mmu-hash32.c 16 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
/*
 *  PowerPC MMU, TLB and BAT emulation helpers for QEMU.
 *
 *  Copyright (c) 2003-2007 Jocelyn Mayer
 *  Copyright (c) 2013 David Gibson, IBM Corporation
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */

#include "cpu.h"
#include "helper.h"
#include "sysemu/kvm.h"
#include "kvm_ppc.h"
#include "mmu-hash32.h"

//#define DEBUG_MMU
28
//#define DEBUG_BAT
29 30 31

#ifdef DEBUG_MMU
#  define LOG_MMU(...) qemu_log(__VA_ARGS__)
32
#  define LOG_MMU_STATE(cpu) log_cpu_state((cpu), 0)
33 34
#else
#  define LOG_MMU(...) do { } while (0)
35
#  define LOG_MMU_STATE(cpu) do { } while (0)
36 37
#endif

38 39 40 41 42 43
#ifdef DEBUG_BATS
#  define LOG_BATS(...) qemu_log(__VA_ARGS__)
#else
#  define LOG_BATS(...) do { } while (0)
#endif

44 45 46 47 48 49
struct mmu_ctx_hash32 {
    hwaddr raddr;      /* Real address              */
    int prot;                      /* Protection bits           */
    int key;                       /* Access key                */
};

50
static int ppc_hash32_pp_prot(int key, int pp, int nx)
51
{
52
    int prot;
53 54 55 56 57 58

    if (key == 0) {
        switch (pp) {
        case 0x0:
        case 0x1:
        case 0x2:
59 60 61
            prot = PAGE_READ | PAGE_WRITE;
            break;

62
        case 0x3:
63
            prot = PAGE_READ;
64
            break;
65 66 67

        default:
            abort();
68 69 70 71
        }
    } else {
        switch (pp) {
        case 0x0:
72
            prot = 0;
73
            break;
74

75 76
        case 0x1:
        case 0x3:
77
            prot = PAGE_READ;
78
            break;
79

80
        case 0x2:
81
            prot = PAGE_READ | PAGE_WRITE;
82
            break;
83 84 85

        default:
            abort();
86 87 88
        }
    }
    if (nx == 0) {
89
        prot |= PAGE_EXEC;
90 91
    }

92
    return prot;
93 94
}

95 96
static int ppc_hash32_pte_prot(CPUPPCState *env,
                               target_ulong sr, ppc_hash_pte32_t pte)
97
{
98
    unsigned pp, key;
99

100 101
    key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));
    pp = pte.pte1 & HPTE32_R_PP;
102

103
    return ppc_hash32_pp_prot(key, pp, !!(sr & SR32_NX));
104 105
}

106 107
static target_ulong hash32_bat_size(CPUPPCState *env,
                                    target_ulong batu, target_ulong batl)
108
{
109 110 111
    if ((msr_pr && !(batu & BATU32_VP))
        || (!msr_pr && !(batu & BATU32_VS))) {
        return 0;
112
    }
113 114

    return BATU32_BEPI & ~((batu & BATU32_BL) << 15);
115 116
}

117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132
static int hash32_bat_prot(CPUPPCState *env,
                           target_ulong batu, target_ulong batl)
{
    int pp, prot;

    prot = 0;
    pp = batl & BATL32_PP;
    if (pp != 0) {
        prot = PAGE_READ | PAGE_EXEC;
        if (pp == 0x2) {
            prot |= PAGE_WRITE;
        }
    }
    return prot;
}

133
static target_ulong hash32_bat_601_size(CPUPPCState *env,
134
                                target_ulong batu, target_ulong batl)
135
{
136 137 138 139 140
    if (!(batl & BATL32_601_V)) {
        return 0;
    }

    return BATU32_BEPI & ~((batl & BATL32_601_BL) << 17);
141 142 143 144 145 146 147 148 149 150 151 152 153
}

static int hash32_bat_601_prot(CPUPPCState *env,
                               target_ulong batu, target_ulong batl)
{
    int key, pp;

    pp = batu & BATU32_601_PP;
    if (msr_pr == 0) {
        key = !!(batu & BATU32_601_KS);
    } else {
        key = !!(batu & BATU32_601_KP);
    }
154
    return ppc_hash32_pp_prot(key, pp, 0);
155 156
}

157 158
static hwaddr ppc_hash32_bat_lookup(CPUPPCState *env, target_ulong ea, int rwx,
                                    int *prot)
159
{
160
    target_ulong *BATlt, *BATut;
161
    int i;
162 163

    LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
164
             rwx == 2 ? 'I' : 'D', ea);
165
    if (rwx == 2) {
166 167
        BATlt = env->IBAT[1];
        BATut = env->IBAT[0];
168
    } else {
169 170 171 172
        BATlt = env->DBAT[1];
        BATut = env->DBAT[0];
    }
    for (i = 0; i < env->nb_BATs; i++) {
173 174
        target_ulong batu = BATut[i];
        target_ulong batl = BATlt[i];
175
        target_ulong mask;
176

177
        if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
178
            mask = hash32_bat_601_size(env, batu, batl);
179
        } else {
180
            mask = hash32_bat_size(env, batu, batl);
181 182 183
        }
        LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
                 " BATl " TARGET_FMT_lx "\n", __func__,
184 185 186 187 188 189 190 191 192
                 type == ACCESS_CODE ? 'I' : 'D', i, ea, batu, batl);

        if (mask && ((ea & mask) == (batu & BATU32_BEPI))) {
            hwaddr raddr = (batl & mask) | (ea & ~mask);

            if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
                *prot = hash32_bat_601_prot(env, batu, batl);
            } else {
                *prot = hash32_bat_prot(env, batu, batl);
193
            }
194 195

            return raddr & TARGET_PAGE_MASK;
196 197
        }
    }
198 199

    /* No hit */
200
#if defined(DEBUG_BATS)
201 202 203 204 205 206 207 208 209 210 211 212 213
    if (qemu_log_enabled()) {
        LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", ea);
        for (i = 0; i < 4; i++) {
            BATu = &BATut[i];
            BATl = &BATlt[i];
            BEPIu = *BATu & BATU32_BEPIU;
            BEPIl = *BATu & BATU32_BEPIL;
            bl = (*BATu & 0x00001FFC) << 15;
            LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
                     " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
                     TARGET_FMT_lx " " TARGET_FMT_lx "\n",
                     __func__, type == ACCESS_CODE ? 'I' : 'D', i, ea,
                     *BATu, *BATl, BEPIu, BEPIl, bl);
214 215
        }
    }
216 217 218
#endif

    return -1;
219 220
}

221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240
static int ppc_hash32_direct_store(CPUPPCState *env, target_ulong sr,
                                   target_ulong eaddr, int rwx,
                                   hwaddr *raddr, int *prot)
{
    int key = !!(msr_pr ? (sr & SR32_KP) : (sr & SR32_KS));

    LOG_MMU("direct store...\n");

    if ((sr & 0x1FF00000) >> 20 == 0x07f) {
        /* Memory-forced I/O controller interface access */
        /* If T=1 and BUID=x'07F', the 601 performs a memory access
         * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
         */
        *raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
        return 0;
    }

    if (rwx == 2) {
        /* No code fetch is allowed in direct-store areas */
241 242 243
        env->exception_index = POWERPC_EXCP_ISI;
        env->error_code = 0x10000000;
        return 1;
244 245 246 247 248 249 250 251
    }

    switch (env->access_type) {
    case ACCESS_INT:
        /* Integer load/store : only access allowed */
        break;
    case ACCESS_FLOAT:
        /* Floating point load/store */
252 253 254 255
        env->exception_index = POWERPC_EXCP_ALIGN;
        env->error_code = POWERPC_EXCP_ALIGN_FP;
        env->spr[SPR_DAR] = eaddr;
        return 1;
256 257
    case ACCESS_RES:
        /* lwarx, ldarx or srwcx. */
258 259 260 261 262 263 264 265
        env->error_code = 0;
        env->spr[SPR_DAR] = eaddr;
        if (rwx == 1) {
            env->spr[SPR_DSISR] = 0x06000000;
        } else {
            env->spr[SPR_DSISR] = 0x04000000;
        }
        return 1;
266 267 268 269 270 271 272 273 274
    case ACCESS_CACHE:
        /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
        /* Should make the instruction do no-op.
         * As it already do no-op, it's quite easy :-)
         */
        *raddr = eaddr;
        return 0;
    case ACCESS_EXT:
        /* eciwx or ecowx */
275 276 277 278 279 280 281 282 283
        env->exception_index = POWERPC_EXCP_DSI;
        env->error_code = 0;
        env->spr[SPR_DAR] = eaddr;
        if (rwx == 1) {
            env->spr[SPR_DSISR] = 0x06100000;
        } else {
            env->spr[SPR_DSISR] = 0x04100000;
        }
        return 1;
284 285 286
    default:
        qemu_log("ERROR: instruction should not need "
                 "address translation\n");
287
        abort();
288 289 290
    }
    if ((rwx == 1 || key != 1) && (rwx == 0 || key != 0)) {
        *raddr = eaddr;
291
        return 0;
292
    } else {
293 294 295 296 297 298 299 300 301
        env->exception_index = POWERPC_EXCP_DSI;
        env->error_code = 0;
        env->spr[SPR_DAR] = eaddr;
        if (rwx == 1) {
            env->spr[SPR_DSISR] = 0x0a000000;
        } else {
            env->spr[SPR_DSISR] = 0x08000000;
        }
        return 1;
302 303 304
    }
}

305 306
hwaddr get_pteg_offset32(CPUPPCState *env, hwaddr hash)
{
307
    return (hash * HASH_PTEG_SIZE_32) & env->htab_mask;
308 309
}

310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335
static hwaddr ppc_hash32_pteg_search(CPUPPCState *env, hwaddr pteg_off,
                                     bool secondary, target_ulong ptem,
                                     ppc_hash_pte32_t *pte)
{
    hwaddr pte_offset = pteg_off;
    target_ulong pte0, pte1;
    int i;

    for (i = 0; i < HPTES_PER_GROUP; i++) {
        pte0 = ppc_hash32_load_hpte0(env, pte_offset);
        pte1 = ppc_hash32_load_hpte1(env, pte_offset);

        if ((pte0 & HPTE32_V_VALID)
            && (secondary == !!(pte0 & HPTE32_V_SECONDARY))
            && HPTE32_V_COMPARE(pte0, ptem)) {
            pte->pte0 = pte0;
            pte->pte1 = pte1;
            return pte_offset;
        }

        pte_offset += HASH_PTE_SIZE_32;
    }

    return -1;
}

336 337 338
static hwaddr ppc_hash32_htab_lookup(CPUPPCState *env,
                                     target_ulong sr, target_ulong eaddr,
                                     ppc_hash_pte32_t *pte)
339
{
340
    hwaddr pteg_off, pte_offset;
341 342
    hwaddr hash;
    uint32_t vsid, pgidx, ptem;
343

344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359
    vsid = sr & SR32_VSID;
    pgidx = (eaddr & ~SEGMENT_MASK_256M) >> TARGET_PAGE_BITS;
    hash = vsid ^ pgidx;
    ptem = (vsid << 7) | (pgidx >> 10);

    /* Page address translation */
    LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
            " hash " TARGET_FMT_plx "\n",
            env->htab_base, env->htab_mask, hash);

    /* Primary PTEG lookup */
    LOG_MMU("0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
            " vsid=%" PRIx32 " ptem=%" PRIx32
            " hash=" TARGET_FMT_plx "\n",
            env->htab_base, env->htab_mask, vsid, ptem, hash);
    pteg_off = get_pteg_offset32(env, hash);
360
    pte_offset = ppc_hash32_pteg_search(env, pteg_off, 0, ptem, pte);
361 362 363 364 365 366 367
    if (pte_offset == -1) {
        /* Secondary PTEG lookup */
        LOG_MMU("1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
                " vsid=%" PRIx32 " api=%" PRIx32
                " hash=" TARGET_FMT_plx "\n", env->htab_base,
                env->htab_mask, vsid, ptem, ~hash);
        pteg_off = get_pteg_offset32(env, ~hash);
368
        pte_offset = ppc_hash32_pteg_search(env, pteg_off, 1, ptem, pte);
369 370
    }

371
    return pte_offset;
372
}
373

374 375 376
static hwaddr ppc_hash32_pte_raddr(target_ulong sr, ppc_hash_pte32_t pte,
                                   target_ulong eaddr)
{
377
    hwaddr rpn = pte.pte1 & HPTE32_R_RPN;
378 379 380 381 382
    hwaddr mask = ~TARGET_PAGE_MASK;

    return (rpn & ~mask) | (eaddr & mask);
}

383 384
int ppc_hash32_handle_mmu_fault(CPUPPCState *env, target_ulong eaddr, int rwx,
                                int mmu_idx)
385
{
386
    target_ulong sr;
387 388
    hwaddr pte_offset;
    ppc_hash_pte32_t pte;
389
    int prot;
390
    uint32_t new_pte1;
391
    const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
392
    hwaddr raddr;
393

394 395
    assert((rwx == 0) || (rwx == 1) || (rwx == 2));

396 397 398
    /* 1. Handle real mode accesses */
    if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
        /* Translation is off */
399 400 401 402
        raddr = eaddr;
        tlb_set_page(env, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
                     PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
                     TARGET_PAGE_SIZE);
403 404 405 406 407
        return 0;
    }

    /* 2. Check Block Address Translation entries (BATs) */
    if (env->nb_BATs != 0) {
408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424
        raddr = ppc_hash32_bat_lookup(env, eaddr, rwx, &prot);
        if (raddr != -1) {
            if (need_prot[rwx] & ~prot) {
                if (rwx == 2) {
                    env->exception_index = POWERPC_EXCP_ISI;
                    env->error_code = 0x08000000;
                } else {
                    env->exception_index = POWERPC_EXCP_DSI;
                    env->error_code = 0;
                    env->spr[SPR_DAR] = eaddr;
                    if (rwx == 1) {
                        env->spr[SPR_DSISR] = 0x0a000000;
                    } else {
                        env->spr[SPR_DSISR] = 0x08000000;
                    }
                }
                return 1;
425
            }
426 427 428 429

            tlb_set_page(env, eaddr & TARGET_PAGE_MASK,
                         raddr & TARGET_PAGE_MASK, prot, mmu_idx,
                         TARGET_PAGE_SIZE);
430
            return 0;
431 432 433
        }
    }

434
    /* 3. Look up the Segment Register */
435
    sr = env->sr[eaddr >> 28];
436 437 438

    /* 4. Handle direct store segments */
    if (sr & SR32_T) {
439 440 441 442 443 444 445 446 447
        if (ppc_hash32_direct_store(env, sr, eaddr, rwx,
                                    &raddr, &prot) == 0) {
            tlb_set_page(env, eaddr & TARGET_PAGE_MASK,
                         raddr & TARGET_PAGE_MASK, prot, mmu_idx,
                         TARGET_PAGE_SIZE);
            return 0;
        } else {
            return 1;
        }
448 449
    }

450
    /* 5. Check for segment level no-execute violation */
451
    if ((rwx == 2) && (sr & SR32_NX)) {
452 453 454
        env->exception_index = POWERPC_EXCP_ISI;
        env->error_code = 0x10000000;
        return 1;
455
    }
456 457 458 459

    /* 6. Locate the PTE in the hash table */
    pte_offset = ppc_hash32_htab_lookup(env, sr, eaddr, &pte);
    if (pte_offset == -1) {
460 461 462 463 464 465 466 467 468 469 470 471 472 473 474
        if (rwx == 2) {
            env->exception_index = POWERPC_EXCP_ISI;
            env->error_code = 0x40000000;
        } else {
            env->exception_index = POWERPC_EXCP_DSI;
            env->error_code = 0;
            env->spr[SPR_DAR] = eaddr;
            if (rwx == 1) {
                env->spr[SPR_DSISR] = 0x42000000;
            } else {
                env->spr[SPR_DSISR] = 0x40000000;
            }
        }

        return 1;
475 476 477 478
    }
    LOG_MMU("found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);

    /* 7. Check access permissions */
479

480
    prot = ppc_hash32_pte_prot(env, sr, pte);
481

482
    if (need_prot[rwx] & ~prot) {
483 484
        /* Access right violation */
        LOG_MMU("PTE access rejected\n");
485 486 487 488 489 490 491 492 493 494 495 496 497 498
        if (rwx == 2) {
            env->exception_index = POWERPC_EXCP_ISI;
            env->error_code = 0x08000000;
        } else {
            env->exception_index = POWERPC_EXCP_DSI;
            env->error_code = 0;
            env->spr[SPR_DAR] = eaddr;
            if (rwx == 1) {
                env->spr[SPR_DSISR] = 0x0a000000;
            } else {
                env->spr[SPR_DSISR] = 0x08000000;
            }
        }
        return 1;
499 500
    }

501 502 503 504
    LOG_MMU("PTE access granted !\n");

    /* 8. Update PTE referenced and changed bits if necessary */

505 506 507 508 509 510
    new_pte1 = pte.pte1 | HPTE32_R_R; /* set referenced bit */
    if (rwx == 1) {
        new_pte1 |= HPTE32_R_C; /* set changed (dirty) bit */
    } else {
        /* Treat the page as read-only for now, so that a later write
         * will pass through this function again to set the C bit */
511
        prot &= ~PAGE_WRITE;
512 513 514 515
    }

    if (new_pte1 != pte.pte1) {
        ppc_hash32_store_hpte1(env, pte_offset, new_pte1);
516
    }
517

518 519
    /* 9. Determine the real address from the PTE */

520 521 522 523
    raddr = ppc_hash32_pte_raddr(sr, pte, eaddr);

    tlb_set_page(env, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
                 prot, mmu_idx, TARGET_PAGE_SIZE);
524 525

    return 0;
526
}
527

528
hwaddr ppc_hash32_get_phys_page_debug(CPUPPCState *env, target_ulong eaddr)
529
{
530 531 532 533 534 535 536 537 538
    target_ulong sr;
    hwaddr pte_offset;
    ppc_hash_pte32_t pte;
    int prot;

    if (msr_dr == 0) {
        /* Translation is off */
        return eaddr;
    }
539

540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555
    if (env->nb_BATs != 0) {
        hwaddr raddr = ppc_hash32_bat_lookup(env, eaddr, 0, &prot);
        if (raddr != -1) {
            return raddr;
        }
    }

    sr = env->sr[eaddr >> 28];

    if (sr & SR32_T) {
        /* FIXME: Add suitable debug support for Direct Store segments */
        return -1;
    }

    pte_offset = ppc_hash32_htab_lookup(env, sr, eaddr, &pte);
    if (pte_offset == -1) {
556 557 558
        return -1;
    }

559
    return ppc_hash32_pte_raddr(sr, pte, eaddr) & TARGET_PAGE_MASK;
560
}