2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 * Copyright (c) 2013 David Gibson, IBM Corporation
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "exec/helper-proto.h"
22 #include "sysemu/kvm.h"
24 #include "mmu-hash64.h"
30 # define LOG_MMU_STATE(cpu) log_cpu_state((cpu), 0)
32 # define LOG_MMU_STATE(cpu) do { } while (0)
36 # define LOG_SLB(...) qemu_log(__VA_ARGS__)
38 # define LOG_SLB(...) do { } while (0)
42 * Used to indicate whether we have allocated htab in the
45 bool kvmppc_kern_htab;
50 static ppc_slb_t *slb_lookup(CPUPPCState *env, target_ulong eaddr)
52 uint64_t esid_256M, esid_1T;
55 LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);
57 esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V;
58 esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V;
60 for (n = 0; n < env->slb_nr; n++) {
61 ppc_slb_t *slb = &env->slb[n];
63 LOG_SLB("%s: slot %d %016" PRIx64 " %016"
64 PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
65 /* We check for 1T matches on all MMUs here - if the MMU
66 * doesn't have 1T segment support, we will have prevented 1T
67 * entries from being inserted in the slbmte code. */
68 if (((slb->esid == esid_256M) &&
69 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
70 || ((slb->esid == esid_1T) &&
71 ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
79 void dump_slb(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
84 cpu_synchronize_state(CPU(ppc_env_get_cpu(env)));
86 cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
87 for (i = 0; i < env->slb_nr; i++) {
88 slbe = env->slb[i].esid;
89 slbv = env->slb[i].vsid;
90 if (slbe == 0 && slbv == 0) {
93 cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
98 void helper_slbia(CPUPPCState *env)
100 PowerPCCPU *cpu = ppc_env_get_cpu(env);
101 int n, do_invalidate;
104 /* XXX: Warning: slbia never invalidates the first segment */
105 for (n = 1; n < env->slb_nr; n++) {
106 ppc_slb_t *slb = &env->slb[n];
108 if (slb->esid & SLB_ESID_V) {
109 slb->esid &= ~SLB_ESID_V;
110 /* XXX: given the fact that segment size is 256 MB or 1TB,
111 * and we still don't have a tlb_flush_mask(env, n, mask)
112 * in QEMU, we just invalidate all TLBs
118 tlb_flush(CPU(cpu), 1);
122 void helper_slbie(CPUPPCState *env, target_ulong addr)
124 PowerPCCPU *cpu = ppc_env_get_cpu(env);
127 slb = slb_lookup(env, addr);
132 if (slb->esid & SLB_ESID_V) {
133 slb->esid &= ~SLB_ESID_V;
135 /* XXX: given the fact that segment size is 256 MB or 1TB,
136 * and we still don't have a tlb_flush_mask(env, n, mask)
137 * in QEMU, we just invalidate all TLBs
139 tlb_flush(CPU(cpu), 1);
143 int ppc_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
145 int slot = rb & 0xfff;
146 ppc_slb_t *slb = &env->slb[slot];
148 if (rb & (0x1000 - env->slb_nr)) {
149 return -1; /* Reserved bits set or slot too high */
151 if (rs & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
152 return -1; /* Bad segment size */
154 if ((rs & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
155 return -1; /* 1T segment on MMU that doesn't support it */
158 /* Mask out the slot number as we store the entry */
159 slb->esid = rb & (SLB_ESID_ESID | SLB_ESID_V);
162 LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
163 " %016" PRIx64 "\n", __func__, slot, rb, rs,
164 slb->esid, slb->vsid);
169 static int ppc_load_slb_esid(CPUPPCState *env, target_ulong rb,
172 int slot = rb & 0xfff;
173 ppc_slb_t *slb = &env->slb[slot];
175 if (slot >= env->slb_nr) {
183 static int ppc_load_slb_vsid(CPUPPCState *env, target_ulong rb,
186 int slot = rb & 0xfff;
187 ppc_slb_t *slb = &env->slb[slot];
189 if (slot >= env->slb_nr) {
197 void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
199 if (ppc_store_slb(env, rb, rs) < 0) {
200 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
205 target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
209 if (ppc_load_slb_esid(env, rb, &rt) < 0) {
210 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
216 target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
220 if (ppc_load_slb_vsid(env, rb, &rt) < 0) {
221 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
228 * 64-bit hash table MMU handling
231 static int ppc_hash64_pte_prot(CPUPPCState *env,
232 ppc_slb_t *slb, ppc_hash_pte64_t pte)
235 /* Some pp bit combinations have undefined behaviour, so default
236 * to no access in those cases */
239 key = !!(msr_pr ? (slb->vsid & SLB_VSID_KP)
240 : (slb->vsid & SLB_VSID_KS));
241 pp = (pte.pte1 & HPTE64_R_PP) | ((pte.pte1 & HPTE64_R_PP0) >> 61);
248 prot = PAGE_READ | PAGE_WRITE;
269 prot = PAGE_READ | PAGE_WRITE;
274 /* No execute if either noexec or guarded bits set */
275 if (!(pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G)
276 || (slb->vsid & SLB_VSID_N)) {
283 static int ppc_hash64_amr_prot(CPUPPCState *env, ppc_hash_pte64_t pte)
286 int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
289 /* Only recent MMUs implement Virtual Page Class Key Protection */
290 if (!(env->mmu_model & POWERPC_MMU_AMR)) {
294 key = HPTE64_R_KEY(pte.pte1);
295 amrbits = (env->spr[SPR_AMR] >> 2*(31 - key)) & 0x3;
297 /* fprintf(stderr, "AMR protection: key=%d AMR=0x%" PRIx64 "\n", key, */
298 /* env->spr[SPR_AMR]); */
301 * A store is permitted if the AMR bit is 0. Remove write
302 * protection if it is set.
308 * A load is permitted if the AMR bit is 0. Remove read
309 * protection if it is set.
318 uint64_t ppc_hash64_start_access(PowerPCCPU *cpu, target_ulong pte_index)
323 pte_offset = pte_index * HASH_PTE_SIZE_64;
324 if (kvmppc_kern_htab) {
326 * HTAB is controlled by KVM. Fetch the PTEG into a new buffer.
328 token = kvmppc_hash64_read_pteg(cpu, pte_index);
333 * pteg read failed, even though we have allocated htab via
339 * HTAB is controlled by QEMU. Just point to the internally
342 if (cpu->env.external_htab) {
343 token = (uint64_t)(uintptr_t) cpu->env.external_htab + pte_offset;
344 } else if (cpu->env.htab_base) {
345 token = cpu->env.htab_base + pte_offset;
350 void ppc_hash64_stop_access(uint64_t token)
352 if (kvmppc_kern_htab) {
353 kvmppc_hash64_free_pteg(token);
357 static hwaddr ppc_hash64_pteg_search(CPUPPCState *env, hwaddr hash,
358 bool secondary, target_ulong ptem,
359 ppc_hash_pte64_t *pte)
363 target_ulong pte0, pte1;
364 target_ulong pte_index;
366 pte_index = (hash & env->htab_mask) * HPTES_PER_GROUP;
367 token = ppc_hash64_start_access(ppc_env_get_cpu(env), pte_index);
371 for (i = 0; i < HPTES_PER_GROUP; i++) {
372 pte0 = ppc_hash64_load_hpte0(env, token, i);
373 pte1 = ppc_hash64_load_hpte1(env, token, i);
375 if ((pte0 & HPTE64_V_VALID)
376 && (secondary == !!(pte0 & HPTE64_V_SECONDARY))
377 && HPTE64_V_COMPARE(pte0, ptem)) {
380 ppc_hash64_stop_access(token);
381 return (pte_index + i) * HASH_PTE_SIZE_64;
384 ppc_hash64_stop_access(token);
386 * We didn't find a valid entry.
391 static uint64_t ppc_hash64_page_shift(ppc_slb_t *slb)
395 /* Page size according to the SLB, which we use to generate the
396 * EPN for hash table lookup.. When we implement more recent MMU
397 * extensions this might be different from the actual page size
398 * encoded in the PTE */
399 if ((slb->vsid & SLB_VSID_LLP_MASK) == SLB_VSID_4K) {
400 epnshift = TARGET_PAGE_BITS;
401 } else if ((slb->vsid & SLB_VSID_LLP_MASK) == SLB_VSID_64K) {
402 epnshift = TARGET_PAGE_BITS_64K;
404 epnshift = TARGET_PAGE_BITS_16M;
409 static hwaddr ppc_hash64_htab_lookup(CPUPPCState *env,
410 ppc_slb_t *slb, target_ulong eaddr,
411 ppc_hash_pte64_t *pte)
415 uint64_t vsid, epnshift, epnmask, epn, ptem;
417 epnshift = ppc_hash64_page_shift(slb);
418 epnmask = ~((1ULL << epnshift) - 1);
420 if (slb->vsid & SLB_VSID_B) {
422 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
423 epn = (eaddr & ~SEGMENT_MASK_1T) & epnmask;
424 hash = vsid ^ (vsid << 25) ^ (epn >> epnshift);
427 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
428 epn = (eaddr & ~SEGMENT_MASK_256M) & epnmask;
429 hash = vsid ^ (epn >> epnshift);
431 ptem = (slb->vsid & SLB_VSID_PTEM) | ((epn >> 16) & HPTE64_V_AVPN);
433 /* Page address translation */
434 qemu_log_mask(CPU_LOG_MMU,
435 "htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
436 " hash " TARGET_FMT_plx "\n",
437 env->htab_base, env->htab_mask, hash);
439 /* Primary PTEG lookup */
440 qemu_log_mask(CPU_LOG_MMU,
441 "0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
442 " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
443 " hash=" TARGET_FMT_plx "\n",
444 env->htab_base, env->htab_mask, vsid, ptem, hash);
445 pte_offset = ppc_hash64_pteg_search(env, hash, 0, ptem, pte);
447 if (pte_offset == -1) {
448 /* Secondary PTEG lookup */
449 qemu_log_mask(CPU_LOG_MMU,
450 "1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
451 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
452 " hash=" TARGET_FMT_plx "\n", env->htab_base,
453 env->htab_mask, vsid, ptem, ~hash);
455 pte_offset = ppc_hash64_pteg_search(env, ~hash, 1, ptem, pte);
461 static hwaddr ppc_hash64_pte_raddr(ppc_slb_t *slb, ppc_hash_pte64_t pte,
465 int target_page_bits;
466 hwaddr rpn = pte.pte1 & HPTE64_R_RPN;
468 * We support 4K, 64K and 16M now
470 target_page_bits = ppc_hash64_page_shift(slb);
471 mask = (1ULL << target_page_bits) - 1;
472 return (rpn & ~mask) | (eaddr & mask);
475 int ppc_hash64_handle_mmu_fault(PowerPCCPU *cpu, target_ulong eaddr,
476 int rwx, int mmu_idx)
478 CPUState *cs = CPU(cpu);
479 CPUPPCState *env = &cpu->env;
482 ppc_hash_pte64_t pte;
483 int pp_prot, amr_prot, prot;
485 const int need_prot[] = {PAGE_READ, PAGE_WRITE, PAGE_EXEC};
488 assert((rwx == 0) || (rwx == 1) || (rwx == 2));
490 /* 1. Handle real mode accesses */
491 if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
492 /* Translation is off */
493 /* In real mode the top 4 effective address bits are ignored */
494 raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
495 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
496 PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
501 /* 2. Translation is on, so look up the SLB */
502 slb = slb_lookup(env, eaddr);
506 cs->exception_index = POWERPC_EXCP_ISEG;
509 cs->exception_index = POWERPC_EXCP_DSEG;
511 env->spr[SPR_DAR] = eaddr;
516 /* 3. Check for segment level no-execute violation */
517 if ((rwx == 2) && (slb->vsid & SLB_VSID_N)) {
518 cs->exception_index = POWERPC_EXCP_ISI;
519 env->error_code = 0x10000000;
523 /* 4. Locate the PTE in the hash table */
524 pte_offset = ppc_hash64_htab_lookup(env, slb, eaddr, &pte);
525 if (pte_offset == -1) {
527 cs->exception_index = POWERPC_EXCP_ISI;
528 env->error_code = 0x40000000;
530 cs->exception_index = POWERPC_EXCP_DSI;
532 env->spr[SPR_DAR] = eaddr;
534 env->spr[SPR_DSISR] = 0x42000000;
536 env->spr[SPR_DSISR] = 0x40000000;
541 qemu_log_mask(CPU_LOG_MMU,
542 "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
544 /* 5. Check access permissions */
546 pp_prot = ppc_hash64_pte_prot(env, slb, pte);
547 amr_prot = ppc_hash64_amr_prot(env, pte);
548 prot = pp_prot & amr_prot;
550 if ((need_prot[rwx] & ~prot) != 0) {
551 /* Access right violation */
552 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
554 cs->exception_index = POWERPC_EXCP_ISI;
555 env->error_code = 0x08000000;
557 target_ulong dsisr = 0;
559 cs->exception_index = POWERPC_EXCP_DSI;
561 env->spr[SPR_DAR] = eaddr;
562 if (need_prot[rwx] & ~pp_prot) {
568 if (need_prot[rwx] & ~amr_prot) {
571 env->spr[SPR_DSISR] = dsisr;
576 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
578 /* 6. Update PTE referenced and changed bits if necessary */
580 new_pte1 = pte.pte1 | HPTE64_R_R; /* set referenced bit */
582 new_pte1 |= HPTE64_R_C; /* set changed (dirty) bit */
584 /* Treat the page as read-only for now, so that a later write
585 * will pass through this function again to set the C bit */
589 if (new_pte1 != pte.pte1) {
590 ppc_hash64_store_hpte(env, pte_offset / HASH_PTE_SIZE_64,
594 /* 7. Determine the real address from the PTE */
596 raddr = ppc_hash64_pte_raddr(slb, pte, eaddr);
598 tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
599 prot, mmu_idx, TARGET_PAGE_SIZE);
604 hwaddr ppc_hash64_get_phys_page_debug(CPUPPCState *env, target_ulong addr)
608 ppc_hash_pte64_t pte;
611 /* In real mode the top 4 effective address bits are ignored */
612 return addr & 0x0FFFFFFFFFFFFFFFULL;
615 slb = slb_lookup(env, addr);
620 pte_offset = ppc_hash64_htab_lookup(env, slb, addr, &pte);
621 if (pte_offset == -1) {
625 return ppc_hash64_pte_raddr(slb, pte, addr) & TARGET_PAGE_MASK;
628 void ppc_hash64_store_hpte(CPUPPCState *env,
629 target_ulong pte_index,
630 target_ulong pte0, target_ulong pte1)
632 CPUState *cs = CPU(ppc_env_get_cpu(env));
634 if (kvmppc_kern_htab) {
635 kvmppc_hash64_write_pte(env, pte_index, pte0, pte1);
639 pte_index *= HASH_PTE_SIZE_64;
640 if (env->external_htab) {
641 stq_p(env->external_htab + pte_index, pte0);
642 stq_p(env->external_htab + pte_index + HASH_PTE_SIZE_64/2, pte1);
644 stq_phys(cs->as, env->htab_base + pte_index, pte0);
645 stq_phys(cs->as, env->htab_base + pte_index + HASH_PTE_SIZE_64/2, pte1);