2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 * Copyright (c) 2013 David Gibson, IBM Corporation
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
22 #include "exec/helper-proto.h"
23 #include "qemu/error-report.h"
24 #include "sysemu/kvm.h"
25 #include "qemu/error-report.h"
27 #include "mmu-hash64.h"
32 # define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
34 # define LOG_SLB(...) do { } while (0)
38 * Used to indicate whether we have allocated htab in the
41 bool kvmppc_kern_htab
;
46 static ppc_slb_t
*slb_lookup(PowerPCCPU
*cpu
, target_ulong eaddr
)
48 CPUPPCState
*env
= &cpu
->env
;
49 uint64_t esid_256M
, esid_1T
;
52 LOG_SLB("%s: eaddr " TARGET_FMT_lx
"\n", __func__
, eaddr
);
54 esid_256M
= (eaddr
& SEGMENT_MASK_256M
) | SLB_ESID_V
;
55 esid_1T
= (eaddr
& SEGMENT_MASK_1T
) | SLB_ESID_V
;
57 for (n
= 0; n
< env
->slb_nr
; n
++) {
58 ppc_slb_t
*slb
= &env
->slb
[n
];
60 LOG_SLB("%s: slot %d %016" PRIx64
" %016"
61 PRIx64
"\n", __func__
, n
, slb
->esid
, slb
->vsid
);
62 /* We check for 1T matches on all MMUs here - if the MMU
63 * doesn't have 1T segment support, we will have prevented 1T
64 * entries from being inserted in the slbmte code. */
65 if (((slb
->esid
== esid_256M
) &&
66 ((slb
->vsid
& SLB_VSID_B
) == SLB_VSID_B_256M
))
67 || ((slb
->esid
== esid_1T
) &&
68 ((slb
->vsid
& SLB_VSID_B
) == SLB_VSID_B_1T
))) {
76 void dump_slb(FILE *f
, fprintf_function cpu_fprintf
, PowerPCCPU
*cpu
)
78 CPUPPCState
*env
= &cpu
->env
;
82 cpu_synchronize_state(CPU(cpu
));
84 cpu_fprintf(f
, "SLB\tESID\t\t\tVSID\n");
85 for (i
= 0; i
< env
->slb_nr
; i
++) {
86 slbe
= env
->slb
[i
].esid
;
87 slbv
= env
->slb
[i
].vsid
;
88 if (slbe
== 0 && slbv
== 0) {
91 cpu_fprintf(f
, "%d\t0x%016" PRIx64
"\t0x%016" PRIx64
"\n",
96 void helper_slbia(CPUPPCState
*env
)
98 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
102 /* XXX: Warning: slbia never invalidates the first segment */
103 for (n
= 1; n
< env
->slb_nr
; n
++) {
104 ppc_slb_t
*slb
= &env
->slb
[n
];
106 if (slb
->esid
& SLB_ESID_V
) {
107 slb
->esid
&= ~SLB_ESID_V
;
108 /* XXX: given the fact that segment size is 256 MB or 1TB,
109 * and we still don't have a tlb_flush_mask(env, n, mask)
110 * in QEMU, we just invalidate all TLBs
116 tlb_flush(CPU(cpu
), 1);
120 void helper_slbie(CPUPPCState
*env
, target_ulong addr
)
122 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
125 slb
= slb_lookup(cpu
, addr
);
130 if (slb
->esid
& SLB_ESID_V
) {
131 slb
->esid
&= ~SLB_ESID_V
;
133 /* XXX: given the fact that segment size is 256 MB or 1TB,
134 * and we still don't have a tlb_flush_mask(env, n, mask)
135 * in QEMU, we just invalidate all TLBs
137 tlb_flush(CPU(cpu
), 1);
141 int ppc_store_slb(PowerPCCPU
*cpu
, target_ulong slot
,
142 target_ulong esid
, target_ulong vsid
)
144 CPUPPCState
*env
= &cpu
->env
;
145 ppc_slb_t
*slb
= &env
->slb
[slot
];
146 const struct ppc_one_seg_page_size
*sps
= NULL
;
149 if (slot
>= env
->slb_nr
) {
150 return -1; /* Bad slot number */
152 if (esid
& ~(SLB_ESID_ESID
| SLB_ESID_V
)) {
153 return -1; /* Reserved bits set */
155 if (vsid
& (SLB_VSID_B
& ~SLB_VSID_B_1T
)) {
156 return -1; /* Bad segment size */
158 if ((vsid
& SLB_VSID_B
) && !(env
->mmu_model
& POWERPC_MMU_1TSEG
)) {
159 return -1; /* 1T segment on MMU that doesn't support it */
162 for (i
= 0; i
< PPC_PAGE_SIZES_MAX_SZ
; i
++) {
163 const struct ppc_one_seg_page_size
*sps1
= &env
->sps
.sps
[i
];
165 if (!sps1
->page_shift
) {
169 if ((vsid
& SLB_VSID_LLP_MASK
) == sps1
->slb_enc
) {
176 error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu
177 " esid 0x"TARGET_FMT_lx
" vsid 0x"TARGET_FMT_lx
,
186 LOG_SLB("%s: %d " TARGET_FMT_lx
" - " TARGET_FMT_lx
" => %016" PRIx64
187 " %016" PRIx64
"\n", __func__
, slot
, esid
, vsid
,
188 slb
->esid
, slb
->vsid
);
193 static int ppc_load_slb_esid(PowerPCCPU
*cpu
, target_ulong rb
,
196 CPUPPCState
*env
= &cpu
->env
;
197 int slot
= rb
& 0xfff;
198 ppc_slb_t
*slb
= &env
->slb
[slot
];
200 if (slot
>= env
->slb_nr
) {
208 static int ppc_load_slb_vsid(PowerPCCPU
*cpu
, target_ulong rb
,
211 CPUPPCState
*env
= &cpu
->env
;
212 int slot
= rb
& 0xfff;
213 ppc_slb_t
*slb
= &env
->slb
[slot
];
215 if (slot
>= env
->slb_nr
) {
223 void helper_store_slb(CPUPPCState
*env
, target_ulong rb
, target_ulong rs
)
225 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
227 if (ppc_store_slb(cpu
, rb
& 0xfff, rb
& ~0xfffULL
, rs
) < 0) {
228 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
233 target_ulong
helper_load_slb_esid(CPUPPCState
*env
, target_ulong rb
)
235 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
238 if (ppc_load_slb_esid(cpu
, rb
, &rt
) < 0) {
239 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
245 target_ulong
helper_load_slb_vsid(CPUPPCState
*env
, target_ulong rb
)
247 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
250 if (ppc_load_slb_vsid(cpu
, rb
, &rt
) < 0) {
251 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
258 * 64-bit hash table MMU handling
261 static int ppc_hash64_pte_prot(PowerPCCPU
*cpu
,
262 ppc_slb_t
*slb
, ppc_hash_pte64_t pte
)
264 CPUPPCState
*env
= &cpu
->env
;
266 /* Some pp bit combinations have undefined behaviour, so default
267 * to no access in those cases */
270 key
= !!(msr_pr
? (slb
->vsid
& SLB_VSID_KP
)
271 : (slb
->vsid
& SLB_VSID_KS
));
272 pp
= (pte
.pte1
& HPTE64_R_PP
) | ((pte
.pte1
& HPTE64_R_PP0
) >> 61);
279 prot
= PAGE_READ
| PAGE_WRITE
;
300 prot
= PAGE_READ
| PAGE_WRITE
;
305 /* No execute if either noexec or guarded bits set */
306 if (!(pte
.pte1
& HPTE64_R_N
) || (pte
.pte1
& HPTE64_R_G
)
307 || (slb
->vsid
& SLB_VSID_N
)) {
314 static int ppc_hash64_amr_prot(PowerPCCPU
*cpu
, ppc_hash_pte64_t pte
)
316 CPUPPCState
*env
= &cpu
->env
;
318 int prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
320 /* Only recent MMUs implement Virtual Page Class Key Protection */
321 if (!(env
->mmu_model
& POWERPC_MMU_AMR
)) {
325 key
= HPTE64_R_KEY(pte
.pte1
);
326 amrbits
= (env
->spr
[SPR_AMR
] >> 2*(31 - key
)) & 0x3;
328 /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */
329 /* env->spr[SPR_AMR]); */
332 * A store is permitted if the AMR bit is 0. Remove write
333 * protection if it is set.
339 * A load is permitted if the AMR bit is 0. Remove read
340 * protection if it is set.
349 uint64_t ppc_hash64_start_access(PowerPCCPU
*cpu
, target_ulong pte_index
)
354 pte_offset
= pte_index
* HASH_PTE_SIZE_64
;
355 if (kvmppc_kern_htab
) {
357 * HTAB is controlled by KVM. Fetch the PTEG into a new buffer.
359 token
= kvmppc_hash64_read_pteg(cpu
, pte_index
);
364 * pteg read failed, even though we have allocated htab via
370 * HTAB is controlled by QEMU. Just point to the internally
373 if (cpu
->env
.external_htab
) {
374 token
= (uint64_t)(uintptr_t) cpu
->env
.external_htab
+ pte_offset
;
375 } else if (cpu
->env
.htab_base
) {
376 token
= cpu
->env
.htab_base
+ pte_offset
;
381 void ppc_hash64_stop_access(uint64_t token
)
383 if (kvmppc_kern_htab
) {
384 kvmppc_hash64_free_pteg(token
);
388 static hwaddr
ppc_hash64_pteg_search(PowerPCCPU
*cpu
, hwaddr hash
,
389 bool secondary
, target_ulong ptem
,
390 ppc_hash_pte64_t
*pte
)
392 CPUPPCState
*env
= &cpu
->env
;
395 target_ulong pte0
, pte1
;
396 target_ulong pte_index
;
398 pte_index
= (hash
& env
->htab_mask
) * HPTES_PER_GROUP
;
399 token
= ppc_hash64_start_access(cpu
, pte_index
);
403 for (i
= 0; i
< HPTES_PER_GROUP
; i
++) {
404 pte0
= ppc_hash64_load_hpte0(cpu
, token
, i
);
405 pte1
= ppc_hash64_load_hpte1(cpu
, token
, i
);
407 if ((pte0
& HPTE64_V_VALID
)
408 && (secondary
== !!(pte0
& HPTE64_V_SECONDARY
))
409 && HPTE64_V_COMPARE(pte0
, ptem
)) {
412 ppc_hash64_stop_access(token
);
413 return (pte_index
+ i
) * HASH_PTE_SIZE_64
;
416 ppc_hash64_stop_access(token
);
418 * We didn't find a valid entry.
423 static hwaddr
ppc_hash64_htab_lookup(PowerPCCPU
*cpu
,
424 ppc_slb_t
*slb
, target_ulong eaddr
,
425 ppc_hash_pte64_t
*pte
)
427 CPUPPCState
*env
= &cpu
->env
;
430 uint64_t vsid
, epnmask
, epn
, ptem
;
432 /* The SLB store path should prevent any bad page size encodings
433 * getting in there, so: */
436 epnmask
= ~((1ULL << slb
->sps
->page_shift
) - 1);
438 if (slb
->vsid
& SLB_VSID_B
) {
440 vsid
= (slb
->vsid
& SLB_VSID_VSID
) >> SLB_VSID_SHIFT_1T
;
441 epn
= (eaddr
& ~SEGMENT_MASK_1T
) & epnmask
;
442 hash
= vsid
^ (vsid
<< 25) ^ (epn
>> slb
->sps
->page_shift
);
445 vsid
= (slb
->vsid
& SLB_VSID_VSID
) >> SLB_VSID_SHIFT
;
446 epn
= (eaddr
& ~SEGMENT_MASK_256M
) & epnmask
;
447 hash
= vsid
^ (epn
>> slb
->sps
->page_shift
);
449 ptem
= (slb
->vsid
& SLB_VSID_PTEM
) | ((epn
>> 16) & HPTE64_V_AVPN
);
451 /* Page address translation */
452 qemu_log_mask(CPU_LOG_MMU
,
453 "htab_base " TARGET_FMT_plx
" htab_mask " TARGET_FMT_plx
454 " hash " TARGET_FMT_plx
"\n",
455 env
->htab_base
, env
->htab_mask
, hash
);
457 /* Primary PTEG lookup */
458 qemu_log_mask(CPU_LOG_MMU
,
459 "0 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
460 " vsid=" TARGET_FMT_lx
" ptem=" TARGET_FMT_lx
461 " hash=" TARGET_FMT_plx
"\n",
462 env
->htab_base
, env
->htab_mask
, vsid
, ptem
, hash
);
463 pte_offset
= ppc_hash64_pteg_search(cpu
, hash
, 0, ptem
, pte
);
465 if (pte_offset
== -1) {
466 /* Secondary PTEG lookup */
467 qemu_log_mask(CPU_LOG_MMU
,
468 "1 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
469 " vsid=" TARGET_FMT_lx
" api=" TARGET_FMT_lx
470 " hash=" TARGET_FMT_plx
"\n", env
->htab_base
,
471 env
->htab_mask
, vsid
, ptem
, ~hash
);
473 pte_offset
= ppc_hash64_pteg_search(cpu
, ~hash
, 1, ptem
, pte
);
479 static unsigned hpte_page_shift(const struct ppc_one_seg_page_size
*sps
,
480 uint64_t pte0
, uint64_t pte1
)
484 if (!(pte0
& HPTE64_V_LARGE
)) {
485 if (sps
->page_shift
!= 12) {
486 /* 4kiB page in a non 4kiB segment */
489 /* Normal 4kiB page */
493 for (i
= 0; i
< PPC_PAGE_SIZES_MAX_SZ
; i
++) {
494 const struct ppc_one_page_size
*ps
= &sps
->enc
[i
];
497 if (!ps
->page_shift
) {
501 if (ps
->page_shift
== 12) {
502 /* L bit is set so this can't be a 4kiB page */
506 mask
= ((1ULL << ps
->page_shift
) - 1) & HPTE64_R_RPN
;
508 if ((pte1
& mask
) == (ps
->pte_enc
<< HPTE64_R_RPN_SHIFT
)) {
509 return ps
->page_shift
;
513 return 0; /* Bad page size encoding */
516 int ppc_hash64_handle_mmu_fault(PowerPCCPU
*cpu
, target_ulong eaddr
,
517 int rwx
, int mmu_idx
)
519 CPUState
*cs
= CPU(cpu
);
520 CPUPPCState
*env
= &cpu
->env
;
524 ppc_hash_pte64_t pte
;
525 int pp_prot
, amr_prot
, prot
;
527 const int need_prot
[] = {PAGE_READ
, PAGE_WRITE
, PAGE_EXEC
};
530 assert((rwx
== 0) || (rwx
== 1) || (rwx
== 2));
532 /* 1. Handle real mode accesses */
533 if (((rwx
== 2) && (msr_ir
== 0)) || ((rwx
!= 2) && (msr_dr
== 0))) {
534 /* Translation is off */
535 /* In real mode the top 4 effective address bits are ignored */
536 raddr
= eaddr
& 0x0FFFFFFFFFFFFFFFULL
;
537 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
, raddr
& TARGET_PAGE_MASK
,
538 PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
, mmu_idx
,
543 /* 2. Translation is on, so look up the SLB */
544 slb
= slb_lookup(cpu
, eaddr
);
548 cs
->exception_index
= POWERPC_EXCP_ISEG
;
551 cs
->exception_index
= POWERPC_EXCP_DSEG
;
553 env
->spr
[SPR_DAR
] = eaddr
;
558 /* 3. Check for segment level no-execute violation */
559 if ((rwx
== 2) && (slb
->vsid
& SLB_VSID_N
)) {
560 cs
->exception_index
= POWERPC_EXCP_ISI
;
561 env
->error_code
= 0x10000000;
565 /* 4. Locate the PTE in the hash table */
566 pte_offset
= ppc_hash64_htab_lookup(cpu
, slb
, eaddr
, &pte
);
567 if (pte_offset
== -1) {
569 cs
->exception_index
= POWERPC_EXCP_ISI
;
570 env
->error_code
= 0x40000000;
572 cs
->exception_index
= POWERPC_EXCP_DSI
;
574 env
->spr
[SPR_DAR
] = eaddr
;
576 env
->spr
[SPR_DSISR
] = 0x42000000;
578 env
->spr
[SPR_DSISR
] = 0x40000000;
583 qemu_log_mask(CPU_LOG_MMU
,
584 "found PTE at offset %08" HWADDR_PRIx
"\n", pte_offset
);
586 /* Validate page size encoding */
587 apshift
= hpte_page_shift(slb
->sps
, pte
.pte0
, pte
.pte1
);
589 error_report("Bad page size encoding in HPTE 0x%"PRIx64
" - 0x%"PRIx64
590 " @ 0x%"HWADDR_PRIx
, pte
.pte0
, pte
.pte1
, pte_offset
);
591 /* Not entirely sure what the right action here, but machine
592 * check seems reasonable */
593 cs
->exception_index
= POWERPC_EXCP_MCHECK
;
598 /* 5. Check access permissions */
600 pp_prot
= ppc_hash64_pte_prot(cpu
, slb
, pte
);
601 amr_prot
= ppc_hash64_amr_prot(cpu
, pte
);
602 prot
= pp_prot
& amr_prot
;
604 if ((need_prot
[rwx
] & ~prot
) != 0) {
605 /* Access right violation */
606 qemu_log_mask(CPU_LOG_MMU
, "PTE access rejected\n");
608 cs
->exception_index
= POWERPC_EXCP_ISI
;
609 env
->error_code
= 0x08000000;
611 target_ulong dsisr
= 0;
613 cs
->exception_index
= POWERPC_EXCP_DSI
;
615 env
->spr
[SPR_DAR
] = eaddr
;
616 if (need_prot
[rwx
] & ~pp_prot
) {
622 if (need_prot
[rwx
] & ~amr_prot
) {
625 env
->spr
[SPR_DSISR
] = dsisr
;
630 qemu_log_mask(CPU_LOG_MMU
, "PTE access granted !\n");
632 /* 6. Update PTE referenced and changed bits if necessary */
634 new_pte1
= pte
.pte1
| HPTE64_R_R
; /* set referenced bit */
636 new_pte1
|= HPTE64_R_C
; /* set changed (dirty) bit */
638 /* Treat the page as read-only for now, so that a later write
639 * will pass through this function again to set the C bit */
643 if (new_pte1
!= pte
.pte1
) {
644 ppc_hash64_store_hpte(cpu
, pte_offset
/ HASH_PTE_SIZE_64
,
648 /* 7. Determine the real address from the PTE */
650 raddr
= deposit64(pte
.pte1
& HPTE64_R_RPN
, 0, apshift
, eaddr
);
652 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
, raddr
& TARGET_PAGE_MASK
,
653 prot
, mmu_idx
, 1ULL << apshift
);
658 hwaddr
ppc_hash64_get_phys_page_debug(PowerPCCPU
*cpu
, target_ulong addr
)
660 CPUPPCState
*env
= &cpu
->env
;
663 ppc_hash_pte64_t pte
;
667 /* In real mode the top 4 effective address bits are ignored */
668 return addr
& 0x0FFFFFFFFFFFFFFFULL
;
671 slb
= slb_lookup(cpu
, addr
);
676 pte_offset
= ppc_hash64_htab_lookup(cpu
, slb
, addr
, &pte
);
677 if (pte_offset
== -1) {
681 apshift
= hpte_page_shift(slb
->sps
, pte
.pte0
, pte
.pte1
);
686 return deposit64(pte
.pte1
& HPTE64_R_RPN
, 0, apshift
, addr
)
690 void ppc_hash64_store_hpte(PowerPCCPU
*cpu
,
691 target_ulong pte_index
,
692 target_ulong pte0
, target_ulong pte1
)
694 CPUPPCState
*env
= &cpu
->env
;
696 if (kvmppc_kern_htab
) {
697 kvmppc_hash64_write_pte(env
, pte_index
, pte0
, pte1
);
701 pte_index
*= HASH_PTE_SIZE_64
;
702 if (env
->external_htab
) {
703 stq_p(env
->external_htab
+ pte_index
, pte0
);
704 stq_p(env
->external_htab
+ pte_index
+ HASH_PTE_SIZE_64
/ 2, pte1
);
706 stq_phys(CPU(cpu
)->as
, env
->htab_base
+ pte_index
, pte0
);
707 stq_phys(CPU(cpu
)->as
,
708 env
->htab_base
+ pte_index
+ HASH_PTE_SIZE_64
/ 2, pte1
);