]> git.proxmox.com Git - qemu.git/blame - target-ppc/mmu_helper.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
target-ppc: Introduce unrealizefn for PowerPCCPU
[qemu.git] / target-ppc / mmu_helper.c
CommitLineData
ec19c4d1
BS		 1/*
2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
3 *
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19#include "cpu.h"
ec19c4d1 20#include "helper.h"
9c17d615 21#include "sysemu/kvm.h"
8cbbe385 22#include "kvm_ppc.h"
10b46525 23#include "mmu-hash64.h"
9d7c3f4a 24#include "mmu-hash32.h"
ec19c4d1 25
8cbbe385
BS		 26//#define DEBUG_MMU
27//#define DEBUG_BATS
ec19c4d1 28//#define DEBUG_SOFTWARE_TLB
8cbbe385
BS		 29//#define DUMP_PAGE_TABLES
30//#define DEBUG_SOFTWARE_TLB
31//#define FLUSH_ALL_TLBS
32
33#ifdef DEBUG_MMU
34# define LOG_MMU(...) qemu_log(__VA_ARGS__)
35# define LOG_MMU_STATE(env) log_cpu_state((env), 0)
36#else
37# define LOG_MMU(...) do { } while (0)
38# define LOG_MMU_STATE(...) do { } while (0)
39#endif
ec19c4d1
BS		 40
41#ifdef DEBUG_SOFTWARE_TLB
42# define LOG_SWTLB(...) qemu_log(__VA_ARGS__)
43#else
44# define LOG_SWTLB(...) do { } while (0)
45#endif
46
8cbbe385
BS		 47#ifdef DEBUG_BATS
48# define LOG_BATS(...) qemu_log(__VA_ARGS__)
49#else
50# define LOG_BATS(...) do { } while (0)
51#endif
52
8cbbe385
BS		 53/*****************************************************************************/
54/* PowerPC MMU emulation */
5dc68eb0
DG		 55
56/* Context used internally during MMU translations */
57typedef struct mmu_ctx_t mmu_ctx_t;
58struct mmu_ctx_t {
59 hwaddr raddr; /* Real address */
60 hwaddr eaddr; /* Effective address */
61 int prot; /* Protection bits */
62 hwaddr hash[2]; /* Pagetable hash values */
63 target_ulong ptem; /* Virtual segment ID | API */
64 int key; /* Access key */
65 int nx; /* Non-execute area */
66};
67
8cbbe385
BS		 68/* Common routines used by software and hardware TLBs emulation */
69static inline int pte_is_valid(target_ulong pte0)
70{
71 return pte0 & 0x80000000 ? 1 : 0;
72}
73
74static inline void pte_invalidate(target_ulong *pte0)
75{
76 *pte0 &= ~0x80000000;
77}
78
8cbbe385
BS		 79#define PTE_PTEM_MASK 0x7FFFFFBF
80#define PTE_CHECK_MASK (TARGET_PAGE_MASK | 0x7B)
8cbbe385 81
496272a7 82static int pp_check(int key, int pp, int nx)
8cbbe385
BS		 83{
84 int access;
85
86 /* Compute access rights */
8cbbe385
BS		 87 access = 0;
88 if (key == 0) {
89 switch (pp) {
90 case 0x0:
91 case 0x1:
92 case 0x2:
93 access |= PAGE_WRITE;
94 /* No break here */
95 case 0x3:
8cbbe385
BS		 96 access |= PAGE_READ;
97 break;
98 }
99 } else {
100 switch (pp) {
101 case 0x0:
8cbbe385
BS		 102 access = 0;
103 break;
104 case 0x1:
105 case 0x3:
106 access = PAGE_READ;
107 break;
108 case 0x2:
109 access = PAGE_READ | PAGE_WRITE;
110 break;
111 }
112 }
113 if (nx == 0) {
114 access |= PAGE_EXEC;
115 }
116
117 return access;
118}
119
496272a7 120static int check_prot(int prot, int rw, int access_type)
8cbbe385
BS		 121{
122 int ret;
123
124 if (access_type == ACCESS_CODE) {
125 if (prot & PAGE_EXEC) {
126 ret = 0;
127 } else {
128 ret = -2;
129 }
130 } else if (rw) {
131 if (prot & PAGE_WRITE) {
132 ret = 0;
133 } else {
134 ret = -2;
135 }
136 } else {
137 if (prot & PAGE_READ) {
138 ret = 0;
139 } else {
140 ret = -2;
141 }
142 }
143
144 return ret;
145}
146
9d7c3f4a
DG		 147static inline int ppc6xx_tlb_pte_check(mmu_ctx_t *ctx, target_ulong pte0,
148 target_ulong pte1, int h, int rw, int type)
8cbbe385
BS		 149{
150 target_ulong ptem, mmask;
151 int access, ret, pteh, ptev, pp;
152
153 ret = -1;
154 /* Check validity and table match */
9d7c3f4a
DG		 155 ptev = pte_is_valid(pte0);
156 pteh = (pte0 >> 6) & 1;
8cbbe385
BS		 157 if (ptev && h == pteh) {
158 /* Check vsid & api */
9d7c3f4a
DG		 159 ptem = pte0 & PTE_PTEM_MASK;
160 mmask = PTE_CHECK_MASK;
161 pp = pte1 & 0x00000003;
8cbbe385 162 if (ptem == ctx->ptem) {
a8170e5e 163 if (ctx->raddr != (hwaddr)-1ULL) {
8cbbe385
BS		 164 /* all matches should have equal RPN, WIMG & PP */
165 if ((ctx->raddr & mmask) != (pte1 & mmask)) {
166 qemu_log("Bad RPN/WIMG/PP\n");
167 return -3;
168 }
169 }
170 /* Compute access rights */
171 access = pp_check(ctx->key, pp, ctx->nx);
172 /* Keep the matching PTE informations */
173 ctx->raddr = pte1;
174 ctx->prot = access;
175 ret = check_prot(ctx->prot, rw, type);
176 if (ret == 0) {
177 /* Access granted */
178 LOG_MMU("PTE access granted !\n");
179 } else {
180 /* Access right violation */
181 LOG_MMU("PTE access rejected\n");
182 }
183 }
184 }
185
186 return ret;
187}
188
496272a7
DG		 189static int pte_update_flags(mmu_ctx_t *ctx, target_ulong *pte1p,
190 int ret, int rw)
8cbbe385
BS		 191{
192 int store = 0;
193
194 /* Update page flags */
195 if (!(*pte1p & 0x00000100)) {
196 /* Update accessed flag */
197 *pte1p |= 0x00000100;
198 store = 1;
199 }
200 if (!(*pte1p & 0x00000080)) {
201 if (rw == 1 && ret == 0) {
202 /* Update changed flag */
203 *pte1p |= 0x00000080;
204 store = 1;
205 } else {
206 /* Force page fault for first write access */
207 ctx->prot &= ~PAGE_WRITE;
208 }
209 }
210
211 return store;
212}
213
214/* Software driven TLB helpers */
215static inline int ppc6xx_tlb_getnum(CPUPPCState *env, target_ulong eaddr,
216 int way, int is_code)
217{
218 int nr;
219
220 /* Select TLB num in a way from address */
221 nr = (eaddr >> TARGET_PAGE_BITS) & (env->tlb_per_way - 1);
222 /* Select TLB way */
223 nr += env->tlb_per_way * way;
224 /* 6xx have separate TLBs for instructions and data */
225 if (is_code && env->id_tlbs == 1) {
226 nr += env->nb_tlb;
227 }
228
229 return nr;
230}
231
232static inline void ppc6xx_tlb_invalidate_all(CPUPPCState *env)
233{
234 ppc6xx_tlb_t *tlb;
235 int nr, max;
236
237 /* LOG_SWTLB("Invalidate all TLBs\n"); */
238 /* Invalidate all defined software TLB */
239 max = env->nb_tlb;
240 if (env->id_tlbs == 1) {
241 max *= 2;
242 }
243 for (nr = 0; nr < max; nr++) {
244 tlb = &env->tlb.tlb6[nr];
245 pte_invalidate(&tlb->pte0);
246 }
247 tlb_flush(env, 1);
248}
249
250static inline void ppc6xx_tlb_invalidate_virt2(CPUPPCState *env,
251 target_ulong eaddr,
252 int is_code, int match_epn)
253{
254#if !defined(FLUSH_ALL_TLBS)
255 ppc6xx_tlb_t *tlb;
256 int way, nr;
257
258 /* Invalidate ITLB + DTLB, all ways */
259 for (way = 0; way < env->nb_ways; way++) {
260 nr = ppc6xx_tlb_getnum(env, eaddr, way, is_code);
261 tlb = &env->tlb.tlb6[nr];
262 if (pte_is_valid(tlb->pte0) && (match_epn == 0 || eaddr == tlb->EPN)) {
263 LOG_SWTLB("TLB invalidate %d/%d " TARGET_FMT_lx "\n", nr,
264 env->nb_tlb, eaddr);
265 pte_invalidate(&tlb->pte0);
266 tlb_flush_page(env, tlb->EPN);
267 }
268 }
269#else
270 /* XXX: PowerPC specification say this is valid as well */
271 ppc6xx_tlb_invalidate_all(env);
272#endif
273}
274
275static inline void ppc6xx_tlb_invalidate_virt(CPUPPCState *env,
276 target_ulong eaddr, int is_code)
277{
278 ppc6xx_tlb_invalidate_virt2(env, eaddr, is_code, 0);
279}
280
9aa5b158
BS		 281static void ppc6xx_tlb_store(CPUPPCState *env, target_ulong EPN, int way,
282 int is_code, target_ulong pte0, target_ulong pte1)
8cbbe385
BS		 283{
284 ppc6xx_tlb_t *tlb;
285 int nr;
286
287 nr = ppc6xx_tlb_getnum(env, EPN, way, is_code);
288 tlb = &env->tlb.tlb6[nr];
289 LOG_SWTLB("Set TLB %d/%d EPN " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
290 " PTE1 " TARGET_FMT_lx "\n", nr, env->nb_tlb, EPN, pte0, pte1);
291 /* Invalidate any pending reference in QEMU for this virtual address */
292 ppc6xx_tlb_invalidate_virt2(env, EPN, is_code, 1);
293 tlb->pte0 = pte0;
294 tlb->pte1 = pte1;
295 tlb->EPN = EPN;
296 /* Store last way for LRU mechanism */
297 env->last_way = way;
298}
299
300static inline int ppc6xx_tlb_check(CPUPPCState *env, mmu_ctx_t *ctx,
301 target_ulong eaddr, int rw, int access_type)
302{
303 ppc6xx_tlb_t *tlb;
304 int nr, best, way;
305 int ret;
306
307 best = -1;
308 ret = -1; /* No TLB found */
309 for (way = 0; way < env->nb_ways; way++) {
310 nr = ppc6xx_tlb_getnum(env, eaddr, way,
311 access_type == ACCESS_CODE ? 1 : 0);
312 tlb = &env->tlb.tlb6[nr];
313 /* This test "emulates" the PTE index match for hardware TLBs */
314 if ((eaddr & TARGET_PAGE_MASK) != tlb->EPN) {
315 LOG_SWTLB("TLB %d/%d %s [" TARGET_FMT_lx " " TARGET_FMT_lx
316 "] <> " TARGET_FMT_lx "\n", nr, env->nb_tlb,
317 pte_is_valid(tlb->pte0) ? "valid" : "inval",
318 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE, eaddr);
319 continue;
320 }
321 LOG_SWTLB("TLB %d/%d %s " TARGET_FMT_lx " <> " TARGET_FMT_lx " "
322 TARGET_FMT_lx " %c %c\n", nr, env->nb_tlb,
323 pte_is_valid(tlb->pte0) ? "valid" : "inval",
324 tlb->EPN, eaddr, tlb->pte1,
325 rw ? 'S' : 'L', access_type == ACCESS_CODE ? 'I' : 'D');
9d7c3f4a 326 switch (ppc6xx_tlb_pte_check(ctx, tlb->pte0, tlb->pte1, 0, rw, access_type)) {
8cbbe385
BS		 327 case -3:
328 /* TLB inconsistency */
329 return -1;
330 case -2:
331 /* Access violation */
332 ret = -2;
333 best = nr;
334 break;
335 case -1:
336 default:
337 /* No match */
338 break;
339 case 0:
340 /* access granted */
341 /* XXX: we should go on looping to check all TLBs consistency
342 * but we can speed-up the whole thing as the
343 * result would be undefined if TLBs are not consistent.
344 */
345 ret = 0;
346 best = nr;
347 goto done;
348 }
349 }
350 if (best != -1) {
351 done:
352 LOG_SWTLB("found TLB at addr " TARGET_FMT_plx " prot=%01x ret=%d\n",
353 ctx->raddr & TARGET_PAGE_MASK, ctx->prot, ret);
354 /* Update page flags */
355 pte_update_flags(ctx, &env->tlb.tlb6[best].pte1, ret, rw);
356 }
357
358 return ret;
359}
360
361/* Perform BAT hit & translation */
362static inline void bat_size_prot(CPUPPCState *env, target_ulong *blp,
363 int *validp, int *protp, target_ulong *BATu,
364 target_ulong *BATl)
365{
366 target_ulong bl;
367 int pp, valid, prot;
368
369 bl = (*BATu & 0x00001FFC) << 15;
370 valid = 0;
371 prot = 0;
372 if (((msr_pr == 0) && (*BATu & 0x00000002)) ||
373 ((msr_pr != 0) && (*BATu & 0x00000001))) {
374 valid = 1;
375 pp = *BATl & 0x00000003;
376 if (pp != 0) {
377 prot = PAGE_READ | PAGE_EXEC;
378 if (pp == 0x2) {
379 prot |= PAGE_WRITE;
380 }
381 }
382 }
383 *blp = bl;
384 *validp = valid;
385 *protp = prot;
386}
387
98132796
DG		 388static int get_bat_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx,
389 target_ulong virtual, int rw, int type)
8cbbe385
BS		 390{
391 target_ulong *BATlt, *BATut, *BATu, *BATl;
392 target_ulong BEPIl, BEPIu, bl;
393 int i, valid, prot;
394 int ret = -1;
395
396 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
397 type == ACCESS_CODE ? 'I' : 'D', virtual);
398 switch (type) {
399 case ACCESS_CODE:
400 BATlt = env->IBAT[1];
401 BATut = env->IBAT[0];
402 break;
403 default:
404 BATlt = env->DBAT[1];
405 BATut = env->DBAT[0];
406 break;
407 }
408 for (i = 0; i < env->nb_BATs; i++) {
409 BATu = &BATut[i];
410 BATl = &BATlt[i];
411 BEPIu = *BATu & 0xF0000000;
412 BEPIl = *BATu & 0x0FFE0000;
98132796 413 bat_size_prot(env, &bl, &valid, &prot, BATu, BATl);
8cbbe385
BS		 414 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
415 " BATl " TARGET_FMT_lx "\n", __func__,
416 type == ACCESS_CODE ? 'I' : 'D', i, virtual, *BATu, *BATl);
417 if ((virtual & 0xF0000000) == BEPIu &&
418 ((virtual & 0x0FFE0000) & ~bl) == BEPIl) {
419 /* BAT matches */
420 if (valid != 0) {
421 /* Get physical address */
422 ctx->raddr = (*BATl & 0xF0000000) |
423 ((virtual & 0x0FFE0000 & bl) | (*BATl & 0x0FFE0000)) |
424 (virtual & 0x0001F000);
425 /* Compute access rights */
426 ctx->prot = prot;
427 ret = check_prot(ctx->prot, rw, type);
428 if (ret == 0) {
429 LOG_BATS("BAT %d match: r " TARGET_FMT_plx " prot=%c%c\n",
430 i, ctx->raddr, ctx->prot & PAGE_READ ? 'R' : '-',
431 ctx->prot & PAGE_WRITE ? 'W' : '-');
432 }
433 break;
434 }
435 }
436 }
437 if (ret < 0) {
438#if defined(DEBUG_BATS)
439 if (qemu_log_enabled()) {
440 LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", virtual);
441 for (i = 0; i < 4; i++) {
442 BATu = &BATut[i];
443 BATl = &BATlt[i];
444 BEPIu = *BATu & 0xF0000000;
445 BEPIl = *BATu & 0x0FFE0000;
446 bl = (*BATu & 0x00001FFC) << 15;
447 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
448 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
449 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
450 __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual,
451 *BATu, *BATl, BEPIu, BEPIl, bl);
452 }
453 }
454#endif
455 }
456 /* No hit */
457 return ret;
458}
459
8cbbe385 460/* Perform segment based translation */
0480884f
DG		 461static inline int get_segment_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx,
462 target_ulong eaddr, int rw, int type)
8cbbe385 463{
a8170e5e 464 hwaddr hash;
8cbbe385
BS		 465 target_ulong vsid;
466 int ds, pr, target_page_bits;
0480884f
DG		 467 int ret;
468 target_ulong sr, pgidx;
8cbbe385
BS		 469
470 pr = msr_pr;
471 ctx->eaddr = eaddr;
8cbbe385 472
0480884f
DG		 473 sr = env->sr[eaddr >> 28];
474 ctx->key = (((sr & 0x20000000) && (pr != 0)) ||
475 ((sr & 0x40000000) && (pr == 0))) ? 1 : 0;
476 ds = sr & 0x80000000 ? 1 : 0;
477 ctx->nx = sr & 0x10000000 ? 1 : 0;
478 vsid = sr & 0x00FFFFFF;
479 target_page_bits = TARGET_PAGE_BITS;
480 LOG_MMU("Check segment v=" TARGET_FMT_lx " %d " TARGET_FMT_lx " nip="
481 TARGET_FMT_lx " lr=" TARGET_FMT_lx
482 " ir=%d dr=%d pr=%d %d t=%d\n",
483 eaddr, (int)(eaddr >> 28), sr, env->nip, env->lr, (int)msr_ir,
484 (int)msr_dr, pr != 0 ? 1 : 0, rw, type);
485 pgidx = (eaddr & ~SEGMENT_MASK_256M) >> target_page_bits;
486 hash = vsid ^ pgidx;
487 ctx->ptem = (vsid << 7) | (pgidx >> 10);
8cbbe385 488
8cbbe385
BS		 489 LOG_MMU("pte segment: key=%d ds %d nx %d vsid " TARGET_FMT_lx "\n",
490 ctx->key, ds, ctx->nx, vsid);
491 ret = -1;
492 if (!ds) {
493 /* Check if instruction fetch is allowed, if needed */
494 if (type != ACCESS_CODE || ctx->nx == 0) {
495 /* Page address translation */
496 LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
497 " hash " TARGET_FMT_plx "\n",
498 env->htab_base, env->htab_mask, hash);
499 ctx->hash[0] = hash;
500 ctx->hash[1] = ~hash;
501
502 /* Initialize real address with an invalid value */
a8170e5e 503 ctx->raddr = (hwaddr)-1ULL;
0480884f
DG		 504 /* Software TLB search */
505 ret = ppc6xx_tlb_check(env, ctx, eaddr, rw, type);
8cbbe385
BS		 506#if defined(DUMP_PAGE_TABLES)
507 if (qemu_log_enabled()) {
a8170e5e 508 hwaddr curaddr;
8cbbe385
BS		 509 uint32_t a0, a1, a2, a3;
510
511 qemu_log("Page table: " TARGET_FMT_plx " len " TARGET_FMT_plx
512 "\n", sdr, mask + 0x80);
513 for (curaddr = sdr; curaddr < (sdr + mask + 0x80);
514 curaddr += 16) {
515 a0 = ldl_phys(curaddr);
516 a1 = ldl_phys(curaddr + 4);
517 a2 = ldl_phys(curaddr + 8);
518 a3 = ldl_phys(curaddr + 12);
519 if (a0 != 0 || a1 != 0 || a2 != 0 || a3 != 0) {
520 qemu_log(TARGET_FMT_plx ": %08x %08x %08x %08x\n",
521 curaddr, a0, a1, a2, a3);
522 }
523 }
524 }
525#endif
526 } else {
527 LOG_MMU("No access allowed\n");
528 ret = -3;
529 }
530 } else {
531 target_ulong sr;
532
533 LOG_MMU("direct store...\n");
534 /* Direct-store segment : absolutely *BUGGY* for now */
535
536 /* Direct-store implies a 32-bit MMU.
537 * Check the Segment Register's bus unit ID (BUID).
538 */
539 sr = env->sr[eaddr >> 28];
540 if ((sr & 0x1FF00000) >> 20 == 0x07f) {
541 /* Memory-forced I/O controller interface access */
542 /* If T=1 and BUID=x'07F', the 601 performs a memory access
543 * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
544 */
545 ctx->raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
546 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
547 return 0;
548 }
549
550 switch (type) {
551 case ACCESS_INT:
552 /* Integer load/store : only access allowed */
553 break;
554 case ACCESS_CODE:
555 /* No code fetch is allowed in direct-store areas */
556 return -4;
557 case ACCESS_FLOAT:
558 /* Floating point load/store */
559 return -4;
560 case ACCESS_RES:
561 /* lwarx, ldarx or srwcx. */
562 return -4;
563 case ACCESS_CACHE:
564 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
565 /* Should make the instruction do no-op.
566 * As it already do no-op, it's quite easy :-)
567 */
568 ctx->raddr = eaddr;
569 return 0;
570 case ACCESS_EXT:
571 /* eciwx or ecowx */
572 return -4;
573 default:
574 qemu_log("ERROR: instruction should not need "
575 "address translation\n");
576 return -4;
577 }
578 if ((rw == 1 || ctx->key != 1) && (rw == 0 || ctx->key != 0)) {
579 ctx->raddr = eaddr;
580 ret = 2;
581 } else {
582 ret = -2;
583 }
584 }
585
586 return ret;
587}
588
589/* Generic TLB check function for embedded PowerPC implementations */
9aa5b158 590static int ppcemb_tlb_check(CPUPPCState *env, ppcemb_tlb_t *tlb,
a8170e5e 591 hwaddr *raddrp,
9aa5b158
BS		 592 target_ulong address, uint32_t pid, int ext,
593 int i)
8cbbe385
BS		 594{
595 target_ulong mask;
596
597 /* Check valid flag */
598 if (!(tlb->prot & PAGE_VALID)) {
599 return -1;
600 }
601 mask = ~(tlb->size - 1);
602 LOG_SWTLB("%s: TLB %d address " TARGET_FMT_lx " PID %u <=> " TARGET_FMT_lx
603 " " TARGET_FMT_lx " %u %x\n", __func__, i, address, pid, tlb->EPN,
604 mask, (uint32_t)tlb->PID, tlb->prot);
605 /* Check PID */
606 if (tlb->PID != 0 && tlb->PID != pid) {
607 return -1;
608 }
609 /* Check effective address */
610 if ((address & mask) != tlb->EPN) {
611 return -1;
612 }
613 *raddrp = (tlb->RPN & mask) | (address & ~mask);
8cbbe385
BS		 614 if (ext) {
615 /* Extend the physical address to 36 bits */
4be403c8 616 *raddrp |= (uint64_t)(tlb->RPN & 0xF) << 32;
8cbbe385 617 }
8cbbe385
BS		 618
619 return 0;
620}
621
622/* Generic TLB search function for PowerPC embedded implementations */
9aa5b158
BS		 623static int ppcemb_tlb_search(CPUPPCState *env, target_ulong address,
624 uint32_t pid)
8cbbe385
BS		 625{
626 ppcemb_tlb_t *tlb;
a8170e5e 627 hwaddr raddr;
8cbbe385
BS		 628 int i, ret;
629
630 /* Default return value is no match */
631 ret = -1;
632 for (i = 0; i < env->nb_tlb; i++) {
633 tlb = &env->tlb.tlbe[i];
634 if (ppcemb_tlb_check(env, tlb, &raddr, address, pid, 0, i) == 0) {
635 ret = i;
636 break;
637 }
638 }
639
640 return ret;
641}
642
643/* Helpers specific to PowerPC 40x implementations */
644static inline void ppc4xx_tlb_invalidate_all(CPUPPCState *env)
645{
646 ppcemb_tlb_t *tlb;
647 int i;
648
649 for (i = 0; i < env->nb_tlb; i++) {
650 tlb = &env->tlb.tlbe[i];
651 tlb->prot &= ~PAGE_VALID;
652 }
653 tlb_flush(env, 1);
654}
655
656static inline void ppc4xx_tlb_invalidate_virt(CPUPPCState *env,
657 target_ulong eaddr, uint32_t pid)
658{
659#if !defined(FLUSH_ALL_TLBS)
660 ppcemb_tlb_t *tlb;
a8170e5e 661 hwaddr raddr;
8cbbe385
BS		 662 target_ulong page, end;
663 int i;
664
665 for (i = 0; i < env->nb_tlb; i++) {
666 tlb = &env->tlb.tlbe[i];
667 if (ppcemb_tlb_check(env, tlb, &raddr, eaddr, pid, 0, i) == 0) {
668 end = tlb->EPN + tlb->size;
669 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
670 tlb_flush_page(env, page);
671 }
672 tlb->prot &= ~PAGE_VALID;
673 break;
674 }
675 }
676#else
677 ppc4xx_tlb_invalidate_all(env);
678#endif
679}
680
681static int mmu40x_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
682 target_ulong address, int rw,
683 int access_type)
684{
685 ppcemb_tlb_t *tlb;
a8170e5e 686 hwaddr raddr;
8cbbe385
BS		 687 int i, ret, zsel, zpr, pr;
688
689 ret = -1;
a8170e5e 690 raddr = (hwaddr)-1ULL;
8cbbe385
BS		 691 pr = msr_pr;
692 for (i = 0; i < env->nb_tlb; i++) {
693 tlb = &env->tlb.tlbe[i];
694 if (ppcemb_tlb_check(env, tlb, &raddr, address,
695 env->spr[SPR_40x_PID], 0, i) < 0) {
696 continue;
697 }
698 zsel = (tlb->attr >> 4) & 0xF;
699 zpr = (env->spr[SPR_40x_ZPR] >> (30 - (2 * zsel))) & 0x3;
700 LOG_SWTLB("%s: TLB %d zsel %d zpr %d rw %d attr %08x\n",
701 __func__, i, zsel, zpr, rw, tlb->attr);
702 /* Check execute enable bit */
703 switch (zpr) {
704 case 0x2:
705 if (pr != 0) {
706 goto check_perms;
707 }
708 /* No break here */
709 case 0x3:
710 /* All accesses granted */
711 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
712 ret = 0;
713 break;
714 case 0x0:
715 if (pr != 0) {
716 /* Raise Zone protection fault. */
717 env->spr[SPR_40x_ESR] = 1 << 22;
718 ctx->prot = 0;
719 ret = -2;
720 break;
721 }
722 /* No break here */
723 case 0x1:
724 check_perms:
725 /* Check from TLB entry */
726 ctx->prot = tlb->prot;
727 ret = check_prot(ctx->prot, rw, access_type);
728 if (ret == -2) {
729 env->spr[SPR_40x_ESR] = 0;
730 }
731 break;
732 }
733 if (ret >= 0) {
734 ctx->raddr = raddr;
735 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
736 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
737 ret);
738 return 0;
739 }
740 }
741 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
742 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
743
744 return ret;
745}
746
747void store_40x_sler(CPUPPCState *env, uint32_t val)
748{
749 /* XXX: TO BE FIXED */
750 if (val != 0x00000000) {
751 cpu_abort(env, "Little-endian regions are not supported by now\n");
752 }
753 env->spr[SPR_405_SLER] = val;
754}
755
756static inline int mmubooke_check_tlb(CPUPPCState *env, ppcemb_tlb_t *tlb,
a8170e5e 757 hwaddr *raddr, int *prot,
8cbbe385
BS		 758 target_ulong address, int rw,
759 int access_type, int i)
760{
761 int ret, prot2;
762
763 if (ppcemb_tlb_check(env, tlb, raddr, address,
764 env->spr[SPR_BOOKE_PID],
765 !env->nb_pids, i) >= 0) {
766 goto found_tlb;
767 }
768
769 if (env->spr[SPR_BOOKE_PID1] &&
770 ppcemb_tlb_check(env, tlb, raddr, address,
771 env->spr[SPR_BOOKE_PID1], 0, i) >= 0) {
772 goto found_tlb;
773 }
774
775 if (env->spr[SPR_BOOKE_PID2] &&
776 ppcemb_tlb_check(env, tlb, raddr, address,
777 env->spr[SPR_BOOKE_PID2], 0, i) >= 0) {
778 goto found_tlb;
779 }
780
781 LOG_SWTLB("%s: TLB entry not found\n", __func__);
782 return -1;
783
784found_tlb:
785
786 if (msr_pr != 0) {
787 prot2 = tlb->prot & 0xF;
788 } else {
789 prot2 = (tlb->prot >> 4) & 0xF;
790 }
791
792 /* Check the address space */
793 if (access_type == ACCESS_CODE) {
794 if (msr_ir != (tlb->attr & 1)) {
795 LOG_SWTLB("%s: AS doesn't match\n", __func__);
796 return -1;
797 }
798
799 *prot = prot2;
800 if (prot2 & PAGE_EXEC) {
801 LOG_SWTLB("%s: good TLB!\n", __func__);
802 return 0;
803 }
804
805 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
806 ret = -3;
807 } else {
808 if (msr_dr != (tlb->attr & 1)) {
809 LOG_SWTLB("%s: AS doesn't match\n", __func__);
810 return -1;
811 }
812
813 *prot = prot2;
814 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
815 LOG_SWTLB("%s: found TLB!\n", __func__);
816 return 0;
817 }
818
819 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
820 ret = -2;
821 }
822
823 return ret;
824}
825
826static int mmubooke_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
827 target_ulong address, int rw,
828 int access_type)
829{
830 ppcemb_tlb_t *tlb;
a8170e5e 831 hwaddr raddr;
8cbbe385
BS		 832 int i, ret;
833
834 ret = -1;
a8170e5e 835 raddr = (hwaddr)-1ULL;
8cbbe385
BS		 836 for (i = 0; i < env->nb_tlb; i++) {
837 tlb = &env->tlb.tlbe[i];
838 ret = mmubooke_check_tlb(env, tlb, &raddr, &ctx->prot, address, rw,
839 access_type, i);
840 if (!ret) {
841 break;
842 }
843 }
844
845 if (ret >= 0) {
846 ctx->raddr = raddr;
847 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
848 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
849 ret);
850 } else {
851 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
852 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
853 }
854
855 return ret;
856}
857
6575c289
BS		 858static void booke206_flush_tlb(CPUPPCState *env, int flags,
859 const int check_iprot)
8cbbe385
BS		 860{
861 int tlb_size;
862 int i, j;
863 ppcmas_tlb_t *tlb = env->tlb.tlbm;
864
865 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
866 if (flags & (1 << i)) {
867 tlb_size = booke206_tlb_size(env, i);
868 for (j = 0; j < tlb_size; j++) {
869 if (!check_iprot || !(tlb[j].mas1 & MAS1_IPROT)) {
870 tlb[j].mas1 &= ~MAS1_VALID;
871 }
872 }
873 }
874 tlb += booke206_tlb_size(env, i);
875 }
876
877 tlb_flush(env, 1);
878}
879
6575c289
BS		 880static hwaddr booke206_tlb_to_page_size(CPUPPCState *env,
881 ppcmas_tlb_t *tlb)
8cbbe385
BS		 882{
883 int tlbm_size;
884
885 tlbm_size = (tlb->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
886
887 return 1024ULL << tlbm_size;
888}
889
890/* TLB check function for MAS based SoftTLBs */
213c7180
DG		 891static int ppcmas_tlb_check(CPUPPCState *env, ppcmas_tlb_t *tlb,
892 hwaddr *raddrp,
10b46525 893 target_ulong address, uint32_t pid)
8cbbe385
BS		 894{
895 target_ulong mask;
896 uint32_t tlb_pid;
897
898 /* Check valid flag */
899 if (!(tlb->mas1 & MAS1_VALID)) {
900 return -1;
901 }
902
903 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
904 LOG_SWTLB("%s: TLB ADDR=0x" TARGET_FMT_lx " PID=0x%x MAS1=0x%x MAS2=0x%"
905 PRIx64 " mask=0x" TARGET_FMT_lx " MAS7_3=0x%" PRIx64 " MAS8=%x\n",
906 __func__, address, pid, tlb->mas1, tlb->mas2, mask, tlb->mas7_3,
907 tlb->mas8);
908
909 /* Check PID */
910 tlb_pid = (tlb->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT;
911 if (tlb_pid != 0 && tlb_pid != pid) {
912 return -1;
913 }
914
915 /* Check effective address */
916 if ((address & mask) != (tlb->mas2 & MAS2_EPN_MASK)) {
917 return -1;
918 }
919
920 if (raddrp) {
921 *raddrp = (tlb->mas7_3 & mask) | (address & ~mask);
922 }
923
924 return 0;
925}
926
927static int mmubooke206_check_tlb(CPUPPCState *env, ppcmas_tlb_t *tlb,
a8170e5e 928 hwaddr *raddr, int *prot,
8cbbe385
BS		 929 target_ulong address, int rw,
930 int access_type)
931{
932 int ret;
933 int prot2 = 0;
934
935 if (ppcmas_tlb_check(env, tlb, raddr, address,
936 env->spr[SPR_BOOKE_PID]) >= 0) {
937 goto found_tlb;
938 }
939
940 if (env->spr[SPR_BOOKE_PID1] &&
941 ppcmas_tlb_check(env, tlb, raddr, address,
942 env->spr[SPR_BOOKE_PID1]) >= 0) {
943 goto found_tlb;
944 }
945
946 if (env->spr[SPR_BOOKE_PID2] &&
947 ppcmas_tlb_check(env, tlb, raddr, address,
948 env->spr[SPR_BOOKE_PID2]) >= 0) {
949 goto found_tlb;
950 }
951
952 LOG_SWTLB("%s: TLB entry not found\n", __func__);
953 return -1;
954
955found_tlb:
956
957 if (msr_pr != 0) {
958 if (tlb->mas7_3 & MAS3_UR) {
959 prot2 |= PAGE_READ;
960 }
961 if (tlb->mas7_3 & MAS3_UW) {
962 prot2 |= PAGE_WRITE;
963 }
964 if (tlb->mas7_3 & MAS3_UX) {
965 prot2 |= PAGE_EXEC;
966 }
967 } else {
968 if (tlb->mas7_3 & MAS3_SR) {
969 prot2 |= PAGE_READ;
970 }
971 if (tlb->mas7_3 & MAS3_SW) {
972 prot2 |= PAGE_WRITE;
973 }
974 if (tlb->mas7_3 & MAS3_SX) {
975 prot2 |= PAGE_EXEC;
976 }
977 }
978
979 /* Check the address space and permissions */
980 if (access_type == ACCESS_CODE) {
981 if (msr_ir != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
982 LOG_SWTLB("%s: AS doesn't match\n", __func__);
983 return -1;
984 }
985
986 *prot = prot2;
987 if (prot2 & PAGE_EXEC) {
988 LOG_SWTLB("%s: good TLB!\n", __func__);
989 return 0;
990 }
991
992 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
993 ret = -3;
994 } else {
995 if (msr_dr != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
996 LOG_SWTLB("%s: AS doesn't match\n", __func__);
997 return -1;
998 }
999
1000 *prot = prot2;
1001 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
1002 LOG_SWTLB("%s: found TLB!\n", __func__);
1003 return 0;
1004 }
1005
1006 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
1007 ret = -2;
1008 }
1009
1010 return ret;
1011}
1012
1013static int mmubooke206_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1014 target_ulong address, int rw,
1015 int access_type)
1016{
1017 ppcmas_tlb_t *tlb;
a8170e5e 1018 hwaddr raddr;
8cbbe385
BS		 1019 int i, j, ret;
1020
1021 ret = -1;
a8170e5e 1022 raddr = (hwaddr)-1ULL;
8cbbe385
BS		 1023
1024 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1025 int ways = booke206_tlb_ways(env, i);
1026
1027 for (j = 0; j < ways; j++) {
1028 tlb = booke206_get_tlbm(env, i, address, j);
1029 if (!tlb) {
1030 continue;
1031 }
1032 ret = mmubooke206_check_tlb(env, tlb, &raddr, &ctx->prot, address,
1033 rw, access_type);
1034 if (ret != -1) {
1035 goto found_tlb;
1036 }
1037 }
1038 }
1039
1040found_tlb:
1041
1042 if (ret >= 0) {
1043 ctx->raddr = raddr;
1044 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
1045 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
1046 ret);
1047 } else {
1048 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
1049 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
1050 }
1051
1052 return ret;
1053}
1054
1055static const char *book3e_tsize_to_str[32] = {
1056 "1K", "2K", "4K", "8K", "16K", "32K", "64K", "128K", "256K", "512K",
1057 "1M", "2M", "4M", "8M", "16M", "32M", "64M", "128M", "256M", "512M",
1058 "1G", "2G", "4G", "8G", "16G", "32G", "64G", "128G", "256G", "512G",
1059 "1T", "2T"
1060};
1061
1062static void mmubooke_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1063 CPUPPCState *env)
1064{
1065 ppcemb_tlb_t *entry;
1066 int i;
1067
1068 if (kvm_enabled() && !env->kvm_sw_tlb) {
1069 cpu_fprintf(f, "Cannot access KVM TLB\n");
1070 return;
1071 }
1072
1073 cpu_fprintf(f, "\nTLB:\n");
1074 cpu_fprintf(f, "Effective Physical Size PID Prot "
1075 "Attr\n");
1076
1077 entry = &env->tlb.tlbe[0];
1078 for (i = 0; i < env->nb_tlb; i++, entry++) {
a8170e5e 1079 hwaddr ea, pa;
8cbbe385
BS		 1080 target_ulong mask;
1081 uint64_t size = (uint64_t)entry->size;
1082 char size_buf[20];
1083
1084 /* Check valid flag */
1085 if (!(entry->prot & PAGE_VALID)) {
1086 continue;
1087 }
1088
1089 mask = ~(entry->size - 1);
1090 ea = entry->EPN & mask;
1091 pa = entry->RPN & mask;
8cbbe385 1092 /* Extend the physical address to 36 bits */
a8170e5e 1093 pa |= (hwaddr)(entry->RPN & 0xF) << 32;
8cbbe385
BS		 1094 size /= 1024;
1095 if (size >= 1024) {
1096 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "M", size / 1024);
1097 } else {
1098 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "k", size);
1099 }
1100 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %s %-5u %08x %08x\n",
1101 (uint64_t)ea, (uint64_t)pa, size_buf, (uint32_t)entry->PID,
1102 entry->prot, entry->attr);
1103 }
1104
1105}
1106
1107static void mmubooke206_dump_one_tlb(FILE *f, fprintf_function cpu_fprintf,
1108 CPUPPCState *env, int tlbn, int offset,
1109 int tlbsize)
1110{
1111 ppcmas_tlb_t *entry;
1112 int i;
1113
1114 cpu_fprintf(f, "\nTLB%d:\n", tlbn);
1115 cpu_fprintf(f, "Effective Physical Size TID TS SRWX"
1116 " URWX WIMGE U0123\n");
1117
1118 entry = &env->tlb.tlbm[offset];
1119 for (i = 0; i < tlbsize; i++, entry++) {
a8170e5e 1120 hwaddr ea, pa, size;
8cbbe385
BS		 1121 int tsize;
1122
1123 if (!(entry->mas1 & MAS1_VALID)) {
1124 continue;
1125 }
1126
1127 tsize = (entry->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
1128 size = 1024ULL << tsize;
1129 ea = entry->mas2 & ~(size - 1);
1130 pa = entry->mas7_3 & ~(size - 1);
1131
1132 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %4s %-5u %1u S%c%c%c"
1133 "U%c%c%c %c%c%c%c%c U%c%c%c%c\n",
1134 (uint64_t)ea, (uint64_t)pa,
1135 book3e_tsize_to_str[tsize],
1136 (entry->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT,
1137 (entry->mas1 & MAS1_TS) >> MAS1_TS_SHIFT,
1138 entry->mas7_3 & MAS3_SR ? 'R' : '-',
1139 entry->mas7_3 & MAS3_SW ? 'W' : '-',
1140 entry->mas7_3 & MAS3_SX ? 'X' : '-',
1141 entry->mas7_3 & MAS3_UR ? 'R' : '-',
1142 entry->mas7_3 & MAS3_UW ? 'W' : '-',
1143 entry->mas7_3 & MAS3_UX ? 'X' : '-',
1144 entry->mas2 & MAS2_W ? 'W' : '-',
1145 entry->mas2 & MAS2_I ? 'I' : '-',
1146 entry->mas2 & MAS2_M ? 'M' : '-',
1147 entry->mas2 & MAS2_G ? 'G' : '-',
1148 entry->mas2 & MAS2_E ? 'E' : '-',
1149 entry->mas7_3 & MAS3_U0 ? '0' : '-',
1150 entry->mas7_3 & MAS3_U1 ? '1' : '-',
1151 entry->mas7_3 & MAS3_U2 ? '2' : '-',
1152 entry->mas7_3 & MAS3_U3 ? '3' : '-');
1153 }
1154}
1155
1156static void mmubooke206_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1157 CPUPPCState *env)
1158{
1159 int offset = 0;
1160 int i;
1161
1162 if (kvm_enabled() && !env->kvm_sw_tlb) {
1163 cpu_fprintf(f, "Cannot access KVM TLB\n");
1164 return;
1165 }
1166
1167 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1168 int size = booke206_tlb_size(env, i);
1169
1170 if (size == 0) {
1171 continue;
1172 }
1173
1174 mmubooke206_dump_one_tlb(f, cpu_fprintf, env, i, offset, size);
1175 offset += size;
1176 }
1177}
1178
8cbbe385
BS		 1179void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
1180{
1181 switch (env->mmu_model) {
1182 case POWERPC_MMU_BOOKE:
1183 mmubooke_dump_mmu(f, cpu_fprintf, env);
1184 break;
1185 case POWERPC_MMU_BOOKE206:
1186 mmubooke206_dump_mmu(f, cpu_fprintf, env);
1187 break;
1188#if defined(TARGET_PPC64)
1189 case POWERPC_MMU_64B:
1190 case POWERPC_MMU_2_06:
126a7930 1191 case POWERPC_MMU_2_06a:
4656e1f0 1192 case POWERPC_MMU_2_06d:
10b46525 1193 dump_slb(f, cpu_fprintf, env);
8cbbe385
BS		 1194 break;
1195#endif
1196 default:
1197 qemu_log_mask(LOG_UNIMP, "%s: unimplemented\n", __func__);
1198 }
1199}
1200
1201static inline int check_physical(CPUPPCState *env, mmu_ctx_t *ctx,
1202 target_ulong eaddr, int rw)
1203{
1204 int in_plb, ret;
1205
1206 ctx->raddr = eaddr;
1207 ctx->prot = PAGE_READ | PAGE_EXEC;
1208 ret = 0;
1209 switch (env->mmu_model) {
8cbbe385
BS		 1210 case POWERPC_MMU_SOFT_6xx:
1211 case POWERPC_MMU_SOFT_74xx:
1212 case POWERPC_MMU_SOFT_4xx:
1213 case POWERPC_MMU_REAL:
1214 case POWERPC_MMU_BOOKE:
1215 ctx->prot |= PAGE_WRITE;
1216 break;
629bd516 1217
8cbbe385
BS		 1218 case POWERPC_MMU_SOFT_4xx_Z:
1219 if (unlikely(msr_pe != 0)) {
1220 /* 403 family add some particular protections,
1221 * using PBL/PBU registers for accesses with no translation.
1222 */
1223 in_plb =
1224 /* Check PLB validity */
1225 (env->pb[0] < env->pb[1] &&
1226 /* and address in plb area */
1227 eaddr >= env->pb[0] && eaddr < env->pb[1]) ||
1228 (env->pb[2] < env->pb[3] &&
1229 eaddr >= env->pb[2] && eaddr < env->pb[3]) ? 1 : 0;
1230 if (in_plb ^ msr_px) {
1231 /* Access in protected area */
1232 if (rw == 1) {
1233 /* Access is not allowed */
1234 ret = -2;
1235 }
1236 } else {
1237 /* Read-write access is allowed */
1238 ctx->prot |= PAGE_WRITE;
1239 }
1240 }
1241 break;
629bd516 1242
8cbbe385 1243 default:
629bd516
DG		 1244 /* Caller's checks mean we should never get here for other models */
1245 abort();
8cbbe385
BS		 1246 return -1;
1247 }
1248
1249 return ret;
1250}
1251
6575c289
BS		 1252static int get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1253 target_ulong eaddr, int rw, int access_type)
8cbbe385 1254{
44bc9107
DG		 1255 int ret = -1;
1256 bool real_mode = (access_type == ACCESS_CODE && msr_ir == 0)
1257 || (access_type != ACCESS_CODE && msr_dr == 0);
8cbbe385
BS		 1258
1259#if 0
1260 qemu_log("%s\n", __func__);
1261#endif
44bc9107
DG		 1262
1263 switch (env->mmu_model) {
44bc9107
DG		 1264 case POWERPC_MMU_SOFT_6xx:
1265 case POWERPC_MMU_SOFT_74xx:
1266 if (real_mode) {
1267 ret = check_physical(env, ctx, eaddr, rw);
1268 } else {
8cbbe385
BS		 1269 /* Try to find a BAT */
1270 if (env->nb_BATs != 0) {
98132796 1271 ret = get_bat_6xx_tlb(env, ctx, eaddr, rw, access_type);
8cbbe385 1272 }
0480884f
DG		 1273 if (ret < 0) {
1274 /* We didn't match any BAT entry or don't have BATs */
1275 ret = get_segment_6xx_tlb(env, ctx, eaddr, rw, access_type);
1276 }
44bc9107
DG		 1277 }
1278 break;
0480884f 1279
44bc9107
DG		 1280 case POWERPC_MMU_SOFT_4xx:
1281 case POWERPC_MMU_SOFT_4xx_Z:
1282 if (real_mode) {
1283 ret = check_physical(env, ctx, eaddr, rw);
1284 } else {
8cbbe385
BS		 1285 ret = mmu40x_get_physical_address(env, ctx, eaddr,
1286 rw, access_type);
44bc9107
DG		 1287 }
1288 break;
1289 case POWERPC_MMU_BOOKE:
1290 ret = mmubooke_get_physical_address(env, ctx, eaddr,
1291 rw, access_type);
1292 break;
1293 case POWERPC_MMU_BOOKE206:
1294 ret = mmubooke206_get_physical_address(env, ctx, eaddr, rw,
8cbbe385 1295 access_type);
44bc9107
DG		 1296 break;
1297 case POWERPC_MMU_MPC8xx:
1298 /* XXX: TODO */
1299 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1300 break;
1301 case POWERPC_MMU_REAL:
1302 if (real_mode) {
1303 ret = check_physical(env, ctx, eaddr, rw);
1304 } else {
8cbbe385 1305 cpu_abort(env, "PowerPC in real mode do not do any translation\n");
8cbbe385 1306 }
44bc9107
DG		 1307 return -1;
1308 default:
1309 cpu_abort(env, "Unknown or invalid MMU model\n");
1310 return -1;
8cbbe385
BS		 1311 }
1312#if 0
1313 qemu_log("%s address " TARGET_FMT_lx " => %d " TARGET_FMT_plx "\n",
1314 __func__, eaddr, ret, ctx->raddr);
1315#endif
1316
1317 return ret;
1318}
1319
a8170e5e 1320hwaddr cpu_get_phys_page_debug(CPUPPCState *env, target_ulong addr)
8cbbe385
BS		 1321{
1322 mmu_ctx_t ctx;
1323
f2ad6be8
DG		 1324 switch (env->mmu_model) {
1325#if defined(TARGET_PPC64)
1326 case POWERPC_MMU_64B:
1327 case POWERPC_MMU_2_06:
126a7930 1328 case POWERPC_MMU_2_06a:
f2ad6be8
DG		 1329 case POWERPC_MMU_2_06d:
1330 return ppc_hash64_get_phys_page_debug(env, addr);
1331#endif
1332
1333 case POWERPC_MMU_32B:
1334 case POWERPC_MMU_601:
1335 return ppc_hash32_get_phys_page_debug(env, addr);
1336
1337 default:
1338 ;
1339 }
1340
8cbbe385
BS		 1341 if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT) != 0)) {
1342 return -1;
1343 }
1344
1345 return ctx.raddr & TARGET_PAGE_MASK;
1346}
1347
1348static void booke206_update_mas_tlb_miss(CPUPPCState *env, target_ulong address,
1349 int rw)
1350{
1351 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
1352 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
1353 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
1354 env->spr[SPR_BOOKE_MAS3] = 0;
1355 env->spr[SPR_BOOKE_MAS6] = 0;
1356 env->spr[SPR_BOOKE_MAS7] = 0;
1357
1358 /* AS */
1359 if (((rw == 2) && msr_ir) || ((rw != 2) && msr_dr)) {
1360 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
1361 env->spr[SPR_BOOKE_MAS6] |= MAS6_SAS;
1362 }
1363
1364 env->spr[SPR_BOOKE_MAS1] |= MAS1_VALID;
1365 env->spr[SPR_BOOKE_MAS2] |= address & MAS2_EPN_MASK;
1366
1367 switch (env->spr[SPR_BOOKE_MAS4] & MAS4_TIDSELD_PIDZ) {
1368 case MAS4_TIDSELD_PID0:
1369 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID] << MAS1_TID_SHIFT;
1370 break;
1371 case MAS4_TIDSELD_PID1:
1372 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID1] << MAS1_TID_SHIFT;
1373 break;
1374 case MAS4_TIDSELD_PID2:
1375 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID2] << MAS1_TID_SHIFT;
1376 break;
1377 }
1378
1379 env->spr[SPR_BOOKE_MAS6] |= env->spr[SPR_BOOKE_PID] << 16;
1380
1381 /* next victim logic */
1382 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
1383 env->last_way++;
1384 env->last_way &= booke206_tlb_ways(env, 0) - 1;
1385 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
1386}
1387
1388/* Perform address translation */
eb20c1c6
DG		 1389static int cpu_ppc_handle_mmu_fault(CPUPPCState *env, target_ulong address,
1390 int rw, int mmu_idx)
8cbbe385
BS		 1391{
1392 mmu_ctx_t ctx;
1393 int access_type;
1394 int ret = 0;
1395
1396 if (rw == 2) {
1397 /* code access */
1398 rw = 0;
1399 access_type = ACCESS_CODE;
1400 } else {
1401 /* data access */
1402 access_type = env->access_type;
1403 }
1404 ret = get_physical_address(env, &ctx, address, rw, access_type);
1405 if (ret == 0) {
1406 tlb_set_page(env, address & TARGET_PAGE_MASK,
1407 ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
1408 mmu_idx, TARGET_PAGE_SIZE);
1409 ret = 0;
1410 } else if (ret < 0) {
1411 LOG_MMU_STATE(env);
1412 if (access_type == ACCESS_CODE) {
1413 switch (ret) {
1414 case -1:
1415 /* No matches in page tables or TLB */
1416 switch (env->mmu_model) {
1417 case POWERPC_MMU_SOFT_6xx:
1418 env->exception_index = POWERPC_EXCP_IFTLB;
1419 env->error_code = 1 << 18;
1420 env->spr[SPR_IMISS] = address;
1421 env->spr[SPR_ICMP] = 0x80000000 | ctx.ptem;
1422 goto tlb_miss;
1423 case POWERPC_MMU_SOFT_74xx:
1424 env->exception_index = POWERPC_EXCP_IFTLB;
1425 goto tlb_miss_74xx;
1426 case POWERPC_MMU_SOFT_4xx:
1427 case POWERPC_MMU_SOFT_4xx_Z:
1428 env->exception_index = POWERPC_EXCP_ITLB;
1429 env->error_code = 0;
1430 env->spr[SPR_40x_DEAR] = address;
1431 env->spr[SPR_40x_ESR] = 0x00000000;
1432 break;
8cbbe385
BS		 1433 case POWERPC_MMU_BOOKE206:
1434 booke206_update_mas_tlb_miss(env, address, rw);
1435 /* fall through */
1436 case POWERPC_MMU_BOOKE:
1437 env->exception_index = POWERPC_EXCP_ITLB;
1438 env->error_code = 0;
1439 env->spr[SPR_BOOKE_DEAR] = address;
1440 return -1;
1441 case POWERPC_MMU_MPC8xx:
1442 /* XXX: TODO */
1443 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1444 break;
1445 case POWERPC_MMU_REAL:
1446 cpu_abort(env, "PowerPC in real mode should never raise "
1447 "any MMU exceptions\n");
1448 return -1;
1449 default:
1450 cpu_abort(env, "Unknown or invalid MMU model\n");
1451 return -1;
1452 }
1453 break;
1454 case -2:
1455 /* Access rights violation */
1456 env->exception_index = POWERPC_EXCP_ISI;
1457 env->error_code = 0x08000000;
1458 break;
1459 case -3:
1460 /* No execute protection violation */
1461 if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1462 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1463 env->spr[SPR_BOOKE_ESR] = 0x00000000;
1464 }
1465 env->exception_index = POWERPC_EXCP_ISI;
1466 env->error_code = 0x10000000;
1467 break;
1468 case -4:
1469 /* Direct store exception */
1470 /* No code fetch is allowed in direct-store areas */
1471 env->exception_index = POWERPC_EXCP_ISI;
1472 env->error_code = 0x10000000;
1473 break;
8cbbe385
BS		 1474 }
1475 } else {
1476 switch (ret) {
1477 case -1:
1478 /* No matches in page tables or TLB */
1479 switch (env->mmu_model) {
1480 case POWERPC_MMU_SOFT_6xx:
1481 if (rw == 1) {
1482 env->exception_index = POWERPC_EXCP_DSTLB;
1483 env->error_code = 1 << 16;
1484 } else {
1485 env->exception_index = POWERPC_EXCP_DLTLB;
1486 env->error_code = 0;
1487 }
1488 env->spr[SPR_DMISS] = address;
1489 env->spr[SPR_DCMP] = 0x80000000 | ctx.ptem;
1490 tlb_miss:
1491 env->error_code |= ctx.key << 19;
1492 env->spr[SPR_HASH1] = env->htab_base +
59191721 1493 get_pteg_offset32(env, ctx.hash[0]);
8cbbe385 1494 env->spr[SPR_HASH2] = env->htab_base +
59191721 1495 get_pteg_offset32(env, ctx.hash[1]);
8cbbe385
BS		 1496 break;
1497 case POWERPC_MMU_SOFT_74xx:
1498 if (rw == 1) {
1499 env->exception_index = POWERPC_EXCP_DSTLB;
1500 } else {
1501 env->exception_index = POWERPC_EXCP_DLTLB;
1502 }
1503 tlb_miss_74xx:
1504 /* Implement LRU algorithm */
1505 env->error_code = ctx.key << 19;
1506 env->spr[SPR_TLBMISS] = (address & ~((target_ulong)0x3)) |
1507 ((env->last_way + 1) & (env->nb_ways - 1));
1508 env->spr[SPR_PTEHI] = 0x80000000 | ctx.ptem;
1509 break;
1510 case POWERPC_MMU_SOFT_4xx:
1511 case POWERPC_MMU_SOFT_4xx_Z:
1512 env->exception_index = POWERPC_EXCP_DTLB;
1513 env->error_code = 0;
1514 env->spr[SPR_40x_DEAR] = address;
1515 if (rw) {
1516 env->spr[SPR_40x_ESR] = 0x00800000;
1517 } else {
1518 env->spr[SPR_40x_ESR] = 0x00000000;
1519 }
1520 break;
8cbbe385
BS		 1521 case POWERPC_MMU_MPC8xx:
1522 /* XXX: TODO */
1523 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1524 break;
1525 case POWERPC_MMU_BOOKE206:
1526 booke206_update_mas_tlb_miss(env, address, rw);
1527 /* fall through */
1528 case POWERPC_MMU_BOOKE:
1529 env->exception_index = POWERPC_EXCP_DTLB;
1530 env->error_code = 0;
1531 env->spr[SPR_BOOKE_DEAR] = address;
1532 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1533 return -1;
1534 case POWERPC_MMU_REAL:
1535 cpu_abort(env, "PowerPC in real mode should never raise "
1536 "any MMU exceptions\n");
1537 return -1;
1538 default:
1539 cpu_abort(env, "Unknown or invalid MMU model\n");
1540 return -1;
1541 }
1542 break;
1543 case -2:
1544 /* Access rights violation */
1545 env->exception_index = POWERPC_EXCP_DSI;
1546 env->error_code = 0;
1547 if (env->mmu_model == POWERPC_MMU_SOFT_4xx
1548 || env->mmu_model == POWERPC_MMU_SOFT_4xx_Z) {
1549 env->spr[SPR_40x_DEAR] = address;
1550 if (rw) {
1551 env->spr[SPR_40x_ESR] |= 0x00800000;
1552 }
1553 } else if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1554 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1555 env->spr[SPR_BOOKE_DEAR] = address;
1556 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1557 } else {
1558 env->spr[SPR_DAR] = address;
1559 if (rw == 1) {
1560 env->spr[SPR_DSISR] = 0x0A000000;
1561 } else {
1562 env->spr[SPR_DSISR] = 0x08000000;
1563 }
1564 }
1565 break;
1566 case -4:
1567 /* Direct store exception */
1568 switch (access_type) {
1569 case ACCESS_FLOAT:
1570 /* Floating point load/store */
1571 env->exception_index = POWERPC_EXCP_ALIGN;
1572 env->error_code = POWERPC_EXCP_ALIGN_FP;
1573 env->spr[SPR_DAR] = address;
1574 break;
1575 case ACCESS_RES:
1576 /* lwarx, ldarx or stwcx. */
1577 env->exception_index = POWERPC_EXCP_DSI;
1578 env->error_code = 0;
1579 env->spr[SPR_DAR] = address;
1580 if (rw == 1) {
1581 env->spr[SPR_DSISR] = 0x06000000;
1582 } else {
1583 env->spr[SPR_DSISR] = 0x04000000;
1584 }
1585 break;
1586 case ACCESS_EXT:
1587 /* eciwx or ecowx */
1588 env->exception_index = POWERPC_EXCP_DSI;
1589 env->error_code = 0;
1590 env->spr[SPR_DAR] = address;
1591 if (rw == 1) {
1592 env->spr[SPR_DSISR] = 0x06100000;
1593 } else {
1594 env->spr[SPR_DSISR] = 0x04100000;
1595 }
1596 break;
1597 default:
1598 printf("DSI: invalid exception (%d)\n", ret);
1599 env->exception_index = POWERPC_EXCP_PROGRAM;
1600 env->error_code =
1601 POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL;
1602 env->spr[SPR_DAR] = address;
1603 break;
1604 }
1605 break;
8cbbe385
BS		 1606 }
1607 }
1608#if 0
1609 printf("%s: set exception to %d %02x\n", __func__,
1610 env->exception, env->error_code);
1611#endif
1612 ret = 1;
1613 }
1614
1615 return ret;
1616}
1617
1618/*****************************************************************************/
1619/* BATs management */
1620#if !defined(FLUSH_ALL_TLBS)
1621static inline void do_invalidate_BAT(CPUPPCState *env, target_ulong BATu,
1622 target_ulong mask)
1623{
1624 target_ulong base, end, page;
1625
1626 base = BATu & ~0x0001FFFF;
1627 end = base + mask + 0x00020000;
1628 LOG_BATS("Flush BAT from " TARGET_FMT_lx " to " TARGET_FMT_lx " ("
1629 TARGET_FMT_lx ")\n", base, end, mask);
1630 for (page = base; page != end; page += TARGET_PAGE_SIZE) {
1631 tlb_flush_page(env, page);
1632 }
1633 LOG_BATS("Flush done\n");
1634}
1635#endif
1636
1637static inline void dump_store_bat(CPUPPCState *env, char ID, int ul, int nr,
1638 target_ulong value)
1639{
1640 LOG_BATS("Set %cBAT%d%c to " TARGET_FMT_lx " (" TARGET_FMT_lx ")\n", ID,
1641 nr, ul == 0 ? 'u' : 'l', value, env->nip);
1642}
1643
9aa5b158 1644void helper_store_ibatu(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385
BS		 1645{
1646 target_ulong mask;
1647
1648 dump_store_bat(env, 'I', 0, nr, value);
1649 if (env->IBAT[0][nr] != value) {
1650 mask = (value << 15) & 0x0FFE0000UL;
1651#if !defined(FLUSH_ALL_TLBS)
1652 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1653#endif
1654 /* When storing valid upper BAT, mask BEPI and BRPN
1655 * and invalidate all TLBs covered by this BAT
1656 */
1657 mask = (value << 15) & 0x0FFE0000UL;
1658 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1659 (value & ~0x0001FFFFUL & ~mask);
1660 env->IBAT[1][nr] = (env->IBAT[1][nr] & 0x0000007B) |
1661 (env->IBAT[1][nr] & ~0x0001FFFF & ~mask);
1662#if !defined(FLUSH_ALL_TLBS)
1663 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1664#else
1665 tlb_flush(env, 1);
1666#endif
1667 }
1668}
1669
9aa5b158 1670void helper_store_ibatl(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385
BS		 1671{
1672 dump_store_bat(env, 'I', 1, nr, value);
1673 env->IBAT[1][nr] = value;
1674}
1675
9aa5b158 1676void helper_store_dbatu(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385
BS		 1677{
1678 target_ulong mask;
1679
1680 dump_store_bat(env, 'D', 0, nr, value);
1681 if (env->DBAT[0][nr] != value) {
1682 /* When storing valid upper BAT, mask BEPI and BRPN
1683 * and invalidate all TLBs covered by this BAT
1684 */
1685 mask = (value << 15) & 0x0FFE0000UL;
1686#if !defined(FLUSH_ALL_TLBS)
1687 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1688#endif
1689 mask = (value << 15) & 0x0FFE0000UL;
1690 env->DBAT[0][nr] = (value & 0x00001FFFUL) |
1691 (value & ~0x0001FFFFUL & ~mask);
1692 env->DBAT[1][nr] = (env->DBAT[1][nr] & 0x0000007B) |
1693 (env->DBAT[1][nr] & ~0x0001FFFF & ~mask);
1694#if !defined(FLUSH_ALL_TLBS)
1695 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1696#else
1697 tlb_flush(env, 1);
1698#endif
1699 }
1700}
1701
9aa5b158 1702void helper_store_dbatl(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385
BS		 1703{
1704 dump_store_bat(env, 'D', 1, nr, value);
1705 env->DBAT[1][nr] = value;
1706}
1707
9aa5b158 1708void helper_store_601_batu(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385
BS		 1709{
1710 target_ulong mask;
1711#if defined(FLUSH_ALL_TLBS)
1712 int do_inval;
1713#endif
1714
1715 dump_store_bat(env, 'I', 0, nr, value);
1716 if (env->IBAT[0][nr] != value) {
1717#if defined(FLUSH_ALL_TLBS)
1718 do_inval = 0;
1719#endif
1720 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1721 if (env->IBAT[1][nr] & 0x40) {
1722 /* Invalidate BAT only if it is valid */
1723#if !defined(FLUSH_ALL_TLBS)
1724 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1725#else
1726 do_inval = 1;
1727#endif
1728 }
1729 /* When storing valid upper BAT, mask BEPI and BRPN
1730 * and invalidate all TLBs covered by this BAT
1731 */
1732 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1733 (value & ~0x0001FFFFUL & ~mask);
1734 env->DBAT[0][nr] = env->IBAT[0][nr];
1735 if (env->IBAT[1][nr] & 0x40) {
1736#if !defined(FLUSH_ALL_TLBS)
1737 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1738#else
1739 do_inval = 1;
1740#endif
1741 }
1742#if defined(FLUSH_ALL_TLBS)
1743 if (do_inval) {
1744 tlb_flush(env, 1);
1745 }
1746#endif
1747 }
1748}
1749
9aa5b158 1750void helper_store_601_batl(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385 1751{
cca48a93 1752#if !defined(FLUSH_ALL_TLBS)
8cbbe385 1753 target_ulong mask;
cca48a93 1754#else
8cbbe385
BS		 1755 int do_inval;
1756#endif
1757
1758 dump_store_bat(env, 'I', 1, nr, value);
1759 if (env->IBAT[1][nr] != value) {
1760#if defined(FLUSH_ALL_TLBS)
1761 do_inval = 0;
1762#endif
1763 if (env->IBAT[1][nr] & 0x40) {
1764#if !defined(FLUSH_ALL_TLBS)
1765 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1766 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1767#else
1768 do_inval = 1;
1769#endif
1770 }
1771 if (value & 0x40) {
1772#if !defined(FLUSH_ALL_TLBS)
1773 mask = (value << 17) & 0x0FFE0000UL;
1774 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1775#else
1776 do_inval = 1;
1777#endif
1778 }
1779 env->IBAT[1][nr] = value;
1780 env->DBAT[1][nr] = value;
1781#if defined(FLUSH_ALL_TLBS)
1782 if (do_inval) {
1783 tlb_flush(env, 1);
1784 }
1785#endif
1786 }
1787}
1788
1789/*****************************************************************************/
1790/* TLB management */
1791void ppc_tlb_invalidate_all(CPUPPCState *env)
1792{
1793 switch (env->mmu_model) {
1794 case POWERPC_MMU_SOFT_6xx:
1795 case POWERPC_MMU_SOFT_74xx:
1796 ppc6xx_tlb_invalidate_all(env);
1797 break;
1798 case POWERPC_MMU_SOFT_4xx:
1799 case POWERPC_MMU_SOFT_4xx_Z:
1800 ppc4xx_tlb_invalidate_all(env);
1801 break;
1802 case POWERPC_MMU_REAL:
1803 cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
1804 break;
1805 case POWERPC_MMU_MPC8xx:
1806 /* XXX: TODO */
1807 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1808 break;
1809 case POWERPC_MMU_BOOKE:
1810 tlb_flush(env, 1);
1811 break;
1812 case POWERPC_MMU_BOOKE206:
1813 booke206_flush_tlb(env, -1, 0);
1814 break;
1815 case POWERPC_MMU_32B:
1816 case POWERPC_MMU_601:
1817#if defined(TARGET_PPC64)
8cbbe385
BS		 1818 case POWERPC_MMU_64B:
1819 case POWERPC_MMU_2_06:
126a7930 1820 case POWERPC_MMU_2_06a:
4656e1f0 1821 case POWERPC_MMU_2_06d:
8cbbe385
BS		 1822#endif /* defined(TARGET_PPC64) */
1823 tlb_flush(env, 1);
1824 break;
1825 default:
1826 /* XXX: TODO */
1827 cpu_abort(env, "Unknown MMU model\n");
1828 break;
1829 }
1830}
1831
1832void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
1833{
1834#if !defined(FLUSH_ALL_TLBS)
1835 addr &= TARGET_PAGE_MASK;
1836 switch (env->mmu_model) {
1837 case POWERPC_MMU_SOFT_6xx:
1838 case POWERPC_MMU_SOFT_74xx:
1839 ppc6xx_tlb_invalidate_virt(env, addr, 0);
1840 if (env->id_tlbs == 1) {
1841 ppc6xx_tlb_invalidate_virt(env, addr, 1);
1842 }
1843 break;
1844 case POWERPC_MMU_SOFT_4xx:
1845 case POWERPC_MMU_SOFT_4xx_Z:
1846 ppc4xx_tlb_invalidate_virt(env, addr, env->spr[SPR_40x_PID]);
1847 break;
1848 case POWERPC_MMU_REAL:
1849 cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
1850 break;
1851 case POWERPC_MMU_MPC8xx:
1852 /* XXX: TODO */
1853 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1854 break;
1855 case POWERPC_MMU_BOOKE:
1856 /* XXX: TODO */
1857 cpu_abort(env, "BookE MMU model is not implemented\n");
1858 break;
1859 case POWERPC_MMU_BOOKE206:
1860 /* XXX: TODO */
1861 cpu_abort(env, "BookE 2.06 MMU model is not implemented\n");
1862 break;
1863 case POWERPC_MMU_32B:
1864 case POWERPC_MMU_601:
1865 /* tlbie invalidate TLBs for all segments */
1866 addr &= ~((target_ulong)-1ULL << 28);
1867 /* XXX: this case should be optimized,
1868 * giving a mask to tlb_flush_page
1869 */
1870 tlb_flush_page(env, addr | (0x0 << 28));
1871 tlb_flush_page(env, addr | (0x1 << 28));
1872 tlb_flush_page(env, addr | (0x2 << 28));
1873 tlb_flush_page(env, addr | (0x3 << 28));
1874 tlb_flush_page(env, addr | (0x4 << 28));
1875 tlb_flush_page(env, addr | (0x5 << 28));
1876 tlb_flush_page(env, addr | (0x6 << 28));
1877 tlb_flush_page(env, addr | (0x7 << 28));
1878 tlb_flush_page(env, addr | (0x8 << 28));
1879 tlb_flush_page(env, addr | (0x9 << 28));
1880 tlb_flush_page(env, addr | (0xA << 28));
1881 tlb_flush_page(env, addr | (0xB << 28));
1882 tlb_flush_page(env, addr | (0xC << 28));
1883 tlb_flush_page(env, addr | (0xD << 28));
1884 tlb_flush_page(env, addr | (0xE << 28));
1885 tlb_flush_page(env, addr | (0xF << 28));
1886 break;
1887#if defined(TARGET_PPC64)
8cbbe385
BS		 1888 case POWERPC_MMU_64B:
1889 case POWERPC_MMU_2_06:
126a7930 1890 case POWERPC_MMU_2_06a:
4656e1f0 1891 case POWERPC_MMU_2_06d:
8cbbe385
BS		 1892 /* tlbie invalidate TLBs for all segments */
1893 /* XXX: given the fact that there are too many segments to invalidate,
1894 * and we still don't have a tlb_flush_mask(env, n, mask) in QEMU,
1895 * we just invalidate all TLBs
1896 */
1897 tlb_flush(env, 1);
1898 break;
1899#endif /* defined(TARGET_PPC64) */
1900 default:
1901 /* XXX: TODO */
1902 cpu_abort(env, "Unknown MMU model\n");
1903 break;
1904 }
1905#else
1906 ppc_tlb_invalidate_all(env);
1907#endif
1908}
1909
1910/*****************************************************************************/
1911/* Special registers manipulation */
8cbbe385
BS		 1912void ppc_store_sdr1(CPUPPCState *env, target_ulong value)
1913{
1914 LOG_MMU("%s: " TARGET_FMT_lx "\n", __func__, value);
1915 if (env->spr[SPR_SDR1] != value) {
1916 env->spr[SPR_SDR1] = value;
1917#if defined(TARGET_PPC64)
1918 if (env->mmu_model & POWERPC_MMU_64) {
1919 target_ulong htabsize = value & SDR_64_HTABSIZE;
1920
1921 if (htabsize > 28) {
1922 fprintf(stderr, "Invalid HTABSIZE 0x" TARGET_FMT_lx
1923 " stored in SDR1\n", htabsize);
1924 htabsize = 28;
1925 }
1926 env->htab_mask = (1ULL << (htabsize + 18)) - 1;
1927 env->htab_base = value & SDR_64_HTABORG;
1928 } else
1929#endif /* defined(TARGET_PPC64) */
1930 {
1931 /* FIXME: Should check for valid HTABMASK values */
1932 env->htab_mask = ((value & SDR_32_HTABMASK) << 16) | 0xFFFF;
1933 env->htab_base = value & SDR_32_HTABORG;
1934 }
1935 tlb_flush(env, 1);
1936 }
1937}
1938
9aa5b158
BS		 1939/* Segment registers load and store */
1940target_ulong helper_load_sr(CPUPPCState *env, target_ulong sr_num)
8cbbe385 1941{
9aa5b158
BS		 1942#if defined(TARGET_PPC64)
1943 if (env->mmu_model & POWERPC_MMU_64) {
1944 /* XXX */
1945 return 0;
1946 }
8cbbe385 1947#endif
9aa5b158
BS		 1948 return env->sr[sr_num];
1949}
8cbbe385 1950
9aa5b158 1951void helper_store_sr(CPUPPCState *env, target_ulong srnum, target_ulong value)
8cbbe385
BS		 1952{
1953 LOG_MMU("%s: reg=%d " TARGET_FMT_lx " " TARGET_FMT_lx "\n", __func__,
9aa5b158 1954 (int)srnum, value, env->sr[srnum]);
8cbbe385
BS		 1955#if defined(TARGET_PPC64)
1956 if (env->mmu_model & POWERPC_MMU_64) {
1957 uint64_t rb = 0, rs = 0;
1958
1959 /* ESID = srnum */
1960 rb |= ((uint32_t)srnum & 0xf) << 28;
1961 /* Set the valid bit */
1962 rb |= 1 << 27;
1963 /* Index = ESID */
1964 rb |= (uint32_t)srnum;
1965
1966 /* VSID = VSID */
1967 rs |= (value & 0xfffffff) << 12;
1968 /* flags = flags */
1969 rs |= ((value >> 27) & 0xf) << 8;
1970
1971 ppc_store_slb(env, rb, rs);
1972 } else
1973#endif
1974 if (env->sr[srnum] != value) {
1975 env->sr[srnum] = value;
1976/* Invalidating 256MB of virtual memory in 4kB pages is way longer than
1977 flusing the whole TLB. */
1978#if !defined(FLUSH_ALL_TLBS) && 0
1979 {
1980 target_ulong page, end;
1981 /* Invalidate 256 MB of virtual memory */
1982 page = (16 << 20) * srnum;
1983 end = page + (16 << 20);
1984 for (; page != end; page += TARGET_PAGE_SIZE) {
1985 tlb_flush_page(env, page);
1986 }
1987 }
1988#else
1989 tlb_flush(env, 1);
1990#endif
1991 }
1992}
8cbbe385 1993
ec19c4d1 1994/* TLB management */
c6c7cf05 1995void helper_tlbia(CPUPPCState *env)
ec19c4d1
BS		 1996{
1997 ppc_tlb_invalidate_all(env);
1998}
1999
c6c7cf05 2000void helper_tlbie(CPUPPCState *env, target_ulong addr)
ec19c4d1
BS		 2001{
2002 ppc_tlb_invalidate_one(env, addr);
2003}
2004
2005/* Software driven TLBs management */
2006/* PowerPC 602/603 software TLB load instructions helpers */
c6c7cf05 2007static void do_6xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
ec19c4d1
BS		 2008{
2009 target_ulong RPN, CMP, EPN;
2010 int way;
2011
2012 RPN = env->spr[SPR_RPA];
2013 if (is_code) {
2014 CMP = env->spr[SPR_ICMP];
2015 EPN = env->spr[SPR_IMISS];
2016 } else {
2017 CMP = env->spr[SPR_DCMP];
2018 EPN = env->spr[SPR_DMISS];
2019 }
2020 way = (env->spr[SPR_SRR1] >> 17) & 1;
2021 (void)EPN; /* avoid a compiler warning */
2022 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2023 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2024 RPN, way);
2025 /* Store this TLB */
2026 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2027 way, is_code, CMP, RPN);
2028}
2029
c6c7cf05 2030void helper_6xx_tlbd(CPUPPCState *env, target_ulong EPN)
ec19c4d1 2031{
c6c7cf05 2032 do_6xx_tlb(env, EPN, 0);
ec19c4d1
BS		 2033}
2034
c6c7cf05 2035void helper_6xx_tlbi(CPUPPCState *env, target_ulong EPN)
ec19c4d1 2036{
c6c7cf05 2037 do_6xx_tlb(env, EPN, 1);
ec19c4d1
BS		 2038}
2039
2040/* PowerPC 74xx software TLB load instructions helpers */
c6c7cf05 2041static void do_74xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
ec19c4d1
BS		 2042{
2043 target_ulong RPN, CMP, EPN;
2044 int way;
2045
2046 RPN = env->spr[SPR_PTELO];
2047 CMP = env->spr[SPR_PTEHI];
2048 EPN = env->spr[SPR_TLBMISS] & ~0x3;
2049 way = env->spr[SPR_TLBMISS] & 0x3;
2050 (void)EPN; /* avoid a compiler warning */
2051 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2052 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2053 RPN, way);
2054 /* Store this TLB */
2055 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2056 way, is_code, CMP, RPN);
2057}
2058
c6c7cf05 2059void helper_74xx_tlbd(CPUPPCState *env, target_ulong EPN)
ec19c4d1 2060{
c6c7cf05 2061 do_74xx_tlb(env, EPN, 0);
ec19c4d1
BS		 2062}
2063
c6c7cf05 2064void helper_74xx_tlbi(CPUPPCState *env, target_ulong EPN)
ec19c4d1 2065{
c6c7cf05 2066 do_74xx_tlb(env, EPN, 1);
ec19c4d1
BS		 2067}
2068
2069/*****************************************************************************/
2070/* PowerPC 601 specific instructions (POWER bridge) */
2071
c6c7cf05 2072target_ulong helper_rac(CPUPPCState *env, target_ulong addr)
ec19c4d1
BS		 2073{
2074 mmu_ctx_t ctx;
2075 int nb_BATs;
2076 target_ulong ret = 0;
2077
2078 /* We don't have to generate many instances of this instruction,
2079 * as rac is supervisor only.
2080 */
2081 /* XXX: FIX THIS: Pretend we have no BAT */
2082 nb_BATs = env->nb_BATs;
2083 env->nb_BATs = 0;
2084 if (get_physical_address(env, &ctx, addr, 0, ACCESS_INT) == 0) {
2085 ret = ctx.raddr;
2086 }
2087 env->nb_BATs = nb_BATs;
2088 return ret;
2089}
2090
2091static inline target_ulong booke_tlb_to_page_size(int size)
2092{
2093 return 1024 << (2 * size);
2094}
2095
2096static inline int booke_page_size_to_tlb(target_ulong page_size)
2097{
2098 int size;
2099
2100 switch (page_size) {
2101 case 0x00000400UL:
2102 size = 0x0;
2103 break;
2104 case 0x00001000UL:
2105 size = 0x1;
2106 break;
2107 case 0x00004000UL:
2108 size = 0x2;
2109 break;
2110 case 0x00010000UL:
2111 size = 0x3;
2112 break;
2113 case 0x00040000UL:
2114 size = 0x4;
2115 break;
2116 case 0x00100000UL:
2117 size = 0x5;
2118 break;
2119 case 0x00400000UL:
2120 size = 0x6;
2121 break;
2122 case 0x01000000UL:
2123 size = 0x7;
2124 break;
2125 case 0x04000000UL:
2126 size = 0x8;
2127 break;
2128 case 0x10000000UL:
2129 size = 0x9;
2130 break;
2131 case 0x40000000UL:
2132 size = 0xA;
2133 break;
2134#if defined(TARGET_PPC64)
2135 case 0x000100000000ULL:
2136 size = 0xB;
2137 break;
2138 case 0x000400000000ULL:
2139 size = 0xC;
2140 break;
2141 case 0x001000000000ULL:
2142 size = 0xD;
2143 break;
2144 case 0x004000000000ULL:
2145 size = 0xE;
2146 break;
2147 case 0x010000000000ULL:
2148 size = 0xF;
2149 break;
2150#endif
2151 default:
2152 size = -1;
2153 break;
2154 }
2155
2156 return size;
2157}
2158
2159/* Helpers for 4xx TLB management */
2160#define PPC4XX_TLB_ENTRY_MASK 0x0000003f /* Mask for 64 TLB entries */
2161
2162#define PPC4XX_TLBHI_V 0x00000040
2163#define PPC4XX_TLBHI_E 0x00000020
2164#define PPC4XX_TLBHI_SIZE_MIN 0
2165#define PPC4XX_TLBHI_SIZE_MAX 7
2166#define PPC4XX_TLBHI_SIZE_DEFAULT 1
2167#define PPC4XX_TLBHI_SIZE_SHIFT 7
2168#define PPC4XX_TLBHI_SIZE_MASK 0x00000007
2169
2170#define PPC4XX_TLBLO_EX 0x00000200
2171#define PPC4XX_TLBLO_WR 0x00000100
2172#define PPC4XX_TLBLO_ATTR_MASK 0x000000FF
2173#define PPC4XX_TLBLO_RPN_MASK 0xFFFFFC00
2174
c6c7cf05 2175target_ulong helper_4xx_tlbre_hi(CPUPPCState *env, target_ulong entry)
ec19c4d1
BS		 2176{
2177 ppcemb_tlb_t *tlb;
2178 target_ulong ret;
2179 int size;
2180
2181 entry &= PPC4XX_TLB_ENTRY_MASK;
2182 tlb = &env->tlb.tlbe[entry];
2183 ret = tlb->EPN;
2184 if (tlb->prot & PAGE_VALID) {
2185 ret |= PPC4XX_TLBHI_V;
2186 }
2187 size = booke_page_size_to_tlb(tlb->size);
2188 if (size < PPC4XX_TLBHI_SIZE_MIN || size > PPC4XX_TLBHI_SIZE_MAX) {
2189 size = PPC4XX_TLBHI_SIZE_DEFAULT;
2190 }
2191 ret |= size << PPC4XX_TLBHI_SIZE_SHIFT;
2192 env->spr[SPR_40x_PID] = tlb->PID;
2193 return ret;
2194}
2195
c6c7cf05 2196target_ulong helper_4xx_tlbre_lo(CPUPPCState *env, target_ulong entry)
ec19c4d1
BS		 2197{
2198 ppcemb_tlb_t *tlb;
2199 target_ulong ret;
2200
2201 entry &= PPC4XX_TLB_ENTRY_MASK;
2202 tlb = &env->tlb.tlbe[entry];
2203 ret = tlb->RPN;
2204 if (tlb->prot & PAGE_EXEC) {
2205 ret |= PPC4XX_TLBLO_EX;
2206 }
2207 if (tlb->prot & PAGE_WRITE) {
2208 ret |= PPC4XX_TLBLO_WR;
2209 }
2210 return ret;
2211}
2212
c6c7cf05
BS		 2213void helper_4xx_tlbwe_hi(CPUPPCState *env, target_ulong entry,
2214 target_ulong val)
ec19c4d1
BS		 2215{
2216 ppcemb_tlb_t *tlb;
2217 target_ulong page, end;
2218
2219 LOG_SWTLB("%s entry %d val " TARGET_FMT_lx "\n", __func__, (int)entry,
2220 val);
2221 entry &= PPC4XX_TLB_ENTRY_MASK;
2222 tlb = &env->tlb.tlbe[entry];
2223 /* Invalidate previous TLB (if it's valid) */
2224 if (tlb->prot & PAGE_VALID) {
2225 end = tlb->EPN + tlb->size;
2226 LOG_SWTLB("%s: invalidate old TLB %d start " TARGET_FMT_lx " end "
2227 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2228 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
2229 tlb_flush_page(env, page);
2230 }
2231 }
2232 tlb->size = booke_tlb_to_page_size((val >> PPC4XX_TLBHI_SIZE_SHIFT)
2233 & PPC4XX_TLBHI_SIZE_MASK);
2234 /* We cannot handle TLB size < TARGET_PAGE_SIZE.
2235 * If this ever occurs, one should use the ppcemb target instead
2236 * of the ppc or ppc64 one
2237 */
2238 if ((val & PPC4XX_TLBHI_V) && tlb->size < TARGET_PAGE_SIZE) {
2239 cpu_abort(env, "TLB size " TARGET_FMT_lu " < %u "
2240 "are not supported (%d)\n",
2241 tlb->size, TARGET_PAGE_SIZE, (int)((val >> 7) & 0x7));
2242 }
2243 tlb->EPN = val & ~(tlb->size - 1);
2244 if (val & PPC4XX_TLBHI_V) {
2245 tlb->prot |= PAGE_VALID;
2246 if (val & PPC4XX_TLBHI_E) {
2247 /* XXX: TO BE FIXED */
2248 cpu_abort(env,
2249 "Little-endian TLB entries are not supported by now\n");
2250 }
2251 } else {
2252 tlb->prot &= ~PAGE_VALID;
2253 }
2254 tlb->PID = env->spr[SPR_40x_PID]; /* PID */
2255 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2256 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2257 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2258 tlb->prot & PAGE_READ ? 'r' : '-',
2259 tlb->prot & PAGE_WRITE ? 'w' : '-',
2260 tlb->prot & PAGE_EXEC ? 'x' : '-',
2261 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2262 /* Invalidate new TLB (if valid) */
2263 if (tlb->prot & PAGE_VALID) {
2264 end = tlb->EPN + tlb->size;
2265 LOG_SWTLB("%s: invalidate TLB %d start " TARGET_FMT_lx " end "
2266 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2267 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
2268 tlb_flush_page(env, page);
2269 }
2270 }
2271}
2272
c6c7cf05
BS		 2273void helper_4xx_tlbwe_lo(CPUPPCState *env, target_ulong entry,
2274 target_ulong val)
ec19c4d1
BS		 2275{
2276 ppcemb_tlb_t *tlb;
2277
2278 LOG_SWTLB("%s entry %i val " TARGET_FMT_lx "\n", __func__, (int)entry,
2279 val);
2280 entry &= PPC4XX_TLB_ENTRY_MASK;
2281 tlb = &env->tlb.tlbe[entry];
2282 tlb->attr = val & PPC4XX_TLBLO_ATTR_MASK;
2283 tlb->RPN = val & PPC4XX_TLBLO_RPN_MASK;
2284 tlb->prot = PAGE_READ;
2285 if (val & PPC4XX_TLBLO_EX) {
2286 tlb->prot |= PAGE_EXEC;
2287 }
2288 if (val & PPC4XX_TLBLO_WR) {
2289 tlb->prot |= PAGE_WRITE;
2290 }
2291 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2292 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2293 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2294 tlb->prot & PAGE_READ ? 'r' : '-',
2295 tlb->prot & PAGE_WRITE ? 'w' : '-',
2296 tlb->prot & PAGE_EXEC ? 'x' : '-',
2297 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2298}
2299
c6c7cf05 2300target_ulong helper_4xx_tlbsx(CPUPPCState *env, target_ulong address)
ec19c4d1
BS		 2301{
2302 return ppcemb_tlb_search(env, address, env->spr[SPR_40x_PID]);
2303}
2304
2305/* PowerPC 440 TLB management */
c6c7cf05
BS		 2306void helper_440_tlbwe(CPUPPCState *env, uint32_t word, target_ulong entry,
2307 target_ulong value)
ec19c4d1
BS		 2308{
2309 ppcemb_tlb_t *tlb;
2310 target_ulong EPN, RPN, size;
2311 int do_flush_tlbs;
2312
2313 LOG_SWTLB("%s word %d entry %d value " TARGET_FMT_lx "\n",
2314 __func__, word, (int)entry, value);
2315 do_flush_tlbs = 0;
2316 entry &= 0x3F;
2317 tlb = &env->tlb.tlbe[entry];
2318 switch (word) {
2319 default:
2320 /* Just here to please gcc */
2321 case 0:
2322 EPN = value & 0xFFFFFC00;
2323 if ((tlb->prot & PAGE_VALID) && EPN != tlb->EPN) {
2324 do_flush_tlbs = 1;
2325 }
2326 tlb->EPN = EPN;
2327 size = booke_tlb_to_page_size((value >> 4) & 0xF);
2328 if ((tlb->prot & PAGE_VALID) && tlb->size < size) {
2329 do_flush_tlbs = 1;
2330 }
2331 tlb->size = size;
2332 tlb->attr &= ~0x1;
2333 tlb->attr |= (value >> 8) & 1;
2334 if (value & 0x200) {
2335 tlb->prot |= PAGE_VALID;
2336 } else {
2337 if (tlb->prot & PAGE_VALID) {
2338 tlb->prot &= ~PAGE_VALID;
2339 do_flush_tlbs = 1;
2340 }
2341 }
2342 tlb->PID = env->spr[SPR_440_MMUCR] & 0x000000FF;
2343 if (do_flush_tlbs) {
2344 tlb_flush(env, 1);
2345 }
2346 break;
2347 case 1:
2348 RPN = value & 0xFFFFFC0F;
2349 if ((tlb->prot & PAGE_VALID) && tlb->RPN != RPN) {
2350 tlb_flush(env, 1);
2351 }
2352 tlb->RPN = RPN;
2353 break;
2354 case 2:
2355 tlb->attr = (tlb->attr & 0x1) | (value & 0x0000FF00);
2356 tlb->prot = tlb->prot & PAGE_VALID;
2357 if (value & 0x1) {
2358 tlb->prot |= PAGE_READ << 4;
2359 }
2360 if (value & 0x2) {
2361 tlb->prot |= PAGE_WRITE << 4;
2362 }
2363 if (value & 0x4) {
2364 tlb->prot |= PAGE_EXEC << 4;
2365 }
2366 if (value & 0x8) {
2367 tlb->prot |= PAGE_READ;
2368 }
2369 if (value & 0x10) {
2370 tlb->prot |= PAGE_WRITE;
2371 }
2372 if (value & 0x20) {
2373 tlb->prot |= PAGE_EXEC;
2374 }
2375 break;
2376 }
2377}
2378
c6c7cf05
BS		 2379target_ulong helper_440_tlbre(CPUPPCState *env, uint32_t word,
2380 target_ulong entry)
ec19c4d1
BS		 2381{
2382 ppcemb_tlb_t *tlb;
2383 target_ulong ret;
2384 int size;
2385
2386 entry &= 0x3F;
2387 tlb = &env->tlb.tlbe[entry];
2388 switch (word) {
2389 default:
2390 /* Just here to please gcc */
2391 case 0:
2392 ret = tlb->EPN;
2393 size = booke_page_size_to_tlb(tlb->size);
2394 if (size < 0 || size > 0xF) {
2395 size = 1;
2396 }
2397 ret |= size << 4;
2398 if (tlb->attr & 0x1) {
2399 ret |= 0x100;
2400 }
2401 if (tlb->prot & PAGE_VALID) {
2402 ret |= 0x200;
2403 }
2404 env->spr[SPR_440_MMUCR] &= ~0x000000FF;
2405 env->spr[SPR_440_MMUCR] |= tlb->PID;
2406 break;
2407 case 1:
2408 ret = tlb->RPN;
2409 break;
2410 case 2:
2411 ret = tlb->attr & ~0x1;
2412 if (tlb->prot & (PAGE_READ << 4)) {
2413 ret |= 0x1;
2414 }
2415 if (tlb->prot & (PAGE_WRITE << 4)) {
2416 ret |= 0x2;
2417 }
2418 if (tlb->prot & (PAGE_EXEC << 4)) {
2419 ret |= 0x4;
2420 }
2421 if (tlb->prot & PAGE_READ) {
2422 ret |= 0x8;
2423 }
2424 if (tlb->prot & PAGE_WRITE) {
2425 ret |= 0x10;
2426 }
2427 if (tlb->prot & PAGE_EXEC) {
2428 ret |= 0x20;
2429 }
2430 break;
2431 }
2432 return ret;
2433}
2434
c6c7cf05 2435target_ulong helper_440_tlbsx(CPUPPCState *env, target_ulong address)
ec19c4d1
BS		 2436{
2437 return ppcemb_tlb_search(env, address, env->spr[SPR_440_MMUCR] & 0xFF);
2438}
2439
2440/* PowerPC BookE 2.06 TLB management */
2441
2442static ppcmas_tlb_t *booke206_cur_tlb(CPUPPCState *env)
2443{
2444 uint32_t tlbncfg = 0;
2445 int esel = (env->spr[SPR_BOOKE_MAS0] & MAS0_ESEL_MASK) >> MAS0_ESEL_SHIFT;
2446 int ea = (env->spr[SPR_BOOKE_MAS2] & MAS2_EPN_MASK);
2447 int tlb;
2448
2449 tlb = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2450 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlb];
2451
2452 if ((tlbncfg & TLBnCFG_HES) && (env->spr[SPR_BOOKE_MAS0] & MAS0_HES)) {
2453 cpu_abort(env, "we don't support HES yet\n");
2454 }
2455
2456 return booke206_get_tlbm(env, tlb, ea, esel);
2457}
2458
c6c7cf05 2459void helper_booke_setpid(CPUPPCState *env, uint32_t pidn, target_ulong pid)
ec19c4d1
BS		 2460{
2461 env->spr[pidn] = pid;
2462 /* changing PIDs mean we're in a different address space now */
2463 tlb_flush(env, 1);
2464}
2465
c6c7cf05 2466void helper_booke206_tlbwe(CPUPPCState *env)
ec19c4d1
BS		 2467{
2468 uint32_t tlbncfg, tlbn;
2469 ppcmas_tlb_t *tlb;
2470 uint32_t size_tlb, size_ps;
77c2cf33
FC		 2471 target_ulong mask;
2472
ec19c4d1
BS		 2473
2474 switch (env->spr[SPR_BOOKE_MAS0] & MAS0_WQ_MASK) {
2475 case MAS0_WQ_ALWAYS:
2476 /* good to go, write that entry */
2477 break;
2478 case MAS0_WQ_COND:
2479 /* XXX check if reserved */
2480 if (0) {
2481 return;
2482 }
2483 break;
2484 case MAS0_WQ_CLR_RSRV:
2485 /* XXX clear entry */
2486 return;
2487 default:
2488 /* no idea what to do */
2489 return;
2490 }
2491
2492 if (((env->spr[SPR_BOOKE_MAS0] & MAS0_ATSEL) == MAS0_ATSEL_LRAT) &&
2493 !msr_gs) {
2494 /* XXX we don't support direct LRAT setting yet */
2495 fprintf(stderr, "cpu: don't support LRAT setting yet\n");
2496 return;
2497 }
2498
2499 tlbn = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2500 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlbn];
2501
2502 tlb = booke206_cur_tlb(env);
2503
2504 if (!tlb) {
2505 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
2506 POWERPC_EXCP_INVAL |
2507 POWERPC_EXCP_INVAL_INVAL);
2508 }
2509
2510 /* check that we support the targeted size */
2511 size_tlb = (env->spr[SPR_BOOKE_MAS1] & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
2512 size_ps = booke206_tlbnps(env, tlbn);
2513 if ((env->spr[SPR_BOOKE_MAS1] & MAS1_VALID) && (tlbncfg & TLBnCFG_AVAIL) &&
2514 !(size_ps & (1 << size_tlb))) {
2515 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
2516 POWERPC_EXCP_INVAL |
2517 POWERPC_EXCP_INVAL_INVAL);
2518 }
2519
2520 if (msr_gs) {
2521 cpu_abort(env, "missing HV implementation\n");
2522 }
2523 tlb->mas7_3 = ((uint64_t)env->spr[SPR_BOOKE_MAS7] << 32) |
2524 env->spr[SPR_BOOKE_MAS3];
2525 tlb->mas1 = env->spr[SPR_BOOKE_MAS1];
2526
2527 /* MAV 1.0 only */
2528 if (!(tlbncfg & TLBnCFG_AVAIL)) {
2529 /* force !AVAIL TLB entries to correct page size */
2530 tlb->mas1 &= ~MAS1_TSIZE_MASK;
2531 /* XXX can be configured in MMUCSR0 */
2532 tlb->mas1 |= (tlbncfg & TLBnCFG_MINSIZE) >> 12;
2533 }
2534
77c2cf33
FC		 2535 /* Make a mask from TLB size to discard invalid bits in EPN field */
2536 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2537 /* Add a mask for page attributes */
2538 mask |= MAS2_ACM | MAS2_VLE | MAS2_W | MAS2_I | MAS2_M | MAS2_G | MAS2_E;
2539
2540 if (!msr_cm) {
2541 /* Executing a tlbwe instruction in 32-bit mode will set
2542 * bits 0:31 of the TLB EPN field to zero.
2543 */
2544 mask &= 0xffffffff;
2545 }
2546
2547 tlb->mas2 = env->spr[SPR_BOOKE_MAS2] & mask;
ec19c4d1
BS		 2548
2549 if (!(tlbncfg & TLBnCFG_IPROT)) {
2550 /* no IPROT supported by TLB */
2551 tlb->mas1 &= ~MAS1_IPROT;
2552 }
2553
2554 if (booke206_tlb_to_page_size(env, tlb) == TARGET_PAGE_SIZE) {
2555 tlb_flush_page(env, tlb->mas2 & MAS2_EPN_MASK);
2556 } else {
2557 tlb_flush(env, 1);
2558 }
2559}
2560
2561static inline void booke206_tlb_to_mas(CPUPPCState *env, ppcmas_tlb_t *tlb)
2562{
2563 int tlbn = booke206_tlbm_to_tlbn(env, tlb);
2564 int way = booke206_tlbm_to_way(env, tlb);
2565
2566 env->spr[SPR_BOOKE_MAS0] = tlbn << MAS0_TLBSEL_SHIFT;
2567 env->spr[SPR_BOOKE_MAS0] |= way << MAS0_ESEL_SHIFT;
2568 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2569
2570 env->spr[SPR_BOOKE_MAS1] = tlb->mas1;
2571 env->spr[SPR_BOOKE_MAS2] = tlb->mas2;
2572 env->spr[SPR_BOOKE_MAS3] = tlb->mas7_3;
2573 env->spr[SPR_BOOKE_MAS7] = tlb->mas7_3 >> 32;
2574}
2575
c6c7cf05 2576void helper_booke206_tlbre(CPUPPCState *env)
ec19c4d1
BS		 2577{
2578 ppcmas_tlb_t *tlb = NULL;
2579
2580 tlb = booke206_cur_tlb(env);
2581 if (!tlb) {
2582 env->spr[SPR_BOOKE_MAS1] = 0;
2583 } else {
2584 booke206_tlb_to_mas(env, tlb);
2585 }
2586}
2587
c6c7cf05 2588void helper_booke206_tlbsx(CPUPPCState *env, target_ulong address)
ec19c4d1
BS		 2589{
2590 ppcmas_tlb_t *tlb = NULL;
2591 int i, j;
a8170e5e 2592 hwaddr raddr;
ec19c4d1
BS		 2593 uint32_t spid, sas;
2594
2595 spid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID_MASK) >> MAS6_SPID_SHIFT;
2596 sas = env->spr[SPR_BOOKE_MAS6] & MAS6_SAS;
2597
2598 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2599 int ways = booke206_tlb_ways(env, i);
2600
2601 for (j = 0; j < ways; j++) {
2602 tlb = booke206_get_tlbm(env, i, address, j);
2603
2604 if (!tlb) {
2605 continue;
2606 }
2607
2608 if (ppcmas_tlb_check(env, tlb, &raddr, address, spid)) {
2609 continue;
2610 }
2611
2612 if (sas != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
2613 continue;
2614 }
2615
2616 booke206_tlb_to_mas(env, tlb);
2617 return;
2618 }
2619 }
2620
2621 /* no entry found, fill with defaults */
2622 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
2623 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
2624 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
2625 env->spr[SPR_BOOKE_MAS3] = 0;
2626 env->spr[SPR_BOOKE_MAS7] = 0;
2627
2628 if (env->spr[SPR_BOOKE_MAS6] & MAS6_SAS) {
2629 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
2630 }
2631
2632 env->spr[SPR_BOOKE_MAS1] |= (env->spr[SPR_BOOKE_MAS6] >> 16)
2633 << MAS1_TID_SHIFT;
2634
2635 /* next victim logic */
2636 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
2637 env->last_way++;
2638 env->last_way &= booke206_tlb_ways(env, 0) - 1;
2639 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2640}
2641
2642static inline void booke206_invalidate_ea_tlb(CPUPPCState *env, int tlbn,
2643 uint32_t ea)
2644{
2645 int i;
2646 int ways = booke206_tlb_ways(env, tlbn);
2647 target_ulong mask;
2648
2649 for (i = 0; i < ways; i++) {
2650 ppcmas_tlb_t *tlb = booke206_get_tlbm(env, tlbn, ea, i);
2651 if (!tlb) {
2652 continue;
2653 }
2654 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2655 if (((tlb->mas2 & MAS2_EPN_MASK) == (ea & mask)) &&
2656 !(tlb->mas1 & MAS1_IPROT)) {
2657 tlb->mas1 &= ~MAS1_VALID;
2658 }
2659 }
2660}
2661
c6c7cf05 2662void helper_booke206_tlbivax(CPUPPCState *env, target_ulong address)
ec19c4d1
BS		 2663{
2664 if (address & 0x4) {
2665 /* flush all entries */
2666 if (address & 0x8) {
2667 /* flush all of TLB1 */
2668 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB1, 1);
2669 } else {
2670 /* flush all of TLB0 */
2671 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB0, 0);
2672 }
2673 return;
2674 }
2675
2676 if (address & 0x8) {
2677 /* flush TLB1 entries */
2678 booke206_invalidate_ea_tlb(env, 1, address);
2679 tlb_flush(env, 1);
2680 } else {
2681 /* flush TLB0 entries */
2682 booke206_invalidate_ea_tlb(env, 0, address);
2683 tlb_flush_page(env, address & MAS2_EPN_MASK);
2684 }
2685}
2686
c6c7cf05 2687void helper_booke206_tlbilx0(CPUPPCState *env, target_ulong address)
ec19c4d1
BS		 2688{
2689 /* XXX missing LPID handling */
2690 booke206_flush_tlb(env, -1, 1);
2691}
2692
c6c7cf05 2693void helper_booke206_tlbilx1(CPUPPCState *env, target_ulong address)
ec19c4d1
BS		 2694{
2695 int i, j;
2696 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
2697 ppcmas_tlb_t *tlb = env->tlb.tlbm;
2698 int tlb_size;
2699
2700 /* XXX missing LPID handling */
2701 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2702 tlb_size = booke206_tlb_size(env, i);
2703 for (j = 0; j < tlb_size; j++) {
2704 if (!(tlb[j].mas1 & MAS1_IPROT) &&
2705 ((tlb[j].mas1 & MAS1_TID_MASK) == tid)) {
2706 tlb[j].mas1 &= ~MAS1_VALID;
2707 }
2708 }
2709 tlb += booke206_tlb_size(env, i);
2710 }
2711 tlb_flush(env, 1);
2712}
2713
c6c7cf05 2714void helper_booke206_tlbilx3(CPUPPCState *env, target_ulong address)
ec19c4d1
BS		 2715{
2716 int i, j;
2717 ppcmas_tlb_t *tlb;
2718 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
2719 int pid = tid >> MAS6_SPID_SHIFT;
2720 int sgs = env->spr[SPR_BOOKE_MAS5] & MAS5_SGS;
2721 int ind = (env->spr[SPR_BOOKE_MAS6] & MAS6_SIND) ? MAS1_IND : 0;
2722 /* XXX check for unsupported isize and raise an invalid opcode then */
2723 int size = env->spr[SPR_BOOKE_MAS6] & MAS6_ISIZE_MASK;
2724 /* XXX implement MAV2 handling */
2725 bool mav2 = false;
2726
2727 /* XXX missing LPID handling */
2728 /* flush by pid and ea */
2729 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2730 int ways = booke206_tlb_ways(env, i);
2731
2732 for (j = 0; j < ways; j++) {
2733 tlb = booke206_get_tlbm(env, i, address, j);
2734 if (!tlb) {
2735 continue;
2736 }
2737 if ((ppcmas_tlb_check(env, tlb, NULL, address, pid) != 0) ||
2738 (tlb->mas1 & MAS1_IPROT) ||
2739 ((tlb->mas1 & MAS1_IND) != ind) ||
2740 ((tlb->mas8 & MAS8_TGS) != sgs)) {
2741 continue;
2742 }
2743 if (mav2 && ((tlb->mas1 & MAS1_TSIZE_MASK) != size)) {
2744 /* XXX only check when MMUCFG[TWC] || TLBnCFG[HES] */
2745 continue;
2746 }
2747 /* XXX e500mc doesn't match SAS, but other cores might */
2748 tlb->mas1 &= ~MAS1_VALID;
2749 }
2750 }
2751 tlb_flush(env, 1);
2752}
2753
c6c7cf05 2754void helper_booke206_tlbflush(CPUPPCState *env, uint32_t type)
ec19c4d1
BS		 2755{
2756 int flags = 0;
2757
2758 if (type & 2) {
2759 flags |= BOOKE206_FLUSH_TLB1;
2760 }
2761
2762 if (type & 4) {
2763 flags |= BOOKE206_FLUSH_TLB0;
2764 }
2765
2766 booke206_flush_tlb(env, flags, 1);
2767}
eb20c1c6
DG		 2768
2769
2770/*****************************************************************************/
2771
2772#define MMUSUFFIX _mmu
2773
2774#define SHIFT 0
2775#include "exec/softmmu_template.h"
2776
2777#define SHIFT 1
2778#include "exec/softmmu_template.h"
2779
2780#define SHIFT 2
2781#include "exec/softmmu_template.h"
2782
2783#define SHIFT 3
2784#include "exec/softmmu_template.h"
2785
2786/* try to fill the TLB and return an exception if error. If retaddr is
2787 NULL, it means that the function was called in C code (i.e. not
2788 from generated code or from helper.c) */
2789/* XXX: fix it to restore all registers */
2790void tlb_fill(CPUPPCState *env, target_ulong addr, int is_write, int mmu_idx,
2791 uintptr_t retaddr)
2792{
b632a148
DG		 2793 CPUState *cpu = ENV_GET_CPU(env);
2794 PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
eb20c1c6
DG		 2795 int ret;
2796
b632a148
DG		 2797 if (pcc->handle_mmu_fault) {
2798 ret = pcc->handle_mmu_fault(env, addr, is_write, mmu_idx);
2799 } else {
2800 ret = cpu_ppc_handle_mmu_fault(env, addr, is_write, mmu_idx);
2801 }
eb20c1c6
DG		 2802 if (unlikely(ret != 0)) {
2803 if (likely(retaddr)) {
2804 /* now we have a real cpu fault */
2805 cpu_restore_state(env, retaddr);
2806 }
2807 helper_raise_exception_err(env, env->exception_index, env->error_code);
2808 }
2809}
Qemu copy for testing