]> git.proxmox.com Git - qemu.git/blob - target-ppc/helper.c
projects / qemu.git / blob
? search:


fc54d718020fe145c58dd0ef40f71581b6f915f7
[qemu.git] / target-ppc / helper.c
1 /*
2 * PowerPC emulation helpers for qemu.
3 *
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19 #include <stdarg.h>
20 #include <stdlib.h>
21 #include <stdio.h>
22 #include <string.h>
23 #include <inttypes.h>
24 #include <signal.h>
25
26 #include "cpu.h"
27 #include "exec-all.h"
28 #include "helper_regs.h"
29 #include "qemu-common.h"
30 #include "kvm.h"
31
32 //#define DEBUG_MMU
33 //#define DEBUG_BATS
34 //#define DEBUG_SLB
35 //#define DEBUG_SOFTWARE_TLB
36 //#define DUMP_PAGE_TABLES
37 //#define DEBUG_EXCEPTIONS
38 //#define FLUSH_ALL_TLBS
39
40 #ifdef DEBUG_MMU
41 # define LOG_MMU(...) qemu_log(__VA_ARGS__)
42 # define LOG_MMU_STATE(env) log_cpu_state((env), 0)
43 #else
44 # define LOG_MMU(...) do { } while (0)
45 # define LOG_MMU_STATE(...) do { } while (0)
46 #endif
47
48
49 #ifdef DEBUG_SOFTWARE_TLB
50 # define LOG_SWTLB(...) qemu_log(__VA_ARGS__)
51 #else
52 # define LOG_SWTLB(...) do { } while (0)
53 #endif
54
55 #ifdef DEBUG_BATS
56 # define LOG_BATS(...) qemu_log(__VA_ARGS__)
57 #else
58 # define LOG_BATS(...) do { } while (0)
59 #endif
60
61 #ifdef DEBUG_SLB
62 # define LOG_SLB(...) qemu_log(__VA_ARGS__)
63 #else
64 # define LOG_SLB(...) do { } while (0)
65 #endif
66
67 #ifdef DEBUG_EXCEPTIONS
68 # define LOG_EXCP(...) qemu_log(__VA_ARGS__)
69 #else
70 # define LOG_EXCP(...) do { } while (0)
71 #endif
72
73
74 /*****************************************************************************/
75 /* PowerPC MMU emulation */
76
77 #if defined(CONFIG_USER_ONLY)
78 int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
79 int mmu_idx, int is_softmmu)
80 {
81 int exception, error_code;
82
83 if (rw == 2) {
84 exception = POWERPC_EXCP_ISI;
85 error_code = 0x40000000;
86 } else {
87 exception = POWERPC_EXCP_DSI;
88 error_code = 0x40000000;
89 if (rw)
90 error_code |= 0x02000000;
91 env->spr[SPR_DAR] = address;
92 env->spr[SPR_DSISR] = error_code;
93 }
94 env->exception_index = exception;
95 env->error_code = error_code;
96
97 return 1;
98 }
99
100 #else
101 /* Common routines used by software and hardware TLBs emulation */
102 static inline int pte_is_valid(target_ulong pte0)
103 {
104 return pte0 & 0x80000000 ? 1 : 0;
105 }
106
107 static inline void pte_invalidate(target_ulong *pte0)
108 {
109 *pte0 &= ~0x80000000;
110 }
111
112 #if defined(TARGET_PPC64)
113 static inline int pte64_is_valid(target_ulong pte0)
114 {
115 return pte0 & 0x0000000000000001ULL ? 1 : 0;
116 }
117
118 static inline void pte64_invalidate(target_ulong *pte0)
119 {
120 *pte0 &= ~0x0000000000000001ULL;
121 }
122 #endif
123
124 #define PTE_PTEM_MASK 0x7FFFFFBF
125 #define PTE_CHECK_MASK (TARGET_PAGE_MASK | 0x7B)
126 #if defined(TARGET_PPC64)
127 #define PTE64_PTEM_MASK 0xFFFFFFFFFFFFFF80ULL
128 #define PTE64_CHECK_MASK (TARGET_PAGE_MASK | 0x7F)
129 #endif
130
131 static inline int pp_check(int key, int pp, int nx)
132 {
133 int access;
134
135 /* Compute access rights */
136 /* When pp is 3/7, the result is undefined. Set it to noaccess */
137 access = 0;
138 if (key == 0) {
139 switch (pp) {
140 case 0x0:
141 case 0x1:
142 case 0x2:
143 access |= PAGE_WRITE;
144 /* No break here */
145 case 0x3:
146 case 0x6:
147 access |= PAGE_READ;
148 break;
149 }
150 } else {
151 switch (pp) {
152 case 0x0:
153 case 0x6:
154 access = 0;
155 break;
156 case 0x1:
157 case 0x3:
158 access = PAGE_READ;
159 break;
160 case 0x2:
161 access = PAGE_READ | PAGE_WRITE;
162 break;
163 }
164 }
165 if (nx == 0)
166 access |= PAGE_EXEC;
167
168 return access;
169 }
170
171 static inline int check_prot(int prot, int rw, int access_type)
172 {
173 int ret;
174
175 if (access_type == ACCESS_CODE) {
176 if (prot & PAGE_EXEC)
177 ret = 0;
178 else
179 ret = -2;
180 } else if (rw) {
181 if (prot & PAGE_WRITE)
182 ret = 0;
183 else
184 ret = -2;
185 } else {
186 if (prot & PAGE_READ)
187 ret = 0;
188 else
189 ret = -2;
190 }
191
192 return ret;
193 }
194
195 static inline int _pte_check(mmu_ctx_t *ctx, int is_64b, target_ulong pte0,
196 target_ulong pte1, int h, int rw, int type)
197 {
198 target_ulong ptem, mmask;
199 int access, ret, pteh, ptev, pp;
200
201 access = 0;
202 ret = -1;
203 /* Check validity and table match */
204 #if defined(TARGET_PPC64)
205 if (is_64b) {
206 ptev = pte64_is_valid(pte0);
207 pteh = (pte0 >> 1) & 1;
208 } else
209 #endif
210 {
211 ptev = pte_is_valid(pte0);
212 pteh = (pte0 >> 6) & 1;
213 }
214 if (ptev && h == pteh) {
215 /* Check vsid & api */
216 #if defined(TARGET_PPC64)
217 if (is_64b) {
218 ptem = pte0 & PTE64_PTEM_MASK;
219 mmask = PTE64_CHECK_MASK;
220 pp = (pte1 & 0x00000003) | ((pte1 >> 61) & 0x00000004);
221 ctx->nx = (pte1 >> 2) & 1; /* No execute bit */
222 ctx->nx |= (pte1 >> 3) & 1; /* Guarded bit */
223 } else
224 #endif
225 {
226 ptem = pte0 & PTE_PTEM_MASK;
227 mmask = PTE_CHECK_MASK;
228 pp = pte1 & 0x00000003;
229 }
230 if (ptem == ctx->ptem) {
231 if (ctx->raddr != (target_phys_addr_t)-1ULL) {
232 /* all matches should have equal RPN, WIMG & PP */
233 if ((ctx->raddr & mmask) != (pte1 & mmask)) {
234 qemu_log("Bad RPN/WIMG/PP\n");
235 return -3;
236 }
237 }
238 /* Compute access rights */
239 access = pp_check(ctx->key, pp, ctx->nx);
240 /* Keep the matching PTE informations */
241 ctx->raddr = pte1;
242 ctx->prot = access;
243 ret = check_prot(ctx->prot, rw, type);
244 if (ret == 0) {
245 /* Access granted */
246 LOG_MMU("PTE access granted !\n");
247 } else {
248 /* Access right violation */
249 LOG_MMU("PTE access rejected\n");
250 }
251 }
252 }
253
254 return ret;
255 }
256
257 static inline int pte32_check(mmu_ctx_t *ctx, target_ulong pte0,
258 target_ulong pte1, int h, int rw, int type)
259 {
260 return _pte_check(ctx, 0, pte0, pte1, h, rw, type);
261 }
262
263 #if defined(TARGET_PPC64)
264 static inline int pte64_check(mmu_ctx_t *ctx, target_ulong pte0,
265 target_ulong pte1, int h, int rw, int type)
266 {
267 return _pte_check(ctx, 1, pte0, pte1, h, rw, type);
268 }
269 #endif
270
271 static inline int pte_update_flags(mmu_ctx_t *ctx, target_ulong *pte1p,
272 int ret, int rw)
273 {
274 int store = 0;
275
276 /* Update page flags */
277 if (!(*pte1p & 0x00000100)) {
278 /* Update accessed flag */
279 *pte1p |= 0x00000100;
280 store = 1;
281 }
282 if (!(*pte1p & 0x00000080)) {
283 if (rw == 1 && ret == 0) {
284 /* Update changed flag */
285 *pte1p |= 0x00000080;
286 store = 1;
287 } else {
288 /* Force page fault for first write access */
289 ctx->prot &= ~PAGE_WRITE;
290 }
291 }
292
293 return store;
294 }
295
296 /* Software driven TLB helpers */
297 static inline int ppc6xx_tlb_getnum(CPUState *env, target_ulong eaddr, int way,
298 int is_code)
299 {
300 int nr;
301
302 /* Select TLB num in a way from address */
303 nr = (eaddr >> TARGET_PAGE_BITS) & (env->tlb_per_way - 1);
304 /* Select TLB way */
305 nr += env->tlb_per_way * way;
306 /* 6xx have separate TLBs for instructions and data */
307 if (is_code && env->id_tlbs == 1)
308 nr += env->nb_tlb;
309
310 return nr;
311 }
312
313 static inline void ppc6xx_tlb_invalidate_all(CPUState *env)
314 {
315 ppc6xx_tlb_t *tlb;
316 int nr, max;
317
318 //LOG_SWTLB("Invalidate all TLBs\n");
319 /* Invalidate all defined software TLB */
320 max = env->nb_tlb;
321 if (env->id_tlbs == 1)
322 max *= 2;
323 for (nr = 0; nr < max; nr++) {
324 tlb = &env->tlb[nr].tlb6;
325 pte_invalidate(&tlb->pte0);
326 }
327 tlb_flush(env, 1);
328 }
329
330 static inline void __ppc6xx_tlb_invalidate_virt(CPUState *env,
331 target_ulong eaddr,
332 int is_code, int match_epn)
333 {
334 #if !defined(FLUSH_ALL_TLBS)
335 ppc6xx_tlb_t *tlb;
336 int way, nr;
337
338 /* Invalidate ITLB + DTLB, all ways */
339 for (way = 0; way < env->nb_ways; way++) {
340 nr = ppc6xx_tlb_getnum(env, eaddr, way, is_code);
341 tlb = &env->tlb[nr].tlb6;
342 if (pte_is_valid(tlb->pte0) && (match_epn == 0 || eaddr == tlb->EPN)) {
343 LOG_SWTLB("TLB invalidate %d/%d " TARGET_FMT_lx "\n", nr,
344 env->nb_tlb, eaddr);
345 pte_invalidate(&tlb->pte0);
346 tlb_flush_page(env, tlb->EPN);
347 }
348 }
349 #else
350 /* XXX: PowerPC specification say this is valid as well */
351 ppc6xx_tlb_invalidate_all(env);
352 #endif
353 }
354
355 static inline void ppc6xx_tlb_invalidate_virt(CPUState *env,
356 target_ulong eaddr, int is_code)
357 {
358 __ppc6xx_tlb_invalidate_virt(env, eaddr, is_code, 0);
359 }
360
361 void ppc6xx_tlb_store (CPUState *env, target_ulong EPN, int way, int is_code,
362 target_ulong pte0, target_ulong pte1)
363 {
364 ppc6xx_tlb_t *tlb;
365 int nr;
366
367 nr = ppc6xx_tlb_getnum(env, EPN, way, is_code);
368 tlb = &env->tlb[nr].tlb6;
369 LOG_SWTLB("Set TLB %d/%d EPN " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
370 " PTE1 " TARGET_FMT_lx "\n", nr, env->nb_tlb, EPN, pte0, pte1);
371 /* Invalidate any pending reference in Qemu for this virtual address */
372 __ppc6xx_tlb_invalidate_virt(env, EPN, is_code, 1);
373 tlb->pte0 = pte0;
374 tlb->pte1 = pte1;
375 tlb->EPN = EPN;
376 /* Store last way for LRU mechanism */
377 env->last_way = way;
378 }
379
380 static inline int ppc6xx_tlb_check(CPUState *env, mmu_ctx_t *ctx,
381 target_ulong eaddr, int rw, int access_type)
382 {
383 ppc6xx_tlb_t *tlb;
384 int nr, best, way;
385 int ret;
386
387 best = -1;
388 ret = -1; /* No TLB found */
389 for (way = 0; way < env->nb_ways; way++) {
390 nr = ppc6xx_tlb_getnum(env, eaddr, way,
391 access_type == ACCESS_CODE ? 1 : 0);
392 tlb = &env->tlb[nr].tlb6;
393 /* This test "emulates" the PTE index match for hardware TLBs */
394 if ((eaddr & TARGET_PAGE_MASK) != tlb->EPN) {
395 LOG_SWTLB("TLB %d/%d %s [" TARGET_FMT_lx " " TARGET_FMT_lx
396 "] <> " TARGET_FMT_lx "\n", nr, env->nb_tlb,
397 pte_is_valid(tlb->pte0) ? "valid" : "inval",
398 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE, eaddr);
399 continue;
400 }
401 LOG_SWTLB("TLB %d/%d %s " TARGET_FMT_lx " <> " TARGET_FMT_lx " "
402 TARGET_FMT_lx " %c %c\n", nr, env->nb_tlb,
403 pte_is_valid(tlb->pte0) ? "valid" : "inval",
404 tlb->EPN, eaddr, tlb->pte1,
405 rw ? 'S' : 'L', access_type == ACCESS_CODE ? 'I' : 'D');
406 switch (pte32_check(ctx, tlb->pte0, tlb->pte1, 0, rw, access_type)) {
407 case -3:
408 /* TLB inconsistency */
409 return -1;
410 case -2:
411 /* Access violation */
412 ret = -2;
413 best = nr;
414 break;
415 case -1:
416 default:
417 /* No match */
418 break;
419 case 0:
420 /* access granted */
421 /* XXX: we should go on looping to check all TLBs consistency
422 * but we can speed-up the whole thing as the
423 * result would be undefined if TLBs are not consistent.
424 */
425 ret = 0;
426 best = nr;
427 goto done;
428 }
429 }
430 if (best != -1) {
431 done:
432 LOG_SWTLB("found TLB at addr " TARGET_FMT_plx " prot=%01x ret=%d\n",
433 ctx->raddr & TARGET_PAGE_MASK, ctx->prot, ret);
434 /* Update page flags */
435 pte_update_flags(ctx, &env->tlb[best].tlb6.pte1, ret, rw);
436 }
437
438 return ret;
439 }
440
441 /* Perform BAT hit & translation */
442 static inline void bat_size_prot(CPUState *env, target_ulong *blp, int *validp,
443 int *protp, target_ulong *BATu,
444 target_ulong *BATl)
445 {
446 target_ulong bl;
447 int pp, valid, prot;
448
449 bl = (*BATu & 0x00001FFC) << 15;
450 valid = 0;
451 prot = 0;
452 if (((msr_pr == 0) && (*BATu & 0x00000002)) ||
453 ((msr_pr != 0) && (*BATu & 0x00000001))) {
454 valid = 1;
455 pp = *BATl & 0x00000003;
456 if (pp != 0) {
457 prot = PAGE_READ | PAGE_EXEC;
458 if (pp == 0x2)
459 prot |= PAGE_WRITE;
460 }
461 }
462 *blp = bl;
463 *validp = valid;
464 *protp = prot;
465 }
466
467 static inline void bat_601_size_prot(CPUState *env, target_ulong *blp,
468 int *validp, int *protp,
469 target_ulong *BATu, target_ulong *BATl)
470 {
471 target_ulong bl;
472 int key, pp, valid, prot;
473
474 bl = (*BATl & 0x0000003F) << 17;
475 LOG_BATS("b %02x ==> bl " TARGET_FMT_lx " msk " TARGET_FMT_lx "\n",
476 (uint8_t)(*BATl & 0x0000003F), bl, ~bl);
477 prot = 0;
478 valid = (*BATl >> 6) & 1;
479 if (valid) {
480 pp = *BATu & 0x00000003;
481 if (msr_pr == 0)
482 key = (*BATu >> 3) & 1;
483 else
484 key = (*BATu >> 2) & 1;
485 prot = pp_check(key, pp, 0);
486 }
487 *blp = bl;
488 *validp = valid;
489 *protp = prot;
490 }
491
492 static inline int get_bat(CPUState *env, mmu_ctx_t *ctx, target_ulong virtual,
493 int rw, int type)
494 {
495 target_ulong *BATlt, *BATut, *BATu, *BATl;
496 target_ulong base, BEPIl, BEPIu, bl;
497 int i, valid, prot;
498 int ret = -1;
499
500 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
501 type == ACCESS_CODE ? 'I' : 'D', virtual);
502 switch (type) {
503 case ACCESS_CODE:
504 BATlt = env->IBAT[1];
505 BATut = env->IBAT[0];
506 break;
507 default:
508 BATlt = env->DBAT[1];
509 BATut = env->DBAT[0];
510 break;
511 }
512 base = virtual & 0xFFFC0000;
513 for (i = 0; i < env->nb_BATs; i++) {
514 BATu = &BATut[i];
515 BATl = &BATlt[i];
516 BEPIu = *BATu & 0xF0000000;
517 BEPIl = *BATu & 0x0FFE0000;
518 if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
519 bat_601_size_prot(env, &bl, &valid, &prot, BATu, BATl);
520 } else {
521 bat_size_prot(env, &bl, &valid, &prot, BATu, BATl);
522 }
523 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
524 " BATl " TARGET_FMT_lx "\n", __func__,
525 type == ACCESS_CODE ? 'I' : 'D', i, virtual, *BATu, *BATl);
526 if ((virtual & 0xF0000000) == BEPIu &&
527 ((virtual & 0x0FFE0000) & ~bl) == BEPIl) {
528 /* BAT matches */
529 if (valid != 0) {
530 /* Get physical address */
531 ctx->raddr = (*BATl & 0xF0000000) |
532 ((virtual & 0x0FFE0000 & bl) | (*BATl & 0x0FFE0000)) |
533 (virtual & 0x0001F000);
534 /* Compute access rights */
535 ctx->prot = prot;
536 ret = check_prot(ctx->prot, rw, type);
537 if (ret == 0)
538 LOG_BATS("BAT %d match: r " TARGET_FMT_plx " prot=%c%c\n",
539 i, ctx->raddr, ctx->prot & PAGE_READ ? 'R' : '-',
540 ctx->prot & PAGE_WRITE ? 'W' : '-');
541 break;
542 }
543 }
544 }
545 if (ret < 0) {
546 #if defined(DEBUG_BATS)
547 if (qemu_log_enabled()) {
548 LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", virtual);
549 for (i = 0; i < 4; i++) {
550 BATu = &BATut[i];
551 BATl = &BATlt[i];
552 BEPIu = *BATu & 0xF0000000;
553 BEPIl = *BATu & 0x0FFE0000;
554 bl = (*BATu & 0x00001FFC) << 15;
555 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
556 " BATl " TARGET_FMT_lx " \n\t" TARGET_FMT_lx " "
557 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
558 __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual,
559 *BATu, *BATl, BEPIu, BEPIl, bl);
560 }
561 }
562 #endif
563 }
564 /* No hit */
565 return ret;
566 }
567
568 /* PTE table lookup */
569 static inline int _find_pte(mmu_ctx_t *ctx, int is_64b, int h, int rw,
570 int type, int target_page_bits)
571 {
572 target_ulong base, pte0, pte1;
573 int i, good = -1;
574 int ret, r;
575
576 ret = -1; /* No entry found */
577 base = ctx->pg_addr[h];
578 for (i = 0; i < 8; i++) {
579 #if defined(TARGET_PPC64)
580 if (is_64b) {
581 pte0 = ldq_phys(base + (i * 16));
582 pte1 = ldq_phys(base + (i * 16) + 8);
583
584 /* We have a TLB that saves 4K pages, so let's
585 * split a huge page to 4k chunks */
586 if (target_page_bits != TARGET_PAGE_BITS)
587 pte1 |= (ctx->eaddr & (( 1 << target_page_bits ) - 1))
588 & TARGET_PAGE_MASK;
589
590 r = pte64_check(ctx, pte0, pte1, h, rw, type);
591 LOG_MMU("Load pte from " TARGET_FMT_lx " => " TARGET_FMT_lx " "
592 TARGET_FMT_lx " %d %d %d " TARGET_FMT_lx "\n",
593 base + (i * 16), pte0, pte1, (int)(pte0 & 1), h,
594 (int)((pte0 >> 1) & 1), ctx->ptem);
595 } else
596 #endif
597 {
598 pte0 = ldl_phys(base + (i * 8));
599 pte1 = ldl_phys(base + (i * 8) + 4);
600 r = pte32_check(ctx, pte0, pte1, h, rw, type);
601 LOG_MMU("Load pte from " TARGET_FMT_lx " => " TARGET_FMT_lx " "
602 TARGET_FMT_lx " %d %d %d " TARGET_FMT_lx "\n",
603 base + (i * 8), pte0, pte1, (int)(pte0 >> 31), h,
604 (int)((pte0 >> 6) & 1), ctx->ptem);
605 }
606 switch (r) {
607 case -3:
608 /* PTE inconsistency */
609 return -1;
610 case -2:
611 /* Access violation */
612 ret = -2;
613 good = i;
614 break;
615 case -1:
616 default:
617 /* No PTE match */
618 break;
619 case 0:
620 /* access granted */
621 /* XXX: we should go on looping to check all PTEs consistency
622 * but if we can speed-up the whole thing as the
623 * result would be undefined if PTEs are not consistent.
624 */
625 ret = 0;
626 good = i;
627 goto done;
628 }
629 }
630 if (good != -1) {
631 done:
632 LOG_MMU("found PTE at addr " TARGET_FMT_lx " prot=%01x ret=%d\n",
633 ctx->raddr, ctx->prot, ret);
634 /* Update page flags */
635 pte1 = ctx->raddr;
636 if (pte_update_flags(ctx, &pte1, ret, rw) == 1) {
637 #if defined(TARGET_PPC64)
638 if (is_64b) {
639 stq_phys_notdirty(base + (good * 16) + 8, pte1);
640 } else
641 #endif
642 {
643 stl_phys_notdirty(base + (good * 8) + 4, pte1);
644 }
645 }
646 }
647
648 return ret;
649 }
650
651 static inline int find_pte32(mmu_ctx_t *ctx, int h, int rw, int type,
652 int target_page_bits)
653 {
654 return _find_pte(ctx, 0, h, rw, type, target_page_bits);
655 }
656
657 #if defined(TARGET_PPC64)
658 static inline int find_pte64(mmu_ctx_t *ctx, int h, int rw, int type,
659 int target_page_bits)
660 {
661 return _find_pte(ctx, 1, h, rw, type, target_page_bits);
662 }
663 #endif
664
665 static inline int find_pte(CPUState *env, mmu_ctx_t *ctx, int h, int rw,
666 int type, int target_page_bits)
667 {
668 #if defined(TARGET_PPC64)
669 if (env->mmu_model & POWERPC_MMU_64)
670 return find_pte64(ctx, h, rw, type, target_page_bits);
671 #endif
672
673 return find_pte32(ctx, h, rw, type, target_page_bits);
674 }
675
676 #if defined(TARGET_PPC64)
677 static ppc_slb_t *slb_get_entry(CPUPPCState *env, int nr)
678 {
679 ppc_slb_t *retval = &env->slb[nr];
680
681 #if 0 // XXX implement bridge mode?
682 if (env->spr[SPR_ASR] & 1) {
683 target_phys_addr_t sr_base;
684
685 sr_base = env->spr[SPR_ASR] & 0xfffffffffffff000;
686 sr_base += (12 * nr);
687
688 retval->tmp64 = ldq_phys(sr_base);
689 retval->tmp = ldl_phys(sr_base + 8);
690 }
691 #endif
692
693 return retval;
694 }
695
696 static void slb_set_entry(CPUPPCState *env, int nr, ppc_slb_t *slb)
697 {
698 ppc_slb_t *entry = &env->slb[nr];
699
700 if (slb == entry)
701 return;
702
703 entry->tmp64 = slb->tmp64;
704 entry->tmp = slb->tmp;
705 }
706
707 static inline int slb_is_valid(ppc_slb_t *slb)
708 {
709 return (int)(slb->tmp64 & 0x0000000008000000ULL);
710 }
711
712 static inline void slb_invalidate(ppc_slb_t *slb)
713 {
714 slb->tmp64 &= ~0x0000000008000000ULL;
715 }
716
717 static inline int slb_lookup(CPUPPCState *env, target_ulong eaddr,
718 target_ulong *vsid, target_ulong *page_mask,
719 int *attr, int *target_page_bits)
720 {
721 target_ulong mask;
722 int n, ret;
723
724 ret = -5;
725 LOG_SLB("%s: eaddr " TARGET_FMT_lx "\n", __func__, eaddr);
726 mask = 0x0000000000000000ULL; /* Avoid gcc warning */
727 for (n = 0; n < env->slb_nr; n++) {
728 ppc_slb_t *slb = slb_get_entry(env, n);
729
730 LOG_SLB("%s: seg %d %016" PRIx64 " %08"
731 PRIx32 "\n", __func__, n, slb->tmp64, slb->tmp);
732 if (slb_is_valid(slb)) {
733 /* SLB entry is valid */
734 mask = 0xFFFFFFFFF0000000ULL;
735 if (slb->tmp & 0x8) {
736 /* 16 MB PTEs */
737 if (target_page_bits)
738 *target_page_bits = 24;
739 } else {
740 /* 4 KB PTEs */
741 if (target_page_bits)
742 *target_page_bits = TARGET_PAGE_BITS;
743 }
744 if ((eaddr & mask) == (slb->tmp64 & mask)) {
745 /* SLB match */
746 *vsid = ((slb->tmp64 << 24) | (slb->tmp >> 8)) & 0x0003FFFFFFFFFFFFULL;
747 *page_mask = ~mask;
748 *attr = slb->tmp & 0xFF;
749 ret = n;
750 break;
751 }
752 }
753 }
754
755 return ret;
756 }
757
758 void ppc_slb_invalidate_all (CPUPPCState *env)
759 {
760 int n, do_invalidate;
761
762 do_invalidate = 0;
763 /* XXX: Warning: slbia never invalidates the first segment */
764 for (n = 1; n < env->slb_nr; n++) {
765 ppc_slb_t *slb = slb_get_entry(env, n);
766
767 if (slb_is_valid(slb)) {
768 slb_invalidate(slb);
769 slb_set_entry(env, n, slb);
770 /* XXX: given the fact that segment size is 256 MB or 1TB,
771 * and we still don't have a tlb_flush_mask(env, n, mask)
772 * in Qemu, we just invalidate all TLBs
773 */
774 do_invalidate = 1;
775 }
776 }
777 if (do_invalidate)
778 tlb_flush(env, 1);
779 }
780
781 void ppc_slb_invalidate_one (CPUPPCState *env, uint64_t T0)
782 {
783 target_ulong vsid, page_mask;
784 int attr;
785 int n;
786
787 n = slb_lookup(env, T0, &vsid, &page_mask, &attr, NULL);
788 if (n >= 0) {
789 ppc_slb_t *slb = slb_get_entry(env, n);
790
791 if (slb_is_valid(slb)) {
792 slb_invalidate(slb);
793 slb_set_entry(env, n, slb);
794 /* XXX: given the fact that segment size is 256 MB or 1TB,
795 * and we still don't have a tlb_flush_mask(env, n, mask)
796 * in Qemu, we just invalidate all TLBs
797 */
798 tlb_flush(env, 1);
799 }
800 }
801 }
802
803 target_ulong ppc_load_slb (CPUPPCState *env, int slb_nr)
804 {
805 target_ulong rt;
806 ppc_slb_t *slb = slb_get_entry(env, slb_nr);
807
808 if (slb_is_valid(slb)) {
809 /* SLB entry is valid */
810 /* Copy SLB bits 62:88 to Rt 37:63 (VSID 23:49) */
811 rt = slb->tmp >> 8; /* 65:88 => 40:63 */
812 rt |= (slb->tmp64 & 0x7) << 24; /* 62:64 => 37:39 */
813 /* Copy SLB bits 89:92 to Rt 33:36 (KsKpNL) */
814 rt |= ((slb->tmp >> 4) & 0xF) << 27;
815 } else {
816 rt = 0;
817 }
818 LOG_SLB("%s: %016" PRIx64 " %08" PRIx32 " => %d "
819 TARGET_FMT_lx "\n", __func__, slb->tmp64, slb->tmp, slb_nr, rt);
820
821 return rt;
822 }
823
824 void ppc_store_slb (CPUPPCState *env, target_ulong rb, target_ulong rs)
825 {
826 ppc_slb_t *slb;
827
828 uint64_t vsid;
829 uint64_t esid;
830 int flags, valid, slb_nr;
831
832 vsid = rs >> 12;
833 flags = ((rs >> 8) & 0xf);
834
835 esid = rb >> 28;
836 valid = (rb & (1 << 27));
837 slb_nr = rb & 0xfff;
838
839 slb = slb_get_entry(env, slb_nr);
840 slb->tmp64 = (esid << 28) | valid | (vsid >> 24);
841 slb->tmp = (vsid << 8) | (flags << 3);
842
843 LOG_SLB("%s: %d " TARGET_FMT_lx " - " TARGET_FMT_lx " => %016" PRIx64
844 " %08" PRIx32 "\n", __func__, slb_nr, rb, rs, slb->tmp64,
845 slb->tmp);
846
847 slb_set_entry(env, slb_nr, slb);
848 }
849 #endif /* defined(TARGET_PPC64) */
850
851 /* Perform segment based translation */
852 static inline target_phys_addr_t get_pgaddr(target_phys_addr_t sdr1,
853 int sdr_sh,
854 target_phys_addr_t hash,
855 target_phys_addr_t mask)
856 {
857 return (sdr1 & ((target_phys_addr_t)(-1ULL) << sdr_sh)) | (hash & mask);
858 }
859
860 static inline int get_segment(CPUState *env, mmu_ctx_t *ctx,
861 target_ulong eaddr, int rw, int type)
862 {
863 target_phys_addr_t sdr, hash, mask, sdr_mask, htab_mask;
864 target_ulong sr, vsid, vsid_mask, pgidx, page_mask;
865 #if defined(TARGET_PPC64)
866 int attr;
867 #endif
868 int ds, vsid_sh, sdr_sh, pr, target_page_bits;
869 int ret, ret2;
870
871 pr = msr_pr;
872 #if defined(TARGET_PPC64)
873 if (env->mmu_model & POWERPC_MMU_64) {
874 LOG_MMU("Check SLBs\n");
875 ret = slb_lookup(env, eaddr, &vsid, &page_mask, &attr,
876 &target_page_bits);
877 if (ret < 0)
878 return ret;
879 ctx->key = ((attr & 0x40) && (pr != 0)) ||
880 ((attr & 0x80) && (pr == 0)) ? 1 : 0;
881 ds = 0;
882 ctx->nx = attr & 0x10 ? 1 : 0;
883 ctx->eaddr = eaddr;
884 vsid_mask = 0x00003FFFFFFFFF80ULL;
885 vsid_sh = 7;
886 sdr_sh = 18;
887 sdr_mask = 0x3FF80;
888 } else
889 #endif /* defined(TARGET_PPC64) */
890 {
891 sr = env->sr[eaddr >> 28];
892 page_mask = 0x0FFFFFFF;
893 ctx->key = (((sr & 0x20000000) && (pr != 0)) ||
894 ((sr & 0x40000000) && (pr == 0))) ? 1 : 0;
895 ds = sr & 0x80000000 ? 1 : 0;
896 ctx->nx = sr & 0x10000000 ? 1 : 0;
897 vsid = sr & 0x00FFFFFF;
898 vsid_mask = 0x01FFFFC0;
899 vsid_sh = 6;
900 sdr_sh = 16;
901 sdr_mask = 0xFFC0;
902 target_page_bits = TARGET_PAGE_BITS;
903 LOG_MMU("Check segment v=" TARGET_FMT_lx " %d " TARGET_FMT_lx " nip="
904 TARGET_FMT_lx " lr=" TARGET_FMT_lx
905 " ir=%d dr=%d pr=%d %d t=%d\n",
906 eaddr, (int)(eaddr >> 28), sr, env->nip, env->lr, (int)msr_ir,
907 (int)msr_dr, pr != 0 ? 1 : 0, rw, type);
908 }
909 LOG_MMU("pte segment: key=%d ds %d nx %d vsid " TARGET_FMT_lx "\n",
910 ctx->key, ds, ctx->nx, vsid);
911 ret = -1;
912 if (!ds) {
913 /* Check if instruction fetch is allowed, if needed */
914 if (type != ACCESS_CODE || ctx->nx == 0) {
915 /* Page address translation */
916 /* Primary table address */
917 sdr = env->sdr1;
918 pgidx = (eaddr & page_mask) >> target_page_bits;
919 #if defined(TARGET_PPC64)
920 if (env->mmu_model & POWERPC_MMU_64) {
921 htab_mask = 0x0FFFFFFF >> (28 - (sdr & 0x1F));
922 /* XXX: this is false for 1 TB segments */
923 hash = ((vsid ^ pgidx) << vsid_sh) & vsid_mask;
924 } else
925 #endif
926 {
927 htab_mask = sdr & 0x000001FF;
928 hash = ((vsid ^ pgidx) << vsid_sh) & vsid_mask;
929 }
930 mask = (htab_mask << sdr_sh) | sdr_mask;
931 LOG_MMU("sdr " TARGET_FMT_plx " sh %d hash " TARGET_FMT_plx
932 " mask " TARGET_FMT_plx " " TARGET_FMT_lx "\n",
933 sdr, sdr_sh, hash, mask, page_mask);
934 ctx->pg_addr[0] = get_pgaddr(sdr, sdr_sh, hash, mask);
935 /* Secondary table address */
936 hash = (~hash) & vsid_mask;
937 LOG_MMU("sdr " TARGET_FMT_plx " sh %d hash " TARGET_FMT_plx
938 " mask " TARGET_FMT_plx "\n", sdr, sdr_sh, hash, mask);
939 ctx->pg_addr[1] = get_pgaddr(sdr, sdr_sh, hash, mask);
940 #if defined(TARGET_PPC64)
941 if (env->mmu_model & POWERPC_MMU_64) {
942 /* Only 5 bits of the page index are used in the AVPN */
943 if (target_page_bits > 23) {
944 ctx->ptem = (vsid << 12) |
945 ((pgidx << (target_page_bits - 16)) & 0xF80);
946 } else {
947 ctx->ptem = (vsid << 12) | ((pgidx >> 4) & 0x0F80);
948 }
949 } else
950 #endif
951 {
952 ctx->ptem = (vsid << 7) | (pgidx >> 10);
953 }
954 /* Initialize real address with an invalid value */
955 ctx->raddr = (target_phys_addr_t)-1ULL;
956 if (unlikely(env->mmu_model == POWERPC_MMU_SOFT_6xx ||
957 env->mmu_model == POWERPC_MMU_SOFT_74xx)) {
958 /* Software TLB search */
959 ret = ppc6xx_tlb_check(env, ctx, eaddr, rw, type);
960 } else {
961 LOG_MMU("0 sdr1=" TARGET_FMT_plx " vsid=" TARGET_FMT_lx " "
962 "api=" TARGET_FMT_lx " hash=" TARGET_FMT_plx
963 " pg_addr=" TARGET_FMT_plx "\n",
964 sdr, vsid, pgidx, hash, ctx->pg_addr[0]);
965 /* Primary table lookup */
966 ret = find_pte(env, ctx, 0, rw, type, target_page_bits);
967 if (ret < 0) {
968 /* Secondary table lookup */
969 if (eaddr != 0xEFFFFFFF)
970 LOG_MMU("1 sdr1=" TARGET_FMT_plx " vsid=" TARGET_FMT_lx " "
971 "api=" TARGET_FMT_lx " hash=" TARGET_FMT_plx
972 " pg_addr=" TARGET_FMT_plx "\n", sdr, vsid,
973 pgidx, hash, ctx->pg_addr[1]);
974 ret2 = find_pte(env, ctx, 1, rw, type,
975 target_page_bits);
976 if (ret2 != -1)
977 ret = ret2;
978 }
979 }
980 #if defined (DUMP_PAGE_TABLES)
981 if (qemu_log_enabled()) {
982 target_phys_addr_t curaddr;
983 uint32_t a0, a1, a2, a3;
984 qemu_log("Page table: " TARGET_FMT_plx " len " TARGET_FMT_plx
985 "\n", sdr, mask + 0x80);
986 for (curaddr = sdr; curaddr < (sdr + mask + 0x80);
987 curaddr += 16) {
988 a0 = ldl_phys(curaddr);
989 a1 = ldl_phys(curaddr + 4);
990 a2 = ldl_phys(curaddr + 8);
991 a3 = ldl_phys(curaddr + 12);
992 if (a0 != 0 || a1 != 0 || a2 != 0 || a3 != 0) {
993 qemu_log(TARGET_FMT_plx ": %08x %08x %08x %08x\n",
994 curaddr, a0, a1, a2, a3);
995 }
996 }
997 }
998 #endif
999 } else {
1000 LOG_MMU("No access allowed\n");
1001 ret = -3;
1002 }
1003 } else {
1004 LOG_MMU("direct store...\n");
1005 /* Direct-store segment : absolutely *BUGGY* for now */
1006 switch (type) {
1007 case ACCESS_INT:
1008 /* Integer load/store : only access allowed */
1009 break;
1010 case ACCESS_CODE:
1011 /* No code fetch is allowed in direct-store areas */
1012 return -4;
1013 case ACCESS_FLOAT:
1014 /* Floating point load/store */
1015 return -4;
1016 case ACCESS_RES:
1017 /* lwarx, ldarx or srwcx. */
1018 return -4;
1019 case ACCESS_CACHE:
1020 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
1021 /* Should make the instruction do no-op.
1022 * As it already do no-op, it's quite easy :-)
1023 */
1024 ctx->raddr = eaddr;
1025 return 0;
1026 case ACCESS_EXT:
1027 /* eciwx or ecowx */
1028 return -4;
1029 default:
1030 qemu_log("ERROR: instruction should not need "
1031 "address translation\n");
1032 return -4;
1033 }
1034 if ((rw == 1 || ctx->key != 1) && (rw == 0 || ctx->key != 0)) {
1035 ctx->raddr = eaddr;
1036 ret = 2;
1037 } else {
1038 ret = -2;
1039 }
1040 }
1041
1042 return ret;
1043 }
1044
1045 /* Generic TLB check function for embedded PowerPC implementations */
1046 static inline int ppcemb_tlb_check(CPUState *env, ppcemb_tlb_t *tlb,
1047 target_phys_addr_t *raddrp,
1048 target_ulong address, uint32_t pid, int ext,
1049 int i)
1050 {
1051 target_ulong mask;
1052
1053 /* Check valid flag */
1054 if (!(tlb->prot & PAGE_VALID)) {
1055 qemu_log("%s: TLB %d not valid\n", __func__, i);
1056 return -1;
1057 }
1058 mask = ~(tlb->size - 1);
1059 LOG_SWTLB("%s: TLB %d address " TARGET_FMT_lx " PID %u <=> " TARGET_FMT_lx
1060 " " TARGET_FMT_lx " %u\n", __func__, i, address, pid, tlb->EPN,
1061 mask, (uint32_t)tlb->PID);
1062 /* Check PID */
1063 if (tlb->PID != 0 && tlb->PID != pid)
1064 return -1;
1065 /* Check effective address */
1066 if ((address & mask) != tlb->EPN)
1067 return -1;
1068 *raddrp = (tlb->RPN & mask) | (address & ~mask);
1069 #if (TARGET_PHYS_ADDR_BITS >= 36)
1070 if (ext) {
1071 /* Extend the physical address to 36 bits */
1072 *raddrp |= (target_phys_addr_t)(tlb->RPN & 0xF) << 32;
1073 }
1074 #endif
1075
1076 return 0;
1077 }
1078
1079 /* Generic TLB search function for PowerPC embedded implementations */
1080 int ppcemb_tlb_search (CPUPPCState *env, target_ulong address, uint32_t pid)
1081 {
1082 ppcemb_tlb_t *tlb;
1083 target_phys_addr_t raddr;
1084 int i, ret;
1085
1086 /* Default return value is no match */
1087 ret = -1;
1088 for (i = 0; i < env->nb_tlb; i++) {
1089 tlb = &env->tlb[i].tlbe;
1090 if (ppcemb_tlb_check(env, tlb, &raddr, address, pid, 0, i) == 0) {
1091 ret = i;
1092 break;
1093 }
1094 }
1095
1096 return ret;
1097 }
1098
1099 /* Helpers specific to PowerPC 40x implementations */
1100 static inline void ppc4xx_tlb_invalidate_all(CPUState *env)
1101 {
1102 ppcemb_tlb_t *tlb;
1103 int i;
1104
1105 for (i = 0; i < env->nb_tlb; i++) {
1106 tlb = &env->tlb[i].tlbe;
1107 tlb->prot &= ~PAGE_VALID;
1108 }
1109 tlb_flush(env, 1);
1110 }
1111
1112 static inline void ppc4xx_tlb_invalidate_virt(CPUState *env,
1113 target_ulong eaddr, uint32_t pid)
1114 {
1115 #if !defined(FLUSH_ALL_TLBS)
1116 ppcemb_tlb_t *tlb;
1117 target_phys_addr_t raddr;
1118 target_ulong page, end;
1119 int i;
1120
1121 for (i = 0; i < env->nb_tlb; i++) {
1122 tlb = &env->tlb[i].tlbe;
1123 if (ppcemb_tlb_check(env, tlb, &raddr, eaddr, pid, 0, i) == 0) {
1124 end = tlb->EPN + tlb->size;
1125 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE)
1126 tlb_flush_page(env, page);
1127 tlb->prot &= ~PAGE_VALID;
1128 break;
1129 }
1130 }
1131 #else
1132 ppc4xx_tlb_invalidate_all(env);
1133 #endif
1134 }
1135
1136 static int mmu40x_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
1137 target_ulong address, int rw, int access_type)
1138 {
1139 ppcemb_tlb_t *tlb;
1140 target_phys_addr_t raddr;
1141 int i, ret, zsel, zpr, pr;
1142
1143 ret = -1;
1144 raddr = (target_phys_addr_t)-1ULL;
1145 pr = msr_pr;
1146 for (i = 0; i < env->nb_tlb; i++) {
1147 tlb = &env->tlb[i].tlbe;
1148 if (ppcemb_tlb_check(env, tlb, &raddr, address,
1149 env->spr[SPR_40x_PID], 0, i) < 0)
1150 continue;
1151 zsel = (tlb->attr >> 4) & 0xF;
1152 zpr = (env->spr[SPR_40x_ZPR] >> (30 - (2 * zsel))) & 0x3;
1153 LOG_SWTLB("%s: TLB %d zsel %d zpr %d rw %d attr %08x\n",
1154 __func__, i, zsel, zpr, rw, tlb->attr);
1155 /* Check execute enable bit */
1156 switch (zpr) {
1157 case 0x2:
1158 if (pr != 0)
1159 goto check_perms;
1160 /* No break here */
1161 case 0x3:
1162 /* All accesses granted */
1163 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
1164 ret = 0;
1165 break;
1166 case 0x0:
1167 if (pr != 0) {
1168 /* Raise Zone protection fault. */
1169 env->spr[SPR_40x_ESR] = 1 << 22;
1170 ctx->prot = 0;
1171 ret = -2;
1172 break;
1173 }
1174 /* No break here */
1175 case 0x1:
1176 check_perms:
1177 /* Check from TLB entry */
1178 /* XXX: there is a problem here or in the TLB fill code... */
1179 ctx->prot = tlb->prot;
1180 ctx->prot |= PAGE_EXEC;
1181 ret = check_prot(ctx->prot, rw, access_type);
1182 if (ret == -2)
1183 env->spr[SPR_40x_ESR] = 0;
1184 break;
1185 }
1186 if (ret >= 0) {
1187 ctx->raddr = raddr;
1188 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
1189 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
1190 ret);
1191 return 0;
1192 }
1193 }
1194 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
1195 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
1196
1197 return ret;
1198 }
1199
1200 void store_40x_sler (CPUPPCState *env, uint32_t val)
1201 {
1202 /* XXX: TO BE FIXED */
1203 if (val != 0x00000000) {
1204 cpu_abort(env, "Little-endian regions are not supported by now\n");
1205 }
1206 env->spr[SPR_405_SLER] = val;
1207 }
1208
1209 static int mmubooke_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
1210 target_ulong address, int rw,
1211 int access_type)
1212 {
1213 ppcemb_tlb_t *tlb;
1214 target_phys_addr_t raddr;
1215 int i, prot, ret;
1216
1217 ret = -1;
1218 raddr = (target_phys_addr_t)-1ULL;
1219 for (i = 0; i < env->nb_tlb; i++) {
1220 tlb = &env->tlb[i].tlbe;
1221 if (ppcemb_tlb_check(env, tlb, &raddr, address,
1222 env->spr[SPR_BOOKE_PID], 1, i) < 0)
1223 continue;
1224 if (msr_pr != 0)
1225 prot = tlb->prot & 0xF;
1226 else
1227 prot = (tlb->prot >> 4) & 0xF;
1228 /* Check the address space */
1229 if (access_type == ACCESS_CODE) {
1230 if (msr_ir != (tlb->attr & 1))
1231 continue;
1232 ctx->prot = prot;
1233 if (prot & PAGE_EXEC) {
1234 ret = 0;
1235 break;
1236 }
1237 ret = -3;
1238 } else {
1239 if (msr_dr != (tlb->attr & 1))
1240 continue;
1241 ctx->prot = prot;
1242 if ((!rw && prot & PAGE_READ) || (rw && (prot & PAGE_WRITE))) {
1243 ret = 0;
1244 break;
1245 }
1246 ret = -2;
1247 }
1248 }
1249 if (ret >= 0)
1250 ctx->raddr = raddr;
1251
1252 return ret;
1253 }
1254
1255 static inline int check_physical(CPUState *env, mmu_ctx_t *ctx,
1256 target_ulong eaddr, int rw)
1257 {
1258 int in_plb, ret;
1259
1260 ctx->raddr = eaddr;
1261 ctx->prot = PAGE_READ | PAGE_EXEC;
1262 ret = 0;
1263 switch (env->mmu_model) {
1264 case POWERPC_MMU_32B:
1265 case POWERPC_MMU_601:
1266 case POWERPC_MMU_SOFT_6xx:
1267 case POWERPC_MMU_SOFT_74xx:
1268 case POWERPC_MMU_SOFT_4xx:
1269 case POWERPC_MMU_REAL:
1270 case POWERPC_MMU_BOOKE:
1271 ctx->prot |= PAGE_WRITE;
1272 break;
1273 #if defined(TARGET_PPC64)
1274 case POWERPC_MMU_620:
1275 case POWERPC_MMU_64B:
1276 /* Real address are 60 bits long */
1277 ctx->raddr &= 0x0FFFFFFFFFFFFFFFULL;
1278 ctx->prot |= PAGE_WRITE;
1279 break;
1280 #endif
1281 case POWERPC_MMU_SOFT_4xx_Z:
1282 if (unlikely(msr_pe != 0)) {
1283 /* 403 family add some particular protections,
1284 * using PBL/PBU registers for accesses with no translation.
1285 */
1286 in_plb =
1287 /* Check PLB validity */
1288 (env->pb[0] < env->pb[1] &&
1289 /* and address in plb area */
1290 eaddr >= env->pb[0] && eaddr < env->pb[1]) ||
1291 (env->pb[2] < env->pb[3] &&
1292 eaddr >= env->pb[2] && eaddr < env->pb[3]) ? 1 : 0;
1293 if (in_plb ^ msr_px) {
1294 /* Access in protected area */
1295 if (rw == 1) {
1296 /* Access is not allowed */
1297 ret = -2;
1298 }
1299 } else {
1300 /* Read-write access is allowed */
1301 ctx->prot |= PAGE_WRITE;
1302 }
1303 }
1304 break;
1305 case POWERPC_MMU_MPC8xx:
1306 /* XXX: TODO */
1307 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1308 break;
1309 case POWERPC_MMU_BOOKE_FSL:
1310 /* XXX: TODO */
1311 cpu_abort(env, "BookE FSL MMU model not implemented\n");
1312 break;
1313 default:
1314 cpu_abort(env, "Unknown or invalid MMU model\n");
1315 return -1;
1316 }
1317
1318 return ret;
1319 }
1320
1321 int get_physical_address (CPUState *env, mmu_ctx_t *ctx, target_ulong eaddr,
1322 int rw, int access_type)
1323 {
1324 int ret;
1325
1326 #if 0
1327 qemu_log("%s\n", __func__);
1328 #endif
1329 if ((access_type == ACCESS_CODE && msr_ir == 0) ||
1330 (access_type != ACCESS_CODE && msr_dr == 0)) {
1331 /* No address translation */
1332 ret = check_physical(env, ctx, eaddr, rw);
1333 } else {
1334 ret = -1;
1335 switch (env->mmu_model) {
1336 case POWERPC_MMU_32B:
1337 case POWERPC_MMU_601:
1338 case POWERPC_MMU_SOFT_6xx:
1339 case POWERPC_MMU_SOFT_74xx:
1340 /* Try to find a BAT */
1341 if (env->nb_BATs != 0)
1342 ret = get_bat(env, ctx, eaddr, rw, access_type);
1343 #if defined(TARGET_PPC64)
1344 case POWERPC_MMU_620:
1345 case POWERPC_MMU_64B:
1346 #endif
1347 if (ret < 0) {
1348 /* We didn't match any BAT entry or don't have BATs */
1349 ret = get_segment(env, ctx, eaddr, rw, access_type);
1350 }
1351 break;
1352 case POWERPC_MMU_SOFT_4xx:
1353 case POWERPC_MMU_SOFT_4xx_Z:
1354 ret = mmu40x_get_physical_address(env, ctx, eaddr,
1355 rw, access_type);
1356 break;
1357 case POWERPC_MMU_BOOKE:
1358 ret = mmubooke_get_physical_address(env, ctx, eaddr,
1359 rw, access_type);
1360 break;
1361 case POWERPC_MMU_MPC8xx:
1362 /* XXX: TODO */
1363 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1364 break;
1365 case POWERPC_MMU_BOOKE_FSL:
1366 /* XXX: TODO */
1367 cpu_abort(env, "BookE FSL MMU model not implemented\n");
1368 return -1;
1369 case POWERPC_MMU_REAL:
1370 cpu_abort(env, "PowerPC in real mode do not do any translation\n");
1371 return -1;
1372 default:
1373 cpu_abort(env, "Unknown or invalid MMU model\n");
1374 return -1;
1375 }
1376 }
1377 #if 0
1378 qemu_log("%s address " TARGET_FMT_lx " => %d " TARGET_FMT_plx "\n",
1379 __func__, eaddr, ret, ctx->raddr);
1380 #endif
1381
1382 return ret;
1383 }
1384
1385 target_phys_addr_t cpu_get_phys_page_debug (CPUState *env, target_ulong addr)
1386 {
1387 mmu_ctx_t ctx;
1388
1389 if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT) != 0))
1390 return -1;
1391
1392 return ctx.raddr & TARGET_PAGE_MASK;
1393 }
1394
1395 /* Perform address translation */
1396 int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
1397 int mmu_idx, int is_softmmu)
1398 {
1399 mmu_ctx_t ctx;
1400 int access_type;
1401 int ret = 0;
1402
1403 if (rw == 2) {
1404 /* code access */
1405 rw = 0;
1406 access_type = ACCESS_CODE;
1407 } else {
1408 /* data access */
1409 access_type = env->access_type;
1410 }
1411 ret = get_physical_address(env, &ctx, address, rw, access_type);
1412 if (ret == 0) {
1413 ret = tlb_set_page_exec(env, address & TARGET_PAGE_MASK,
1414 ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
1415 mmu_idx, is_softmmu);
1416 } else if (ret < 0) {
1417 LOG_MMU_STATE(env);
1418 if (access_type == ACCESS_CODE) {
1419 switch (ret) {
1420 case -1:
1421 /* No matches in page tables or TLB */
1422 switch (env->mmu_model) {
1423 case POWERPC_MMU_SOFT_6xx:
1424 env->exception_index = POWERPC_EXCP_IFTLB;
1425 env->error_code = 1 << 18;
1426 env->spr[SPR_IMISS] = address;
1427 env->spr[SPR_ICMP] = 0x80000000 | ctx.ptem;
1428 goto tlb_miss;
1429 case POWERPC_MMU_SOFT_74xx:
1430 env->exception_index = POWERPC_EXCP_IFTLB;
1431 goto tlb_miss_74xx;
1432 case POWERPC_MMU_SOFT_4xx:
1433 case POWERPC_MMU_SOFT_4xx_Z:
1434 env->exception_index = POWERPC_EXCP_ITLB;
1435 env->error_code = 0;
1436 env->spr[SPR_40x_DEAR] = address;
1437 env->spr[SPR_40x_ESR] = 0x00000000;
1438 break;
1439 case POWERPC_MMU_32B:
1440 case POWERPC_MMU_601:
1441 #if defined(TARGET_PPC64)
1442 case POWERPC_MMU_620:
1443 case POWERPC_MMU_64B:
1444 #endif
1445 env->exception_index = POWERPC_EXCP_ISI;
1446 env->error_code = 0x40000000;
1447 break;
1448 case POWERPC_MMU_BOOKE:
1449 /* XXX: TODO */
1450 cpu_abort(env, "BookE MMU model is not implemented\n");
1451 return -1;
1452 case POWERPC_MMU_BOOKE_FSL:
1453 /* XXX: TODO */
1454 cpu_abort(env, "BookE FSL MMU model is not implemented\n");
1455 return -1;
1456 case POWERPC_MMU_MPC8xx:
1457 /* XXX: TODO */
1458 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1459 break;
1460 case POWERPC_MMU_REAL:
1461 cpu_abort(env, "PowerPC in real mode should never raise "
1462 "any MMU exceptions\n");
1463 return -1;
1464 default:
1465 cpu_abort(env, "Unknown or invalid MMU model\n");
1466 return -1;
1467 }
1468 break;
1469 case -2:
1470 /* Access rights violation */
1471 env->exception_index = POWERPC_EXCP_ISI;
1472 env->error_code = 0x08000000;
1473 break;
1474 case -3:
1475 /* No execute protection violation */
1476 env->exception_index = POWERPC_EXCP_ISI;
1477 env->error_code = 0x10000000;
1478 break;
1479 case -4:
1480 /* Direct store exception */
1481 /* No code fetch is allowed in direct-store areas */
1482 env->exception_index = POWERPC_EXCP_ISI;
1483 env->error_code = 0x10000000;
1484 break;
1485 #if defined(TARGET_PPC64)
1486 case -5:
1487 /* No match in segment table */
1488 if (env->mmu_model == POWERPC_MMU_620) {
1489 env->exception_index = POWERPC_EXCP_ISI;
1490 /* XXX: this might be incorrect */
1491 env->error_code = 0x40000000;
1492 } else {
1493 env->exception_index = POWERPC_EXCP_ISEG;
1494 env->error_code = 0;
1495 }
1496 break;
1497 #endif
1498 }
1499 } else {
1500 switch (ret) {
1501 case -1:
1502 /* No matches in page tables or TLB */
1503 switch (env->mmu_model) {
1504 case POWERPC_MMU_SOFT_6xx:
1505 if (rw == 1) {
1506 env->exception_index = POWERPC_EXCP_DSTLB;
1507 env->error_code = 1 << 16;
1508 } else {
1509 env->exception_index = POWERPC_EXCP_DLTLB;
1510 env->error_code = 0;
1511 }
1512 env->spr[SPR_DMISS] = address;
1513 env->spr[SPR_DCMP] = 0x80000000 | ctx.ptem;
1514 tlb_miss:
1515 env->error_code |= ctx.key << 19;
1516 env->spr[SPR_HASH1] = ctx.pg_addr[0];
1517 env->spr[SPR_HASH2] = ctx.pg_addr[1];
1518 break;
1519 case POWERPC_MMU_SOFT_74xx:
1520 if (rw == 1) {
1521 env->exception_index = POWERPC_EXCP_DSTLB;
1522 } else {
1523 env->exception_index = POWERPC_EXCP_DLTLB;
1524 }
1525 tlb_miss_74xx:
1526 /* Implement LRU algorithm */
1527 env->error_code = ctx.key << 19;
1528 env->spr[SPR_TLBMISS] = (address & ~((target_ulong)0x3)) |
1529 ((env->last_way + 1) & (env->nb_ways - 1));
1530 env->spr[SPR_PTEHI] = 0x80000000 | ctx.ptem;
1531 break;
1532 case POWERPC_MMU_SOFT_4xx:
1533 case POWERPC_MMU_SOFT_4xx_Z:
1534 env->exception_index = POWERPC_EXCP_DTLB;
1535 env->error_code = 0;
1536 env->spr[SPR_40x_DEAR] = address;
1537 if (rw)
1538 env->spr[SPR_40x_ESR] = 0x00800000;
1539 else
1540 env->spr[SPR_40x_ESR] = 0x00000000;
1541 break;
1542 case POWERPC_MMU_32B:
1543 case POWERPC_MMU_601:
1544 #if defined(TARGET_PPC64)
1545 case POWERPC_MMU_620:
1546 case POWERPC_MMU_64B:
1547 #endif
1548 env->exception_index = POWERPC_EXCP_DSI;
1549 env->error_code = 0;
1550 env->spr[SPR_DAR] = address;
1551 if (rw == 1)
1552 env->spr[SPR_DSISR] = 0x42000000;
1553 else
1554 env->spr[SPR_DSISR] = 0x40000000;
1555 break;
1556 case POWERPC_MMU_MPC8xx:
1557 /* XXX: TODO */
1558 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1559 break;
1560 case POWERPC_MMU_BOOKE:
1561 /* XXX: TODO */
1562 cpu_abort(env, "BookE MMU model is not implemented\n");
1563 return -1;
1564 case POWERPC_MMU_BOOKE_FSL:
1565 /* XXX: TODO */
1566 cpu_abort(env, "BookE FSL MMU model is not implemented\n");
1567 return -1;
1568 case POWERPC_MMU_REAL:
1569 cpu_abort(env, "PowerPC in real mode should never raise "
1570 "any MMU exceptions\n");
1571 return -1;
1572 default:
1573 cpu_abort(env, "Unknown or invalid MMU model\n");
1574 return -1;
1575 }
1576 break;
1577 case -2:
1578 /* Access rights violation */
1579 env->exception_index = POWERPC_EXCP_DSI;
1580 env->error_code = 0;
1581 if (env->mmu_model == POWERPC_MMU_SOFT_4xx
1582 || env->mmu_model == POWERPC_MMU_SOFT_4xx_Z) {
1583 env->spr[SPR_40x_DEAR] = address;
1584 if (rw) {
1585 env->spr[SPR_40x_ESR] |= 0x00800000;
1586 }
1587 } else {
1588 env->spr[SPR_DAR] = address;
1589 if (rw == 1) {
1590 env->spr[SPR_DSISR] = 0x0A000000;
1591 } else {
1592 env->spr[SPR_DSISR] = 0x08000000;
1593 }
1594 }
1595 break;
1596 case -4:
1597 /* Direct store exception */
1598 switch (access_type) {
1599 case ACCESS_FLOAT:
1600 /* Floating point load/store */
1601 env->exception_index = POWERPC_EXCP_ALIGN;
1602 env->error_code = POWERPC_EXCP_ALIGN_FP;
1603 env->spr[SPR_DAR] = address;
1604 break;
1605 case ACCESS_RES:
1606 /* lwarx, ldarx or stwcx. */
1607 env->exception_index = POWERPC_EXCP_DSI;
1608 env->error_code = 0;
1609 env->spr[SPR_DAR] = address;
1610 if (rw == 1)
1611 env->spr[SPR_DSISR] = 0x06000000;
1612 else
1613 env->spr[SPR_DSISR] = 0x04000000;
1614 break;
1615 case ACCESS_EXT:
1616 /* eciwx or ecowx */
1617 env->exception_index = POWERPC_EXCP_DSI;
1618 env->error_code = 0;
1619 env->spr[SPR_DAR] = address;
1620 if (rw == 1)
1621 env->spr[SPR_DSISR] = 0x06100000;
1622 else
1623 env->spr[SPR_DSISR] = 0x04100000;
1624 break;
1625 default:
1626 printf("DSI: invalid exception (%d)\n", ret);
1627 env->exception_index = POWERPC_EXCP_PROGRAM;
1628 env->error_code =
1629 POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL;
1630 env->spr[SPR_DAR] = address;
1631 break;
1632 }
1633 break;
1634 #if defined(TARGET_PPC64)
1635 case -5:
1636 /* No match in segment table */
1637 if (env->mmu_model == POWERPC_MMU_620) {
1638 env->exception_index = POWERPC_EXCP_DSI;
1639 env->error_code = 0;
1640 env->spr[SPR_DAR] = address;
1641 /* XXX: this might be incorrect */
1642 if (rw == 1)
1643 env->spr[SPR_DSISR] = 0x42000000;
1644 else
1645 env->spr[SPR_DSISR] = 0x40000000;
1646 } else {
1647 env->exception_index = POWERPC_EXCP_DSEG;
1648 env->error_code = 0;
1649 env->spr[SPR_DAR] = address;
1650 }
1651 break;
1652 #endif
1653 }
1654 }
1655 #if 0
1656 printf("%s: set exception to %d %02x\n", __func__,
1657 env->exception, env->error_code);
1658 #endif
1659 ret = 1;
1660 }
1661
1662 return ret;
1663 }
1664
1665 /*****************************************************************************/
1666 /* BATs management */
1667 #if !defined(FLUSH_ALL_TLBS)
1668 static inline void do_invalidate_BAT(CPUPPCState *env, target_ulong BATu,
1669 target_ulong mask)
1670 {
1671 target_ulong base, end, page;
1672
1673 base = BATu & ~0x0001FFFF;
1674 end = base + mask + 0x00020000;
1675 LOG_BATS("Flush BAT from " TARGET_FMT_lx " to " TARGET_FMT_lx " ("
1676 TARGET_FMT_lx ")\n", base, end, mask);
1677 for (page = base; page != end; page += TARGET_PAGE_SIZE)
1678 tlb_flush_page(env, page);
1679 LOG_BATS("Flush done\n");
1680 }
1681 #endif
1682
1683 static inline void dump_store_bat(CPUPPCState *env, char ID, int ul, int nr,
1684 target_ulong value)
1685 {
1686 LOG_BATS("Set %cBAT%d%c to " TARGET_FMT_lx " (" TARGET_FMT_lx ")\n", ID,
1687 nr, ul == 0 ? 'u' : 'l', value, env->nip);
1688 }
1689
1690 void ppc_store_ibatu (CPUPPCState *env, int nr, target_ulong value)
1691 {
1692 target_ulong mask;
1693
1694 dump_store_bat(env, 'I', 0, nr, value);
1695 if (env->IBAT[0][nr] != value) {
1696 mask = (value << 15) & 0x0FFE0000UL;
1697 #if !defined(FLUSH_ALL_TLBS)
1698 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1699 #endif
1700 /* When storing valid upper BAT, mask BEPI and BRPN
1701 * and invalidate all TLBs covered by this BAT
1702 */
1703 mask = (value << 15) & 0x0FFE0000UL;
1704 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1705 (value & ~0x0001FFFFUL & ~mask);
1706 env->IBAT[1][nr] = (env->IBAT[1][nr] & 0x0000007B) |
1707 (env->IBAT[1][nr] & ~0x0001FFFF & ~mask);
1708 #if !defined(FLUSH_ALL_TLBS)
1709 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1710 #else
1711 tlb_flush(env, 1);
1712 #endif
1713 }
1714 }
1715
1716 void ppc_store_ibatl (CPUPPCState *env, int nr, target_ulong value)
1717 {
1718 dump_store_bat(env, 'I', 1, nr, value);
1719 env->IBAT[1][nr] = value;
1720 }
1721
1722 void ppc_store_dbatu (CPUPPCState *env, int nr, target_ulong value)
1723 {
1724 target_ulong mask;
1725
1726 dump_store_bat(env, 'D', 0, nr, value);
1727 if (env->DBAT[0][nr] != value) {
1728 /* When storing valid upper BAT, mask BEPI and BRPN
1729 * and invalidate all TLBs covered by this BAT
1730 */
1731 mask = (value << 15) & 0x0FFE0000UL;
1732 #if !defined(FLUSH_ALL_TLBS)
1733 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1734 #endif
1735 mask = (value << 15) & 0x0FFE0000UL;
1736 env->DBAT[0][nr] = (value & 0x00001FFFUL) |
1737 (value & ~0x0001FFFFUL & ~mask);
1738 env->DBAT[1][nr] = (env->DBAT[1][nr] & 0x0000007B) |
1739 (env->DBAT[1][nr] & ~0x0001FFFF & ~mask);
1740 #if !defined(FLUSH_ALL_TLBS)
1741 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1742 #else
1743 tlb_flush(env, 1);
1744 #endif
1745 }
1746 }
1747
1748 void ppc_store_dbatl (CPUPPCState *env, int nr, target_ulong value)
1749 {
1750 dump_store_bat(env, 'D', 1, nr, value);
1751 env->DBAT[1][nr] = value;
1752 }
1753
1754 void ppc_store_ibatu_601 (CPUPPCState *env, int nr, target_ulong value)
1755 {
1756 target_ulong mask;
1757 int do_inval;
1758
1759 dump_store_bat(env, 'I', 0, nr, value);
1760 if (env->IBAT[0][nr] != value) {
1761 do_inval = 0;
1762 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1763 if (env->IBAT[1][nr] & 0x40) {
1764 /* Invalidate BAT only if it is valid */
1765 #if !defined(FLUSH_ALL_TLBS)
1766 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1767 #else
1768 do_inval = 1;
1769 #endif
1770 }
1771 /* When storing valid upper BAT, mask BEPI and BRPN
1772 * and invalidate all TLBs covered by this BAT
1773 */
1774 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1775 (value & ~0x0001FFFFUL & ~mask);
1776 env->DBAT[0][nr] = env->IBAT[0][nr];
1777 if (env->IBAT[1][nr] & 0x40) {
1778 #if !defined(FLUSH_ALL_TLBS)
1779 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1780 #else
1781 do_inval = 1;
1782 #endif
1783 }
1784 #if defined(FLUSH_ALL_TLBS)
1785 if (do_inval)
1786 tlb_flush(env, 1);
1787 #endif
1788 }
1789 }
1790
1791 void ppc_store_ibatl_601 (CPUPPCState *env, int nr, target_ulong value)
1792 {
1793 target_ulong mask;
1794 int do_inval;
1795
1796 dump_store_bat(env, 'I', 1, nr, value);
1797 if (env->IBAT[1][nr] != value) {
1798 do_inval = 0;
1799 if (env->IBAT[1][nr] & 0x40) {
1800 #if !defined(FLUSH_ALL_TLBS)
1801 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1802 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1803 #else
1804 do_inval = 1;
1805 #endif
1806 }
1807 if (value & 0x40) {
1808 #if !defined(FLUSH_ALL_TLBS)
1809 mask = (value << 17) & 0x0FFE0000UL;
1810 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1811 #else
1812 do_inval = 1;
1813 #endif
1814 }
1815 env->IBAT[1][nr] = value;
1816 env->DBAT[1][nr] = value;
1817 #if defined(FLUSH_ALL_TLBS)
1818 if (do_inval)
1819 tlb_flush(env, 1);
1820 #endif
1821 }
1822 }
1823
1824 /*****************************************************************************/
1825 /* TLB management */
1826 void ppc_tlb_invalidate_all (CPUPPCState *env)
1827 {
1828 switch (env->mmu_model) {
1829 case POWERPC_MMU_SOFT_6xx:
1830 case POWERPC_MMU_SOFT_74xx:
1831 ppc6xx_tlb_invalidate_all(env);
1832 break;
1833 case POWERPC_MMU_SOFT_4xx:
1834 case POWERPC_MMU_SOFT_4xx_Z:
1835 ppc4xx_tlb_invalidate_all(env);
1836 break;
1837 case POWERPC_MMU_REAL:
1838 cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
1839 break;
1840 case POWERPC_MMU_MPC8xx:
1841 /* XXX: TODO */
1842 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1843 break;
1844 case POWERPC_MMU_BOOKE:
1845 /* XXX: TODO */
1846 cpu_abort(env, "BookE MMU model is not implemented\n");
1847 break;
1848 case POWERPC_MMU_BOOKE_FSL:
1849 /* XXX: TODO */
1850 if (!kvm_enabled())
1851 cpu_abort(env, "BookE MMU model is not implemented\n");
1852 break;
1853 case POWERPC_MMU_32B:
1854 case POWERPC_MMU_601:
1855 #if defined(TARGET_PPC64)
1856 case POWERPC_MMU_620:
1857 case POWERPC_MMU_64B:
1858 #endif /* defined(TARGET_PPC64) */
1859 tlb_flush(env, 1);
1860 break;
1861 default:
1862 /* XXX: TODO */
1863 cpu_abort(env, "Unknown MMU model\n");
1864 break;
1865 }
1866 }
1867
1868 void ppc_tlb_invalidate_one (CPUPPCState *env, target_ulong addr)
1869 {
1870 #if !defined(FLUSH_ALL_TLBS)
1871 addr &= TARGET_PAGE_MASK;
1872 switch (env->mmu_model) {
1873 case POWERPC_MMU_SOFT_6xx:
1874 case POWERPC_MMU_SOFT_74xx:
1875 ppc6xx_tlb_invalidate_virt(env, addr, 0);
1876 if (env->id_tlbs == 1)
1877 ppc6xx_tlb_invalidate_virt(env, addr, 1);
1878 break;
1879 case POWERPC_MMU_SOFT_4xx:
1880 case POWERPC_MMU_SOFT_4xx_Z:
1881 ppc4xx_tlb_invalidate_virt(env, addr, env->spr[SPR_40x_PID]);
1882 break;
1883 case POWERPC_MMU_REAL:
1884 cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
1885 break;
1886 case POWERPC_MMU_MPC8xx:
1887 /* XXX: TODO */
1888 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1889 break;
1890 case POWERPC_MMU_BOOKE:
1891 /* XXX: TODO */
1892 cpu_abort(env, "BookE MMU model is not implemented\n");
1893 break;
1894 case POWERPC_MMU_BOOKE_FSL:
1895 /* XXX: TODO */
1896 cpu_abort(env, "BookE FSL MMU model is not implemented\n");
1897 break;
1898 case POWERPC_MMU_32B:
1899 case POWERPC_MMU_601:
1900 /* tlbie invalidate TLBs for all segments */
1901 addr &= ~((target_ulong)-1ULL << 28);
1902 /* XXX: this case should be optimized,
1903 * giving a mask to tlb_flush_page
1904 */
1905 tlb_flush_page(env, addr | (0x0 << 28));
1906 tlb_flush_page(env, addr | (0x1 << 28));
1907 tlb_flush_page(env, addr | (0x2 << 28));
1908 tlb_flush_page(env, addr | (0x3 << 28));
1909 tlb_flush_page(env, addr | (0x4 << 28));
1910 tlb_flush_page(env, addr | (0x5 << 28));
1911 tlb_flush_page(env, addr | (0x6 << 28));
1912 tlb_flush_page(env, addr | (0x7 << 28));
1913 tlb_flush_page(env, addr | (0x8 << 28));
1914 tlb_flush_page(env, addr | (0x9 << 28));
1915 tlb_flush_page(env, addr | (0xA << 28));
1916 tlb_flush_page(env, addr | (0xB << 28));
1917 tlb_flush_page(env, addr | (0xC << 28));
1918 tlb_flush_page(env, addr | (0xD << 28));
1919 tlb_flush_page(env, addr | (0xE << 28));
1920 tlb_flush_page(env, addr | (0xF << 28));
1921 break;
1922 #if defined(TARGET_PPC64)
1923 case POWERPC_MMU_620:
1924 case POWERPC_MMU_64B:
1925 /* tlbie invalidate TLBs for all segments */
1926 /* XXX: given the fact that there are too many segments to invalidate,
1927 * and we still don't have a tlb_flush_mask(env, n, mask) in Qemu,
1928 * we just invalidate all TLBs
1929 */
1930 tlb_flush(env, 1);
1931 break;
1932 #endif /* defined(TARGET_PPC64) */
1933 default:
1934 /* XXX: TODO */
1935 cpu_abort(env, "Unknown MMU model\n");
1936 break;
1937 }
1938 #else
1939 ppc_tlb_invalidate_all(env);
1940 #endif
1941 }
1942
1943 /*****************************************************************************/
1944 /* Special registers manipulation */
1945 #if defined(TARGET_PPC64)
1946 void ppc_store_asr (CPUPPCState *env, target_ulong value)
1947 {
1948 if (env->asr != value) {
1949 env->asr = value;
1950 tlb_flush(env, 1);
1951 }
1952 }
1953 #endif
1954
1955 void ppc_store_sdr1 (CPUPPCState *env, target_ulong value)
1956 {
1957 LOG_MMU("%s: " TARGET_FMT_lx "\n", __func__, value);
1958 if (env->sdr1 != value) {
1959 /* XXX: for PowerPC 64, should check that the HTABSIZE value
1960 * is <= 28
1961 */
1962 env->sdr1 = value;
1963 tlb_flush(env, 1);
1964 }
1965 }
1966
1967 #if defined(TARGET_PPC64)
1968 target_ulong ppc_load_sr (CPUPPCState *env, int slb_nr)
1969 {
1970 // XXX
1971 return 0;
1972 }
1973 #endif
1974
1975 void ppc_store_sr (CPUPPCState *env, int srnum, target_ulong value)
1976 {
1977 LOG_MMU("%s: reg=%d " TARGET_FMT_lx " " TARGET_FMT_lx "\n", __func__,
1978 srnum, value, env->sr[srnum]);
1979 #if defined(TARGET_PPC64)
1980 if (env->mmu_model & POWERPC_MMU_64) {
1981 uint64_t rb = 0, rs = 0;
1982
1983 /* ESID = srnum */
1984 rb |= ((uint32_t)srnum & 0xf) << 28;
1985 /* Set the valid bit */
1986 rb |= 1 << 27;
1987 /* Index = ESID */
1988 rb |= (uint32_t)srnum;
1989
1990 /* VSID = VSID */
1991 rs |= (value & 0xfffffff) << 12;
1992 /* flags = flags */
1993 rs |= ((value >> 27) & 0xf) << 9;
1994
1995 ppc_store_slb(env, rb, rs);
1996 } else
1997 #endif
1998 if (env->sr[srnum] != value) {
1999 env->sr[srnum] = value;
2000 /* Invalidating 256MB of virtual memory in 4kB pages is way longer than
2001 flusing the whole TLB. */
2002 #if !defined(FLUSH_ALL_TLBS) && 0
2003 {
2004 target_ulong page, end;
2005 /* Invalidate 256 MB of virtual memory */
2006 page = (16 << 20) * srnum;
2007 end = page + (16 << 20);
2008 for (; page != end; page += TARGET_PAGE_SIZE)
2009 tlb_flush_page(env, page);
2010 }
2011 #else
2012 tlb_flush(env, 1);
2013 #endif
2014 }
2015 }
2016 #endif /* !defined (CONFIG_USER_ONLY) */
2017
2018 /* GDBstub can read and write MSR... */
2019 void ppc_store_msr (CPUPPCState *env, target_ulong value)
2020 {
2021 hreg_store_msr(env, value, 0);
2022 }
2023
2024 /*****************************************************************************/
2025 /* Exception processing */
2026 #if defined (CONFIG_USER_ONLY)
2027 void do_interrupt (CPUState *env)
2028 {
2029 env->exception_index = POWERPC_EXCP_NONE;
2030 env->error_code = 0;
2031 }
2032
2033 void ppc_hw_interrupt (CPUState *env)
2034 {
2035 env->exception_index = POWERPC_EXCP_NONE;
2036 env->error_code = 0;
2037 }
2038 #else /* defined (CONFIG_USER_ONLY) */
2039 static inline void dump_syscall(CPUState *env)
2040 {
2041 qemu_log_mask(CPU_LOG_INT, "syscall r0=%016" PRIx64 " r3=%016" PRIx64
2042 " r4=%016" PRIx64 " r5=%016" PRIx64 " r6=%016" PRIx64
2043 " nip=" TARGET_FMT_lx "\n",
2044 ppc_dump_gpr(env, 0), ppc_dump_gpr(env, 3),
2045 ppc_dump_gpr(env, 4), ppc_dump_gpr(env, 5),
2046 ppc_dump_gpr(env, 6), env->nip);
2047 }
2048
2049 /* Note that this function should be greatly optimized
2050 * when called with a constant excp, from ppc_hw_interrupt
2051 */
2052 static inline void powerpc_excp(CPUState *env, int excp_model, int excp)
2053 {
2054 target_ulong msr, new_msr, vector;
2055 int srr0, srr1, asrr0, asrr1;
2056 int lpes0, lpes1, lev;
2057
2058 if (0) {
2059 /* XXX: find a suitable condition to enable the hypervisor mode */
2060 lpes0 = (env->spr[SPR_LPCR] >> 1) & 1;
2061 lpes1 = (env->spr[SPR_LPCR] >> 2) & 1;
2062 } else {
2063 /* Those values ensure we won't enter the hypervisor mode */
2064 lpes0 = 0;
2065 lpes1 = 1;
2066 }
2067
2068 qemu_log_mask(CPU_LOG_INT, "Raise exception at " TARGET_FMT_lx
2069 " => %08x (%02x)\n", env->nip, excp, env->error_code);
2070 msr = env->msr;
2071 new_msr = msr;
2072 srr0 = SPR_SRR0;
2073 srr1 = SPR_SRR1;
2074 asrr0 = -1;
2075 asrr1 = -1;
2076 msr &= ~((target_ulong)0x783F0000);
2077 switch (excp) {
2078 case POWERPC_EXCP_NONE:
2079 /* Should never happen */
2080 return;
2081 case POWERPC_EXCP_CRITICAL: /* Critical input */
2082 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2083 switch (excp_model) {
2084 case POWERPC_EXCP_40x:
2085 srr0 = SPR_40x_SRR2;
2086 srr1 = SPR_40x_SRR3;
2087 break;
2088 case POWERPC_EXCP_BOOKE:
2089 srr0 = SPR_BOOKE_CSRR0;
2090 srr1 = SPR_BOOKE_CSRR1;
2091 break;
2092 case POWERPC_EXCP_G2:
2093 break;
2094 default:
2095 goto excp_invalid;
2096 }
2097 goto store_next;
2098 case POWERPC_EXCP_MCHECK: /* Machine check exception */
2099 if (msr_me == 0) {
2100 /* Machine check exception is not enabled.
2101 * Enter checkstop state.
2102 */
2103 if (qemu_log_enabled()) {
2104 qemu_log("Machine check while not allowed. "
2105 "Entering checkstop state\n");
2106 } else {
2107 fprintf(stderr, "Machine check while not allowed. "
2108 "Entering checkstop state\n");
2109 }
2110 env->halted = 1;
2111 env->interrupt_request |= CPU_INTERRUPT_EXITTB;
2112 }
2113 new_msr &= ~((target_ulong)1 << MSR_RI);
2114 new_msr &= ~((target_ulong)1 << MSR_ME);
2115 if (0) {
2116 /* XXX: find a suitable condition to enable the hypervisor mode */
2117 new_msr |= (target_ulong)MSR_HVB;
2118 }
2119 /* XXX: should also have something loaded in DAR / DSISR */
2120 switch (excp_model) {
2121 case POWERPC_EXCP_40x:
2122 srr0 = SPR_40x_SRR2;
2123 srr1 = SPR_40x_SRR3;
2124 break;
2125 case POWERPC_EXCP_BOOKE:
2126 srr0 = SPR_BOOKE_MCSRR0;
2127 srr1 = SPR_BOOKE_MCSRR1;
2128 asrr0 = SPR_BOOKE_CSRR0;
2129 asrr1 = SPR_BOOKE_CSRR1;
2130 break;
2131 default:
2132 break;
2133 }
2134 goto store_next;
2135 case POWERPC_EXCP_DSI: /* Data storage exception */
2136 LOG_EXCP("DSI exception: DSISR=" TARGET_FMT_lx" DAR=" TARGET_FMT_lx
2137 "\n", env->spr[SPR_DSISR], env->spr[SPR_DAR]);
2138 new_msr &= ~((target_ulong)1 << MSR_RI);
2139 if (lpes1 == 0)
2140 new_msr |= (target_ulong)MSR_HVB;
2141 goto store_next;
2142 case POWERPC_EXCP_ISI: /* Instruction storage exception */
2143 LOG_EXCP("ISI exception: msr=" TARGET_FMT_lx ", nip=" TARGET_FMT_lx
2144 "\n", msr, env->nip);
2145 new_msr &= ~((target_ulong)1 << MSR_RI);
2146 if (lpes1 == 0)
2147 new_msr |= (target_ulong)MSR_HVB;
2148 msr |= env->error_code;
2149 goto store_next;
2150 case POWERPC_EXCP_EXTERNAL: /* External input */
2151 new_msr &= ~((target_ulong)1 << MSR_RI);
2152 if (lpes0 == 1)
2153 new_msr |= (target_ulong)MSR_HVB;
2154 goto store_next;
2155 case POWERPC_EXCP_ALIGN: /* Alignment exception */
2156 new_msr &= ~((target_ulong)1 << MSR_RI);
2157 if (lpes1 == 0)
2158 new_msr |= (target_ulong)MSR_HVB;
2159 /* XXX: this is false */
2160 /* Get rS/rD and rA from faulting opcode */
2161 env->spr[SPR_DSISR] |= (ldl_code((env->nip - 4)) & 0x03FF0000) >> 16;
2162 goto store_current;
2163 case POWERPC_EXCP_PROGRAM: /* Program exception */
2164 switch (env->error_code & ~0xF) {
2165 case POWERPC_EXCP_FP:
2166 if ((msr_fe0 == 0 && msr_fe1 == 0) || msr_fp == 0) {
2167 LOG_EXCP("Ignore floating point exception\n");
2168 env->exception_index = POWERPC_EXCP_NONE;
2169 env->error_code = 0;
2170 return;
2171 }
2172 new_msr &= ~((target_ulong)1 << MSR_RI);
2173 if (lpes1 == 0)
2174 new_msr |= (target_ulong)MSR_HVB;
2175 msr |= 0x00100000;
2176 if (msr_fe0 == msr_fe1)
2177 goto store_next;
2178 msr |= 0x00010000;
2179 break;
2180 case POWERPC_EXCP_INVAL:
2181 LOG_EXCP("Invalid instruction at " TARGET_FMT_lx "\n", env->nip);
2182 new_msr &= ~((target_ulong)1 << MSR_RI);
2183 if (lpes1 == 0)
2184 new_msr |= (target_ulong)MSR_HVB;
2185 msr |= 0x00080000;
2186 break;
2187 case POWERPC_EXCP_PRIV:
2188 new_msr &= ~((target_ulong)1 << MSR_RI);
2189 if (lpes1 == 0)
2190 new_msr |= (target_ulong)MSR_HVB;
2191 msr |= 0x00040000;
2192 break;
2193 case POWERPC_EXCP_TRAP:
2194 new_msr &= ~((target_ulong)1 << MSR_RI);
2195 if (lpes1 == 0)
2196 new_msr |= (target_ulong)MSR_HVB;
2197 msr |= 0x00020000;
2198 break;
2199 default:
2200 /* Should never occur */
2201 cpu_abort(env, "Invalid program exception %d. Aborting\n",
2202 env->error_code);
2203 break;
2204 }
2205 goto store_current;
2206 case POWERPC_EXCP_FPU: /* Floating-point unavailable exception */
2207 new_msr &= ~((target_ulong)1 << MSR_RI);
2208 if (lpes1 == 0)
2209 new_msr |= (target_ulong)MSR_HVB;
2210 goto store_current;
2211 case POWERPC_EXCP_SYSCALL: /* System call exception */
2212 /* NOTE: this is a temporary hack to support graphics OSI
2213 calls from the MOL driver */
2214 /* XXX: To be removed */
2215 if (env->gpr[3] == 0x113724fa && env->gpr[4] == 0x77810f9b &&
2216 env->osi_call) {
2217 if (env->osi_call(env) != 0) {
2218 env->exception_index = POWERPC_EXCP_NONE;
2219 env->error_code = 0;
2220 return;
2221 }
2222 }
2223 dump_syscall(env);
2224 new_msr &= ~((target_ulong)1 << MSR_RI);
2225 lev = env->error_code;
2226 if (lev == 1 || (lpes0 == 0 && lpes1 == 0))
2227 new_msr |= (target_ulong)MSR_HVB;
2228 goto store_next;
2229 case POWERPC_EXCP_APU: /* Auxiliary processor unavailable */
2230 new_msr &= ~((target_ulong)1 << MSR_RI);
2231 goto store_current;
2232 case POWERPC_EXCP_DECR: /* Decrementer exception */
2233 new_msr &= ~((target_ulong)1 << MSR_RI);
2234 if (lpes1 == 0)
2235 new_msr |= (target_ulong)MSR_HVB;
2236 goto store_next;
2237 case POWERPC_EXCP_FIT: /* Fixed-interval timer interrupt */
2238 /* FIT on 4xx */
2239 LOG_EXCP("FIT exception\n");
2240 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2241 goto store_next;
2242 case POWERPC_EXCP_WDT: /* Watchdog timer interrupt */
2243 LOG_EXCP("WDT exception\n");
2244 switch (excp_model) {
2245 case POWERPC_EXCP_BOOKE:
2246 srr0 = SPR_BOOKE_CSRR0;
2247 srr1 = SPR_BOOKE_CSRR1;
2248 break;
2249 default:
2250 break;
2251 }
2252 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2253 goto store_next;
2254 case POWERPC_EXCP_DTLB: /* Data TLB error */
2255 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2256 goto store_next;
2257 case POWERPC_EXCP_ITLB: /* Instruction TLB error */
2258 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2259 goto store_next;
2260 case POWERPC_EXCP_DEBUG: /* Debug interrupt */
2261 switch (excp_model) {
2262 case POWERPC_EXCP_BOOKE:
2263 srr0 = SPR_BOOKE_DSRR0;
2264 srr1 = SPR_BOOKE_DSRR1;
2265 asrr0 = SPR_BOOKE_CSRR0;
2266 asrr1 = SPR_BOOKE_CSRR1;
2267 break;
2268 default:
2269 break;
2270 }
2271 /* XXX: TODO */
2272 cpu_abort(env, "Debug exception is not implemented yet !\n");
2273 goto store_next;
2274 case POWERPC_EXCP_SPEU: /* SPE/embedded floating-point unavailable */
2275 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2276 goto store_current;
2277 case POWERPC_EXCP_EFPDI: /* Embedded floating-point data interrupt */
2278 /* XXX: TODO */
2279 cpu_abort(env, "Embedded floating point data exception "
2280 "is not implemented yet !\n");
2281 goto store_next;
2282 case POWERPC_EXCP_EFPRI: /* Embedded floating-point round interrupt */
2283 /* XXX: TODO */
2284 cpu_abort(env, "Embedded floating point round exception "
2285 "is not implemented yet !\n");
2286 goto store_next;
2287 case POWERPC_EXCP_EPERFM: /* Embedded performance monitor interrupt */
2288 new_msr &= ~((target_ulong)1 << MSR_RI);
2289 /* XXX: TODO */
2290 cpu_abort(env,
2291 "Performance counter exception is not implemented yet !\n");
2292 goto store_next;
2293 case POWERPC_EXCP_DOORI: /* Embedded doorbell interrupt */
2294 /* XXX: TODO */
2295 cpu_abort(env,
2296 "Embedded doorbell interrupt is not implemented yet !\n");
2297 goto store_next;
2298 case POWERPC_EXCP_DOORCI: /* Embedded doorbell critical interrupt */
2299 switch (excp_model) {
2300 case POWERPC_EXCP_BOOKE:
2301 srr0 = SPR_BOOKE_CSRR0;
2302 srr1 = SPR_BOOKE_CSRR1;
2303 break;
2304 default:
2305 break;
2306 }
2307 /* XXX: TODO */
2308 cpu_abort(env, "Embedded doorbell critical interrupt "
2309 "is not implemented yet !\n");
2310 goto store_next;
2311 case POWERPC_EXCP_RESET: /* System reset exception */
2312 new_msr &= ~((target_ulong)1 << MSR_RI);
2313 if (0) {
2314 /* XXX: find a suitable condition to enable the hypervisor mode */
2315 new_msr |= (target_ulong)MSR_HVB;
2316 }
2317 goto store_next;
2318 case POWERPC_EXCP_DSEG: /* Data segment exception */
2319 new_msr &= ~((target_ulong)1 << MSR_RI);
2320 if (lpes1 == 0)
2321 new_msr |= (target_ulong)MSR_HVB;
2322 goto store_next;
2323 case POWERPC_EXCP_ISEG: /* Instruction segment exception */
2324 new_msr &= ~((target_ulong)1 << MSR_RI);
2325 if (lpes1 == 0)
2326 new_msr |= (target_ulong)MSR_HVB;
2327 goto store_next;
2328 case POWERPC_EXCP_HDECR: /* Hypervisor decrementer exception */
2329 srr0 = SPR_HSRR0;
2330 srr1 = SPR_HSRR1;
2331 new_msr |= (target_ulong)MSR_HVB;
2332 goto store_next;
2333 case POWERPC_EXCP_TRACE: /* Trace exception */
2334 new_msr &= ~((target_ulong)1 << MSR_RI);
2335 if (lpes1 == 0)
2336 new_msr |= (target_ulong)MSR_HVB;
2337 goto store_next;
2338 case POWERPC_EXCP_HDSI: /* Hypervisor data storage exception */
2339 srr0 = SPR_HSRR0;
2340 srr1 = SPR_HSRR1;
2341 new_msr |= (target_ulong)MSR_HVB;
2342 goto store_next;
2343 case POWERPC_EXCP_HISI: /* Hypervisor instruction storage exception */
2344 srr0 = SPR_HSRR0;
2345 srr1 = SPR_HSRR1;
2346 new_msr |= (target_ulong)MSR_HVB;
2347 goto store_next;
2348 case POWERPC_EXCP_HDSEG: /* Hypervisor data segment exception */
2349 srr0 = SPR_HSRR0;
2350 srr1 = SPR_HSRR1;
2351 new_msr |= (target_ulong)MSR_HVB;
2352 goto store_next;
2353 case POWERPC_EXCP_HISEG: /* Hypervisor instruction segment exception */
2354 srr0 = SPR_HSRR0;
2355 srr1 = SPR_HSRR1;
2356 new_msr |= (target_ulong)MSR_HVB;
2357 goto store_next;
2358 case POWERPC_EXCP_VPU: /* Vector unavailable exception */
2359 new_msr &= ~((target_ulong)1 << MSR_RI);
2360 if (lpes1 == 0)
2361 new_msr |= (target_ulong)MSR_HVB;
2362 goto store_current;
2363 case POWERPC_EXCP_PIT: /* Programmable interval timer interrupt */
2364 LOG_EXCP("PIT exception\n");
2365 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2366 goto store_next;
2367 case POWERPC_EXCP_IO: /* IO error exception */
2368 /* XXX: TODO */
2369 cpu_abort(env, "601 IO error exception is not implemented yet !\n");
2370 goto store_next;
2371 case POWERPC_EXCP_RUNM: /* Run mode exception */
2372 /* XXX: TODO */
2373 cpu_abort(env, "601 run mode exception is not implemented yet !\n");
2374 goto store_next;
2375 case POWERPC_EXCP_EMUL: /* Emulation trap exception */
2376 /* XXX: TODO */
2377 cpu_abort(env, "602 emulation trap exception "
2378 "is not implemented yet !\n");
2379 goto store_next;
2380 case POWERPC_EXCP_IFTLB: /* Instruction fetch TLB error */
2381 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2382 if (lpes1 == 0) /* XXX: check this */
2383 new_msr |= (target_ulong)MSR_HVB;
2384 switch (excp_model) {
2385 case POWERPC_EXCP_602:
2386 case POWERPC_EXCP_603:
2387 case POWERPC_EXCP_603E:
2388 case POWERPC_EXCP_G2:
2389 goto tlb_miss_tgpr;
2390 case POWERPC_EXCP_7x5:
2391 goto tlb_miss;
2392 case POWERPC_EXCP_74xx:
2393 goto tlb_miss_74xx;
2394 default:
2395 cpu_abort(env, "Invalid instruction TLB miss exception\n");
2396 break;
2397 }
2398 break;
2399 case POWERPC_EXCP_DLTLB: /* Data load TLB miss */
2400 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2401 if (lpes1 == 0) /* XXX: check this */
2402 new_msr |= (target_ulong)MSR_HVB;
2403 switch (excp_model) {
2404 case POWERPC_EXCP_602:
2405 case POWERPC_EXCP_603:
2406 case POWERPC_EXCP_603E:
2407 case POWERPC_EXCP_G2:
2408 goto tlb_miss_tgpr;
2409 case POWERPC_EXCP_7x5:
2410 goto tlb_miss;
2411 case POWERPC_EXCP_74xx:
2412 goto tlb_miss_74xx;
2413 default:
2414 cpu_abort(env, "Invalid data load TLB miss exception\n");
2415 break;
2416 }
2417 break;
2418 case POWERPC_EXCP_DSTLB: /* Data store TLB miss */
2419 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2420 if (lpes1 == 0) /* XXX: check this */
2421 new_msr |= (target_ulong)MSR_HVB;
2422 switch (excp_model) {
2423 case POWERPC_EXCP_602:
2424 case POWERPC_EXCP_603:
2425 case POWERPC_EXCP_603E:
2426 case POWERPC_EXCP_G2:
2427 tlb_miss_tgpr:
2428 /* Swap temporary saved registers with GPRs */
2429 if (!(new_msr & ((target_ulong)1 << MSR_TGPR))) {
2430 new_msr |= (target_ulong)1 << MSR_TGPR;
2431 hreg_swap_gpr_tgpr(env);
2432 }
2433 goto tlb_miss;
2434 case POWERPC_EXCP_7x5:
2435 tlb_miss:
2436 #if defined (DEBUG_SOFTWARE_TLB)
2437 if (qemu_log_enabled()) {
2438 const char *es;
2439 target_ulong *miss, *cmp;
2440 int en;
2441 if (excp == POWERPC_EXCP_IFTLB) {
2442 es = "I";
2443 en = 'I';
2444 miss = &env->spr[SPR_IMISS];
2445 cmp = &env->spr[SPR_ICMP];
2446 } else {
2447 if (excp == POWERPC_EXCP_DLTLB)
2448 es = "DL";
2449 else
2450 es = "DS";
2451 en = 'D';
2452 miss = &env->spr[SPR_DMISS];
2453 cmp = &env->spr[SPR_DCMP];
2454 }
2455 qemu_log("6xx %sTLB miss: %cM " TARGET_FMT_lx " %cC "
2456 TARGET_FMT_lx " H1 " TARGET_FMT_lx " H2 "
2457 TARGET_FMT_lx " %08x\n", es, en, *miss, en, *cmp,
2458 env->spr[SPR_HASH1], env->spr[SPR_HASH2],
2459 env->error_code);
2460 }
2461 #endif
2462 msr |= env->crf[0] << 28;
2463 msr |= env->error_code; /* key, D/I, S/L bits */
2464 /* Set way using a LRU mechanism */
2465 msr |= ((env->last_way + 1) & (env->nb_ways - 1)) << 17;
2466 break;
2467 case POWERPC_EXCP_74xx:
2468 tlb_miss_74xx:
2469 #if defined (DEBUG_SOFTWARE_TLB)
2470 if (qemu_log_enabled()) {
2471 const char *es;
2472 target_ulong *miss, *cmp;
2473 int en;
2474 if (excp == POWERPC_EXCP_IFTLB) {
2475 es = "I";
2476 en = 'I';
2477 miss = &env->spr[SPR_TLBMISS];
2478 cmp = &env->spr[SPR_PTEHI];
2479 } else {
2480 if (excp == POWERPC_EXCP_DLTLB)
2481 es = "DL";
2482 else
2483 es = "DS";
2484 en = 'D';
2485 miss = &env->spr[SPR_TLBMISS];
2486 cmp = &env->spr[SPR_PTEHI];
2487 }
2488 qemu_log("74xx %sTLB miss: %cM " TARGET_FMT_lx " %cC "
2489 TARGET_FMT_lx " %08x\n", es, en, *miss, en, *cmp,
2490 env->error_code);
2491 }
2492 #endif
2493 msr |= env->error_code; /* key bit */
2494 break;
2495 default:
2496 cpu_abort(env, "Invalid data store TLB miss exception\n");
2497 break;
2498 }
2499 goto store_next;
2500 case POWERPC_EXCP_FPA: /* Floating-point assist exception */
2501 /* XXX: TODO */
2502 cpu_abort(env, "Floating point assist exception "
2503 "is not implemented yet !\n");
2504 goto store_next;
2505 case POWERPC_EXCP_DABR: /* Data address breakpoint */
2506 /* XXX: TODO */
2507 cpu_abort(env, "DABR exception is not implemented yet !\n");
2508 goto store_next;
2509 case POWERPC_EXCP_IABR: /* Instruction address breakpoint */
2510 /* XXX: TODO */
2511 cpu_abort(env, "IABR exception is not implemented yet !\n");
2512 goto store_next;
2513 case POWERPC_EXCP_SMI: /* System management interrupt */
2514 /* XXX: TODO */
2515 cpu_abort(env, "SMI exception is not implemented yet !\n");
2516 goto store_next;
2517 case POWERPC_EXCP_THERM: /* Thermal interrupt */
2518 /* XXX: TODO */
2519 cpu_abort(env, "Thermal management exception "
2520 "is not implemented yet !\n");
2521 goto store_next;
2522 case POWERPC_EXCP_PERFM: /* Embedded performance monitor interrupt */
2523 new_msr &= ~((target_ulong)1 << MSR_RI);
2524 if (lpes1 == 0)
2525 new_msr |= (target_ulong)MSR_HVB;
2526 /* XXX: TODO */
2527 cpu_abort(env,
2528 "Performance counter exception is not implemented yet !\n");
2529 goto store_next;
2530 case POWERPC_EXCP_VPUA: /* Vector assist exception */
2531 /* XXX: TODO */
2532 cpu_abort(env, "VPU assist exception is not implemented yet !\n");
2533 goto store_next;
2534 case POWERPC_EXCP_SOFTP: /* Soft patch exception */
2535 /* XXX: TODO */
2536 cpu_abort(env,
2537 "970 soft-patch exception is not implemented yet !\n");
2538 goto store_next;
2539 case POWERPC_EXCP_MAINT: /* Maintenance exception */
2540 /* XXX: TODO */
2541 cpu_abort(env,
2542 "970 maintenance exception is not implemented yet !\n");
2543 goto store_next;
2544 case POWERPC_EXCP_MEXTBR: /* Maskable external breakpoint */
2545 /* XXX: TODO */
2546 cpu_abort(env, "Maskable external exception "
2547 "is not implemented yet !\n");
2548 goto store_next;
2549 case POWERPC_EXCP_NMEXTBR: /* Non maskable external breakpoint */
2550 /* XXX: TODO */
2551 cpu_abort(env, "Non maskable external exception "
2552 "is not implemented yet !\n");
2553 goto store_next;
2554 default:
2555 excp_invalid:
2556 cpu_abort(env, "Invalid PowerPC exception %d. Aborting\n", excp);
2557 break;
2558 store_current:
2559 /* save current instruction location */
2560 env->spr[srr0] = env->nip - 4;
2561 break;
2562 store_next:
2563 /* save next instruction location */
2564 env->spr[srr0] = env->nip;
2565 break;
2566 }
2567 /* Save MSR */
2568 env->spr[srr1] = msr;
2569 /* If any alternate SRR register are defined, duplicate saved values */
2570 if (asrr0 != -1)
2571 env->spr[asrr0] = env->spr[srr0];
2572 if (asrr1 != -1)
2573 env->spr[asrr1] = env->spr[srr1];
2574 /* If we disactivated any translation, flush TLBs */
2575 if (new_msr & ((1 << MSR_IR) | (1 << MSR_DR)))
2576 tlb_flush(env, 1);
2577 /* reload MSR with correct bits */
2578 new_msr &= ~((target_ulong)1 << MSR_EE);
2579 new_msr &= ~((target_ulong)1 << MSR_PR);
2580 new_msr &= ~((target_ulong)1 << MSR_FP);
2581 new_msr &= ~((target_ulong)1 << MSR_FE0);
2582 new_msr &= ~((target_ulong)1 << MSR_SE);
2583 new_msr &= ~((target_ulong)1 << MSR_BE);
2584 new_msr &= ~((target_ulong)1 << MSR_FE1);
2585 new_msr &= ~((target_ulong)1 << MSR_IR);
2586 new_msr &= ~((target_ulong)1 << MSR_DR);
2587 #if 0 /* Fix this: not on all targets */
2588 new_msr &= ~((target_ulong)1 << MSR_PMM);
2589 #endif
2590 new_msr &= ~((target_ulong)1 << MSR_LE);
2591 if (msr_ile)
2592 new_msr |= (target_ulong)1 << MSR_LE;
2593 else
2594 new_msr &= ~((target_ulong)1 << MSR_LE);
2595 /* Jump to handler */
2596 vector = env->excp_vectors[excp];
2597 if (vector == (target_ulong)-1ULL) {
2598 cpu_abort(env, "Raised an exception without defined vector %d\n",
2599 excp);
2600 }
2601 vector |= env->excp_prefix;
2602 #if defined(TARGET_PPC64)
2603 if (excp_model == POWERPC_EXCP_BOOKE) {
2604 if (!msr_icm) {
2605 new_msr &= ~((target_ulong)1 << MSR_CM);
2606 vector = (uint32_t)vector;
2607 } else {
2608 new_msr |= (target_ulong)1 << MSR_CM;
2609 }
2610 } else {
2611 if (!msr_isf && !(env->mmu_model & POWERPC_MMU_64)) {
2612 new_msr &= ~((target_ulong)1 << MSR_SF);
2613 vector = (uint32_t)vector;
2614 } else {
2615 new_msr |= (target_ulong)1 << MSR_SF;
2616 }
2617 }
2618 #endif
2619 /* XXX: we don't use hreg_store_msr here as already have treated
2620 * any special case that could occur. Just store MSR and update hflags
2621 */
2622 env->msr = new_msr & env->msr_mask;
2623 hreg_compute_hflags(env);
2624 env->nip = vector;
2625 /* Reset exception state */
2626 env->exception_index = POWERPC_EXCP_NONE;
2627 env->error_code = 0;
2628 }
2629
2630 void do_interrupt (CPUState *env)
2631 {
2632 powerpc_excp(env, env->excp_model, env->exception_index);
2633 }
2634
2635 void ppc_hw_interrupt (CPUPPCState *env)
2636 {
2637 int hdice;
2638
2639 #if 0
2640 qemu_log_mask(CPU_LOG_INT, "%s: %p pending %08x req %08x me %d ee %d\n",
2641 __func__, env, env->pending_interrupts,
2642 env->interrupt_request, (int)msr_me, (int)msr_ee);
2643 #endif
2644 /* External reset */
2645 if (env->pending_interrupts & (1 << PPC_INTERRUPT_RESET)) {
2646 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_RESET);
2647 powerpc_excp(env, env->excp_model, POWERPC_EXCP_RESET);
2648 return;
2649 }
2650 /* Machine check exception */
2651 if (env->pending_interrupts & (1 << PPC_INTERRUPT_MCK)) {
2652 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_MCK);
2653 powerpc_excp(env, env->excp_model, POWERPC_EXCP_MCHECK);
2654 return;
2655 }
2656 #if 0 /* TODO */
2657 /* External debug exception */
2658 if (env->pending_interrupts & (1 << PPC_INTERRUPT_DEBUG)) {
2659 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DEBUG);
2660 powerpc_excp(env, env->excp_model, POWERPC_EXCP_DEBUG);
2661 return;
2662 }
2663 #endif
2664 if (0) {
2665 /* XXX: find a suitable condition to enable the hypervisor mode */
2666 hdice = env->spr[SPR_LPCR] & 1;
2667 } else {
2668 hdice = 0;
2669 }
2670 if ((msr_ee != 0 || msr_hv == 0 || msr_pr != 0) && hdice != 0) {
2671 /* Hypervisor decrementer exception */
2672 if (env->pending_interrupts & (1 << PPC_INTERRUPT_HDECR)) {
2673 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_HDECR);
2674 powerpc_excp(env, env->excp_model, POWERPC_EXCP_HDECR);
2675 return;
2676 }
2677 }
2678 if (msr_ce != 0) {
2679 /* External critical interrupt */
2680 if (env->pending_interrupts & (1 << PPC_INTERRUPT_CEXT)) {
2681 /* Taking a critical external interrupt does not clear the external
2682 * critical interrupt status
2683 */
2684 #if 0
2685 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_CEXT);
2686 #endif
2687 powerpc_excp(env, env->excp_model, POWERPC_EXCP_CRITICAL);
2688 return;
2689 }
2690 }
2691 if (msr_ee != 0) {
2692 /* Watchdog timer on embedded PowerPC */
2693 if (env->pending_interrupts & (1 << PPC_INTERRUPT_WDT)) {
2694 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_WDT);
2695 powerpc_excp(env, env->excp_model, POWERPC_EXCP_WDT);
2696 return;
2697 }
2698 if (env->pending_interrupts & (1 << PPC_INTERRUPT_CDOORBELL)) {
2699 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_CDOORBELL);
2700 powerpc_excp(env, env->excp_model, POWERPC_EXCP_DOORCI);
2701 return;
2702 }
2703 /* Fixed interval timer on embedded PowerPC */
2704 if (env->pending_interrupts & (1 << PPC_INTERRUPT_FIT)) {
2705 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_FIT);
2706 powerpc_excp(env, env->excp_model, POWERPC_EXCP_FIT);
2707 return;
2708 }
2709 /* Programmable interval timer on embedded PowerPC */
2710 if (env->pending_interrupts & (1 << PPC_INTERRUPT_PIT)) {
2711 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_PIT);
2712 powerpc_excp(env, env->excp_model, POWERPC_EXCP_PIT);
2713 return;
2714 }
2715 /* Decrementer exception */
2716 if (env->pending_interrupts & (1 << PPC_INTERRUPT_DECR)) {
2717 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DECR);
2718 powerpc_excp(env, env->excp_model, POWERPC_EXCP_DECR);
2719 return;
2720 }
2721 /* External interrupt */
2722 if (env->pending_interrupts & (1 << PPC_INTERRUPT_EXT)) {
2723 /* Taking an external interrupt does not clear the external
2724 * interrupt status
2725 */
2726 #if 0
2727 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_EXT);
2728 #endif
2729 powerpc_excp(env, env->excp_model, POWERPC_EXCP_EXTERNAL);
2730 return;
2731 }
2732 if (env->pending_interrupts & (1 << PPC_INTERRUPT_DOORBELL)) {
2733 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DOORBELL);
2734 powerpc_excp(env, env->excp_model, POWERPC_EXCP_DOORI);
2735 return;
2736 }
2737 if (env->pending_interrupts & (1 << PPC_INTERRUPT_PERFM)) {
2738 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_PERFM);
2739 powerpc_excp(env, env->excp_model, POWERPC_EXCP_PERFM);
2740 return;
2741 }
2742 /* Thermal interrupt */
2743 if (env->pending_interrupts & (1 << PPC_INTERRUPT_THERM)) {
2744 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_THERM);
2745 powerpc_excp(env, env->excp_model, POWERPC_EXCP_THERM);
2746 return;
2747 }
2748 }
2749 }
2750 #endif /* !CONFIG_USER_ONLY */
2751
2752 void cpu_dump_rfi (target_ulong RA, target_ulong msr)
2753 {
2754 qemu_log("Return from exception at " TARGET_FMT_lx " with flags "
2755 TARGET_FMT_lx "\n", RA, msr);
2756 }
2757
2758 void cpu_reset(CPUPPCState *env)
2759 {
2760 target_ulong msr;
2761
2762 if (qemu_loglevel_mask(CPU_LOG_RESET)) {
2763 qemu_log("CPU Reset (CPU %d)\n", env->cpu_index);
2764 log_cpu_state(env, 0);
2765 }
2766
2767 msr = (target_ulong)0;
2768 if (0) {
2769 /* XXX: find a suitable condition to enable the hypervisor mode */
2770 msr |= (target_ulong)MSR_HVB;
2771 }
2772 msr |= (target_ulong)0 << MSR_AP; /* TO BE CHECKED */
2773 msr |= (target_ulong)0 << MSR_SA; /* TO BE CHECKED */
2774 msr |= (target_ulong)1 << MSR_EP;
2775 #if defined (DO_SINGLE_STEP) && 0
2776 /* Single step trace mode */
2777 msr |= (target_ulong)1 << MSR_SE;
2778 msr |= (target_ulong)1 << MSR_BE;
2779 #endif
2780 #if defined(CONFIG_USER_ONLY)
2781 msr |= (target_ulong)1 << MSR_FP; /* Allow floating point usage */
2782 msr |= (target_ulong)1 << MSR_VR; /* Allow altivec usage */
2783 msr |= (target_ulong)1 << MSR_SPE; /* Allow SPE usage */
2784 msr |= (target_ulong)1 << MSR_PR;
2785 #else
2786 env->excp_prefix = env->hreset_excp_prefix;
2787 env->nip = env->hreset_vector | env->excp_prefix;
2788 if (env->mmu_model != POWERPC_MMU_REAL)
2789 ppc_tlb_invalidate_all(env);
2790 #endif
2791 env->msr = msr & env->msr_mask;
2792 #if defined(TARGET_PPC64)
2793 if (env->mmu_model & POWERPC_MMU_64)
2794 env->msr |= (1ULL << MSR_SF);
2795 #endif
2796 hreg_compute_hflags(env);
2797 env->reserve_addr = (target_ulong)-1ULL;
2798 /* Be sure no exception or interrupt is pending */
2799 env->pending_interrupts = 0;
2800 env->exception_index = POWERPC_EXCP_NONE;
2801 env->error_code = 0;
2802 /* Flush all TLBs */
2803 tlb_flush(env, 1);
2804 }
2805
2806 CPUPPCState *cpu_ppc_init (const char *cpu_model)
2807 {
2808 CPUPPCState *env;
2809 const ppc_def_t *def;
2810
2811 def = cpu_ppc_find_by_name(cpu_model);
2812 if (!def)
2813 return NULL;
2814
2815 env = qemu_mallocz(sizeof(CPUPPCState));
2816 cpu_exec_init(env);
2817 ppc_translate_init();
2818 env->cpu_model_str = cpu_model;
2819 cpu_ppc_register_internal(env, def);
2820
2821 qemu_init_vcpu(env);
2822
2823 return env;
2824 }
2825
2826 void cpu_ppc_close (CPUPPCState *env)
2827 {
2828 /* Should also remove all opcode tables... */
2829 qemu_free(env);
2830 }
Qemu copy for testing