2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 * Copyright (c) 2013 David Gibson, IBM Corporation
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
22 #include "sysemu/kvm.h"
24 #include "mmu-hash64.h"
30 # define LOG_MMU(...) qemu_log(__VA_ARGS__)
31 # define LOG_MMU_STATE(env) log_cpu_state((env), 0)
33 # define LOG_MMU(...) do { } while (0)
34 # define LOG_MMU_STATE(...) do { } while (0)
38 # define LOG_SLB(...) qemu_log(__VA_ARGS__)
40 # define LOG_SLB(...) do { } while (0)
43 struct mmu_ctx_hash64
{
44 hwaddr raddr
; /* Real address */
45 int prot
; /* Protection bits */
52 static ppc_slb_t
*slb_lookup(CPUPPCState
*env
, target_ulong eaddr
)
54 uint64_t esid_256M
, esid_1T
;
57 LOG_SLB("%s: eaddr " TARGET_FMT_lx
"\n", __func__
, eaddr
);
59 esid_256M
= (eaddr
& SEGMENT_MASK_256M
) | SLB_ESID_V
;
60 esid_1T
= (eaddr
& SEGMENT_MASK_1T
) | SLB_ESID_V
;
62 for (n
= 0; n
< env
->slb_nr
; n
++) {
63 ppc_slb_t
*slb
= &env
->slb
[n
];
65 LOG_SLB("%s: slot %d %016" PRIx64
" %016"
66 PRIx64
"\n", __func__
, n
, slb
->esid
, slb
->vsid
);
67 /* We check for 1T matches on all MMUs here - if the MMU
68 * doesn't have 1T segment support, we will have prevented 1T
69 * entries from being inserted in the slbmte code. */
70 if (((slb
->esid
== esid_256M
) &&
71 ((slb
->vsid
& SLB_VSID_B
) == SLB_VSID_B_256M
))
72 || ((slb
->esid
== esid_1T
) &&
73 ((slb
->vsid
& SLB_VSID_B
) == SLB_VSID_B_1T
))) {
81 void dump_slb(FILE *f
, fprintf_function cpu_fprintf
, CPUPPCState
*env
)
86 cpu_synchronize_state(env
);
88 cpu_fprintf(f
, "SLB\tESID\t\t\tVSID\n");
89 for (i
= 0; i
< env
->slb_nr
; i
++) {
90 slbe
= env
->slb
[i
].esid
;
91 slbv
= env
->slb
[i
].vsid
;
92 if (slbe
== 0 && slbv
== 0) {
95 cpu_fprintf(f
, "%d\t0x%016" PRIx64
"\t0x%016" PRIx64
"\n",
100 void helper_slbia(CPUPPCState
*env
)
102 int n
, do_invalidate
;
105 /* XXX: Warning: slbia never invalidates the first segment */
106 for (n
= 1; n
< env
->slb_nr
; n
++) {
107 ppc_slb_t
*slb
= &env
->slb
[n
];
109 if (slb
->esid
& SLB_ESID_V
) {
110 slb
->esid
&= ~SLB_ESID_V
;
111 /* XXX: given the fact that segment size is 256 MB or 1TB,
112 * and we still don't have a tlb_flush_mask(env, n, mask)
113 * in QEMU, we just invalidate all TLBs
123 void helper_slbie(CPUPPCState
*env
, target_ulong addr
)
127 slb
= slb_lookup(env
, addr
);
132 if (slb
->esid
& SLB_ESID_V
) {
133 slb
->esid
&= ~SLB_ESID_V
;
135 /* XXX: given the fact that segment size is 256 MB or 1TB,
136 * and we still don't have a tlb_flush_mask(env, n, mask)
137 * in QEMU, we just invalidate all TLBs
143 int ppc_store_slb(CPUPPCState
*env
, target_ulong rb
, target_ulong rs
)
145 int slot
= rb
& 0xfff;
146 ppc_slb_t
*slb
= &env
->slb
[slot
];
148 if (rb
& (0x1000 - env
->slb_nr
)) {
149 return -1; /* Reserved bits set or slot too high */
151 if (rs
& (SLB_VSID_B
& ~SLB_VSID_B_1T
)) {
152 return -1; /* Bad segment size */
154 if ((rs
& SLB_VSID_B
) && !(env
->mmu_model
& POWERPC_MMU_1TSEG
)) {
155 return -1; /* 1T segment on MMU that doesn't support it */
158 /* Mask out the slot number as we store the entry */
159 slb
->esid
= rb
& (SLB_ESID_ESID
| SLB_ESID_V
);
162 LOG_SLB("%s: %d " TARGET_FMT_lx
" - " TARGET_FMT_lx
" => %016" PRIx64
163 " %016" PRIx64
"\n", __func__
, slot
, rb
, rs
,
164 slb
->esid
, slb
->vsid
);
169 static int ppc_load_slb_esid(CPUPPCState
*env
, target_ulong rb
,
172 int slot
= rb
& 0xfff;
173 ppc_slb_t
*slb
= &env
->slb
[slot
];
175 if (slot
>= env
->slb_nr
) {
183 static int ppc_load_slb_vsid(CPUPPCState
*env
, target_ulong rb
,
186 int slot
= rb
& 0xfff;
187 ppc_slb_t
*slb
= &env
->slb
[slot
];
189 if (slot
>= env
->slb_nr
) {
197 void helper_store_slb(CPUPPCState
*env
, target_ulong rb
, target_ulong rs
)
199 if (ppc_store_slb(env
, rb
, rs
) < 0) {
200 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
205 target_ulong
helper_load_slb_esid(CPUPPCState
*env
, target_ulong rb
)
209 if (ppc_load_slb_esid(env
, rb
, &rt
) < 0) {
210 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
216 target_ulong
helper_load_slb_vsid(CPUPPCState
*env
, target_ulong rb
)
220 if (ppc_load_slb_vsid(env
, rb
, &rt
) < 0) {
221 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
228 * 64-bit hash table MMU handling
231 static int ppc_hash64_pte_prot(CPUPPCState
*env
,
232 ppc_slb_t
*slb
, ppc_hash_pte64_t pte
)
235 /* Some pp bit combinations have undefined behaviour, so default
236 * to no access in those cases */
239 key
= !!(msr_pr
? (slb
->vsid
& SLB_VSID_KP
)
240 : (slb
->vsid
& SLB_VSID_KS
));
241 pp
= (pte
.pte1
& HPTE64_R_PP
) | ((pte
.pte1
& HPTE64_R_PP0
) >> 61);
248 prot
= PAGE_READ
| PAGE_WRITE
;
269 prot
= PAGE_READ
| PAGE_WRITE
;
274 /* No execute if either noexec or guarded bits set */
275 if (!(pte
.pte1
& HPTE64_R_N
) || (pte
.pte1
& HPTE64_R_G
)
276 || (slb
->vsid
& SLB_VSID_N
)) {
283 static hwaddr
ppc_hash64_pteg_search(CPUPPCState
*env
, hwaddr pteg_off
,
284 bool secondary
, target_ulong ptem
,
285 ppc_hash_pte64_t
*pte
)
287 hwaddr pte_offset
= pteg_off
;
288 target_ulong pte0
, pte1
;
291 for (i
= 0; i
< HPTES_PER_GROUP
; i
++) {
292 pte0
= ppc_hash64_load_hpte0(env
, pte_offset
);
293 pte1
= ppc_hash64_load_hpte1(env
, pte_offset
);
295 if ((pte0
& HPTE64_V_VALID
)
296 && (secondary
== !!(pte0
& HPTE64_V_SECONDARY
))
297 && HPTE64_V_COMPARE(pte0
, ptem
)) {
303 pte_offset
+= HASH_PTE_SIZE_64
;
309 static hwaddr
ppc_hash64_htab_lookup(CPUPPCState
*env
,
310 ppc_slb_t
*slb
, target_ulong eaddr
,
311 ppc_hash_pte64_t
*pte
)
313 hwaddr pteg_off
, pte_offset
;
315 uint64_t vsid
, epnshift
, epnmask
, epn
, ptem
;
317 /* Page size according to the SLB, which we use to generate the
318 * EPN for hash table lookup.. When we implement more recent MMU
319 * extensions this might be different from the actual page size
320 * encoded in the PTE */
321 epnshift
= (slb
->vsid
& SLB_VSID_L
)
322 ? TARGET_PAGE_BITS_16M
: TARGET_PAGE_BITS
;
323 epnmask
= ~((1ULL << epnshift
) - 1);
325 if (slb
->vsid
& SLB_VSID_B
) {
327 vsid
= (slb
->vsid
& SLB_VSID_VSID
) >> SLB_VSID_SHIFT_1T
;
328 epn
= (eaddr
& ~SEGMENT_MASK_1T
) & epnmask
;
329 hash
= vsid
^ (vsid
<< 25) ^ (epn
>> epnshift
);
332 vsid
= (slb
->vsid
& SLB_VSID_VSID
) >> SLB_VSID_SHIFT
;
333 epn
= (eaddr
& ~SEGMENT_MASK_256M
) & epnmask
;
334 hash
= vsid
^ (epn
>> epnshift
);
336 ptem
= (slb
->vsid
& SLB_VSID_PTEM
) | ((epn
>> 16) & HPTE64_V_AVPN
);
338 /* Page address translation */
339 LOG_MMU("htab_base " TARGET_FMT_plx
" htab_mask " TARGET_FMT_plx
340 " hash " TARGET_FMT_plx
"\n",
341 env
->htab_base
, env
->htab_mask
, hash
);
343 /* Primary PTEG lookup */
344 LOG_MMU("0 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
345 " vsid=" TARGET_FMT_lx
" ptem=" TARGET_FMT_lx
346 " hash=" TARGET_FMT_plx
"\n",
347 env
->htab_base
, env
->htab_mask
, vsid
, ptem
, hash
);
348 pteg_off
= (hash
* HASH_PTEG_SIZE_64
) & env
->htab_mask
;
349 pte_offset
= ppc_hash64_pteg_search(env
, pteg_off
, 0, ptem
, pte
);
351 if (pte_offset
== -1) {
352 /* Secondary PTEG lookup */
353 LOG_MMU("1 htab=" TARGET_FMT_plx
"/" TARGET_FMT_plx
354 " vsid=" TARGET_FMT_lx
" api=" TARGET_FMT_lx
355 " hash=" TARGET_FMT_plx
"\n", env
->htab_base
,
356 env
->htab_mask
, vsid
, ptem
, ~hash
);
358 pteg_off
= (~hash
* HASH_PTEG_SIZE_64
) & env
->htab_mask
;
359 pte_offset
= ppc_hash64_pteg_search(env
, pteg_off
, 1, ptem
, pte
);
365 static hwaddr
ppc_hash64_pte_raddr(ppc_slb_t
*slb
, ppc_hash_pte64_t pte
,
368 hwaddr rpn
= pte
.pte1
& HPTE64_R_RPN
;
369 /* FIXME: Add support for SLLP extended page sizes */
370 int target_page_bits
= (slb
->vsid
& SLB_VSID_L
)
371 ? TARGET_PAGE_BITS_16M
: TARGET_PAGE_BITS
;
372 hwaddr mask
= (1ULL << target_page_bits
) - 1;
374 return (rpn
& ~mask
) | (eaddr
& mask
);
377 static int ppc_hash64_translate(CPUPPCState
*env
, struct mmu_ctx_hash64
*ctx
,
378 target_ulong eaddr
, int rwx
)
382 ppc_hash_pte64_t pte
;
384 const int need_prot
[] = {PAGE_READ
, PAGE_WRITE
, PAGE_EXEC
};
386 assert((rwx
== 0) || (rwx
== 1) || (rwx
== 2));
388 /* 1. Handle real mode accesses */
389 if (((rwx
== 2) && (msr_ir
== 0)) || ((rwx
!= 2) && (msr_dr
== 0))) {
390 /* Translation is off */
391 /* In real mode the top 4 effective address bits are ignored */
392 ctx
->raddr
= eaddr
& 0x0FFFFFFFFFFFFFFFULL
;
393 ctx
->prot
= PAGE_READ
| PAGE_EXEC
| PAGE_WRITE
;
397 /* 2. Translation is on, so look up the SLB */
398 slb
= slb_lookup(env
, eaddr
);
404 /* 3. Check for segment level no-execute violation */
405 if ((rwx
== 2) && (slb
->vsid
& SLB_VSID_N
)) {
409 /* 4. Locate the PTE in the hash table */
410 pte_offset
= ppc_hash64_htab_lookup(env
, slb
, eaddr
, &pte
);
411 if (pte_offset
== -1) {
414 LOG_MMU("found PTE at offset %08" HWADDR_PRIx
"\n", pte_offset
);
416 /* 5. Check access permissions */
418 ctx
->prot
= ppc_hash64_pte_prot(env
, slb
, pte
);
420 if ((need_prot
[rwx
] & ~ctx
->prot
) != 0) {
421 /* Access right violation */
422 LOG_MMU("PTE access rejected\n");
426 LOG_MMU("PTE access granted !\n");
428 /* 6. Update PTE referenced and changed bits if necessary */
430 new_pte1
= pte
.pte1
| HPTE64_R_R
; /* set referenced bit */
432 new_pte1
|= HPTE64_R_C
; /* set changed (dirty) bit */
434 /* Treat the page as read-only for now, so that a later write
435 * will pass through this function again to set the C bit */
436 ctx
->prot
&= ~PAGE_WRITE
;
439 if (new_pte1
!= pte
.pte1
) {
440 ppc_hash64_store_hpte1(env
, pte_offset
, new_pte1
);
443 /* 7. Determine the real address from the PTE */
445 ctx
->raddr
= ppc_hash64_pte_raddr(slb
, pte
, eaddr
);
450 hwaddr
ppc_hash64_get_phys_page_debug(CPUPPCState
*env
, target_ulong addr
)
454 ppc_hash_pte64_t pte
;
457 /* In real mode the top 4 effective address bits are ignored */
458 return addr
& 0x0FFFFFFFFFFFFFFFULL
;
461 slb
= slb_lookup(env
, addr
);
466 pte_offset
= ppc_hash64_htab_lookup(env
, slb
, addr
, &pte
);
467 if (pte_offset
== -1) {
471 return ppc_hash64_pte_raddr(slb
, pte
, addr
) & TARGET_PAGE_MASK
;
474 int ppc_hash64_handle_mmu_fault(CPUPPCState
*env
, target_ulong address
, int rwx
,
477 struct mmu_ctx_hash64 ctx
;
480 ret
= ppc_hash64_translate(env
, &ctx
, address
, rwx
);
482 tlb_set_page(env
, address
& TARGET_PAGE_MASK
,
483 ctx
.raddr
& TARGET_PAGE_MASK
, ctx
.prot
,
484 mmu_idx
, TARGET_PAGE_SIZE
);
486 } else if (ret
< 0) {
491 env
->exception_index
= POWERPC_EXCP_ISI
;
492 env
->error_code
= 0x40000000;
495 /* Access rights violation */
496 env
->exception_index
= POWERPC_EXCP_ISI
;
497 env
->error_code
= 0x08000000;
500 /* No execute protection violation */
501 env
->exception_index
= POWERPC_EXCP_ISI
;
502 env
->error_code
= 0x10000000;
505 /* No match in segment table */
506 env
->exception_index
= POWERPC_EXCP_ISEG
;
513 /* No matches in page tables or TLB */
514 env
->exception_index
= POWERPC_EXCP_DSI
;
516 env
->spr
[SPR_DAR
] = address
;
518 env
->spr
[SPR_DSISR
] = 0x42000000;
520 env
->spr
[SPR_DSISR
] = 0x40000000;
524 /* Access rights violation */
525 env
->exception_index
= POWERPC_EXCP_DSI
;
527 env
->spr
[SPR_DAR
] = address
;
529 env
->spr
[SPR_DSISR
] = 0x0A000000;
531 env
->spr
[SPR_DSISR
] = 0x08000000;
535 /* No match in segment table */
536 env
->exception_index
= POWERPC_EXCP_DSEG
;
538 env
->spr
[SPR_DAR
] = address
;
543 printf("%s: set exception to %d %02x\n", __func__
,
544 env
->exception
, env
->error_code
);