]> git.proxmox.com Git - mirror_qemu.git/blob - target-ppc/mmu_helper.c
projects / mirror_qemu.git / blob
? search:


c0421848b179dc24c26094a83a0d6809dd15e321
[mirror_qemu.git] / target-ppc / mmu_helper.c
1 /*
2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
3 *
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19 #include "cpu.h"
20 #include "helper.h"
21 #include "sysemu/kvm.h"
22 #include "kvm_ppc.h"
23 #include "mmu-hash64.h"
24 #include "mmu-hash32.h"
25
26 //#define DEBUG_MMU
27 //#define DEBUG_BATS
28 //#define DEBUG_SOFTWARE_TLB
29 //#define DUMP_PAGE_TABLES
30 //#define DEBUG_SOFTWARE_TLB
31 //#define FLUSH_ALL_TLBS
32
33 #ifdef DEBUG_MMU
34 # define LOG_MMU(...) qemu_log(__VA_ARGS__)
35 # define LOG_MMU_STATE(cpu) log_cpu_state((cpu), 0)
36 #else
37 # define LOG_MMU(...) do { } while (0)
38 # define LOG_MMU_STATE(cpu) do { } while (0)
39 #endif
40
41 #ifdef DEBUG_SOFTWARE_TLB
42 # define LOG_SWTLB(...) qemu_log(__VA_ARGS__)
43 #else
44 # define LOG_SWTLB(...) do { } while (0)
45 #endif
46
47 #ifdef DEBUG_BATS
48 # define LOG_BATS(...) qemu_log(__VA_ARGS__)
49 #else
50 # define LOG_BATS(...) do { } while (0)
51 #endif
52
53 /*****************************************************************************/
54 /* PowerPC MMU emulation */
55
56 /* Context used internally during MMU translations */
57 typedef struct mmu_ctx_t mmu_ctx_t;
58 struct mmu_ctx_t {
59 hwaddr raddr; /* Real address */
60 hwaddr eaddr; /* Effective address */
61 int prot; /* Protection bits */
62 hwaddr hash[2]; /* Pagetable hash values */
63 target_ulong ptem; /* Virtual segment ID | API */
64 int key; /* Access key */
65 int nx; /* Non-execute area */
66 };
67
68 /* Common routines used by software and hardware TLBs emulation */
69 static inline int pte_is_valid(target_ulong pte0)
70 {
71 return pte0 & 0x80000000 ? 1 : 0;
72 }
73
74 static inline void pte_invalidate(target_ulong *pte0)
75 {
76 *pte0 &= ~0x80000000;
77 }
78
79 #define PTE_PTEM_MASK 0x7FFFFFBF
80 #define PTE_CHECK_MASK (TARGET_PAGE_MASK | 0x7B)
81
82 static int pp_check(int key, int pp, int nx)
83 {
84 int access;
85
86 /* Compute access rights */
87 access = 0;
88 if (key == 0) {
89 switch (pp) {
90 case 0x0:
91 case 0x1:
92 case 0x2:
93 access |= PAGE_WRITE;
94 /* No break here */
95 case 0x3:
96 access |= PAGE_READ;
97 break;
98 }
99 } else {
100 switch (pp) {
101 case 0x0:
102 access = 0;
103 break;
104 case 0x1:
105 case 0x3:
106 access = PAGE_READ;
107 break;
108 case 0x2:
109 access = PAGE_READ | PAGE_WRITE;
110 break;
111 }
112 }
113 if (nx == 0) {
114 access |= PAGE_EXEC;
115 }
116
117 return access;
118 }
119
120 static int check_prot(int prot, int rw, int access_type)
121 {
122 int ret;
123
124 if (access_type == ACCESS_CODE) {
125 if (prot & PAGE_EXEC) {
126 ret = 0;
127 } else {
128 ret = -2;
129 }
130 } else if (rw) {
131 if (prot & PAGE_WRITE) {
132 ret = 0;
133 } else {
134 ret = -2;
135 }
136 } else {
137 if (prot & PAGE_READ) {
138 ret = 0;
139 } else {
140 ret = -2;
141 }
142 }
143
144 return ret;
145 }
146
147 static inline int ppc6xx_tlb_pte_check(mmu_ctx_t *ctx, target_ulong pte0,
148 target_ulong pte1, int h, int rw, int type)
149 {
150 target_ulong ptem, mmask;
151 int access, ret, pteh, ptev, pp;
152
153 ret = -1;
154 /* Check validity and table match */
155 ptev = pte_is_valid(pte0);
156 pteh = (pte0 >> 6) & 1;
157 if (ptev && h == pteh) {
158 /* Check vsid & api */
159 ptem = pte0 & PTE_PTEM_MASK;
160 mmask = PTE_CHECK_MASK;
161 pp = pte1 & 0x00000003;
162 if (ptem == ctx->ptem) {
163 if (ctx->raddr != (hwaddr)-1ULL) {
164 /* all matches should have equal RPN, WIMG & PP */
165 if ((ctx->raddr & mmask) != (pte1 & mmask)) {
166 qemu_log("Bad RPN/WIMG/PP\n");
167 return -3;
168 }
169 }
170 /* Compute access rights */
171 access = pp_check(ctx->key, pp, ctx->nx);
172 /* Keep the matching PTE informations */
173 ctx->raddr = pte1;
174 ctx->prot = access;
175 ret = check_prot(ctx->prot, rw, type);
176 if (ret == 0) {
177 /* Access granted */
178 LOG_MMU("PTE access granted !\n");
179 } else {
180 /* Access right violation */
181 LOG_MMU("PTE access rejected\n");
182 }
183 }
184 }
185
186 return ret;
187 }
188
189 static int pte_update_flags(mmu_ctx_t *ctx, target_ulong *pte1p,
190 int ret, int rw)
191 {
192 int store = 0;
193
194 /* Update page flags */
195 if (!(*pte1p & 0x00000100)) {
196 /* Update accessed flag */
197 *pte1p |= 0x00000100;
198 store = 1;
199 }
200 if (!(*pte1p & 0x00000080)) {
201 if (rw == 1 && ret == 0) {
202 /* Update changed flag */
203 *pte1p |= 0x00000080;
204 store = 1;
205 } else {
206 /* Force page fault for first write access */
207 ctx->prot &= ~PAGE_WRITE;
208 }
209 }
210
211 return store;
212 }
213
214 /* Software driven TLB helpers */
215 static inline int ppc6xx_tlb_getnum(CPUPPCState *env, target_ulong eaddr,
216 int way, int is_code)
217 {
218 int nr;
219
220 /* Select TLB num in a way from address */
221 nr = (eaddr >> TARGET_PAGE_BITS) & (env->tlb_per_way - 1);
222 /* Select TLB way */
223 nr += env->tlb_per_way * way;
224 /* 6xx have separate TLBs for instructions and data */
225 if (is_code && env->id_tlbs == 1) {
226 nr += env->nb_tlb;
227 }
228
229 return nr;
230 }
231
232 static inline void ppc6xx_tlb_invalidate_all(CPUPPCState *env)
233 {
234 ppc6xx_tlb_t *tlb;
235 int nr, max;
236
237 /* LOG_SWTLB("Invalidate all TLBs\n"); */
238 /* Invalidate all defined software TLB */
239 max = env->nb_tlb;
240 if (env->id_tlbs == 1) {
241 max *= 2;
242 }
243 for (nr = 0; nr < max; nr++) {
244 tlb = &env->tlb.tlb6[nr];
245 pte_invalidate(&tlb->pte0);
246 }
247 tlb_flush(env, 1);
248 }
249
250 static inline void ppc6xx_tlb_invalidate_virt2(CPUPPCState *env,
251 target_ulong eaddr,
252 int is_code, int match_epn)
253 {
254 #if !defined(FLUSH_ALL_TLBS)
255 ppc6xx_tlb_t *tlb;
256 int way, nr;
257
258 /* Invalidate ITLB + DTLB, all ways */
259 for (way = 0; way < env->nb_ways; way++) {
260 nr = ppc6xx_tlb_getnum(env, eaddr, way, is_code);
261 tlb = &env->tlb.tlb6[nr];
262 if (pte_is_valid(tlb->pte0) && (match_epn == 0 || eaddr == tlb->EPN)) {
263 LOG_SWTLB("TLB invalidate %d/%d " TARGET_FMT_lx "\n", nr,
264 env->nb_tlb, eaddr);
265 pte_invalidate(&tlb->pte0);
266 tlb_flush_page(env, tlb->EPN);
267 }
268 }
269 #else
270 /* XXX: PowerPC specification say this is valid as well */
271 ppc6xx_tlb_invalidate_all(env);
272 #endif
273 }
274
275 static inline void ppc6xx_tlb_invalidate_virt(CPUPPCState *env,
276 target_ulong eaddr, int is_code)
277 {
278 ppc6xx_tlb_invalidate_virt2(env, eaddr, is_code, 0);
279 }
280
281 static void ppc6xx_tlb_store(CPUPPCState *env, target_ulong EPN, int way,
282 int is_code, target_ulong pte0, target_ulong pte1)
283 {
284 ppc6xx_tlb_t *tlb;
285 int nr;
286
287 nr = ppc6xx_tlb_getnum(env, EPN, way, is_code);
288 tlb = &env->tlb.tlb6[nr];
289 LOG_SWTLB("Set TLB %d/%d EPN " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
290 " PTE1 " TARGET_FMT_lx "\n", nr, env->nb_tlb, EPN, pte0, pte1);
291 /* Invalidate any pending reference in QEMU for this virtual address */
292 ppc6xx_tlb_invalidate_virt2(env, EPN, is_code, 1);
293 tlb->pte0 = pte0;
294 tlb->pte1 = pte1;
295 tlb->EPN = EPN;
296 /* Store last way for LRU mechanism */
297 env->last_way = way;
298 }
299
300 static inline int ppc6xx_tlb_check(CPUPPCState *env, mmu_ctx_t *ctx,
301 target_ulong eaddr, int rw, int access_type)
302 {
303 ppc6xx_tlb_t *tlb;
304 int nr, best, way;
305 int ret;
306
307 best = -1;
308 ret = -1; /* No TLB found */
309 for (way = 0; way < env->nb_ways; way++) {
310 nr = ppc6xx_tlb_getnum(env, eaddr, way,
311 access_type == ACCESS_CODE ? 1 : 0);
312 tlb = &env->tlb.tlb6[nr];
313 /* This test "emulates" the PTE index match for hardware TLBs */
314 if ((eaddr & TARGET_PAGE_MASK) != tlb->EPN) {
315 LOG_SWTLB("TLB %d/%d %s [" TARGET_FMT_lx " " TARGET_FMT_lx
316 "] <> " TARGET_FMT_lx "\n", nr, env->nb_tlb,
317 pte_is_valid(tlb->pte0) ? "valid" : "inval",
318 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE, eaddr);
319 continue;
320 }
321 LOG_SWTLB("TLB %d/%d %s " TARGET_FMT_lx " <> " TARGET_FMT_lx " "
322 TARGET_FMT_lx " %c %c\n", nr, env->nb_tlb,
323 pte_is_valid(tlb->pte0) ? "valid" : "inval",
324 tlb->EPN, eaddr, tlb->pte1,
325 rw ? 'S' : 'L', access_type == ACCESS_CODE ? 'I' : 'D');
326 switch (ppc6xx_tlb_pte_check(ctx, tlb->pte0, tlb->pte1, 0, rw, access_type)) {
327 case -3:
328 /* TLB inconsistency */
329 return -1;
330 case -2:
331 /* Access violation */
332 ret = -2;
333 best = nr;
334 break;
335 case -1:
336 default:
337 /* No match */
338 break;
339 case 0:
340 /* access granted */
341 /* XXX: we should go on looping to check all TLBs consistency
342 * but we can speed-up the whole thing as the
343 * result would be undefined if TLBs are not consistent.
344 */
345 ret = 0;
346 best = nr;
347 goto done;
348 }
349 }
350 if (best != -1) {
351 done:
352 LOG_SWTLB("found TLB at addr " TARGET_FMT_plx " prot=%01x ret=%d\n",
353 ctx->raddr & TARGET_PAGE_MASK, ctx->prot, ret);
354 /* Update page flags */
355 pte_update_flags(ctx, &env->tlb.tlb6[best].pte1, ret, rw);
356 }
357
358 return ret;
359 }
360
361 /* Perform BAT hit & translation */
362 static inline void bat_size_prot(CPUPPCState *env, target_ulong *blp,
363 int *validp, int *protp, target_ulong *BATu,
364 target_ulong *BATl)
365 {
366 target_ulong bl;
367 int pp, valid, prot;
368
369 bl = (*BATu & 0x00001FFC) << 15;
370 valid = 0;
371 prot = 0;
372 if (((msr_pr == 0) && (*BATu & 0x00000002)) ||
373 ((msr_pr != 0) && (*BATu & 0x00000001))) {
374 valid = 1;
375 pp = *BATl & 0x00000003;
376 if (pp != 0) {
377 prot = PAGE_READ | PAGE_EXEC;
378 if (pp == 0x2) {
379 prot |= PAGE_WRITE;
380 }
381 }
382 }
383 *blp = bl;
384 *validp = valid;
385 *protp = prot;
386 }
387
388 static int get_bat_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx,
389 target_ulong virtual, int rw, int type)
390 {
391 target_ulong *BATlt, *BATut, *BATu, *BATl;
392 target_ulong BEPIl, BEPIu, bl;
393 int i, valid, prot;
394 int ret = -1;
395
396 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
397 type == ACCESS_CODE ? 'I' : 'D', virtual);
398 switch (type) {
399 case ACCESS_CODE:
400 BATlt = env->IBAT[1];
401 BATut = env->IBAT[0];
402 break;
403 default:
404 BATlt = env->DBAT[1];
405 BATut = env->DBAT[0];
406 break;
407 }
408 for (i = 0; i < env->nb_BATs; i++) {
409 BATu = &BATut[i];
410 BATl = &BATlt[i];
411 BEPIu = *BATu & 0xF0000000;
412 BEPIl = *BATu & 0x0FFE0000;
413 bat_size_prot(env, &bl, &valid, &prot, BATu, BATl);
414 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
415 " BATl " TARGET_FMT_lx "\n", __func__,
416 type == ACCESS_CODE ? 'I' : 'D', i, virtual, *BATu, *BATl);
417 if ((virtual & 0xF0000000) == BEPIu &&
418 ((virtual & 0x0FFE0000) & ~bl) == BEPIl) {
419 /* BAT matches */
420 if (valid != 0) {
421 /* Get physical address */
422 ctx->raddr = (*BATl & 0xF0000000) |
423 ((virtual & 0x0FFE0000 & bl) | (*BATl & 0x0FFE0000)) |
424 (virtual & 0x0001F000);
425 /* Compute access rights */
426 ctx->prot = prot;
427 ret = check_prot(ctx->prot, rw, type);
428 if (ret == 0) {
429 LOG_BATS("BAT %d match: r " TARGET_FMT_plx " prot=%c%c\n",
430 i, ctx->raddr, ctx->prot & PAGE_READ ? 'R' : '-',
431 ctx->prot & PAGE_WRITE ? 'W' : '-');
432 }
433 break;
434 }
435 }
436 }
437 if (ret < 0) {
438 #if defined(DEBUG_BATS)
439 if (qemu_log_enabled()) {
440 LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", virtual);
441 for (i = 0; i < 4; i++) {
442 BATu = &BATut[i];
443 BATl = &BATlt[i];
444 BEPIu = *BATu & 0xF0000000;
445 BEPIl = *BATu & 0x0FFE0000;
446 bl = (*BATu & 0x00001FFC) << 15;
447 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
448 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
449 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
450 __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual,
451 *BATu, *BATl, BEPIu, BEPIl, bl);
452 }
453 }
454 #endif
455 }
456 /* No hit */
457 return ret;
458 }
459
460 /* Perform segment based translation */
461 static inline int get_segment_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx,
462 target_ulong eaddr, int rw, int type)
463 {
464 hwaddr hash;
465 target_ulong vsid;
466 int ds, pr, target_page_bits;
467 int ret;
468 target_ulong sr, pgidx;
469
470 pr = msr_pr;
471 ctx->eaddr = eaddr;
472
473 sr = env->sr[eaddr >> 28];
474 ctx->key = (((sr & 0x20000000) && (pr != 0)) ||
475 ((sr & 0x40000000) && (pr == 0))) ? 1 : 0;
476 ds = sr & 0x80000000 ? 1 : 0;
477 ctx->nx = sr & 0x10000000 ? 1 : 0;
478 vsid = sr & 0x00FFFFFF;
479 target_page_bits = TARGET_PAGE_BITS;
480 LOG_MMU("Check segment v=" TARGET_FMT_lx " %d " TARGET_FMT_lx " nip="
481 TARGET_FMT_lx " lr=" TARGET_FMT_lx
482 " ir=%d dr=%d pr=%d %d t=%d\n",
483 eaddr, (int)(eaddr >> 28), sr, env->nip, env->lr, (int)msr_ir,
484 (int)msr_dr, pr != 0 ? 1 : 0, rw, type);
485 pgidx = (eaddr & ~SEGMENT_MASK_256M) >> target_page_bits;
486 hash = vsid ^ pgidx;
487 ctx->ptem = (vsid << 7) | (pgidx >> 10);
488
489 LOG_MMU("pte segment: key=%d ds %d nx %d vsid " TARGET_FMT_lx "\n",
490 ctx->key, ds, ctx->nx, vsid);
491 ret = -1;
492 if (!ds) {
493 /* Check if instruction fetch is allowed, if needed */
494 if (type != ACCESS_CODE || ctx->nx == 0) {
495 /* Page address translation */
496 LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
497 " hash " TARGET_FMT_plx "\n",
498 env->htab_base, env->htab_mask, hash);
499 ctx->hash[0] = hash;
500 ctx->hash[1] = ~hash;
501
502 /* Initialize real address with an invalid value */
503 ctx->raddr = (hwaddr)-1ULL;
504 /* Software TLB search */
505 ret = ppc6xx_tlb_check(env, ctx, eaddr, rw, type);
506 #if defined(DUMP_PAGE_TABLES)
507 if (qemu_log_enabled()) {
508 hwaddr curaddr;
509 uint32_t a0, a1, a2, a3;
510
511 qemu_log("Page table: " TARGET_FMT_plx " len " TARGET_FMT_plx
512 "\n", sdr, mask + 0x80);
513 for (curaddr = sdr; curaddr < (sdr + mask + 0x80);
514 curaddr += 16) {
515 a0 = ldl_phys(curaddr);
516 a1 = ldl_phys(curaddr + 4);
517 a2 = ldl_phys(curaddr + 8);
518 a3 = ldl_phys(curaddr + 12);
519 if (a0 != 0 || a1 != 0 || a2 != 0 || a3 != 0) {
520 qemu_log(TARGET_FMT_plx ": %08x %08x %08x %08x\n",
521 curaddr, a0, a1, a2, a3);
522 }
523 }
524 }
525 #endif
526 } else {
527 LOG_MMU("No access allowed\n");
528 ret = -3;
529 }
530 } else {
531 target_ulong sr;
532
533 LOG_MMU("direct store...\n");
534 /* Direct-store segment : absolutely *BUGGY* for now */
535
536 /* Direct-store implies a 32-bit MMU.
537 * Check the Segment Register's bus unit ID (BUID).
538 */
539 sr = env->sr[eaddr >> 28];
540 if ((sr & 0x1FF00000) >> 20 == 0x07f) {
541 /* Memory-forced I/O controller interface access */
542 /* If T=1 and BUID=x'07F', the 601 performs a memory access
543 * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
544 */
545 ctx->raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
546 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
547 return 0;
548 }
549
550 switch (type) {
551 case ACCESS_INT:
552 /* Integer load/store : only access allowed */
553 break;
554 case ACCESS_CODE:
555 /* No code fetch is allowed in direct-store areas */
556 return -4;
557 case ACCESS_FLOAT:
558 /* Floating point load/store */
559 return -4;
560 case ACCESS_RES:
561 /* lwarx, ldarx or srwcx. */
562 return -4;
563 case ACCESS_CACHE:
564 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
565 /* Should make the instruction do no-op.
566 * As it already do no-op, it's quite easy :-)
567 */
568 ctx->raddr = eaddr;
569 return 0;
570 case ACCESS_EXT:
571 /* eciwx or ecowx */
572 return -4;
573 default:
574 qemu_log("ERROR: instruction should not need "
575 "address translation\n");
576 return -4;
577 }
578 if ((rw == 1 || ctx->key != 1) && (rw == 0 || ctx->key != 0)) {
579 ctx->raddr = eaddr;
580 ret = 2;
581 } else {
582 ret = -2;
583 }
584 }
585
586 return ret;
587 }
588
589 /* Generic TLB check function for embedded PowerPC implementations */
590 static int ppcemb_tlb_check(CPUPPCState *env, ppcemb_tlb_t *tlb,
591 hwaddr *raddrp,
592 target_ulong address, uint32_t pid, int ext,
593 int i)
594 {
595 target_ulong mask;
596
597 /* Check valid flag */
598 if (!(tlb->prot & PAGE_VALID)) {
599 return -1;
600 }
601 mask = ~(tlb->size - 1);
602 LOG_SWTLB("%s: TLB %d address " TARGET_FMT_lx " PID %u <=> " TARGET_FMT_lx
603 " " TARGET_FMT_lx " %u %x\n", __func__, i, address, pid, tlb->EPN,
604 mask, (uint32_t)tlb->PID, tlb->prot);
605 /* Check PID */
606 if (tlb->PID != 0 && tlb->PID != pid) {
607 return -1;
608 }
609 /* Check effective address */
610 if ((address & mask) != tlb->EPN) {
611 return -1;
612 }
613 *raddrp = (tlb->RPN & mask) | (address & ~mask);
614 if (ext) {
615 /* Extend the physical address to 36 bits */
616 *raddrp |= (uint64_t)(tlb->RPN & 0xF) << 32;
617 }
618
619 return 0;
620 }
621
622 /* Generic TLB search function for PowerPC embedded implementations */
623 static int ppcemb_tlb_search(CPUPPCState *env, target_ulong address,
624 uint32_t pid)
625 {
626 ppcemb_tlb_t *tlb;
627 hwaddr raddr;
628 int i, ret;
629
630 /* Default return value is no match */
631 ret = -1;
632 for (i = 0; i < env->nb_tlb; i++) {
633 tlb = &env->tlb.tlbe[i];
634 if (ppcemb_tlb_check(env, tlb, &raddr, address, pid, 0, i) == 0) {
635 ret = i;
636 break;
637 }
638 }
639
640 return ret;
641 }
642
643 /* Helpers specific to PowerPC 40x implementations */
644 static inline void ppc4xx_tlb_invalidate_all(CPUPPCState *env)
645 {
646 ppcemb_tlb_t *tlb;
647 int i;
648
649 for (i = 0; i < env->nb_tlb; i++) {
650 tlb = &env->tlb.tlbe[i];
651 tlb->prot &= ~PAGE_VALID;
652 }
653 tlb_flush(env, 1);
654 }
655
656 static inline void ppc4xx_tlb_invalidate_virt(CPUPPCState *env,
657 target_ulong eaddr, uint32_t pid)
658 {
659 #if !defined(FLUSH_ALL_TLBS)
660 ppcemb_tlb_t *tlb;
661 hwaddr raddr;
662 target_ulong page, end;
663 int i;
664
665 for (i = 0; i < env->nb_tlb; i++) {
666 tlb = &env->tlb.tlbe[i];
667 if (ppcemb_tlb_check(env, tlb, &raddr, eaddr, pid, 0, i) == 0) {
668 end = tlb->EPN + tlb->size;
669 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
670 tlb_flush_page(env, page);
671 }
672 tlb->prot &= ~PAGE_VALID;
673 break;
674 }
675 }
676 #else
677 ppc4xx_tlb_invalidate_all(env);
678 #endif
679 }
680
681 static int mmu40x_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
682 target_ulong address, int rw,
683 int access_type)
684 {
685 ppcemb_tlb_t *tlb;
686 hwaddr raddr;
687 int i, ret, zsel, zpr, pr;
688
689 ret = -1;
690 raddr = (hwaddr)-1ULL;
691 pr = msr_pr;
692 for (i = 0; i < env->nb_tlb; i++) {
693 tlb = &env->tlb.tlbe[i];
694 if (ppcemb_tlb_check(env, tlb, &raddr, address,
695 env->spr[SPR_40x_PID], 0, i) < 0) {
696 continue;
697 }
698 zsel = (tlb->attr >> 4) & 0xF;
699 zpr = (env->spr[SPR_40x_ZPR] >> (30 - (2 * zsel))) & 0x3;
700 LOG_SWTLB("%s: TLB %d zsel %d zpr %d rw %d attr %08x\n",
701 __func__, i, zsel, zpr, rw, tlb->attr);
702 /* Check execute enable bit */
703 switch (zpr) {
704 case 0x2:
705 if (pr != 0) {
706 goto check_perms;
707 }
708 /* No break here */
709 case 0x3:
710 /* All accesses granted */
711 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
712 ret = 0;
713 break;
714 case 0x0:
715 if (pr != 0) {
716 /* Raise Zone protection fault. */
717 env->spr[SPR_40x_ESR] = 1 << 22;
718 ctx->prot = 0;
719 ret = -2;
720 break;
721 }
722 /* No break here */
723 case 0x1:
724 check_perms:
725 /* Check from TLB entry */
726 ctx->prot = tlb->prot;
727 ret = check_prot(ctx->prot, rw, access_type);
728 if (ret == -2) {
729 env->spr[SPR_40x_ESR] = 0;
730 }
731 break;
732 }
733 if (ret >= 0) {
734 ctx->raddr = raddr;
735 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
736 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
737 ret);
738 return 0;
739 }
740 }
741 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
742 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
743
744 return ret;
745 }
746
747 void store_40x_sler(CPUPPCState *env, uint32_t val)
748 {
749 /* XXX: TO BE FIXED */
750 if (val != 0x00000000) {
751 cpu_abort(env, "Little-endian regions are not supported by now\n");
752 }
753 env->spr[SPR_405_SLER] = val;
754 }
755
756 static inline int mmubooke_check_tlb(CPUPPCState *env, ppcemb_tlb_t *tlb,
757 hwaddr *raddr, int *prot,
758 target_ulong address, int rw,
759 int access_type, int i)
760 {
761 int ret, prot2;
762
763 if (ppcemb_tlb_check(env, tlb, raddr, address,
764 env->spr[SPR_BOOKE_PID],
765 !env->nb_pids, i) >= 0) {
766 goto found_tlb;
767 }
768
769 if (env->spr[SPR_BOOKE_PID1] &&
770 ppcemb_tlb_check(env, tlb, raddr, address,
771 env->spr[SPR_BOOKE_PID1], 0, i) >= 0) {
772 goto found_tlb;
773 }
774
775 if (env->spr[SPR_BOOKE_PID2] &&
776 ppcemb_tlb_check(env, tlb, raddr, address,
777 env->spr[SPR_BOOKE_PID2], 0, i) >= 0) {
778 goto found_tlb;
779 }
780
781 LOG_SWTLB("%s: TLB entry not found\n", __func__);
782 return -1;
783
784 found_tlb:
785
786 if (msr_pr != 0) {
787 prot2 = tlb->prot & 0xF;
788 } else {
789 prot2 = (tlb->prot >> 4) & 0xF;
790 }
791
792 /* Check the address space */
793 if (access_type == ACCESS_CODE) {
794 if (msr_ir != (tlb->attr & 1)) {
795 LOG_SWTLB("%s: AS doesn't match\n", __func__);
796 return -1;
797 }
798
799 *prot = prot2;
800 if (prot2 & PAGE_EXEC) {
801 LOG_SWTLB("%s: good TLB!\n", __func__);
802 return 0;
803 }
804
805 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
806 ret = -3;
807 } else {
808 if (msr_dr != (tlb->attr & 1)) {
809 LOG_SWTLB("%s: AS doesn't match\n", __func__);
810 return -1;
811 }
812
813 *prot = prot2;
814 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
815 LOG_SWTLB("%s: found TLB!\n", __func__);
816 return 0;
817 }
818
819 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
820 ret = -2;
821 }
822
823 return ret;
824 }
825
826 static int mmubooke_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
827 target_ulong address, int rw,
828 int access_type)
829 {
830 ppcemb_tlb_t *tlb;
831 hwaddr raddr;
832 int i, ret;
833
834 ret = -1;
835 raddr = (hwaddr)-1ULL;
836 for (i = 0; i < env->nb_tlb; i++) {
837 tlb = &env->tlb.tlbe[i];
838 ret = mmubooke_check_tlb(env, tlb, &raddr, &ctx->prot, address, rw,
839 access_type, i);
840 if (!ret) {
841 break;
842 }
843 }
844
845 if (ret >= 0) {
846 ctx->raddr = raddr;
847 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
848 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
849 ret);
850 } else {
851 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
852 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
853 }
854
855 return ret;
856 }
857
858 static void booke206_flush_tlb(CPUPPCState *env, int flags,
859 const int check_iprot)
860 {
861 int tlb_size;
862 int i, j;
863 ppcmas_tlb_t *tlb = env->tlb.tlbm;
864
865 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
866 if (flags & (1 << i)) {
867 tlb_size = booke206_tlb_size(env, i);
868 for (j = 0; j < tlb_size; j++) {
869 if (!check_iprot || !(tlb[j].mas1 & MAS1_IPROT)) {
870 tlb[j].mas1 &= ~MAS1_VALID;
871 }
872 }
873 }
874 tlb += booke206_tlb_size(env, i);
875 }
876
877 tlb_flush(env, 1);
878 }
879
880 static hwaddr booke206_tlb_to_page_size(CPUPPCState *env,
881 ppcmas_tlb_t *tlb)
882 {
883 int tlbm_size;
884
885 tlbm_size = (tlb->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
886
887 return 1024ULL << tlbm_size;
888 }
889
890 /* TLB check function for MAS based SoftTLBs */
891 static int ppcmas_tlb_check(CPUPPCState *env, ppcmas_tlb_t *tlb,
892 hwaddr *raddrp,
893 target_ulong address, uint32_t pid)
894 {
895 target_ulong mask;
896 uint32_t tlb_pid;
897
898 /* Check valid flag */
899 if (!(tlb->mas1 & MAS1_VALID)) {
900 return -1;
901 }
902
903 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
904 LOG_SWTLB("%s: TLB ADDR=0x" TARGET_FMT_lx " PID=0x%x MAS1=0x%x MAS2=0x%"
905 PRIx64 " mask=0x" TARGET_FMT_lx " MAS7_3=0x%" PRIx64 " MAS8=%x\n",
906 __func__, address, pid, tlb->mas1, tlb->mas2, mask, tlb->mas7_3,
907 tlb->mas8);
908
909 /* Check PID */
910 tlb_pid = (tlb->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT;
911 if (tlb_pid != 0 && tlb_pid != pid) {
912 return -1;
913 }
914
915 /* Check effective address */
916 if ((address & mask) != (tlb->mas2 & MAS2_EPN_MASK)) {
917 return -1;
918 }
919
920 if (raddrp) {
921 *raddrp = (tlb->mas7_3 & mask) | (address & ~mask);
922 }
923
924 return 0;
925 }
926
927 static int mmubooke206_check_tlb(CPUPPCState *env, ppcmas_tlb_t *tlb,
928 hwaddr *raddr, int *prot,
929 target_ulong address, int rw,
930 int access_type)
931 {
932 int ret;
933 int prot2 = 0;
934
935 if (ppcmas_tlb_check(env, tlb, raddr, address,
936 env->spr[SPR_BOOKE_PID]) >= 0) {
937 goto found_tlb;
938 }
939
940 if (env->spr[SPR_BOOKE_PID1] &&
941 ppcmas_tlb_check(env, tlb, raddr, address,
942 env->spr[SPR_BOOKE_PID1]) >= 0) {
943 goto found_tlb;
944 }
945
946 if (env->spr[SPR_BOOKE_PID2] &&
947 ppcmas_tlb_check(env, tlb, raddr, address,
948 env->spr[SPR_BOOKE_PID2]) >= 0) {
949 goto found_tlb;
950 }
951
952 LOG_SWTLB("%s: TLB entry not found\n", __func__);
953 return -1;
954
955 found_tlb:
956
957 if (msr_pr != 0) {
958 if (tlb->mas7_3 & MAS3_UR) {
959 prot2 |= PAGE_READ;
960 }
961 if (tlb->mas7_3 & MAS3_UW) {
962 prot2 |= PAGE_WRITE;
963 }
964 if (tlb->mas7_3 & MAS3_UX) {
965 prot2 |= PAGE_EXEC;
966 }
967 } else {
968 if (tlb->mas7_3 & MAS3_SR) {
969 prot2 |= PAGE_READ;
970 }
971 if (tlb->mas7_3 & MAS3_SW) {
972 prot2 |= PAGE_WRITE;
973 }
974 if (tlb->mas7_3 & MAS3_SX) {
975 prot2 |= PAGE_EXEC;
976 }
977 }
978
979 /* Check the address space and permissions */
980 if (access_type == ACCESS_CODE) {
981 if (msr_ir != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
982 LOG_SWTLB("%s: AS doesn't match\n", __func__);
983 return -1;
984 }
985
986 *prot = prot2;
987 if (prot2 & PAGE_EXEC) {
988 LOG_SWTLB("%s: good TLB!\n", __func__);
989 return 0;
990 }
991
992 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
993 ret = -3;
994 } else {
995 if (msr_dr != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
996 LOG_SWTLB("%s: AS doesn't match\n", __func__);
997 return -1;
998 }
999
1000 *prot = prot2;
1001 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
1002 LOG_SWTLB("%s: found TLB!\n", __func__);
1003 return 0;
1004 }
1005
1006 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
1007 ret = -2;
1008 }
1009
1010 return ret;
1011 }
1012
1013 static int mmubooke206_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1014 target_ulong address, int rw,
1015 int access_type)
1016 {
1017 ppcmas_tlb_t *tlb;
1018 hwaddr raddr;
1019 int i, j, ret;
1020
1021 ret = -1;
1022 raddr = (hwaddr)-1ULL;
1023
1024 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1025 int ways = booke206_tlb_ways(env, i);
1026
1027 for (j = 0; j < ways; j++) {
1028 tlb = booke206_get_tlbm(env, i, address, j);
1029 if (!tlb) {
1030 continue;
1031 }
1032 ret = mmubooke206_check_tlb(env, tlb, &raddr, &ctx->prot, address,
1033 rw, access_type);
1034 if (ret != -1) {
1035 goto found_tlb;
1036 }
1037 }
1038 }
1039
1040 found_tlb:
1041
1042 if (ret >= 0) {
1043 ctx->raddr = raddr;
1044 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
1045 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
1046 ret);
1047 } else {
1048 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
1049 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
1050 }
1051
1052 return ret;
1053 }
1054
1055 static const char *book3e_tsize_to_str[32] = {
1056 "1K", "2K", "4K", "8K", "16K", "32K", "64K", "128K", "256K", "512K",
1057 "1M", "2M", "4M", "8M", "16M", "32M", "64M", "128M", "256M", "512M",
1058 "1G", "2G", "4G", "8G", "16G", "32G", "64G", "128G", "256G", "512G",
1059 "1T", "2T"
1060 };
1061
1062 static void mmubooke_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1063 CPUPPCState *env)
1064 {
1065 ppcemb_tlb_t *entry;
1066 int i;
1067
1068 if (kvm_enabled() && !env->kvm_sw_tlb) {
1069 cpu_fprintf(f, "Cannot access KVM TLB\n");
1070 return;
1071 }
1072
1073 cpu_fprintf(f, "\nTLB:\n");
1074 cpu_fprintf(f, "Effective Physical Size PID Prot "
1075 "Attr\n");
1076
1077 entry = &env->tlb.tlbe[0];
1078 for (i = 0; i < env->nb_tlb; i++, entry++) {
1079 hwaddr ea, pa;
1080 target_ulong mask;
1081 uint64_t size = (uint64_t)entry->size;
1082 char size_buf[20];
1083
1084 /* Check valid flag */
1085 if (!(entry->prot & PAGE_VALID)) {
1086 continue;
1087 }
1088
1089 mask = ~(entry->size - 1);
1090 ea = entry->EPN & mask;
1091 pa = entry->RPN & mask;
1092 /* Extend the physical address to 36 bits */
1093 pa |= (hwaddr)(entry->RPN & 0xF) << 32;
1094 size /= 1024;
1095 if (size >= 1024) {
1096 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "M", size / 1024);
1097 } else {
1098 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "k", size);
1099 }
1100 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %s %-5u %08x %08x\n",
1101 (uint64_t)ea, (uint64_t)pa, size_buf, (uint32_t)entry->PID,
1102 entry->prot, entry->attr);
1103 }
1104
1105 }
1106
1107 static void mmubooke206_dump_one_tlb(FILE *f, fprintf_function cpu_fprintf,
1108 CPUPPCState *env, int tlbn, int offset,
1109 int tlbsize)
1110 {
1111 ppcmas_tlb_t *entry;
1112 int i;
1113
1114 cpu_fprintf(f, "\nTLB%d:\n", tlbn);
1115 cpu_fprintf(f, "Effective Physical Size TID TS SRWX"
1116 " URWX WIMGE U0123\n");
1117
1118 entry = &env->tlb.tlbm[offset];
1119 for (i = 0; i < tlbsize; i++, entry++) {
1120 hwaddr ea, pa, size;
1121 int tsize;
1122
1123 if (!(entry->mas1 & MAS1_VALID)) {
1124 continue;
1125 }
1126
1127 tsize = (entry->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
1128 size = 1024ULL << tsize;
1129 ea = entry->mas2 & ~(size - 1);
1130 pa = entry->mas7_3 & ~(size - 1);
1131
1132 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %4s %-5u %1u S%c%c%c"
1133 "U%c%c%c %c%c%c%c%c U%c%c%c%c\n",
1134 (uint64_t)ea, (uint64_t)pa,
1135 book3e_tsize_to_str[tsize],
1136 (entry->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT,
1137 (entry->mas1 & MAS1_TS) >> MAS1_TS_SHIFT,
1138 entry->mas7_3 & MAS3_SR ? 'R' : '-',
1139 entry->mas7_3 & MAS3_SW ? 'W' : '-',
1140 entry->mas7_3 & MAS3_SX ? 'X' : '-',
1141 entry->mas7_3 & MAS3_UR ? 'R' : '-',
1142 entry->mas7_3 & MAS3_UW ? 'W' : '-',
1143 entry->mas7_3 & MAS3_UX ? 'X' : '-',
1144 entry->mas2 & MAS2_W ? 'W' : '-',
1145 entry->mas2 & MAS2_I ? 'I' : '-',
1146 entry->mas2 & MAS2_M ? 'M' : '-',
1147 entry->mas2 & MAS2_G ? 'G' : '-',
1148 entry->mas2 & MAS2_E ? 'E' : '-',
1149 entry->mas7_3 & MAS3_U0 ? '0' : '-',
1150 entry->mas7_3 & MAS3_U1 ? '1' : '-',
1151 entry->mas7_3 & MAS3_U2 ? '2' : '-',
1152 entry->mas7_3 & MAS3_U3 ? '3' : '-');
1153 }
1154 }
1155
1156 static void mmubooke206_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1157 CPUPPCState *env)
1158 {
1159 int offset = 0;
1160 int i;
1161
1162 if (kvm_enabled() && !env->kvm_sw_tlb) {
1163 cpu_fprintf(f, "Cannot access KVM TLB\n");
1164 return;
1165 }
1166
1167 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1168 int size = booke206_tlb_size(env, i);
1169
1170 if (size == 0) {
1171 continue;
1172 }
1173
1174 mmubooke206_dump_one_tlb(f, cpu_fprintf, env, i, offset, size);
1175 offset += size;
1176 }
1177 }
1178
1179 static void mmu6xx_dump_BATs(FILE *f, fprintf_function cpu_fprintf,
1180 CPUPPCState *env, int type)
1181 {
1182 target_ulong *BATlt, *BATut, *BATu, *BATl;
1183 target_ulong BEPIl, BEPIu, bl;
1184 int i;
1185
1186 switch (type) {
1187 case ACCESS_CODE:
1188 BATlt = env->IBAT[1];
1189 BATut = env->IBAT[0];
1190 break;
1191 default:
1192 BATlt = env->DBAT[1];
1193 BATut = env->DBAT[0];
1194 break;
1195 }
1196
1197 for (i = 0; i < env->nb_BATs; i++) {
1198 BATu = &BATut[i];
1199 BATl = &BATlt[i];
1200 BEPIu = *BATu & 0xF0000000;
1201 BEPIl = *BATu & 0x0FFE0000;
1202 bl = (*BATu & 0x00001FFC) << 15;
1203 cpu_fprintf(f, "%s BAT%d BATu " TARGET_FMT_lx
1204 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
1205 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
1206 type == ACCESS_CODE ? "code" : "data", i,
1207 *BATu, *BATl, BEPIu, BEPIl, bl);
1208 }
1209 }
1210
1211 static void mmu6xx_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1212 CPUPPCState *env)
1213 {
1214 ppc6xx_tlb_t *tlb;
1215 target_ulong sr;
1216 int type, way, entry, i;
1217
1218 cpu_fprintf(f, "HTAB base = 0x%"HWADDR_PRIx"\n", env->htab_base);
1219 cpu_fprintf(f, "HTAB mask = 0x%"HWADDR_PRIx"\n", env->htab_mask);
1220
1221 cpu_fprintf(f, "\nSegment registers:\n");
1222 for (i = 0; i < 32; i++) {
1223 sr = env->sr[i];
1224 if (sr & 0x80000000) {
1225 cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d BUID=0x%03x "
1226 "CNTLR_SPEC=0x%05x\n", i,
1227 sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0,
1228 sr & 0x20000000 ? 1 : 0, (uint32_t)((sr >> 20) & 0x1FF),
1229 (uint32_t)(sr & 0xFFFFF));
1230 } else {
1231 cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d N=%d VSID=0x%06x\n", i,
1232 sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0,
1233 sr & 0x20000000 ? 1 : 0, sr & 0x10000000 ? 1 : 0,
1234 (uint32_t)(sr & 0x00FFFFFF));
1235 }
1236 }
1237
1238 cpu_fprintf(f, "\nBATs:\n");
1239 mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_INT);
1240 mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_CODE);
1241
1242 if (env->id_tlbs != 1) {
1243 cpu_fprintf(f, "ERROR: 6xx MMU should have separated TLB"
1244 " for code and data\n");
1245 }
1246
1247 cpu_fprintf(f, "\nTLBs [EPN EPN + SIZE]\n");
1248
1249 for (type = 0; type < 2; type++) {
1250 for (way = 0; way < env->nb_ways; way++) {
1251 for (entry = env->nb_tlb * type + env->tlb_per_way * way;
1252 entry < (env->nb_tlb * type + env->tlb_per_way * (way + 1));
1253 entry++) {
1254
1255 tlb = &env->tlb.tlb6[entry];
1256 cpu_fprintf(f, "%s TLB %02d/%02d way:%d %s ["
1257 TARGET_FMT_lx " " TARGET_FMT_lx "]\n",
1258 type ? "code" : "data", entry % env->nb_tlb,
1259 env->nb_tlb, way,
1260 pte_is_valid(tlb->pte0) ? "valid" : "inval",
1261 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE);
1262 }
1263 }
1264 }
1265 }
1266
1267 void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
1268 {
1269 switch (env->mmu_model) {
1270 case POWERPC_MMU_BOOKE:
1271 mmubooke_dump_mmu(f, cpu_fprintf, env);
1272 break;
1273 case POWERPC_MMU_BOOKE206:
1274 mmubooke206_dump_mmu(f, cpu_fprintf, env);
1275 break;
1276 case POWERPC_MMU_SOFT_6xx:
1277 case POWERPC_MMU_SOFT_74xx:
1278 mmu6xx_dump_mmu(f, cpu_fprintf, env);
1279 break;
1280 #if defined(TARGET_PPC64)
1281 case POWERPC_MMU_64B:
1282 case POWERPC_MMU_2_06:
1283 case POWERPC_MMU_2_06a:
1284 case POWERPC_MMU_2_06d:
1285 dump_slb(f, cpu_fprintf, env);
1286 break;
1287 #endif
1288 default:
1289 qemu_log_mask(LOG_UNIMP, "%s: unimplemented\n", __func__);
1290 }
1291 }
1292
1293 static inline int check_physical(CPUPPCState *env, mmu_ctx_t *ctx,
1294 target_ulong eaddr, int rw)
1295 {
1296 int in_plb, ret;
1297
1298 ctx->raddr = eaddr;
1299 ctx->prot = PAGE_READ | PAGE_EXEC;
1300 ret = 0;
1301 switch (env->mmu_model) {
1302 case POWERPC_MMU_SOFT_6xx:
1303 case POWERPC_MMU_SOFT_74xx:
1304 case POWERPC_MMU_SOFT_4xx:
1305 case POWERPC_MMU_REAL:
1306 case POWERPC_MMU_BOOKE:
1307 ctx->prot |= PAGE_WRITE;
1308 break;
1309
1310 case POWERPC_MMU_SOFT_4xx_Z:
1311 if (unlikely(msr_pe != 0)) {
1312 /* 403 family add some particular protections,
1313 * using PBL/PBU registers for accesses with no translation.
1314 */
1315 in_plb =
1316 /* Check PLB validity */
1317 (env->pb[0] < env->pb[1] &&
1318 /* and address in plb area */
1319 eaddr >= env->pb[0] && eaddr < env->pb[1]) ||
1320 (env->pb[2] < env->pb[3] &&
1321 eaddr >= env->pb[2] && eaddr < env->pb[3]) ? 1 : 0;
1322 if (in_plb ^ msr_px) {
1323 /* Access in protected area */
1324 if (rw == 1) {
1325 /* Access is not allowed */
1326 ret = -2;
1327 }
1328 } else {
1329 /* Read-write access is allowed */
1330 ctx->prot |= PAGE_WRITE;
1331 }
1332 }
1333 break;
1334
1335 default:
1336 /* Caller's checks mean we should never get here for other models */
1337 abort();
1338 return -1;
1339 }
1340
1341 return ret;
1342 }
1343
1344 static int get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1345 target_ulong eaddr, int rw, int access_type)
1346 {
1347 int ret = -1;
1348 bool real_mode = (access_type == ACCESS_CODE && msr_ir == 0)
1349 || (access_type != ACCESS_CODE && msr_dr == 0);
1350
1351 #if 0
1352 qemu_log("%s\n", __func__);
1353 #endif
1354
1355 switch (env->mmu_model) {
1356 case POWERPC_MMU_SOFT_6xx:
1357 case POWERPC_MMU_SOFT_74xx:
1358 if (real_mode) {
1359 ret = check_physical(env, ctx, eaddr, rw);
1360 } else {
1361 /* Try to find a BAT */
1362 if (env->nb_BATs != 0) {
1363 ret = get_bat_6xx_tlb(env, ctx, eaddr, rw, access_type);
1364 }
1365 if (ret < 0) {
1366 /* We didn't match any BAT entry or don't have BATs */
1367 ret = get_segment_6xx_tlb(env, ctx, eaddr, rw, access_type);
1368 }
1369 }
1370 break;
1371
1372 case POWERPC_MMU_SOFT_4xx:
1373 case POWERPC_MMU_SOFT_4xx_Z:
1374 if (real_mode) {
1375 ret = check_physical(env, ctx, eaddr, rw);
1376 } else {
1377 ret = mmu40x_get_physical_address(env, ctx, eaddr,
1378 rw, access_type);
1379 }
1380 break;
1381 case POWERPC_MMU_BOOKE:
1382 ret = mmubooke_get_physical_address(env, ctx, eaddr,
1383 rw, access_type);
1384 break;
1385 case POWERPC_MMU_BOOKE206:
1386 ret = mmubooke206_get_physical_address(env, ctx, eaddr, rw,
1387 access_type);
1388 break;
1389 case POWERPC_MMU_MPC8xx:
1390 /* XXX: TODO */
1391 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1392 break;
1393 case POWERPC_MMU_REAL:
1394 if (real_mode) {
1395 ret = check_physical(env, ctx, eaddr, rw);
1396 } else {
1397 cpu_abort(env, "PowerPC in real mode do not do any translation\n");
1398 }
1399 return -1;
1400 default:
1401 cpu_abort(env, "Unknown or invalid MMU model\n");
1402 return -1;
1403 }
1404 #if 0
1405 qemu_log("%s address " TARGET_FMT_lx " => %d " TARGET_FMT_plx "\n",
1406 __func__, eaddr, ret, ctx->raddr);
1407 #endif
1408
1409 return ret;
1410 }
1411
1412 hwaddr ppc_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
1413 {
1414 PowerPCCPU *cpu = POWERPC_CPU(cs);
1415 CPUPPCState *env = &cpu->env;
1416 mmu_ctx_t ctx;
1417
1418 switch (env->mmu_model) {
1419 #if defined(TARGET_PPC64)
1420 case POWERPC_MMU_64B:
1421 case POWERPC_MMU_2_06:
1422 case POWERPC_MMU_2_06a:
1423 case POWERPC_MMU_2_06d:
1424 return ppc_hash64_get_phys_page_debug(env, addr);
1425 #endif
1426
1427 case POWERPC_MMU_32B:
1428 case POWERPC_MMU_601:
1429 return ppc_hash32_get_phys_page_debug(env, addr);
1430
1431 default:
1432 ;
1433 }
1434
1435 if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT) != 0)) {
1436
1437 /* Some MMUs have separate TLBs for code and data. If we only try an
1438 * ACCESS_INT, we may not be able to read instructions mapped by code
1439 * TLBs, so we also try a ACCESS_CODE.
1440 */
1441 if (unlikely(get_physical_address(env, &ctx, addr, 0,
1442 ACCESS_CODE) != 0)) {
1443 return -1;
1444 }
1445 }
1446
1447 return ctx.raddr & TARGET_PAGE_MASK;
1448 }
1449
1450 static void booke206_update_mas_tlb_miss(CPUPPCState *env, target_ulong address,
1451 int rw)
1452 {
1453 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
1454 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
1455 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
1456 env->spr[SPR_BOOKE_MAS3] = 0;
1457 env->spr[SPR_BOOKE_MAS6] = 0;
1458 env->spr[SPR_BOOKE_MAS7] = 0;
1459
1460 /* AS */
1461 if (((rw == 2) && msr_ir) || ((rw != 2) && msr_dr)) {
1462 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
1463 env->spr[SPR_BOOKE_MAS6] |= MAS6_SAS;
1464 }
1465
1466 env->spr[SPR_BOOKE_MAS1] |= MAS1_VALID;
1467 env->spr[SPR_BOOKE_MAS2] |= address & MAS2_EPN_MASK;
1468
1469 switch (env->spr[SPR_BOOKE_MAS4] & MAS4_TIDSELD_PIDZ) {
1470 case MAS4_TIDSELD_PID0:
1471 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID] << MAS1_TID_SHIFT;
1472 break;
1473 case MAS4_TIDSELD_PID1:
1474 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID1] << MAS1_TID_SHIFT;
1475 break;
1476 case MAS4_TIDSELD_PID2:
1477 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID2] << MAS1_TID_SHIFT;
1478 break;
1479 }
1480
1481 env->spr[SPR_BOOKE_MAS6] |= env->spr[SPR_BOOKE_PID] << 16;
1482
1483 /* next victim logic */
1484 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
1485 env->last_way++;
1486 env->last_way &= booke206_tlb_ways(env, 0) - 1;
1487 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
1488 }
1489
1490 /* Perform address translation */
1491 static int cpu_ppc_handle_mmu_fault(CPUPPCState *env, target_ulong address,
1492 int rw, int mmu_idx)
1493 {
1494 CPUState *cs = CPU(ppc_env_get_cpu(env));
1495 mmu_ctx_t ctx;
1496 int access_type;
1497 int ret = 0;
1498
1499 if (rw == 2) {
1500 /* code access */
1501 rw = 0;
1502 access_type = ACCESS_CODE;
1503 } else {
1504 /* data access */
1505 access_type = env->access_type;
1506 }
1507 ret = get_physical_address(env, &ctx, address, rw, access_type);
1508 if (ret == 0) {
1509 tlb_set_page(env, address & TARGET_PAGE_MASK,
1510 ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
1511 mmu_idx, TARGET_PAGE_SIZE);
1512 ret = 0;
1513 } else if (ret < 0) {
1514 LOG_MMU_STATE(cs);
1515 if (access_type == ACCESS_CODE) {
1516 switch (ret) {
1517 case -1:
1518 /* No matches in page tables or TLB */
1519 switch (env->mmu_model) {
1520 case POWERPC_MMU_SOFT_6xx:
1521 cs->exception_index = POWERPC_EXCP_IFTLB;
1522 env->error_code = 1 << 18;
1523 env->spr[SPR_IMISS] = address;
1524 env->spr[SPR_ICMP] = 0x80000000 | ctx.ptem;
1525 goto tlb_miss;
1526 case POWERPC_MMU_SOFT_74xx:
1527 cs->exception_index = POWERPC_EXCP_IFTLB;
1528 goto tlb_miss_74xx;
1529 case POWERPC_MMU_SOFT_4xx:
1530 case POWERPC_MMU_SOFT_4xx_Z:
1531 cs->exception_index = POWERPC_EXCP_ITLB;
1532 env->error_code = 0;
1533 env->spr[SPR_40x_DEAR] = address;
1534 env->spr[SPR_40x_ESR] = 0x00000000;
1535 break;
1536 case POWERPC_MMU_BOOKE206:
1537 booke206_update_mas_tlb_miss(env, address, rw);
1538 /* fall through */
1539 case POWERPC_MMU_BOOKE:
1540 cs->exception_index = POWERPC_EXCP_ITLB;
1541 env->error_code = 0;
1542 env->spr[SPR_BOOKE_DEAR] = address;
1543 return -1;
1544 case POWERPC_MMU_MPC8xx:
1545 /* XXX: TODO */
1546 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1547 break;
1548 case POWERPC_MMU_REAL:
1549 cpu_abort(env, "PowerPC in real mode should never raise "
1550 "any MMU exceptions\n");
1551 return -1;
1552 default:
1553 cpu_abort(env, "Unknown or invalid MMU model\n");
1554 return -1;
1555 }
1556 break;
1557 case -2:
1558 /* Access rights violation */
1559 cs->exception_index = POWERPC_EXCP_ISI;
1560 env->error_code = 0x08000000;
1561 break;
1562 case -3:
1563 /* No execute protection violation */
1564 if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1565 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1566 env->spr[SPR_BOOKE_ESR] = 0x00000000;
1567 }
1568 cs->exception_index = POWERPC_EXCP_ISI;
1569 env->error_code = 0x10000000;
1570 break;
1571 case -4:
1572 /* Direct store exception */
1573 /* No code fetch is allowed in direct-store areas */
1574 cs->exception_index = POWERPC_EXCP_ISI;
1575 env->error_code = 0x10000000;
1576 break;
1577 }
1578 } else {
1579 switch (ret) {
1580 case -1:
1581 /* No matches in page tables or TLB */
1582 switch (env->mmu_model) {
1583 case POWERPC_MMU_SOFT_6xx:
1584 if (rw == 1) {
1585 cs->exception_index = POWERPC_EXCP_DSTLB;
1586 env->error_code = 1 << 16;
1587 } else {
1588 cs->exception_index = POWERPC_EXCP_DLTLB;
1589 env->error_code = 0;
1590 }
1591 env->spr[SPR_DMISS] = address;
1592 env->spr[SPR_DCMP] = 0x80000000 | ctx.ptem;
1593 tlb_miss:
1594 env->error_code |= ctx.key << 19;
1595 env->spr[SPR_HASH1] = env->htab_base +
1596 get_pteg_offset32(env, ctx.hash[0]);
1597 env->spr[SPR_HASH2] = env->htab_base +
1598 get_pteg_offset32(env, ctx.hash[1]);
1599 break;
1600 case POWERPC_MMU_SOFT_74xx:
1601 if (rw == 1) {
1602 cs->exception_index = POWERPC_EXCP_DSTLB;
1603 } else {
1604 cs->exception_index = POWERPC_EXCP_DLTLB;
1605 }
1606 tlb_miss_74xx:
1607 /* Implement LRU algorithm */
1608 env->error_code = ctx.key << 19;
1609 env->spr[SPR_TLBMISS] = (address & ~((target_ulong)0x3)) |
1610 ((env->last_way + 1) & (env->nb_ways - 1));
1611 env->spr[SPR_PTEHI] = 0x80000000 | ctx.ptem;
1612 break;
1613 case POWERPC_MMU_SOFT_4xx:
1614 case POWERPC_MMU_SOFT_4xx_Z:
1615 cs->exception_index = POWERPC_EXCP_DTLB;
1616 env->error_code = 0;
1617 env->spr[SPR_40x_DEAR] = address;
1618 if (rw) {
1619 env->spr[SPR_40x_ESR] = 0x00800000;
1620 } else {
1621 env->spr[SPR_40x_ESR] = 0x00000000;
1622 }
1623 break;
1624 case POWERPC_MMU_MPC8xx:
1625 /* XXX: TODO */
1626 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1627 break;
1628 case POWERPC_MMU_BOOKE206:
1629 booke206_update_mas_tlb_miss(env, address, rw);
1630 /* fall through */
1631 case POWERPC_MMU_BOOKE:
1632 cs->exception_index = POWERPC_EXCP_DTLB;
1633 env->error_code = 0;
1634 env->spr[SPR_BOOKE_DEAR] = address;
1635 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1636 return -1;
1637 case POWERPC_MMU_REAL:
1638 cpu_abort(env, "PowerPC in real mode should never raise "
1639 "any MMU exceptions\n");
1640 return -1;
1641 default:
1642 cpu_abort(env, "Unknown or invalid MMU model\n");
1643 return -1;
1644 }
1645 break;
1646 case -2:
1647 /* Access rights violation */
1648 cs->exception_index = POWERPC_EXCP_DSI;
1649 env->error_code = 0;
1650 if (env->mmu_model == POWERPC_MMU_SOFT_4xx
1651 || env->mmu_model == POWERPC_MMU_SOFT_4xx_Z) {
1652 env->spr[SPR_40x_DEAR] = address;
1653 if (rw) {
1654 env->spr[SPR_40x_ESR] |= 0x00800000;
1655 }
1656 } else if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1657 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1658 env->spr[SPR_BOOKE_DEAR] = address;
1659 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1660 } else {
1661 env->spr[SPR_DAR] = address;
1662 if (rw == 1) {
1663 env->spr[SPR_DSISR] = 0x0A000000;
1664 } else {
1665 env->spr[SPR_DSISR] = 0x08000000;
1666 }
1667 }
1668 break;
1669 case -4:
1670 /* Direct store exception */
1671 switch (access_type) {
1672 case ACCESS_FLOAT:
1673 /* Floating point load/store */
1674 cs->exception_index = POWERPC_EXCP_ALIGN;
1675 env->error_code = POWERPC_EXCP_ALIGN_FP;
1676 env->spr[SPR_DAR] = address;
1677 break;
1678 case ACCESS_RES:
1679 /* lwarx, ldarx or stwcx. */
1680 cs->exception_index = POWERPC_EXCP_DSI;
1681 env->error_code = 0;
1682 env->spr[SPR_DAR] = address;
1683 if (rw == 1) {
1684 env->spr[SPR_DSISR] = 0x06000000;
1685 } else {
1686 env->spr[SPR_DSISR] = 0x04000000;
1687 }
1688 break;
1689 case ACCESS_EXT:
1690 /* eciwx or ecowx */
1691 cs->exception_index = POWERPC_EXCP_DSI;
1692 env->error_code = 0;
1693 env->spr[SPR_DAR] = address;
1694 if (rw == 1) {
1695 env->spr[SPR_DSISR] = 0x06100000;
1696 } else {
1697 env->spr[SPR_DSISR] = 0x04100000;
1698 }
1699 break;
1700 default:
1701 printf("DSI: invalid exception (%d)\n", ret);
1702 cs->exception_index = POWERPC_EXCP_PROGRAM;
1703 env->error_code =
1704 POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL;
1705 env->spr[SPR_DAR] = address;
1706 break;
1707 }
1708 break;
1709 }
1710 }
1711 #if 0
1712 printf("%s: set exception to %d %02x\n", __func__,
1713 cs->exception, env->error_code);
1714 #endif
1715 ret = 1;
1716 }
1717
1718 return ret;
1719 }
1720
1721 /*****************************************************************************/
1722 /* BATs management */
1723 #if !defined(FLUSH_ALL_TLBS)
1724 static inline void do_invalidate_BAT(CPUPPCState *env, target_ulong BATu,
1725 target_ulong mask)
1726 {
1727 target_ulong base, end, page;
1728
1729 base = BATu & ~0x0001FFFF;
1730 end = base + mask + 0x00020000;
1731 LOG_BATS("Flush BAT from " TARGET_FMT_lx " to " TARGET_FMT_lx " ("
1732 TARGET_FMT_lx ")\n", base, end, mask);
1733 for (page = base; page != end; page += TARGET_PAGE_SIZE) {
1734 tlb_flush_page(env, page);
1735 }
1736 LOG_BATS("Flush done\n");
1737 }
1738 #endif
1739
1740 static inline void dump_store_bat(CPUPPCState *env, char ID, int ul, int nr,
1741 target_ulong value)
1742 {
1743 LOG_BATS("Set %cBAT%d%c to " TARGET_FMT_lx " (" TARGET_FMT_lx ")\n", ID,
1744 nr, ul == 0 ? 'u' : 'l', value, env->nip);
1745 }
1746
1747 void helper_store_ibatu(CPUPPCState *env, uint32_t nr, target_ulong value)
1748 {
1749 target_ulong mask;
1750
1751 dump_store_bat(env, 'I', 0, nr, value);
1752 if (env->IBAT[0][nr] != value) {
1753 mask = (value << 15) & 0x0FFE0000UL;
1754 #if !defined(FLUSH_ALL_TLBS)
1755 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1756 #endif
1757 /* When storing valid upper BAT, mask BEPI and BRPN
1758 * and invalidate all TLBs covered by this BAT
1759 */
1760 mask = (value << 15) & 0x0FFE0000UL;
1761 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1762 (value & ~0x0001FFFFUL & ~mask);
1763 env->IBAT[1][nr] = (env->IBAT[1][nr] & 0x0000007B) |
1764 (env->IBAT[1][nr] & ~0x0001FFFF & ~mask);
1765 #if !defined(FLUSH_ALL_TLBS)
1766 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1767 #else
1768 tlb_flush(env, 1);
1769 #endif
1770 }
1771 }
1772
1773 void helper_store_ibatl(CPUPPCState *env, uint32_t nr, target_ulong value)
1774 {
1775 dump_store_bat(env, 'I', 1, nr, value);
1776 env->IBAT[1][nr] = value;
1777 }
1778
1779 void helper_store_dbatu(CPUPPCState *env, uint32_t nr, target_ulong value)
1780 {
1781 target_ulong mask;
1782
1783 dump_store_bat(env, 'D', 0, nr, value);
1784 if (env->DBAT[0][nr] != value) {
1785 /* When storing valid upper BAT, mask BEPI and BRPN
1786 * and invalidate all TLBs covered by this BAT
1787 */
1788 mask = (value << 15) & 0x0FFE0000UL;
1789 #if !defined(FLUSH_ALL_TLBS)
1790 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1791 #endif
1792 mask = (value << 15) & 0x0FFE0000UL;
1793 env->DBAT[0][nr] = (value & 0x00001FFFUL) |
1794 (value & ~0x0001FFFFUL & ~mask);
1795 env->DBAT[1][nr] = (env->DBAT[1][nr] & 0x0000007B) |
1796 (env->DBAT[1][nr] & ~0x0001FFFF & ~mask);
1797 #if !defined(FLUSH_ALL_TLBS)
1798 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1799 #else
1800 tlb_flush(env, 1);
1801 #endif
1802 }
1803 }
1804
1805 void helper_store_dbatl(CPUPPCState *env, uint32_t nr, target_ulong value)
1806 {
1807 dump_store_bat(env, 'D', 1, nr, value);
1808 env->DBAT[1][nr] = value;
1809 }
1810
1811 void helper_store_601_batu(CPUPPCState *env, uint32_t nr, target_ulong value)
1812 {
1813 target_ulong mask;
1814 #if defined(FLUSH_ALL_TLBS)
1815 int do_inval;
1816 #endif
1817
1818 dump_store_bat(env, 'I', 0, nr, value);
1819 if (env->IBAT[0][nr] != value) {
1820 #if defined(FLUSH_ALL_TLBS)
1821 do_inval = 0;
1822 #endif
1823 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1824 if (env->IBAT[1][nr] & 0x40) {
1825 /* Invalidate BAT only if it is valid */
1826 #if !defined(FLUSH_ALL_TLBS)
1827 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1828 #else
1829 do_inval = 1;
1830 #endif
1831 }
1832 /* When storing valid upper BAT, mask BEPI and BRPN
1833 * and invalidate all TLBs covered by this BAT
1834 */
1835 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1836 (value & ~0x0001FFFFUL & ~mask);
1837 env->DBAT[0][nr] = env->IBAT[0][nr];
1838 if (env->IBAT[1][nr] & 0x40) {
1839 #if !defined(FLUSH_ALL_TLBS)
1840 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1841 #else
1842 do_inval = 1;
1843 #endif
1844 }
1845 #if defined(FLUSH_ALL_TLBS)
1846 if (do_inval) {
1847 tlb_flush(env, 1);
1848 }
1849 #endif
1850 }
1851 }
1852
1853 void helper_store_601_batl(CPUPPCState *env, uint32_t nr, target_ulong value)
1854 {
1855 #if !defined(FLUSH_ALL_TLBS)
1856 target_ulong mask;
1857 #else
1858 int do_inval;
1859 #endif
1860
1861 dump_store_bat(env, 'I', 1, nr, value);
1862 if (env->IBAT[1][nr] != value) {
1863 #if defined(FLUSH_ALL_TLBS)
1864 do_inval = 0;
1865 #endif
1866 if (env->IBAT[1][nr] & 0x40) {
1867 #if !defined(FLUSH_ALL_TLBS)
1868 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1869 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1870 #else
1871 do_inval = 1;
1872 #endif
1873 }
1874 if (value & 0x40) {
1875 #if !defined(FLUSH_ALL_TLBS)
1876 mask = (value << 17) & 0x0FFE0000UL;
1877 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1878 #else
1879 do_inval = 1;
1880 #endif
1881 }
1882 env->IBAT[1][nr] = value;
1883 env->DBAT[1][nr] = value;
1884 #if defined(FLUSH_ALL_TLBS)
1885 if (do_inval) {
1886 tlb_flush(env, 1);
1887 }
1888 #endif
1889 }
1890 }
1891
1892 /*****************************************************************************/
1893 /* TLB management */
1894 void ppc_tlb_invalidate_all(CPUPPCState *env)
1895 {
1896 switch (env->mmu_model) {
1897 case POWERPC_MMU_SOFT_6xx:
1898 case POWERPC_MMU_SOFT_74xx:
1899 ppc6xx_tlb_invalidate_all(env);
1900 break;
1901 case POWERPC_MMU_SOFT_4xx:
1902 case POWERPC_MMU_SOFT_4xx_Z:
1903 ppc4xx_tlb_invalidate_all(env);
1904 break;
1905 case POWERPC_MMU_REAL:
1906 cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
1907 break;
1908 case POWERPC_MMU_MPC8xx:
1909 /* XXX: TODO */
1910 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1911 break;
1912 case POWERPC_MMU_BOOKE:
1913 tlb_flush(env, 1);
1914 break;
1915 case POWERPC_MMU_BOOKE206:
1916 booke206_flush_tlb(env, -1, 0);
1917 break;
1918 case POWERPC_MMU_32B:
1919 case POWERPC_MMU_601:
1920 #if defined(TARGET_PPC64)
1921 case POWERPC_MMU_64B:
1922 case POWERPC_MMU_2_06:
1923 case POWERPC_MMU_2_06a:
1924 case POWERPC_MMU_2_06d:
1925 #endif /* defined(TARGET_PPC64) */
1926 tlb_flush(env, 1);
1927 break;
1928 default:
1929 /* XXX: TODO */
1930 cpu_abort(env, "Unknown MMU model\n");
1931 break;
1932 }
1933 }
1934
1935 void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
1936 {
1937 #if !defined(FLUSH_ALL_TLBS)
1938 addr &= TARGET_PAGE_MASK;
1939 switch (env->mmu_model) {
1940 case POWERPC_MMU_SOFT_6xx:
1941 case POWERPC_MMU_SOFT_74xx:
1942 ppc6xx_tlb_invalidate_virt(env, addr, 0);
1943 if (env->id_tlbs == 1) {
1944 ppc6xx_tlb_invalidate_virt(env, addr, 1);
1945 }
1946 break;
1947 case POWERPC_MMU_SOFT_4xx:
1948 case POWERPC_MMU_SOFT_4xx_Z:
1949 ppc4xx_tlb_invalidate_virt(env, addr, env->spr[SPR_40x_PID]);
1950 break;
1951 case POWERPC_MMU_REAL:
1952 cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
1953 break;
1954 case POWERPC_MMU_MPC8xx:
1955 /* XXX: TODO */
1956 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1957 break;
1958 case POWERPC_MMU_BOOKE:
1959 /* XXX: TODO */
1960 cpu_abort(env, "BookE MMU model is not implemented\n");
1961 break;
1962 case POWERPC_MMU_BOOKE206:
1963 /* XXX: TODO */
1964 cpu_abort(env, "BookE 2.06 MMU model is not implemented\n");
1965 break;
1966 case POWERPC_MMU_32B:
1967 case POWERPC_MMU_601:
1968 /* tlbie invalidate TLBs for all segments */
1969 addr &= ~((target_ulong)-1ULL << 28);
1970 /* XXX: this case should be optimized,
1971 * giving a mask to tlb_flush_page
1972 */
1973 tlb_flush_page(env, addr | (0x0 << 28));
1974 tlb_flush_page(env, addr | (0x1 << 28));
1975 tlb_flush_page(env, addr | (0x2 << 28));
1976 tlb_flush_page(env, addr | (0x3 << 28));
1977 tlb_flush_page(env, addr | (0x4 << 28));
1978 tlb_flush_page(env, addr | (0x5 << 28));
1979 tlb_flush_page(env, addr | (0x6 << 28));
1980 tlb_flush_page(env, addr | (0x7 << 28));
1981 tlb_flush_page(env, addr | (0x8 << 28));
1982 tlb_flush_page(env, addr | (0x9 << 28));
1983 tlb_flush_page(env, addr | (0xA << 28));
1984 tlb_flush_page(env, addr | (0xB << 28));
1985 tlb_flush_page(env, addr | (0xC << 28));
1986 tlb_flush_page(env, addr | (0xD << 28));
1987 tlb_flush_page(env, addr | (0xE << 28));
1988 tlb_flush_page(env, addr | (0xF << 28));
1989 break;
1990 #if defined(TARGET_PPC64)
1991 case POWERPC_MMU_64B:
1992 case POWERPC_MMU_2_06:
1993 case POWERPC_MMU_2_06a:
1994 case POWERPC_MMU_2_06d:
1995 /* tlbie invalidate TLBs for all segments */
1996 /* XXX: given the fact that there are too many segments to invalidate,
1997 * and we still don't have a tlb_flush_mask(env, n, mask) in QEMU,
1998 * we just invalidate all TLBs
1999 */
2000 tlb_flush(env, 1);
2001 break;
2002 #endif /* defined(TARGET_PPC64) */
2003 default:
2004 /* XXX: TODO */
2005 cpu_abort(env, "Unknown MMU model\n");
2006 break;
2007 }
2008 #else
2009 ppc_tlb_invalidate_all(env);
2010 #endif
2011 }
2012
2013 /*****************************************************************************/
2014 /* Special registers manipulation */
2015 void ppc_store_sdr1(CPUPPCState *env, target_ulong value)
2016 {
2017 LOG_MMU("%s: " TARGET_FMT_lx "\n", __func__, value);
2018 assert(!env->external_htab);
2019 if (env->spr[SPR_SDR1] != value) {
2020 env->spr[SPR_SDR1] = value;
2021 #if defined(TARGET_PPC64)
2022 if (env->mmu_model & POWERPC_MMU_64) {
2023 target_ulong htabsize = value & SDR_64_HTABSIZE;
2024
2025 if (htabsize > 28) {
2026 fprintf(stderr, "Invalid HTABSIZE 0x" TARGET_FMT_lx
2027 " stored in SDR1\n", htabsize);
2028 htabsize = 28;
2029 }
2030 env->htab_mask = (1ULL << (htabsize + 18 - 7)) - 1;
2031 env->htab_base = value & SDR_64_HTABORG;
2032 } else
2033 #endif /* defined(TARGET_PPC64) */
2034 {
2035 /* FIXME: Should check for valid HTABMASK values */
2036 env->htab_mask = ((value & SDR_32_HTABMASK) << 16) | 0xFFFF;
2037 env->htab_base = value & SDR_32_HTABORG;
2038 }
2039 tlb_flush(env, 1);
2040 }
2041 }
2042
2043 /* Segment registers load and store */
2044 target_ulong helper_load_sr(CPUPPCState *env, target_ulong sr_num)
2045 {
2046 #if defined(TARGET_PPC64)
2047 if (env->mmu_model & POWERPC_MMU_64) {
2048 /* XXX */
2049 return 0;
2050 }
2051 #endif
2052 return env->sr[sr_num];
2053 }
2054
2055 void helper_store_sr(CPUPPCState *env, target_ulong srnum, target_ulong value)
2056 {
2057 LOG_MMU("%s: reg=%d " TARGET_FMT_lx " " TARGET_FMT_lx "\n", __func__,
2058 (int)srnum, value, env->sr[srnum]);
2059 #if defined(TARGET_PPC64)
2060 if (env->mmu_model & POWERPC_MMU_64) {
2061 uint64_t rb = 0, rs = 0;
2062
2063 /* ESID = srnum */
2064 rb |= ((uint32_t)srnum & 0xf) << 28;
2065 /* Set the valid bit */
2066 rb |= SLB_ESID_V;
2067 /* Index = ESID */
2068 rb |= (uint32_t)srnum;
2069
2070 /* VSID = VSID */
2071 rs |= (value & 0xfffffff) << 12;
2072 /* flags = flags */
2073 rs |= ((value >> 27) & 0xf) << 8;
2074
2075 ppc_store_slb(env, rb, rs);
2076 } else
2077 #endif
2078 if (env->sr[srnum] != value) {
2079 env->sr[srnum] = value;
2080 /* Invalidating 256MB of virtual memory in 4kB pages is way longer than
2081 flusing the whole TLB. */
2082 #if !defined(FLUSH_ALL_TLBS) && 0
2083 {
2084 target_ulong page, end;
2085 /* Invalidate 256 MB of virtual memory */
2086 page = (16 << 20) * srnum;
2087 end = page + (16 << 20);
2088 for (; page != end; page += TARGET_PAGE_SIZE) {
2089 tlb_flush_page(env, page);
2090 }
2091 }
2092 #else
2093 tlb_flush(env, 1);
2094 #endif
2095 }
2096 }
2097
2098 /* TLB management */
2099 void helper_tlbia(CPUPPCState *env)
2100 {
2101 ppc_tlb_invalidate_all(env);
2102 }
2103
2104 void helper_tlbie(CPUPPCState *env, target_ulong addr)
2105 {
2106 ppc_tlb_invalidate_one(env, addr);
2107 }
2108
2109 /* Software driven TLBs management */
2110 /* PowerPC 602/603 software TLB load instructions helpers */
2111 static void do_6xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
2112 {
2113 target_ulong RPN, CMP, EPN;
2114 int way;
2115
2116 RPN = env->spr[SPR_RPA];
2117 if (is_code) {
2118 CMP = env->spr[SPR_ICMP];
2119 EPN = env->spr[SPR_IMISS];
2120 } else {
2121 CMP = env->spr[SPR_DCMP];
2122 EPN = env->spr[SPR_DMISS];
2123 }
2124 way = (env->spr[SPR_SRR1] >> 17) & 1;
2125 (void)EPN; /* avoid a compiler warning */
2126 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2127 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2128 RPN, way);
2129 /* Store this TLB */
2130 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2131 way, is_code, CMP, RPN);
2132 }
2133
2134 void helper_6xx_tlbd(CPUPPCState *env, target_ulong EPN)
2135 {
2136 do_6xx_tlb(env, EPN, 0);
2137 }
2138
2139 void helper_6xx_tlbi(CPUPPCState *env, target_ulong EPN)
2140 {
2141 do_6xx_tlb(env, EPN, 1);
2142 }
2143
2144 /* PowerPC 74xx software TLB load instructions helpers */
2145 static void do_74xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
2146 {
2147 target_ulong RPN, CMP, EPN;
2148 int way;
2149
2150 RPN = env->spr[SPR_PTELO];
2151 CMP = env->spr[SPR_PTEHI];
2152 EPN = env->spr[SPR_TLBMISS] & ~0x3;
2153 way = env->spr[SPR_TLBMISS] & 0x3;
2154 (void)EPN; /* avoid a compiler warning */
2155 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2156 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2157 RPN, way);
2158 /* Store this TLB */
2159 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2160 way, is_code, CMP, RPN);
2161 }
2162
2163 void helper_74xx_tlbd(CPUPPCState *env, target_ulong EPN)
2164 {
2165 do_74xx_tlb(env, EPN, 0);
2166 }
2167
2168 void helper_74xx_tlbi(CPUPPCState *env, target_ulong EPN)
2169 {
2170 do_74xx_tlb(env, EPN, 1);
2171 }
2172
2173 /*****************************************************************************/
2174 /* PowerPC 601 specific instructions (POWER bridge) */
2175
2176 target_ulong helper_rac(CPUPPCState *env, target_ulong addr)
2177 {
2178 mmu_ctx_t ctx;
2179 int nb_BATs;
2180 target_ulong ret = 0;
2181
2182 /* We don't have to generate many instances of this instruction,
2183 * as rac is supervisor only.
2184 */
2185 /* XXX: FIX THIS: Pretend we have no BAT */
2186 nb_BATs = env->nb_BATs;
2187 env->nb_BATs = 0;
2188 if (get_physical_address(env, &ctx, addr, 0, ACCESS_INT) == 0) {
2189 ret = ctx.raddr;
2190 }
2191 env->nb_BATs = nb_BATs;
2192 return ret;
2193 }
2194
2195 static inline target_ulong booke_tlb_to_page_size(int size)
2196 {
2197 return 1024 << (2 * size);
2198 }
2199
2200 static inline int booke_page_size_to_tlb(target_ulong page_size)
2201 {
2202 int size;
2203
2204 switch (page_size) {
2205 case 0x00000400UL:
2206 size = 0x0;
2207 break;
2208 case 0x00001000UL:
2209 size = 0x1;
2210 break;
2211 case 0x00004000UL:
2212 size = 0x2;
2213 break;
2214 case 0x00010000UL:
2215 size = 0x3;
2216 break;
2217 case 0x00040000UL:
2218 size = 0x4;
2219 break;
2220 case 0x00100000UL:
2221 size = 0x5;
2222 break;
2223 case 0x00400000UL:
2224 size = 0x6;
2225 break;
2226 case 0x01000000UL:
2227 size = 0x7;
2228 break;
2229 case 0x04000000UL:
2230 size = 0x8;
2231 break;
2232 case 0x10000000UL:
2233 size = 0x9;
2234 break;
2235 case 0x40000000UL:
2236 size = 0xA;
2237 break;
2238 #if defined(TARGET_PPC64)
2239 case 0x000100000000ULL:
2240 size = 0xB;
2241 break;
2242 case 0x000400000000ULL:
2243 size = 0xC;
2244 break;
2245 case 0x001000000000ULL:
2246 size = 0xD;
2247 break;
2248 case 0x004000000000ULL:
2249 size = 0xE;
2250 break;
2251 case 0x010000000000ULL:
2252 size = 0xF;
2253 break;
2254 #endif
2255 default:
2256 size = -1;
2257 break;
2258 }
2259
2260 return size;
2261 }
2262
2263 /* Helpers for 4xx TLB management */
2264 #define PPC4XX_TLB_ENTRY_MASK 0x0000003f /* Mask for 64 TLB entries */
2265
2266 #define PPC4XX_TLBHI_V 0x00000040
2267 #define PPC4XX_TLBHI_E 0x00000020
2268 #define PPC4XX_TLBHI_SIZE_MIN 0
2269 #define PPC4XX_TLBHI_SIZE_MAX 7
2270 #define PPC4XX_TLBHI_SIZE_DEFAULT 1
2271 #define PPC4XX_TLBHI_SIZE_SHIFT 7
2272 #define PPC4XX_TLBHI_SIZE_MASK 0x00000007
2273
2274 #define PPC4XX_TLBLO_EX 0x00000200
2275 #define PPC4XX_TLBLO_WR 0x00000100
2276 #define PPC4XX_TLBLO_ATTR_MASK 0x000000FF
2277 #define PPC4XX_TLBLO_RPN_MASK 0xFFFFFC00
2278
2279 target_ulong helper_4xx_tlbre_hi(CPUPPCState *env, target_ulong entry)
2280 {
2281 ppcemb_tlb_t *tlb;
2282 target_ulong ret;
2283 int size;
2284
2285 entry &= PPC4XX_TLB_ENTRY_MASK;
2286 tlb = &env->tlb.tlbe[entry];
2287 ret = tlb->EPN;
2288 if (tlb->prot & PAGE_VALID) {
2289 ret |= PPC4XX_TLBHI_V;
2290 }
2291 size = booke_page_size_to_tlb(tlb->size);
2292 if (size < PPC4XX_TLBHI_SIZE_MIN || size > PPC4XX_TLBHI_SIZE_MAX) {
2293 size = PPC4XX_TLBHI_SIZE_DEFAULT;
2294 }
2295 ret |= size << PPC4XX_TLBHI_SIZE_SHIFT;
2296 env->spr[SPR_40x_PID] = tlb->PID;
2297 return ret;
2298 }
2299
2300 target_ulong helper_4xx_tlbre_lo(CPUPPCState *env, target_ulong entry)
2301 {
2302 ppcemb_tlb_t *tlb;
2303 target_ulong ret;
2304
2305 entry &= PPC4XX_TLB_ENTRY_MASK;
2306 tlb = &env->tlb.tlbe[entry];
2307 ret = tlb->RPN;
2308 if (tlb->prot & PAGE_EXEC) {
2309 ret |= PPC4XX_TLBLO_EX;
2310 }
2311 if (tlb->prot & PAGE_WRITE) {
2312 ret |= PPC4XX_TLBLO_WR;
2313 }
2314 return ret;
2315 }
2316
2317 void helper_4xx_tlbwe_hi(CPUPPCState *env, target_ulong entry,
2318 target_ulong val)
2319 {
2320 ppcemb_tlb_t *tlb;
2321 target_ulong page, end;
2322
2323 LOG_SWTLB("%s entry %d val " TARGET_FMT_lx "\n", __func__, (int)entry,
2324 val);
2325 entry &= PPC4XX_TLB_ENTRY_MASK;
2326 tlb = &env->tlb.tlbe[entry];
2327 /* Invalidate previous TLB (if it's valid) */
2328 if (tlb->prot & PAGE_VALID) {
2329 end = tlb->EPN + tlb->size;
2330 LOG_SWTLB("%s: invalidate old TLB %d start " TARGET_FMT_lx " end "
2331 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2332 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
2333 tlb_flush_page(env, page);
2334 }
2335 }
2336 tlb->size = booke_tlb_to_page_size((val >> PPC4XX_TLBHI_SIZE_SHIFT)
2337 & PPC4XX_TLBHI_SIZE_MASK);
2338 /* We cannot handle TLB size < TARGET_PAGE_SIZE.
2339 * If this ever occurs, one should use the ppcemb target instead
2340 * of the ppc or ppc64 one
2341 */
2342 if ((val & PPC4XX_TLBHI_V) && tlb->size < TARGET_PAGE_SIZE) {
2343 cpu_abort(env, "TLB size " TARGET_FMT_lu " < %u "
2344 "are not supported (%d)\n",
2345 tlb->size, TARGET_PAGE_SIZE, (int)((val >> 7) & 0x7));
2346 }
2347 tlb->EPN = val & ~(tlb->size - 1);
2348 if (val & PPC4XX_TLBHI_V) {
2349 tlb->prot |= PAGE_VALID;
2350 if (val & PPC4XX_TLBHI_E) {
2351 /* XXX: TO BE FIXED */
2352 cpu_abort(env,
2353 "Little-endian TLB entries are not supported by now\n");
2354 }
2355 } else {
2356 tlb->prot &= ~PAGE_VALID;
2357 }
2358 tlb->PID = env->spr[SPR_40x_PID]; /* PID */
2359 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2360 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2361 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2362 tlb->prot & PAGE_READ ? 'r' : '-',
2363 tlb->prot & PAGE_WRITE ? 'w' : '-',
2364 tlb->prot & PAGE_EXEC ? 'x' : '-',
2365 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2366 /* Invalidate new TLB (if valid) */
2367 if (tlb->prot & PAGE_VALID) {
2368 end = tlb->EPN + tlb->size;
2369 LOG_SWTLB("%s: invalidate TLB %d start " TARGET_FMT_lx " end "
2370 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2371 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
2372 tlb_flush_page(env, page);
2373 }
2374 }
2375 }
2376
2377 void helper_4xx_tlbwe_lo(CPUPPCState *env, target_ulong entry,
2378 target_ulong val)
2379 {
2380 ppcemb_tlb_t *tlb;
2381
2382 LOG_SWTLB("%s entry %i val " TARGET_FMT_lx "\n", __func__, (int)entry,
2383 val);
2384 entry &= PPC4XX_TLB_ENTRY_MASK;
2385 tlb = &env->tlb.tlbe[entry];
2386 tlb->attr = val & PPC4XX_TLBLO_ATTR_MASK;
2387 tlb->RPN = val & PPC4XX_TLBLO_RPN_MASK;
2388 tlb->prot = PAGE_READ;
2389 if (val & PPC4XX_TLBLO_EX) {
2390 tlb->prot |= PAGE_EXEC;
2391 }
2392 if (val & PPC4XX_TLBLO_WR) {
2393 tlb->prot |= PAGE_WRITE;
2394 }
2395 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2396 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2397 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2398 tlb->prot & PAGE_READ ? 'r' : '-',
2399 tlb->prot & PAGE_WRITE ? 'w' : '-',
2400 tlb->prot & PAGE_EXEC ? 'x' : '-',
2401 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2402 }
2403
2404 target_ulong helper_4xx_tlbsx(CPUPPCState *env, target_ulong address)
2405 {
2406 return ppcemb_tlb_search(env, address, env->spr[SPR_40x_PID]);
2407 }
2408
2409 /* PowerPC 440 TLB management */
2410 void helper_440_tlbwe(CPUPPCState *env, uint32_t word, target_ulong entry,
2411 target_ulong value)
2412 {
2413 ppcemb_tlb_t *tlb;
2414 target_ulong EPN, RPN, size;
2415 int do_flush_tlbs;
2416
2417 LOG_SWTLB("%s word %d entry %d value " TARGET_FMT_lx "\n",
2418 __func__, word, (int)entry, value);
2419 do_flush_tlbs = 0;
2420 entry &= 0x3F;
2421 tlb = &env->tlb.tlbe[entry];
2422 switch (word) {
2423 default:
2424 /* Just here to please gcc */
2425 case 0:
2426 EPN = value & 0xFFFFFC00;
2427 if ((tlb->prot & PAGE_VALID) && EPN != tlb->EPN) {
2428 do_flush_tlbs = 1;
2429 }
2430 tlb->EPN = EPN;
2431 size = booke_tlb_to_page_size((value >> 4) & 0xF);
2432 if ((tlb->prot & PAGE_VALID) && tlb->size < size) {
2433 do_flush_tlbs = 1;
2434 }
2435 tlb->size = size;
2436 tlb->attr &= ~0x1;
2437 tlb->attr |= (value >> 8) & 1;
2438 if (value & 0x200) {
2439 tlb->prot |= PAGE_VALID;
2440 } else {
2441 if (tlb->prot & PAGE_VALID) {
2442 tlb->prot &= ~PAGE_VALID;
2443 do_flush_tlbs = 1;
2444 }
2445 }
2446 tlb->PID = env->spr[SPR_440_MMUCR] & 0x000000FF;
2447 if (do_flush_tlbs) {
2448 tlb_flush(env, 1);
2449 }
2450 break;
2451 case 1:
2452 RPN = value & 0xFFFFFC0F;
2453 if ((tlb->prot & PAGE_VALID) && tlb->RPN != RPN) {
2454 tlb_flush(env, 1);
2455 }
2456 tlb->RPN = RPN;
2457 break;
2458 case 2:
2459 tlb->attr = (tlb->attr & 0x1) | (value & 0x0000FF00);
2460 tlb->prot = tlb->prot & PAGE_VALID;
2461 if (value & 0x1) {
2462 tlb->prot |= PAGE_READ << 4;
2463 }
2464 if (value & 0x2) {
2465 tlb->prot |= PAGE_WRITE << 4;
2466 }
2467 if (value & 0x4) {
2468 tlb->prot |= PAGE_EXEC << 4;
2469 }
2470 if (value & 0x8) {
2471 tlb->prot |= PAGE_READ;
2472 }
2473 if (value & 0x10) {
2474 tlb->prot |= PAGE_WRITE;
2475 }
2476 if (value & 0x20) {
2477 tlb->prot |= PAGE_EXEC;
2478 }
2479 break;
2480 }
2481 }
2482
2483 target_ulong helper_440_tlbre(CPUPPCState *env, uint32_t word,
2484 target_ulong entry)
2485 {
2486 ppcemb_tlb_t *tlb;
2487 target_ulong ret;
2488 int size;
2489
2490 entry &= 0x3F;
2491 tlb = &env->tlb.tlbe[entry];
2492 switch (word) {
2493 default:
2494 /* Just here to please gcc */
2495 case 0:
2496 ret = tlb->EPN;
2497 size = booke_page_size_to_tlb(tlb->size);
2498 if (size < 0 || size > 0xF) {
2499 size = 1;
2500 }
2501 ret |= size << 4;
2502 if (tlb->attr & 0x1) {
2503 ret |= 0x100;
2504 }
2505 if (tlb->prot & PAGE_VALID) {
2506 ret |= 0x200;
2507 }
2508 env->spr[SPR_440_MMUCR] &= ~0x000000FF;
2509 env->spr[SPR_440_MMUCR] |= tlb->PID;
2510 break;
2511 case 1:
2512 ret = tlb->RPN;
2513 break;
2514 case 2:
2515 ret = tlb->attr & ~0x1;
2516 if (tlb->prot & (PAGE_READ << 4)) {
2517 ret |= 0x1;
2518 }
2519 if (tlb->prot & (PAGE_WRITE << 4)) {
2520 ret |= 0x2;
2521 }
2522 if (tlb->prot & (PAGE_EXEC << 4)) {
2523 ret |= 0x4;
2524 }
2525 if (tlb->prot & PAGE_READ) {
2526 ret |= 0x8;
2527 }
2528 if (tlb->prot & PAGE_WRITE) {
2529 ret |= 0x10;
2530 }
2531 if (tlb->prot & PAGE_EXEC) {
2532 ret |= 0x20;
2533 }
2534 break;
2535 }
2536 return ret;
2537 }
2538
2539 target_ulong helper_440_tlbsx(CPUPPCState *env, target_ulong address)
2540 {
2541 return ppcemb_tlb_search(env, address, env->spr[SPR_440_MMUCR] & 0xFF);
2542 }
2543
2544 /* PowerPC BookE 2.06 TLB management */
2545
2546 static ppcmas_tlb_t *booke206_cur_tlb(CPUPPCState *env)
2547 {
2548 uint32_t tlbncfg = 0;
2549 int esel = (env->spr[SPR_BOOKE_MAS0] & MAS0_ESEL_MASK) >> MAS0_ESEL_SHIFT;
2550 int ea = (env->spr[SPR_BOOKE_MAS2] & MAS2_EPN_MASK);
2551 int tlb;
2552
2553 tlb = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2554 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlb];
2555
2556 if ((tlbncfg & TLBnCFG_HES) && (env->spr[SPR_BOOKE_MAS0] & MAS0_HES)) {
2557 cpu_abort(env, "we don't support HES yet\n");
2558 }
2559
2560 return booke206_get_tlbm(env, tlb, ea, esel);
2561 }
2562
2563 void helper_booke_setpid(CPUPPCState *env, uint32_t pidn, target_ulong pid)
2564 {
2565 env->spr[pidn] = pid;
2566 /* changing PIDs mean we're in a different address space now */
2567 tlb_flush(env, 1);
2568 }
2569
2570 void helper_booke206_tlbwe(CPUPPCState *env)
2571 {
2572 uint32_t tlbncfg, tlbn;
2573 ppcmas_tlb_t *tlb;
2574 uint32_t size_tlb, size_ps;
2575 target_ulong mask;
2576
2577
2578 switch (env->spr[SPR_BOOKE_MAS0] & MAS0_WQ_MASK) {
2579 case MAS0_WQ_ALWAYS:
2580 /* good to go, write that entry */
2581 break;
2582 case MAS0_WQ_COND:
2583 /* XXX check if reserved */
2584 if (0) {
2585 return;
2586 }
2587 break;
2588 case MAS0_WQ_CLR_RSRV:
2589 /* XXX clear entry */
2590 return;
2591 default:
2592 /* no idea what to do */
2593 return;
2594 }
2595
2596 if (((env->spr[SPR_BOOKE_MAS0] & MAS0_ATSEL) == MAS0_ATSEL_LRAT) &&
2597 !msr_gs) {
2598 /* XXX we don't support direct LRAT setting yet */
2599 fprintf(stderr, "cpu: don't support LRAT setting yet\n");
2600 return;
2601 }
2602
2603 tlbn = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2604 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlbn];
2605
2606 tlb = booke206_cur_tlb(env);
2607
2608 if (!tlb) {
2609 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
2610 POWERPC_EXCP_INVAL |
2611 POWERPC_EXCP_INVAL_INVAL);
2612 }
2613
2614 /* check that we support the targeted size */
2615 size_tlb = (env->spr[SPR_BOOKE_MAS1] & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
2616 size_ps = booke206_tlbnps(env, tlbn);
2617 if ((env->spr[SPR_BOOKE_MAS1] & MAS1_VALID) && (tlbncfg & TLBnCFG_AVAIL) &&
2618 !(size_ps & (1 << size_tlb))) {
2619 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
2620 POWERPC_EXCP_INVAL |
2621 POWERPC_EXCP_INVAL_INVAL);
2622 }
2623
2624 if (msr_gs) {
2625 cpu_abort(env, "missing HV implementation\n");
2626 }
2627 tlb->mas7_3 = ((uint64_t)env->spr[SPR_BOOKE_MAS7] << 32) |
2628 env->spr[SPR_BOOKE_MAS3];
2629 tlb->mas1 = env->spr[SPR_BOOKE_MAS1];
2630
2631 /* MAV 1.0 only */
2632 if (!(tlbncfg & TLBnCFG_AVAIL)) {
2633 /* force !AVAIL TLB entries to correct page size */
2634 tlb->mas1 &= ~MAS1_TSIZE_MASK;
2635 /* XXX can be configured in MMUCSR0 */
2636 tlb->mas1 |= (tlbncfg & TLBnCFG_MINSIZE) >> 12;
2637 }
2638
2639 /* Make a mask from TLB size to discard invalid bits in EPN field */
2640 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2641 /* Add a mask for page attributes */
2642 mask |= MAS2_ACM | MAS2_VLE | MAS2_W | MAS2_I | MAS2_M | MAS2_G | MAS2_E;
2643
2644 if (!msr_cm) {
2645 /* Executing a tlbwe instruction in 32-bit mode will set
2646 * bits 0:31 of the TLB EPN field to zero.
2647 */
2648 mask &= 0xffffffff;
2649 }
2650
2651 tlb->mas2 = env->spr[SPR_BOOKE_MAS2] & mask;
2652
2653 if (!(tlbncfg & TLBnCFG_IPROT)) {
2654 /* no IPROT supported by TLB */
2655 tlb->mas1 &= ~MAS1_IPROT;
2656 }
2657
2658 if (booke206_tlb_to_page_size(env, tlb) == TARGET_PAGE_SIZE) {
2659 tlb_flush_page(env, tlb->mas2 & MAS2_EPN_MASK);
2660 } else {
2661 tlb_flush(env, 1);
2662 }
2663 }
2664
2665 static inline void booke206_tlb_to_mas(CPUPPCState *env, ppcmas_tlb_t *tlb)
2666 {
2667 int tlbn = booke206_tlbm_to_tlbn(env, tlb);
2668 int way = booke206_tlbm_to_way(env, tlb);
2669
2670 env->spr[SPR_BOOKE_MAS0] = tlbn << MAS0_TLBSEL_SHIFT;
2671 env->spr[SPR_BOOKE_MAS0] |= way << MAS0_ESEL_SHIFT;
2672 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2673
2674 env->spr[SPR_BOOKE_MAS1] = tlb->mas1;
2675 env->spr[SPR_BOOKE_MAS2] = tlb->mas2;
2676 env->spr[SPR_BOOKE_MAS3] = tlb->mas7_3;
2677 env->spr[SPR_BOOKE_MAS7] = tlb->mas7_3 >> 32;
2678 }
2679
2680 void helper_booke206_tlbre(CPUPPCState *env)
2681 {
2682 ppcmas_tlb_t *tlb = NULL;
2683
2684 tlb = booke206_cur_tlb(env);
2685 if (!tlb) {
2686 env->spr[SPR_BOOKE_MAS1] = 0;
2687 } else {
2688 booke206_tlb_to_mas(env, tlb);
2689 }
2690 }
2691
2692 void helper_booke206_tlbsx(CPUPPCState *env, target_ulong address)
2693 {
2694 ppcmas_tlb_t *tlb = NULL;
2695 int i, j;
2696 hwaddr raddr;
2697 uint32_t spid, sas;
2698
2699 spid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID_MASK) >> MAS6_SPID_SHIFT;
2700 sas = env->spr[SPR_BOOKE_MAS6] & MAS6_SAS;
2701
2702 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2703 int ways = booke206_tlb_ways(env, i);
2704
2705 for (j = 0; j < ways; j++) {
2706 tlb = booke206_get_tlbm(env, i, address, j);
2707
2708 if (!tlb) {
2709 continue;
2710 }
2711
2712 if (ppcmas_tlb_check(env, tlb, &raddr, address, spid)) {
2713 continue;
2714 }
2715
2716 if (sas != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
2717 continue;
2718 }
2719
2720 booke206_tlb_to_mas(env, tlb);
2721 return;
2722 }
2723 }
2724
2725 /* no entry found, fill with defaults */
2726 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
2727 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
2728 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
2729 env->spr[SPR_BOOKE_MAS3] = 0;
2730 env->spr[SPR_BOOKE_MAS7] = 0;
2731
2732 if (env->spr[SPR_BOOKE_MAS6] & MAS6_SAS) {
2733 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
2734 }
2735
2736 env->spr[SPR_BOOKE_MAS1] |= (env->spr[SPR_BOOKE_MAS6] >> 16)
2737 << MAS1_TID_SHIFT;
2738
2739 /* next victim logic */
2740 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
2741 env->last_way++;
2742 env->last_way &= booke206_tlb_ways(env, 0) - 1;
2743 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2744 }
2745
2746 static inline void booke206_invalidate_ea_tlb(CPUPPCState *env, int tlbn,
2747 uint32_t ea)
2748 {
2749 int i;
2750 int ways = booke206_tlb_ways(env, tlbn);
2751 target_ulong mask;
2752
2753 for (i = 0; i < ways; i++) {
2754 ppcmas_tlb_t *tlb = booke206_get_tlbm(env, tlbn, ea, i);
2755 if (!tlb) {
2756 continue;
2757 }
2758 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2759 if (((tlb->mas2 & MAS2_EPN_MASK) == (ea & mask)) &&
2760 !(tlb->mas1 & MAS1_IPROT)) {
2761 tlb->mas1 &= ~MAS1_VALID;
2762 }
2763 }
2764 }
2765
2766 void helper_booke206_tlbivax(CPUPPCState *env, target_ulong address)
2767 {
2768 if (address & 0x4) {
2769 /* flush all entries */
2770 if (address & 0x8) {
2771 /* flush all of TLB1 */
2772 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB1, 1);
2773 } else {
2774 /* flush all of TLB0 */
2775 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB0, 0);
2776 }
2777 return;
2778 }
2779
2780 if (address & 0x8) {
2781 /* flush TLB1 entries */
2782 booke206_invalidate_ea_tlb(env, 1, address);
2783 tlb_flush(env, 1);
2784 } else {
2785 /* flush TLB0 entries */
2786 booke206_invalidate_ea_tlb(env, 0, address);
2787 tlb_flush_page(env, address & MAS2_EPN_MASK);
2788 }
2789 }
2790
2791 void helper_booke206_tlbilx0(CPUPPCState *env, target_ulong address)
2792 {
2793 /* XXX missing LPID handling */
2794 booke206_flush_tlb(env, -1, 1);
2795 }
2796
2797 void helper_booke206_tlbilx1(CPUPPCState *env, target_ulong address)
2798 {
2799 int i, j;
2800 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
2801 ppcmas_tlb_t *tlb = env->tlb.tlbm;
2802 int tlb_size;
2803
2804 /* XXX missing LPID handling */
2805 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2806 tlb_size = booke206_tlb_size(env, i);
2807 for (j = 0; j < tlb_size; j++) {
2808 if (!(tlb[j].mas1 & MAS1_IPROT) &&
2809 ((tlb[j].mas1 & MAS1_TID_MASK) == tid)) {
2810 tlb[j].mas1 &= ~MAS1_VALID;
2811 }
2812 }
2813 tlb += booke206_tlb_size(env, i);
2814 }
2815 tlb_flush(env, 1);
2816 }
2817
2818 void helper_booke206_tlbilx3(CPUPPCState *env, target_ulong address)
2819 {
2820 int i, j;
2821 ppcmas_tlb_t *tlb;
2822 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
2823 int pid = tid >> MAS6_SPID_SHIFT;
2824 int sgs = env->spr[SPR_BOOKE_MAS5] & MAS5_SGS;
2825 int ind = (env->spr[SPR_BOOKE_MAS6] & MAS6_SIND) ? MAS1_IND : 0;
2826 /* XXX check for unsupported isize and raise an invalid opcode then */
2827 int size = env->spr[SPR_BOOKE_MAS6] & MAS6_ISIZE_MASK;
2828 /* XXX implement MAV2 handling */
2829 bool mav2 = false;
2830
2831 /* XXX missing LPID handling */
2832 /* flush by pid and ea */
2833 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2834 int ways = booke206_tlb_ways(env, i);
2835
2836 for (j = 0; j < ways; j++) {
2837 tlb = booke206_get_tlbm(env, i, address, j);
2838 if (!tlb) {
2839 continue;
2840 }
2841 if ((ppcmas_tlb_check(env, tlb, NULL, address, pid) != 0) ||
2842 (tlb->mas1 & MAS1_IPROT) ||
2843 ((tlb->mas1 & MAS1_IND) != ind) ||
2844 ((tlb->mas8 & MAS8_TGS) != sgs)) {
2845 continue;
2846 }
2847 if (mav2 && ((tlb->mas1 & MAS1_TSIZE_MASK) != size)) {
2848 /* XXX only check when MMUCFG[TWC] || TLBnCFG[HES] */
2849 continue;
2850 }
2851 /* XXX e500mc doesn't match SAS, but other cores might */
2852 tlb->mas1 &= ~MAS1_VALID;
2853 }
2854 }
2855 tlb_flush(env, 1);
2856 }
2857
2858 void helper_booke206_tlbflush(CPUPPCState *env, uint32_t type)
2859 {
2860 int flags = 0;
2861
2862 if (type & 2) {
2863 flags |= BOOKE206_FLUSH_TLB1;
2864 }
2865
2866 if (type & 4) {
2867 flags |= BOOKE206_FLUSH_TLB0;
2868 }
2869
2870 booke206_flush_tlb(env, flags, 1);
2871 }
2872
2873
2874 /*****************************************************************************/
2875
2876 #include "exec/softmmu_exec.h"
2877
2878 #define MMUSUFFIX _mmu
2879
2880 #define SHIFT 0
2881 #include "exec/softmmu_template.h"
2882
2883 #define SHIFT 1
2884 #include "exec/softmmu_template.h"
2885
2886 #define SHIFT 2
2887 #include "exec/softmmu_template.h"
2888
2889 #define SHIFT 3
2890 #include "exec/softmmu_template.h"
2891
2892 /* try to fill the TLB and return an exception if error. If retaddr is
2893 NULL, it means that the function was called in C code (i.e. not
2894 from generated code or from helper.c) */
2895 /* XXX: fix it to restore all registers */
2896 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
2897 uintptr_t retaddr)
2898 {
2899 PowerPCCPU *cpu = POWERPC_CPU(cs);
2900 PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cs);
2901 CPUPPCState *env = &cpu->env;
2902 int ret;
2903
2904 if (pcc->handle_mmu_fault) {
2905 ret = pcc->handle_mmu_fault(env, addr, is_write, mmu_idx);
2906 } else {
2907 ret = cpu_ppc_handle_mmu_fault(env, addr, is_write, mmu_idx);
2908 }
2909 if (unlikely(ret != 0)) {
2910 if (likely(retaddr)) {
2911 /* now we have a real cpu fault */
2912 cpu_restore_state(env, retaddr);
2913 }
2914 helper_raise_exception_err(env, cs->exception_index, env->error_code);
2915 }
2916 }
QEMU mirror