target-ppc/mmu-hash32.c

   1 /*
   2  *  PowerPC MMU, TLB and BAT emulation helpers for QEMU.
   3  *
   4  *  Copyright (c) 2003-2007 Jocelyn Mayer
   5  *  Copyright (c) 2013 David Gibson, IBM Corporation
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "cpu.h"
  22 #include "exec/helper-proto.h"
  23 #include "sysemu/kvm.h"
  24 #include "kvm_ppc.h"
  25 #include "mmu-hash32.h"
  26
  27 //#define DEBUG_BAT
  28
  29 #ifdef DEBUG_BATS
  30 #  define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
  31 #else
  32 #  define LOG_BATS(...) do { } while (0)
  33 #endif
  34
  35 struct mmu_ctx_hash32 {
  36     hwaddr raddr;      /* Real address              */
  37     int prot;                      /* Protection bits           */
  38     int key;                       /* Access key                */
  39 };
  40
  41 static int ppc_hash32_pp_prot(int key, int pp, int nx)
  42 {
  43     int prot;
  44
  45     if (key == 0) {
  46         switch (pp) {
  47         case 0x0:
  48         case 0x1:
  49         case 0x2:
  50             prot = PAGE_READ | PAGE_WRITE;
  51             break;
  52
  53         case 0x3:
  54             prot = PAGE_READ;
  55             break;
  56
  57         default:
  58             abort();
  59         }
  60     } else {
  61         switch (pp) {
  62         case 0x0:
  63             prot = 0;
  64             break;
  65
  66         case 0x1:
  67         case 0x3:
  68             prot = PAGE_READ;
  69             break;
  70
  71         case 0x2:
  72             prot = PAGE_READ | PAGE_WRITE;
  73             break;
  74
  75         default:
  76             abort();
  77         }
  78     }
  79     if (nx == 0) {
  80         prot |= PAGE_EXEC;
  81     }
  82
  83     return prot;
  84 }
  85
  86 static int ppc_hash32_pte_prot(CPUPPCState *env,
  87                                target_ulong sr, ppc_hash_pte32_t pte)
  88 {
  89     unsigned pp, key;
  90
  91     key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
  92     pp = pte.pte1 & HPTE32_R_PP;
  93
  94     return ppc_hash32_pp_prot(key, pp, !!(sr & SR32_NX));
  95 }
  96
  97 static target_ulong hash32_bat_size(CPUPPCState *env,
  98                                     target_ulong batu, target_ulong batl)
  99 {
 100     if ((msr_pr && !(batu & BATU32_VP))
 101         || (!msr_pr && !(batu & BATU32_VS))) {
 102         return 0;
 103     }
 104
 105     return BATU32_BEPI & ~((batu & BATU32_BL) << 15);
 106 }
 107
 108 static int hash32_bat_prot(CPUPPCState *env,
 109                            target_ulong batu, target_ulong batl)
 110 {
 111     int pp, prot;
 112
 113     prot = 0;
 114     pp = batl & BATL32_PP;
 115     if (pp != 0) {
 116         prot = PAGE_READ | PAGE_EXEC;
 117         if (pp == 0x2) {
 118             prot |= PAGE_WRITE;
 119         }
 120     }
 121     return prot;
 122 }
 123
 124 static target_ulong hash32_bat_601_size(CPUPPCState *env,
 125                                 target_ulong batu, target_ulong batl)
 126 {
 127     if (!(batl & BATL32_601_V)) {
 128         return 0;
 129     }
 130
 131     return BATU32_BEPI & ~((batl & BATL32_601_BL) << 17);
 132 }
 133
 134 static int hash32_bat_601_prot(CPUPPCState *env,
 135                                target_ulong batu, target_ulong batl)
 136 {
 137     int key, pp;
 138
 139     pp = batu & BATU32_601_PP;
 140     if (msr_pr == 0) {
 141         key = !!(batu & BATU32_601_KS);
 142     } else {
 143         key = !!(batu & BATU32_601_KP);
 144     }
 145     return ppc_hash32_pp_prot(key, pp, 0);
 146 }
 147
 148 static hwaddr ppc_hash32_bat_lookup(CPUPPCState *env, target_ulong ea, int rwx,
 149                                     int *prot)
 150 {
 151     target_ulong *BATlt, *BATut;
 152     int i;
 153
 154     LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
 155              rwx == 2 ? 'I' : 'D', ea);
 156     if (rwx == 2) {
 157         BATlt = env->IBAT[1];
 158         BATut = env->IBAT[0];
 159     } else {
 160         BATlt = env->DBAT[1];
 161         BATut = env->DBAT[0];
 162     }
 163     for (i = 0; i < env->nb_BATs; i++) {
 164         target_ulong batu = BATut[i];
 165         target_ulong batl = BATlt[i];
 166         target_ulong mask;
 167
 168         if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 169             mask = hash32_bat_601_size(env, batu, batl);
 170         } else {
 171             mask = hash32_bat_size(env, batu, batl);
 172         }
 173         LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 174                  " BATl " TARGET_FMT_lx "\n", __func__,
 175                  type == ACCESS_CODE ? 'I' : 'D', i, ea, batu, batl);
 176
 177         if (mask && ((ea & mask) == (batu & BATU32_BEPI))) {
 178             hwaddr raddr = (batl & mask) | (ea & ~mask);
 179
 180             if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 181                 *prot = hash32_bat_601_prot(env, batu, batl);
 182             } else {
 183                 *prot = hash32_bat_prot(env, batu, batl);
 184             }
 185
 186             return raddr & TARGET_PAGE_MASK;
 187         }
 188     }
 189
 190     /* No hit */
 191 #if defined(DEBUG_BATS)
 192     if (qemu_log_enabled()) {
 193         LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", ea);
 194         for (i = 0; i < 4; i++) {
 195             BATu = &BATut[i];
 196             BATl = &BATlt[i];
 197             BEPIu = *BATu & BATU32_BEPIU;
 198             BEPIl = *BATu & BATU32_BEPIL;
 199             bl = (*BATu & 0x00001FFC) << 15;
 200             LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 201                      " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
 202                      TARGET_FMT_lx " " TARGET_FMT_lx "\n",
 203                      __func__, type == ACCESS_CODE ? 'I' : 'D', i, ea,
 204                      *BATu, *BATl, BEPIu, BEPIl, bl);
 205         }
 206     }
 207 #endif
 208
 209     return -1;
 210 }
 211
 212 static int ppc_hash32_direct_store(CPUPPCState *env, target_ulong sr,
 213                                    target_ulong eaddr, int rwx,
 214                                    hwaddr *raddr, int *prot)
 215 {
 216     CPUState *cs = CPU(ppc_env_get_cpu(env));
 217     int key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
 218
 219     qemu_log_mask(CPU_LOG_MMU, "direct store...\n");
 220
 221     if ((sr & 0x1FF00000) >> 20 == 0x07f) {
 222         /* Memory-forced I/O controller interface access */
 223         /* If T=1 and BUID=x'07F', the 601 performs a memory access
 224          * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
 225          */
 226         *raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
 227         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 228         return 0;
 229     }
 230
 231     if (rwx == 2) {
 232         /* No code fetch is allowed in direct-store areas */
 233         cs->exception_index = POWERPC_EXCP_ISI;
 234         env->error_code = 0x10000000;
 235         return 1;
 236     }
 237
 238     switch (env->access_type) {
 239     case ACCESS_INT:
 240         /* Integer load/store : only access allowed */
 241         break;
 242     case ACCESS_FLOAT:
 243         /* Floating point load/store */
 244         cs->exception_index = POWERPC_EXCP_ALIGN;
 245         env->error_code = POWERPC_EXCP_ALIGN_FP;
 246         env->spr[SPR_DAR] = eaddr;
 247         return 1;
 248     case ACCESS_RES:
 249         /* lwarx, ldarx or srwcx. */
 250         env->error_code = 0;
 251         env->spr[SPR_DAR] = eaddr;
 252         if (rwx == 1) {
 253             env->spr[SPR_DSISR] = 0x06000000;
 254         } else {
 255             env->spr[SPR_DSISR] = 0x04000000;
 256         }
 257         return 1;
 258     case ACCESS_CACHE:
 259         /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
 260         /* Should make the instruction do no-op.
 261          * As it already do no-op, it's quite easy :-)
 262          */
 263         *raddr = eaddr;
 264         return 0;
 265     case ACCESS_EXT:
 266         /* eciwx or ecowx */
 267         cs->exception_index = POWERPC_EXCP_DSI;
 268         env->error_code = 0;
 269         env->spr[SPR_DAR] = eaddr;
 270         if (rwx == 1) {
 271             env->spr[SPR_DSISR] = 0x06100000;
 272         } else {
 273             env->spr[SPR_DSISR] = 0x04100000;
 274         }
 275         return 1;
 276     default:
 277         cpu_abort(cs, "ERROR: instruction should not need "
 278                  "address translation\n");
 279     }
 280     if ((rwx == 1 || key != 1) && (rwx == 0 || key != 0)) {
 281         *raddr = eaddr;
 282         return 0;
 283     } else {
 284         cs->exception_index = POWERPC_EXCP_DSI;
 285         env->error_code = 0;
 286         env->spr[SPR_DAR] = eaddr;
 287         if (rwx == 1) {
 288             env->spr[SPR_DSISR] = 0x0a000000;
 289         } else {
 290             env->spr[SPR_DSISR] = 0x08000000;
 291         }
 292         return 1;
 293     }
 294 }
 295
 296 hwaddr get_pteg_offset32(CPUPPCState *env, hwaddr hash)
 297 {
 298     return (hash * HASH_PTEG_SIZE_32) & env->htab_mask;
 299 }
 300
 301 static hwaddr ppc_hash32_pteg_search(CPUPPCState *env, hwaddr pteg_off,
 302                                      bool secondary, target_ulong ptem,
 303                                      ppc_hash_pte32_t *pte)
 304 {
 305     hwaddr pte_offset = pteg_off;
 306     target_ulong pte0, pte1;
 307     int i;
 308
 309     for (i = 0; i < HPTES_PER_GROUP; i++) {
 310         pte0 = ppc_hash32_load_hpte0(env, pte_offset);
 311         pte1 = ppc_hash32_load_hpte1(env, pte_offset);
 312
 313         if ((pte0 & HPTE32_V_VALID)
 314             && (secondary == !!(pte0 & HPTE32_V_SECONDARY))
 315             && HPTE32_V_COMPARE(pte0, ptem)) {
 316             pte->pte0 = pte0;
 317             pte->pte1 = pte1;
 318             return pte_offset;
 319         }
 320
 321         pte_offset += HASH_PTE_SIZE_32;
 322     }
 323
 324     return -1;
 325 }
 326
 327 static hwaddr ppc_hash32_htab_lookup(CPUPPCState *env,
 328                                      target_ulong sr, target_ulong eaddr,
 329                                      ppc_hash_pte32_t *pte)
 330 {
 331     hwaddr pteg_off, pte_offset;
 332     hwaddr hash;
 333     uint32_t vsid, pgidx, ptem;
 334
 335     vsid = sr & SR32_VSID;
 336     pgidx = (eaddr & ~SEGMENT_MASK_256M) >> TARGET_PAGE_BITS;
 337     hash = vsid ^ pgidx;
 338     ptem = (vsid << 7) | (pgidx >> 10);
 339
 340     /* Page address translation */
 341     qemu_log_mask(CPU_LOG_MMU, "htab_base " TARGET_FMT_plx
 342             " htab_mask " TARGET_FMT_plx
 343             " hash " TARGET_FMT_plx "\n",
 344             env->htab_base, env->htab_mask, hash);
 345
 346     /* Primary PTEG lookup */
 347     qemu_log_mask(CPU_LOG_MMU, "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 348             " vsid=%" PRIx32 " ptem=%" PRIx32
 349             " hash=" TARGET_FMT_plx "\n",
 350             env->htab_base, env->htab_mask, vsid, ptem, hash);
 351     pteg_off = get_pteg_offset32(env, hash);
 352     pte_offset = ppc_hash32_pteg_search(env, pteg_off, 0, ptem, pte);
 353     if (pte_offset == -1) {
 354         /* Secondary PTEG lookup */
 355         qemu_log_mask(CPU_LOG_MMU, "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 356                 " vsid=%" PRIx32 " api=%" PRIx32
 357                 " hash=" TARGET_FMT_plx "\n", env->htab_base,
 358                 env->htab_mask, vsid, ptem, ~hash);
 359         pteg_off = get_pteg_offset32(env, ~hash);
 360         pte_offset = ppc_hash32_pteg_search(env, pteg_off, 1, ptem, pte);
 361     }
 362
 363     return pte_offset;
 364 }
 365
 366 static hwaddr ppc_hash32_pte_raddr(target_ulong sr, ppc_hash_pte32_t pte,
 367                                    target_ulong eaddr)
 368 {
 369     hwaddr rpn = pte.pte1 & HPTE32_R_RPN;
 370     hwaddr mask = ~TARGET_PAGE_MASK;
 371
 372     return (rpn & ~mask) | (eaddr & mask);
 373 }
 374
 375 int ppc_hash32_handle_mmu_fault(PowerPCCPU *cpu, target_ulong eaddr, int rwx,
 376                                 int mmu_idx)
 377 {
 378     CPUState *cs = CPU(cpu);
 379     CPUPPCState *env = &cpu->env;
 380     target_ulong sr;
 381     hwaddr pte_offset;
 382     ppc_hash_pte32_t pte;
 383     int prot;
 384     uint32_t new_pte1;
 385     const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
 386     hwaddr raddr;
 387
 388     assert((rwx == 0) || (rwx == 1) || (rwx == 2));
 389
 390     /* 1. Handle real mode accesses */
 391     if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
 392         /* Translation is off */
 393         raddr = eaddr;
 394         tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 395                      PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
 396                      TARGET_PAGE_SIZE);
 397         return 0;
 398     }
 399
 400     /* 2. Check Block Address Translation entries (BATs) */
 401     if (env->nb_BATs != 0) {
 402         raddr = ppc_hash32_bat_lookup(env, eaddr, rwx, &prot);
 403         if (raddr != -1) {
 404             if (need_prot[rwx] & ~prot) {
 405                 if (rwx == 2) {
 406                     cs->exception_index = POWERPC_EXCP_ISI;
 407                     env->error_code = 0x08000000;
 408                 } else {
 409                     cs->exception_index = POWERPC_EXCP_DSI;
 410                     env->error_code = 0;
 411                     env->spr[SPR_DAR] = eaddr;
 412                     if (rwx == 1) {
 413                         env->spr[SPR_DSISR] = 0x0a000000;
 414                     } else {
 415                         env->spr[SPR_DSISR] = 0x08000000;
 416                     }
 417                 }
 418                 return 1;
 419             }
 420
 421             tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
 422                          raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 423                          TARGET_PAGE_SIZE);
 424             return 0;
 425         }
 426     }
 427
 428     /* 3. Look up the Segment Register */
 429     sr = env->sr[eaddr >> 28];
 430
 431     /* 4. Handle direct store segments */
 432     if (sr & SR32_T) {
 433         if (ppc_hash32_direct_store(env, sr, eaddr, rwx,
 434                                     &raddr, &prot) == 0) {
 435             tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
 436                          raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 437                          TARGET_PAGE_SIZE);
 438             return 0;
 439         } else {
 440             return 1;
 441         }
 442     }
 443
 444     /* 5. Check for segment level no-execute violation */
 445     if ((rwx == 2) && (sr & SR32_NX)) {
 446         cs->exception_index = POWERPC_EXCP_ISI;
 447         env->error_code = 0x10000000;
 448         return 1;
 449     }
 450
 451     /* 6. Locate the PTE in the hash table */
 452     pte_offset = ppc_hash32_htab_lookup(env, sr, eaddr, &pte);
 453     if (pte_offset == -1) {
 454         if (rwx == 2) {
 455             cs->exception_index = POWERPC_EXCP_ISI;
 456             env->error_code = 0x40000000;
 457         } else {
 458             cs->exception_index = POWERPC_EXCP_DSI;
 459             env->error_code = 0;
 460             env->spr[SPR_DAR] = eaddr;
 461             if (rwx == 1) {
 462                 env->spr[SPR_DSISR] = 0x42000000;
 463             } else {
 464                 env->spr[SPR_DSISR] = 0x40000000;
 465             }
 466         }
 467
 468         return 1;
 469     }
 470     qemu_log_mask(CPU_LOG_MMU,
 471                 "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
 472
 473     /* 7. Check access permissions */
 474
 475     prot = ppc_hash32_pte_prot(env, sr, pte);
 476
 477     if (need_prot[rwx] & ~prot) {
 478         /* Access right violation */
 479         qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
 480         if (rwx == 2) {
 481             cs->exception_index = POWERPC_EXCP_ISI;
 482             env->error_code = 0x08000000;
 483         } else {
 484             cs->exception_index = POWERPC_EXCP_DSI;
 485             env->error_code = 0;
 486             env->spr[SPR_DAR] = eaddr;
 487             if (rwx == 1) {
 488                 env->spr[SPR_DSISR] = 0x0a000000;
 489             } else {
 490                 env->spr[SPR_DSISR] = 0x08000000;
 491             }
 492         }
 493         return 1;
 494     }
 495
 496     qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
 497
 498     /* 8. Update PTE referenced and changed bits if necessary */
 499
 500     new_pte1 = pte.pte1 | HPTE32_R_R; /* set referenced bit */
 501     if (rwx == 1) {
 502         new_pte1 |= HPTE32_R_C; /* set changed (dirty) bit */
 503     } else {
 504         /* Treat the page as read-only for now, so that a later write
 505          * will pass through this function again to set the C bit */
 506         prot &= ~PAGE_WRITE;
 507     }
 508
 509     if (new_pte1 != pte.pte1) {
 510         ppc_hash32_store_hpte1(env, pte_offset, new_pte1);
 511     }
 512
 513     /* 9. Determine the real address from the PTE */
 514
 515     raddr = ppc_hash32_pte_raddr(sr, pte, eaddr);
 516
 517     tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 518                  prot, mmu_idx, TARGET_PAGE_SIZE);
 519
 520     return 0;
 521 }
 522
 523 hwaddr ppc_hash32_get_phys_page_debug(CPUPPCState *env, target_ulong eaddr)
 524 {
 525     target_ulong sr;
 526     hwaddr pte_offset;
 527     ppc_hash_pte32_t pte;
 528     int prot;
 529
 530     if (msr_dr == 0) {
 531         /* Translation is off */
 532         return eaddr;
 533     }
 534
 535     if (env->nb_BATs != 0) {
 536         hwaddr raddr = ppc_hash32_bat_lookup(env, eaddr, 0, &prot);
 537         if (raddr != -1) {
 538             return raddr;
 539         }
 540     }
 541
 542     sr = env->sr[eaddr >> 28];
 543
 544     if (sr & SR32_T) {
 545         /* FIXME: Add suitable debug support for Direct Store segments */
 546         return -1;
 547     }
 548
 549     pte_offset = ppc_hash32_htab_lookup(env, sr, eaddr, &pte);
 550     if (pte_offset == -1) {
 551         return -1;
 552     }
 553
 554     return ppc_hash32_pte_raddr(sr, pte, eaddr) & TARGET_PAGE_MASK;
 555 }