target/ppc/mmu-hash32.c

   1 /*
   2  *  PowerPC MMU, TLB and BAT emulation helpers for QEMU.
   3  *
   4  *  Copyright (c) 2003-2007 Jocelyn Mayer
   5  *  Copyright (c) 2013 David Gibson, IBM Corporation
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "cpu.h"
  23 #include "exec/exec-all.h"
  24 #include "exec/helper-proto.h"
  25 #include "sysemu/kvm.h"
  26 #include "kvm_ppc.h"
  27 #include "mmu-hash32.h"
  28 #include "exec/log.h"
  29
  30 /* #define DEBUG_BAT */
  31
  32 #ifdef DEBUG_BATS
  33 #  define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
  34 #else
  35 #  define LOG_BATS(...) do { } while (0)
  36 #endif
  37
  38 struct mmu_ctx_hash32 {
  39     hwaddr raddr;      /* Real address              */
  40     int prot;                      /* Protection bits           */
  41     int key;                       /* Access key                */
  42 };
  43
  44 static int ppc_hash32_pp_prot(int key, int pp, int nx)
  45 {
  46     int prot;
  47
  48     if (key == 0) {
  49         switch (pp) {
  50         case 0x0:
  51         case 0x1:
  52         case 0x2:
  53             prot = PAGE_READ | PAGE_WRITE;
  54             break;
  55
  56         case 0x3:
  57             prot = PAGE_READ;
  58             break;
  59
  60         default:
  61             abort();
  62         }
  63     } else {
  64         switch (pp) {
  65         case 0x0:
  66             prot = 0;
  67             break;
  68
  69         case 0x1:
  70         case 0x3:
  71             prot = PAGE_READ;
  72             break;
  73
  74         case 0x2:
  75             prot = PAGE_READ | PAGE_WRITE;
  76             break;
  77
  78         default:
  79             abort();
  80         }
  81     }
  82     if (nx == 0) {
  83         prot |= PAGE_EXEC;
  84     }
  85
  86     return prot;
  87 }
  88
  89 static int ppc_hash32_pte_prot(PowerPCCPU *cpu,
  90                                target_ulong sr, ppc_hash_pte32_t pte)
  91 {
  92     CPUPPCState *env = &cpu->env;
  93     unsigned pp, key;
  94
  95     key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
  96     pp = pte.pte1 & HPTE32_R_PP;
  97
  98     return ppc_hash32_pp_prot(key, pp, !!(sr & SR32_NX));
  99 }
 100
 101 static target_ulong hash32_bat_size(PowerPCCPU *cpu,
 102                                     target_ulong batu, target_ulong batl)
 103 {
 104     CPUPPCState *env = &cpu->env;
 105
 106     if ((msr_pr && !(batu & BATU32_VP))
 107         || (!msr_pr && !(batu & BATU32_VS))) {
 108         return 0;
 109     }
 110
 111     return BATU32_BEPI & ~((batu & BATU32_BL) << 15);
 112 }
 113
 114 static int hash32_bat_prot(PowerPCCPU *cpu,
 115                            target_ulong batu, target_ulong batl)
 116 {
 117     int pp, prot;
 118
 119     prot = 0;
 120     pp = batl & BATL32_PP;
 121     if (pp != 0) {
 122         prot = PAGE_READ | PAGE_EXEC;
 123         if (pp == 0x2) {
 124             prot |= PAGE_WRITE;
 125         }
 126     }
 127     return prot;
 128 }
 129
 130 static target_ulong hash32_bat_601_size(PowerPCCPU *cpu,
 131                                 target_ulong batu, target_ulong batl)
 132 {
 133     if (!(batl & BATL32_601_V)) {
 134         return 0;
 135     }
 136
 137     return BATU32_BEPI & ~((batl & BATL32_601_BL) << 17);
 138 }
 139
 140 static int hash32_bat_601_prot(PowerPCCPU *cpu,
 141                                target_ulong batu, target_ulong batl)
 142 {
 143     CPUPPCState *env = &cpu->env;
 144     int key, pp;
 145
 146     pp = batu & BATU32_601_PP;
 147     if (msr_pr == 0) {
 148         key = !!(batu & BATU32_601_KS);
 149     } else {
 150         key = !!(batu & BATU32_601_KP);
 151     }
 152     return ppc_hash32_pp_prot(key, pp, 0);
 153 }
 154
 155 static hwaddr ppc_hash32_bat_lookup(PowerPCCPU *cpu, target_ulong ea, int rwx,
 156                                     int *prot)
 157 {
 158     CPUPPCState *env = &cpu->env;
 159     target_ulong *BATlt, *BATut;
 160     int i;
 161
 162     LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
 163              rwx == 2 ? 'I' : 'D', ea);
 164     if (rwx == 2) {
 165         BATlt = env->IBAT[1];
 166         BATut = env->IBAT[0];
 167     } else {
 168         BATlt = env->DBAT[1];
 169         BATut = env->DBAT[0];
 170     }
 171     for (i = 0; i < env->nb_BATs; i++) {
 172         target_ulong batu = BATut[i];
 173         target_ulong batl = BATlt[i];
 174         target_ulong mask;
 175
 176         if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 177             mask = hash32_bat_601_size(cpu, batu, batl);
 178         } else {
 179             mask = hash32_bat_size(cpu, batu, batl);
 180         }
 181         LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 182                  " BATl " TARGET_FMT_lx "\n", __func__,
 183                  type == ACCESS_CODE ? 'I' : 'D', i, ea, batu, batl);
 184
 185         if (mask && ((ea & mask) == (batu & BATU32_BEPI))) {
 186             hwaddr raddr = (batl & mask) | (ea & ~mask);
 187
 188             if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 189                 *prot = hash32_bat_601_prot(cpu, batu, batl);
 190             } else {
 191                 *prot = hash32_bat_prot(cpu, batu, batl);
 192             }
 193
 194             return raddr & TARGET_PAGE_MASK;
 195         }
 196     }
 197
 198     /* No hit */
 199 #if defined(DEBUG_BATS)
 200     if (qemu_log_enabled()) {
 201         LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", ea);
 202         for (i = 0; i < 4; i++) {
 203             BATu = &BATut[i];
 204             BATl = &BATlt[i];
 205             BEPIu = *BATu & BATU32_BEPIU;
 206             BEPIl = *BATu & BATU32_BEPIL;
 207             bl = (*BATu & 0x00001FFC) << 15;
 208             LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 209                      " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
 210                      TARGET_FMT_lx " " TARGET_FMT_lx "\n",
 211                      __func__, type == ACCESS_CODE ? 'I' : 'D', i, ea,
 212                      *BATu, *BATl, BEPIu, BEPIl, bl);
 213         }
 214     }
 215 #endif
 216
 217     return -1;
 218 }
 219
 220 static int ppc_hash32_direct_store(PowerPCCPU *cpu, target_ulong sr,
 221                                    target_ulong eaddr, int rwx,
 222                                    hwaddr *raddr, int *prot)
 223 {
 224     CPUState *cs = CPU(cpu);
 225     CPUPPCState *env = &cpu->env;
 226     int key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
 227
 228     qemu_log_mask(CPU_LOG_MMU, "direct store...\n");
 229
 230     if ((sr & 0x1FF00000) >> 20 == 0x07f) {
 231         /*
 232          * Memory-forced I/O controller interface access
 233          *
 234          * If T=1 and BUID=x'07F', the 601 performs a memory access
 235          * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
 236          */
 237         *raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
 238         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 239         return 0;
 240     }
 241
 242     if (rwx == 2) {
 243         /* No code fetch is allowed in direct-store areas */
 244         cs->exception_index = POWERPC_EXCP_ISI;
 245         env->error_code = 0x10000000;
 246         return 1;
 247     }
 248
 249     switch (env->access_type) {
 250     case ACCESS_INT:
 251         /* Integer load/store : only access allowed */
 252         break;
 253     case ACCESS_FLOAT:
 254         /* Floating point load/store */
 255         cs->exception_index = POWERPC_EXCP_ALIGN;
 256         env->error_code = POWERPC_EXCP_ALIGN_FP;
 257         env->spr[SPR_DAR] = eaddr;
 258         return 1;
 259     case ACCESS_RES:
 260         /* lwarx, ldarx or srwcx. */
 261         env->error_code = 0;
 262         env->spr[SPR_DAR] = eaddr;
 263         if (rwx == 1) {
 264             env->spr[SPR_DSISR] = 0x06000000;
 265         } else {
 266             env->spr[SPR_DSISR] = 0x04000000;
 267         }
 268         return 1;
 269     case ACCESS_CACHE:
 270         /*
 271          * dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi
 272          *
 273          * Should make the instruction do no-op.  As it already do
 274          * no-op, it's quite easy :-)
 275          */
 276         *raddr = eaddr;
 277         return 0;
 278     case ACCESS_EXT:
 279         /* eciwx or ecowx */
 280         cs->exception_index = POWERPC_EXCP_DSI;
 281         env->error_code = 0;
 282         env->spr[SPR_DAR] = eaddr;
 283         if (rwx == 1) {
 284             env->spr[SPR_DSISR] = 0x06100000;
 285         } else {
 286             env->spr[SPR_DSISR] = 0x04100000;
 287         }
 288         return 1;
 289     default:
 290         cpu_abort(cs, "ERROR: instruction should not need "
 291                  "address translation\n");
 292     }
 293     if ((rwx == 1 || key != 1) && (rwx == 0 || key != 0)) {
 294         *raddr = eaddr;
 295         return 0;
 296     } else {
 297         cs->exception_index = POWERPC_EXCP_DSI;
 298         env->error_code = 0;
 299         env->spr[SPR_DAR] = eaddr;
 300         if (rwx == 1) {
 301             env->spr[SPR_DSISR] = 0x0a000000;
 302         } else {
 303             env->spr[SPR_DSISR] = 0x08000000;
 304         }
 305         return 1;
 306     }
 307 }
 308
 309 hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash)
 310 {
 311     target_ulong mask = ppc_hash32_hpt_mask(cpu);
 312
 313     return (hash * HASH_PTEG_SIZE_32) & mask;
 314 }
 315
 316 static hwaddr ppc_hash32_pteg_search(PowerPCCPU *cpu, hwaddr pteg_off,
 317                                      bool secondary, target_ulong ptem,
 318                                      ppc_hash_pte32_t *pte)
 319 {
 320     hwaddr pte_offset = pteg_off;
 321     target_ulong pte0, pte1;
 322     int i;
 323
 324     for (i = 0; i < HPTES_PER_GROUP; i++) {
 325         pte0 = ppc_hash32_load_hpte0(cpu, pte_offset);
 326         /*
 327          * pte0 contains the valid bit and must be read before pte1,
 328          * otherwise we might see an old pte1 with a new valid bit and
 329          * thus an inconsistent hpte value
 330          */
 331         smp_rmb();
 332         pte1 = ppc_hash32_load_hpte1(cpu, pte_offset);
 333
 334         if ((pte0 & HPTE32_V_VALID)
 335             && (secondary == !!(pte0 & HPTE32_V_SECONDARY))
 336             && HPTE32_V_COMPARE(pte0, ptem)) {
 337             pte->pte0 = pte0;
 338             pte->pte1 = pte1;
 339             return pte_offset;
 340         }
 341
 342         pte_offset += HASH_PTE_SIZE_32;
 343     }
 344
 345     return -1;
 346 }
 347
 348 static void ppc_hash32_set_r(PowerPCCPU *cpu, hwaddr pte_offset, uint32_t pte1)
 349 {
 350     target_ulong base = ppc_hash32_hpt_base(cpu);
 351     hwaddr offset = pte_offset + 6;
 352
 353     /* The HW performs a non-atomic byte update */
 354     stb_phys(CPU(cpu)->as, base + offset, ((pte1 >> 8) & 0xff) | 0x01);
 355 }
 356
 357 static void ppc_hash32_set_c(PowerPCCPU *cpu, hwaddr pte_offset, uint64_t pte1)
 358 {
 359     target_ulong base = ppc_hash32_hpt_base(cpu);
 360     hwaddr offset = pte_offset + 7;
 361
 362     /* The HW performs a non-atomic byte update */
 363     stb_phys(CPU(cpu)->as, base + offset, (pte1 & 0xff) | 0x80);
 364 }
 365
 366 static hwaddr ppc_hash32_htab_lookup(PowerPCCPU *cpu,
 367                                      target_ulong sr, target_ulong eaddr,
 368                                      ppc_hash_pte32_t *pte)
 369 {
 370     hwaddr pteg_off, pte_offset;
 371     hwaddr hash;
 372     uint32_t vsid, pgidx, ptem;
 373
 374     vsid = sr & SR32_VSID;
 375     pgidx = (eaddr & ~SEGMENT_MASK_256M) >> TARGET_PAGE_BITS;
 376     hash = vsid ^ pgidx;
 377     ptem = (vsid << 7) | (pgidx >> 10);
 378
 379     /* Page address translation */
 380     qemu_log_mask(CPU_LOG_MMU, "htab_base " TARGET_FMT_plx
 381             " htab_mask " TARGET_FMT_plx
 382             " hash " TARGET_FMT_plx "\n",
 383             ppc_hash32_hpt_base(cpu), ppc_hash32_hpt_mask(cpu), hash);
 384
 385     /* Primary PTEG lookup */
 386     qemu_log_mask(CPU_LOG_MMU, "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 387             " vsid=%" PRIx32 " ptem=%" PRIx32
 388             " hash=" TARGET_FMT_plx "\n",
 389             ppc_hash32_hpt_base(cpu), ppc_hash32_hpt_mask(cpu),
 390             vsid, ptem, hash);
 391     pteg_off = get_pteg_offset32(cpu, hash);
 392     pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 0, ptem, pte);
 393     if (pte_offset == -1) {
 394         /* Secondary PTEG lookup */
 395         qemu_log_mask(CPU_LOG_MMU, "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 396                 " vsid=%" PRIx32 " api=%" PRIx32
 397                 " hash=" TARGET_FMT_plx "\n", ppc_hash32_hpt_base(cpu),
 398                 ppc_hash32_hpt_mask(cpu), vsid, ptem, ~hash);
 399         pteg_off = get_pteg_offset32(cpu, ~hash);
 400         pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 1, ptem, pte);
 401     }
 402
 403     return pte_offset;
 404 }
 405
 406 static hwaddr ppc_hash32_pte_raddr(target_ulong sr, ppc_hash_pte32_t pte,
 407                                    target_ulong eaddr)
 408 {
 409     hwaddr rpn = pte.pte1 & HPTE32_R_RPN;
 410     hwaddr mask = ~TARGET_PAGE_MASK;
 411
 412     return (rpn & ~mask) | (eaddr & mask);
 413 }
 414
 415 int ppc_hash32_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, int rwx,
 416                                 int mmu_idx)
 417 {
 418     CPUState *cs = CPU(cpu);
 419     CPUPPCState *env = &cpu->env;
 420     target_ulong sr;
 421     hwaddr pte_offset;
 422     ppc_hash_pte32_t pte;
 423     int prot;
 424     const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
 425     hwaddr raddr;
 426
 427     assert((rwx == 0) || (rwx == 1) || (rwx == 2));
 428
 429     /* 1. Handle real mode accesses */
 430     if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
 431         /* Translation is off */
 432         raddr = eaddr;
 433         tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 434                      PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
 435                      TARGET_PAGE_SIZE);
 436         return 0;
 437     }
 438
 439     /* 2. Check Block Address Translation entries (BATs) */
 440     if (env->nb_BATs != 0) {
 441         raddr = ppc_hash32_bat_lookup(cpu, eaddr, rwx, &prot);
 442         if (raddr != -1) {
 443             if (need_prot[rwx] & ~prot) {
 444                 if (rwx == 2) {
 445                     cs->exception_index = POWERPC_EXCP_ISI;
 446                     env->error_code = 0x08000000;
 447                 } else {
 448                     cs->exception_index = POWERPC_EXCP_DSI;
 449                     env->error_code = 0;
 450                     env->spr[SPR_DAR] = eaddr;
 451                     if (rwx == 1) {
 452                         env->spr[SPR_DSISR] = 0x0a000000;
 453                     } else {
 454                         env->spr[SPR_DSISR] = 0x08000000;
 455                     }
 456                 }
 457                 return 1;
 458             }
 459
 460             tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
 461                          raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 462                          TARGET_PAGE_SIZE);
 463             return 0;
 464         }
 465     }
 466
 467     /* 3. Look up the Segment Register */
 468     sr = env->sr[eaddr >> 28];
 469
 470     /* 4. Handle direct store segments */
 471     if (sr & SR32_T) {
 472         if (ppc_hash32_direct_store(cpu, sr, eaddr, rwx,
 473                                     &raddr, &prot) == 0) {
 474             tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
 475                          raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 476                          TARGET_PAGE_SIZE);
 477             return 0;
 478         } else {
 479             return 1;
 480         }
 481     }
 482
 483     /* 5. Check for segment level no-execute violation */
 484     if ((rwx == 2) && (sr & SR32_NX)) {
 485         cs->exception_index = POWERPC_EXCP_ISI;
 486         env->error_code = 0x10000000;
 487         return 1;
 488     }
 489
 490     /* 6. Locate the PTE in the hash table */
 491     pte_offset = ppc_hash32_htab_lookup(cpu, sr, eaddr, &pte);
 492     if (pte_offset == -1) {
 493         if (rwx == 2) {
 494             cs->exception_index = POWERPC_EXCP_ISI;
 495             env->error_code = 0x40000000;
 496         } else {
 497             cs->exception_index = POWERPC_EXCP_DSI;
 498             env->error_code = 0;
 499             env->spr[SPR_DAR] = eaddr;
 500             if (rwx == 1) {
 501                 env->spr[SPR_DSISR] = 0x42000000;
 502             } else {
 503                 env->spr[SPR_DSISR] = 0x40000000;
 504             }
 505         }
 506
 507         return 1;
 508     }
 509     qemu_log_mask(CPU_LOG_MMU,
 510                 "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
 511
 512     /* 7. Check access permissions */
 513
 514     prot = ppc_hash32_pte_prot(cpu, sr, pte);
 515
 516     if (need_prot[rwx] & ~prot) {
 517         /* Access right violation */
 518         qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
 519         if (rwx == 2) {
 520             cs->exception_index = POWERPC_EXCP_ISI;
 521             env->error_code = 0x08000000;
 522         } else {
 523             cs->exception_index = POWERPC_EXCP_DSI;
 524             env->error_code = 0;
 525             env->spr[SPR_DAR] = eaddr;
 526             if (rwx == 1) {
 527                 env->spr[SPR_DSISR] = 0x0a000000;
 528             } else {
 529                 env->spr[SPR_DSISR] = 0x08000000;
 530             }
 531         }
 532         return 1;
 533     }
 534
 535     qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
 536
 537     /* 8. Update PTE referenced and changed bits if necessary */
 538
 539     if (!(pte.pte1 & HPTE32_R_R)) {
 540         ppc_hash32_set_r(cpu, pte_offset, pte.pte1);
 541     }
 542     if (!(pte.pte1 & HPTE32_R_C)) {
 543         if (rwx == 1) {
 544             ppc_hash32_set_c(cpu, pte_offset, pte.pte1);
 545         } else {
 546             /*
 547              * Treat the page as read-only for now, so that a later write
 548              * will pass through this function again to set the C bit
 549              */
 550             prot &= ~PAGE_WRITE;
 551         }
 552      }
 553
 554     /* 9. Determine the real address from the PTE */
 555
 556     raddr = ppc_hash32_pte_raddr(sr, pte, eaddr);
 557
 558     tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 559                  prot, mmu_idx, TARGET_PAGE_SIZE);
 560
 561     return 0;
 562 }
 563
 564 hwaddr ppc_hash32_get_phys_page_debug(PowerPCCPU *cpu, target_ulong eaddr)
 565 {
 566     CPUPPCState *env = &cpu->env;
 567     target_ulong sr;
 568     hwaddr pte_offset;
 569     ppc_hash_pte32_t pte;
 570     int prot;
 571
 572     if (msr_dr == 0) {
 573         /* Translation is off */
 574         return eaddr;
 575     }
 576
 577     if (env->nb_BATs != 0) {
 578         hwaddr raddr = ppc_hash32_bat_lookup(cpu, eaddr, 0, &prot);
 579         if (raddr != -1) {
 580             return raddr;
 581         }
 582     }
 583
 584     sr = env->sr[eaddr >> 28];
 585
 586     if (sr & SR32_T) {
 587         /* FIXME: Add suitable debug support for Direct Store segments */
 588         return -1;
 589     }
 590
 591     pte_offset = ppc_hash32_htab_lookup(cpu, sr, eaddr, &pte);
 592     if (pte_offset == -1) {
 593         return -1;
 594     }
 595
 596     return ppc_hash32_pte_raddr(sr, pte, eaddr) & TARGET_PAGE_MASK;
 597 }