2 * PowerPC MMU, TLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 * Copyright (c) 2013 David Gibson, IBM Corporation
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
23 #include "exec/exec-all.h"
24 #include "sysemu/kvm.h"
27 #include "mmu-hash32.h"
28 #include "mmu-books.h"
31 /* #define DEBUG_BATS */
34 # define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
36 # define LOG_BATS(...) do { } while (0)
39 struct mmu_ctx_hash32 {
40 hwaddr raddr; /* Real address */
41 int prot; /* Protection bits */
42 int key; /* Access key */
45 static int ppc_hash32_pp_prot(int key, int pp, int nx)
54 prot = PAGE_READ | PAGE_WRITE;
76 prot = PAGE_READ | PAGE_WRITE;
90 static int ppc_hash32_pte_prot(int mmu_idx,
91 target_ulong sr, ppc_hash_pte32_t pte)
95 key = !!(mmuidx_pr(mmu_idx) ? (sr & SR32_KP) : (sr & SR32_KS));
96 pp = pte.pte1 & HPTE32_R_PP;
98 return ppc_hash32_pp_prot(key, pp, !!(sr & SR32_NX));
101 static target_ulong hash32_bat_size(int mmu_idx,
102 target_ulong batu, target_ulong batl)
104 if ((mmuidx_pr(mmu_idx) && !(batu & BATU32_VP))
105 || (!mmuidx_pr(mmu_idx) && !(batu & BATU32_VS))) {
109 return BATU32_BEPI & ~((batu & BATU32_BL) << 15);
112 static int hash32_bat_prot(PowerPCCPU *cpu,
113 target_ulong batu, target_ulong batl)
118 pp = batl & BATL32_PP;
120 prot = PAGE_READ | PAGE_EXEC;
128 static hwaddr ppc_hash32_bat_lookup(PowerPCCPU *cpu, target_ulong ea,
129 MMUAccessType access_type, int *prot,
132 CPUPPCState *env = &cpu->env;
133 target_ulong *BATlt, *BATut;
134 bool ifetch = access_type == MMU_INST_FETCH;
137 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
138 ifetch ? 'I' : 'D', ea);
140 BATlt = env->IBAT[1];
141 BATut = env->IBAT[0];
143 BATlt = env->DBAT[1];
144 BATut = env->DBAT[0];
146 for (i = 0; i < env->nb_BATs; i++) {
147 target_ulong batu = BATut[i];
148 target_ulong batl = BATlt[i];
151 mask = hash32_bat_size(mmu_idx, batu, batl);
152 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
153 " BATl " TARGET_FMT_lx "\n", __func__,
154 ifetch ? 'I' : 'D', i, ea, batu, batl);
156 if (mask && ((ea & mask) == (batu & BATU32_BEPI))) {
157 hwaddr raddr = (batl & mask) | (ea & ~mask);
159 *prot = hash32_bat_prot(cpu, batu, batl);
161 return raddr & TARGET_PAGE_MASK;
166 #if defined(DEBUG_BATS)
167 if (qemu_log_enabled()) {
168 target_ulong *BATu, *BATl;
169 target_ulong BEPIl, BEPIu, bl;
171 LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", ea);
172 for (i = 0; i < 4; i++) {
175 BEPIu = *BATu & BATU32_BEPIU;
176 BEPIl = *BATu & BATU32_BEPIL;
177 bl = (*BATu & 0x00001FFC) << 15;
178 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
179 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
180 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
181 __func__, ifetch ? 'I' : 'D', i, ea,
182 *BATu, *BATl, BEPIu, BEPIl, bl);
190 static bool ppc_hash32_direct_store(PowerPCCPU *cpu, target_ulong sr,
192 MMUAccessType access_type,
193 hwaddr *raddr, int *prot, int mmu_idx,
196 CPUState *cs = CPU(cpu);
197 CPUPPCState *env = &cpu->env;
198 int key = !!(mmuidx_pr(mmu_idx) ? (sr & SR32_KP) : (sr & SR32_KS));
200 qemu_log_mask(CPU_LOG_MMU, "direct store...\n");
202 if (access_type == MMU_INST_FETCH) {
203 /* No code fetch is allowed in direct-store areas */
205 cs->exception_index = POWERPC_EXCP_ISI;
206 env->error_code = 0x10000000;
212 * From ppc_cpu_get_phys_page_debug, env->access_type is not set.
213 * Assume ACCESS_INT for that case.
215 switch (guest_visible ? env->access_type : ACCESS_INT) {
217 /* Integer load/store : only access allowed */
220 /* Floating point load/store */
221 cs->exception_index = POWERPC_EXCP_ALIGN;
222 env->error_code = POWERPC_EXCP_ALIGN_FP;
223 env->spr[SPR_DAR] = eaddr;
226 /* lwarx, ldarx or srwcx. */
228 env->spr[SPR_DAR] = eaddr;
229 if (access_type == MMU_DATA_STORE) {
230 env->spr[SPR_DSISR] = 0x06000000;
232 env->spr[SPR_DSISR] = 0x04000000;
237 * dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi
239 * Should make the instruction do no-op. As it already do
240 * no-op, it's quite easy :-)
246 cs->exception_index = POWERPC_EXCP_DSI;
248 env->spr[SPR_DAR] = eaddr;
249 if (access_type == MMU_DATA_STORE) {
250 env->spr[SPR_DSISR] = 0x06100000;
252 env->spr[SPR_DSISR] = 0x04100000;
256 cpu_abort(cs, "ERROR: insn should not need address translation\n");
259 *prot = key ? PAGE_READ | PAGE_WRITE : PAGE_READ;
260 if (*prot & prot_for_access_type(access_type)) {
266 cs->exception_index = POWERPC_EXCP_DSI;
268 env->spr[SPR_DAR] = eaddr;
269 if (access_type == MMU_DATA_STORE) {
270 env->spr[SPR_DSISR] = 0x0a000000;
272 env->spr[SPR_DSISR] = 0x08000000;
278 hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash)
280 target_ulong mask = ppc_hash32_hpt_mask(cpu);
282 return (hash * HASH_PTEG_SIZE_32) & mask;
285 static hwaddr ppc_hash32_pteg_search(PowerPCCPU *cpu, hwaddr pteg_off,
286 bool secondary, target_ulong ptem,
287 ppc_hash_pte32_t *pte)
289 hwaddr pte_offset = pteg_off;
290 target_ulong pte0, pte1;
293 for (i = 0; i < HPTES_PER_GROUP; i++) {
294 pte0 = ppc_hash32_load_hpte0(cpu, pte_offset);
296 * pte0 contains the valid bit and must be read before pte1,
297 * otherwise we might see an old pte1 with a new valid bit and
298 * thus an inconsistent hpte value
301 pte1 = ppc_hash32_load_hpte1(cpu, pte_offset);
303 if ((pte0 & HPTE32_V_VALID)
304 && (secondary == !!(pte0 & HPTE32_V_SECONDARY))
305 && HPTE32_V_COMPARE(pte0, ptem)) {
311 pte_offset += HASH_PTE_SIZE_32;
317 static void ppc_hash32_set_r(PowerPCCPU *cpu, hwaddr pte_offset, uint32_t pte1)
319 target_ulong base = ppc_hash32_hpt_base(cpu);
320 hwaddr offset = pte_offset + 6;
322 /* The HW performs a non-atomic byte update */
323 stb_phys(CPU(cpu)->as, base + offset, ((pte1 >> 8) & 0xff) | 0x01);
326 static void ppc_hash32_set_c(PowerPCCPU *cpu, hwaddr pte_offset, uint64_t pte1)
328 target_ulong base = ppc_hash32_hpt_base(cpu);
329 hwaddr offset = pte_offset + 7;
331 /* The HW performs a non-atomic byte update */
332 stb_phys(CPU(cpu)->as, base + offset, (pte1 & 0xff) | 0x80);
335 static hwaddr ppc_hash32_htab_lookup(PowerPCCPU *cpu,
336 target_ulong sr, target_ulong eaddr,
337 ppc_hash_pte32_t *pte)
339 hwaddr pteg_off, pte_offset;
341 uint32_t vsid, pgidx, ptem;
343 vsid = sr & SR32_VSID;
344 pgidx = (eaddr & ~SEGMENT_MASK_256M) >> TARGET_PAGE_BITS;
346 ptem = (vsid << 7) | (pgidx >> 10);
348 /* Page address translation */
349 qemu_log_mask(CPU_LOG_MMU, "htab_base " HWADDR_FMT_plx
350 " htab_mask " HWADDR_FMT_plx
351 " hash " HWADDR_FMT_plx "\n",
352 ppc_hash32_hpt_base(cpu), ppc_hash32_hpt_mask(cpu), hash);
354 /* Primary PTEG lookup */
355 qemu_log_mask(CPU_LOG_MMU, "0 htab=" HWADDR_FMT_plx "/" HWADDR_FMT_plx
356 " vsid=%" PRIx32 " ptem=%" PRIx32
357 " hash=" HWADDR_FMT_plx "\n",
358 ppc_hash32_hpt_base(cpu), ppc_hash32_hpt_mask(cpu),
360 pteg_off = get_pteg_offset32(cpu, hash);
361 pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 0, ptem, pte);
362 if (pte_offset == -1) {
363 /* Secondary PTEG lookup */
364 qemu_log_mask(CPU_LOG_MMU, "1 htab=" HWADDR_FMT_plx "/" HWADDR_FMT_plx
365 " vsid=%" PRIx32 " api=%" PRIx32
366 " hash=" HWADDR_FMT_plx "\n", ppc_hash32_hpt_base(cpu),
367 ppc_hash32_hpt_mask(cpu), vsid, ptem, ~hash);
368 pteg_off = get_pteg_offset32(cpu, ~hash);
369 pte_offset = ppc_hash32_pteg_search(cpu, pteg_off, 1, ptem, pte);
375 static hwaddr ppc_hash32_pte_raddr(target_ulong sr, ppc_hash_pte32_t pte,
378 hwaddr rpn = pte.pte1 & HPTE32_R_RPN;
379 hwaddr mask = ~TARGET_PAGE_MASK;
381 return (rpn & ~mask) | (eaddr & mask);
384 bool ppc_hash32_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
385 hwaddr *raddrp, int *psizep, int *protp, int mmu_idx,
388 CPUState *cs = CPU(cpu);
389 CPUPPCState *env = &cpu->env;
392 ppc_hash_pte32_t pte;
397 /* There are no hash32 large pages. */
398 *psizep = TARGET_PAGE_BITS;
400 /* 1. Handle real mode accesses */
401 if (mmuidx_real(mmu_idx)) {
402 /* Translation is off */
404 *protp = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
408 need_prot = prot_for_access_type(access_type);
410 /* 2. Check Block Address Translation entries (BATs) */
411 if (env->nb_BATs != 0) {
412 raddr = ppc_hash32_bat_lookup(cpu, eaddr, access_type, protp, mmu_idx);
414 if (need_prot & ~*protp) {
416 if (access_type == MMU_INST_FETCH) {
417 cs->exception_index = POWERPC_EXCP_ISI;
418 env->error_code = 0x08000000;
420 cs->exception_index = POWERPC_EXCP_DSI;
422 env->spr[SPR_DAR] = eaddr;
423 if (access_type == MMU_DATA_STORE) {
424 env->spr[SPR_DSISR] = 0x0a000000;
426 env->spr[SPR_DSISR] = 0x08000000;
437 /* 3. Look up the Segment Register */
438 sr = env->sr[eaddr >> 28];
440 /* 4. Handle direct store segments */
442 return ppc_hash32_direct_store(cpu, sr, eaddr, access_type,
443 raddrp, protp, mmu_idx, guest_visible);
446 /* 5. Check for segment level no-execute violation */
447 if (access_type == MMU_INST_FETCH && (sr & SR32_NX)) {
449 cs->exception_index = POWERPC_EXCP_ISI;
450 env->error_code = 0x10000000;
455 /* 6. Locate the PTE in the hash table */
456 pte_offset = ppc_hash32_htab_lookup(cpu, sr, eaddr, &pte);
457 if (pte_offset == -1) {
459 if (access_type == MMU_INST_FETCH) {
460 cs->exception_index = POWERPC_EXCP_ISI;
461 env->error_code = 0x40000000;
463 cs->exception_index = POWERPC_EXCP_DSI;
465 env->spr[SPR_DAR] = eaddr;
466 if (access_type == MMU_DATA_STORE) {
467 env->spr[SPR_DSISR] = 0x42000000;
469 env->spr[SPR_DSISR] = 0x40000000;
475 qemu_log_mask(CPU_LOG_MMU,
476 "found PTE at offset %08" HWADDR_PRIx "\n", pte_offset);
478 /* 7. Check access permissions */
480 prot = ppc_hash32_pte_prot(mmu_idx, sr, pte);
482 if (need_prot & ~prot) {
483 /* Access right violation */
484 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
486 if (access_type == MMU_INST_FETCH) {
487 cs->exception_index = POWERPC_EXCP_ISI;
488 env->error_code = 0x08000000;
490 cs->exception_index = POWERPC_EXCP_DSI;
492 env->spr[SPR_DAR] = eaddr;
493 if (access_type == MMU_DATA_STORE) {
494 env->spr[SPR_DSISR] = 0x0a000000;
496 env->spr[SPR_DSISR] = 0x08000000;
503 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
505 /* 8. Update PTE referenced and changed bits if necessary */
507 if (!(pte.pte1 & HPTE32_R_R)) {
508 ppc_hash32_set_r(cpu, pte_offset, pte.pte1);
510 if (!(pte.pte1 & HPTE32_R_C)) {
511 if (access_type == MMU_DATA_STORE) {
512 ppc_hash32_set_c(cpu, pte_offset, pte.pte1);
515 * Treat the page as read-only for now, so that a later write
516 * will pass through this function again to set the C bit
522 /* 9. Determine the real address from the PTE */
524 *raddrp = ppc_hash32_pte_raddr(sr, pte, eaddr);