target-ppc/mmu-hash64.c

   1 /*
   2  *  PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
   3  *
   4  *  Copyright (c) 2003-2007 Jocelyn Mayer
   5  *  Copyright (c) 2013 David Gibson, IBM Corporation
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20 #include "cpu.h"
  21 #include "helper.h"
  22 #include "sysemu/kvm.h"
  23 #include "kvm_ppc.h"
  24 #include "mmu-hash64.h"
  25
  26 //#define DEBUG_MMU
  27 //#define DEBUG_SLB
  28
  29 #ifdef DEBUG_MMU
  30 #  define LOG_MMU(...) qemu_log(__VA_ARGS__)
  31 #  define LOG_MMU_STATE(env) log_cpu_state((env), 0)
  32 #else
  33 #  define LOG_MMU(...) do { } while (0)
  34 #  define LOG_MMU_STATE(...) do { } while (0)
  35 #endif
  36
  37 #ifdef DEBUG_SLB
  38 #  define LOG_SLB(...) qemu_log(__VA_ARGS__)
  39 #else
  40 #  define LOG_SLB(...) do { } while (0)
  41 #endif
  42
  43 /*
  44  * SLB handling
  45  */
  46
  47 static ppc_slb_t *slb_lookup(CPUPPCState *env, target_ulong eaddr)
  48 {
  49     uint64_t esid_256M, esid_1T;
  50     int n;
  51
  52     LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);
  53
  54     esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V;
  55     esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V;
  56
  57     for (n = 0; n < env->slb_nr; n++) {
  58         ppc_slb_t *slb = &env->slb[n];
  59
  60         LOG_SLB("%s: slot %d %016" PRIx64 " %016"
  61                     PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
  62         /* We check for 1T matches on all MMUs here - if the MMU
  63          * doesn't have 1T segment support, we will have prevented 1T
  64          * entries from being inserted in the slbmte code. */
  65         if (((slb->esid == esid_256M) &&
  66              ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
  67             || ((slb->esid == esid_1T) &&
  68                 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
  69             return slb;
  70         }
  71     }
  72
  73     return NULL;
  74 }
  75
  76 void dump_slb(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
  77 {
  78     int i;
  79     uint64_t slbe, slbv;
  80
  81     cpu_synchronize_state(env);
  82
  83     cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
  84     for (i = 0; i < env->slb_nr; i++) {
  85         slbe = env->slb[i].esid;
  86         slbv = env->slb[i].vsid;
  87         if (slbe == 0 && slbv == 0) {
  88             continue;
  89         }
  90         cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
  91                     i, slbe, slbv);
  92     }
  93 }
  94
  95 void helper_slbia(CPUPPCState *env)
  96 {
  97     int n, do_invalidate;
  98
  99     do_invalidate = 0;
 100     /* XXX: Warning: slbia never invalidates the first segment */
 101     for (n = 1; n < env->slb_nr; n++) {
 102         ppc_slb_t *slb = &env->slb[n];
 103
 104         if (slb->esid & SLB_ESID_V) {
 105             slb->esid &= ~SLB_ESID_V;
 106             /* XXX: given the fact that segment size is 256 MB or 1TB,
 107              *      and we still don't have a tlb_flush_mask(env, n, mask)
 108              *      in QEMU, we just invalidate all TLBs
 109              */
 110             do_invalidate = 1;
 111         }
 112     }
 113     if (do_invalidate) {
 114         tlb_flush(env, 1);
 115     }
 116 }
 117
 118 void helper_slbie(CPUPPCState *env, target_ulong addr)
 119 {
 120     ppc_slb_t *slb;
 121
 122     slb = slb_lookup(env, addr);
 123     if (!slb) {
 124         return;
 125     }
 126
 127     if (slb->esid & SLB_ESID_V) {
 128         slb->esid &= ~SLB_ESID_V;
 129
 130         /* XXX: given the fact that segment size is 256 MB or 1TB,
 131          *      and we still don't have a tlb_flush_mask(env, n, mask)
 132          *      in QEMU, we just invalidate all TLBs
 133          */
 134         tlb_flush(env, 1);
 135     }
 136 }
 137
 138 int ppc_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
 139 {
 140     int slot = rb & 0xfff;
 141     ppc_slb_t *slb = &env->slb[slot];
 142
 143     if (rb & (0x1000 - env->slb_nr)) {
 144         return -1; /* Reserved bits set or slot too high */
 145     }
 146     if (rs & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
 147         return -1; /* Bad segment size */
 148     }
 149     if ((rs & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
 150         return -1; /* 1T segment on MMU that doesn't support it */
 151     }
 152
 153     /* Mask out the slot number as we store the entry */
 154     slb->esid = rb & (SLB_ESID_ESID | SLB_ESID_V);
 155     slb->vsid = rs;
 156
 157     LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
 158             " %016" PRIx64 "\n", __func__, slot, rb, rs,
 159             slb->esid, slb->vsid);
 160
 161     return 0;
 162 }
 163
 164 static int ppc_load_slb_esid(CPUPPCState *env, target_ulong rb,
 165                              target_ulong *rt)
 166 {
 167     int slot = rb & 0xfff;
 168     ppc_slb_t *slb = &env->slb[slot];
 169
 170     if (slot >= env->slb_nr) {
 171         return -1;
 172     }
 173
 174     *rt = slb->esid;
 175     return 0;
 176 }
 177
 178 static int ppc_load_slb_vsid(CPUPPCState *env, target_ulong rb,
 179                              target_ulong *rt)
 180 {
 181     int slot = rb & 0xfff;
 182     ppc_slb_t *slb = &env->slb[slot];
 183
 184     if (slot >= env->slb_nr) {
 185         return -1;
 186     }
 187
 188     *rt = slb->vsid;
 189     return 0;
 190 }
 191
 192 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
 193 {
 194     if (ppc_store_slb(env, rb, rs) < 0) {
 195         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 196                                    POWERPC_EXCP_INVAL);
 197     }
 198 }
 199
 200 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
 201 {
 202     target_ulong rt = 0;
 203
 204     if (ppc_load_slb_esid(env, rb, &rt) < 0) {
 205         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 206                                    POWERPC_EXCP_INVAL);
 207     }
 208     return rt;
 209 }
 210
 211 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
 212 {
 213     target_ulong rt = 0;
 214
 215     if (ppc_load_slb_vsid(env, rb, &rt) < 0) {
 216         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 217                                    POWERPC_EXCP_INVAL);
 218     }
 219     return rt;
 220 }
 221
 222 /*
 223  * 64-bit hash table MMU handling
 224  */
 225
 226 #define PTE64_PTEM_MASK 0xFFFFFFFFFFFFFF80ULL
 227 #define PTE64_CHECK_MASK (TARGET_PAGE_MASK | 0x7F)
 228
 229 static inline int pte64_is_valid(target_ulong pte0)
 230 {
 231     return pte0 & 0x0000000000000001ULL ? 1 : 0;
 232 }
 233
 234 static int pte64_check(mmu_ctx_t *ctx, target_ulong pte0,
 235                        target_ulong pte1, int h, int rw, int type)
 236 {
 237     target_ulong ptem, mmask;
 238     int access, ret, pteh, ptev, pp;
 239
 240     ret = -1;
 241     /* Check validity and table match */
 242     ptev = pte64_is_valid(pte0);
 243     pteh = (pte0 >> 1) & 1;
 244     if (ptev && h == pteh) {
 245         /* Check vsid & api */
 246         ptem = pte0 & PTE64_PTEM_MASK;
 247         mmask = PTE64_CHECK_MASK;
 248         pp = (pte1 & 0x00000003) | ((pte1 >> 61) & 0x00000004);
 249         ctx->nx  = (pte1 >> 2) & 1; /* No execute bit */
 250         ctx->nx |= (pte1 >> 3) & 1; /* Guarded bit    */
 251         if (ptem == ctx->ptem) {
 252             if (ctx->raddr != (hwaddr)-1ULL) {
 253                 /* all matches should have equal RPN, WIMG & PP */
 254                 if ((ctx->raddr & mmask) != (pte1 & mmask)) {
 255                     qemu_log("Bad RPN/WIMG/PP\n");
 256                     return -3;
 257                 }
 258             }
 259             /* Compute access rights */
 260             access = pp_check(ctx->key, pp, ctx->nx);
 261             /* Keep the matching PTE informations */
 262             ctx->raddr = pte1;
 263             ctx->prot = access;
 264             ret = check_prot(ctx->prot, rw, type);
 265             if (ret == 0) {
 266                 /* Access granted */
 267                 LOG_MMU("PTE access granted !\n");
 268             } else {
 269                 /* Access right violation */
 270                 LOG_MMU("PTE access rejected\n");
 271             }
 272         }
 273     }
 274
 275     return ret;
 276 }
 277
 278 /* PTE table lookup */
 279 static int find_pte64(CPUPPCState *env, mmu_ctx_t *ctx, int h,
 280                       int rw, int type, int target_page_bits)
 281 {
 282     hwaddr pteg_off;
 283     target_ulong pte0, pte1;
 284     int i, good = -1;
 285     int ret, r;
 286
 287     ret = -1; /* No entry found */
 288     pteg_off = get_pteg_offset(env, ctx->hash[h], HASH_PTE_SIZE_64);
 289     for (i = 0; i < 8; i++) {
 290         if (env->external_htab) {
 291             pte0 = ldq_p(env->external_htab + pteg_off + (i * 16));
 292             pte1 = ldq_p(env->external_htab + pteg_off + (i * 16) + 8);
 293         } else {
 294             pte0 = ldq_phys(env->htab_base + pteg_off + (i * 16));
 295             pte1 = ldq_phys(env->htab_base + pteg_off + (i * 16) + 8);
 296         }
 297
 298         r = pte64_check(ctx, pte0, pte1, h, rw, type);
 299         LOG_MMU("Load pte from %016" HWADDR_PRIx " => " TARGET_FMT_lx " "
 300                 TARGET_FMT_lx " %d %d %d " TARGET_FMT_lx "\n",
 301                 pteg_off + (i * 16), pte0, pte1, (int)(pte0 & 1), h,
 302                 (int)((pte0 >> 1) & 1), ctx->ptem);
 303         switch (r) {
 304         case -3:
 305             /* PTE inconsistency */
 306             return -1;
 307         case -2:
 308             /* Access violation */
 309             ret = -2;
 310             good = i;
 311             break;
 312         case -1:
 313         default:
 314             /* No PTE match */
 315             break;
 316         case 0:
 317             /* access granted */
 318             /* XXX: we should go on looping to check all PTEs consistency
 319              *      but if we can speed-up the whole thing as the
 320              *      result would be undefined if PTEs are not consistent.
 321              */
 322             ret = 0;
 323             good = i;
 324             goto done;
 325         }
 326     }
 327     if (good != -1) {
 328     done:
 329         LOG_MMU("found PTE at addr %08" HWADDR_PRIx " prot=%01x ret=%d\n",
 330                 ctx->raddr, ctx->prot, ret);
 331         /* Update page flags */
 332         pte1 = ctx->raddr;
 333         if (pte_update_flags(ctx, &pte1, ret, rw) == 1) {
 334             if (env->external_htab) {
 335                 stq_p(env->external_htab + pteg_off + (good * 16) + 8,
 336                       pte1);
 337             } else {
 338                 stq_phys_notdirty(env->htab_base + pteg_off +
 339                                   (good * 16) + 8, pte1);
 340             }
 341         }
 342     }
 343
 344     /* We have a TLB that saves 4K pages, so let's
 345      * split a huge page to 4k chunks */
 346     if (target_page_bits != TARGET_PAGE_BITS) {
 347         ctx->raddr |= (ctx->eaddr & ((1 << target_page_bits) - 1))
 348                       & TARGET_PAGE_MASK;
 349     }
 350     return ret;
 351 }
 352
 353 static int get_segment64(CPUPPCState *env, mmu_ctx_t *ctx,
 354                          target_ulong eaddr, int rw, int type)
 355 {
 356     hwaddr hash;
 357     target_ulong vsid;
 358     int pr, target_page_bits;
 359     int ret, ret2;
 360
 361     pr = msr_pr;
 362     ctx->eaddr = eaddr;
 363     ppc_slb_t *slb;
 364     target_ulong pageaddr;
 365     int segment_bits;
 366
 367     LOG_MMU("Check SLBs\n");
 368     slb = slb_lookup(env, eaddr);
 369     if (!slb) {
 370         return -5;
 371     }
 372
 373     if (slb->vsid & SLB_VSID_B) {
 374         vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
 375         segment_bits = 40;
 376     } else {
 377         vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
 378         segment_bits = 28;
 379     }
 380
 381     target_page_bits = (slb->vsid & SLB_VSID_L)
 382         ? TARGET_PAGE_BITS_16M : TARGET_PAGE_BITS;
 383     ctx->key = !!(pr ? (slb->vsid & SLB_VSID_KP)
 384                   : (slb->vsid & SLB_VSID_KS));
 385     ctx->nx = !!(slb->vsid & SLB_VSID_N);
 386
 387     pageaddr = eaddr & ((1ULL << segment_bits)
 388                             - (1ULL << target_page_bits));
 389     if (slb->vsid & SLB_VSID_B) {
 390         hash = vsid ^ (vsid << 25) ^ (pageaddr >> target_page_bits);
 391     } else {
 392         hash = vsid ^ (pageaddr >> target_page_bits);
 393     }
 394     /* Only 5 bits of the page index are used in the AVPN */
 395     ctx->ptem = (slb->vsid & SLB_VSID_PTEM) |
 396         ((pageaddr >> 16) & ((1ULL << segment_bits) - 0x80));
 397
 398     LOG_MMU("pte segment: key=%d nx %d vsid " TARGET_FMT_lx "\n",
 399             ctx->key, ctx->nx, vsid);
 400     ret = -1;
 401
 402     /* Check if instruction fetch is allowed, if needed */
 403     if (type != ACCESS_CODE || ctx->nx == 0) {
 404         /* Page address translation */
 405         LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
 406                 " hash " TARGET_FMT_plx "\n",
 407                 env->htab_base, env->htab_mask, hash);
 408         ctx->hash[0] = hash;
 409         ctx->hash[1] = ~hash;
 410
 411         /* Initialize real address with an invalid value */
 412         ctx->raddr = (hwaddr)-1ULL;
 413         LOG_MMU("0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 414                 " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
 415                 " hash=" TARGET_FMT_plx "\n",
 416                 env->htab_base, env->htab_mask, vsid, ctx->ptem,
 417                 ctx->hash[0]);
 418         /* Primary table lookup */
 419         ret = find_pte64(env, ctx, 0, rw, type, target_page_bits);
 420         if (ret < 0) {
 421             /* Secondary table lookup */
 422             LOG_MMU("1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 423                     " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
 424                     " hash=" TARGET_FMT_plx "\n", env->htab_base,
 425                     env->htab_mask, vsid, ctx->ptem, ctx->hash[1]);
 426             ret2 = find_pte64(env, ctx, 1, rw, type, target_page_bits);
 427             if (ret2 != -1) {
 428                 ret = ret2;
 429             }
 430         }
 431     } else {
 432         LOG_MMU("No access allowed\n");
 433         ret = -3;
 434     }
 435
 436     return ret;
 437 }
 438
 439 int ppc_hash64_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
 440                                     target_ulong eaddr, int rw, int access_type)
 441 {
 442     bool real_mode = (access_type == ACCESS_CODE && msr_ir == 0)
 443         || (access_type != ACCESS_CODE && msr_dr == 0);
 444
 445     if (real_mode) {
 446         ctx->raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
 447         ctx->prot = PAGE_READ | PAGE_EXEC | PAGE_WRITE;
 448         return 0;
 449     } else {
 450         return get_segment64(env, ctx, eaddr, rw, access_type);
 451     }
 452 }
 453
 454 int ppc_hash64_handle_mmu_fault(CPUPPCState *env, target_ulong address, int rw,
 455                                 int mmu_idx)
 456 {
 457     mmu_ctx_t ctx;
 458     int access_type;
 459     int ret = 0;
 460
 461     if (rw == 2) {
 462         /* code access */
 463         rw = 0;
 464         access_type = ACCESS_CODE;
 465     } else {
 466         /* data access */
 467         access_type = env->access_type;
 468     }
 469     ret = ppc_hash64_get_physical_address(env, &ctx, address, rw, access_type);
 470     if (ret == 0) {
 471         tlb_set_page(env, address & TARGET_PAGE_MASK,
 472                      ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
 473                      mmu_idx, TARGET_PAGE_SIZE);
 474         ret = 0;
 475     } else if (ret < 0) {
 476         LOG_MMU_STATE(env);
 477         if (access_type == ACCESS_CODE) {
 478             switch (ret) {
 479             case -1:
 480                 env->exception_index = POWERPC_EXCP_ISI;
 481                 env->error_code = 0x40000000;
 482                 break;
 483             case -2:
 484                 /* Access rights violation */
 485                 env->exception_index = POWERPC_EXCP_ISI;
 486                 env->error_code = 0x08000000;
 487                 break;
 488             case -3:
 489                 /* No execute protection violation */
 490                 env->exception_index = POWERPC_EXCP_ISI;
 491                 env->error_code = 0x10000000;
 492                 break;
 493             case -5:
 494                 /* No match in segment table */
 495                 env->exception_index = POWERPC_EXCP_ISEG;
 496                 env->error_code = 0;
 497                 break;
 498             }
 499         } else {
 500             switch (ret) {
 501             case -1:
 502                 /* No matches in page tables or TLB */
 503                 env->exception_index = POWERPC_EXCP_DSI;
 504                 env->error_code = 0;
 505                 env->spr[SPR_DAR] = address;
 506                 if (rw == 1) {
 507                     env->spr[SPR_DSISR] = 0x42000000;
 508                 } else {
 509                     env->spr[SPR_DSISR] = 0x40000000;
 510                 }
 511                 break;
 512             case -2:
 513                 /* Access rights violation */
 514                 env->exception_index = POWERPC_EXCP_DSI;
 515                 env->error_code = 0;
 516                 env->spr[SPR_DAR] = address;
 517                 if (rw == 1) {
 518                     env->spr[SPR_DSISR] = 0x0A000000;
 519                 } else {
 520                     env->spr[SPR_DSISR] = 0x08000000;
 521                 }
 522                 break;
 523             case -5:
 524                 /* No match in segment table */
 525                 env->exception_index = POWERPC_EXCP_DSEG;
 526                 env->error_code = 0;
 527                 env->spr[SPR_DAR] = address;
 528                 break;
 529             }
 530         }
 531 #if 0
 532         printf("%s: set exception to %d %02x\n", __func__,
 533                env->exception, env->error_code);
 534 #endif
 535         ret = 1;
 536     }
 537
 538     return ret;
 539 }