target-ppc: mmu_ctx_t should not be a global type
[qemu/ar7.git] / target-ppc / mmu-hash64.c
blob3008be8ee9802e3e588e6b806a7c9a3ecbcd45ea
1 /*
2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 * Copyright (c) 2013 David Gibson, IBM Corporation
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 #include "cpu.h"
21 #include "helper.h"
22 #include "sysemu/kvm.h"
23 #include "kvm_ppc.h"
24 #include "mmu-hash64.h"
26 //#define DEBUG_MMU
27 //#define DEBUG_SLB
29 #ifdef DEBUG_MMU
30 # define LOG_MMU(...) qemu_log(__VA_ARGS__)
31 # define LOG_MMU_STATE(env) log_cpu_state((env), 0)
32 #else
33 # define LOG_MMU(...) do { } while (0)
34 # define LOG_MMU_STATE(...) do { } while (0)
35 #endif
37 #ifdef DEBUG_SLB
38 # define LOG_SLB(...) qemu_log(__VA_ARGS__)
39 #else
40 # define LOG_SLB(...) do { } while (0)
41 #endif
43 struct mmu_ctx_hash64 {
44 hwaddr raddr; /* Real address */
45 hwaddr eaddr; /* Effective address */
46 int prot; /* Protection bits */
47 hwaddr hash[2]; /* Pagetable hash values */
48 target_ulong ptem; /* Virtual segment ID | API */
49 int key; /* Access key */
50 int nx; /* Non-execute area */
54 * SLB handling
57 static ppc_slb_t *slb_lookup(CPUPPCState *env, target_ulong eaddr)
59 uint64_t esid_256M, esid_1T;
60 int n;
62 LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);
64 esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V;
65 esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V;
67 for (n = 0; n < env->slb_nr; n++) {
68 ppc_slb_t *slb = &env->slb[n];
70 LOG_SLB("%s: slot %d %016" PRIx64 " %016"
71 PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
72 /* We check for 1T matches on all MMUs here - if the MMU
73 * doesn't have 1T segment support, we will have prevented 1T
74 * entries from being inserted in the slbmte code. */
75 if (((slb->esid == esid_256M) &&
76 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
77 || ((slb->esid == esid_1T) &&
78 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
79 return slb;
83 return NULL;
86 void dump_slb(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
88 int i;
89 uint64_t slbe, slbv;
91 cpu_synchronize_state(env);
93 cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
94 for (i = 0; i < env->slb_nr; i++) {
95 slbe = env->slb[i].esid;
96 slbv = env->slb[i].vsid;
97 if (slbe == 0 && slbv == 0) {
98 continue;
100 cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
101 i, slbe, slbv);
105 void helper_slbia(CPUPPCState *env)
107 int n, do_invalidate;
109 do_invalidate = 0;
110 /* XXX: Warning: slbia never invalidates the first segment */
111 for (n = 1; n < env->slb_nr; n++) {
112 ppc_slb_t *slb = &env->slb[n];
114 if (slb->esid & SLB_ESID_V) {
115 slb->esid &= ~SLB_ESID_V;
116 /* XXX: given the fact that segment size is 256 MB or 1TB,
117 * and we still don't have a tlb_flush_mask(env, n, mask)
118 * in QEMU, we just invalidate all TLBs
120 do_invalidate = 1;
123 if (do_invalidate) {
124 tlb_flush(env, 1);
128 void helper_slbie(CPUPPCState *env, target_ulong addr)
130 ppc_slb_t *slb;
132 slb = slb_lookup(env, addr);
133 if (!slb) {
134 return;
137 if (slb->esid & SLB_ESID_V) {
138 slb->esid &= ~SLB_ESID_V;
140 /* XXX: given the fact that segment size is 256 MB or 1TB,
141 * and we still don't have a tlb_flush_mask(env, n, mask)
142 * in QEMU, we just invalidate all TLBs
144 tlb_flush(env, 1);
148 int ppc_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
150 int slot = rb & 0xfff;
151 ppc_slb_t *slb = &env->slb[slot];
153 if (rb & (0x1000 - env->slb_nr)) {
154 return -1; /* Reserved bits set or slot too high */
156 if (rs & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
157 return -1; /* Bad segment size */
159 if ((rs & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
160 return -1; /* 1T segment on MMU that doesn't support it */
163 /* Mask out the slot number as we store the entry */
164 slb->esid = rb & (SLB_ESID_ESID | SLB_ESID_V);
165 slb->vsid = rs;
167 LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
168 " %016" PRIx64 "\n", __func__, slot, rb, rs,
169 slb->esid, slb->vsid);
171 return 0;
174 static int ppc_load_slb_esid(CPUPPCState *env, target_ulong rb,
175 target_ulong *rt)
177 int slot = rb & 0xfff;
178 ppc_slb_t *slb = &env->slb[slot];
180 if (slot >= env->slb_nr) {
181 return -1;
184 *rt = slb->esid;
185 return 0;
188 static int ppc_load_slb_vsid(CPUPPCState *env, target_ulong rb,
189 target_ulong *rt)
191 int slot = rb & 0xfff;
192 ppc_slb_t *slb = &env->slb[slot];
194 if (slot >= env->slb_nr) {
195 return -1;
198 *rt = slb->vsid;
199 return 0;
202 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
204 if (ppc_store_slb(env, rb, rs) < 0) {
205 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
206 POWERPC_EXCP_INVAL);
210 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
212 target_ulong rt = 0;
214 if (ppc_load_slb_esid(env, rb, &rt) < 0) {
215 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
216 POWERPC_EXCP_INVAL);
218 return rt;
221 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
223 target_ulong rt = 0;
225 if (ppc_load_slb_vsid(env, rb, &rt) < 0) {
226 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
227 POWERPC_EXCP_INVAL);
229 return rt;
233 * 64-bit hash table MMU handling
236 #define PTE64_PTEM_MASK 0xFFFFFFFFFFFFFF80ULL
237 #define PTE64_CHECK_MASK (TARGET_PAGE_MASK | 0x7F)
239 static int ppc_hash64_pp_check(int key, int pp, int nx)
241 int access;
243 /* Compute access rights */
244 /* When pp is 4, 5 or 7, the result is undefined. Set it to noaccess */
245 access = 0;
246 if (key == 0) {
247 switch (pp) {
248 case 0x0:
249 case 0x1:
250 case 0x2:
251 access |= PAGE_WRITE;
252 /* No break here */
253 case 0x3:
254 case 0x6:
255 access |= PAGE_READ;
256 break;
258 } else {
259 switch (pp) {
260 case 0x0:
261 case 0x6:
262 access = 0;
263 break;
264 case 0x1:
265 case 0x3:
266 access = PAGE_READ;
267 break;
268 case 0x2:
269 access = PAGE_READ | PAGE_WRITE;
270 break;
273 if (nx == 0) {
274 access |= PAGE_EXEC;
277 return access;
280 static int ppc_hash64_check_prot(int prot, int rw, int access_type)
282 int ret;
284 if (access_type == ACCESS_CODE) {
285 if (prot & PAGE_EXEC) {
286 ret = 0;
287 } else {
288 ret = -2;
290 } else if (rw) {
291 if (prot & PAGE_WRITE) {
292 ret = 0;
293 } else {
294 ret = -2;
296 } else {
297 if (prot & PAGE_READ) {
298 ret = 0;
299 } else {
300 ret = -2;
304 return ret;
307 static inline int pte64_is_valid(target_ulong pte0)
309 return pte0 & 0x0000000000000001ULL ? 1 : 0;
312 static int pte64_check(struct mmu_ctx_hash64 *ctx, target_ulong pte0,
313 target_ulong pte1, int h, int rw, int type)
315 target_ulong ptem, mmask;
316 int access, ret, pteh, ptev, pp;
318 ret = -1;
319 /* Check validity and table match */
320 ptev = pte64_is_valid(pte0);
321 pteh = (pte0 >> 1) & 1;
322 if (ptev && h == pteh) {
323 /* Check vsid & api */
324 ptem = pte0 & PTE64_PTEM_MASK;
325 mmask = PTE64_CHECK_MASK;
326 pp = (pte1 & 0x00000003) | ((pte1 >> 61) & 0x00000004);
327 ctx->nx = (pte1 >> 2) & 1; /* No execute bit */
328 ctx->nx |= (pte1 >> 3) & 1; /* Guarded bit */
329 if (ptem == ctx->ptem) {
330 if (ctx->raddr != (hwaddr)-1ULL) {
331 /* all matches should have equal RPN, WIMG & PP */
332 if ((ctx->raddr & mmask) != (pte1 & mmask)) {
333 qemu_log("Bad RPN/WIMG/PP\n");
334 return -3;
337 /* Compute access rights */
338 access = ppc_hash64_pp_check(ctx->key, pp, ctx->nx);
339 /* Keep the matching PTE informations */
340 ctx->raddr = pte1;
341 ctx->prot = access;
342 ret = ppc_hash64_check_prot(ctx->prot, rw, type);
343 if (ret == 0) {
344 /* Access granted */
345 LOG_MMU("PTE access granted !\n");
346 } else {
347 /* Access right violation */
348 LOG_MMU("PTE access rejected\n");
353 return ret;
356 static int ppc_hash64_pte_update_flags(struct mmu_ctx_hash64 *ctx,
357 target_ulong *pte1p,
358 int ret, int rw)
360 int store = 0;
362 /* Update page flags */
363 if (!(*pte1p & 0x00000100)) {
364 /* Update accessed flag */
365 *pte1p |= 0x00000100;
366 store = 1;
368 if (!(*pte1p & 0x00000080)) {
369 if (rw == 1 && ret == 0) {
370 /* Update changed flag */
371 *pte1p |= 0x00000080;
372 store = 1;
373 } else {
374 /* Force page fault for first write access */
375 ctx->prot &= ~PAGE_WRITE;
379 return store;
382 /* PTE table lookup */
383 static int find_pte64(CPUPPCState *env, struct mmu_ctx_hash64 *ctx, int h,
384 int rw, int type, int target_page_bits)
386 hwaddr pteg_off;
387 target_ulong pte0, pte1;
388 int i, good = -1;
389 int ret, r;
391 ret = -1; /* No entry found */
392 pteg_off = (ctx->hash[h] * HASH_PTE_SIZE_64 * 8) & env->htab_mask;
393 for (i = 0; i < 8; i++) {
394 if (env->external_htab) {
395 pte0 = ldq_p(env->external_htab + pteg_off + (i * 16));
396 pte1 = ldq_p(env->external_htab + pteg_off + (i * 16) + 8);
397 } else {
398 pte0 = ldq_phys(env->htab_base + pteg_off + (i * 16));
399 pte1 = ldq_phys(env->htab_base + pteg_off + (i * 16) + 8);
402 r = pte64_check(ctx, pte0, pte1, h, rw, type);
403 LOG_MMU("Load pte from %016" HWADDR_PRIx " => " TARGET_FMT_lx " "
404 TARGET_FMT_lx " %d %d %d " TARGET_FMT_lx "\n",
405 pteg_off + (i * 16), pte0, pte1, (int)(pte0 & 1), h,
406 (int)((pte0 >> 1) & 1), ctx->ptem);
407 switch (r) {
408 case -3:
409 /* PTE inconsistency */
410 return -1;
411 case -2:
412 /* Access violation */
413 ret = -2;
414 good = i;
415 break;
416 case -1:
417 default:
418 /* No PTE match */
419 break;
420 case 0:
421 /* access granted */
422 /* XXX: we should go on looping to check all PTEs consistency
423 * but if we can speed-up the whole thing as the
424 * result would be undefined if PTEs are not consistent.
426 ret = 0;
427 good = i;
428 goto done;
431 if (good != -1) {
432 done:
433 LOG_MMU("found PTE at addr %08" HWADDR_PRIx " prot=%01x ret=%d\n",
434 ctx->raddr, ctx->prot, ret);
435 /* Update page flags */
436 pte1 = ctx->raddr;
437 if (ppc_hash64_pte_update_flags(ctx, &pte1, ret, rw) == 1) {
438 if (env->external_htab) {
439 stq_p(env->external_htab + pteg_off + (good * 16) + 8,
440 pte1);
441 } else {
442 stq_phys_notdirty(env->htab_base + pteg_off +
443 (good * 16) + 8, pte1);
448 /* We have a TLB that saves 4K pages, so let's
449 * split a huge page to 4k chunks */
450 if (target_page_bits != TARGET_PAGE_BITS) {
451 ctx->raddr |= (ctx->eaddr & ((1 << target_page_bits) - 1))
452 & TARGET_PAGE_MASK;
454 return ret;
457 static int get_segment64(CPUPPCState *env, struct mmu_ctx_hash64 *ctx,
458 target_ulong eaddr, int rw, int type)
460 hwaddr hash;
461 target_ulong vsid;
462 int pr, target_page_bits;
463 int ret, ret2;
465 pr = msr_pr;
466 ctx->eaddr = eaddr;
467 ppc_slb_t *slb;
468 target_ulong pageaddr;
469 int segment_bits;
471 LOG_MMU("Check SLBs\n");
472 slb = slb_lookup(env, eaddr);
473 if (!slb) {
474 return -5;
477 if (slb->vsid & SLB_VSID_B) {
478 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
479 segment_bits = 40;
480 } else {
481 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
482 segment_bits = 28;
485 target_page_bits = (slb->vsid & SLB_VSID_L)
486 ? TARGET_PAGE_BITS_16M : TARGET_PAGE_BITS;
487 ctx->key = !!(pr ? (slb->vsid & SLB_VSID_KP)
488 : (slb->vsid & SLB_VSID_KS));
489 ctx->nx = !!(slb->vsid & SLB_VSID_N);
491 pageaddr = eaddr & ((1ULL << segment_bits)
492 - (1ULL << target_page_bits));
493 if (slb->vsid & SLB_VSID_B) {
494 hash = vsid ^ (vsid << 25) ^ (pageaddr >> target_page_bits);
495 } else {
496 hash = vsid ^ (pageaddr >> target_page_bits);
498 /* Only 5 bits of the page index are used in the AVPN */
499 ctx->ptem = (slb->vsid & SLB_VSID_PTEM) |
500 ((pageaddr >> 16) & ((1ULL << segment_bits) - 0x80));
502 LOG_MMU("pte segment: key=%d nx %d vsid " TARGET_FMT_lx "\n",
503 ctx->key, ctx->nx, vsid);
504 ret = -1;
506 /* Check if instruction fetch is allowed, if needed */
507 if (type != ACCESS_CODE || ctx->nx == 0) {
508 /* Page address translation */
509 LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
510 " hash " TARGET_FMT_plx "\n",
511 env->htab_base, env->htab_mask, hash);
512 ctx->hash[0] = hash;
513 ctx->hash[1] = ~hash;
515 /* Initialize real address with an invalid value */
516 ctx->raddr = (hwaddr)-1ULL;
517 LOG_MMU("0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
518 " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
519 " hash=" TARGET_FMT_plx "\n",
520 env->htab_base, env->htab_mask, vsid, ctx->ptem,
521 ctx->hash[0]);
522 /* Primary table lookup */
523 ret = find_pte64(env, ctx, 0, rw, type, target_page_bits);
524 if (ret < 0) {
525 /* Secondary table lookup */
526 LOG_MMU("1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
527 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
528 " hash=" TARGET_FMT_plx "\n", env->htab_base,
529 env->htab_mask, vsid, ctx->ptem, ctx->hash[1]);
530 ret2 = find_pte64(env, ctx, 1, rw, type, target_page_bits);
531 if (ret2 != -1) {
532 ret = ret2;
535 } else {
536 LOG_MMU("No access allowed\n");
537 ret = -3;
540 return ret;
543 static int ppc_hash64_get_physical_address(CPUPPCState *env,
544 struct mmu_ctx_hash64 *ctx,
545 target_ulong eaddr, int rw,
546 int access_type)
548 bool real_mode = (access_type == ACCESS_CODE && msr_ir == 0)
549 || (access_type != ACCESS_CODE && msr_dr == 0);
551 if (real_mode) {
552 ctx->raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
553 ctx->prot = PAGE_READ | PAGE_EXEC | PAGE_WRITE;
554 return 0;
555 } else {
556 return get_segment64(env, ctx, eaddr, rw, access_type);
560 hwaddr ppc_hash64_get_phys_page_debug(CPUPPCState *env, target_ulong addr)
562 struct mmu_ctx_hash64 ctx;
564 if (unlikely(ppc_hash64_get_physical_address(env, &ctx, addr, 0, ACCESS_INT)
565 != 0)) {
566 return -1;
569 return ctx.raddr & TARGET_PAGE_MASK;
572 int ppc_hash64_handle_mmu_fault(CPUPPCState *env, target_ulong address, int rw,
573 int mmu_idx)
575 struct mmu_ctx_hash64 ctx;
576 int access_type;
577 int ret = 0;
579 if (rw == 2) {
580 /* code access */
581 rw = 0;
582 access_type = ACCESS_CODE;
583 } else {
584 /* data access */
585 access_type = env->access_type;
587 ret = ppc_hash64_get_physical_address(env, &ctx, address, rw, access_type);
588 if (ret == 0) {
589 tlb_set_page(env, address & TARGET_PAGE_MASK,
590 ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
591 mmu_idx, TARGET_PAGE_SIZE);
592 ret = 0;
593 } else if (ret < 0) {
594 LOG_MMU_STATE(env);
595 if (access_type == ACCESS_CODE) {
596 switch (ret) {
597 case -1:
598 env->exception_index = POWERPC_EXCP_ISI;
599 env->error_code = 0x40000000;
600 break;
601 case -2:
602 /* Access rights violation */
603 env->exception_index = POWERPC_EXCP_ISI;
604 env->error_code = 0x08000000;
605 break;
606 case -3:
607 /* No execute protection violation */
608 env->exception_index = POWERPC_EXCP_ISI;
609 env->error_code = 0x10000000;
610 break;
611 case -5:
612 /* No match in segment table */
613 env->exception_index = POWERPC_EXCP_ISEG;
614 env->error_code = 0;
615 break;
617 } else {
618 switch (ret) {
619 case -1:
620 /* No matches in page tables or TLB */
621 env->exception_index = POWERPC_EXCP_DSI;
622 env->error_code = 0;
623 env->spr[SPR_DAR] = address;
624 if (rw == 1) {
625 env->spr[SPR_DSISR] = 0x42000000;
626 } else {
627 env->spr[SPR_DSISR] = 0x40000000;
629 break;
630 case -2:
631 /* Access rights violation */
632 env->exception_index = POWERPC_EXCP_DSI;
633 env->error_code = 0;
634 env->spr[SPR_DAR] = address;
635 if (rw == 1) {
636 env->spr[SPR_DSISR] = 0x0A000000;
637 } else {
638 env->spr[SPR_DSISR] = 0x08000000;
640 break;
641 case -5:
642 /* No match in segment table */
643 env->exception_index = POWERPC_EXCP_DSEG;
644 env->error_code = 0;
645 env->spr[SPR_DAR] = address;
646 break;
649 #if 0
650 printf("%s: set exception to %d %02x\n", __func__,
651 env->exception, env->error_code);
652 #endif
653 ret = 1;
656 return ret;