target-ppc/mmu-hash32.c

   1 /*
   2  *  PowerPC MMU, TLB and BAT emulation helpers for QEMU.
   3  *
   4  *  Copyright (c) 2003-2007 Jocelyn Mayer
   5  *  Copyright (c) 2013 David Gibson, IBM Corporation
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "cpu.h"
  22 #include "helper.h"
  23 #include "sysemu/kvm.h"
  24 #include "kvm_ppc.h"
  25 #include "mmu-hash32.h"
  26
  27 //#define DEBUG_MMU
  28 //#define DEBUG_BAT
  29
  30 #ifdef DEBUG_MMU
  31 #  define LOG_MMU(...) qemu_log(__VA_ARGS__)
  32 #  define LOG_MMU_STATE(cpu) log_cpu_state((cpu), 0)
  33 #else
  34 #  define LOG_MMU(...) do { } while (0)
  35 #  define LOG_MMU_STATE(cpu) do { } while (0)
  36 #endif
  37
  38 #ifdef DEBUG_BATS
  39 #  define LOG_BATS(...) qemu_log(__VA_ARGS__)
  40 #else
  41 #  define LOG_BATS(...) do { } while (0)
  42 #endif
  43
  44 struct mmu_ctx_hash32 {
  45     hwaddr raddr;      /* Real address              */
  46     int prot;                      /* Protection bits           */
  47     int key;                       /* Access key                */
  48 };
  49
  50 static int ppc_hash32_pp_prot(int key, int pp, int nx)
  51 {
  52     int prot;
  53
  54     if (key == 0) {
  55         switch (pp) {
  56         case 0x0:
  57         case 0x1:
  58         case 0x2:
  59             prot = PAGE_READ | PAGE_WRITE;
  60             break;
  61
  62         case 0x3:
  63             prot = PAGE_READ;
  64             break;
  65
  66         default:
  67             abort();
  68         }
  69     } else {
  70         switch (pp) {
  71         case 0x0:
  72             prot = 0;
  73             break;
  74
  75         case 0x1:
  76         case 0x3:
  77             prot = PAGE_READ;
  78             break;
  79
  80         case 0x2:
  81             prot = PAGE_READ | PAGE_WRITE;
  82             break;
  83
  84         default:
  85             abort();
  86         }
  87     }
  88     if (nx == 0) {
  89         prot |= PAGE_EXEC;
  90     }
  91
  92     return prot;
  93 }
  94
  95 static int ppc_hash32_pte_prot(CPUPPCState *env,
  96                                target_ulong sr, ppc_hash_pte32_t pte)
  97 {
  98     unsigned pp, key;
  99
 100     key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
 101     pp = pte.pte1 & HPTE32_R_PP;
 102
 103     return ppc_hash32_pp_prot(key, pp, !!(sr & SR32_NX));
 104 }
 105
 106 static target_ulong hash32_bat_size(CPUPPCState *env,
 107                                     target_ulong batu, target_ulong batl)
 108 {
 109     if ((msr_pr && !(batu & BATU32_VP))
 110         || (!msr_pr && !(batu & BATU32_VS))) {
 111         return 0;
 112     }
 113
 114     return BATU32_BEPI & ~((batu & BATU32_BL) << 15);
 115 }
 116
 117 static int hash32_bat_prot(CPUPPCState *env,
 118                            target_ulong batu, target_ulong batl)
 119 {
 120     int pp, prot;
 121
 122     prot = 0;
 123     pp = batl & BATL32_PP;
 124     if (pp != 0) {
 125         prot = PAGE_READ | PAGE_EXEC;
 126         if (pp == 0x2) {
 127             prot |= PAGE_WRITE;
 128         }
 129     }
 130     return prot;
 131 }
 132
 133 static target_ulong hash32_bat_601_size(CPUPPCState *env,
 134                                 target_ulong batu, target_ulong batl)
 135 {
 136     if (!(batl & BATL32_601_V)) {
 137         return 0;
 138     }
 139
 140     return BATU32_BEPI & ~((batl & BATL32_601_BL) << 17);
 141 }
 142
 143 static int hash32_bat_601_prot(CPUPPCState *env,
 144                                target_ulong batu, target_ulong batl)
 145 {
 146     int key, pp;
 147
 148     pp = batu & BATU32_601_PP;
 149     if (msr_pr == 0) {
 150         key = !!(batu & BATU32_601_KS);
 151     } else {
 152         key = !!(batu & BATU32_601_KP);
 153     }
 154     return ppc_hash32_pp_prot(key, pp, 0);
 155 }
 156
 157 static hwaddr ppc_hash32_bat_lookup(CPUPPCState *env, target_ulong ea, int rwx,
 158                                     int *prot)
 159 {
 160     target_ulong *BATlt, *BATut;
 161     int i;
 162
 163     LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
 164              rwx == 2 ? 'I' : 'D', ea);
 165     if (rwx == 2) {
 166         BATlt = env->IBAT[1];
 167         BATut = env->IBAT[0];
 168     } else {
 169         BATlt = env->DBAT[1];
 170         BATut = env->DBAT[0];
 171     }
 172     for (i = 0; i < env->nb_BATs; i++) {
 173         target_ulong batu = BATut[i];
 174         target_ulong batl = BATlt[i];
 175         target_ulong mask;
 176
 177         if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 178             mask = hash32_bat_601_size(env, batu, batl);
 179         } else {
 180             mask = hash32_bat_size(env, batu, batl);
 181         }
 182         LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 183                  " BATl " TARGET_FMT_lx "\n", __func__,
 184                  type == ACCESS_CODE ? 'I' : 'D', i, ea, batu, batl);
 185
 186         if (mask && ((ea & mask) == (batu & BATU32_BEPI))) {
 187             hwaddr raddr = (batl & mask) | (ea & ~mask);
 188
 189             if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 190                 *prot = hash32_bat_601_prot(env, batu, batl);
 191             } else {
 192                 *prot = hash32_bat_prot(env, batu, batl);
 193             }
 194
 195             return raddr & TARGET_PAGE_MASK;
 196         }
 197     }
 198
 199     /* No hit */
 200 #if defined(DEBUG_BATS)
 201     if (qemu_log_enabled()) {
 202         LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", ea);
 203         for (i = 0; i < 4; i++) {
 204             BATu = &BATut[i];
 205             BATl = &BATlt[i];
 206             BEPIu = *BATu & BATU32_BEPIU;
 207             BEPIl = *BATu & BATU32_BEPIL;
 208             bl = (*BATu & 0x00001FFC) << 15;
 209             LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 210                      " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
 211                      TARGET_FMT_lx " " TARGET_FMT_lx "\n",
 212                      __func__, type == ACCESS_CODE ? 'I' : 'D', i, ea,
 213                      *BATu, *BATl, BEPIu, BEPIl, bl);
 214         }
 215     }
 216 #endif
 217
 218     return -1;
 219 }
 220
 221 static int ppc_hash32_direct_store(CPUPPCState *env, target_ulong sr,
 222                                    target_ulong eaddr, int rwx,
 223                                    hwaddr *raddr, int *prot)
 224 {
 225     int key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
 226
 227     LOG_MMU("direct store...\n");
 228
 229     if ((sr & 0x1FF00000) >> 20 == 0x07f) {
 230         /* Memory-forced I/O controller interface access */
 231         /* If T=1 and BUID=x'07F', the 601 performs a memory access
 232          * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
 233          */
 234         *raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
 235         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 236         return 0;
 237     }
 238
 239     if (rwx == 2) {
 240         /* No code fetch is allowed in direct-store areas */
 241         env->exception_index = POWERPC_EXCP_ISI;
 242         env->error_code = 0x10000000;
 243         return 1;
 244     }
 245
 246     switch (env->access_type) {
 247     case ACCESS_INT:
 248         /* Integer load/store : only access allowed */
 249         break;
 250     case ACCESS_FLOAT:
 251         /* Floating point load/store */
 252         env->exception_index = POWERPC_EXCP_ALIGN;
 253         env->error_code = POWERPC_EXCP_ALIGN_FP;
 254         env->spr[SPR_DAR] = eaddr;
 255         return 1;
 256     case ACCESS_RES:
 257         /* lwarx, ldarx or srwcx. */
 258         env->error_code = 0;
 259         env->spr[SPR_DAR] = eaddr;
 260         if (rwx == 1) {
 261             env->spr[SPR_DSISR] = 0x06000000;
 262         } else {
 263             env->spr[SPR_DSISR] = 0x04000000;
 264         }
 265         return 1;
 266     case ACCESS_CACHE:
 267         /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
 268         /* Should make the instruction do no-op.
 269          * As it already do no-op, it's quite easy :-)
 270          */
 271         *raddr = eaddr;
 272         return 0;
 273     case ACCESS_EXT:
 274         /* eciwx or ecowx */
 275         env->exception_index = POWERPC_EXCP_DSI;
 276         env->error_code = 0;
 277         env->spr[SPR_DAR] = eaddr;
 278         if (rwx == 1) {
 279             env->spr[SPR_DSISR] = 0x06100000;
 280         } else {
 281             env->spr[SPR_DSISR] = 0x04100000;
 282         }
 283         return 1;
 284     default:
 285         qemu_log("ERROR: instruction should not need "
 286                  "address translation\n");
 287         abort();
 288     }
 289     if ((rwx == 1 || key != 1) && (rwx == 0 || key != 0)) {
 290         *raddr = eaddr;
 291         return 0;
 292     } else {
 293         env->exception_index = POWERPC_EXCP_DSI;
 294         env->error_code = 0;
 295         env->spr[SPR_DAR] = eaddr;
 296         if (rwx == 1) {
 297             env->spr[SPR_DSISR] = 0x0a000000;
 298         } else {
 299             env->spr[SPR_DSISR] = 0x08000000;
 300         }
 301         return 1;
 302     }
 303 }
 304
 305 hwaddr get_pteg_offset32(CPUPPCState *env, hwaddr hash)
 306 {
 307     return (hash * HASH_PTEG_SIZE_32) & env->htab_mask;
 308 }
 309
 310 static hwaddr ppc_hash32_pteg_search(CPUPPCState *env, hwaddr pteg_off,
 311                                      bool secondary, target_ulong ptem,
 312                                      ppc_hash_pte32_t *pte)
 313 {
 314     hwaddr pte_offset = pteg_off;
 315     target_ulong pte0, pte1;
 316     int i;
 317
 318     for (i = 0; i < HPTES_PER_GROUP; i++) {
 319         pte0 = ppc_hash32_load_hpte0(env, pte_offset);
 320         pte1 = ppc_hash32_load_hpte1(env, pte_offset);
 321
 322         if ((pte0 & HPTE32_V_VALID)
 323             && (secondary == !!(pte0 & HPTE32_V_SECONDARY))
 324             && HPTE32_V_COMPARE(pte0, ptem)) {
 325             pte->pte0 = pte0;
 326             pte->pte1 = pte1;
 327             return pte_offset;
 328         }
 329
 330         pte_offset += HASH_PTE_SIZE_32;
 331     }
 332
 333     return -1;
 334 }
 335
 336 static hwaddr ppc_hash32_htab_lookup(CPUPPCState *env,
 337                                      target_ulong sr, target_ulong eaddr,
 338                                      ppc_hash_pte32_t *pte)
 339 {
 340     hwaddr pteg_off, pte_offset;
 341     hwaddr hash;
 342     uint32_t vsid, pgidx, ptem;
 343
 344     vsid = sr & SR32_VSID;
 345     pgidx = (eaddr & ~SEGMENT_MASK_256M) >> TARGET_PAGE_BITS;
 346     hash = vsid ^ pgidx;
 347     ptem = (vsid << 7) | (pgidx >> 10);
 348
 349     /* Page address translation */
 350     LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
 351             " hash " TARGET_FMT_plx "\n",
 352             env->htab_base, env->htab_mask, hash);
 353
 354     /* Primary PTEG lookup */
 355     LOG_MMU("0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 356             " vsid=%" PRIx32 " ptem=%" PRIx32
 357             " hash=" TARGET_FMT_plx "\n",
 358             env->htab_base, env->htab_mask, vsid, ptem, hash);
 359     pteg_off = get_pteg_offset32(env, hash);
 360     pte_offset = ppc_hash32_pteg_search(env, pteg_off, 0, ptem, pte);
 361     if (pte_offset == -1) {
 362         /* Secondary PTEG lookup */
 363         LOG_MMU("1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 364                 " vsid=%" PRIx32 " api=%" PRIx32
 365                 " hash=" TARGET_FMT_plx "\n", env->htab_base,
 366                 env->htab_mask, vsid, ptem, ~hash);
 367         pteg_off = get_pteg_offset32(env, ~hash);
 368         pte_offset = ppc_hash32_pteg_search(env, pteg_off, 1, ptem, pte);
 369     }
 370
 371     return pte_offset;
 372 }
 373
 374 static hwaddr ppc_hash32_pte_raddr(target_ulong sr, ppc_hash_pte32_t pte,
 375                                    target_ulong eaddr)
 376 {
 377     hwaddr rpn = pte.pte1 & HPTE32_R_RPN;
 378     hwaddr mask = ~TARGET_PAGE_MASK;
 379
 380     return (rpn & ~mask) | (eaddr & mask);
 381 }
 382
 383 int ppc_hash32_handle_mmu_fault(CPUPPCState *env, target_ulong eaddr, int rwx,
 384                                 int mmu_idx)
 385 {
 386     target_ulong sr;
 387     hwaddr pte_offset;
 388     ppc_hash_pte32_t pte;
 389     int prot;
 390     uint32_t new_pte1;
 391     const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
 392     hwaddr raddr;
 393
 394     assert((rwx == 0) || (rwx == 1) || (rwx == 2));
 395
 396     /* 1. Handle real mode accesses */
 397     if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
 398         /* Translation is off */
 399         raddr = eaddr;
 400         tlb_set_page(env, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 401                      PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
 402                      TARGET_PAGE_SIZE);
 403         return 0;
 404     }
 405
 406     /* 2. Check Block Address Translation entries (BATs) */
 407     if (env->nb_BATs != 0) {
 408         raddr = ppc_hash32_bat_lookup(env, eaddr, rwx, &prot);
 409         if (raddr != -1) {
 410             if (need_prot[rwx] & ~prot) {
 411                 if (rwx == 2) {
 412                     env->exception_index = POWERPC_EXCP_ISI;
 413                     env->error_code = 0x08000000;
 414                 } else {
 415                     env->exception_index = POWERPC_EXCP_DSI;
 416                     env->error_code = 0;
 417                     env->spr[SPR_DAR] = eaddr;
 418                     if (rwx == 1) {
 419                         env->spr[SPR_DSISR] = 0x0a000000;
 420                     } else {
 421                         env->spr[SPR_DSISR] = 0x08000000;
 422                     }
 423                 }
 424                 return 1;
 425             }
 426
 427             tlb_set_page(env, eaddr & TARGET_PAGE_MASK,
 428                          raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 429                          TARGET_PAGE_SIZE);
 430             return 0;
 431         }
 432     }
 433
 434     /* 3. Look up the Segment Register */
 435     sr = env->sr[eaddr >> 28];
 436
 437     /* 4. Handle direct store segments */
 438     if (sr & SR32_T) {
 439         if (ppc_hash32_direct_store(env, sr, eaddr, rwx,
 440                                     &raddr, &prot) == 0) {
 441             tlb_set_page(env, eaddr & TARGET_PAGE_MASK,
 442                          raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 443                          TARGET_PAGE_SIZE);
 444             return 0;
 445         } else {
 446             return 1;
 447         }
 448     }
 449
 450     /* 5. Check for segment level no-execute violation */
 451     if ((rwx == 2) && (sr & SR32_NX)) {
 452         env->exception_index = POWERPC_EXCP_ISI;
 453         env->error_code = 0x10000000;
 454         return 1;
 455     }
 456
 457     /* 6. Locate the PTE in the hash table */
 458     pte_offset = ppc_hash32_htab_lookup(env, sr, eaddr, &pte);
 459     if (pte_offset == -1) {
 460         if (rwx == 2) {
 461             env->exception_index = POWERPC_EXCP_ISI;
 462             env->error_code = 0x40000000;
 463         } else {
 464             env->exception_index = POWERPC_EXCP_DSI;
 465             env->error_code = 0;
 466             env->spr[SPR_DAR] = eaddr;
 467             if (rwx == 1) {
 468                 env->spr[SPR_DSISR] = 0x42000000;
 469             } else {
 470                 env->spr[SPR_DSISR] = 0x40000000;
 471             }
 472         }
 473
 474         return 1;
 475     }
 476     LOG_MMU("found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
 477
 478     /* 7. Check access permissions */
 479
 480     prot = ppc_hash32_pte_prot(env, sr, pte);
 481
 482     if (need_prot[rwx] & ~prot) {
 483         /* Access right violation */
 484         LOG_MMU("PTE access rejected\n");
 485         if (rwx == 2) {
 486             env->exception_index = POWERPC_EXCP_ISI;
 487             env->error_code = 0x08000000;
 488         } else {
 489             env->exception_index = POWERPC_EXCP_DSI;
 490             env->error_code = 0;
 491             env->spr[SPR_DAR] = eaddr;
 492             if (rwx == 1) {
 493                 env->spr[SPR_DSISR] = 0x0a000000;
 494             } else {
 495                 env->spr[SPR_DSISR] = 0x08000000;
 496             }
 497         }
 498         return 1;
 499     }
 500
 501     LOG_MMU("PTE access granted !\n");
 502
 503     /* 8. Update PTE referenced and changed bits if necessary */
 504
 505     new_pte1 = pte.pte1 | HPTE32_R_R; /* set referenced bit */
 506     if (rwx == 1) {
 507         new_pte1 |= HPTE32_R_C; /* set changed (dirty) bit */
 508     } else {
 509         /* Treat the page as read-only for now, so that a later write
 510          * will pass through this function again to set the C bit */
 511         prot &= ~PAGE_WRITE;
 512     }
 513
 514     if (new_pte1 != pte.pte1) {
 515         ppc_hash32_store_hpte1(env, pte_offset, new_pte1);
 516     }
 517
 518     /* 9. Determine the real address from the PTE */
 519
 520     raddr = ppc_hash32_pte_raddr(sr, pte, eaddr);
 521
 522     tlb_set_page(env, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 523                  prot, mmu_idx, TARGET_PAGE_SIZE);
 524
 525     return 0;
 526 }
 527
 528 hwaddr ppc_hash32_get_phys_page_debug(CPUPPCState *env, target_ulong eaddr)
 529 {
 530     target_ulong sr;
 531     hwaddr pte_offset;
 532     ppc_hash_pte32_t pte;
 533     int prot;
 534
 535     if (msr_dr == 0) {
 536         /* Translation is off */
 537         return eaddr;
 538     }
 539
 540     if (env->nb_BATs != 0) {
 541         hwaddr raddr = ppc_hash32_bat_lookup(env, eaddr, 0, &prot);
 542         if (raddr != -1) {
 543             return raddr;
 544         }
 545     }
 546
 547     sr = env->sr[eaddr >> 28];
 548
 549     if (sr & SR32_T) {
 550         /* FIXME: Add suitable debug support for Direct Store segments */
 551         return -1;
 552     }
 553
 554     pte_offset = ppc_hash32_htab_lookup(env, sr, eaddr, &pte);
 555     if (pte_offset == -1) {
 556         return -1;
 557     }
 558
 559     return ppc_hash32_pte_raddr(sr, pte, eaddr) & TARGET_PAGE_MASK;
 560 }