target-ppc/mmu-hash64.c

   1 /*
   2  *  PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
   3  *
   4  *  Copyright (c) 2003-2007 Jocelyn Mayer
   5  *  Copyright (c) 2013 David Gibson, IBM Corporation
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20 #include "qemu/osdep.h"
  21 #include "cpu.h"
  22 #include "exec/helper-proto.h"
  23 #include "qemu/error-report.h"
  24 #include "sysemu/kvm.h"
  25 #include "qemu/error-report.h"
  26 #include "kvm_ppc.h"
  27 #include "mmu-hash64.h"
  28
  29 //#define DEBUG_SLB
  30
  31 #ifdef DEBUG_SLB
  32 #  define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
  33 #else
  34 #  define LOG_SLB(...) do { } while (0)
  35 #endif
  36
  37 /*
  38  * Used to indicate whether we have allocated htab in the
  39  * host kernel
  40  */
  41 bool kvmppc_kern_htab;
  42 /*
  43  * SLB handling
  44  */
  45
  46 static ppc_slb_t *slb_lookup(PowerPCCPU *cpu, target_ulong eaddr)
  47 {
  48     CPUPPCState *env = &cpu->env;
  49     uint64_t esid_256M, esid_1T;
  50     int n;
  51
  52     LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);
  53
  54     esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V;
  55     esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V;
  56
  57     for (n = 0; n < env->slb_nr; n++) {
  58         ppc_slb_t *slb = &env->slb[n];
  59
  60         LOG_SLB("%s: slot %d %016" PRIx64 " %016"
  61                     PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
  62         /* We check for 1T matches on all MMUs here - if the MMU
  63          * doesn't have 1T segment support, we will have prevented 1T
  64          * entries from being inserted in the slbmte code. */
  65         if (((slb->esid == esid_256M) &&
  66              ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
  67             || ((slb->esid == esid_1T) &&
  68                 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
  69             return slb;
  70         }
  71     }
  72
  73     return NULL;
  74 }
  75
  76 void dump_slb(FILE *f, fprintf_function cpu_fprintf, PowerPCCPU *cpu)
  77 {
  78     CPUPPCState *env = &cpu->env;
  79     int i;
  80     uint64_t slbe, slbv;
  81
  82     cpu_synchronize_state(CPU(cpu));
  83
  84     cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
  85     for (i = 0; i < env->slb_nr; i++) {
  86         slbe = env->slb[i].esid;
  87         slbv = env->slb[i].vsid;
  88         if (slbe == 0 && slbv == 0) {
  89             continue;
  90         }
  91         cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
  92                     i, slbe, slbv);
  93     }
  94 }
  95
  96 void helper_slbia(CPUPPCState *env)
  97 {
  98     PowerPCCPU *cpu = ppc_env_get_cpu(env);
  99     int n, do_invalidate;
 100
 101     do_invalidate = 0;
 102     /* XXX: Warning: slbia never invalidates the first segment */
 103     for (n = 1; n < env->slb_nr; n++) {
 104         ppc_slb_t *slb = &env->slb[n];
 105
 106         if (slb->esid & SLB_ESID_V) {
 107             slb->esid &= ~SLB_ESID_V;
 108             /* XXX: given the fact that segment size is 256 MB or 1TB,
 109              *      and we still don't have a tlb_flush_mask(env, n, mask)
 110              *      in QEMU, we just invalidate all TLBs
 111              */
 112             do_invalidate = 1;
 113         }
 114     }
 115     if (do_invalidate) {
 116         tlb_flush(CPU(cpu), 1);
 117     }
 118 }
 119
 120 void helper_slbie(CPUPPCState *env, target_ulong addr)
 121 {
 122     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 123     ppc_slb_t *slb;
 124
 125     slb = slb_lookup(cpu, addr);
 126     if (!slb) {
 127         return;
 128     }
 129
 130     if (slb->esid & SLB_ESID_V) {
 131         slb->esid &= ~SLB_ESID_V;
 132
 133         /* XXX: given the fact that segment size is 256 MB or 1TB,
 134          *      and we still don't have a tlb_flush_mask(env, n, mask)
 135          *      in QEMU, we just invalidate all TLBs
 136          */
 137         tlb_flush(CPU(cpu), 1);
 138     }
 139 }
 140
 141 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot,
 142                   target_ulong esid, target_ulong vsid)
 143 {
 144     CPUPPCState *env = &cpu->env;
 145     ppc_slb_t *slb = &env->slb[slot];
 146     const struct ppc_one_seg_page_size *sps = NULL;
 147     int i;
 148
 149     if (slot >= env->slb_nr) {
 150         return -1; /* Bad slot number */
 151     }
 152     if (esid & ~(SLB_ESID_ESID | SLB_ESID_V)) {
 153         return -1; /* Reserved bits set */
 154     }
 155     if (vsid & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
 156         return -1; /* Bad segment size */
 157     }
 158     if ((vsid & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
 159         return -1; /* 1T segment on MMU that doesn't support it */
 160     }
 161
 162     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 163         const struct ppc_one_seg_page_size *sps1 = &env->sps.sps[i];
 164
 165         if (!sps1->page_shift) {
 166             break;
 167         }
 168
 169         if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) {
 170             sps = sps1;
 171             break;
 172         }
 173     }
 174
 175     if (!sps) {
 176         error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu
 177                      " esid 0x"TARGET_FMT_lx" vsid 0x"TARGET_FMT_lx,
 178                      slot, esid, vsid);
 179         return -1;
 180     }
 181
 182     slb->esid = esid;
 183     slb->vsid = vsid;
 184     slb->sps = sps;
 185
 186     LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
 187             " %016" PRIx64 "\n", __func__, slot, esid, vsid,
 188             slb->esid, slb->vsid);
 189
 190     return 0;
 191 }
 192
 193 static int ppc_load_slb_esid(PowerPCCPU *cpu, target_ulong rb,
 194                              target_ulong *rt)
 195 {
 196     CPUPPCState *env = &cpu->env;
 197     int slot = rb & 0xfff;
 198     ppc_slb_t *slb = &env->slb[slot];
 199
 200     if (slot >= env->slb_nr) {
 201         return -1;
 202     }
 203
 204     *rt = slb->esid;
 205     return 0;
 206 }
 207
 208 static int ppc_load_slb_vsid(PowerPCCPU *cpu, target_ulong rb,
 209                              target_ulong *rt)
 210 {
 211     CPUPPCState *env = &cpu->env;
 212     int slot = rb & 0xfff;
 213     ppc_slb_t *slb = &env->slb[slot];
 214
 215     if (slot >= env->slb_nr) {
 216         return -1;
 217     }
 218
 219     *rt = slb->vsid;
 220     return 0;
 221 }
 222
 223 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
 224 {
 225     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 226
 227     if (ppc_store_slb(cpu, rb & 0xfff, rb & ~0xfffULL, rs) < 0) {
 228         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 229                                    POWERPC_EXCP_INVAL);
 230     }
 231 }
 232
 233 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
 234 {
 235     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 236     target_ulong rt = 0;
 237
 238     if (ppc_load_slb_esid(cpu, rb, &rt) < 0) {
 239         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 240                                    POWERPC_EXCP_INVAL);
 241     }
 242     return rt;
 243 }
 244
 245 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
 246 {
 247     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 248     target_ulong rt = 0;
 249
 250     if (ppc_load_slb_vsid(cpu, rb, &rt) < 0) {
 251         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 252                                    POWERPC_EXCP_INVAL);
 253     }
 254     return rt;
 255 }
 256
 257 /*
 258  * 64-bit hash table MMU handling
 259  */
 260
 261 static int ppc_hash64_pte_prot(PowerPCCPU *cpu,
 262                                ppc_slb_t *slb, ppc_hash_pte64_t pte)
 263 {
 264     CPUPPCState *env = &cpu->env;
 265     unsigned pp, key;
 266     /* Some pp bit combinations have undefined behaviour, so default
 267      * to no access in those cases */
 268     int prot = 0;
 269
 270     key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP)
 271              : (slb->vsid & SLB_VSID_KS));
 272     pp = (pte.pte1 & HPTE64_R_PP) | ((pte.pte1 & HPTE64_R_PP0) >> 61);
 273
 274     if (key == 0) {
 275         switch (pp) {
 276         case 0x0:
 277         case 0x1:
 278         case 0x2:
 279             prot = PAGE_READ | PAGE_WRITE;
 280             break;
 281
 282         case 0x3:
 283         case 0x6:
 284             prot = PAGE_READ;
 285             break;
 286         }
 287     } else {
 288         switch (pp) {
 289         case 0x0:
 290         case 0x6:
 291             prot = 0;
 292             break;
 293
 294         case 0x1:
 295         case 0x3:
 296             prot = PAGE_READ;
 297             break;
 298
 299         case 0x2:
 300             prot = PAGE_READ | PAGE_WRITE;
 301             break;
 302         }
 303     }
 304
 305     /* No execute if either noexec or guarded bits set */
 306     if (!(pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G)
 307         || (slb->vsid & SLB_VSID_N)) {
 308         prot |= PAGE_EXEC;
 309     }
 310
 311     return prot;
 312 }
 313
 314 static int ppc_hash64_amr_prot(PowerPCCPU *cpu, ppc_hash_pte64_t pte)
 315 {
 316     CPUPPCState *env = &cpu->env;
 317     int key, amrbits;
 318     int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 319
 320     /* Only recent MMUs implement Virtual Page Class Key Protection */
 321     if (!(env->mmu_model & POWERPC_MMU_AMR)) {
 322         return prot;
 323     }
 324
 325     key = HPTE64_R_KEY(pte.pte1);
 326     amrbits = (env->spr[SPR_AMR] >> 2*(31 - key)) & 0x3;
 327
 328     /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */
 329     /*         env->spr[SPR_AMR]); */
 330
 331     /*
 332      * A store is permitted if the AMR bit is 0. Remove write
 333      * protection if it is set.
 334      */
 335     if (amrbits & 0x2) {
 336         prot &= ~PAGE_WRITE;
 337     }
 338     /*
 339      * A load is permitted if the AMR bit is 0. Remove read
 340      * protection if it is set.
 341      */
 342     if (amrbits & 0x1) {
 343         prot &= ~PAGE_READ;
 344     }
 345
 346     return prot;
 347 }
 348
 349 uint64_t ppc_hash64_start_access(PowerPCCPU *cpu, target_ulong pte_index)
 350 {
 351     uint64_t token = 0;
 352     hwaddr pte_offset;
 353
 354     pte_offset = pte_index * HASH_PTE_SIZE_64;
 355     if (kvmppc_kern_htab) {
 356         /*
 357          * HTAB is controlled by KVM. Fetch the PTEG into a new buffer.
 358          */
 359         token = kvmppc_hash64_read_pteg(cpu, pte_index);
 360         if (token) {
 361             return token;
 362         }
 363         /*
 364          * pteg read failed, even though we have allocated htab via
 365          * kvmppc_reset_htab.
 366          */
 367         return 0;
 368     }
 369     /*
 370      * HTAB is controlled by QEMU. Just point to the internally
 371      * accessible PTEG.
 372      */
 373     if (cpu->env.external_htab) {
 374         token = (uint64_t)(uintptr_t) cpu->env.external_htab + pte_offset;
 375     } else if (cpu->env.htab_base) {
 376         token = cpu->env.htab_base + pte_offset;
 377     }
 378     return token;
 379 }
 380
 381 void ppc_hash64_stop_access(uint64_t token)
 382 {
 383     if (kvmppc_kern_htab) {
 384         kvmppc_hash64_free_pteg(token);
 385     }
 386 }
 387
 388 static hwaddr ppc_hash64_pteg_search(PowerPCCPU *cpu, hwaddr hash,
 389                                      bool secondary, target_ulong ptem,
 390                                      ppc_hash_pte64_t *pte)
 391 {
 392     CPUPPCState *env = &cpu->env;
 393     int i;
 394     uint64_t token;
 395     target_ulong pte0, pte1;
 396     target_ulong pte_index;
 397
 398     pte_index = (hash & env->htab_mask) * HPTES_PER_GROUP;
 399     token = ppc_hash64_start_access(cpu, pte_index);
 400     if (!token) {
 401         return -1;
 402     }
 403     for (i = 0; i < HPTES_PER_GROUP; i++) {
 404         pte0 = ppc_hash64_load_hpte0(cpu, token, i);
 405         pte1 = ppc_hash64_load_hpte1(cpu, token, i);
 406
 407         if ((pte0 & HPTE64_V_VALID)
 408             && (secondary == !!(pte0 & HPTE64_V_SECONDARY))
 409             && HPTE64_V_COMPARE(pte0, ptem)) {
 410             pte->pte0 = pte0;
 411             pte->pte1 = pte1;
 412             ppc_hash64_stop_access(token);
 413             return (pte_index + i) * HASH_PTE_SIZE_64;
 414         }
 415     }
 416     ppc_hash64_stop_access(token);
 417     /*
 418      * We didn't find a valid entry.
 419      */
 420     return -1;
 421 }
 422
 423 static hwaddr ppc_hash64_htab_lookup(PowerPCCPU *cpu,
 424                                      ppc_slb_t *slb, target_ulong eaddr,
 425                                      ppc_hash_pte64_t *pte)
 426 {
 427     CPUPPCState *env = &cpu->env;
 428     hwaddr pte_offset;
 429     hwaddr hash;
 430     uint64_t vsid, epnmask, epn, ptem;
 431
 432     /* The SLB store path should prevent any bad page size encodings
 433      * getting in there, so: */
 434     assert(slb->sps);
 435
 436     epnmask = ~((1ULL << slb->sps->page_shift) - 1);
 437
 438     if (slb->vsid & SLB_VSID_B) {
 439         /* 1TB segment */
 440         vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
 441         epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask;
 442         hash = vsid ^ (vsid << 25) ^ (epn >> slb->sps->page_shift);
 443     } else {
 444         /* 256M segment */
 445         vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
 446         epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask;
 447         hash = vsid ^ (epn >> slb->sps->page_shift);
 448     }
 449     ptem = (slb->vsid & SLB_VSID_PTEM) | ((epn >> 16) & HPTE64_V_AVPN);
 450
 451     /* Page address translation */
 452     qemu_log_mask(CPU_LOG_MMU,
 453             "htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
 454             " hash " TARGET_FMT_plx "\n",
 455             env->htab_base, env->htab_mask, hash);
 456
 457     /* Primary PTEG lookup */
 458     qemu_log_mask(CPU_LOG_MMU,
 459             "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 460             " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
 461             " hash=" TARGET_FMT_plx "\n",
 462             env->htab_base, env->htab_mask, vsid, ptem,  hash);
 463     pte_offset = ppc_hash64_pteg_search(cpu, hash, 0, ptem, pte);
 464
 465     if (pte_offset == -1) {
 466         /* Secondary PTEG lookup */
 467         qemu_log_mask(CPU_LOG_MMU,
 468                 "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 469                 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
 470                 " hash=" TARGET_FMT_plx "\n", env->htab_base,
 471                 env->htab_mask, vsid, ptem, ~hash);
 472
 473         pte_offset = ppc_hash64_pteg_search(cpu, ~hash, 1, ptem, pte);
 474     }
 475
 476     return pte_offset;
 477 }
 478
 479 static unsigned hpte_page_shift(const struct ppc_one_seg_page_size *sps,
 480     uint64_t pte0, uint64_t pte1)
 481 {
 482     int i;
 483
 484     if (!(pte0 & HPTE64_V_LARGE)) {
 485         if (sps->page_shift != 12) {
 486             /* 4kiB page in a non 4kiB segment */
 487             return 0;
 488         }
 489         /* Normal 4kiB page */
 490         return 12;
 491     }
 492
 493     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 494         const struct ppc_one_page_size *ps = &sps->enc[i];
 495         uint64_t mask;
 496
 497         if (!ps->page_shift) {
 498             break;
 499         }
 500
 501         if (ps->page_shift == 12) {
 502             /* L bit is set so this can't be a 4kiB page */
 503             continue;
 504         }
 505
 506         mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN;
 507
 508         if ((pte1 & mask) == (ps->pte_enc << HPTE64_R_RPN_SHIFT)) {
 509             return ps->page_shift;
 510         }
 511     }
 512
 513     return 0; /* Bad page size encoding */
 514 }
 515
 516 unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU *cpu,
 517                                           uint64_t pte0, uint64_t pte1,
 518                                           unsigned *seg_page_shift)
 519 {
 520     CPUPPCState *env = &cpu->env;
 521     int i;
 522
 523     if (!(pte0 & HPTE64_V_LARGE)) {
 524         *seg_page_shift = 12;
 525         return 12;
 526     }
 527
 528     /*
 529      * The encodings in env->sps need to be carefully chosen so that
 530      * this gives an unambiguous result.
 531      */
 532     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 533         const struct ppc_one_seg_page_size *sps = &env->sps.sps[i];
 534         unsigned shift;
 535
 536         if (!sps->page_shift) {
 537             break;
 538         }
 539
 540         shift = hpte_page_shift(sps, pte0, pte1);
 541         if (shift) {
 542             *seg_page_shift = sps->page_shift;
 543             return shift;
 544         }
 545     }
 546
 547     *seg_page_shift = 0;
 548     return 0;
 549 }
 550
 551 int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, target_ulong eaddr,
 552                                 int rwx, int mmu_idx)
 553 {
 554     CPUState *cs = CPU(cpu);
 555     CPUPPCState *env = &cpu->env;
 556     ppc_slb_t *slb;
 557     unsigned apshift;
 558     hwaddr pte_offset;
 559     ppc_hash_pte64_t pte;
 560     int pp_prot, amr_prot, prot;
 561     uint64_t new_pte1;
 562     const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
 563     hwaddr raddr;
 564
 565     assert((rwx == 0) || (rwx == 1) || (rwx == 2));
 566
 567     /* 1. Handle real mode accesses */
 568     if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
 569         /* Translation is off */
 570         /* In real mode the top 4 effective address bits are ignored */
 571         raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
 572         tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 573                      PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
 574                      TARGET_PAGE_SIZE);
 575         return 0;
 576     }
 577
 578     /* 2. Translation is on, so look up the SLB */
 579     slb = slb_lookup(cpu, eaddr);
 580
 581     if (!slb) {
 582         if (rwx == 2) {
 583             cs->exception_index = POWERPC_EXCP_ISEG;
 584             env->error_code = 0;
 585         } else {
 586             cs->exception_index = POWERPC_EXCP_DSEG;
 587             env->error_code = 0;
 588             env->spr[SPR_DAR] = eaddr;
 589         }
 590         return 1;
 591     }
 592
 593     /* 3. Check for segment level no-execute violation */
 594     if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) {
 595         cs->exception_index = POWERPC_EXCP_ISI;
 596         env->error_code = 0x10000000;
 597         return 1;
 598     }
 599
 600     /* 4. Locate the PTE in the hash table */
 601     pte_offset = ppc_hash64_htab_lookup(cpu, slb, eaddr, &pte);
 602     if (pte_offset == -1) {
 603         if (rwx == 2) {
 604             cs->exception_index = POWERPC_EXCP_ISI;
 605             env->error_code = 0x40000000;
 606         } else {
 607             cs->exception_index = POWERPC_EXCP_DSI;
 608             env->error_code = 0;
 609             env->spr[SPR_DAR] = eaddr;
 610             if (rwx == 1) {
 611                 env->spr[SPR_DSISR] = 0x42000000;
 612             } else {
 613                 env->spr[SPR_DSISR] = 0x40000000;
 614             }
 615         }
 616         return 1;
 617     }
 618     qemu_log_mask(CPU_LOG_MMU,
 619                 "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
 620
 621     /* Validate page size encoding */
 622     apshift = hpte_page_shift(slb->sps, pte.pte0, pte.pte1);
 623     if (!apshift) {
 624         error_report("Bad page size encoding in HPTE 0x%"PRIx64" - 0x%"PRIx64
 625                      " @ 0x%"HWADDR_PRIx, pte.pte0, pte.pte1, pte_offset);
 626         /* Not entirely sure what the right action here, but machine
 627          * check seems reasonable */
 628         cs->exception_index = POWERPC_EXCP_MCHECK;
 629         env->error_code = 0;
 630         return 1;
 631     }
 632
 633     /* 5. Check access permissions */
 634
 635     pp_prot = ppc_hash64_pte_prot(cpu, slb, pte);
 636     amr_prot = ppc_hash64_amr_prot(cpu, pte);
 637     prot = pp_prot & amr_prot;
 638
 639     if ((need_prot[rwx] & ~prot) != 0) {
 640         /* Access right violation */
 641         qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
 642         if (rwx == 2) {
 643             cs->exception_index = POWERPC_EXCP_ISI;
 644             env->error_code = 0x08000000;
 645         } else {
 646             target_ulong dsisr = 0;
 647
 648             cs->exception_index = POWERPC_EXCP_DSI;
 649             env->error_code = 0;
 650             env->spr[SPR_DAR] = eaddr;
 651             if (need_prot[rwx] & ~pp_prot) {
 652                 dsisr |= 0x08000000;
 653             }
 654             if (rwx == 1) {
 655                 dsisr |= 0x02000000;
 656             }
 657             if (need_prot[rwx] & ~amr_prot) {
 658                 dsisr |= 0x00200000;
 659             }
 660             env->spr[SPR_DSISR] = dsisr;
 661         }
 662         return 1;
 663     }
 664
 665     qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
 666
 667     /* 6. Update PTE referenced and changed bits if necessary */
 668
 669     new_pte1 = pte.pte1 | HPTE64_R_R; /* set referenced bit */
 670     if (rwx == 1) {
 671         new_pte1 |= HPTE64_R_C; /* set changed (dirty) bit */
 672     } else {
 673         /* Treat the page as read-only for now, so that a later write
 674          * will pass through this function again to set the C bit */
 675         prot &= ~PAGE_WRITE;
 676     }
 677
 678     if (new_pte1 != pte.pte1) {
 679         ppc_hash64_store_hpte(cpu, pte_offset / HASH_PTE_SIZE_64,
 680                               pte.pte0, new_pte1);
 681     }
 682
 683     /* 7. Determine the real address from the PTE */
 684
 685     raddr = deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, eaddr);
 686
 687     tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 688                  prot, mmu_idx, 1ULL << apshift);
 689
 690     return 0;
 691 }
 692
 693 hwaddr ppc_hash64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr)
 694 {
 695     CPUPPCState *env = &cpu->env;
 696     ppc_slb_t *slb;
 697     hwaddr pte_offset;
 698     ppc_hash_pte64_t pte;
 699     unsigned apshift;
 700
 701     if (msr_dr == 0) {
 702         /* In real mode the top 4 effective address bits are ignored */
 703         return addr & 0x0FFFFFFFFFFFFFFFULL;
 704     }
 705
 706     slb = slb_lookup(cpu, addr);
 707     if (!slb) {
 708         return -1;
 709     }
 710
 711     pte_offset = ppc_hash64_htab_lookup(cpu, slb, addr, &pte);
 712     if (pte_offset == -1) {
 713         return -1;
 714     }
 715
 716     apshift = hpte_page_shift(slb->sps, pte.pte0, pte.pte1);
 717     if (!apshift) {
 718         return -1;
 719     }
 720
 721     return deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, addr)
 722         & TARGET_PAGE_MASK;
 723 }
 724
 725 void ppc_hash64_store_hpte(PowerPCCPU *cpu,
 726                            target_ulong pte_index,
 727                            target_ulong pte0, target_ulong pte1)
 728 {
 729     CPUPPCState *env = &cpu->env;
 730
 731     if (kvmppc_kern_htab) {
 732         kvmppc_hash64_write_pte(env, pte_index, pte0, pte1);
 733         return;
 734     }
 735
 736     pte_index *= HASH_PTE_SIZE_64;
 737     if (env->external_htab) {
 738         stq_p(env->external_htab + pte_index, pte0);
 739         stq_p(env->external_htab + pte_index + HASH_PTE_SIZE_64 / 2, pte1);
 740     } else {
 741         stq_phys(CPU(cpu)->as, env->htab_base + pte_index, pte0);
 742         stq_phys(CPU(cpu)->as,
 743                  env->htab_base + pte_index + HASH_PTE_SIZE_64 / 2, pte1);
 744     }
 745 }
 746
 747 void ppc_hash64_tlb_flush_hpte(PowerPCCPU *cpu,
 748                                target_ulong pte_index,
 749                                target_ulong pte0, target_ulong pte1)
 750 {
 751     /*
 752      * XXX: given the fact that there are too many segments to
 753      * invalidate, and we still don't have a tlb_flush_mask(env, n,
 754      * mask) in QEMU, we just invalidate all TLBs
 755      */
 756     tlb_flush(CPU(cpu), 1);
 757 }