[qemu.git] / target-ppc / mmu-hash64.c

/*
 *  PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
 *
 *  Copyright (c) 2003-2007 Jocelyn Mayer
 *  Copyright (c) 2013 David Gibson, IBM Corporation
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */
#include "cpu.h"
#include "helper.h"
#include "sysemu/kvm.h"
#include "kvm_ppc.h"
#include "mmu-hash64.h"

//#define DEBUG_MMU
//#define DEBUG_SLB

#ifdef DEBUG_MMU
#  define LOG_MMU(...) qemu_log(__VA_ARGS__)
#  define LOG_MMU_STATE(env) log_cpu_state((env), 0)
#else
#  define LOG_MMU(...) do { } while (0)
#  define LOG_MMU_STATE(...) do { } while (0)
#endif

#ifdef DEBUG_SLB
#  define LOG_SLB(...) qemu_log(__VA_ARGS__)
#else
#  define LOG_SLB(...) do { } while (0)
#endif

struct mmu_ctx_hash64 {
    hwaddr raddr;      /* Real address              */
    hwaddr eaddr;      /* Effective address         */
    int prot;                      /* Protection bits           */
    hwaddr hash[2];    /* Pagetable hash values     */
    target_ulong ptem;             /* Virtual segment ID | API  */
    int key;                       /* Access key                */
    int nx;                        /* Non-execute area          */
};

/*
 * SLB handling
 */

static ppc_slb_t *slb_lookup(CPUPPCState *env, target_ulong eaddr)
{
    uint64_t esid_256M, esid_1T;
    int n;

    LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);

    esid_256M = (eaddr & SEGMENT_MASK_256M) | SLB_ESID_V;
    esid_1T = (eaddr & SEGMENT_MASK_1T) | SLB_ESID_V;

    for (n = 0; n < env->slb_nr; n++) {
        ppc_slb_t *slb = &env->slb[n];

        LOG_SLB("%s: slot %d %016" PRIx64 " %016"
                    PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
        /* We check for 1T matches on all MMUs here - if the MMU
         * doesn't have 1T segment support, we will have prevented 1T
         * entries from being inserted in the slbmte code. */
        if (((slb->esid == esid_256M) &&
             ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
            || ((slb->esid == esid_1T) &&
                ((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
            return slb;
        }
    }

    return NULL;
}

void dump_slb(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
{
    int i;
    uint64_t slbe, slbv;

    cpu_synchronize_state(env);

    cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
    for (i = 0; i < env->slb_nr; i++) {
        slbe = env->slb[i].esid;
        slbv = env->slb[i].vsid;
        if (slbe == 0 && slbv == 0) {
            continue;
        }
        cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
                    i, slbe, slbv);
    }
}

void helper_slbia(CPUPPCState *env)
{
    int n, do_invalidate;

    do_invalidate = 0;
    /* XXX: Warning: slbia never invalidates the first segment */
    for (n = 1; n < env->slb_nr; n++) {
        ppc_slb_t *slb = &env->slb[n];

        if (slb->esid & SLB_ESID_V) {
            slb->esid &= ~SLB_ESID_V;
            /* XXX: given the fact that segment size is 256 MB or 1TB,
             *      and we still don't have a tlb_flush_mask(env, n, mask)
             *      in QEMU, we just invalidate all TLBs
             */
            do_invalidate = 1;
        }
    }
    if (do_invalidate) {
        tlb_flush(env, 1);
    }
}

void helper_slbie(CPUPPCState *env, target_ulong addr)
{
    ppc_slb_t *slb;

    slb = slb_lookup(env, addr);
    if (!slb) {
        return;
    }

    if (slb->esid & SLB_ESID_V) {
        slb->esid &= ~SLB_ESID_V;

        /* XXX: given the fact that segment size is 256 MB or 1TB,
         *      and we still don't have a tlb_flush_mask(env, n, mask)
         *      in QEMU, we just invalidate all TLBs
         */
        tlb_flush(env, 1);
    }
}

int ppc_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
{
    int slot = rb & 0xfff;
    ppc_slb_t *slb = &env->slb[slot];

    if (rb & (0x1000 - env->slb_nr)) {
        return -1; /* Reserved bits set or slot too high */
    }
    if (rs & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
        return -1; /* Bad segment size */
    }
    if ((rs & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
        return -1; /* 1T segment on MMU that doesn't support it */
    }

    /* Mask out the slot number as we store the entry */
    slb->esid = rb & (SLB_ESID_ESID | SLB_ESID_V);
    slb->vsid = rs;

    LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
            " %016" PRIx64 "\n", __func__, slot, rb, rs,
            slb->esid, slb->vsid);

    return 0;
}

static int ppc_load_slb_esid(CPUPPCState *env, target_ulong rb,
                             target_ulong *rt)
{
    int slot = rb & 0xfff;
    ppc_slb_t *slb = &env->slb[slot];

    if (slot >= env->slb_nr) {
        return -1;
    }

    *rt = slb->esid;
    return 0;
}

static int ppc_load_slb_vsid(CPUPPCState *env, target_ulong rb,
                             target_ulong *rt)
{
    int slot = rb & 0xfff;
    ppc_slb_t *slb = &env->slb[slot];

    if (slot >= env->slb_nr) {
        return -1;
    }

    *rt = slb->vsid;
    return 0;
}

void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
{
    if (ppc_store_slb(env, rb, rs) < 0) {
        helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
                                   POWERPC_EXCP_INVAL);
    }
}

target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
{
    target_ulong rt = 0;

    if (ppc_load_slb_esid(env, rb, &rt) < 0) {
        helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
                                   POWERPC_EXCP_INVAL);
    }
    return rt;
}

target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
{
    target_ulong rt = 0;

    if (ppc_load_slb_vsid(env, rb, &rt) < 0) {
        helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
                                   POWERPC_EXCP_INVAL);
    }
    return rt;
}

/*
 * 64-bit hash table MMU handling
 */

#define PTE64_PTEM_MASK 0xFFFFFFFFFFFFFF80ULL
#define PTE64_CHECK_MASK (TARGET_PAGE_MASK | 0x7F)

static int ppc_hash64_pp_check(int key, int pp, int nx)
{
    int access;

    /* Compute access rights */
    /* When pp is 4, 5 or 7, the result is undefined. Set it to noaccess */
    access = 0;
    if (key == 0) {
        switch (pp) {
        case 0x0:
        case 0x1:
        case 0x2:
            access |= PAGE_WRITE;
            /* No break here */
        case 0x3:
        case 0x6:
            access |= PAGE_READ;
            break;
        }
    } else {
        switch (pp) {
        case 0x0:
        case 0x6:
            access = 0;
            break;
        case 0x1:
        case 0x3:
            access = PAGE_READ;
            break;
        case 0x2:
            access = PAGE_READ | PAGE_WRITE;
            break;
        }
    }
    if (nx == 0) {
        access |= PAGE_EXEC;
    }

    return access;
}

static int ppc_hash64_check_prot(int prot, int rw, int access_type)
{
    int ret;

    if (access_type == ACCESS_CODE) {
        if (prot & PAGE_EXEC) {
            ret = 0;
        } else {
            ret = -2;
        }
    } else if (rw) {
        if (prot & PAGE_WRITE) {
            ret = 0;
        } else {
            ret = -2;
        }
    } else {
        if (prot & PAGE_READ) {
            ret = 0;
        } else {
            ret = -2;
        }
    }

    return ret;
}

static inline int pte64_is_valid(target_ulong pte0)
{
    return pte0 & 0x0000000000000001ULL ? 1 : 0;
}

static int pte64_check(struct mmu_ctx_hash64 *ctx, target_ulong pte0,
                       target_ulong pte1, int h, int rw, int type)
{
    target_ulong ptem, mmask;
    int access, ret, pteh, ptev, pp;

    ret = -1;
    /* Check validity and table match */
    ptev = pte64_is_valid(pte0);
    pteh = (pte0 >> 1) & 1;
    if (ptev && h == pteh) {
        /* Check vsid & api */
        ptem = pte0 & PTE64_PTEM_MASK;
        mmask = PTE64_CHECK_MASK;
        pp = (pte1 & 0x00000003) | ((pte1 >> 61) & 0x00000004);
        ctx->nx  = (pte1 >> 2) & 1; /* No execute bit */
        ctx->nx |= (pte1 >> 3) & 1; /* Guarded bit    */
        if (ptem == ctx->ptem) {
            if (ctx->raddr != (hwaddr)-1ULL) {
                /* all matches should have equal RPN, WIMG & PP */
                if ((ctx->raddr & mmask) != (pte1 & mmask)) {
                    qemu_log("Bad RPN/WIMG/PP\n");
                    return -3;
                }
            }
            /* Compute access rights */
            access = ppc_hash64_pp_check(ctx->key, pp, ctx->nx);
            /* Keep the matching PTE informations */
            ctx->raddr = pte1;
            ctx->prot = access;
            ret = ppc_hash64_check_prot(ctx->prot, rw, type);
            if (ret == 0) {
                /* Access granted */
                LOG_MMU("PTE access granted !\n");
            } else {
                /* Access right violation */
                LOG_MMU("PTE access rejected\n");
            }
        }
    }

    return ret;
}

static int ppc_hash64_pte_update_flags(struct mmu_ctx_hash64 *ctx,
                                       target_ulong *pte1p,
                                       int ret, int rw)
{
    int store = 0;

    /* Update page flags */
    if (!(*pte1p & 0x00000100)) {
        /* Update accessed flag */
        *pte1p |= 0x00000100;
        store = 1;
    }
    if (!(*pte1p & 0x00000080)) {
        if (rw == 1 && ret == 0) {
            /* Update changed flag */
            *pte1p |= 0x00000080;
            store = 1;
        } else {
            /* Force page fault for first write access */
            ctx->prot &= ~PAGE_WRITE;
        }
    }

    return store;
}

/* PTE table lookup */
static int find_pte64(CPUPPCState *env, struct mmu_ctx_hash64 *ctx, int h,
                      int rw, int type, int target_page_bits)
{
    hwaddr pteg_off;
    target_ulong pte0, pte1;
    int i, good = -1;
    int ret, r;

    ret = -1; /* No entry found */
    pteg_off = (ctx->hash[h] * HASH_PTE_SIZE_64 * 8) & env->htab_mask;
    for (i = 0; i < 8; i++) {
        if (env->external_htab) {
            pte0 = ldq_p(env->external_htab + pteg_off + (i * 16));
            pte1 = ldq_p(env->external_htab + pteg_off + (i * 16) + 8);
        } else {
            pte0 = ldq_phys(env->htab_base + pteg_off + (i * 16));
            pte1 = ldq_phys(env->htab_base + pteg_off + (i * 16) + 8);
        }

        r = pte64_check(ctx, pte0, pte1, h, rw, type);
        LOG_MMU("Load pte from %016" HWADDR_PRIx " => " TARGET_FMT_lx " "
                TARGET_FMT_lx " %d %d %d " TARGET_FMT_lx "\n",
                pteg_off + (i * 16), pte0, pte1, (int)(pte0 & 1), h,
                (int)((pte0 >> 1) & 1), ctx->ptem);
        switch (r) {
        case -3:
            /* PTE inconsistency */
            return -1;
        case -2:
            /* Access violation */
            ret = -2;
            good = i;
            break;
        case -1:
        default:
            /* No PTE match */
            break;
        case 0:
            /* access granted */
            /* XXX: we should go on looping to check all PTEs consistency
             *      but if we can speed-up the whole thing as the
             *      result would be undefined if PTEs are not consistent.
             */
            ret = 0;
            good = i;
            goto done;
        }
    }
    if (good != -1) {
    done:
        LOG_MMU("found PTE at addr %08" HWADDR_PRIx " prot=%01x ret=%d\n",
                ctx->raddr, ctx->prot, ret);
        /* Update page flags */
        pte1 = ctx->raddr;
        if (ppc_hash64_pte_update_flags(ctx, &pte1, ret, rw) == 1) {
            if (env->external_htab) {
                stq_p(env->external_htab + pteg_off + (good * 16) + 8,
                      pte1);
            } else {
                stq_phys_notdirty(env->htab_base + pteg_off +
                                  (good * 16) + 8, pte1);
            }
        }
    }

    /* We have a TLB that saves 4K pages, so let's
     * split a huge page to 4k chunks */
    if (target_page_bits != TARGET_PAGE_BITS) {
        ctx->raddr |= (ctx->eaddr & ((1 << target_page_bits) - 1))
                      & TARGET_PAGE_MASK;
    }
    return ret;
}

static int get_segment64(CPUPPCState *env, struct mmu_ctx_hash64 *ctx,
                         target_ulong eaddr, int rw, int type)
{
    hwaddr hash;
    target_ulong vsid;
    int pr, target_page_bits;
    int ret, ret2;

    pr = msr_pr;
    ctx->eaddr = eaddr;
    ppc_slb_t *slb;
    target_ulong pageaddr;
    int segment_bits;

    LOG_MMU("Check SLBs\n");
    slb = slb_lookup(env, eaddr);
    if (!slb) {
        return -5;
    }

    if (slb->vsid & SLB_VSID_B) {
        vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
        segment_bits = 40;
    } else {
        vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
        segment_bits = 28;
    }

    target_page_bits = (slb->vsid & SLB_VSID_L)
        ? TARGET_PAGE_BITS_16M : TARGET_PAGE_BITS;
    ctx->key = !!(pr ? (slb->vsid & SLB_VSID_KP)
                  : (slb->vsid & SLB_VSID_KS));
    ctx->nx = !!(slb->vsid & SLB_VSID_N);

    pageaddr = eaddr & ((1ULL << segment_bits)
                            - (1ULL << target_page_bits));
    if (slb->vsid & SLB_VSID_B) {
        hash = vsid ^ (vsid << 25) ^ (pageaddr >> target_page_bits);
    } else {
        hash = vsid ^ (pageaddr >> target_page_bits);
    }
    /* Only 5 bits of the page index are used in the AVPN */
    ctx->ptem = (slb->vsid & SLB_VSID_PTEM) |
        ((pageaddr >> 16) & ((1ULL << segment_bits) - 0x80));

    LOG_MMU("pte segment: key=%d nx %d vsid " TARGET_FMT_lx "\n",
            ctx->key, ctx->nx, vsid);
    ret = -1;

    /* Check if instruction fetch is allowed, if needed */
    if (type != ACCESS_CODE || ctx->nx == 0) {
        /* Page address translation */
        LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
                " hash " TARGET_FMT_plx "\n",
                env->htab_base, env->htab_mask, hash);
        ctx->hash[0] = hash;
        ctx->hash[1] = ~hash;

        /* Initialize real address with an invalid value */
        ctx->raddr = (hwaddr)-1ULL;
        LOG_MMU("0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
                " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
                " hash=" TARGET_FMT_plx "\n",
                env->htab_base, env->htab_mask, vsid, ctx->ptem,
                ctx->hash[0]);
        /* Primary table lookup */
        ret = find_pte64(env, ctx, 0, rw, type, target_page_bits);
        if (ret < 0) {
            /* Secondary table lookup */
            LOG_MMU("1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
                    " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
                    " hash=" TARGET_FMT_plx "\n", env->htab_base,
                    env->htab_mask, vsid, ctx->ptem, ctx->hash[1]);
            ret2 = find_pte64(env, ctx, 1, rw, type, target_page_bits);
            if (ret2 != -1) {
                ret = ret2;
            }
        }
    } else {
        LOG_MMU("No access allowed\n");
        ret = -3;
    }

    return ret;
}

static int ppc_hash64_get_physical_address(CPUPPCState *env,
                                           struct mmu_ctx_hash64 *ctx,
                                           target_ulong eaddr, int rw,
                                           int access_type)
{
    bool real_mode = (access_type == ACCESS_CODE && msr_ir == 0)
        || (access_type != ACCESS_CODE && msr_dr == 0);

    if (real_mode) {
        ctx->raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
        ctx->prot = PAGE_READ | PAGE_EXEC | PAGE_WRITE;
        return 0;
    } else {
        return get_segment64(env, ctx, eaddr, rw, access_type);
    }
}

hwaddr ppc_hash64_get_phys_page_debug(CPUPPCState *env, target_ulong addr)
{
    struct mmu_ctx_hash64 ctx;

    if (unlikely(ppc_hash64_get_physical_address(env, &ctx, addr, 0, ACCESS_INT)
                 != 0)) {
        return -1;
    }

    return ctx.raddr & TARGET_PAGE_MASK;
}

int ppc_hash64_handle_mmu_fault(CPUPPCState *env, target_ulong address, int rw,
                                int mmu_idx)
{
    struct mmu_ctx_hash64 ctx;
    int access_type;
    int ret = 0;

    if (rw == 2) {
        /* code access */
        rw = 0;
        access_type = ACCESS_CODE;
    } else {
        /* data access */
        access_type = env->access_type;
    }
    ret = ppc_hash64_get_physical_address(env, &ctx, address, rw, access_type);
    if (ret == 0) {
        tlb_set_page(env, address & TARGET_PAGE_MASK,
                     ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
                     mmu_idx, TARGET_PAGE_SIZE);
        ret = 0;
    } else if (ret < 0) {
        LOG_MMU_STATE(env);
        if (access_type == ACCESS_CODE) {
            switch (ret) {
            case -1:
                env->exception_index = POWERPC_EXCP_ISI;
                env->error_code = 0x40000000;
                break;
            case -2:
                /* Access rights violation */
                env->exception_index = POWERPC_EXCP_ISI;
                env->error_code = 0x08000000;
                break;
            case -3:
                /* No execute protection violation */
                env->exception_index = POWERPC_EXCP_ISI;
                env->error_code = 0x10000000;
                break;
            case -5:
                /* No match in segment table */
                env->exception_index = POWERPC_EXCP_ISEG;
                env->error_code = 0;
                break;
            }
        } else {
            switch (ret) {
            case -1:
                /* No matches in page tables or TLB */
                env->exception_index = POWERPC_EXCP_DSI;
                env->error_code = 0;
                env->spr[SPR_DAR] = address;
                if (rw == 1) {
                    env->spr[SPR_DSISR] = 0x42000000;
                } else {
                    env->spr[SPR_DSISR] = 0x40000000;
                }
                break;
            case -2:
                /* Access rights violation */
                env->exception_index = POWERPC_EXCP_DSI;
                env->error_code = 0;
                env->spr[SPR_DAR] = address;
                if (rw == 1) {
                    env->spr[SPR_DSISR] = 0x0A000000;
                } else {
                    env->spr[SPR_DSISR] = 0x08000000;
                }
                break;
            case -5:
                /* No match in segment table */
                env->exception_index = POWERPC_EXCP_DSEG;
                env->error_code = 0;
                env->spr[SPR_DAR] = address;
                break;
            }
        }
#if 0
        printf("%s: set exception to %d %02x\n", __func__,
               env->exception, env->error_code);
#endif
        ret = 1;
    }

    return ret;
}
Commit	Line	Data
10b46525 DG	1	/*
	2	* PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
	3	*
	4	* Copyright (c) 2003-2007 Jocelyn Mayer
	5	* Copyright (c) 2013 David Gibson, IBM Corporation
	6	*
	7	* This library is free software; you can redistribute it and/or
	8	* modify it under the terms of the GNU Lesser General Public
	9	* License as published by the Free Software Foundation; either
	10	* version 2 of the License, or (at your option) any later version.
	11	*
	12	* This library is distributed in the hope that it will be useful,
	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	15	* Lesser General Public License for more details.
	16	*
	17	* You should have received a copy of the GNU Lesser General Public
	18	* License along with this library; if not, see <http://www.gnu.org/licenses/>.
	19	*/
	20	#include "cpu.h"
	21	#include "helper.h"
	22	#include "sysemu/kvm.h"
	23	#include "kvm_ppc.h"
	24	#include "mmu-hash64.h"
	25
9d7c3f4a	26	//#define DEBUG_MMU
10b46525 DG	27	//#define DEBUG_SLB
10b46525 DG	28
9d7c3f4a DG	29	#ifdef DEBUG_MMU
	30	# define LOG_MMU(...) qemu_log(__VA_ARGS__)
	31	# define LOG_MMU_STATE(env) log_cpu_state((env), 0)
	32	#else
	33	# define LOG_MMU(...) do { } while (0)
	34	# define LOG_MMU_STATE(...) do { } while (0)
	35	#endif
	36
10b46525 DG	37	#ifdef DEBUG_SLB
	38	# define LOG_SLB(...) qemu_log(__VA_ARGS__)
	39	#else
	40	# define LOG_SLB(...) do { } while (0)
	41	#endif
	42
5dc68eb0 DG	43	struct mmu_ctx_hash64 {
	44	hwaddr raddr; /* Real address */
	45	hwaddr eaddr; /* Effective address */
	46	int prot; /* Protection bits */
	47	hwaddr hash[2]; /* Pagetable hash values */
	48	target_ulong ptem; /* Virtual segment ID \| API */
	49	int key; /* Access key */
	50	int nx; /* Non-execute area */
	51	};
	52
10b46525 DG	53	/*
	54	* SLB handling
	55	*/
	56
0480884f	57	static ppc_slb_t slb_lookup(CPUPPCState env, target_ulong eaddr)
10b46525 DG	58	{
	59	uint64_t esid_256M, esid_1T;
	60	int n;
	61
	62	LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);
	63
	64	esid_256M = (eaddr & SEGMENT_MASK_256M) \| SLB_ESID_V;
	65	esid_1T = (eaddr & SEGMENT_MASK_1T) \| SLB_ESID_V;
	66
	67	for (n = 0; n < env->slb_nr; n++) {
	68	ppc_slb_t *slb = &env->slb[n];
	69
	70	LOG_SLB("%s: slot %d %016" PRIx64 " %016"
	71	PRIx64 "\n", __func__, n, slb->esid, slb->vsid);
	72	/* We check for 1T matches on all MMUs here - if the MMU
	73	* doesn't have 1T segment support, we will have prevented 1T
	74	* entries from being inserted in the slbmte code. */
	75	if (((slb->esid == esid_256M) &&
	76	((slb->vsid & SLB_VSID_B) == SLB_VSID_B_256M))
	77	\|\| ((slb->esid == esid_1T) &&
	78	((slb->vsid & SLB_VSID_B) == SLB_VSID_B_1T))) {
	79	return slb;
	80	}
	81	}
	82
	83	return NULL;
	84	}
	85
	86	void dump_slb(FILE f, fprintf_function cpu_fprintf, CPUPPCState env)
	87	{
	88	int i;
	89	uint64_t slbe, slbv;
	90
	91	cpu_synchronize_state(env);
	92
	93	cpu_fprintf(f, "SLB\tESID\t\t\tVSID\n");
	94	for (i = 0; i < env->slb_nr; i++) {
	95	slbe = env->slb[i].esid;
	96	slbv = env->slb[i].vsid;
	97	if (slbe == 0 && slbv == 0) {
	98	continue;
	99	}
	100	cpu_fprintf(f, "%d\t0x%016" PRIx64 "\t0x%016" PRIx64 "\n",
	101	i, slbe, slbv);
	102	}
	103	}
	104
	105	void helper_slbia(CPUPPCState *env)
	106	{
	107	int n, do_invalidate;
	108
	109	do_invalidate = 0;
	110	/* XXX: Warning: slbia never invalidates the first segment */
	111	for (n = 1; n < env->slb_nr; n++) {
	112	ppc_slb_t *slb = &env->slb[n];
	113
	114	if (slb->esid & SLB_ESID_V) {
	115	slb->esid &= ~SLB_ESID_V;
	116	/* XXX: given the fact that segment size is 256 MB or 1TB,
	117	* and we still don't have a tlb_flush_mask(env, n, mask)
	118	* in QEMU, we just invalidate all TLBs
	119	*/
	120	do_invalidate = 1;
	121	}
122	}
123	if (do_invalidate) {
124	tlb_flush(env, 1);
125	}
126	}
127
128	void helper_slbie(CPUPPCState *env, target_ulong addr)
129	{
130	ppc_slb_t *slb;
131
132	slb = slb_lookup(env, addr);
133	if (!slb) {
134	return;
135	}
136
137	if (slb->esid & SLB_ESID_V) {
138	slb->esid &= ~SLB_ESID_V;
139
140	/* XXX: given the fact that segment size is 256 MB or 1TB,
141	* and we still don't have a tlb_flush_mask(env, n, mask)
142	* in QEMU, we just invalidate all TLBs
143	*/
144	tlb_flush(env, 1);
145	}
146	}
147
148	int ppc_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
149	{
150	int slot = rb & 0xfff;
151	ppc_slb_t *slb = &env->slb[slot];
152
153	if (rb & (0x1000 - env->slb_nr)) {
154	return -1; /* Reserved bits set or slot too high */
155	}
156	if (rs & (SLB_VSID_B & ~SLB_VSID_B_1T)) {
157	return -1; /* Bad segment size */
158	}
159	if ((rs & SLB_VSID_B) && !(env->mmu_model & POWERPC_MMU_1TSEG)) {
160	return -1; /* 1T segment on MMU that doesn't support it */
161	}
162
163	/* Mask out the slot number as we store the entry */
164	slb->esid = rb & (SLB_ESID_ESID \| SLB_ESID_V);
165	slb->vsid = rs;
166
167	LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
168	" %016" PRIx64 "\n", __func__, slot, rb, rs,
169	slb->esid, slb->vsid);
170
171	return 0;
172	}
173
174	static int ppc_load_slb_esid(CPUPPCState *env, target_ulong rb,
175	target_ulong *rt)
176	{
177	int slot = rb & 0xfff;
178	ppc_slb_t *slb = &env->slb[slot];
179
180	if (slot >= env->slb_nr) {
181	return -1;
182	}
183
184	*rt = slb->esid;
185	return 0;
186	}
187
188	static int ppc_load_slb_vsid(CPUPPCState *env, target_ulong rb,
189	target_ulong *rt)
190	{
191	int slot = rb & 0xfff;
192	ppc_slb_t *slb = &env->slb[slot];
193
194	if (slot >= env->slb_nr) {
195	return -1;
196	}
197
198	*rt = slb->vsid;
199	return 0;
200	}
201
202	void helper_store_slb(CPUPPCState *env, target_ulong rb, target_ulong rs)
203	{
204	if (ppc_store_slb(env, rb, rs) < 0) {
205	helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
206	POWERPC_EXCP_INVAL);
207	}
208	}
209
210	target_ulong helper_load_slb_esid(CPUPPCState *env, target_ulong rb)
211	{
212	target_ulong rt = 0;
213
214	if (ppc_load_slb_esid(env, rb, &rt) < 0) {
215	helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
216	POWERPC_EXCP_INVAL);
217	}
218	return rt;
219	}
220
221	target_ulong helper_load_slb_vsid(CPUPPCState *env, target_ulong rb)
222	{
223	target_ulong rt = 0;
224
225	if (ppc_load_slb_vsid(env, rb, &rt) < 0) {
226	helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
227	POWERPC_EXCP_INVAL);
228	}
229	return rt;
230	}
9d7c3f4a DG	231
	232	/*
	233	* 64-bit hash table MMU handling
	234	*/
	235
	236	#define PTE64_PTEM_MASK 0xFFFFFFFFFFFFFF80ULL
	237	#define PTE64_CHECK_MASK (TARGET_PAGE_MASK \| 0x7F)
	238
496272a7 DG	239	static int ppc_hash64_pp_check(int key, int pp, int nx)
	240	{
	241	int access;
	242
	243	/* Compute access rights */
	244	/* When pp is 4, 5 or 7, the result is undefined. Set it to noaccess */
	245	access = 0;
	246	if (key == 0) {
	247	switch (pp) {
	248	case 0x0:
	249	case 0x1:
	250	case 0x2:
	251	access \|= PAGE_WRITE;
	252	/* No break here */
	253	case 0x3:
	254	case 0x6:
	255	access \|= PAGE_READ;
	256	break;
	257	}
	258	} else {
	259	switch (pp) {
	260	case 0x0:
	261	case 0x6:
	262	access = 0;
	263	break;
	264	case 0x1:
	265	case 0x3:
	266	access = PAGE_READ;
	267	break;
	268	case 0x2:
	269	access = PAGE_READ \| PAGE_WRITE;
	270	break;
	271	}
	272	}
	273	if (nx == 0) {
	274	access \|= PAGE_EXEC;
	275	}
	276
	277	return access;
	278	}
	279
	280	static int ppc_hash64_check_prot(int prot, int rw, int access_type)
	281	{
	282	int ret;
	283
	284	if (access_type == ACCESS_CODE) {
	285	if (prot & PAGE_EXEC) {
	286	ret = 0;
	287	} else {
	288	ret = -2;
	289	}
	290	} else if (rw) {
	291	if (prot & PAGE_WRITE) {
	292	ret = 0;
	293	} else {
	294	ret = -2;
	295	}
	296	} else {
	297	if (prot & PAGE_READ) {
	298	ret = 0;
	299	} else {
	300	ret = -2;
	301	}
	302	}
303
304	return ret;
305	}
306
9d7c3f4a DG	307	static inline int pte64_is_valid(target_ulong pte0)
	308	{
	309	return pte0 & 0x0000000000000001ULL ? 1 : 0;
	310	}
	311
5dc68eb0	312	static int pte64_check(struct mmu_ctx_hash64 *ctx, target_ulong pte0,
c69b6151	313	target_ulong pte1, int h, int rw, int type)
9d7c3f4a DG	314	{
	315	target_ulong ptem, mmask;
	316	int access, ret, pteh, ptev, pp;
	317
	318	ret = -1;
	319	/* Check validity and table match */
	320	ptev = pte64_is_valid(pte0);
	321	pteh = (pte0 >> 1) & 1;
	322	if (ptev && h == pteh) {
	323	/* Check vsid & api */
	324	ptem = pte0 & PTE64_PTEM_MASK;
	325	mmask = PTE64_CHECK_MASK;
	326	pp = (pte1 & 0x00000003) \| ((pte1 >> 61) & 0x00000004);
	327	ctx->nx = (pte1 >> 2) & 1; /* No execute bit */
	328	ctx->nx \|= (pte1 >> 3) & 1; /* Guarded bit */
	329	if (ptem == ctx->ptem) {
	330	if (ctx->raddr != (hwaddr)-1ULL) {
	331	/* all matches should have equal RPN, WIMG & PP */
	332	if ((ctx->raddr & mmask) != (pte1 & mmask)) {
	333	qemu_log("Bad RPN/WIMG/PP\n");
	334	return -3;
	335	}
	336	}
	337	/* Compute access rights */
496272a7	338	access = ppc_hash64_pp_check(ctx->key, pp, ctx->nx);
9d7c3f4a DG	339	/* Keep the matching PTE informations */
	340	ctx->raddr = pte1;
	341	ctx->prot = access;
496272a7	342	ret = ppc_hash64_check_prot(ctx->prot, rw, type);
9d7c3f4a DG	343	if (ret == 0) {
	344	/* Access granted */
	345	LOG_MMU("PTE access granted !\n");
	346	} else {
	347	/* Access right violation */
	348	LOG_MMU("PTE access rejected\n");
	349	}
	350	}
	351	}
	352
	353	return ret;
	354	}
c69b6151	355
5dc68eb0 DG	356	static int ppc_hash64_pte_update_flags(struct mmu_ctx_hash64 *ctx,
5dc68eb0 DG	357	target_ulong *pte1p,
496272a7 DG	358	int ret, int rw)
	359	{
	360	int store = 0;
	361
	362	/* Update page flags */
	363	if (!(*pte1p & 0x00000100)) {
	364	/* Update accessed flag */
	365	*pte1p \|= 0x00000100;
	366	store = 1;
	367	}
	368	if (!(*pte1p & 0x00000080)) {
	369	if (rw == 1 && ret == 0) {
	370	/* Update changed flag */
	371	*pte1p \|= 0x00000080;
	372	store = 1;
	373	} else {
	374	/* Force page fault for first write access */
	375	ctx->prot &= ~PAGE_WRITE;
	376	}
	377	}
	378
	379	return store;
	380	}
	381
c69b6151	382	/* PTE table lookup */
5dc68eb0	383	static int find_pte64(CPUPPCState env, struct mmu_ctx_hash64 ctx, int h,
0480884f	384	int rw, int type, int target_page_bits)
c69b6151 DG	385	{
	386	hwaddr pteg_off;
	387	target_ulong pte0, pte1;
	388	int i, good = -1;
	389	int ret, r;
	390
	391	ret = -1; /* No entry found */
59191721	392	pteg_off = (ctx->hash[h] * HASH_PTE_SIZE_64 * 8) & env->htab_mask;
c69b6151 DG	393	for (i = 0; i < 8; i++) {
	394	if (env->external_htab) {
	395	pte0 = ldq_p(env->external_htab + pteg_off + (i * 16));
	396	pte1 = ldq_p(env->external_htab + pteg_off + (i * 16) + 8);
	397	} else {
	398	pte0 = ldq_phys(env->htab_base + pteg_off + (i * 16));
	399	pte1 = ldq_phys(env->htab_base + pteg_off + (i * 16) + 8);
	400	}
	401
	402	r = pte64_check(ctx, pte0, pte1, h, rw, type);
	403	LOG_MMU("Load pte from %016" HWADDR_PRIx " => " TARGET_FMT_lx " "
	404	TARGET_FMT_lx " %d %d %d " TARGET_FMT_lx "\n",
	405	pteg_off + (i * 16), pte0, pte1, (int)(pte0 & 1), h,
	406	(int)((pte0 >> 1) & 1), ctx->ptem);
	407	switch (r) {
	408	case -3:
	409	/* PTE inconsistency */
	410	return -1;
	411	case -2:
	412	/* Access violation */
	413	ret = -2;
	414	good = i;
	415	break;
	416	case -1:
	417	default:
	418	/* No PTE match */
	419	break;
	420	case 0:
	421	/* access granted */
	422	/* XXX: we should go on looping to check all PTEs consistency
	423	* but if we can speed-up the whole thing as the
	424	* result would be undefined if PTEs are not consistent.
	425	*/
	426	ret = 0;
	427	good = i;
	428	goto done;
	429	}
	430	}
	431	if (good != -1) {
	432	done:
	433	LOG_MMU("found PTE at addr %08" HWADDR_PRIx " prot=%01x ret=%d\n",
	434	ctx->raddr, ctx->prot, ret);
	435	/* Update page flags */
	436	pte1 = ctx->raddr;
496272a7	437	if (ppc_hash64_pte_update_flags(ctx, &pte1, ret, rw) == 1) {
c69b6151 DG	438	if (env->external_htab) {
	439	stq_p(env->external_htab + pteg_off + (good * 16) + 8,
	440	pte1);
	441	} else {
	442	stq_phys_notdirty(env->htab_base + pteg_off +
	443	(good * 16) + 8, pte1);
	444	}
	445	}
	446	}
	447
	448	/* We have a TLB that saves 4K pages, so let's
	449	* split a huge page to 4k chunks */
	450	if (target_page_bits != TARGET_PAGE_BITS) {
	451	ctx->raddr \|= (ctx->eaddr & ((1 << target_page_bits) - 1))
	452	& TARGET_PAGE_MASK;
	453	}
	454	return ret;
	455	}
0480884f	456
5dc68eb0	457	static int get_segment64(CPUPPCState env, struct mmu_ctx_hash64 ctx,
629bd516	458	target_ulong eaddr, int rw, int type)
0480884f DG	459	{
	460	hwaddr hash;
	461	target_ulong vsid;
	462	int pr, target_page_bits;
	463	int ret, ret2;
	464
	465	pr = msr_pr;
	466	ctx->eaddr = eaddr;
	467	ppc_slb_t *slb;
	468	target_ulong pageaddr;
	469	int segment_bits;
	470
	471	LOG_MMU("Check SLBs\n");
	472	slb = slb_lookup(env, eaddr);
	473	if (!slb) {
	474	return -5;
	475	}
	476
	477	if (slb->vsid & SLB_VSID_B) {
	478	vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
	479	segment_bits = 40;
	480	} else {
	481	vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
	482	segment_bits = 28;
	483	}
	484
	485	target_page_bits = (slb->vsid & SLB_VSID_L)
	486	? TARGET_PAGE_BITS_16M : TARGET_PAGE_BITS;
	487	ctx->key = !!(pr ? (slb->vsid & SLB_VSID_KP)
	488	: (slb->vsid & SLB_VSID_KS));
	489	ctx->nx = !!(slb->vsid & SLB_VSID_N);
	490
	491	pageaddr = eaddr & ((1ULL << segment_bits)
	492	- (1ULL << target_page_bits));
	493	if (slb->vsid & SLB_VSID_B) {
	494	hash = vsid ^ (vsid << 25) ^ (pageaddr >> target_page_bits);
	495	} else {
	496	hash = vsid ^ (pageaddr >> target_page_bits);
	497	}
	498	/* Only 5 bits of the page index are used in the AVPN */
	499	ctx->ptem = (slb->vsid & SLB_VSID_PTEM) \|
	500	((pageaddr >> 16) & ((1ULL << segment_bits) - 0x80));
	501
	502	LOG_MMU("pte segment: key=%d nx %d vsid " TARGET_FMT_lx "\n",
	503	ctx->key, ctx->nx, vsid);
	504	ret = -1;
	505
	506	/* Check if instruction fetch is allowed, if needed */
	507	if (type != ACCESS_CODE \|\| ctx->nx == 0) {
	508	/* Page address translation */
	509	LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
	510	" hash " TARGET_FMT_plx "\n",
	511	env->htab_base, env->htab_mask, hash);
	512	ctx->hash[0] = hash;
	513	ctx->hash[1] = ~hash;
	514
	515	/* Initialize real address with an invalid value */
	516	ctx->raddr = (hwaddr)-1ULL;
	517	LOG_MMU("0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
	518	" vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
	519	" hash=" TARGET_FMT_plx "\n",
	520	env->htab_base, env->htab_mask, vsid, ctx->ptem,
	521	ctx->hash[0]);
	522	/* Primary table lookup */
523	ret = find_pte64(env, ctx, 0, rw, type, target_page_bits);
524	if (ret < 0) {
525	/* Secondary table lookup */
526	LOG_MMU("1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
527	" vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
528	" hash=" TARGET_FMT_plx "\n", env->htab_base,
529	env->htab_mask, vsid, ctx->ptem, ctx->hash[1]);
530	ret2 = find_pte64(env, ctx, 1, rw, type, target_page_bits);
531	if (ret2 != -1) {
532	ret = ret2;
533	}
534	}
535	} else {
536	LOG_MMU("No access allowed\n");
537	ret = -3;
538	}
539
540	return ret;
541	}
629bd516	542
5dc68eb0 DG	543	static int ppc_hash64_get_physical_address(CPUPPCState *env,
5dc68eb0 DG	544	struct mmu_ctx_hash64 *ctx,
f2ad6be8 DG	545	target_ulong eaddr, int rw,
f2ad6be8 DG	546	int access_type)
629bd516 DG	547	{
	548	bool real_mode = (access_type == ACCESS_CODE && msr_ir == 0)
	549	\|\| (access_type != ACCESS_CODE && msr_dr == 0);
	550
	551	if (real_mode) {
	552	ctx->raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
	553	ctx->prot = PAGE_READ \| PAGE_EXEC \| PAGE_WRITE;
	554	return 0;
	555	} else {
	556	return get_segment64(env, ctx, eaddr, rw, access_type);
	557	}
	558	}
25de24ab	559
f2ad6be8 DG	560	hwaddr ppc_hash64_get_phys_page_debug(CPUPPCState *env, target_ulong addr)
f2ad6be8 DG	561	{
5dc68eb0	562	struct mmu_ctx_hash64 ctx;
f2ad6be8 DG	563
	564	if (unlikely(ppc_hash64_get_physical_address(env, &ctx, addr, 0, ACCESS_INT)
	565	!= 0)) {
	566	return -1;
	567	}
	568
	569	return ctx.raddr & TARGET_PAGE_MASK;
	570	}
	571
25de24ab DG	572	int ppc_hash64_handle_mmu_fault(CPUPPCState *env, target_ulong address, int rw,
	573	int mmu_idx)
	574	{
5dc68eb0	575	struct mmu_ctx_hash64 ctx;
25de24ab DG	576	int access_type;
	577	int ret = 0;
	578
	579	if (rw == 2) {
	580	/* code access */
	581	rw = 0;
	582	access_type = ACCESS_CODE;
	583	} else {
	584	/* data access */
	585	access_type = env->access_type;
	586	}
	587	ret = ppc_hash64_get_physical_address(env, &ctx, address, rw, access_type);
	588	if (ret == 0) {
	589	tlb_set_page(env, address & TARGET_PAGE_MASK,
	590	ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
	591	mmu_idx, TARGET_PAGE_SIZE);
	592	ret = 0;
	593	} else if (ret < 0) {
	594	LOG_MMU_STATE(env);
	595	if (access_type == ACCESS_CODE) {
	596	switch (ret) {
	597	case -1:
	598	env->exception_index = POWERPC_EXCP_ISI;
	599	env->error_code = 0x40000000;
	600	break;
	601	case -2:
	602	/* Access rights violation */
	603	env->exception_index = POWERPC_EXCP_ISI;
	604	env->error_code = 0x08000000;
	605	break;
	606	case -3:
	607	/* No execute protection violation */
	608	env->exception_index = POWERPC_EXCP_ISI;
	609	env->error_code = 0x10000000;
	610	break;
	611	case -5:
	612	/* No match in segment table */
	613	env->exception_index = POWERPC_EXCP_ISEG;
	614	env->error_code = 0;
	615	break;
	616	}
	617	} else {
	618	switch (ret) {
	619	case -1:
	620	/* No matches in page tables or TLB */
	621	env->exception_index = POWERPC_EXCP_DSI;
	622	env->error_code = 0;
	623	env->spr[SPR_DAR] = address;
	624	if (rw == 1) {
	625	env->spr[SPR_DSISR] = 0x42000000;
	626	} else {
	627	env->spr[SPR_DSISR] = 0x40000000;
	628	}
	629	break;
	630	case -2:
	631	/* Access rights violation */
	632	env->exception_index = POWERPC_EXCP_DSI;
	633	env->error_code = 0;
	634	env->spr[SPR_DAR] = address;
	635	if (rw == 1) {
	636	env->spr[SPR_DSISR] = 0x0A000000;
	637	} else {
	638	env->spr[SPR_DSISR] = 0x08000000;
	639	}
640	break;
641	case -5:
642	/* No match in segment table */
643	env->exception_index = POWERPC_EXCP_DSEG;
644	env->error_code = 0;
645	env->spr[SPR_DAR] = address;
646	break;
647	}
648	}
649	#if 0
650	printf("%s: set exception to %d %02x\n", __func__,
651	env->exception, env->error_code);
652	#endif
653	ret = 1;
654	}
655
656	return ret;
657	}