m25p80: avoid out of bounds accesses
[qemu.git] / target-ppc / machine.c
blob4820f22377e226da551bb265c7d16f7b8262b254
1 #include "qemu/osdep.h"
2 #include "qemu-common.h"
3 #include "cpu.h"
4 #include "exec/exec-all.h"
5 #include "hw/hw.h"
6 #include "hw/boards.h"
7 #include "sysemu/kvm.h"
8 #include "helper_regs.h"
9 #include "mmu-hash64.h"
10 #include "migration/cpu.h"
11 #include "exec/exec-all.h"
13 static int cpu_load_old(QEMUFile *f, void *opaque, int version_id)
15 PowerPCCPU *cpu = opaque;
16 CPUPPCState *env = &cpu->env;
17 unsigned int i, j;
18 target_ulong sdr1;
19 uint32_t fpscr;
20 target_ulong xer;
22 for (i = 0; i < 32; i++)
23 qemu_get_betls(f, &env->gpr[i]);
24 #if !defined(TARGET_PPC64)
25 for (i = 0; i < 32; i++)
26 qemu_get_betls(f, &env->gprh[i]);
27 #endif
28 qemu_get_betls(f, &env->lr);
29 qemu_get_betls(f, &env->ctr);
30 for (i = 0; i < 8; i++)
31 qemu_get_be32s(f, &env->crf[i]);
32 qemu_get_betls(f, &xer);
33 cpu_write_xer(env, xer);
34 qemu_get_betls(f, &env->reserve_addr);
35 qemu_get_betls(f, &env->msr);
36 for (i = 0; i < 4; i++)
37 qemu_get_betls(f, &env->tgpr[i]);
38 for (i = 0; i < 32; i++) {
39 union {
40 float64 d;
41 uint64_t l;
42 } u;
43 u.l = qemu_get_be64(f);
44 env->fpr[i] = u.d;
46 qemu_get_be32s(f, &fpscr);
47 env->fpscr = fpscr;
48 qemu_get_sbe32s(f, &env->access_type);
49 #if defined(TARGET_PPC64)
50 qemu_get_betls(f, &env->spr[SPR_ASR]);
51 qemu_get_sbe32s(f, &env->slb_nr);
52 #endif
53 qemu_get_betls(f, &sdr1);
54 for (i = 0; i < 32; i++)
55 qemu_get_betls(f, &env->sr[i]);
56 for (i = 0; i < 2; i++)
57 for (j = 0; j < 8; j++)
58 qemu_get_betls(f, &env->DBAT[i][j]);
59 for (i = 0; i < 2; i++)
60 for (j = 0; j < 8; j++)
61 qemu_get_betls(f, &env->IBAT[i][j]);
62 qemu_get_sbe32s(f, &env->nb_tlb);
63 qemu_get_sbe32s(f, &env->tlb_per_way);
64 qemu_get_sbe32s(f, &env->nb_ways);
65 qemu_get_sbe32s(f, &env->last_way);
66 qemu_get_sbe32s(f, &env->id_tlbs);
67 qemu_get_sbe32s(f, &env->nb_pids);
68 if (env->tlb.tlb6) {
69 // XXX assumes 6xx
70 for (i = 0; i < env->nb_tlb; i++) {
71 qemu_get_betls(f, &env->tlb.tlb6[i].pte0);
72 qemu_get_betls(f, &env->tlb.tlb6[i].pte1);
73 qemu_get_betls(f, &env->tlb.tlb6[i].EPN);
76 for (i = 0; i < 4; i++)
77 qemu_get_betls(f, &env->pb[i]);
78 for (i = 0; i < 1024; i++)
79 qemu_get_betls(f, &env->spr[i]);
80 if (!env->external_htab) {
81 ppc_store_sdr1(env, sdr1);
83 qemu_get_be32s(f, &env->vscr);
84 qemu_get_be64s(f, &env->spe_acc);
85 qemu_get_be32s(f, &env->spe_fscr);
86 qemu_get_betls(f, &env->msr_mask);
87 qemu_get_be32s(f, &env->flags);
88 qemu_get_sbe32s(f, &env->error_code);
89 qemu_get_be32s(f, &env->pending_interrupts);
90 qemu_get_be32s(f, &env->irq_input_state);
91 for (i = 0; i < POWERPC_EXCP_NB; i++)
92 qemu_get_betls(f, &env->excp_vectors[i]);
93 qemu_get_betls(f, &env->excp_prefix);
94 qemu_get_betls(f, &env->ivor_mask);
95 qemu_get_betls(f, &env->ivpr_mask);
96 qemu_get_betls(f, &env->hreset_vector);
97 qemu_get_betls(f, &env->nip);
98 qemu_get_betls(f, &env->hflags);
99 qemu_get_betls(f, &env->hflags_nmsr);
100 qemu_get_sbe32(f); /* Discard unused mmu_idx */
101 qemu_get_sbe32(f); /* Discard unused power_mode */
103 /* Recompute mmu indices */
104 hreg_compute_mem_idx(env);
106 return 0;
109 static int get_avr(QEMUFile *f, void *pv, size_t size)
111 ppc_avr_t *v = pv;
113 v->u64[0] = qemu_get_be64(f);
114 v->u64[1] = qemu_get_be64(f);
116 return 0;
119 static void put_avr(QEMUFile *f, void *pv, size_t size)
121 ppc_avr_t *v = pv;
123 qemu_put_be64(f, v->u64[0]);
124 qemu_put_be64(f, v->u64[1]);
127 static const VMStateInfo vmstate_info_avr = {
128 .name = "avr",
129 .get = get_avr,
130 .put = put_avr,
133 #define VMSTATE_AVR_ARRAY_V(_f, _s, _n, _v) \
134 VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_avr, ppc_avr_t)
136 #define VMSTATE_AVR_ARRAY(_f, _s, _n) \
137 VMSTATE_AVR_ARRAY_V(_f, _s, _n, 0)
139 static void cpu_pre_save(void *opaque)
141 PowerPCCPU *cpu = opaque;
142 CPUPPCState *env = &cpu->env;
143 int i;
145 env->spr[SPR_LR] = env->lr;
146 env->spr[SPR_CTR] = env->ctr;
147 env->spr[SPR_XER] = cpu_read_xer(env);
148 #if defined(TARGET_PPC64)
149 env->spr[SPR_CFAR] = env->cfar;
150 #endif
151 env->spr[SPR_BOOKE_SPEFSCR] = env->spe_fscr;
153 for (i = 0; (i < 4) && (i < env->nb_BATs); i++) {
154 env->spr[SPR_DBAT0U + 2*i] = env->DBAT[0][i];
155 env->spr[SPR_DBAT0U + 2*i + 1] = env->DBAT[1][i];
156 env->spr[SPR_IBAT0U + 2*i] = env->IBAT[0][i];
157 env->spr[SPR_IBAT0U + 2*i + 1] = env->IBAT[1][i];
159 for (i = 0; (i < 4) && ((i+4) < env->nb_BATs); i++) {
160 env->spr[SPR_DBAT4U + 2*i] = env->DBAT[0][i+4];
161 env->spr[SPR_DBAT4U + 2*i + 1] = env->DBAT[1][i+4];
162 env->spr[SPR_IBAT4U + 2*i] = env->IBAT[0][i+4];
163 env->spr[SPR_IBAT4U + 2*i + 1] = env->IBAT[1][i+4];
167 static int cpu_post_load(void *opaque, int version_id)
169 PowerPCCPU *cpu = opaque;
170 CPUPPCState *env = &cpu->env;
171 int i;
172 target_ulong msr;
175 * We always ignore the source PVR. The user or management
176 * software has to take care of running QEMU in a compatible mode.
178 env->spr[SPR_PVR] = env->spr_cb[SPR_PVR].default_value;
179 env->lr = env->spr[SPR_LR];
180 env->ctr = env->spr[SPR_CTR];
181 cpu_write_xer(env, env->spr[SPR_XER]);
182 #if defined(TARGET_PPC64)
183 env->cfar = env->spr[SPR_CFAR];
184 #endif
185 env->spe_fscr = env->spr[SPR_BOOKE_SPEFSCR];
187 for (i = 0; (i < 4) && (i < env->nb_BATs); i++) {
188 env->DBAT[0][i] = env->spr[SPR_DBAT0U + 2*i];
189 env->DBAT[1][i] = env->spr[SPR_DBAT0U + 2*i + 1];
190 env->IBAT[0][i] = env->spr[SPR_IBAT0U + 2*i];
191 env->IBAT[1][i] = env->spr[SPR_IBAT0U + 2*i + 1];
193 for (i = 0; (i < 4) && ((i+4) < env->nb_BATs); i++) {
194 env->DBAT[0][i+4] = env->spr[SPR_DBAT4U + 2*i];
195 env->DBAT[1][i+4] = env->spr[SPR_DBAT4U + 2*i + 1];
196 env->IBAT[0][i+4] = env->spr[SPR_IBAT4U + 2*i];
197 env->IBAT[1][i+4] = env->spr[SPR_IBAT4U + 2*i + 1];
200 if (!env->external_htab) {
201 /* Restore htab_base and htab_mask variables */
202 ppc_store_sdr1(env, env->spr[SPR_SDR1]);
205 /* Invalidate all msr bits except MSR_TGPR/MSR_HVB before restoring */
206 msr = env->msr;
207 env->msr ^= ~((1ULL << MSR_TGPR) | MSR_HVB);
208 ppc_store_msr(env, msr);
210 hreg_compute_mem_idx(env);
212 return 0;
215 static bool fpu_needed(void *opaque)
217 PowerPCCPU *cpu = opaque;
219 return (cpu->env.insns_flags & PPC_FLOAT);
222 static const VMStateDescription vmstate_fpu = {
223 .name = "cpu/fpu",
224 .version_id = 1,
225 .minimum_version_id = 1,
226 .needed = fpu_needed,
227 .fields = (VMStateField[]) {
228 VMSTATE_FLOAT64_ARRAY(env.fpr, PowerPCCPU, 32),
229 VMSTATE_UINTTL(env.fpscr, PowerPCCPU),
230 VMSTATE_END_OF_LIST()
234 static bool altivec_needed(void *opaque)
236 PowerPCCPU *cpu = opaque;
238 return (cpu->env.insns_flags & PPC_ALTIVEC);
241 static const VMStateDescription vmstate_altivec = {
242 .name = "cpu/altivec",
243 .version_id = 1,
244 .minimum_version_id = 1,
245 .needed = altivec_needed,
246 .fields = (VMStateField[]) {
247 VMSTATE_AVR_ARRAY(env.avr, PowerPCCPU, 32),
248 VMSTATE_UINT32(env.vscr, PowerPCCPU),
249 VMSTATE_END_OF_LIST()
253 static bool vsx_needed(void *opaque)
255 PowerPCCPU *cpu = opaque;
257 return (cpu->env.insns_flags2 & PPC2_VSX);
260 static const VMStateDescription vmstate_vsx = {
261 .name = "cpu/vsx",
262 .version_id = 1,
263 .minimum_version_id = 1,
264 .needed = vsx_needed,
265 .fields = (VMStateField[]) {
266 VMSTATE_UINT64_ARRAY(env.vsr, PowerPCCPU, 32),
267 VMSTATE_END_OF_LIST()
271 #ifdef TARGET_PPC64
272 /* Transactional memory state */
273 static bool tm_needed(void *opaque)
275 PowerPCCPU *cpu = opaque;
276 CPUPPCState *env = &cpu->env;
277 return msr_ts;
280 static const VMStateDescription vmstate_tm = {
281 .name = "cpu/tm",
282 .version_id = 1,
283 .minimum_version_id = 1,
284 .minimum_version_id_old = 1,
285 .needed = tm_needed,
286 .fields = (VMStateField []) {
287 VMSTATE_UINTTL_ARRAY(env.tm_gpr, PowerPCCPU, 32),
288 VMSTATE_AVR_ARRAY(env.tm_vsr, PowerPCCPU, 64),
289 VMSTATE_UINT64(env.tm_cr, PowerPCCPU),
290 VMSTATE_UINT64(env.tm_lr, PowerPCCPU),
291 VMSTATE_UINT64(env.tm_ctr, PowerPCCPU),
292 VMSTATE_UINT64(env.tm_fpscr, PowerPCCPU),
293 VMSTATE_UINT64(env.tm_amr, PowerPCCPU),
294 VMSTATE_UINT64(env.tm_ppr, PowerPCCPU),
295 VMSTATE_UINT64(env.tm_vrsave, PowerPCCPU),
296 VMSTATE_UINT32(env.tm_vscr, PowerPCCPU),
297 VMSTATE_UINT64(env.tm_dscr, PowerPCCPU),
298 VMSTATE_UINT64(env.tm_tar, PowerPCCPU),
299 VMSTATE_END_OF_LIST()
302 #endif
304 static bool sr_needed(void *opaque)
306 #ifdef TARGET_PPC64
307 PowerPCCPU *cpu = opaque;
309 return !(cpu->env.mmu_model & POWERPC_MMU_64);
310 #else
311 return true;
312 #endif
315 static const VMStateDescription vmstate_sr = {
316 .name = "cpu/sr",
317 .version_id = 1,
318 .minimum_version_id = 1,
319 .needed = sr_needed,
320 .fields = (VMStateField[]) {
321 VMSTATE_UINTTL_ARRAY(env.sr, PowerPCCPU, 32),
322 VMSTATE_END_OF_LIST()
326 #ifdef TARGET_PPC64
327 static int get_slbe(QEMUFile *f, void *pv, size_t size)
329 ppc_slb_t *v = pv;
331 v->esid = qemu_get_be64(f);
332 v->vsid = qemu_get_be64(f);
334 return 0;
337 static void put_slbe(QEMUFile *f, void *pv, size_t size)
339 ppc_slb_t *v = pv;
341 qemu_put_be64(f, v->esid);
342 qemu_put_be64(f, v->vsid);
345 static const VMStateInfo vmstate_info_slbe = {
346 .name = "slbe",
347 .get = get_slbe,
348 .put = put_slbe,
351 #define VMSTATE_SLB_ARRAY_V(_f, _s, _n, _v) \
352 VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_slbe, ppc_slb_t)
354 #define VMSTATE_SLB_ARRAY(_f, _s, _n) \
355 VMSTATE_SLB_ARRAY_V(_f, _s, _n, 0)
357 static bool slb_needed(void *opaque)
359 PowerPCCPU *cpu = opaque;
361 /* We don't support any of the old segment table based 64-bit CPUs */
362 return (cpu->env.mmu_model & POWERPC_MMU_64);
365 static int slb_post_load(void *opaque, int version_id)
367 PowerPCCPU *cpu = opaque;
368 CPUPPCState *env = &cpu->env;
369 int i;
371 /* We've pulled in the raw esid and vsid values from the migration
372 * stream, but we need to recompute the page size pointers */
373 for (i = 0; i < env->slb_nr; i++) {
374 if (ppc_store_slb(cpu, i, env->slb[i].esid, env->slb[i].vsid) < 0) {
375 /* Migration source had bad values in its SLB */
376 return -1;
380 return 0;
383 static const VMStateDescription vmstate_slb = {
384 .name = "cpu/slb",
385 .version_id = 1,
386 .minimum_version_id = 1,
387 .needed = slb_needed,
388 .post_load = slb_post_load,
389 .fields = (VMStateField[]) {
390 VMSTATE_INT32_EQUAL(env.slb_nr, PowerPCCPU),
391 VMSTATE_SLB_ARRAY(env.slb, PowerPCCPU, MAX_SLB_ENTRIES),
392 VMSTATE_END_OF_LIST()
395 #endif /* TARGET_PPC64 */
397 static const VMStateDescription vmstate_tlb6xx_entry = {
398 .name = "cpu/tlb6xx_entry",
399 .version_id = 1,
400 .minimum_version_id = 1,
401 .fields = (VMStateField[]) {
402 VMSTATE_UINTTL(pte0, ppc6xx_tlb_t),
403 VMSTATE_UINTTL(pte1, ppc6xx_tlb_t),
404 VMSTATE_UINTTL(EPN, ppc6xx_tlb_t),
405 VMSTATE_END_OF_LIST()
409 static bool tlb6xx_needed(void *opaque)
411 PowerPCCPU *cpu = opaque;
412 CPUPPCState *env = &cpu->env;
414 return env->nb_tlb && (env->tlb_type == TLB_6XX);
417 static const VMStateDescription vmstate_tlb6xx = {
418 .name = "cpu/tlb6xx",
419 .version_id = 1,
420 .minimum_version_id = 1,
421 .needed = tlb6xx_needed,
422 .fields = (VMStateField[]) {
423 VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
424 VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlb6, PowerPCCPU,
425 env.nb_tlb,
426 vmstate_tlb6xx_entry,
427 ppc6xx_tlb_t),
428 VMSTATE_UINTTL_ARRAY(env.tgpr, PowerPCCPU, 4),
429 VMSTATE_END_OF_LIST()
433 static const VMStateDescription vmstate_tlbemb_entry = {
434 .name = "cpu/tlbemb_entry",
435 .version_id = 1,
436 .minimum_version_id = 1,
437 .fields = (VMStateField[]) {
438 VMSTATE_UINT64(RPN, ppcemb_tlb_t),
439 VMSTATE_UINTTL(EPN, ppcemb_tlb_t),
440 VMSTATE_UINTTL(PID, ppcemb_tlb_t),
441 VMSTATE_UINTTL(size, ppcemb_tlb_t),
442 VMSTATE_UINT32(prot, ppcemb_tlb_t),
443 VMSTATE_UINT32(attr, ppcemb_tlb_t),
444 VMSTATE_END_OF_LIST()
448 static bool tlbemb_needed(void *opaque)
450 PowerPCCPU *cpu = opaque;
451 CPUPPCState *env = &cpu->env;
453 return env->nb_tlb && (env->tlb_type == TLB_EMB);
456 static bool pbr403_needed(void *opaque)
458 PowerPCCPU *cpu = opaque;
459 uint32_t pvr = cpu->env.spr[SPR_PVR];
461 return (pvr & 0xffff0000) == 0x00200000;
464 static const VMStateDescription vmstate_pbr403 = {
465 .name = "cpu/pbr403",
466 .version_id = 1,
467 .minimum_version_id = 1,
468 .needed = pbr403_needed,
469 .fields = (VMStateField[]) {
470 VMSTATE_UINTTL_ARRAY(env.pb, PowerPCCPU, 4),
471 VMSTATE_END_OF_LIST()
475 static const VMStateDescription vmstate_tlbemb = {
476 .name = "cpu/tlb6xx",
477 .version_id = 1,
478 .minimum_version_id = 1,
479 .needed = tlbemb_needed,
480 .fields = (VMStateField[]) {
481 VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
482 VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlbe, PowerPCCPU,
483 env.nb_tlb,
484 vmstate_tlbemb_entry,
485 ppcemb_tlb_t),
486 /* 403 protection registers */
487 VMSTATE_END_OF_LIST()
489 .subsections = (const VMStateDescription*[]) {
490 &vmstate_pbr403,
491 NULL
495 static const VMStateDescription vmstate_tlbmas_entry = {
496 .name = "cpu/tlbmas_entry",
497 .version_id = 1,
498 .minimum_version_id = 1,
499 .fields = (VMStateField[]) {
500 VMSTATE_UINT32(mas8, ppcmas_tlb_t),
501 VMSTATE_UINT32(mas1, ppcmas_tlb_t),
502 VMSTATE_UINT64(mas2, ppcmas_tlb_t),
503 VMSTATE_UINT64(mas7_3, ppcmas_tlb_t),
504 VMSTATE_END_OF_LIST()
508 static bool tlbmas_needed(void *opaque)
510 PowerPCCPU *cpu = opaque;
511 CPUPPCState *env = &cpu->env;
513 return env->nb_tlb && (env->tlb_type == TLB_MAS);
516 static const VMStateDescription vmstate_tlbmas = {
517 .name = "cpu/tlbmas",
518 .version_id = 1,
519 .minimum_version_id = 1,
520 .needed = tlbmas_needed,
521 .fields = (VMStateField[]) {
522 VMSTATE_INT32_EQUAL(env.nb_tlb, PowerPCCPU),
523 VMSTATE_STRUCT_VARRAY_POINTER_INT32(env.tlb.tlbm, PowerPCCPU,
524 env.nb_tlb,
525 vmstate_tlbmas_entry,
526 ppcmas_tlb_t),
527 VMSTATE_END_OF_LIST()
531 const VMStateDescription vmstate_ppc_cpu = {
532 .name = "cpu",
533 .version_id = 5,
534 .minimum_version_id = 5,
535 .minimum_version_id_old = 4,
536 .load_state_old = cpu_load_old,
537 .pre_save = cpu_pre_save,
538 .post_load = cpu_post_load,
539 .fields = (VMStateField[]) {
540 VMSTATE_UNUSED(sizeof(target_ulong)), /* was _EQUAL(env.spr[SPR_PVR]) */
542 /* User mode architected state */
543 VMSTATE_UINTTL_ARRAY(env.gpr, PowerPCCPU, 32),
544 #if !defined(TARGET_PPC64)
545 VMSTATE_UINTTL_ARRAY(env.gprh, PowerPCCPU, 32),
546 #endif
547 VMSTATE_UINT32_ARRAY(env.crf, PowerPCCPU, 8),
548 VMSTATE_UINTTL(env.nip, PowerPCCPU),
550 /* SPRs */
551 VMSTATE_UINTTL_ARRAY(env.spr, PowerPCCPU, 1024),
552 VMSTATE_UINT64(env.spe_acc, PowerPCCPU),
554 /* Reservation */
555 VMSTATE_UINTTL(env.reserve_addr, PowerPCCPU),
557 /* Supervisor mode architected state */
558 VMSTATE_UINTTL(env.msr, PowerPCCPU),
560 /* Internal state */
561 VMSTATE_UINTTL(env.hflags_nmsr, PowerPCCPU),
562 /* FIXME: access_type? */
564 /* Sanity checking */
565 VMSTATE_UINTTL_EQUAL(env.msr_mask, PowerPCCPU),
566 VMSTATE_UINT64_EQUAL(env.insns_flags, PowerPCCPU),
567 VMSTATE_UINT64_EQUAL(env.insns_flags2, PowerPCCPU),
568 VMSTATE_UINT32_EQUAL(env.nb_BATs, PowerPCCPU),
569 VMSTATE_END_OF_LIST()
571 .subsections = (const VMStateDescription*[]) {
572 &vmstate_fpu,
573 &vmstate_altivec,
574 &vmstate_vsx,
575 &vmstate_sr,
576 #ifdef TARGET_PPC64
577 &vmstate_tm,
578 &vmstate_slb,
579 #endif /* TARGET_PPC64 */
580 &vmstate_tlb6xx,
581 &vmstate_tlbemb,
582 &vmstate_tlbmas,
583 NULL