LXR qemu/target-ppc/mmu-hash32.c

   1/*
   2 *  PowerPC MMU, TLB and BAT emulation helpers for QEMU.
   3 *
   4 *  Copyright (c) 2003-2007 Jocelyn Mayer
   5 *  Copyright (c) 2013 David Gibson, IBM Corporation
   6 *
   7 * This library is free software; you can redistribute it and/or
   8 * modify it under the terms of the GNU Lesser General Public
   9 * License as published by the Free Software Foundation; either
  10 * version 2 of the License, or (at your option) any later version.
  11 *
  12 * This library is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15 * Lesser General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU Lesser General Public
  18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21#include "qemu/osdep.h"
  22#include "cpu.h"
  23#include "exec/helper-proto.h"
  24#include "sysemu/kvm.h"
  25#include "kvm_ppc.h"
  26#include "mmu-hash32.h"
  27#include "exec/log.h"
  28
  29//#define DEBUG_BAT
  30
  31#ifdef DEBUG_BATS
  32#  define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
  33#else
  34#  define LOG_BATS(...) do { } while (0)
  35#endif
  36
  37struct mmu_ctx_hash32 {
  38    hwaddr raddr;      /* Real address              */
  39    int prot;                      /* Protection bits           */
  40    int key;                       /* Access key                */
  41};
  42
  43static int ppc_hash32_pp_prot(int key, int pp, int nx)
  44{
  45    int prot;
  46
  47    if (key == 0) {
  48        switch (pp) {
  49        case 0x0:
  50        case 0x1:
  51        case 0x2:
  52            prot = PAGE_READ | PAGE_WRITE;
  53            break;
  54
  55        case 0x3:
  56            prot = PAGE_READ;
  57            break;
  58
  59        default:
  60            abort();
  61        }
  62    } else {
  63        switch (pp) {
  64        case 0x0:
  65            prot = 0;
  66            break;
  67
  68        case 0x1:
  69        case 0x3:
  70            prot = PAGE_READ;
  71            break;
  72
  73        case 0x2:
  74            prot = PAGE_READ | PAGE_WRITE;
  75            break;
  76
  77        default:
  78            abort();
  79        }
  80    }
  81    if (nx == 0) {
  82        prot |= PAGE_EXEC;
  83    }
  84
  85    return prot;
  86}
  87
  88static int ppc_hash32_pte_prot(PowerPCCPU *cpu,
  89                               target_ulong sr, ppc_hash_pte32_t pte)
  90{
  91    CPUPPCState *env = &cpu->env;
  92    unsigned pp, key;
  93
  94    key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
  95    pp = pte.pte1 & HPTE32_R_PP;
  96
  97    return ppc_hash32_pp_prot(key, pp, !!(sr & SR32_NX));
  98}
  99
 100static target_ulong hash32_bat_size(PowerPCCPU *cpu,
 101                                    target_ulong batu, target_ulong batl)
 102{
 103    CPUPPCState *env = &cpu->env;
 104
 105    if ((msr_pr && !(batu & BATU32_VP))
 106        || (!msr_pr && !(batu & BATU32_VS))) {
 107        return 0;
 108    }
 109
 110    return BATU32_BEPI & ~((batu & BATU32_BL) << 15);
 111}
 112
 113static int hash32_bat_prot(PowerPCCPU *cpu,
 114                           target_ulong batu, target_ulong batl)
 115{
 116    int pp, prot;
 117
 118    prot = 0;
 119    pp = batl & BATL32_PP;
 120    if (pp != 0) {
 121        prot = PAGE_READ | PAGE_EXEC;
 122        if (pp == 0x2) {
 123            prot |= PAGE_WRITE;
 124        }
 125    }
 126    return prot;
 127}
 128
 129static target_ulong hash32_bat_601_size(PowerPCCPU *cpu,
 130                                target_ulong batu, target_ulong batl)
 131{
 132    if (!(batl & BATL32_601_V)) {
 133        return 0;
 134    }
 135
 136    return BATU32_BEPI & ~((batl & BATL32_601_BL) << 17);
 137}
 138
 139static int hash32_bat_601_prot(PowerPCCPU *cpu,
 140                               target_ulong batu, target_ulong batl)
 141{
 142    CPUPPCState *env = &cpu->env;
 143    int key, pp;
 144
 145    pp = batu & BATU32_601_PP;
 146    if (msr_pr == 0) {
 147        key = !!(batu & BATU32_601_KS);
 148    } else {
 149        key = !!(batu & BATU32_601_KP);
 150    }
 151    return ppc_hash32_pp_prot(key, pp, 0);
 152}
 153
 154static hwaddr ppc_hash32_bat_lookup(PowerPCCPU *cpu, target_ulong ea, int rwx,
 155                                    int *prot)
 156{
 157    CPUPPCState *env = &cpu->env;
 158    target_ulong *BATlt, *BATut;
 159    int i;
 160
 161    LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
 162             rwx == 2 ? 'I' : 'D', ea);
 163    if (rwx == 2) {
 164        BATlt = env->IBAT[1];
 165        BATut = env->IBAT[0];
 166    } else {
 167        BATlt = env->DBAT[1];
 168        BATut = env->DBAT[0];
 169    }
 170    for (i = 0; i < env->nb_BATs; i++) {
 171        target_ulong batu = BATut[i];
 172        target_ulong batl = BATlt[i];
 173        target_ulong mask;
 174
 175        if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 176            mask = hash32_bat_601_size(cpu, batu, batl);
 177        } else {
 178            mask = hash32_bat_size(cpu, batu, batl);
 179        }
 180        LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 181                 " BATl " TARGET_FMT_lx "\n", __func__,
 182                 type == ACCESS_CODE ? 'I' : 'D', i, ea, batu, batl);
 183
 184        if (mask && ((ea & mask) == (batu & BATU32_BEPI))) {
 185            hwaddr raddr = (batl & mask) | (ea & ~mask);
 186
 187            if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
 188                *prot = hash32_bat_601_prot(cpu, batu, batl);
 189            } else {
 190                *prot = hash32_bat_prot(cpu, batu, batl);
 191            }
 192
 193            return raddr & TARGET_PAGE_MASK;
 194        }
 195    }
 196
 197    /* No hit */
 198#if defined(DEBUG_BATS)
 199    if (qemu_log_enabled()) {
 200        LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", ea);
 201        for (i = 0; i < 4; i++) {
 202            BATu = &BATut[i];
 203            BATl = &BATlt[i];
 204            BEPIu = *BATu & BATU32_BEPIU;
 205            BEPIl = *BATu & BATU32_BEPIL;
 206            bl = (*BATu & 0x00001FFC) << 15;
 207            LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
 208                     " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
 209                     TARGET_FMT_lx " " TARGET_FMT_lx "\n",
 210                     __func__, type == ACCESS_CODE ? 'I' : 'D', i, ea,
 211                     *BATu, *BATl, BEPIu, BEPIl, bl);
 212        }
 213    }
 214#endif
 215
 216    return -1;
 217}
 218
 219static int ppc_hash32_direct_store(PowerPCCPU *cpu, target_ulong sr,
 220                                   target_ulong eaddr, int rwx,
 221                                   hwaddr *raddr, int *prot)
 222{
 223    CPUState *cs = CPU(cpu);
 224    CPUPPCState *env = &cpu->env;
 225    int key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
 226
 227    qemu_log_mask(CPU_LOG_MMU, "direct store...\n");
 228
 229    if ((sr & 0x1FF00000) >> 20 == 0x07f) {
 230        /* Memory-forced I/O controller interface access */
 231        /* If T=1 and BUID=x'07F', the 601 performs a memory access
 232         * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
 233         */
 234        *raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
 235        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 236        return 0;
 237    }
 238
 239    if (rwx == 2) {
 240        /* No code fetch is allowed in direct-store areas */
 241        cs->exception_index = POWERPC_EXCP_ISI;
 242        env->error_code = 0x10000000;
 243        return 1;
 244    }
 245
 246    switch (env->access_type) {
 247    case ACCESS_INT:
 248        /* Integer load/store : only access allowed */
 249        break;
 250    case ACCESS_FLOAT:
 251        /* Floating point load/store */
 252        cs->exception_index = POWERPC_EXCP_ALIGN;
 253        env->error_code = POWERPC_EXCP_ALIGN_FP;
 254        env->spr[SPR_DAR] = eaddr;
 255        return 1;
 256    case ACCESS_RES:
 257        /* lwarx, ldarx or srwcx. */
 258        env->error_code = 0;
 259        env->spr[SPR_DAR] = eaddr;
 260        if (rwx == 1) {
 261            env->spr[SPR_DSISR] = 0x06000000;
 262        } else {
 263            env->spr[SPR_DSISR] = 0x04000000;
 264        }
 265        return 1;
 266    case ACCESS_CACHE:
 267        /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
 268        /* Should make the instruction do no-op.
 269         * As it already do no-op, it's quite easy :-)
 270         */
 271        *raddr = eaddr;
 272        return 0;
 273    case ACCESS_EXT:
 274        /* eciwx or ecowx */
 275        cs->exception_index = POWERPC_EXCP_DSI;
 276        env->error_code = 0;
 277        env->spr[SPR_DAR] = eaddr;
 278        if (rwx == 1) {
 279            env->spr[SPR_DSISR] = 0x06100000;
 280        } else {
 281            env->spr[SPR_DSISR] = 0x04100000;
 282        }
 283        return 1;
 284    default:
 285        cpu_abort(cs, "ERROR: instruction should not need "
 286                 "address translation\n");
 287    }
 288    if ((rwx == 1 || key != 1) && (rwx == 0 || key != 0)) {
 289        *raddr = eaddr;
 290        return 0;
 291    } else {
 292        cs->exception_index = POWERPC_EXCP_DSI;
 293        env->error_code = 0;
 294        env->spr[SPR_DAR] = eaddr;
 295        if (rwx == 1) {
 296            env->spr[SPR_DSISR] = 0x0a000000;
 297        } else {
 298            env->spr[SPR_DSISR] = 0x08000000;
 299        }
 300        return 1;
 301    }
 302}
 303
 304hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash)
 305{
 306    CPUPPCState *env = &cpu->env;
 307
 308    return (hash * HASH_PTEG_SIZE_32) & env->htab_mask;
 309}
 310
 311static hwaddr ppc_hash32_pteg_search(PowerPCCPU *cpu, hwaddr pteg_off,
 312                                     bool secondary, target_ulong ptem,
 313                                     ppc_hash_pte32_t *pte)
 314{
 315    hwaddr pte_offset = pteg_off;
 316    target_ulong pte0, pte1;
 317    int i;
 318
 319    for (i = 0; i < HPTES_PER_GROUP; i++) {
 320        pte0 = ppc_hash32_load_hpte0(cpu, pte_offset);
 321        pte1 = ppc_hash32_load_hpte1(cpu, pte_offset);
 322
 323        if ((pte0 & HPTE32_V_VALID)
 324            && (secondary == !!(pte0 & HPTE32_V_SECONDARY))
 325            && HPTE32_V_COMPARE(pte0, ptem)) {
 326            pte->pte0 = pte0;
 327            pte->pte1 = pte1;
 328            return pte_offset;
 329        }
 330
 331        pte_offset += HASH_PTE_SIZE_32;
 332    }
 333
 334    return -1;
 335}
 336
 337static hwaddr ppc_hash32_htab_lookup(PowerPCCPU *cpu,
 338                                     target_ulong sr, target_ulong eaddr,
 339                                     ppc_hash_pte32_t *pte)
 340{
 341    CPUPPCState *env = &cpu->env;
 342    hwaddr pteg_off, pte_offset;
 343    hwaddr hash;
 344    uint32_t vsid, pgidx, ptem;
 345
 346    vsid = sr & SR32_VSID;
 347    pgidx = (eaddr & ~SEGMENT_MASK_256M) >> TARGET_PAGE_BITS;
 348    hash = vsid ^ pgidx;
 349    ptem = (vsid << 7) | (pgidx >> 10);
 350
 351    /* Page address translation */
 352    qemu_log_mask(CPU_LOG_MMU, "htab_base " TARGET_FMT_plx
 353            " htab_mask " TARGET_FMT_plx
 354            " hash " TARGET_FMT_plx "\n",
 355            env->htab_base, env->htab_mask, hash);
 356
 357    /* Primary PTEG lookup */
 358    qemu_log_mask(CPU_LOG_MMU, "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 359            " vsid=%" PRIx32 " ptem=%" PRIx32
 360            " hash=" TARGET_FMT_plx "\n",
 361            env->htab_base, env->htab_mask, vsid, ptem, hash);
 362    pteg_off = get_pteg_offset32(cpu, hash);
 363    pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 0, ptem, pte);
 364    if (pte_offset == -1) {
 365        /* Secondary PTEG lookup */
 366        qemu_log_mask(CPU_LOG_MMU, "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 367                " vsid=%" PRIx32 " api=%" PRIx32
 368                " hash=" TARGET_FMT_plx "\n", env->htab_base,
 369                env->htab_mask, vsid, ptem, ~hash);
 370        pteg_off = get_pteg_offset32(cpu, ~hash);
 371        pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 1, ptem, pte);
 372    }
 373
 374    return pte_offset;
 375}
 376
 377static hwaddr ppc_hash32_pte_raddr(target_ulong sr, ppc_hash_pte32_t pte,
 378                                   target_ulong eaddr)
 379{
 380    hwaddr rpn = pte.pte1 & HPTE32_R_RPN;
 381    hwaddr mask = ~TARGET_PAGE_MASK;
 382
 383    return (rpn & ~mask) | (eaddr & mask);
 384}
 385
 386int ppc_hash32_handle_mmu_fault(PowerPCCPU *cpu, target_ulong eaddr, int rwx,
 387                                int mmu_idx)
 388{
 389    CPUState *cs = CPU(cpu);
 390    CPUPPCState *env = &cpu->env;
 391    target_ulong sr;
 392    hwaddr pte_offset;
 393    ppc_hash_pte32_t pte;
 394    int prot;
 395    uint32_t new_pte1;
 396    const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
 397    hwaddr raddr;
 398
 399    assert((rwx == 0) || (rwx == 1) || (rwx == 2));
 400
 401    /* 1. Handle real mode accesses */
 402    if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
 403        /* Translation is off */
 404        raddr = eaddr;
 405        tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 406                     PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
 407                     TARGET_PAGE_SIZE);
 408        return 0;
 409    }
 410
 411    /* 2. Check Block Address Translation entries (BATs) */
 412    if (env->nb_BATs != 0) {
 413        raddr = ppc_hash32_bat_lookup(cpu, eaddr, rwx, &prot);
 414        if (raddr != -1) {
 415            if (need_prot[rwx] & ~prot) {
 416                if (rwx == 2) {
 417                    cs->exception_index = POWERPC_EXCP_ISI;
 418                    env->error_code = 0x08000000;
 419                } else {
 420                    cs->exception_index = POWERPC_EXCP_DSI;
 421                    env->error_code = 0;
 422                    env->spr[SPR_DAR] = eaddr;
 423                    if (rwx == 1) {
 424                        env->spr[SPR_DSISR] = 0x0a000000;
 425                    } else {
 426                        env->spr[SPR_DSISR] = 0x08000000;
 427                    }
 428                }
 429                return 1;
 430            }
 431
 432            tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
 433                         raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 434                         TARGET_PAGE_SIZE);
 435            return 0;
 436        }
 437    }
 438
 439    /* 3. Look up the Segment Register */
 440    sr = env->sr[eaddr >> 28];
 441
 442    /* 4. Handle direct store segments */
 443    if (sr & SR32_T) {
 444        if (ppc_hash32_direct_store(cpu, sr, eaddr, rwx,
 445                                    &raddr, &prot) == 0) {
 446            tlb_set_page(cs, eaddr & TARGET_PAGE_MASK,
 447                         raddr & TARGET_PAGE_MASK, prot, mmu_idx,
 448                         TARGET_PAGE_SIZE);
 449            return 0;
 450        } else {
 451            return 1;
 452        }
 453    }
 454
 455    /* 5. Check for segment level no-execute violation */
 456    if ((rwx == 2) && (sr & SR32_NX)) {
 457        cs->exception_index = POWERPC_EXCP_ISI;
 458        env->error_code = 0x10000000;
 459        return 1;
 460    }
 461
 462    /* 6. Locate the PTE in the hash table */
 463    pte_offset = ppc_hash32_htab_lookup(cpu, sr, eaddr, &pte);
 464    if (pte_offset == -1) {
 465        if (rwx == 2) {
 466            cs->exception_index = POWERPC_EXCP_ISI;
 467            env->error_code = 0x40000000;
 468        } else {
 469            cs->exception_index = POWERPC_EXCP_DSI;
 470            env->error_code = 0;
 471            env->spr[SPR_DAR] = eaddr;
 472            if (rwx == 1) {
 473                env->spr[SPR_DSISR] = 0x42000000;
 474            } else {
 475                env->spr[SPR_DSISR] = 0x40000000;
 476            }
 477        }
 478
 479        return 1;
 480    }
 481    qemu_log_mask(CPU_LOG_MMU,
 482                "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
 483
 484    /* 7. Check access permissions */
 485
 486    prot = ppc_hash32_pte_prot(cpu, sr, pte);
 487
 488    if (need_prot[rwx] & ~prot) {
 489        /* Access right violation */
 490        qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
 491        if (rwx == 2) {
 492            cs->exception_index = POWERPC_EXCP_ISI;
 493            env->error_code = 0x08000000;
 494        } else {
 495            cs->exception_index = POWERPC_EXCP_DSI;
 496            env->error_code = 0;
 497            env->spr[SPR_DAR] = eaddr;
 498            if (rwx == 1) {
 499                env->spr[SPR_DSISR] = 0x0a000000;
 500            } else {
 501                env->spr[SPR_DSISR] = 0x08000000;
 502            }
 503        }
 504        return 1;
 505    }
 506
 507    qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
 508
 509    /* 8. Update PTE referenced and changed bits if necessary */
 510
 511    new_pte1 = pte.pte1 | HPTE32_R_R; /* set referenced bit */
 512    if (rwx == 1) {
 513        new_pte1 |= HPTE32_R_C; /* set changed (dirty) bit */
 514    } else {
 515        /* Treat the page as read-only for now, so that a later write
 516         * will pass through this function again to set the C bit */
 517        prot &= ~PAGE_WRITE;
 518    }
 519
 520    if (new_pte1 != pte.pte1) {
 521        ppc_hash32_store_hpte1(cpu, pte_offset, new_pte1);
 522    }
 523
 524    /* 9. Determine the real address from the PTE */
 525
 526    raddr = ppc_hash32_pte_raddr(sr, pte, eaddr);
 527
 528    tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 529                 prot, mmu_idx, TARGET_PAGE_SIZE);
 530
 531    return 0;
 532}
 533
 534hwaddr ppc_hash32_get_phys_page_debug(PowerPCCPU *cpu, target_ulong eaddr)
 535{
 536    CPUPPCState *env = &cpu->env;
 537    target_ulong sr;
 538    hwaddr pte_offset;
 539    ppc_hash_pte32_t pte;
 540    int prot;
 541
 542    if (msr_dr == 0) {
 543        /* Translation is off */
 544        return eaddr;
 545    }
 546
 547    if (env->nb_BATs != 0) {
 548        hwaddr raddr = ppc_hash32_bat_lookup(cpu, eaddr, 0, &prot);
 549        if (raddr != -1) {
 550            return raddr;
 551        }
 552    }
 553
 554    sr = env->sr[eaddr >> 28];
 555
 556    if (sr & SR32_T) {
 557        /* FIXME: Add suitable debug support for Direct Store segments */
 558        return -1;
 559    }
 560
 561    pte_offset = ppc_hash32_htab_lookup(cpu, sr, eaddr, &pte);
 562    if (pte_offset == -1) {
 563        return -1;
 564    }
 565
 566    return ppc_hash32_pte_raddr(sr, pte, eaddr) & TARGET_PAGE_MASK;
 567}
 568