ | PAGE_WRITE;
  82             break;
  83
  84         default:
  85             abort();
  86         }
  87     }
  88     if (nx == 0) {
  89         prot |= PAGE_EXEC;
  90     }
  91
  92     return prot;
  93 }
  94
  95 static int ppc_hash32_pte_prot(CPUPPCState *env,
  96                                target_ulong sr, ppc_hash_pte32_t pte)
  97 {
  98     unsigned pp, key;
  99
 100     key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
 101     pp = pte.pte1 & HPTE32_R_PP;
 102
 103     return ppc_hash32_pp_prot(key, pp, !!(sr & SR32_NX));
 104 }
 105
 106 static target_ulong hash32_bat_size(CPUPPCState *env,
 107                                     target_ulong batu, target_ulong batl)
 108 {
 109     if ((msr_pr && !(batu & BATU32_VP))
 110         || (!msr_pr && !(batu & BATU32_VS))) {
 111         return 0;
 112     }
 113
 114     return BATU32_BEPI & ~((batu & BATU32_BL) << 15);
 115 }
 116
 117 static int hash32_bat_prot(CPUPPCState *env,
 118                            target_ulong batu, target_ulong batl)
 119 {
 120     int pp, prot;
 121
 122     prot = 0;
 123     pp = batl & BATL32_PP;
 124     if (pp != 0) {
 125         prot = PAGE_READ | PAGE_EXEC;
 126         if (pp == 0x2) {
 127             prot |= PAGE_WRITE;
 128         }
 129     }
 130     return prot;
 131 }
 132
 133 static target_ulong hash32_bat_601_size(CPUPPCState *env,
 134                                 target_ulong batu, target_ulong batl)
 135 {
 136     if (!(batl & BATL32_601_V)) {
 137         return 0;
 138     }
 139
 140     return BATU32_BEPI & ~((batl & BATL32_601_BL) << 17);
 141 }
 142
 143 static int hash32_bat_601_prot(CPUPPCState *env,
 144                                target_ulong batu, target_ulong batl)
 145 {
 146     int key, pp;
 147
 148     pp = batu & BATU32_601_PP;
 149     if (msr_pr == 0) {
 150         key = !!(batu & BATU32_601_KS);
 151     } else {
 152         key = !!(batu & BATU32_601_KP);
 153     }
 154     return ppc_hash32_pp_prot(key, pp, 0);
 155 }
 156
 157 static hwaddr ppc_hash32_bat_lookup(CPUPPCState *env, target_ulong ea, int rwx,
 158                                     int *prot)
 159 {
 160     target_ulong *BATlt, *BATut;
 161     int i;
 162
 163     LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
 164              rwx == 2 ? 'I' : 'D', ea);
 165     if (rwx == 2) {
 166         BATlt = env->IBAT[1];
 167         BATut = env->IBAT[0];
 168     } else {
 169         BATlt = env->DBAT[1];
 170         BATut = env->DBAT[0];
 171     }
 172     for (i = 0; i < env->nb_BATs; i++) {
 173         target_ulong batu = BATut[i];
 174         target_ulong batl = BATlt[i];
 175         target_ulong mask;
 176
 177         if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 178             mask = hash32_bat_601_size(env, batu, batl);
 179         } else {
 180             mask = hash32_bat_size(env, batu, batl);
 181         }
 182         LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 183                  " BATl " TARGET_FMT_lx "\n", __func__,
 184                  type == ACCESS_CODE ? 'I' : 'D', i, ea, batu, batl);
 185
 186         if (mask && ((ea & mask) == (batu & BATU32_BEPI))) {
 187             hwaddr raddr = (batl & mask) | (ea & ~mask);
 188
 189             if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 190                 *prot = hash32_bat_601_prot(env, batu, batl);
 191             } else {
 192                 *prot = hash32_bat_prot(env, batu, batl);
 193             }
 194
 195             return raddr & TARGET_PAGE_MASK;
 196         }
 197     }
 198
 199     /* No hit */
 200 #if defined(DEBUG_BATS)
 201     if (qemu_log_enabled()) {
 202         LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", ea);
 203         for (i = 0; i < 4; i++) {
 204             BATu = &BATut[i];
 205             BATl = &BATlt[i];
 206             BEPIu = *BATu & BATU32_BEPIU;
 207             BEPIl = *BATu & BATU32_BEPIL;
 208             bl = (*BATu & 0x00001FFC) << 15;
 209             LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 210                      " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
 211                      TARGET_FMT_lx " " TARGET_FMT_lx "\n",
 212                      __func__, type == ACCESS_CODE ? 'I' : 'D', i, ea,
 213                      *BATu, *BATl, BEPIu, BEPIl, bl);
 214         }
 215     }
 216 #endif
 217
 218     return -1;
 219 }
 220
 221 static int ppc_hash32_direct_store(CPUPPCState *env, target_ulong sr,
 222                                    target_ulong eaddr, int rwx,
 223                                    hwaddr *raddr, int *prot)
 224 {
 225     CPUState *cs = CPU(ppc_env_get_cpu(env));
 226     int key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
 227
 228     LOG_MMU("direct store...\n");
 229
 230     if ((sr & 0x1FF00000) >> 20 == 0x07f) {
 231         /* Memory-forced I/O controller interface access */
 232         /* If T=1 and BUID=x'07F', the 601 performs a memory access
 233          * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
 234          */
 235         *raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
 236         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 237         return 0;
 238     }
 239
 240     if (rwx == 2) {
 241         /* No code fetch is allowed in direct-store areas */
 242         cs->exception_index = POWERPC_EXCP_ISI;
 243         env->error_code = 0x10000000;
 244         return 1;
 245     }
 246
 247     switch (env->access_type) {
 248     case ACCESS_INT:
 249         /* Integer load/store : only access allowed */
 250         break;
 251     case ACCESS_FLOAT:
 252         /* Floating point load/store */
 253         cs->exception_index = POWERPC_EXCP_ALIGN;
 254         env->error_code = POWERPC_EXCP_ALIGN_FP;
 255         env->spr[SPR_DAR] = eaddr;
 256         return 1;
 257     case ACCESS_RES:
 258         /* lwarx, ldarx or srwcx. */
 259         env->error_code = 0;
 260         env->spr[SPR_DAR] = eaddr;
 261         if (rwx == 1) {
 262             env->spr[SPR_DSISR] = 0x06000000;
 263         } else {
 264             env->spr[SPR_DSISR] = 0x04000000;
 265         }
 266         return 1;
 267     case ACCESS_CACHE:
 268         /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
 269         /* Should make the instruction do no-op.
 270          * As it already do no-op, it's quite easy :-)
 271          */
 272         *raddr = eaddr;
 273         return 0;
 274     case ACCESS_EXT:
 275         /* eciwx or ecowx */
 276         cs->exception_index = POWERPC_EXCP_DSI;
 277         env->error_code = 0;
 278         env->spr[SPR_DAR] = eaddr;
 279         if (rwx == 1) {
 280             env->spr[SPR_DSISR] = 0x06100000;
 281         } else {
 282             env->spr[SPR_DSISR] = 0x04100000;
 283         }
 284         return 1;
 285     default:
 286         qemu_log("ERROR: instruction should not need "
 287                  "address translation\n");
 288         abort();
 289     }
 290     if ((rwx == 1 || key != 1) && (rwx == 0 || key != 0)) {
 291         *raddr = eaddr;
 292         return 0;
 293     } else {
 294         cs->exception_index = POWERPC_EXCP_DSI;
 295         env->error_code = 0;
 296         env->spr[SPR_DAR] = eaddr;
 297         if (rwx == 1) {
 298             env->spr[SPR_DSISR] = 0x0a000000;
 299         } else {
 300             env->spr[SPR_DSISR] = 0x08000000;
 301         }
 302         return 1;
 303     }
 304 }
 305
 306 hwaddr get_pteg_offset32(CPUPPCState *env, hwaddr hash)
 307 {
 308     return (hash * HASH_PTEG_SIZE_32) & env->htab_mask;
 309 }
 310
 311 static hwaddr ppc_hash32_pteg_search(CPUPPCState *env, hwaddr pteg_off,
 312                                      bool secondary, target_ulong ptem,
 313                                      ppc_hash_pte32_t *pte)
 314 {
 315     hwaddr pte_offset = pteg_off;
 316     target_ulong pte0, pte1;
 317     int i;
 318
 319     for (i = 0; i < HPTES_PER_GROUP; i++) {
 320         pte0 = ppc_hash32_load_hpte0(env, pte_offset);
 321         pte1 = ppc_hash32_load_hpte1(env, pte_offset);
 322
 323         if ((pte0 & HPTE32_V_VALID)
 324             && (secondary == !!(pte0 & HPTE32_V_SECONDARY))
 325             && HPTE32_V_COMPARE(pte0, ptem)) {
 326             pte->pte0 = pte0;
 327             pte->pte1 = pte1;
 328             return pte_offset;
 329         }
 330
 331         pte_offset += HASH_PTE_SIZE_32;
 332     }
 333
 334     return -1;
 335 }
 336
 337 static hwaddr ppc_hash32_htab_lookup(CPUPPCState *env,
 338                                      target_ulong sr, target_ulong eaddr,
 339                                      ppc_hash_pte32_t *pte)
 340 {
 341     hwaddr pteg_off, pte_offset;
 342     hwaddr hash;
 343     uint32_t vsid, pgidx, ptem;
 344
 345     vsid = sr & SR32_VSID;
 346     pgidx = (eaddr & ~SEGMENT_MASK_256M) >> TARGET_PAGE_BITS;
 347     hash = vsid ^ pgidx;
 348     ptem = (vsid << 7) | (pgidx >> 10);
 349
 350     /* Page address translation */
 351     LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
 352             " hash " TARGET_FMT_plx "\n",
 353             env->htab_base, env->htab_mask, hash);
 354
 355     /* Primary PTEG lookup */
 356     LOG_MMU("0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 357             " vsid=%" PRIx32 " ptem=%" PRIx32
 358             " hash=" TARGET_FMT_plx "\n",
 359             env->htab_base, env->htab_mask, vsid, ptem, hash);
 360     pteg_off = get_pteg_offset32(env, hash);
 361     pte_offset = ppc_hash32_pteg_search(env, pteg_off, 0, ptem, pte);
 362     if (pte_offset == -1) {
 363         /* Secondary PTEG lookup */
 364         LOG_MMU("1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 365                 " vsid=%" PRIx32 " api=%" PRIx32
 366                 " hash=" TARGET_FMT_plx "\n", env->htab_base,
 367                 env->htab_mask, vsid, ptem, ~hash);
 368         pteg_off = get_pteg_offset32(env, ~hash);
 369         pte_offset = ppc_hash32_pteg_search(env, pteg_off, 1, ptem, pte);
 370     }
 371
 372     return pte_offset;
 373 }
 374
 375 static hwaddr ppc_hash32_pte_raddr(target_ulong sr, ppc_hash_pte32_t pte,
 376                                    target_ulong eaddr)
 377 {
 378     hwaddr rpn = pte.pte1 & HPTE32_R_RPN;
 379     hwaddr mask = ~TARGET_PAGE_MASK;
 380
 381     return (rpn & ~mask) | (eaddr & mask);
 382 }
 383
 384 int ppc_hash32_handle_mmu_fault(PowerPCCPU *cpu, target_ulong eaddr, int rwx,
 385                                 int mmu_idx)
 386 {
 387     CPUState *cs = CPU(cpu);
 388     CPUPPCState *env = &cpu->env;
 389     target_ulong sr;
 390     hwaddr pte_offset;
 391     ppc_hash_pte32_t pte;
 392     int prot;
 393     uint32_t new_pte1;
 394     const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
 395     hwaddr raddr;
 396
 397     assert((rwx == 0) || (rwx == 1) || (rwx == 2));
 398
 399     /* 1. Handle real mode accesses */
 400     if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
 401         /* Translation is off */
 402         raddr = eaddr;
 403         tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 404                      PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
 405                      TARGET_PAGE_SIZE);
 406         return 0;
 407     }
 408
 409     /* 2. Check Block Address Translation entries (BATs) */
 410     if (env->nb_BATs != 0) {
 411         raddr = ppc_hash32_bat_lookup(env, eaddr, rwx, &prot);
 412         if (raddr != -1) {
 413             if (need_prot[rwx] & ~prot) {
 414                 if (rwx == 2) {
 415                     cs->exception_index = POWERPC_EXCP_ISI;
 416                     env->error_code = 0x08000000;
 417                 } else {
 418                     cs->exception_index = POWERPC_EXCP_DSI;
 419                     env->error_code = 0;
 420                     env->spr[SPR_DAR] = eaddr;
 421                     if (rwx == 1) {
 422                         env->spr[SPR_DSISR] = 0x0a000000;
 423                     } else {
 424                         env->spr[SPR_DSISR] = 0x08000000;
 425                     }
 426                 }
 427                 return 1;
 428             }
 429
 430             tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
 431                          raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 432                          TARGET_PAGE_SIZE);
 433             return 0;
 434         }
 435     }
 436
 437     /* 3. Look up the Segment Register */
 438     sr = env->sr[eaddr >> 28];
 439
 440     /* 4. Handle direct store segments */
 441     if (sr & SR32_T) {
 442         if (ppc_hash32_direct_store(env, sr, eaddr, rwx,
 443                                     &raddr, &prot) == 0) {
 444             tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
 445                          raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 446                          TARGET_PAGE_SIZE);
 447             return 0;
 448         } else {
 449             return 1;
 450         }
 451     }
 452
 453     /* 5. Check for segment level no-execute violation */
 454     if ((rwx == 2) && (sr & SR32_NX)) {
 455         cs->exception_index = POWERPC_EXCP_ISI;
 456         env->error_code = 0x10000000;
 457         return 1;
 458     }
 459
 460     /* 6. Locate the PTE in the hash table */
 461     pte_offset = ppc_hash32_htab_lookup(env, sr, eaddr, &pte);
 462     if (pte_offset == -1) {
 463         if (rwx == 2) {
 464             cs->exception_index = POWERPC_EXCP_ISI;
 465             env->error_code = 0x40000000;
 466         } else {
 467             cs->exception_index = POWERPC_EXCP_DSI;
 468             env->error_code = 0;
 469             env->spr[SPR_DAR] = eaddr;
 470             if (rwx == 1) {
 471                 env->spr[SPR_DSISR] = 0x42000000;
 472             } else {
 473                 env->spr[SPR_DSISR] = 0x40000000;
 474             }
 475         }
 476
 477         return 1;
 478     }
 479     LOG_MMU("found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
 480
 481     /* 7. Check access permissions */
 482
 483     prot = ppc_hash32_pte_prot(env, sr, pte);
 484
 485     if (need_prot[rwx] & ~prot) {
 486         /* Access right violation */
 487         LOG_MMU("PTE access rejected\n");
 488         if (rwx == 2) {
 489             cs->exception_index = POWERPC_EXCP_ISI;
 490             env->error_code = 0x08000000;
 491         } else {
 492             cs->exception_index = POWERPC_EXCP_DSI;
 493             env->error_code = 0;
 494             env->spr[SPR_DAR] = eaddr;
 495             if (rwx == 1) {
 496                 env->spr[SPR_DSISR] = 0x0a000000;
 497             } else {
 498                 env->spr[SPR_DSISR] = 0x08000000;
 499             }
 500         }
 501         return 1;
 502     }
 503
 504     LOG_MMU("PTE access granted !\n");
 505
 506     /* 8. Update PTE referenced and changed bits if necessary */
 507
 508     new_pte1 = pte.pte1 | HPTE32_R_R; /* set referenced bit */
 509     if (rwx == 1) {
 510         new_pte1 |= HPTE32_R_C; /* set changed (dirty) bit */
 511     } else {
 512         /* Treat the page as read-only for now, so that a later write
 513          * will pass through this function again to set the C bit */
 514         prot &= ~PAGE_WRITE;
 515     }
 516
 517     if (new_pte1 != pte.pte1) {
 518         ppc_hash32_store_hpte1(env, pte_offset, new_pte1);
 519     }
 520
 521     /* 9. Determine the real address from the PTE */
 522
 523     raddr = ppc_hash32_pte_raddr(sr, pte, eaddr);
 524
 525     tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 526                  prot, mmu_idx, TARGET_PAGE_SIZE);
 527
 528     return 0;
 529 }
 530
 531 hwaddr ppc_hash32_get_phys_page_debug(CPUPPCState *env, target_ulong eaddr)
 532 {
 533     target_ulong sr;
 534     hwaddr pte_offset;
 535     ppc_hash_pte32_t pte;
 536     int prot;
 537
 538     if (msr_dr == 0) {
 539         /* Translation is off */
 540         return eaddr;
 541     }
 542
 543     if (env->nb_BATs != 0) {
 544         hwaddr raddr = ppc_hash32_bat_lookup(env, eaddr, 0, &prot);
 545         if (raddr != -1) {
 546             return raddr;
 547         }
 548     }
 549
 550     sr = env->sr[eaddr >> 28];
 551
 552     if (sr & SR32_T) {
 553         /* FIXME: Add suitable debug support for Direct Store segments */
 554         return -1;
 555     }
 556
 557     pte_offset = ppc_hash32_htab_lookup(env, sr, eaddr, &pte);
 558     if (pte_offset == -1) {
 559         return -1;
 560     }
 561
 562     return ppc_hash32_pte_raddr(sr, pte, eaddr) & TARGET_PAGE_MASK;
 563 }