1 /* 2 * PowerPC emulation helpers for QEMU. 3 * 4 * Copyright (c) 2003-2007 Jocelyn Mayer 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2.1 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 #include "qemu/osdep.h" 20 #include "cpu.h" 21 #include "hw/ppc/ppc.h" 22 #include "exec/helper-proto.h" 23 #include "exec/exec-all.h" 24 #include "qemu/log.h" 25 #include "qemu/main-loop.h" 26 27 /*****************************************************************************/ 28 /* SPR accesses */ 29 30 target_ulong helper_load_tbl(CPUPPCState *env) 31 { 32 return (target_ulong)cpu_ppc_load_tbl(env); 33 } 34 35 target_ulong helper_load_tbu(CPUPPCState *env) 36 { 37 return cpu_ppc_load_tbu(env); 38 } 39 40 target_ulong helper_load_atbl(CPUPPCState *env) 41 { 42 return (target_ulong)cpu_ppc_load_atbl(env); 43 } 44 45 target_ulong helper_load_atbu(CPUPPCState *env) 46 { 47 return cpu_ppc_load_atbu(env); 48 } 49 50 target_ulong helper_load_vtb(CPUPPCState *env) 51 { 52 return cpu_ppc_load_vtb(env); 53 } 54 55 #if defined(TARGET_PPC64) && !defined(CONFIG_USER_ONLY) 56 target_ulong helper_load_purr(CPUPPCState *env) 57 { 58 return (target_ulong)cpu_ppc_load_purr(env); 59 } 60 61 void helper_store_purr(CPUPPCState *env, target_ulong val) 62 { 63 CPUState *cs = env_cpu(env); 64 CPUState *ccs; 65 66 if (ppc_cpu_lpar_single_threaded(cs)) { 67 cpu_ppc_store_purr(env, val); 68 return; 69 } 70 71 THREAD_SIBLING_FOREACH(cs, ccs) { 72 CPUPPCState *cenv = &POWERPC_CPU(ccs)->env; 73 cpu_ppc_store_purr(cenv, val); 74 } 75 } 76 #endif 77 78 #if !defined(CONFIG_USER_ONLY) 79 void helper_store_tbl(CPUPPCState *env, target_ulong val) 80 { 81 CPUState *cs = env_cpu(env); 82 CPUState *ccs; 83 84 if (ppc_cpu_lpar_single_threaded(cs)) { 85 cpu_ppc_store_tbl(env, val); 86 return; 87 } 88 89 THREAD_SIBLING_FOREACH(cs, ccs) { 90 CPUPPCState *cenv = &POWERPC_CPU(ccs)->env; 91 cpu_ppc_store_tbl(cenv, val); 92 } 93 } 94 95 void helper_store_tbu(CPUPPCState *env, target_ulong val) 96 { 97 CPUState *cs = env_cpu(env); 98 CPUState *ccs; 99 100 if (ppc_cpu_lpar_single_threaded(cs)) { 101 cpu_ppc_store_tbu(env, val); 102 return; 103 } 104 105 THREAD_SIBLING_FOREACH(cs, ccs) { 106 CPUPPCState *cenv = &POWERPC_CPU(ccs)->env; 107 cpu_ppc_store_tbu(cenv, val); 108 } 109 } 110 111 void helper_store_atbl(CPUPPCState *env, target_ulong val) 112 { 113 cpu_ppc_store_atbl(env, val); 114 } 115 116 void helper_store_atbu(CPUPPCState *env, target_ulong val) 117 { 118 cpu_ppc_store_atbu(env, val); 119 } 120 121 target_ulong helper_load_decr(CPUPPCState *env) 122 { 123 return cpu_ppc_load_decr(env); 124 } 125 126 void helper_store_decr(CPUPPCState *env, target_ulong val) 127 { 128 cpu_ppc_store_decr(env, val); 129 } 130 131 target_ulong helper_load_hdecr(CPUPPCState *env) 132 { 133 return cpu_ppc_load_hdecr(env); 134 } 135 136 void helper_store_hdecr(CPUPPCState *env, target_ulong val) 137 { 138 CPUState *cs = env_cpu(env); 139 CPUState *ccs; 140 141 if (ppc_cpu_lpar_single_threaded(cs)) { 142 cpu_ppc_store_hdecr(env, val); 143 return; 144 } 145 146 THREAD_SIBLING_FOREACH(cs, ccs) { 147 CPUPPCState *cenv = &POWERPC_CPU(ccs)->env; 148 cpu_ppc_store_hdecr(cenv, val); 149 } 150 } 151 152 void helper_store_vtb(CPUPPCState *env, target_ulong val) 153 { 154 CPUState *cs = env_cpu(env); 155 CPUState *ccs; 156 157 if (ppc_cpu_lpar_single_threaded(cs)) { 158 cpu_ppc_store_vtb(env, val); 159 return; 160 } 161 162 THREAD_SIBLING_FOREACH(cs, ccs) { 163 CPUPPCState *cenv = &POWERPC_CPU(ccs)->env; 164 cpu_ppc_store_vtb(cenv, val); 165 } 166 } 167 168 void helper_store_tbu40(CPUPPCState *env, target_ulong val) 169 { 170 CPUState *cs = env_cpu(env); 171 CPUState *ccs; 172 173 if (ppc_cpu_lpar_single_threaded(cs)) { 174 cpu_ppc_store_tbu40(env, val); 175 return; 176 } 177 178 THREAD_SIBLING_FOREACH(cs, ccs) { 179 CPUPPCState *cenv = &POWERPC_CPU(ccs)->env; 180 cpu_ppc_store_tbu40(cenv, val); 181 } 182 } 183 184 target_ulong helper_load_40x_pit(CPUPPCState *env) 185 { 186 return load_40x_pit(env); 187 } 188 189 void helper_store_40x_pit(CPUPPCState *env, target_ulong val) 190 { 191 store_40x_pit(env, val); 192 } 193 194 void helper_store_40x_tcr(CPUPPCState *env, target_ulong val) 195 { 196 store_40x_tcr(env, val); 197 } 198 199 void helper_store_40x_tsr(CPUPPCState *env, target_ulong val) 200 { 201 store_40x_tsr(env, val); 202 } 203 204 void helper_store_booke_tcr(CPUPPCState *env, target_ulong val) 205 { 206 store_booke_tcr(env, val); 207 } 208 209 void helper_store_booke_tsr(CPUPPCState *env, target_ulong val) 210 { 211 store_booke_tsr(env, val); 212 } 213 214 #if defined(TARGET_PPC64) && !defined(CONFIG_USER_ONLY) 215 /* 216 * qemu-user breaks with pnv headers, so they go under ifdefs for now. 217 * A clean up may be to move powernv specific registers and helpers into 218 * target/ppc/pnv_helper.c 219 */ 220 #include "hw/ppc/pnv_core.h" 221 /* 222 * POWER processor Timebase Facility 223 */ 224 225 /* 226 * The TBST is the timebase state machine, which is a per-core machine that 227 * is used to synchronize the core TB with the ChipTOD. States 3,4,5 are 228 * not used in POWER8/9/10. 229 * 230 * The state machine gets driven by writes to TFMR SPR from the core, and 231 * by signals from the ChipTOD. The state machine table for common 232 * transitions is as follows (according to hardware specs, not necessarily 233 * this implementation): 234 * 235 * | Cur | Event | New | 236 * +----------------+----------------------------------+-----+ 237 * | 0 RESET | TFMR |= LOAD_TOD_MOD | 1 | 238 * | 1 SEND_TOD_MOD | "immediate transition" | 2 | 239 * | 2 NOT_SET | mttbu/mttbu40/mttbl | 2 | 240 * | 2 NOT_SET | TFMR |= MOVE_CHIP_TOD_TO_TB | 6 | 241 * | 6 SYNC_WAIT | "sync pulse from ChipTOD" | 7 | 242 * | 7 GET_TOD | ChipTOD xscom MOVE_TOD_TO_TB_REG | 8 | 243 * | 8 TB_RUNNING | mttbu/mttbu40 | 8 | 244 * | 8 TB_RUNNING | TFMR |= LOAD_TOD_MOD | 1 | 245 * | 8 TB_RUNNING | mttbl | 9 | 246 * | 9 TB_ERROR | TFMR |= CLEAR_TB_ERRORS | 0 | 247 * 248 * - LOAD_TOD_MOD will also move states 2,6 to state 1, omitted from table 249 * because it's not a typical init flow. 250 * 251 * - The ERROR state can be entered from most/all other states on invalid 252 * states (e.g., if some TFMR control bit is set from a state where it's 253 * not listed to cause a transition away from), omitted to avoid clutter. 254 * 255 * Note: mttbl causes a timebase error because this inevitably causes 256 * ticks to be lost and TB to become unsynchronized, whereas TB can be 257 * adjusted using mttbu* without losing ticks. mttbl behaviour is not 258 * modelled. 259 * 260 * Note: the TB state machine does not actually cause any real TB adjustment! 261 * TB starts out synchronized across all vCPUs (hardware threads) in 262 * QMEU, so for now the purpose of the TBST and ChipTOD model is simply 263 * to step through firmware initialisation sequences. 264 */ 265 static unsigned int tfmr_get_tb_state(uint64_t tfmr) 266 { 267 return (tfmr & TFMR_TBST_ENCODED) >> (63 - 31); 268 } 269 270 static uint64_t tfmr_new_tb_state(uint64_t tfmr, unsigned int tbst) 271 { 272 tfmr &= ~TFMR_TBST_LAST; 273 tfmr |= (tfmr & TFMR_TBST_ENCODED) >> 4; /* move state to last state */ 274 tfmr &= ~TFMR_TBST_ENCODED; 275 tfmr |= (uint64_t)tbst << (63 - 31); /* move new state to state */ 276 277 if (tbst == TBST_TB_RUNNING) { 278 tfmr |= TFMR_TB_VALID; 279 } else { 280 tfmr &= ~TFMR_TB_VALID; 281 } 282 283 return tfmr; 284 } 285 286 static void write_tfmr(CPUPPCState *env, target_ulong val) 287 { 288 CPUState *cs = env_cpu(env); 289 290 if (ppc_cpu_core_single_threaded(cs)) { 291 env->spr[SPR_TFMR] = val; 292 } else { 293 CPUState *ccs; 294 THREAD_SIBLING_FOREACH(cs, ccs) { 295 CPUPPCState *cenv = &POWERPC_CPU(ccs)->env; 296 cenv->spr[SPR_TFMR] = val; 297 } 298 } 299 } 300 301 static PnvCoreTODState *cpu_get_tbst(PowerPCCPU *cpu) 302 { 303 PnvCore *pc = pnv_cpu_state(cpu)->pnv_core; 304 305 return &pc->tod_state; 306 } 307 308 static void tb_state_machine_step(CPUPPCState *env) 309 { 310 PowerPCCPU *cpu = env_archcpu(env); 311 PnvCoreTODState *tod_state = cpu_get_tbst(cpu); 312 uint64_t tfmr = env->spr[SPR_TFMR]; 313 unsigned int tbst = tfmr_get_tb_state(tfmr); 314 315 if (!(tfmr & TFMR_TB_ECLIPZ) || tbst == TBST_TB_ERROR) { 316 return; 317 } 318 319 if (tod_state->tb_sync_pulse_timer) { 320 tod_state->tb_sync_pulse_timer--; 321 } else { 322 tfmr |= TFMR_TB_SYNC_OCCURED; 323 write_tfmr(env, tfmr); 324 } 325 326 if (tod_state->tb_state_timer) { 327 tod_state->tb_state_timer--; 328 return; 329 } 330 331 if (tfmr & TFMR_LOAD_TOD_MOD) { 332 tfmr &= ~TFMR_LOAD_TOD_MOD; 333 if (tbst == TBST_GET_TOD) { 334 tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); 335 tfmr |= TFMR_FIRMWARE_CONTROL_ERROR; 336 } else { 337 tfmr = tfmr_new_tb_state(tfmr, TBST_SEND_TOD_MOD); 338 /* State seems to transition immediately */ 339 tfmr = tfmr_new_tb_state(tfmr, TBST_NOT_SET); 340 } 341 } else if (tfmr & TFMR_MOVE_CHIP_TOD_TO_TB) { 342 if (tbst == TBST_SYNC_WAIT) { 343 tfmr = tfmr_new_tb_state(tfmr, TBST_GET_TOD); 344 tod_state->tb_state_timer = 3; 345 } else if (tbst == TBST_GET_TOD) { 346 if (tod_state->tod_sent_to_tb) { 347 tfmr = tfmr_new_tb_state(tfmr, TBST_TB_RUNNING); 348 tfmr &= ~TFMR_MOVE_CHIP_TOD_TO_TB; 349 tod_state->tb_ready_for_tod = 0; 350 tod_state->tod_sent_to_tb = 0; 351 } 352 } else { 353 qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: MOVE_CHIP_TOD_TO_TB " 354 "state machine in invalid state 0x%x\n", tbst); 355 tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); 356 tfmr |= TFMR_FIRMWARE_CONTROL_ERROR; 357 tod_state->tb_ready_for_tod = 0; 358 } 359 } 360 361 write_tfmr(env, tfmr); 362 } 363 364 target_ulong helper_load_tfmr(CPUPPCState *env) 365 { 366 tb_state_machine_step(env); 367 368 return env->spr[SPR_TFMR] | TFMR_TB_ECLIPZ; 369 } 370 371 void helper_store_tfmr(CPUPPCState *env, target_ulong val) 372 { 373 PowerPCCPU *cpu = env_archcpu(env); 374 PnvCoreTODState *tod_state = cpu_get_tbst(cpu); 375 uint64_t tfmr = env->spr[SPR_TFMR]; 376 uint64_t clear_on_write; 377 unsigned int tbst = tfmr_get_tb_state(tfmr); 378 379 if (!(val & TFMR_TB_ECLIPZ)) { 380 qemu_log_mask(LOG_UNIMP, "TFMR non-ECLIPZ mode not implemented\n"); 381 tfmr &= ~TFMR_TBST_ENCODED; 382 tfmr &= ~TFMR_TBST_LAST; 383 goto out; 384 } 385 386 /* Update control bits */ 387 tfmr = (tfmr & ~TFMR_CONTROL_MASK) | (val & TFMR_CONTROL_MASK); 388 389 /* Several bits are clear-on-write, only one is implemented so far */ 390 clear_on_write = val & TFMR_FIRMWARE_CONTROL_ERROR; 391 tfmr &= ~clear_on_write; 392 393 /* 394 * mtspr always clears this. The sync pulse timer makes it come back 395 * after the second mfspr. 396 */ 397 tfmr &= ~TFMR_TB_SYNC_OCCURED; 398 tod_state->tb_sync_pulse_timer = 1; 399 400 if (((tfmr | val) & (TFMR_LOAD_TOD_MOD | TFMR_MOVE_CHIP_TOD_TO_TB)) == 401 (TFMR_LOAD_TOD_MOD | TFMR_MOVE_CHIP_TOD_TO_TB)) { 402 qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: LOAD_TOD_MOD and " 403 "MOVE_CHIP_TOD_TO_TB both set\n"); 404 tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); 405 tfmr |= TFMR_FIRMWARE_CONTROL_ERROR; 406 tod_state->tb_ready_for_tod = 0; 407 goto out; 408 } 409 410 if (tfmr & TFMR_CLEAR_TB_ERRORS) { 411 /* 412 * Workbook says TFMR_CLEAR_TB_ERRORS should be written twice. 413 * This is not simulated/required here. 414 */ 415 tfmr = tfmr_new_tb_state(tfmr, TBST_RESET); 416 tfmr &= ~TFMR_CLEAR_TB_ERRORS; 417 tfmr &= ~TFMR_LOAD_TOD_MOD; 418 tfmr &= ~TFMR_MOVE_CHIP_TOD_TO_TB; 419 tfmr &= ~TFMR_FIRMWARE_CONTROL_ERROR; /* XXX: should this be cleared? */ 420 tod_state->tb_ready_for_tod = 0; 421 tod_state->tod_sent_to_tb = 0; 422 goto out; 423 } 424 425 if (tbst == TBST_TB_ERROR) { 426 qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: mtspr TFMR in TB_ERROR" 427 " state\n"); 428 tfmr |= TFMR_FIRMWARE_CONTROL_ERROR; 429 return; 430 } 431 432 if (tfmr & TFMR_LOAD_TOD_MOD) { 433 /* Wait for an arbitrary 3 mfspr until the next state transition. */ 434 tod_state->tb_state_timer = 3; 435 } else if (tfmr & TFMR_MOVE_CHIP_TOD_TO_TB) { 436 if (tbst == TBST_NOT_SET) { 437 tfmr = tfmr_new_tb_state(tfmr, TBST_SYNC_WAIT); 438 tod_state->tb_ready_for_tod = 1; 439 tod_state->tb_state_timer = 3; /* arbitrary */ 440 } else { 441 qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: MOVE_CHIP_TOD_TO_TB " 442 "not in TB not set state 0x%x\n", 443 tbst); 444 tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); 445 tfmr |= TFMR_FIRMWARE_CONTROL_ERROR; 446 tod_state->tb_ready_for_tod = 0; 447 } 448 } 449 450 out: 451 write_tfmr(env, tfmr); 452 } 453 #endif 454 455 /*****************************************************************************/ 456 /* Embedded PowerPC specific helpers */ 457 458 /* XXX: to be improved to check access rights when in user-mode */ 459 target_ulong helper_load_dcr(CPUPPCState *env, target_ulong dcrn) 460 { 461 uint32_t val = 0; 462 463 if (unlikely(env->dcr_env == NULL)) { 464 qemu_log_mask(LOG_GUEST_ERROR, "No DCR environment\n"); 465 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 466 POWERPC_EXCP_INVAL | 467 POWERPC_EXCP_INVAL_INVAL, GETPC()); 468 } else { 469 int ret; 470 471 bql_lock(); 472 ret = ppc_dcr_read(env->dcr_env, (uint32_t)dcrn, &val); 473 bql_unlock(); 474 if (unlikely(ret != 0)) { 475 qemu_log_mask(LOG_GUEST_ERROR, "DCR read error %d %03x\n", 476 (uint32_t)dcrn, (uint32_t)dcrn); 477 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 478 POWERPC_EXCP_INVAL | 479 POWERPC_EXCP_INVAL_INVAL, GETPC()); 480 } 481 } 482 return val; 483 } 484 485 void helper_store_dcr(CPUPPCState *env, target_ulong dcrn, target_ulong val) 486 { 487 if (unlikely(env->dcr_env == NULL)) { 488 qemu_log_mask(LOG_GUEST_ERROR, "No DCR environment\n"); 489 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 490 POWERPC_EXCP_INVAL | 491 POWERPC_EXCP_INVAL_INVAL, GETPC()); 492 } else { 493 int ret; 494 bql_lock(); 495 ret = ppc_dcr_write(env->dcr_env, (uint32_t)dcrn, (uint32_t)val); 496 bql_unlock(); 497 if (unlikely(ret != 0)) { 498 qemu_log_mask(LOG_GUEST_ERROR, "DCR write error %d %03x\n", 499 (uint32_t)dcrn, (uint32_t)dcrn); 500 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 501 POWERPC_EXCP_INVAL | 502 POWERPC_EXCP_INVAL_INVAL, GETPC()); 503 } 504 } 505 } 506 #endif 507