2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 * Copyright (c) 2013 David Gibson, IBM Corporation
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
21 #include "qemu/units.h"
23 #include "exec/exec-all.h"
24 #include "exec/helper-proto.h"
25 #include "qemu/error-report.h"
26 #include "qemu/qemu-print.h"
27 #include "sysemu/hw_accel.h"
29 #include "mmu-hash64.h"
32 #include "mmu-book3s-v3.h"
34 /* #define DEBUG_SLB */
37 # define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
39 # define LOG_SLB(...) do { } while (0)
46 static ppc_slb_t
*slb_lookup(PowerPCCPU
*cpu
, target_ulong eaddr
)
48 CPUPPCState
*env
= &cpu
->env
;
49 uint64_t esid_256M
, esid_1T
;
52 LOG_SLB("%s: eaddr " TARGET_FMT_lx
"\n", __func__
, eaddr
);
54 esid_256M
= (eaddr
& SEGMENT_MASK_256M
) | SLB_ESID_V
;
55 esid_1T
= (eaddr
& SEGMENT_MASK_1T
) | SLB_ESID_V
;
57 for (n
= 0; n
< cpu
->hash64_opts
->slb_size
; n
++) {
58 ppc_slb_t
*slb
= &env
->slb
[n
];
60 LOG_SLB("%s: slot %d %016" PRIx64
" %016"
61 PRIx64
"\n", __func__
, n
, slb
->esid
, slb
->vsid
);
63 * We check for 1T matches on all MMUs here - if the MMU
64 * doesn't have 1T segment support, we will have prevented 1T
65 * entries from being inserted in the slbmte code.
67 if (((slb
->esid
== esid_256M
) &&
68 ((slb
->vsid
& SLB_VSID_B
) == SLB_VSID_B_256M
))
69 || ((slb
->esid
== esid_1T
) &&
70 ((slb
->vsid
& SLB_VSID_B
) == SLB_VSID_B_1T
))) {
78 void dump_slb(PowerPCCPU
*cpu
)
80 CPUPPCState
*env
= &cpu
->env
;
84 cpu_synchronize_state(CPU(cpu
));
86 qemu_printf("SLB\tESID\t\t\tVSID\n");
87 for (i
= 0; i
< cpu
->hash64_opts
->slb_size
; i
++) {
88 slbe
= env
->slb
[i
].esid
;
89 slbv
= env
->slb
[i
].vsid
;
90 if (slbe
== 0 && slbv
== 0) {
93 qemu_printf("%d\t0x%016" PRIx64
"\t0x%016" PRIx64
"\n",
98 void helper_slbia(CPUPPCState
*env
)
100 PowerPCCPU
*cpu
= env_archcpu(env
);
103 /* XXX: Warning: slbia never invalidates the first segment */
104 for (n
= 1; n
< cpu
->hash64_opts
->slb_size
; n
++) {
105 ppc_slb_t
*slb
= &env
->slb
[n
];
107 if (slb
->esid
& SLB_ESID_V
) {
108 slb
->esid
&= ~SLB_ESID_V
;
110 * XXX: given the fact that segment size is 256 MB or 1TB,
111 * and we still don't have a tlb_flush_mask(env, n, mask)
112 * in QEMU, we just invalidate all TLBs
114 env
->tlb_need_flush
|= TLB_NEED_LOCAL_FLUSH
;
119 static void __helper_slbie(CPUPPCState
*env
, target_ulong addr
,
122 PowerPCCPU
*cpu
= env_archcpu(env
);
125 slb
= slb_lookup(cpu
, addr
);
130 if (slb
->esid
& SLB_ESID_V
) {
131 slb
->esid
&= ~SLB_ESID_V
;
134 * XXX: given the fact that segment size is 256 MB or 1TB,
135 * and we still don't have a tlb_flush_mask(env, n, mask)
136 * in QEMU, we just invalidate all TLBs
138 env
->tlb_need_flush
|=
139 (global
== false ? TLB_NEED_LOCAL_FLUSH
: TLB_NEED_GLOBAL_FLUSH
);
143 void helper_slbie(CPUPPCState
*env
, target_ulong addr
)
145 __helper_slbie(env
, addr
, false);
148 void helper_slbieg(CPUPPCState
*env
, target_ulong addr
)
150 __helper_slbie(env
, addr
, true);
153 int ppc_store_slb(PowerPCCPU
*cpu
, target_ulong slot
,
154 target_ulong esid
, target_ulong vsid
)
156 CPUPPCState
*env
= &cpu
->env
;
157 ppc_slb_t
*slb
= &env
->slb
[slot
];
158 const PPCHash64SegmentPageSizes
*sps
= NULL
;
161 if (slot
>= cpu
->hash64_opts
->slb_size
) {
162 return -1; /* Bad slot number */
164 if (esid
& ~(SLB_ESID_ESID
| SLB_ESID_V
)) {
165 return -1; /* Reserved bits set */
167 if (vsid
& (SLB_VSID_B
& ~SLB_VSID_B_1T
)) {
168 return -1; /* Bad segment size */
170 if ((vsid
& SLB_VSID_B
) && !(ppc_hash64_has(cpu
, PPC_HASH64_1TSEG
))) {
171 return -1; /* 1T segment on MMU that doesn't support it */
174 for (i
= 0; i
< PPC_PAGE_SIZES_MAX_SZ
; i
++) {
175 const PPCHash64SegmentPageSizes
*sps1
= &cpu
->hash64_opts
->sps
[i
];
177 if (!sps1
->page_shift
) {
181 if ((vsid
& SLB_VSID_LLP_MASK
) == sps1
->slb_enc
) {
188 error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu
189 " esid 0x"TARGET_FMT_lx
" vsid 0x"TARGET_FMT_lx
,
198 LOG_SLB("%s: " TARGET_FMT_lu
" " TARGET_FMT_lx
" - " TARGET_FMT_lx
199 " => %016" PRIx64
" %016" PRIx64
"\n", __func__
, slot
, esid
, vsid
,
200 slb
->esid
, slb
->vsid
);
205 static int ppc_load_slb_esid(PowerPCCPU
*cpu
, target_ulong rb
,
208 CPUPPCState
*env
= &cpu
->env
;
209 int slot
= rb
& 0xfff;
210 ppc_slb_t
*slb
= &env
->slb
[slot
];
212 if (slot
>= cpu
->hash64_opts
->slb_size
) {
220 static int ppc_load_slb_vsid(PowerPCCPU
*cpu
, target_ulong rb
,
223 CPUPPCState
*env
= &cpu
->env
;
224 int slot
= rb
& 0xfff;
225 ppc_slb_t
*slb
= &env
->slb
[slot
];
227 if (slot
>= cpu
->hash64_opts
->slb_size
) {
235 static int ppc_find_slb_vsid(PowerPCCPU
*cpu
, target_ulong rb
,
238 CPUPPCState
*env
= &cpu
->env
;
241 if (!msr_is_64bit(env
, env
->msr
)) {
244 slb
= slb_lookup(cpu
, rb
);
246 *rt
= (target_ulong
)-1ul;
253 void helper_store_slb(CPUPPCState
*env
, target_ulong rb
, target_ulong rs
)
255 PowerPCCPU
*cpu
= env_archcpu(env
);
257 if (ppc_store_slb(cpu
, rb
& 0xfff, rb
& ~0xfffULL
, rs
) < 0) {
258 raise_exception_err_ra(env
, POWERPC_EXCP_PROGRAM
,
259 POWERPC_EXCP_INVAL
, GETPC());
263 target_ulong
helper_load_slb_esid(CPUPPCState
*env
, target_ulong rb
)
265 PowerPCCPU
*cpu
= env_archcpu(env
);
268 if (ppc_load_slb_esid(cpu
, rb
, &rt
) < 0) {
269 raise_exception_err_ra(env
, POWERPC_EXCP_PROGRAM
,
270 POWERPC_EXCP_INVAL
, GETPC());
275 target_ulong
helper_find_slb_vsid(CPUPPCState
*env
, target_ulong rb
)
277 PowerPCCPU
*cpu
= env_archcpu(env
);
280 if (ppc_find_slb_vsid(cpu
, rb
, &rt
) < 0) {
281 raise_exception_err_ra(env
, POWERPC_EXCP_PROGRAM
,
282 POWERPC_EXCP_INVAL
, GETPC());
287 target_ulong
helper_load_slb_vsid(CPUPPCState
*env
, target_ulong rb
)
289 PowerPCCPU
*cpu
= env_archcpu(env
);
292 if (ppc_load_slb_vsid(cpu
, rb
, &rt
) < 0) {
293 raise_exception_err_ra(env
, POWERPC_EXCP_PROGRAM
,
294 POWERPC_EXCP_INVAL
, GETPC());
299 /* Check No-Execute or Guarded Storage */
300 static inline int ppc_hash64_pte_noexec_guard(PowerPCCPU
*cpu
,
301 ppc_hash_pte64_t pte
)
303 /* Exec permissions CANNOT take away read or write permissions */
304 return (pte
.pte1
& HPTE64_R_N
) || (pte
.pte1
& HPTE64_R_G
) ?
305 PAGE_READ
| PAGE_WRITE
: PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
308 /* Check Basic Storage Protection */
309 static int ppc_hash64_pte_prot(PowerPCCPU
*cpu
,
310 ppc_slb_t
*slb
, ppc_hash_pte64_t pte
)
312 CPUPPCState
*env
= &cpu
->env
;
315 * Some pp bit combinations have undefined behaviour, so default
316 * to no access in those cases
320 key
= !!(msr_pr
? (slb
->vsid
& SLB_VSID_KP
)
321 : (slb
->vsid
& SLB_VSID_KS
));
322 pp
= (pte
.pte1
& HPTE64_R_PP
) | ((pte
.pte1
& HPTE64_R_PP0
) >> 61);
329 prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
334 prot
= PAGE_READ
| PAGE_EXEC
;
345 prot
= PAGE_READ
| PAGE_EXEC
;
349 prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
357 /* Check the instruction access permissions specified in the IAMR */
358 static int ppc_hash64_iamr_prot(PowerPCCPU
*cpu
, int key
)
360 CPUPPCState
*env
= &cpu
->env
;
361 int iamr_bits
= (env
->spr
[SPR_IAMR
] >> 2 * (31 - key
)) & 0x3;
364 * An instruction fetch is permitted if the IAMR bit is 0.
365 * If the bit is set, return PAGE_READ | PAGE_WRITE because this bit
366 * can only take away EXEC permissions not READ or WRITE permissions.
367 * If bit is cleared return PAGE_READ | PAGE_WRITE | PAGE_EXEC since
368 * EXEC permissions are allowed.
370 return (iamr_bits
& 0x1) ? PAGE_READ
| PAGE_WRITE
:
371 PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
374 static int ppc_hash64_amr_prot(PowerPCCPU
*cpu
, ppc_hash_pte64_t pte
)
376 CPUPPCState
*env
= &cpu
->env
;
378 int prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
380 /* Only recent MMUs implement Virtual Page Class Key Protection */
381 if (!ppc_hash64_has(cpu
, PPC_HASH64_AMR
)) {
385 key
= HPTE64_R_KEY(pte
.pte1
);
386 amrbits
= (env
->spr
[SPR_AMR
] >> 2 * (31 - key
)) & 0x3;
388 /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */
389 /* env->spr[SPR_AMR]); */
392 * A store is permitted if the AMR bit is 0. Remove write
393 * protection if it is set.
399 * A load is permitted if the AMR bit is 0. Remove read
400 * protection if it is set.
406 switch (env
->mmu_model
) {
408 * MMU version 2.07 and later support IAMR
409 * Check if the IAMR allows the instruction access - it will return
410 * PAGE_EXEC if it doesn't (and thus that bit will be cleared) or 0
411 * if it does (and prot will be unchanged indicating execution support).
413 case POWERPC_MMU_2_07
:
414 case POWERPC_MMU_3_00
:
415 prot
&= ppc_hash64_iamr_prot(cpu
, key
);
424 const ppc_hash_pte64_t
*ppc_hash64_map_hptes(PowerPCCPU
*cpu
,
427 hwaddr pte_offset
= ptex
* HASH_PTE_SIZE_64
;
429 hwaddr plen
= n
* HASH_PTE_SIZE_64
;
430 const ppc_hash_pte64_t
*hptes
;
433 PPCVirtualHypervisorClass
*vhc
=
434 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu
->vhyp
);
435 return vhc
->map_hptes(cpu
->vhyp
, ptex
, n
);
437 base
= ppc_hash64_hpt_base(cpu
);
443 hptes
= address_space_map(CPU(cpu
)->as
, base
+ pte_offset
, &plen
, false,
444 MEMTXATTRS_UNSPECIFIED
);
445 if (plen
< (n
* HASH_PTE_SIZE_64
)) {
446 hw_error("%s: Unable to map all requested HPTEs\n", __func__
);
451 void ppc_hash64_unmap_hptes(PowerPCCPU
*cpu
, const ppc_hash_pte64_t
*hptes
,
455 PPCVirtualHypervisorClass
*vhc
=
456 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu
->vhyp
);
457 vhc
->unmap_hptes(cpu
->vhyp
, hptes
, ptex
, n
);
461 address_space_unmap(CPU(cpu
)->as
, (void *)hptes
, n
* HASH_PTE_SIZE_64
,
462 false, n
* HASH_PTE_SIZE_64
);
465 static unsigned hpte_page_shift(const PPCHash64SegmentPageSizes
*sps
,
466 uint64_t pte0
, uint64_t pte1
)
470 if (!(pte0
& HPTE64_V_LARGE
)) {
471 if (sps
->page_shift
!= 12) {
472 /* 4kiB page in a non 4kiB segment */
475 /* Normal 4kiB page */
479 for (i
= 0; i
< PPC_PAGE_SIZES_MAX_SZ
; i
++) {
480 const PPCHash64PageSize
*ps
= &sps
->enc
[i
];
483 if (!ps
->page_shift
) {
487 if (ps
->page_shift
== 12) {
488 /* L bit is set so this can't be a 4kiB page */
492 mask
= ((1ULL << ps
->page_shift
) - 1) & HPTE64_R_RPN
;
494 if ((pte1
& mask
) == ((uint64_t)ps
->pte_enc
<< HPTE64_R_RPN_SHIFT
)) {
495 return ps
->page_shift
;
499 return 0; /* Bad page size encoding */
502 static void ppc64_v3_new_to_old_hpte(target_ulong
*pte0
, target_ulong
*pte1
)
504 /* Insert B into pte0 */
505 *pte0
= (*pte0
& HPTE64_V_COMMON_BITS
) |
506 ((*pte1
& HPTE64_R_3_0_SSIZE_MASK
) <<
507 (HPTE64_V_SSIZE_SHIFT
- HPTE64_R_3_0_SSIZE_SHIFT
));
509 /* Remove B from pte1 */
510 *pte1
= *pte1
& ~HPTE64_R_3_0_SSIZE_MASK
;
514 static hwaddr
ppc_hash64_pteg_search(PowerPCCPU
*cpu
, hwaddr hash
,
515 const PPCHash64SegmentPageSizes
*sps
,
517 ppc_hash_pte64_t
*pte
, unsigned *pshift
)
520 const ppc_hash_pte64_t
*pteg
;
521 target_ulong pte0
, pte1
;
524 ptex
= (hash
& ppc_hash64_hpt_mask(cpu
)) * HPTES_PER_GROUP
;
525 pteg
= ppc_hash64_map_hptes(cpu
, ptex
, HPTES_PER_GROUP
);
529 for (i
= 0; i
< HPTES_PER_GROUP
; i
++) {
530 pte0
= ppc_hash64_hpte0(cpu
, pteg
, i
);
532 * pte0 contains the valid bit and must be read before pte1,
533 * otherwise we might see an old pte1 with a new valid bit and
534 * thus an inconsistent hpte value
537 pte1
= ppc_hash64_hpte1(cpu
, pteg
, i
);
539 /* Convert format if necessary */
540 if (cpu
->env
.mmu_model
== POWERPC_MMU_3_00
&& !cpu
->vhyp
) {
541 ppc64_v3_new_to_old_hpte(&pte0
, &pte1
);
544 /* This compares V, B, H (secondary) and the AVPN */
545 if (HPTE64_V_COMPARE(pte0
, ptem
)) {
546 *pshift
= hpte_page_shift(sps
, pte0
, pte1
);
548 * If there is no match, ignore the PTE, it could simply
549 * be for a different segment size encoding and the
550 * architecture specifies we should not match. Linux will
551 * potentially leave behind PTEs for the wrong base page
552 * size when demoting segments.
558 * We don't do anything with pshift yet as qemu TLB only
559 * deals with 4K pages anyway
563 ppc_hash64_unmap_hptes(cpu
, pteg
, ptex
, HPTES_PER_GROUP
);
567 ppc_hash64_unmap_hptes(cpu
, pteg
, ptex
, HPTES_PER_GROUP
);
569 * We didn't find a valid entry.
574 static hwaddr
ppc_hash64_htab_lookup(PowerPCCPU
*cpu
,
575 ppc_slb_t
*slb
, target_ulong eaddr
,
576 ppc_hash_pte64_t
*pte
, unsigned *pshift
)
578 CPUPPCState
*env
= &cpu
->env
;
580 uint64_t vsid
, epnmask
, epn
, ptem
;
581 const PPCHash64SegmentPageSizes
*sps
= slb
->sps
;
584 * The SLB store path should prevent any bad page size encodings
585 * getting in there, so:
589 /* If ISL is set in LPCR we need to clamp the page size to 4K */
590 if (env
->spr
[SPR_LPCR
] & LPCR_ISL
) {
591 /* We assume that when using TCG, 4k is first entry of SPS */
592 sps
= &cpu
->hash64_opts
->sps
[0];
593 assert(sps
->page_shift
== 12);
596 epnmask
= ~((1ULL << sps
->page_shift
) - 1);
598 if (slb
->vsid
& SLB_VSID_B
) {
600 vsid
= (slb
->vsid
& SLB_VSID_VSID
) >> SLB_VSID_SHIFT_1T
;
601 epn
= (eaddr
& ~SEGMENT_MASK_1T
) & epnmask
;
602 hash
= vsid
^ (vsid
<< 25) ^ (epn
>> sps
->page_shift
);
605 vsid
= (slb
->vsid
& SLB_VSID_VSID
) >> SLB_VSID_SHIFT
;
606 epn
= (eaddr
& ~SEGMENT_MASK_256M
) & epnmask
;
607 hash
= vsid
^ (epn
>> sps
->page_shift
);
609 ptem
= (slb
->vsid
& SLB_VSID_PTEM
) | ((epn
>> 16) & HPTE64_V_AVPN
);
610 ptem
|= HPTE64_V_VALID
;
612 /* Page address translation */
613 qemu_log_mask(CPU_LOG_MMU
,
614 "htab_base " TARGET_FMT_plx
" htab_mask " TARGET_FMT_plx
615 " hash " TARGET_FMT_plx
"\n",
616 ppc_hash64_hpt_base(cpu
), ppc_hash64_hpt_mask(cpu
), hash
);
618 /* Primary PTEG lookup */
619 qemu_log_mask(CPU_LOG_MMU
,
620 "0 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
621 " vsid=" TARGET_FMT_lx
" ptem=" TARGET_FMT_lx
622 " hash=" TARGET_FMT_plx
"\n",
623 ppc_hash64_hpt_base(cpu
), ppc_hash64_hpt_mask(cpu
),
625 ptex
= ppc_hash64_pteg_search(cpu
, hash
, sps
, ptem
, pte
, pshift
);
628 /* Secondary PTEG lookup */
629 ptem
|= HPTE64_V_SECONDARY
;
630 qemu_log_mask(CPU_LOG_MMU
,
631 "1 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
632 " vsid=" TARGET_FMT_lx
" api=" TARGET_FMT_lx
633 " hash=" TARGET_FMT_plx
"\n", ppc_hash64_hpt_base(cpu
),
634 ppc_hash64_hpt_mask(cpu
), vsid
, ptem
, ~hash
);
636 ptex
= ppc_hash64_pteg_search(cpu
, ~hash
, sps
, ptem
, pte
, pshift
);
642 unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU
*cpu
,
643 uint64_t pte0
, uint64_t pte1
)
647 if (!(pte0
& HPTE64_V_LARGE
)) {
652 * The encodings in env->sps need to be carefully chosen so that
653 * this gives an unambiguous result.
655 for (i
= 0; i
< PPC_PAGE_SIZES_MAX_SZ
; i
++) {
656 const PPCHash64SegmentPageSizes
*sps
= &cpu
->hash64_opts
->sps
[i
];
659 if (!sps
->page_shift
) {
663 shift
= hpte_page_shift(sps
, pte0
, pte1
);
672 static bool ppc_hash64_use_vrma(CPUPPCState
*env
)
674 switch (env
->mmu_model
) {
675 case POWERPC_MMU_3_00
:
677 * ISAv3.0 (POWER9) always uses VRMA, the VPM0 field and RMOR
678 * register no longer exist
683 return !!(env
->spr
[SPR_LPCR
] & LPCR_VPM0
);
687 static void ppc_hash64_set_isi(CPUState
*cs
, uint64_t error_code
)
689 CPUPPCState
*env
= &POWERPC_CPU(cs
)->env
;
693 vpm
= !!(env
->spr
[SPR_LPCR
] & LPCR_VPM1
);
695 vpm
= ppc_hash64_use_vrma(env
);
697 if (vpm
&& !msr_hv
) {
698 cs
->exception_index
= POWERPC_EXCP_HISI
;
700 cs
->exception_index
= POWERPC_EXCP_ISI
;
702 env
->error_code
= error_code
;
705 static void ppc_hash64_set_dsi(CPUState
*cs
, uint64_t dar
, uint64_t dsisr
)
707 CPUPPCState
*env
= &POWERPC_CPU(cs
)->env
;
711 vpm
= !!(env
->spr
[SPR_LPCR
] & LPCR_VPM1
);
713 vpm
= ppc_hash64_use_vrma(env
);
715 if (vpm
&& !msr_hv
) {
716 cs
->exception_index
= POWERPC_EXCP_HDSI
;
717 env
->spr
[SPR_HDAR
] = dar
;
718 env
->spr
[SPR_HDSISR
] = dsisr
;
720 cs
->exception_index
= POWERPC_EXCP_DSI
;
721 env
->spr
[SPR_DAR
] = dar
;
722 env
->spr
[SPR_DSISR
] = dsisr
;
728 static void ppc_hash64_set_r(PowerPCCPU
*cpu
, hwaddr ptex
, uint64_t pte1
)
730 hwaddr base
, offset
= ptex
* HASH_PTE_SIZE_64
+ 16;
733 PPCVirtualHypervisorClass
*vhc
=
734 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu
->vhyp
);
735 vhc
->hpte_set_r(cpu
->vhyp
, ptex
, pte1
);
738 base
= ppc_hash64_hpt_base(cpu
);
741 /* The HW performs a non-atomic byte update */
742 stb_phys(CPU(cpu
)->as
, base
+ offset
, ((pte1
>> 8) & 0xff) | 0x01);
745 static void ppc_hash64_set_c(PowerPCCPU
*cpu
, hwaddr ptex
, uint64_t pte1
)
747 hwaddr base
, offset
= ptex
* HASH_PTE_SIZE_64
+ 15;
750 PPCVirtualHypervisorClass
*vhc
=
751 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu
->vhyp
);
752 vhc
->hpte_set_c(cpu
->vhyp
, ptex
, pte1
);
755 base
= ppc_hash64_hpt_base(cpu
);
757 /* The HW performs a non-atomic byte update */
758 stb_phys(CPU(cpu
)->as
, base
+ offset
, (pte1
& 0xff) | 0x80);
761 static target_ulong
rmls_limit(PowerPCCPU
*cpu
)
763 CPUPPCState
*env
= &cpu
->env
;
765 * In theory the meanings of RMLS values are implementation
766 * dependent. In practice, this seems to have been the set from
767 * POWER4+..POWER8, and RMLS is no longer supported in POWER9.
769 * Unsupported values mean the OS has shot itself in the
770 * foot. Return a 0-sized RMA in this case, which we expect
771 * to trigger an immediate DSI or ISI
773 static const target_ulong rma_sizes
[16] = {
782 target_ulong rmls
= (env
->spr
[SPR_LPCR
] & LPCR_RMLS
) >> LPCR_RMLS_SHIFT
;
784 return rma_sizes
[rmls
];
787 int ppc_hash64_handle_mmu_fault(PowerPCCPU
*cpu
, vaddr eaddr
,
788 int rwx
, int mmu_idx
)
790 CPUState
*cs
= CPU(cpu
);
791 CPUPPCState
*env
= &cpu
->env
;
795 ppc_hash_pte64_t pte
;
796 int exec_prot
, pp_prot
, amr_prot
, prot
;
797 const int need_prot
[] = {PAGE_READ
, PAGE_WRITE
, PAGE_EXEC
};
800 assert((rwx
== 0) || (rwx
== 1) || (rwx
== 2));
803 * Note on LPCR usage: 970 uses HID4, but our special variant of
804 * store_spr copies relevant fields into env->spr[SPR_LPCR].
805 * Similarily we filter unimplemented bits when storing into LPCR
806 * depending on the MMU version. This code can thus just use the
810 /* 1. Handle real mode accesses */
811 if (((rwx
== 2) && (msr_ir
== 0)) || ((rwx
!= 2) && (msr_dr
== 0))) {
813 * Translation is supposedly "off", but in real mode the top 4
814 * effective address bits are (mostly) ignored
816 raddr
= eaddr
& 0x0FFFFFFFFFFFFFFFULL
;
820 * In virtual hypervisor mode, there's nothing to do:
821 * EA == GPA == qemu guest address
823 } else if (msr_hv
|| !env
->has_hv_mode
) {
824 /* In HV mode, add HRMOR if top EA bit is clear */
825 if (!(eaddr
>> 63)) {
826 raddr
|= env
->spr
[SPR_HRMOR
];
828 } else if (ppc_hash64_use_vrma(env
)) {
829 /* Emulated VRMA mode */
830 slb
= &env
->vrma_slb
;
832 /* Invalid VRMA setup, machine check */
833 cs
->exception_index
= POWERPC_EXCP_MCHECK
;
838 goto skip_slb_search
;
840 target_ulong limit
= rmls_limit(cpu
);
842 /* Emulated old-style RMO mode, bounds check against RMLS */
843 if (raddr
>= limit
) {
845 ppc_hash64_set_isi(cs
, SRR1_PROTFAULT
);
847 int dsisr
= DSISR_PROTFAULT
;
849 dsisr
|= DSISR_ISSTORE
;
851 ppc_hash64_set_dsi(cs
, eaddr
, dsisr
);
856 raddr
|= env
->spr
[SPR_RMOR
];
858 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
, raddr
& TARGET_PAGE_MASK
,
859 PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
, mmu_idx
,
864 /* 2. Translation is on, so look up the SLB */
865 slb
= slb_lookup(cpu
, eaddr
);
867 /* No entry found, check if in-memory segment tables are in use */
868 if (ppc64_use_proc_tbl(cpu
)) {
869 /* TODO - Unsupported */
870 error_report("Segment Table Support Unimplemented");
873 /* Segment still not found, generate the appropriate interrupt */
875 cs
->exception_index
= POWERPC_EXCP_ISEG
;
878 cs
->exception_index
= POWERPC_EXCP_DSEG
;
880 env
->spr
[SPR_DAR
] = eaddr
;
887 /* 3. Check for segment level no-execute violation */
888 if ((rwx
== 2) && (slb
->vsid
& SLB_VSID_N
)) {
889 ppc_hash64_set_isi(cs
, SRR1_NOEXEC_GUARD
);
893 /* 4. Locate the PTE in the hash table */
894 ptex
= ppc_hash64_htab_lookup(cpu
, slb
, eaddr
, &pte
, &apshift
);
897 ppc_hash64_set_isi(cs
, SRR1_NOPTE
);
899 int dsisr
= DSISR_NOPTE
;
901 dsisr
|= DSISR_ISSTORE
;
903 ppc_hash64_set_dsi(cs
, eaddr
, dsisr
);
907 qemu_log_mask(CPU_LOG_MMU
,
908 "found PTE at index %08" HWADDR_PRIx
"\n", ptex
);
910 /* 5. Check access permissions */
912 exec_prot
= ppc_hash64_pte_noexec_guard(cpu
, pte
);
913 pp_prot
= ppc_hash64_pte_prot(cpu
, slb
, pte
);
914 amr_prot
= ppc_hash64_amr_prot(cpu
, pte
);
915 prot
= exec_prot
& pp_prot
& amr_prot
;
917 if ((need_prot
[rwx
] & ~prot
) != 0) {
918 /* Access right violation */
919 qemu_log_mask(CPU_LOG_MMU
, "PTE access rejected\n");
922 if (PAGE_EXEC
& ~exec_prot
) {
923 srr1
|= SRR1_NOEXEC_GUARD
; /* Access violates noexec or guard */
924 } else if (PAGE_EXEC
& ~pp_prot
) {
925 srr1
|= SRR1_PROTFAULT
; /* Access violates access authority */
927 if (PAGE_EXEC
& ~amr_prot
) {
928 srr1
|= SRR1_IAMR
; /* Access violates virt pg class key prot */
930 ppc_hash64_set_isi(cs
, srr1
);
933 if (need_prot
[rwx
] & ~pp_prot
) {
934 dsisr
|= DSISR_PROTFAULT
;
937 dsisr
|= DSISR_ISSTORE
;
939 if (need_prot
[rwx
] & ~amr_prot
) {
942 ppc_hash64_set_dsi(cs
, eaddr
, dsisr
);
947 qemu_log_mask(CPU_LOG_MMU
, "PTE access granted !\n");
949 /* 6. Update PTE referenced and changed bits if necessary */
951 if (!(pte
.pte1
& HPTE64_R_R
)) {
952 ppc_hash64_set_r(cpu
, ptex
, pte
.pte1
);
954 if (!(pte
.pte1
& HPTE64_R_C
)) {
956 ppc_hash64_set_c(cpu
, ptex
, pte
.pte1
);
959 * Treat the page as read-only for now, so that a later write
960 * will pass through this function again to set the C bit
966 /* 7. Determine the real address from the PTE */
968 raddr
= deposit64(pte
.pte1
& HPTE64_R_RPN
, 0, apshift
, eaddr
);
970 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
, raddr
& TARGET_PAGE_MASK
,
971 prot
, mmu_idx
, 1ULL << apshift
);
976 hwaddr
ppc_hash64_get_phys_page_debug(PowerPCCPU
*cpu
, target_ulong addr
)
978 CPUPPCState
*env
= &cpu
->env
;
981 ppc_hash_pte64_t pte
;
984 /* Handle real mode */
986 /* In real mode the top 4 effective address bits are ignored */
987 raddr
= addr
& 0x0FFFFFFFFFFFFFFFULL
;
991 * In virtual hypervisor mode, there's nothing to do:
992 * EA == GPA == qemu guest address
995 } else if ((msr_hv
|| !env
->has_hv_mode
) && !(addr
>> 63)) {
996 /* In HV mode, add HRMOR if top EA bit is clear */
997 return raddr
| env
->spr
[SPR_HRMOR
];
998 } else if (ppc_hash64_use_vrma(env
)) {
999 /* Emulated VRMA mode */
1000 slb
= &env
->vrma_slb
;
1005 target_ulong limit
= rmls_limit(cpu
);
1007 /* Emulated old-style RMO mode, bounds check against RMLS */
1008 if (raddr
>= limit
) {
1011 return raddr
| env
->spr
[SPR_RMOR
];
1014 slb
= slb_lookup(cpu
, addr
);
1020 ptex
= ppc_hash64_htab_lookup(cpu
, slb
, addr
, &pte
, &apshift
);
1025 return deposit64(pte
.pte1
& HPTE64_R_RPN
, 0, apshift
, addr
)
1029 void ppc_hash64_tlb_flush_hpte(PowerPCCPU
*cpu
, target_ulong ptex
,
1030 target_ulong pte0
, target_ulong pte1
)
1033 * XXX: given the fact that there are too many segments to
1034 * invalidate, and we still don't have a tlb_flush_mask(env, n,
1035 * mask) in QEMU, we just invalidate all TLBs
1037 cpu
->env
.tlb_need_flush
= TLB_NEED_GLOBAL_FLUSH
| TLB_NEED_LOCAL_FLUSH
;
1040 static void ppc_hash64_update_vrma(PowerPCCPU
*cpu
)
1042 CPUPPCState
*env
= &cpu
->env
;
1043 const PPCHash64SegmentPageSizes
*sps
= NULL
;
1044 target_ulong esid
, vsid
, lpcr
;
1045 ppc_slb_t
*slb
= &env
->vrma_slb
;
1049 /* First clear it */
1050 slb
->esid
= slb
->vsid
= 0;
1053 /* Is VRMA enabled ? */
1054 if (!ppc_hash64_use_vrma(env
)) {
1059 * Make one up. Mostly ignore the ESID which will not be needed
1062 lpcr
= env
->spr
[SPR_LPCR
];
1063 vsid
= SLB_VSID_VRMA
;
1064 vrmasd
= (lpcr
& LPCR_VRMASD
) >> LPCR_VRMASD_SHIFT
;
1065 vsid
|= (vrmasd
<< 4) & (SLB_VSID_L
| SLB_VSID_LP
);
1068 for (i
= 0; i
< PPC_PAGE_SIZES_MAX_SZ
; i
++) {
1069 const PPCHash64SegmentPageSizes
*sps1
= &cpu
->hash64_opts
->sps
[i
];
1071 if (!sps1
->page_shift
) {
1075 if ((vsid
& SLB_VSID_LLP_MASK
) == sps1
->slb_enc
) {
1082 error_report("Bad page size encoding esid 0x"TARGET_FMT_lx
1083 " vsid 0x"TARGET_FMT_lx
, esid
, vsid
);
1092 void ppc_store_lpcr(PowerPCCPU
*cpu
, target_ulong val
)
1094 PowerPCCPUClass
*pcc
= POWERPC_CPU_GET_CLASS(cpu
);
1095 CPUPPCState
*env
= &cpu
->env
;
1097 env
->spr
[SPR_LPCR
] = val
& pcc
->lpcr_mask
;
1098 ppc_hash64_update_vrma(cpu
);
1101 void helper_store_lpcr(CPUPPCState
*env
, target_ulong val
)
1103 PowerPCCPU
*cpu
= env_archcpu(env
);
1105 ppc_store_lpcr(cpu
, val
);
1108 void ppc_hash64_init(PowerPCCPU
*cpu
)
1110 CPUPPCState
*env
= &cpu
->env
;
1111 PowerPCCPUClass
*pcc
= POWERPC_CPU_GET_CLASS(cpu
);
1113 if (!pcc
->hash64_opts
) {
1114 assert(!(env
->mmu_model
& POWERPC_MMU_64
));
1118 cpu
->hash64_opts
= g_memdup(pcc
->hash64_opts
, sizeof(*cpu
->hash64_opts
));
1121 void ppc_hash64_finalize(PowerPCCPU
*cpu
)
1123 g_free(cpu
->hash64_opts
);
1126 const PPCHash64Options ppc_hash64_opts_basic
= {
1130 { .page_shift
= 12, /* 4K */
1132 .enc
= { { .page_shift
= 12, .pte_enc
= 0 } }
1134 { .page_shift
= 24, /* 16M */
1136 .enc
= { { .page_shift
= 24, .pte_enc
= 0 } }
1141 const PPCHash64Options ppc_hash64_opts_POWER7
= {
1142 .flags
= PPC_HASH64_1TSEG
| PPC_HASH64_AMR
| PPC_HASH64_CI_LARGEPAGE
,
1146 .page_shift
= 12, /* 4K */
1148 .enc
= { { .page_shift
= 12, .pte_enc
= 0 },
1149 { .page_shift
= 16, .pte_enc
= 0x7 },
1150 { .page_shift
= 24, .pte_enc
= 0x38 }, },
1153 .page_shift
= 16, /* 64K */
1154 .slb_enc
= SLB_VSID_64K
,
1155 .enc
= { { .page_shift
= 16, .pte_enc
= 0x1 },
1156 { .page_shift
= 24, .pte_enc
= 0x8 }, },
1159 .page_shift
= 24, /* 16M */
1160 .slb_enc
= SLB_VSID_16M
,
1161 .enc
= { { .page_shift
= 24, .pte_enc
= 0 }, },
1164 .page_shift
= 34, /* 16G */
1165 .slb_enc
= SLB_VSID_16G
,
1166 .enc
= { { .page_shift
= 34, .pte_enc
= 0x3 }, },
1171 void ppc_hash64_filter_pagesizes(PowerPCCPU
*cpu
,
1172 bool (*cb
)(void *, uint32_t, uint32_t),
1175 PPCHash64Options
*opts
= cpu
->hash64_opts
;
1178 bool ci_largepage
= false;
1183 for (i
= 0; i
< ARRAY_SIZE(opts
->sps
); i
++) {
1184 PPCHash64SegmentPageSizes
*sps
= &opts
->sps
[i
];
1190 if (!sps
->page_shift
) {
1194 for (j
= 0; j
< ARRAY_SIZE(sps
->enc
); j
++) {
1195 PPCHash64PageSize
*ps
= &sps
->enc
[j
];
1198 if (!ps
->page_shift
) {
1202 if (cb(opaque
, sps
->page_shift
, ps
->page_shift
)) {
1203 if (ps
->page_shift
>= 16) {
1204 ci_largepage
= true;
1206 sps
->enc
[m
++] = *ps
;
1210 /* Clear rest of the row */
1211 for (j
= m
; j
< ARRAY_SIZE(sps
->enc
); j
++) {
1212 memset(&sps
->enc
[j
], 0, sizeof(sps
->enc
[j
]));
1220 /* Clear the rest of the table */
1221 for (i
= n
; i
< ARRAY_SIZE(opts
->sps
); i
++) {
1222 memset(&opts
->sps
[i
], 0, sizeof(opts
->sps
[i
]));
1225 if (!ci_largepage
) {
1226 opts
->flags
&= ~PPC_HASH64_CI_LARGEPAGE
;