Skip to content

Commit d5fee0b

Browse files
sjitindarsinghdgibson
authored andcommitted
target/ppc: Implement ISA V3.00 radix page fault handler
ISA V3.00 introduced a new radix mmu model. Implement the page fault handler for this so we can run a tcg guest in radix mode and perform address translation correctly. In real mode (mmu turned off) addresses are masked to remove the top 4 bits and then are subject to partition scoped translation, since we only support pseries at this stage it is only necessary to perform the masking and then we're done. In virtual mode (mmu turned on) address translation if performed as follows: 1. Use the quadrant to determine the fully qualified address. The fully qualified address is defined as the combination of the effective address, the effective logical partition id (LPID) and the effective process id (PID). Based on the quadrant (EA63:62) we set the pid and lpid like so: quadrant 0: lpid = LPIDR, pid = PIDR quadrant 1: HV only (not allowed in pseries) quadrant 2: HV only (not allowed in pseries) quadrant 3: lpid = LPIDR, pid = 0 If we can't get the fully qualified address we raise a segment interrupt. 2. Find the guest radix tree We ask the virtual hypervisor for the partition table which was registered with H_REGISTER_PROC_TBL which points us to the process table in guest memory. We then index this table by pid to get the process table entry which points us to the appropriate radix tree to translate the address. If the process table isn't big enough to contain an entry for the current pid then we raise a storage interrupt. 3. Walk the radix tree Next we walk the radix tree where each level is a table of page directory entries indexed by some number of bits from the effective address, where the number of bits is determined by the table size. We continue to walk the tree (while entries are valid and the table is of minimum size) until we reach a table of page table entries, indicated by having the leaf bit set. The appropriate pte is then checked for sufficient access permissions, the reference and change bits are updated and the real address is calculated from the real page number bits of the pte and the low bits of the effective address. If we can't find an entry or can't access the entry bacause of permissions then we raise a storage interrupt. Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com> [dwg: Add missing parentheses to macro] Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
1 parent c883050 commit d5fee0b

File tree

6 files changed

+341
-4
lines changed

6 files changed

+341
-4
lines changed

target/ppc/Makefile.objs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ obj-y += translate.o
44
ifeq ($(CONFIG_SOFTMMU),y)
55
obj-y += machine.o mmu_helper.o mmu-hash32.o monitor.o arch_dump.o
66
obj-$(TARGET_PPC64) += mmu-hash64.o mmu-book3s-v3.o compat.o
7+
obj-$(TARGET_PPC64) += mmu-radix64.o
78
endif
89
obj-$(CONFIG_KVM) += kvm.o
910
obj-$(call lnot,$(CONFIG_KVM)) += kvm-stub.o

target/ppc/cpu.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -482,6 +482,8 @@ struct ppc_slb_t {
482482
#define DSISR_ISSTORE 0x02000000
483483
/* Not permitted by virtual page class key protection */
484484
#define DSISR_AMR 0x00200000
485+
/* Unsupported Radix Tree Configuration */
486+
#define DSISR_R_BADCONFIG 0x00080000
485487

486488
/* SRR1 error code fields */
487489

target/ppc/mmu-book3s-v3.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,13 @@
2222
#include "cpu.h"
2323
#include "mmu-hash64.h"
2424
#include "mmu-book3s-v3.h"
25-
#include "qemu/error-report.h"
25+
#include "mmu-radix64.h"
2626

2727
int ppc64_v3_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, int rwx,
2828
int mmu_idx)
2929
{
3030
if (ppc64_radix_guest(cpu)) { /* Guest uses radix */
31-
/* TODO - Unsupported */
32-
error_report("Guest Radix Support Unimplemented");
33-
exit(1);
31+
return ppc_radix64_handle_mmu_fault(cpu, eaddr, rwx, mmu_idx);
3432
} else { /* Guest uses hash */
3533
return ppc_hash64_handle_mmu_fault(cpu, eaddr, rwx, mmu_idx);
3634
}

target/ppc/mmu-book3s-v3.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@
2525
/* Partition Table Entry Fields */
2626
#define PATBE1_GR 0x8000000000000000
2727

28+
/* Process Table Entry */
29+
struct prtb_entry {
30+
uint64_t prtbe0, prtbe1;
31+
};
32+
2833
#ifdef TARGET_PPC64
2934

3035
static inline bool ppc64_use_proc_tbl(PowerPCCPU *cpu)

target/ppc/mmu-radix64.c

Lines changed: 259 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,259 @@
1+
/*
2+
* PowerPC Radix MMU mulation helpers for QEMU.
3+
*
4+
* Copyright (c) 2016 Suraj Jitindar Singh, IBM Corporation
5+
*
6+
* This library is free software; you can redistribute it and/or
7+
* modify it under the terms of the GNU Lesser General Public
8+
* License as published by the Free Software Foundation; either
9+
* version 2 of the License, or (at your option) any later version.
10+
*
11+
* This library is distributed in the hope that it will be useful,
12+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
13+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14+
* Lesser General Public License for more details.
15+
*
16+
* You should have received a copy of the GNU Lesser General Public
17+
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
18+
*/
19+
20+
#include "qemu/osdep.h"
21+
#include "qapi/error.h"
22+
#include "cpu.h"
23+
#include "exec/exec-all.h"
24+
#include "exec/helper-proto.h"
25+
#include "qemu/error-report.h"
26+
#include "sysemu/kvm.h"
27+
#include "kvm_ppc.h"
28+
#include "exec/log.h"
29+
#include "mmu-radix64.h"
30+
#include "mmu-book3s-v3.h"
31+
32+
static bool ppc_radix64_get_fully_qualified_addr(CPUPPCState *env, vaddr eaddr,
33+
uint64_t *lpid, uint64_t *pid)
34+
{
35+
/* We don't have HV support yet and shouldn't get here with it set anyway */
36+
assert(!msr_hv);
37+
38+
if (!msr_hv) { /* !MSR[HV] -> Guest */
39+
switch (eaddr & R_EADDR_QUADRANT) {
40+
case R_EADDR_QUADRANT0: /* Guest application */
41+
*lpid = env->spr[SPR_LPIDR];
42+
*pid = env->spr[SPR_BOOKS_PID];
43+
break;
44+
case R_EADDR_QUADRANT1: /* Illegal */
45+
case R_EADDR_QUADRANT2:
46+
return false;
47+
case R_EADDR_QUADRANT3: /* Guest OS */
48+
*lpid = env->spr[SPR_LPIDR];
49+
*pid = 0; /* pid set to 0 -> addresses guest operating system */
50+
break;
51+
}
52+
}
53+
54+
return true;
55+
}
56+
57+
static void ppc_radix64_raise_segi(PowerPCCPU *cpu, int rwx, vaddr eaddr)
58+
{
59+
CPUState *cs = CPU(cpu);
60+
CPUPPCState *env = &cpu->env;
61+
62+
if (rwx == 2) { /* Instruction Segment Interrupt */
63+
cs->exception_index = POWERPC_EXCP_ISEG;
64+
} else { /* Data Segment Interrupt */
65+
cs->exception_index = POWERPC_EXCP_DSEG;
66+
env->spr[SPR_DAR] = eaddr;
67+
}
68+
env->error_code = 0;
69+
}
70+
71+
static void ppc_radix64_raise_si(PowerPCCPU *cpu, int rwx, vaddr eaddr,
72+
uint32_t cause)
73+
{
74+
CPUState *cs = CPU(cpu);
75+
CPUPPCState *env = &cpu->env;
76+
77+
if (rwx == 2) { /* Instruction Storage Interrupt */
78+
cs->exception_index = POWERPC_EXCP_ISI;
79+
env->error_code = cause;
80+
} else { /* Data Storage Interrupt */
81+
cs->exception_index = POWERPC_EXCP_DSI;
82+
if (rwx == 1) { /* Write -> Store */
83+
cause |= DSISR_ISSTORE;
84+
}
85+
env->spr[SPR_DSISR] = cause;
86+
env->spr[SPR_DAR] = eaddr;
87+
env->error_code = 0;
88+
}
89+
}
90+
91+
92+
static bool ppc_radix64_check_prot(PowerPCCPU *cpu, int rwx, uint64_t pte,
93+
int *fault_cause, int *prot)
94+
{
95+
CPUPPCState *env = &cpu->env;
96+
const int need_prot[] = { PAGE_READ, PAGE_WRITE, PAGE_EXEC };
97+
98+
/* Check Page Attributes (pte58:59) */
99+
if (((pte & R_PTE_ATT) == R_PTE_ATT_NI_IO) && (rwx == 2)) {
100+
/*
101+
* Radix PTE entries with the non-idempotent I/O attribute are treated
102+
* as guarded storage
103+
*/
104+
*fault_cause |= SRR1_NOEXEC_GUARD;
105+
return true;
106+
}
107+
108+
/* Determine permissions allowed by Encoded Access Authority */
109+
if ((pte & R_PTE_EAA_PRIV) && msr_pr) { /* Insufficient Privilege */
110+
*prot = 0;
111+
} else if (msr_pr || (pte & R_PTE_EAA_PRIV)) {
112+
*prot = ppc_radix64_get_prot_eaa(pte);
113+
} else { /* !msr_pr && !(pte & R_PTE_EAA_PRIV) */
114+
*prot = ppc_radix64_get_prot_eaa(pte);
115+
*prot &= ppc_radix64_get_prot_amr(cpu); /* Least combined permissions */
116+
}
117+
118+
/* Check if requested access type is allowed */
119+
if (need_prot[rwx] & ~(*prot)) { /* Page Protected for that Access */
120+
*fault_cause |= DSISR_PROTFAULT;
121+
return true;
122+
}
123+
124+
return false;
125+
}
126+
127+
static void ppc_radix64_set_rc(PowerPCCPU *cpu, int rwx, uint64_t pte,
128+
hwaddr pte_addr, int *prot)
129+
{
130+
CPUState *cs = CPU(cpu);
131+
uint64_t npte;
132+
133+
npte = pte | R_PTE_R; /* Always set reference bit */
134+
135+
if (rwx == 1) { /* Store/Write */
136+
npte |= R_PTE_C; /* Set change bit */
137+
} else {
138+
/*
139+
* Treat the page as read-only for now, so that a later write
140+
* will pass through this function again to set the C bit.
141+
*/
142+
*prot &= ~PAGE_WRITE;
143+
}
144+
145+
if (pte ^ npte) { /* If pte has changed then write it back */
146+
stq_phys(cs->as, pte_addr, npte);
147+
}
148+
}
149+
150+
static uint64_t ppc_radix64_walk_tree(PowerPCCPU *cpu, int rwx, vaddr eaddr,
151+
uint64_t base_addr, uint64_t nls,
152+
hwaddr *raddr, int *psize,
153+
int *fault_cause, int *prot,
154+
hwaddr *pte_addr)
155+
{
156+
CPUState *cs = CPU(cpu);
157+
uint64_t index, pde;
158+
159+
if (nls < 5) { /* Directory maps less than 2**5 entries */
160+
*fault_cause |= DSISR_R_BADCONFIG;
161+
return 0;
162+
}
163+
164+
/* Read page <directory/table> entry from guest address space */
165+
index = eaddr >> (*psize - nls); /* Shift */
166+
index &= ((1UL << nls) - 1); /* Mask */
167+
pde = ldq_phys(cs->as, base_addr + (index * sizeof(pde)));
168+
if (!(pde & R_PTE_VALID)) { /* Invalid Entry */
169+
*fault_cause |= DSISR_NOPTE;
170+
return 0;
171+
}
172+
173+
*psize -= nls;
174+
175+
/* Check if Leaf Entry -> Page Table Entry -> Stop the Search */
176+
if (pde & R_PTE_LEAF) {
177+
uint64_t rpn = pde & R_PTE_RPN;
178+
uint64_t mask = (1UL << *psize) - 1;
179+
180+
if (ppc_radix64_check_prot(cpu, rwx, pde, fault_cause, prot)) {
181+
return 0; /* Protection Denied Access */
182+
}
183+
184+
/* Or high bits of rpn and low bits to ea to form whole real addr */
185+
*raddr = (rpn & ~mask) | (eaddr & mask);
186+
*pte_addr = base_addr + (index * sizeof(pde));
187+
return pde;
188+
}
189+
190+
/* Next Level of Radix Tree */
191+
return ppc_radix64_walk_tree(cpu, rwx, eaddr, pde & R_PDE_NLB,
192+
pde & R_PDE_NLS, raddr, psize,
193+
fault_cause, prot, pte_addr);
194+
}
195+
196+
int ppc_radix64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, int rwx,
197+
int mmu_idx)
198+
{
199+
CPUState *cs = CPU(cpu);
200+
CPUPPCState *env = &cpu->env;
201+
PPCVirtualHypervisorClass *vhc =
202+
PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
203+
hwaddr raddr, pte_addr;
204+
uint64_t lpid = 0, pid = 0, offset, size, patbe, prtbe0, pte;
205+
int page_size, prot, fault_cause = 0;
206+
207+
assert((rwx == 0) || (rwx == 1) || (rwx == 2));
208+
assert(!msr_hv); /* For now there is no Radix PowerNV Support */
209+
assert(cpu->vhyp);
210+
assert(ppc64_use_proc_tbl(cpu));
211+
212+
/* Real Mode Access */
213+
if (((rwx == 2) && (msr_ir == 0)) || ((rwx != 2) && (msr_dr == 0))) {
214+
/* In real mode top 4 effective addr bits (mostly) ignored */
215+
raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
216+
217+
tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
218+
PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
219+
TARGET_PAGE_SIZE);
220+
return 0;
221+
}
222+
223+
/* Virtual Mode Access - get the fully qualified address */
224+
if (!ppc_radix64_get_fully_qualified_addr(env, eaddr, &lpid, &pid)) {
225+
ppc_radix64_raise_segi(cpu, rwx, eaddr);
226+
return 1;
227+
}
228+
229+
/* Get Process Table */
230+
patbe = vhc->get_patbe(cpu->vhyp);
231+
232+
/* Index Process Table by PID to Find Corresponding Process Table Entry */
233+
offset = pid * sizeof(struct prtb_entry);
234+
size = 1ULL << ((patbe & PATBE1_R_PRTS) + 12);
235+
if (offset >= size) {
236+
/* offset exceeds size of the process table */
237+
ppc_radix64_raise_si(cpu, rwx, eaddr, DSISR_NOPTE);
238+
return 1;
239+
}
240+
prtbe0 = ldq_phys(cs->as, (patbe & PATBE1_R_PRTB) + offset);
241+
242+
/* Walk Radix Tree from Process Table Entry to Convert EA to RA */
243+
page_size = PRTBE_R_GET_RTS(prtbe0);
244+
pte = ppc_radix64_walk_tree(cpu, rwx, eaddr & R_EADDR_MASK,
245+
prtbe0 & PRTBE_R_RPDB, prtbe0 & PRTBE_R_RPDS,
246+
&raddr, &page_size, &fault_cause, &prot,
247+
&pte_addr);
248+
if (!pte) {
249+
ppc_radix64_raise_si(cpu, rwx, eaddr, fault_cause);
250+
return 1;
251+
}
252+
253+
/* Update Reference and Change Bits */
254+
ppc_radix64_set_rc(cpu, rwx, pte, pte_addr, &prot);
255+
256+
tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
257+
prot, mmu_idx, 1UL << page_size);
258+
return 1;
259+
}

target/ppc/mmu-radix64.h

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
#ifndef MMU_RADIX64_H
2+
#define MMU_RADIX64_H
3+
4+
#ifndef CONFIG_USER_ONLY
5+
6+
/* Radix Quadrants */
7+
#define R_EADDR_MASK 0x3FFFFFFFFFFFFFFF
8+
#define R_EADDR_QUADRANT 0xC000000000000000
9+
#define R_EADDR_QUADRANT0 0x0000000000000000
10+
#define R_EADDR_QUADRANT1 0x4000000000000000
11+
#define R_EADDR_QUADRANT2 0x8000000000000000
12+
#define R_EADDR_QUADRANT3 0xC000000000000000
13+
14+
/* Radix Partition Table Entry Fields */
15+
#define PATBE1_R_PRTB 0x0FFFFFFFFFFFF000
16+
#define PATBE1_R_PRTS 0x000000000000001F
17+
18+
/* Radix Process Table Entry Fields */
19+
#define PRTBE_R_GET_RTS(rts) \
20+
((((rts >> 58) & 0x18) | ((rts >> 5) & 0x7)) + 31)
21+
#define PRTBE_R_RPDB 0x0FFFFFFFFFFFFF00
22+
#define PRTBE_R_RPDS 0x000000000000001F
23+
24+
/* Radix Page Directory/Table Entry Fields */
25+
#define R_PTE_VALID 0x8000000000000000
26+
#define R_PTE_LEAF 0x4000000000000000
27+
#define R_PTE_SW0 0x2000000000000000
28+
#define R_PTE_RPN 0x01FFFFFFFFFFF000
29+
#define R_PTE_SW1 0x0000000000000E00
30+
#define R_GET_SW(sw) (((sw >> 58) & 0x8) | ((sw >> 9) & 0x7))
31+
#define R_PTE_R 0x0000000000000100
32+
#define R_PTE_C 0x0000000000000080
33+
#define R_PTE_ATT 0x0000000000000030
34+
#define R_PTE_ATT_NORMAL 0x0000000000000000
35+
#define R_PTE_ATT_SAO 0x0000000000000010
36+
#define R_PTE_ATT_NI_IO 0x0000000000000020
37+
#define R_PTE_ATT_TOLERANT_IO 0x0000000000000030
38+
#define R_PTE_EAA_PRIV 0x0000000000000008
39+
#define R_PTE_EAA_R 0x0000000000000004
40+
#define R_PTE_EAA_RW 0x0000000000000002
41+
#define R_PTE_EAA_X 0x0000000000000001
42+
#define R_PDE_NLB PRTBE_R_RPDB
43+
#define R_PDE_NLS PRTBE_R_RPDS
44+
45+
#ifdef TARGET_PPC64
46+
47+
int ppc_radix64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, int rwx,
48+
int mmu_idx);
49+
50+
static inline int ppc_radix64_get_prot_eaa(uint64_t pte)
51+
{
52+
return (pte & R_PTE_EAA_R ? PAGE_READ : 0) |
53+
(pte & R_PTE_EAA_RW ? PAGE_READ | PAGE_WRITE : 0) |
54+
(pte & R_PTE_EAA_X ? PAGE_EXEC : 0);
55+
}
56+
57+
static inline int ppc_radix64_get_prot_amr(PowerPCCPU *cpu)
58+
{
59+
CPUPPCState *env = &cpu->env;
60+
int amr = env->spr[SPR_AMR] >> 62; /* We only care about key0 AMR63:62 */
61+
int iamr = env->spr[SPR_IAMR] >> 62; /* We only care about key0 IAMR63:62 */
62+
63+
return (amr & 0x2 ? 0 : PAGE_WRITE) | /* Access denied if bit is set */
64+
(amr & 0x1 ? 0 : PAGE_READ) |
65+
(iamr & 0x1 ? 0 : PAGE_EXEC);
66+
}
67+
68+
#endif /* TARGET_PPC64 */
69+
70+
#endif /* CONFIG_USER_ONLY */
71+
72+
#endif /* MMU_RADIX64_H */

0 commit comments

Comments
 (0)