2 * PowerPC Radix MMU mulation helpers for QEMU.
4 * Copyright (c) 2016 Suraj Jitindar Singh, IBM Corporation
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
22 #include "exec/exec-all.h"
23 #include "qemu/error-report.h"
24 #include "sysemu/kvm.h"
28 #include "mmu-radix64.h"
29 #include "mmu-book3s-v3.h"
31 static bool ppc_radix64_get_fully_qualified_addr(const CPUPPCState
*env
,
33 uint64_t *lpid
, uint64_t *pid
)
35 /* When EA(2:11) are nonzero, raise a segment interrupt */
36 if (eaddr
& ~R_EADDR_VALID_MASK
) {
40 if (msr_hv
) { /* MSR[HV] -> Hypervisor/bare metal */
41 switch (eaddr
& R_EADDR_QUADRANT
) {
42 case R_EADDR_QUADRANT0
:
44 *pid
= env
->spr
[SPR_BOOKS_PID
];
46 case R_EADDR_QUADRANT1
:
47 *lpid
= env
->spr
[SPR_LPIDR
];
48 *pid
= env
->spr
[SPR_BOOKS_PID
];
50 case R_EADDR_QUADRANT2
:
51 *lpid
= env
->spr
[SPR_LPIDR
];
54 case R_EADDR_QUADRANT3
:
59 g_assert_not_reached();
61 } else { /* !MSR[HV] -> Guest */
62 switch (eaddr
& R_EADDR_QUADRANT
) {
63 case R_EADDR_QUADRANT0
: /* Guest application */
64 *lpid
= env
->spr
[SPR_LPIDR
];
65 *pid
= env
->spr
[SPR_BOOKS_PID
];
67 case R_EADDR_QUADRANT1
: /* Illegal */
68 case R_EADDR_QUADRANT2
:
70 case R_EADDR_QUADRANT3
: /* Guest OS */
71 *lpid
= env
->spr
[SPR_LPIDR
];
72 *pid
= 0; /* pid set to 0 -> addresses guest operating system */
75 g_assert_not_reached();
82 static void ppc_radix64_raise_segi(PowerPCCPU
*cpu
, MMUAccessType access_type
,
85 CPUState
*cs
= CPU(cpu
);
86 CPUPPCState
*env
= &cpu
->env
;
88 switch (access_type
) {
90 /* Instruction Segment Interrupt */
91 cs
->exception_index
= POWERPC_EXCP_ISEG
;
95 /* Data Segment Interrupt */
96 cs
->exception_index
= POWERPC_EXCP_DSEG
;
97 env
->spr
[SPR_DAR
] = eaddr
;
100 g_assert_not_reached();
105 static inline const char *access_str(MMUAccessType access_type
)
107 return access_type
== MMU_DATA_LOAD
? "reading" :
108 (access_type
== MMU_DATA_STORE
? "writing" : "execute");
111 static void ppc_radix64_raise_si(PowerPCCPU
*cpu
, MMUAccessType access_type
,
112 vaddr eaddr
, uint32_t cause
)
114 CPUState
*cs
= CPU(cpu
);
115 CPUPPCState
*env
= &cpu
->env
;
117 qemu_log_mask(CPU_LOG_MMU
, "%s for %s @0x%"VADDR_PRIx
" cause %08x\n",
118 __func__
, access_str(access_type
),
121 switch (access_type
) {
123 /* Instruction Storage Interrupt */
124 cs
->exception_index
= POWERPC_EXCP_ISI
;
125 env
->error_code
= cause
;
128 cause
|= DSISR_ISSTORE
;
131 /* Data Storage Interrupt */
132 cs
->exception_index
= POWERPC_EXCP_DSI
;
133 env
->spr
[SPR_DSISR
] = cause
;
134 env
->spr
[SPR_DAR
] = eaddr
;
138 g_assert_not_reached();
142 static void ppc_radix64_raise_hsi(PowerPCCPU
*cpu
, MMUAccessType access_type
,
143 vaddr eaddr
, hwaddr g_raddr
, uint32_t cause
)
145 CPUState
*cs
= CPU(cpu
);
146 CPUPPCState
*env
= &cpu
->env
;
148 qemu_log_mask(CPU_LOG_MMU
, "%s for %s @0x%"VADDR_PRIx
" 0x%"
149 HWADDR_PRIx
" cause %08x\n",
150 __func__
, access_str(access_type
),
151 eaddr
, g_raddr
, cause
);
153 switch (access_type
) {
155 /* H Instruction Storage Interrupt */
156 cs
->exception_index
= POWERPC_EXCP_HISI
;
157 env
->spr
[SPR_ASDR
] = g_raddr
;
158 env
->error_code
= cause
;
161 cause
|= DSISR_ISSTORE
;
164 /* H Data Storage Interrupt */
165 cs
->exception_index
= POWERPC_EXCP_HDSI
;
166 env
->spr
[SPR_HDSISR
] = cause
;
167 env
->spr
[SPR_HDAR
] = eaddr
;
168 env
->spr
[SPR_ASDR
] = g_raddr
;
172 g_assert_not_reached();
176 static bool ppc_radix64_check_prot(PowerPCCPU
*cpu
, MMUAccessType access_type
,
177 uint64_t pte
, int *fault_cause
, int *prot
,
178 int mmu_idx
, bool partition_scoped
)
180 CPUPPCState
*env
= &cpu
->env
;
183 /* Check Page Attributes (pte58:59) */
184 if ((pte
& R_PTE_ATT
) == R_PTE_ATT_NI_IO
&& access_type
== MMU_INST_FETCH
) {
186 * Radix PTE entries with the non-idempotent I/O attribute are treated
189 *fault_cause
|= SRR1_NOEXEC_GUARD
;
193 /* Determine permissions allowed by Encoded Access Authority */
194 if (!partition_scoped
&& (pte
& R_PTE_EAA_PRIV
) && msr_pr
) {
196 } else if (mmuidx_pr(mmu_idx
) || (pte
& R_PTE_EAA_PRIV
) ||
198 *prot
= ppc_radix64_get_prot_eaa(pte
);
199 } else { /* !msr_pr && !(pte & R_PTE_EAA_PRIV) && !partition_scoped */
200 *prot
= ppc_radix64_get_prot_eaa(pte
);
201 *prot
&= ppc_radix64_get_prot_amr(cpu
); /* Least combined permissions */
204 /* Check if requested access type is allowed */
205 need_prot
= prot_for_access_type(access_type
);
206 if (need_prot
& ~*prot
) { /* Page Protected for that Access */
207 *fault_cause
|= DSISR_PROTFAULT
;
214 static void ppc_radix64_set_rc(PowerPCCPU
*cpu
, MMUAccessType access_type
,
215 uint64_t pte
, hwaddr pte_addr
, int *prot
)
217 CPUState
*cs
= CPU(cpu
);
220 npte
= pte
| R_PTE_R
; /* Always set reference bit */
222 if (access_type
== MMU_DATA_STORE
) { /* Store/Write */
223 npte
|= R_PTE_C
; /* Set change bit */
226 * Treat the page as read-only for now, so that a later write
227 * will pass through this function again to set the C bit.
229 *prot
&= ~PAGE_WRITE
;
232 if (pte
^ npte
) { /* If pte has changed then write it back */
233 stq_phys(cs
->as
, pte_addr
, npte
);
237 static int ppc_radix64_next_level(AddressSpace
*as
, vaddr eaddr
,
238 uint64_t *pte_addr
, uint64_t *nls
,
239 int *psize
, uint64_t *pte
, int *fault_cause
)
243 if (*nls
< 5) { /* Directory maps less than 2**5 entries */
244 *fault_cause
|= DSISR_R_BADCONFIG
;
248 /* Read page <directory/table> entry from guest address space */
249 pde
= ldq_phys(as
, *pte_addr
);
250 if (!(pde
& R_PTE_VALID
)) { /* Invalid Entry */
251 *fault_cause
|= DSISR_NOPTE
;
257 if (!(pde
& R_PTE_LEAF
)) { /* Prepare for next iteration */
258 *nls
= pde
& R_PDE_NLS
;
259 index
= eaddr
>> (*psize
- *nls
); /* Shift */
260 index
&= ((1UL << *nls
) - 1); /* Mask */
261 *pte_addr
= (pde
& R_PDE_NLB
) + (index
* sizeof(pde
));
266 static int ppc_radix64_walk_tree(AddressSpace
*as
, vaddr eaddr
,
267 uint64_t base_addr
, uint64_t nls
,
268 hwaddr
*raddr
, int *psize
, uint64_t *pte
,
269 int *fault_cause
, hwaddr
*pte_addr
)
271 uint64_t index
, pde
, rpn
, mask
;
273 if (nls
< 5) { /* Directory maps less than 2**5 entries */
274 *fault_cause
|= DSISR_R_BADCONFIG
;
278 index
= eaddr
>> (*psize
- nls
); /* Shift */
279 index
&= ((1UL << nls
) - 1); /* Mask */
280 *pte_addr
= base_addr
+ (index
* sizeof(pde
));
284 ret
= ppc_radix64_next_level(as
, eaddr
, pte_addr
, &nls
, psize
, &pde
,
289 } while (!(pde
& R_PTE_LEAF
));
292 rpn
= pde
& R_PTE_RPN
;
293 mask
= (1UL << *psize
) - 1;
295 /* Or high bits of rpn and low bits to ea to form whole real addr */
296 *raddr
= (rpn
& ~mask
) | (eaddr
& mask
);
300 static bool validate_pate(PowerPCCPU
*cpu
, uint64_t lpid
, ppc_v3_pate_t
*pate
)
302 CPUPPCState
*env
= &cpu
->env
;
304 if (!(pate
->dw0
& PATE0_HR
)) {
307 if (lpid
== 0 && !msr_hv
) {
310 if ((pate
->dw0
& PATE1_R_PRTS
) < 5) {
313 /* More checks ... */
317 static int ppc_radix64_partition_scoped_xlate(PowerPCCPU
*cpu
,
318 MMUAccessType access_type
,
319 vaddr eaddr
, hwaddr g_raddr
,
321 hwaddr
*h_raddr
, int *h_prot
,
322 int *h_page_size
, bool pde_addr
,
323 int mmu_idx
, bool guest_visible
)
329 qemu_log_mask(CPU_LOG_MMU
, "%s for %s @0x%"VADDR_PRIx
330 " mmu_idx %u 0x%"HWADDR_PRIx
"\n",
331 __func__
, access_str(access_type
),
332 eaddr
, mmu_idx
, g_raddr
);
334 *h_page_size
= PRTBE_R_GET_RTS(pate
.dw0
);
335 /* No valid pte or access denied due to protection */
336 if (ppc_radix64_walk_tree(CPU(cpu
)->as
, g_raddr
, pate
.dw0
& PRTBE_R_RPDB
,
337 pate
.dw0
& PRTBE_R_RPDS
, h_raddr
, h_page_size
,
338 &pte
, &fault_cause
, &pte_addr
) ||
339 ppc_radix64_check_prot(cpu
, access_type
, pte
,
340 &fault_cause
, h_prot
, mmu_idx
, true)) {
341 if (pde_addr
) { /* address being translated was that of a guest pde */
342 fault_cause
|= DSISR_PRTABLE_FAULT
;
345 ppc_radix64_raise_hsi(cpu
, access_type
, eaddr
, g_raddr
, fault_cause
);
351 ppc_radix64_set_rc(cpu
, access_type
, pte
, pte_addr
, h_prot
);
357 static int ppc_radix64_process_scoped_xlate(PowerPCCPU
*cpu
,
358 MMUAccessType access_type
,
359 vaddr eaddr
, uint64_t pid
,
360 ppc_v3_pate_t pate
, hwaddr
*g_raddr
,
361 int *g_prot
, int *g_page_size
,
362 int mmu_idx
, bool guest_visible
)
364 CPUState
*cs
= CPU(cpu
);
365 CPUPPCState
*env
= &cpu
->env
;
366 uint64_t offset
, size
, prtbe_addr
, prtbe0
, base_addr
, nls
, index
, pte
;
367 int fault_cause
= 0, h_page_size
, h_prot
;
368 hwaddr h_raddr
, pte_addr
;
371 qemu_log_mask(CPU_LOG_MMU
, "%s for %s @0x%"VADDR_PRIx
372 " mmu_idx %u pid %"PRIu64
"\n",
373 __func__
, access_str(access_type
),
374 eaddr
, mmu_idx
, pid
);
376 /* Index Process Table by PID to Find Corresponding Process Table Entry */
377 offset
= pid
* sizeof(struct prtb_entry
);
378 size
= 1ULL << ((pate
.dw1
& PATE1_R_PRTS
) + 12);
379 if (offset
>= size
) {
380 /* offset exceeds size of the process table */
382 ppc_radix64_raise_si(cpu
, access_type
, eaddr
, DSISR_NOPTE
);
386 prtbe_addr
= (pate
.dw1
& PATE1_R_PRTB
) + offset
;
389 prtbe0
= ldq_phys(cs
->as
, prtbe_addr
);
392 * Process table addresses are subject to partition-scoped
395 * On a Radix host, the partition-scoped page table for LPID=0
396 * is only used to translate the effective addresses of the
397 * process table entries.
399 ret
= ppc_radix64_partition_scoped_xlate(cpu
, 0, eaddr
, prtbe_addr
,
400 pate
, &h_raddr
, &h_prot
,
402 /* mmu_idx is 5 because we're translating from hypervisor scope */
407 prtbe0
= ldq_phys(cs
->as
, h_raddr
);
410 /* Walk Radix Tree from Process Table Entry to Convert EA to RA */
411 *g_page_size
= PRTBE_R_GET_RTS(prtbe0
);
412 base_addr
= prtbe0
& PRTBE_R_RPDB
;
413 nls
= prtbe0
& PRTBE_R_RPDS
;
414 if (msr_hv
|| cpu
->vhyp
) {
416 * Can treat process table addresses as real addresses
418 ret
= ppc_radix64_walk_tree(cs
->as
, eaddr
& R_EADDR_MASK
, base_addr
,
419 nls
, g_raddr
, g_page_size
, &pte
,
420 &fault_cause
, &pte_addr
);
424 ppc_radix64_raise_si(cpu
, access_type
, eaddr
, fault_cause
);
431 index
= (eaddr
& R_EADDR_MASK
) >> (*g_page_size
- nls
); /* Shift */
432 index
&= ((1UL << nls
) - 1); /* Mask */
433 pte_addr
= base_addr
+ (index
* sizeof(pte
));
436 * Each process table address is subject to a partition-scoped
440 ret
= ppc_radix64_partition_scoped_xlate(cpu
, 0, eaddr
, pte_addr
,
441 pate
, &h_raddr
, &h_prot
,
443 /* mmu_idx is 5 because we're translating from hypervisor scope */
449 ret
= ppc_radix64_next_level(cs
->as
, eaddr
& R_EADDR_MASK
, &h_raddr
,
450 &nls
, g_page_size
, &pte
, &fault_cause
);
454 ppc_radix64_raise_si(cpu
, access_type
, eaddr
, fault_cause
);
459 } while (!(pte
& R_PTE_LEAF
));
461 rpn
= pte
& R_PTE_RPN
;
462 mask
= (1UL << *g_page_size
) - 1;
464 /* Or high bits of rpn and low bits to ea to form whole real addr */
465 *g_raddr
= (rpn
& ~mask
) | (eaddr
& mask
);
468 if (ppc_radix64_check_prot(cpu
, access_type
, pte
, &fault_cause
,
469 g_prot
, mmu_idx
, false)) {
470 /* Access denied due to protection */
472 ppc_radix64_raise_si(cpu
, access_type
, eaddr
, fault_cause
);
478 ppc_radix64_set_rc(cpu
, access_type
, pte
, pte_addr
, g_prot
);
485 * Radix tree translation is a 2 steps translation process:
487 * 1. Process-scoped translation: Guest Eff Addr -> Guest Real Addr
488 * 2. Partition-scoped translation: Guest Real Addr -> Host Real Addr
491 * +-------------+----------------+---------------+
492 * | | HV = 0 | HV = 1 |
493 * +-------------+----------------+---------------+
494 * | Relocation | Partition | No |
495 * | = Off | Scoped | Translation |
496 * Relocation +-------------+----------------+---------------+
497 * | Relocation | Partition & | Process |
498 * | = On | Process Scoped | Scoped |
499 * +-------------+----------------+---------------+
501 static bool ppc_radix64_xlate_impl(PowerPCCPU
*cpu
, vaddr eaddr
,
502 MMUAccessType access_type
, hwaddr
*raddr
,
503 int *psizep
, int *protp
, int mmu_idx
,
506 CPUPPCState
*env
= &cpu
->env
;
513 assert(!(mmuidx_hv(mmu_idx
) && cpu
->vhyp
));
515 relocation
= !mmuidx_real(mmu_idx
);
517 /* HV or virtual hypervisor Real Mode Access */
518 if (!relocation
&& (mmuidx_hv(mmu_idx
) || cpu
->vhyp
)) {
519 /* In real mode top 4 effective addr bits (mostly) ignored */
520 *raddr
= eaddr
& 0x0FFFFFFFFFFFFFFFULL
;
522 /* In HV mode, add HRMOR if top EA bit is clear */
523 if (mmuidx_hv(mmu_idx
) || !env
->has_hv_mode
) {
524 if (!(eaddr
>> 63)) {
525 *raddr
|= env
->spr
[SPR_HRMOR
];
528 *protp
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
529 *psizep
= TARGET_PAGE_BITS
;
534 * Check UPRT (we avoid the check in real mode to deal with
535 * transitional states during kexec.
537 if (guest_visible
&& !ppc64_use_proc_tbl(cpu
)) {
538 qemu_log_mask(LOG_GUEST_ERROR
,
539 "LPCR:UPRT not set in radix mode ! LPCR="
540 TARGET_FMT_lx
"\n", env
->spr
[SPR_LPCR
]);
543 /* Virtual Mode Access - get the fully qualified address */
544 if (!ppc_radix64_get_fully_qualified_addr(&cpu
->env
, eaddr
, &lpid
, &pid
)) {
546 ppc_radix64_raise_segi(cpu
, access_type
, eaddr
);
551 /* Get Process Table */
553 PPCVirtualHypervisorClass
*vhc
;
554 vhc
= PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu
->vhyp
);
555 vhc
->get_pate(cpu
->vhyp
, &pate
);
557 if (!ppc64_v3_get_pate(cpu
, lpid
, &pate
)) {
559 ppc_radix64_raise_si(cpu
, access_type
, eaddr
, DSISR_NOPTE
);
563 if (!validate_pate(cpu
, lpid
, &pate
)) {
565 ppc_radix64_raise_si(cpu
, access_type
, eaddr
, DSISR_R_BADCONFIG
);
572 *protp
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
575 * Perform process-scoped translation if relocation enabled.
577 * - Translates an effective address to a host real address in
578 * quadrants 0 and 3 when HV=1.
580 * - Translates an effective address to a guest real address.
583 int ret
= ppc_radix64_process_scoped_xlate(cpu
, access_type
, eaddr
, pid
,
584 pate
, &g_raddr
, &prot
,
585 &psize
, mmu_idx
, guest_visible
);
589 *psizep
= MIN(*psizep
, psize
);
592 g_raddr
= eaddr
& R_EADDR_MASK
;
599 * Perform partition-scoped translation if !HV or HV access to
600 * quadrants 1 or 2. Translates a guest real address to a host
603 if (lpid
|| !mmuidx_hv(mmu_idx
)) {
606 ret
= ppc_radix64_partition_scoped_xlate(cpu
, access_type
, eaddr
,
607 g_raddr
, pate
, raddr
,
608 &prot
, &psize
, false,
609 mmu_idx
, guest_visible
);
613 *psizep
= MIN(*psizep
, psize
);
623 bool ppc_radix64_xlate(PowerPCCPU
*cpu
, vaddr eaddr
, MMUAccessType access_type
,
624 hwaddr
*raddrp
, int *psizep
, int *protp
, int mmu_idx
,
627 bool ret
= ppc_radix64_xlate_impl(cpu
, eaddr
, access_type
, raddrp
,
628 psizep
, protp
, mmu_idx
, guest_visible
);
630 qemu_log_mask(CPU_LOG_MMU
, "%s for %s @0x%"VADDR_PRIx
631 " mmu_idx %u (prot %c%c%c) -> 0x%"HWADDR_PRIx
"\n",
632 __func__
, access_str(access_type
),
634 *protp
& PAGE_READ
? 'r' : '-',
635 *protp
& PAGE_WRITE
? 'w' : '-',
636 *protp
& PAGE_EXEC
? 'x' : '-',