target/ppc/mmu-radix64.c

   1 /*
   2  *  PowerPC Radix MMU mulation helpers for QEMU.
   3  *
   4  *  Copyright (c) 2016 Suraj Jitindar Singh, IBM Corporation
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "qemu/osdep.h"
  21 #include "cpu.h"
  22 #include "exec/exec-all.h"
  23 #include "exec/helper-proto.h"
  24 #include "qemu/error-report.h"
  25 #include "sysemu/kvm.h"
  26 #include "kvm_ppc.h"
  27 #include "exec/log.h"
  28 #include "mmu-radix64.h"
  29 #include "mmu-book3s-v3.h"
  30
  31 static bool ppc_radix64_get_fully_qualified_addr(const CPUPPCState *env,
  32                                                  vaddr eaddr,
  33                                                  uint64_t *lpid, uint64_t *pid)
  34 {
  35     if (msr_hv) { /* MSR[HV] -> Hypervisor/bare metal */
  36         switch (eaddr & R_EADDR_QUADRANT) {
  37         case R_EADDR_QUADRANT0:
  38             *lpid = 0;
  39             *pid = env->spr[SPR_BOOKS_PID];
  40             break;
  41         case R_EADDR_QUADRANT1:
  42             *lpid = env->spr[SPR_LPIDR];
  43             *pid = env->spr[SPR_BOOKS_PID];
  44             break;
  45         case R_EADDR_QUADRANT2:
  46             *lpid = env->spr[SPR_LPIDR];
  47             *pid = 0;
  48             break;
  49         case R_EADDR_QUADRANT3:
  50             *lpid = 0;
  51             *pid = 0;
  52             break;
  53         default:
  54             g_assert_not_reached();
  55         }
  56     } else {  /* !MSR[HV] -> Guest */
  57         switch (eaddr & R_EADDR_QUADRANT) {
  58         case R_EADDR_QUADRANT0: /* Guest application */
  59             *lpid = env->spr[SPR_LPIDR];
  60             *pid = env->spr[SPR_BOOKS_PID];
  61             break;
  62         case R_EADDR_QUADRANT1: /* Illegal */
  63         case R_EADDR_QUADRANT2:
  64             return false;
  65         case R_EADDR_QUADRANT3: /* Guest OS */
  66             *lpid = env->spr[SPR_LPIDR];
  67             *pid = 0; /* pid set to 0 -> addresses guest operating system */
  68             break;
  69         default:
  70             g_assert_not_reached();
  71         }
  72     }
  73
  74     return true;
  75 }
  76
  77 static void ppc_radix64_raise_segi(PowerPCCPU *cpu, int rwx, vaddr eaddr)
  78 {
  79     CPUState *cs = CPU(cpu);
  80     CPUPPCState *env = &cpu->env;
  81
  82     if (rwx == 2) { /* Instruction Segment Interrupt */
  83         cs->exception_index = POWERPC_EXCP_ISEG;
  84     } else { /* Data Segment Interrupt */
  85         cs->exception_index = POWERPC_EXCP_DSEG;
  86         env->spr[SPR_DAR] = eaddr;
  87     }
  88     env->error_code = 0;
  89 }
  90
  91 static void ppc_radix64_raise_si(PowerPCCPU *cpu, int rwx, vaddr eaddr,
  92                                 uint32_t cause)
  93 {
  94     CPUState *cs = CPU(cpu);
  95     CPUPPCState *env = &cpu->env;
  96
  97     if (rwx == 2) { /* Instruction Storage Interrupt */
  98         cs->exception_index = POWERPC_EXCP_ISI;
  99         env->error_code = cause;
 100     } else { /* Data Storage Interrupt */
 101         cs->exception_index = POWERPC_EXCP_DSI;
 102         if (rwx == 1) { /* Write -> Store */
 103             cause |= DSISR_ISSTORE;
 104         }
 105         env->spr[SPR_DSISR] = cause;
 106         env->spr[SPR_DAR] = eaddr;
 107         env->error_code = 0;
 108     }
 109 }
 110
 111 static void ppc_radix64_raise_hsi(PowerPCCPU *cpu, int rwx, vaddr eaddr,
 112                                   hwaddr g_raddr, uint32_t cause)
 113 {
 114     CPUState *cs = CPU(cpu);
 115     CPUPPCState *env = &cpu->env;
 116
 117     if (rwx == 2) { /* H Instruction Storage Interrupt */
 118         cs->exception_index = POWERPC_EXCP_HISI;
 119         env->spr[SPR_ASDR] = g_raddr;
 120         env->error_code = cause;
 121     } else { /* H Data Storage Interrupt */
 122         cs->exception_index = POWERPC_EXCP_HDSI;
 123         if (rwx == 1) { /* Write -> Store */
 124             cause |= DSISR_ISSTORE;
 125         }
 126         env->spr[SPR_HDSISR] = cause;
 127         env->spr[SPR_HDAR] = eaddr;
 128         env->spr[SPR_ASDR] = g_raddr;
 129         env->error_code = 0;
 130     }
 131 }
 132
 133 static bool ppc_radix64_check_prot(PowerPCCPU *cpu, int rwx, uint64_t pte,
 134                                    int *fault_cause, int *prot,
 135                                    bool partition_scoped)
 136 {
 137     CPUPPCState *env = &cpu->env;
 138     const int need_prot[] = { PAGE_READ, PAGE_WRITE, PAGE_EXEC };
 139
 140     /* Check Page Attributes (pte58:59) */
 141     if (((pte & R_PTE_ATT) == R_PTE_ATT_NI_IO) && (rwx == 2)) {
 142         /*
 143          * Radix PTE entries with the non-idempotent I/O attribute are treated
 144          * as guarded storage
 145          */
 146         *fault_cause |= SRR1_NOEXEC_GUARD;
 147         return true;
 148     }
 149
 150     /* Determine permissions allowed by Encoded Access Authority */
 151     if (!partition_scoped && (pte & R_PTE_EAA_PRIV) && msr_pr) {
 152         *prot = 0;
 153     } else if (msr_pr || (pte & R_PTE_EAA_PRIV) || partition_scoped) {
 154         *prot = ppc_radix64_get_prot_eaa(pte);
 155     } else { /* !msr_pr && !(pte & R_PTE_EAA_PRIV) && !partition_scoped */
 156         *prot = ppc_radix64_get_prot_eaa(pte);
 157         *prot &= ppc_radix64_get_prot_amr(cpu); /* Least combined permissions */
 158     }
 159
 160     /* Check if requested access type is allowed */
 161     if (need_prot[rwx] & ~(*prot)) { /* Page Protected for that Access */
 162         *fault_cause |= DSISR_PROTFAULT;
 163         return true;
 164     }
 165
 166     return false;
 167 }
 168
 169 static void ppc_radix64_set_rc(PowerPCCPU *cpu, int rwx, uint64_t pte,
 170                                hwaddr pte_addr, int *prot)
 171 {
 172     CPUState *cs = CPU(cpu);
 173     uint64_t npte;
 174
 175     npte = pte | R_PTE_R; /* Always set reference bit */
 176
 177     if (rwx == 1) { /* Store/Write */
 178         npte |= R_PTE_C; /* Set change bit */
 179     } else {
 180         /*
 181          * Treat the page as read-only for now, so that a later write
 182          * will pass through this function again to set the C bit.
 183          */
 184         *prot &= ~PAGE_WRITE;
 185     }
 186
 187     if (pte ^ npte) { /* If pte has changed then write it back */
 188         stq_phys(cs->as, pte_addr, npte);
 189     }
 190 }
 191
 192 static int ppc_radix64_next_level(AddressSpace *as, vaddr eaddr,
 193                                   uint64_t *pte_addr, uint64_t *nls,
 194                                   int *psize, uint64_t *pte, int *fault_cause)
 195 {
 196     uint64_t index, pde;
 197
 198     if (*nls < 5) { /* Directory maps less than 2**5 entries */
 199         *fault_cause |= DSISR_R_BADCONFIG;
 200         return 1;
 201     }
 202
 203     /* Read page <directory/table> entry from guest address space */
 204     pde = ldq_phys(as, *pte_addr);
 205     if (!(pde & R_PTE_VALID)) {         /* Invalid Entry */
 206         *fault_cause |= DSISR_NOPTE;
 207         return 1;
 208     }
 209
 210     *pte = pde;
 211     *psize -= *nls;
 212     if (!(pde & R_PTE_LEAF)) { /* Prepare for next iteration */
 213         *nls = pde & R_PDE_NLS;
 214         index = eaddr >> (*psize - *nls);       /* Shift */
 215         index &= ((1UL << *nls) - 1);           /* Mask */
 216         *pte_addr = (pde & R_PDE_NLB) + (index * sizeof(pde));
 217     }
 218     return 0;
 219 }
 220
 221 static int ppc_radix64_walk_tree(AddressSpace *as, vaddr eaddr,
 222                                  uint64_t base_addr, uint64_t nls,
 223                                  hwaddr *raddr, int *psize, uint64_t *pte,
 224                                  int *fault_cause, hwaddr *pte_addr)
 225 {
 226     uint64_t index, pde, rpn , mask;
 227
 228     if (nls < 5) { /* Directory maps less than 2**5 entries */
 229         *fault_cause |= DSISR_R_BADCONFIG;
 230         return 1;
 231     }
 232
 233     index = eaddr >> (*psize - nls);    /* Shift */
 234     index &= ((1UL << nls) - 1);       /* Mask */
 235     *pte_addr = base_addr + (index * sizeof(pde));
 236     do {
 237         int ret;
 238
 239         ret = ppc_radix64_next_level(as, eaddr, pte_addr, &nls, psize, &pde,
 240                                      fault_cause);
 241         if (ret) {
 242             return ret;
 243         }
 244     } while (!(pde & R_PTE_LEAF));
 245
 246     *pte = pde;
 247     rpn = pde & R_PTE_RPN;
 248     mask = (1UL << *psize) - 1;
 249
 250     /* Or high bits of rpn and low bits to ea to form whole real addr */
 251     *raddr = (rpn & ~mask) | (eaddr & mask);
 252     return 0;
 253 }
 254
 255 static bool validate_pate(PowerPCCPU *cpu, uint64_t lpid, ppc_v3_pate_t *pate)
 256 {
 257     CPUPPCState *env = &cpu->env;
 258
 259     if (!(pate->dw0 & PATE0_HR)) {
 260         return false;
 261     }
 262     if (lpid == 0 && !msr_hv) {
 263         return false;
 264     }
 265     if ((pate->dw0 & PATE1_R_PRTS) < 5) {
 266         return false;
 267     }
 268     /* More checks ... */
 269     return true;
 270 }
 271
 272 static int ppc_radix64_partition_scoped_xlate(PowerPCCPU *cpu, int rwx,
 273                                               vaddr eaddr, hwaddr g_raddr,
 274                                               ppc_v3_pate_t pate,
 275                                               hwaddr *h_raddr, int *h_prot,
 276                                               int *h_page_size, bool pde_addr,
 277                                               bool cause_excp)
 278 {
 279     int fault_cause = 0;
 280     hwaddr pte_addr;
 281     uint64_t pte;
 282
 283     *h_page_size = PRTBE_R_GET_RTS(pate.dw0);
 284     /* No valid pte or access denied due to protection */
 285     if (ppc_radix64_walk_tree(CPU(cpu)->as, g_raddr, pate.dw0 & PRTBE_R_RPDB,
 286                               pate.dw0 & PRTBE_R_RPDS, h_raddr, h_page_size,
 287                               &pte, &fault_cause, &pte_addr) ||
 288         ppc_radix64_check_prot(cpu, rwx, pte, &fault_cause, h_prot, true)) {
 289         if (pde_addr) { /* address being translated was that of a guest pde */
 290             fault_cause |= DSISR_PRTABLE_FAULT;
 291         }
 292         if (cause_excp) {
 293             ppc_radix64_raise_hsi(cpu, rwx, eaddr, g_raddr, fault_cause);
 294         }
 295         return 1;
 296     }
 297
 298     /* Update Reference and Change Bits */
 299     ppc_radix64_set_rc(cpu, rwx, pte, pte_addr, h_prot);
 300
 301     return 0;
 302 }
 303
 304 static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu, int rwx,
 305                                             vaddr eaddr, uint64_t pid,
 306                                             ppc_v3_pate_t pate, hwaddr *g_raddr,
 307                                             int *g_prot, int *g_page_size,
 308                                             bool cause_excp)
 309 {
 310     CPUState *cs = CPU(cpu);
 311     CPUPPCState *env = &cpu->env;
 312     uint64_t offset, size, prtbe_addr, prtbe0, base_addr, nls, index, pte;
 313     int fault_cause = 0, h_page_size, h_prot;
 314     hwaddr h_raddr, pte_addr;
 315     int ret;
 316
 317     /* Index Process Table by PID to Find Corresponding Process Table Entry */
 318     offset = pid * sizeof(struct prtb_entry);
 319     size = 1ULL << ((pate.dw1 & PATE1_R_PRTS) + 12);
 320     if (offset >= size) {
 321         /* offset exceeds size of the process table */
 322         if (cause_excp) {
 323             ppc_radix64_raise_si(cpu, rwx, eaddr, DSISR_NOPTE);
 324         }
 325         return 1;
 326     }
 327     prtbe_addr = (pate.dw1 & PATE1_R_PRTB) + offset;
 328
 329     if (cpu->vhyp) {
 330         prtbe0 = ldq_phys(cs->as, prtbe_addr);
 331     } else {
 332         /*
 333          * Process table addresses are subject to partition-scoped
 334          * translation
 335          *
 336          * On a Radix host, the partition-scoped page table for LPID=0
 337          * is only used to translate the effective addresses of the
 338          * process table entries.
 339          */
 340         ret = ppc_radix64_partition_scoped_xlate(cpu, 0, eaddr, prtbe_addr,
 341                                                  pate, &h_raddr, &h_prot,
 342                                                  &h_page_size, 1, 1);
 343         if (ret) {
 344             return ret;
 345         }
 346         prtbe0 = ldq_phys(cs->as, h_raddr);
 347     }
 348
 349     /* Walk Radix Tree from Process Table Entry to Convert EA to RA */
 350     *g_page_size = PRTBE_R_GET_RTS(prtbe0);
 351     base_addr = prtbe0 & PRTBE_R_RPDB;
 352     nls = prtbe0 & PRTBE_R_RPDS;
 353     if (msr_hv || cpu->vhyp) {
 354         /*
 355          * Can treat process table addresses as real addresses
 356          */
 357         ret = ppc_radix64_walk_tree(cs->as, eaddr & R_EADDR_MASK, base_addr,
 358                                     nls, g_raddr, g_page_size, &pte,
 359                                     &fault_cause, &pte_addr);
 360         if (ret) {
 361             /* No valid PTE */
 362             if (cause_excp) {
 363                 ppc_radix64_raise_si(cpu, rwx, eaddr, fault_cause);
 364             }
 365             return ret;
 366         }
 367     } else {
 368         uint64_t rpn, mask;
 369
 370         index = (eaddr & R_EADDR_MASK) >> (*g_page_size - nls); /* Shift */
 371         index &= ((1UL << nls) - 1);                            /* Mask */
 372         pte_addr = base_addr + (index * sizeof(pte));
 373
 374         /*
 375          * Each process table address is subject to a partition-scoped
 376          * translation
 377          */
 378         do {
 379             ret = ppc_radix64_partition_scoped_xlate(cpu, 0, eaddr, pte_addr,
 380                                                      pate, &h_raddr, &h_prot,
 381                                                      &h_page_size, 1, 1);
 382             if (ret) {
 383                 return ret;
 384             }
 385
 386             ret = ppc_radix64_next_level(cs->as, eaddr & R_EADDR_MASK, &h_raddr,
 387                                          &nls, g_page_size, &pte, &fault_cause);
 388             if (ret) {
 389                 /* No valid pte */
 390                 if (cause_excp) {
 391                     ppc_radix64_raise_si(cpu, rwx, eaddr, fault_cause);
 392                 }
 393                 return ret;
 394             }
 395             pte_addr = h_raddr;
 396         } while (!(pte & R_PTE_LEAF));
 397
 398         rpn = pte & R_PTE_RPN;
 399         mask = (1UL << *g_page_size) - 1;
 400
 401         /* Or high bits of rpn and low bits to ea to form whole real addr */
 402         *g_raddr = (rpn & ~mask) | (eaddr & mask);
 403     }
 404
 405     if (ppc_radix64_check_prot(cpu, rwx, pte, &fault_cause, g_prot, false)) {
 406         /* Access denied due to protection */
 407         if (cause_excp) {
 408             ppc_radix64_raise_si(cpu, rwx, eaddr, fault_cause);
 409         }
 410         return 1;
 411     }
 412
 413     ppc_radix64_set_rc(cpu, rwx, pte, pte_addr, g_prot);
 414
 415     return 0;
 416 }
 417
 418 /*
 419  * Radix tree translation is a 2 steps translation process:
 420  *
 421  * 1. Process-scoped translation:   Guest Eff Addr  -> Guest Real Addr
 422  * 2. Partition-scoped translation: Guest Real Addr -> Host Real Addr
 423  *
 424  *                                  MSR[HV]
 425  *              +-------------+----------------+---------------+
 426  *              |             |     HV = 0     |     HV = 1    |
 427  *              +-------------+----------------+---------------+
 428  *              | Relocation  |    Partition   |      No       |
 429  *              | = Off       |     Scoped     |  Translation  |
 430  *  Relocation  +-------------+----------------+---------------+
 431  *              | Relocation  |   Partition &  |    Process    |
 432  *              | = On        | Process Scoped |    Scoped     |
 433  *              +-------------+----------------+---------------+
 434  */
 435 static int ppc_radix64_xlate(PowerPCCPU *cpu, vaddr eaddr, int rwx,
 436                              bool relocation,
 437                              hwaddr *raddr, int *psizep, int *protp,
 438                              bool cause_excp)
 439 {
 440     CPUPPCState *env = &cpu->env;
 441     uint64_t lpid, pid;
 442     ppc_v3_pate_t pate;
 443     int psize, prot;
 444     hwaddr g_raddr;
 445
 446     /* Virtual Mode Access - get the fully qualified address */
 447     if (!ppc_radix64_get_fully_qualified_addr(&cpu->env, eaddr, &lpid, &pid)) {
 448         if (cause_excp) {
 449             ppc_radix64_raise_segi(cpu, rwx, eaddr);
 450         }
 451         return 1;
 452     }
 453
 454     /* Get Process Table */
 455     if (cpu->vhyp) {
 456         PPCVirtualHypervisorClass *vhc;
 457         vhc = PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
 458         vhc->get_pate(cpu->vhyp, &pate);
 459     } else {
 460         if (!ppc64_v3_get_pate(cpu, lpid, &pate)) {
 461             if (cause_excp) {
 462                 ppc_radix64_raise_si(cpu, rwx, eaddr, DSISR_NOPTE);
 463             }
 464             return 1;
 465         }
 466         if (!validate_pate(cpu, lpid, &pate)) {
 467             if (cause_excp) {
 468                 ppc_radix64_raise_si(cpu, rwx, eaddr, DSISR_R_BADCONFIG);
 469             }
 470             return 1;
 471         }
 472     }
 473
 474     *psizep = INT_MAX;
 475     *protp = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 476
 477     /*
 478      * Perform process-scoped translation if relocation enabled.
 479      *
 480      * - Translates an effective address to a host real address in
 481      *   quadrants 0 and 3 when HV=1.
 482      *
 483      * - Translates an effective address to a guest real address.
 484      */
 485     if (relocation) {
 486         int ret = ppc_radix64_process_scoped_xlate(cpu, rwx, eaddr, pid,
 487                                                    pate, &g_raddr, &prot,
 488                                                    &psize, cause_excp);
 489         if (ret) {
 490             return ret;
 491         }
 492         *psizep = MIN(*psizep, psize);
 493         *protp &= prot;
 494     } else {
 495         g_raddr = eaddr & R_EADDR_MASK;
 496     }
 497
 498     if (cpu->vhyp) {
 499         *raddr = g_raddr;
 500     } else {
 501         /*
 502          * Perform partition-scoped translation if !HV or HV access to
 503          * quadrants 1 or 2. Translates a guest real address to a host
 504          * real address.
 505          */
 506         if (lpid || !msr_hv) {
 507             int ret;
 508
 509             ret = ppc_radix64_partition_scoped_xlate(cpu, rwx, eaddr, g_raddr,
 510                                                      pate, raddr, &prot, &psize,
 511                                                      0, cause_excp);
 512             if (ret) {
 513                 return ret;
 514             }
 515             *psizep = MIN(*psizep, psize);
 516             *protp &= prot;
 517         } else {
 518             *raddr = g_raddr;
 519         }
 520     }
 521
 522     return 0;
 523 }
 524
 525 int ppc_radix64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, int rwx,
 526                                  int mmu_idx)
 527 {
 528     CPUState *cs = CPU(cpu);
 529     CPUPPCState *env = &cpu->env;
 530     int page_size, prot;
 531     bool relocation;
 532     hwaddr raddr;
 533
 534     assert(!(msr_hv && cpu->vhyp));
 535     assert((rwx == 0) || (rwx == 1) || (rwx == 2));
 536
 537     relocation = ((rwx == 2) && (msr_ir == 1)) || ((rwx != 2) && (msr_dr == 1));
 538     /* HV or virtual hypervisor Real Mode Access */
 539     if (!relocation && (msr_hv || cpu->vhyp)) {
 540         /* In real mode top 4 effective addr bits (mostly) ignored */
 541         raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
 542
 543         /* In HV mode, add HRMOR if top EA bit is clear */
 544         if (msr_hv || !env->has_hv_mode) {
 545             if (!(eaddr >> 63)) {
 546                 raddr |= env->spr[SPR_HRMOR];
 547            }
 548         }
 549         tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 550                      PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
 551                      TARGET_PAGE_SIZE);
 552         return 0;
 553     }
 554
 555     /*
 556      * Check UPRT (we avoid the check in real mode to deal with
 557      * transitional states during kexec.
 558      */
 559     if (!ppc64_use_proc_tbl(cpu)) {
 560         qemu_log_mask(LOG_GUEST_ERROR,
 561                       "LPCR:UPRT not set in radix mode ! LPCR="
 562                       TARGET_FMT_lx "\n", env->spr[SPR_LPCR]);
 563     }
 564
 565     /* Translate eaddr to raddr (where raddr is addr qemu needs for access) */
 566     if (ppc_radix64_xlate(cpu, eaddr, rwx, relocation, &raddr,
 567                           &page_size, &prot, true)) {
 568         return 1;
 569     }
 570
 571     tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 572                  prot, mmu_idx, 1UL << page_size);
 573     return 0;
 574 }
 575
 576 hwaddr ppc_radix64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong eaddr)
 577 {
 578     CPUPPCState *env = &cpu->env;
 579     int psize, prot;
 580     hwaddr raddr;
 581
 582     /* Handle Real Mode */
 583     if ((msr_dr == 0) && (msr_hv || cpu->vhyp)) {
 584         /* In real mode top 4 effective addr bits (mostly) ignored */
 585         return eaddr & 0x0FFFFFFFFFFFFFFFULL;
 586     }
 587
 588     if (ppc_radix64_xlate(cpu, eaddr, 0, msr_dr, &raddr, &psize,
 589                           &prot, false)) {
 590         return -1;
 591     }
 592
 593     return raddr & TARGET_PAGE_MASK;
 594 }