1 /* 2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU. 3 * 4 * Copyright (c) 2003-2007 Jocelyn Mayer 5 * Copyright (c) 2013 David Gibson, IBM Corporation 6 * 7 * This library is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU Lesser General Public 9 * License as published by the Free Software Foundation; either 10 * version 2 of the License, or (at your option) any later version. 11 * 12 * This library is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 * Lesser General Public License for more details. 16 * 17 * You should have received a copy of the GNU Lesser General Public 18 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 19 */ 20 #include "qemu/osdep.h" 21 #include "qemu/units.h" 22 #include "cpu.h" 23 #include "exec/exec-all.h" 24 #include "exec/helper-proto.h" 25 #include "qemu/error-report.h" 26 #include "qemu/qemu-print.h" 27 #include "sysemu/hw_accel.h" 28 #include "kvm_ppc.h" 29 #include "mmu-hash64.h" 30 #include "exec/log.h" 31 #include "hw/hw.h" 32 #include "mmu-book3s-v3.h" 33 34 /* #define DEBUG_SLB */ 35 36 #ifdef DEBUG_SLB 37 # define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__) 38 #else 39 # define LOG_SLB(...) do { } while (0) 40 #endif 41 42 /* 43 * SLB handling 44 */ 45 46 static ppc_slb_t *slb_lookup(PowerPCCPU *cpu, target_ulong eaddr) 47 { 48 CPUPPCState *env = &cpu->env; 49 uint64_t esid_256M, esid_1T; 50 int n; 51 52 LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr); 53 54 esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V; 55 esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V; 56 57 for (n = 0; n < cpu->hash64_opts->slb_size; n++) { 58 ppc_slb_t *slb = &env->slb[n]; 59 60 LOG_SLB("%s: slot %d %016" PRIx64 " %016" 61 PRIx64 "\n", __func__, n, slb->esid, slb->vsid); 62 /* 63 * We check for 1T matches on all MMUs here - if the MMU 64 * doesn't have 1T segment support, we will have prevented 1T 65 * entries from being inserted in the slbmte code. 66 */ 67 if (((slb->esid == esid_256M) && 68 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M)) 69 || ((slb->esid == esid_1T) && 70 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) { 71 return slb; 72 } 73 } 74 75 return NULL; 76 } 77 78 void dump_slb(PowerPCCPU *cpu) 79 { 80 CPUPPCState *env = &cpu->env; 81 int i; 82 uint64_t slbe, slbv; 83 84 cpu_synchronize_state(CPU(cpu)); 85 86 qemu_printf("SLB\tESID\t\t\tVSID\n"); 87 for (i = 0; i < cpu->hash64_opts->slb_size; i++) { 88 slbe = env->slb[i].esid; 89 slbv = env->slb[i].vsid; 90 if (slbe == 0 && slbv == 0) { 91 continue; 92 } 93 qemu_printf("%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n", 94 i, slbe, slbv); 95 } 96 } 97 98 void helper_slbia(CPUPPCState *env) 99 { 100 PowerPCCPU *cpu = env_archcpu(env); 101 int n; 102 103 /* XXX: Warning: slbia never invalidates the first segment */ 104 for (n = 1; n < cpu->hash64_opts->slb_size; n++) { 105 ppc_slb_t *slb = &env->slb[n]; 106 107 if (slb->esid & SLB_ESID_V) { 108 slb->esid &= ~SLB_ESID_V; 109 /* 110 * XXX: given the fact that segment size is 256 MB or 1TB, 111 * and we still don't have a tlb_flush_mask(env, n, mask) 112 * in QEMU, we just invalidate all TLBs 113 */ 114 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH; 115 } 116 } 117 } 118 119 static void __helper_slbie(CPUPPCState *env, target_ulong addr, 120 target_ulong global) 121 { 122 PowerPCCPU *cpu = env_archcpu(env); 123 ppc_slb_t *slb; 124 125 slb = slb_lookup(cpu, addr); 126 if (!slb) { 127 return; 128 } 129 130 if (slb->esid & SLB_ESID_V) { 131 slb->esid &= ~SLB_ESID_V; 132 133 /* 134 * XXX: given the fact that segment size is 256 MB or 1TB, 135 * and we still don't have a tlb_flush_mask(env, n, mask) 136 * in QEMU, we just invalidate all TLBs 137 */ 138 env->tlb_need_flush |= 139 (global == false ? TLB_NEED_LOCAL_FLUSH : TLB_NEED_GLOBAL_FLUSH); 140 } 141 } 142 143 void helper_slbie(CPUPPCState *env, target_ulong addr) 144 { 145 __helper_slbie(env, addr, false); 146 } 147 148 void helper_slbieg(CPUPPCState *env, target_ulong addr) 149 { 150 __helper_slbie(env, addr, true); 151 } 152 153 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot, 154 target_ulong esid, target_ulong vsid) 155 { 156 CPUPPCState *env = &cpu->env; 157 ppc_slb_t *slb = &env->slb[slot]; 158 const PPCHash64SegmentPageSizes *sps = NULL; 159 int i; 160 161 if (slot >= cpu->hash64_opts->slb_size) { 162 return -1; /* Bad slot number */ 163 } 164 if (esid & ~(SLB_ESID_ESID | SLB_ESID_V)) { 165 return -1; /* Reserved bits set */ 166 } 167 if (vsid & (SLB_VSID_B & ~SLB_VSID_B_1T)) { 168 return -1; /* Bad segment size */ 169 } 170 if ((vsid & SLB_VSID_B) && !(ppc_hash64_has(cpu, PPC_HASH64_1TSEG))) { 171 return -1; /* 1T segment on MMU that doesn't support it */ 172 } 173 174 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 175 const PPCHash64SegmentPageSizes *sps1 = &cpu->hash64_opts->sps[i]; 176 177 if (!sps1->page_shift) { 178 break; 179 } 180 181 if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) { 182 sps = sps1; 183 break; 184 } 185 } 186 187 if (!sps) { 188 error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu 189 " esid 0x"TARGET_FMT_lx" vsid 0x"TARGET_FMT_lx, 190 slot, esid, vsid); 191 return -1; 192 } 193 194 slb->esid = esid; 195 slb->vsid = vsid; 196 slb->sps = sps; 197 198 LOG_SLB("%s: " TARGET_FMT_lu " " TARGET_FMT_lx " - " TARGET_FMT_lx 199 " => %016" PRIx64 " %016" PRIx64 "\n", __func__, slot, esid, vsid, 200 slb->esid, slb->vsid); 201 202 return 0; 203 } 204 205 static int ppc_load_slb_esid(PowerPCCPU *cpu, target_ulong rb, 206 target_ulong *rt) 207 { 208 CPUPPCState *env = &cpu->env; 209 int slot = rb & 0xfff; 210 ppc_slb_t *slb = &env->slb[slot]; 211 212 if (slot >= cpu->hash64_opts->slb_size) { 213 return -1; 214 } 215 216 *rt = slb->esid; 217 return 0; 218 } 219 220 static int ppc_load_slb_vsid(PowerPCCPU *cpu, target_ulong rb, 221 target_ulong *rt) 222 { 223 CPUPPCState *env = &cpu->env; 224 int slot = rb & 0xfff; 225 ppc_slb_t *slb = &env->slb[slot]; 226 227 if (slot >= cpu->hash64_opts->slb_size) { 228 return -1; 229 } 230 231 *rt = slb->vsid; 232 return 0; 233 } 234 235 static int ppc_find_slb_vsid(PowerPCCPU *cpu, target_ulong rb, 236 target_ulong *rt) 237 { 238 CPUPPCState *env = &cpu->env; 239 ppc_slb_t *slb; 240 241 if (!msr_is_64bit(env, env->msr)) { 242 rb &= 0xffffffff; 243 } 244 slb = slb_lookup(cpu, rb); 245 if (slb == NULL) { 246 *rt = (target_ulong)-1ul; 247 } else { 248 *rt = slb->vsid; 249 } 250 return 0; 251 } 252 253 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs) 254 { 255 PowerPCCPU *cpu = env_archcpu(env); 256 257 if (ppc_store_slb(cpu, rb & 0xfff, rb & ~0xfffULL, rs) < 0) { 258 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 259 POWERPC_EXCP_INVAL, GETPC()); 260 } 261 } 262 263 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb) 264 { 265 PowerPCCPU *cpu = env_archcpu(env); 266 target_ulong rt = 0; 267 268 if (ppc_load_slb_esid(cpu, rb, &rt) < 0) { 269 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 270 POWERPC_EXCP_INVAL, GETPC()); 271 } 272 return rt; 273 } 274 275 target_ulong helper_find_slb_vsid(CPUPPCState *env, target_ulong rb) 276 { 277 PowerPCCPU *cpu = env_archcpu(env); 278 target_ulong rt = 0; 279 280 if (ppc_find_slb_vsid(cpu, rb, &rt) < 0) { 281 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 282 POWERPC_EXCP_INVAL, GETPC()); 283 } 284 return rt; 285 } 286 287 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb) 288 { 289 PowerPCCPU *cpu = env_archcpu(env); 290 target_ulong rt = 0; 291 292 if (ppc_load_slb_vsid(cpu, rb, &rt) < 0) { 293 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 294 POWERPC_EXCP_INVAL, GETPC()); 295 } 296 return rt; 297 } 298 299 /* Check No-Execute or Guarded Storage */ 300 static inline int ppc_hash64_pte_noexec_guard(PowerPCCPU *cpu, 301 ppc_hash_pte64_t pte) 302 { 303 /* Exec permissions CANNOT take away read or write permissions */ 304 return (pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G) ? 305 PAGE_READ | PAGE_WRITE : PAGE_READ | PAGE_WRITE | PAGE_EXEC; 306 } 307 308 /* Check Basic Storage Protection */ 309 static int ppc_hash64_pte_prot(PowerPCCPU *cpu, 310 ppc_slb_t *slb, ppc_hash_pte64_t pte) 311 { 312 CPUPPCState *env = &cpu->env; 313 unsigned pp, key; 314 /* 315 * Some pp bit combinations have undefined behaviour, so default 316 * to no access in those cases 317 */ 318 int prot = 0; 319 320 key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP) 321 : (slb->vsid & SLB_VSID_KS)); 322 pp = (pte.pte1 & HPTE64_R_PP) | ((pte.pte1 & HPTE64_R_PP0) >> 61); 323 324 if (key == 0) { 325 switch (pp) { 326 case 0x0: 327 case 0x1: 328 case 0x2: 329 prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 330 break; 331 332 case 0x3: 333 case 0x6: 334 prot = PAGE_READ | PAGE_EXEC; 335 break; 336 } 337 } else { 338 switch (pp) { 339 case 0x0: 340 case 0x6: 341 break; 342 343 case 0x1: 344 case 0x3: 345 prot = PAGE_READ | PAGE_EXEC; 346 break; 347 348 case 0x2: 349 prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 350 break; 351 } 352 } 353 354 return prot; 355 } 356 357 /* Check the instruction access permissions specified in the IAMR */ 358 static int ppc_hash64_iamr_prot(PowerPCCPU *cpu, int key) 359 { 360 CPUPPCState *env = &cpu->env; 361 int iamr_bits = (env->spr[SPR_IAMR] >> 2 * (31 - key)) & 0x3; 362 363 /* 364 * An instruction fetch is permitted if the IAMR bit is 0. 365 * If the bit is set, return PAGE_READ | PAGE_WRITE because this bit 366 * can only take away EXEC permissions not READ or WRITE permissions. 367 * If bit is cleared return PAGE_READ | PAGE_WRITE | PAGE_EXEC since 368 * EXEC permissions are allowed. 369 */ 370 return (iamr_bits & 0x1) ? PAGE_READ | PAGE_WRITE : 371 PAGE_READ | PAGE_WRITE | PAGE_EXEC; 372 } 373 374 static int ppc_hash64_amr_prot(PowerPCCPU *cpu, ppc_hash_pte64_t pte) 375 { 376 CPUPPCState *env = &cpu->env; 377 int key, amrbits; 378 int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 379 380 /* Only recent MMUs implement Virtual Page Class Key Protection */ 381 if (!ppc_hash64_has(cpu, PPC_HASH64_AMR)) { 382 return prot; 383 } 384 385 key = HPTE64_R_KEY(pte.pte1); 386 amrbits = (env->spr[SPR_AMR] >> 2 * (31 - key)) & 0x3; 387 388 /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */ 389 /* env->spr[SPR_AMR]); */ 390 391 /* 392 * A store is permitted if the AMR bit is 0. Remove write 393 * protection if it is set. 394 */ 395 if (amrbits & 0x2) { 396 prot &= ~PAGE_WRITE; 397 } 398 /* 399 * A load is permitted if the AMR bit is 0. Remove read 400 * protection if it is set. 401 */ 402 if (amrbits & 0x1) { 403 prot &= ~PAGE_READ; 404 } 405 406 switch (env->mmu_model) { 407 /* 408 * MMU version 2.07 and later support IAMR 409 * Check if the IAMR allows the instruction access - it will return 410 * PAGE_EXEC if it doesn't (and thus that bit will be cleared) or 0 411 * if it does (and prot will be unchanged indicating execution support). 412 */ 413 case POWERPC_MMU_2_07: 414 case POWERPC_MMU_3_00: 415 prot &= ppc_hash64_iamr_prot(cpu, key); 416 break; 417 default: 418 break; 419 } 420 421 return prot; 422 } 423 424 const ppc_hash_pte64_t *ppc_hash64_map_hptes(PowerPCCPU *cpu, 425 hwaddr ptex, int n) 426 { 427 hwaddr pte_offset = ptex * HASH_PTE_SIZE_64; 428 hwaddr base; 429 hwaddr plen = n * HASH_PTE_SIZE_64; 430 const ppc_hash_pte64_t *hptes; 431 432 if (cpu->vhyp) { 433 PPCVirtualHypervisorClass *vhc = 434 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp); 435 return vhc->map_hptes(cpu->vhyp, ptex, n); 436 } 437 base = ppc_hash64_hpt_base(cpu); 438 439 if (!base) { 440 return NULL; 441 } 442 443 hptes = address_space_map(CPU(cpu)->as, base + pte_offset, &plen, false, 444 MEMTXATTRS_UNSPECIFIED); 445 if (plen < (n * HASH_PTE_SIZE_64)) { 446 hw_error("%s: Unable to map all requested HPTEs\n", __func__); 447 } 448 return hptes; 449 } 450 451 void ppc_hash64_unmap_hptes(PowerPCCPU *cpu, const ppc_hash_pte64_t *hptes, 452 hwaddr ptex, int n) 453 { 454 if (cpu->vhyp) { 455 PPCVirtualHypervisorClass *vhc = 456 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp); 457 vhc->unmap_hptes(cpu->vhyp, hptes, ptex, n); 458 return; 459 } 460 461 address_space_unmap(CPU(cpu)->as, (void *)hptes, n * HASH_PTE_SIZE_64, 462 false, n * HASH_PTE_SIZE_64); 463 } 464 465 static unsigned hpte_page_shift(const PPCHash64SegmentPageSizes *sps, 466 uint64_t pte0, uint64_t pte1) 467 { 468 int i; 469 470 if (!(pte0 & HPTE64_V_LARGE)) { 471 if (sps->page_shift != 12) { 472 /* 4kiB page in a non 4kiB segment */ 473 return 0; 474 } 475 /* Normal 4kiB page */ 476 return 12; 477 } 478 479 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 480 const PPCHash64PageSize *ps = &sps->enc[i]; 481 uint64_t mask; 482 483 if (!ps->page_shift) { 484 break; 485 } 486 487 if (ps->page_shift == 12) { 488 /* L bit is set so this can't be a 4kiB page */ 489 continue; 490 } 491 492 mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN; 493 494 if ((pte1 & mask) == ((uint64_t)ps->pte_enc << HPTE64_R_RPN_SHIFT)) { 495 return ps->page_shift; 496 } 497 } 498 499 return 0; /* Bad page size encoding */ 500 } 501 502 static void ppc64_v3_new_to_old_hpte(target_ulong *pte0, target_ulong *pte1) 503 { 504 /* Insert B into pte0 */ 505 *pte0 = (*pte0 & HPTE64_V_COMMON_BITS) | 506 ((*pte1 & HPTE64_R_3_0_SSIZE_MASK) << 507 (HPTE64_V_SSIZE_SHIFT - HPTE64_R_3_0_SSIZE_SHIFT)); 508 509 /* Remove B from pte1 */ 510 *pte1 = *pte1 & ~HPTE64_R_3_0_SSIZE_MASK; 511 } 512 513 514 static hwaddr ppc_hash64_pteg_search(PowerPCCPU *cpu, hwaddr hash, 515 const PPCHash64SegmentPageSizes *sps, 516 target_ulong ptem, 517 ppc_hash_pte64_t *pte, unsigned *pshift) 518 { 519 int i; 520 const ppc_hash_pte64_t *pteg; 521 target_ulong pte0, pte1; 522 target_ulong ptex; 523 524 ptex = (hash & ppc_hash64_hpt_mask(cpu)) * HPTES_PER_GROUP; 525 pteg = ppc_hash64_map_hptes(cpu, ptex, HPTES_PER_GROUP); 526 if (!pteg) { 527 return -1; 528 } 529 for (i = 0; i < HPTES_PER_GROUP; i++) { 530 pte0 = ppc_hash64_hpte0(cpu, pteg, i); 531 /* 532 * pte0 contains the valid bit and must be read before pte1, 533 * otherwise we might see an old pte1 with a new valid bit and 534 * thus an inconsistent hpte value 535 */ 536 smp_rmb(); 537 pte1 = ppc_hash64_hpte1(cpu, pteg, i); 538 539 /* Convert format if necessary */ 540 if (cpu->env.mmu_model == POWERPC_MMU_3_00 && !cpu->vhyp) { 541 ppc64_v3_new_to_old_hpte(&pte0, &pte1); 542 } 543 544 /* This compares V, B, H (secondary) and the AVPN */ 545 if (HPTE64_V_COMPARE(pte0, ptem)) { 546 *pshift = hpte_page_shift(sps, pte0, pte1); 547 /* 548 * If there is no match, ignore the PTE, it could simply 549 * be for a different segment size encoding and the 550 * architecture specifies we should not match. Linux will 551 * potentially leave behind PTEs for the wrong base page 552 * size when demoting segments. 553 */ 554 if (*pshift == 0) { 555 continue; 556 } 557 /* 558 * We don't do anything with pshift yet as qemu TLB only 559 * deals with 4K pages anyway 560 */ 561 pte->pte0 = pte0; 562 pte->pte1 = pte1; 563 ppc_hash64_unmap_hptes(cpu, pteg, ptex, HPTES_PER_GROUP); 564 return ptex + i; 565 } 566 } 567 ppc_hash64_unmap_hptes(cpu, pteg, ptex, HPTES_PER_GROUP); 568 /* 569 * We didn't find a valid entry. 570 */ 571 return -1; 572 } 573 574 static hwaddr ppc_hash64_htab_lookup(PowerPCCPU *cpu, 575 ppc_slb_t *slb, target_ulong eaddr, 576 ppc_hash_pte64_t *pte, unsigned *pshift) 577 { 578 CPUPPCState *env = &cpu->env; 579 hwaddr hash, ptex; 580 uint64_t vsid, epnmask, epn, ptem; 581 const PPCHash64SegmentPageSizes *sps = slb->sps; 582 583 /* 584 * The SLB store path should prevent any bad page size encodings 585 * getting in there, so: 586 */ 587 assert(sps); 588 589 /* If ISL is set in LPCR we need to clamp the page size to 4K */ 590 if (env->spr[SPR_LPCR] & LPCR_ISL) { 591 /* We assume that when using TCG, 4k is first entry of SPS */ 592 sps = &cpu->hash64_opts->sps[0]; 593 assert(sps->page_shift == 12); 594 } 595 596 epnmask = ~((1ULL << sps->page_shift) - 1); 597 598 if (slb->vsid & SLB_VSID_B) { 599 /* 1TB segment */ 600 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T; 601 epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask; 602 hash = vsid ^ (vsid << 25) ^ (epn >> sps->page_shift); 603 } else { 604 /* 256M segment */ 605 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT; 606 epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask; 607 hash = vsid ^ (epn >> sps->page_shift); 608 } 609 ptem = (slb->vsid & SLB_VSID_PTEM) | ((epn >> 16) & HPTE64_V_AVPN); 610 ptem |= HPTE64_V_VALID; 611 612 /* Page address translation */ 613 qemu_log_mask(CPU_LOG_MMU, 614 "htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx 615 " hash " TARGET_FMT_plx "\n", 616 ppc_hash64_hpt_base(cpu), ppc_hash64_hpt_mask(cpu), hash); 617 618 /* Primary PTEG lookup */ 619 qemu_log_mask(CPU_LOG_MMU, 620 "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx 621 " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx 622 " hash=" TARGET_FMT_plx "\n", 623 ppc_hash64_hpt_base(cpu), ppc_hash64_hpt_mask(cpu), 624 vsid, ptem, hash); 625 ptex = ppc_hash64_pteg_search(cpu, hash, sps, ptem, pte, pshift); 626 627 if (ptex == -1) { 628 /* Secondary PTEG lookup */ 629 ptem |= HPTE64_V_SECONDARY; 630 qemu_log_mask(CPU_LOG_MMU, 631 "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx 632 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx 633 " hash=" TARGET_FMT_plx "\n", ppc_hash64_hpt_base(cpu), 634 ppc_hash64_hpt_mask(cpu), vsid, ptem, ~hash); 635 636 ptex = ppc_hash64_pteg_search(cpu, ~hash, sps, ptem, pte, pshift); 637 } 638 639 return ptex; 640 } 641 642 unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU *cpu, 643 uint64_t pte0, uint64_t pte1) 644 { 645 int i; 646 647 if (!(pte0 & HPTE64_V_LARGE)) { 648 return 12; 649 } 650 651 /* 652 * The encodings in env->sps need to be carefully chosen so that 653 * this gives an unambiguous result. 654 */ 655 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 656 const PPCHash64SegmentPageSizes *sps = &cpu->hash64_opts->sps[i]; 657 unsigned shift; 658 659 if (!sps->page_shift) { 660 break; 661 } 662 663 shift = hpte_page_shift(sps, pte0, pte1); 664 if (shift) { 665 return shift; 666 } 667 } 668 669 return 0; 670 } 671 672 static bool ppc_hash64_use_vrma(CPUPPCState *env) 673 { 674 switch (env->mmu_model) { 675 case POWERPC_MMU_3_00: 676 /* 677 * ISAv3.0 (POWER9) always uses VRMA, the VPM0 field and RMOR 678 * register no longer exist 679 */ 680 return true; 681 682 default: 683 return !!(env->spr[SPR_LPCR] & LPCR_VPM0); 684 } 685 } 686 687 static void ppc_hash64_set_isi(CPUState *cs, uint64_t error_code) 688 { 689 CPUPPCState *env = &POWERPC_CPU(cs)->env; 690 bool vpm; 691 692 if (msr_ir) { 693 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1); 694 } else { 695 vpm = ppc_hash64_use_vrma(env); 696 } 697 if (vpm && !msr_hv) { 698 cs->exception_index = POWERPC_EXCP_HISI; 699 } else { 700 cs->exception_index = POWERPC_EXCP_ISI; 701 } 702 env->error_code = error_code; 703 } 704 705 static void ppc_hash64_set_dsi(CPUState *cs, uint64_t dar, uint64_t dsisr) 706 { 707 CPUPPCState *env = &POWERPC_CPU(cs)->env; 708 bool vpm; 709 710 if (msr_dr) { 711 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1); 712 } else { 713 vpm = ppc_hash64_use_vrma(env); 714 } 715 if (vpm && !msr_hv) { 716 cs->exception_index = POWERPC_EXCP_HDSI; 717 env->spr[SPR_HDAR] = dar; 718 env->spr[SPR_HDSISR] = dsisr; 719 } else { 720 cs->exception_index = POWERPC_EXCP_DSI; 721 env->spr[SPR_DAR] = dar; 722 env->spr[SPR_DSISR] = dsisr; 723 } 724 env->error_code = 0; 725 } 726 727 728 static void ppc_hash64_set_r(PowerPCCPU *cpu, hwaddr ptex, uint64_t pte1) 729 { 730 hwaddr base, offset = ptex * HASH_PTE_SIZE_64 + 16; 731 732 if (cpu->vhyp) { 733 PPCVirtualHypervisorClass *vhc = 734 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp); 735 vhc->hpte_set_r(cpu->vhyp, ptex, pte1); 736 return; 737 } 738 base = ppc_hash64_hpt_base(cpu); 739 740 741 /* The HW performs a non-atomic byte update */ 742 stb_phys(CPU(cpu)->as, base + offset, ((pte1 >> 8) & 0xff) | 0x01); 743 } 744 745 static void ppc_hash64_set_c(PowerPCCPU *cpu, hwaddr ptex, uint64_t pte1) 746 { 747 hwaddr base, offset = ptex * HASH_PTE_SIZE_64 + 15; 748 749 if (cpu->vhyp) { 750 PPCVirtualHypervisorClass *vhc = 751 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp); 752 vhc->hpte_set_c(cpu->vhyp, ptex, pte1); 753 return; 754 } 755 base = ppc_hash64_hpt_base(cpu); 756 757 /* The HW performs a non-atomic byte update */ 758 stb_phys(CPU(cpu)->as, base + offset, (pte1 & 0xff) | 0x80); 759 } 760 761 static target_ulong rmls_limit(PowerPCCPU *cpu) 762 { 763 CPUPPCState *env = &cpu->env; 764 /* 765 * In theory the meanings of RMLS values are implementation 766 * dependent. In practice, this seems to have been the set from 767 * POWER4+..POWER8, and RMLS is no longer supported in POWER9. 768 * 769 * Unsupported values mean the OS has shot itself in the 770 * foot. Return a 0-sized RMA in this case, which we expect 771 * to trigger an immediate DSI or ISI 772 */ 773 static const target_ulong rma_sizes[16] = { 774 [0] = 256 * GiB, 775 [1] = 16 * GiB, 776 [2] = 1 * GiB, 777 [3] = 64 * MiB, 778 [4] = 256 * MiB, 779 [7] = 128 * MiB, 780 [8] = 32 * MiB, 781 }; 782 target_ulong rmls = (env->spr[SPR_LPCR] & LPCR_RMLS) >> LPCR_RMLS_SHIFT; 783 784 return rma_sizes[rmls]; 785 } 786 787 static int build_vrma_slbe(PowerPCCPU *cpu, ppc_slb_t *slb) 788 { 789 CPUPPCState *env = &cpu->env; 790 target_ulong lpcr = env->spr[SPR_LPCR]; 791 uint32_t vrmasd = (lpcr & LPCR_VRMASD) >> LPCR_VRMASD_SHIFT; 792 target_ulong vsid = SLB_VSID_VRMA | ((vrmasd << 4) & SLB_VSID_LLP_MASK); 793 int i; 794 795 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 796 const PPCHash64SegmentPageSizes *sps = &cpu->hash64_opts->sps[i]; 797 798 if (!sps->page_shift) { 799 break; 800 } 801 802 if ((vsid & SLB_VSID_LLP_MASK) == sps->slb_enc) { 803 slb->esid = SLB_ESID_V; 804 slb->vsid = vsid; 805 slb->sps = sps; 806 return 0; 807 } 808 } 809 810 error_report("Bad page size encoding in LPCR[VRMASD]; LPCR=0x" 811 TARGET_FMT_lx"\n", lpcr); 812 813 return -1; 814 } 815 816 int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, 817 int rwx, int mmu_idx) 818 { 819 CPUState *cs = CPU(cpu); 820 CPUPPCState *env = &cpu->env; 821 ppc_slb_t vrma_slbe; 822 ppc_slb_t *slb; 823 unsigned apshift; 824 hwaddr ptex; 825 ppc_hash_pte64_t pte; 826 int exec_prot, pp_prot, amr_prot, prot; 827 const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC}; 828 hwaddr raddr; 829 830 assert((rwx == 0) || (rwx == 1) || (rwx == 2)); 831 832 /* 833 * Note on LPCR usage: 970 uses HID4, but our special variant of 834 * store_spr copies relevant fields into env->spr[SPR_LPCR]. 835 * Similarily we filter unimplemented bits when storing into LPCR 836 * depending on the MMU version. This code can thus just use the 837 * LPCR "as-is". 838 */ 839 840 /* 1. Handle real mode accesses */ 841 if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) { 842 /* 843 * Translation is supposedly "off", but in real mode the top 4 844 * effective address bits are (mostly) ignored 845 */ 846 raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL; 847 848 if (cpu->vhyp) { 849 /* 850 * In virtual hypervisor mode, there's nothing to do: 851 * EA == GPA == qemu guest address 852 */ 853 } else if (msr_hv || !env->has_hv_mode) { 854 /* In HV mode, add HRMOR if top EA bit is clear */ 855 if (!(eaddr >> 63)) { 856 raddr |= env->spr[SPR_HRMOR]; 857 } 858 } else if (ppc_hash64_use_vrma(env)) { 859 /* Emulated VRMA mode */ 860 slb = &vrma_slbe; 861 if (build_vrma_slbe(cpu, slb) != 0) { 862 /* Invalid VRMA setup, machine check */ 863 cs->exception_index = POWERPC_EXCP_MCHECK; 864 env->error_code = 0; 865 return 1; 866 } 867 868 goto skip_slb_search; 869 } else { 870 target_ulong limit = rmls_limit(cpu); 871 872 /* Emulated old-style RMO mode, bounds check against RMLS */ 873 if (raddr >= limit) { 874 if (rwx == 2) { 875 ppc_hash64_set_isi(cs, SRR1_PROTFAULT); 876 } else { 877 int dsisr = DSISR_PROTFAULT; 878 if (rwx == 1) { 879 dsisr |= DSISR_ISSTORE; 880 } 881 ppc_hash64_set_dsi(cs, eaddr, dsisr); 882 } 883 return 1; 884 } 885 886 raddr |= env->spr[SPR_RMOR]; 887 } 888 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK, 889 PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx, 890 TARGET_PAGE_SIZE); 891 return 0; 892 } 893 894 /* 2. Translation is on, so look up the SLB */ 895 slb = slb_lookup(cpu, eaddr); 896 if (!slb) { 897 /* No entry found, check if in-memory segment tables are in use */ 898 if (ppc64_use_proc_tbl(cpu)) { 899 /* TODO - Unsupported */ 900 error_report("Segment Table Support Unimplemented"); 901 exit(1); 902 } 903 /* Segment still not found, generate the appropriate interrupt */ 904 if (rwx == 2) { 905 cs->exception_index = POWERPC_EXCP_ISEG; 906 env->error_code = 0; 907 } else { 908 cs->exception_index = POWERPC_EXCP_DSEG; 909 env->error_code = 0; 910 env->spr[SPR_DAR] = eaddr; 911 } 912 return 1; 913 } 914 915 skip_slb_search: 916 917 /* 3. Check for segment level no-execute violation */ 918 if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) { 919 ppc_hash64_set_isi(cs, SRR1_NOEXEC_GUARD); 920 return 1; 921 } 922 923 /* 4. Locate the PTE in the hash table */ 924 ptex = ppc_hash64_htab_lookup(cpu, slb, eaddr, &pte, &apshift); 925 if (ptex == -1) { 926 if (rwx == 2) { 927 ppc_hash64_set_isi(cs, SRR1_NOPTE); 928 } else { 929 int dsisr = DSISR_NOPTE; 930 if (rwx == 1) { 931 dsisr |= DSISR_ISSTORE; 932 } 933 ppc_hash64_set_dsi(cs, eaddr, dsisr); 934 } 935 return 1; 936 } 937 qemu_log_mask(CPU_LOG_MMU, 938 "found PTE at index %08" HWADDR_PRIx "\n", ptex); 939 940 /* 5. Check access permissions */ 941 942 exec_prot = ppc_hash64_pte_noexec_guard(cpu, pte); 943 pp_prot = ppc_hash64_pte_prot(cpu, slb, pte); 944 amr_prot = ppc_hash64_amr_prot(cpu, pte); 945 prot = exec_prot & pp_prot & amr_prot; 946 947 if ((need_prot[rwx] & ~prot) != 0) { 948 /* Access right violation */ 949 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n"); 950 if (rwx == 2) { 951 int srr1 = 0; 952 if (PAGE_EXEC & ~exec_prot) { 953 srr1 |= SRR1_NOEXEC_GUARD; /* Access violates noexec or guard */ 954 } else if (PAGE_EXEC & ~pp_prot) { 955 srr1 |= SRR1_PROTFAULT; /* Access violates access authority */ 956 } 957 if (PAGE_EXEC & ~amr_prot) { 958 srr1 |= SRR1_IAMR; /* Access violates virt pg class key prot */ 959 } 960 ppc_hash64_set_isi(cs, srr1); 961 } else { 962 int dsisr = 0; 963 if (need_prot[rwx] & ~pp_prot) { 964 dsisr |= DSISR_PROTFAULT; 965 } 966 if (rwx == 1) { 967 dsisr |= DSISR_ISSTORE; 968 } 969 if (need_prot[rwx] & ~amr_prot) { 970 dsisr |= DSISR_AMR; 971 } 972 ppc_hash64_set_dsi(cs, eaddr, dsisr); 973 } 974 return 1; 975 } 976 977 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n"); 978 979 /* 6. Update PTE referenced and changed bits if necessary */ 980 981 if (!(pte.pte1 & HPTE64_R_R)) { 982 ppc_hash64_set_r(cpu, ptex, pte.pte1); 983 } 984 if (!(pte.pte1 & HPTE64_R_C)) { 985 if (rwx == 1) { 986 ppc_hash64_set_c(cpu, ptex, pte.pte1); 987 } else { 988 /* 989 * Treat the page as read-only for now, so that a later write 990 * will pass through this function again to set the C bit 991 */ 992 prot &= ~PAGE_WRITE; 993 } 994 } 995 996 /* 7. Determine the real address from the PTE */ 997 998 raddr = deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, eaddr); 999 1000 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK, 1001 prot, mmu_idx, 1ULL << apshift); 1002 1003 return 0; 1004 } 1005 1006 hwaddr ppc_hash64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr) 1007 { 1008 CPUPPCState *env = &cpu->env; 1009 ppc_slb_t vrma_slbe; 1010 ppc_slb_t *slb; 1011 hwaddr ptex, raddr; 1012 ppc_hash_pte64_t pte; 1013 unsigned apshift; 1014 1015 /* Handle real mode */ 1016 if (msr_dr == 0) { 1017 /* In real mode the top 4 effective address bits are ignored */ 1018 raddr = addr & 0x0FFFFFFFFFFFFFFFULL; 1019 1020 if (cpu->vhyp) { 1021 /* 1022 * In virtual hypervisor mode, there's nothing to do: 1023 * EA == GPA == qemu guest address 1024 */ 1025 return raddr; 1026 } else if ((msr_hv || !env->has_hv_mode) && !(addr >> 63)) { 1027 /* In HV mode, add HRMOR if top EA bit is clear */ 1028 return raddr | env->spr[SPR_HRMOR]; 1029 } else if (ppc_hash64_use_vrma(env)) { 1030 /* Emulated VRMA mode */ 1031 slb = &vrma_slbe; 1032 if (build_vrma_slbe(cpu, slb) != 0) { 1033 return -1; 1034 } 1035 } else { 1036 target_ulong limit = rmls_limit(cpu); 1037 1038 /* Emulated old-style RMO mode, bounds check against RMLS */ 1039 if (raddr >= limit) { 1040 return -1; 1041 } 1042 return raddr | env->spr[SPR_RMOR]; 1043 } 1044 } else { 1045 slb = slb_lookup(cpu, addr); 1046 if (!slb) { 1047 return -1; 1048 } 1049 } 1050 1051 ptex = ppc_hash64_htab_lookup(cpu, slb, addr, &pte, &apshift); 1052 if (ptex == -1) { 1053 return -1; 1054 } 1055 1056 return deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, addr) 1057 & TARGET_PAGE_MASK; 1058 } 1059 1060 void ppc_hash64_tlb_flush_hpte(PowerPCCPU *cpu, target_ulong ptex, 1061 target_ulong pte0, target_ulong pte1) 1062 { 1063 /* 1064 * XXX: given the fact that there are too many segments to 1065 * invalidate, and we still don't have a tlb_flush_mask(env, n, 1066 * mask) in QEMU, we just invalidate all TLBs 1067 */ 1068 cpu->env.tlb_need_flush = TLB_NEED_GLOBAL_FLUSH | TLB_NEED_LOCAL_FLUSH; 1069 } 1070 1071 void ppc_store_lpcr(PowerPCCPU *cpu, target_ulong val) 1072 { 1073 PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu); 1074 CPUPPCState *env = &cpu->env; 1075 1076 env->spr[SPR_LPCR] = val & pcc->lpcr_mask; 1077 } 1078 1079 void helper_store_lpcr(CPUPPCState *env, target_ulong val) 1080 { 1081 PowerPCCPU *cpu = env_archcpu(env); 1082 1083 ppc_store_lpcr(cpu, val); 1084 } 1085 1086 void ppc_hash64_init(PowerPCCPU *cpu) 1087 { 1088 CPUPPCState *env = &cpu->env; 1089 PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu); 1090 1091 if (!pcc->hash64_opts) { 1092 assert(!(env->mmu_model & POWERPC_MMU_64)); 1093 return; 1094 } 1095 1096 cpu->hash64_opts = g_memdup(pcc->hash64_opts, sizeof(*cpu->hash64_opts)); 1097 } 1098 1099 void ppc_hash64_finalize(PowerPCCPU *cpu) 1100 { 1101 g_free(cpu->hash64_opts); 1102 } 1103 1104 const PPCHash64Options ppc_hash64_opts_basic = { 1105 .flags = 0, 1106 .slb_size = 64, 1107 .sps = { 1108 { .page_shift = 12, /* 4K */ 1109 .slb_enc = 0, 1110 .enc = { { .page_shift = 12, .pte_enc = 0 } } 1111 }, 1112 { .page_shift = 24, /* 16M */ 1113 .slb_enc = 0x100, 1114 .enc = { { .page_shift = 24, .pte_enc = 0 } } 1115 }, 1116 }, 1117 }; 1118 1119 const PPCHash64Options ppc_hash64_opts_POWER7 = { 1120 .flags = PPC_HASH64_1TSEG | PPC_HASH64_AMR | PPC_HASH64_CI_LARGEPAGE, 1121 .slb_size = 32, 1122 .sps = { 1123 { 1124 .page_shift = 12, /* 4K */ 1125 .slb_enc = 0, 1126 .enc = { { .page_shift = 12, .pte_enc = 0 }, 1127 { .page_shift = 16, .pte_enc = 0x7 }, 1128 { .page_shift = 24, .pte_enc = 0x38 }, }, 1129 }, 1130 { 1131 .page_shift = 16, /* 64K */ 1132 .slb_enc = SLB_VSID_64K, 1133 .enc = { { .page_shift = 16, .pte_enc = 0x1 }, 1134 { .page_shift = 24, .pte_enc = 0x8 }, }, 1135 }, 1136 { 1137 .page_shift = 24, /* 16M */ 1138 .slb_enc = SLB_VSID_16M, 1139 .enc = { { .page_shift = 24, .pte_enc = 0 }, }, 1140 }, 1141 { 1142 .page_shift = 34, /* 16G */ 1143 .slb_enc = SLB_VSID_16G, 1144 .enc = { { .page_shift = 34, .pte_enc = 0x3 }, }, 1145 }, 1146 } 1147 }; 1148 1149 void ppc_hash64_filter_pagesizes(PowerPCCPU *cpu, 1150 bool (*cb)(void *, uint32_t, uint32_t), 1151 void *opaque) 1152 { 1153 PPCHash64Options *opts = cpu->hash64_opts; 1154 int i; 1155 int n = 0; 1156 bool ci_largepage = false; 1157 1158 assert(opts); 1159 1160 n = 0; 1161 for (i = 0; i < ARRAY_SIZE(opts->sps); i++) { 1162 PPCHash64SegmentPageSizes *sps = &opts->sps[i]; 1163 int j; 1164 int m = 0; 1165 1166 assert(n <= i); 1167 1168 if (!sps->page_shift) { 1169 break; 1170 } 1171 1172 for (j = 0; j < ARRAY_SIZE(sps->enc); j++) { 1173 PPCHash64PageSize *ps = &sps->enc[j]; 1174 1175 assert(m <= j); 1176 if (!ps->page_shift) { 1177 break; 1178 } 1179 1180 if (cb(opaque, sps->page_shift, ps->page_shift)) { 1181 if (ps->page_shift >= 16) { 1182 ci_largepage = true; 1183 } 1184 sps->enc[m++] = *ps; 1185 } 1186 } 1187 1188 /* Clear rest of the row */ 1189 for (j = m; j < ARRAY_SIZE(sps->enc); j++) { 1190 memset(&sps->enc[j], 0, sizeof(sps->enc[j])); 1191 } 1192 1193 if (m) { 1194 n++; 1195 } 1196 } 1197 1198 /* Clear the rest of the table */ 1199 for (i = n; i < ARRAY_SIZE(opts->sps); i++) { 1200 memset(&opts->sps[i], 0, sizeof(opts->sps[i])); 1201 } 1202 1203 if (!ci_largepage) { 1204 opts->flags &= ~PPC_HASH64_CI_LARGEPAGE; 1205 } 1206 } 1207