LXR qemu/target/ppc/mmu-hash32.c

   1/*
   2 *  PowerPC MMU, TLB and BAT emulation helpers for QEMU.
   3 *
   4 *  Copyright (c) 2003-2007 Jocelyn Mayer
   5 *  Copyright (c) 2013 David Gibson, IBM Corporation
   6 *
   7 * This library is free software; you can redistribute it and/or
   8 * modify it under the terms of the GNU Lesser General Public
   9 * License as published by the Free Software Foundation; either
  10 * version 2 of the License, or (at your option) any later version.
  11 *
  12 * This library is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15 * Lesser General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU Lesser General Public
  18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21#include "qemu/osdep.h"
  22#include "cpu.h"
  23#include "exec/exec-all.h"
  24#include "exec/helper-proto.h"
  25#include "sysemu/kvm.h"
  26#include "kvm_ppc.h"
  27#include "mmu-hash32.h"
  28#include "exec/log.h"
  29
  30/* #define DEBUG_BAT */
  31
  32#ifdef DEBUG_BATS
  33#  define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
  34#else
  35#  define LOG_BATS(...) do { } while (0)
  36#endif
  37
  38struct mmu_ctx_hash32 {
  39    hwaddr raddr;      /* Real address              */
  40    int prot;                      /* Protection bits           */
  41    int key;                       /* Access key                */
  42};
  43
  44static int ppc_hash32_pp_prot(int key, int pp, int nx)
  45{
  46    int prot;
  47
  48    if (key == 0) {
  49        switch (pp) {
  50        case 0x0:
  51        case 0x1:
  52        case 0x2:
  53            prot = PAGE_READ | PAGE_WRITE;
  54            break;
  55
  56        case 0x3:
  57            prot = PAGE_READ;
  58            break;
  59
  60        default:
  61            abort();
  62        }
  63    } else {
  64        switch (pp) {
  65        case 0x0:
  66            prot = 0;
  67            break;
  68
  69        case 0x1:
  70        case 0x3:
  71            prot = PAGE_READ;
  72            break;
  73
  74        case 0x2:
  75            prot = PAGE_READ | PAGE_WRITE;
  76            break;
  77
  78        default:
  79            abort();
  80        }
  81    }
  82    if (nx == 0) {
  83        prot |= PAGE_EXEC;
  84    }
  85
  86    return prot;
  87}
  88
  89static int ppc_hash32_pte_prot(PowerPCCPU *cpu,
  90                               target_ulong sr, ppc_hash_pte32_t pte)
  91{
  92    CPUPPCState *env = &cpu->env;
  93    unsigned pp, key;
  94
  95    key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
  96    pp = pte.pte1 & HPTE32_R_PP;
  97
  98    return ppc_hash32_pp_prot(key, pp, !!(sr & SR32_NX));
  99}
 100
 101static target_ulong hash32_bat_size(PowerPCCPU *cpu,
 102                                    target_ulong batu, target_ulong batl)
 103{
 104    CPUPPCState *env = &cpu->env;
 105
 106    if ((msr_pr && !(batu & BATU32_VP))
 107        || (!msr_pr && !(batu & BATU32_VS))) {
 108        return 0;
 109    }
 110
 111    return BATU32_BEPI & ~((batu & BATU32_BL) << 15);
 112}
 113
 114static int hash32_bat_prot(PowerPCCPU *cpu,
 115                           target_ulong batu, target_ulong batl)
 116{
 117    int pp, prot;
 118
 119    prot = 0;
 120    pp = batl & BATL32_PP;
 121    if (pp != 0) {
 122        prot = PAGE_READ | PAGE_EXEC;
 123        if (pp == 0x2) {
 124            prot |= PAGE_WRITE;
 125        }
 126    }
 127    return prot;
 128}
 129
 130static target_ulong hash32_bat_601_size(PowerPCCPU *cpu,
 131                                target_ulong batu, target_ulong batl)
 132{
 133    if (!(batl & BATL32_601_V)) {
 134        return 0;
 135    }
 136
 137    return BATU32_BEPI & ~((batl & BATL32_601_BL) << 17);
 138}
 139
 140static int hash32_bat_601_prot(PowerPCCPU *cpu,
 141                               target_ulong batu, target_ulong batl)
 142{
 143    CPUPPCState *env = &cpu->env;
 144    int key, pp;
 145
 146    pp = batu & BATU32_601_PP;
 147    if (msr_pr == 0) {
 148        key = !!(batu & BATU32_601_KS);
 149    } else {
 150        key = !!(batu & BATU32_601_KP);
 151    }
 152    return ppc_hash32_pp_prot(key, pp, 0);
 153}
 154
 155static hwaddr ppc_hash32_bat_lookup(PowerPCCPU *cpu, target_ulong ea, int rwx,
 156                                    int *prot)
 157{
 158    CPUPPCState *env = &cpu->env;
 159    target_ulong *BATlt, *BATut;
 160    int i;
 161
 162    LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
 163             rwx == 2 ? 'I' : 'D', ea);
 164    if (rwx == 2) {
 165        BATlt = env->IBAT[1];
 166        BATut = env->IBAT[0];
 167    } else {
 168        BATlt = env->DBAT[1];
 169        BATut = env->DBAT[0];
 170    }
 171    for (i = 0; i < env->nb_BATs; i++) {
 172        target_ulong batu = BATut[i];
 173        target_ulong batl = BATlt[i];
 174        target_ulong mask;
 175
 176        if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 177            mask = hash32_bat_601_size(cpu, batu, batl);
 178        } else {
 179            mask = hash32_bat_size(cpu, batu, batl);
 180        }
 181        LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 182                 " BATl " TARGET_FMT_lx "\n", __func__,
 183                 type == ACCESS_CODE ? 'I' : 'D', i, ea, batu, batl);
 184
 185        if (mask && ((ea & mask) == (batu & BATU32_BEPI))) {
 186            hwaddr raddr = (batl & mask) | (ea & ~mask);
 187
 188            if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 189                *prot = hash32_bat_601_prot(cpu, batu, batl);
 190            } else {
 191                *prot = hash32_bat_prot(cpu, batu, batl);
 192            }
 193
 194            return raddr & TARGET_PAGE_MASK;
 195        }
 196    }
 197
 198    /* No hit */
 199#if defined(DEBUG_BATS)
 200    if (qemu_log_enabled()) {
 201        LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", ea);
 202        for (i = 0; i < 4; i++) {
 203            BATu = &BATut[i];
 204            BATl = &BATlt[i];
 205            BEPIu = *BATu & BATU32_BEPIU;
 206            BEPIl = *BATu & BATU32_BEPIL;
 207            bl = (*BATu & 0x00001FFC) << 15;
 208            LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 209                     " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
 210                     TARGET_FMT_lx " " TARGET_FMT_lx "\n",
 211                     __func__, type == ACCESS_CODE ? 'I' : 'D', i, ea,
 212                     *BATu, *BATl, BEPIu, BEPIl, bl);
 213        }
 214    }
 215#endif
 216
 217    return -1;
 218}
 219
 220static int ppc_hash32_direct_store(PowerPCCPU *cpu, target_ulong sr,
 221                                   target_ulong eaddr, int rwx,
 222                                   hwaddr *raddr, int *prot)
 223{
 224    CPUState *cs = CPU(cpu);
 225    CPUPPCState *env = &cpu->env;
 226    int key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
 227
 228    qemu_log_mask(CPU_LOG_MMU, "direct store...\n");
 229
 230    if ((sr & 0x1FF00000) >> 20 == 0x07f) {
 231        /*
 232         * Memory-forced I/O controller interface access
 233         *
 234         * If T=1 and BUID=x'07F', the 601 performs a memory access
 235         * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
 236         */
 237        *raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
 238        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 239        return 0;
 240    }
 241
 242    if (rwx == 2) {
 243        /* No code fetch is allowed in direct-store areas */
 244        cs->exception_index = POWERPC_EXCP_ISI;
 245        env->error_code = 0x10000000;
 246        return 1;
 247    }
 248
 249    switch (env->access_type) {
 250    case ACCESS_INT:
 251        /* Integer load/store : only access allowed */
 252        break;
 253    case ACCESS_FLOAT:
 254        /* Floating point load/store */
 255        cs->exception_index = POWERPC_EXCP_ALIGN;
 256        env->error_code = POWERPC_EXCP_ALIGN_FP;
 257        env->spr[SPR_DAR] = eaddr;
 258        return 1;
 259    case ACCESS_RES:
 260        /* lwarx, ldarx or srwcx. */
 261        env->error_code = 0;
 262        env->spr[SPR_DAR] = eaddr;
 263        if (rwx == 1) {
 264            env->spr[SPR_DSISR] = 0x06000000;
 265        } else {
 266            env->spr[SPR_DSISR] = 0x04000000;
 267        }
 268        return 1;
 269    case ACCESS_CACHE:
 270        /*
 271         * dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi
 272         *
 273         * Should make the instruction do no-op.  As it already do
 274         * no-op, it's quite easy :-)
 275         */
 276        *raddr = eaddr;
 277        return 0;
 278    case ACCESS_EXT:
 279        /* eciwx or ecowx */
 280        cs->exception_index = POWERPC_EXCP_DSI;
 281        env->error_code = 0;
 282        env->spr[SPR_DAR] = eaddr;
 283        if (rwx == 1) {
 284            env->spr[SPR_DSISR] = 0x06100000;
 285        } else {
 286            env->spr[SPR_DSISR] = 0x04100000;
 287        }
 288        return 1;
 289    default:
 290        cpu_abort(cs, "ERROR: instruction should not need "
 291                 "address translation\n");
 292    }
 293    if ((rwx == 1 || key != 1) && (rwx == 0 || key != 0)) {
 294        *raddr = eaddr;
 295        return 0;
 296    } else {
 297        cs->exception_index = POWERPC_EXCP_DSI;
 298        env->error_code = 0;
 299        env->spr[SPR_DAR] = eaddr;
 300        if (rwx == 1) {
 301            env->spr[SPR_DSISR] = 0x0a000000;
 302        } else {
 303            env->spr[SPR_DSISR] = 0x08000000;
 304        }
 305        return 1;
 306    }
 307}
 308
 309hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash)
 310{
 311    target_ulong mask = ppc_hash32_hpt_mask(cpu);
 312
 313    return (hash * HASH_PTEG_SIZE_32) & mask;
 314}
 315
 316static hwaddr ppc_hash32_pteg_search(PowerPCCPU *cpu, hwaddr pteg_off,
 317                                     bool secondary, target_ulong ptem,
 318                                     ppc_hash_pte32_t *pte)
 319{
 320    hwaddr pte_offset = pteg_off;
 321    target_ulong pte0, pte1;
 322    int i;
 323
 324    for (i = 0; i < HPTES_PER_GROUP; i++) {
 325        pte0 = ppc_hash32_load_hpte0(cpu, pte_offset);
 326        /*
 327         * pte0 contains the valid bit and must be read before pte1,
 328         * otherwise we might see an old pte1 with a new valid bit and
 329         * thus an inconsistent hpte value
 330         */
 331        smp_rmb();
 332        pte1 = ppc_hash32_load_hpte1(cpu, pte_offset);
 333
 334        if ((pte0 & HPTE32_V_VALID)
 335            && (secondary == !!(pte0 & HPTE32_V_SECONDARY))
 336            && HPTE32_V_COMPARE(pte0, ptem)) {
 337            pte->pte0 = pte0;
 338            pte->pte1 = pte1;
 339            return pte_offset;
 340        }
 341
 342        pte_offset += HASH_PTE_SIZE_32;
 343    }
 344
 345    return -1;
 346}
 347
 348static void ppc_hash32_set_r(PowerPCCPU *cpu, hwaddr pte_offset, uint32_t pte1)
 349{
 350    target_ulong base = ppc_hash32_hpt_base(cpu);
 351    hwaddr offset = pte_offset + 6;
 352
 353    /* The HW performs a non-atomic byte update */
 354    stb_phys(CPU(cpu)->as, base + offset, ((pte1 >> 8) & 0xff) | 0x01);
 355}
 356
 357static void ppc_hash32_set_c(PowerPCCPU *cpu, hwaddr pte_offset, uint64_t pte1)
 358{
 359    target_ulong base = ppc_hash32_hpt_base(cpu);
 360    hwaddr offset = pte_offset + 7;
 361
 362    /* The HW performs a non-atomic byte update */
 363    stb_phys(CPU(cpu)->as, base + offset, (pte1 & 0xff) | 0x80);
 364}
 365
 366static hwaddr ppc_hash32_htab_lookup(PowerPCCPU *cpu,
 367                                     target_ulong sr, target_ulong eaddr,
 368                                     ppc_hash_pte32_t *pte)
 369{
 370    hwaddr pteg_off, pte_offset;
 371    hwaddr hash;
 372    uint32_t vsid, pgidx, ptem;
 373
 374    vsid = sr & SR32_VSID;
 375    pgidx = (eaddr & ~SEGMENT_MASK_256M) >> TARGET_PAGE_BITS;
 376    hash = vsid ^ pgidx;
 377    ptem = (vsid << 7) | (pgidx >> 10);
 378
 379    /* Page address translation */
 380    qemu_log_mask(CPU_LOG_MMU, "htab_base " TARGET_FMT_plx
 381            " htab_mask " TARGET_FMT_plx
 382            " hash " TARGET_FMT_plx "\n",
 383            ppc_hash32_hpt_base(cpu), ppc_hash32_hpt_mask(cpu), hash);
 384
 385    /* Primary PTEG lookup */
 386    qemu_log_mask(CPU_LOG_MMU, "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 387            " vsid=%" PRIx32 " ptem=%" PRIx32
 388            " hash=" TARGET_FMT_plx "\n",
 389            ppc_hash32_hpt_base(cpu), ppc_hash32_hpt_mask(cpu),
 390            vsid, ptem, hash);
 391    pteg_off = get_pteg_offset32(cpu, hash);
 392    pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 0, ptem, pte);
 393    if (pte_offset == -1) {
 394        /* Secondary PTEG lookup */
 395        qemu_log_mask(CPU_LOG_MMU, "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 396                " vsid=%" PRIx32 " api=%" PRIx32
 397                " hash=" TARGET_FMT_plx "\n", ppc_hash32_hpt_base(cpu),
 398                ppc_hash32_hpt_mask(cpu), vsid, ptem, ~hash);
 399        pteg_off = get_pteg_offset32(cpu, ~hash);
 400        pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 1, ptem, pte);
 401    }
 402
 403    return pte_offset;
 404}
 405
 406static hwaddr ppc_hash32_pte_raddr(target_ulong sr, ppc_hash_pte32_t pte,
 407                                   target_ulong eaddr)
 408{
 409    hwaddr rpn = pte.pte1 & HPTE32_R_RPN;
 410    hwaddr mask = ~TARGET_PAGE_MASK;
 411
 412    return (rpn & ~mask) | (eaddr & mask);
 413}
 414
 415int ppc_hash32_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, int rwx,
 416                                int mmu_idx)
 417{
 418    CPUState *cs = CPU(cpu);
 419    CPUPPCState *env = &cpu->env;
 420    target_ulong sr;
 421    hwaddr pte_offset;
 422    ppc_hash_pte32_t pte;
 423    int prot;
 424    const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
 425    hwaddr raddr;
 426
 427    assert((rwx == 0) || (rwx == 1) || (rwx == 2));
 428
 429    /* 1. Handle real mode accesses */
 430    if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
 431        /* Translation is off */
 432        raddr = eaddr;
 433        tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 434                     PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
 435                     TARGET_PAGE_SIZE);
 436        return 0;
 437    }
 438
 439    /* 2. Check Block Address Translation entries (BATs) */
 440    if (env->nb_BATs != 0) {
 441        raddr = ppc_hash32_bat_lookup(cpu, eaddr, rwx, &prot);
 442        if (raddr != -1) {
 443            if (need_prot[rwx] & ~prot) {
 444                if (rwx == 2) {
 445                    cs->exception_index = POWERPC_EXCP_ISI;
 446                    env->error_code = 0x08000000;
 447                } else {
 448                    cs->exception_index = POWERPC_EXCP_DSI;
 449                    env->error_code = 0;
 450                    env->spr[SPR_DAR] = eaddr;
 451                    if (rwx == 1) {
 452                        env->spr[SPR_DSISR] = 0x0a000000;
 453                    } else {
 454                        env->spr[SPR_DSISR] = 0x08000000;
 455                    }
 456                }
 457                return 1;
 458            }
 459
 460            tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
 461                         raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 462                         TARGET_PAGE_SIZE);
 463            return 0;
 464        }
 465    }
 466
 467    /* 3. Look up the Segment Register */
 468    sr = env->sr[eaddr >> 28];
 469
 470    /* 4. Handle direct store segments */
 471    if (sr & SR32_T) {
 472        if (ppc_hash32_direct_store(cpu, sr, eaddr, rwx,
 473                                    &raddr, &prot) == 0) {
 474            tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
 475                         raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 476                         TARGET_PAGE_SIZE);
 477            return 0;
 478        } else {
 479            return 1;
 480        }
 481    }
 482
 483    /* 5. Check for segment level no-execute violation */
 484    if ((rwx == 2) && (sr & SR32_NX)) {
 485        cs->exception_index = POWERPC_EXCP_ISI;
 486        env->error_code = 0x10000000;
 487        return 1;
 488    }
 489
 490    /* 6. Locate the PTE in the hash table */
 491    pte_offset = ppc_hash32_htab_lookup(cpu, sr, eaddr, &pte);
 492    if (pte_offset == -1) {
 493        if (rwx == 2) {
 494            cs->exception_index = POWERPC_EXCP_ISI;
 495            env->error_code = 0x40000000;
 496        } else {
 497            cs->exception_index = POWERPC_EXCP_DSI;
 498            env->error_code = 0;
 499            env->spr[SPR_DAR] = eaddr;
 500            if (rwx == 1) {
 501                env->spr[SPR_DSISR] = 0x42000000;
 502            } else {
 503                env->spr[SPR_DSISR] = 0x40000000;
 504            }
 505        }
 506
 507        return 1;
 508    }
 509    qemu_log_mask(CPU_LOG_MMU,
 510                "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
 511
 512    /* 7. Check access permissions */
 513
 514    prot = ppc_hash32_pte_prot(cpu, sr, pte);
 515
 516    if (need_prot[rwx] & ~prot) {
 517        /* Access right violation */
 518        qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
 519        if (rwx == 2) {
 520            cs->exception_index = POWERPC_EXCP_ISI;
 521            env->error_code = 0x08000000;
 522        } else {
 523            cs->exception_index = POWERPC_EXCP_DSI;
 524            env->error_code = 0;
 525            env->spr[SPR_DAR] = eaddr;
 526            if (rwx == 1) {
 527                env->spr[SPR_DSISR] = 0x0a000000;
 528            } else {
 529                env->spr[SPR_DSISR] = 0x08000000;
 530            }
 531        }
 532        return 1;
 533    }
 534
 535    qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
 536
 537    /* 8. Update PTE referenced and changed bits if necessary */
 538
 539    if (!(pte.pte1 & HPTE32_R_R)) {
 540        ppc_hash32_set_r(cpu, pte_offset, pte.pte1);
 541    }
 542    if (!(pte.pte1 & HPTE32_R_C)) {
 543        if (rwx == 1) {
 544            ppc_hash32_set_c(cpu, pte_offset, pte.pte1);
 545        } else {
 546            /*
 547             * Treat the page as read-only for now, so that a later write
 548             * will pass through this function again to set the C bit
 549             */
 550            prot &= ~PAGE_WRITE;
 551        }
 552     }
 553
 554    /* 9. Determine the real address from the PTE */
 555
 556    raddr = ppc_hash32_pte_raddr(sr, pte, eaddr);
 557
 558    tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 559                 prot, mmu_idx, TARGET_PAGE_SIZE);
 560
 561    return 0;
 562}
 563
 564hwaddr ppc_hash32_get_phys_page_debug(PowerPCCPU *cpu, target_ulong eaddr)
 565{
 566    CPUPPCState *env = &cpu->env;
 567    target_ulong sr;
 568    hwaddr pte_offset;
 569    ppc_hash_pte32_t pte;
 570    int prot;
 571
 572    if (msr_dr == 0) {
 573        /* Translation is off */
 574        return eaddr;
 575    }
 576
 577    if (env->nb_BATs != 0) {
 578        hwaddr raddr = ppc_hash32_bat_lookup(cpu, eaddr, 0, &prot);
 579        if (raddr != -1) {
 580            return raddr;
 581        }
 582    }
 583
 584    sr = env->sr[eaddr >> 28];
 585
 586    if (sr & SR32_T) {
 587        /* FIXME: Add suitable debug support for Direct Store segments */
 588        return -1;
 589    }
 590
 591    pte_offset = ppc_hash32_htab_lookup(cpu, sr, eaddr, &pte);
 592    if (pte_offset == -1) {
 593        return -1;
 594    }
 595
 596    return ppc_hash32_pte_raddr(sr, pte, eaddr) & TARGET_PAGE_MASK;
 597}
 598