target/ppc/mmu-hash64.c

   1 /*
   2  *  PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
   3  *
   4  *  Copyright (c) 2003-2007 Jocelyn Mayer
   5  *  Copyright (c) 2013 David Gibson, IBM Corporation
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20 #include "qemu/osdep.h"
  21 #include "qapi/error.h"
  22 #include "cpu.h"
  23 #include "exec/exec-all.h"
  24 #include "exec/helper-proto.h"
  25 #include "qemu/error-report.h"
  26 #include "sysemu/hw_accel.h"
  27 #include "kvm_ppc.h"
  28 #include "mmu-hash64.h"
  29 #include "exec/log.h"
  30 #include "hw/hw.h"
  31
  32 //#define DEBUG_SLB
  33
  34 #ifdef DEBUG_SLB
  35 #  define LOG_SLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
  36 #else
  37 #  define LOG_SLB(...) do { } while (0)
  38 #endif
  39
  40 /*
  41  * SLB handling
  42  */
  43
  44 static ppc_slb_t *slb_lookup(PowerPCCPU *cpu, target_ulong eaddr)
  45 {
  46     CPUPPCState *env = &cpu->env;
  47     uint64_t esid_256M, esid_1T;
  48     int n;
  49
  50     LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);
  51
  52     esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V;
  53     esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V;
  54
  55     for (n = 0; n < env->slb_nr; n++) {
  56         ppc_slb_t *slb = &env->slb[n];
  57
  58         LOG_SLB("%s: slot %d %016" PRIx64 " %016"
  59                     PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
  60         /* We check for 1T matches on all MMUs here - if the MMU
  61          * doesn't have 1T segment support, we will have prevented 1T
  62          * entries from being inserted in the slbmte code. */
  63         if (((slb->esid == esid_256M) &&
  64              ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
  65             || ((slb->esid == esid_1T) &&
  66                 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
  67             return slb;
  68         }
  69     }
  70
  71     return NULL;
  72 }
  73
  74 void dump_slb(FILE *f, fprintf_function cpu_fprintf, PowerPCCPU *cpu)
  75 {
  76     CPUPPCState *env = &cpu->env;
  77     int i;
  78     uint64_t slbe, slbv;
  79
  80     cpu_synchronize_state(CPU(cpu));
  81
  82     cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
  83     for (i = 0; i < env->slb_nr; i++) {
  84         slbe = env->slb[i].esid;
  85         slbv = env->slb[i].vsid;
  86         if (slbe == 0 && slbv == 0) {
  87             continue;
  88         }
  89         cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
  90                     i, slbe, slbv);
  91     }
  92 }
  93
  94 void helper_slbia(CPUPPCState *env)
  95 {
  96     int n;
  97
  98     /* XXX: Warning: slbia never invalidates the first segment */
  99     for (n = 1; n < env->slb_nr; n++) {
 100         ppc_slb_t *slb = &env->slb[n];
 101
 102         if (slb->esid & SLB_ESID_V) {
 103             slb->esid &= ~SLB_ESID_V;
 104             /* XXX: given the fact that segment size is 256 MB or 1TB,
 105              *      and we still don't have a tlb_flush_mask(env, n, mask)
 106              *      in QEMU, we just invalidate all TLBs
 107              */
 108             env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH;
 109         }
 110     }
 111 }
 112
 113 static void __helper_slbie(CPUPPCState *env, target_ulong addr,
 114                            target_ulong global)
 115 {
 116     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 117     ppc_slb_t *slb;
 118
 119     slb = slb_lookup(cpu, addr);
 120     if (!slb) {
 121         return;
 122     }
 123
 124     if (slb->esid & SLB_ESID_V) {
 125         slb->esid &= ~SLB_ESID_V;
 126
 127         /* XXX: given the fact that segment size is 256 MB or 1TB,
 128          *      and we still don't have a tlb_flush_mask(env, n, mask)
 129          *      in QEMU, we just invalidate all TLBs
 130          */
 131         env->tlb_need_flush |=
 132             (global == false ? TLB_NEED_LOCAL_FLUSH : TLB_NEED_GLOBAL_FLUSH);
 133     }
 134 }
 135
 136 void helper_slbie(CPUPPCState *env, target_ulong addr)
 137 {
 138     __helper_slbie(env, addr, false);
 139 }
 140
 141 void helper_slbieg(CPUPPCState *env, target_ulong addr)
 142 {
 143     __helper_slbie(env, addr, true);
 144 }
 145
 146 int ppc_store_slb(PowerPCCPU *cpu, target_ulong slot,
 147                   target_ulong esid, target_ulong vsid)
 148 {
 149     CPUPPCState *env = &cpu->env;
 150     ppc_slb_t *slb = &env->slb[slot];
 151     const struct ppc_one_seg_page_size *sps = NULL;
 152     int i;
 153
 154     if (slot >= env->slb_nr) {
 155         return -1; /* Bad slot number */
 156     }
 157     if (esid & ~(SLB_ESID_ESID | SLB_ESID_V)) {
 158         return -1; /* Reserved bits set */
 159     }
 160     if (vsid & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
 161         return -1; /* Bad segment size */
 162     }
 163     if ((vsid & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
 164         return -1; /* 1T segment on MMU that doesn't support it */
 165     }
 166
 167     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 168         const struct ppc_one_seg_page_size *sps1 = &env->sps.sps[i];
 169
 170         if (!sps1->page_shift) {
 171             break;
 172         }
 173
 174         if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) {
 175             sps = sps1;
 176             break;
 177         }
 178     }
 179
 180     if (!sps) {
 181         error_report("Bad page size encoding in SLB store: slot "TARGET_FMT_lu
 182                      " esid 0x"TARGET_FMT_lx" vsid 0x"TARGET_FMT_lx,
 183                      slot, esid, vsid);
 184         return -1;
 185     }
 186
 187     slb->esid = esid;
 188     slb->vsid = vsid;
 189     slb->sps = sps;
 190
 191     LOG_SLB("%s: " TARGET_FMT_lu " " TARGET_FMT_lx " - " TARGET_FMT_lx
 192             " => %016" PRIx64 " %016" PRIx64 "\n", __func__, slot, esid, vsid,
 193             slb->esid, slb->vsid);
 194
 195     return 0;
 196 }
 197
 198 static int ppc_load_slb_esid(PowerPCCPU *cpu, target_ulong rb,
 199                              target_ulong *rt)
 200 {
 201     CPUPPCState *env = &cpu->env;
 202     int slot = rb & 0xfff;
 203     ppc_slb_t *slb = &env->slb[slot];
 204
 205     if (slot >= env->slb_nr) {
 206         return -1;
 207     }
 208
 209     *rt = slb->esid;
 210     return 0;
 211 }
 212
 213 static int ppc_load_slb_vsid(PowerPCCPU *cpu, target_ulong rb,
 214                              target_ulong *rt)
 215 {
 216     CPUPPCState *env = &cpu->env;
 217     int slot = rb & 0xfff;
 218     ppc_slb_t *slb = &env->slb[slot];
 219
 220     if (slot >= env->slb_nr) {
 221         return -1;
 222     }
 223
 224     *rt = slb->vsid;
 225     return 0;
 226 }
 227
 228 static int ppc_find_slb_vsid(PowerPCCPU *cpu, target_ulong rb,
 229                              target_ulong *rt)
 230 {
 231     CPUPPCState *env = &cpu->env;
 232     ppc_slb_t *slb;
 233
 234     if (!msr_is_64bit(env, env->msr)) {
 235         rb &= 0xffffffff;
 236     }
 237     slb = slb_lookup(cpu, rb);
 238     if (slb == NULL) {
 239         *rt = (target_ulong)-1ul;
 240     } else {
 241         *rt = slb->vsid;
 242     }
 243     return 0;
 244 }
 245
 246 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
 247 {
 248     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 249
 250     if (ppc_store_slb(cpu, rb & 0xfff, rb & ~0xfffULL, rs) < 0) {
 251         raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
 252                                POWERPC_EXCP_INVAL, GETPC());
 253     }
 254 }
 255
 256 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
 257 {
 258     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 259     target_ulong rt = 0;
 260
 261     if (ppc_load_slb_esid(cpu, rb, &rt) < 0) {
 262         raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
 263                                POWERPC_EXCP_INVAL, GETPC());
 264     }
 265     return rt;
 266 }
 267
 268 target_ulong helper_find_slb_vsid(CPUPPCState *env, target_ulong rb)
 269 {
 270     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 271     target_ulong rt = 0;
 272
 273     if (ppc_find_slb_vsid(cpu, rb, &rt) < 0) {
 274         raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
 275                                POWERPC_EXCP_INVAL, GETPC());
 276     }
 277     return rt;
 278 }
 279
 280 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
 281 {
 282     PowerPCCPU *cpu = ppc_env_get_cpu(env);
 283     target_ulong rt = 0;
 284
 285     if (ppc_load_slb_vsid(cpu, rb, &rt) < 0) {
 286         raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
 287                                POWERPC_EXCP_INVAL, GETPC());
 288     }
 289     return rt;
 290 }
 291
 292 static int ppc_hash64_pte_prot(PowerPCCPU *cpu,
 293                                ppc_slb_t *slb, ppc_hash_pte64_t pte)
 294 {
 295     CPUPPCState *env = &cpu->env;
 296     unsigned pp, key;
 297     /* Some pp bit combinations have undefined behaviour, so default
 298      * to no access in those cases */
 299     int prot = 0;
 300
 301     key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP)
 302              : (slb->vsid & SLB_VSID_KS));
 303     pp = (pte.pte1 & HPTE64_R_PP) | ((pte.pte1 & HPTE64_R_PP0) >> 61);
 304
 305     if (key == 0) {
 306         switch (pp) {
 307         case 0x0:
 308         case 0x1:
 309         case 0x2:
 310             prot = PAGE_READ | PAGE_WRITE;
 311             break;
 312
 313         case 0x3:
 314         case 0x6:
 315             prot = PAGE_READ;
 316             break;
 317         }
 318     } else {
 319         switch (pp) {
 320         case 0x0:
 321         case 0x6:
 322             prot = 0;
 323             break;
 324
 325         case 0x1:
 326         case 0x3:
 327             prot = PAGE_READ;
 328             break;
 329
 330         case 0x2:
 331             prot = PAGE_READ | PAGE_WRITE;
 332             break;
 333         }
 334     }
 335
 336     /* No execute if either noexec or guarded bits set */
 337     if (!(pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G)
 338         || (slb->vsid & SLB_VSID_N)) {
 339         prot |= PAGE_EXEC;
 340     }
 341
 342     return prot;
 343 }
 344
 345 static int ppc_hash64_amr_prot(PowerPCCPU *cpu, ppc_hash_pte64_t pte)
 346 {
 347     CPUPPCState *env = &cpu->env;
 348     int key, amrbits;
 349     int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 350
 351     /* Only recent MMUs implement Virtual Page Class Key Protection */
 352     if (!(env->mmu_model & POWERPC_MMU_AMR)) {
 353         return prot;
 354     }
 355
 356     key = HPTE64_R_KEY(pte.pte1);
 357     amrbits = (env->spr[SPR_AMR] >> 2*(31 - key)) & 0x3;
 358
 359     /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */
 360     /*         env->spr[SPR_AMR]); */
 361
 362     /*
 363      * A store is permitted if the AMR bit is 0. Remove write
 364      * protection if it is set.
 365      */
 366     if (amrbits & 0x2) {
 367         prot &= ~PAGE_WRITE;
 368     }
 369     /*
 370      * A load is permitted if the AMR bit is 0. Remove read
 371      * protection if it is set.
 372      */
 373     if (amrbits & 0x1) {
 374         prot &= ~PAGE_READ;
 375     }
 376
 377     return prot;
 378 }
 379
 380 const ppc_hash_pte64_t *ppc_hash64_map_hptes(PowerPCCPU *cpu,
 381                                              hwaddr ptex, int n)
 382 {
 383     hwaddr pte_offset = ptex * HASH_PTE_SIZE_64;
 384     hwaddr base = ppc_hash64_hpt_base(cpu);
 385     hwaddr plen = n * HASH_PTE_SIZE_64;
 386     const ppc_hash_pte64_t *hptes;
 387
 388     if (cpu->vhyp) {
 389         PPCVirtualHypervisorClass *vhc =
 390             PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
 391         return vhc->map_hptes(cpu->vhyp, ptex, n);
 392     }
 393
 394     if (!base) {
 395         return NULL;
 396     }
 397
 398     hptes = address_space_map(CPU(cpu)->as, base + pte_offset, &plen, false);
 399     if (plen < (n * HASH_PTE_SIZE_64)) {
 400         hw_error("%s: Unable to map all requested HPTEs\n", __func__);
 401     }
 402     return hptes;
 403 }
 404
 405 void ppc_hash64_unmap_hptes(PowerPCCPU *cpu, const ppc_hash_pte64_t *hptes,
 406                             hwaddr ptex, int n)
 407 {
 408     if (cpu->vhyp) {
 409         PPCVirtualHypervisorClass *vhc =
 410             PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
 411         vhc->unmap_hptes(cpu->vhyp, hptes, ptex, n);
 412         return;
 413     }
 414
 415     address_space_unmap(CPU(cpu)->as, (void *)hptes, n * HASH_PTE_SIZE_64,
 416                         false, n * HASH_PTE_SIZE_64);
 417 }
 418
 419 static unsigned hpte_page_shift(const struct ppc_one_seg_page_size *sps,
 420     uint64_t pte0, uint64_t pte1)
 421 {
 422     int i;
 423
 424     if (!(pte0 & HPTE64_V_LARGE)) {
 425         if (sps->page_shift != 12) {
 426             /* 4kiB page in a non 4kiB segment */
 427             return 0;
 428         }
 429         /* Normal 4kiB page */
 430         return 12;
 431     }
 432
 433     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 434         const struct ppc_one_page_size *ps = &sps->enc[i];
 435         uint64_t mask;
 436
 437         if (!ps->page_shift) {
 438             break;
 439         }
 440
 441         if (ps->page_shift == 12) {
 442             /* L bit is set so this can't be a 4kiB page */
 443             continue;
 444         }
 445
 446         mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN;
 447
 448         if ((pte1 & mask) == ((uint64_t)ps->pte_enc << HPTE64_R_RPN_SHIFT)) {
 449             return ps->page_shift;
 450         }
 451     }
 452
 453     return 0; /* Bad page size encoding */
 454 }
 455
 456 static hwaddr ppc_hash64_pteg_search(PowerPCCPU *cpu, hwaddr hash,
 457                                      const struct ppc_one_seg_page_size *sps,
 458                                      target_ulong ptem,
 459                                      ppc_hash_pte64_t *pte, unsigned *pshift)
 460 {
 461     int i;
 462     const ppc_hash_pte64_t *pteg;
 463     target_ulong pte0, pte1;
 464     target_ulong ptex;
 465
 466     ptex = (hash & ppc_hash64_hpt_mask(cpu)) * HPTES_PER_GROUP;
 467     pteg = ppc_hash64_map_hptes(cpu, ptex, HPTES_PER_GROUP);
 468     if (!pteg) {
 469         return -1;
 470     }
 471     for (i = 0; i < HPTES_PER_GROUP; i++) {
 472         pte0 = ppc_hash64_hpte0(cpu, pteg, i);
 473         pte1 = ppc_hash64_hpte1(cpu, pteg, i);
 474
 475         /* This compares V, B, H (secondary) and the AVPN */
 476         if (HPTE64_V_COMPARE(pte0, ptem)) {
 477             *pshift = hpte_page_shift(sps, pte0, pte1);
 478             /*
 479              * If there is no match, ignore the PTE, it could simply
 480              * be for a different segment size encoding and the
 481              * architecture specifies we should not match. Linux will
 482              * potentially leave behind PTEs for the wrong base page
 483              * size when demoting segments.
 484              */
 485             if (*pshift == 0) {
 486                 continue;
 487             }
 488             /* We don't do anything with pshift yet as qemu TLB only deals
 489              * with 4K pages anyway
 490              */
 491             pte->pte0 = pte0;
 492             pte->pte1 = pte1;
 493             ppc_hash64_unmap_hptes(cpu, pteg, ptex, HPTES_PER_GROUP);
 494             return ptex + i;
 495         }
 496     }
 497     ppc_hash64_unmap_hptes(cpu, pteg, ptex, HPTES_PER_GROUP);
 498     /*
 499      * We didn't find a valid entry.
 500      */
 501     return -1;
 502 }
 503
 504 static hwaddr ppc_hash64_htab_lookup(PowerPCCPU *cpu,
 505                                      ppc_slb_t *slb, target_ulong eaddr,
 506                                      ppc_hash_pte64_t *pte, unsigned *pshift)
 507 {
 508     CPUPPCState *env = &cpu->env;
 509     hwaddr hash, ptex;
 510     uint64_t vsid, epnmask, epn, ptem;
 511     const struct ppc_one_seg_page_size *sps = slb->sps;
 512
 513     /* The SLB store path should prevent any bad page size encodings
 514      * getting in there, so: */
 515     assert(sps);
 516
 517     /* If ISL is set in LPCR we need to clamp the page size to 4K */
 518     if (env->spr[SPR_LPCR] & LPCR_ISL) {
 519         /* We assume that when using TCG, 4k is first entry of SPS */
 520         sps = &env->sps.sps[0];
 521         assert(sps->page_shift == 12);
 522     }
 523
 524     epnmask = ~((1ULL << sps->page_shift) - 1);
 525
 526     if (slb->vsid & SLB_VSID_B) {
 527         /* 1TB segment */
 528         vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
 529         epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask;
 530         hash = vsid ^ (vsid << 25) ^ (epn >> sps->page_shift);
 531     } else {
 532         /* 256M segment */
 533         vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
 534         epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask;
 535         hash = vsid ^ (epn >> sps->page_shift);
 536     }
 537     ptem = (slb->vsid & SLB_VSID_PTEM) | ((epn >> 16) & HPTE64_V_AVPN);
 538     ptem |= HPTE64_V_VALID;
 539
 540     /* Page address translation */
 541     qemu_log_mask(CPU_LOG_MMU,
 542             "htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
 543             " hash " TARGET_FMT_plx "\n",
 544             ppc_hash64_hpt_base(cpu), ppc_hash64_hpt_mask(cpu), hash);
 545
 546     /* Primary PTEG lookup */
 547     qemu_log_mask(CPU_LOG_MMU,
 548             "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 549             " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
 550             " hash=" TARGET_FMT_plx "\n",
 551             ppc_hash64_hpt_base(cpu), ppc_hash64_hpt_mask(cpu),
 552             vsid, ptem,  hash);
 553     ptex = ppc_hash64_pteg_search(cpu, hash, sps, ptem, pte, pshift);
 554
 555     if (ptex == -1) {
 556         /* Secondary PTEG lookup */
 557         ptem |= HPTE64_V_SECONDARY;
 558         qemu_log_mask(CPU_LOG_MMU,
 559                 "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
 560                 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
 561                 " hash=" TARGET_FMT_plx "\n", ppc_hash64_hpt_base(cpu),
 562                 ppc_hash64_hpt_mask(cpu), vsid, ptem, ~hash);
 563
 564         ptex = ppc_hash64_pteg_search(cpu, ~hash, sps, ptem, pte, pshift);
 565     }
 566
 567     return ptex;
 568 }
 569
 570 unsigned ppc_hash64_hpte_page_shift_noslb(PowerPCCPU *cpu,
 571                                           uint64_t pte0, uint64_t pte1)
 572 {
 573     CPUPPCState *env = &cpu->env;
 574     int i;
 575
 576     if (!(pte0 & HPTE64_V_LARGE)) {
 577         return 12;
 578     }
 579
 580     /*
 581      * The encodings in env->sps need to be carefully chosen so that
 582      * this gives an unambiguous result.
 583      */
 584     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 585         const struct ppc_one_seg_page_size *sps = &env->sps.sps[i];
 586         unsigned shift;
 587
 588         if (!sps->page_shift) {
 589             break;
 590         }
 591
 592         shift = hpte_page_shift(sps, pte0, pte1);
 593         if (shift) {
 594             return shift;
 595         }
 596     }
 597
 598     return 0;
 599 }
 600
 601 static void ppc_hash64_set_isi(CPUState *cs, CPUPPCState *env,
 602                                uint64_t error_code)
 603 {
 604     bool vpm;
 605
 606     if (msr_ir) {
 607         vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1);
 608     } else {
 609         switch (env->mmu_model) {
 610         case POWERPC_MMU_3_00:
 611             /* Field deprecated in ISAv3.00 - interrupts always go to hyperv */
 612             vpm = true;
 613             break;
 614         default:
 615             vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM0);
 616             break;
 617         }
 618     }
 619     if (vpm && !msr_hv) {
 620         cs->exception_index = POWERPC_EXCP_HISI;
 621     } else {
 622         cs->exception_index = POWERPC_EXCP_ISI;
 623     }
 624     env->error_code = error_code;
 625 }
 626
 627 static void ppc_hash64_set_dsi(CPUState *cs, CPUPPCState *env, uint64_t dar,
 628                                uint64_t dsisr)
 629 {
 630     bool vpm;
 631
 632     if (msr_dr) {
 633         vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1);
 634     } else {
 635         switch (env->mmu_model) {
 636         case POWERPC_MMU_3_00:
 637             /* Field deprecated in ISAv3.00 - interrupts always go to hyperv */
 638             vpm = true;
 639             break;
 640         default:
 641             vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM0);
 642             break;
 643         }
 644     }
 645     if (vpm && !msr_hv) {
 646         cs->exception_index = POWERPC_EXCP_HDSI;
 647         env->spr[SPR_HDAR] = dar;
 648         env->spr[SPR_HDSISR] = dsisr;
 649     } else {
 650         cs->exception_index = POWERPC_EXCP_DSI;
 651         env->spr[SPR_DAR] = dar;
 652         env->spr[SPR_DSISR] = dsisr;
 653    }
 654     env->error_code = 0;
 655 }
 656
 657
 658 int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr,
 659                                 int rwx, int mmu_idx)
 660 {
 661     CPUState *cs = CPU(cpu);
 662     CPUPPCState *env = &cpu->env;
 663     ppc_slb_t *slb;
 664     unsigned apshift;
 665     hwaddr ptex;
 666     ppc_hash_pte64_t pte;
 667     int pp_prot, amr_prot, prot;
 668     uint64_t new_pte1, dsisr;
 669     const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
 670     hwaddr raddr;
 671
 672     assert((rwx == 0) || (rwx == 1) || (rwx == 2));
 673
 674     /* Note on LPCR usage: 970 uses HID4, but our special variant
 675      * of store_spr copies relevant fields into env->spr[SPR_LPCR].
 676      * Similarily we filter unimplemented bits when storing into
 677      * LPCR depending on the MMU version. This code can thus just
 678      * use the LPCR "as-is".
 679      */
 680
 681     /* 1. Handle real mode accesses */
 682     if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
 683         /* Translation is supposedly "off"  */
 684         /* In real mode the top 4 effective address bits are (mostly) ignored */
 685         raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
 686
 687         /* In HV mode, add HRMOR if top EA bit is clear */
 688         if (msr_hv || !env->has_hv_mode) {
 689             if (!(eaddr >> 63)) {
 690                 raddr |= env->spr[SPR_HRMOR];
 691             }
 692         } else {
 693             /* Otherwise, check VPM for RMA vs VRMA */
 694             if (env->spr[SPR_LPCR] & LPCR_VPM0) {
 695                 slb = &env->vrma_slb;
 696                 if (slb->sps) {
 697                     goto skip_slb_search;
 698                 }
 699                 /* Not much else to do here */
 700                 cs->exception_index = POWERPC_EXCP_MCHECK;
 701                 env->error_code = 0;
 702                 return 1;
 703             } else if (raddr < env->rmls) {
 704                 /* RMA. Check bounds in RMLS */
 705                 raddr |= env->spr[SPR_RMOR];
 706             } else {
 707                 /* The access failed, generate the approriate interrupt */
 708                 if (rwx == 2) {
 709                     ppc_hash64_set_isi(cs, env, 0x08000000);
 710                 } else {
 711                     dsisr = 0x08000000;
 712                     if (rwx == 1) {
 713                         dsisr |= 0x02000000;
 714                     }
 715                     ppc_hash64_set_dsi(cs, env, eaddr, dsisr);
 716                 }
 717                 return 1;
 718             }
 719         }
 720         tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 721                      PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
 722                      TARGET_PAGE_SIZE);
 723         return 0;
 724     }
 725
 726     /* 2. Translation is on, so look up the SLB */
 727     slb = slb_lookup(cpu, eaddr);
 728     if (!slb) {
 729         if (rwx == 2) {
 730             cs->exception_index = POWERPC_EXCP_ISEG;
 731             env->error_code = 0;
 732         } else {
 733             cs->exception_index = POWERPC_EXCP_DSEG;
 734             env->error_code = 0;
 735             env->spr[SPR_DAR] = eaddr;
 736         }
 737         return 1;
 738     }
 739
 740 skip_slb_search:
 741
 742     /* 3. Check for segment level no-execute violation */
 743     if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) {
 744         ppc_hash64_set_isi(cs, env, 0x10000000);
 745         return 1;
 746     }
 747
 748     /* 4. Locate the PTE in the hash table */
 749     ptex = ppc_hash64_htab_lookup(cpu, slb, eaddr, &pte, &apshift);
 750     if (ptex == -1) {
 751         dsisr = 0x40000000;
 752         if (rwx == 2) {
 753             ppc_hash64_set_isi(cs, env, dsisr);
 754         } else {
 755             if (rwx == 1) {
 756                 dsisr |= 0x02000000;
 757             }
 758             ppc_hash64_set_dsi(cs, env, eaddr, dsisr);
 759         }
 760         return 1;
 761     }
 762     qemu_log_mask(CPU_LOG_MMU,
 763                   "found PTE at index %08" HWADDR_PRIx "\n", ptex);
 764
 765     /* 5. Check access permissions */
 766
 767     pp_prot = ppc_hash64_pte_prot(cpu, slb, pte);
 768     amr_prot = ppc_hash64_amr_prot(cpu, pte);
 769     prot = pp_prot & amr_prot;
 770
 771     if ((need_prot[rwx] & ~prot) != 0) {
 772         /* Access right violation */
 773         qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
 774         if (rwx == 2) {
 775             ppc_hash64_set_isi(cs, env, 0x08000000);
 776         } else {
 777             dsisr = 0;
 778             if (need_prot[rwx] & ~pp_prot) {
 779                 dsisr |= 0x08000000;
 780             }
 781             if (rwx == 1) {
 782                 dsisr |= 0x02000000;
 783             }
 784             if (need_prot[rwx] & ~amr_prot) {
 785                 dsisr |= 0x00200000;
 786             }
 787             ppc_hash64_set_dsi(cs, env, eaddr, dsisr);
 788         }
 789         return 1;
 790     }
 791
 792     qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
 793
 794     /* 6. Update PTE referenced and changed bits if necessary */
 795
 796     new_pte1 = pte.pte1 | HPTE64_R_R; /* set referenced bit */
 797     if (rwx == 1) {
 798         new_pte1 |= HPTE64_R_C; /* set changed (dirty) bit */
 799     } else {
 800         /* Treat the page as read-only for now, so that a later write
 801          * will pass through this function again to set the C bit */
 802         prot &= ~PAGE_WRITE;
 803     }
 804
 805     if (new_pte1 != pte.pte1) {
 806         ppc_hash64_store_hpte(cpu, ptex, pte.pte0, new_pte1);
 807     }
 808
 809     /* 7. Determine the real address from the PTE */
 810
 811     raddr = deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, eaddr);
 812
 813     tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
 814                  prot, mmu_idx, 1ULL << apshift);
 815
 816     return 0;
 817 }
 818
 819 hwaddr ppc_hash64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr)
 820 {
 821     CPUPPCState *env = &cpu->env;
 822     ppc_slb_t *slb;
 823     hwaddr ptex, raddr;
 824     ppc_hash_pte64_t pte;
 825     unsigned apshift;
 826
 827     /* Handle real mode */
 828     if (msr_dr == 0) {
 829         /* In real mode the top 4 effective address bits are ignored */
 830         raddr = addr & 0x0FFFFFFFFFFFFFFFULL;
 831
 832         /* In HV mode, add HRMOR if top EA bit is clear */
 833         if ((msr_hv || !env->has_hv_mode) && !(addr >> 63)) {
 834             return raddr | env->spr[SPR_HRMOR];
 835         }
 836
 837         /* Otherwise, check VPM for RMA vs VRMA */
 838         if (env->spr[SPR_LPCR] & LPCR_VPM0) {
 839             slb = &env->vrma_slb;
 840             if (!slb->sps) {
 841                 return -1;
 842             }
 843         } else if (raddr < env->rmls) {
 844             /* RMA. Check bounds in RMLS */
 845             return raddr | env->spr[SPR_RMOR];
 846         } else {
 847             return -1;
 848         }
 849     } else {
 850         slb = slb_lookup(cpu, addr);
 851         if (!slb) {
 852             return -1;
 853         }
 854     }
 855
 856     ptex = ppc_hash64_htab_lookup(cpu, slb, addr, &pte, &apshift);
 857     if (ptex == -1) {
 858         return -1;
 859     }
 860
 861     return deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, addr)
 862         & TARGET_PAGE_MASK;
 863 }
 864
 865 void ppc_hash64_store_hpte(PowerPCCPU *cpu, hwaddr ptex,
 866                            uint64_t pte0, uint64_t pte1)
 867 {
 868     hwaddr base = ppc_hash64_hpt_base(cpu);
 869     hwaddr offset = ptex * HASH_PTE_SIZE_64;
 870
 871     if (cpu->vhyp) {
 872         PPCVirtualHypervisorClass *vhc =
 873             PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
 874         vhc->store_hpte(cpu->vhyp, ptex, pte0, pte1);
 875         return;
 876     }
 877
 878     stq_phys(CPU(cpu)->as, base + offset, pte0);
 879     stq_phys(CPU(cpu)->as, base + offset + HASH_PTE_SIZE_64 / 2, pte1);
 880 }
 881
 882 void ppc_hash64_tlb_flush_hpte(PowerPCCPU *cpu, target_ulong ptex,
 883                                target_ulong pte0, target_ulong pte1)
 884 {
 885     /*
 886      * XXX: given the fact that there are too many segments to
 887      * invalidate, and we still don't have a tlb_flush_mask(env, n,
 888      * mask) in QEMU, we just invalidate all TLBs
 889      */
 890     cpu->env.tlb_need_flush = TLB_NEED_GLOBAL_FLUSH | TLB_NEED_LOCAL_FLUSH;
 891 }
 892
 893 void ppc_hash64_update_rmls(CPUPPCState *env)
 894 {
 895     uint64_t lpcr = env->spr[SPR_LPCR];
 896
 897     /*
 898      * This is the full 4 bits encoding of POWER8. Previous
 899      * CPUs only support a subset of these but the filtering
 900      * is done when writing LPCR
 901      */
 902     switch ((lpcr & LPCR_RMLS) >> LPCR_RMLS_SHIFT) {
 903     case 0x8: /* 32MB */
 904         env->rmls = 0x2000000ull;
 905         break;
 906     case 0x3: /* 64MB */
 907         env->rmls = 0x4000000ull;
 908         break;
 909     case 0x7: /* 128MB */
 910         env->rmls = 0x8000000ull;
 911         break;
 912     case 0x4: /* 256MB */
 913         env->rmls = 0x10000000ull;
 914         break;
 915     case 0x2: /* 1GB */
 916         env->rmls = 0x40000000ull;
 917         break;
 918     case 0x1: /* 16GB */
 919         env->rmls = 0x400000000ull;
 920         break;
 921     default:
 922         /* What to do here ??? */
 923         env->rmls = 0;
 924     }
 925 }
 926
 927 void ppc_hash64_update_vrma(CPUPPCState *env)
 928 {
 929     const struct ppc_one_seg_page_size *sps = NULL;
 930     target_ulong esid, vsid, lpcr;
 931     ppc_slb_t *slb = &env->vrma_slb;
 932     uint32_t vrmasd;
 933     int i;
 934
 935     /* First clear it */
 936     slb->esid = slb->vsid = 0;
 937     slb->sps = NULL;
 938
 939     /* Is VRMA enabled ? */
 940     lpcr = env->spr[SPR_LPCR];
 941     if (!(lpcr & LPCR_VPM0)) {
 942         return;
 943     }
 944
 945     /* Make one up. Mostly ignore the ESID which will not be
 946      * needed for translation
 947      */
 948     vsid = SLB_VSID_VRMA;
 949     vrmasd = (lpcr & LPCR_VRMASD) >> LPCR_VRMASD_SHIFT;
 950     vsid |= (vrmasd << 4) & (SLB_VSID_L | SLB_VSID_LP);
 951     esid = SLB_ESID_V;
 952
 953    for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
 954         const struct ppc_one_seg_page_size *sps1 = &env->sps.sps[i];
 955
 956         if (!sps1->page_shift) {
 957             break;
 958         }
 959
 960         if ((vsid & SLB_VSID_LLP_MASK) == sps1->slb_enc) {
 961             sps = sps1;
 962             break;
 963         }
 964     }
 965
 966     if (!sps) {
 967         error_report("Bad page size encoding esid 0x"TARGET_FMT_lx
 968                      " vsid 0x"TARGET_FMT_lx, esid, vsid);
 969         return;
 970     }
 971
 972     slb->vsid = vsid;
 973     slb->esid = esid;
 974     slb->sps = sps;
 975 }
 976
 977 void helper_store_lpcr(CPUPPCState *env, target_ulong val)
 978 {
 979     uint64_t lpcr = 0;
 980
 981     /* Filter out bits */
 982     switch (env->mmu_model) {
 983     case POWERPC_MMU_64B: /* 970 */
 984         if (val & 0x40) {
 985             lpcr |= LPCR_LPES0;
 986         }
 987         if (val & 0x8000000000000000ull) {
 988             lpcr |= LPCR_LPES1;
 989         }
 990         if (val & 0x20) {
 991             lpcr |= (0x4ull << LPCR_RMLS_SHIFT);
 992         }
 993         if (val & 0x4000000000000000ull) {
 994             lpcr |= (0x2ull << LPCR_RMLS_SHIFT);
 995         }
 996         if (val & 0x2000000000000000ull) {
 997             lpcr |= (0x1ull << LPCR_RMLS_SHIFT);
 998         }
 999         env->spr[SPR_RMOR] = ((lpcr >> 41) & 0xffffull) << 26;
1000
1001         /* XXX We could also write LPID from HID4 here
1002          * but since we don't tag any translation on it
1003          * it doesn't actually matter
1004          */
1005         /* XXX For proper emulation of 970 we also need
1006          * to dig HRMOR out of HID5
1007          */
1008         break;
1009     case POWERPC_MMU_2_03: /* P5p */
1010         lpcr = val & (LPCR_RMLS | LPCR_ILE |
1011                       LPCR_LPES0 | LPCR_LPES1 |
1012                       LPCR_RMI | LPCR_HDICE);
1013         break;
1014     case POWERPC_MMU_2_06: /* P7 */
1015         lpcr = val & (LPCR_VPM0 | LPCR_VPM1 | LPCR_ISL | LPCR_DPFD |
1016                       LPCR_VRMASD | LPCR_RMLS | LPCR_ILE |
1017                       LPCR_P7_PECE0 | LPCR_P7_PECE1 | LPCR_P7_PECE2 |
1018                       LPCR_MER | LPCR_TC |
1019                       LPCR_LPES0 | LPCR_LPES1 | LPCR_HDICE);
1020         break;
1021     case POWERPC_MMU_2_07: /* P8 */
1022         lpcr = val & (LPCR_VPM0 | LPCR_VPM1 | LPCR_ISL | LPCR_KBV |
1023                       LPCR_DPFD | LPCR_VRMASD | LPCR_RMLS | LPCR_ILE |
1024                       LPCR_AIL | LPCR_ONL | LPCR_P8_PECE0 | LPCR_P8_PECE1 |
1025                       LPCR_P8_PECE2 | LPCR_P8_PECE3 | LPCR_P8_PECE4 |
1026                       LPCR_MER | LPCR_TC | LPCR_LPES0 | LPCR_HDICE);
1027         break;
1028     case POWERPC_MMU_3_00: /* P9 */
1029         lpcr = val & (LPCR_VPM1 | LPCR_ISL | LPCR_KBV | LPCR_DPFD |
1030                       (LPCR_PECE_U_MASK & LPCR_HVEE) | LPCR_ILE | LPCR_AIL |
1031                       LPCR_UPRT | LPCR_EVIRT | LPCR_ONL |
1032                       (LPCR_PECE_L_MASK & (LPCR_PDEE | LPCR_HDEE | LPCR_EEE |
1033                       LPCR_DEE | LPCR_OEE)) | LPCR_MER | LPCR_GTSE | LPCR_TC |
1034                       LPCR_HEIC | LPCR_LPES0 | LPCR_HVICE | LPCR_HDICE);
1035         break;
1036     default:
1037         ;
1038     }
1039     env->spr[SPR_LPCR] = lpcr;
1040     ppc_hash64_update_rmls(env);
1041     ppc_hash64_update_vrma(env);
1042 }