1 /*
2 * Miscellaneous PowerPC emulation helpers for QEMU.
3 *
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "qemu/osdep.h"
21 #include "qemu/log.h"
22 #include "cpu.h"
23 #include "exec/exec-all.h"
24 #include "exec/helper-proto.h"
25 #include "qemu/error-report.h"
26 #include "qemu/main-loop.h"
27 #include "mmu-book3s-v3.h"
28 #include "hw/ppc/ppc.h"
29
30 #include "helper_regs.h"
31
32 /*****************************************************************************/
33 /* SPR accesses */
helper_load_dump_spr(CPUPPCState * env,uint32_t sprn)34 void helper_load_dump_spr(CPUPPCState *env, uint32_t sprn)
35 {
36 qemu_log("Read SPR %d %03x => " TARGET_FMT_lx "\n", sprn, sprn,
37 env->spr[sprn]);
38 }
39
helper_store_dump_spr(CPUPPCState * env,uint32_t sprn)40 void helper_store_dump_spr(CPUPPCState *env, uint32_t sprn)
41 {
42 qemu_log("Write SPR %d %03x <= " TARGET_FMT_lx "\n", sprn, sprn,
43 env->spr[sprn]);
44 }
45
helper_spr_core_write_generic(CPUPPCState * env,uint32_t sprn,target_ulong val)46 void helper_spr_core_write_generic(CPUPPCState *env, uint32_t sprn,
47 target_ulong val)
48 {
49 CPUState *cs = env_cpu(env);
50 CPUState *ccs;
51
52 if (ppc_cpu_core_single_threaded(cs)) {
53 env->spr[sprn] = val;
54 return;
55 }
56
57 THREAD_SIBLING_FOREACH(cs, ccs) {
58 CPUPPCState *cenv = &POWERPC_CPU(ccs)->env;
59 cenv->spr[sprn] = val;
60 }
61 }
62
helper_spr_write_CTRL(CPUPPCState * env,uint32_t sprn,target_ulong val)63 void helper_spr_write_CTRL(CPUPPCState *env, uint32_t sprn,
64 target_ulong val)
65 {
66 CPUState *cs = env_cpu(env);
67 CPUState *ccs;
68 uint32_t run = val & 1;
69 uint32_t ts, ts_mask;
70
71 assert(sprn == SPR_CTRL);
72
73 env->spr[sprn] &= ~1U;
74 env->spr[sprn] |= run;
75
76 ts_mask = ~(1U << (8 + env->spr[SPR_TIR]));
77 ts = run << (8 + env->spr[SPR_TIR]);
78
79 THREAD_SIBLING_FOREACH(cs, ccs) {
80 CPUPPCState *cenv = &POWERPC_CPU(ccs)->env;
81
82 cenv->spr[sprn] &= ts_mask;
83 cenv->spr[sprn] |= ts;
84 }
85 }
86
87
88 #ifdef TARGET_PPC64
raise_hv_fu_exception(CPUPPCState * env,uint32_t bit,const char * caller,uint32_t cause,uintptr_t raddr)89 static void raise_hv_fu_exception(CPUPPCState *env, uint32_t bit,
90 const char *caller, uint32_t cause,
91 uintptr_t raddr)
92 {
93 qemu_log_mask(CPU_LOG_INT, "HV Facility %d is unavailable (%s)\n",
94 bit, caller);
95
96 env->spr[SPR_HFSCR] &= ~((target_ulong)FSCR_IC_MASK << FSCR_IC_POS);
97
98 raise_exception_err_ra(env, POWERPC_EXCP_HV_FU, cause, raddr);
99 }
100
raise_fu_exception(CPUPPCState * env,uint32_t bit,uint32_t sprn,uint32_t cause,uintptr_t raddr)101 static void raise_fu_exception(CPUPPCState *env, uint32_t bit,
102 uint32_t sprn, uint32_t cause,
103 uintptr_t raddr)
104 {
105 qemu_log("Facility SPR %d is unavailable (SPR FSCR:%d)\n", sprn, bit);
106
107 env->spr[SPR_FSCR] &= ~((target_ulong)FSCR_IC_MASK << FSCR_IC_POS);
108 cause &= FSCR_IC_MASK;
109 env->spr[SPR_FSCR] |= (target_ulong)cause << FSCR_IC_POS;
110
111 raise_exception_err_ra(env, POWERPC_EXCP_FU, 0, raddr);
112 }
113 #endif
114
helper_hfscr_facility_check(CPUPPCState * env,uint32_t bit,const char * caller,uint32_t cause)115 void helper_hfscr_facility_check(CPUPPCState *env, uint32_t bit,
116 const char *caller, uint32_t cause)
117 {
118 #ifdef TARGET_PPC64
119 if ((env->msr_mask & MSR_HVB) && !FIELD_EX64(env->msr, MSR, HV) &&
120 !(env->spr[SPR_HFSCR] & (1UL << bit))) {
121 raise_hv_fu_exception(env, bit, caller, cause, GETPC());
122 }
123 #endif
124 }
125
helper_fscr_facility_check(CPUPPCState * env,uint32_t bit,uint32_t sprn,uint32_t cause)126 void helper_fscr_facility_check(CPUPPCState *env, uint32_t bit,
127 uint32_t sprn, uint32_t cause)
128 {
129 #ifdef TARGET_PPC64
130 if (env->spr[SPR_FSCR] & (1ULL << bit)) {
131 /* Facility is enabled, continue */
132 return;
133 }
134 raise_fu_exception(env, bit, sprn, cause, GETPC());
135 #endif
136 }
137
helper_msr_facility_check(CPUPPCState * env,uint32_t bit,uint32_t sprn,uint32_t cause)138 void helper_msr_facility_check(CPUPPCState *env, uint32_t bit,
139 uint32_t sprn, uint32_t cause)
140 {
141 #ifdef TARGET_PPC64
142 if (env->msr & (1ULL << bit)) {
143 /* Facility is enabled, continue */
144 return;
145 }
146 raise_fu_exception(env, bit, sprn, cause, GETPC());
147 #endif
148 }
149
150 #if !defined(CONFIG_USER_ONLY)
151
152 #ifdef TARGET_PPC64
helper_mmcr0_facility_check(CPUPPCState * env,uint32_t bit,uint32_t sprn,uint32_t cause)153 static void helper_mmcr0_facility_check(CPUPPCState *env, uint32_t bit,
154 uint32_t sprn, uint32_t cause)
155 {
156 if (FIELD_EX64(env->msr, MSR, PR) &&
157 !(env->spr[SPR_POWER_MMCR0] & (1ULL << bit))) {
158 raise_fu_exception(env, bit, sprn, cause, GETPC());
159 }
160 }
161 #endif
162
helper_store_sdr1(CPUPPCState * env,target_ulong val)163 void helper_store_sdr1(CPUPPCState *env, target_ulong val)
164 {
165 if (env->spr[SPR_SDR1] != val) {
166 ppc_store_sdr1(env, val);
167 tlb_flush(env_cpu(env));
168 }
169 }
170
171 #if defined(TARGET_PPC64)
helper_store_ptcr(CPUPPCState * env,target_ulong val)172 void helper_store_ptcr(CPUPPCState *env, target_ulong val)
173 {
174 if (env->spr[SPR_PTCR] != val) {
175 CPUState *cs = env_cpu(env);
176 PowerPCCPU *cpu = env_archcpu(env);
177 target_ulong ptcr_mask = PTCR_PATB | PTCR_PATS;
178 target_ulong patbsize = val & PTCR_PATS;
179
180 qemu_log_mask(CPU_LOG_MMU, "%s: " TARGET_FMT_lx "\n", __func__, val);
181
182 assert(!cpu->vhyp);
183 assert(env->mmu_model & POWERPC_MMU_3_00);
184
185 if (val & ~ptcr_mask) {
186 error_report("Invalid bits 0x"TARGET_FMT_lx" set in PTCR",
187 val & ~ptcr_mask);
188 val &= ptcr_mask;
189 }
190
191 if (patbsize > 24) {
192 error_report("Invalid Partition Table size 0x" TARGET_FMT_lx
193 " stored in PTCR", patbsize);
194 return;
195 }
196
197 if (ppc_cpu_lpar_single_threaded(cs)) {
198 env->spr[SPR_PTCR] = val;
199 tlb_flush(cs);
200 } else {
201 CPUState *ccs;
202
203 THREAD_SIBLING_FOREACH(cs, ccs) {
204 PowerPCCPU *ccpu = POWERPC_CPU(ccs);
205 CPUPPCState *cenv = &ccpu->env;
206 cenv->spr[SPR_PTCR] = val;
207 tlb_flush(ccs);
208 }
209 }
210 }
211 }
212
helper_store_pcr(CPUPPCState * env,target_ulong value)213 void helper_store_pcr(CPUPPCState *env, target_ulong value)
214 {
215 PowerPCCPU *cpu = env_archcpu(env);
216 PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
217
218 env->spr[SPR_PCR] = value & pcc->pcr_mask;
219 }
220
helper_store_ciabr(CPUPPCState * env,target_ulong value)221 void helper_store_ciabr(CPUPPCState *env, target_ulong value)
222 {
223 ppc_store_ciabr(env, value);
224 }
225
helper_store_dawr0(CPUPPCState * env,target_ulong value)226 void helper_store_dawr0(CPUPPCState *env, target_ulong value)
227 {
228 ppc_store_dawr0(env, value);
229 }
230
helper_store_dawrx0(CPUPPCState * env,target_ulong value)231 void helper_store_dawrx0(CPUPPCState *env, target_ulong value)
232 {
233 ppc_store_dawrx0(env, value);
234 }
235
236 /*
237 * DPDES register is shared. Each bit reflects the state of the
238 * doorbell interrupt of a thread of the same core.
239 */
helper_load_dpdes(CPUPPCState * env)240 target_ulong helper_load_dpdes(CPUPPCState *env)
241 {
242 CPUState *cs = env_cpu(env);
243 CPUState *ccs;
244 target_ulong dpdes = 0;
245
246 helper_hfscr_facility_check(env, HFSCR_MSGP, "load DPDES", HFSCR_IC_MSGP);
247
248 /* DPDES behaves as 1-thread in LPAR-per-thread mode */
249 if (ppc_cpu_lpar_single_threaded(cs)) {
250 if (env->pending_interrupts & PPC_INTERRUPT_DOORBELL) {
251 dpdes = 1;
252 }
253 return dpdes;
254 }
255
256 bql_lock();
257 THREAD_SIBLING_FOREACH(cs, ccs) {
258 PowerPCCPU *ccpu = POWERPC_CPU(ccs);
259 CPUPPCState *cenv = &ccpu->env;
260 uint32_t thread_id = ppc_cpu_tir(ccpu);
261
262 if (cenv->pending_interrupts & PPC_INTERRUPT_DOORBELL) {
263 dpdes |= (0x1 << thread_id);
264 }
265 }
266 bql_unlock();
267
268 return dpdes;
269 }
270
helper_store_dpdes(CPUPPCState * env,target_ulong val)271 void helper_store_dpdes(CPUPPCState *env, target_ulong val)
272 {
273 PowerPCCPU *cpu = env_archcpu(env);
274 CPUState *cs = env_cpu(env);
275 CPUState *ccs;
276
277 helper_hfscr_facility_check(env, HFSCR_MSGP, "store DPDES", HFSCR_IC_MSGP);
278
279 /* DPDES behaves as 1-thread in LPAR-per-thread mode */
280 if (ppc_cpu_lpar_single_threaded(cs)) {
281 ppc_set_irq(cpu, PPC_INTERRUPT_DOORBELL, val & 0x1);
282 return;
283 }
284
285 /* Does iothread need to be locked for walking CPU list? */
286 bql_lock();
287 THREAD_SIBLING_FOREACH(cs, ccs) {
288 PowerPCCPU *ccpu = POWERPC_CPU(ccs);
289 uint32_t thread_id = ppc_cpu_tir(ccpu);
290
291 ppc_set_irq(ccpu, PPC_INTERRUPT_DOORBELL, val & (0x1 << thread_id));
292 }
293 bql_unlock();
294 }
295
296 /*
297 * qemu-user breaks with pnv headers, so they go under ifdefs for now.
298 * A clean up may be to move powernv specific registers and helpers into
299 * target/ppc/pnv_helper.c
300 */
301 #include "hw/ppc/pnv_core.h"
302
303 /* Indirect SCOM (SPRC/SPRD) access to SCRATCH0-7 are implemented. */
helper_store_sprc(CPUPPCState * env,target_ulong val)304 void helper_store_sprc(CPUPPCState *env, target_ulong val)
305 {
306 if (val & ~0x3f8ULL) {
307 qemu_log_mask(LOG_GUEST_ERROR, "Invalid SPRC register value "
308 TARGET_FMT_lx"\n", val);
309 return;
310 }
311 env->spr[SPR_POWER_SPRC] = val;
312 }
313
helper_load_sprd(CPUPPCState * env)314 target_ulong helper_load_sprd(CPUPPCState *env)
315 {
316 /*
317 * SPRD is a HV-only register for Power CPUs, so this will only be
318 * accessed by powernv machines.
319 */
320 PowerPCCPU *cpu = env_archcpu(env);
321 PnvCore *pc = pnv_cpu_state(cpu)->pnv_core;
322 target_ulong sprc = env->spr[SPR_POWER_SPRC];
323
324 switch (sprc & 0x3e0) {
325 case 0: /* SCRATCH0-3 */
326 case 1: /* SCRATCH4-7 */
327 return pc->scratch[(sprc >> 3) & 0x7];
328
329 case 0x1e0: /* core thread state */
330 if (env->excp_model == POWERPC_EXCP_POWER9) {
331 /*
332 * Only implement for POWER9 because skiboot uses it to check
333 * big-core mode. Other bits are unimplemented so we would
334 * prefer to get unimplemented message on POWER10 if it were
335 * used anywhere.
336 */
337 if (pc->big_core) {
338 return PPC_BIT(63);
339 } else {
340 return 0;
341 }
342 }
343 /* fallthru */
344
345 default:
346 qemu_log_mask(LOG_UNIMP, "mfSPRD: Unimplemented SPRC:0x"
347 TARGET_FMT_lx"\n", sprc);
348 break;
349 }
350 return 0;
351 }
352
helper_store_sprd(CPUPPCState * env,target_ulong val)353 void helper_store_sprd(CPUPPCState *env, target_ulong val)
354 {
355 target_ulong sprc = env->spr[SPR_POWER_SPRC];
356 PowerPCCPU *cpu = env_archcpu(env);
357 PnvCore *pc = pnv_cpu_state(cpu)->pnv_core;
358 int nr;
359
360 switch (sprc & 0x3e0) {
361 case 0: /* SCRATCH0-3 */
362 case 1: /* SCRATCH4-7 */
363 /*
364 * Log stores to SCRATCH, because some firmware uses these for
365 * debugging and logging, but they would normally be read by the BMC,
366 * which is not implemented in QEMU yet. This gives a way to get at the
367 * information. Could also dump these upon checkstop.
368 */
369 nr = (sprc >> 3) & 0x7;
370 qemu_log("SPRD write 0x" TARGET_FMT_lx " to SCRATCH%d\n", val, nr);
371 pc->scratch[nr] = val;
372 break;
373 default:
374 qemu_log_mask(LOG_UNIMP, "mtSPRD: Unimplemented SPRC:0x"
375 TARGET_FMT_lx"\n", sprc);
376 break;
377 }
378 }
379 #endif /* defined(TARGET_PPC64) */
380
helper_store_pidr(CPUPPCState * env,target_ulong val)381 void helper_store_pidr(CPUPPCState *env, target_ulong val)
382 {
383 env->spr[SPR_BOOKS_PID] = (uint32_t)val;
384 tlb_flush(env_cpu(env));
385 }
386
helper_store_lpidr(CPUPPCState * env,target_ulong val)387 void helper_store_lpidr(CPUPPCState *env, target_ulong val)
388 {
389 env->spr[SPR_LPIDR] = (uint32_t)val;
390
391 /*
392 * We need to flush the TLB on LPID changes as we only tag HV vs
393 * guest in TCG TLB. Also the quadrants means the HV will
394 * potentially access and cache entries for the current LPID as
395 * well.
396 */
397 tlb_flush(env_cpu(env));
398 }
399
helper_store_40x_dbcr0(CPUPPCState * env,target_ulong val)400 void helper_store_40x_dbcr0(CPUPPCState *env, target_ulong val)
401 {
402 /* Bits 26 & 27 affect single-stepping. */
403 hreg_compute_hflags(env);
404 /* Bits 28 & 29 affect reset or shutdown. */
405 store_40x_dbcr0(env, val);
406 }
407
helper_store_40x_sler(CPUPPCState * env,target_ulong val)408 void helper_store_40x_sler(CPUPPCState *env, target_ulong val)
409 {
410 store_40x_sler(env, val);
411 }
412 #endif
413
414 /*****************************************************************************/
415 /* Special registers manipulation */
416
417 /*
418 * This code is lifted from MacOnLinux. It is called whenever THRM1,2
419 * or 3 is read an fixes up the values in such a way that will make
420 * MacOS not hang. These registers exist on some 75x and 74xx
421 * processors.
422 */
helper_fixup_thrm(CPUPPCState * env)423 void helper_fixup_thrm(CPUPPCState *env)
424 {
425 target_ulong v, t;
426 int i;
427
428 #define THRM1_TIN (1 << 31)
429 #define THRM1_TIV (1 << 30)
430 #define THRM1_THRES(x) (((x) & 0x7f) << 23)
431 #define THRM1_TID (1 << 2)
432 #define THRM1_TIE (1 << 1)
433 #define THRM1_V (1 << 0)
434 #define THRM3_E (1 << 0)
435
436 if (!(env->spr[SPR_THRM3] & THRM3_E)) {
437 return;
438 }
439
440 /* Note: Thermal interrupts are unimplemented */
441 for (i = SPR_THRM1; i <= SPR_THRM2; i++) {
442 v = env->spr[i];
443 if (!(v & THRM1_V)) {
444 continue;
445 }
446 v |= THRM1_TIV;
447 v &= ~THRM1_TIN;
448 t = v & THRM1_THRES(127);
449 if ((v & THRM1_TID) && t < THRM1_THRES(24)) {
450 v |= THRM1_TIN;
451 }
452 if (!(v & THRM1_TID) && t > THRM1_THRES(24)) {
453 v |= THRM1_TIN;
454 }
455 env->spr[i] = v;
456 }
457 }
458
459 #if !defined(CONFIG_USER_ONLY)
460 #if defined(TARGET_PPC64)
helper_clrbhrb(CPUPPCState * env)461 void helper_clrbhrb(CPUPPCState *env)
462 {
463 helper_hfscr_facility_check(env, HFSCR_BHRB, "clrbhrb", FSCR_IC_BHRB);
464
465 helper_mmcr0_facility_check(env, MMCR0_BHRBA_NR, 0, FSCR_IC_BHRB);
466
467 if (env->flags & POWERPC_FLAG_BHRB) {
468 memset(env->bhrb, 0, sizeof(env->bhrb));
469 }
470 }
471
helper_mfbhrbe(CPUPPCState * env,uint32_t bhrbe)472 uint64_t helper_mfbhrbe(CPUPPCState *env, uint32_t bhrbe)
473 {
474 unsigned int index;
475
476 helper_hfscr_facility_check(env, HFSCR_BHRB, "mfbhrbe", FSCR_IC_BHRB);
477
478 helper_mmcr0_facility_check(env, MMCR0_BHRBA_NR, 0, FSCR_IC_BHRB);
479
480 if (!(env->flags & POWERPC_FLAG_BHRB) ||
481 (bhrbe >= env->bhrb_num_entries) ||
482 (env->spr[SPR_POWER_MMCR0] & MMCR0_PMAE)) {
483 return 0;
484 }
485
486 /*
487 * Note: bhrb_offset is the byte offset for writing the
488 * next entry (over the oldest entry), which is why we
489 * must offset bhrbe by 1 to get to the 0th entry.
490 */
491 index = ((env->bhrb_offset / sizeof(uint64_t)) - (bhrbe + 1)) %
492 env->bhrb_num_entries;
493 return env->bhrb[index];
494 }
495 #endif
496 #endif
497