2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 * Copyright (c) 2013 David Gibson, IBM Corporation
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
22 #include "exec/helper-proto.h"
23 #include "sysemu/kvm.h"
25 #include "mmu-hash64.h"
30 # define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
32 # define LOG_SLB(...) do { } while (0)
36 * Used to indicate whether we have allocated htab in the
39 bool kvmppc_kern_htab
;
44 static ppc_slb_t
*slb_lookup(CPUPPCState
*env
, target_ulong eaddr
)
46 uint64_t esid_256M
, esid_1T
;
49 LOG_SLB("%s: eaddr " TARGET_FMT_lx
"\n", __func__
, eaddr
);
51 esid_256M
= (eaddr
& SEGMENT_MASK_256M
) | SLB_ESID_V
;
52 esid_1T
= (eaddr
& SEGMENT_MASK_1T
) | SLB_ESID_V
;
54 for (n
= 0; n
< env
->slb_nr
; n
++) {
55 ppc_slb_t
*slb
= &env
->slb
[n
];
57 LOG_SLB("%s: slot %d %016" PRIx64
" %016"
58 PRIx64
"\n", __func__
, n
, slb
->esid
, slb
->vsid
);
59 /* We check for 1T matches on all MMUs here - if the MMU
60 * doesn't have 1T segment support, we will have prevented 1T
61 * entries from being inserted in the slbmte code. */
62 if (((slb
->esid
== esid_256M
) &&
63 ((slb
->vsid
& SLB_VSID_B
) == SLB_VSID_B_256M
))
64 || ((slb
->esid
== esid_1T
) &&
65 ((slb
->vsid
& SLB_VSID_B
) == SLB_VSID_B_1T
))) {
73 void dump_slb(FILE *f
, fprintf_function cpu_fprintf
, CPUPPCState
*env
)
78 cpu_synchronize_state(CPU(ppc_env_get_cpu(env
)));
80 cpu_fprintf(f
, "SLB\tESID\t\t\tVSID\n");
81 for (i
= 0; i
< env
->slb_nr
; i
++) {
82 slbe
= env
->slb
[i
].esid
;
83 slbv
= env
->slb
[i
].vsid
;
84 if (slbe
== 0 && slbv
== 0) {
87 cpu_fprintf(f
, "%d\t0x%016" PRIx64
"\t0x%016" PRIx64
"\n",
92 void helper_slbia(CPUPPCState
*env
)
94 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
98 /* XXX: Warning: slbia never invalidates the first segment */
99 for (n
= 1; n
< env
->slb_nr
; n
++) {
100 ppc_slb_t
*slb
= &env
->slb
[n
];
102 if (slb
->esid
& SLB_ESID_V
) {
103 slb
->esid
&= ~SLB_ESID_V
;
104 /* XXX: given the fact that segment size is 256 MB or 1TB,
105 * and we still don't have a tlb_flush_mask(env, n, mask)
106 * in QEMU, we just invalidate all TLBs
112 tlb_flush(CPU(cpu
), 1);
116 void helper_slbie(CPUPPCState
*env
, target_ulong addr
)
118 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
121 slb
= slb_lookup(env
, addr
);
126 if (slb
->esid
& SLB_ESID_V
) {
127 slb
->esid
&= ~SLB_ESID_V
;
129 /* XXX: given the fact that segment size is 256 MB or 1TB,
130 * and we still don't have a tlb_flush_mask(env, n, mask)
131 * in QEMU, we just invalidate all TLBs
133 tlb_flush(CPU(cpu
), 1);
137 int ppc_store_slb(CPUPPCState
*env
, target_ulong rb
, target_ulong rs
)
139 int slot
= rb
& 0xfff;
140 ppc_slb_t
*slb
= &env
->slb
[slot
];
142 if (rb
& (0x1000 - env
->slb_nr
)) {
143 return -1; /* Reserved bits set or slot too high */
145 if (rs
& (SLB_VSID_B
& ~SLB_VSID_B_1T
)) {
146 return -1; /* Bad segment size */
148 if ((rs
& SLB_VSID_B
) && !(env
->mmu_model
& POWERPC_MMU_1TSEG
)) {
149 return -1; /* 1T segment on MMU that doesn't support it */
152 /* Mask out the slot number as we store the entry */
153 slb
->esid
= rb
& (SLB_ESID_ESID
| SLB_ESID_V
);
156 LOG_SLB("%s: %d " TARGET_FMT_lx
" - " TARGET_FMT_lx
" => %016" PRIx64
157 " %016" PRIx64
"\n", __func__
, slot
, rb
, rs
,
158 slb
->esid
, slb
->vsid
);
163 static int ppc_load_slb_esid(CPUPPCState
*env
, target_ulong rb
,
166 int slot
= rb
& 0xfff;
167 ppc_slb_t
*slb
= &env
->slb
[slot
];
169 if (slot
>= env
->slb_nr
) {
177 static int ppc_load_slb_vsid(CPUPPCState
*env
, target_ulong rb
,
180 int slot
= rb
& 0xfff;
181 ppc_slb_t
*slb
= &env
->slb
[slot
];
183 if (slot
>= env
->slb_nr
) {
191 void helper_store_slb(CPUPPCState
*env
, target_ulong rb
, target_ulong rs
)
193 if (ppc_store_slb(env
, rb
, rs
) < 0) {
194 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
199 target_ulong
helper_load_slb_esid(CPUPPCState
*env
, target_ulong rb
)
203 if (ppc_load_slb_esid(env
, rb
, &rt
) < 0) {
204 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
210 target_ulong
helper_load_slb_vsid(CPUPPCState
*env
, target_ulong rb
)
214 if (ppc_load_slb_vsid(env
, rb
, &rt
) < 0) {
215 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
222 * 64-bit hash table MMU handling
225 static int ppc_hash64_pte_prot(CPUPPCState
*env
,
226 ppc_slb_t
*slb
, ppc_hash_pte64_t pte
)
229 /* Some pp bit combinations have undefined behaviour, so default
230 * to no access in those cases */
233 key
= !!(msr_pr
? (slb
->vsid
& SLB_VSID_KP
)
234 : (slb
->vsid
& SLB_VSID_KS
));
235 pp
= (pte
.pte1
& HPTE64_R_PP
) | ((pte
.pte1
& HPTE64_R_PP0
) >> 61);
242 prot
= PAGE_READ
| PAGE_WRITE
;
263 prot
= PAGE_READ
| PAGE_WRITE
;
268 /* No execute if either noexec or guarded bits set */
269 if (!(pte
.pte1
& HPTE64_R_N
) || (pte
.pte1
& HPTE64_R_G
)
270 || (slb
->vsid
& SLB_VSID_N
)) {
277 static int ppc_hash64_amr_prot(CPUPPCState
*env
, ppc_hash_pte64_t pte
)
280 int prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
283 /* Only recent MMUs implement Virtual Page Class Key Protection */
284 if (!(env
->mmu_model
& POWERPC_MMU_AMR
)) {
288 key
= HPTE64_R_KEY(pte
.pte1
);
289 amrbits
= (env
->spr
[SPR_AMR
] >> 2*(31 - key
)) & 0x3;
291 /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */
292 /* env->spr[SPR_AMR]); */
295 * A store is permitted if the AMR bit is 0. Remove write
296 * protection if it is set.
302 * A load is permitted if the AMR bit is 0. Remove read
303 * protection if it is set.
312 uint64_t ppc_hash64_start_access(PowerPCCPU
*cpu
, target_ulong pte_index
)
317 pte_offset
= pte_index
* HASH_PTE_SIZE_64
;
318 if (kvmppc_kern_htab
) {
320 * HTAB is controlled by KVM. Fetch the PTEG into a new buffer.
322 token
= kvmppc_hash64_read_pteg(cpu
, pte_index
);
327 * pteg read failed, even though we have allocated htab via
333 * HTAB is controlled by QEMU. Just point to the internally
336 if (cpu
->env
.external_htab
) {
337 token
= (uint64_t)(uintptr_t) cpu
->env
.external_htab
+ pte_offset
;
338 } else if (cpu
->env
.htab_base
) {
339 token
= cpu
->env
.htab_base
+ pte_offset
;
344 void ppc_hash64_stop_access(uint64_t token
)
346 if (kvmppc_kern_htab
) {
347 kvmppc_hash64_free_pteg(token
);
351 static hwaddr
ppc_hash64_pteg_search(CPUPPCState
*env
, hwaddr hash
,
352 bool secondary
, target_ulong ptem
,
353 ppc_hash_pte64_t
*pte
)
357 target_ulong pte0
, pte1
;
358 target_ulong pte_index
;
360 pte_index
= (hash
& env
->htab_mask
) * HPTES_PER_GROUP
;
361 token
= ppc_hash64_start_access(ppc_env_get_cpu(env
), pte_index
);
365 for (i
= 0; i
< HPTES_PER_GROUP
; i
++) {
366 pte0
= ppc_hash64_load_hpte0(env
, token
, i
);
367 pte1
= ppc_hash64_load_hpte1(env
, token
, i
);
369 if ((pte0
& HPTE64_V_VALID
)
370 && (secondary
== !!(pte0
& HPTE64_V_SECONDARY
))
371 && HPTE64_V_COMPARE(pte0
, ptem
)) {
374 ppc_hash64_stop_access(token
);
375 return (pte_index
+ i
) * HASH_PTE_SIZE_64
;
378 ppc_hash64_stop_access(token
);
380 * We didn't find a valid entry.
385 static uint64_t ppc_hash64_page_shift(ppc_slb_t
*slb
)
389 /* Page size according to the SLB, which we use to generate the
390 * EPN for hash table lookup.. When we implement more recent MMU
391 * extensions this might be different from the actual page size
392 * encoded in the PTE */
393 if ((slb
->vsid
& SLB_VSID_LLP_MASK
) == SLB_VSID_4K
) {
394 epnshift
= TARGET_PAGE_BITS
;
395 } else if ((slb
->vsid
& SLB_VSID_LLP_MASK
) == SLB_VSID_64K
) {
396 epnshift
= TARGET_PAGE_BITS_64K
;
398 epnshift
= TARGET_PAGE_BITS_16M
;
403 static hwaddr
ppc_hash64_htab_lookup(CPUPPCState
*env
,
404 ppc_slb_t
*slb
, target_ulong eaddr
,
405 ppc_hash_pte64_t
*pte
)
409 uint64_t vsid
, epnshift
, epnmask
, epn
, ptem
;
411 epnshift
= ppc_hash64_page_shift(slb
);
412 epnmask
= ~((1ULL << epnshift
) - 1);
414 if (slb
->vsid
& SLB_VSID_B
) {
416 vsid
= (slb
->vsid
& SLB_VSID_VSID
) >> SLB_VSID_SHIFT_1T
;
417 epn
= (eaddr
& ~SEGMENT_MASK_1T
) & epnmask
;
418 hash
= vsid
^ (vsid
<< 25) ^ (epn
>> epnshift
);
421 vsid
= (slb
->vsid
& SLB_VSID_VSID
) >> SLB_VSID_SHIFT
;
422 epn
= (eaddr
& ~SEGMENT_MASK_256M
) & epnmask
;
423 hash
= vsid
^ (epn
>> epnshift
);
425 ptem
= (slb
->vsid
& SLB_VSID_PTEM
) | ((epn
>> 16) & HPTE64_V_AVPN
);
427 /* Page address translation */
428 qemu_log_mask(CPU_LOG_MMU
,
429 "htab_base " TARGET_FMT_plx
" htab_mask " TARGET_FMT_plx
430 " hash " TARGET_FMT_plx
"\n",
431 env
->htab_base
, env
->htab_mask
, hash
);
433 /* Primary PTEG lookup */
434 qemu_log_mask(CPU_LOG_MMU
,
435 "0 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
436 " vsid=" TARGET_FMT_lx
" ptem=" TARGET_FMT_lx
437 " hash=" TARGET_FMT_plx
"\n",
438 env
->htab_base
, env
->htab_mask
, vsid
, ptem
, hash
);
439 pte_offset
= ppc_hash64_pteg_search(env
, hash
, 0, ptem
, pte
);
441 if (pte_offset
== -1) {
442 /* Secondary PTEG lookup */
443 qemu_log_mask(CPU_LOG_MMU
,
444 "1 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
445 " vsid=" TARGET_FMT_lx
" api=" TARGET_FMT_lx
446 " hash=" TARGET_FMT_plx
"\n", env
->htab_base
,
447 env
->htab_mask
, vsid
, ptem
, ~hash
);
449 pte_offset
= ppc_hash64_pteg_search(env
, ~hash
, 1, ptem
, pte
);
455 static hwaddr
ppc_hash64_pte_raddr(ppc_slb_t
*slb
, ppc_hash_pte64_t pte
,
459 int target_page_bits
;
460 hwaddr rpn
= pte
.pte1
& HPTE64_R_RPN
;
462 * We support 4K, 64K and 16M now
464 target_page_bits
= ppc_hash64_page_shift(slb
);
465 mask
= (1ULL << target_page_bits
) - 1;
466 return (rpn
& ~mask
) | (eaddr
& mask
);
469 int ppc_hash64_handle_mmu_fault(PowerPCCPU
*cpu
, target_ulong eaddr
,
470 int rwx
, int mmu_idx
)
472 CPUState
*cs
= CPU(cpu
);
473 CPUPPCState
*env
= &cpu
->env
;
476 ppc_hash_pte64_t pte
;
477 int pp_prot
, amr_prot
, prot
;
479 const int need_prot
[] = {PAGE_READ
, PAGE_WRITE
, PAGE_EXEC
};
482 assert((rwx
== 0) || (rwx
== 1) || (rwx
== 2));
484 /* 1. Handle real mode accesses */
485 if (((rwx
== 2) && (msr_ir
== 0)) || ((rwx
!= 2) && (msr_dr
== 0))) {
486 /* Translation is off */
487 /* In real mode the top 4 effective address bits are ignored */
488 raddr
= eaddr
& 0x0FFFFFFFFFFFFFFFULL
;
489 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
, raddr
& TARGET_PAGE_MASK
,
490 PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
, mmu_idx
,
495 /* 2. Translation is on, so look up the SLB */
496 slb
= slb_lookup(env
, eaddr
);
500 cs
->exception_index
= POWERPC_EXCP_ISEG
;
503 cs
->exception_index
= POWERPC_EXCP_DSEG
;
505 env
->spr
[SPR_DAR
] = eaddr
;
510 /* 3. Check for segment level no-execute violation */
511 if ((rwx
== 2) && (slb
->vsid
& SLB_VSID_N
)) {
512 cs
->exception_index
= POWERPC_EXCP_ISI
;
513 env
->error_code
= 0x10000000;
517 /* 4. Locate the PTE in the hash table */
518 pte_offset
= ppc_hash64_htab_lookup(env
, slb
, eaddr
, &pte
);
519 if (pte_offset
== -1) {
521 cs
->exception_index
= POWERPC_EXCP_ISI
;
522 env
->error_code
= 0x40000000;
524 cs
->exception_index
= POWERPC_EXCP_DSI
;
526 env
->spr
[SPR_DAR
] = eaddr
;
528 env
->spr
[SPR_DSISR
] = 0x42000000;
530 env
->spr
[SPR_DSISR
] = 0x40000000;
535 qemu_log_mask(CPU_LOG_MMU
,
536 "found PTE at offset %08" HWADDR_PRIx
"\n", pte_offset
);
538 /* 5. Check access permissions */
540 pp_prot
= ppc_hash64_pte_prot(env
, slb
, pte
);
541 amr_prot
= ppc_hash64_amr_prot(env
, pte
);
542 prot
= pp_prot
& amr_prot
;
544 if ((need_prot
[rwx
] & ~prot
) != 0) {
545 /* Access right violation */
546 qemu_log_mask(CPU_LOG_MMU
, "PTE access rejected\n");
548 cs
->exception_index
= POWERPC_EXCP_ISI
;
549 env
->error_code
= 0x08000000;
551 target_ulong dsisr
= 0;
553 cs
->exception_index
= POWERPC_EXCP_DSI
;
555 env
->spr
[SPR_DAR
] = eaddr
;
556 if (need_prot
[rwx
] & ~pp_prot
) {
562 if (need_prot
[rwx
] & ~amr_prot
) {
565 env
->spr
[SPR_DSISR
] = dsisr
;
570 qemu_log_mask(CPU_LOG_MMU
, "PTE access granted !\n");
572 /* 6. Update PTE referenced and changed bits if necessary */
574 new_pte1
= pte
.pte1
| HPTE64_R_R
; /* set referenced bit */
576 new_pte1
|= HPTE64_R_C
; /* set changed (dirty) bit */
578 /* Treat the page as read-only for now, so that a later write
579 * will pass through this function again to set the C bit */
583 if (new_pte1
!= pte
.pte1
) {
584 ppc_hash64_store_hpte(env
, pte_offset
/ HASH_PTE_SIZE_64
,
588 /* 7. Determine the real address from the PTE */
590 raddr
= ppc_hash64_pte_raddr(slb
, pte
, eaddr
);
592 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
, raddr
& TARGET_PAGE_MASK
,
593 prot
, mmu_idx
, TARGET_PAGE_SIZE
);
598 hwaddr
ppc_hash64_get_phys_page_debug(CPUPPCState
*env
, target_ulong addr
)
602 ppc_hash_pte64_t pte
;
605 /* In real mode the top 4 effective address bits are ignored */
606 return addr
& 0x0FFFFFFFFFFFFFFFULL
;
609 slb
= slb_lookup(env
, addr
);
614 pte_offset
= ppc_hash64_htab_lookup(env
, slb
, addr
, &pte
);
615 if (pte_offset
== -1) {
619 return ppc_hash64_pte_raddr(slb
, pte
, addr
) & TARGET_PAGE_MASK
;
622 void ppc_hash64_store_hpte(CPUPPCState
*env
,
623 target_ulong pte_index
,
624 target_ulong pte0
, target_ulong pte1
)
626 CPUState
*cs
= CPU(ppc_env_get_cpu(env
));
628 if (kvmppc_kern_htab
) {
629 kvmppc_hash64_write_pte(env
, pte_index
, pte0
, pte1
);
633 pte_index
*= HASH_PTE_SIZE_64
;
634 if (env
->external_htab
) {
635 stq_p(env
->external_htab
+ pte_index
, pte0
);
636 stq_p(env
->external_htab
+ pte_index
+ HASH_PTE_SIZE_64
/2, pte1
);
638 stq_phys(cs
->as
, env
->htab_base
+ pte_index
, pte0
);
639 stq_phys(cs
->as
, env
->htab_base
+ pte_index
+ HASH_PTE_SIZE_64
/2, pte1
);