[mirror_qemu.git] / target-ppc / mmu-hash64.c

/*
 *  PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
 *
 *  Copyright (c) 2003-2007 Jocelyn Mayer
 *  Copyright (c) 2013 David Gibson, IBM Corporation
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */
#include "cpu.h"
#include "helper.h"
#include "sysemu/kvm.h"
#include "kvm_ppc.h"
#include "mmu-hash64.h"

//#define DEBUG_MMU
//#define DEBUG_SLB

#ifdef DEBUG_MMU
#  define LOG_MMU(...) qemu_log(__VA_ARGS__)
#  define LOG_MMU_STATE(env) log_cpu_state((env), 0)
#else
#  define LOG_MMU(...) do { } while (0)
#  define LOG_MMU_STATE(...) do { } while (0)
#endif

#ifdef DEBUG_SLB
#  define LOG_SLB(...) qemu_log(__VA_ARGS__)
#else
#  define LOG_SLB(...) do { } while (0)
#endif

struct mmu_ctx_hash64 {
    hwaddr raddr;      /* Real address              */
    int prot;                      /* Protection bits           */
    int key;                       /* Access key                */
};

/*
 * SLB handling
 */

static ppc_slb_t *slb_lookup(CPUPPCState *env, target_ulong eaddr)
{
    uint64_t esid_256M, esid_1T;
    int n;

    LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);

    esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V;
    esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V;

    for (n = 0; n < env->slb_nr; n++) {
        ppc_slb_t *slb = &env->slb[n];

        LOG_SLB("%s: slot %d %016" PRIx64 " %016"
                    PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
        /* We check for 1T matches on all MMUs here - if the MMU
         * doesn't have 1T segment support, we will have prevented 1T
         * entries from being inserted in the slbmte code. */
        if (((slb->esid == esid_256M) &&
             ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
            || ((slb->esid == esid_1T) &&
                ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
            return slb;
        }
    }

    return NULL;
}

void dump_slb(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
{
    int i;
    uint64_t slbe, slbv;

    cpu_synchronize_state(env);

    cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
    for (i = 0; i < env->slb_nr; i++) {
        slbe = env->slb[i].esid;
        slbv = env->slb[i].vsid;
        if (slbe == 0 && slbv == 0) {
            continue;
        }
        cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
                    i, slbe, slbv);
    }
}

void helper_slbia(CPUPPCState *env)
{
    int n, do_invalidate;

    do_invalidate = 0;
    /* XXX: Warning: slbia never invalidates the first segment */
    for (n = 1; n < env->slb_nr; n++) {
        ppc_slb_t *slb = &env->slb[n];

        if (slb->esid & SLB_ESID_V) {
            slb->esid &= ~SLB_ESID_V;
            /* XXX: given the fact that segment size is 256 MB or 1TB,
             *      and we still don't have a tlb_flush_mask(env, n, mask)
             *      in QEMU, we just invalidate all TLBs
             */
            do_invalidate = 1;
        }
    }
    if (do_invalidate) {
        tlb_flush(env, 1);
    }
}

void helper_slbie(CPUPPCState *env, target_ulong addr)
{
    ppc_slb_t *slb;

    slb = slb_lookup(env, addr);
    if (!slb) {
        return;
    }

    if (slb->esid & SLB_ESID_V) {
        slb->esid &= ~SLB_ESID_V;

        /* XXX: given the fact that segment size is 256 MB or 1TB,
         *      and we still don't have a tlb_flush_mask(env, n, mask)
         *      in QEMU, we just invalidate all TLBs
         */
        tlb_flush(env, 1);
    }
}

int ppc_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
{
    int slot = rb & 0xfff;
    ppc_slb_t *slb = &env->slb[slot];

    if (rb & (0x1000 - env->slb_nr)) {
        return -1; /* Reserved bits set or slot too high */
    }
    if (rs & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
        return -1; /* Bad segment size */
    }
    if ((rs & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
        return -1; /* 1T segment on MMU that doesn't support it */
    }

    /* Mask out the slot number as we store the entry */
    slb->esid = rb & (SLB_ESID_ESID | SLB_ESID_V);
    slb->vsid = rs;

    LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
            " %016" PRIx64 "\n", __func__, slot, rb, rs,
            slb->esid, slb->vsid);

    return 0;
}

static int ppc_load_slb_esid(CPUPPCState *env, target_ulong rb,
                             target_ulong *rt)
{
    int slot = rb & 0xfff;
    ppc_slb_t *slb = &env->slb[slot];

    if (slot >= env->slb_nr) {
        return -1;
    }

    *rt = slb->esid;
    return 0;
}

static int ppc_load_slb_vsid(CPUPPCState *env, target_ulong rb,
                             target_ulong *rt)
{
    int slot = rb & 0xfff;
    ppc_slb_t *slb = &env->slb[slot];

    if (slot >= env->slb_nr) {
        return -1;
    }

    *rt = slb->vsid;
    return 0;
}

void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
{
    if (ppc_store_slb(env, rb, rs) < 0) {
        helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
                                   POWERPC_EXCP_INVAL);
    }
}

target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
{
    target_ulong rt = 0;

    if (ppc_load_slb_esid(env, rb, &rt) < 0) {
        helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
                                   POWERPC_EXCP_INVAL);
    }
    return rt;
}

target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
{
    target_ulong rt = 0;

    if (ppc_load_slb_vsid(env, rb, &rt) < 0) {
        helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
                                   POWERPC_EXCP_INVAL);
    }
    return rt;
}

/*
 * 64-bit hash table MMU handling
 */

static int ppc_hash64_pp_check(int key, int pp, bool nx)
{
    int access;

    /* Compute access rights */
    /* When pp is 4, 5 or 7, the result is undefined. Set it to noaccess */
    access = 0;
    if (key == 0) {
        switch (pp) {
        case 0x0:
        case 0x1:
        case 0x2:
            access |= PAGE_WRITE;
            /* No break here */
        case 0x3:
        case 0x6:
            access |= PAGE_READ;
            break;
        }
    } else {
        switch (pp) {
        case 0x0:
        case 0x6:
            access = 0;
            break;
        case 0x1:
        case 0x3:
            access = PAGE_READ;
            break;
        case 0x2:
            access = PAGE_READ | PAGE_WRITE;
            break;
        }
    }
    if (!nx) {
        access |= PAGE_EXEC;
    }

    return access;
}

static int ppc_hash64_check_prot(int prot, int rwx)
{
    int ret;

    if (rwx == 2) {
        if (prot & PAGE_EXEC) {
            ret = 0;
        } else {
            ret = -2;
        }
    } else if (rwx == 1) {
        if (prot & PAGE_WRITE) {
            ret = 0;
        } else {
            ret = -2;
        }
    } else {
        if (prot & PAGE_READ) {
            ret = 0;
        } else {
            ret = -2;
        }
    }

    return ret;
}

static int ppc_hash64_pte_update_flags(struct mmu_ctx_hash64 *ctx,
                                       uint64_t *pte1p, int ret, int rw)
{
    int store = 0;

    /* Update page flags */
    if (!(*pte1p & HPTE64_R_R)) {
        /* Update accessed flag */
        *pte1p |= HPTE64_R_R;
        store = 1;
    }
    if (!(*pte1p & HPTE64_R_C)) {
        if (rw == 1 && ret == 0) {
            /* Update changed flag */
            *pte1p |= HPTE64_R_C;
            store = 1;
        } else {
            /* Force page fault for first write access */
            ctx->prot &= ~PAGE_WRITE;
        }
    }

    return store;
}

static hwaddr ppc_hash64_pteg_search(CPUPPCState *env, hwaddr pteg_off,
                                     bool secondary, target_ulong ptem,
                                     ppc_hash_pte64_t *pte)
{
    hwaddr pte_offset = pteg_off;
    target_ulong pte0, pte1;
    int i;

    for (i = 0; i < HPTES_PER_GROUP; i++) {
        pte0 = ppc_hash64_load_hpte0(env, pte_offset);
        pte1 = ppc_hash64_load_hpte1(env, pte_offset);

        if ((pte0 & HPTE64_V_VALID)
            && (secondary == !!(pte0 & HPTE64_V_SECONDARY))
            && HPTE64_V_COMPARE(pte0, ptem)) {
            pte->pte0 = pte0;
            pte->pte1 = pte1;
            return pte_offset;
        }

        pte_offset += HASH_PTE_SIZE_64;
    }

    return -1;
}

static hwaddr ppc_hash64_htab_lookup(CPUPPCState *env,
                                     ppc_slb_t *slb, target_ulong eaddr,
                                     ppc_hash_pte64_t *pte)
{
    hwaddr pteg_off, pte_offset;
    hwaddr hash;
    uint64_t vsid, epnshift, epnmask, epn, ptem;

    /* Page size according to the SLB, which we use to generate the
     * EPN for hash table lookup..  When we implement more recent MMU
     * extensions this might be different from the actual page size
     * encoded in the PTE */
    epnshift = (slb->vsid & SLB_VSID_L)
        ? TARGET_PAGE_BITS_16M : TARGET_PAGE_BITS;
    epnmask = ~((1ULL << epnshift) - 1);

    if (slb->vsid & SLB_VSID_B) {
        /* 1TB segment */
        vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
        epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask;
        hash = vsid ^ (vsid << 25) ^ (epn >> epnshift);
    } else {
        /* 256M segment */
        vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
        epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask;
        hash = vsid ^ (epn >> epnshift);
    }
    ptem = (slb->vsid & SLB_VSID_PTEM) | ((epn >> 16) & HPTE64_V_AVPN);

    /* Page address translation */
    LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
            " hash " TARGET_FMT_plx "\n",
            env->htab_base, env->htab_mask, hash);

    /* Primary PTEG lookup */
    LOG_MMU("0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
            " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
            " hash=" TARGET_FMT_plx "\n",
            env->htab_base, env->htab_mask, vsid, ptem,  hash);
    pteg_off = (hash * HASH_PTEG_SIZE_64) & env->htab_mask;
    pte_offset = ppc_hash64_pteg_search(env, pteg_off, 0, ptem, pte);

    if (pte_offset == -1) {
        /* Secondary PTEG lookup */
        LOG_MMU("1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
                " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
                " hash=" TARGET_FMT_plx "\n", env->htab_base,
                env->htab_mask, vsid, ptem, ~hash);

        pteg_off = (~hash * HASH_PTEG_SIZE_64) & env->htab_mask;
        pte_offset = ppc_hash64_pteg_search(env, pteg_off, 1, ptem, pte);
    }

    return pte_offset;
}

static int ppc_hash64_translate(CPUPPCState *env, struct mmu_ctx_hash64 *ctx,
                                target_ulong eaddr, int rwx)
{
    int ret;
    ppc_slb_t *slb;
    hwaddr pte_offset;
    ppc_hash_pte64_t pte;
    int target_page_bits;

    assert((rwx == 0) || (rwx == 1) || (rwx == 2));

    /* 1. Handle real mode accesses */
    if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
        /* Translation is off */
        /* In real mode the top 4 effective address bits are ignored */
        ctx->raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
        ctx->prot = PAGE_READ | PAGE_EXEC | PAGE_WRITE;
        return 0;
    }

    /* 2. Translation is on, so look up the SLB */
    slb = slb_lookup(env, eaddr);

    if (!slb) {
        return -5;
    }

    /* 3. Check for segment level no-execute violation */
    if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) {
        return -3;
    }

    /* 4. Locate the PTE in the hash table */
    pte_offset = ppc_hash64_htab_lookup(env, slb, eaddr, &pte);
    if (pte_offset == -1) {
        return -1;
    }
    LOG_MMU("found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);

    /* 5. Check access permissions */
    ctx->key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP)
                  : (slb->vsid & SLB_VSID_KS));


    int access, pp;
    bool nx;

    pp = (pte.pte1 & HPTE64_R_PP) | ((pte.pte1 & HPTE64_R_PP0) >> 61);
    /* No execute if either noexec or guarded bits set */
    nx = (pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G);
    /* Compute access rights */
    access = ppc_hash64_pp_check(ctx->key, pp, nx);
    /* Keep the matching PTE informations */
    ctx->raddr = pte.pte1;
    ctx->prot = access;
    ret = ppc_hash64_check_prot(ctx->prot, rwx);

    if (ret) {
        /* Access right violation */
        LOG_MMU("PTE access rejected\n");
        return ret;
    }

    LOG_MMU("PTE access granted !\n");

    /* 6. Update PTE referenced and changed bits if necessary */

    if (ppc_hash64_pte_update_flags(ctx, &pte.pte1, ret, rwx) == 1) {
        ppc_hash64_store_hpte1(env, pte_offset, pte.pte1);
    }

    /* We have a TLB that saves 4K pages, so let's
     * split a huge page to 4k chunks */
    target_page_bits = (slb->vsid & SLB_VSID_L)
        ? TARGET_PAGE_BITS_16M : TARGET_PAGE_BITS;
    if (target_page_bits != TARGET_PAGE_BITS) {
        ctx->raddr |= (eaddr & ((1 << target_page_bits) - 1))
                      & TARGET_PAGE_MASK;
    }
    return ret;
}

hwaddr ppc_hash64_get_phys_page_debug(CPUPPCState *env, target_ulong addr)
{
    struct mmu_ctx_hash64 ctx;

    if (unlikely(ppc_hash64_translate(env, &ctx, addr, 0) != 0)) {
        return -1;
    }

    return ctx.raddr & TARGET_PAGE_MASK;
}

int ppc_hash64_handle_mmu_fault(CPUPPCState *env, target_ulong address, int rwx,
                                int mmu_idx)
{
    struct mmu_ctx_hash64 ctx;
    int ret = 0;

    ret = ppc_hash64_translate(env, &ctx, address, rwx);
    if (ret == 0) {
        tlb_set_page(env, address & TARGET_PAGE_MASK,
                     ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
                     mmu_idx, TARGET_PAGE_SIZE);
        ret = 0;
    } else if (ret < 0) {
        LOG_MMU_STATE(env);
        if (rwx == 2) {
            switch (ret) {
            case -1:
                env->exception_index = POWERPC_EXCP_ISI;
                env->error_code = 0x40000000;
                break;
            case -2:
                /* Access rights violation */
                env->exception_index = POWERPC_EXCP_ISI;
                env->error_code = 0x08000000;
                break;
            case -3:
                /* No execute protection violation */
                env->exception_index = POWERPC_EXCP_ISI;
                env->error_code = 0x10000000;
                break;
            case -5:
                /* No match in segment table */
                env->exception_index = POWERPC_EXCP_ISEG;
                env->error_code = 0;
                break;
            }
        } else {
            switch (ret) {
            case -1:
                /* No matches in page tables or TLB */
                env->exception_index = POWERPC_EXCP_DSI;
                env->error_code = 0;
                env->spr[SPR_DAR] = address;
                if (rwx == 1) {
                    env->spr[SPR_DSISR] = 0x42000000;
                } else {
                    env->spr[SPR_DSISR] = 0x40000000;
                }
                break;
            case -2:
                /* Access rights violation */
                env->exception_index = POWERPC_EXCP_DSI;
                env->error_code = 0;
                env->spr[SPR_DAR] = address;
                if (rwx == 1) {
                    env->spr[SPR_DSISR] = 0x0A000000;
                } else {
                    env->spr[SPR_DSISR] = 0x08000000;
                }
                break;
            case -5:
                /* No match in segment table */
                env->exception_index = POWERPC_EXCP_DSEG;
                env->error_code = 0;
                env->spr[SPR_DAR] = address;
                break;
            }
        }
#if 0
        printf("%s: set exception to %d %02x\n", __func__,
               env->exception, env->error_code);
#endif
        ret = 1;
    }

    return ret;
}
Commit	Line	Data
10b46525 DG	1	/*
	2	* PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
	3	*
	4	* Copyright (c) 2003-2007 Jocelyn Mayer
	5	* Copyright (c) 2013 David Gibson, IBM Corporation
	6	*
	7	* This library is free software; you can redistribute it and/or
	8	* modify it under the terms of the GNU Lesser General Public
	9	* License as published by the Free Software Foundation; either
	10	* version 2 of the License, or (at your option) any later version.
	11	*
	12	* This library is distributed in the hope that it will be useful,
	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	15	* Lesser General Public License for more details.
	16	*
	17	* You should have received a copy of the GNU Lesser General Public
	18	* License along with this library; if not, see <http://www.gnu.org/licenses/>.
	19	*/
	20	#include "cpu.h"
	21	#include "helper.h"
	22	#include "sysemu/kvm.h"
	23	#include "kvm_ppc.h"
	24	#include "mmu-hash64.h"
	25
9d7c3f4a	26	//#define DEBUG_MMU
10b46525 DG	27	//#define DEBUG_SLB
10b46525 DG	28
9d7c3f4a DG	29	#ifdef DEBUG_MMU
	30	# define LOG_MMU(...) qemu_log(__VA_ARGS__)
	31	# define LOG_MMU_STATE(env) log_cpu_state((env), 0)
	32	#else
	33	# define LOG_MMU(...) do { } while (0)
	34	# define LOG_MMU_STATE(...) do { } while (0)
	35	#endif
	36
10b46525 DG	37	#ifdef DEBUG_SLB
	38	# define LOG_SLB(...) qemu_log(__VA_ARGS__)
	39	#else
	40	# define LOG_SLB(...) do { } while (0)
	41	#endif
	42
5dc68eb0 DG	43	struct mmu_ctx_hash64 {
5dc68eb0 DG	44	hwaddr raddr; /* Real address */
5dc68eb0	45	int prot; /* Protection bits */
5dc68eb0	46	int key; /* Access key */
5dc68eb0 DG	47	};
5dc68eb0 DG	48
10b46525 DG	49	/*
	50	* SLB handling
	51	*/
	52
0480884f	53	static ppc_slb_t slb_lookup(CPUPPCState env, target_ulong eaddr)
10b46525 DG	54	{
	55	uint64_t esid_256M, esid_1T;
	56	int n;
	57
	58	LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);
	59
	60	esid_256M = (eaddr & SEGMENT_MASK_256M) \| SLB_ESID_V;
	61	esid_1T = (eaddr & SEGMENT_MASK_1T) \| SLB_ESID_V;
	62
	63	for (n = 0; n < env->slb_nr; n++) {
	64	ppc_slb_t *slb = &env->slb[n];
	65
	66	LOG_SLB("%s: slot %d %016" PRIx64 " %016"
	67	PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
	68	/* We check for 1T matches on all MMUs here - if the MMU
	69	* doesn't have 1T segment support, we will have prevented 1T
	70	* entries from being inserted in the slbmte code. */
	71	if (((slb->esid == esid_256M) &&
	72	((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
	73	\|\| ((slb->esid == esid_1T) &&
	74	((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
	75	return slb;
	76	}
	77	}
	78
	79	return NULL;
	80	}
	81
	82	void dump_slb(FILE f, fprintf_function cpu_fprintf, CPUPPCState env)
	83	{
	84	int i;
	85	uint64_t slbe, slbv;
	86
	87	cpu_synchronize_state(env);
	88
	89	cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
	90	for (i = 0; i < env->slb_nr; i++) {
	91	slbe = env->slb[i].esid;
	92	slbv = env->slb[i].vsid;
	93	if (slbe == 0 && slbv == 0) {
	94	continue;
	95	}
	96	cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
	97	i, slbe, slbv);
	98	}
	99	}
	100
	101	void helper_slbia(CPUPPCState *env)
	102	{
	103	int n, do_invalidate;
	104
	105	do_invalidate = 0;
	106	/* XXX: Warning: slbia never invalidates the first segment */
	107	for (n = 1; n < env->slb_nr; n++) {
	108	ppc_slb_t *slb = &env->slb[n];
	109
	110	if (slb->esid & SLB_ESID_V) {
	111	slb->esid &= ~SLB_ESID_V;
	112	/* XXX: given the fact that segment size is 256 MB or 1TB,
	113	* and we still don't have a tlb_flush_mask(env, n, mask)
	114	* in QEMU, we just invalidate all TLBs
	115	*/
	116	do_invalidate = 1;
	117	}
118	}
119	if (do_invalidate) {
120	tlb_flush(env, 1);
121	}
122	}
123
124	void helper_slbie(CPUPPCState *env, target_ulong addr)
125	{
126	ppc_slb_t *slb;
127
128	slb = slb_lookup(env, addr);
129	if (!slb) {
130	return;
131	}
132
133	if (slb->esid & SLB_ESID_V) {
134	slb->esid &= ~SLB_ESID_V;
135
136	/* XXX: given the fact that segment size is 256 MB or 1TB,
137	* and we still don't have a tlb_flush_mask(env, n, mask)
138	* in QEMU, we just invalidate all TLBs
139	*/
140	tlb_flush(env, 1);
141	}
142	}
143
144	int ppc_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
145	{
146	int slot = rb & 0xfff;
147	ppc_slb_t *slb = &env->slb[slot];
148
149	if (rb & (0x1000 - env->slb_nr)) {
150	return -1; /* Reserved bits set or slot too high */
151	}
152	if (rs & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
153	return -1; /* Bad segment size */
154	}
155	if ((rs & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
156	return -1; /* 1T segment on MMU that doesn't support it */
157	}
158
159	/* Mask out the slot number as we store the entry */
160	slb->esid = rb & (SLB_ESID_ESID \| SLB_ESID_V);
161	slb->vsid = rs;
162
163	LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
164	" %016" PRIx64 "\n", __func__, slot, rb, rs,
165	slb->esid, slb->vsid);
166
167	return 0;
168	}
169
170	static int ppc_load_slb_esid(CPUPPCState *env, target_ulong rb,
171	target_ulong *rt)
172	{
173	int slot = rb & 0xfff;
174	ppc_slb_t *slb = &env->slb[slot];
175
176	if (slot >= env->slb_nr) {
177	return -1;
178	}
179
180	*rt = slb->esid;
181	return 0;
182	}
183
184	static int ppc_load_slb_vsid(CPUPPCState *env, target_ulong rb,
185	target_ulong *rt)
186	{
187	int slot = rb & 0xfff;
188	ppc_slb_t *slb = &env->slb[slot];
189
190	if (slot >= env->slb_nr) {
191	return -1;
192	}
193
194	*rt = slb->vsid;
195	return 0;
196	}
197
198	void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
199	{
200	if (ppc_store_slb(env, rb, rs) < 0) {
201	helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
202	POWERPC_EXCP_INVAL);
203	}
204	}
205
206	target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
207	{
208	target_ulong rt = 0;
209
210	if (ppc_load_slb_esid(env, rb, &rt) < 0) {
211	helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
212	POWERPC_EXCP_INVAL);
213	}
214	return rt;
215	}
216
217	target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
218	{
219	target_ulong rt = 0;
220
221	if (ppc_load_slb_vsid(env, rb, &rt) < 0) {
222	helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
223	POWERPC_EXCP_INVAL);
224	}
225	return rt;
226	}
9d7c3f4a DG	227
	228	/*
	229	* 64-bit hash table MMU handling
	230	*/
	231
ba36ed10	232	static int ppc_hash64_pp_check(int key, int pp, bool nx)
496272a7 DG	233	{
	234	int access;
	235
	236	/* Compute access rights */
	237	/* When pp is 4, 5 or 7, the result is undefined. Set it to noaccess */
	238	access = 0;
	239	if (key == 0) {
	240	switch (pp) {
	241	case 0x0:
	242	case 0x1:
	243	case 0x2:
	244	access \|= PAGE_WRITE;
	245	/* No break here */
	246	case 0x3:
	247	case 0x6:
	248	access \|= PAGE_READ;
	249	break;
	250	}
	251	} else {
	252	switch (pp) {
	253	case 0x0:
	254	case 0x6:
	255	access = 0;
	256	break;
	257	case 0x1:
	258	case 0x3:
	259	access = PAGE_READ;
	260	break;
	261	case 0x2:
	262	access = PAGE_READ \| PAGE_WRITE;
	263	break;
	264	}
	265	}
ba36ed10	266	if (!nx) {
496272a7 DG	267	access \|= PAGE_EXEC;
	268	}
	269
	270	return access;
	271	}
	272
91cda45b	273	static int ppc_hash64_check_prot(int prot, int rwx)
496272a7 DG	274	{
	275	int ret;
	276
91cda45b	277	if (rwx == 2) {
496272a7 DG	278	if (prot & PAGE_EXEC) {
	279	ret = 0;
	280	} else {
	281	ret = -2;
	282	}
91cda45b	283	} else if (rwx == 1) {
496272a7 DG	284	if (prot & PAGE_WRITE) {
	285	ret = 0;
	286	} else {
	287	ret = -2;
	288	}
	289	} else {
	290	if (prot & PAGE_READ) {
	291	ret = 0;
	292	} else {
	293	ret = -2;
	294	}
	295	}
	296
	297	return ret;
	298	}
	299
5dc68eb0	300	static int ppc_hash64_pte_update_flags(struct mmu_ctx_hash64 *ctx,
aea390e4	301	uint64_t *pte1p, int ret, int rw)
496272a7 DG	302	{
	303	int store = 0;
	304
	305	/* Update page flags */
d5aea6f3	306	if (!(*pte1p & HPTE64_R_R)) {
496272a7	307	/* Update accessed flag */
d5aea6f3	308	*pte1p \|= HPTE64_R_R;
496272a7 DG	309	store = 1;
496272a7 DG	310	}
d5aea6f3	311	if (!(*pte1p & HPTE64_R_C)) {
496272a7 DG	312	if (rw == 1 && ret == 0) {
496272a7 DG	313	/* Update changed flag */
d5aea6f3	314	*pte1p \|= HPTE64_R_C;
496272a7 DG	315	store = 1;
	316	} else {
	317	/* Force page fault for first write access */
	318	ctx->prot &= ~PAGE_WRITE;
	319	}
	320	}
	321
	322	return store;
	323	}
	324
aea390e4 DG	325	static hwaddr ppc_hash64_pteg_search(CPUPPCState *env, hwaddr pteg_off,
	326	bool secondary, target_ulong ptem,
	327	ppc_hash_pte64_t *pte)
	328	{
	329	hwaddr pte_offset = pteg_off;
	330	target_ulong pte0, pte1;
	331	int i;
	332
	333	for (i = 0; i < HPTES_PER_GROUP; i++) {
	334	pte0 = ppc_hash64_load_hpte0(env, pte_offset);
	335	pte1 = ppc_hash64_load_hpte1(env, pte_offset);
	336
	337	if ((pte0 & HPTE64_V_VALID)
	338	&& (secondary == !!(pte0 & HPTE64_V_SECONDARY))
	339	&& HPTE64_V_COMPARE(pte0, ptem)) {
	340	pte->pte0 = pte0;
	341	pte->pte1 = pte1;
	342	return pte_offset;
	343	}
	344
	345	pte_offset += HASH_PTE_SIZE_64;
	346	}
	347
	348	return -1;
	349	}
	350
7f3bdc2d DG	351	static hwaddr ppc_hash64_htab_lookup(CPUPPCState *env,
	352	ppc_slb_t *slb, target_ulong eaddr,
	353	ppc_hash_pte64_t *pte)
c69b6151	354	{
aea390e4	355	hwaddr pteg_off, pte_offset;
a1ff751a	356	hwaddr hash;
18148898	357	uint64_t vsid, epnshift, epnmask, epn, ptem;
a1ff751a	358
18148898 DG	359	/* Page size according to the SLB, which we use to generate the
	360	* EPN for hash table lookup.. When we implement more recent MMU
	361	* extensions this might be different from the actual page size
	362	* encoded in the PTE */
	363	epnshift = (slb->vsid & SLB_VSID_L)
a1ff751a	364	? TARGET_PAGE_BITS_16M : TARGET_PAGE_BITS;
18148898	365	epnmask = ~((1ULL << epnshift) - 1);
a1ff751a	366
a1ff751a	367	if (slb->vsid & SLB_VSID_B) {
18148898 DG	368	/* 1TB segment */
	369	vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
	370	epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask;
	371	hash = vsid ^ (vsid << 25) ^ (epn >> epnshift);
a1ff751a	372	} else {
18148898 DG	373	/* 256M segment */
	374	vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
	375	epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask;
	376	hash = vsid ^ (epn >> epnshift);
a1ff751a	377	}
18148898	378	ptem = (slb->vsid & SLB_VSID_PTEM) \| ((epn >> 16) & HPTE64_V_AVPN);
a1ff751a	379
a1ff751a DG	380	/* Page address translation */
	381	LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
	382	" hash " TARGET_FMT_plx "\n",
	383	env->htab_base, env->htab_mask, hash);
	384
a1ff751a DG	385	/* Primary PTEG lookup */
	386	LOG_MMU("0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
	387	" vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
	388	" hash=" TARGET_FMT_plx "\n",
	389	env->htab_base, env->htab_mask, vsid, ptem, hash);
	390	pteg_off = (hash * HASH_PTEG_SIZE_64) & env->htab_mask;
7f3bdc2d DG	391	pte_offset = ppc_hash64_pteg_search(env, pteg_off, 0, ptem, pte);
7f3bdc2d DG	392
a1ff751a DG	393	if (pte_offset == -1) {
	394	/* Secondary PTEG lookup */
	395	LOG_MMU("1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
	396	" vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
	397	" hash=" TARGET_FMT_plx "\n", env->htab_base,
	398	env->htab_mask, vsid, ptem, ~hash);
	399
	400	pteg_off = (~hash * HASH_PTEG_SIZE_64) & env->htab_mask;
7f3bdc2d	401	pte_offset = ppc_hash64_pteg_search(env, pteg_off, 1, ptem, pte);
a1ff751a DG	402	}
a1ff751a DG	403
7f3bdc2d	404	return pte_offset;
c69b6151	405	}
0480884f	406
65d61643 DG	407	static int ppc_hash64_translate(CPUPPCState env, struct mmu_ctx_hash64 ctx,
65d61643 DG	408	target_ulong eaddr, int rwx)
0480884f	409	{
a1ff751a	410	int ret;
0480884f	411	ppc_slb_t *slb;
7f3bdc2d DG	412	hwaddr pte_offset;
	413	ppc_hash_pte64_t pte;
	414	int target_page_bits;
0480884f	415
6a980110 DG	416	assert((rwx == 0) \|\| (rwx == 1) \|\| (rwx == 2));
6a980110 DG	417
65d61643 DG	418	/* 1. Handle real mode accesses */
	419	if (((rwx == 2) && (msr_ir == 0)) \|\| ((rwx != 2) && (msr_dr == 0))) {
	420	/* Translation is off */
	421	/* In real mode the top 4 effective address bits are ignored */
	422	ctx->raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
	423	ctx->prot = PAGE_READ \| PAGE_EXEC \| PAGE_WRITE;
	424	return 0;
	425	}
	426
bb218042	427	/* 2. Translation is on, so look up the SLB */
0480884f	428	slb = slb_lookup(env, eaddr);
bb218042	429
0480884f DG	430	if (!slb) {
	431	return -5;
	432	}
	433
bb218042 DG	434	/* 3. Check for segment level no-execute violation */
	435	if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) {
	436	return -3;
	437	}
	438
7f3bdc2d DG	439	/* 4. Locate the PTE in the hash table */
	440	pte_offset = ppc_hash64_htab_lookup(env, slb, eaddr, &pte);
	441	if (pte_offset == -1) {
	442	return -1;
	443	}
	444	LOG_MMU("found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
	445
	446	/* 5. Check access permissions */
	447	ctx->key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP)
	448	: (slb->vsid & SLB_VSID_KS));
	449
6a980110 DG	450
	451	int access, pp;
	452	bool nx;
	453
	454	pp = (pte.pte1 & HPTE64_R_PP) \| ((pte.pte1 & HPTE64_R_PP0) >> 61);
	455	/* No execute if either noexec or guarded bits set */
	456	nx = (pte.pte1 & HPTE64_R_N) \|\| (pte.pte1 & HPTE64_R_G);
	457	/* Compute access rights */
	458	access = ppc_hash64_pp_check(ctx->key, pp, nx);
	459	/* Keep the matching PTE informations */
	460	ctx->raddr = pte.pte1;
	461	ctx->prot = access;
	462	ret = ppc_hash64_check_prot(ctx->prot, rwx);
87dc3fd1 DG	463
87dc3fd1 DG	464	if (ret) {
6a980110 DG	465	/* Access right violation */
6a980110 DG	466	LOG_MMU("PTE access rejected\n");
87dc3fd1	467	return ret;
6a980110 DG	468	}
6a980110 DG	469
87dc3fd1 DG	470	LOG_MMU("PTE access granted !\n");
	471
	472	/* 6. Update PTE referenced and changed bits if necessary */
	473
7f3bdc2d DG	474	if (ppc_hash64_pte_update_flags(ctx, &pte.pte1, ret, rwx) == 1) {
	475	ppc_hash64_store_hpte1(env, pte_offset, pte.pte1);
	476	}
0480884f	477
7f3bdc2d DG	478	/* We have a TLB that saves 4K pages, so let's
	479	* split a huge page to 4k chunks */
	480	target_page_bits = (slb->vsid & SLB_VSID_L)
	481	? TARGET_PAGE_BITS_16M : TARGET_PAGE_BITS;
	482	if (target_page_bits != TARGET_PAGE_BITS) {
	483	ctx->raddr \|= (eaddr & ((1 << target_page_bits) - 1))
	484	& TARGET_PAGE_MASK;
	485	}
0480884f DG	486	return ret;
0480884f DG	487	}
629bd516	488
f2ad6be8 DG	489	hwaddr ppc_hash64_get_phys_page_debug(CPUPPCState *env, target_ulong addr)
f2ad6be8 DG	490	{
5dc68eb0	491	struct mmu_ctx_hash64 ctx;
f2ad6be8	492
65d61643	493	if (unlikely(ppc_hash64_translate(env, &ctx, addr, 0) != 0)) {
f2ad6be8 DG	494	return -1;
	495	}
	496
	497	return ctx.raddr & TARGET_PAGE_MASK;
	498	}
	499
91cda45b	500	int ppc_hash64_handle_mmu_fault(CPUPPCState *env, target_ulong address, int rwx,
25de24ab DG	501	int mmu_idx)
25de24ab DG	502	{
5dc68eb0	503	struct mmu_ctx_hash64 ctx;
25de24ab DG	504	int ret = 0;
25de24ab DG	505
65d61643	506	ret = ppc_hash64_translate(env, &ctx, address, rwx);
25de24ab DG	507	if (ret == 0) {
	508	tlb_set_page(env, address & TARGET_PAGE_MASK,
	509	ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
	510	mmu_idx, TARGET_PAGE_SIZE);
	511	ret = 0;
	512	} else if (ret < 0) {
	513	LOG_MMU_STATE(env);
91cda45b	514	if (rwx == 2) {
25de24ab DG	515	switch (ret) {
	516	case -1:
	517	env->exception_index = POWERPC_EXCP_ISI;
	518	env->error_code = 0x40000000;
	519	break;
	520	case -2:
	521	/* Access rights violation */
	522	env->exception_index = POWERPC_EXCP_ISI;
	523	env->error_code = 0x08000000;
	524	break;
	525	case -3:
	526	/* No execute protection violation */
	527	env->exception_index = POWERPC_EXCP_ISI;
	528	env->error_code = 0x10000000;
	529	break;
	530	case -5:
	531	/* No match in segment table */
	532	env->exception_index = POWERPC_EXCP_ISEG;
	533	env->error_code = 0;
	534	break;
	535	}
	536	} else {
	537	switch (ret) {
	538	case -1:
	539	/* No matches in page tables or TLB */
	540	env->exception_index = POWERPC_EXCP_DSI;
	541	env->error_code = 0;
	542	env->spr[SPR_DAR] = address;
91cda45b	543	if (rwx == 1) {
25de24ab DG	544	env->spr[SPR_DSISR] = 0x42000000;
	545	} else {
	546	env->spr[SPR_DSISR] = 0x40000000;
	547	}
	548	break;
	549	case -2:
	550	/* Access rights violation */
	551	env->exception_index = POWERPC_EXCP_DSI;
	552	env->error_code = 0;
	553	env->spr[SPR_DAR] = address;
91cda45b	554	if (rwx == 1) {
25de24ab DG	555	env->spr[SPR_DSISR] = 0x0A000000;
	556	} else {
	557	env->spr[SPR_DSISR] = 0x08000000;
	558	}
	559	break;
	560	case -5:
	561	/* No match in segment table */
	562	env->exception_index = POWERPC_EXCP_DSEG;
	563	env->error_code = 0;
	564	env->spr[SPR_DAR] = address;
	565	break;
	566	}
	567	}
	568	#if 0
	569	printf("%s: set exception to %d %02x\n", __func__,
	570	env->exception, env->error_code);
	571	#endif
	572	ret = 1;
	573	}
	574
	575	return ret;
	576	}