1 /* 2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU. 3 * 4 * Copyright (c) 2003-2007 Jocelyn Mayer 5 * Copyright (c) 2013 David Gibson, IBM Corporation 6 * 7 * This library is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU Lesser General Public 9 * License as published by the Free Software Foundation; either 10 * version 2 of the License, or (at your option) any later version. 11 * 12 * This library is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 * Lesser General Public License for more details. 16 * 17 * You should have received a copy of the GNU Lesser General Public 18 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 19 */ 20 #include "qemu/osdep.h" 21 #include "cpu.h" 22 #include "exec/exec-all.h" 23 #include "exec/helper-proto.h" 24 #include "qemu/error-report.h" 25 #include "sysemu/hw_accel.h" 26 #include "kvm_ppc.h" 27 #include "mmu-hash64.h" 28 #include "exec/log.h" 29 #include "hw/hw.h" 30 #include "mmu-book3s-v3.h" 31 32 //#define DEBUG_SLB 33 34 #ifdef DEBUG_SLB 35 # define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__) 36 #else 37 # define LOG_SLB(...) do { } while (0) 38 #endif 39 40 /* 41 * SLB handling 42 */ 43 44 static ppc_slb_t *slb_lookup(PowerPCCPU *cpu, target_ulong eaddr) 45 { 46 CPUPPCState *env = &cpu->env; 47 uint64_t esid_256M, esid_1T; 48 int n; 49 50 LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr); 51 52 esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V; 53 esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V; 54 55 for (n = 0; n < cpu->hash64_opts->slb_size; n++) { 56 ppc_slb_t *slb = &env->slb[n]; 57 58 LOG_SLB("%s: slot %d %016" PRIx64 " %016" 59 PRIx64 "\n", __func__, n, slb->esid, slb->vsid); 60 /* We check for 1T matches on all MMUs here - if the MMU 61 * doesn't have 1T segment support, we will have prevented 1T 62 * entries from being inserted in the slbmte code. */ 63 if (((slb->esid == esid_256M) && 64 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M)) 65 || ((slb->esid == esid_1T) && 66 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) { 67 return slb; 68 } 69 } 70 71 return NULL; 72 } 73 74 void dump_slb(FILE *f, fprintf_function cpu_fprintf, PowerPCCPU *cpu) 75 { 76 CPUPPCState *env = &cpu->env; 77 int i; 78 uint64_t slbe, slbv; 79 80 cpu_synchronize_state(CPU(cpu)); 81 82 cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n"); 83 for (i = 0; i < cpu->hash64_opts->slb_size; i++) { 84 slbe = env->slb[i].esid; 85 slbv = env->slb[i].vsid; 86 if (slbe == 0 && slbv == 0) { 87 continue; 88 } 89 cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n", 90 i, slbe, slbv); 91 } 92 } 93 94 void helper_slbia(CPUPPCState *env) 95 { 96 PowerPCCPU *cpu = ppc_env_get_cpu(env); 97 int n; 98 99 /* XXX: Warning: slbia never invalidates the first segment */ 100 for (n = 1; n < cpu->hash64_opts->slb_size; n++) { 101 ppc_slb_t *slb = &env->slb[n]; 102 103 if (slb->esid & SLB_ESID_V) { 104 slb->esid &= ~SLB_ESID_V; 105 /* XXX: given the fact that segment size is 256 MB or 1TB, 106 * and we still don't have a tlb_flush_mask(env, n, mask) 107 * in QEMU, we just invalidate all TLBs 108 */ 109 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH; 110 } 111 } 112 } 113 114 static void __helper_slbie(CPUPPCState *env, target_ulong addr, 115 target_ulong global) 116 { 117 PowerPCCPU *cpu = ppc_env_get_cpu(env); 118 ppc_slb_t *slb; 119 120 slb = slb_lookup(cpu, addr); 121 if (!slb) { 122 return; 123 } 124 125 if (slb->esid & SLB_ESID_V) { 126 slb->esid &= ~SLB_ESID_V; 127 128 /* XXX: given the fact that segment size is 256 MB or 1TB, 129 * and we still don't have a tlb_flush_mask(env, n, mask) 130 * in QEMU, we just invalidate all TLBs 131 */ 132 env->tlb_need_flush |= 133 (global == false ? TLB_NEED_LOCAL_FLUSH : TLB_NEED_GLOBAL_FLUSH); 134 } 135 } 136 137 void helper_slbie(CPUPPCState *env, target_ulong addr) 138 { 139 __helper_slbie(env, addr, false); 140 } 141 142 void helper_slbieg(CPUPPCState *env, target_ulong addr) 143 { 144 __helper_slbie(env, addr, true); 145 } 146 147 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot, 148 target_ulong esid, target_ulong vsid) 149 { 150 CPUPPCState *env = &cpu->env; 151 ppc_slb_t *slb = &env->slb[slot]; 152 const PPCHash64SegmentPageSizes *sps = NULL; 153 int i; 154 155 if (slot >= cpu->hash64_opts->slb_size) { 156 return -1; /* Bad slot number */ 157 } 158 if (esid & ~(SLB_ESID_ESID | SLB_ESID_V)) { 159 return -1; /* Reserved bits set */ 160 } 161 if (vsid & (SLB_VSID_B & ~SLB_VSID_B_1T)) { 162 return -1; /* Bad segment size */ 163 } 164 if ((vsid & SLB_VSID_B) && !(ppc_hash64_has(cpu, PPC_HASH64_1TSEG))) { 165 return -1; /* 1T segment on MMU that doesn't support it */ 166 } 167 168 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 169 const PPCHash64SegmentPageSizes *sps1 = &cpu->hash64_opts->sps[i]; 170 171 if (!sps1->page_shift) { 172 break; 173 } 174 175 if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) { 176 sps = sps1; 177 break; 178 } 179 } 180 181 if (!sps) { 182 error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu 183 " esid 0x"TARGET_FMT_lx" vsid 0x"TARGET_FMT_lx, 184 slot, esid, vsid); 185 return -1; 186 } 187 188 slb->esid = esid; 189 slb->vsid = vsid; 190 slb->sps = sps; 191 192 LOG_SLB("%s: " TARGET_FMT_lu " " TARGET_FMT_lx " - " TARGET_FMT_lx 193 " => %016" PRIx64 " %016" PRIx64 "\n", __func__, slot, esid, vsid, 194 slb->esid, slb->vsid); 195 196 return 0; 197 } 198 199 static int ppc_load_slb_esid(PowerPCCPU *cpu, target_ulong rb, 200 target_ulong *rt) 201 { 202 CPUPPCState *env = &cpu->env; 203 int slot = rb & 0xfff; 204 ppc_slb_t *slb = &env->slb[slot]; 205 206 if (slot >= cpu->hash64_opts->slb_size) { 207 return -1; 208 } 209 210 *rt = slb->esid; 211 return 0; 212 } 213 214 static int ppc_load_slb_vsid(PowerPCCPU *cpu, target_ulong rb, 215 target_ulong *rt) 216 { 217 CPUPPCState *env = &cpu->env; 218 int slot = rb & 0xfff; 219 ppc_slb_t *slb = &env->slb[slot]; 220 221 if (slot >= cpu->hash64_opts->slb_size) { 222 return -1; 223 } 224 225 *rt = slb->vsid; 226 return 0; 227 } 228 229 static int ppc_find_slb_vsid(PowerPCCPU *cpu, target_ulong rb, 230 target_ulong *rt) 231 { 232 CPUPPCState *env = &cpu->env; 233 ppc_slb_t *slb; 234 235 if (!msr_is_64bit(env, env->msr)) { 236 rb &= 0xffffffff; 237 } 238 slb = slb_lookup(cpu, rb); 239 if (slb == NULL) { 240 *rt = (target_ulong)-1ul; 241 } else { 242 *rt = slb->vsid; 243 } 244 return 0; 245 } 246 247 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs) 248 { 249 PowerPCCPU *cpu = ppc_env_get_cpu(env); 250 251 if (ppc_store_slb(cpu, rb & 0xfff, rb & ~0xfffULL, rs) < 0) { 252 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 253 POWERPC_EXCP_INVAL, GETPC()); 254 } 255 } 256 257 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb) 258 { 259 PowerPCCPU *cpu = ppc_env_get_cpu(env); 260 target_ulong rt = 0; 261 262 if (ppc_load_slb_esid(cpu, rb, &rt) < 0) { 263 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 264 POWERPC_EXCP_INVAL, GETPC()); 265 } 266 return rt; 267 } 268 269 target_ulong helper_find_slb_vsid(CPUPPCState *env, target_ulong rb) 270 { 271 PowerPCCPU *cpu = ppc_env_get_cpu(env); 272 target_ulong rt = 0; 273 274 if (ppc_find_slb_vsid(cpu, rb, &rt) < 0) { 275 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 276 POWERPC_EXCP_INVAL, GETPC()); 277 } 278 return rt; 279 } 280 281 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb) 282 { 283 PowerPCCPU *cpu = ppc_env_get_cpu(env); 284 target_ulong rt = 0; 285 286 if (ppc_load_slb_vsid(cpu, rb, &rt) < 0) { 287 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 288 POWERPC_EXCP_INVAL, GETPC()); 289 } 290 return rt; 291 } 292 293 /* Check No-Execute or Guarded Storage */ 294 static inline int ppc_hash64_pte_noexec_guard(PowerPCCPU *cpu, 295 ppc_hash_pte64_t pte) 296 { 297 /* Exec permissions CANNOT take away read or write permissions */ 298 return (pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G) ? 299 PAGE_READ | PAGE_WRITE : PAGE_READ | PAGE_WRITE | PAGE_EXEC; 300 } 301 302 /* Check Basic Storage Protection */ 303 static int ppc_hash64_pte_prot(PowerPCCPU *cpu, 304 ppc_slb_t *slb, ppc_hash_pte64_t pte) 305 { 306 CPUPPCState *env = &cpu->env; 307 unsigned pp, key; 308 /* Some pp bit combinations have undefined behaviour, so default 309 * to no access in those cases */ 310 int prot = 0; 311 312 key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP) 313 : (slb->vsid & SLB_VSID_KS)); 314 pp = (pte.pte1 & HPTE64_R_PP) | ((pte.pte1 & HPTE64_R_PP0) >> 61); 315 316 if (key == 0) { 317 switch (pp) { 318 case 0x0: 319 case 0x1: 320 case 0x2: 321 prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 322 break; 323 324 case 0x3: 325 case 0x6: 326 prot = PAGE_READ | PAGE_EXEC; 327 break; 328 } 329 } else { 330 switch (pp) { 331 case 0x0: 332 case 0x6: 333 break; 334 335 case 0x1: 336 case 0x3: 337 prot = PAGE_READ | PAGE_EXEC; 338 break; 339 340 case 0x2: 341 prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 342 break; 343 } 344 } 345 346 return prot; 347 } 348 349 /* Check the instruction access permissions specified in the IAMR */ 350 static int ppc_hash64_iamr_prot(PowerPCCPU *cpu, int key) 351 { 352 CPUPPCState *env = &cpu->env; 353 int iamr_bits = (env->spr[SPR_IAMR] >> 2 * (31 - key)) & 0x3; 354 355 /* 356 * An instruction fetch is permitted if the IAMR bit is 0. 357 * If the bit is set, return PAGE_READ | PAGE_WRITE because this bit 358 * can only take away EXEC permissions not READ or WRITE permissions. 359 * If bit is cleared return PAGE_READ | PAGE_WRITE | PAGE_EXEC since 360 * EXEC permissions are allowed. 361 */ 362 return (iamr_bits & 0x1) ? PAGE_READ | PAGE_WRITE : 363 PAGE_READ | PAGE_WRITE | PAGE_EXEC; 364 } 365 366 static int ppc_hash64_amr_prot(PowerPCCPU *cpu, ppc_hash_pte64_t pte) 367 { 368 CPUPPCState *env = &cpu->env; 369 int key, amrbits; 370 int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 371 372 /* Only recent MMUs implement Virtual Page Class Key Protection */ 373 if (!ppc_hash64_has(cpu, PPC_HASH64_AMR)) { 374 return prot; 375 } 376 377 key = HPTE64_R_KEY(pte.pte1); 378 amrbits = (env->spr[SPR_AMR] >> 2*(31 - key)) & 0x3; 379 380 /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */ 381 /* env->spr[SPR_AMR]); */ 382 383 /* 384 * A store is permitted if the AMR bit is 0. Remove write 385 * protection if it is set. 386 */ 387 if (amrbits & 0x2) { 388 prot &= ~PAGE_WRITE; 389 } 390 /* 391 * A load is permitted if the AMR bit is 0. Remove read 392 * protection if it is set. 393 */ 394 if (amrbits & 0x1) { 395 prot &= ~PAGE_READ; 396 } 397 398 switch (env->mmu_model) { 399 /* 400 * MMU version 2.07 and later support IAMR 401 * Check if the IAMR allows the instruction access - it will return 402 * PAGE_EXEC if it doesn't (and thus that bit will be cleared) or 0 403 * if it does (and prot will be unchanged indicating execution support). 404 */ 405 case POWERPC_MMU_2_07: 406 case POWERPC_MMU_3_00: 407 prot &= ppc_hash64_iamr_prot(cpu, key); 408 break; 409 default: 410 break; 411 } 412 413 return prot; 414 } 415 416 const ppc_hash_pte64_t *ppc_hash64_map_hptes(PowerPCCPU *cpu, 417 hwaddr ptex, int n) 418 { 419 hwaddr pte_offset = ptex * HASH_PTE_SIZE_64; 420 hwaddr base = ppc_hash64_hpt_base(cpu); 421 hwaddr plen = n * HASH_PTE_SIZE_64; 422 const ppc_hash_pte64_t *hptes; 423 424 if (cpu->vhyp) { 425 PPCVirtualHypervisorClass *vhc = 426 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp); 427 return vhc->map_hptes(cpu->vhyp, ptex, n); 428 } 429 430 if (!base) { 431 return NULL; 432 } 433 434 hptes = address_space_map(CPU(cpu)->as, base + pte_offset, &plen, false, 435 MEMTXATTRS_UNSPECIFIED); 436 if (plen < (n * HASH_PTE_SIZE_64)) { 437 hw_error("%s: Unable to map all requested HPTEs\n", __func__); 438 } 439 return hptes; 440 } 441 442 void ppc_hash64_unmap_hptes(PowerPCCPU *cpu, const ppc_hash_pte64_t *hptes, 443 hwaddr ptex, int n) 444 { 445 if (cpu->vhyp) { 446 PPCVirtualHypervisorClass *vhc = 447 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp); 448 vhc->unmap_hptes(cpu->vhyp, hptes, ptex, n); 449 return; 450 } 451 452 address_space_unmap(CPU(cpu)->as, (void *)hptes, n * HASH_PTE_SIZE_64, 453 false, n * HASH_PTE_SIZE_64); 454 } 455 456 static unsigned hpte_page_shift(const PPCHash64SegmentPageSizes *sps, 457 uint64_t pte0, uint64_t pte1) 458 { 459 int i; 460 461 if (!(pte0 & HPTE64_V_LARGE)) { 462 if (sps->page_shift != 12) { 463 /* 4kiB page in a non 4kiB segment */ 464 return 0; 465 } 466 /* Normal 4kiB page */ 467 return 12; 468 } 469 470 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 471 const PPCHash64PageSize *ps = &sps->enc[i]; 472 uint64_t mask; 473 474 if (!ps->page_shift) { 475 break; 476 } 477 478 if (ps->page_shift == 12) { 479 /* L bit is set so this can't be a 4kiB page */ 480 continue; 481 } 482 483 mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN; 484 485 if ((pte1 & mask) == ((uint64_t)ps->pte_enc << HPTE64_R_RPN_SHIFT)) { 486 return ps->page_shift; 487 } 488 } 489 490 return 0; /* Bad page size encoding */ 491 } 492 493 static hwaddr ppc_hash64_pteg_search(PowerPCCPU *cpu, hwaddr hash, 494 const PPCHash64SegmentPageSizes *sps, 495 target_ulong ptem, 496 ppc_hash_pte64_t *pte, unsigned *pshift) 497 { 498 int i; 499 const ppc_hash_pte64_t *pteg; 500 target_ulong pte0, pte1; 501 target_ulong ptex; 502 503 ptex = (hash & ppc_hash64_hpt_mask(cpu)) * HPTES_PER_GROUP; 504 pteg = ppc_hash64_map_hptes(cpu, ptex, HPTES_PER_GROUP); 505 if (!pteg) { 506 return -1; 507 } 508 for (i = 0; i < HPTES_PER_GROUP; i++) { 509 pte0 = ppc_hash64_hpte0(cpu, pteg, i); 510 pte1 = ppc_hash64_hpte1(cpu, pteg, i); 511 512 /* This compares V, B, H (secondary) and the AVPN */ 513 if (HPTE64_V_COMPARE(pte0, ptem)) { 514 *pshift = hpte_page_shift(sps, pte0, pte1); 515 /* 516 * If there is no match, ignore the PTE, it could simply 517 * be for a different segment size encoding and the 518 * architecture specifies we should not match. Linux will 519 * potentially leave behind PTEs for the wrong base page 520 * size when demoting segments. 521 */ 522 if (*pshift == 0) { 523 continue; 524 } 525 /* We don't do anything with pshift yet as qemu TLB only deals 526 * with 4K pages anyway 527 */ 528 pte->pte0 = pte0; 529 pte->pte1 = pte1; 530 ppc_hash64_unmap_hptes(cpu, pteg, ptex, HPTES_PER_GROUP); 531 return ptex + i; 532 } 533 } 534 ppc_hash64_unmap_hptes(cpu, pteg, ptex, HPTES_PER_GROUP); 535 /* 536 * We didn't find a valid entry. 537 */ 538 return -1; 539 } 540 541 static hwaddr ppc_hash64_htab_lookup(PowerPCCPU *cpu, 542 ppc_slb_t *slb, target_ulong eaddr, 543 ppc_hash_pte64_t *pte, unsigned *pshift) 544 { 545 CPUPPCState *env = &cpu->env; 546 hwaddr hash, ptex; 547 uint64_t vsid, epnmask, epn, ptem; 548 const PPCHash64SegmentPageSizes *sps = slb->sps; 549 550 /* The SLB store path should prevent any bad page size encodings 551 * getting in there, so: */ 552 assert(sps); 553 554 /* If ISL is set in LPCR we need to clamp the page size to 4K */ 555 if (env->spr[SPR_LPCR] & LPCR_ISL) { 556 /* We assume that when using TCG, 4k is first entry of SPS */ 557 sps = &cpu->hash64_opts->sps[0]; 558 assert(sps->page_shift == 12); 559 } 560 561 epnmask = ~((1ULL << sps->page_shift) - 1); 562 563 if (slb->vsid & SLB_VSID_B) { 564 /* 1TB segment */ 565 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T; 566 epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask; 567 hash = vsid ^ (vsid << 25) ^ (epn >> sps->page_shift); 568 } else { 569 /* 256M segment */ 570 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT; 571 epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask; 572 hash = vsid ^ (epn >> sps->page_shift); 573 } 574 ptem = (slb->vsid & SLB_VSID_PTEM) | ((epn >> 16) & HPTE64_V_AVPN); 575 ptem |= HPTE64_V_VALID; 576 577 /* Page address translation */ 578 qemu_log_mask(CPU_LOG_MMU, 579 "htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx 580 " hash " TARGET_FMT_plx "\n", 581 ppc_hash64_hpt_base(cpu), ppc_hash64_hpt_mask(cpu), hash); 582 583 /* Primary PTEG lookup */ 584 qemu_log_mask(CPU_LOG_MMU, 585 "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx 586 " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx 587 " hash=" TARGET_FMT_plx "\n", 588 ppc_hash64_hpt_base(cpu), ppc_hash64_hpt_mask(cpu), 589 vsid, ptem, hash); 590 ptex = ppc_hash64_pteg_search(cpu, hash, sps, ptem, pte, pshift); 591 592 if (ptex == -1) { 593 /* Secondary PTEG lookup */ 594 ptem |= HPTE64_V_SECONDARY; 595 qemu_log_mask(CPU_LOG_MMU, 596 "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx 597 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx 598 " hash=" TARGET_FMT_plx "\n", ppc_hash64_hpt_base(cpu), 599 ppc_hash64_hpt_mask(cpu), vsid, ptem, ~hash); 600 601 ptex = ppc_hash64_pteg_search(cpu, ~hash, sps, ptem, pte, pshift); 602 } 603 604 return ptex; 605 } 606 607 unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU *cpu, 608 uint64_t pte0, uint64_t pte1) 609 { 610 int i; 611 612 if (!(pte0 & HPTE64_V_LARGE)) { 613 return 12; 614 } 615 616 /* 617 * The encodings in env->sps need to be carefully chosen so that 618 * this gives an unambiguous result. 619 */ 620 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 621 const PPCHash64SegmentPageSizes *sps = &cpu->hash64_opts->sps[i]; 622 unsigned shift; 623 624 if (!sps->page_shift) { 625 break; 626 } 627 628 shift = hpte_page_shift(sps, pte0, pte1); 629 if (shift) { 630 return shift; 631 } 632 } 633 634 return 0; 635 } 636 637 static void ppc_hash64_set_isi(CPUState *cs, uint64_t error_code) 638 { 639 CPUPPCState *env = &POWERPC_CPU(cs)->env; 640 bool vpm; 641 642 if (msr_ir) { 643 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1); 644 } else { 645 switch (env->mmu_model) { 646 case POWERPC_MMU_3_00: 647 /* Field deprecated in ISAv3.00 - interrupts always go to hyperv */ 648 vpm = true; 649 break; 650 default: 651 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM0); 652 break; 653 } 654 } 655 if (vpm && !msr_hv) { 656 cs->exception_index = POWERPC_EXCP_HISI; 657 } else { 658 cs->exception_index = POWERPC_EXCP_ISI; 659 } 660 env->error_code = error_code; 661 } 662 663 static void ppc_hash64_set_dsi(CPUState *cs, uint64_t dar, uint64_t dsisr) 664 { 665 CPUPPCState *env = &POWERPC_CPU(cs)->env; 666 bool vpm; 667 668 if (msr_dr) { 669 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1); 670 } else { 671 switch (env->mmu_model) { 672 case POWERPC_MMU_3_00: 673 /* Field deprecated in ISAv3.00 - interrupts always go to hyperv */ 674 vpm = true; 675 break; 676 default: 677 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM0); 678 break; 679 } 680 } 681 if (vpm && !msr_hv) { 682 cs->exception_index = POWERPC_EXCP_HDSI; 683 env->spr[SPR_HDAR] = dar; 684 env->spr[SPR_HDSISR] = dsisr; 685 } else { 686 cs->exception_index = POWERPC_EXCP_DSI; 687 env->spr[SPR_DAR] = dar; 688 env->spr[SPR_DSISR] = dsisr; 689 } 690 env->error_code = 0; 691 } 692 693 694 int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, 695 int rwx, int mmu_idx) 696 { 697 CPUState *cs = CPU(cpu); 698 CPUPPCState *env = &cpu->env; 699 ppc_slb_t *slb; 700 unsigned apshift; 701 hwaddr ptex; 702 ppc_hash_pte64_t pte; 703 int exec_prot, pp_prot, amr_prot, prot; 704 uint64_t new_pte1; 705 const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC}; 706 hwaddr raddr; 707 708 assert((rwx == 0) || (rwx == 1) || (rwx == 2)); 709 710 /* Note on LPCR usage: 970 uses HID4, but our special variant 711 * of store_spr copies relevant fields into env->spr[SPR_LPCR]. 712 * Similarily we filter unimplemented bits when storing into 713 * LPCR depending on the MMU version. This code can thus just 714 * use the LPCR "as-is". 715 */ 716 717 /* 1. Handle real mode accesses */ 718 if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) { 719 /* Translation is supposedly "off" */ 720 /* In real mode the top 4 effective address bits are (mostly) ignored */ 721 raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL; 722 723 /* In HV mode, add HRMOR if top EA bit is clear */ 724 if (msr_hv || !env->has_hv_mode) { 725 if (!(eaddr >> 63)) { 726 raddr |= env->spr[SPR_HRMOR]; 727 } 728 } else { 729 /* Otherwise, check VPM for RMA vs VRMA */ 730 if (env->spr[SPR_LPCR] & LPCR_VPM0) { 731 slb = &env->vrma_slb; 732 if (slb->sps) { 733 goto skip_slb_search; 734 } 735 /* Not much else to do here */ 736 cs->exception_index = POWERPC_EXCP_MCHECK; 737 env->error_code = 0; 738 return 1; 739 } else if (raddr < env->rmls) { 740 /* RMA. Check bounds in RMLS */ 741 raddr |= env->spr[SPR_RMOR]; 742 } else { 743 /* The access failed, generate the approriate interrupt */ 744 if (rwx == 2) { 745 ppc_hash64_set_isi(cs, SRR1_PROTFAULT); 746 } else { 747 int dsisr = DSISR_PROTFAULT; 748 if (rwx == 1) { 749 dsisr |= DSISR_ISSTORE; 750 } 751 ppc_hash64_set_dsi(cs, eaddr, dsisr); 752 } 753 return 1; 754 } 755 } 756 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK, 757 PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx, 758 TARGET_PAGE_SIZE); 759 return 0; 760 } 761 762 /* 2. Translation is on, so look up the SLB */ 763 slb = slb_lookup(cpu, eaddr); 764 if (!slb) { 765 /* No entry found, check if in-memory segment tables are in use */ 766 if (ppc64_use_proc_tbl(cpu)) { 767 /* TODO - Unsupported */ 768 error_report("Segment Table Support Unimplemented"); 769 exit(1); 770 } 771 /* Segment still not found, generate the appropriate interrupt */ 772 if (rwx == 2) { 773 cs->exception_index = POWERPC_EXCP_ISEG; 774 env->error_code = 0; 775 } else { 776 cs->exception_index = POWERPC_EXCP_DSEG; 777 env->error_code = 0; 778 env->spr[SPR_DAR] = eaddr; 779 } 780 return 1; 781 } 782 783 skip_slb_search: 784 785 /* 3. Check for segment level no-execute violation */ 786 if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) { 787 ppc_hash64_set_isi(cs, SRR1_NOEXEC_GUARD); 788 return 1; 789 } 790 791 /* 4. Locate the PTE in the hash table */ 792 ptex = ppc_hash64_htab_lookup(cpu, slb, eaddr, &pte, &apshift); 793 if (ptex == -1) { 794 if (rwx == 2) { 795 ppc_hash64_set_isi(cs, SRR1_NOPTE); 796 } else { 797 int dsisr = DSISR_NOPTE; 798 if (rwx == 1) { 799 dsisr |= DSISR_ISSTORE; 800 } 801 ppc_hash64_set_dsi(cs, eaddr, dsisr); 802 } 803 return 1; 804 } 805 qemu_log_mask(CPU_LOG_MMU, 806 "found PTE at index %08" HWADDR_PRIx "\n", ptex); 807 808 /* 5. Check access permissions */ 809 810 exec_prot = ppc_hash64_pte_noexec_guard(cpu, pte); 811 pp_prot = ppc_hash64_pte_prot(cpu, slb, pte); 812 amr_prot = ppc_hash64_amr_prot(cpu, pte); 813 prot = exec_prot & pp_prot & amr_prot; 814 815 if ((need_prot[rwx] & ~prot) != 0) { 816 /* Access right violation */ 817 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n"); 818 if (rwx == 2) { 819 int srr1 = 0; 820 if (PAGE_EXEC & ~exec_prot) { 821 srr1 |= SRR1_NOEXEC_GUARD; /* Access violates noexec or guard */ 822 } else if (PAGE_EXEC & ~pp_prot) { 823 srr1 |= SRR1_PROTFAULT; /* Access violates access authority */ 824 } 825 if (PAGE_EXEC & ~amr_prot) { 826 srr1 |= SRR1_IAMR; /* Access violates virt pg class key prot */ 827 } 828 ppc_hash64_set_isi(cs, srr1); 829 } else { 830 int dsisr = 0; 831 if (need_prot[rwx] & ~pp_prot) { 832 dsisr |= DSISR_PROTFAULT; 833 } 834 if (rwx == 1) { 835 dsisr |= DSISR_ISSTORE; 836 } 837 if (need_prot[rwx] & ~amr_prot) { 838 dsisr |= DSISR_AMR; 839 } 840 ppc_hash64_set_dsi(cs, eaddr, dsisr); 841 } 842 return 1; 843 } 844 845 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n"); 846 847 /* 6. Update PTE referenced and changed bits if necessary */ 848 849 new_pte1 = pte.pte1 | HPTE64_R_R; /* set referenced bit */ 850 if (rwx == 1) { 851 new_pte1 |= HPTE64_R_C; /* set changed (dirty) bit */ 852 } else { 853 /* Treat the page as read-only for now, so that a later write 854 * will pass through this function again to set the C bit */ 855 prot &= ~PAGE_WRITE; 856 } 857 858 if (new_pte1 != pte.pte1) { 859 ppc_hash64_store_hpte(cpu, ptex, pte.pte0, new_pte1); 860 } 861 862 /* 7. Determine the real address from the PTE */ 863 864 raddr = deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, eaddr); 865 866 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK, 867 prot, mmu_idx, 1ULL << apshift); 868 869 return 0; 870 } 871 872 hwaddr ppc_hash64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr) 873 { 874 CPUPPCState *env = &cpu->env; 875 ppc_slb_t *slb; 876 hwaddr ptex, raddr; 877 ppc_hash_pte64_t pte; 878 unsigned apshift; 879 880 /* Handle real mode */ 881 if (msr_dr == 0) { 882 /* In real mode the top 4 effective address bits are ignored */ 883 raddr = addr & 0x0FFFFFFFFFFFFFFFULL; 884 885 /* In HV mode, add HRMOR if top EA bit is clear */ 886 if ((msr_hv || !env->has_hv_mode) && !(addr >> 63)) { 887 return raddr | env->spr[SPR_HRMOR]; 888 } 889 890 /* Otherwise, check VPM for RMA vs VRMA */ 891 if (env->spr[SPR_LPCR] & LPCR_VPM0) { 892 slb = &env->vrma_slb; 893 if (!slb->sps) { 894 return -1; 895 } 896 } else if (raddr < env->rmls) { 897 /* RMA. Check bounds in RMLS */ 898 return raddr | env->spr[SPR_RMOR]; 899 } else { 900 return -1; 901 } 902 } else { 903 slb = slb_lookup(cpu, addr); 904 if (!slb) { 905 return -1; 906 } 907 } 908 909 ptex = ppc_hash64_htab_lookup(cpu, slb, addr, &pte, &apshift); 910 if (ptex == -1) { 911 return -1; 912 } 913 914 return deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, addr) 915 & TARGET_PAGE_MASK; 916 } 917 918 void ppc_hash64_store_hpte(PowerPCCPU *cpu, hwaddr ptex, 919 uint64_t pte0, uint64_t pte1) 920 { 921 hwaddr base = ppc_hash64_hpt_base(cpu); 922 hwaddr offset = ptex * HASH_PTE_SIZE_64; 923 924 if (cpu->vhyp) { 925 PPCVirtualHypervisorClass *vhc = 926 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp); 927 vhc->store_hpte(cpu->vhyp, ptex, pte0, pte1); 928 return; 929 } 930 931 stq_phys(CPU(cpu)->as, base + offset, pte0); 932 stq_phys(CPU(cpu)->as, base + offset + HASH_PTE_SIZE_64 / 2, pte1); 933 } 934 935 void ppc_hash64_tlb_flush_hpte(PowerPCCPU *cpu, target_ulong ptex, 936 target_ulong pte0, target_ulong pte1) 937 { 938 /* 939 * XXX: given the fact that there are too many segments to 940 * invalidate, and we still don't have a tlb_flush_mask(env, n, 941 * mask) in QEMU, we just invalidate all TLBs 942 */ 943 cpu->env.tlb_need_flush = TLB_NEED_GLOBAL_FLUSH | TLB_NEED_LOCAL_FLUSH; 944 } 945 946 static void ppc_hash64_update_rmls(PowerPCCPU *cpu) 947 { 948 CPUPPCState *env = &cpu->env; 949 uint64_t lpcr = env->spr[SPR_LPCR]; 950 951 /* 952 * This is the full 4 bits encoding of POWER8. Previous 953 * CPUs only support a subset of these but the filtering 954 * is done when writing LPCR 955 */ 956 switch ((lpcr & LPCR_RMLS) >> LPCR_RMLS_SHIFT) { 957 case 0x8: /* 32MB */ 958 env->rmls = 0x2000000ull; 959 break; 960 case 0x3: /* 64MB */ 961 env->rmls = 0x4000000ull; 962 break; 963 case 0x7: /* 128MB */ 964 env->rmls = 0x8000000ull; 965 break; 966 case 0x4: /* 256MB */ 967 env->rmls = 0x10000000ull; 968 break; 969 case 0x2: /* 1GB */ 970 env->rmls = 0x40000000ull; 971 break; 972 case 0x1: /* 16GB */ 973 env->rmls = 0x400000000ull; 974 break; 975 default: 976 /* What to do here ??? */ 977 env->rmls = 0; 978 } 979 } 980 981 static void ppc_hash64_update_vrma(PowerPCCPU *cpu) 982 { 983 CPUPPCState *env = &cpu->env; 984 const PPCHash64SegmentPageSizes *sps = NULL; 985 target_ulong esid, vsid, lpcr; 986 ppc_slb_t *slb = &env->vrma_slb; 987 uint32_t vrmasd; 988 int i; 989 990 /* First clear it */ 991 slb->esid = slb->vsid = 0; 992 slb->sps = NULL; 993 994 /* Is VRMA enabled ? */ 995 lpcr = env->spr[SPR_LPCR]; 996 if (!(lpcr & LPCR_VPM0)) { 997 return; 998 } 999 1000 /* Make one up. Mostly ignore the ESID which will not be 1001 * needed for translation 1002 */ 1003 vsid = SLB_VSID_VRMA; 1004 vrmasd = (lpcr & LPCR_VRMASD) >> LPCR_VRMASD_SHIFT; 1005 vsid |= (vrmasd << 4) & (SLB_VSID_L | SLB_VSID_LP); 1006 esid = SLB_ESID_V; 1007 1008 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 1009 const PPCHash64SegmentPageSizes *sps1 = &cpu->hash64_opts->sps[i]; 1010 1011 if (!sps1->page_shift) { 1012 break; 1013 } 1014 1015 if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) { 1016 sps = sps1; 1017 break; 1018 } 1019 } 1020 1021 if (!sps) { 1022 error_report("Bad page size encoding esid 0x"TARGET_FMT_lx 1023 " vsid 0x"TARGET_FMT_lx, esid, vsid); 1024 return; 1025 } 1026 1027 slb->vsid = vsid; 1028 slb->esid = esid; 1029 slb->sps = sps; 1030 } 1031 1032 void ppc_store_lpcr(PowerPCCPU *cpu, target_ulong val) 1033 { 1034 CPUPPCState *env = &cpu->env; 1035 uint64_t lpcr = 0; 1036 1037 /* Filter out bits */ 1038 switch (env->mmu_model) { 1039 case POWERPC_MMU_64B: /* 970 */ 1040 if (val & 0x40) { 1041 lpcr |= LPCR_LPES0; 1042 } 1043 if (val & 0x8000000000000000ull) { 1044 lpcr |= LPCR_LPES1; 1045 } 1046 if (val & 0x20) { 1047 lpcr |= (0x4ull << LPCR_RMLS_SHIFT); 1048 } 1049 if (val & 0x4000000000000000ull) { 1050 lpcr |= (0x2ull << LPCR_RMLS_SHIFT); 1051 } 1052 if (val & 0x2000000000000000ull) { 1053 lpcr |= (0x1ull << LPCR_RMLS_SHIFT); 1054 } 1055 env->spr[SPR_RMOR] = ((lpcr >> 41) & 0xffffull) << 26; 1056 1057 /* XXX We could also write LPID from HID4 here 1058 * but since we don't tag any translation on it 1059 * it doesn't actually matter 1060 */ 1061 /* XXX For proper emulation of 970 we also need 1062 * to dig HRMOR out of HID5 1063 */ 1064 break; 1065 case POWERPC_MMU_2_03: /* P5p */ 1066 lpcr = val & (LPCR_RMLS | LPCR_ILE | 1067 LPCR_LPES0 | LPCR_LPES1 | 1068 LPCR_RMI | LPCR_HDICE); 1069 break; 1070 case POWERPC_MMU_2_06: /* P7 */ 1071 lpcr = val & (LPCR_VPM0 | LPCR_VPM1 | LPCR_ISL | LPCR_DPFD | 1072 LPCR_VRMASD | LPCR_RMLS | LPCR_ILE | 1073 LPCR_P7_PECE0 | LPCR_P7_PECE1 | LPCR_P7_PECE2 | 1074 LPCR_MER | LPCR_TC | 1075 LPCR_LPES0 | LPCR_LPES1 | LPCR_HDICE); 1076 break; 1077 case POWERPC_MMU_2_07: /* P8 */ 1078 lpcr = val & (LPCR_VPM0 | LPCR_VPM1 | LPCR_ISL | LPCR_KBV | 1079 LPCR_DPFD | LPCR_VRMASD | LPCR_RMLS | LPCR_ILE | 1080 LPCR_AIL | LPCR_ONL | LPCR_P8_PECE0 | LPCR_P8_PECE1 | 1081 LPCR_P8_PECE2 | LPCR_P8_PECE3 | LPCR_P8_PECE4 | 1082 LPCR_MER | LPCR_TC | LPCR_LPES0 | LPCR_HDICE); 1083 break; 1084 case POWERPC_MMU_3_00: /* P9 */ 1085 lpcr = val & (LPCR_VPM1 | LPCR_ISL | LPCR_KBV | LPCR_DPFD | 1086 (LPCR_PECE_U_MASK & LPCR_HVEE) | LPCR_ILE | LPCR_AIL | 1087 LPCR_UPRT | LPCR_EVIRT | LPCR_ONL | 1088 (LPCR_PECE_L_MASK & (LPCR_PDEE | LPCR_HDEE | LPCR_EEE | 1089 LPCR_DEE | LPCR_OEE)) | LPCR_MER | LPCR_GTSE | LPCR_TC | 1090 LPCR_HEIC | LPCR_LPES0 | LPCR_HVICE | LPCR_HDICE); 1091 break; 1092 default: 1093 ; 1094 } 1095 env->spr[SPR_LPCR] = lpcr; 1096 ppc_hash64_update_rmls(cpu); 1097 ppc_hash64_update_vrma(cpu); 1098 } 1099 1100 void helper_store_lpcr(CPUPPCState *env, target_ulong val) 1101 { 1102 PowerPCCPU *cpu = ppc_env_get_cpu(env); 1103 1104 ppc_store_lpcr(cpu, val); 1105 } 1106 1107 void ppc_hash64_init(PowerPCCPU *cpu) 1108 { 1109 CPUPPCState *env = &cpu->env; 1110 PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu); 1111 1112 if (!pcc->hash64_opts) { 1113 assert(!(env->mmu_model & POWERPC_MMU_64)); 1114 return; 1115 } 1116 1117 cpu->hash64_opts = g_memdup(pcc->hash64_opts, sizeof(*cpu->hash64_opts)); 1118 } 1119 1120 void ppc_hash64_finalize(PowerPCCPU *cpu) 1121 { 1122 g_free(cpu->hash64_opts); 1123 } 1124 1125 const PPCHash64Options ppc_hash64_opts_basic = { 1126 .flags = 0, 1127 .slb_size = 64, 1128 .sps = { 1129 { .page_shift = 12, /* 4K */ 1130 .slb_enc = 0, 1131 .enc = { { .page_shift = 12, .pte_enc = 0 } } 1132 }, 1133 { .page_shift = 24, /* 16M */ 1134 .slb_enc = 0x100, 1135 .enc = { { .page_shift = 24, .pte_enc = 0 } } 1136 }, 1137 }, 1138 }; 1139 1140 const PPCHash64Options ppc_hash64_opts_POWER7 = { 1141 .flags = PPC_HASH64_1TSEG | PPC_HASH64_AMR | PPC_HASH64_CI_LARGEPAGE, 1142 .slb_size = 32, 1143 .sps = { 1144 { 1145 .page_shift = 12, /* 4K */ 1146 .slb_enc = 0, 1147 .enc = { { .page_shift = 12, .pte_enc = 0 }, 1148 { .page_shift = 16, .pte_enc = 0x7 }, 1149 { .page_shift = 24, .pte_enc = 0x38 }, }, 1150 }, 1151 { 1152 .page_shift = 16, /* 64K */ 1153 .slb_enc = SLB_VSID_64K, 1154 .enc = { { .page_shift = 16, .pte_enc = 0x1 }, 1155 { .page_shift = 24, .pte_enc = 0x8 }, }, 1156 }, 1157 { 1158 .page_shift = 24, /* 16M */ 1159 .slb_enc = SLB_VSID_16M, 1160 .enc = { { .page_shift = 24, .pte_enc = 0 }, }, 1161 }, 1162 { 1163 .page_shift = 34, /* 16G */ 1164 .slb_enc = SLB_VSID_16G, 1165 .enc = { { .page_shift = 34, .pte_enc = 0x3 }, }, 1166 }, 1167 } 1168 }; 1169 1170 void ppc_hash64_filter_pagesizes(PowerPCCPU *cpu, 1171 bool (*cb)(void *, uint32_t, uint32_t), 1172 void *opaque) 1173 { 1174 PPCHash64Options *opts = cpu->hash64_opts; 1175 int i; 1176 int n = 0; 1177 bool ci_largepage = false; 1178 1179 assert(opts); 1180 1181 n = 0; 1182 for (i = 0; i < ARRAY_SIZE(opts->sps); i++) { 1183 PPCHash64SegmentPageSizes *sps = &opts->sps[i]; 1184 int j; 1185 int m = 0; 1186 1187 assert(n <= i); 1188 1189 if (!sps->page_shift) { 1190 break; 1191 } 1192 1193 for (j = 0; j < ARRAY_SIZE(sps->enc); j++) { 1194 PPCHash64PageSize *ps = &sps->enc[j]; 1195 1196 assert(m <= j); 1197 if (!ps->page_shift) { 1198 break; 1199 } 1200 1201 if (cb(opaque, sps->page_shift, ps->page_shift)) { 1202 if (ps->page_shift >= 16) { 1203 ci_largepage = true; 1204 } 1205 sps->enc[m++] = *ps; 1206 } 1207 } 1208 1209 /* Clear rest of the row */ 1210 for (j = m; j < ARRAY_SIZE(sps->enc); j++) { 1211 memset(&sps->enc[j], 0, sizeof(sps->enc[j])); 1212 } 1213 1214 if (m) { 1215 n++; 1216 } 1217 } 1218 1219 /* Clear the rest of the table */ 1220 for (i = n; i < ARRAY_SIZE(opts->sps); i++) { 1221 memset(&opts->sps[i], 0, sizeof(opts->sps[i])); 1222 } 1223 1224 if (!ci_largepage) { 1225 opts->flags &= ~PPC_HASH64_CI_LARGEPAGE; 1226 } 1227 } 1228