ipmi: replace goto by a return statement
[qemu/cris-port.git] / target-ppc / mmu-hash32.c
blob39abb2fd39c49675a3635b836eb35a055c83d557
1 /*
2 * PowerPC MMU, TLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 * Copyright (c) 2013 David Gibson, IBM Corporation
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
22 #include "cpu.h"
23 #include "exec/helper-proto.h"
24 #include "sysemu/kvm.h"
25 #include "kvm_ppc.h"
26 #include "mmu-hash32.h"
27 #include "exec/log.h"
29 //#define DEBUG_BAT
31 #ifdef DEBUG_BATS
32 # define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
33 #else
34 # define LOG_BATS(...) do { } while (0)
35 #endif
37 struct mmu_ctx_hash32 {
38 hwaddr raddr; /* Real address */
39 int prot; /* Protection bits */
40 int key; /* Access key */
43 static int ppc_hash32_pp_prot(int key, int pp, int nx)
45 int prot;
47 if (key == 0) {
48 switch (pp) {
49 case 0x0:
50 case 0x1:
51 case 0x2:
52 prot = PAGE_READ | PAGE_WRITE;
53 break;
55 case 0x3:
56 prot = PAGE_READ;
57 break;
59 default:
60 abort();
62 } else {
63 switch (pp) {
64 case 0x0:
65 prot = 0;
66 break;
68 case 0x1:
69 case 0x3:
70 prot = PAGE_READ;
71 break;
73 case 0x2:
74 prot = PAGE_READ | PAGE_WRITE;
75 break;
77 default:
78 abort();
81 if (nx == 0) {
82 prot |= PAGE_EXEC;
85 return prot;
88 static int ppc_hash32_pte_prot(PowerPCCPU *cpu,
89 target_ulong sr, ppc_hash_pte32_t pte)
91 CPUPPCState *env = &cpu->env;
92 unsigned pp, key;
94 key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
95 pp = pte.pte1 & HPTE32_R_PP;
97 return ppc_hash32_pp_prot(key, pp, !!(sr & SR32_NX));
100 static target_ulong hash32_bat_size(PowerPCCPU *cpu,
101 target_ulong batu, target_ulong batl)
103 CPUPPCState *env = &cpu->env;
105 if ((msr_pr && !(batu & BATU32_VP))
106 || (!msr_pr && !(batu & BATU32_VS))) {
107 return 0;
110 return BATU32_BEPI & ~((batu & BATU32_BL) << 15);
113 static int hash32_bat_prot(PowerPCCPU *cpu,
114 target_ulong batu, target_ulong batl)
116 int pp, prot;
118 prot = 0;
119 pp = batl & BATL32_PP;
120 if (pp != 0) {
121 prot = PAGE_READ | PAGE_EXEC;
122 if (pp == 0x2) {
123 prot |= PAGE_WRITE;
126 return prot;
129 static target_ulong hash32_bat_601_size(PowerPCCPU *cpu,
130 target_ulong batu, target_ulong batl)
132 if (!(batl & BATL32_601_V)) {
133 return 0;
136 return BATU32_BEPI & ~((batl & BATL32_601_BL) << 17);
139 static int hash32_bat_601_prot(PowerPCCPU *cpu,
140 target_ulong batu, target_ulong batl)
142 CPUPPCState *env = &cpu->env;
143 int key, pp;
145 pp = batu & BATU32_601_PP;
146 if (msr_pr == 0) {
147 key = !!(batu & BATU32_601_KS);
148 } else {
149 key = !!(batu & BATU32_601_KP);
151 return ppc_hash32_pp_prot(key, pp, 0);
154 static hwaddr ppc_hash32_bat_lookup(PowerPCCPU *cpu, target_ulong ea, int rwx,
155 int *prot)
157 CPUPPCState *env = &cpu->env;
158 target_ulong *BATlt, *BATut;
159 int i;
161 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
162 rwx == 2 ? 'I' : 'D', ea);
163 if (rwx == 2) {
164 BATlt = env->IBAT[1];
165 BATut = env->IBAT[0];
166 } else {
167 BATlt = env->DBAT[1];
168 BATut = env->DBAT[0];
170 for (i = 0; i < env->nb_BATs; i++) {
171 target_ulong batu = BATut[i];
172 target_ulong batl = BATlt[i];
173 target_ulong mask;
175 if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
176 mask = hash32_bat_601_size(cpu, batu, batl);
177 } else {
178 mask = hash32_bat_size(cpu, batu, batl);
180 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
181 " BATl " TARGET_FMT_lx "\n", __func__,
182 type == ACCESS_CODE ? 'I' : 'D', i, ea, batu, batl);
184 if (mask && ((ea & mask) == (batu & BATU32_BEPI))) {
185 hwaddr raddr = (batl & mask) | (ea & ~mask);
187 if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
188 *prot = hash32_bat_601_prot(cpu, batu, batl);
189 } else {
190 *prot = hash32_bat_prot(cpu, batu, batl);
193 return raddr & TARGET_PAGE_MASK;
197 /* No hit */
198 #if defined(DEBUG_BATS)
199 if (qemu_log_enabled()) {
200 LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", ea);
201 for (i = 0; i < 4; i++) {
202 BATu = &BATut[i];
203 BATl = &BATlt[i];
204 BEPIu = *BATu & BATU32_BEPIU;
205 BEPIl = *BATu & BATU32_BEPIL;
206 bl = (*BATu & 0x00001FFC) << 15;
207 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
208 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
209 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
210 __func__, type == ACCESS_CODE ? 'I' : 'D', i, ea,
211 *BATu, *BATl, BEPIu, BEPIl, bl);
214 #endif
216 return -1;
219 static int ppc_hash32_direct_store(PowerPCCPU *cpu, target_ulong sr,
220 target_ulong eaddr, int rwx,
221 hwaddr *raddr, int *prot)
223 CPUState *cs = CPU(cpu);
224 CPUPPCState *env = &cpu->env;
225 int key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
227 qemu_log_mask(CPU_LOG_MMU, "direct store...\n");
229 if ((sr & 0x1FF00000) >> 20 == 0x07f) {
230 /* Memory-forced I/O controller interface access */
231 /* If T=1 and BUID=x'07F', the 601 performs a memory access
232 * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
234 *raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
235 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
236 return 0;
239 if (rwx == 2) {
240 /* No code fetch is allowed in direct-store areas */
241 cs->exception_index = POWERPC_EXCP_ISI;
242 env->error_code = 0x10000000;
243 return 1;
246 switch (env->access_type) {
247 case ACCESS_INT:
248 /* Integer load/store : only access allowed */
249 break;
250 case ACCESS_FLOAT:
251 /* Floating point load/store */
252 cs->exception_index = POWERPC_EXCP_ALIGN;
253 env->error_code = POWERPC_EXCP_ALIGN_FP;
254 env->spr[SPR_DAR] = eaddr;
255 return 1;
256 case ACCESS_RES:
257 /* lwarx, ldarx or srwcx. */
258 env->error_code = 0;
259 env->spr[SPR_DAR] = eaddr;
260 if (rwx == 1) {
261 env->spr[SPR_DSISR] = 0x06000000;
262 } else {
263 env->spr[SPR_DSISR] = 0x04000000;
265 return 1;
266 case ACCESS_CACHE:
267 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
268 /* Should make the instruction do no-op.
269 * As it already do no-op, it's quite easy :-)
271 *raddr = eaddr;
272 return 0;
273 case ACCESS_EXT:
274 /* eciwx or ecowx */
275 cs->exception_index = POWERPC_EXCP_DSI;
276 env->error_code = 0;
277 env->spr[SPR_DAR] = eaddr;
278 if (rwx == 1) {
279 env->spr[SPR_DSISR] = 0x06100000;
280 } else {
281 env->spr[SPR_DSISR] = 0x04100000;
283 return 1;
284 default:
285 cpu_abort(cs, "ERROR: instruction should not need "
286 "address translation\n");
288 if ((rwx == 1 || key != 1) && (rwx == 0 || key != 0)) {
289 *raddr = eaddr;
290 return 0;
291 } else {
292 cs->exception_index = POWERPC_EXCP_DSI;
293 env->error_code = 0;
294 env->spr[SPR_DAR] = eaddr;
295 if (rwx == 1) {
296 env->spr[SPR_DSISR] = 0x0a000000;
297 } else {
298 env->spr[SPR_DSISR] = 0x08000000;
300 return 1;
304 hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash)
306 CPUPPCState *env = &cpu->env;
308 return (hash * HASH_PTEG_SIZE_32) & env->htab_mask;
311 static hwaddr ppc_hash32_pteg_search(PowerPCCPU *cpu, hwaddr pteg_off,
312 bool secondary, target_ulong ptem,
313 ppc_hash_pte32_t *pte)
315 hwaddr pte_offset = pteg_off;
316 target_ulong pte0, pte1;
317 int i;
319 for (i = 0; i < HPTES_PER_GROUP; i++) {
320 pte0 = ppc_hash32_load_hpte0(cpu, pte_offset);
321 pte1 = ppc_hash32_load_hpte1(cpu, pte_offset);
323 if ((pte0 & HPTE32_V_VALID)
324 && (secondary == !!(pte0 & HPTE32_V_SECONDARY))
325 && HPTE32_V_COMPARE(pte0, ptem)) {
326 pte->pte0 = pte0;
327 pte->pte1 = pte1;
328 return pte_offset;
331 pte_offset += HASH_PTE_SIZE_32;
334 return -1;
337 static hwaddr ppc_hash32_htab_lookup(PowerPCCPU *cpu,
338 target_ulong sr, target_ulong eaddr,
339 ppc_hash_pte32_t *pte)
341 CPUPPCState *env = &cpu->env;
342 hwaddr pteg_off, pte_offset;
343 hwaddr hash;
344 uint32_t vsid, pgidx, ptem;
346 vsid = sr & SR32_VSID;
347 pgidx = (eaddr & ~SEGMENT_MASK_256M) >> TARGET_PAGE_BITS;
348 hash = vsid ^ pgidx;
349 ptem = (vsid << 7) | (pgidx >> 10);
351 /* Page address translation */
352 qemu_log_mask(CPU_LOG_MMU, "htab_base " TARGET_FMT_plx
353 " htab_mask " TARGET_FMT_plx
354 " hash " TARGET_FMT_plx "\n",
355 env->htab_base, env->htab_mask, hash);
357 /* Primary PTEG lookup */
358 qemu_log_mask(CPU_LOG_MMU, "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
359 " vsid=%" PRIx32 " ptem=%" PRIx32
360 " hash=" TARGET_FMT_plx "\n",
361 env->htab_base, env->htab_mask, vsid, ptem, hash);
362 pteg_off = get_pteg_offset32(cpu, hash);
363 pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 0, ptem, pte);
364 if (pte_offset == -1) {
365 /* Secondary PTEG lookup */
366 qemu_log_mask(CPU_LOG_MMU, "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
367 " vsid=%" PRIx32 " api=%" PRIx32
368 " hash=" TARGET_FMT_plx "\n", env->htab_base,
369 env->htab_mask, vsid, ptem, ~hash);
370 pteg_off = get_pteg_offset32(cpu, ~hash);
371 pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 1, ptem, pte);
374 return pte_offset;
377 static hwaddr ppc_hash32_pte_raddr(target_ulong sr, ppc_hash_pte32_t pte,
378 target_ulong eaddr)
380 hwaddr rpn = pte.pte1 & HPTE32_R_RPN;
381 hwaddr mask = ~TARGET_PAGE_MASK;
383 return (rpn & ~mask) | (eaddr & mask);
386 int ppc_hash32_handle_mmu_fault(PowerPCCPU *cpu, target_ulong eaddr, int rwx,
387 int mmu_idx)
389 CPUState *cs = CPU(cpu);
390 CPUPPCState *env = &cpu->env;
391 target_ulong sr;
392 hwaddr pte_offset;
393 ppc_hash_pte32_t pte;
394 int prot;
395 uint32_t new_pte1;
396 const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
397 hwaddr raddr;
399 assert((rwx == 0) || (rwx == 1) || (rwx == 2));
401 /* 1. Handle real mode accesses */
402 if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
403 /* Translation is off */
404 raddr = eaddr;
405 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
406 PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
407 TARGET_PAGE_SIZE);
408 return 0;
411 /* 2. Check Block Address Translation entries (BATs) */
412 if (env->nb_BATs != 0) {
413 raddr = ppc_hash32_bat_lookup(cpu, eaddr, rwx, &prot);
414 if (raddr != -1) {
415 if (need_prot[rwx] & ~prot) {
416 if (rwx == 2) {
417 cs->exception_index = POWERPC_EXCP_ISI;
418 env->error_code = 0x08000000;
419 } else {
420 cs->exception_index = POWERPC_EXCP_DSI;
421 env->error_code = 0;
422 env->spr[SPR_DAR] = eaddr;
423 if (rwx == 1) {
424 env->spr[SPR_DSISR] = 0x0a000000;
425 } else {
426 env->spr[SPR_DSISR] = 0x08000000;
429 return 1;
432 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
433 raddr & TARGET_PAGE_MASK, prot, mmu_idx,
434 TARGET_PAGE_SIZE);
435 return 0;
439 /* 3. Look up the Segment Register */
440 sr = env->sr[eaddr >> 28];
442 /* 4. Handle direct store segments */
443 if (sr & SR32_T) {
444 if (ppc_hash32_direct_store(cpu, sr, eaddr, rwx,
445 &raddr, &prot) == 0) {
446 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
447 raddr & TARGET_PAGE_MASK, prot, mmu_idx,
448 TARGET_PAGE_SIZE);
449 return 0;
450 } else {
451 return 1;
455 /* 5. Check for segment level no-execute violation */
456 if ((rwx == 2) && (sr & SR32_NX)) {
457 cs->exception_index = POWERPC_EXCP_ISI;
458 env->error_code = 0x10000000;
459 return 1;
462 /* 6. Locate the PTE in the hash table */
463 pte_offset = ppc_hash32_htab_lookup(cpu, sr, eaddr, &pte);
464 if (pte_offset == -1) {
465 if (rwx == 2) {
466 cs->exception_index = POWERPC_EXCP_ISI;
467 env->error_code = 0x40000000;
468 } else {
469 cs->exception_index = POWERPC_EXCP_DSI;
470 env->error_code = 0;
471 env->spr[SPR_DAR] = eaddr;
472 if (rwx == 1) {
473 env->spr[SPR_DSISR] = 0x42000000;
474 } else {
475 env->spr[SPR_DSISR] = 0x40000000;
479 return 1;
481 qemu_log_mask(CPU_LOG_MMU,
482 "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
484 /* 7. Check access permissions */
486 prot = ppc_hash32_pte_prot(cpu, sr, pte);
488 if (need_prot[rwx] & ~prot) {
489 /* Access right violation */
490 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
491 if (rwx == 2) {
492 cs->exception_index = POWERPC_EXCP_ISI;
493 env->error_code = 0x08000000;
494 } else {
495 cs->exception_index = POWERPC_EXCP_DSI;
496 env->error_code = 0;
497 env->spr[SPR_DAR] = eaddr;
498 if (rwx == 1) {
499 env->spr[SPR_DSISR] = 0x0a000000;
500 } else {
501 env->spr[SPR_DSISR] = 0x08000000;
504 return 1;
507 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
509 /* 8. Update PTE referenced and changed bits if necessary */
511 new_pte1 = pte.pte1 | HPTE32_R_R; /* set referenced bit */
512 if (rwx == 1) {
513 new_pte1 |= HPTE32_R_C; /* set changed (dirty) bit */
514 } else {
515 /* Treat the page as read-only for now, so that a later write
516 * will pass through this function again to set the C bit */
517 prot &= ~PAGE_WRITE;
520 if (new_pte1 != pte.pte1) {
521 ppc_hash32_store_hpte1(cpu, pte_offset, new_pte1);
524 /* 9. Determine the real address from the PTE */
526 raddr = ppc_hash32_pte_raddr(sr, pte, eaddr);
528 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
529 prot, mmu_idx, TARGET_PAGE_SIZE);
531 return 0;
534 hwaddr ppc_hash32_get_phys_page_debug(PowerPCCPU *cpu, target_ulong eaddr)
536 CPUPPCState *env = &cpu->env;
537 target_ulong sr;
538 hwaddr pte_offset;
539 ppc_hash_pte32_t pte;
540 int prot;
542 if (msr_dr == 0) {
543 /* Translation is off */
544 return eaddr;
547 if (env->nb_BATs != 0) {
548 hwaddr raddr = ppc_hash32_bat_lookup(cpu, eaddr, 0, &prot);
549 if (raddr != -1) {
550 return raddr;
554 sr = env->sr[eaddr >> 28];
556 if (sr & SR32_T) {
557 /* FIXME: Add suitable debug support for Direct Store segments */
558 return -1;
561 pte_offset = ppc_hash32_htab_lookup(cpu, sr, eaddr, &pte);
562 if (pte_offset == -1) {
563 return -1;
566 return ppc_hash32_pte_raddr(sr, pte, eaddr) & TARGET_PAGE_MASK;