1 /*-
2  * Copyright (c) 2006 Peter Wemm
3  * Copyright (c) 2019 Leandro Lupori
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  *
26  * From: FreeBSD: src/lib/libkvm/kvm_minidump_riscv.c
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 #include <sys/param.h>
33 #include <vm/vm.h>
34 
35 #include <kvm.h>
36 
37 #include <limits.h>
38 #include <stdint.h>
39 #include <stdlib.h>
40 #include <string.h>
41 #include <unistd.h>
42 
43 #include "../../sys/powerpc/include/minidump.h"
44 #include "kvm_private.h"
45 #include "kvm_powerpc64.h"
46 
47 /*
48  * PowerPC64 HPT machine dependent routines for kvm and minidumps.
49  *
50  * Address Translation parameters:
51  *
52  * b = 12 (SLB base page size: 4 KB)
53  * b = 24 (SLB base page size: 16 MB)
54  * p = 12 (page size: 4 KB)
55  * p = 24 (page size: 16 MB)
56  * s = 28 (segment size: 256 MB)
57  */
58 
59 /* Large (huge) page params */
60 #define	LP_PAGE_SHIFT		24
61 #define	LP_PAGE_SIZE		(1ULL << LP_PAGE_SHIFT)
62 #define	LP_PAGE_MASK		0x00ffffffULL
63 
64 /* SLB */
65 
66 #define	SEGMENT_LENGTH		0x10000000ULL
67 
68 #define	round_seg(x)		roundup2((uint64_t)(x), SEGMENT_LENGTH)
69 
70 /* Virtual real-mode VSID in LPARs */
71 #define	VSID_VRMA		0x1ffffffULL
72 
73 #define	SLBV_L			0x0000000000000100ULL /* Large page selector */
74 #define	SLBV_CLASS		0x0000000000000080ULL /* Class selector */
75 #define	SLBV_LP_MASK		0x0000000000000030ULL
76 #define	SLBV_VSID_MASK		0x3ffffffffffff000ULL /* Virtual SegID mask */
77 #define	SLBV_VSID_SHIFT		12
78 
79 #define	SLBE_B_MASK		0x0000000006000000ULL
80 #define	SLBE_B_256MB		0x0000000000000000ULL
81 #define	SLBE_VALID		0x0000000008000000ULL /* SLB entry valid */
82 #define	SLBE_INDEX_MASK		0x0000000000000fffULL /* SLB index mask */
83 #define	SLBE_ESID_MASK		0xfffffffff0000000ULL /* Effective SegID mask */
84 #define	SLBE_ESID_SHIFT		28
85 
86 /* PTE */
87 
88 #define	LPTEH_VSID_SHIFT	12
89 #define	LPTEH_AVPN_MASK		0xffffffffffffff80ULL
90 #define	LPTEH_B_MASK		0xc000000000000000ULL
91 #define	LPTEH_B_256MB		0x0000000000000000ULL
92 #define	LPTEH_BIG		0x0000000000000004ULL	/* 4KB/16MB page */
93 #define	LPTEH_HID		0x0000000000000002ULL
94 #define	LPTEH_VALID		0x0000000000000001ULL
95 
96 #define	LPTEL_RPGN		0xfffffffffffff000ULL
97 #define	LPTEL_LP_MASK		0x00000000000ff000ULL
98 #define	LPTEL_NOEXEC		0x0000000000000004ULL
99 
100 /* Supervisor        (U: RW, S: RW) */
101 #define	LPTEL_BW		0x0000000000000002ULL
102 
103 /* Both Read Only    (U: RO, S: RO) */
104 #define	LPTEL_BR		0x0000000000000003ULL
105 
106 #define	LPTEL_RW		LPTEL_BW
107 #define	LPTEL_RO		LPTEL_BR
108 
109 /*
110  * PTE AVA field manipulation macros.
111  *
112  * AVA[0:54] = PTEH[2:56]
113  * AVA[VSID] = AVA[0:49] = PTEH[2:51]
114  * AVA[PAGE] = AVA[50:54] = PTEH[52:56]
115  */
116 #define	PTEH_AVA_VSID_MASK	0x3ffffffffffff000UL
117 #define	PTEH_AVA_VSID_SHIFT	12
118 #define	PTEH_AVA_VSID(p) \
119 	(((p) & PTEH_AVA_VSID_MASK) >> PTEH_AVA_VSID_SHIFT)
120 
121 #define	PTEH_AVA_PAGE_MASK	0x0000000000000f80UL
122 #define	PTEH_AVA_PAGE_SHIFT	7
123 #define	PTEH_AVA_PAGE(p) \
124 	(((p) & PTEH_AVA_PAGE_MASK) >> PTEH_AVA_PAGE_SHIFT)
125 
126 /* Masks to obtain the Physical Address from PTE low 64-bit word. */
127 #define	PTEL_PA_MASK		0x0ffffffffffff000UL
128 #define	PTEL_LP_PA_MASK		0x0fffffffff000000UL
129 
130 #define	PTE_HASH_MASK		0x0000007fffffffffUL
131 
132 /*
133  * Number of AVA/VA page bits to shift right, in order to leave only the
134  * ones that should be considered.
135  *
136  * q = MIN(54, 77-b) (PowerISA v2.07B, 5.7.7.3)
137  * n = q + 1 - 50 (VSID size in bits)
138  * s(ava) = 5 - n
139  * s(va) = (28 - b) - n
140  *
141  * q: bit number of lower limit of VA/AVA bits to compare
142  * n: number of AVA/VA page bits to compare
143  * s: shift amount
144  * 28 - b: VA page size in bits
145  */
146 #define	AVA_PAGE_SHIFT(b)	(5 - (MIN(54, 77-(b)) + 1 - 50))
147 #define	VA_PAGE_SHIFT(b)	(28 - (b) - (MIN(54, 77-(b)) + 1 - 50))
148 
149 /* Kernel ESID -> VSID mapping */
150 #define	KERNEL_VSID_BIT	0x0000001000000000UL /* Bit set in all kernel VSIDs */
151 #define	KERNEL_VSID(esid) ((((((uint64_t)esid << 8) | ((uint64_t)esid >> 28)) \
152 				* 0x13bbUL) & (KERNEL_VSID_BIT - 1)) | \
153 				KERNEL_VSID_BIT)
154 
155 /* Types */
156 
157 typedef uint64_t	ppc64_physaddr_t;
158 
159 typedef struct {
160 	uint64_t slbv;
161 	uint64_t slbe;
162 } ppc64_slb_entry_t;
163 
164 typedef struct {
165 	uint64_t pte_hi;
166 	uint64_t pte_lo;
167 } ppc64_pt_entry_t;
168 
169 struct hpt_data {
170 	ppc64_slb_entry_t *slbs;
171 	uint32_t slbsize;
172 };
173 
174 
175 static void
176 slb_fill(ppc64_slb_entry_t *slb, uint64_t ea, uint64_t i)
177 {
178 	uint64_t esid;
179 
180 	esid = ea >> SLBE_ESID_SHIFT;
181 	slb->slbv = KERNEL_VSID(esid) << SLBV_VSID_SHIFT;
182 	slb->slbe = (esid << SLBE_ESID_SHIFT) | SLBE_VALID | i;
183 }
184 
185 static int
186 slb_init(kvm_t *kd)
187 {
188 	struct minidumphdr *hdr;
189 	struct hpt_data *data;
190 	ppc64_slb_entry_t *slb;
191 	uint32_t slbsize;
192 	uint64_t ea, i, maxmem;
193 
194 	hdr = &kd->vmst->hdr;
195 	data = PPC64_MMU_DATA(kd);
196 
197 	/* Alloc SLBs */
198 	maxmem = hdr->bitmapsize * 8 * PPC64_PAGE_SIZE;
199 	slbsize = round_seg(hdr->kernend + 1 - hdr->kernbase + maxmem) /
200 	    SEGMENT_LENGTH * sizeof(ppc64_slb_entry_t);
201 	data->slbs = _kvm_malloc(kd, slbsize);
202 	if (data->slbs == NULL) {
203 		_kvm_err(kd, kd->program, "cannot allocate slbs");
204 		return (-1);
205 	}
206 	data->slbsize = slbsize;
207 
208 	dprintf("%s: maxmem=0x%jx, segs=%jd, slbsize=0x%jx\n",
209 	    __func__, (uintmax_t)maxmem,
210 	    (uintmax_t)slbsize / sizeof(ppc64_slb_entry_t), (uintmax_t)slbsize);
211 
212 	/*
213 	 * Generate needed SLB entries.
214 	 *
215 	 * When translating addresses from EA to VA to PA, the needed SLB
216 	 * entry could be generated on the fly, but this is not the case
217 	 * for the walk_pages method, that needs to search the SLB entry
218 	 * by VSID, in order to find out the EA from a PTE.
219 	 */
220 
221 	/* VM area */
222 	for (ea = hdr->kernbase, i = 0, slb = data->slbs;
223 	    ea < hdr->kernend; ea += SEGMENT_LENGTH, i++, slb++)
224 		slb_fill(slb, ea, i);
225 
226 	/* DMAP area */
227 	for (ea = hdr->dmapbase;
228 	    ea < MIN(hdr->dmapend, hdr->dmapbase + maxmem);
229 	    ea += SEGMENT_LENGTH, i++, slb++) {
230 		slb_fill(slb, ea, i);
231 		if (hdr->hw_direct_map)
232 			slb->slbv |= SLBV_L;
233 	}
234 
235 	return (0);
236 }
237 
238 static void
239 ppc64mmu_hpt_cleanup(kvm_t *kd)
240 {
241 	struct hpt_data *data;
242 
243 	if (kd->vmst == NULL)
244 		return;
245 
246 	data = PPC64_MMU_DATA(kd);
247 	free(data->slbs);
248 	free(data);
249 	PPC64_MMU_DATA(kd) = NULL;
250 }
251 
252 static int
253 ppc64mmu_hpt_init(kvm_t *kd)
254 {
255 	struct hpt_data *data;
256 
257 	/* Alloc MMU data */
258 	data = _kvm_malloc(kd, sizeof(*data));
259 	if (data == NULL) {
260 		_kvm_err(kd, kd->program, "cannot allocate MMU data");
261 		return (-1);
262 	}
263 	data->slbs = NULL;
264 	PPC64_MMU_DATA(kd) = data;
265 
266 	if (slb_init(kd) == -1)
267 		goto failed;
268 
269 	return (0);
270 
271 failed:
272 	ppc64mmu_hpt_cleanup(kd);
273 	return (-1);
274 }
275 
276 static ppc64_slb_entry_t *
277 slb_search(kvm_t *kd, kvaddr_t ea)
278 {
279 	struct hpt_data *data;
280 	ppc64_slb_entry_t *slb;
281 	int i, n;
282 
283 	data = PPC64_MMU_DATA(kd);
284 	slb = data->slbs;
285 	n = data->slbsize / sizeof(ppc64_slb_entry_t);
286 
287 	/* SLB search */
288 	for (i = 0; i < n; i++, slb++) {
289 		if ((slb->slbe & SLBE_VALID) == 0)
290 			continue;
291 
292 		/* Compare 36-bit ESID of EA with segment one (64-s) */
293 		if ((slb->slbe & SLBE_ESID_MASK) != (ea & SLBE_ESID_MASK))
294 			continue;
295 
296 		/* Match found */
297 		dprintf("SEG#%02d: slbv=0x%016jx, slbe=0x%016jx\n",
298 		    i, (uintmax_t)slb->slbv, (uintmax_t)slb->slbe);
299 		break;
300 	}
301 
302 	/* SLB not found */
303 	if (i == n) {
304 		_kvm_err(kd, kd->program, "%s: segment not found for EA 0x%jx",
305 		    __func__, (uintmax_t)ea);
306 		return (NULL);
307 	}
308 	return (slb);
309 }
310 
311 static ppc64_pt_entry_t
312 pte_get(kvm_t *kd, u_long ptex)
313 {
314 	ppc64_pt_entry_t pte, *p;
315 
316 	p = _kvm_pmap_get(kd, ptex, sizeof(pte));
317 	pte.pte_hi = be64toh(p->pte_hi);
318 	pte.pte_lo = be64toh(p->pte_lo);
319 	return (pte);
320 }
321 
322 static int
323 pte_search(kvm_t *kd, ppc64_slb_entry_t *slb, uint64_t hid, kvaddr_t ea,
324     ppc64_pt_entry_t *p)
325 {
326 	uint64_t hash, hmask;
327 	uint64_t pteg, ptex;
328 	uint64_t va_vsid, va_page;
329 	int b;
330 	int ava_pg_shift, va_pg_shift;
331 	ppc64_pt_entry_t pte;
332 
333 	/*
334 	 * Get VA:
335 	 *
336 	 * va(78) = va_vsid(50) || va_page(s-b) || offset(b)
337 	 *
338 	 * va_vsid: 50-bit VSID (78-s)
339 	 * va_page: (s-b)-bit VA page
340 	 */
341 	b = slb->slbv & SLBV_L? LP_PAGE_SHIFT : PPC64_PAGE_SHIFT;
342 	va_vsid = (slb->slbv & SLBV_VSID_MASK) >> SLBV_VSID_SHIFT;
343 	va_page = (ea & ~SLBE_ESID_MASK) >> b;
344 
345 	dprintf("%s: hid=0x%jx, ea=0x%016jx, b=%d, va_vsid=0x%010jx, "
346 	    "va_page=0x%04jx\n",
347 	    __func__, (uintmax_t)hid, (uintmax_t)ea, b,
348 	    (uintmax_t)va_vsid, (uintmax_t)va_page);
349 
350 	/*
351 	 * Get hash:
352 	 *
353 	 * Primary hash: va_vsid(11:49) ^ va_page(s-b)
354 	 * Secondary hash: ~primary_hash
355 	 */
356 	hash = (va_vsid & PTE_HASH_MASK) ^ va_page;
357 	if (hid)
358 		hash = ~hash & PTE_HASH_MASK;
359 
360 	/*
361 	 * Get PTEG:
362 	 *
363 	 * pteg = (hash(0:38) & hmask) << 3
364 	 *
365 	 * hmask (hash mask): mask generated from HTABSIZE || 11*0b1
366 	 * hmask = number_of_ptegs - 1
367 	 */
368 	hmask = kd->vmst->hdr.pmapsize / (8 * sizeof(ppc64_pt_entry_t)) - 1;
369 	pteg = (hash & hmask) << 3;
370 
371 	ava_pg_shift = AVA_PAGE_SHIFT(b);
372 	va_pg_shift = VA_PAGE_SHIFT(b);
373 
374 	dprintf("%s: hash=0x%010jx, hmask=0x%010jx, (hash & hmask)=0x%010jx, "
375 	    "pteg=0x%011jx, ava_pg_shift=%d, va_pg_shift=%d\n",
376 	    __func__, (uintmax_t)hash, (uintmax_t)hmask,
377 	    (uintmax_t)(hash & hmask), (uintmax_t)pteg,
378 	    ava_pg_shift, va_pg_shift);
379 
380 	/* Search PTEG */
381 	for (ptex = pteg; ptex < pteg + 8; ptex++) {
382 		pte = pte_get(kd, ptex);
383 
384 		/* Check H, V and B */
385 		if ((pte.pte_hi & LPTEH_HID) != hid ||
386 		    (pte.pte_hi & LPTEH_VALID) == 0 ||
387 		    (pte.pte_hi & LPTEH_B_MASK) != LPTEH_B_256MB)
388 			continue;
389 
390 		/* Compare AVA with VA */
391 		if (PTEH_AVA_VSID(pte.pte_hi) != va_vsid ||
392 		    (PTEH_AVA_PAGE(pte.pte_hi) >> ava_pg_shift) !=
393 		    (va_page >> va_pg_shift))
394 			continue;
395 
396 		/*
397 		 * Check if PTE[L] matches SLBV[L].
398 		 *
399 		 * Note: this check ignores PTE[LP], as does the kernel.
400 		 */
401 		if (b == PPC64_PAGE_SHIFT) {
402 			if (pte.pte_hi & LPTEH_BIG)
403 				continue;
404 		} else if ((pte.pte_hi & LPTEH_BIG) == 0)
405 			continue;
406 
407 		/* Match found */
408 		dprintf("%s: PTE found: ptex=0x%jx, pteh=0x%016jx, "
409 		    "ptel=0x%016jx\n",
410 		    __func__, (uintmax_t)ptex, (uintmax_t)pte.pte_hi,
411 		    (uintmax_t)pte.pte_lo);
412 		break;
413 	}
414 
415 	/* Not found? */
416 	if (ptex == pteg + 8) {
417 		/* Try secondary hash */
418 		if (hid == 0)
419 			return (pte_search(kd, slb, LPTEH_HID, ea, p));
420 		else {
421 			_kvm_err(kd, kd->program,
422 			    "%s: pte not found", __func__);
423 			return (-1);
424 		}
425 	}
426 
427 	/* PTE found */
428 	*p = pte;
429 	return (0);
430 }
431 
432 static int
433 pte_lookup(kvm_t *kd, kvaddr_t ea, ppc64_pt_entry_t *pte)
434 {
435 	ppc64_slb_entry_t *slb;
436 
437 	/* First, find SLB */
438 	if ((slb = slb_search(kd, ea)) == NULL)
439 		return (-1);
440 
441 	/* Next, find PTE */
442 	return (pte_search(kd, slb, 0, ea, pte));
443 }
444 
445 static int
446 ppc64mmu_hpt_kvatop(kvm_t *kd, kvaddr_t va, off_t *pa)
447 {
448 	struct minidumphdr *hdr;
449 	struct vmstate *vm;
450 	ppc64_pt_entry_t pte;
451 	ppc64_physaddr_t pgoff, pgpa;
452 	off_t ptoff;
453 	int err;
454 
455 	vm = kd->vmst;
456 	hdr = &vm->hdr;
457 	pgoff = va & PPC64_PAGE_MASK;
458 
459 	dprintf("%s: va=0x%016jx\n", __func__, (uintmax_t)va);
460 
461 	/*
462 	 * A common use case of libkvm is to first find a symbol address
463 	 * from the kernel image and then use kvatop to translate it and
464 	 * to be able to fetch its corresponding data.
465 	 *
466 	 * The problem is that, in PowerPC64 case, the addresses of relocated
467 	 * data won't match those in the kernel image. This is handled here by
468 	 * adding the relocation offset to those addresses.
469 	 */
470 	if (va < hdr->dmapbase)
471 		va += hdr->startkernel - PPC64_KERNBASE;
472 
473 	/* Handle DMAP */
474 	if (va >= hdr->dmapbase && va <= hdr->dmapend) {
475 		pgpa = (va & ~hdr->dmapbase) & ~PPC64_PAGE_MASK;
476 		ptoff = _kvm_pt_find(kd, pgpa, PPC64_PAGE_SIZE);
477 		if (ptoff == -1) {
478 			_kvm_err(kd, kd->program, "%s: "
479 			    "direct map address 0x%jx not in minidump",
480 			    __func__, (uintmax_t)va);
481 			goto invalid;
482 		}
483 		*pa = ptoff + pgoff;
484 		return (PPC64_PAGE_SIZE - pgoff);
485 	/* Translate VA to PA */
486 	} else if (va >= hdr->kernbase) {
487 		if ((err = pte_lookup(kd, va, &pte)) == -1) {
488 			_kvm_err(kd, kd->program,
489 			    "%s: pte not valid", __func__);
490 			goto invalid;
491 		}
492 
493 		if (pte.pte_hi & LPTEH_BIG)
494 			pgpa = (pte.pte_lo & PTEL_LP_PA_MASK) |
495 			    (va & ~PPC64_PAGE_MASK & LP_PAGE_MASK);
496 		else
497 			pgpa = pte.pte_lo & PTEL_PA_MASK;
498 		dprintf("%s: pgpa=0x%016jx\n", __func__, (uintmax_t)pgpa);
499 
500 		ptoff = _kvm_pt_find(kd, pgpa, PPC64_PAGE_SIZE);
501 		if (ptoff == -1) {
502 			_kvm_err(kd, kd->program, "%s: "
503 			    "physical address 0x%jx not in minidump",
504 			    __func__, (uintmax_t)pgpa);
505 			goto invalid;
506 		}
507 		*pa = ptoff + pgoff;
508 		return (PPC64_PAGE_SIZE - pgoff);
509 	} else {
510 		_kvm_err(kd, kd->program,
511 		    "%s: virtual address 0x%jx not minidumped",
512 		    __func__, (uintmax_t)va);
513 		goto invalid;
514 	}
515 
516 invalid:
517 	_kvm_err(kd, 0, "invalid address (0x%jx)", (uintmax_t)va);
518 	return (0);
519 }
520 
521 static vm_prot_t
522 entry_to_prot(ppc64_pt_entry_t *pte)
523 {
524 	vm_prot_t prot = VM_PROT_READ;
525 
526 	if (pte->pte_lo & LPTEL_RW)
527 		prot |= VM_PROT_WRITE;
528 	if ((pte->pte_lo & LPTEL_NOEXEC) != 0)
529 		prot |= VM_PROT_EXECUTE;
530 	return (prot);
531 }
532 
533 static ppc64_slb_entry_t *
534 slb_vsid_search(kvm_t *kd, uint64_t vsid)
535 {
536 	struct hpt_data *data;
537 	ppc64_slb_entry_t *slb;
538 	int i, n;
539 
540 	data = PPC64_MMU_DATA(kd);
541 	slb = data->slbs;
542 	n = data->slbsize / sizeof(ppc64_slb_entry_t);
543 	vsid <<= SLBV_VSID_SHIFT;
544 
545 	/* SLB search */
546 	for (i = 0; i < n; i++, slb++) {
547 		/* Check if valid and compare VSID */
548 		if ((slb->slbe & SLBE_VALID) &&
549 		    (slb->slbv & SLBV_VSID_MASK) == vsid)
550 			break;
551 	}
552 
553 	/* SLB not found */
554 	if (i == n) {
555 		_kvm_err(kd, kd->program,
556 		    "%s: segment not found for VSID 0x%jx",
557 		    __func__, (uintmax_t)vsid >> SLBV_VSID_SHIFT);
558 		return (NULL);
559 	}
560 	return (slb);
561 }
562 
563 static u_long
564 get_ea(kvm_t *kd, ppc64_pt_entry_t *pte, u_long ptex)
565 {
566 	ppc64_slb_entry_t *slb;
567 	uint64_t ea, hash, vsid;
568 	int b, shift;
569 
570 	/* Find SLB */
571 	vsid = PTEH_AVA_VSID(pte->pte_hi);
572 	if ((slb = slb_vsid_search(kd, vsid)) == NULL)
573 		return (~0UL);
574 
575 	/* Get ESID part of EA */
576 	ea = slb->slbe & SLBE_ESID_MASK;
577 
578 	b = slb->slbv & SLBV_L? LP_PAGE_SHIFT : PPC64_PAGE_SHIFT;
579 
580 	/*
581 	 * If there are less than 64K PTEGs (16-bit), the upper bits of
582 	 * EA page must be obtained from PTEH's AVA.
583 	 */
584 	if (kd->vmst->hdr.pmapsize / (8 * sizeof(ppc64_pt_entry_t)) <
585 	    0x10000U) {
586 		/*
587 		 * Add 0 to 5 EA bits, right after VSID.
588 		 * b == 12: 5 bits
589 		 * b == 24: 4 bits
590 		 */
591 		shift = AVA_PAGE_SHIFT(b);
592 		ea |= (PTEH_AVA_PAGE(pte->pte_hi) >> shift) <<
593 		    (SLBE_ESID_SHIFT - 5 + shift);
594 	}
595 
596 	/* Get VA page from hash and add to EA. */
597 	hash = (ptex & ~7) >> 3;
598 	if (pte->pte_hi & LPTEH_HID)
599 		hash = ~hash & PTE_HASH_MASK;
600 	ea |= ((hash ^ (vsid & PTE_HASH_MASK)) << b) & ~SLBE_ESID_MASK;
601 	return (ea);
602 }
603 
604 static int
605 ppc64mmu_hpt_walk_pages(kvm_t *kd, kvm_walk_pages_cb_t *cb, void *arg)
606 {
607 	struct vmstate *vm;
608 	int ret;
609 	unsigned int pagesz;
610 	u_long dva, pa, va;
611 	u_long ptex, nptes;
612 	uint64_t vsid;
613 
614 	ret = 0;
615 	vm = kd->vmst;
616 	nptes = vm->hdr.pmapsize / sizeof(ppc64_pt_entry_t);
617 
618 	/* Walk through PTEs */
619 	for (ptex = 0; ptex < nptes; ptex++) {
620 		ppc64_pt_entry_t pte = pte_get(kd, ptex);
621 		if ((pte.pte_hi & LPTEH_VALID) == 0)
622 			continue;
623 
624 		/* Skip non-kernel related pages, as well as VRMA ones */
625 		vsid = PTEH_AVA_VSID(pte.pte_hi);
626 		if ((vsid & KERNEL_VSID_BIT) == 0 ||
627 		    (vsid >> PPC64_PAGE_SHIFT) == VSID_VRMA)
628 			continue;
629 
630 		/* Retrieve page's VA (EA on PPC64 terminology) */
631 		if ((va = get_ea(kd, &pte, ptex)) == ~0UL)
632 			goto out;
633 
634 		/* Get PA and page size */
635 		if (pte.pte_hi & LPTEH_BIG) {
636 			pa = pte.pte_lo & PTEL_LP_PA_MASK;
637 			pagesz = LP_PAGE_SIZE;
638 		} else {
639 			pa = pte.pte_lo & PTEL_PA_MASK;
640 			pagesz = PPC64_PAGE_SIZE;
641 		}
642 
643 		/* Get DMAP address */
644 		dva = vm->hdr.dmapbase + pa;
645 
646 		if (!_kvm_visit_cb(kd, cb, arg, pa, va, dva,
647 		    entry_to_prot(&pte), pagesz, 0))
648 			goto out;
649 	}
650 	ret = 1;
651 
652 out:
653 	return (ret);
654 }
655 
656 
657 static struct ppc64_mmu_ops ops = {
658 	.init		= ppc64mmu_hpt_init,
659 	.cleanup	= ppc64mmu_hpt_cleanup,
660 	.kvatop		= ppc64mmu_hpt_kvatop,
661 	.walk_pages	= ppc64mmu_hpt_walk_pages,
662 };
663 struct ppc64_mmu_ops *ppc64_mmu_ops_hpt = &ops;
664