target-ppc/mmu-hash64.c

   1 /*
   2  *  PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
   3  *
   4  *  Copyright (c) 2003-2007 Jocelyn Mayer
   5  *  Copyright (c) 2013 David Gibson, IBM Corporation
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20 #include "qemu/osdep.h"
  21 #include "qapi/error.h"
  22 #include "cpu.h"
  23 #include "exec/exec-all.h"
  24 #include "exec/helper-proto.h"
  25 #include "qemu/error-report.h"
  26 #include "sysemu/kvm.h"
  27 #include "qemu/error-report.h"
  28 #include "kvm_ppc.h"
  29 #include "mmu-hash64.h"
  30 #include "exec/log.h"
  31
  32 //#define DEBUG_SLB
  33
  34 #ifdef DEBUG_SLB
  35 #  define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
  36 #else
  37 #  define LOG_SLB(...) do { } while (0)
  38 #endif
  39
  40 /*
  41  * Used to indicate that a CPU has its hash page table (HPT) managed
  42  * within the host kernel
  43  */
  44 #define MMU_HASH64_KVM_MANAGED_HPT      ((void *)-1)
  45
  46 /*
  47  * SLB handling
  48  */
  49
  50 static ppc_slb_t *slb_lookup(PowerPCCPU *cpu, target_ulong eaddr)
  51 {
  52     CPUPPCState *env = &cpu->env;
  53     uint64_t esid_256M, esid_1T;
  54     int n;
  55
  56     LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);
  57
  58     esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V;
  59     esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V;
  60
  61     for (n = 0; n < env->slb_nr; n++) {
  62         ppc_slb_t *slb = &env->slb[n];
  63
  64         LOG_SLB("%s: slot %d %016" PRIx64 " %016"
  65                     PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
  66         /* We check for 1T matches on all MMUs here - if the MMU
  67          * doesn't have 1T segment support, we will have prevented 1T
  68          * entries from being inserted in the slbmte code. */
  69         if (((slb->esid == esid_256M) &&
  70              ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
  71             || ((slb->esid == esid_1T) &&
  72                 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
  73             return slb;
  74         }
  75     }
  76
  77     return NULL;
  78 }
  79
  80 void dump_slb(FILE *f, fprintf_function cpu_fprintf, PowerPCCPU *cpu)
  81 {
  82     CPUPPCState *env = &cpu->env;
  83     int i;
  84     uint64_t slbe, slbv;
  85
  86     cpu_synchronize_state(CPU(cpu));
  87
  88     cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
  89     for (i = 0; i < env->slb_nr; i++) {
  90         slbe = env->slb[i].esid;
  91         slbv = env->slb[i].vsid;
  92         if (slbe == 0 && slbv == 0) {
  93             continue;
  94         }
  95         cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
  96                     i, slbe, slbv);
  97     }
  98 }
  99
 100 void helper_slbia(CPUPPCState *env)
 101 {
 102     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 103     int n, do_invalidate;
 104
 105     do_invalidate = 0;
 106     /* XXX: Warning: slbia never invalidates the first segment */
 107     for (n = 1; n < env->slb_nr; n++) {
 108         ppc_slb_t *slb = &env->slb[n];
 109
 110         if (slb->esid & SLB_ESID_V) {
 111             slb->esid &= ~SLB_ESID_V;
 112             /* XXX: given the fact that segment size is 256 MB or 1TB,
 113              *      and we still don't have a tlb_flush_mask(env, n, mask)
 114              *      in QEMU, we just invalidate all TLBs
 115              */
 116             do_invalidate = 1;
 117         }
 118     }
 119     if (do_invalidate) {
 120         tlb_flush(CPU(cpu), 1);
 121     }
 122 }
 123
 124 void helper_slbie(CPUPPCState *env, target_ulong addr)
 125 {
 126     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 127     ppc_slb_t *slb;
 128
 129     slb = slb_lookup(cpu, addr);
 130     if (!slb) {
 131         return;
 132     }
 133
 134     if (slb->esid & SLB_ESID_V) {
 135         slb->esid &= ~SLB_ESID_V;
 136
 137         /* XXX: given the fact that segment size is 256 MB or 1TB,
 138          *      and we still don't have a tlb_flush_mask(env, n, mask)
 139          *      in QEMU, we just invalidate all TLBs
 140          */
 141         tlb_flush(CPU(cpu), 1);
 142     }
 143 }
 144
 145 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot,
 146                   target_ulong esid, target_ulong vsid)
 147 {
 148     CPUPPCState *env = &cpu->env;
 149     ppc_slb_t *slb = &env->slb[slot];
 150     const struct ppc_one_seg_page_size *sps = NULL;
 151     int i;
 152
 153     if (slot >= env->slb_nr) {
 154         return -1; /* Bad slot number */
 155     }
 156     if (esid & ~(SLB_ESID_ESID | SLB_ESID_V)) {
 157         return -1; /* Reserved bits set */
 158     }
 159     if (vsid & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
 160         return -1; /* Bad segment size */
 161     }
 162     if ((vsid & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
 163         return -1; /* 1T segment on MMU that doesn't support it */
 164     }
 165
 166     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 167         const struct ppc_one_seg_page_size *sps1 = &env->sps.sps[i];
 168
 169         if (!sps1->page_shift) {
 170             break;
 171         }
 172
 173         if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) {
 174             sps = sps1;
 175             break;
 176         }
 177     }
 178
 179     if (!sps) {
 180         error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu
 181                      " esid 0x"TARGET_FMT_lx" vsid 0x"TARGET_FMT_lx,
 182                      slot, esid, vsid);
 183         return -1;
 184     }
 185
 186     slb->esid = esid;
 187     slb->vsid = vsid;
 188     slb->sps = sps;
 189
 190     LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
 191             " %016" PRIx64 "\n", __func__, slot, esid, vsid,
 192             slb->esid, slb->vsid);
 193
 194     return 0;
 195 }
 196
 197 static int ppc_load_slb_esid(PowerPCCPU *cpu, target_ulong rb,
 198                              target_ulong *rt)
 199 {
 200     CPUPPCState *env = &cpu->env;
 201     int slot = rb & 0xfff;
 202     ppc_slb_t *slb = &env->slb[slot];
 203
 204     if (slot >= env->slb_nr) {
 205         return -1;
 206     }
 207
 208     *rt = slb->esid;
 209     return 0;
 210 }
 211
 212 static int ppc_load_slb_vsid(PowerPCCPU *cpu, target_ulong rb,
 213                              target_ulong *rt)
 214 {
 215     CPUPPCState *env = &cpu->env;
 216     int slot = rb & 0xfff;
 217     ppc_slb_t *slb = &env->slb[slot];
 218
 219     if (slot >= env->slb_nr) {
 220         return -1;
 221     }
 222
 223     *rt = slb->vsid;
 224     return 0;
 225 }
 226
 227 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
 228 {
 229     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 230
 231     if (ppc_store_slb(cpu, rb & 0xfff, rb & ~0xfffULL, rs) < 0) {
 232         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 233                                    POWERPC_EXCP_INVAL);
 234     }
 235 }
 236
 237 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
 238 {
 239     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 240     target_ulong rt = 0;
 241
 242     if (ppc_load_slb_esid(cpu, rb, &rt) < 0) {
 243         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 244                                    POWERPC_EXCP_INVAL);
 245     }
 246     return rt;
 247 }
 248
 249 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
 250 {
 251     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 252     target_ulong rt = 0;
 253
 254     if (ppc_load_slb_vsid(cpu, rb, &rt) < 0) {
 255         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 256                                    POWERPC_EXCP_INVAL);
 257     }
 258     return rt;
 259 }
 260
 261 /*
 262  * 64-bit hash table MMU handling
 263  */
 264 void ppc_hash64_set_sdr1(PowerPCCPU *cpu, target_ulong value,
 265                          Error **errp)
 266 {
 267     CPUPPCState *env = &cpu->env;
 268     target_ulong htabsize = value & SDR_64_HTABSIZE;
 269
 270     env->spr[SPR_SDR1] = value;
 271     if (htabsize > 28) {
 272         error_setg(errp,
 273                    "Invalid HTABSIZE 0x" TARGET_FMT_lx" stored in SDR1",
 274                    htabsize);
 275         htabsize = 28;
 276     }
 277     env->htab_mask = (1ULL << (htabsize + 18 - 7)) - 1;
 278     env->htab_base = value & SDR_64_HTABORG;
 279 }
 280
 281 void ppc_hash64_set_external_hpt(PowerPCCPU *cpu, void *hpt, int shift,
 282                                  Error **errp)
 283 {
 284     CPUPPCState *env = &cpu->env;
 285     Error *local_err = NULL;
 286
 287     cpu_synchronize_state(CPU(cpu));
 288
 289     if (hpt) {
 290         env->external_htab = hpt;
 291     } else {
 292         env->external_htab = MMU_HASH64_KVM_MANAGED_HPT;
 293     }
 294     ppc_hash64_set_sdr1(cpu, (target_ulong)(uintptr_t)hpt | (shift - 18),
 295                         &local_err);
 296     if (local_err) {
 297         error_propagate(errp, local_err);
 298         return;
 299     }
 300
 301     /* Not strictly necessary, but makes it clearer that an external
 302      * htab is in use when debugging */
 303     env->htab_base = -1;
 304
 305     if (kvm_enabled()) {
 306         if (kvmppc_put_books_sregs(cpu) < 0) {
 307             error_setg(errp, "Unable to update SDR1 in KVM");
 308         }
 309     }
 310 }
 311
 312 static int ppc_hash64_pte_prot(PowerPCCPU *cpu,
 313                                ppc_slb_t *slb, ppc_hash_pte64_t pte)
 314 {
 315     CPUPPCState *env = &cpu->env;
 316     unsigned pp, key;
 317     /* Some pp bit combinations have undefined behaviour, so default
 318      * to no access in those cases */
 319     int prot = 0;
 320
 321     key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP)
 322              : (slb->vsid & SLB_VSID_KS));
 323     pp = (pte.pte1 & HPTE64_R_PP) | ((pte.pte1 & HPTE64_R_PP0) >> 61);
 324
 325     if (key == 0) {
 326         switch (pp) {
 327         case 0x0:
 328         case 0x1:
 329         case 0x2:
 330             prot = PAGE_READ | PAGE_WRITE;
 331             break;
 332
 333         case 0x3:
 334         case 0x6:
 335             prot = PAGE_READ;
 336             break;
 337         }
 338     } else {
 339         switch (pp) {
 340         case 0x0:
 341         case 0x6:
 342             prot = 0;
 343             break;
 344
 345         case 0x1:
 346         case 0x3:
 347             prot = PAGE_READ;
 348             break;
 349
 350         case 0x2:
 351             prot = PAGE_READ | PAGE_WRITE;
 352             break;
 353         }
 354     }
 355
 356     /* No execute if either noexec or guarded bits set */
 357     if (!(pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G)
 358         || (slb->vsid & SLB_VSID_N)) {
 359         prot |= PAGE_EXEC;
 360     }
 361
 362     return prot;
 363 }
 364
 365 static int ppc_hash64_amr_prot(PowerPCCPU *cpu, ppc_hash_pte64_t pte)
 366 {
 367     CPUPPCState *env = &cpu->env;
 368     int key, amrbits;
 369     int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 370
 371     /* Only recent MMUs implement Virtual Page Class Key Protection */
 372     if (!(env->mmu_model & POWERPC_MMU_AMR)) {
 373         return prot;
 374     }
 375
 376     key = HPTE64_R_KEY(pte.pte1);
 377     amrbits = (env->spr[SPR_AMR] >> 2*(31 - key)) & 0x3;
 378
 379     /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */
 380     /*         env->spr[SPR_AMR]); */
 381
 382     /*
 383      * A store is permitted if the AMR bit is 0. Remove write
 384      * protection if it is set.
 385      */
 386     if (amrbits & 0x2) {
 387         prot &= ~PAGE_WRITE;
 388     }
 389     /*
 390      * A load is permitted if the AMR bit is 0. Remove read
 391      * protection if it is set.
 392      */
 393     if (amrbits & 0x1) {
 394         prot &= ~PAGE_READ;
 395     }
 396
 397     return prot;
 398 }
 399
 400 uint64_t ppc_hash64_start_access(PowerPCCPU *cpu, target_ulong pte_index)
 401 {
 402     uint64_t token = 0;
 403     hwaddr pte_offset;
 404
 405     pte_offset = pte_index * HASH_PTE_SIZE_64;
 406     if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) {
 407         /*
 408          * HTAB is controlled by KVM. Fetch the PTEG into a new buffer.
 409          */
 410         token = kvmppc_hash64_read_pteg(cpu, pte_index);
 411     } else if (cpu->env.external_htab) {
 412         /*
 413          * HTAB is controlled by QEMU. Just point to the internally
 414          * accessible PTEG.
 415          */
 416         token = (uint64_t)(uintptr_t) cpu->env.external_htab + pte_offset;
 417     } else if (cpu->env.htab_base) {
 418         token = cpu->env.htab_base + pte_offset;
 419     }
 420     return token;
 421 }
 422
 423 void ppc_hash64_stop_access(PowerPCCPU *cpu, uint64_t token)
 424 {
 425     if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) {
 426         kvmppc_hash64_free_pteg(token);
 427     }
 428 }
 429
 430 static hwaddr ppc_hash64_pteg_search(PowerPCCPU *cpu, hwaddr hash,
 431                                      bool secondary, target_ulong ptem,
 432                                      ppc_hash_pte64_t *pte)
 433 {
 434     CPUPPCState *env = &cpu->env;
 435     int i;
 436     uint64_t token;
 437     target_ulong pte0, pte1;
 438     target_ulong pte_index;
 439
 440     pte_index = (hash & env->htab_mask) * HPTES_PER_GROUP;
 441     token = ppc_hash64_start_access(cpu, pte_index);
 442     if (!token) {
 443         return -1;
 444     }
 445     for (i = 0; i < HPTES_PER_GROUP; i++) {
 446         pte0 = ppc_hash64_load_hpte0(cpu, token, i);
 447         pte1 = ppc_hash64_load_hpte1(cpu, token, i);
 448
 449         if ((pte0 & HPTE64_V_VALID)
 450             && (secondary == !!(pte0 & HPTE64_V_SECONDARY))
 451             && HPTE64_V_COMPARE(pte0, ptem)) {
 452             pte->pte0 = pte0;
 453             pte->pte1 = pte1;
 454             ppc_hash64_stop_access(cpu, token);
 455             return (pte_index + i) * HASH_PTE_SIZE_64;
 456         }
 457     }
 458     ppc_hash64_stop_access(cpu, token);
 459     /*
 460      * We didn't find a valid entry.
 461      */
 462     return -1;
 463 }
 464
 465 static hwaddr ppc_hash64_htab_lookup(PowerPCCPU *cpu,
 466                                      ppc_slb_t *slb, target_ulong eaddr,
 467                                      ppc_hash_pte64_t *pte)
 468 {
 469     CPUPPCState *env = &cpu->env;
 470     hwaddr pte_offset;
 471     hwaddr hash;
 472     uint64_t vsid, epnmask, epn, ptem;
 473
 474     /* The SLB store path should prevent any bad page size encodings
 475      * getting in there, so: */
 476     assert(slb->sps);
 477
 478     epnmask = ~((1ULL << slb->sps->page_shift) - 1);
 479
 480     if (slb->vsid & SLB_VSID_B) {
 481         /* 1TB segment */
 482         vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
 483         epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask;
 484         hash = vsid ^ (vsid << 25) ^ (epn >> slb->sps->page_shift);
 485     } else {
 486         /* 256M segment */
 487         vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
 488         epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask;
 489         hash = vsid ^ (epn >> slb->sps->page_shift);
 490     }
 491     ptem = (slb->vsid & SLB_VSID_PTEM) | ((epn >> 16) & HPTE64_V_AVPN);
 492
 493     /* Page address translation */
 494     qemu_log_mask(CPU_LOG_MMU,
 495             "htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
 496             " hash " TARGET_FMT_plx "\n",
 497             env->htab_base, env->htab_mask, hash);
 498
 499     /* Primary PTEG lookup */
 500     qemu_log_mask(CPU_LOG_MMU,
 501             "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 502             " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
 503             " hash=" TARGET_FMT_plx "\n",
 504             env->htab_base, env->htab_mask, vsid, ptem,  hash);
 505     pte_offset = ppc_hash64_pteg_search(cpu, hash, 0, ptem, pte);
 506
 507     if (pte_offset == -1) {
 508         /* Secondary PTEG lookup */
 509         qemu_log_mask(CPU_LOG_MMU,
 510                 "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 511                 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
 512                 " hash=" TARGET_FMT_plx "\n", env->htab_base,
 513                 env->htab_mask, vsid, ptem, ~hash);
 514
 515         pte_offset = ppc_hash64_pteg_search(cpu, ~hash, 1, ptem, pte);
 516     }
 517
 518     return pte_offset;
 519 }
 520
 521 static unsigned hpte_page_shift(const struct ppc_one_seg_page_size *sps,
 522     uint64_t pte0, uint64_t pte1)
 523 {
 524     int i;
 525
 526     if (!(pte0 & HPTE64_V_LARGE)) {
 527         if (sps->page_shift != 12) {
 528             /* 4kiB page in a non 4kiB segment */
 529             return 0;
 530         }
 531         /* Normal 4kiB page */
 532         return 12;
 533     }
 534
 535     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 536         const struct ppc_one_page_size *ps = &sps->enc[i];
 537         uint64_t mask;
 538
 539         if (!ps->page_shift) {
 540             break;
 541         }
 542
 543         if (ps->page_shift == 12) {
 544             /* L bit is set so this can't be a 4kiB page */
 545             continue;
 546         }
 547
 548         mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN;
 549
 550         if ((pte1 & mask) == (ps->pte_enc << HPTE64_R_RPN_SHIFT)) {
 551             return ps->page_shift;
 552         }
 553     }
 554
 555     return 0; /* Bad page size encoding */
 556 }
 557
 558 unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU *cpu,
 559                                           uint64_t pte0, uint64_t pte1,
 560                                           unsigned *seg_page_shift)
 561 {
 562     CPUPPCState *env = &cpu->env;
 563     int i;
 564
 565     if (!(pte0 & HPTE64_V_LARGE)) {
 566         *seg_page_shift = 12;
 567         return 12;
 568     }
 569
 570     /*
 571      * The encodings in env->sps need to be carefully chosen so that
 572      * this gives an unambiguous result.
 573      */
 574     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 575         const struct ppc_one_seg_page_size *sps = &env->sps.sps[i];
 576         unsigned shift;
 577
 578         if (!sps->page_shift) {
 579             break;
 580         }
 581
 582         shift = hpte_page_shift(sps, pte0, pte1);
 583         if (shift) {
 584             *seg_page_shift = sps->page_shift;
 585             return shift;
 586         }
 587     }
 588
 589     *seg_page_shift = 0;
 590     return 0;
 591 }
 592
 593 int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr,
 594                                 int rwx, int mmu_idx)
 595 {
 596     CPUState *cs = CPU(cpu);
 597     CPUPPCState *env = &cpu->env;
 598     ppc_slb_t *slb;
 599     unsigned apshift;
 600     hwaddr pte_offset;
 601     ppc_hash_pte64_t pte;
 602     int pp_prot, amr_prot, prot;
 603     uint64_t new_pte1;
 604     const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
 605     hwaddr raddr;
 606
 607     assert((rwx == 0) || (rwx == 1) || (rwx == 2));
 608
 609     /* 1. Handle real mode accesses */
 610     if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
 611         /* Translation is off */
 612         /* In real mode the top 4 effective address bits are ignored */
 613         raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
 614         tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 615                      PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
 616                      TARGET_PAGE_SIZE);
 617         return 0;
 618     }
 619
 620     /* 2. Translation is on, so look up the SLB */
 621     slb = slb_lookup(cpu, eaddr);
 622
 623     if (!slb) {
 624         if (rwx == 2) {
 625             cs->exception_index = POWERPC_EXCP_ISEG;
 626             env->error_code = 0;
 627         } else {
 628             cs->exception_index = POWERPC_EXCP_DSEG;
 629             env->error_code = 0;
 630             env->spr[SPR_DAR] = eaddr;
 631         }
 632         return 1;
 633     }
 634
 635     /* 3. Check for segment level no-execute violation */
 636     if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) {
 637         cs->exception_index = POWERPC_EXCP_ISI;
 638         env->error_code = 0x10000000;
 639         return 1;
 640     }
 641
 642     /* 4. Locate the PTE in the hash table */
 643     pte_offset = ppc_hash64_htab_lookup(cpu, slb, eaddr, &pte);
 644     if (pte_offset == -1) {
 645         if (rwx == 2) {
 646             cs->exception_index = POWERPC_EXCP_ISI;
 647             env->error_code = 0x40000000;
 648         } else {
 649             cs->exception_index = POWERPC_EXCP_DSI;
 650             env->error_code = 0;
 651             env->spr[SPR_DAR] = eaddr;
 652             if (rwx == 1) {
 653                 env->spr[SPR_DSISR] = 0x42000000;
 654             } else {
 655                 env->spr[SPR_DSISR] = 0x40000000;
 656             }
 657         }
 658         return 1;
 659     }
 660     qemu_log_mask(CPU_LOG_MMU,
 661                 "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
 662
 663     /* Validate page size encoding */
 664     apshift = hpte_page_shift(slb->sps, pte.pte0, pte.pte1);
 665     if (!apshift) {
 666         error_report("Bad page size encoding in HPTE 0x%"PRIx64" - 0x%"PRIx64
 667                      " @ 0x%"HWADDR_PRIx, pte.pte0, pte.pte1, pte_offset);
 668         /* Not entirely sure what the right action here, but machine
 669          * check seems reasonable */
 670         cs->exception_index = POWERPC_EXCP_MCHECK;
 671         env->error_code = 0;
 672         return 1;
 673     }
 674
 675     /* 5. Check access permissions */
 676
 677     pp_prot = ppc_hash64_pte_prot(cpu, slb, pte);
 678     amr_prot = ppc_hash64_amr_prot(cpu, pte);
 679     prot = pp_prot & amr_prot;
 680
 681     if ((need_prot[rwx] & ~prot) != 0) {
 682         /* Access right violation */
 683         qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
 684         if (rwx == 2) {
 685             cs->exception_index = POWERPC_EXCP_ISI;
 686             env->error_code = 0x08000000;
 687         } else {
 688             target_ulong dsisr = 0;
 689
 690             cs->exception_index = POWERPC_EXCP_DSI;
 691             env->error_code = 0;
 692             env->spr[SPR_DAR] = eaddr;
 693             if (need_prot[rwx] & ~pp_prot) {
 694                 dsisr |= 0x08000000;
 695             }
 696             if (rwx == 1) {
 697                 dsisr |= 0x02000000;
 698             }
 699             if (need_prot[rwx] & ~amr_prot) {
 700                 dsisr |= 0x00200000;
 701             }
 702             env->spr[SPR_DSISR] = dsisr;
 703         }
 704         return 1;
 705     }
 706
 707     qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
 708
 709     /* 6. Update PTE referenced and changed bits if necessary */
 710
 711     new_pte1 = pte.pte1 | HPTE64_R_R; /* set referenced bit */
 712     if (rwx == 1) {
 713         new_pte1 |= HPTE64_R_C; /* set changed (dirty) bit */
 714     } else {
 715         /* Treat the page as read-only for now, so that a later write
 716          * will pass through this function again to set the C bit */
 717         prot &= ~PAGE_WRITE;
 718     }
 719
 720     if (new_pte1 != pte.pte1) {
 721         ppc_hash64_store_hpte(cpu, pte_offset / HASH_PTE_SIZE_64,
 722                               pte.pte0, new_pte1);
 723     }
 724
 725     /* 7. Determine the real address from the PTE */
 726
 727     raddr = deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, eaddr);
 728
 729     tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 730                  prot, mmu_idx, 1ULL << apshift);
 731
 732     return 0;
 733 }
 734
 735 hwaddr ppc_hash64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr)
 736 {
 737     CPUPPCState *env = &cpu->env;
 738     ppc_slb_t *slb;
 739     hwaddr pte_offset;
 740     ppc_hash_pte64_t pte;
 741     unsigned apshift;
 742
 743     if (msr_dr == 0) {
 744         /* In real mode the top 4 effective address bits are ignored */
 745         return addr & 0x0FFFFFFFFFFFFFFFULL;
 746     }
 747
 748     slb = slb_lookup(cpu, addr);
 749     if (!slb) {
 750         return -1;
 751     }
 752
 753     pte_offset = ppc_hash64_htab_lookup(cpu, slb, addr, &pte);
 754     if (pte_offset == -1) {
 755         return -1;
 756     }
 757
 758     apshift = hpte_page_shift(slb->sps, pte.pte0, pte.pte1);
 759     if (!apshift) {
 760         return -1;
 761     }
 762
 763     return deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, addr)
 764         & TARGET_PAGE_MASK;
 765 }
 766
 767 void ppc_hash64_store_hpte(PowerPCCPU *cpu,
 768                            target_ulong pte_index,
 769                            target_ulong pte0, target_ulong pte1)
 770 {
 771     CPUPPCState *env = &cpu->env;
 772
 773     if (env->external_htab == MMU_HASH64_KVM_MANAGED_HPT) {
 774         kvmppc_hash64_write_pte(env, pte_index, pte0, pte1);
 775         return;
 776     }
 777
 778     pte_index *= HASH_PTE_SIZE_64;
 779     if (env->external_htab) {
 780         stq_p(env->external_htab + pte_index, pte0);
 781         stq_p(env->external_htab + pte_index + HASH_PTE_SIZE_64 / 2, pte1);
 782     } else {
 783         stq_phys(CPU(cpu)->as, env->htab_base + pte_index, pte0);
 784         stq_phys(CPU(cpu)->as,
 785                  env->htab_base + pte_index + HASH_PTE_SIZE_64 / 2, pte1);
 786     }
 787 }
 788
 789 void ppc_hash64_tlb_flush_hpte(PowerPCCPU *cpu,
 790                                target_ulong pte_index,
 791                                target_ulong pte0, target_ulong pte1)
 792 {
 793     /*
 794      * XXX: given the fact that there are too many segments to
 795      * invalidate, and we still don't have a tlb_flush_mask(env, n,
 796      * mask) in QEMU, we just invalidate all TLBs
 797      */
 798     tlb_flush(CPU(cpu), 1);
 799 }