1 /* 2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU. 3 * 4 * Copyright (c) 2003-2007 Jocelyn Mayer 5 * Copyright (c) 2013 David Gibson, IBM Corporation 6 * 7 * This library is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU Lesser General Public 9 * License as published by the Free Software Foundation; either 10 * version 2 of the License, or (at your option) any later version. 11 * 12 * This library is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 * Lesser General Public License for more details. 16 * 17 * You should have received a copy of the GNU Lesser General Public 18 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 19 */ 20 #include "qemu/osdep.h" 21 #include "qapi/error.h" 22 #include "cpu.h" 23 #include "exec/exec-all.h" 24 #include "exec/helper-proto.h" 25 #include "qemu/error-report.h" 26 #include "sysemu/hw_accel.h" 27 #include "kvm_ppc.h" 28 #include "mmu-hash64.h" 29 #include "exec/log.h" 30 31 //#define DEBUG_SLB 32 33 #ifdef DEBUG_SLB 34 # define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__) 35 #else 36 # define LOG_SLB(...) do { } while (0) 37 #endif 38 39 /* 40 * Used to indicate that a CPU has its hash page table (HPT) managed 41 * within the host kernel 42 */ 43 #define MMU_HASH64_KVM_MANAGED_HPT ((void *)-1) 44 45 /* 46 * SLB handling 47 */ 48 49 static ppc_slb_t *slb_lookup(PowerPCCPU *cpu, target_ulong eaddr) 50 { 51 CPUPPCState *env = &cpu->env; 52 uint64_t esid_256M, esid_1T; 53 int n; 54 55 LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr); 56 57 esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V; 58 esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V; 59 60 for (n = 0; n < env->slb_nr; n++) { 61 ppc_slb_t *slb = &env->slb[n]; 62 63 LOG_SLB("%s: slot %d %016" PRIx64 " %016" 64 PRIx64 "\n", __func__, n, slb->esid, slb->vsid); 65 /* We check for 1T matches on all MMUs here - if the MMU 66 * doesn't have 1T segment support, we will have prevented 1T 67 * entries from being inserted in the slbmte code. */ 68 if (((slb->esid == esid_256M) && 69 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M)) 70 || ((slb->esid == esid_1T) && 71 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) { 72 return slb; 73 } 74 } 75 76 return NULL; 77 } 78 79 void dump_slb(FILE *f, fprintf_function cpu_fprintf, PowerPCCPU *cpu) 80 { 81 CPUPPCState *env = &cpu->env; 82 int i; 83 uint64_t slbe, slbv; 84 85 cpu_synchronize_state(CPU(cpu)); 86 87 cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n"); 88 for (i = 0; i < env->slb_nr; i++) { 89 slbe = env->slb[i].esid; 90 slbv = env->slb[i].vsid; 91 if (slbe == 0 && slbv == 0) { 92 continue; 93 } 94 cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n", 95 i, slbe, slbv); 96 } 97 } 98 99 void helper_slbia(CPUPPCState *env) 100 { 101 int n; 102 103 /* XXX: Warning: slbia never invalidates the first segment */ 104 for (n = 1; n < env->slb_nr; n++) { 105 ppc_slb_t *slb = &env->slb[n]; 106 107 if (slb->esid & SLB_ESID_V) { 108 slb->esid &= ~SLB_ESID_V; 109 /* XXX: given the fact that segment size is 256 MB or 1TB, 110 * and we still don't have a tlb_flush_mask(env, n, mask) 111 * in QEMU, we just invalidate all TLBs 112 */ 113 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH; 114 } 115 } 116 } 117 118 static void __helper_slbie(CPUPPCState *env, target_ulong addr, 119 target_ulong global) 120 { 121 PowerPCCPU *cpu = ppc_env_get_cpu(env); 122 ppc_slb_t *slb; 123 124 slb = slb_lookup(cpu, addr); 125 if (!slb) { 126 return; 127 } 128 129 if (slb->esid & SLB_ESID_V) { 130 slb->esid &= ~SLB_ESID_V; 131 132 /* XXX: given the fact that segment size is 256 MB or 1TB, 133 * and we still don't have a tlb_flush_mask(env, n, mask) 134 * in QEMU, we just invalidate all TLBs 135 */ 136 env->tlb_need_flush |= 137 (global == false ? TLB_NEED_LOCAL_FLUSH : TLB_NEED_GLOBAL_FLUSH); 138 } 139 } 140 141 void helper_slbie(CPUPPCState *env, target_ulong addr) 142 { 143 __helper_slbie(env, addr, false); 144 } 145 146 void helper_slbieg(CPUPPCState *env, target_ulong addr) 147 { 148 __helper_slbie(env, addr, true); 149 } 150 151 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot, 152 target_ulong esid, target_ulong vsid) 153 { 154 CPUPPCState *env = &cpu->env; 155 ppc_slb_t *slb = &env->slb[slot]; 156 const struct ppc_one_seg_page_size *sps = NULL; 157 int i; 158 159 if (slot >= env->slb_nr) { 160 return -1; /* Bad slot number */ 161 } 162 if (esid & ~(SLB_ESID_ESID | SLB_ESID_V)) { 163 return -1; /* Reserved bits set */ 164 } 165 if (vsid & (SLB_VSID_B & ~SLB_VSID_B_1T)) { 166 return -1; /* Bad segment size */ 167 } 168 if ((vsid & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) { 169 return -1; /* 1T segment on MMU that doesn't support it */ 170 } 171 172 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 173 const struct ppc_one_seg_page_size *sps1 = &env->sps.sps[i]; 174 175 if (!sps1->page_shift) { 176 break; 177 } 178 179 if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) { 180 sps = sps1; 181 break; 182 } 183 } 184 185 if (!sps) { 186 error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu 187 " esid 0x"TARGET_FMT_lx" vsid 0x"TARGET_FMT_lx, 188 slot, esid, vsid); 189 return -1; 190 } 191 192 slb->esid = esid; 193 slb->vsid = vsid; 194 slb->sps = sps; 195 196 LOG_SLB("%s: " TARGET_FMT_lu " " TARGET_FMT_lx " - " TARGET_FMT_lx 197 " => %016" PRIx64 " %016" PRIx64 "\n", __func__, slot, esid, vsid, 198 slb->esid, slb->vsid); 199 200 return 0; 201 } 202 203 static int ppc_load_slb_esid(PowerPCCPU *cpu, target_ulong rb, 204 target_ulong *rt) 205 { 206 CPUPPCState *env = &cpu->env; 207 int slot = rb & 0xfff; 208 ppc_slb_t *slb = &env->slb[slot]; 209 210 if (slot >= env->slb_nr) { 211 return -1; 212 } 213 214 *rt = slb->esid; 215 return 0; 216 } 217 218 static int ppc_load_slb_vsid(PowerPCCPU *cpu, target_ulong rb, 219 target_ulong *rt) 220 { 221 CPUPPCState *env = &cpu->env; 222 int slot = rb & 0xfff; 223 ppc_slb_t *slb = &env->slb[slot]; 224 225 if (slot >= env->slb_nr) { 226 return -1; 227 } 228 229 *rt = slb->vsid; 230 return 0; 231 } 232 233 static int ppc_find_slb_vsid(PowerPCCPU *cpu, target_ulong rb, 234 target_ulong *rt) 235 { 236 CPUPPCState *env = &cpu->env; 237 ppc_slb_t *slb; 238 239 if (!msr_is_64bit(env, env->msr)) { 240 rb &= 0xffffffff; 241 } 242 slb = slb_lookup(cpu, rb); 243 if (slb == NULL) { 244 *rt = (target_ulong)-1ul; 245 } else { 246 *rt = slb->vsid; 247 } 248 return 0; 249 } 250 251 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs) 252 { 253 PowerPCCPU *cpu = ppc_env_get_cpu(env); 254 255 if (ppc_store_slb(cpu, rb & 0xfff, rb & ~0xfffULL, rs) < 0) { 256 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 257 POWERPC_EXCP_INVAL, GETPC()); 258 } 259 } 260 261 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb) 262 { 263 PowerPCCPU *cpu = ppc_env_get_cpu(env); 264 target_ulong rt = 0; 265 266 if (ppc_load_slb_esid(cpu, rb, &rt) < 0) { 267 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 268 POWERPC_EXCP_INVAL, GETPC()); 269 } 270 return rt; 271 } 272 273 target_ulong helper_find_slb_vsid(CPUPPCState *env, target_ulong rb) 274 { 275 PowerPCCPU *cpu = ppc_env_get_cpu(env); 276 target_ulong rt = 0; 277 278 if (ppc_find_slb_vsid(cpu, rb, &rt) < 0) { 279 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 280 POWERPC_EXCP_INVAL, GETPC()); 281 } 282 return rt; 283 } 284 285 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb) 286 { 287 PowerPCCPU *cpu = ppc_env_get_cpu(env); 288 target_ulong rt = 0; 289 290 if (ppc_load_slb_vsid(cpu, rb, &rt) < 0) { 291 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 292 POWERPC_EXCP_INVAL, GETPC()); 293 } 294 return rt; 295 } 296 297 /* 298 * 64-bit hash table MMU handling 299 */ 300 void ppc_hash64_set_sdr1(PowerPCCPU *cpu, target_ulong value, 301 Error **errp) 302 { 303 CPUPPCState *env = &cpu->env; 304 target_ulong htabsize = value & SDR_64_HTABSIZE; 305 306 env->spr[SPR_SDR1] = value; 307 if (htabsize > 28) { 308 error_setg(errp, 309 "Invalid HTABSIZE 0x" TARGET_FMT_lx" stored in SDR1", 310 htabsize); 311 htabsize = 28; 312 } 313 env->htab_mask = (1ULL << (htabsize + 18 - 7)) - 1; 314 env->htab_base = value & SDR_64_HTABORG; 315 } 316 317 void ppc_hash64_set_external_hpt(PowerPCCPU *cpu, void *hpt, int shift, 318 Error **errp) 319 { 320 CPUPPCState *env = &cpu->env; 321 Error *local_err = NULL; 322 323 if (hpt) { 324 env->external_htab = hpt; 325 } else { 326 env->external_htab = MMU_HASH64_KVM_MANAGED_HPT; 327 } 328 ppc_hash64_set_sdr1(cpu, (target_ulong)(uintptr_t)hpt | (shift - 18), 329 &local_err); 330 if (local_err) { 331 error_propagate(errp, local_err); 332 return; 333 } 334 335 /* Not strictly necessary, but makes it clearer that an external 336 * htab is in use when debugging */ 337 env->htab_base = -1; 338 339 if (kvm_enabled()) { 340 if (kvmppc_put_books_sregs(cpu) < 0) { 341 error_setg(errp, "Unable to update SDR1 in KVM"); 342 } 343 } 344 } 345 346 static int ppc_hash64_pte_prot(PowerPCCPU *cpu, 347 ppc_slb_t *slb, ppc_hash_pte64_t pte) 348 { 349 CPUPPCState *env = &cpu->env; 350 unsigned pp, key; 351 /* Some pp bit combinations have undefined behaviour, so default 352 * to no access in those cases */ 353 int prot = 0; 354 355 key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP) 356 : (slb->vsid & SLB_VSID_KS)); 357 pp = (pte.pte1 & HPTE64_R_PP) | ((pte.pte1 & HPTE64_R_PP0) >> 61); 358 359 if (key == 0) { 360 switch (pp) { 361 case 0x0: 362 case 0x1: 363 case 0x2: 364 prot = PAGE_READ | PAGE_WRITE; 365 break; 366 367 case 0x3: 368 case 0x6: 369 prot = PAGE_READ; 370 break; 371 } 372 } else { 373 switch (pp) { 374 case 0x0: 375 case 0x6: 376 prot = 0; 377 break; 378 379 case 0x1: 380 case 0x3: 381 prot = PAGE_READ; 382 break; 383 384 case 0x2: 385 prot = PAGE_READ | PAGE_WRITE; 386 break; 387 } 388 } 389 390 /* No execute if either noexec or guarded bits set */ 391 if (!(pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G) 392 || (slb->vsid & SLB_VSID_N)) { 393 prot |= PAGE_EXEC; 394 } 395 396 return prot; 397 } 398 399 static int ppc_hash64_amr_prot(PowerPCCPU *cpu, ppc_hash_pte64_t pte) 400 { 401 CPUPPCState *env = &cpu->env; 402 int key, amrbits; 403 int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 404 405 /* Only recent MMUs implement Virtual Page Class Key Protection */ 406 if (!(env->mmu_model & POWERPC_MMU_AMR)) { 407 return prot; 408 } 409 410 key = HPTE64_R_KEY(pte.pte1); 411 amrbits = (env->spr[SPR_AMR] >> 2*(31 - key)) & 0x3; 412 413 /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */ 414 /* env->spr[SPR_AMR]); */ 415 416 /* 417 * A store is permitted if the AMR bit is 0. Remove write 418 * protection if it is set. 419 */ 420 if (amrbits & 0x2) { 421 prot &= ~PAGE_WRITE; 422 } 423 /* 424 * A load is permitted if the AMR bit is 0. Remove read 425 * protection if it is set. 426 */ 427 if (amrbits & 0x1) { 428 prot &= ~PAGE_READ; 429 } 430 431 return prot; 432 } 433 434 uint64_t ppc_hash64_start_access(PowerPCCPU *cpu, target_ulong pte_index) 435 { 436 uint64_t token = 0; 437 hwaddr pte_offset; 438 439 pte_offset = pte_index * HASH_PTE_SIZE_64; 440 if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) { 441 /* 442 * HTAB is controlled by KVM. Fetch the PTEG into a new buffer. 443 */ 444 token = kvmppc_hash64_read_pteg(cpu, pte_index); 445 } else if (cpu->env.external_htab) { 446 /* 447 * HTAB is controlled by QEMU. Just point to the internally 448 * accessible PTEG. 449 */ 450 token = (uint64_t)(uintptr_t) cpu->env.external_htab + pte_offset; 451 } else if (cpu->env.htab_base) { 452 token = cpu->env.htab_base + pte_offset; 453 } 454 return token; 455 } 456 457 void ppc_hash64_stop_access(PowerPCCPU *cpu, uint64_t token) 458 { 459 if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) { 460 kvmppc_hash64_free_pteg(token); 461 } 462 } 463 464 static unsigned hpte_page_shift(const struct ppc_one_seg_page_size *sps, 465 uint64_t pte0, uint64_t pte1) 466 { 467 int i; 468 469 if (!(pte0 & HPTE64_V_LARGE)) { 470 if (sps->page_shift != 12) { 471 /* 4kiB page in a non 4kiB segment */ 472 return 0; 473 } 474 /* Normal 4kiB page */ 475 return 12; 476 } 477 478 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 479 const struct ppc_one_page_size *ps = &sps->enc[i]; 480 uint64_t mask; 481 482 if (!ps->page_shift) { 483 break; 484 } 485 486 if (ps->page_shift == 12) { 487 /* L bit is set so this can't be a 4kiB page */ 488 continue; 489 } 490 491 mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN; 492 493 if ((pte1 & mask) == ((uint64_t)ps->pte_enc << HPTE64_R_RPN_SHIFT)) { 494 return ps->page_shift; 495 } 496 } 497 498 return 0; /* Bad page size encoding */ 499 } 500 501 static hwaddr ppc_hash64_pteg_search(PowerPCCPU *cpu, hwaddr hash, 502 const struct ppc_one_seg_page_size *sps, 503 target_ulong ptem, 504 ppc_hash_pte64_t *pte, unsigned *pshift) 505 { 506 CPUPPCState *env = &cpu->env; 507 int i; 508 uint64_t token; 509 target_ulong pte0, pte1; 510 target_ulong pte_index; 511 512 pte_index = (hash & env->htab_mask) * HPTES_PER_GROUP; 513 token = ppc_hash64_start_access(cpu, pte_index); 514 if (!token) { 515 return -1; 516 } 517 for (i = 0; i < HPTES_PER_GROUP; i++) { 518 pte0 = ppc_hash64_load_hpte0(cpu, token, i); 519 pte1 = ppc_hash64_load_hpte1(cpu, token, i); 520 521 /* This compares V, B, H (secondary) and the AVPN */ 522 if (HPTE64_V_COMPARE(pte0, ptem)) { 523 *pshift = hpte_page_shift(sps, pte0, pte1); 524 /* 525 * If there is no match, ignore the PTE, it could simply 526 * be for a different segment size encoding and the 527 * architecture specifies we should not match. Linux will 528 * potentially leave behind PTEs for the wrong base page 529 * size when demoting segments. 530 */ 531 if (*pshift == 0) { 532 continue; 533 } 534 /* We don't do anything with pshift yet as qemu TLB only deals 535 * with 4K pages anyway 536 */ 537 pte->pte0 = pte0; 538 pte->pte1 = pte1; 539 ppc_hash64_stop_access(cpu, token); 540 return (pte_index + i) * HASH_PTE_SIZE_64; 541 } 542 } 543 ppc_hash64_stop_access(cpu, token); 544 /* 545 * We didn't find a valid entry. 546 */ 547 return -1; 548 } 549 550 static hwaddr ppc_hash64_htab_lookup(PowerPCCPU *cpu, 551 ppc_slb_t *slb, target_ulong eaddr, 552 ppc_hash_pte64_t *pte, unsigned *pshift) 553 { 554 CPUPPCState *env = &cpu->env; 555 hwaddr pte_offset; 556 hwaddr hash; 557 uint64_t vsid, epnmask, epn, ptem; 558 const struct ppc_one_seg_page_size *sps = slb->sps; 559 560 /* The SLB store path should prevent any bad page size encodings 561 * getting in there, so: */ 562 assert(sps); 563 564 /* If ISL is set in LPCR we need to clamp the page size to 4K */ 565 if (env->spr[SPR_LPCR] & LPCR_ISL) { 566 /* We assume that when using TCG, 4k is first entry of SPS */ 567 sps = &env->sps.sps[0]; 568 assert(sps->page_shift == 12); 569 } 570 571 epnmask = ~((1ULL << sps->page_shift) - 1); 572 573 if (slb->vsid & SLB_VSID_B) { 574 /* 1TB segment */ 575 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T; 576 epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask; 577 hash = vsid ^ (vsid << 25) ^ (epn >> sps->page_shift); 578 } else { 579 /* 256M segment */ 580 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT; 581 epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask; 582 hash = vsid ^ (epn >> sps->page_shift); 583 } 584 ptem = (slb->vsid & SLB_VSID_PTEM) | ((epn >> 16) & HPTE64_V_AVPN); 585 ptem |= HPTE64_V_VALID; 586 587 /* Page address translation */ 588 qemu_log_mask(CPU_LOG_MMU, 589 "htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx 590 " hash " TARGET_FMT_plx "\n", 591 env->htab_base, env->htab_mask, hash); 592 593 /* Primary PTEG lookup */ 594 qemu_log_mask(CPU_LOG_MMU, 595 "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx 596 " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx 597 " hash=" TARGET_FMT_plx "\n", 598 env->htab_base, env->htab_mask, vsid, ptem, hash); 599 pte_offset = ppc_hash64_pteg_search(cpu, hash, sps, ptem, pte, pshift); 600 601 if (pte_offset == -1) { 602 /* Secondary PTEG lookup */ 603 ptem |= HPTE64_V_SECONDARY; 604 qemu_log_mask(CPU_LOG_MMU, 605 "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx 606 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx 607 " hash=" TARGET_FMT_plx "\n", env->htab_base, 608 env->htab_mask, vsid, ptem, ~hash); 609 610 pte_offset = ppc_hash64_pteg_search(cpu, ~hash, sps, ptem, pte, pshift); 611 } 612 613 return pte_offset; 614 } 615 616 unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU *cpu, 617 uint64_t pte0, uint64_t pte1) 618 { 619 CPUPPCState *env = &cpu->env; 620 int i; 621 622 if (!(pte0 & HPTE64_V_LARGE)) { 623 return 12; 624 } 625 626 /* 627 * The encodings in env->sps need to be carefully chosen so that 628 * this gives an unambiguous result. 629 */ 630 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 631 const struct ppc_one_seg_page_size *sps = &env->sps.sps[i]; 632 unsigned shift; 633 634 if (!sps->page_shift) { 635 break; 636 } 637 638 shift = hpte_page_shift(sps, pte0, pte1); 639 if (shift) { 640 return shift; 641 } 642 } 643 644 return 0; 645 } 646 647 static void ppc_hash64_set_isi(CPUState *cs, CPUPPCState *env, 648 uint64_t error_code) 649 { 650 bool vpm; 651 652 if (msr_ir) { 653 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1); 654 } else { 655 switch (env->mmu_model) { 656 case POWERPC_MMU_3_00: 657 /* Field deprecated in ISAv3.00 - interrupts always go to hyperv */ 658 vpm = true; 659 break; 660 default: 661 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM0); 662 break; 663 } 664 } 665 if (vpm && !msr_hv) { 666 cs->exception_index = POWERPC_EXCP_HISI; 667 } else { 668 cs->exception_index = POWERPC_EXCP_ISI; 669 } 670 env->error_code = error_code; 671 } 672 673 static void ppc_hash64_set_dsi(CPUState *cs, CPUPPCState *env, uint64_t dar, 674 uint64_t dsisr) 675 { 676 bool vpm; 677 678 if (msr_dr) { 679 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1); 680 } else { 681 switch (env->mmu_model) { 682 case POWERPC_MMU_3_00: 683 /* Field deprecated in ISAv3.00 - interrupts always go to hyperv */ 684 vpm = true; 685 break; 686 default: 687 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM0); 688 break; 689 } 690 } 691 if (vpm && !msr_hv) { 692 cs->exception_index = POWERPC_EXCP_HDSI; 693 env->spr[SPR_HDAR] = dar; 694 env->spr[SPR_HDSISR] = dsisr; 695 } else { 696 cs->exception_index = POWERPC_EXCP_DSI; 697 env->spr[SPR_DAR] = dar; 698 env->spr[SPR_DSISR] = dsisr; 699 } 700 env->error_code = 0; 701 } 702 703 704 int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, 705 int rwx, int mmu_idx) 706 { 707 CPUState *cs = CPU(cpu); 708 CPUPPCState *env = &cpu->env; 709 ppc_slb_t *slb; 710 unsigned apshift; 711 hwaddr pte_offset; 712 ppc_hash_pte64_t pte; 713 int pp_prot, amr_prot, prot; 714 uint64_t new_pte1, dsisr; 715 const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC}; 716 hwaddr raddr; 717 718 assert((rwx == 0) || (rwx == 1) || (rwx == 2)); 719 720 /* Note on LPCR usage: 970 uses HID4, but our special variant 721 * of store_spr copies relevant fields into env->spr[SPR_LPCR]. 722 * Similarily we filter unimplemented bits when storing into 723 * LPCR depending on the MMU version. This code can thus just 724 * use the LPCR "as-is". 725 */ 726 727 /* 1. Handle real mode accesses */ 728 if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) { 729 /* Translation is supposedly "off" */ 730 /* In real mode the top 4 effective address bits are (mostly) ignored */ 731 raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL; 732 733 /* In HV mode, add HRMOR if top EA bit is clear */ 734 if (msr_hv || !env->has_hv_mode) { 735 if (!(eaddr >> 63)) { 736 raddr |= env->spr[SPR_HRMOR]; 737 } 738 } else { 739 /* Otherwise, check VPM for RMA vs VRMA */ 740 if (env->spr[SPR_LPCR] & LPCR_VPM0) { 741 slb = &env->vrma_slb; 742 if (slb->sps) { 743 goto skip_slb_search; 744 } 745 /* Not much else to do here */ 746 cs->exception_index = POWERPC_EXCP_MCHECK; 747 env->error_code = 0; 748 return 1; 749 } else if (raddr < env->rmls) { 750 /* RMA. Check bounds in RMLS */ 751 raddr |= env->spr[SPR_RMOR]; 752 } else { 753 /* The access failed, generate the approriate interrupt */ 754 if (rwx == 2) { 755 ppc_hash64_set_isi(cs, env, 0x08000000); 756 } else { 757 dsisr = 0x08000000; 758 if (rwx == 1) { 759 dsisr |= 0x02000000; 760 } 761 ppc_hash64_set_dsi(cs, env, eaddr, dsisr); 762 } 763 return 1; 764 } 765 } 766 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK, 767 PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx, 768 TARGET_PAGE_SIZE); 769 return 0; 770 } 771 772 /* 2. Translation is on, so look up the SLB */ 773 slb = slb_lookup(cpu, eaddr); 774 if (!slb) { 775 if (rwx == 2) { 776 cs->exception_index = POWERPC_EXCP_ISEG; 777 env->error_code = 0; 778 } else { 779 cs->exception_index = POWERPC_EXCP_DSEG; 780 env->error_code = 0; 781 env->spr[SPR_DAR] = eaddr; 782 } 783 return 1; 784 } 785 786 skip_slb_search: 787 788 /* 3. Check for segment level no-execute violation */ 789 if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) { 790 ppc_hash64_set_isi(cs, env, 0x10000000); 791 return 1; 792 } 793 794 /* 4. Locate the PTE in the hash table */ 795 pte_offset = ppc_hash64_htab_lookup(cpu, slb, eaddr, &pte, &apshift); 796 if (pte_offset == -1) { 797 dsisr = 0x40000000; 798 if (rwx == 2) { 799 ppc_hash64_set_isi(cs, env, dsisr); 800 } else { 801 if (rwx == 1) { 802 dsisr |= 0x02000000; 803 } 804 ppc_hash64_set_dsi(cs, env, eaddr, dsisr); 805 } 806 return 1; 807 } 808 qemu_log_mask(CPU_LOG_MMU, 809 "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset); 810 811 /* 5. Check access permissions */ 812 813 pp_prot = ppc_hash64_pte_prot(cpu, slb, pte); 814 amr_prot = ppc_hash64_amr_prot(cpu, pte); 815 prot = pp_prot & amr_prot; 816 817 if ((need_prot[rwx] & ~prot) != 0) { 818 /* Access right violation */ 819 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n"); 820 if (rwx == 2) { 821 ppc_hash64_set_isi(cs, env, 0x08000000); 822 } else { 823 dsisr = 0; 824 if (need_prot[rwx] & ~pp_prot) { 825 dsisr |= 0x08000000; 826 } 827 if (rwx == 1) { 828 dsisr |= 0x02000000; 829 } 830 if (need_prot[rwx] & ~amr_prot) { 831 dsisr |= 0x00200000; 832 } 833 ppc_hash64_set_dsi(cs, env, eaddr, dsisr); 834 } 835 return 1; 836 } 837 838 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n"); 839 840 /* 6. Update PTE referenced and changed bits if necessary */ 841 842 new_pte1 = pte.pte1 | HPTE64_R_R; /* set referenced bit */ 843 if (rwx == 1) { 844 new_pte1 |= HPTE64_R_C; /* set changed (dirty) bit */ 845 } else { 846 /* Treat the page as read-only for now, so that a later write 847 * will pass through this function again to set the C bit */ 848 prot &= ~PAGE_WRITE; 849 } 850 851 if (new_pte1 != pte.pte1) { 852 ppc_hash64_store_hpte(cpu, pte_offset / HASH_PTE_SIZE_64, 853 pte.pte0, new_pte1); 854 } 855 856 /* 7. Determine the real address from the PTE */ 857 858 raddr = deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, eaddr); 859 860 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK, 861 prot, mmu_idx, 1ULL << apshift); 862 863 return 0; 864 } 865 866 hwaddr ppc_hash64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr) 867 { 868 CPUPPCState *env = &cpu->env; 869 ppc_slb_t *slb; 870 hwaddr pte_offset, raddr; 871 ppc_hash_pte64_t pte; 872 unsigned apshift; 873 874 /* Handle real mode */ 875 if (msr_dr == 0) { 876 /* In real mode the top 4 effective address bits are ignored */ 877 raddr = addr & 0x0FFFFFFFFFFFFFFFULL; 878 879 /* In HV mode, add HRMOR if top EA bit is clear */ 880 if ((msr_hv || !env->has_hv_mode) && !(addr >> 63)) { 881 return raddr | env->spr[SPR_HRMOR]; 882 } 883 884 /* Otherwise, check VPM for RMA vs VRMA */ 885 if (env->spr[SPR_LPCR] & LPCR_VPM0) { 886 slb = &env->vrma_slb; 887 if (!slb->sps) { 888 return -1; 889 } 890 } else if (raddr < env->rmls) { 891 /* RMA. Check bounds in RMLS */ 892 return raddr | env->spr[SPR_RMOR]; 893 } else { 894 return -1; 895 } 896 } else { 897 slb = slb_lookup(cpu, addr); 898 if (!slb) { 899 return -1; 900 } 901 } 902 903 pte_offset = ppc_hash64_htab_lookup(cpu, slb, addr, &pte, &apshift); 904 if (pte_offset == -1) { 905 return -1; 906 } 907 908 return deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, addr) 909 & TARGET_PAGE_MASK; 910 } 911 912 void ppc_hash64_store_hpte(PowerPCCPU *cpu, 913 target_ulong pte_index, 914 target_ulong pte0, target_ulong pte1) 915 { 916 CPUPPCState *env = &cpu->env; 917 918 if (env->external_htab == MMU_HASH64_KVM_MANAGED_HPT) { 919 kvmppc_hash64_write_pte(env, pte_index, pte0, pte1); 920 return; 921 } 922 923 pte_index *= HASH_PTE_SIZE_64; 924 if (env->external_htab) { 925 stq_p(env->external_htab + pte_index, pte0); 926 stq_p(env->external_htab + pte_index + HASH_PTE_SIZE_64 / 2, pte1); 927 } else { 928 stq_phys(CPU(cpu)->as, env->htab_base + pte_index, pte0); 929 stq_phys(CPU(cpu)->as, 930 env->htab_base + pte_index + HASH_PTE_SIZE_64 / 2, pte1); 931 } 932 } 933 934 void ppc_hash64_tlb_flush_hpte(PowerPCCPU *cpu, 935 target_ulong pte_index, 936 target_ulong pte0, target_ulong pte1) 937 { 938 /* 939 * XXX: given the fact that there are too many segments to 940 * invalidate, and we still don't have a tlb_flush_mask(env, n, 941 * mask) in QEMU, we just invalidate all TLBs 942 */ 943 cpu->env.tlb_need_flush = TLB_NEED_GLOBAL_FLUSH | TLB_NEED_LOCAL_FLUSH; 944 } 945 946 void ppc_hash64_update_rmls(CPUPPCState *env) 947 { 948 uint64_t lpcr = env->spr[SPR_LPCR]; 949 950 /* 951 * This is the full 4 bits encoding of POWER8. Previous 952 * CPUs only support a subset of these but the filtering 953 * is done when writing LPCR 954 */ 955 switch ((lpcr & LPCR_RMLS) >> LPCR_RMLS_SHIFT) { 956 case 0x8: /* 32MB */ 957 env->rmls = 0x2000000ull; 958 break; 959 case 0x3: /* 64MB */ 960 env->rmls = 0x4000000ull; 961 break; 962 case 0x7: /* 128MB */ 963 env->rmls = 0x8000000ull; 964 break; 965 case 0x4: /* 256MB */ 966 env->rmls = 0x10000000ull; 967 break; 968 case 0x2: /* 1GB */ 969 env->rmls = 0x40000000ull; 970 break; 971 case 0x1: /* 16GB */ 972 env->rmls = 0x400000000ull; 973 break; 974 default: 975 /* What to do here ??? */ 976 env->rmls = 0; 977 } 978 } 979 980 void ppc_hash64_update_vrma(CPUPPCState *env) 981 { 982 const struct ppc_one_seg_page_size *sps = NULL; 983 target_ulong esid, vsid, lpcr; 984 ppc_slb_t *slb = &env->vrma_slb; 985 uint32_t vrmasd; 986 int i; 987 988 /* First clear it */ 989 slb->esid = slb->vsid = 0; 990 slb->sps = NULL; 991 992 /* Is VRMA enabled ? */ 993 lpcr = env->spr[SPR_LPCR]; 994 if (!(lpcr & LPCR_VPM0)) { 995 return; 996 } 997 998 /* Make one up. Mostly ignore the ESID which will not be 999 * needed for translation 1000 */ 1001 vsid = SLB_VSID_VRMA; 1002 vrmasd = (lpcr & LPCR_VRMASD) >> LPCR_VRMASD_SHIFT; 1003 vsid |= (vrmasd << 4) & (SLB_VSID_L | SLB_VSID_LP); 1004 esid = SLB_ESID_V; 1005 1006 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 1007 const struct ppc_one_seg_page_size *sps1 = &env->sps.sps[i]; 1008 1009 if (!sps1->page_shift) { 1010 break; 1011 } 1012 1013 if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) { 1014 sps = sps1; 1015 break; 1016 } 1017 } 1018 1019 if (!sps) { 1020 error_report("Bad page size encoding esid 0x"TARGET_FMT_lx 1021 " vsid 0x"TARGET_FMT_lx, esid, vsid); 1022 return; 1023 } 1024 1025 slb->vsid = vsid; 1026 slb->esid = esid; 1027 slb->sps = sps; 1028 } 1029 1030 void helper_store_lpcr(CPUPPCState *env, target_ulong val) 1031 { 1032 uint64_t lpcr = 0; 1033 1034 /* Filter out bits */ 1035 switch (env->mmu_model) { 1036 case POWERPC_MMU_64B: /* 970 */ 1037 if (val & 0x40) { 1038 lpcr |= LPCR_LPES0; 1039 } 1040 if (val & 0x8000000000000000ull) { 1041 lpcr |= LPCR_LPES1; 1042 } 1043 if (val & 0x20) { 1044 lpcr |= (0x4ull << LPCR_RMLS_SHIFT); 1045 } 1046 if (val & 0x4000000000000000ull) { 1047 lpcr |= (0x2ull << LPCR_RMLS_SHIFT); 1048 } 1049 if (val & 0x2000000000000000ull) { 1050 lpcr |= (0x1ull << LPCR_RMLS_SHIFT); 1051 } 1052 env->spr[SPR_RMOR] = ((lpcr >> 41) & 0xffffull) << 26; 1053 1054 /* XXX We could also write LPID from HID4 here 1055 * but since we don't tag any translation on it 1056 * it doesn't actually matter 1057 */ 1058 /* XXX For proper emulation of 970 we also need 1059 * to dig HRMOR out of HID5 1060 */ 1061 break; 1062 case POWERPC_MMU_2_03: /* P5p */ 1063 lpcr = val & (LPCR_RMLS | LPCR_ILE | 1064 LPCR_LPES0 | LPCR_LPES1 | 1065 LPCR_RMI | LPCR_HDICE); 1066 break; 1067 case POWERPC_MMU_2_06: /* P7 */ 1068 lpcr = val & (LPCR_VPM0 | LPCR_VPM1 | LPCR_ISL | LPCR_DPFD | 1069 LPCR_VRMASD | LPCR_RMLS | LPCR_ILE | 1070 LPCR_P7_PECE0 | LPCR_P7_PECE1 | LPCR_P7_PECE2 | 1071 LPCR_MER | LPCR_TC | 1072 LPCR_LPES0 | LPCR_LPES1 | LPCR_HDICE); 1073 break; 1074 case POWERPC_MMU_2_07: /* P8 */ 1075 lpcr = val & (LPCR_VPM0 | LPCR_VPM1 | LPCR_ISL | LPCR_KBV | 1076 LPCR_DPFD | LPCR_VRMASD | LPCR_RMLS | LPCR_ILE | 1077 LPCR_AIL | LPCR_ONL | LPCR_P8_PECE0 | LPCR_P8_PECE1 | 1078 LPCR_P8_PECE2 | LPCR_P8_PECE3 | LPCR_P8_PECE4 | 1079 LPCR_MER | LPCR_TC | LPCR_LPES0 | LPCR_HDICE); 1080 break; 1081 case POWERPC_MMU_3_00: /* P9 */ 1082 lpcr = val & (LPCR_VPM1 | LPCR_ISL | LPCR_KBV | LPCR_DPFD | 1083 (LPCR_PECE_U_MASK & LPCR_HVEE) | LPCR_ILE | LPCR_AIL | 1084 LPCR_UPRT | LPCR_EVIRT | LPCR_ONL | 1085 (LPCR_PECE_L_MASK & (LPCR_PDEE | LPCR_HDEE | LPCR_EEE | 1086 LPCR_DEE | LPCR_OEE)) | LPCR_MER | LPCR_GTSE | LPCR_TC | 1087 LPCR_HEIC | LPCR_LPES0 | LPCR_HVICE | LPCR_HDICE); 1088 break; 1089 default: 1090 ; 1091 } 1092 env->spr[SPR_LPCR] = lpcr; 1093 ppc_hash64_update_rmls(env); 1094 ppc_hash64_update_vrma(env); 1095 } 1096