1 /* 2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU. 3 * 4 * Copyright (c) 2003-2007 Jocelyn Mayer 5 * Copyright (c) 2013 David Gibson, IBM Corporation 6 * 7 * This library is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU Lesser General Public 9 * License as published by the Free Software Foundation; either 10 * version 2 of the License, or (at your option) any later version. 11 * 12 * This library is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 * Lesser General Public License for more details. 16 * 17 * You should have received a copy of the GNU Lesser General Public 18 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 19 */ 20 #include "qemu/osdep.h" 21 #include "qapi/error.h" 22 #include "cpu.h" 23 #include "exec/exec-all.h" 24 #include "exec/helper-proto.h" 25 #include "qemu/error-report.h" 26 #include "sysemu/hw_accel.h" 27 #include "kvm_ppc.h" 28 #include "mmu-hash64.h" 29 #include "exec/log.h" 30 #include "hw/hw.h" 31 32 //#define DEBUG_SLB 33 34 #ifdef DEBUG_SLB 35 # define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__) 36 #else 37 # define LOG_SLB(...) do { } while (0) 38 #endif 39 40 /* 41 * SLB handling 42 */ 43 44 static ppc_slb_t *slb_lookup(PowerPCCPU *cpu, target_ulong eaddr) 45 { 46 CPUPPCState *env = &cpu->env; 47 uint64_t esid_256M, esid_1T; 48 int n; 49 50 LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr); 51 52 esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V; 53 esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V; 54 55 for (n = 0; n < env->slb_nr; n++) { 56 ppc_slb_t *slb = &env->slb[n]; 57 58 LOG_SLB("%s: slot %d %016" PRIx64 " %016" 59 PRIx64 "\n", __func__, n, slb->esid, slb->vsid); 60 /* We check for 1T matches on all MMUs here - if the MMU 61 * doesn't have 1T segment support, we will have prevented 1T 62 * entries from being inserted in the slbmte code. */ 63 if (((slb->esid == esid_256M) && 64 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M)) 65 || ((slb->esid == esid_1T) && 66 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) { 67 return slb; 68 } 69 } 70 71 return NULL; 72 } 73 74 void dump_slb(FILE *f, fprintf_function cpu_fprintf, PowerPCCPU *cpu) 75 { 76 CPUPPCState *env = &cpu->env; 77 int i; 78 uint64_t slbe, slbv; 79 80 cpu_synchronize_state(CPU(cpu)); 81 82 cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n"); 83 for (i = 0; i < env->slb_nr; i++) { 84 slbe = env->slb[i].esid; 85 slbv = env->slb[i].vsid; 86 if (slbe == 0 && slbv == 0) { 87 continue; 88 } 89 cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n", 90 i, slbe, slbv); 91 } 92 } 93 94 void helper_slbia(CPUPPCState *env) 95 { 96 int n; 97 98 /* XXX: Warning: slbia never invalidates the first segment */ 99 for (n = 1; n < env->slb_nr; n++) { 100 ppc_slb_t *slb = &env->slb[n]; 101 102 if (slb->esid & SLB_ESID_V) { 103 slb->esid &= ~SLB_ESID_V; 104 /* XXX: given the fact that segment size is 256 MB or 1TB, 105 * and we still don't have a tlb_flush_mask(env, n, mask) 106 * in QEMU, we just invalidate all TLBs 107 */ 108 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH; 109 } 110 } 111 } 112 113 static void __helper_slbie(CPUPPCState *env, target_ulong addr, 114 target_ulong global) 115 { 116 PowerPCCPU *cpu = ppc_env_get_cpu(env); 117 ppc_slb_t *slb; 118 119 slb = slb_lookup(cpu, addr); 120 if (!slb) { 121 return; 122 } 123 124 if (slb->esid & SLB_ESID_V) { 125 slb->esid &= ~SLB_ESID_V; 126 127 /* XXX: given the fact that segment size is 256 MB or 1TB, 128 * and we still don't have a tlb_flush_mask(env, n, mask) 129 * in QEMU, we just invalidate all TLBs 130 */ 131 env->tlb_need_flush |= 132 (global == false ? TLB_NEED_LOCAL_FLUSH : TLB_NEED_GLOBAL_FLUSH); 133 } 134 } 135 136 void helper_slbie(CPUPPCState *env, target_ulong addr) 137 { 138 __helper_slbie(env, addr, false); 139 } 140 141 void helper_slbieg(CPUPPCState *env, target_ulong addr) 142 { 143 __helper_slbie(env, addr, true); 144 } 145 146 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot, 147 target_ulong esid, target_ulong vsid) 148 { 149 CPUPPCState *env = &cpu->env; 150 ppc_slb_t *slb = &env->slb[slot]; 151 const struct ppc_one_seg_page_size *sps = NULL; 152 int i; 153 154 if (slot >= env->slb_nr) { 155 return -1; /* Bad slot number */ 156 } 157 if (esid & ~(SLB_ESID_ESID | SLB_ESID_V)) { 158 return -1; /* Reserved bits set */ 159 } 160 if (vsid & (SLB_VSID_B & ~SLB_VSID_B_1T)) { 161 return -1; /* Bad segment size */ 162 } 163 if ((vsid & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) { 164 return -1; /* 1T segment on MMU that doesn't support it */ 165 } 166 167 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 168 const struct ppc_one_seg_page_size *sps1 = &env->sps.sps[i]; 169 170 if (!sps1->page_shift) { 171 break; 172 } 173 174 if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) { 175 sps = sps1; 176 break; 177 } 178 } 179 180 if (!sps) { 181 error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu 182 " esid 0x"TARGET_FMT_lx" vsid 0x"TARGET_FMT_lx, 183 slot, esid, vsid); 184 return -1; 185 } 186 187 slb->esid = esid; 188 slb->vsid = vsid; 189 slb->sps = sps; 190 191 LOG_SLB("%s: " TARGET_FMT_lu " " TARGET_FMT_lx " - " TARGET_FMT_lx 192 " => %016" PRIx64 " %016" PRIx64 "\n", __func__, slot, esid, vsid, 193 slb->esid, slb->vsid); 194 195 return 0; 196 } 197 198 static int ppc_load_slb_esid(PowerPCCPU *cpu, target_ulong rb, 199 target_ulong *rt) 200 { 201 CPUPPCState *env = &cpu->env; 202 int slot = rb & 0xfff; 203 ppc_slb_t *slb = &env->slb[slot]; 204 205 if (slot >= env->slb_nr) { 206 return -1; 207 } 208 209 *rt = slb->esid; 210 return 0; 211 } 212 213 static int ppc_load_slb_vsid(PowerPCCPU *cpu, target_ulong rb, 214 target_ulong *rt) 215 { 216 CPUPPCState *env = &cpu->env; 217 int slot = rb & 0xfff; 218 ppc_slb_t *slb = &env->slb[slot]; 219 220 if (slot >= env->slb_nr) { 221 return -1; 222 } 223 224 *rt = slb->vsid; 225 return 0; 226 } 227 228 static int ppc_find_slb_vsid(PowerPCCPU *cpu, target_ulong rb, 229 target_ulong *rt) 230 { 231 CPUPPCState *env = &cpu->env; 232 ppc_slb_t *slb; 233 234 if (!msr_is_64bit(env, env->msr)) { 235 rb &= 0xffffffff; 236 } 237 slb = slb_lookup(cpu, rb); 238 if (slb == NULL) { 239 *rt = (target_ulong)-1ul; 240 } else { 241 *rt = slb->vsid; 242 } 243 return 0; 244 } 245 246 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs) 247 { 248 PowerPCCPU *cpu = ppc_env_get_cpu(env); 249 250 if (ppc_store_slb(cpu, rb & 0xfff, rb & ~0xfffULL, rs) < 0) { 251 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 252 POWERPC_EXCP_INVAL, GETPC()); 253 } 254 } 255 256 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb) 257 { 258 PowerPCCPU *cpu = ppc_env_get_cpu(env); 259 target_ulong rt = 0; 260 261 if (ppc_load_slb_esid(cpu, rb, &rt) < 0) { 262 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 263 POWERPC_EXCP_INVAL, GETPC()); 264 } 265 return rt; 266 } 267 268 target_ulong helper_find_slb_vsid(CPUPPCState *env, target_ulong rb) 269 { 270 PowerPCCPU *cpu = ppc_env_get_cpu(env); 271 target_ulong rt = 0; 272 273 if (ppc_find_slb_vsid(cpu, rb, &rt) < 0) { 274 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 275 POWERPC_EXCP_INVAL, GETPC()); 276 } 277 return rt; 278 } 279 280 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb) 281 { 282 PowerPCCPU *cpu = ppc_env_get_cpu(env); 283 target_ulong rt = 0; 284 285 if (ppc_load_slb_vsid(cpu, rb, &rt) < 0) { 286 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 287 POWERPC_EXCP_INVAL, GETPC()); 288 } 289 return rt; 290 } 291 292 static int ppc_hash64_pte_prot(PowerPCCPU *cpu, 293 ppc_slb_t *slb, ppc_hash_pte64_t pte) 294 { 295 CPUPPCState *env = &cpu->env; 296 unsigned pp, key; 297 /* Some pp bit combinations have undefined behaviour, so default 298 * to no access in those cases */ 299 int prot = 0; 300 301 key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP) 302 : (slb->vsid & SLB_VSID_KS)); 303 pp = (pte.pte1 & HPTE64_R_PP) | ((pte.pte1 & HPTE64_R_PP0) >> 61); 304 305 if (key == 0) { 306 switch (pp) { 307 case 0x0: 308 case 0x1: 309 case 0x2: 310 prot = PAGE_READ | PAGE_WRITE; 311 break; 312 313 case 0x3: 314 case 0x6: 315 prot = PAGE_READ; 316 break; 317 } 318 } else { 319 switch (pp) { 320 case 0x0: 321 case 0x6: 322 prot = 0; 323 break; 324 325 case 0x1: 326 case 0x3: 327 prot = PAGE_READ; 328 break; 329 330 case 0x2: 331 prot = PAGE_READ | PAGE_WRITE; 332 break; 333 } 334 } 335 336 /* No execute if either noexec or guarded bits set */ 337 if (!(pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G) 338 || (slb->vsid & SLB_VSID_N)) { 339 prot |= PAGE_EXEC; 340 } 341 342 return prot; 343 } 344 345 static int ppc_hash64_amr_prot(PowerPCCPU *cpu, ppc_hash_pte64_t pte) 346 { 347 CPUPPCState *env = &cpu->env; 348 int key, amrbits; 349 int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 350 351 /* Only recent MMUs implement Virtual Page Class Key Protection */ 352 if (!(env->mmu_model & POWERPC_MMU_AMR)) { 353 return prot; 354 } 355 356 key = HPTE64_R_KEY(pte.pte1); 357 amrbits = (env->spr[SPR_AMR] >> 2*(31 - key)) & 0x3; 358 359 /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */ 360 /* env->spr[SPR_AMR]); */ 361 362 /* 363 * A store is permitted if the AMR bit is 0. Remove write 364 * protection if it is set. 365 */ 366 if (amrbits & 0x2) { 367 prot &= ~PAGE_WRITE; 368 } 369 /* 370 * A load is permitted if the AMR bit is 0. Remove read 371 * protection if it is set. 372 */ 373 if (amrbits & 0x1) { 374 prot &= ~PAGE_READ; 375 } 376 377 return prot; 378 } 379 380 const ppc_hash_pte64_t *ppc_hash64_map_hptes(PowerPCCPU *cpu, 381 hwaddr ptex, int n) 382 { 383 hwaddr pte_offset = ptex * HASH_PTE_SIZE_64; 384 hwaddr base = ppc_hash64_hpt_base(cpu); 385 hwaddr plen = n * HASH_PTE_SIZE_64; 386 const ppc_hash_pte64_t *hptes; 387 388 if (cpu->vhyp) { 389 PPCVirtualHypervisorClass *vhc = 390 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp); 391 return vhc->map_hptes(cpu->vhyp, ptex, n); 392 } 393 394 if (!base) { 395 return NULL; 396 } 397 398 hptes = address_space_map(CPU(cpu)->as, base + pte_offset, &plen, false); 399 if (plen < (n * HASH_PTE_SIZE_64)) { 400 hw_error("%s: Unable to map all requested HPTEs\n", __func__); 401 } 402 return hptes; 403 } 404 405 void ppc_hash64_unmap_hptes(PowerPCCPU *cpu, const ppc_hash_pte64_t *hptes, 406 hwaddr ptex, int n) 407 { 408 if (cpu->vhyp) { 409 PPCVirtualHypervisorClass *vhc = 410 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp); 411 vhc->unmap_hptes(cpu->vhyp, hptes, ptex, n); 412 return; 413 } 414 415 address_space_unmap(CPU(cpu)->as, (void *)hptes, n * HASH_PTE_SIZE_64, 416 false, n * HASH_PTE_SIZE_64); 417 } 418 419 static unsigned hpte_page_shift(const struct ppc_one_seg_page_size *sps, 420 uint64_t pte0, uint64_t pte1) 421 { 422 int i; 423 424 if (!(pte0 & HPTE64_V_LARGE)) { 425 if (sps->page_shift != 12) { 426 /* 4kiB page in a non 4kiB segment */ 427 return 0; 428 } 429 /* Normal 4kiB page */ 430 return 12; 431 } 432 433 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 434 const struct ppc_one_page_size *ps = &sps->enc[i]; 435 uint64_t mask; 436 437 if (!ps->page_shift) { 438 break; 439 } 440 441 if (ps->page_shift == 12) { 442 /* L bit is set so this can't be a 4kiB page */ 443 continue; 444 } 445 446 mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN; 447 448 if ((pte1 & mask) == ((uint64_t)ps->pte_enc << HPTE64_R_RPN_SHIFT)) { 449 return ps->page_shift; 450 } 451 } 452 453 return 0; /* Bad page size encoding */ 454 } 455 456 static hwaddr ppc_hash64_pteg_search(PowerPCCPU *cpu, hwaddr hash, 457 const struct ppc_one_seg_page_size *sps, 458 target_ulong ptem, 459 ppc_hash_pte64_t *pte, unsigned *pshift) 460 { 461 int i; 462 const ppc_hash_pte64_t *pteg; 463 target_ulong pte0, pte1; 464 target_ulong ptex; 465 466 ptex = (hash & ppc_hash64_hpt_mask(cpu)) * HPTES_PER_GROUP; 467 pteg = ppc_hash64_map_hptes(cpu, ptex, HPTES_PER_GROUP); 468 if (!pteg) { 469 return -1; 470 } 471 for (i = 0; i < HPTES_PER_GROUP; i++) { 472 pte0 = ppc_hash64_hpte0(cpu, pteg, i); 473 pte1 = ppc_hash64_hpte1(cpu, pteg, i); 474 475 /* This compares V, B, H (secondary) and the AVPN */ 476 if (HPTE64_V_COMPARE(pte0, ptem)) { 477 *pshift = hpte_page_shift(sps, pte0, pte1); 478 /* 479 * If there is no match, ignore the PTE, it could simply 480 * be for a different segment size encoding and the 481 * architecture specifies we should not match. Linux will 482 * potentially leave behind PTEs for the wrong base page 483 * size when demoting segments. 484 */ 485 if (*pshift == 0) { 486 continue; 487 } 488 /* We don't do anything with pshift yet as qemu TLB only deals 489 * with 4K pages anyway 490 */ 491 pte->pte0 = pte0; 492 pte->pte1 = pte1; 493 ppc_hash64_unmap_hptes(cpu, pteg, ptex, HPTES_PER_GROUP); 494 return ptex + i; 495 } 496 } 497 ppc_hash64_unmap_hptes(cpu, pteg, ptex, HPTES_PER_GROUP); 498 /* 499 * We didn't find a valid entry. 500 */ 501 return -1; 502 } 503 504 static hwaddr ppc_hash64_htab_lookup(PowerPCCPU *cpu, 505 ppc_slb_t *slb, target_ulong eaddr, 506 ppc_hash_pte64_t *pte, unsigned *pshift) 507 { 508 CPUPPCState *env = &cpu->env; 509 hwaddr hash, ptex; 510 uint64_t vsid, epnmask, epn, ptem; 511 const struct ppc_one_seg_page_size *sps = slb->sps; 512 513 /* The SLB store path should prevent any bad page size encodings 514 * getting in there, so: */ 515 assert(sps); 516 517 /* If ISL is set in LPCR we need to clamp the page size to 4K */ 518 if (env->spr[SPR_LPCR] & LPCR_ISL) { 519 /* We assume that when using TCG, 4k is first entry of SPS */ 520 sps = &env->sps.sps[0]; 521 assert(sps->page_shift == 12); 522 } 523 524 epnmask = ~((1ULL << sps->page_shift) - 1); 525 526 if (slb->vsid & SLB_VSID_B) { 527 /* 1TB segment */ 528 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T; 529 epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask; 530 hash = vsid ^ (vsid << 25) ^ (epn >> sps->page_shift); 531 } else { 532 /* 256M segment */ 533 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT; 534 epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask; 535 hash = vsid ^ (epn >> sps->page_shift); 536 } 537 ptem = (slb->vsid & SLB_VSID_PTEM) | ((epn >> 16) & HPTE64_V_AVPN); 538 ptem |= HPTE64_V_VALID; 539 540 /* Page address translation */ 541 qemu_log_mask(CPU_LOG_MMU, 542 "htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx 543 " hash " TARGET_FMT_plx "\n", 544 ppc_hash64_hpt_base(cpu), ppc_hash64_hpt_mask(cpu), hash); 545 546 /* Primary PTEG lookup */ 547 qemu_log_mask(CPU_LOG_MMU, 548 "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx 549 " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx 550 " hash=" TARGET_FMT_plx "\n", 551 ppc_hash64_hpt_base(cpu), ppc_hash64_hpt_mask(cpu), 552 vsid, ptem, hash); 553 ptex = ppc_hash64_pteg_search(cpu, hash, sps, ptem, pte, pshift); 554 555 if (ptex == -1) { 556 /* Secondary PTEG lookup */ 557 ptem |= HPTE64_V_SECONDARY; 558 qemu_log_mask(CPU_LOG_MMU, 559 "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx 560 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx 561 " hash=" TARGET_FMT_plx "\n", ppc_hash64_hpt_base(cpu), 562 ppc_hash64_hpt_mask(cpu), vsid, ptem, ~hash); 563 564 ptex = ppc_hash64_pteg_search(cpu, ~hash, sps, ptem, pte, pshift); 565 } 566 567 return ptex; 568 } 569 570 unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU *cpu, 571 uint64_t pte0, uint64_t pte1) 572 { 573 CPUPPCState *env = &cpu->env; 574 int i; 575 576 if (!(pte0 & HPTE64_V_LARGE)) { 577 return 12; 578 } 579 580 /* 581 * The encodings in env->sps need to be carefully chosen so that 582 * this gives an unambiguous result. 583 */ 584 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 585 const struct ppc_one_seg_page_size *sps = &env->sps.sps[i]; 586 unsigned shift; 587 588 if (!sps->page_shift) { 589 break; 590 } 591 592 shift = hpte_page_shift(sps, pte0, pte1); 593 if (shift) { 594 return shift; 595 } 596 } 597 598 return 0; 599 } 600 601 static void ppc_hash64_set_isi(CPUState *cs, CPUPPCState *env, 602 uint64_t error_code) 603 { 604 bool vpm; 605 606 if (msr_ir) { 607 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1); 608 } else { 609 switch (env->mmu_model) { 610 case POWERPC_MMU_3_00: 611 /* Field deprecated in ISAv3.00 - interrupts always go to hyperv */ 612 vpm = true; 613 break; 614 default: 615 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM0); 616 break; 617 } 618 } 619 if (vpm && !msr_hv) { 620 cs->exception_index = POWERPC_EXCP_HISI; 621 } else { 622 cs->exception_index = POWERPC_EXCP_ISI; 623 } 624 env->error_code = error_code; 625 } 626 627 static void ppc_hash64_set_dsi(CPUState *cs, CPUPPCState *env, uint64_t dar, 628 uint64_t dsisr) 629 { 630 bool vpm; 631 632 if (msr_dr) { 633 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1); 634 } else { 635 switch (env->mmu_model) { 636 case POWERPC_MMU_3_00: 637 /* Field deprecated in ISAv3.00 - interrupts always go to hyperv */ 638 vpm = true; 639 break; 640 default: 641 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM0); 642 break; 643 } 644 } 645 if (vpm && !msr_hv) { 646 cs->exception_index = POWERPC_EXCP_HDSI; 647 env->spr[SPR_HDAR] = dar; 648 env->spr[SPR_HDSISR] = dsisr; 649 } else { 650 cs->exception_index = POWERPC_EXCP_DSI; 651 env->spr[SPR_DAR] = dar; 652 env->spr[SPR_DSISR] = dsisr; 653 } 654 env->error_code = 0; 655 } 656 657 658 int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, 659 int rwx, int mmu_idx) 660 { 661 CPUState *cs = CPU(cpu); 662 CPUPPCState *env = &cpu->env; 663 ppc_slb_t *slb; 664 unsigned apshift; 665 hwaddr ptex; 666 ppc_hash_pte64_t pte; 667 int pp_prot, amr_prot, prot; 668 uint64_t new_pte1, dsisr; 669 const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC}; 670 hwaddr raddr; 671 672 assert((rwx == 0) || (rwx == 1) || (rwx == 2)); 673 674 /* Note on LPCR usage: 970 uses HID4, but our special variant 675 * of store_spr copies relevant fields into env->spr[SPR_LPCR]. 676 * Similarily we filter unimplemented bits when storing into 677 * LPCR depending on the MMU version. This code can thus just 678 * use the LPCR "as-is". 679 */ 680 681 /* 1. Handle real mode accesses */ 682 if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) { 683 /* Translation is supposedly "off" */ 684 /* In real mode the top 4 effective address bits are (mostly) ignored */ 685 raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL; 686 687 /* In HV mode, add HRMOR if top EA bit is clear */ 688 if (msr_hv || !env->has_hv_mode) { 689 if (!(eaddr >> 63)) { 690 raddr |= env->spr[SPR_HRMOR]; 691 } 692 } else { 693 /* Otherwise, check VPM for RMA vs VRMA */ 694 if (env->spr[SPR_LPCR] & LPCR_VPM0) { 695 slb = &env->vrma_slb; 696 if (slb->sps) { 697 goto skip_slb_search; 698 } 699 /* Not much else to do here */ 700 cs->exception_index = POWERPC_EXCP_MCHECK; 701 env->error_code = 0; 702 return 1; 703 } else if (raddr < env->rmls) { 704 /* RMA. Check bounds in RMLS */ 705 raddr |= env->spr[SPR_RMOR]; 706 } else { 707 /* The access failed, generate the approriate interrupt */ 708 if (rwx == 2) { 709 ppc_hash64_set_isi(cs, env, 0x08000000); 710 } else { 711 dsisr = 0x08000000; 712 if (rwx == 1) { 713 dsisr |= 0x02000000; 714 } 715 ppc_hash64_set_dsi(cs, env, eaddr, dsisr); 716 } 717 return 1; 718 } 719 } 720 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK, 721 PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx, 722 TARGET_PAGE_SIZE); 723 return 0; 724 } 725 726 /* 2. Translation is on, so look up the SLB */ 727 slb = slb_lookup(cpu, eaddr); 728 if (!slb) { 729 if (rwx == 2) { 730 cs->exception_index = POWERPC_EXCP_ISEG; 731 env->error_code = 0; 732 } else { 733 cs->exception_index = POWERPC_EXCP_DSEG; 734 env->error_code = 0; 735 env->spr[SPR_DAR] = eaddr; 736 } 737 return 1; 738 } 739 740 skip_slb_search: 741 742 /* 3. Check for segment level no-execute violation */ 743 if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) { 744 ppc_hash64_set_isi(cs, env, 0x10000000); 745 return 1; 746 } 747 748 /* 4. Locate the PTE in the hash table */ 749 ptex = ppc_hash64_htab_lookup(cpu, slb, eaddr, &pte, &apshift); 750 if (ptex == -1) { 751 dsisr = 0x40000000; 752 if (rwx == 2) { 753 ppc_hash64_set_isi(cs, env, dsisr); 754 } else { 755 if (rwx == 1) { 756 dsisr |= 0x02000000; 757 } 758 ppc_hash64_set_dsi(cs, env, eaddr, dsisr); 759 } 760 return 1; 761 } 762 qemu_log_mask(CPU_LOG_MMU, 763 "found PTE at index %08" HWADDR_PRIx "\n", ptex); 764 765 /* 5. Check access permissions */ 766 767 pp_prot = ppc_hash64_pte_prot(cpu, slb, pte); 768 amr_prot = ppc_hash64_amr_prot(cpu, pte); 769 prot = pp_prot & amr_prot; 770 771 if ((need_prot[rwx] & ~prot) != 0) { 772 /* Access right violation */ 773 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n"); 774 if (rwx == 2) { 775 ppc_hash64_set_isi(cs, env, 0x08000000); 776 } else { 777 dsisr = 0; 778 if (need_prot[rwx] & ~pp_prot) { 779 dsisr |= 0x08000000; 780 } 781 if (rwx == 1) { 782 dsisr |= 0x02000000; 783 } 784 if (need_prot[rwx] & ~amr_prot) { 785 dsisr |= 0x00200000; 786 } 787 ppc_hash64_set_dsi(cs, env, eaddr, dsisr); 788 } 789 return 1; 790 } 791 792 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n"); 793 794 /* 6. Update PTE referenced and changed bits if necessary */ 795 796 new_pte1 = pte.pte1 | HPTE64_R_R; /* set referenced bit */ 797 if (rwx == 1) { 798 new_pte1 |= HPTE64_R_C; /* set changed (dirty) bit */ 799 } else { 800 /* Treat the page as read-only for now, so that a later write 801 * will pass through this function again to set the C bit */ 802 prot &= ~PAGE_WRITE; 803 } 804 805 if (new_pte1 != pte.pte1) { 806 ppc_hash64_store_hpte(cpu, ptex, pte.pte0, new_pte1); 807 } 808 809 /* 7. Determine the real address from the PTE */ 810 811 raddr = deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, eaddr); 812 813 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK, 814 prot, mmu_idx, 1ULL << apshift); 815 816 return 0; 817 } 818 819 hwaddr ppc_hash64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr) 820 { 821 CPUPPCState *env = &cpu->env; 822 ppc_slb_t *slb; 823 hwaddr ptex, raddr; 824 ppc_hash_pte64_t pte; 825 unsigned apshift; 826 827 /* Handle real mode */ 828 if (msr_dr == 0) { 829 /* In real mode the top 4 effective address bits are ignored */ 830 raddr = addr & 0x0FFFFFFFFFFFFFFFULL; 831 832 /* In HV mode, add HRMOR if top EA bit is clear */ 833 if ((msr_hv || !env->has_hv_mode) && !(addr >> 63)) { 834 return raddr | env->spr[SPR_HRMOR]; 835 } 836 837 /* Otherwise, check VPM for RMA vs VRMA */ 838 if (env->spr[SPR_LPCR] & LPCR_VPM0) { 839 slb = &env->vrma_slb; 840 if (!slb->sps) { 841 return -1; 842 } 843 } else if (raddr < env->rmls) { 844 /* RMA. Check bounds in RMLS */ 845 return raddr | env->spr[SPR_RMOR]; 846 } else { 847 return -1; 848 } 849 } else { 850 slb = slb_lookup(cpu, addr); 851 if (!slb) { 852 return -1; 853 } 854 } 855 856 ptex = ppc_hash64_htab_lookup(cpu, slb, addr, &pte, &apshift); 857 if (ptex == -1) { 858 return -1; 859 } 860 861 return deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, addr) 862 & TARGET_PAGE_MASK; 863 } 864 865 void ppc_hash64_store_hpte(PowerPCCPU *cpu, hwaddr ptex, 866 uint64_t pte0, uint64_t pte1) 867 { 868 hwaddr base = ppc_hash64_hpt_base(cpu); 869 hwaddr offset = ptex * HASH_PTE_SIZE_64; 870 871 if (cpu->vhyp) { 872 PPCVirtualHypervisorClass *vhc = 873 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp); 874 vhc->store_hpte(cpu->vhyp, ptex, pte0, pte1); 875 return; 876 } 877 878 stq_phys(CPU(cpu)->as, base + offset, pte0); 879 stq_phys(CPU(cpu)->as, base + offset + HASH_PTE_SIZE_64 / 2, pte1); 880 } 881 882 void ppc_hash64_tlb_flush_hpte(PowerPCCPU *cpu, target_ulong ptex, 883 target_ulong pte0, target_ulong pte1) 884 { 885 /* 886 * XXX: given the fact that there are too many segments to 887 * invalidate, and we still don't have a tlb_flush_mask(env, n, 888 * mask) in QEMU, we just invalidate all TLBs 889 */ 890 cpu->env.tlb_need_flush = TLB_NEED_GLOBAL_FLUSH | TLB_NEED_LOCAL_FLUSH; 891 } 892 893 void ppc_hash64_update_rmls(CPUPPCState *env) 894 { 895 uint64_t lpcr = env->spr[SPR_LPCR]; 896 897 /* 898 * This is the full 4 bits encoding of POWER8. Previous 899 * CPUs only support a subset of these but the filtering 900 * is done when writing LPCR 901 */ 902 switch ((lpcr & LPCR_RMLS) >> LPCR_RMLS_SHIFT) { 903 case 0x8: /* 32MB */ 904 env->rmls = 0x2000000ull; 905 break; 906 case 0x3: /* 64MB */ 907 env->rmls = 0x4000000ull; 908 break; 909 case 0x7: /* 128MB */ 910 env->rmls = 0x8000000ull; 911 break; 912 case 0x4: /* 256MB */ 913 env->rmls = 0x10000000ull; 914 break; 915 case 0x2: /* 1GB */ 916 env->rmls = 0x40000000ull; 917 break; 918 case 0x1: /* 16GB */ 919 env->rmls = 0x400000000ull; 920 break; 921 default: 922 /* What to do here ??? */ 923 env->rmls = 0; 924 } 925 } 926 927 void ppc_hash64_update_vrma(CPUPPCState *env) 928 { 929 const struct ppc_one_seg_page_size *sps = NULL; 930 target_ulong esid, vsid, lpcr; 931 ppc_slb_t *slb = &env->vrma_slb; 932 uint32_t vrmasd; 933 int i; 934 935 /* First clear it */ 936 slb->esid = slb->vsid = 0; 937 slb->sps = NULL; 938 939 /* Is VRMA enabled ? */ 940 lpcr = env->spr[SPR_LPCR]; 941 if (!(lpcr & LPCR_VPM0)) { 942 return; 943 } 944 945 /* Make one up. Mostly ignore the ESID which will not be 946 * needed for translation 947 */ 948 vsid = SLB_VSID_VRMA; 949 vrmasd = (lpcr & LPCR_VRMASD) >> LPCR_VRMASD_SHIFT; 950 vsid |= (vrmasd << 4) & (SLB_VSID_L | SLB_VSID_LP); 951 esid = SLB_ESID_V; 952 953 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) { 954 const struct ppc_one_seg_page_size *sps1 = &env->sps.sps[i]; 955 956 if (!sps1->page_shift) { 957 break; 958 } 959 960 if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) { 961 sps = sps1; 962 break; 963 } 964 } 965 966 if (!sps) { 967 error_report("Bad page size encoding esid 0x"TARGET_FMT_lx 968 " vsid 0x"TARGET_FMT_lx, esid, vsid); 969 return; 970 } 971 972 slb->vsid = vsid; 973 slb->esid = esid; 974 slb->sps = sps; 975 } 976 977 void helper_store_lpcr(CPUPPCState *env, target_ulong val) 978 { 979 uint64_t lpcr = 0; 980 981 /* Filter out bits */ 982 switch (env->mmu_model) { 983 case POWERPC_MMU_64B: /* 970 */ 984 if (val & 0x40) { 985 lpcr |= LPCR_LPES0; 986 } 987 if (val & 0x8000000000000000ull) { 988 lpcr |= LPCR_LPES1; 989 } 990 if (val & 0x20) { 991 lpcr |= (0x4ull << LPCR_RMLS_SHIFT); 992 } 993 if (val & 0x4000000000000000ull) { 994 lpcr |= (0x2ull << LPCR_RMLS_SHIFT); 995 } 996 if (val & 0x2000000000000000ull) { 997 lpcr |= (0x1ull << LPCR_RMLS_SHIFT); 998 } 999 env->spr[SPR_RMOR] = ((lpcr >> 41) & 0xffffull) << 26; 1000 1001 /* XXX We could also write LPID from HID4 here 1002 * but since we don't tag any translation on it 1003 * it doesn't actually matter 1004 */ 1005 /* XXX For proper emulation of 970 we also need 1006 * to dig HRMOR out of HID5 1007 */ 1008 break; 1009 case POWERPC_MMU_2_03: /* P5p */ 1010 lpcr = val & (LPCR_RMLS | LPCR_ILE | 1011 LPCR_LPES0 | LPCR_LPES1 | 1012 LPCR_RMI | LPCR_HDICE); 1013 break; 1014 case POWERPC_MMU_2_06: /* P7 */ 1015 lpcr = val & (LPCR_VPM0 | LPCR_VPM1 | LPCR_ISL | LPCR_DPFD | 1016 LPCR_VRMASD | LPCR_RMLS | LPCR_ILE | 1017 LPCR_P7_PECE0 | LPCR_P7_PECE1 | LPCR_P7_PECE2 | 1018 LPCR_MER | LPCR_TC | 1019 LPCR_LPES0 | LPCR_LPES1 | LPCR_HDICE); 1020 break; 1021 case POWERPC_MMU_2_07: /* P8 */ 1022 lpcr = val & (LPCR_VPM0 | LPCR_VPM1 | LPCR_ISL | LPCR_KBV | 1023 LPCR_DPFD | LPCR_VRMASD | LPCR_RMLS | LPCR_ILE | 1024 LPCR_AIL | LPCR_ONL | LPCR_P8_PECE0 | LPCR_P8_PECE1 | 1025 LPCR_P8_PECE2 | LPCR_P8_PECE3 | LPCR_P8_PECE4 | 1026 LPCR_MER | LPCR_TC | LPCR_LPES0 | LPCR_HDICE); 1027 break; 1028 case POWERPC_MMU_3_00: /* P9 */ 1029 lpcr = val & (LPCR_VPM1 | LPCR_ISL | LPCR_KBV | LPCR_DPFD | 1030 (LPCR_PECE_U_MASK & LPCR_HVEE) | LPCR_ILE | LPCR_AIL | 1031 LPCR_UPRT | LPCR_EVIRT | LPCR_ONL | 1032 (LPCR_PECE_L_MASK & (LPCR_PDEE | LPCR_HDEE | LPCR_EEE | 1033 LPCR_DEE | LPCR_OEE)) | LPCR_MER | LPCR_GTSE | LPCR_TC | 1034 LPCR_HEIC | LPCR_LPES0 | LPCR_HVICE | LPCR_HDICE); 1035 break; 1036 default: 1037 ; 1038 } 1039 env->spr[SPR_LPCR] = lpcr; 1040 ppc_hash64_update_rmls(env); 1041 ppc_hash64_update_vrma(env); 1042 } 1043