2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 * Copyright (c) 2013 David Gibson, IBM Corporation
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
21 #include "qapi/error.h"
23 #include "exec/exec-all.h"
24 #include "exec/helper-proto.h"
25 #include "qemu/error-report.h"
26 #include "sysemu/kvm.h"
27 #include "qemu/error-report.h"
29 #include "mmu-hash64.h"
35 # define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
37 # define LOG_SLB(...) do { } while (0)
41 * Used to indicate that a CPU has its hash page table (HPT) managed
42 * within the host kernel
44 #define MMU_HASH64_KVM_MANAGED_HPT ((void *)-1)
50 static ppc_slb_t
*slb_lookup(PowerPCCPU
*cpu
, target_ulong eaddr
)
52 CPUPPCState
*env
= &cpu
->env
;
53 uint64_t esid_256M
, esid_1T
;
56 LOG_SLB("%s: eaddr " TARGET_FMT_lx
"\n", __func__
, eaddr
);
58 esid_256M
= (eaddr
& SEGMENT_MASK_256M
) | SLB_ESID_V
;
59 esid_1T
= (eaddr
& SEGMENT_MASK_1T
) | SLB_ESID_V
;
61 for (n
= 0; n
< env
->slb_nr
; n
++) {
62 ppc_slb_t
*slb
= &env
->slb
[n
];
64 LOG_SLB("%s: slot %d %016" PRIx64
" %016"
65 PRIx64
"\n", __func__
, n
, slb
->esid
, slb
->vsid
);
66 /* We check for 1T matches on all MMUs here - if the MMU
67 * doesn't have 1T segment support, we will have prevented 1T
68 * entries from being inserted in the slbmte code. */
69 if (((slb
->esid
== esid_256M
) &&
70 ((slb
->vsid
& SLB_VSID_B
) == SLB_VSID_B_256M
))
71 || ((slb
->esid
== esid_1T
) &&
72 ((slb
->vsid
& SLB_VSID_B
) == SLB_VSID_B_1T
))) {
80 void dump_slb(FILE *f
, fprintf_function cpu_fprintf
, PowerPCCPU
*cpu
)
82 CPUPPCState
*env
= &cpu
->env
;
86 cpu_synchronize_state(CPU(cpu
));
88 cpu_fprintf(f
, "SLB\tESID\t\t\tVSID\n");
89 for (i
= 0; i
< env
->slb_nr
; i
++) {
90 slbe
= env
->slb
[i
].esid
;
91 slbv
= env
->slb
[i
].vsid
;
92 if (slbe
== 0 && slbv
== 0) {
95 cpu_fprintf(f
, "%d\t0x%016" PRIx64
"\t0x%016" PRIx64
"\n",
100 void helper_slbia(CPUPPCState
*env
)
104 /* XXX: Warning: slbia never invalidates the first segment */
105 for (n
= 1; n
< env
->slb_nr
; n
++) {
106 ppc_slb_t
*slb
= &env
->slb
[n
];
108 if (slb
->esid
& SLB_ESID_V
) {
109 slb
->esid
&= ~SLB_ESID_V
;
110 /* XXX: given the fact that segment size is 256 MB or 1TB,
111 * and we still don't have a tlb_flush_mask(env, n, mask)
112 * in QEMU, we just invalidate all TLBs
114 env
->tlb_need_flush
= 1;
119 void helper_slbie(CPUPPCState
*env
, target_ulong addr
)
121 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
124 slb
= slb_lookup(cpu
, addr
);
129 if (slb
->esid
& SLB_ESID_V
) {
130 slb
->esid
&= ~SLB_ESID_V
;
132 /* XXX: given the fact that segment size is 256 MB or 1TB,
133 * and we still don't have a tlb_flush_mask(env, n, mask)
134 * in QEMU, we just invalidate all TLBs
136 env
->tlb_need_flush
= 1;
140 int ppc_store_slb(PowerPCCPU
*cpu
, target_ulong slot
,
141 target_ulong esid
, target_ulong vsid
)
143 CPUPPCState
*env
= &cpu
->env
;
144 ppc_slb_t
*slb
= &env
->slb
[slot
];
145 const struct ppc_one_seg_page_size
*sps
= NULL
;
148 if (slot
>= env
->slb_nr
) {
149 return -1; /* Bad slot number */
151 if (esid
& ~(SLB_ESID_ESID
| SLB_ESID_V
)) {
152 return -1; /* Reserved bits set */
154 if (vsid
& (SLB_VSID_B
& ~SLB_VSID_B_1T
)) {
155 return -1; /* Bad segment size */
157 if ((vsid
& SLB_VSID_B
) && !(env
->mmu_model
& POWERPC_MMU_1TSEG
)) {
158 return -1; /* 1T segment on MMU that doesn't support it */
161 for (i
= 0; i
< PPC_PAGE_SIZES_MAX_SZ
; i
++) {
162 const struct ppc_one_seg_page_size
*sps1
= &env
->sps
.sps
[i
];
164 if (!sps1
->page_shift
) {
168 if ((vsid
& SLB_VSID_LLP_MASK
) == sps1
->slb_enc
) {
175 error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu
176 " esid 0x"TARGET_FMT_lx
" vsid 0x"TARGET_FMT_lx
,
185 LOG_SLB("%s: %d " TARGET_FMT_lx
" - " TARGET_FMT_lx
" => %016" PRIx64
186 " %016" PRIx64
"\n", __func__
, slot
, esid
, vsid
,
187 slb
->esid
, slb
->vsid
);
192 static int ppc_load_slb_esid(PowerPCCPU
*cpu
, target_ulong rb
,
195 CPUPPCState
*env
= &cpu
->env
;
196 int slot
= rb
& 0xfff;
197 ppc_slb_t
*slb
= &env
->slb
[slot
];
199 if (slot
>= env
->slb_nr
) {
207 static int ppc_load_slb_vsid(PowerPCCPU
*cpu
, target_ulong rb
,
210 CPUPPCState
*env
= &cpu
->env
;
211 int slot
= rb
& 0xfff;
212 ppc_slb_t
*slb
= &env
->slb
[slot
];
214 if (slot
>= env
->slb_nr
) {
222 static int ppc_find_slb_vsid(PowerPCCPU
*cpu
, target_ulong rb
,
225 CPUPPCState
*env
= &cpu
->env
;
228 if (!msr_is_64bit(env
, env
->msr
)) {
231 slb
= slb_lookup(cpu
, rb
);
233 *rt
= (target_ulong
)-1ul;
240 void helper_store_slb(CPUPPCState
*env
, target_ulong rb
, target_ulong rs
)
242 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
244 if (ppc_store_slb(cpu
, rb
& 0xfff, rb
& ~0xfffULL
, rs
) < 0) {
245 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
250 target_ulong
helper_load_slb_esid(CPUPPCState
*env
, target_ulong rb
)
252 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
255 if (ppc_load_slb_esid(cpu
, rb
, &rt
) < 0) {
256 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
262 target_ulong
helper_find_slb_vsid(CPUPPCState
*env
, target_ulong rb
)
264 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
267 if (ppc_find_slb_vsid(cpu
, rb
, &rt
) < 0) {
268 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
274 target_ulong
helper_load_slb_vsid(CPUPPCState
*env
, target_ulong rb
)
276 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
279 if (ppc_load_slb_vsid(cpu
, rb
, &rt
) < 0) {
280 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
287 * 64-bit hash table MMU handling
289 void ppc_hash64_set_sdr1(PowerPCCPU
*cpu
, target_ulong value
,
292 CPUPPCState
*env
= &cpu
->env
;
293 target_ulong htabsize
= value
& SDR_64_HTABSIZE
;
295 env
->spr
[SPR_SDR1
] = value
;
298 "Invalid HTABSIZE 0x" TARGET_FMT_lx
" stored in SDR1",
302 env
->htab_mask
= (1ULL << (htabsize
+ 18 - 7)) - 1;
303 env
->htab_base
= value
& SDR_64_HTABORG
;
306 void ppc_hash64_set_external_hpt(PowerPCCPU
*cpu
, void *hpt
, int shift
,
309 CPUPPCState
*env
= &cpu
->env
;
310 Error
*local_err
= NULL
;
313 env
->external_htab
= hpt
;
315 env
->external_htab
= MMU_HASH64_KVM_MANAGED_HPT
;
317 ppc_hash64_set_sdr1(cpu
, (target_ulong
)(uintptr_t)hpt
| (shift
- 18),
320 error_propagate(errp
, local_err
);
324 /* Not strictly necessary, but makes it clearer that an external
325 * htab is in use when debugging */
329 if (kvmppc_put_books_sregs(cpu
) < 0) {
330 error_setg(errp
, "Unable to update SDR1 in KVM");
335 static int ppc_hash64_pte_prot(PowerPCCPU
*cpu
,
336 ppc_slb_t
*slb
, ppc_hash_pte64_t pte
)
338 CPUPPCState
*env
= &cpu
->env
;
340 /* Some pp bit combinations have undefined behaviour, so default
341 * to no access in those cases */
344 key
= !!(msr_pr
? (slb
->vsid
& SLB_VSID_KP
)
345 : (slb
->vsid
& SLB_VSID_KS
));
346 pp
= (pte
.pte1
& HPTE64_R_PP
) | ((pte
.pte1
& HPTE64_R_PP0
) >> 61);
353 prot
= PAGE_READ
| PAGE_WRITE
;
374 prot
= PAGE_READ
| PAGE_WRITE
;
379 /* No execute if either noexec or guarded bits set */
380 if (!(pte
.pte1
& HPTE64_R_N
) || (pte
.pte1
& HPTE64_R_G
)
381 || (slb
->vsid
& SLB_VSID_N
)) {
388 static int ppc_hash64_amr_prot(PowerPCCPU
*cpu
, ppc_hash_pte64_t pte
)
390 CPUPPCState
*env
= &cpu
->env
;
392 int prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
394 /* Only recent MMUs implement Virtual Page Class Key Protection */
395 if (!(env
->mmu_model
& POWERPC_MMU_AMR
)) {
399 key
= HPTE64_R_KEY(pte
.pte1
);
400 amrbits
= (env
->spr
[SPR_AMR
] >> 2*(31 - key
)) & 0x3;
402 /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */
403 /* env->spr[SPR_AMR]); */
406 * A store is permitted if the AMR bit is 0. Remove write
407 * protection if it is set.
413 * A load is permitted if the AMR bit is 0. Remove read
414 * protection if it is set.
423 uint64_t ppc_hash64_start_access(PowerPCCPU
*cpu
, target_ulong pte_index
)
428 pte_offset
= pte_index
* HASH_PTE_SIZE_64
;
429 if (cpu
->env
.external_htab
== MMU_HASH64_KVM_MANAGED_HPT
) {
431 * HTAB is controlled by KVM. Fetch the PTEG into a new buffer.
433 token
= kvmppc_hash64_read_pteg(cpu
, pte_index
);
434 } else if (cpu
->env
.external_htab
) {
436 * HTAB is controlled by QEMU. Just point to the internally
439 token
= (uint64_t)(uintptr_t) cpu
->env
.external_htab
+ pte_offset
;
440 } else if (cpu
->env
.htab_base
) {
441 token
= cpu
->env
.htab_base
+ pte_offset
;
446 void ppc_hash64_stop_access(PowerPCCPU
*cpu
, uint64_t token
)
448 if (cpu
->env
.external_htab
== MMU_HASH64_KVM_MANAGED_HPT
) {
449 kvmppc_hash64_free_pteg(token
);
453 static unsigned hpte_page_shift(const struct ppc_one_seg_page_size
*sps
,
454 uint64_t pte0
, uint64_t pte1
)
458 if (!(pte0
& HPTE64_V_LARGE
)) {
459 if (sps
->page_shift
!= 12) {
460 /* 4kiB page in a non 4kiB segment */
463 /* Normal 4kiB page */
467 for (i
= 0; i
< PPC_PAGE_SIZES_MAX_SZ
; i
++) {
468 const struct ppc_one_page_size
*ps
= &sps
->enc
[i
];
471 if (!ps
->page_shift
) {
475 if (ps
->page_shift
== 12) {
476 /* L bit is set so this can't be a 4kiB page */
480 mask
= ((1ULL << ps
->page_shift
) - 1) & HPTE64_R_RPN
;
482 if ((pte1
& mask
) == (ps
->pte_enc
<< HPTE64_R_RPN_SHIFT
)) {
483 return ps
->page_shift
;
487 return 0; /* Bad page size encoding */
490 static hwaddr
ppc_hash64_pteg_search(PowerPCCPU
*cpu
, hwaddr hash
,
491 const struct ppc_one_seg_page_size
*sps
,
493 ppc_hash_pte64_t
*pte
, unsigned *pshift
)
495 CPUPPCState
*env
= &cpu
->env
;
498 target_ulong pte0
, pte1
;
499 target_ulong pte_index
;
501 pte_index
= (hash
& env
->htab_mask
) * HPTES_PER_GROUP
;
502 token
= ppc_hash64_start_access(cpu
, pte_index
);
506 for (i
= 0; i
< HPTES_PER_GROUP
; i
++) {
507 pte0
= ppc_hash64_load_hpte0(cpu
, token
, i
);
508 pte1
= ppc_hash64_load_hpte1(cpu
, token
, i
);
510 /* This compares V, B, H (secondary) and the AVPN */
511 if (HPTE64_V_COMPARE(pte0
, ptem
)) {
512 *pshift
= hpte_page_shift(sps
, pte0
, pte1
);
514 * If there is no match, ignore the PTE, it could simply
515 * be for a different segment size encoding and the
516 * architecture specifies we should not match. Linux will
517 * potentially leave behind PTEs for the wrong base page
518 * size when demoting segments.
523 /* We don't do anything with pshift yet as qemu TLB only deals
524 * with 4K pages anyway
528 ppc_hash64_stop_access(cpu
, token
);
529 return (pte_index
+ i
) * HASH_PTE_SIZE_64
;
532 ppc_hash64_stop_access(cpu
, token
);
534 * We didn't find a valid entry.
539 static hwaddr
ppc_hash64_htab_lookup(PowerPCCPU
*cpu
,
540 ppc_slb_t
*slb
, target_ulong eaddr
,
541 ppc_hash_pte64_t
*pte
, unsigned *pshift
)
543 CPUPPCState
*env
= &cpu
->env
;
546 uint64_t vsid
, epnmask
, epn
, ptem
;
547 const struct ppc_one_seg_page_size
*sps
= slb
->sps
;
549 /* The SLB store path should prevent any bad page size encodings
550 * getting in there, so: */
553 /* If ISL is set in LPCR we need to clamp the page size to 4K */
554 if (env
->spr
[SPR_LPCR
] & LPCR_ISL
) {
555 /* We assume that when using TCG, 4k is first entry of SPS */
556 sps
= &env
->sps
.sps
[0];
557 assert(sps
->page_shift
== 12);
560 epnmask
= ~((1ULL << sps
->page_shift
) - 1);
562 if (slb
->vsid
& SLB_VSID_B
) {
564 vsid
= (slb
->vsid
& SLB_VSID_VSID
) >> SLB_VSID_SHIFT_1T
;
565 epn
= (eaddr
& ~SEGMENT_MASK_1T
) & epnmask
;
566 hash
= vsid
^ (vsid
<< 25) ^ (epn
>> sps
->page_shift
);
569 vsid
= (slb
->vsid
& SLB_VSID_VSID
) >> SLB_VSID_SHIFT
;
570 epn
= (eaddr
& ~SEGMENT_MASK_256M
) & epnmask
;
571 hash
= vsid
^ (epn
>> sps
->page_shift
);
573 ptem
= (slb
->vsid
& SLB_VSID_PTEM
) | ((epn
>> 16) & HPTE64_V_AVPN
);
574 ptem
|= HPTE64_V_VALID
;
576 /* Page address translation */
577 qemu_log_mask(CPU_LOG_MMU
,
578 "htab_base " TARGET_FMT_plx
" htab_mask " TARGET_FMT_plx
579 " hash " TARGET_FMT_plx
"\n",
580 env
->htab_base
, env
->htab_mask
, hash
);
582 /* Primary PTEG lookup */
583 qemu_log_mask(CPU_LOG_MMU
,
584 "0 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
585 " vsid=" TARGET_FMT_lx
" ptem=" TARGET_FMT_lx
586 " hash=" TARGET_FMT_plx
"\n",
587 env
->htab_base
, env
->htab_mask
, vsid
, ptem
, hash
);
588 pte_offset
= ppc_hash64_pteg_search(cpu
, hash
, sps
, ptem
, pte
, pshift
);
590 if (pte_offset
== -1) {
591 /* Secondary PTEG lookup */
592 ptem
|= HPTE64_V_SECONDARY
;
593 qemu_log_mask(CPU_LOG_MMU
,
594 "1 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
595 " vsid=" TARGET_FMT_lx
" api=" TARGET_FMT_lx
596 " hash=" TARGET_FMT_plx
"\n", env
->htab_base
,
597 env
->htab_mask
, vsid
, ptem
, ~hash
);
599 pte_offset
= ppc_hash64_pteg_search(cpu
, ~hash
, sps
, ptem
, pte
, pshift
);
605 unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU
*cpu
,
606 uint64_t pte0
, uint64_t pte1
)
608 CPUPPCState
*env
= &cpu
->env
;
611 if (!(pte0
& HPTE64_V_LARGE
)) {
616 * The encodings in env->sps need to be carefully chosen so that
617 * this gives an unambiguous result.
619 for (i
= 0; i
< PPC_PAGE_SIZES_MAX_SZ
; i
++) {
620 const struct ppc_one_seg_page_size
*sps
= &env
->sps
.sps
[i
];
623 if (!sps
->page_shift
) {
627 shift
= hpte_page_shift(sps
, pte0
, pte1
);
636 static void ppc_hash64_set_isi(CPUState
*cs
, CPUPPCState
*env
,
642 vpm
= !!(env
->spr
[SPR_LPCR
] & LPCR_VPM1
);
644 vpm
= !!(env
->spr
[SPR_LPCR
] & LPCR_VPM0
);
646 if (vpm
&& !msr_hv
) {
647 cs
->exception_index
= POWERPC_EXCP_HISI
;
649 cs
->exception_index
= POWERPC_EXCP_ISI
;
651 env
->error_code
= error_code
;
654 static void ppc_hash64_set_dsi(CPUState
*cs
, CPUPPCState
*env
, uint64_t dar
,
660 vpm
= !!(env
->spr
[SPR_LPCR
] & LPCR_VPM1
);
662 vpm
= !!(env
->spr
[SPR_LPCR
] & LPCR_VPM0
);
664 if (vpm
&& !msr_hv
) {
665 cs
->exception_index
= POWERPC_EXCP_HDSI
;
666 env
->spr
[SPR_HDAR
] = dar
;
667 env
->spr
[SPR_HDSISR
] = dsisr
;
669 cs
->exception_index
= POWERPC_EXCP_DSI
;
670 env
->spr
[SPR_DAR
] = dar
;
671 env
->spr
[SPR_DSISR
] = dsisr
;
677 int ppc_hash64_handle_mmu_fault(PowerPCCPU
*cpu
, vaddr eaddr
,
678 int rwx
, int mmu_idx
)
680 CPUState
*cs
= CPU(cpu
);
681 CPUPPCState
*env
= &cpu
->env
;
685 ppc_hash_pte64_t pte
;
686 int pp_prot
, amr_prot
, prot
;
687 uint64_t new_pte1
, dsisr
;
688 const int need_prot
[] = {PAGE_READ
, PAGE_WRITE
, PAGE_EXEC
};
691 assert((rwx
== 0) || (rwx
== 1) || (rwx
== 2));
693 /* Note on LPCR usage: 970 uses HID4, but our special variant
694 * of store_spr copies relevant fields into env->spr[SPR_LPCR].
695 * Similarily we filter unimplemented bits when storing into
696 * LPCR depending on the MMU version. This code can thus just
697 * use the LPCR "as-is".
700 /* 1. Handle real mode accesses */
701 if (((rwx
== 2) && (msr_ir
== 0)) || ((rwx
!= 2) && (msr_dr
== 0))) {
702 /* Translation is supposedly "off" */
703 /* In real mode the top 4 effective address bits are (mostly) ignored */
704 raddr
= eaddr
& 0x0FFFFFFFFFFFFFFFULL
;
706 /* In HV mode, add HRMOR if top EA bit is clear */
707 if (msr_hv
|| !env
->has_hv_mode
) {
708 if (!(eaddr
>> 63)) {
709 raddr
|= env
->spr
[SPR_HRMOR
];
712 /* Otherwise, check VPM for RMA vs VRMA */
713 if (env
->spr
[SPR_LPCR
] & LPCR_VPM0
) {
714 slb
= &env
->vrma_slb
;
716 goto skip_slb_search
;
718 /* Not much else to do here */
719 cs
->exception_index
= POWERPC_EXCP_MCHECK
;
722 } else if (raddr
< env
->rmls
) {
723 /* RMA. Check bounds in RMLS */
724 raddr
|= env
->spr
[SPR_RMOR
];
726 /* The access failed, generate the approriate interrupt */
728 ppc_hash64_set_isi(cs
, env
, 0x08000000);
734 ppc_hash64_set_dsi(cs
, env
, eaddr
, dsisr
);
739 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
, raddr
& TARGET_PAGE_MASK
,
740 PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
, mmu_idx
,
745 /* 2. Translation is on, so look up the SLB */
746 slb
= slb_lookup(cpu
, eaddr
);
749 cs
->exception_index
= POWERPC_EXCP_ISEG
;
752 cs
->exception_index
= POWERPC_EXCP_DSEG
;
754 env
->spr
[SPR_DAR
] = eaddr
;
761 /* 3. Check for segment level no-execute violation */
762 if ((rwx
== 2) && (slb
->vsid
& SLB_VSID_N
)) {
763 ppc_hash64_set_isi(cs
, env
, 0x10000000);
767 /* 4. Locate the PTE in the hash table */
768 pte_offset
= ppc_hash64_htab_lookup(cpu
, slb
, eaddr
, &pte
, &apshift
);
769 if (pte_offset
== -1) {
772 ppc_hash64_set_isi(cs
, env
, dsisr
);
777 ppc_hash64_set_dsi(cs
, env
, eaddr
, dsisr
);
781 qemu_log_mask(CPU_LOG_MMU
,
782 "found PTE at offset %08" HWADDR_PRIx
"\n", pte_offset
);
784 /* 5. Check access permissions */
786 pp_prot
= ppc_hash64_pte_prot(cpu
, slb
, pte
);
787 amr_prot
= ppc_hash64_amr_prot(cpu
, pte
);
788 prot
= pp_prot
& amr_prot
;
790 if ((need_prot
[rwx
] & ~prot
) != 0) {
791 /* Access right violation */
792 qemu_log_mask(CPU_LOG_MMU
, "PTE access rejected\n");
794 ppc_hash64_set_isi(cs
, env
, 0x08000000);
797 if (need_prot
[rwx
] & ~pp_prot
) {
803 if (need_prot
[rwx
] & ~amr_prot
) {
806 ppc_hash64_set_dsi(cs
, env
, eaddr
, dsisr
);
811 qemu_log_mask(CPU_LOG_MMU
, "PTE access granted !\n");
813 /* 6. Update PTE referenced and changed bits if necessary */
815 new_pte1
= pte
.pte1
| HPTE64_R_R
; /* set referenced bit */
817 new_pte1
|= HPTE64_R_C
; /* set changed (dirty) bit */
819 /* Treat the page as read-only for now, so that a later write
820 * will pass through this function again to set the C bit */
824 if (new_pte1
!= pte
.pte1
) {
825 ppc_hash64_store_hpte(cpu
, pte_offset
/ HASH_PTE_SIZE_64
,
829 /* 7. Determine the real address from the PTE */
831 raddr
= deposit64(pte
.pte1
& HPTE64_R_RPN
, 0, apshift
, eaddr
);
833 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
, raddr
& TARGET_PAGE_MASK
,
834 prot
, mmu_idx
, 1ULL << apshift
);
839 hwaddr
ppc_hash64_get_phys_page_debug(PowerPCCPU
*cpu
, target_ulong addr
)
841 CPUPPCState
*env
= &cpu
->env
;
843 hwaddr pte_offset
, raddr
;
844 ppc_hash_pte64_t pte
;
847 /* Handle real mode */
849 /* In real mode the top 4 effective address bits are ignored */
850 raddr
= addr
& 0x0FFFFFFFFFFFFFFFULL
;
852 /* In HV mode, add HRMOR if top EA bit is clear */
853 if ((msr_hv
|| !env
->has_hv_mode
) && !(addr
>> 63)) {
854 return raddr
| env
->spr
[SPR_HRMOR
];
857 /* Otherwise, check VPM for RMA vs VRMA */
858 if (env
->spr
[SPR_LPCR
] & LPCR_VPM0
) {
859 slb
= &env
->vrma_slb
;
863 } else if (raddr
< env
->rmls
) {
864 /* RMA. Check bounds in RMLS */
865 return raddr
| env
->spr
[SPR_RMOR
];
870 slb
= slb_lookup(cpu
, addr
);
876 pte_offset
= ppc_hash64_htab_lookup(cpu
, slb
, addr
, &pte
, &apshift
);
877 if (pte_offset
== -1) {
881 return deposit64(pte
.pte1
& HPTE64_R_RPN
, 0, apshift
, addr
)
885 void ppc_hash64_store_hpte(PowerPCCPU
*cpu
,
886 target_ulong pte_index
,
887 target_ulong pte0
, target_ulong pte1
)
889 CPUPPCState
*env
= &cpu
->env
;
891 if (env
->external_htab
== MMU_HASH64_KVM_MANAGED_HPT
) {
892 kvmppc_hash64_write_pte(env
, pte_index
, pte0
, pte1
);
896 pte_index
*= HASH_PTE_SIZE_64
;
897 if (env
->external_htab
) {
898 stq_p(env
->external_htab
+ pte_index
, pte0
);
899 stq_p(env
->external_htab
+ pte_index
+ HASH_PTE_SIZE_64
/ 2, pte1
);
901 stq_phys(CPU(cpu
)->as
, env
->htab_base
+ pte_index
, pte0
);
902 stq_phys(CPU(cpu
)->as
,
903 env
->htab_base
+ pte_index
+ HASH_PTE_SIZE_64
/ 2, pte1
);
907 void ppc_hash64_tlb_flush_hpte(PowerPCCPU
*cpu
,
908 target_ulong pte_index
,
909 target_ulong pte0
, target_ulong pte1
)
912 * XXX: given the fact that there are too many segments to
913 * invalidate, and we still don't have a tlb_flush_mask(env, n,
914 * mask) in QEMU, we just invalidate all TLBs
916 tlb_flush(CPU(cpu
), 1);
919 void ppc_hash64_update_rmls(CPUPPCState
*env
)
921 uint64_t lpcr
= env
->spr
[SPR_LPCR
];
924 * This is the full 4 bits encoding of POWER8. Previous
925 * CPUs only support a subset of these but the filtering
926 * is done when writing LPCR
928 switch ((lpcr
& LPCR_RMLS
) >> LPCR_RMLS_SHIFT
) {
930 env
->rmls
= 0x2000000ull
;
933 env
->rmls
= 0x4000000ull
;
935 case 0x7: /* 128MB */
936 env
->rmls
= 0x8000000ull
;
938 case 0x4: /* 256MB */
939 env
->rmls
= 0x10000000ull
;
942 env
->rmls
= 0x40000000ull
;
945 env
->rmls
= 0x400000000ull
;
948 /* What to do here ??? */
953 void ppc_hash64_update_vrma(CPUPPCState
*env
)
955 const struct ppc_one_seg_page_size
*sps
= NULL
;
956 target_ulong esid
, vsid
, lpcr
;
957 ppc_slb_t
*slb
= &env
->vrma_slb
;
962 slb
->esid
= slb
->vsid
= 0;
965 /* Is VRMA enabled ? */
966 lpcr
= env
->spr
[SPR_LPCR
];
967 if (!(lpcr
& LPCR_VPM0
)) {
971 /* Make one up. Mostly ignore the ESID which will not be
972 * needed for translation
974 vsid
= SLB_VSID_VRMA
;
975 vrmasd
= (lpcr
& LPCR_VRMASD
) >> LPCR_VRMASD_SHIFT
;
976 vsid
|= (vrmasd
<< 4) & (SLB_VSID_L
| SLB_VSID_LP
);
979 for (i
= 0; i
< PPC_PAGE_SIZES_MAX_SZ
; i
++) {
980 const struct ppc_one_seg_page_size
*sps1
= &env
->sps
.sps
[i
];
982 if (!sps1
->page_shift
) {
986 if ((vsid
& SLB_VSID_LLP_MASK
) == sps1
->slb_enc
) {
993 error_report("Bad page size encoding esid 0x"TARGET_FMT_lx
994 " vsid 0x"TARGET_FMT_lx
, esid
, vsid
);
1003 void helper_store_lpcr(CPUPPCState
*env
, target_ulong val
)
1007 /* Filter out bits */
1008 switch (env
->mmu_model
) {
1009 case POWERPC_MMU_64B
: /* 970 */
1013 if (val
& 0x8000000000000000ull
) {
1017 lpcr
|= (0x4ull
<< LPCR_RMLS_SHIFT
);
1019 if (val
& 0x4000000000000000ull
) {
1020 lpcr
|= (0x2ull
<< LPCR_RMLS_SHIFT
);
1022 if (val
& 0x2000000000000000ull
) {
1023 lpcr
|= (0x1ull
<< LPCR_RMLS_SHIFT
);
1025 env
->spr
[SPR_RMOR
] = ((lpcr
>> 41) & 0xffffull
) << 26;
1027 /* XXX We could also write LPID from HID4 here
1028 * but since we don't tag any translation on it
1029 * it doesn't actually matter
1031 /* XXX For proper emulation of 970 we also need
1032 * to dig HRMOR out of HID5
1035 case POWERPC_MMU_2_03
: /* P5p */
1036 lpcr
= val
& (LPCR_RMLS
| LPCR_ILE
|
1037 LPCR_LPES0
| LPCR_LPES1
|
1038 LPCR_RMI
| LPCR_HDICE
);
1040 case POWERPC_MMU_2_06
: /* P7 */
1041 lpcr
= val
& (LPCR_VPM0
| LPCR_VPM1
| LPCR_ISL
| LPCR_DPFD
|
1042 LPCR_VRMASD
| LPCR_RMLS
| LPCR_ILE
|
1043 LPCR_P7_PECE0
| LPCR_P7_PECE1
| LPCR_P7_PECE2
|
1044 LPCR_MER
| LPCR_TC
|
1045 LPCR_LPES0
| LPCR_LPES1
| LPCR_HDICE
);
1047 case POWERPC_MMU_2_07
: /* P8 */
1048 lpcr
= val
& (LPCR_VPM0
| LPCR_VPM1
| LPCR_ISL
| LPCR_KBV
|
1049 LPCR_DPFD
| LPCR_VRMASD
| LPCR_RMLS
| LPCR_ILE
|
1050 LPCR_AIL
| LPCR_ONL
| LPCR_P8_PECE0
| LPCR_P8_PECE1
|
1051 LPCR_P8_PECE2
| LPCR_P8_PECE3
| LPCR_P8_PECE4
|
1052 LPCR_MER
| LPCR_TC
| LPCR_LPES0
| LPCR_HDICE
);
1057 env
->spr
[SPR_LPCR
] = lpcr
;
1058 ppc_hash64_update_rmls(env
);
1059 ppc_hash64_update_vrma(env
);