xref: /openbmc/qemu/target/ppc/mmu-radix64.c (revision cde3c425)
1 /*
2  *  PowerPC Radix MMU mulation helpers for QEMU.
3  *
4  *  Copyright (c) 2016 Suraj Jitindar Singh, IBM Corporation
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "cpu.h"
22 #include "exec/exec-all.h"
23 #include "exec/page-protection.h"
24 #include "qemu/error-report.h"
25 #include "sysemu/kvm.h"
26 #include "kvm_ppc.h"
27 #include "exec/log.h"
28 #include "internal.h"
29 #include "mmu-radix64.h"
30 #include "mmu-book3s-v3.h"
31 #include "mmu-books.h"
32 
33 /* Radix Partition Table Entry Fields */
34 #define PATE1_R_PRTB           0x0FFFFFFFFFFFF000
35 #define PATE1_R_PRTS           0x000000000000001F
36 
37 /* Radix Process Table Entry Fields */
38 #define PRTBE_R_GET_RTS(rts) \
39     ((((rts >> 58) & 0x18) | ((rts >> 5) & 0x7)) + 31)
40 #define PRTBE_R_RPDB            0x0FFFFFFFFFFFFF00
41 #define PRTBE_R_RPDS            0x000000000000001F
42 
43 /* Radix Page Directory/Table Entry Fields */
44 #define R_PTE_VALID             0x8000000000000000
45 #define R_PTE_LEAF              0x4000000000000000
46 #define R_PTE_SW0               0x2000000000000000
47 #define R_PTE_RPN               0x01FFFFFFFFFFF000
48 #define R_PTE_SW1               0x0000000000000E00
49 #define R_GET_SW(sw)            (((sw >> 58) & 0x8) | ((sw >> 9) & 0x7))
50 #define R_PTE_R                 0x0000000000000100
51 #define R_PTE_C                 0x0000000000000080
52 #define R_PTE_ATT               0x0000000000000030
53 #define R_PTE_ATT_NORMAL        0x0000000000000000
54 #define R_PTE_ATT_SAO           0x0000000000000010
55 #define R_PTE_ATT_NI_IO         0x0000000000000020
56 #define R_PTE_ATT_TOLERANT_IO   0x0000000000000030
57 #define R_PTE_EAA_PRIV          0x0000000000000008
58 #define R_PTE_EAA_R             0x0000000000000004
59 #define R_PTE_EAA_RW            0x0000000000000002
60 #define R_PTE_EAA_X             0x0000000000000001
61 #define R_PDE_NLB               PRTBE_R_RPDB
62 #define R_PDE_NLS               PRTBE_R_RPDS
63 
64 static bool ppc_radix64_get_fully_qualified_addr(const CPUPPCState *env,
65                                                  vaddr eaddr,
66                                                  uint64_t *lpid, uint64_t *pid)
67 {
68     /* When EA(2:11) are nonzero, raise a segment interrupt */
69     if (eaddr & ~R_EADDR_VALID_MASK) {
70         return false;
71     }
72 
73     if (FIELD_EX64(env->msr, MSR, HV)) { /* MSR[HV] -> Hypervisor/bare metal */
74         switch (eaddr & R_EADDR_QUADRANT) {
75         case R_EADDR_QUADRANT0:
76             *lpid = 0;
77             *pid = env->spr[SPR_BOOKS_PID];
78             break;
79         case R_EADDR_QUADRANT1:
80             *lpid = env->spr[SPR_LPIDR];
81             *pid = env->spr[SPR_BOOKS_PID];
82             break;
83         case R_EADDR_QUADRANT2:
84             *lpid = env->spr[SPR_LPIDR];
85             *pid = 0;
86             break;
87         case R_EADDR_QUADRANT3:
88             *lpid = 0;
89             *pid = 0;
90             break;
91         default:
92             g_assert_not_reached();
93         }
94     } else {  /* !MSR[HV] -> Guest */
95         switch (eaddr & R_EADDR_QUADRANT) {
96         case R_EADDR_QUADRANT0: /* Guest application */
97             *lpid = env->spr[SPR_LPIDR];
98             *pid = env->spr[SPR_BOOKS_PID];
99             break;
100         case R_EADDR_QUADRANT1: /* Illegal */
101         case R_EADDR_QUADRANT2:
102             return false;
103         case R_EADDR_QUADRANT3: /* Guest OS */
104             *lpid = env->spr[SPR_LPIDR];
105             *pid = 0; /* pid set to 0 -> addresses guest operating system */
106             break;
107         default:
108             g_assert_not_reached();
109         }
110     }
111 
112     return true;
113 }
114 
115 static void ppc_radix64_raise_segi(PowerPCCPU *cpu, MMUAccessType access_type,
116                                    vaddr eaddr)
117 {
118     CPUState *cs = CPU(cpu);
119     CPUPPCState *env = &cpu->env;
120 
121     switch (access_type) {
122     case MMU_INST_FETCH:
123         /* Instruction Segment Interrupt */
124         cs->exception_index = POWERPC_EXCP_ISEG;
125         break;
126     case MMU_DATA_STORE:
127     case MMU_DATA_LOAD:
128         /* Data Segment Interrupt */
129         cs->exception_index = POWERPC_EXCP_DSEG;
130         env->spr[SPR_DAR] = eaddr;
131         break;
132     default:
133         g_assert_not_reached();
134     }
135     env->error_code = 0;
136 }
137 
138 static inline const char *access_str(MMUAccessType access_type)
139 {
140     return access_type == MMU_DATA_LOAD ? "reading" :
141         (access_type == MMU_DATA_STORE ? "writing" : "execute");
142 }
143 
144 static void ppc_radix64_raise_si(PowerPCCPU *cpu, MMUAccessType access_type,
145                                  vaddr eaddr, uint32_t cause)
146 {
147     CPUState *cs = CPU(cpu);
148     CPUPPCState *env = &cpu->env;
149 
150     qemu_log_mask(CPU_LOG_MMU, "%s for %s @0x%"VADDR_PRIx" cause %08x\n",
151                   __func__, access_str(access_type),
152                   eaddr, cause);
153 
154     switch (access_type) {
155     case MMU_INST_FETCH:
156         /* Instruction Storage Interrupt */
157         cs->exception_index = POWERPC_EXCP_ISI;
158         env->error_code = cause;
159         break;
160     case MMU_DATA_STORE:
161         cause |= DSISR_ISSTORE;
162         /* fall through */
163     case MMU_DATA_LOAD:
164         /* Data Storage Interrupt */
165         cs->exception_index = POWERPC_EXCP_DSI;
166         env->spr[SPR_DSISR] = cause;
167         env->spr[SPR_DAR] = eaddr;
168         env->error_code = 0;
169         break;
170     default:
171         g_assert_not_reached();
172     }
173 }
174 
175 static void ppc_radix64_raise_hsi(PowerPCCPU *cpu, MMUAccessType access_type,
176                                   vaddr eaddr, hwaddr g_raddr, uint32_t cause)
177 {
178     CPUState *cs = CPU(cpu);
179     CPUPPCState *env = &cpu->env;
180 
181     env->error_code = 0;
182     if (cause & DSISR_PRTABLE_FAULT) {
183         /* HDSI PRTABLE_FAULT gets the originating access type in error_code */
184         env->error_code = access_type;
185         access_type = MMU_DATA_LOAD;
186     }
187 
188     qemu_log_mask(CPU_LOG_MMU, "%s for %s @0x%"VADDR_PRIx" 0x%"
189                   HWADDR_PRIx" cause %08x\n",
190                   __func__, access_str(access_type),
191                   eaddr, g_raddr, cause);
192 
193     switch (access_type) {
194     case MMU_INST_FETCH:
195         /* H Instruction Storage Interrupt */
196         cs->exception_index = POWERPC_EXCP_HISI;
197         env->spr[SPR_ASDR] = g_raddr;
198         env->error_code = cause;
199         break;
200     case MMU_DATA_STORE:
201         cause |= DSISR_ISSTORE;
202         /* fall through */
203     case MMU_DATA_LOAD:
204         /* H Data Storage Interrupt */
205         cs->exception_index = POWERPC_EXCP_HDSI;
206         env->spr[SPR_HDSISR] = cause;
207         env->spr[SPR_HDAR] = eaddr;
208         env->spr[SPR_ASDR] = g_raddr;
209         break;
210     default:
211         g_assert_not_reached();
212     }
213 }
214 
215 static int ppc_radix64_get_prot_eaa(uint64_t pte)
216 {
217     return (pte & R_PTE_EAA_R ? PAGE_READ : 0) |
218            (pte & R_PTE_EAA_RW ? PAGE_READ | PAGE_WRITE : 0) |
219            (pte & R_PTE_EAA_X ? PAGE_EXEC : 0);
220 }
221 
222 static int ppc_radix64_get_prot_amr(const PowerPCCPU *cpu)
223 {
224     const CPUPPCState *env = &cpu->env;
225     int amr = env->spr[SPR_AMR] >> 62; /* We only care about key0 AMR63:62 */
226     int iamr = env->spr[SPR_IAMR] >> 62; /* We only care about key0 IAMR63:62 */
227 
228     return (amr & 0x2 ? 0 : PAGE_WRITE) | /* Access denied if bit is set */
229            (amr & 0x1 ? 0 : PAGE_READ) |
230            (iamr & 0x1 ? 0 : PAGE_EXEC);
231 }
232 
233 static bool ppc_radix64_check_prot(PowerPCCPU *cpu, MMUAccessType access_type,
234                                    uint64_t pte, int *fault_cause, int *prot,
235                                    int mmu_idx, bool partition_scoped)
236 {
237     CPUPPCState *env = &cpu->env;
238 
239     /* Check Page Attributes (pte58:59) */
240     if ((pte & R_PTE_ATT) == R_PTE_ATT_NI_IO && access_type == MMU_INST_FETCH) {
241         /*
242          * Radix PTE entries with the non-idempotent I/O attribute are treated
243          * as guarded storage
244          */
245         *fault_cause |= SRR1_NOEXEC_GUARD;
246         return true;
247     }
248 
249     /* Determine permissions allowed by Encoded Access Authority */
250     if (!partition_scoped && (pte & R_PTE_EAA_PRIV) &&
251         FIELD_EX64(env->msr, MSR, PR)) {
252         *prot = 0;
253     } else if (mmuidx_pr(mmu_idx) || (pte & R_PTE_EAA_PRIV) ||
254                partition_scoped) {
255         *prot = ppc_radix64_get_prot_eaa(pte);
256     } else { /* !MSR_PR && !(pte & R_PTE_EAA_PRIV) && !partition_scoped */
257         *prot = ppc_radix64_get_prot_eaa(pte);
258         *prot &= ppc_radix64_get_prot_amr(cpu); /* Least combined permissions */
259     }
260 
261     /* Check if requested access type is allowed */
262     if (!check_prot_access_type(*prot, access_type)) {
263         /* Page Protected for that Access */
264         *fault_cause |= access_type == MMU_INST_FETCH ? SRR1_NOEXEC_GUARD :
265                                                         DSISR_PROTFAULT;
266         return true;
267     }
268 
269     return false;
270 }
271 
272 static int ppc_radix64_check_rc(MMUAccessType access_type, uint64_t pte)
273 {
274     switch (access_type) {
275     case MMU_DATA_STORE:
276         if (!(pte & R_PTE_C)) {
277             break;
278         }
279         /* fall through */
280     case MMU_INST_FETCH:
281     case MMU_DATA_LOAD:
282         if (!(pte & R_PTE_R)) {
283             break;
284         }
285 
286         /* R/C bits are already set appropriately for this access */
287         return 0;
288     }
289 
290     return 1;
291 }
292 
293 static bool ppc_radix64_is_valid_level(int level, int psize, uint64_t nls)
294 {
295     bool ret;
296 
297     /*
298      * Check if this is a valid level, according to POWER9 and POWER10
299      * Processor User's Manuals, sections 4.10.4.1 and 5.10.6.1, respectively:
300      * Supported Radix Tree Configurations and Resulting Page Sizes.
301      *
302      * Note: these checks are specific to POWER9 and POWER10 CPUs. Any future
303      * CPUs that supports a different Radix MMU configuration will need their
304      * own implementation.
305      */
306     switch (level) {
307     case 0:     /* Root Page Dir */
308         ret = psize == 52 && nls == 13;
309         break;
310     case 1:
311     case 2:
312         ret = nls == 9;
313         break;
314     case 3:
315         ret = nls == 9 || nls == 5;
316         break;
317     default:
318         ret = false;
319     }
320 
321     if (unlikely(!ret)) {
322         qemu_log_mask(LOG_GUEST_ERROR, "invalid radix configuration: "
323                       "level %d size %d nls %"PRIu64"\n",
324                       level, psize, nls);
325     }
326     return ret;
327 }
328 
329 static int ppc_radix64_next_level(AddressSpace *as, vaddr eaddr,
330                                   uint64_t *pte_addr, uint64_t *nls,
331                                   int *psize, uint64_t *pte, int *fault_cause)
332 {
333     uint64_t index, mask, nlb, pde;
334 
335     /* Read page <directory/table> entry from guest address space */
336     pde = ldq_phys(as, *pte_addr);
337     if (!(pde & R_PTE_VALID)) {         /* Invalid Entry */
338         *fault_cause |= DSISR_NOPTE;
339         return 1;
340     }
341 
342     *pte = pde;
343     *psize -= *nls;
344     if (!(pde & R_PTE_LEAF)) { /* Prepare for next iteration */
345         *nls = pde & R_PDE_NLS;
346         index = eaddr >> (*psize - *nls);       /* Shift */
347         index &= ((1UL << *nls) - 1);           /* Mask */
348         nlb = pde & R_PDE_NLB;
349         mask = MAKE_64BIT_MASK(0, *nls + 3);
350 
351         if (nlb & mask) {
352             qemu_log_mask(LOG_GUEST_ERROR,
353                 "%s: misaligned page dir/table base: 0x%" PRIx64
354                 " page dir size: 0x%" PRIx64 "\n",
355                 __func__, nlb, mask + 1);
356             nlb &= ~mask;
357         }
358         *pte_addr = nlb + index * sizeof(pde);
359     }
360     return 0;
361 }
362 
363 static int ppc_radix64_walk_tree(AddressSpace *as, vaddr eaddr,
364                                  uint64_t base_addr, uint64_t nls,
365                                  hwaddr *raddr, int *psize, uint64_t *pte,
366                                  int *fault_cause, hwaddr *pte_addr)
367 {
368     uint64_t index, pde, rpn, mask;
369     int level = 0;
370 
371     index = eaddr >> (*psize - nls);    /* Shift */
372     index &= ((1UL << nls) - 1);        /* Mask */
373     mask = MAKE_64BIT_MASK(0, nls + 3);
374 
375     if (base_addr & mask) {
376         qemu_log_mask(LOG_GUEST_ERROR,
377             "%s: misaligned page dir base: 0x%" PRIx64
378             " page dir size: 0x%" PRIx64 "\n",
379             __func__, base_addr, mask + 1);
380         base_addr &= ~mask;
381     }
382     *pte_addr = base_addr + index * sizeof(pde);
383 
384     do {
385         int ret;
386 
387         if (!ppc_radix64_is_valid_level(level++, *psize, nls)) {
388             *fault_cause |= DSISR_R_BADCONFIG;
389             return 1;
390         }
391 
392         ret = ppc_radix64_next_level(as, eaddr, pte_addr, &nls, psize, &pde,
393                                      fault_cause);
394         if (ret) {
395             return ret;
396         }
397     } while (!(pde & R_PTE_LEAF));
398 
399     *pte = pde;
400     rpn = pde & R_PTE_RPN;
401     mask = (1UL << *psize) - 1;
402 
403     /* Or high bits of rpn and low bits to ea to form whole real addr */
404     *raddr = (rpn & ~mask) | (eaddr & mask);
405     return 0;
406 }
407 
408 static bool validate_pate(PowerPCCPU *cpu, uint64_t lpid, ppc_v3_pate_t *pate)
409 {
410     CPUPPCState *env = &cpu->env;
411 
412     if (!(pate->dw0 & PATE0_HR)) {
413         return false;
414     }
415     if (lpid == 0 && !FIELD_EX64(env->msr, MSR, HV)) {
416         return false;
417     }
418     if ((pate->dw0 & PATE1_R_PRTS) < 5) {
419         return false;
420     }
421     /* More checks ... */
422     return true;
423 }
424 
425 static int ppc_radix64_partition_scoped_xlate(PowerPCCPU *cpu,
426                                               MMUAccessType orig_access_type,
427                                               vaddr eaddr, hwaddr g_raddr,
428                                               ppc_v3_pate_t pate,
429                                               hwaddr *h_raddr, int *h_prot,
430                                               int *h_page_size, bool pde_addr,
431                                               int mmu_idx, uint64_t lpid,
432                                               bool guest_visible)
433 {
434     MMUAccessType access_type = orig_access_type;
435     int fault_cause = 0;
436     hwaddr pte_addr;
437     uint64_t pte;
438 
439     if (pde_addr) {
440         /*
441          * Translation of process-scoped tables/directories is performed as
442          * a read-access.
443          */
444         access_type = MMU_DATA_LOAD;
445     }
446 
447     qemu_log_mask(CPU_LOG_MMU, "%s for %s @0x%"VADDR_PRIx
448                   " mmu_idx %u 0x%"HWADDR_PRIx"\n",
449                   __func__, access_str(access_type),
450                   eaddr, mmu_idx, g_raddr);
451 
452     *h_page_size = PRTBE_R_GET_RTS(pate.dw0);
453     /* No valid pte or access denied due to protection */
454     if (ppc_radix64_walk_tree(CPU(cpu)->as, g_raddr, pate.dw0 & PRTBE_R_RPDB,
455                               pate.dw0 & PRTBE_R_RPDS, h_raddr, h_page_size,
456                               &pte, &fault_cause, &pte_addr) ||
457         ppc_radix64_check_prot(cpu, access_type, pte,
458                                &fault_cause, h_prot, mmu_idx, true)) {
459         if (pde_addr) { /* address being translated was that of a guest pde */
460             fault_cause |= DSISR_PRTABLE_FAULT;
461         }
462         if (guest_visible) {
463             ppc_radix64_raise_hsi(cpu, orig_access_type,
464                                   eaddr, g_raddr, fault_cause);
465         }
466         return 1;
467     }
468 
469     if (guest_visible) {
470         if (ppc_radix64_check_rc(access_type, pte)) {
471             /*
472              * Per ISA 3.1 Book III, 7.5.3 and 7.5.5, failure to set R/C during
473              * partition-scoped translation when effLPID = 0 results in normal
474              * (non-Hypervisor) Data and Instruction Storage Interrupts
475              * respectively.
476              *
477              * ISA 3.0 is ambiguous about this, but tests on POWER9 hardware
478              * seem to exhibit the same behavior.
479              */
480             if (lpid > 0) {
481                 ppc_radix64_raise_hsi(cpu, access_type, eaddr, g_raddr,
482                                       DSISR_ATOMIC_RC);
483             } else {
484                 ppc_radix64_raise_si(cpu, access_type, eaddr, DSISR_ATOMIC_RC);
485             }
486             return 1;
487         }
488     }
489 
490     return 0;
491 }
492 
493 /*
494  * The spapr vhc has a flat partition scope provided by qemu memory when
495  * not nested.
496  *
497  * When running a nested guest, the addressing is 2-level radix on top of the
498  * vhc memory, so it works practically identically to the bare metal 2-level
499  * radix. So that code is selected directly. A cleaner and more flexible nested
500  * hypervisor implementation would allow the vhc to provide a ->nested_xlate()
501  * function but that is not required for the moment.
502  */
503 static bool vhyp_flat_addressing(PowerPCCPU *cpu)
504 {
505     if (cpu->vhyp) {
506         return !vhyp_cpu_in_nested(cpu);
507     }
508     return false;
509 }
510 
511 static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
512                                             MMUAccessType access_type,
513                                             vaddr eaddr, uint64_t pid,
514                                             ppc_v3_pate_t pate, hwaddr *g_raddr,
515                                             int *g_prot, int *g_page_size,
516                                             int mmu_idx, uint64_t lpid,
517                                             bool guest_visible)
518 {
519     CPUState *cs = CPU(cpu);
520     CPUPPCState *env = &cpu->env;
521     uint64_t offset, size, prtb, prtbe_addr, prtbe0, base_addr, nls, index, pte;
522     int fault_cause = 0, h_page_size, h_prot;
523     hwaddr h_raddr, pte_addr;
524     int ret;
525 
526     qemu_log_mask(CPU_LOG_MMU, "%s for %s @0x%"VADDR_PRIx
527                   " mmu_idx %u pid %"PRIu64"\n",
528                   __func__, access_str(access_type),
529                   eaddr, mmu_idx, pid);
530 
531     prtb = (pate.dw1 & PATE1_R_PRTB);
532     size = 1ULL << ((pate.dw1 & PATE1_R_PRTS) + 12);
533     if (prtb & (size - 1)) {
534         /* Process Table not properly aligned */
535         if (guest_visible) {
536             ppc_radix64_raise_si(cpu, access_type, eaddr, DSISR_R_BADCONFIG);
537         }
538         return 1;
539     }
540 
541     /* Index Process Table by PID to Find Corresponding Process Table Entry */
542     offset = pid * sizeof(struct prtb_entry);
543     if (offset >= size) {
544         /* offset exceeds size of the process table */
545         if (guest_visible) {
546             ppc_radix64_raise_si(cpu, access_type, eaddr, DSISR_NOPTE);
547         }
548         return 1;
549     }
550     prtbe_addr = prtb + offset;
551 
552     if (vhyp_flat_addressing(cpu)) {
553         prtbe0 = ldq_phys(cs->as, prtbe_addr);
554     } else {
555         /*
556          * Process table addresses are subject to partition-scoped
557          * translation
558          *
559          * On a Radix host, the partition-scoped page table for LPID=0
560          * is only used to translate the effective addresses of the
561          * process table entries.
562          */
563         /* mmu_idx is 5 because we're translating from hypervisor scope */
564         ret = ppc_radix64_partition_scoped_xlate(cpu, access_type, eaddr,
565                                                  prtbe_addr, pate, &h_raddr,
566                                                  &h_prot, &h_page_size, true,
567                                                  5, lpid, guest_visible);
568         if (ret) {
569             return ret;
570         }
571         prtbe0 = ldq_phys(cs->as, h_raddr);
572     }
573 
574     /* Walk Radix Tree from Process Table Entry to Convert EA to RA */
575     *g_page_size = PRTBE_R_GET_RTS(prtbe0);
576     base_addr = prtbe0 & PRTBE_R_RPDB;
577     nls = prtbe0 & PRTBE_R_RPDS;
578     if (FIELD_EX64(env->msr, MSR, HV) || vhyp_flat_addressing(cpu)) {
579         /*
580          * Can treat process table addresses as real addresses
581          */
582         ret = ppc_radix64_walk_tree(cs->as, eaddr & R_EADDR_MASK, base_addr,
583                                     nls, g_raddr, g_page_size, &pte,
584                                     &fault_cause, &pte_addr);
585         if (ret) {
586             /* No valid PTE */
587             if (guest_visible) {
588                 ppc_radix64_raise_si(cpu, access_type, eaddr, fault_cause);
589             }
590             return ret;
591         }
592     } else {
593         uint64_t rpn, mask;
594         int level = 0;
595 
596         index = (eaddr & R_EADDR_MASK) >> (*g_page_size - nls); /* Shift */
597         index &= ((1UL << nls) - 1);                            /* Mask */
598         pte_addr = base_addr + (index * sizeof(pte));
599 
600         /*
601          * Each process table address is subject to a partition-scoped
602          * translation
603          */
604         do {
605             /* mmu_idx is 5 because we're translating from hypervisor scope */
606             ret = ppc_radix64_partition_scoped_xlate(cpu, access_type, eaddr,
607                                                      pte_addr, pate, &h_raddr,
608                                                      &h_prot, &h_page_size,
609                                                      true, 5, lpid,
610                                                      guest_visible);
611             if (ret) {
612                 return ret;
613             }
614 
615             if (!ppc_radix64_is_valid_level(level++, *g_page_size, nls)) {
616                 fault_cause |= DSISR_R_BADCONFIG;
617                 ret = 1;
618             } else {
619                 ret = ppc_radix64_next_level(cs->as, eaddr & R_EADDR_MASK,
620                                              &h_raddr, &nls, g_page_size,
621                                              &pte, &fault_cause);
622             }
623 
624             if (ret) {
625                 /* No valid pte */
626                 if (guest_visible) {
627                     ppc_radix64_raise_si(cpu, access_type, eaddr, fault_cause);
628                 }
629                 return ret;
630             }
631             pte_addr = h_raddr;
632         } while (!(pte & R_PTE_LEAF));
633 
634         rpn = pte & R_PTE_RPN;
635         mask = (1UL << *g_page_size) - 1;
636 
637         /* Or high bits of rpn and low bits to ea to form whole real addr */
638         *g_raddr = (rpn & ~mask) | (eaddr & mask);
639     }
640 
641     if (ppc_radix64_check_prot(cpu, access_type, pte, &fault_cause,
642                                g_prot, mmu_idx, false)) {
643         /* Access denied due to protection */
644         if (guest_visible) {
645             ppc_radix64_raise_si(cpu, access_type, eaddr, fault_cause);
646         }
647         return 1;
648     }
649 
650     if (guest_visible) {
651         /* R/C bits not appropriately set for access */
652         if (ppc_radix64_check_rc(access_type, pte)) {
653             ppc_radix64_raise_si(cpu, access_type, eaddr, DSISR_ATOMIC_RC);
654             return 1;
655         }
656     }
657 
658     return 0;
659 }
660 
661 /*
662  * Radix tree translation is a 2 steps translation process:
663  *
664  * 1. Process-scoped translation:   Guest Eff Addr  -> Guest Real Addr
665  * 2. Partition-scoped translation: Guest Real Addr -> Host Real Addr
666  *
667  *                                  MSR[HV]
668  *              +-------------+----------------+---------------+
669  *              |             |     HV = 0     |     HV = 1    |
670  *              +-------------+----------------+---------------+
671  *              | Relocation  |    Partition   |      No       |
672  *              | = Off       |     Scoped     |  Translation  |
673  *  Relocation  +-------------+----------------+---------------+
674  *              | Relocation  |   Partition &  |    Process    |
675  *              | = On        | Process Scoped |    Scoped     |
676  *              +-------------+----------------+---------------+
677  */
678 static bool ppc_radix64_xlate_impl(PowerPCCPU *cpu, vaddr eaddr,
679                                    MMUAccessType access_type, hwaddr *raddr,
680                                    int *psizep, int *protp, int mmu_idx,
681                                    bool guest_visible)
682 {
683     CPUPPCState *env = &cpu->env;
684     uint64_t lpid, pid;
685     ppc_v3_pate_t pate;
686     int psize, prot;
687     hwaddr g_raddr;
688     bool relocation;
689 
690     assert(!(mmuidx_hv(mmu_idx) && cpu->vhyp));
691 
692     relocation = !mmuidx_real(mmu_idx);
693 
694     /* HV or virtual hypervisor Real Mode Access */
695     if (!relocation && (mmuidx_hv(mmu_idx) || vhyp_flat_addressing(cpu))) {
696         /* In real mode top 4 effective addr bits (mostly) ignored */
697         *raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
698 
699         /* In HV mode, add HRMOR if top EA bit is clear */
700         if (mmuidx_hv(mmu_idx) || !env->has_hv_mode) {
701             if (!(eaddr >> 63)) {
702                 *raddr |= env->spr[SPR_HRMOR];
703            }
704         }
705         *protp = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
706         *psizep = TARGET_PAGE_BITS;
707         return true;
708     }
709 
710     /*
711      * Check UPRT (we avoid the check in real mode to deal with
712      * transitional states during kexec.
713      */
714     if (guest_visible && !ppc64_use_proc_tbl(cpu)) {
715         qemu_log_mask(LOG_GUEST_ERROR,
716                       "LPCR:UPRT not set in radix mode ! LPCR="
717                       TARGET_FMT_lx "\n", env->spr[SPR_LPCR]);
718     }
719 
720     /* Virtual Mode Access - get the fully qualified address */
721     if (!ppc_radix64_get_fully_qualified_addr(&cpu->env, eaddr, &lpid, &pid)) {
722         if (guest_visible) {
723             ppc_radix64_raise_segi(cpu, access_type, eaddr);
724         }
725         return false;
726     }
727 
728     /* Get Partition Table */
729     if (cpu->vhyp) {
730         if (!cpu->vhyp_class->get_pate(cpu->vhyp, cpu, lpid, &pate)) {
731             if (guest_visible) {
732                 ppc_radix64_raise_hsi(cpu, access_type, eaddr, eaddr,
733                                       DSISR_R_BADCONFIG);
734             }
735             return false;
736         }
737     } else {
738         if (!ppc64_v3_get_pate(cpu, lpid, &pate)) {
739             if (guest_visible) {
740                 ppc_radix64_raise_hsi(cpu, access_type, eaddr, eaddr,
741                                       DSISR_R_BADCONFIG);
742             }
743             return false;
744         }
745         if (!validate_pate(cpu, lpid, &pate)) {
746             if (guest_visible) {
747                 ppc_radix64_raise_hsi(cpu, access_type, eaddr, eaddr,
748                                       DSISR_R_BADCONFIG);
749             }
750             return false;
751         }
752     }
753 
754     *psizep = INT_MAX;
755     *protp = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
756 
757     /*
758      * Perform process-scoped translation if relocation enabled.
759      *
760      * - Translates an effective address to a host real address in
761      *   quadrants 0 and 3 when HV=1.
762      *
763      * - Translates an effective address to a guest real address.
764      */
765     if (relocation) {
766         int ret = ppc_radix64_process_scoped_xlate(cpu, access_type, eaddr, pid,
767                                                    pate, &g_raddr, &prot,
768                                                    &psize, mmu_idx, lpid,
769                                                    guest_visible);
770         if (ret) {
771             return false;
772         }
773         *psizep = MIN(*psizep, psize);
774         *protp &= prot;
775     } else {
776         g_raddr = eaddr & R_EADDR_MASK;
777     }
778 
779     if (vhyp_flat_addressing(cpu)) {
780         *raddr = g_raddr;
781     } else {
782         /*
783          * Perform partition-scoped translation if !HV or HV access to
784          * quadrants 1 or 2. Translates a guest real address to a host
785          * real address.
786          */
787         if (lpid || !mmuidx_hv(mmu_idx)) {
788             int ret;
789 
790             ret = ppc_radix64_partition_scoped_xlate(cpu, access_type, eaddr,
791                                                      g_raddr, pate, raddr,
792                                                      &prot, &psize, false,
793                                                      mmu_idx, lpid,
794                                                      guest_visible);
795             if (ret) {
796                 return false;
797             }
798             *psizep = MIN(*psizep, psize);
799             *protp &= prot;
800         } else {
801             *raddr = g_raddr;
802         }
803     }
804 
805     return true;
806 }
807 
808 bool ppc_radix64_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
809                        hwaddr *raddrp, int *psizep, int *protp, int mmu_idx,
810                        bool guest_visible)
811 {
812     bool ret = ppc_radix64_xlate_impl(cpu, eaddr, access_type, raddrp,
813                                       psizep, protp, mmu_idx, guest_visible);
814 
815     qemu_log_mask(CPU_LOG_MMU, "%s for %s @0x%"VADDR_PRIx
816                   " mmu_idx %u (prot %c%c%c) -> 0x%"HWADDR_PRIx"\n",
817                   __func__, access_str(access_type),
818                   eaddr, mmu_idx,
819                   *protp & PAGE_READ ? 'r' : '-',
820                   *protp & PAGE_WRITE ? 'w' : '-',
821                   *protp & PAGE_EXEC ? 'x' : '-',
822                   *raddrp);
823 
824     return ret;
825 }
826