target/ppc/mmu-hash32.c

   1 /*
   2  *  PowerPC MMU, TLB and BAT emulation helpers for QEMU.
   3  *
   4  *  Copyright (c) 2003-2007 Jocelyn Mayer
   5  *  Copyright (c) 2013 David Gibson, IBM Corporation
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "qemu/osdep.h"
  22 #include "cpu.h"
  23 #include "exec/exec-all.h"
  24 #include "sysemu/kvm.h"
  25 #include "kvm_ppc.h"
  26 #include "internal.h"
  27 #include "mmu-hash32.h"
  28 #include "exec/log.h"
  29
  30 /* #define DEBUG_BATS */
  31
  32 #ifdef DEBUG_BATS
  33 #  define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
  34 #else
  35 #  define LOG_BATS(...) do { } while (0)
  36 #endif
  37
  38 struct mmu_ctx_hash32 {
  39     hwaddr raddr;      /* Real address              */
  40     int prot;                      /* Protection bits           */
  41     int key;                       /* Access key                */
  42 };
  43
  44 static int ppc_hash32_pp_prot(int key, int pp, int nx)
  45 {
  46     int prot;
  47
  48     if (key == 0) {
  49         switch (pp) {
  50         case 0x0:
  51         case 0x1:
  52         case 0x2:
  53             prot = PAGE_READ | PAGE_WRITE;
  54             break;
  55
  56         case 0x3:
  57             prot = PAGE_READ;
  58             break;
  59
  60         default:
  61             abort();
  62         }
  63     } else {
  64         switch (pp) {
  65         case 0x0:
  66             prot = 0;
  67             break;
  68
  69         case 0x1:
  70         case 0x3:
  71             prot = PAGE_READ;
  72             break;
  73
  74         case 0x2:
  75             prot = PAGE_READ | PAGE_WRITE;
  76             break;
  77
  78         default:
  79             abort();
  80         }
  81     }
  82     if (nx == 0) {
  83         prot |= PAGE_EXEC;
  84     }
  85
  86     return prot;
  87 }
  88
  89 static int ppc_hash32_pte_prot(PowerPCCPU *cpu,
  90                                target_ulong sr, ppc_hash_pte32_t pte)
  91 {
  92     CPUPPCState *env = &cpu->env;
  93     unsigned pp, key;
  94
  95     key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
  96     pp = pte.pte1 & HPTE32_R_PP;
  97
  98     return ppc_hash32_pp_prot(key, pp, !!(sr & SR32_NX));
  99 }
 100
 101 static target_ulong hash32_bat_size(PowerPCCPU *cpu,
 102                                     target_ulong batu, target_ulong batl)
 103 {
 104     CPUPPCState *env = &cpu->env;
 105
 106     if ((msr_pr && !(batu & BATU32_VP))
 107         || (!msr_pr && !(batu & BATU32_VS))) {
 108         return 0;
 109     }
 110
 111     return BATU32_BEPI & ~((batu & BATU32_BL) << 15);
 112 }
 113
 114 static int hash32_bat_prot(PowerPCCPU *cpu,
 115                            target_ulong batu, target_ulong batl)
 116 {
 117     int pp, prot;
 118
 119     prot = 0;
 120     pp = batl & BATL32_PP;
 121     if (pp != 0) {
 122         prot = PAGE_READ | PAGE_EXEC;
 123         if (pp == 0x2) {
 124             prot |= PAGE_WRITE;
 125         }
 126     }
 127     return prot;
 128 }
 129
 130 static target_ulong hash32_bat_601_size(PowerPCCPU *cpu,
 131                                 target_ulong batu, target_ulong batl)
 132 {
 133     if (!(batl & BATL32_601_V)) {
 134         return 0;
 135     }
 136
 137     return BATU32_BEPI & ~((batl & BATL32_601_BL) << 17);
 138 }
 139
 140 static int hash32_bat_601_prot(PowerPCCPU *cpu,
 141                                target_ulong batu, target_ulong batl)
 142 {
 143     CPUPPCState *env = &cpu->env;
 144     int key, pp;
 145
 146     pp = batu & BATU32_601_PP;
 147     if (msr_pr == 0) {
 148         key = !!(batu & BATU32_601_KS);
 149     } else {
 150         key = !!(batu & BATU32_601_KP);
 151     }
 152     return ppc_hash32_pp_prot(key, pp, 0);
 153 }
 154
 155 static hwaddr ppc_hash32_bat_lookup(PowerPCCPU *cpu, target_ulong ea,
 156                                     MMUAccessType access_type, int *prot)
 157 {
 158     CPUPPCState *env = &cpu->env;
 159     target_ulong *BATlt, *BATut;
 160     bool ifetch = access_type == MMU_INST_FETCH;
 161     int i;
 162
 163     LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
 164              ifetch ? 'I' : 'D', ea);
 165     if (ifetch) {
 166         BATlt = env->IBAT[1];
 167         BATut = env->IBAT[0];
 168     } else {
 169         BATlt = env->DBAT[1];
 170         BATut = env->DBAT[0];
 171     }
 172     for (i = 0; i < env->nb_BATs; i++) {
 173         target_ulong batu = BATut[i];
 174         target_ulong batl = BATlt[i];
 175         target_ulong mask;
 176
 177         if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 178             mask = hash32_bat_601_size(cpu, batu, batl);
 179         } else {
 180             mask = hash32_bat_size(cpu, batu, batl);
 181         }
 182         LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 183                  " BATl " TARGET_FMT_lx "\n", __func__,
 184                  ifetch ? 'I' : 'D', i, ea, batu, batl);
 185
 186         if (mask && ((ea & mask) == (batu & BATU32_BEPI))) {
 187             hwaddr raddr = (batl & mask) | (ea & ~mask);
 188
 189             if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 190                 *prot = hash32_bat_601_prot(cpu, batu, batl);
 191             } else {
 192                 *prot = hash32_bat_prot(cpu, batu, batl);
 193             }
 194
 195             return raddr & TARGET_PAGE_MASK;
 196         }
 197     }
 198
 199     /* No hit */
 200 #if defined(DEBUG_BATS)
 201     if (qemu_log_enabled()) {
 202         target_ulong *BATu, *BATl;
 203         target_ulong BEPIl, BEPIu, bl;
 204
 205         LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", ea);
 206         for (i = 0; i < 4; i++) {
 207             BATu = &BATut[i];
 208             BATl = &BATlt[i];
 209             BEPIu = *BATu & BATU32_BEPIU;
 210             BEPIl = *BATu & BATU32_BEPIL;
 211             bl = (*BATu & 0x00001FFC) << 15;
 212             LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 213                      " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
 214                      TARGET_FMT_lx " " TARGET_FMT_lx "\n",
 215                      __func__, ifetch ? 'I' : 'D', i, ea,
 216                      *BATu, *BATl, BEPIu, BEPIl, bl);
 217         }
 218     }
 219 #endif
 220
 221     return -1;
 222 }
 223
 224 static bool ppc_hash32_direct_store(PowerPCCPU *cpu, target_ulong sr,
 225                                     target_ulong eaddr,
 226                                     MMUAccessType access_type,
 227                                     hwaddr *raddr, int *prot,
 228                                     bool guest_visible)
 229 {
 230     CPUState *cs = CPU(cpu);
 231     CPUPPCState *env = &cpu->env;
 232     int key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
 233
 234     qemu_log_mask(CPU_LOG_MMU, "direct store...\n");
 235
 236     if ((sr & 0x1FF00000) >> 20 == 0x07f) {
 237         /*
 238          * Memory-forced I/O controller interface access
 239          *
 240          * If T=1 and BUID=x'07F', the 601 performs a memory access
 241          * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
 242          */
 243         *raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
 244         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 245         return true;
 246     }
 247
 248     if (access_type == MMU_INST_FETCH) {
 249         /* No code fetch is allowed in direct-store areas */
 250         if (guest_visible) {
 251             cs->exception_index = POWERPC_EXCP_ISI;
 252             env->error_code = 0x10000000;
 253         }
 254         return false;
 255     }
 256
 257     /*
 258      * From ppc_cpu_get_phys_page_debug, env->access_type is not set.
 259      * Assume ACCESS_INT for that case.
 260      */
 261     switch (guest_visible ? env->access_type : ACCESS_INT) {
 262     case ACCESS_INT:
 263         /* Integer load/store : only access allowed */
 264         break;
 265     case ACCESS_FLOAT:
 266         /* Floating point load/store */
 267         cs->exception_index = POWERPC_EXCP_ALIGN;
 268         env->error_code = POWERPC_EXCP_ALIGN_FP;
 269         env->spr[SPR_DAR] = eaddr;
 270         return false;
 271     case ACCESS_RES:
 272         /* lwarx, ldarx or srwcx. */
 273         env->error_code = 0;
 274         env->spr[SPR_DAR] = eaddr;
 275         if (access_type == MMU_DATA_STORE) {
 276             env->spr[SPR_DSISR] = 0x06000000;
 277         } else {
 278             env->spr[SPR_DSISR] = 0x04000000;
 279         }
 280         return false;
 281     case ACCESS_CACHE:
 282         /*
 283          * dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi
 284          *
 285          * Should make the instruction do no-op.  As it already do
 286          * no-op, it's quite easy :-)
 287          */
 288         *raddr = eaddr;
 289         return true;
 290     case ACCESS_EXT:
 291         /* eciwx or ecowx */
 292         cs->exception_index = POWERPC_EXCP_DSI;
 293         env->error_code = 0;
 294         env->spr[SPR_DAR] = eaddr;
 295         if (access_type == MMU_DATA_STORE) {
 296             env->spr[SPR_DSISR] = 0x06100000;
 297         } else {
 298             env->spr[SPR_DSISR] = 0x04100000;
 299         }
 300         return false;
 301     default:
 302         cpu_abort(cs, "ERROR: insn should not need address translation\n");
 303     }
 304
 305     *prot = key ? PAGE_READ | PAGE_WRITE : PAGE_READ;
 306     if (*prot & prot_for_access_type(access_type)) {
 307         *raddr = eaddr;
 308         return true;
 309     }
 310
 311     if (guest_visible) {
 312         cs->exception_index = POWERPC_EXCP_DSI;
 313         env->error_code = 0;
 314         env->spr[SPR_DAR] = eaddr;
 315         if (access_type == MMU_DATA_STORE) {
 316             env->spr[SPR_DSISR] = 0x0a000000;
 317         } else {
 318             env->spr[SPR_DSISR] = 0x08000000;
 319         }
 320     }
 321     return false;
 322 }
 323
 324 hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash)
 325 {
 326     target_ulong mask = ppc_hash32_hpt_mask(cpu);
 327
 328     return (hash * HASH_PTEG_SIZE_32) & mask;
 329 }
 330
 331 static hwaddr ppc_hash32_pteg_search(PowerPCCPU *cpu, hwaddr pteg_off,
 332                                      bool secondary, target_ulong ptem,
 333                                      ppc_hash_pte32_t *pte)
 334 {
 335     hwaddr pte_offset = pteg_off;
 336     target_ulong pte0, pte1;
 337     int i;
 338
 339     for (i = 0; i < HPTES_PER_GROUP; i++) {
 340         pte0 = ppc_hash32_load_hpte0(cpu, pte_offset);
 341         /*
 342          * pte0 contains the valid bit and must be read before pte1,
 343          * otherwise we might see an old pte1 with a new valid bit and
 344          * thus an inconsistent hpte value
 345          */
 346         smp_rmb();
 347         pte1 = ppc_hash32_load_hpte1(cpu, pte_offset);
 348
 349         if ((pte0 & HPTE32_V_VALID)
 350             && (secondary == !!(pte0 & HPTE32_V_SECONDARY))
 351             && HPTE32_V_COMPARE(pte0, ptem)) {
 352             pte->pte0 = pte0;
 353             pte->pte1 = pte1;
 354             return pte_offset;
 355         }
 356
 357         pte_offset += HASH_PTE_SIZE_32;
 358     }
 359
 360     return -1;
 361 }
 362
 363 static void ppc_hash32_set_r(PowerPCCPU *cpu, hwaddr pte_offset, uint32_t pte1)
 364 {
 365     target_ulong base = ppc_hash32_hpt_base(cpu);
 366     hwaddr offset = pte_offset + 6;
 367
 368     /* The HW performs a non-atomic byte update */
 369     stb_phys(CPU(cpu)->as, base + offset, ((pte1 >> 8) & 0xff) | 0x01);
 370 }
 371
 372 static void ppc_hash32_set_c(PowerPCCPU *cpu, hwaddr pte_offset, uint64_t pte1)
 373 {
 374     target_ulong base = ppc_hash32_hpt_base(cpu);
 375     hwaddr offset = pte_offset + 7;
 376
 377     /* The HW performs a non-atomic byte update */
 378     stb_phys(CPU(cpu)->as, base + offset, (pte1 & 0xff) | 0x80);
 379 }
 380
 381 static hwaddr ppc_hash32_htab_lookup(PowerPCCPU *cpu,
 382                                      target_ulong sr, target_ulong eaddr,
 383                                      ppc_hash_pte32_t *pte)
 384 {
 385     hwaddr pteg_off, pte_offset;
 386     hwaddr hash;
 387     uint32_t vsid, pgidx, ptem;
 388
 389     vsid = sr & SR32_VSID;
 390     pgidx = (eaddr & ~SEGMENT_MASK_256M) >> TARGET_PAGE_BITS;
 391     hash = vsid ^ pgidx;
 392     ptem = (vsid << 7) | (pgidx >> 10);
 393
 394     /* Page address translation */
 395     qemu_log_mask(CPU_LOG_MMU, "htab_base " TARGET_FMT_plx
 396             " htab_mask " TARGET_FMT_plx
 397             " hash " TARGET_FMT_plx "\n",
 398             ppc_hash32_hpt_base(cpu), ppc_hash32_hpt_mask(cpu), hash);
 399
 400     /* Primary PTEG lookup */
 401     qemu_log_mask(CPU_LOG_MMU, "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 402             " vsid=%" PRIx32 " ptem=%" PRIx32
 403             " hash=" TARGET_FMT_plx "\n",
 404             ppc_hash32_hpt_base(cpu), ppc_hash32_hpt_mask(cpu),
 405             vsid, ptem, hash);
 406     pteg_off = get_pteg_offset32(cpu, hash);
 407     pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 0, ptem, pte);
 408     if (pte_offset == -1) {
 409         /* Secondary PTEG lookup */
 410         qemu_log_mask(CPU_LOG_MMU, "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 411                 " vsid=%" PRIx32 " api=%" PRIx32
 412                 " hash=" TARGET_FMT_plx "\n", ppc_hash32_hpt_base(cpu),
 413                 ppc_hash32_hpt_mask(cpu), vsid, ptem, ~hash);
 414         pteg_off = get_pteg_offset32(cpu, ~hash);
 415         pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 1, ptem, pte);
 416     }
 417
 418     return pte_offset;
 419 }
 420
 421 static hwaddr ppc_hash32_pte_raddr(target_ulong sr, ppc_hash_pte32_t pte,
 422                                    target_ulong eaddr)
 423 {
 424     hwaddr rpn = pte.pte1 & HPTE32_R_RPN;
 425     hwaddr mask = ~TARGET_PAGE_MASK;
 426
 427     return (rpn & ~mask) | (eaddr & mask);
 428 }
 429
 430 bool ppc_hash32_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
 431                       hwaddr *raddrp, int *psizep, int *protp,
 432                       bool guest_visible)
 433 {
 434     CPUState *cs = CPU(cpu);
 435     CPUPPCState *env = &cpu->env;
 436     target_ulong sr;
 437     hwaddr pte_offset;
 438     ppc_hash_pte32_t pte;
 439     int prot;
 440     int need_prot;
 441     hwaddr raddr;
 442
 443     /* There are no hash32 large pages. */
 444     *psizep = TARGET_PAGE_BITS;
 445
 446     /* 1. Handle real mode accesses */
 447     if (access_type == MMU_INST_FETCH ? !msr_ir : !msr_dr) {
 448         /* Translation is off */
 449         *raddrp = eaddr;
 450         *protp = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 451         return true;
 452     }
 453
 454     need_prot = prot_for_access_type(access_type);
 455
 456     /* 2. Check Block Address Translation entries (BATs) */
 457     if (env->nb_BATs != 0) {
 458         raddr = ppc_hash32_bat_lookup(cpu, eaddr, access_type, protp);
 459         if (raddr != -1) {
 460             if (need_prot & ~*protp) {
 461                 if (guest_visible) {
 462                     if (access_type == MMU_INST_FETCH) {
 463                         cs->exception_index = POWERPC_EXCP_ISI;
 464                         env->error_code = 0x08000000;
 465                     } else {
 466                         cs->exception_index = POWERPC_EXCP_DSI;
 467                         env->error_code = 0;
 468                         env->spr[SPR_DAR] = eaddr;
 469                         if (access_type == MMU_DATA_STORE) {
 470                             env->spr[SPR_DSISR] = 0x0a000000;
 471                         } else {
 472                             env->spr[SPR_DSISR] = 0x08000000;
 473                         }
 474                     }
 475                 }
 476                 return false;
 477             }
 478             *raddrp = raddr;
 479             return true;
 480         }
 481     }
 482
 483     /* 3. Look up the Segment Register */
 484     sr = env->sr[eaddr >> 28];
 485
 486     /* 4. Handle direct store segments */
 487     if (sr & SR32_T) {
 488         return ppc_hash32_direct_store(cpu, sr, eaddr, access_type,
 489                                        raddrp, protp, guest_visible);
 490     }
 491
 492     /* 5. Check for segment level no-execute violation */
 493     if (access_type == MMU_INST_FETCH && (sr & SR32_NX)) {
 494         if (guest_visible) {
 495             cs->exception_index = POWERPC_EXCP_ISI;
 496             env->error_code = 0x10000000;
 497         }
 498         return false;
 499     }
 500
 501     /* 6. Locate the PTE in the hash table */
 502     pte_offset = ppc_hash32_htab_lookup(cpu, sr, eaddr, &pte);
 503     if (pte_offset == -1) {
 504         if (guest_visible) {
 505             if (access_type == MMU_INST_FETCH) {
 506                 cs->exception_index = POWERPC_EXCP_ISI;
 507                 env->error_code = 0x40000000;
 508             } else {
 509                 cs->exception_index = POWERPC_EXCP_DSI;
 510                 env->error_code = 0;
 511                 env->spr[SPR_DAR] = eaddr;
 512                 if (access_type == MMU_DATA_STORE) {
 513                     env->spr[SPR_DSISR] = 0x42000000;
 514                 } else {
 515                     env->spr[SPR_DSISR] = 0x40000000;
 516                 }
 517             }
 518         }
 519         return false;
 520     }
 521     qemu_log_mask(CPU_LOG_MMU,
 522                 "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
 523
 524     /* 7. Check access permissions */
 525
 526     prot = ppc_hash32_pte_prot(cpu, sr, pte);
 527
 528     if (need_prot & ~prot) {
 529         /* Access right violation */
 530         qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
 531         if (guest_visible) {
 532             if (access_type == MMU_INST_FETCH) {
 533                 cs->exception_index = POWERPC_EXCP_ISI;
 534                 env->error_code = 0x08000000;
 535             } else {
 536                 cs->exception_index = POWERPC_EXCP_DSI;
 537                 env->error_code = 0;
 538                 env->spr[SPR_DAR] = eaddr;
 539                 if (access_type == MMU_DATA_STORE) {
 540                     env->spr[SPR_DSISR] = 0x0a000000;
 541                 } else {
 542                     env->spr[SPR_DSISR] = 0x08000000;
 543                 }
 544             }
 545         }
 546         return false;
 547     }
 548
 549     qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
 550
 551     /* 8. Update PTE referenced and changed bits if necessary */
 552
 553     if (!(pte.pte1 & HPTE32_R_R)) {
 554         ppc_hash32_set_r(cpu, pte_offset, pte.pte1);
 555     }
 556     if (!(pte.pte1 & HPTE32_R_C)) {
 557         if (access_type == MMU_DATA_STORE) {
 558             ppc_hash32_set_c(cpu, pte_offset, pte.pte1);
 559         } else {
 560             /*
 561              * Treat the page as read-only for now, so that a later write
 562              * will pass through this function again to set the C bit
 563              */
 564             prot &= ~PAGE_WRITE;
 565         }
 566      }
 567
 568     /* 9. Determine the real address from the PTE */
 569
 570     *raddrp = ppc_hash32_pte_raddr(sr, pte, eaddr);
 571     *protp = prot;
 572     return true;
 573 }