2 * PowerPC MMU, TLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 * Copyright (c) 2013 David Gibson, IBM Corporation
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
23 #include "exec/exec-all.h"
24 #include "exec/helper-proto.h"
25 #include "sysemu/kvm.h"
27 #include "mmu-hash32.h"
33 # define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
35 # define LOG_BATS(...) do { } while (0)
38 struct mmu_ctx_hash32
{
39 hwaddr raddr
; /* Real address */
40 int prot
; /* Protection bits */
41 int key
; /* Access key */
44 static int ppc_hash32_pp_prot(int key
, int pp
, int nx
)
53 prot
= PAGE_READ
| PAGE_WRITE
;
75 prot
= PAGE_READ
| PAGE_WRITE
;
89 static int ppc_hash32_pte_prot(PowerPCCPU
*cpu
,
90 target_ulong sr
, ppc_hash_pte32_t pte
)
92 CPUPPCState
*env
= &cpu
->env
;
95 key
= !!(msr_pr
? (sr
& SR32_KP
) : (sr
& SR32_KS
));
96 pp
= pte
.pte1
& HPTE32_R_PP
;
98 return ppc_hash32_pp_prot(key
, pp
, !!(sr
& SR32_NX
));
101 static target_ulong
hash32_bat_size(PowerPCCPU
*cpu
,
102 target_ulong batu
, target_ulong batl
)
104 CPUPPCState
*env
= &cpu
->env
;
106 if ((msr_pr
&& !(batu
& BATU32_VP
))
107 || (!msr_pr
&& !(batu
& BATU32_VS
))) {
111 return BATU32_BEPI
& ~((batu
& BATU32_BL
) << 15);
114 static int hash32_bat_prot(PowerPCCPU
*cpu
,
115 target_ulong batu
, target_ulong batl
)
120 pp
= batl
& BATL32_PP
;
122 prot
= PAGE_READ
| PAGE_EXEC
;
130 static target_ulong
hash32_bat_601_size(PowerPCCPU
*cpu
,
131 target_ulong batu
, target_ulong batl
)
133 if (!(batl
& BATL32_601_V
)) {
137 return BATU32_BEPI
& ~((batl
& BATL32_601_BL
) << 17);
140 static int hash32_bat_601_prot(PowerPCCPU
*cpu
,
141 target_ulong batu
, target_ulong batl
)
143 CPUPPCState
*env
= &cpu
->env
;
146 pp
= batu
& BATU32_601_PP
;
148 key
= !!(batu
& BATU32_601_KS
);
150 key
= !!(batu
& BATU32_601_KP
);
152 return ppc_hash32_pp_prot(key
, pp
, 0);
155 static hwaddr
ppc_hash32_bat_lookup(PowerPCCPU
*cpu
, target_ulong ea
, int rwx
,
158 CPUPPCState
*env
= &cpu
->env
;
159 target_ulong
*BATlt
, *BATut
;
162 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx
"\n", __func__
,
163 rwx
== 2 ? 'I' : 'D', ea
);
165 BATlt
= env
->IBAT
[1];
166 BATut
= env
->IBAT
[0];
168 BATlt
= env
->DBAT
[1];
169 BATut
= env
->DBAT
[0];
171 for (i
= 0; i
< env
->nb_BATs
; i
++) {
172 target_ulong batu
= BATut
[i
];
173 target_ulong batl
= BATlt
[i
];
176 if (unlikely(env
->mmu_model
== POWERPC_MMU_601
)) {
177 mask
= hash32_bat_601_size(cpu
, batu
, batl
);
179 mask
= hash32_bat_size(cpu
, batu
, batl
);
181 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx
" BATu " TARGET_FMT_lx
182 " BATl " TARGET_FMT_lx
"\n", __func__
,
183 type
== ACCESS_CODE
? 'I' : 'D', i
, ea
, batu
, batl
);
185 if (mask
&& ((ea
& mask
) == (batu
& BATU32_BEPI
))) {
186 hwaddr raddr
= (batl
& mask
) | (ea
& ~mask
);
188 if (unlikely(env
->mmu_model
== POWERPC_MMU_601
)) {
189 *prot
= hash32_bat_601_prot(cpu
, batu
, batl
);
191 *prot
= hash32_bat_prot(cpu
, batu
, batl
);
194 return raddr
& TARGET_PAGE_MASK
;
199 #if defined(DEBUG_BATS)
200 if (qemu_log_enabled()) {
201 LOG_BATS("no BAT match for " TARGET_FMT_lx
":\n", ea
);
202 for (i
= 0; i
< 4; i
++) {
205 BEPIu
= *BATu
& BATU32_BEPIU
;
206 BEPIl
= *BATu
& BATU32_BEPIL
;
207 bl
= (*BATu
& 0x00001FFC) << 15;
208 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx
" BATu " TARGET_FMT_lx
209 " BATl " TARGET_FMT_lx
"\n\t" TARGET_FMT_lx
" "
210 TARGET_FMT_lx
" " TARGET_FMT_lx
"\n",
211 __func__
, type
== ACCESS_CODE
? 'I' : 'D', i
, ea
,
212 *BATu
, *BATl
, BEPIu
, BEPIl
, bl
);
220 static int ppc_hash32_direct_store(PowerPCCPU
*cpu
, target_ulong sr
,
221 target_ulong eaddr
, int rwx
,
222 hwaddr
*raddr
, int *prot
)
224 CPUState
*cs
= CPU(cpu
);
225 CPUPPCState
*env
= &cpu
->env
;
226 int key
= !!(msr_pr
? (sr
& SR32_KP
) : (sr
& SR32_KS
));
228 qemu_log_mask(CPU_LOG_MMU
, "direct store...\n");
230 if ((sr
& 0x1FF00000) >> 20 == 0x07f) {
231 /* Memory-forced I/O controller interface access */
232 /* If T=1 and BUID=x'07F', the 601 performs a memory access
233 * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
235 *raddr
= ((sr
& 0xF) << 28) | (eaddr
& 0x0FFFFFFF);
236 *prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
241 /* No code fetch is allowed in direct-store areas */
242 cs
->exception_index
= POWERPC_EXCP_ISI
;
243 env
->error_code
= 0x10000000;
247 switch (env
->access_type
) {
249 /* Integer load/store : only access allowed */
252 /* Floating point load/store */
253 cs
->exception_index
= POWERPC_EXCP_ALIGN
;
254 env
->error_code
= POWERPC_EXCP_ALIGN_FP
;
255 env
->spr
[SPR_DAR
] = eaddr
;
258 /* lwarx, ldarx or srwcx. */
260 env
->spr
[SPR_DAR
] = eaddr
;
262 env
->spr
[SPR_DSISR
] = 0x06000000;
264 env
->spr
[SPR_DSISR
] = 0x04000000;
268 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
269 /* Should make the instruction do no-op.
270 * As it already do no-op, it's quite easy :-)
276 cs
->exception_index
= POWERPC_EXCP_DSI
;
278 env
->spr
[SPR_DAR
] = eaddr
;
280 env
->spr
[SPR_DSISR
] = 0x06100000;
282 env
->spr
[SPR_DSISR
] = 0x04100000;
286 cpu_abort(cs
, "ERROR: instruction should not need "
287 "address translation\n");
289 if ((rwx
== 1 || key
!= 1) && (rwx
== 0 || key
!= 0)) {
293 cs
->exception_index
= POWERPC_EXCP_DSI
;
295 env
->spr
[SPR_DAR
] = eaddr
;
297 env
->spr
[SPR_DSISR
] = 0x0a000000;
299 env
->spr
[SPR_DSISR
] = 0x08000000;
305 hwaddr
get_pteg_offset32(PowerPCCPU
*cpu
, hwaddr hash
)
307 target_ulong mask
= ppc_hash32_hpt_mask(cpu
);
309 return (hash
* HASH_PTEG_SIZE_32
) & mask
;
312 static hwaddr
ppc_hash32_pteg_search(PowerPCCPU
*cpu
, hwaddr pteg_off
,
313 bool secondary
, target_ulong ptem
,
314 ppc_hash_pte32_t
*pte
)
316 hwaddr pte_offset
= pteg_off
;
317 target_ulong pte0
, pte1
;
320 for (i
= 0; i
< HPTES_PER_GROUP
; i
++) {
321 pte0
= ppc_hash32_load_hpte0(cpu
, pte_offset
);
323 * pte0 contains the valid bit and must be read before pte1,
324 * otherwise we might see an old pte1 with a new valid bit and
325 * thus an inconsistent hpte value
328 pte1
= ppc_hash32_load_hpte1(cpu
, pte_offset
);
330 if ((pte0
& HPTE32_V_VALID
)
331 && (secondary
== !!(pte0
& HPTE32_V_SECONDARY
))
332 && HPTE32_V_COMPARE(pte0
, ptem
)) {
338 pte_offset
+= HASH_PTE_SIZE_32
;
344 static hwaddr
ppc_hash32_htab_lookup(PowerPCCPU
*cpu
,
345 target_ulong sr
, target_ulong eaddr
,
346 ppc_hash_pte32_t
*pte
)
348 hwaddr pteg_off
, pte_offset
;
350 uint32_t vsid
, pgidx
, ptem
;
352 vsid
= sr
& SR32_VSID
;
353 pgidx
= (eaddr
& ~SEGMENT_MASK_256M
) >> TARGET_PAGE_BITS
;
355 ptem
= (vsid
<< 7) | (pgidx
>> 10);
357 /* Page address translation */
358 qemu_log_mask(CPU_LOG_MMU
, "htab_base " TARGET_FMT_plx
359 " htab_mask " TARGET_FMT_plx
360 " hash " TARGET_FMT_plx
"\n",
361 ppc_hash32_hpt_base(cpu
), ppc_hash32_hpt_mask(cpu
), hash
);
363 /* Primary PTEG lookup */
364 qemu_log_mask(CPU_LOG_MMU
, "0 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
365 " vsid=%" PRIx32
" ptem=%" PRIx32
366 " hash=" TARGET_FMT_plx
"\n",
367 ppc_hash32_hpt_base(cpu
), ppc_hash32_hpt_mask(cpu
),
369 pteg_off
= get_pteg_offset32(cpu
, hash
);
370 pte_offset
= ppc_hash32_pteg_search(cpu
, pteg_off
, 0, ptem
, pte
);
371 if (pte_offset
== -1) {
372 /* Secondary PTEG lookup */
373 qemu_log_mask(CPU_LOG_MMU
, "1 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
374 " vsid=%" PRIx32
" api=%" PRIx32
375 " hash=" TARGET_FMT_plx
"\n", ppc_hash32_hpt_base(cpu
),
376 ppc_hash32_hpt_mask(cpu
), vsid
, ptem
, ~hash
);
377 pteg_off
= get_pteg_offset32(cpu
, ~hash
);
378 pte_offset
= ppc_hash32_pteg_search(cpu
, pteg_off
, 1, ptem
, pte
);
384 static hwaddr
ppc_hash32_pte_raddr(target_ulong sr
, ppc_hash_pte32_t pte
,
387 hwaddr rpn
= pte
.pte1
& HPTE32_R_RPN
;
388 hwaddr mask
= ~TARGET_PAGE_MASK
;
390 return (rpn
& ~mask
) | (eaddr
& mask
);
393 int ppc_hash32_handle_mmu_fault(PowerPCCPU
*cpu
, vaddr eaddr
, int rwx
,
396 CPUState
*cs
= CPU(cpu
);
397 CPUPPCState
*env
= &cpu
->env
;
400 ppc_hash_pte32_t pte
;
403 const int need_prot
[] = {PAGE_READ
, PAGE_WRITE
, PAGE_EXEC
};
406 assert((rwx
== 0) || (rwx
== 1) || (rwx
== 2));
408 /* 1. Handle real mode accesses */
409 if (((rwx
== 2) && (msr_ir
== 0)) || ((rwx
!= 2) && (msr_dr
== 0))) {
410 /* Translation is off */
412 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
, raddr
& TARGET_PAGE_MASK
,
413 PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
, mmu_idx
,
418 /* 2. Check Block Address Translation entries (BATs) */
419 if (env
->nb_BATs
!= 0) {
420 raddr
= ppc_hash32_bat_lookup(cpu
, eaddr
, rwx
, &prot
);
422 if (need_prot
[rwx
] & ~prot
) {
424 cs
->exception_index
= POWERPC_EXCP_ISI
;
425 env
->error_code
= 0x08000000;
427 cs
->exception_index
= POWERPC_EXCP_DSI
;
429 env
->spr
[SPR_DAR
] = eaddr
;
431 env
->spr
[SPR_DSISR
] = 0x0a000000;
433 env
->spr
[SPR_DSISR
] = 0x08000000;
439 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
,
440 raddr
& TARGET_PAGE_MASK
, prot
, mmu_idx
,
446 /* 3. Look up the Segment Register */
447 sr
= env
->sr
[eaddr
>> 28];
449 /* 4. Handle direct store segments */
451 if (ppc_hash32_direct_store(cpu
, sr
, eaddr
, rwx
,
452 &raddr
, &prot
) == 0) {
453 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
,
454 raddr
& TARGET_PAGE_MASK
, prot
, mmu_idx
,
462 /* 5. Check for segment level no-execute violation */
463 if ((rwx
== 2) && (sr
& SR32_NX
)) {
464 cs
->exception_index
= POWERPC_EXCP_ISI
;
465 env
->error_code
= 0x10000000;
469 /* 6. Locate the PTE in the hash table */
470 pte_offset
= ppc_hash32_htab_lookup(cpu
, sr
, eaddr
, &pte
);
471 if (pte_offset
== -1) {
473 cs
->exception_index
= POWERPC_EXCP_ISI
;
474 env
->error_code
= 0x40000000;
476 cs
->exception_index
= POWERPC_EXCP_DSI
;
478 env
->spr
[SPR_DAR
] = eaddr
;
480 env
->spr
[SPR_DSISR
] = 0x42000000;
482 env
->spr
[SPR_DSISR
] = 0x40000000;
488 qemu_log_mask(CPU_LOG_MMU
,
489 "found PTE at offset %08" HWADDR_PRIx
"\n", pte_offset
);
491 /* 7. Check access permissions */
493 prot
= ppc_hash32_pte_prot(cpu
, sr
, pte
);
495 if (need_prot
[rwx
] & ~prot
) {
496 /* Access right violation */
497 qemu_log_mask(CPU_LOG_MMU
, "PTE access rejected\n");
499 cs
->exception_index
= POWERPC_EXCP_ISI
;
500 env
->error_code
= 0x08000000;
502 cs
->exception_index
= POWERPC_EXCP_DSI
;
504 env
->spr
[SPR_DAR
] = eaddr
;
506 env
->spr
[SPR_DSISR
] = 0x0a000000;
508 env
->spr
[SPR_DSISR
] = 0x08000000;
514 qemu_log_mask(CPU_LOG_MMU
, "PTE access granted !\n");
516 /* 8. Update PTE referenced and changed bits if necessary */
518 new_pte1
= pte
.pte1
| HPTE32_R_R
; /* set referenced bit */
520 new_pte1
|= HPTE32_R_C
; /* set changed (dirty) bit */
522 /* Treat the page as read-only for now, so that a later write
523 * will pass through this function again to set the C bit */
527 if (new_pte1
!= pte
.pte1
) {
528 ppc_hash32_store_hpte1(cpu
, pte_offset
, new_pte1
);
531 /* 9. Determine the real address from the PTE */
533 raddr
= ppc_hash32_pte_raddr(sr
, pte
, eaddr
);
535 tlb_set_page(cs
, eaddr
& TARGET_PAGE_MASK
, raddr
& TARGET_PAGE_MASK
,
536 prot
, mmu_idx
, TARGET_PAGE_SIZE
);
541 hwaddr
ppc_hash32_get_phys_page_debug(PowerPCCPU
*cpu
, target_ulong eaddr
)
543 CPUPPCState
*env
= &cpu
->env
;
546 ppc_hash_pte32_t pte
;
550 /* Translation is off */
554 if (env
->nb_BATs
!= 0) {
555 hwaddr raddr
= ppc_hash32_bat_lookup(cpu
, eaddr
, 0, &prot
);
561 sr
= env
->sr
[eaddr
>> 28];
564 /* FIXME: Add suitable debug support for Direct Store segments */
568 pte_offset
= ppc_hash32_htab_lookup(cpu
, sr
, eaddr
, &pte
);
569 if (pte_offset
== -1) {
573 return ppc_hash32_pte_raddr(sr
, pte
, eaddr
) & TARGET_PAGE_MASK
;