2 * MIPS emulation helpers for qemu.
4 * Copyright (c) 2004-2005 Jocelyn Mayer
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
27 #include "sysemu/kvm.h"
39 #if !defined(CONFIG_USER_ONLY)
41 /* no MMU emulation */
42 int no_mmu_map_address (CPUMIPSState
*env
, hwaddr
*physical
, int *prot
,
43 target_ulong address
, int rw
, int access_type
)
46 *prot
= PAGE_READ
| PAGE_WRITE
;
50 /* fixed mapping MMU emulation */
51 int fixed_mmu_map_address (CPUMIPSState
*env
, hwaddr
*physical
, int *prot
,
52 target_ulong address
, int rw
, int access_type
)
54 if (address
<= (int32_t)0x7FFFFFFFUL
) {
55 if (!(env
->CP0_Status
& (1 << CP0St_ERL
)))
56 *physical
= address
+ 0x40000000UL
;
59 } else if (address
<= (int32_t)0xBFFFFFFFUL
)
60 *physical
= address
& 0x1FFFFFFF;
64 *prot
= PAGE_READ
| PAGE_WRITE
;
68 /* MIPS32/MIPS64 R4000-style MMU emulation */
69 int r4k_map_address (CPUMIPSState
*env
, hwaddr
*physical
, int *prot
,
70 target_ulong address
, int rw
, int access_type
)
72 uint8_t ASID
= env
->CP0_EntryHi
& 0xFF;
75 for (i
= 0; i
< env
->tlb
->tlb_in_use
; i
++) {
76 r4k_tlb_t
*tlb
= &env
->tlb
->mmu
.r4k
.tlb
[i
];
77 /* 1k pages are not supported. */
78 target_ulong mask
= tlb
->PageMask
| ~(TARGET_PAGE_MASK
<< 1);
79 target_ulong tag
= address
& ~mask
;
80 target_ulong VPN
= tlb
->VPN
& ~mask
;
81 #if defined(TARGET_MIPS64)
85 /* Check ASID, virtual page number & size */
86 if ((tlb
->G
== 1 || tlb
->ASID
== ASID
) && VPN
== tag
&& !tlb
->EHINV
) {
88 int n
= !!(address
& mask
& ~(mask
>> 1));
89 /* Check access rights */
90 if (!(n
? tlb
->V1
: tlb
->V0
)) {
91 return TLBRET_INVALID
;
93 if (rw
== MMU_INST_FETCH
&& (n
? tlb
->XI1
: tlb
->XI0
)) {
96 if (rw
== MMU_DATA_LOAD
&& (n
? tlb
->RI1
: tlb
->RI0
)) {
99 if (rw
!= MMU_DATA_STORE
|| (n
? tlb
->D1
: tlb
->D0
)) {
100 *physical
= tlb
->PFN
[n
] | (address
& (mask
>> 1));
102 if (n
? tlb
->D1
: tlb
->D0
)
109 return TLBRET_NOMATCH
;
112 static int get_physical_address (CPUMIPSState
*env
, hwaddr
*physical
,
113 int *prot
, target_ulong real_address
,
114 int rw
, int access_type
)
116 /* User mode can only access useg/xuseg */
117 int user_mode
= (env
->hflags
& MIPS_HFLAG_MODE
) == MIPS_HFLAG_UM
;
118 int supervisor_mode
= (env
->hflags
& MIPS_HFLAG_MODE
) == MIPS_HFLAG_SM
;
119 int kernel_mode
= !user_mode
&& !supervisor_mode
;
120 #if defined(TARGET_MIPS64)
121 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
122 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
123 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
125 int ret
= TLBRET_MATCH
;
126 /* effective address (modified for KVM T&E kernel segments) */
127 target_ulong address
= real_address
;
130 qemu_log("user mode %d h %08x\n", user_mode
, env
->hflags
);
133 #define USEG_LIMIT 0x7FFFFFFFUL
134 #define KSEG0_BASE 0x80000000UL
135 #define KSEG1_BASE 0xA0000000UL
136 #define KSEG2_BASE 0xC0000000UL
137 #define KSEG3_BASE 0xE0000000UL
139 #define KVM_KSEG0_BASE 0x40000000UL
140 #define KVM_KSEG2_BASE 0x60000000UL
143 /* KVM T&E adds guest kernel segments in useg */
144 if (real_address
>= KVM_KSEG0_BASE
) {
145 if (real_address
< KVM_KSEG2_BASE
) {
147 address
+= KSEG0_BASE
- KVM_KSEG0_BASE
;
148 } else if (real_address
<= USEG_LIMIT
) {
150 address
+= KSEG2_BASE
- KVM_KSEG2_BASE
;
155 if (address
<= USEG_LIMIT
) {
157 if (env
->CP0_Status
& (1 << CP0St_ERL
)) {
158 *physical
= address
& 0xFFFFFFFF;
159 *prot
= PAGE_READ
| PAGE_WRITE
;
161 ret
= env
->tlb
->map_address(env
, physical
, prot
, real_address
, rw
, access_type
);
163 #if defined(TARGET_MIPS64)
164 } else if (address
< 0x4000000000000000ULL
) {
166 if (UX
&& address
<= (0x3FFFFFFFFFFFFFFFULL
& env
->SEGMask
)) {
167 ret
= env
->tlb
->map_address(env
, physical
, prot
, real_address
, rw
, access_type
);
169 ret
= TLBRET_BADADDR
;
171 } else if (address
< 0x8000000000000000ULL
) {
173 if ((supervisor_mode
|| kernel_mode
) &&
174 SX
&& address
<= (0x7FFFFFFFFFFFFFFFULL
& env
->SEGMask
)) {
175 ret
= env
->tlb
->map_address(env
, physical
, prot
, real_address
, rw
, access_type
);
177 ret
= TLBRET_BADADDR
;
179 } else if (address
< 0xC000000000000000ULL
) {
181 if (kernel_mode
&& KX
&&
182 (address
& 0x07FFFFFFFFFFFFFFULL
) <= env
->PAMask
) {
183 *physical
= address
& env
->PAMask
;
184 *prot
= PAGE_READ
| PAGE_WRITE
;
186 ret
= TLBRET_BADADDR
;
188 } else if (address
< 0xFFFFFFFF80000000ULL
) {
190 if (kernel_mode
&& KX
&&
191 address
<= (0xFFFFFFFF7FFFFFFFULL
& env
->SEGMask
)) {
192 ret
= env
->tlb
->map_address(env
, physical
, prot
, real_address
, rw
, access_type
);
194 ret
= TLBRET_BADADDR
;
197 } else if (address
< (int32_t)KSEG1_BASE
) {
200 *physical
= address
- (int32_t)KSEG0_BASE
;
201 *prot
= PAGE_READ
| PAGE_WRITE
;
203 ret
= TLBRET_BADADDR
;
205 } else if (address
< (int32_t)KSEG2_BASE
) {
208 *physical
= address
- (int32_t)KSEG1_BASE
;
209 *prot
= PAGE_READ
| PAGE_WRITE
;
211 ret
= TLBRET_BADADDR
;
213 } else if (address
< (int32_t)KSEG3_BASE
) {
215 if (supervisor_mode
|| kernel_mode
) {
216 ret
= env
->tlb
->map_address(env
, physical
, prot
, real_address
, rw
, access_type
);
218 ret
= TLBRET_BADADDR
;
222 /* XXX: debug segment is not emulated */
224 ret
= env
->tlb
->map_address(env
, physical
, prot
, real_address
, rw
, access_type
);
226 ret
= TLBRET_BADADDR
;
230 qemu_log(TARGET_FMT_lx
" %d %d => %" HWADDR_PRIx
" %d (%d)\n",
231 address
, rw
, access_type
, *physical
, *prot
, ret
);
238 static void raise_mmu_exception(CPUMIPSState
*env
, target_ulong address
,
239 int rw
, int tlb_error
)
241 CPUState
*cs
= CPU(mips_env_get_cpu(env
));
242 int exception
= 0, error_code
= 0;
247 /* Reference to kernel address from user mode or supervisor mode */
248 /* Reference to supervisor address from user mode */
249 if (rw
== MMU_DATA_STORE
) {
250 exception
= EXCP_AdES
;
252 exception
= EXCP_AdEL
;
256 /* No TLB match for a mapped address */
257 if (rw
== MMU_DATA_STORE
) {
258 exception
= EXCP_TLBS
;
260 exception
= EXCP_TLBL
;
265 /* TLB match with no valid bit */
266 if (rw
== MMU_DATA_STORE
) {
267 exception
= EXCP_TLBS
;
269 exception
= EXCP_TLBL
;
273 /* TLB match but 'D' bit is cleared */
274 exception
= EXCP_LTLBL
;
277 /* Execute-Inhibit Exception */
278 if (env
->CP0_PageGrain
& (1 << CP0PG_IEC
)) {
279 exception
= EXCP_TLBXI
;
281 exception
= EXCP_TLBL
;
285 /* Read-Inhibit Exception */
286 if (env
->CP0_PageGrain
& (1 << CP0PG_IEC
)) {
287 exception
= EXCP_TLBRI
;
289 exception
= EXCP_TLBL
;
293 /* Raise exception */
294 env
->CP0_BadVAddr
= address
;
295 env
->CP0_Context
= (env
->CP0_Context
& ~0x007fffff) |
296 ((address
>> 9) & 0x007ffff0);
298 (env
->CP0_EntryHi
& 0xFF) | (address
& (TARGET_PAGE_MASK
<< 1));
299 #if defined(TARGET_MIPS64)
300 env
->CP0_EntryHi
&= env
->SEGMask
;
301 env
->CP0_XContext
= (env
->CP0_XContext
& ((~0ULL) << (env
->SEGBITS
- 7))) |
302 ((address
& 0xC00000000000ULL
) >> (55 - env
->SEGBITS
)) |
303 ((address
& ((1ULL << env
->SEGBITS
) - 1) & 0xFFFFFFFFFFFFE000ULL
) >> 9);
305 cs
->exception_index
= exception
;
306 env
->error_code
= error_code
;
309 #if !defined(CONFIG_USER_ONLY)
310 hwaddr
mips_cpu_get_phys_page_debug(CPUState
*cs
, vaddr addr
)
312 MIPSCPU
*cpu
= MIPS_CPU(cs
);
316 if (get_physical_address(&cpu
->env
, &phys_addr
, &prot
, addr
, 0,
324 int mips_cpu_handle_mmu_fault(CPUState
*cs
, vaddr address
, int rw
,
327 MIPSCPU
*cpu
= MIPS_CPU(cs
);
328 CPUMIPSState
*env
= &cpu
->env
;
329 #if !defined(CONFIG_USER_ONLY)
337 log_cpu_state(cs
, 0);
339 qemu_log("%s pc " TARGET_FMT_lx
" ad %" VADDR_PRIx
" rw %d mmu_idx %d\n",
340 __func__
, env
->active_tc
.PC
, address
, rw
, mmu_idx
);
343 #if !defined(CONFIG_USER_ONLY)
344 /* XXX: put correct access by using cpu_restore_state()
346 access_type
= ACCESS_INT
;
347 ret
= get_physical_address(env
, &physical
, &prot
,
348 address
, rw
, access_type
);
349 qemu_log("%s address=%" VADDR_PRIx
" ret %d physical " TARGET_FMT_plx
351 __func__
, address
, ret
, physical
, prot
);
352 if (ret
== TLBRET_MATCH
) {
353 tlb_set_page(cs
, address
& TARGET_PAGE_MASK
,
354 physical
& TARGET_PAGE_MASK
, prot
| PAGE_EXEC
,
355 mmu_idx
, TARGET_PAGE_SIZE
);
360 raise_mmu_exception(env
, address
, rw
, ret
);
367 #if !defined(CONFIG_USER_ONLY)
368 hwaddr
cpu_mips_translate_address(CPUMIPSState
*env
, target_ulong address
, int rw
)
376 access_type
= ACCESS_INT
;
377 ret
= get_physical_address(env
, &physical
, &prot
,
378 address
, rw
, access_type
);
379 if (ret
!= TLBRET_MATCH
) {
380 raise_mmu_exception(env
, address
, rw
, ret
);
388 static const char * const excp_names
[EXCP_LAST
+ 1] = {
389 [EXCP_RESET
] = "reset",
390 [EXCP_SRESET
] = "soft reset",
391 [EXCP_DSS
] = "debug single step",
392 [EXCP_DINT
] = "debug interrupt",
393 [EXCP_NMI
] = "non-maskable interrupt",
394 [EXCP_MCHECK
] = "machine check",
395 [EXCP_EXT_INTERRUPT
] = "interrupt",
396 [EXCP_DFWATCH
] = "deferred watchpoint",
397 [EXCP_DIB
] = "debug instruction breakpoint",
398 [EXCP_IWATCH
] = "instruction fetch watchpoint",
399 [EXCP_AdEL
] = "address error load",
400 [EXCP_AdES
] = "address error store",
401 [EXCP_TLBF
] = "TLB refill",
402 [EXCP_IBE
] = "instruction bus error",
403 [EXCP_DBp
] = "debug breakpoint",
404 [EXCP_SYSCALL
] = "syscall",
405 [EXCP_BREAK
] = "break",
406 [EXCP_CpU
] = "coprocessor unusable",
407 [EXCP_RI
] = "reserved instruction",
408 [EXCP_OVERFLOW
] = "arithmetic overflow",
409 [EXCP_TRAP
] = "trap",
410 [EXCP_FPE
] = "floating point",
411 [EXCP_DDBS
] = "debug data break store",
412 [EXCP_DWATCH
] = "data watchpoint",
413 [EXCP_LTLBL
] = "TLB modify",
414 [EXCP_TLBL
] = "TLB load",
415 [EXCP_TLBS
] = "TLB store",
416 [EXCP_DBE
] = "data bus error",
417 [EXCP_DDBL
] = "debug data break load",
418 [EXCP_THREAD
] = "thread",
419 [EXCP_MDMX
] = "MDMX",
420 [EXCP_C2E
] = "precise coprocessor 2",
421 [EXCP_CACHE
] = "cache error",
422 [EXCP_TLBXI
] = "TLB execute-inhibit",
423 [EXCP_TLBRI
] = "TLB read-inhibit",
426 target_ulong
exception_resume_pc (CPUMIPSState
*env
)
429 target_ulong isa_mode
;
431 isa_mode
= !!(env
->hflags
& MIPS_HFLAG_M16
);
432 bad_pc
= env
->active_tc
.PC
| isa_mode
;
433 if (env
->hflags
& MIPS_HFLAG_BMASK
) {
434 /* If the exception was raised from a delay slot, come back to
436 bad_pc
-= (env
->hflags
& MIPS_HFLAG_B16
? 2 : 4);
442 #if !defined(CONFIG_USER_ONLY)
443 static void set_hflags_for_handler (CPUMIPSState
*env
)
445 /* Exception handlers are entered in 32-bit mode. */
446 env
->hflags
&= ~(MIPS_HFLAG_M16
);
447 /* ...except that microMIPS lets you choose. */
448 if (env
->insn_flags
& ASE_MICROMIPS
) {
449 env
->hflags
|= (!!(env
->CP0_Config3
450 & (1 << CP0C3_ISA_ON_EXC
))
451 << MIPS_HFLAG_M16_SHIFT
);
456 void mips_cpu_do_interrupt(CPUState
*cs
)
458 #if !defined(CONFIG_USER_ONLY)
459 MIPSCPU
*cpu
= MIPS_CPU(cs
);
460 CPUMIPSState
*env
= &cpu
->env
;
465 if (qemu_log_enabled() && cs
->exception_index
!= EXCP_EXT_INTERRUPT
) {
466 if (cs
->exception_index
< 0 || cs
->exception_index
> EXCP_LAST
) {
469 name
= excp_names
[cs
->exception_index
];
472 qemu_log("%s enter: PC " TARGET_FMT_lx
" EPC " TARGET_FMT_lx
" %s exception\n",
473 __func__
, env
->active_tc
.PC
, env
->CP0_EPC
, name
);
475 if (cs
->exception_index
== EXCP_EXT_INTERRUPT
&&
476 (env
->hflags
& MIPS_HFLAG_DM
)) {
477 cs
->exception_index
= EXCP_DINT
;
480 switch (cs
->exception_index
) {
482 env
->CP0_Debug
|= 1 << CP0DB_DSS
;
483 /* Debug single step cannot be raised inside a delay slot and
484 resume will always occur on the next instruction
485 (but we assume the pc has always been updated during
486 code translation). */
487 env
->CP0_DEPC
= env
->active_tc
.PC
| !!(env
->hflags
& MIPS_HFLAG_M16
);
488 goto enter_debug_mode
;
490 env
->CP0_Debug
|= 1 << CP0DB_DINT
;
493 env
->CP0_Debug
|= 1 << CP0DB_DIB
;
496 env
->CP0_Debug
|= 1 << CP0DB_DBp
;
499 env
->CP0_Debug
|= 1 << CP0DB_DDBS
;
502 env
->CP0_Debug
|= 1 << CP0DB_DDBL
;
504 env
->CP0_DEPC
= exception_resume_pc(env
);
505 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
507 env
->hflags
|= MIPS_HFLAG_DM
| MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
508 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
509 /* EJTAG probe trap enable is not implemented... */
510 if (!(env
->CP0_Status
& (1 << CP0St_EXL
)))
511 env
->CP0_Cause
&= ~(1U << CP0Ca_BD
);
512 env
->active_tc
.PC
= (int32_t)0xBFC00480;
513 set_hflags_for_handler(env
);
519 env
->CP0_Status
|= (1 << CP0St_SR
);
520 memset(env
->CP0_WatchLo
, 0, sizeof(*env
->CP0_WatchLo
));
523 env
->CP0_Status
|= (1 << CP0St_NMI
);
525 env
->CP0_ErrorEPC
= exception_resume_pc(env
);
526 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
527 env
->CP0_Status
|= (1 << CP0St_ERL
) | (1 << CP0St_BEV
);
528 env
->hflags
|= MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
529 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
530 if (!(env
->CP0_Status
& (1 << CP0St_EXL
)))
531 env
->CP0_Cause
&= ~(1U << CP0Ca_BD
);
532 env
->active_tc
.PC
= (int32_t)0xBFC00000;
533 set_hflags_for_handler(env
);
535 case EXCP_EXT_INTERRUPT
:
537 if (env
->CP0_Cause
& (1 << CP0Ca_IV
))
540 if (env
->CP0_Config3
& ((1 << CP0C3_VInt
) | (1 << CP0C3_VEIC
))) {
541 /* Vectored Interrupts. */
542 unsigned int spacing
;
544 unsigned int pending
= (env
->CP0_Cause
& CP0Ca_IP_mask
) >> 8;
546 pending
&= env
->CP0_Status
>> 8;
547 /* Compute the Vector Spacing. */
548 spacing
= (env
->CP0_IntCtl
>> CP0IntCtl_VS
) & ((1 << 6) - 1);
551 if (env
->CP0_Config3
& (1 << CP0C3_VInt
)) {
552 /* For VInt mode, the MIPS computes the vector internally. */
553 for (vector
= 7; vector
> 0; vector
--) {
554 if (pending
& (1 << vector
)) {
560 /* For VEIC mode, the external interrupt controller feeds the
561 vector through the CP0Cause IP lines. */
564 offset
= 0x200 + vector
* spacing
;
572 if (env
->error_code
== 1 && !(env
->CP0_Status
& (1 << CP0St_EXL
))) {
573 #if defined(TARGET_MIPS64)
574 int R
= env
->CP0_BadVAddr
>> 62;
575 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
576 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
577 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
579 if (((R
== 0 && UX
) || (R
== 1 && SX
) || (R
== 3 && KX
)) &&
580 (!(env
->insn_flags
& (INSN_LOONGSON2E
| INSN_LOONGSON2F
))))
589 if (env
->error_code
== 1 && !(env
->CP0_Status
& (1 << CP0St_EXL
))) {
590 #if defined(TARGET_MIPS64)
591 int R
= env
->CP0_BadVAddr
>> 62;
592 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
593 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
594 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
596 if (((R
== 0 && UX
) || (R
== 1 && SX
) || (R
== 3 && KX
)) &&
597 (!(env
->insn_flags
& (INSN_LOONGSON2E
| INSN_LOONGSON2F
))))
627 env
->CP0_Cause
= (env
->CP0_Cause
& ~(0x3 << CP0Ca_CE
)) |
628 (env
->error_code
<< CP0Ca_CE
);
653 /* XXX: TODO: manage defered watch exceptions */
666 if (env
->CP0_Status
& (1 << CP0St_BEV
)) {
672 if (!(env
->CP0_Status
& (1 << CP0St_EXL
))) {
673 env
->CP0_EPC
= exception_resume_pc(env
);
674 if (env
->hflags
& MIPS_HFLAG_BMASK
) {
675 env
->CP0_Cause
|= (1U << CP0Ca_BD
);
677 env
->CP0_Cause
&= ~(1U << CP0Ca_BD
);
679 env
->CP0_Status
|= (1 << CP0St_EXL
);
680 env
->hflags
|= MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
681 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
683 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
684 if (env
->CP0_Status
& (1 << CP0St_BEV
)) {
685 env
->active_tc
.PC
= (int32_t)0xBFC00200;
687 env
->active_tc
.PC
= (int32_t)(env
->CP0_EBase
& ~0x3ff);
689 env
->active_tc
.PC
+= offset
;
690 set_hflags_for_handler(env
);
691 env
->CP0_Cause
= (env
->CP0_Cause
& ~(0x1f << CP0Ca_EC
)) | (cause
<< CP0Ca_EC
);
694 qemu_log("Invalid MIPS exception %d. Exiting\n", cs
->exception_index
);
695 printf("Invalid MIPS exception %d. Exiting\n", cs
->exception_index
);
698 if (qemu_log_enabled() && cs
->exception_index
!= EXCP_EXT_INTERRUPT
) {
699 qemu_log("%s: PC " TARGET_FMT_lx
" EPC " TARGET_FMT_lx
" cause %d\n"
700 " S %08x C %08x A " TARGET_FMT_lx
" D " TARGET_FMT_lx
"\n",
701 __func__
, env
->active_tc
.PC
, env
->CP0_EPC
, cause
,
702 env
->CP0_Status
, env
->CP0_Cause
, env
->CP0_BadVAddr
,
706 cs
->exception_index
= EXCP_NONE
;
709 bool mips_cpu_exec_interrupt(CPUState
*cs
, int interrupt_request
)
711 if (interrupt_request
& CPU_INTERRUPT_HARD
) {
712 MIPSCPU
*cpu
= MIPS_CPU(cs
);
713 CPUMIPSState
*env
= &cpu
->env
;
715 if (cpu_mips_hw_interrupts_pending(env
)) {
717 cs
->exception_index
= EXCP_EXT_INTERRUPT
;
719 mips_cpu_do_interrupt(cs
);
726 #if !defined(CONFIG_USER_ONLY)
727 void r4k_invalidate_tlb (CPUMIPSState
*env
, int idx
, int use_extra
)
729 MIPSCPU
*cpu
= mips_env_get_cpu(env
);
734 uint8_t ASID
= env
->CP0_EntryHi
& 0xFF;
737 tlb
= &env
->tlb
->mmu
.r4k
.tlb
[idx
];
738 /* The qemu TLB is flushed when the ASID changes, so no need to
739 flush these entries again. */
740 if (tlb
->G
== 0 && tlb
->ASID
!= ASID
) {
744 if (use_extra
&& env
->tlb
->tlb_in_use
< MIPS_TLB_MAX
) {
745 /* For tlbwr, we can shadow the discarded entry into
746 a new (fake) TLB entry, as long as the guest can not
747 tell that it's there. */
748 env
->tlb
->mmu
.r4k
.tlb
[env
->tlb
->tlb_in_use
] = *tlb
;
749 env
->tlb
->tlb_in_use
++;
753 /* 1k pages are not supported. */
754 mask
= tlb
->PageMask
| ~(TARGET_PAGE_MASK
<< 1);
757 addr
= tlb
->VPN
& ~mask
;
758 #if defined(TARGET_MIPS64)
759 if (addr
>= (0xFFFFFFFF80000000ULL
& env
->SEGMask
)) {
760 addr
|= 0x3FFFFF0000000000ULL
;
763 end
= addr
| (mask
>> 1);
765 tlb_flush_page(cs
, addr
);
766 addr
+= TARGET_PAGE_SIZE
;
771 addr
= (tlb
->VPN
& ~mask
) | ((mask
>> 1) + 1);
772 #if defined(TARGET_MIPS64)
773 if (addr
>= (0xFFFFFFFF80000000ULL
& env
->SEGMask
)) {
774 addr
|= 0x3FFFFF0000000000ULL
;
778 while (addr
- 1 < end
) {
779 tlb_flush_page(cs
, addr
);
780 addr
+= TARGET_PAGE_SIZE
;