tests: virtio-9p: rename PCI configuration test
[qemu.git] / target / ppc / mmu-hash64.c
1 /*
2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
3 *
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 * Copyright (c) 2013 David Gibson, IBM Corporation
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19 */
20 #include "qemu/osdep.h"
21 #include "qapi/error.h"
22 #include "cpu.h"
23 #include "exec/exec-all.h"
24 #include "exec/helper-proto.h"
25 #include "qemu/error-report.h"
26 #include "sysemu/kvm.h"
27 #include "kvm_ppc.h"
28 #include "mmu-hash64.h"
29 #include "exec/log.h"
30
31 //#define DEBUG_SLB
32
33 #ifdef DEBUG_SLB
34 # define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
35 #else
36 # define LOG_SLB(...) do { } while (0)
37 #endif
38
39 /*
40 * Used to indicate that a CPU has its hash page table (HPT) managed
41 * within the host kernel
42 */
43 #define MMU_HASH64_KVM_MANAGED_HPT ((void *)-1)
44
45 /*
46 * SLB handling
47 */
48
49 static ppc_slb_t *slb_lookup(PowerPCCPU *cpu, target_ulong eaddr)
50 {
51 CPUPPCState *env = &cpu->env;
52 uint64_t esid_256M, esid_1T;
53 int n;
54
55 LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);
56
57 esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V;
58 esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V;
59
60 for (n = 0; n < env->slb_nr; n++) {
61 ppc_slb_t *slb = &env->slb[n];
62
63 LOG_SLB("%s: slot %d %016" PRIx64 " %016"
64 PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
65 /* We check for 1T matches on all MMUs here - if the MMU
66 * doesn't have 1T segment support, we will have prevented 1T
67 * entries from being inserted in the slbmte code. */
68 if (((slb->esid == esid_256M) &&
69 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
70 || ((slb->esid == esid_1T) &&
71 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
72 return slb;
73 }
74 }
75
76 return NULL;
77 }
78
79 void dump_slb(FILE *f, fprintf_function cpu_fprintf, PowerPCCPU *cpu)
80 {
81 CPUPPCState *env = &cpu->env;
82 int i;
83 uint64_t slbe, slbv;
84
85 cpu_synchronize_state(CPU(cpu));
86
87 cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
88 for (i = 0; i < env->slb_nr; i++) {
89 slbe = env->slb[i].esid;
90 slbv = env->slb[i].vsid;
91 if (slbe == 0 && slbv == 0) {
92 continue;
93 }
94 cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
95 i, slbe, slbv);
96 }
97 }
98
99 void helper_slbia(CPUPPCState *env)
100 {
101 int n;
102
103 /* XXX: Warning: slbia never invalidates the first segment */
104 for (n = 1; n < env->slb_nr; n++) {
105 ppc_slb_t *slb = &env->slb[n];
106
107 if (slb->esid & SLB_ESID_V) {
108 slb->esid &= ~SLB_ESID_V;
109 /* XXX: given the fact that segment size is 256 MB or 1TB,
110 * and we still don't have a tlb_flush_mask(env, n, mask)
111 * in QEMU, we just invalidate all TLBs
112 */
113 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH;
114 }
115 }
116 }
117
118 void helper_slbie(CPUPPCState *env, target_ulong addr)
119 {
120 PowerPCCPU *cpu = ppc_env_get_cpu(env);
121 ppc_slb_t *slb;
122
123 slb = slb_lookup(cpu, addr);
124 if (!slb) {
125 return;
126 }
127
128 if (slb->esid & SLB_ESID_V) {
129 slb->esid &= ~SLB_ESID_V;
130
131 /* XXX: given the fact that segment size is 256 MB or 1TB,
132 * and we still don't have a tlb_flush_mask(env, n, mask)
133 * in QEMU, we just invalidate all TLBs
134 */
135 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH;
136 }
137 }
138
139 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot,
140 target_ulong esid, target_ulong vsid)
141 {
142 CPUPPCState *env = &cpu->env;
143 ppc_slb_t *slb = &env->slb[slot];
144 const struct ppc_one_seg_page_size *sps = NULL;
145 int i;
146
147 if (slot >= env->slb_nr) {
148 return -1; /* Bad slot number */
149 }
150 if (esid & ~(SLB_ESID_ESID | SLB_ESID_V)) {
151 return -1; /* Reserved bits set */
152 }
153 if (vsid & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
154 return -1; /* Bad segment size */
155 }
156 if ((vsid & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
157 return -1; /* 1T segment on MMU that doesn't support it */
158 }
159
160 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
161 const struct ppc_one_seg_page_size *sps1 = &env->sps.sps[i];
162
163 if (!sps1->page_shift) {
164 break;
165 }
166
167 if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) {
168 sps = sps1;
169 break;
170 }
171 }
172
173 if (!sps) {
174 error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu
175 " esid 0x"TARGET_FMT_lx" vsid 0x"TARGET_FMT_lx,
176 slot, esid, vsid);
177 return -1;
178 }
179
180 slb->esid = esid;
181 slb->vsid = vsid;
182 slb->sps = sps;
183
184 LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
185 " %016" PRIx64 "\n", __func__, slot, esid, vsid,
186 slb->esid, slb->vsid);
187
188 return 0;
189 }
190
191 static int ppc_load_slb_esid(PowerPCCPU *cpu, target_ulong rb,
192 target_ulong *rt)
193 {
194 CPUPPCState *env = &cpu->env;
195 int slot = rb & 0xfff;
196 ppc_slb_t *slb = &env->slb[slot];
197
198 if (slot >= env->slb_nr) {
199 return -1;
200 }
201
202 *rt = slb->esid;
203 return 0;
204 }
205
206 static int ppc_load_slb_vsid(PowerPCCPU *cpu, target_ulong rb,
207 target_ulong *rt)
208 {
209 CPUPPCState *env = &cpu->env;
210 int slot = rb & 0xfff;
211 ppc_slb_t *slb = &env->slb[slot];
212
213 if (slot >= env->slb_nr) {
214 return -1;
215 }
216
217 *rt = slb->vsid;
218 return 0;
219 }
220
221 static int ppc_find_slb_vsid(PowerPCCPU *cpu, target_ulong rb,
222 target_ulong *rt)
223 {
224 CPUPPCState *env = &cpu->env;
225 ppc_slb_t *slb;
226
227 if (!msr_is_64bit(env, env->msr)) {
228 rb &= 0xffffffff;
229 }
230 slb = slb_lookup(cpu, rb);
231 if (slb == NULL) {
232 *rt = (target_ulong)-1ul;
233 } else {
234 *rt = slb->vsid;
235 }
236 return 0;
237 }
238
239 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
240 {
241 PowerPCCPU *cpu = ppc_env_get_cpu(env);
242
243 if (ppc_store_slb(cpu, rb & 0xfff, rb & ~0xfffULL, rs) < 0) {
244 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
245 POWERPC_EXCP_INVAL, GETPC());
246 }
247 }
248
249 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
250 {
251 PowerPCCPU *cpu = ppc_env_get_cpu(env);
252 target_ulong rt = 0;
253
254 if (ppc_load_slb_esid(cpu, rb, &rt) < 0) {
255 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
256 POWERPC_EXCP_INVAL, GETPC());
257 }
258 return rt;
259 }
260
261 target_ulong helper_find_slb_vsid(CPUPPCState *env, target_ulong rb)
262 {
263 PowerPCCPU *cpu = ppc_env_get_cpu(env);
264 target_ulong rt = 0;
265
266 if (ppc_find_slb_vsid(cpu, rb, &rt) < 0) {
267 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
268 POWERPC_EXCP_INVAL, GETPC());
269 }
270 return rt;
271 }
272
273 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
274 {
275 PowerPCCPU *cpu = ppc_env_get_cpu(env);
276 target_ulong rt = 0;
277
278 if (ppc_load_slb_vsid(cpu, rb, &rt) < 0) {
279 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
280 POWERPC_EXCP_INVAL, GETPC());
281 }
282 return rt;
283 }
284
285 /*
286 * 64-bit hash table MMU handling
287 */
288 void ppc_hash64_set_sdr1(PowerPCCPU *cpu, target_ulong value,
289 Error **errp)
290 {
291 CPUPPCState *env = &cpu->env;
292 target_ulong htabsize = value & SDR_64_HTABSIZE;
293
294 env->spr[SPR_SDR1] = value;
295 if (htabsize > 28) {
296 error_setg(errp,
297 "Invalid HTABSIZE 0x" TARGET_FMT_lx" stored in SDR1",
298 htabsize);
299 htabsize = 28;
300 }
301 env->htab_mask = (1ULL << (htabsize + 18 - 7)) - 1;
302 env->htab_base = value & SDR_64_HTABORG;
303 }
304
305 void ppc_hash64_set_external_hpt(PowerPCCPU *cpu, void *hpt, int shift,
306 Error **errp)
307 {
308 CPUPPCState *env = &cpu->env;
309 Error *local_err = NULL;
310
311 if (hpt) {
312 env->external_htab = hpt;
313 } else {
314 env->external_htab = MMU_HASH64_KVM_MANAGED_HPT;
315 }
316 ppc_hash64_set_sdr1(cpu, (target_ulong)(uintptr_t)hpt | (shift - 18),
317 &local_err);
318 if (local_err) {
319 error_propagate(errp, local_err);
320 return;
321 }
322
323 /* Not strictly necessary, but makes it clearer that an external
324 * htab is in use when debugging */
325 env->htab_base = -1;
326
327 if (kvm_enabled()) {
328 if (kvmppc_put_books_sregs(cpu) < 0) {
329 error_setg(errp, "Unable to update SDR1 in KVM");
330 }
331 }
332 }
333
334 static int ppc_hash64_pte_prot(PowerPCCPU *cpu,
335 ppc_slb_t *slb, ppc_hash_pte64_t pte)
336 {
337 CPUPPCState *env = &cpu->env;
338 unsigned pp, key;
339 /* Some pp bit combinations have undefined behaviour, so default
340 * to no access in those cases */
341 int prot = 0;
342
343 key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP)
344 : (slb->vsid & SLB_VSID_KS));
345 pp = (pte.pte1 & HPTE64_R_PP) | ((pte.pte1 & HPTE64_R_PP0) >> 61);
346
347 if (key == 0) {
348 switch (pp) {
349 case 0x0:
350 case 0x1:
351 case 0x2:
352 prot = PAGE_READ | PAGE_WRITE;
353 break;
354
355 case 0x3:
356 case 0x6:
357 prot = PAGE_READ;
358 break;
359 }
360 } else {
361 switch (pp) {
362 case 0x0:
363 case 0x6:
364 prot = 0;
365 break;
366
367 case 0x1:
368 case 0x3:
369 prot = PAGE_READ;
370 break;
371
372 case 0x2:
373 prot = PAGE_READ | PAGE_WRITE;
374 break;
375 }
376 }
377
378 /* No execute if either noexec or guarded bits set */
379 if (!(pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G)
380 || (slb->vsid & SLB_VSID_N)) {
381 prot |= PAGE_EXEC;
382 }
383
384 return prot;
385 }
386
387 static int ppc_hash64_amr_prot(PowerPCCPU *cpu, ppc_hash_pte64_t pte)
388 {
389 CPUPPCState *env = &cpu->env;
390 int key, amrbits;
391 int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
392
393 /* Only recent MMUs implement Virtual Page Class Key Protection */
394 if (!(env->mmu_model & POWERPC_MMU_AMR)) {
395 return prot;
396 }
397
398 key = HPTE64_R_KEY(pte.pte1);
399 amrbits = (env->spr[SPR_AMR] >> 2*(31 - key)) & 0x3;
400
401 /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */
402 /* env->spr[SPR_AMR]); */
403
404 /*
405 * A store is permitted if the AMR bit is 0. Remove write
406 * protection if it is set.
407 */
408 if (amrbits & 0x2) {
409 prot &= ~PAGE_WRITE;
410 }
411 /*
412 * A load is permitted if the AMR bit is 0. Remove read
413 * protection if it is set.
414 */
415 if (amrbits & 0x1) {
416 prot &= ~PAGE_READ;
417 }
418
419 return prot;
420 }
421
422 uint64_t ppc_hash64_start_access(PowerPCCPU *cpu, target_ulong pte_index)
423 {
424 uint64_t token = 0;
425 hwaddr pte_offset;
426
427 pte_offset = pte_index * HASH_PTE_SIZE_64;
428 if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) {
429 /*
430 * HTAB is controlled by KVM. Fetch the PTEG into a new buffer.
431 */
432 token = kvmppc_hash64_read_pteg(cpu, pte_index);
433 } else if (cpu->env.external_htab) {
434 /*
435 * HTAB is controlled by QEMU. Just point to the internally
436 * accessible PTEG.
437 */
438 token = (uint64_t)(uintptr_t) cpu->env.external_htab + pte_offset;
439 } else if (cpu->env.htab_base) {
440 token = cpu->env.htab_base + pte_offset;
441 }
442 return token;
443 }
444
445 void ppc_hash64_stop_access(PowerPCCPU *cpu, uint64_t token)
446 {
447 if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) {
448 kvmppc_hash64_free_pteg(token);
449 }
450 }
451
452 static unsigned hpte_page_shift(const struct ppc_one_seg_page_size *sps,
453 uint64_t pte0, uint64_t pte1)
454 {
455 int i;
456
457 if (!(pte0 & HPTE64_V_LARGE)) {
458 if (sps->page_shift != 12) {
459 /* 4kiB page in a non 4kiB segment */
460 return 0;
461 }
462 /* Normal 4kiB page */
463 return 12;
464 }
465
466 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
467 const struct ppc_one_page_size *ps = &sps->enc[i];
468 uint64_t mask;
469
470 if (!ps->page_shift) {
471 break;
472 }
473
474 if (ps->page_shift == 12) {
475 /* L bit is set so this can't be a 4kiB page */
476 continue;
477 }
478
479 mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN;
480
481 if ((pte1 & mask) == ((uint64_t)ps->pte_enc << HPTE64_R_RPN_SHIFT)) {
482 return ps->page_shift;
483 }
484 }
485
486 return 0; /* Bad page size encoding */
487 }
488
489 static hwaddr ppc_hash64_pteg_search(PowerPCCPU *cpu, hwaddr hash,
490 const struct ppc_one_seg_page_size *sps,
491 target_ulong ptem,
492 ppc_hash_pte64_t *pte, unsigned *pshift)
493 {
494 CPUPPCState *env = &cpu->env;
495 int i;
496 uint64_t token;
497 target_ulong pte0, pte1;
498 target_ulong pte_index;
499
500 pte_index = (hash & env->htab_mask) * HPTES_PER_GROUP;
501 token = ppc_hash64_start_access(cpu, pte_index);
502 if (!token) {
503 return -1;
504 }
505 for (i = 0; i < HPTES_PER_GROUP; i++) {
506 pte0 = ppc_hash64_load_hpte0(cpu, token, i);
507 pte1 = ppc_hash64_load_hpte1(cpu, token, i);
508
509 /* This compares V, B, H (secondary) and the AVPN */
510 if (HPTE64_V_COMPARE(pte0, ptem)) {
511 *pshift = hpte_page_shift(sps, pte0, pte1);
512 /*
513 * If there is no match, ignore the PTE, it could simply
514 * be for a different segment size encoding and the
515 * architecture specifies we should not match. Linux will
516 * potentially leave behind PTEs for the wrong base page
517 * size when demoting segments.
518 */
519 if (*pshift == 0) {
520 continue;
521 }
522 /* We don't do anything with pshift yet as qemu TLB only deals
523 * with 4K pages anyway
524 */
525 pte->pte0 = pte0;
526 pte->pte1 = pte1;
527 ppc_hash64_stop_access(cpu, token);
528 return (pte_index + i) * HASH_PTE_SIZE_64;
529 }
530 }
531 ppc_hash64_stop_access(cpu, token);
532 /*
533 * We didn't find a valid entry.
534 */
535 return -1;
536 }
537
538 static hwaddr ppc_hash64_htab_lookup(PowerPCCPU *cpu,
539 ppc_slb_t *slb, target_ulong eaddr,
540 ppc_hash_pte64_t *pte, unsigned *pshift)
541 {
542 CPUPPCState *env = &cpu->env;
543 hwaddr pte_offset;
544 hwaddr hash;
545 uint64_t vsid, epnmask, epn, ptem;
546 const struct ppc_one_seg_page_size *sps = slb->sps;
547
548 /* The SLB store path should prevent any bad page size encodings
549 * getting in there, so: */
550 assert(sps);
551
552 /* If ISL is set in LPCR we need to clamp the page size to 4K */
553 if (env->spr[SPR_LPCR] & LPCR_ISL) {
554 /* We assume that when using TCG, 4k is first entry of SPS */
555 sps = &env->sps.sps[0];
556 assert(sps->page_shift == 12);
557 }
558
559 epnmask = ~((1ULL << sps->page_shift) - 1);
560
561 if (slb->vsid & SLB_VSID_B) {
562 /* 1TB segment */
563 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
564 epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask;
565 hash = vsid ^ (vsid << 25) ^ (epn >> sps->page_shift);
566 } else {
567 /* 256M segment */
568 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
569 epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask;
570 hash = vsid ^ (epn >> sps->page_shift);
571 }
572 ptem = (slb->vsid & SLB_VSID_PTEM) | ((epn >> 16) & HPTE64_V_AVPN);
573 ptem |= HPTE64_V_VALID;
574
575 /* Page address translation */
576 qemu_log_mask(CPU_LOG_MMU,
577 "htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
578 " hash " TARGET_FMT_plx "\n",
579 env->htab_base, env->htab_mask, hash);
580
581 /* Primary PTEG lookup */
582 qemu_log_mask(CPU_LOG_MMU,
583 "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
584 " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
585 " hash=" TARGET_FMT_plx "\n",
586 env->htab_base, env->htab_mask, vsid, ptem, hash);
587 pte_offset = ppc_hash64_pteg_search(cpu, hash, sps, ptem, pte, pshift);
588
589 if (pte_offset == -1) {
590 /* Secondary PTEG lookup */
591 ptem |= HPTE64_V_SECONDARY;
592 qemu_log_mask(CPU_LOG_MMU,
593 "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
594 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
595 " hash=" TARGET_FMT_plx "\n", env->htab_base,
596 env->htab_mask, vsid, ptem, ~hash);
597
598 pte_offset = ppc_hash64_pteg_search(cpu, ~hash, sps, ptem, pte, pshift);
599 }
600
601 return pte_offset;
602 }
603
604 unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU *cpu,
605 uint64_t pte0, uint64_t pte1)
606 {
607 CPUPPCState *env = &cpu->env;
608 int i;
609
610 if (!(pte0 & HPTE64_V_LARGE)) {
611 return 12;
612 }
613
614 /*
615 * The encodings in env->sps need to be carefully chosen so that
616 * this gives an unambiguous result.
617 */
618 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
619 const struct ppc_one_seg_page_size *sps = &env->sps.sps[i];
620 unsigned shift;
621
622 if (!sps->page_shift) {
623 break;
624 }
625
626 shift = hpte_page_shift(sps, pte0, pte1);
627 if (shift) {
628 return shift;
629 }
630 }
631
632 return 0;
633 }
634
635 static void ppc_hash64_set_isi(CPUState *cs, CPUPPCState *env,
636 uint64_t error_code)
637 {
638 bool vpm;
639
640 if (msr_ir) {
641 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1);
642 } else {
643 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM0);
644 }
645 if (vpm && !msr_hv) {
646 cs->exception_index = POWERPC_EXCP_HISI;
647 } else {
648 cs->exception_index = POWERPC_EXCP_ISI;
649 }
650 env->error_code = error_code;
651 }
652
653 static void ppc_hash64_set_dsi(CPUState *cs, CPUPPCState *env, uint64_t dar,
654 uint64_t dsisr)
655 {
656 bool vpm;
657
658 if (msr_dr) {
659 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1);
660 } else {
661 vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM0);
662 }
663 if (vpm && !msr_hv) {
664 cs->exception_index = POWERPC_EXCP_HDSI;
665 env->spr[SPR_HDAR] = dar;
666 env->spr[SPR_HDSISR] = dsisr;
667 } else {
668 cs->exception_index = POWERPC_EXCP_DSI;
669 env->spr[SPR_DAR] = dar;
670 env->spr[SPR_DSISR] = dsisr;
671 }
672 env->error_code = 0;
673 }
674
675
676 int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr,
677 int rwx, int mmu_idx)
678 {
679 CPUState *cs = CPU(cpu);
680 CPUPPCState *env = &cpu->env;
681 ppc_slb_t *slb;
682 unsigned apshift;
683 hwaddr pte_offset;
684 ppc_hash_pte64_t pte;
685 int pp_prot, amr_prot, prot;
686 uint64_t new_pte1, dsisr;
687 const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
688 hwaddr raddr;
689
690 assert((rwx == 0) || (rwx == 1) || (rwx == 2));
691
692 /* Note on LPCR usage: 970 uses HID4, but our special variant
693 * of store_spr copies relevant fields into env->spr[SPR_LPCR].
694 * Similarily we filter unimplemented bits when storing into
695 * LPCR depending on the MMU version. This code can thus just
696 * use the LPCR "as-is".
697 */
698
699 /* 1. Handle real mode accesses */
700 if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
701 /* Translation is supposedly "off" */
702 /* In real mode the top 4 effective address bits are (mostly) ignored */
703 raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
704
705 /* In HV mode, add HRMOR if top EA bit is clear */
706 if (msr_hv || !env->has_hv_mode) {
707 if (!(eaddr >> 63)) {
708 raddr |= env->spr[SPR_HRMOR];
709 }
710 } else {
711 /* Otherwise, check VPM for RMA vs VRMA */
712 if (env->spr[SPR_LPCR] & LPCR_VPM0) {
713 slb = &env->vrma_slb;
714 if (slb->sps) {
715 goto skip_slb_search;
716 }
717 /* Not much else to do here */
718 cs->exception_index = POWERPC_EXCP_MCHECK;
719 env->error_code = 0;
720 return 1;
721 } else if (raddr < env->rmls) {
722 /* RMA. Check bounds in RMLS */
723 raddr |= env->spr[SPR_RMOR];
724 } else {
725 /* The access failed, generate the approriate interrupt */
726 if (rwx == 2) {
727 ppc_hash64_set_isi(cs, env, 0x08000000);
728 } else {
729 dsisr = 0x08000000;
730 if (rwx == 1) {
731 dsisr |= 0x02000000;
732 }
733 ppc_hash64_set_dsi(cs, env, eaddr, dsisr);
734 }
735 return 1;
736 }
737 }
738 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
739 PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
740 TARGET_PAGE_SIZE);
741 return 0;
742 }
743
744 /* 2. Translation is on, so look up the SLB */
745 slb = slb_lookup(cpu, eaddr);
746 if (!slb) {
747 if (rwx == 2) {
748 cs->exception_index = POWERPC_EXCP_ISEG;
749 env->error_code = 0;
750 } else {
751 cs->exception_index = POWERPC_EXCP_DSEG;
752 env->error_code = 0;
753 env->spr[SPR_DAR] = eaddr;
754 }
755 return 1;
756 }
757
758 skip_slb_search:
759
760 /* 3. Check for segment level no-execute violation */
761 if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) {
762 ppc_hash64_set_isi(cs, env, 0x10000000);
763 return 1;
764 }
765
766 /* 4. Locate the PTE in the hash table */
767 pte_offset = ppc_hash64_htab_lookup(cpu, slb, eaddr, &pte, &apshift);
768 if (pte_offset == -1) {
769 dsisr = 0x40000000;
770 if (rwx == 2) {
771 ppc_hash64_set_isi(cs, env, dsisr);
772 } else {
773 if (rwx == 1) {
774 dsisr |= 0x02000000;
775 }
776 ppc_hash64_set_dsi(cs, env, eaddr, dsisr);
777 }
778 return 1;
779 }
780 qemu_log_mask(CPU_LOG_MMU,
781 "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
782
783 /* 5. Check access permissions */
784
785 pp_prot = ppc_hash64_pte_prot(cpu, slb, pte);
786 amr_prot = ppc_hash64_amr_prot(cpu, pte);
787 prot = pp_prot & amr_prot;
788
789 if ((need_prot[rwx] & ~prot) != 0) {
790 /* Access right violation */
791 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
792 if (rwx == 2) {
793 ppc_hash64_set_isi(cs, env, 0x08000000);
794 } else {
795 dsisr = 0;
796 if (need_prot[rwx] & ~pp_prot) {
797 dsisr |= 0x08000000;
798 }
799 if (rwx == 1) {
800 dsisr |= 0x02000000;
801 }
802 if (need_prot[rwx] & ~amr_prot) {
803 dsisr |= 0x00200000;
804 }
805 ppc_hash64_set_dsi(cs, env, eaddr, dsisr);
806 }
807 return 1;
808 }
809
810 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
811
812 /* 6. Update PTE referenced and changed bits if necessary */
813
814 new_pte1 = pte.pte1 | HPTE64_R_R; /* set referenced bit */
815 if (rwx == 1) {
816 new_pte1 |= HPTE64_R_C; /* set changed (dirty) bit */
817 } else {
818 /* Treat the page as read-only for now, so that a later write
819 * will pass through this function again to set the C bit */
820 prot &= ~PAGE_WRITE;
821 }
822
823 if (new_pte1 != pte.pte1) {
824 ppc_hash64_store_hpte(cpu, pte_offset / HASH_PTE_SIZE_64,
825 pte.pte0, new_pte1);
826 }
827
828 /* 7. Determine the real address from the PTE */
829
830 raddr = deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, eaddr);
831
832 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
833 prot, mmu_idx, 1ULL << apshift);
834
835 return 0;
836 }
837
838 hwaddr ppc_hash64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr)
839 {
840 CPUPPCState *env = &cpu->env;
841 ppc_slb_t *slb;
842 hwaddr pte_offset, raddr;
843 ppc_hash_pte64_t pte;
844 unsigned apshift;
845
846 /* Handle real mode */
847 if (msr_dr == 0) {
848 /* In real mode the top 4 effective address bits are ignored */
849 raddr = addr & 0x0FFFFFFFFFFFFFFFULL;
850
851 /* In HV mode, add HRMOR if top EA bit is clear */
852 if ((msr_hv || !env->has_hv_mode) && !(addr >> 63)) {
853 return raddr | env->spr[SPR_HRMOR];
854 }
855
856 /* Otherwise, check VPM for RMA vs VRMA */
857 if (env->spr[SPR_LPCR] & LPCR_VPM0) {
858 slb = &env->vrma_slb;
859 if (!slb->sps) {
860 return -1;
861 }
862 } else if (raddr < env->rmls) {
863 /* RMA. Check bounds in RMLS */
864 return raddr | env->spr[SPR_RMOR];
865 } else {
866 return -1;
867 }
868 } else {
869 slb = slb_lookup(cpu, addr);
870 if (!slb) {
871 return -1;
872 }
873 }
874
875 pte_offset = ppc_hash64_htab_lookup(cpu, slb, addr, &pte, &apshift);
876 if (pte_offset == -1) {
877 return -1;
878 }
879
880 return deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, addr)
881 & TARGET_PAGE_MASK;
882 }
883
884 void ppc_hash64_store_hpte(PowerPCCPU *cpu,
885 target_ulong pte_index,
886 target_ulong pte0, target_ulong pte1)
887 {
888 CPUPPCState *env = &cpu->env;
889
890 if (env->external_htab == MMU_HASH64_KVM_MANAGED_HPT) {
891 kvmppc_hash64_write_pte(env, pte_index, pte0, pte1);
892 return;
893 }
894
895 pte_index *= HASH_PTE_SIZE_64;
896 if (env->external_htab) {
897 stq_p(env->external_htab + pte_index, pte0);
898 stq_p(env->external_htab + pte_index + HASH_PTE_SIZE_64 / 2, pte1);
899 } else {
900 stq_phys(CPU(cpu)->as, env->htab_base + pte_index, pte0);
901 stq_phys(CPU(cpu)->as,
902 env->htab_base + pte_index + HASH_PTE_SIZE_64 / 2, pte1);
903 }
904 }
905
906 void ppc_hash64_tlb_flush_hpte(PowerPCCPU *cpu,
907 target_ulong pte_index,
908 target_ulong pte0, target_ulong pte1)
909 {
910 /*
911 * XXX: given the fact that there are too many segments to
912 * invalidate, and we still don't have a tlb_flush_mask(env, n,
913 * mask) in QEMU, we just invalidate all TLBs
914 */
915 cpu->env.tlb_need_flush = TLB_NEED_GLOBAL_FLUSH | TLB_NEED_LOCAL_FLUSH;
916 }
917
918 void ppc_hash64_update_rmls(CPUPPCState *env)
919 {
920 uint64_t lpcr = env->spr[SPR_LPCR];
921
922 /*
923 * This is the full 4 bits encoding of POWER8. Previous
924 * CPUs only support a subset of these but the filtering
925 * is done when writing LPCR
926 */
927 switch ((lpcr & LPCR_RMLS) >> LPCR_RMLS_SHIFT) {
928 case 0x8: /* 32MB */
929 env->rmls = 0x2000000ull;
930 break;
931 case 0x3: /* 64MB */
932 env->rmls = 0x4000000ull;
933 break;
934 case 0x7: /* 128MB */
935 env->rmls = 0x8000000ull;
936 break;
937 case 0x4: /* 256MB */
938 env->rmls = 0x10000000ull;
939 break;
940 case 0x2: /* 1GB */
941 env->rmls = 0x40000000ull;
942 break;
943 case 0x1: /* 16GB */
944 env->rmls = 0x400000000ull;
945 break;
946 default:
947 /* What to do here ??? */
948 env->rmls = 0;
949 }
950 }
951
952 void ppc_hash64_update_vrma(CPUPPCState *env)
953 {
954 const struct ppc_one_seg_page_size *sps = NULL;
955 target_ulong esid, vsid, lpcr;
956 ppc_slb_t *slb = &env->vrma_slb;
957 uint32_t vrmasd;
958 int i;
959
960 /* First clear it */
961 slb->esid = slb->vsid = 0;
962 slb->sps = NULL;
963
964 /* Is VRMA enabled ? */
965 lpcr = env->spr[SPR_LPCR];
966 if (!(lpcr & LPCR_VPM0)) {
967 return;
968 }
969
970 /* Make one up. Mostly ignore the ESID which will not be
971 * needed for translation
972 */
973 vsid = SLB_VSID_VRMA;
974 vrmasd = (lpcr & LPCR_VRMASD) >> LPCR_VRMASD_SHIFT;
975 vsid |= (vrmasd << 4) & (SLB_VSID_L | SLB_VSID_LP);
976 esid = SLB_ESID_V;
977
978 for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
979 const struct ppc_one_seg_page_size *sps1 = &env->sps.sps[i];
980
981 if (!sps1->page_shift) {
982 break;
983 }
984
985 if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) {
986 sps = sps1;
987 break;
988 }
989 }
990
991 if (!sps) {
992 error_report("Bad page size encoding esid 0x"TARGET_FMT_lx
993 " vsid 0x"TARGET_FMT_lx, esid, vsid);
994 return;
995 }
996
997 slb->vsid = vsid;
998 slb->esid = esid;
999 slb->sps = sps;
1000 }
1001
1002 void helper_store_lpcr(CPUPPCState *env, target_ulong val)
1003 {
1004 uint64_t lpcr = 0;
1005
1006 /* Filter out bits */
1007 switch (env->mmu_model) {
1008 case POWERPC_MMU_64B: /* 970 */
1009 if (val & 0x40) {
1010 lpcr |= LPCR_LPES0;
1011 }
1012 if (val & 0x8000000000000000ull) {
1013 lpcr |= LPCR_LPES1;
1014 }
1015 if (val & 0x20) {
1016 lpcr |= (0x4ull << LPCR_RMLS_SHIFT);
1017 }
1018 if (val & 0x4000000000000000ull) {
1019 lpcr |= (0x2ull << LPCR_RMLS_SHIFT);
1020 }
1021 if (val & 0x2000000000000000ull) {
1022 lpcr |= (0x1ull << LPCR_RMLS_SHIFT);
1023 }
1024 env->spr[SPR_RMOR] = ((lpcr >> 41) & 0xffffull) << 26;
1025
1026 /* XXX We could also write LPID from HID4 here
1027 * but since we don't tag any translation on it
1028 * it doesn't actually matter
1029 */
1030 /* XXX For proper emulation of 970 we also need
1031 * to dig HRMOR out of HID5
1032 */
1033 break;
1034 case POWERPC_MMU_2_03: /* P5p */
1035 lpcr = val & (LPCR_RMLS | LPCR_ILE |
1036 LPCR_LPES0 | LPCR_LPES1 |
1037 LPCR_RMI | LPCR_HDICE);
1038 break;
1039 case POWERPC_MMU_2_06: /* P7 */
1040 lpcr = val & (LPCR_VPM0 | LPCR_VPM1 | LPCR_ISL | LPCR_DPFD |
1041 LPCR_VRMASD | LPCR_RMLS | LPCR_ILE |
1042 LPCR_P7_PECE0 | LPCR_P7_PECE1 | LPCR_P7_PECE2 |
1043 LPCR_MER | LPCR_TC |
1044 LPCR_LPES0 | LPCR_LPES1 | LPCR_HDICE);
1045 break;
1046 case POWERPC_MMU_2_07: /* P8 */
1047 lpcr = val & (LPCR_VPM0 | LPCR_VPM1 | LPCR_ISL | LPCR_KBV |
1048 LPCR_DPFD | LPCR_VRMASD | LPCR_RMLS | LPCR_ILE |
1049 LPCR_AIL | LPCR_ONL | LPCR_P8_PECE0 | LPCR_P8_PECE1 |
1050 LPCR_P8_PECE2 | LPCR_P8_PECE3 | LPCR_P8_PECE4 |
1051 LPCR_MER | LPCR_TC | LPCR_LPES0 | LPCR_HDICE);
1052 break;
1053 default:
1054 ;
1055 }
1056 env->spr[SPR_LPCR] = lpcr;
1057 ppc_hash64_update_rmls(env);
1058 ppc_hash64_update_vrma(env);
1059 }