[mirror_qemu.git] / target-mips / helper.c

/*
 *  MIPS emulation helpers for qemu.
 *
 *  Copyright (c) 2004-2005 Jocelyn Mayer
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */
#include <stdarg.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <inttypes.h>
#include <signal.h>

#include "cpu.h"
#include "exec-all.h"

enum {
    TLBRET_DIRTY = -4,
    TLBRET_INVALID = -3,
    TLBRET_NOMATCH = -2,
    TLBRET_BADADDR = -1,
    TLBRET_MATCH = 0
};

/* no MMU emulation */
int no_mmu_map_address (CPUState *env, target_ulong *physical, int *prot,
                        target_ulong address, int rw, int access_type)
{
    *physical = address;
    *prot = PAGE_READ | PAGE_WRITE;
    return TLBRET_MATCH;
}

/* fixed mapping MMU emulation */
int fixed_mmu_map_address (CPUState *env, target_ulong *physical, int *prot,
                           target_ulong address, int rw, int access_type)
{
    if (address <= (int32_t)0x7FFFFFFFUL) {
        if (!(env->CP0_Status & (1 << CP0St_ERL)))
            *physical = address + 0x40000000UL;
        else
            *physical = address;
    } else if (address <= (int32_t)0xBFFFFFFFUL)
        *physical = address & 0x1FFFFFFF;
    else
        *physical = address;

    *prot = PAGE_READ | PAGE_WRITE;
    return TLBRET_MATCH;
}

/* MIPS32/MIPS64 R4000-style MMU emulation */
int r4k_map_address (CPUState *env, target_ulong *physical, int *prot,
                     target_ulong address, int rw, int access_type)
{
    uint8_t ASID = env->CP0_EntryHi & 0xFF;
    int i;

    for (i = 0; i < env->tlb->tlb_in_use; i++) {
        r4k_tlb_t *tlb = &env->tlb->mmu.r4k.tlb[i];
        /* 1k pages are not supported. */
        target_ulong mask = tlb->PageMask | ~(TARGET_PAGE_MASK << 1);
        target_ulong tag = address & ~mask;
        target_ulong VPN = tlb->VPN & ~mask;
#if defined(TARGET_MIPS64)
        tag &= env->SEGMask;
#endif

        /* Check ASID, virtual page number & size */
        if ((tlb->G == 1 || tlb->ASID == ASID) && VPN == tag) {
            /* TLB match */
            int n = !!(address & mask & ~(mask >> 1));
            /* Check access rights */
            if (!(n ? tlb->V1 : tlb->V0))
                return TLBRET_INVALID;
            if (rw == 0 || (n ? tlb->D1 : tlb->D0)) {
                *physical = tlb->PFN[n] | (address & (mask >> 1));
                *prot = PAGE_READ;
                if (n ? tlb->D1 : tlb->D0)
                    *prot |= PAGE_WRITE;
                return TLBRET_MATCH;
            }
            return TLBRET_DIRTY;
        }
    }
    return TLBRET_NOMATCH;
}

#if !defined(CONFIG_USER_ONLY)
static int get_physical_address (CPUState *env, target_ulong *physical,
                                int *prot, target_ulong address,
                                int rw, int access_type)
{
    /* User mode can only access useg/xuseg */
    int user_mode = (env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_UM;
    int supervisor_mode = (env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_SM;
    int kernel_mode = !user_mode && !supervisor_mode;
#if defined(TARGET_MIPS64)
    int UX = (env->CP0_Status & (1 << CP0St_UX)) != 0;
    int SX = (env->CP0_Status & (1 << CP0St_SX)) != 0;
    int KX = (env->CP0_Status & (1 << CP0St_KX)) != 0;
#endif
    int ret = TLBRET_MATCH;

#if 0
    qemu_log("user mode %d h %08x\n", user_mode, env->hflags);
#endif

    if (address <= (int32_t)0x7FFFFFFFUL) {
        /* useg */
        if (env->CP0_Status & (1 << CP0St_ERL)) {
            *physical = address & 0xFFFFFFFF;
            *prot = PAGE_READ | PAGE_WRITE;
        } else {
            ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
        }
#if defined(TARGET_MIPS64)
    } else if (address < 0x4000000000000000ULL) {
        /* xuseg */
        if (UX && address <= (0x3FFFFFFFFFFFFFFFULL & env->SEGMask)) {
            ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
        } else {
            ret = TLBRET_BADADDR;
        }
    } else if (address < 0x8000000000000000ULL) {
        /* xsseg */
        if ((supervisor_mode || kernel_mode) &&
            SX && address <= (0x7FFFFFFFFFFFFFFFULL & env->SEGMask)) {
            ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
        } else {
            ret = TLBRET_BADADDR;
        }
    } else if (address < 0xC000000000000000ULL) {
        /* xkphys */
        if (kernel_mode && KX &&
            (address & 0x07FFFFFFFFFFFFFFULL) <= env->PAMask) {
            *physical = address & env->PAMask;
            *prot = PAGE_READ | PAGE_WRITE;
        } else {
            ret = TLBRET_BADADDR;
        }
    } else if (address < 0xFFFFFFFF80000000ULL) {
        /* xkseg */
        if (kernel_mode && KX &&
            address <= (0xFFFFFFFF7FFFFFFFULL & env->SEGMask)) {
            ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
        } else {
            ret = TLBRET_BADADDR;
        }
#endif
    } else if (address < (int32_t)0xA0000000UL) {
        /* kseg0 */
        if (kernel_mode) {
            *physical = address - (int32_t)0x80000000UL;
            *prot = PAGE_READ | PAGE_WRITE;
        } else {
            ret = TLBRET_BADADDR;
        }
    } else if (address < (int32_t)0xC0000000UL) {
        /* kseg1 */
        if (kernel_mode) {
            *physical = address - (int32_t)0xA0000000UL;
            *prot = PAGE_READ | PAGE_WRITE;
        } else {
            ret = TLBRET_BADADDR;
        }
    } else if (address < (int32_t)0xE0000000UL) {
        /* sseg (kseg2) */
        if (supervisor_mode || kernel_mode) {
            ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
        } else {
            ret = TLBRET_BADADDR;
        }
    } else {
        /* kseg3 */
        /* XXX: debug segment is not emulated */
        if (kernel_mode) {
            ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
        } else {
            ret = TLBRET_BADADDR;
        }
    }
#if 0
    qemu_log(TARGET_FMT_lx " %d %d => " TARGET_FMT_lx " %d (%d)\n",
            address, rw, access_type, *physical, *prot, ret);
    }
#endif

    return ret;
}
#endif

target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
{
#if defined(CONFIG_USER_ONLY)
    return addr;
#else
    target_ulong phys_addr;
    int prot;

    if (get_physical_address(env, &phys_addr, &prot, addr, 0, ACCESS_INT) != 0)
        return -1;
    return phys_addr;
#endif
}

int cpu_mips_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
                               int mmu_idx, int is_softmmu)
{
#if !defined(CONFIG_USER_ONLY)
    target_ulong physical;
    int prot;
#endif
    int exception = 0, error_code = 0;
    int access_type;
    int ret = 0;

#if 0
    log_cpu_state(env, 0);
#endif
    qemu_log("%s pc " TARGET_FMT_lx " ad " TARGET_FMT_lx " rw %d mmu_idx %d smmu %d\n",
              __func__, env->active_tc.PC, address, rw, mmu_idx, is_softmmu);

    rw &= 1;

    /* data access */
    /* XXX: put correct access by using cpu_restore_state()
       correctly */
    access_type = ACCESS_INT;
#if defined(CONFIG_USER_ONLY)
    ret = TLBRET_NOMATCH;
#else
    ret = get_physical_address(env, &physical, &prot,
                               address, rw, access_type);
    qemu_log("%s address=" TARGET_FMT_lx " ret %d physical " TARGET_FMT_lx " prot %d\n",
              __func__, address, ret, physical, prot);
    if (ret == TLBRET_MATCH) {
       ret = tlb_set_page(env, address & TARGET_PAGE_MASK,
                          physical & TARGET_PAGE_MASK, prot,
                          mmu_idx, is_softmmu);
    } else if (ret < 0)
#endif
    {
        switch (ret) {
        default:
        case TLBRET_BADADDR:
            /* Reference to kernel address from user mode or supervisor mode */
            /* Reference to supervisor address from user mode */
            if (rw)
                exception = EXCP_AdES;
            else
                exception = EXCP_AdEL;
            break;
        case TLBRET_NOMATCH:
            /* No TLB match for a mapped address */
            if (rw)
                exception = EXCP_TLBS;
            else
                exception = EXCP_TLBL;
            error_code = 1;
            break;
        case TLBRET_INVALID:
            /* TLB match with no valid bit */
            if (rw)
                exception = EXCP_TLBS;
            else
                exception = EXCP_TLBL;
            break;
        case TLBRET_DIRTY:
            /* TLB match but 'D' bit is cleared */
            exception = EXCP_LTLBL;
            break;

        }
        /* Raise exception */
        env->CP0_BadVAddr = address;
        env->CP0_Context = (env->CP0_Context & ~0x007fffff) |
                           ((address >> 9) &   0x007ffff0);
        env->CP0_EntryHi =
            (env->CP0_EntryHi & 0xFF) | (address & (TARGET_PAGE_MASK << 1));
#if defined(TARGET_MIPS64)
        env->CP0_EntryHi &= env->SEGMask;
        env->CP0_XContext = (env->CP0_XContext & ((~0ULL) << (env->SEGBITS - 7))) |
                            ((address & 0xC00000000000ULL) >> (55 - env->SEGBITS)) |
                            ((address & ((1ULL << env->SEGBITS) - 1) & 0xFFFFFFFFFFFFE000ULL) >> 9);
#endif
        env->exception_index = exception;
        env->error_code = error_code;
        ret = 1;
    }

    return ret;
}

static const char * const excp_names[EXCP_LAST + 1] = {
    [EXCP_RESET] = "reset",
    [EXCP_SRESET] = "soft reset",
    [EXCP_DSS] = "debug single step",
    [EXCP_DINT] = "debug interrupt",
    [EXCP_NMI] = "non-maskable interrupt",
    [EXCP_MCHECK] = "machine check",
    [EXCP_EXT_INTERRUPT] = "interrupt",
    [EXCP_DFWATCH] = "deferred watchpoint",
    [EXCP_DIB] = "debug instruction breakpoint",
    [EXCP_IWATCH] = "instruction fetch watchpoint",
    [EXCP_AdEL] = "address error load",
    [EXCP_AdES] = "address error store",
    [EXCP_TLBF] = "TLB refill",
    [EXCP_IBE] = "instruction bus error",
    [EXCP_DBp] = "debug breakpoint",
    [EXCP_SYSCALL] = "syscall",
    [EXCP_BREAK] = "break",
    [EXCP_CpU] = "coprocessor unusable",
    [EXCP_RI] = "reserved instruction",
    [EXCP_OVERFLOW] = "arithmetic overflow",
    [EXCP_TRAP] = "trap",
    [EXCP_FPE] = "floating point",
    [EXCP_DDBS] = "debug data break store",
    [EXCP_DWATCH] = "data watchpoint",
    [EXCP_LTLBL] = "TLB modify",
    [EXCP_TLBL] = "TLB load",
    [EXCP_TLBS] = "TLB store",
    [EXCP_DBE] = "data bus error",
    [EXCP_DDBL] = "debug data break load",
    [EXCP_THREAD] = "thread",
    [EXCP_MDMX] = "MDMX",
    [EXCP_C2E] = "precise coprocessor 2",
    [EXCP_CACHE] = "cache error",
};

void do_interrupt (CPUState *env)
{
#if !defined(CONFIG_USER_ONLY)
    target_ulong offset;
    int cause = -1;
    const char *name;

    if (qemu_log_enabled() && env->exception_index != EXCP_EXT_INTERRUPT) {
        if (env->exception_index < 0 || env->exception_index > EXCP_LAST)
            name = "unknown";
        else
            name = excp_names[env->exception_index];

        qemu_log("%s enter: PC " TARGET_FMT_lx " EPC " TARGET_FMT_lx " %s exception\n",
                 __func__, env->active_tc.PC, env->CP0_EPC, name);
    }
    if (env->exception_index == EXCP_EXT_INTERRUPT &&
        (env->hflags & MIPS_HFLAG_DM))
        env->exception_index = EXCP_DINT;
    offset = 0x180;
    switch (env->exception_index) {
    case EXCP_DSS:
        env->CP0_Debug |= 1 << CP0DB_DSS;
        /* Debug single step cannot be raised inside a delay slot and
           resume will always occur on the next instruction
           (but we assume the pc has always been updated during
           code translation). */
        env->CP0_DEPC = env->active_tc.PC;
        goto enter_debug_mode;
    case EXCP_DINT:
        env->CP0_Debug |= 1 << CP0DB_DINT;
        goto set_DEPC;
    case EXCP_DIB:
        env->CP0_Debug |= 1 << CP0DB_DIB;
        goto set_DEPC;
    case EXCP_DBp:
        env->CP0_Debug |= 1 << CP0DB_DBp;
        goto set_DEPC;
    case EXCP_DDBS:
        env->CP0_Debug |= 1 << CP0DB_DDBS;
        goto set_DEPC;
    case EXCP_DDBL:
        env->CP0_Debug |= 1 << CP0DB_DDBL;
    set_DEPC:
        if (env->hflags & MIPS_HFLAG_BMASK) {
            /* If the exception was raised from a delay slot,
               come back to the jump.  */
            env->CP0_DEPC = env->active_tc.PC - 4;
            env->hflags &= ~MIPS_HFLAG_BMASK;
        } else {
            env->CP0_DEPC = env->active_tc.PC;
        }
 enter_debug_mode:
        env->hflags |= MIPS_HFLAG_DM | MIPS_HFLAG_64 | MIPS_HFLAG_CP0;
        env->hflags &= ~(MIPS_HFLAG_KSU);
        /* EJTAG probe trap enable is not implemented... */
        if (!(env->CP0_Status & (1 << CP0St_EXL)))
            env->CP0_Cause &= ~(1 << CP0Ca_BD);
        env->active_tc.PC = (int32_t)0xBFC00480;
        break;
    case EXCP_RESET:
        cpu_reset(env);
        break;
    case EXCP_SRESET:
        env->CP0_Status |= (1 << CP0St_SR);
        memset(env->CP0_WatchLo, 0, sizeof(*env->CP0_WatchLo));
        goto set_error_EPC;
    case EXCP_NMI:
        env->CP0_Status |= (1 << CP0St_NMI);
 set_error_EPC:
        if (env->hflags & MIPS_HFLAG_BMASK) {
            /* If the exception was raised from a delay slot,
               come back to the jump.  */
            env->CP0_ErrorEPC = env->active_tc.PC - 4;
            env->hflags &= ~MIPS_HFLAG_BMASK;
        } else {
            env->CP0_ErrorEPC = env->active_tc.PC;
        }
        env->CP0_Status |= (1 << CP0St_ERL) | (1 << CP0St_BEV);
        env->hflags |= MIPS_HFLAG_64 | MIPS_HFLAG_CP0;
        env->hflags &= ~(MIPS_HFLAG_KSU);
        if (!(env->CP0_Status & (1 << CP0St_EXL)))
            env->CP0_Cause &= ~(1 << CP0Ca_BD);
        env->active_tc.PC = (int32_t)0xBFC00000;
        break;
    case EXCP_EXT_INTERRUPT:
        cause = 0;
        if (env->CP0_Cause & (1 << CP0Ca_IV))
            offset = 0x200;
        goto set_EPC;
    case EXCP_LTLBL:
        cause = 1;
        goto set_EPC;
    case EXCP_TLBL:
        cause = 2;
        if (env->error_code == 1 && !(env->CP0_Status & (1 << CP0St_EXL))) {
#if defined(TARGET_MIPS64)
            int R = env->CP0_BadVAddr >> 62;
            int UX = (env->CP0_Status & (1 << CP0St_UX)) != 0;
            int SX = (env->CP0_Status & (1 << CP0St_SX)) != 0;
            int KX = (env->CP0_Status & (1 << CP0St_KX)) != 0;

            if ((R == 0 && UX) || (R == 1 && SX) || (R == 3 && KX))
                offset = 0x080;
            else
#endif
                offset = 0x000;
        }
        goto set_EPC;
    case EXCP_TLBS:
        cause = 3;
        if (env->error_code == 1 && !(env->CP0_Status & (1 << CP0St_EXL))) {
#if defined(TARGET_MIPS64)
            int R = env->CP0_BadVAddr >> 62;
            int UX = (env->CP0_Status & (1 << CP0St_UX)) != 0;
            int SX = (env->CP0_Status & (1 << CP0St_SX)) != 0;
            int KX = (env->CP0_Status & (1 << CP0St_KX)) != 0;

            if ((R == 0 && UX) || (R == 1 && SX) || (R == 3 && KX))
                offset = 0x080;
            else
#endif
                offset = 0x000;
        }
        goto set_EPC;
    case EXCP_AdEL:
        cause = 4;
        goto set_EPC;
    case EXCP_AdES:
        cause = 5;
        goto set_EPC;
    case EXCP_IBE:
        cause = 6;
        goto set_EPC;
    case EXCP_DBE:
        cause = 7;
        goto set_EPC;
    case EXCP_SYSCALL:
        cause = 8;
        goto set_EPC;
    case EXCP_BREAK:
        cause = 9;
        goto set_EPC;
    case EXCP_RI:
        cause = 10;
        goto set_EPC;
    case EXCP_CpU:
        cause = 11;
        env->CP0_Cause = (env->CP0_Cause & ~(0x3 << CP0Ca_CE)) |
                         (env->error_code << CP0Ca_CE);
        goto set_EPC;
    case EXCP_OVERFLOW:
        cause = 12;
        goto set_EPC;
    case EXCP_TRAP:
        cause = 13;
        goto set_EPC;
    case EXCP_FPE:
        cause = 15;
        goto set_EPC;
    case EXCP_C2E:
        cause = 18;
        goto set_EPC;
    case EXCP_MDMX:
        cause = 22;
        goto set_EPC;
    case EXCP_DWATCH:
        cause = 23;
        /* XXX: TODO: manage defered watch exceptions */
        goto set_EPC;
    case EXCP_MCHECK:
        cause = 24;
        goto set_EPC;
    case EXCP_THREAD:
        cause = 25;
        goto set_EPC;
    case EXCP_CACHE:
        cause = 30;
        if (env->CP0_Status & (1 << CP0St_BEV)) {
            offset = 0x100;
        } else {
            offset = 0x20000100;
        }
 set_EPC:
        if (!(env->CP0_Status & (1 << CP0St_EXL))) {
            if (env->hflags & MIPS_HFLAG_BMASK) {
                /* If the exception was raised from a delay slot,
                   come back to the jump.  */
                env->CP0_EPC = env->active_tc.PC - 4;
                env->CP0_Cause |= (1 << CP0Ca_BD);
            } else {
                env->CP0_EPC = env->active_tc.PC;
                env->CP0_Cause &= ~(1 << CP0Ca_BD);
            }
            env->CP0_Status |= (1 << CP0St_EXL);
            env->hflags |= MIPS_HFLAG_64 | MIPS_HFLAG_CP0;
            env->hflags &= ~(MIPS_HFLAG_KSU);
        }
        env->hflags &= ~MIPS_HFLAG_BMASK;
        if (env->CP0_Status & (1 << CP0St_BEV)) {
            env->active_tc.PC = (int32_t)0xBFC00200;
        } else {
            env->active_tc.PC = (int32_t)(env->CP0_EBase & ~0x3ff);
        }
        env->active_tc.PC += offset;
        env->CP0_Cause = (env->CP0_Cause & ~(0x1f << CP0Ca_EC)) | (cause << CP0Ca_EC);
        break;
    default:
        qemu_log("Invalid MIPS exception %d. Exiting\n", env->exception_index);
        printf("Invalid MIPS exception %d. Exiting\n", env->exception_index);
        exit(1);
    }
    if (qemu_log_enabled() && env->exception_index != EXCP_EXT_INTERRUPT) {
        qemu_log("%s: PC " TARGET_FMT_lx " EPC " TARGET_FMT_lx " cause %d\n"
                "    S %08x C %08x A " TARGET_FMT_lx " D " TARGET_FMT_lx "\n",
                __func__, env->active_tc.PC, env->CP0_EPC, cause,
                env->CP0_Status, env->CP0_Cause, env->CP0_BadVAddr,
                env->CP0_DEPC);
    }
#endif
    env->exception_index = EXCP_NONE;
}

void r4k_invalidate_tlb (CPUState *env, int idx, int use_extra)
{
    r4k_tlb_t *tlb;
    target_ulong addr;
    target_ulong end;
    uint8_t ASID = env->CP0_EntryHi & 0xFF;
    target_ulong mask;

    tlb = &env->tlb->mmu.r4k.tlb[idx];
    /* The qemu TLB is flushed when the ASID changes, so no need to
       flush these entries again.  */
    if (tlb->G == 0 && tlb->ASID != ASID) {
        return;
    }

    if (use_extra && env->tlb->tlb_in_use < MIPS_TLB_MAX) {
        /* For tlbwr, we can shadow the discarded entry into
           a new (fake) TLB entry, as long as the guest can not
           tell that it's there.  */
        env->tlb->mmu.r4k.tlb[env->tlb->tlb_in_use] = *tlb;
        env->tlb->tlb_in_use++;
        return;
    }

    /* 1k pages are not supported. */
    mask = tlb->PageMask | ~(TARGET_PAGE_MASK << 1);
    if (tlb->V0) {
        addr = tlb->VPN & ~mask;
#if defined(TARGET_MIPS64)
        if (addr >= (0xFFFFFFFF80000000ULL & env->SEGMask)) {
            addr |= 0x3FFFFF0000000000ULL;
        }
#endif
        end = addr | (mask >> 1);
        while (addr < end) {
            tlb_flush_page (env, addr);
            addr += TARGET_PAGE_SIZE;
        }
    }
    if (tlb->V1) {
        addr = (tlb->VPN & ~mask) | ((mask >> 1) + 1);
#if defined(TARGET_MIPS64)
        if (addr >= (0xFFFFFFFF80000000ULL & env->SEGMask)) {
            addr |= 0x3FFFFF0000000000ULL;
        }
#endif
        end = addr | mask;
        while (addr - 1 < end) {
            tlb_flush_page (env, addr);
            addr += TARGET_PAGE_SIZE;
        }
    }
}
Commit	Line	Data
6af0bf9c FB	1	/*
6af0bf9c FB	2	* MIPS emulation helpers for qemu.
5fafdf24	3	*
6af0bf9c FB	4	* Copyright (c) 2004-2005 Jocelyn Mayer
	5	*
	6	* This library is free software; you can redistribute it and/or
	7	* modify it under the terms of the GNU Lesser General Public
	8	* License as published by the Free Software Foundation; either
	9	* version 2 of the License, or (at your option) any later version.
	10	*
	11	* This library is distributed in the hope that it will be useful,
	12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	14	* Lesser General Public License for more details.
	15	*
	16	* You should have received a copy of the GNU Lesser General Public
8167ee88	17	* License along with this library; if not, see <http://www.gnu.org/licenses/>.
6af0bf9c	18	*/
e37e863f FB	19	#include <stdarg.h>
	20	#include <stdlib.h>
	21	#include <stdio.h>
	22	#include <string.h>
	23	#include <inttypes.h>
	24	#include <signal.h>
e37e863f FB	25
	26	#include "cpu.h"
	27	#include "exec-all.h"
6af0bf9c	28
43057ab1 FB	29	enum {
	30	TLBRET_DIRTY = -4,
	31	TLBRET_INVALID = -3,
	32	TLBRET_NOMATCH = -2,
	33	TLBRET_BADADDR = -1,
	34	TLBRET_MATCH = 0
	35	};
	36
29929e34 TS	37	/* no MMU emulation */
29929e34 TS	38	int no_mmu_map_address (CPUState env, target_ulong physical, int *prot,
6af0bf9c	39	target_ulong address, int rw, int access_type)
29929e34 TS	40	{
	41	*physical = address;
	42	*prot = PAGE_READ \| PAGE_WRITE;
	43	return TLBRET_MATCH;
	44	}
	45
	46	/* fixed mapping MMU emulation */
	47	int fixed_mmu_map_address (CPUState env, target_ulong physical, int *prot,
	48	target_ulong address, int rw, int access_type)
	49	{
	50	if (address <= (int32_t)0x7FFFFFFFUL) {
	51	if (!(env->CP0_Status & (1 << CP0St_ERL)))
	52	*physical = address + 0x40000000UL;
	53	else
	54	*physical = address;
	55	} else if (address <= (int32_t)0xBFFFFFFFUL)
	56	*physical = address & 0x1FFFFFFF;
	57	else
	58	*physical = address;
	59
	60	*prot = PAGE_READ \| PAGE_WRITE;
	61	return TLBRET_MATCH;
	62	}
	63
	64	/* MIPS32/MIPS64 R4000-style MMU emulation */
	65	int r4k_map_address (CPUState env, target_ulong physical, int *prot,
	66	target_ulong address, int rw, int access_type)
6af0bf9c	67	{
925fd0f2	68	uint8_t ASID = env->CP0_EntryHi & 0xFF;
3b1c8be4	69	int i;
6af0bf9c	70
ead9360e TS	71	for (i = 0; i < env->tlb->tlb_in_use; i++) {
ead9360e TS	72	r4k_tlb_t *tlb = &env->tlb->mmu.r4k.tlb[i];
3b1c8be4	73	/* 1k pages are not supported. */
f2e9ebef	74	target_ulong mask = tlb->PageMask \| ~(TARGET_PAGE_MASK << 1);
3b1c8be4	75	target_ulong tag = address & ~mask;
f2e9ebef	76	target_ulong VPN = tlb->VPN & ~mask;
d26bc211	77	#if defined(TARGET_MIPS64)
e034e2c3	78	tag &= env->SEGMask;
100ce988	79	#endif
3b1c8be4	80
6af0bf9c	81	/* Check ASID, virtual page number & size */
f2e9ebef	82	if ((tlb->G == 1 \|\| tlb->ASID == ASID) && VPN == tag) {
6af0bf9c	83	/* TLB match */
f2e9ebef	84	int n = !!(address & mask & ~(mask >> 1));
6af0bf9c	85	/* Check access rights */
f2e9ebef	86	if (!(n ? tlb->V1 : tlb->V0))
43057ab1	87	return TLBRET_INVALID;
f2e9ebef	88	if (rw == 0 \|\| (n ? tlb->D1 : tlb->D0)) {
3b1c8be4	89	*physical = tlb->PFN[n] \| (address & (mask >> 1));
9fb63ac2	90	*prot = PAGE_READ;
98c1b82b	91	if (n ? tlb->D1 : tlb->D0)
9fb63ac2	92	*prot \|= PAGE_WRITE;
43057ab1	93	return TLBRET_MATCH;
6af0bf9c	94	}
43057ab1	95	return TLBRET_DIRTY;
6af0bf9c FB	96	}
6af0bf9c FB	97	}
43057ab1	98	return TLBRET_NOMATCH;
6af0bf9c	99	}
6af0bf9c	100
932e71cd	101	#if !defined(CONFIG_USER_ONLY)
43057ab1 FB	102	static int get_physical_address (CPUState env, target_ulong physical,
	103	int *prot, target_ulong address,
	104	int rw, int access_type)
6af0bf9c	105	{
b4ab4b4e	106	/* User mode can only access useg/xuseg */
43057ab1	107	int user_mode = (env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_UM;
671880e6 TS	108	int supervisor_mode = (env->hflags & MIPS_HFLAG_MODE) == MIPS_HFLAG_SM;
671880e6 TS	109	int kernel_mode = !user_mode && !supervisor_mode;
d26bc211	110	#if defined(TARGET_MIPS64)
b4ab4b4e TS	111	int UX = (env->CP0_Status & (1 << CP0St_UX)) != 0;
	112	int SX = (env->CP0_Status & (1 << CP0St_SX)) != 0;
	113	int KX = (env->CP0_Status & (1 << CP0St_KX)) != 0;
	114	#endif
43057ab1 FB	115	int ret = TLBRET_MATCH;
43057ab1 FB	116
6af0bf9c	117	#if 0
93fcfe39	118	qemu_log("user mode %d h %08x\n", user_mode, env->hflags);
6af0bf9c	119	#endif
b4ab4b4e	120
b4ab4b4e TS	121	if (address <= (int32_t)0x7FFFFFFFUL) {
b4ab4b4e TS	122	/* useg */
996ba2cc	123	if (env->CP0_Status & (1 << CP0St_ERL)) {
29929e34	124	*physical = address & 0xFFFFFFFF;
6af0bf9c	125	*prot = PAGE_READ \| PAGE_WRITE;
996ba2cc	126	} else {
ead9360e	127	ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
6af0bf9c	128	}
d26bc211	129	#if defined(TARGET_MIPS64)
89fc88da	130	} else if (address < 0x4000000000000000ULL) {
b4ab4b4e	131	/* xuseg */
6958549d	132	if (UX && address <= (0x3FFFFFFFFFFFFFFFULL & env->SEGMask)) {
ead9360e	133	ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
6958549d AJ	134	} else {
6958549d AJ	135	ret = TLBRET_BADADDR;
b4ab4b4e	136	}
89fc88da	137	} else if (address < 0x8000000000000000ULL) {
b4ab4b4e	138	/* xsseg */
6958549d AJ	139	if ((supervisor_mode \|\| kernel_mode) &&
6958549d AJ	140	SX && address <= (0x7FFFFFFFFFFFFFFFULL & env->SEGMask)) {
ead9360e	141	ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
6958549d AJ	142	} else {
6958549d AJ	143	ret = TLBRET_BADADDR;
b4ab4b4e	144	}
89fc88da	145	} else if (address < 0xC000000000000000ULL) {
b4ab4b4e	146	/* xkphys */
671880e6	147	if (kernel_mode && KX &&
6d35524c TS	148	(address & 0x07FFFFFFFFFFFFFFULL) <= env->PAMask) {
6d35524c TS	149	*physical = address & env->PAMask;
b4ab4b4e	150	*prot = PAGE_READ \| PAGE_WRITE;
6958549d AJ	151	} else {
	152	ret = TLBRET_BADADDR;
	153	}
89fc88da	154	} else if (address < 0xFFFFFFFF80000000ULL) {
b4ab4b4e	155	/* xkseg */
6958549d AJ	156	if (kernel_mode && KX &&
6958549d AJ	157	address <= (0xFFFFFFFF7FFFFFFFULL & env->SEGMask)) {
ead9360e	158	ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
6958549d AJ	159	} else {
	160	ret = TLBRET_BADADDR;
	161	}
b4ab4b4e	162	#endif
5dc4b744	163	} else if (address < (int32_t)0xA0000000UL) {
6af0bf9c	164	/* kseg0 */
671880e6 TS	165	if (kernel_mode) {
	166	*physical = address - (int32_t)0x80000000UL;
	167	*prot = PAGE_READ \| PAGE_WRITE;
	168	} else {
	169	ret = TLBRET_BADADDR;
	170	}
5dc4b744	171	} else if (address < (int32_t)0xC0000000UL) {
6af0bf9c	172	/* kseg1 */
671880e6 TS	173	if (kernel_mode) {
	174	*physical = address - (int32_t)0xA0000000UL;
	175	*prot = PAGE_READ \| PAGE_WRITE;
	176	} else {
	177	ret = TLBRET_BADADDR;
	178	}
5dc4b744	179	} else if (address < (int32_t)0xE0000000UL) {
89fc88da	180	/* sseg (kseg2) */
671880e6 TS	181	if (supervisor_mode \|\| kernel_mode) {
	182	ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
	183	} else {
	184	ret = TLBRET_BADADDR;
	185	}
6af0bf9c FB	186	} else {
6af0bf9c FB	187	/* kseg3 */
6af0bf9c	188	/* XXX: debug segment is not emulated */
671880e6 TS	189	if (kernel_mode) {
	190	ret = env->tlb->map_address(env, physical, prot, address, rw, access_type);
	191	} else {
	192	ret = TLBRET_BADADDR;
	193	}
6af0bf9c FB	194	}
6af0bf9c FB	195	#if 0
93fcfe39 AL	196	qemu_log(TARGET_FMT_lx " %d %d => " TARGET_FMT_lx " %d (%d)\n",
93fcfe39 AL	197	address, rw, access_type, physical, prot, ret);
6af0bf9c FB	198	}
	199	#endif
	200
	201	return ret;
	202	}
932e71cd	203	#endif
6af0bf9c	204
9b3c35e0	205	target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
6af0bf9c	206	{
932e71cd AJ	207	#if defined(CONFIG_USER_ONLY)
	208	return addr;
	209	#else
	210	target_ulong phys_addr;
	211	int prot;
6af0bf9c	212
932e71cd AJ	213	if (get_physical_address(env, &phys_addr, &prot, addr, 0, ACCESS_INT) != 0)
	214	return -1;
	215	return phys_addr;
	216	#endif
6af0bf9c	217	}
6af0bf9c	218
6af0bf9c	219	int cpu_mips_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
6ebbf390	220	int mmu_idx, int is_softmmu)
6af0bf9c	221	{
932e71cd	222	#if !defined(CONFIG_USER_ONLY)
6af0bf9c FB	223	target_ulong physical;
6af0bf9c FB	224	int prot;
932e71cd	225	#endif
6af0bf9c FB	226	int exception = 0, error_code = 0;
	227	int access_type;
	228	int ret = 0;
	229
4ad40f36	230	#if 0
93fcfe39	231	log_cpu_state(env, 0);
4ad40f36	232	#endif
93fcfe39 AL	233	qemu_log("%s pc " TARGET_FMT_lx " ad " TARGET_FMT_lx " rw %d mmu_idx %d smmu %d\n",
93fcfe39 AL	234	__func__, env->active_tc.PC, address, rw, mmu_idx, is_softmmu);
4ad40f36 FB	235
	236	rw &= 1;
	237
6af0bf9c FB	238	/* data access */
	239	/* XXX: put correct access by using cpu_restore_state()
	240	correctly */
	241	access_type = ACCESS_INT;
932e71cd AJ	242	#if defined(CONFIG_USER_ONLY)
	243	ret = TLBRET_NOMATCH;
	244	#else
6af0bf9c FB	245	ret = get_physical_address(env, &physical, &prot,
6af0bf9c FB	246	address, rw, access_type);
93fcfe39 AL	247	qemu_log("%s address=" TARGET_FMT_lx " ret %d physical " TARGET_FMT_lx " prot %d\n",
93fcfe39 AL	248	__func__, address, ret, physical, prot);
43057ab1 FB	249	if (ret == TLBRET_MATCH) {
	250	ret = tlb_set_page(env, address & TARGET_PAGE_MASK,
	251	physical & TARGET_PAGE_MASK, prot,
6ebbf390	252	mmu_idx, is_softmmu);
932e71cd AJ	253	} else if (ret < 0)
	254	#endif
	255	{
6af0bf9c FB	256	switch (ret) {
6af0bf9c FB	257	default:
43057ab1	258	case TLBRET_BADADDR:
6af0bf9c FB	259	/* Reference to kernel address from user mode or supervisor mode */
	260	/* Reference to supervisor address from user mode */
	261	if (rw)
	262	exception = EXCP_AdES;
	263	else
	264	exception = EXCP_AdEL;
	265	break;
43057ab1	266	case TLBRET_NOMATCH:
6af0bf9c FB	267	/* No TLB match for a mapped address */
	268	if (rw)
	269	exception = EXCP_TLBS;
	270	else
	271	exception = EXCP_TLBL;
	272	error_code = 1;
	273	break;
43057ab1	274	case TLBRET_INVALID:
6af0bf9c FB	275	/* TLB match with no valid bit */
	276	if (rw)
	277	exception = EXCP_TLBS;
	278	else
	279	exception = EXCP_TLBL;
6af0bf9c	280	break;
43057ab1	281	case TLBRET_DIRTY:
6af0bf9c FB	282	/* TLB match but 'D' bit is cleared */
	283	exception = EXCP_LTLBL;
	284	break;
3b46e624	285
6af0bf9c	286	}
6af0bf9c FB	287	/* Raise exception */
6af0bf9c FB	288	env->CP0_BadVAddr = address;
100ce988	289	env->CP0_Context = (env->CP0_Context & ~0x007fffff) \|
6958549d	290	((address >> 9) & 0x007ffff0);
6af0bf9c	291	env->CP0_EntryHi =
43057ab1	292	(env->CP0_EntryHi & 0xFF) \| (address & (TARGET_PAGE_MASK << 1));
d26bc211	293	#if defined(TARGET_MIPS64)
e034e2c3 TS	294	env->CP0_EntryHi &= env->SEGMask;
e034e2c3 TS	295	env->CP0_XContext = (env->CP0_XContext & ((~0ULL) << (env->SEGBITS - 7))) \|
9c67ef0c	296	((address & 0xC00000000000ULL) >> (55 - env->SEGBITS)) \|
e034e2c3	297	((address & ((1ULL << env->SEGBITS) - 1) & 0xFFFFFFFFFFFFE000ULL) >> 9);
100ce988	298	#endif
6af0bf9c FB	299	env->exception_index = exception;
	300	env->error_code = error_code;
	301	ret = 1;
	302	}
	303
	304	return ret;
	305	}
	306
9a5d878f TS	307	static const char * const excp_names[EXCP_LAST + 1] = {
	308	[EXCP_RESET] = "reset",
	309	[EXCP_SRESET] = "soft reset",
	310	[EXCP_DSS] = "debug single step",
	311	[EXCP_DINT] = "debug interrupt",
	312	[EXCP_NMI] = "non-maskable interrupt",
	313	[EXCP_MCHECK] = "machine check",
	314	[EXCP_EXT_INTERRUPT] = "interrupt",
	315	[EXCP_DFWATCH] = "deferred watchpoint",
	316	[EXCP_DIB] = "debug instruction breakpoint",
	317	[EXCP_IWATCH] = "instruction fetch watchpoint",
	318	[EXCP_AdEL] = "address error load",
	319	[EXCP_AdES] = "address error store",
	320	[EXCP_TLBF] = "TLB refill",
	321	[EXCP_IBE] = "instruction bus error",
	322	[EXCP_DBp] = "debug breakpoint",
	323	[EXCP_SYSCALL] = "syscall",
	324	[EXCP_BREAK] = "break",
	325	[EXCP_CpU] = "coprocessor unusable",
	326	[EXCP_RI] = "reserved instruction",
	327	[EXCP_OVERFLOW] = "arithmetic overflow",
	328	[EXCP_TRAP] = "trap",
	329	[EXCP_FPE] = "floating point",
	330	[EXCP_DDBS] = "debug data break store",
	331	[EXCP_DWATCH] = "data watchpoint",
	332	[EXCP_LTLBL] = "TLB modify",
	333	[EXCP_TLBL] = "TLB load",
	334	[EXCP_TLBS] = "TLB store",
	335	[EXCP_DBE] = "data bus error",
	336	[EXCP_DDBL] = "debug data break load",
	337	[EXCP_THREAD] = "thread",
	338	[EXCP_MDMX] = "MDMX",
	339	[EXCP_C2E] = "precise coprocessor 2",
	340	[EXCP_CACHE] = "cache error",
14e51cc7	341	};
14e51cc7	342
6af0bf9c FB	343	void do_interrupt (CPUState *env)
6af0bf9c FB	344	{
932e71cd AJ	345	#if !defined(CONFIG_USER_ONLY)
	346	target_ulong offset;
	347	int cause = -1;
	348	const char *name;
100ce988	349
93fcfe39	350	if (qemu_log_enabled() && env->exception_index != EXCP_EXT_INTERRUPT) {
932e71cd AJ	351	if (env->exception_index < 0 \|\| env->exception_index > EXCP_LAST)
	352	name = "unknown";
	353	else
	354	name = excp_names[env->exception_index];
b67bfe8d	355
93fcfe39 AL	356	qemu_log("%s enter: PC " TARGET_FMT_lx " EPC " TARGET_FMT_lx " %s exception\n",
93fcfe39 AL	357	__func__, env->active_tc.PC, env->CP0_EPC, name);
932e71cd AJ	358	}
	359	if (env->exception_index == EXCP_EXT_INTERRUPT &&
	360	(env->hflags & MIPS_HFLAG_DM))
	361	env->exception_index = EXCP_DINT;
	362	offset = 0x180;
	363	switch (env->exception_index) {
	364	case EXCP_DSS:
	365	env->CP0_Debug \|= 1 << CP0DB_DSS;
	366	/* Debug single step cannot be raised inside a delay slot and
	367	resume will always occur on the next instruction
	368	(but we assume the pc has always been updated during
	369	code translation). */
	370	env->CP0_DEPC = env->active_tc.PC;
	371	goto enter_debug_mode;
	372	case EXCP_DINT:
	373	env->CP0_Debug \|= 1 << CP0DB_DINT;
	374	goto set_DEPC;
	375	case EXCP_DIB:
	376	env->CP0_Debug \|= 1 << CP0DB_DIB;
	377	goto set_DEPC;
	378	case EXCP_DBp:
	379	env->CP0_Debug \|= 1 << CP0DB_DBp;
	380	goto set_DEPC;
	381	case EXCP_DDBS:
	382	env->CP0_Debug \|= 1 << CP0DB_DDBS;
	383	goto set_DEPC;
	384	case EXCP_DDBL:
	385	env->CP0_Debug \|= 1 << CP0DB_DDBL;
	386	set_DEPC:
	387	if (env->hflags & MIPS_HFLAG_BMASK) {
	388	/* If the exception was raised from a delay slot,
	389	come back to the jump. */
	390	env->CP0_DEPC = env->active_tc.PC - 4;
	391	env->hflags &= ~MIPS_HFLAG_BMASK;
	392	} else {
0eaef5aa	393	env->CP0_DEPC = env->active_tc.PC;
932e71cd	394	}
0eaef5aa	395	enter_debug_mode:
932e71cd AJ	396	env->hflags \|= MIPS_HFLAG_DM \| MIPS_HFLAG_64 \| MIPS_HFLAG_CP0;
	397	env->hflags &= ~(MIPS_HFLAG_KSU);
	398	/* EJTAG probe trap enable is not implemented... */
	399	if (!(env->CP0_Status & (1 << CP0St_EXL)))
	400	env->CP0_Cause &= ~(1 << CP0Ca_BD);
	401	env->active_tc.PC = (int32_t)0xBFC00480;
	402	break;
	403	case EXCP_RESET:
	404	cpu_reset(env);
	405	break;
	406	case EXCP_SRESET:
	407	env->CP0_Status \|= (1 << CP0St_SR);
	408	memset(env->CP0_WatchLo, 0, sizeof(*env->CP0_WatchLo));
	409	goto set_error_EPC;
	410	case EXCP_NMI:
	411	env->CP0_Status \|= (1 << CP0St_NMI);
0eaef5aa	412	set_error_EPC:
932e71cd AJ	413	if (env->hflags & MIPS_HFLAG_BMASK) {
	414	/* If the exception was raised from a delay slot,
	415	come back to the jump. */
	416	env->CP0_ErrorEPC = env->active_tc.PC - 4;
	417	env->hflags &= ~MIPS_HFLAG_BMASK;
	418	} else {
	419	env->CP0_ErrorEPC = env->active_tc.PC;
	420	}
	421	env->CP0_Status \|= (1 << CP0St_ERL) \| (1 << CP0St_BEV);
	422	env->hflags \|= MIPS_HFLAG_64 \| MIPS_HFLAG_CP0;
	423	env->hflags &= ~(MIPS_HFLAG_KSU);
	424	if (!(env->CP0_Status & (1 << CP0St_EXL)))
	425	env->CP0_Cause &= ~(1 << CP0Ca_BD);
	426	env->active_tc.PC = (int32_t)0xBFC00000;
	427	break;
	428	case EXCP_EXT_INTERRUPT:
	429	cause = 0;
	430	if (env->CP0_Cause & (1 << CP0Ca_IV))
	431	offset = 0x200;
	432	goto set_EPC;
	433	case EXCP_LTLBL:
	434	cause = 1;
	435	goto set_EPC;
	436	case EXCP_TLBL:
	437	cause = 2;
	438	if (env->error_code == 1 && !(env->CP0_Status & (1 << CP0St_EXL))) {
0eaef5aa	439	#if defined(TARGET_MIPS64)
932e71cd AJ	440	int R = env->CP0_BadVAddr >> 62;
	441	int UX = (env->CP0_Status & (1 << CP0St_UX)) != 0;
	442	int SX = (env->CP0_Status & (1 << CP0St_SX)) != 0;
	443	int KX = (env->CP0_Status & (1 << CP0St_KX)) != 0;
0eaef5aa	444
932e71cd AJ	445	if ((R == 0 && UX) \|\| (R == 1 && SX) \|\| (R == 3 && KX))
	446	offset = 0x080;
	447	else
0eaef5aa	448	#endif
932e71cd AJ	449	offset = 0x000;
	450	}
	451	goto set_EPC;
	452	case EXCP_TLBS:
	453	cause = 3;
	454	if (env->error_code == 1 && !(env->CP0_Status & (1 << CP0St_EXL))) {
0eaef5aa	455	#if defined(TARGET_MIPS64)
932e71cd AJ	456	int R = env->CP0_BadVAddr >> 62;
	457	int UX = (env->CP0_Status & (1 << CP0St_UX)) != 0;
	458	int SX = (env->CP0_Status & (1 << CP0St_SX)) != 0;
	459	int KX = (env->CP0_Status & (1 << CP0St_KX)) != 0;
0eaef5aa	460
932e71cd AJ	461	if ((R == 0 && UX) \|\| (R == 1 && SX) \|\| (R == 3 && KX))
	462	offset = 0x080;
	463	else
0eaef5aa	464	#endif
932e71cd AJ	465	offset = 0x000;
	466	}
	467	goto set_EPC;
	468	case EXCP_AdEL:
	469	cause = 4;
	470	goto set_EPC;
	471	case EXCP_AdES:
	472	cause = 5;
	473	goto set_EPC;
	474	case EXCP_IBE:
	475	cause = 6;
	476	goto set_EPC;
	477	case EXCP_DBE:
	478	cause = 7;
	479	goto set_EPC;
	480	case EXCP_SYSCALL:
	481	cause = 8;
	482	goto set_EPC;
	483	case EXCP_BREAK:
	484	cause = 9;
	485	goto set_EPC;
	486	case EXCP_RI:
	487	cause = 10;
	488	goto set_EPC;
	489	case EXCP_CpU:
	490	cause = 11;
	491	env->CP0_Cause = (env->CP0_Cause & ~(0x3 << CP0Ca_CE)) \|
	492	(env->error_code << CP0Ca_CE);
	493	goto set_EPC;
	494	case EXCP_OVERFLOW:
	495	cause = 12;
	496	goto set_EPC;
	497	case EXCP_TRAP:
	498	cause = 13;
	499	goto set_EPC;
	500	case EXCP_FPE:
	501	cause = 15;
	502	goto set_EPC;
	503	case EXCP_C2E:
	504	cause = 18;
	505	goto set_EPC;
	506	case EXCP_MDMX:
	507	cause = 22;
	508	goto set_EPC;
	509	case EXCP_DWATCH:
	510	cause = 23;
	511	/* XXX: TODO: manage defered watch exceptions */
	512	goto set_EPC;
	513	case EXCP_MCHECK:
	514	cause = 24;
	515	goto set_EPC;
	516	case EXCP_THREAD:
	517	cause = 25;
	518	goto set_EPC;
	519	case EXCP_CACHE:
	520	cause = 30;
	521	if (env->CP0_Status & (1 << CP0St_BEV)) {
	522	offset = 0x100;
	523	} else {
	524	offset = 0x20000100;
	525	}
0eaef5aa	526	set_EPC:
932e71cd AJ	527	if (!(env->CP0_Status & (1 << CP0St_EXL))) {
	528	if (env->hflags & MIPS_HFLAG_BMASK) {
	529	/* If the exception was raised from a delay slot,
	530	come back to the jump. */
	531	env->CP0_EPC = env->active_tc.PC - 4;
	532	env->CP0_Cause \|= (1 << CP0Ca_BD);
0eaef5aa	533	} else {
932e71cd AJ	534	env->CP0_EPC = env->active_tc.PC;
932e71cd AJ	535	env->CP0_Cause &= ~(1 << CP0Ca_BD);
0eaef5aa	536	}
932e71cd AJ	537	env->CP0_Status \|= (1 << CP0St_EXL);
	538	env->hflags \|= MIPS_HFLAG_64 \| MIPS_HFLAG_CP0;
	539	env->hflags &= ~(MIPS_HFLAG_KSU);
6af0bf9c	540	}
932e71cd AJ	541	env->hflags &= ~MIPS_HFLAG_BMASK;
	542	if (env->CP0_Status & (1 << CP0St_BEV)) {
	543	env->active_tc.PC = (int32_t)0xBFC00200;
	544	} else {
	545	env->active_tc.PC = (int32_t)(env->CP0_EBase & ~0x3ff);
6af0bf9c	546	}
932e71cd AJ	547	env->active_tc.PC += offset;
	548	env->CP0_Cause = (env->CP0_Cause & ~(0x1f << CP0Ca_EC)) \| (cause << CP0Ca_EC);
	549	break;
	550	default:
93fcfe39	551	qemu_log("Invalid MIPS exception %d. Exiting\n", env->exception_index);
932e71cd AJ	552	printf("Invalid MIPS exception %d. Exiting\n", env->exception_index);
	553	exit(1);
	554	}
93fcfe39 AL	555	if (qemu_log_enabled() && env->exception_index != EXCP_EXT_INTERRUPT) {
93fcfe39 AL	556	qemu_log("%s: PC " TARGET_FMT_lx " EPC " TARGET_FMT_lx " cause %d\n"
932e71cd AJ	557	" S %08x C %08x A " TARGET_FMT_lx " D " TARGET_FMT_lx "\n",
	558	__func__, env->active_tc.PC, env->CP0_EPC, cause,
	559	env->CP0_Status, env->CP0_Cause, env->CP0_BadVAddr,
	560	env->CP0_DEPC);
6af0bf9c	561	}
932e71cd	562	#endif
6af0bf9c FB	563	env->exception_index = EXCP_NONE;
6af0bf9c FB	564	}
2ee4aed8	565
29929e34	566	void r4k_invalidate_tlb (CPUState *env, int idx, int use_extra)
2ee4aed8	567	{
29929e34	568	r4k_tlb_t *tlb;
3b1c8be4 TS	569	target_ulong addr;
	570	target_ulong end;
	571	uint8_t ASID = env->CP0_EntryHi & 0xFF;
	572	target_ulong mask;
2ee4aed8	573
ead9360e	574	tlb = &env->tlb->mmu.r4k.tlb[idx];
f2e9ebef	575	/* The qemu TLB is flushed when the ASID changes, so no need to
2ee4aed8 FB	576	flush these entries again. */
	577	if (tlb->G == 0 && tlb->ASID != ASID) {
	578	return;
	579	}
	580
ead9360e	581	if (use_extra && env->tlb->tlb_in_use < MIPS_TLB_MAX) {
2ee4aed8	582	/* For tlbwr, we can shadow the discarded entry into
6958549d AJ	583	a new (fake) TLB entry, as long as the guest can not
6958549d AJ	584	tell that it's there. */
ead9360e TS	585	env->tlb->mmu.r4k.tlb[env->tlb->tlb_in_use] = *tlb;
ead9360e TS	586	env->tlb->tlb_in_use++;
2ee4aed8 FB	587	return;
	588	}
	589
3b1c8be4	590	/* 1k pages are not supported. */
f2e9ebef	591	mask = tlb->PageMask \| ~(TARGET_PAGE_MASK << 1);
3b1c8be4	592	if (tlb->V0) {
f2e9ebef	593	addr = tlb->VPN & ~mask;
d26bc211	594	#if defined(TARGET_MIPS64)
e034e2c3	595	if (addr >= (0xFFFFFFFF80000000ULL & env->SEGMask)) {
100ce988 TS	596	addr \|= 0x3FFFFF0000000000ULL;
	597	}
	598	#endif
3b1c8be4 TS	599	end = addr \| (mask >> 1);
	600	while (addr < end) {
	601	tlb_flush_page (env, addr);
	602	addr += TARGET_PAGE_SIZE;
	603	}
	604	}
	605	if (tlb->V1) {
f2e9ebef	606	addr = (tlb->VPN & ~mask) \| ((mask >> 1) + 1);
d26bc211	607	#if defined(TARGET_MIPS64)
e034e2c3	608	if (addr >= (0xFFFFFFFF80000000ULL & env->SEGMask)) {
100ce988 TS	609	addr \|= 0x3FFFFF0000000000ULL;
	610	}
	611	#endif
3b1c8be4	612	end = addr \| mask;
53715e48	613	while (addr - 1 < end) {
3b1c8be4 TS	614	tlb_flush_page (env, addr);
	615	addr += TARGET_PAGE_SIZE;
	616	}
	617	}
2ee4aed8	618	}