target-ppc/mmu-hash64.c

   1 /*
   2  *  PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
   3  *
   4  *  Copyright (c) 2003-2007 Jocelyn Mayer
   5  *  Copyright (c) 2013 David Gibson, IBM Corporation
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20 #include "qemu/osdep.h"
  21 #include "cpu.h"
  22 #include "exec/helper-proto.h"
  23 #include "qemu/error-report.h"
  24 #include "sysemu/kvm.h"
  25 #include "qemu/error-report.h"
  26 #include "kvm_ppc.h"
  27 #include "mmu-hash64.h"
  28 #include "exec/log.h"
  29
  30 //#define DEBUG_SLB
  31
  32 #ifdef DEBUG_SLB
  33 #  define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
  34 #else
  35 #  define LOG_SLB(...) do { } while (0)
  36 #endif
  37
  38 /*
  39  * Used to indicate that a CPU has its hash page table (HPT) managed
  40  * within the host kernel
  41  */
  42 #define MMU_HASH64_KVM_MANAGED_HPT      ((void *)-1)
  43
  44 /*
  45  * SLB handling
  46  */
  47
  48 static ppc_slb_t *slb_lookup(PowerPCCPU *cpu, target_ulong eaddr)
  49 {
  50     CPUPPCState *env = &cpu->env;
  51     uint64_t esid_256M, esid_1T;
  52     int n;
  53
  54     LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);
  55
  56     esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V;
  57     esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V;
  58
  59     for (n = 0; n < env->slb_nr; n++) {
  60         ppc_slb_t *slb = &env->slb[n];
  61
  62         LOG_SLB("%s: slot %d %016" PRIx64 " %016"
  63                     PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
  64         /* We check for 1T matches on all MMUs here - if the MMU
  65          * doesn't have 1T segment support, we will have prevented 1T
  66          * entries from being inserted in the slbmte code. */
  67         if (((slb->esid == esid_256M) &&
  68              ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
  69             || ((slb->esid == esid_1T) &&
  70                 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
  71             return slb;
  72         }
  73     }
  74
  75     return NULL;
  76 }
  77
  78 void dump_slb(FILE *f, fprintf_function cpu_fprintf, PowerPCCPU *cpu)
  79 {
  80     CPUPPCState *env = &cpu->env;
  81     int i;
  82     uint64_t slbe, slbv;
  83
  84     cpu_synchronize_state(CPU(cpu));
  85
  86     cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
  87     for (i = 0; i < env->slb_nr; i++) {
  88         slbe = env->slb[i].esid;
  89         slbv = env->slb[i].vsid;
  90         if (slbe == 0 && slbv == 0) {
  91             continue;
  92         }
  93         cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
  94                     i, slbe, slbv);
  95     }
  96 }
  97
  98 void helper_slbia(CPUPPCState *env)
  99 {
 100     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 101     int n, do_invalidate;
 102
 103     do_invalidate = 0;
 104     /* XXX: Warning: slbia never invalidates the first segment */
 105     for (n = 1; n < env->slb_nr; n++) {
 106         ppc_slb_t *slb = &env->slb[n];
 107
 108         if (slb->esid & SLB_ESID_V) {
 109             slb->esid &= ~SLB_ESID_V;
 110             /* XXX: given the fact that segment size is 256 MB or 1TB,
 111              *      and we still don't have a tlb_flush_mask(env, n, mask)
 112              *      in QEMU, we just invalidate all TLBs
 113              */
 114             do_invalidate = 1;
 115         }
 116     }
 117     if (do_invalidate) {
 118         tlb_flush(CPU(cpu), 1);
 119     }
 120 }
 121
 122 void helper_slbie(CPUPPCState *env, target_ulong addr)
 123 {
 124     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 125     ppc_slb_t *slb;
 126
 127     slb = slb_lookup(cpu, addr);
 128     if (!slb) {
 129         return;
 130     }
 131
 132     if (slb->esid & SLB_ESID_V) {
 133         slb->esid &= ~SLB_ESID_V;
 134
 135         /* XXX: given the fact that segment size is 256 MB or 1TB,
 136          *      and we still don't have a tlb_flush_mask(env, n, mask)
 137          *      in QEMU, we just invalidate all TLBs
 138          */
 139         tlb_flush(CPU(cpu), 1);
 140     }
 141 }
 142
 143 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot,
 144                   target_ulong esid, target_ulong vsid)
 145 {
 146     CPUPPCState *env = &cpu->env;
 147     ppc_slb_t *slb = &env->slb[slot];
 148     const struct ppc_one_seg_page_size *sps = NULL;
 149     int i;
 150
 151     if (slot >= env->slb_nr) {
 152         return -1; /* Bad slot number */
 153     }
 154     if (esid & ~(SLB_ESID_ESID | SLB_ESID_V)) {
 155         return -1; /* Reserved bits set */
 156     }
 157     if (vsid & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
 158         return -1; /* Bad segment size */
 159     }
 160     if ((vsid & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
 161         return -1; /* 1T segment on MMU that doesn't support it */
 162     }
 163
 164     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 165         const struct ppc_one_seg_page_size *sps1 = &env->sps.sps[i];
 166
 167         if (!sps1->page_shift) {
 168             break;
 169         }
 170
 171         if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) {
 172             sps = sps1;
 173             break;
 174         }
 175     }
 176
 177     if (!sps) {
 178         error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu
 179                      " esid 0x"TARGET_FMT_lx" vsid 0x"TARGET_FMT_lx,
 180                      slot, esid, vsid);
 181         return -1;
 182     }
 183
 184     slb->esid = esid;
 185     slb->vsid = vsid;
 186     slb->sps = sps;
 187
 188     LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
 189             " %016" PRIx64 "\n", __func__, slot, esid, vsid,
 190             slb->esid, slb->vsid);
 191
 192     return 0;
 193 }
 194
 195 static int ppc_load_slb_esid(PowerPCCPU *cpu, target_ulong rb,
 196                              target_ulong *rt)
 197 {
 198     CPUPPCState *env = &cpu->env;
 199     int slot = rb & 0xfff;
 200     ppc_slb_t *slb = &env->slb[slot];
 201
 202     if (slot >= env->slb_nr) {
 203         return -1;
 204     }
 205
 206     *rt = slb->esid;
 207     return 0;
 208 }
 209
 210 static int ppc_load_slb_vsid(PowerPCCPU *cpu, target_ulong rb,
 211                              target_ulong *rt)
 212 {
 213     CPUPPCState *env = &cpu->env;
 214     int slot = rb & 0xfff;
 215     ppc_slb_t *slb = &env->slb[slot];
 216
 217     if (slot >= env->slb_nr) {
 218         return -1;
 219     }
 220
 221     *rt = slb->vsid;
 222     return 0;
 223 }
 224
 225 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
 226 {
 227     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 228
 229     if (ppc_store_slb(cpu, rb & 0xfff, rb & ~0xfffULL, rs) < 0) {
 230         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 231                                    POWERPC_EXCP_INVAL);
 232     }
 233 }
 234
 235 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
 236 {
 237     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 238     target_ulong rt = 0;
 239
 240     if (ppc_load_slb_esid(cpu, rb, &rt) < 0) {
 241         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 242                                    POWERPC_EXCP_INVAL);
 243     }
 244     return rt;
 245 }
 246
 247 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
 248 {
 249     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 250     target_ulong rt = 0;
 251
 252     if (ppc_load_slb_vsid(cpu, rb, &rt) < 0) {
 253         helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
 254                                    POWERPC_EXCP_INVAL);
 255     }
 256     return rt;
 257 }
 258
 259 /*
 260  * 64-bit hash table MMU handling
 261  */
 262 void ppc_hash64_set_sdr1(PowerPCCPU *cpu, target_ulong value,
 263                          Error **errp)
 264 {
 265     CPUPPCState *env = &cpu->env;
 266     target_ulong htabsize = value & SDR_64_HTABSIZE;
 267
 268     env->spr[SPR_SDR1] = value;
 269     if (htabsize > 28) {
 270         error_setg(errp,
 271                    "Invalid HTABSIZE 0x" TARGET_FMT_lx" stored in SDR1",
 272                    htabsize);
 273         htabsize = 28;
 274     }
 275     env->htab_mask = (1ULL << (htabsize + 18 - 7)) - 1;
 276     env->htab_base = value & SDR_64_HTABORG;
 277 }
 278
 279 void ppc_hash64_set_external_hpt(PowerPCCPU *cpu, void *hpt, int shift,
 280                                  Error **errp)
 281 {
 282     CPUPPCState *env = &cpu->env;
 283     Error *local_err = NULL;
 284
 285     cpu_synchronize_state(CPU(cpu));
 286
 287     if (hpt) {
 288         env->external_htab = hpt;
 289     } else {
 290         env->external_htab = MMU_HASH64_KVM_MANAGED_HPT;
 291     }
 292     ppc_hash64_set_sdr1(cpu, (target_ulong)(uintptr_t)hpt | (shift - 18),
 293                         &local_err);
 294     if (local_err) {
 295         error_propagate(errp, local_err);
 296         return;
 297     }
 298
 299     /* Not strictly necessary, but makes it clearer that an external
 300      * htab is in use when debugging */
 301     env->htab_base = -1;
 302
 303     if (kvm_enabled()) {
 304         if (kvmppc_put_books_sregs(cpu) < 0) {
 305             error_setg(errp, "Unable to update SDR1 in KVM");
 306         }
 307     }
 308 }
 309
 310 static int ppc_hash64_pte_prot(PowerPCCPU *cpu,
 311                                ppc_slb_t *slb, ppc_hash_pte64_t pte)
 312 {
 313     CPUPPCState *env = &cpu->env;
 314     unsigned pp, key;
 315     /* Some pp bit combinations have undefined behaviour, so default
 316      * to no access in those cases */
 317     int prot = 0;
 318
 319     key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP)
 320              : (slb->vsid & SLB_VSID_KS));
 321     pp = (pte.pte1 & HPTE64_R_PP) | ((pte.pte1 & HPTE64_R_PP0) >> 61);
 322
 323     if (key == 0) {
 324         switch (pp) {
 325         case 0x0:
 326         case 0x1:
 327         case 0x2:
 328             prot = PAGE_READ | PAGE_WRITE;
 329             break;
 330
 331         case 0x3:
 332         case 0x6:
 333             prot = PAGE_READ;
 334             break;
 335         }
 336     } else {
 337         switch (pp) {
 338         case 0x0:
 339         case 0x6:
 340             prot = 0;
 341             break;
 342
 343         case 0x1:
 344         case 0x3:
 345             prot = PAGE_READ;
 346             break;
 347
 348         case 0x2:
 349             prot = PAGE_READ | PAGE_WRITE;
 350             break;
 351         }
 352     }
 353
 354     /* No execute if either noexec or guarded bits set */
 355     if (!(pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G)
 356         || (slb->vsid & SLB_VSID_N)) {
 357         prot |= PAGE_EXEC;
 358     }
 359
 360     return prot;
 361 }
 362
 363 static int ppc_hash64_amr_prot(PowerPCCPU *cpu, ppc_hash_pte64_t pte)
 364 {
 365     CPUPPCState *env = &cpu->env;
 366     int key, amrbits;
 367     int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 368
 369     /* Only recent MMUs implement Virtual Page Class Key Protection */
 370     if (!(env->mmu_model & POWERPC_MMU_AMR)) {
 371         return prot;
 372     }
 373
 374     key = HPTE64_R_KEY(pte.pte1);
 375     amrbits = (env->spr[SPR_AMR] >> 2*(31 - key)) & 0x3;
 376
 377     /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */
 378     /*         env->spr[SPR_AMR]); */
 379
 380     /*
 381      * A store is permitted if the AMR bit is 0. Remove write
 382      * protection if it is set.
 383      */
 384     if (amrbits & 0x2) {
 385         prot &= ~PAGE_WRITE;
 386     }
 387     /*
 388      * A load is permitted if the AMR bit is 0. Remove read
 389      * protection if it is set.
 390      */
 391     if (amrbits & 0x1) {
 392         prot &= ~PAGE_READ;
 393     }
 394
 395     return prot;
 396 }
 397
 398 uint64_t ppc_hash64_start_access(PowerPCCPU *cpu, target_ulong pte_index)
 399 {
 400     uint64_t token = 0;
 401     hwaddr pte_offset;
 402
 403     pte_offset = pte_index * HASH_PTE_SIZE_64;
 404     if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) {
 405         /*
 406          * HTAB is controlled by KVM. Fetch the PTEG into a new buffer.
 407          */
 408         token = kvmppc_hash64_read_pteg(cpu, pte_index);
 409     } else if (cpu->env.external_htab) {
 410         /*
 411          * HTAB is controlled by QEMU. Just point to the internally
 412          * accessible PTEG.
 413          */
 414         token = (uint64_t)(uintptr_t) cpu->env.external_htab + pte_offset;
 415     } else if (cpu->env.htab_base) {
 416         token = cpu->env.htab_base + pte_offset;
 417     }
 418     return token;
 419 }
 420
 421 void ppc_hash64_stop_access(PowerPCCPU *cpu, uint64_t token)
 422 {
 423     if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) {
 424         kvmppc_hash64_free_pteg(token);
 425     }
 426 }
 427
 428 static hwaddr ppc_hash64_pteg_search(PowerPCCPU *cpu, hwaddr hash,
 429                                      bool secondary, target_ulong ptem,
 430                                      ppc_hash_pte64_t *pte)
 431 {
 432     CPUPPCState *env = &cpu->env;
 433     int i;
 434     uint64_t token;
 435     target_ulong pte0, pte1;
 436     target_ulong pte_index;
 437
 438     pte_index = (hash & env->htab_mask) * HPTES_PER_GROUP;
 439     token = ppc_hash64_start_access(cpu, pte_index);
 440     if (!token) {
 441         return -1;
 442     }
 443     for (i = 0; i < HPTES_PER_GROUP; i++) {
 444         pte0 = ppc_hash64_load_hpte0(cpu, token, i);
 445         pte1 = ppc_hash64_load_hpte1(cpu, token, i);
 446
 447         if ((pte0 & HPTE64_V_VALID)
 448             && (secondary == !!(pte0 & HPTE64_V_SECONDARY))
 449             && HPTE64_V_COMPARE(pte0, ptem)) {
 450             pte->pte0 = pte0;
 451             pte->pte1 = pte1;
 452             ppc_hash64_stop_access(cpu, token);
 453             return (pte_index + i) * HASH_PTE_SIZE_64;
 454         }
 455     }
 456     ppc_hash64_stop_access(cpu, token);
 457     /*
 458      * We didn't find a valid entry.
 459      */
 460     return -1;
 461 }
 462
 463 static hwaddr ppc_hash64_htab_lookup(PowerPCCPU *cpu,
 464                                      ppc_slb_t *slb, target_ulong eaddr,
 465                                      ppc_hash_pte64_t *pte)
 466 {
 467     CPUPPCState *env = &cpu->env;
 468     hwaddr pte_offset;
 469     hwaddr hash;
 470     uint64_t vsid, epnmask, epn, ptem;
 471
 472     /* The SLB store path should prevent any bad page size encodings
 473      * getting in there, so: */
 474     assert(slb->sps);
 475
 476     epnmask = ~((1ULL << slb->sps->page_shift) - 1);
 477
 478     if (slb->vsid & SLB_VSID_B) {
 479         /* 1TB segment */
 480         vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
 481         epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask;
 482         hash = vsid ^ (vsid << 25) ^ (epn >> slb->sps->page_shift);
 483     } else {
 484         /* 256M segment */
 485         vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
 486         epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask;
 487         hash = vsid ^ (epn >> slb->sps->page_shift);
 488     }
 489     ptem = (slb->vsid & SLB_VSID_PTEM) | ((epn >> 16) & HPTE64_V_AVPN);
 490
 491     /* Page address translation */
 492     qemu_log_mask(CPU_LOG_MMU,
 493             "htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
 494             " hash " TARGET_FMT_plx "\n",
 495             env->htab_base, env->htab_mask, hash);
 496
 497     /* Primary PTEG lookup */
 498     qemu_log_mask(CPU_LOG_MMU,
 499             "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 500             " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
 501             " hash=" TARGET_FMT_plx "\n",
 502             env->htab_base, env->htab_mask, vsid, ptem,  hash);
 503     pte_offset = ppc_hash64_pteg_search(cpu, hash, 0, ptem, pte);
 504
 505     if (pte_offset == -1) {
 506         /* Secondary PTEG lookup */
 507         qemu_log_mask(CPU_LOG_MMU,
 508                 "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 509                 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
 510                 " hash=" TARGET_FMT_plx "\n", env->htab_base,
 511                 env->htab_mask, vsid, ptem, ~hash);
 512
 513         pte_offset = ppc_hash64_pteg_search(cpu, ~hash, 1, ptem, pte);
 514     }
 515
 516     return pte_offset;
 517 }
 518
 519 static unsigned hpte_page_shift(const struct ppc_one_seg_page_size *sps,
 520     uint64_t pte0, uint64_t pte1)
 521 {
 522     int i;
 523
 524     if (!(pte0 & HPTE64_V_LARGE)) {
 525         if (sps->page_shift != 12) {
 526             /* 4kiB page in a non 4kiB segment */
 527             return 0;
 528         }
 529         /* Normal 4kiB page */
 530         return 12;
 531     }
 532
 533     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 534         const struct ppc_one_page_size *ps = &sps->enc[i];
 535         uint64_t mask;
 536
 537         if (!ps->page_shift) {
 538             break;
 539         }
 540
 541         if (ps->page_shift == 12) {
 542             /* L bit is set so this can't be a 4kiB page */
 543             continue;
 544         }
 545
 546         mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN;
 547
 548         if ((pte1 & mask) == (ps->pte_enc << HPTE64_R_RPN_SHIFT)) {
 549             return ps->page_shift;
 550         }
 551     }
 552
 553     return 0; /* Bad page size encoding */
 554 }
 555
 556 unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU *cpu,
 557                                           uint64_t pte0, uint64_t pte1,
 558                                           unsigned *seg_page_shift)
 559 {
 560     CPUPPCState *env = &cpu->env;
 561     int i;
 562
 563     if (!(pte0 & HPTE64_V_LARGE)) {
 564         *seg_page_shift = 12;
 565         return 12;
 566     }
 567
 568     /*
 569      * The encodings in env->sps need to be carefully chosen so that
 570      * this gives an unambiguous result.
 571      */
 572     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 573         const struct ppc_one_seg_page_size *sps = &env->sps.sps[i];
 574         unsigned shift;
 575
 576         if (!sps->page_shift) {
 577             break;
 578         }
 579
 580         shift = hpte_page_shift(sps, pte0, pte1);
 581         if (shift) {
 582             *seg_page_shift = sps->page_shift;
 583             return shift;
 584         }
 585     }
 586
 587     *seg_page_shift = 0;
 588     return 0;
 589 }
 590
 591 int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, target_ulong eaddr,
 592                                 int rwx, int mmu_idx)
 593 {
 594     CPUState *cs = CPU(cpu);
 595     CPUPPCState *env = &cpu->env;
 596     ppc_slb_t *slb;
 597     unsigned apshift;
 598     hwaddr pte_offset;
 599     ppc_hash_pte64_t pte;
 600     int pp_prot, amr_prot, prot;
 601     uint64_t new_pte1;
 602     const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
 603     hwaddr raddr;
 604
 605     assert((rwx == 0) || (rwx == 1) || (rwx == 2));
 606
 607     /* 1. Handle real mode accesses */
 608     if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
 609         /* Translation is off */
 610         /* In real mode the top 4 effective address bits are ignored */
 611         raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
 612         tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 613                      PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
 614                      TARGET_PAGE_SIZE);
 615         return 0;
 616     }
 617
 618     /* 2. Translation is on, so look up the SLB */
 619     slb = slb_lookup(cpu, eaddr);
 620
 621     if (!slb) {
 622         if (rwx == 2) {
 623             cs->exception_index = POWERPC_EXCP_ISEG;
 624             env->error_code = 0;
 625         } else {
 626             cs->exception_index = POWERPC_EXCP_DSEG;
 627             env->error_code = 0;
 628             env->spr[SPR_DAR] = eaddr;
 629         }
 630         return 1;
 631     }
 632
 633     /* 3. Check for segment level no-execute violation */
 634     if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) {
 635         cs->exception_index = POWERPC_EXCP_ISI;
 636         env->error_code = 0x10000000;
 637         return 1;
 638     }
 639
 640     /* 4. Locate the PTE in the hash table */
 641     pte_offset = ppc_hash64_htab_lookup(cpu, slb, eaddr, &pte);
 642     if (pte_offset == -1) {
 643         if (rwx == 2) {
 644             cs->exception_index = POWERPC_EXCP_ISI;
 645             env->error_code = 0x40000000;
 646         } else {
 647             cs->exception_index = POWERPC_EXCP_DSI;
 648             env->error_code = 0;
 649             env->spr[SPR_DAR] = eaddr;
 650             if (rwx == 1) {
 651                 env->spr[SPR_DSISR] = 0x42000000;
 652             } else {
 653                 env->spr[SPR_DSISR] = 0x40000000;
 654             }
 655         }
 656         return 1;
 657     }
 658     qemu_log_mask(CPU_LOG_MMU,
 659                 "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
 660
 661     /* Validate page size encoding */
 662     apshift = hpte_page_shift(slb->sps, pte.pte0, pte.pte1);
 663     if (!apshift) {
 664         error_report("Bad page size encoding in HPTE 0x%"PRIx64" - 0x%"PRIx64
 665                      " @ 0x%"HWADDR_PRIx, pte.pte0, pte.pte1, pte_offset);
 666         /* Not entirely sure what the right action here, but machine
 667          * check seems reasonable */
 668         cs->exception_index = POWERPC_EXCP_MCHECK;
 669         env->error_code = 0;
 670         return 1;
 671     }
 672
 673     /* 5. Check access permissions */
 674
 675     pp_prot = ppc_hash64_pte_prot(cpu, slb, pte);
 676     amr_prot = ppc_hash64_amr_prot(cpu, pte);
 677     prot = pp_prot & amr_prot;
 678
 679     if ((need_prot[rwx] & ~prot) != 0) {
 680         /* Access right violation */
 681         qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
 682         if (rwx == 2) {
 683             cs->exception_index = POWERPC_EXCP_ISI;
 684             env->error_code = 0x08000000;
 685         } else {
 686             target_ulong dsisr = 0;
 687
 688             cs->exception_index = POWERPC_EXCP_DSI;
 689             env->error_code = 0;
 690             env->spr[SPR_DAR] = eaddr;
 691             if (need_prot[rwx] & ~pp_prot) {
 692                 dsisr |= 0x08000000;
 693             }
 694             if (rwx == 1) {
 695                 dsisr |= 0x02000000;
 696             }
 697             if (need_prot[rwx] & ~amr_prot) {
 698                 dsisr |= 0x00200000;
 699             }
 700             env->spr[SPR_DSISR] = dsisr;
 701         }
 702         return 1;
 703     }
 704
 705     qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
 706
 707     /* 6. Update PTE referenced and changed bits if necessary */
 708
 709     new_pte1 = pte.pte1 | HPTE64_R_R; /* set referenced bit */
 710     if (rwx == 1) {
 711         new_pte1 |= HPTE64_R_C; /* set changed (dirty) bit */
 712     } else {
 713         /* Treat the page as read-only for now, so that a later write
 714          * will pass through this function again to set the C bit */
 715         prot &= ~PAGE_WRITE;
 716     }
 717
 718     if (new_pte1 != pte.pte1) {
 719         ppc_hash64_store_hpte(cpu, pte_offset / HASH_PTE_SIZE_64,
 720                               pte.pte0, new_pte1);
 721     }
 722
 723     /* 7. Determine the real address from the PTE */
 724
 725     raddr = deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, eaddr);
 726
 727     tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 728                  prot, mmu_idx, 1ULL << apshift);
 729
 730     return 0;
 731 }
 732
 733 hwaddr ppc_hash64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr)
 734 {
 735     CPUPPCState *env = &cpu->env;
 736     ppc_slb_t *slb;
 737     hwaddr pte_offset;
 738     ppc_hash_pte64_t pte;
 739     unsigned apshift;
 740
 741     if (msr_dr == 0) {
 742         /* In real mode the top 4 effective address bits are ignored */
 743         return addr & 0x0FFFFFFFFFFFFFFFULL;
 744     }
 745
 746     slb = slb_lookup(cpu, addr);
 747     if (!slb) {
 748         return -1;
 749     }
 750
 751     pte_offset = ppc_hash64_htab_lookup(cpu, slb, addr, &pte);
 752     if (pte_offset == -1) {
 753         return -1;
 754     }
 755
 756     apshift = hpte_page_shift(slb->sps, pte.pte0, pte.pte1);
 757     if (!apshift) {
 758         return -1;
 759     }
 760
 761     return deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, addr)
 762         & TARGET_PAGE_MASK;
 763 }
 764
 765 void ppc_hash64_store_hpte(PowerPCCPU *cpu,
 766                            target_ulong pte_index,
 767                            target_ulong pte0, target_ulong pte1)
 768 {
 769     CPUPPCState *env = &cpu->env;
 770
 771     if (env->external_htab == MMU_HASH64_KVM_MANAGED_HPT) {
 772         kvmppc_hash64_write_pte(env, pte_index, pte0, pte1);
 773         return;
 774     }
 775
 776     pte_index *= HASH_PTE_SIZE_64;
 777     if (env->external_htab) {
 778         stq_p(env->external_htab + pte_index, pte0);
 779         stq_p(env->external_htab + pte_index + HASH_PTE_SIZE_64 / 2, pte1);
 780     } else {
 781         stq_phys(CPU(cpu)->as, env->htab_base + pte_index, pte0);
 782         stq_phys(CPU(cpu)->as,
 783                  env->htab_base + pte_index + HASH_PTE_SIZE_64 / 2, pte1);
 784     }
 785 }
 786
 787 void ppc_hash64_tlb_flush_hpte(PowerPCCPU *cpu,
 788                                target_ulong pte_index,
 789                                target_ulong pte0, target_ulong pte1)
 790 {
 791     /*
 792      * XXX: given the fact that there are too many segments to
 793      * invalidate, and we still don't have a tlb_flush_mask(env, n,
 794      * mask) in QEMU, we just invalidate all TLBs
 795      */
 796     tlb_flush(CPU(cpu), 1);
 797 }