]> git.proxmox.com Git - mirror_qemu.git/blob - target-ppc/mmu_helper.c
projects / mirror_qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
target-ppc: Move SLB handling into a mmu-hash64.c
[mirror_qemu.git] / target-ppc / mmu_helper.c
1 /*
2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
3 *
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19 #include "cpu.h"
20 #include "helper.h"
21 #include "sysemu/kvm.h"
22 #include "kvm_ppc.h"
23 #include "mmu-hash64.h"
24
25 //#define DEBUG_MMU
26 //#define DEBUG_BATS
27 //#define DEBUG_SOFTWARE_TLB
28 //#define DUMP_PAGE_TABLES
29 //#define DEBUG_SOFTWARE_TLB
30 //#define FLUSH_ALL_TLBS
31
32 #ifdef DEBUG_MMU
33 # define LOG_MMU(...) qemu_log(__VA_ARGS__)
34 # define LOG_MMU_STATE(env) log_cpu_state((env), 0)
35 #else
36 # define LOG_MMU(...) do { } while (0)
37 # define LOG_MMU_STATE(...) do { } while (0)
38 #endif
39
40 #ifdef DEBUG_SOFTWARE_TLB
41 # define LOG_SWTLB(...) qemu_log(__VA_ARGS__)
42 #else
43 # define LOG_SWTLB(...) do { } while (0)
44 #endif
45
46 #ifdef DEBUG_BATS
47 # define LOG_BATS(...) qemu_log(__VA_ARGS__)
48 #else
49 # define LOG_BATS(...) do { } while (0)
50 #endif
51
52 /*****************************************************************************/
53 /* PowerPC MMU emulation */
54 #if defined(CONFIG_USER_ONLY)
55 int cpu_ppc_handle_mmu_fault(CPUPPCState *env, target_ulong address, int rw,
56 int mmu_idx)
57 {
58 int exception, error_code;
59
60 if (rw == 2) {
61 exception = POWERPC_EXCP_ISI;
62 error_code = 0x40000000;
63 } else {
64 exception = POWERPC_EXCP_DSI;
65 error_code = 0x40000000;
66 if (rw) {
67 error_code |= 0x02000000;
68 }
69 env->spr[SPR_DAR] = address;
70 env->spr[SPR_DSISR] = error_code;
71 }
72 env->exception_index = exception;
73 env->error_code = error_code;
74
75 return 1;
76 }
77
78 #else
79 /* Common routines used by software and hardware TLBs emulation */
80 static inline int pte_is_valid(target_ulong pte0)
81 {
82 return pte0 & 0x80000000 ? 1 : 0;
83 }
84
85 static inline void pte_invalidate(target_ulong *pte0)
86 {
87 *pte0 &= ~0x80000000;
88 }
89
90 #if defined(TARGET_PPC64)
91 static inline int pte64_is_valid(target_ulong pte0)
92 {
93 return pte0 & 0x0000000000000001ULL ? 1 : 0;
94 }
95 #endif
96
97 #define PTE_PTEM_MASK 0x7FFFFFBF
98 #define PTE_CHECK_MASK (TARGET_PAGE_MASK | 0x7B)
99 #if defined(TARGET_PPC64)
100 #define PTE64_PTEM_MASK 0xFFFFFFFFFFFFFF80ULL
101 #define PTE64_CHECK_MASK (TARGET_PAGE_MASK | 0x7F)
102 #endif
103
104 static inline int pp_check(int key, int pp, int nx)
105 {
106 int access;
107
108 /* Compute access rights */
109 /* When pp is 3/7, the result is undefined. Set it to noaccess */
110 access = 0;
111 if (key == 0) {
112 switch (pp) {
113 case 0x0:
114 case 0x1:
115 case 0x2:
116 access |= PAGE_WRITE;
117 /* No break here */
118 case 0x3:
119 case 0x6:
120 access |= PAGE_READ;
121 break;
122 }
123 } else {
124 switch (pp) {
125 case 0x0:
126 case 0x6:
127 access = 0;
128 break;
129 case 0x1:
130 case 0x3:
131 access = PAGE_READ;
132 break;
133 case 0x2:
134 access = PAGE_READ | PAGE_WRITE;
135 break;
136 }
137 }
138 if (nx == 0) {
139 access |= PAGE_EXEC;
140 }
141
142 return access;
143 }
144
145 static inline int check_prot(int prot, int rw, int access_type)
146 {
147 int ret;
148
149 if (access_type == ACCESS_CODE) {
150 if (prot & PAGE_EXEC) {
151 ret = 0;
152 } else {
153 ret = -2;
154 }
155 } else if (rw) {
156 if (prot & PAGE_WRITE) {
157 ret = 0;
158 } else {
159 ret = -2;
160 }
161 } else {
162 if (prot & PAGE_READ) {
163 ret = 0;
164 } else {
165 ret = -2;
166 }
167 }
168
169 return ret;
170 }
171
172 static inline int pte_check(mmu_ctx_t *ctx, int is_64b, target_ulong pte0,
173 target_ulong pte1, int h, int rw, int type)
174 {
175 target_ulong ptem, mmask;
176 int access, ret, pteh, ptev, pp;
177
178 ret = -1;
179 /* Check validity and table match */
180 #if defined(TARGET_PPC64)
181 if (is_64b) {
182 ptev = pte64_is_valid(pte0);
183 pteh = (pte0 >> 1) & 1;
184 } else
185 #endif
186 {
187 ptev = pte_is_valid(pte0);
188 pteh = (pte0 >> 6) & 1;
189 }
190 if (ptev && h == pteh) {
191 /* Check vsid & api */
192 #if defined(TARGET_PPC64)
193 if (is_64b) {
194 ptem = pte0 & PTE64_PTEM_MASK;
195 mmask = PTE64_CHECK_MASK;
196 pp = (pte1 & 0x00000003) | ((pte1 >> 61) & 0x00000004);
197 ctx->nx = (pte1 >> 2) & 1; /* No execute bit */
198 ctx->nx |= (pte1 >> 3) & 1; /* Guarded bit */
199 } else
200 #endif
201 {
202 ptem = pte0 & PTE_PTEM_MASK;
203 mmask = PTE_CHECK_MASK;
204 pp = pte1 & 0x00000003;
205 }
206 if (ptem == ctx->ptem) {
207 if (ctx->raddr != (hwaddr)-1ULL) {
208 /* all matches should have equal RPN, WIMG & PP */
209 if ((ctx->raddr & mmask) != (pte1 & mmask)) {
210 qemu_log("Bad RPN/WIMG/PP\n");
211 return -3;
212 }
213 }
214 /* Compute access rights */
215 access = pp_check(ctx->key, pp, ctx->nx);
216 /* Keep the matching PTE informations */
217 ctx->raddr = pte1;
218 ctx->prot = access;
219 ret = check_prot(ctx->prot, rw, type);
220 if (ret == 0) {
221 /* Access granted */
222 LOG_MMU("PTE access granted !\n");
223 } else {
224 /* Access right violation */
225 LOG_MMU("PTE access rejected\n");
226 }
227 }
228 }
229
230 return ret;
231 }
232
233 static inline int pte32_check(mmu_ctx_t *ctx, target_ulong pte0,
234 target_ulong pte1, int h, int rw, int type)
235 {
236 return pte_check(ctx, 0, pte0, pte1, h, rw, type);
237 }
238
239 #if defined(TARGET_PPC64)
240 static inline int pte64_check(mmu_ctx_t *ctx, target_ulong pte0,
241 target_ulong pte1, int h, int rw, int type)
242 {
243 return pte_check(ctx, 1, pte0, pte1, h, rw, type);
244 }
245 #endif
246
247 static inline int pte_update_flags(mmu_ctx_t *ctx, target_ulong *pte1p,
248 int ret, int rw)
249 {
250 int store = 0;
251
252 /* Update page flags */
253 if (!(*pte1p & 0x00000100)) {
254 /* Update accessed flag */
255 *pte1p |= 0x00000100;
256 store = 1;
257 }
258 if (!(*pte1p & 0x00000080)) {
259 if (rw == 1 && ret == 0) {
260 /* Update changed flag */
261 *pte1p |= 0x00000080;
262 store = 1;
263 } else {
264 /* Force page fault for first write access */
265 ctx->prot &= ~PAGE_WRITE;
266 }
267 }
268
269 return store;
270 }
271
272 /* Software driven TLB helpers */
273 static inline int ppc6xx_tlb_getnum(CPUPPCState *env, target_ulong eaddr,
274 int way, int is_code)
275 {
276 int nr;
277
278 /* Select TLB num in a way from address */
279 nr = (eaddr >> TARGET_PAGE_BITS) & (env->tlb_per_way - 1);
280 /* Select TLB way */
281 nr += env->tlb_per_way * way;
282 /* 6xx have separate TLBs for instructions and data */
283 if (is_code && env->id_tlbs == 1) {
284 nr += env->nb_tlb;
285 }
286
287 return nr;
288 }
289
290 static inline void ppc6xx_tlb_invalidate_all(CPUPPCState *env)
291 {
292 ppc6xx_tlb_t *tlb;
293 int nr, max;
294
295 /* LOG_SWTLB("Invalidate all TLBs\n"); */
296 /* Invalidate all defined software TLB */
297 max = env->nb_tlb;
298 if (env->id_tlbs == 1) {
299 max *= 2;
300 }
301 for (nr = 0; nr < max; nr++) {
302 tlb = &env->tlb.tlb6[nr];
303 pte_invalidate(&tlb->pte0);
304 }
305 tlb_flush(env, 1);
306 }
307
308 static inline void ppc6xx_tlb_invalidate_virt2(CPUPPCState *env,
309 target_ulong eaddr,
310 int is_code, int match_epn)
311 {
312 #if !defined(FLUSH_ALL_TLBS)
313 ppc6xx_tlb_t *tlb;
314 int way, nr;
315
316 /* Invalidate ITLB + DTLB, all ways */
317 for (way = 0; way < env->nb_ways; way++) {
318 nr = ppc6xx_tlb_getnum(env, eaddr, way, is_code);
319 tlb = &env->tlb.tlb6[nr];
320 if (pte_is_valid(tlb->pte0) && (match_epn == 0 || eaddr == tlb->EPN)) {
321 LOG_SWTLB("TLB invalidate %d/%d " TARGET_FMT_lx "\n", nr,
322 env->nb_tlb, eaddr);
323 pte_invalidate(&tlb->pte0);
324 tlb_flush_page(env, tlb->EPN);
325 }
326 }
327 #else
328 /* XXX: PowerPC specification say this is valid as well */
329 ppc6xx_tlb_invalidate_all(env);
330 #endif
331 }
332
333 static inline void ppc6xx_tlb_invalidate_virt(CPUPPCState *env,
334 target_ulong eaddr, int is_code)
335 {
336 ppc6xx_tlb_invalidate_virt2(env, eaddr, is_code, 0);
337 }
338
339 static void ppc6xx_tlb_store(CPUPPCState *env, target_ulong EPN, int way,
340 int is_code, target_ulong pte0, target_ulong pte1)
341 {
342 ppc6xx_tlb_t *tlb;
343 int nr;
344
345 nr = ppc6xx_tlb_getnum(env, EPN, way, is_code);
346 tlb = &env->tlb.tlb6[nr];
347 LOG_SWTLB("Set TLB %d/%d EPN " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
348 " PTE1 " TARGET_FMT_lx "\n", nr, env->nb_tlb, EPN, pte0, pte1);
349 /* Invalidate any pending reference in QEMU for this virtual address */
350 ppc6xx_tlb_invalidate_virt2(env, EPN, is_code, 1);
351 tlb->pte0 = pte0;
352 tlb->pte1 = pte1;
353 tlb->EPN = EPN;
354 /* Store last way for LRU mechanism */
355 env->last_way = way;
356 }
357
358 static inline int ppc6xx_tlb_check(CPUPPCState *env, mmu_ctx_t *ctx,
359 target_ulong eaddr, int rw, int access_type)
360 {
361 ppc6xx_tlb_t *tlb;
362 int nr, best, way;
363 int ret;
364
365 best = -1;
366 ret = -1; /* No TLB found */
367 for (way = 0; way < env->nb_ways; way++) {
368 nr = ppc6xx_tlb_getnum(env, eaddr, way,
369 access_type == ACCESS_CODE ? 1 : 0);
370 tlb = &env->tlb.tlb6[nr];
371 /* This test "emulates" the PTE index match for hardware TLBs */
372 if ((eaddr & TARGET_PAGE_MASK) != tlb->EPN) {
373 LOG_SWTLB("TLB %d/%d %s [" TARGET_FMT_lx " " TARGET_FMT_lx
374 "] <> " TARGET_FMT_lx "\n", nr, env->nb_tlb,
375 pte_is_valid(tlb->pte0) ? "valid" : "inval",
376 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE, eaddr);
377 continue;
378 }
379 LOG_SWTLB("TLB %d/%d %s " TARGET_FMT_lx " <> " TARGET_FMT_lx " "
380 TARGET_FMT_lx " %c %c\n", nr, env->nb_tlb,
381 pte_is_valid(tlb->pte0) ? "valid" : "inval",
382 tlb->EPN, eaddr, tlb->pte1,
383 rw ? 'S' : 'L', access_type == ACCESS_CODE ? 'I' : 'D');
384 switch (pte32_check(ctx, tlb->pte0, tlb->pte1, 0, rw, access_type)) {
385 case -3:
386 /* TLB inconsistency */
387 return -1;
388 case -2:
389 /* Access violation */
390 ret = -2;
391 best = nr;
392 break;
393 case -1:
394 default:
395 /* No match */
396 break;
397 case 0:
398 /* access granted */
399 /* XXX: we should go on looping to check all TLBs consistency
400 * but we can speed-up the whole thing as the
401 * result would be undefined if TLBs are not consistent.
402 */
403 ret = 0;
404 best = nr;
405 goto done;
406 }
407 }
408 if (best != -1) {
409 done:
410 LOG_SWTLB("found TLB at addr " TARGET_FMT_plx " prot=%01x ret=%d\n",
411 ctx->raddr & TARGET_PAGE_MASK, ctx->prot, ret);
412 /* Update page flags */
413 pte_update_flags(ctx, &env->tlb.tlb6[best].pte1, ret, rw);
414 }
415
416 return ret;
417 }
418
419 /* Perform BAT hit & translation */
420 static inline void bat_size_prot(CPUPPCState *env, target_ulong *blp,
421 int *validp, int *protp, target_ulong *BATu,
422 target_ulong *BATl)
423 {
424 target_ulong bl;
425 int pp, valid, prot;
426
427 bl = (*BATu & 0x00001FFC) << 15;
428 valid = 0;
429 prot = 0;
430 if (((msr_pr == 0) && (*BATu & 0x00000002)) ||
431 ((msr_pr != 0) && (*BATu & 0x00000001))) {
432 valid = 1;
433 pp = *BATl & 0x00000003;
434 if (pp != 0) {
435 prot = PAGE_READ | PAGE_EXEC;
436 if (pp == 0x2) {
437 prot |= PAGE_WRITE;
438 }
439 }
440 }
441 *blp = bl;
442 *validp = valid;
443 *protp = prot;
444 }
445
446 static inline void bat_601_size_prot(CPUPPCState *env, target_ulong *blp,
447 int *validp, int *protp,
448 target_ulong *BATu, target_ulong *BATl)
449 {
450 target_ulong bl;
451 int key, pp, valid, prot;
452
453 bl = (*BATl & 0x0000003F) << 17;
454 LOG_BATS("b %02x ==> bl " TARGET_FMT_lx " msk " TARGET_FMT_lx "\n",
455 (uint8_t)(*BATl & 0x0000003F), bl, ~bl);
456 prot = 0;
457 valid = (*BATl >> 6) & 1;
458 if (valid) {
459 pp = *BATu & 0x00000003;
460 if (msr_pr == 0) {
461 key = (*BATu >> 3) & 1;
462 } else {
463 key = (*BATu >> 2) & 1;
464 }
465 prot = pp_check(key, pp, 0);
466 }
467 *blp = bl;
468 *validp = valid;
469 *protp = prot;
470 }
471
472 static inline int get_bat(CPUPPCState *env, mmu_ctx_t *ctx,
473 target_ulong virtual, int rw, int type)
474 {
475 target_ulong *BATlt, *BATut, *BATu, *BATl;
476 target_ulong BEPIl, BEPIu, bl;
477 int i, valid, prot;
478 int ret = -1;
479
480 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
481 type == ACCESS_CODE ? 'I' : 'D', virtual);
482 switch (type) {
483 case ACCESS_CODE:
484 BATlt = env->IBAT[1];
485 BATut = env->IBAT[0];
486 break;
487 default:
488 BATlt = env->DBAT[1];
489 BATut = env->DBAT[0];
490 break;
491 }
492 for (i = 0; i < env->nb_BATs; i++) {
493 BATu = &BATut[i];
494 BATl = &BATlt[i];
495 BEPIu = *BATu & 0xF0000000;
496 BEPIl = *BATu & 0x0FFE0000;
497 if (unlikely(env->mmu_model == POWERPC_MMU_601)) {
498 bat_601_size_prot(env, &bl, &valid, &prot, BATu, BATl);
499 } else {
500 bat_size_prot(env, &bl, &valid, &prot, BATu, BATl);
501 }
502 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
503 " BATl " TARGET_FMT_lx "\n", __func__,
504 type == ACCESS_CODE ? 'I' : 'D', i, virtual, *BATu, *BATl);
505 if ((virtual & 0xF0000000) == BEPIu &&
506 ((virtual & 0x0FFE0000) & ~bl) == BEPIl) {
507 /* BAT matches */
508 if (valid != 0) {
509 /* Get physical address */
510 ctx->raddr = (*BATl & 0xF0000000) |
511 ((virtual & 0x0FFE0000 & bl) | (*BATl & 0x0FFE0000)) |
512 (virtual & 0x0001F000);
513 /* Compute access rights */
514 ctx->prot = prot;
515 ret = check_prot(ctx->prot, rw, type);
516 if (ret == 0) {
517 LOG_BATS("BAT %d match: r " TARGET_FMT_plx " prot=%c%c\n",
518 i, ctx->raddr, ctx->prot & PAGE_READ ? 'R' : '-',
519 ctx->prot & PAGE_WRITE ? 'W' : '-');
520 }
521 break;
522 }
523 }
524 }
525 if (ret < 0) {
526 #if defined(DEBUG_BATS)
527 if (qemu_log_enabled()) {
528 LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", virtual);
529 for (i = 0; i < 4; i++) {
530 BATu = &BATut[i];
531 BATl = &BATlt[i];
532 BEPIu = *BATu & 0xF0000000;
533 BEPIl = *BATu & 0x0FFE0000;
534 bl = (*BATu & 0x00001FFC) << 15;
535 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
536 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
537 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
538 __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual,
539 *BATu, *BATl, BEPIu, BEPIl, bl);
540 }
541 }
542 #endif
543 }
544 /* No hit */
545 return ret;
546 }
547
548 static inline hwaddr get_pteg_offset(CPUPPCState *env,
549 hwaddr hash,
550 int pte_size)
551 {
552 return (hash * pte_size * 8) & env->htab_mask;
553 }
554
555 /* PTE table lookup */
556 static inline int find_pte2(CPUPPCState *env, mmu_ctx_t *ctx, int is_64b, int h,
557 int rw, int type, int target_page_bits)
558 {
559 hwaddr pteg_off;
560 target_ulong pte0, pte1;
561 int i, good = -1;
562 int ret, r;
563
564 ret = -1; /* No entry found */
565 pteg_off = get_pteg_offset(env, ctx->hash[h],
566 is_64b ? HASH_PTE_SIZE_64 : HASH_PTE_SIZE_32);
567 for (i = 0; i < 8; i++) {
568 #if defined(TARGET_PPC64)
569 if (is_64b) {
570 if (env->external_htab) {
571 pte0 = ldq_p(env->external_htab + pteg_off + (i * 16));
572 pte1 = ldq_p(env->external_htab + pteg_off + (i * 16) + 8);
573 } else {
574 pte0 = ldq_phys(env->htab_base + pteg_off + (i * 16));
575 pte1 = ldq_phys(env->htab_base + pteg_off + (i * 16) + 8);
576 }
577
578 r = pte64_check(ctx, pte0, pte1, h, rw, type);
579 LOG_MMU("Load pte from %016" HWADDR_PRIx " => " TARGET_FMT_lx " "
580 TARGET_FMT_lx " %d %d %d " TARGET_FMT_lx "\n",
581 pteg_off + (i * 16), pte0, pte1, (int)(pte0 & 1), h,
582 (int)((pte0 >> 1) & 1), ctx->ptem);
583 } else
584 #endif
585 {
586 if (env->external_htab) {
587 pte0 = ldl_p(env->external_htab + pteg_off + (i * 8));
588 pte1 = ldl_p(env->external_htab + pteg_off + (i * 8) + 4);
589 } else {
590 pte0 = ldl_phys(env->htab_base + pteg_off + (i * 8));
591 pte1 = ldl_phys(env->htab_base + pteg_off + (i * 8) + 4);
592 }
593 r = pte32_check(ctx, pte0, pte1, h, rw, type);
594 LOG_MMU("Load pte from %08" HWADDR_PRIx " => " TARGET_FMT_lx " "
595 TARGET_FMT_lx " %d %d %d " TARGET_FMT_lx "\n",
596 pteg_off + (i * 8), pte0, pte1, (int)(pte0 >> 31), h,
597 (int)((pte0 >> 6) & 1), ctx->ptem);
598 }
599 switch (r) {
600 case -3:
601 /* PTE inconsistency */
602 return -1;
603 case -2:
604 /* Access violation */
605 ret = -2;
606 good = i;
607 break;
608 case -1:
609 default:
610 /* No PTE match */
611 break;
612 case 0:
613 /* access granted */
614 /* XXX: we should go on looping to check all PTEs consistency
615 * but if we can speed-up the whole thing as the
616 * result would be undefined if PTEs are not consistent.
617 */
618 ret = 0;
619 good = i;
620 goto done;
621 }
622 }
623 if (good != -1) {
624 done:
625 LOG_MMU("found PTE at addr %08" HWADDR_PRIx " prot=%01x ret=%d\n",
626 ctx->raddr, ctx->prot, ret);
627 /* Update page flags */
628 pte1 = ctx->raddr;
629 if (pte_update_flags(ctx, &pte1, ret, rw) == 1) {
630 #if defined(TARGET_PPC64)
631 if (is_64b) {
632 if (env->external_htab) {
633 stq_p(env->external_htab + pteg_off + (good * 16) + 8,
634 pte1);
635 } else {
636 stq_phys_notdirty(env->htab_base + pteg_off +
637 (good * 16) + 8, pte1);
638 }
639 } else
640 #endif
641 {
642 if (env->external_htab) {
643 stl_p(env->external_htab + pteg_off + (good * 8) + 4,
644 pte1);
645 } else {
646 stl_phys_notdirty(env->htab_base + pteg_off +
647 (good * 8) + 4, pte1);
648 }
649 }
650 }
651 }
652
653 /* We have a TLB that saves 4K pages, so let's
654 * split a huge page to 4k chunks */
655 if (target_page_bits != TARGET_PAGE_BITS) {
656 ctx->raddr |= (ctx->eaddr & ((1 << target_page_bits) - 1))
657 & TARGET_PAGE_MASK;
658 }
659 return ret;
660 }
661
662 static inline int find_pte(CPUPPCState *env, mmu_ctx_t *ctx, int h, int rw,
663 int type, int target_page_bits)
664 {
665 #if defined(TARGET_PPC64)
666 if (env->mmu_model & POWERPC_MMU_64) {
667 return find_pte2(env, ctx, 1, h, rw, type, target_page_bits);
668 }
669 #endif
670
671 return find_pte2(env, ctx, 0, h, rw, type, target_page_bits);
672 }
673
674 /* Perform segment based translation */
675 static inline int get_segment(CPUPPCState *env, mmu_ctx_t *ctx,
676 target_ulong eaddr, int rw, int type)
677 {
678 hwaddr hash;
679 target_ulong vsid;
680 int ds, pr, target_page_bits;
681 int ret, ret2;
682
683 pr = msr_pr;
684 ctx->eaddr = eaddr;
685 #if defined(TARGET_PPC64)
686 if (env->mmu_model & POWERPC_MMU_64) {
687 ppc_slb_t *slb;
688 target_ulong pageaddr;
689 int segment_bits;
690
691 LOG_MMU("Check SLBs\n");
692 slb = slb_lookup(env, eaddr);
693 if (!slb) {
694 return -5;
695 }
696
697 if (slb->vsid & SLB_VSID_B) {
698 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT_1T;
699 segment_bits = 40;
700 } else {
701 vsid = (slb->vsid & SLB_VSID_VSID) >> SLB_VSID_SHIFT;
702 segment_bits = 28;
703 }
704
705 target_page_bits = (slb->vsid & SLB_VSID_L)
706 ? TARGET_PAGE_BITS_16M : TARGET_PAGE_BITS;
707 ctx->key = !!(pr ? (slb->vsid & SLB_VSID_KP)
708 : (slb->vsid & SLB_VSID_KS));
709 ds = 0;
710 ctx->nx = !!(slb->vsid & SLB_VSID_N);
711
712 pageaddr = eaddr & ((1ULL << segment_bits)
713 - (1ULL << target_page_bits));
714 if (slb->vsid & SLB_VSID_B) {
715 hash = vsid ^ (vsid << 25) ^ (pageaddr >> target_page_bits);
716 } else {
717 hash = vsid ^ (pageaddr >> target_page_bits);
718 }
719 /* Only 5 bits of the page index are used in the AVPN */
720 ctx->ptem = (slb->vsid & SLB_VSID_PTEM) |
721 ((pageaddr >> 16) & ((1ULL << segment_bits) - 0x80));
722 } else
723 #endif /* defined(TARGET_PPC64) */
724 {
725 target_ulong sr, pgidx;
726
727 sr = env->sr[eaddr >> 28];
728 ctx->key = (((sr & 0x20000000) && (pr != 0)) ||
729 ((sr & 0x40000000) && (pr == 0))) ? 1 : 0;
730 ds = sr & 0x80000000 ? 1 : 0;
731 ctx->nx = sr & 0x10000000 ? 1 : 0;
732 vsid = sr & 0x00FFFFFF;
733 target_page_bits = TARGET_PAGE_BITS;
734 LOG_MMU("Check segment v=" TARGET_FMT_lx " %d " TARGET_FMT_lx " nip="
735 TARGET_FMT_lx " lr=" TARGET_FMT_lx
736 " ir=%d dr=%d pr=%d %d t=%d\n",
737 eaddr, (int)(eaddr >> 28), sr, env->nip, env->lr, (int)msr_ir,
738 (int)msr_dr, pr != 0 ? 1 : 0, rw, type);
739 pgidx = (eaddr & ~SEGMENT_MASK_256M) >> target_page_bits;
740 hash = vsid ^ pgidx;
741 ctx->ptem = (vsid << 7) | (pgidx >> 10);
742 }
743 LOG_MMU("pte segment: key=%d ds %d nx %d vsid " TARGET_FMT_lx "\n",
744 ctx->key, ds, ctx->nx, vsid);
745 ret = -1;
746 if (!ds) {
747 /* Check if instruction fetch is allowed, if needed */
748 if (type != ACCESS_CODE || ctx->nx == 0) {
749 /* Page address translation */
750 LOG_MMU("htab_base " TARGET_FMT_plx " htab_mask " TARGET_FMT_plx
751 " hash " TARGET_FMT_plx "\n",
752 env->htab_base, env->htab_mask, hash);
753 ctx->hash[0] = hash;
754 ctx->hash[1] = ~hash;
755
756 /* Initialize real address with an invalid value */
757 ctx->raddr = (hwaddr)-1ULL;
758 if (unlikely(env->mmu_model == POWERPC_MMU_SOFT_6xx ||
759 env->mmu_model == POWERPC_MMU_SOFT_74xx)) {
760 /* Software TLB search */
761 ret = ppc6xx_tlb_check(env, ctx, eaddr, rw, type);
762 } else {
763 LOG_MMU("0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
764 " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
765 " hash=" TARGET_FMT_plx "\n",
766 env->htab_base, env->htab_mask, vsid, ctx->ptem,
767 ctx->hash[0]);
768 /* Primary table lookup */
769 ret = find_pte(env, ctx, 0, rw, type, target_page_bits);
770 if (ret < 0) {
771 /* Secondary table lookup */
772 LOG_MMU("1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
773 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
774 " hash=" TARGET_FMT_plx "\n", env->htab_base,
775 env->htab_mask, vsid, ctx->ptem, ctx->hash[1]);
776 ret2 = find_pte(env, ctx, 1, rw, type,
777 target_page_bits);
778 if (ret2 != -1) {
779 ret = ret2;
780 }
781 }
782 }
783 #if defined(DUMP_PAGE_TABLES)
784 if (qemu_log_enabled()) {
785 hwaddr curaddr;
786 uint32_t a0, a1, a2, a3;
787
788 qemu_log("Page table: " TARGET_FMT_plx " len " TARGET_FMT_plx
789 "\n", sdr, mask + 0x80);
790 for (curaddr = sdr; curaddr < (sdr + mask + 0x80);
791 curaddr += 16) {
792 a0 = ldl_phys(curaddr);
793 a1 = ldl_phys(curaddr + 4);
794 a2 = ldl_phys(curaddr + 8);
795 a3 = ldl_phys(curaddr + 12);
796 if (a0 != 0 || a1 != 0 || a2 != 0 || a3 != 0) {
797 qemu_log(TARGET_FMT_plx ": %08x %08x %08x %08x\n",
798 curaddr, a0, a1, a2, a3);
799 }
800 }
801 }
802 #endif
803 } else {
804 LOG_MMU("No access allowed\n");
805 ret = -3;
806 }
807 } else {
808 target_ulong sr;
809
810 LOG_MMU("direct store...\n");
811 /* Direct-store segment : absolutely *BUGGY* for now */
812
813 /* Direct-store implies a 32-bit MMU.
814 * Check the Segment Register's bus unit ID (BUID).
815 */
816 sr = env->sr[eaddr >> 28];
817 if ((sr & 0x1FF00000) >> 20 == 0x07f) {
818 /* Memory-forced I/O controller interface access */
819 /* If T=1 and BUID=x'07F', the 601 performs a memory access
820 * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
821 */
822 ctx->raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
823 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
824 return 0;
825 }
826
827 switch (type) {
828 case ACCESS_INT:
829 /* Integer load/store : only access allowed */
830 break;
831 case ACCESS_CODE:
832 /* No code fetch is allowed in direct-store areas */
833 return -4;
834 case ACCESS_FLOAT:
835 /* Floating point load/store */
836 return -4;
837 case ACCESS_RES:
838 /* lwarx, ldarx or srwcx. */
839 return -4;
840 case ACCESS_CACHE:
841 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
842 /* Should make the instruction do no-op.
843 * As it already do no-op, it's quite easy :-)
844 */
845 ctx->raddr = eaddr;
846 return 0;
847 case ACCESS_EXT:
848 /* eciwx or ecowx */
849 return -4;
850 default:
851 qemu_log("ERROR: instruction should not need "
852 "address translation\n");
853 return -4;
854 }
855 if ((rw == 1 || ctx->key != 1) && (rw == 0 || ctx->key != 0)) {
856 ctx->raddr = eaddr;
857 ret = 2;
858 } else {
859 ret = -2;
860 }
861 }
862
863 return ret;
864 }
865
866 /* Generic TLB check function for embedded PowerPC implementations */
867 static int ppcemb_tlb_check(CPUPPCState *env, ppcemb_tlb_t *tlb,
868 hwaddr *raddrp,
869 target_ulong address, uint32_t pid, int ext,
870 int i)
871 {
872 target_ulong mask;
873
874 /* Check valid flag */
875 if (!(tlb->prot & PAGE_VALID)) {
876 return -1;
877 }
878 mask = ~(tlb->size - 1);
879 LOG_SWTLB("%s: TLB %d address " TARGET_FMT_lx " PID %u <=> " TARGET_FMT_lx
880 " " TARGET_FMT_lx " %u %x\n", __func__, i, address, pid, tlb->EPN,
881 mask, (uint32_t)tlb->PID, tlb->prot);
882 /* Check PID */
883 if (tlb->PID != 0 && tlb->PID != pid) {
884 return -1;
885 }
886 /* Check effective address */
887 if ((address & mask) != tlb->EPN) {
888 return -1;
889 }
890 *raddrp = (tlb->RPN & mask) | (address & ~mask);
891 if (ext) {
892 /* Extend the physical address to 36 bits */
893 *raddrp |= (uint64_t)(tlb->RPN & 0xF) << 32;
894 }
895
896 return 0;
897 }
898
899 /* Generic TLB search function for PowerPC embedded implementations */
900 static int ppcemb_tlb_search(CPUPPCState *env, target_ulong address,
901 uint32_t pid)
902 {
903 ppcemb_tlb_t *tlb;
904 hwaddr raddr;
905 int i, ret;
906
907 /* Default return value is no match */
908 ret = -1;
909 for (i = 0; i < env->nb_tlb; i++) {
910 tlb = &env->tlb.tlbe[i];
911 if (ppcemb_tlb_check(env, tlb, &raddr, address, pid, 0, i) == 0) {
912 ret = i;
913 break;
914 }
915 }
916
917 return ret;
918 }
919
920 /* Helpers specific to PowerPC 40x implementations */
921 static inline void ppc4xx_tlb_invalidate_all(CPUPPCState *env)
922 {
923 ppcemb_tlb_t *tlb;
924 int i;
925
926 for (i = 0; i < env->nb_tlb; i++) {
927 tlb = &env->tlb.tlbe[i];
928 tlb->prot &= ~PAGE_VALID;
929 }
930 tlb_flush(env, 1);
931 }
932
933 static inline void ppc4xx_tlb_invalidate_virt(CPUPPCState *env,
934 target_ulong eaddr, uint32_t pid)
935 {
936 #if !defined(FLUSH_ALL_TLBS)
937 ppcemb_tlb_t *tlb;
938 hwaddr raddr;
939 target_ulong page, end;
940 int i;
941
942 for (i = 0; i < env->nb_tlb; i++) {
943 tlb = &env->tlb.tlbe[i];
944 if (ppcemb_tlb_check(env, tlb, &raddr, eaddr, pid, 0, i) == 0) {
945 end = tlb->EPN + tlb->size;
946 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
947 tlb_flush_page(env, page);
948 }
949 tlb->prot &= ~PAGE_VALID;
950 break;
951 }
952 }
953 #else
954 ppc4xx_tlb_invalidate_all(env);
955 #endif
956 }
957
958 static int mmu40x_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
959 target_ulong address, int rw,
960 int access_type)
961 {
962 ppcemb_tlb_t *tlb;
963 hwaddr raddr;
964 int i, ret, zsel, zpr, pr;
965
966 ret = -1;
967 raddr = (hwaddr)-1ULL;
968 pr = msr_pr;
969 for (i = 0; i < env->nb_tlb; i++) {
970 tlb = &env->tlb.tlbe[i];
971 if (ppcemb_tlb_check(env, tlb, &raddr, address,
972 env->spr[SPR_40x_PID], 0, i) < 0) {
973 continue;
974 }
975 zsel = (tlb->attr >> 4) & 0xF;
976 zpr = (env->spr[SPR_40x_ZPR] >> (30 - (2 * zsel))) & 0x3;
977 LOG_SWTLB("%s: TLB %d zsel %d zpr %d rw %d attr %08x\n",
978 __func__, i, zsel, zpr, rw, tlb->attr);
979 /* Check execute enable bit */
980 switch (zpr) {
981 case 0x2:
982 if (pr != 0) {
983 goto check_perms;
984 }
985 /* No break here */
986 case 0x3:
987 /* All accesses granted */
988 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
989 ret = 0;
990 break;
991 case 0x0:
992 if (pr != 0) {
993 /* Raise Zone protection fault. */
994 env->spr[SPR_40x_ESR] = 1 << 22;
995 ctx->prot = 0;
996 ret = -2;
997 break;
998 }
999 /* No break here */
1000 case 0x1:
1001 check_perms:
1002 /* Check from TLB entry */
1003 ctx->prot = tlb->prot;
1004 ret = check_prot(ctx->prot, rw, access_type);
1005 if (ret == -2) {
1006 env->spr[SPR_40x_ESR] = 0;
1007 }
1008 break;
1009 }
1010 if (ret >= 0) {
1011 ctx->raddr = raddr;
1012 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
1013 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
1014 ret);
1015 return 0;
1016 }
1017 }
1018 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
1019 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
1020
1021 return ret;
1022 }
1023
1024 void store_40x_sler(CPUPPCState *env, uint32_t val)
1025 {
1026 /* XXX: TO BE FIXED */
1027 if (val != 0x00000000) {
1028 cpu_abort(env, "Little-endian regions are not supported by now\n");
1029 }
1030 env->spr[SPR_405_SLER] = val;
1031 }
1032
1033 static inline int mmubooke_check_tlb(CPUPPCState *env, ppcemb_tlb_t *tlb,
1034 hwaddr *raddr, int *prot,
1035 target_ulong address, int rw,
1036 int access_type, int i)
1037 {
1038 int ret, prot2;
1039
1040 if (ppcemb_tlb_check(env, tlb, raddr, address,
1041 env->spr[SPR_BOOKE_PID],
1042 !env->nb_pids, i) >= 0) {
1043 goto found_tlb;
1044 }
1045
1046 if (env->spr[SPR_BOOKE_PID1] &&
1047 ppcemb_tlb_check(env, tlb, raddr, address,
1048 env->spr[SPR_BOOKE_PID1], 0, i) >= 0) {
1049 goto found_tlb;
1050 }
1051
1052 if (env->spr[SPR_BOOKE_PID2] &&
1053 ppcemb_tlb_check(env, tlb, raddr, address,
1054 env->spr[SPR_BOOKE_PID2], 0, i) >= 0) {
1055 goto found_tlb;
1056 }
1057
1058 LOG_SWTLB("%s: TLB entry not found\n", __func__);
1059 return -1;
1060
1061 found_tlb:
1062
1063 if (msr_pr != 0) {
1064 prot2 = tlb->prot & 0xF;
1065 } else {
1066 prot2 = (tlb->prot >> 4) & 0xF;
1067 }
1068
1069 /* Check the address space */
1070 if (access_type == ACCESS_CODE) {
1071 if (msr_ir != (tlb->attr & 1)) {
1072 LOG_SWTLB("%s: AS doesn't match\n", __func__);
1073 return -1;
1074 }
1075
1076 *prot = prot2;
1077 if (prot2 & PAGE_EXEC) {
1078 LOG_SWTLB("%s: good TLB!\n", __func__);
1079 return 0;
1080 }
1081
1082 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
1083 ret = -3;
1084 } else {
1085 if (msr_dr != (tlb->attr & 1)) {
1086 LOG_SWTLB("%s: AS doesn't match\n", __func__);
1087 return -1;
1088 }
1089
1090 *prot = prot2;
1091 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
1092 LOG_SWTLB("%s: found TLB!\n", __func__);
1093 return 0;
1094 }
1095
1096 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
1097 ret = -2;
1098 }
1099
1100 return ret;
1101 }
1102
1103 static int mmubooke_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1104 target_ulong address, int rw,
1105 int access_type)
1106 {
1107 ppcemb_tlb_t *tlb;
1108 hwaddr raddr;
1109 int i, ret;
1110
1111 ret = -1;
1112 raddr = (hwaddr)-1ULL;
1113 for (i = 0; i < env->nb_tlb; i++) {
1114 tlb = &env->tlb.tlbe[i];
1115 ret = mmubooke_check_tlb(env, tlb, &raddr, &ctx->prot, address, rw,
1116 access_type, i);
1117 if (!ret) {
1118 break;
1119 }
1120 }
1121
1122 if (ret >= 0) {
1123 ctx->raddr = raddr;
1124 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
1125 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
1126 ret);
1127 } else {
1128 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
1129 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
1130 }
1131
1132 return ret;
1133 }
1134
1135 static void booke206_flush_tlb(CPUPPCState *env, int flags,
1136 const int check_iprot)
1137 {
1138 int tlb_size;
1139 int i, j;
1140 ppcmas_tlb_t *tlb = env->tlb.tlbm;
1141
1142 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1143 if (flags & (1 << i)) {
1144 tlb_size = booke206_tlb_size(env, i);
1145 for (j = 0; j < tlb_size; j++) {
1146 if (!check_iprot || !(tlb[j].mas1 & MAS1_IPROT)) {
1147 tlb[j].mas1 &= ~MAS1_VALID;
1148 }
1149 }
1150 }
1151 tlb += booke206_tlb_size(env, i);
1152 }
1153
1154 tlb_flush(env, 1);
1155 }
1156
1157 static hwaddr booke206_tlb_to_page_size(CPUPPCState *env,
1158 ppcmas_tlb_t *tlb)
1159 {
1160 int tlbm_size;
1161
1162 tlbm_size = (tlb->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
1163
1164 return 1024ULL << tlbm_size;
1165 }
1166
1167 /* TLB check function for MAS based SoftTLBs */
1168 static int ppcmas_tlb_check(CPUPPCState *env, ppcmas_tlb_t *tlb,
1169 hwaddr *raddrp,
1170 target_ulong address, uint32_t pid)
1171 {
1172 target_ulong mask;
1173 uint32_t tlb_pid;
1174
1175 /* Check valid flag */
1176 if (!(tlb->mas1 & MAS1_VALID)) {
1177 return -1;
1178 }
1179
1180 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
1181 LOG_SWTLB("%s: TLB ADDR=0x" TARGET_FMT_lx " PID=0x%x MAS1=0x%x MAS2=0x%"
1182 PRIx64 " mask=0x" TARGET_FMT_lx " MAS7_3=0x%" PRIx64 " MAS8=%x\n",
1183 __func__, address, pid, tlb->mas1, tlb->mas2, mask, tlb->mas7_3,
1184 tlb->mas8);
1185
1186 /* Check PID */
1187 tlb_pid = (tlb->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT;
1188 if (tlb_pid != 0 && tlb_pid != pid) {
1189 return -1;
1190 }
1191
1192 /* Check effective address */
1193 if ((address & mask) != (tlb->mas2 & MAS2_EPN_MASK)) {
1194 return -1;
1195 }
1196
1197 if (raddrp) {
1198 *raddrp = (tlb->mas7_3 & mask) | (address & ~mask);
1199 }
1200
1201 return 0;
1202 }
1203
1204 static int mmubooke206_check_tlb(CPUPPCState *env, ppcmas_tlb_t *tlb,
1205 hwaddr *raddr, int *prot,
1206 target_ulong address, int rw,
1207 int access_type)
1208 {
1209 int ret;
1210 int prot2 = 0;
1211
1212 if (ppcmas_tlb_check(env, tlb, raddr, address,
1213 env->spr[SPR_BOOKE_PID]) >= 0) {
1214 goto found_tlb;
1215 }
1216
1217 if (env->spr[SPR_BOOKE_PID1] &&
1218 ppcmas_tlb_check(env, tlb, raddr, address,
1219 env->spr[SPR_BOOKE_PID1]) >= 0) {
1220 goto found_tlb;
1221 }
1222
1223 if (env->spr[SPR_BOOKE_PID2] &&
1224 ppcmas_tlb_check(env, tlb, raddr, address,
1225 env->spr[SPR_BOOKE_PID2]) >= 0) {
1226 goto found_tlb;
1227 }
1228
1229 LOG_SWTLB("%s: TLB entry not found\n", __func__);
1230 return -1;
1231
1232 found_tlb:
1233
1234 if (msr_pr != 0) {
1235 if (tlb->mas7_3 & MAS3_UR) {
1236 prot2 |= PAGE_READ;
1237 }
1238 if (tlb->mas7_3 & MAS3_UW) {
1239 prot2 |= PAGE_WRITE;
1240 }
1241 if (tlb->mas7_3 & MAS3_UX) {
1242 prot2 |= PAGE_EXEC;
1243 }
1244 } else {
1245 if (tlb->mas7_3 & MAS3_SR) {
1246 prot2 |= PAGE_READ;
1247 }
1248 if (tlb->mas7_3 & MAS3_SW) {
1249 prot2 |= PAGE_WRITE;
1250 }
1251 if (tlb->mas7_3 & MAS3_SX) {
1252 prot2 |= PAGE_EXEC;
1253 }
1254 }
1255
1256 /* Check the address space and permissions */
1257 if (access_type == ACCESS_CODE) {
1258 if (msr_ir != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
1259 LOG_SWTLB("%s: AS doesn't match\n", __func__);
1260 return -1;
1261 }
1262
1263 *prot = prot2;
1264 if (prot2 & PAGE_EXEC) {
1265 LOG_SWTLB("%s: good TLB!\n", __func__);
1266 return 0;
1267 }
1268
1269 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
1270 ret = -3;
1271 } else {
1272 if (msr_dr != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
1273 LOG_SWTLB("%s: AS doesn't match\n", __func__);
1274 return -1;
1275 }
1276
1277 *prot = prot2;
1278 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
1279 LOG_SWTLB("%s: found TLB!\n", __func__);
1280 return 0;
1281 }
1282
1283 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
1284 ret = -2;
1285 }
1286
1287 return ret;
1288 }
1289
1290 static int mmubooke206_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1291 target_ulong address, int rw,
1292 int access_type)
1293 {
1294 ppcmas_tlb_t *tlb;
1295 hwaddr raddr;
1296 int i, j, ret;
1297
1298 ret = -1;
1299 raddr = (hwaddr)-1ULL;
1300
1301 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1302 int ways = booke206_tlb_ways(env, i);
1303
1304 for (j = 0; j < ways; j++) {
1305 tlb = booke206_get_tlbm(env, i, address, j);
1306 if (!tlb) {
1307 continue;
1308 }
1309 ret = mmubooke206_check_tlb(env, tlb, &raddr, &ctx->prot, address,
1310 rw, access_type);
1311 if (ret != -1) {
1312 goto found_tlb;
1313 }
1314 }
1315 }
1316
1317 found_tlb:
1318
1319 if (ret >= 0) {
1320 ctx->raddr = raddr;
1321 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
1322 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
1323 ret);
1324 } else {
1325 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
1326 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
1327 }
1328
1329 return ret;
1330 }
1331
1332 static const char *book3e_tsize_to_str[32] = {
1333 "1K", "2K", "4K", "8K", "16K", "32K", "64K", "128K", "256K", "512K",
1334 "1M", "2M", "4M", "8M", "16M", "32M", "64M", "128M", "256M", "512M",
1335 "1G", "2G", "4G", "8G", "16G", "32G", "64G", "128G", "256G", "512G",
1336 "1T", "2T"
1337 };
1338
1339 static void mmubooke_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1340 CPUPPCState *env)
1341 {
1342 ppcemb_tlb_t *entry;
1343 int i;
1344
1345 if (kvm_enabled() && !env->kvm_sw_tlb) {
1346 cpu_fprintf(f, "Cannot access KVM TLB\n");
1347 return;
1348 }
1349
1350 cpu_fprintf(f, "\nTLB:\n");
1351 cpu_fprintf(f, "Effective Physical Size PID Prot "
1352 "Attr\n");
1353
1354 entry = &env->tlb.tlbe[0];
1355 for (i = 0; i < env->nb_tlb; i++, entry++) {
1356 hwaddr ea, pa;
1357 target_ulong mask;
1358 uint64_t size = (uint64_t)entry->size;
1359 char size_buf[20];
1360
1361 /* Check valid flag */
1362 if (!(entry->prot & PAGE_VALID)) {
1363 continue;
1364 }
1365
1366 mask = ~(entry->size - 1);
1367 ea = entry->EPN & mask;
1368 pa = entry->RPN & mask;
1369 /* Extend the physical address to 36 bits */
1370 pa |= (hwaddr)(entry->RPN & 0xF) << 32;
1371 size /= 1024;
1372 if (size >= 1024) {
1373 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "M", size / 1024);
1374 } else {
1375 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "k", size);
1376 }
1377 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %s %-5u %08x %08x\n",
1378 (uint64_t)ea, (uint64_t)pa, size_buf, (uint32_t)entry->PID,
1379 entry->prot, entry->attr);
1380 }
1381
1382 }
1383
1384 static void mmubooke206_dump_one_tlb(FILE *f, fprintf_function cpu_fprintf,
1385 CPUPPCState *env, int tlbn, int offset,
1386 int tlbsize)
1387 {
1388 ppcmas_tlb_t *entry;
1389 int i;
1390
1391 cpu_fprintf(f, "\nTLB%d:\n", tlbn);
1392 cpu_fprintf(f, "Effective Physical Size TID TS SRWX"
1393 " URWX WIMGE U0123\n");
1394
1395 entry = &env->tlb.tlbm[offset];
1396 for (i = 0; i < tlbsize; i++, entry++) {
1397 hwaddr ea, pa, size;
1398 int tsize;
1399
1400 if (!(entry->mas1 & MAS1_VALID)) {
1401 continue;
1402 }
1403
1404 tsize = (entry->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
1405 size = 1024ULL << tsize;
1406 ea = entry->mas2 & ~(size - 1);
1407 pa = entry->mas7_3 & ~(size - 1);
1408
1409 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %4s %-5u %1u S%c%c%c"
1410 "U%c%c%c %c%c%c%c%c U%c%c%c%c\n",
1411 (uint64_t)ea, (uint64_t)pa,
1412 book3e_tsize_to_str[tsize],
1413 (entry->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT,
1414 (entry->mas1 & MAS1_TS) >> MAS1_TS_SHIFT,
1415 entry->mas7_3 & MAS3_SR ? 'R' : '-',
1416 entry->mas7_3 & MAS3_SW ? 'W' : '-',
1417 entry->mas7_3 & MAS3_SX ? 'X' : '-',
1418 entry->mas7_3 & MAS3_UR ? 'R' : '-',
1419 entry->mas7_3 & MAS3_UW ? 'W' : '-',
1420 entry->mas7_3 & MAS3_UX ? 'X' : '-',
1421 entry->mas2 & MAS2_W ? 'W' : '-',
1422 entry->mas2 & MAS2_I ? 'I' : '-',
1423 entry->mas2 & MAS2_M ? 'M' : '-',
1424 entry->mas2 & MAS2_G ? 'G' : '-',
1425 entry->mas2 & MAS2_E ? 'E' : '-',
1426 entry->mas7_3 & MAS3_U0 ? '0' : '-',
1427 entry->mas7_3 & MAS3_U1 ? '1' : '-',
1428 entry->mas7_3 & MAS3_U2 ? '2' : '-',
1429 entry->mas7_3 & MAS3_U3 ? '3' : '-');
1430 }
1431 }
1432
1433 static void mmubooke206_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1434 CPUPPCState *env)
1435 {
1436 int offset = 0;
1437 int i;
1438
1439 if (kvm_enabled() && !env->kvm_sw_tlb) {
1440 cpu_fprintf(f, "Cannot access KVM TLB\n");
1441 return;
1442 }
1443
1444 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1445 int size = booke206_tlb_size(env, i);
1446
1447 if (size == 0) {
1448 continue;
1449 }
1450
1451 mmubooke206_dump_one_tlb(f, cpu_fprintf, env, i, offset, size);
1452 offset += size;
1453 }
1454 }
1455
1456 void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
1457 {
1458 switch (env->mmu_model) {
1459 case POWERPC_MMU_BOOKE:
1460 mmubooke_dump_mmu(f, cpu_fprintf, env);
1461 break;
1462 case POWERPC_MMU_BOOKE206:
1463 mmubooke206_dump_mmu(f, cpu_fprintf, env);
1464 break;
1465 #if defined(TARGET_PPC64)
1466 case POWERPC_MMU_64B:
1467 case POWERPC_MMU_2_06:
1468 case POWERPC_MMU_2_06d:
1469 dump_slb(f, cpu_fprintf, env);
1470 break;
1471 #endif
1472 default:
1473 qemu_log_mask(LOG_UNIMP, "%s: unimplemented\n", __func__);
1474 }
1475 }
1476
1477 static inline int check_physical(CPUPPCState *env, mmu_ctx_t *ctx,
1478 target_ulong eaddr, int rw)
1479 {
1480 int in_plb, ret;
1481
1482 ctx->raddr = eaddr;
1483 ctx->prot = PAGE_READ | PAGE_EXEC;
1484 ret = 0;
1485 switch (env->mmu_model) {
1486 case POWERPC_MMU_32B:
1487 case POWERPC_MMU_601:
1488 case POWERPC_MMU_SOFT_6xx:
1489 case POWERPC_MMU_SOFT_74xx:
1490 case POWERPC_MMU_SOFT_4xx:
1491 case POWERPC_MMU_REAL:
1492 case POWERPC_MMU_BOOKE:
1493 ctx->prot |= PAGE_WRITE;
1494 break;
1495 #if defined(TARGET_PPC64)
1496 case POWERPC_MMU_64B:
1497 case POWERPC_MMU_2_06:
1498 case POWERPC_MMU_2_06d:
1499 /* Real address are 60 bits long */
1500 ctx->raddr &= 0x0FFFFFFFFFFFFFFFULL;
1501 ctx->prot |= PAGE_WRITE;
1502 break;
1503 #endif
1504 case POWERPC_MMU_SOFT_4xx_Z:
1505 if (unlikely(msr_pe != 0)) {
1506 /* 403 family add some particular protections,
1507 * using PBL/PBU registers for accesses with no translation.
1508 */
1509 in_plb =
1510 /* Check PLB validity */
1511 (env->pb[0] < env->pb[1] &&
1512 /* and address in plb area */
1513 eaddr >= env->pb[0] && eaddr < env->pb[1]) ||
1514 (env->pb[2] < env->pb[3] &&
1515 eaddr >= env->pb[2] && eaddr < env->pb[3]) ? 1 : 0;
1516 if (in_plb ^ msr_px) {
1517 /* Access in protected area */
1518 if (rw == 1) {
1519 /* Access is not allowed */
1520 ret = -2;
1521 }
1522 } else {
1523 /* Read-write access is allowed */
1524 ctx->prot |= PAGE_WRITE;
1525 }
1526 }
1527 break;
1528 case POWERPC_MMU_MPC8xx:
1529 /* XXX: TODO */
1530 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1531 break;
1532 case POWERPC_MMU_BOOKE206:
1533 cpu_abort(env, "BookE 2.06 MMU doesn't have physical real mode\n");
1534 break;
1535 default:
1536 cpu_abort(env, "Unknown or invalid MMU model\n");
1537 return -1;
1538 }
1539
1540 return ret;
1541 }
1542
1543 static int get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1544 target_ulong eaddr, int rw, int access_type)
1545 {
1546 int ret;
1547
1548 #if 0
1549 qemu_log("%s\n", __func__);
1550 #endif
1551 if ((access_type == ACCESS_CODE && msr_ir == 0) ||
1552 (access_type != ACCESS_CODE && msr_dr == 0)) {
1553 if (env->mmu_model == POWERPC_MMU_BOOKE) {
1554 /* The BookE MMU always performs address translation. The
1555 IS and DS bits only affect the address space. */
1556 ret = mmubooke_get_physical_address(env, ctx, eaddr,
1557 rw, access_type);
1558 } else if (env->mmu_model == POWERPC_MMU_BOOKE206) {
1559 ret = mmubooke206_get_physical_address(env, ctx, eaddr, rw,
1560 access_type);
1561 } else {
1562 /* No address translation. */
1563 ret = check_physical(env, ctx, eaddr, rw);
1564 }
1565 } else {
1566 ret = -1;
1567 switch (env->mmu_model) {
1568 case POWERPC_MMU_32B:
1569 case POWERPC_MMU_601:
1570 case POWERPC_MMU_SOFT_6xx:
1571 case POWERPC_MMU_SOFT_74xx:
1572 /* Try to find a BAT */
1573 if (env->nb_BATs != 0) {
1574 ret = get_bat(env, ctx, eaddr, rw, access_type);
1575 }
1576 #if defined(TARGET_PPC64)
1577 case POWERPC_MMU_64B:
1578 case POWERPC_MMU_2_06:
1579 case POWERPC_MMU_2_06d:
1580 #endif
1581 if (ret < 0) {
1582 /* We didn't match any BAT entry or don't have BATs */
1583 ret = get_segment(env, ctx, eaddr, rw, access_type);
1584 }
1585 break;
1586 case POWERPC_MMU_SOFT_4xx:
1587 case POWERPC_MMU_SOFT_4xx_Z:
1588 ret = mmu40x_get_physical_address(env, ctx, eaddr,
1589 rw, access_type);
1590 break;
1591 case POWERPC_MMU_BOOKE:
1592 ret = mmubooke_get_physical_address(env, ctx, eaddr,
1593 rw, access_type);
1594 break;
1595 case POWERPC_MMU_BOOKE206:
1596 ret = mmubooke206_get_physical_address(env, ctx, eaddr, rw,
1597 access_type);
1598 break;
1599 case POWERPC_MMU_MPC8xx:
1600 /* XXX: TODO */
1601 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1602 break;
1603 case POWERPC_MMU_REAL:
1604 cpu_abort(env, "PowerPC in real mode do not do any translation\n");
1605 return -1;
1606 default:
1607 cpu_abort(env, "Unknown or invalid MMU model\n");
1608 return -1;
1609 }
1610 }
1611 #if 0
1612 qemu_log("%s address " TARGET_FMT_lx " => %d " TARGET_FMT_plx "\n",
1613 __func__, eaddr, ret, ctx->raddr);
1614 #endif
1615
1616 return ret;
1617 }
1618
1619 hwaddr cpu_get_phys_page_debug(CPUPPCState *env, target_ulong addr)
1620 {
1621 mmu_ctx_t ctx;
1622
1623 if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT) != 0)) {
1624 return -1;
1625 }
1626
1627 return ctx.raddr & TARGET_PAGE_MASK;
1628 }
1629
1630 static void booke206_update_mas_tlb_miss(CPUPPCState *env, target_ulong address,
1631 int rw)
1632 {
1633 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
1634 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
1635 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
1636 env->spr[SPR_BOOKE_MAS3] = 0;
1637 env->spr[SPR_BOOKE_MAS6] = 0;
1638 env->spr[SPR_BOOKE_MAS7] = 0;
1639
1640 /* AS */
1641 if (((rw == 2) && msr_ir) || ((rw != 2) && msr_dr)) {
1642 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
1643 env->spr[SPR_BOOKE_MAS6] |= MAS6_SAS;
1644 }
1645
1646 env->spr[SPR_BOOKE_MAS1] |= MAS1_VALID;
1647 env->spr[SPR_BOOKE_MAS2] |= address & MAS2_EPN_MASK;
1648
1649 switch (env->spr[SPR_BOOKE_MAS4] & MAS4_TIDSELD_PIDZ) {
1650 case MAS4_TIDSELD_PID0:
1651 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID] << MAS1_TID_SHIFT;
1652 break;
1653 case MAS4_TIDSELD_PID1:
1654 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID1] << MAS1_TID_SHIFT;
1655 break;
1656 case MAS4_TIDSELD_PID2:
1657 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID2] << MAS1_TID_SHIFT;
1658 break;
1659 }
1660
1661 env->spr[SPR_BOOKE_MAS6] |= env->spr[SPR_BOOKE_PID] << 16;
1662
1663 /* next victim logic */
1664 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
1665 env->last_way++;
1666 env->last_way &= booke206_tlb_ways(env, 0) - 1;
1667 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
1668 }
1669
1670 /* Perform address translation */
1671 int cpu_ppc_handle_mmu_fault(CPUPPCState *env, target_ulong address, int rw,
1672 int mmu_idx)
1673 {
1674 mmu_ctx_t ctx;
1675 int access_type;
1676 int ret = 0;
1677
1678 if (rw == 2) {
1679 /* code access */
1680 rw = 0;
1681 access_type = ACCESS_CODE;
1682 } else {
1683 /* data access */
1684 access_type = env->access_type;
1685 }
1686 ret = get_physical_address(env, &ctx, address, rw, access_type);
1687 if (ret == 0) {
1688 tlb_set_page(env, address & TARGET_PAGE_MASK,
1689 ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
1690 mmu_idx, TARGET_PAGE_SIZE);
1691 ret = 0;
1692 } else if (ret < 0) {
1693 LOG_MMU_STATE(env);
1694 if (access_type == ACCESS_CODE) {
1695 switch (ret) {
1696 case -1:
1697 /* No matches in page tables or TLB */
1698 switch (env->mmu_model) {
1699 case POWERPC_MMU_SOFT_6xx:
1700 env->exception_index = POWERPC_EXCP_IFTLB;
1701 env->error_code = 1 << 18;
1702 env->spr[SPR_IMISS] = address;
1703 env->spr[SPR_ICMP] = 0x80000000 | ctx.ptem;
1704 goto tlb_miss;
1705 case POWERPC_MMU_SOFT_74xx:
1706 env->exception_index = POWERPC_EXCP_IFTLB;
1707 goto tlb_miss_74xx;
1708 case POWERPC_MMU_SOFT_4xx:
1709 case POWERPC_MMU_SOFT_4xx_Z:
1710 env->exception_index = POWERPC_EXCP_ITLB;
1711 env->error_code = 0;
1712 env->spr[SPR_40x_DEAR] = address;
1713 env->spr[SPR_40x_ESR] = 0x00000000;
1714 break;
1715 case POWERPC_MMU_32B:
1716 case POWERPC_MMU_601:
1717 #if defined(TARGET_PPC64)
1718 case POWERPC_MMU_64B:
1719 case POWERPC_MMU_2_06:
1720 case POWERPC_MMU_2_06d:
1721 #endif
1722 env->exception_index = POWERPC_EXCP_ISI;
1723 env->error_code = 0x40000000;
1724 break;
1725 case POWERPC_MMU_BOOKE206:
1726 booke206_update_mas_tlb_miss(env, address, rw);
1727 /* fall through */
1728 case POWERPC_MMU_BOOKE:
1729 env->exception_index = POWERPC_EXCP_ITLB;
1730 env->error_code = 0;
1731 env->spr[SPR_BOOKE_DEAR] = address;
1732 return -1;
1733 case POWERPC_MMU_MPC8xx:
1734 /* XXX: TODO */
1735 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1736 break;
1737 case POWERPC_MMU_REAL:
1738 cpu_abort(env, "PowerPC in real mode should never raise "
1739 "any MMU exceptions\n");
1740 return -1;
1741 default:
1742 cpu_abort(env, "Unknown or invalid MMU model\n");
1743 return -1;
1744 }
1745 break;
1746 case -2:
1747 /* Access rights violation */
1748 env->exception_index = POWERPC_EXCP_ISI;
1749 env->error_code = 0x08000000;
1750 break;
1751 case -3:
1752 /* No execute protection violation */
1753 if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1754 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1755 env->spr[SPR_BOOKE_ESR] = 0x00000000;
1756 }
1757 env->exception_index = POWERPC_EXCP_ISI;
1758 env->error_code = 0x10000000;
1759 break;
1760 case -4:
1761 /* Direct store exception */
1762 /* No code fetch is allowed in direct-store areas */
1763 env->exception_index = POWERPC_EXCP_ISI;
1764 env->error_code = 0x10000000;
1765 break;
1766 #if defined(TARGET_PPC64)
1767 case -5:
1768 /* No match in segment table */
1769 env->exception_index = POWERPC_EXCP_ISEG;
1770 env->error_code = 0;
1771 break;
1772 #endif
1773 }
1774 } else {
1775 switch (ret) {
1776 case -1:
1777 /* No matches in page tables or TLB */
1778 switch (env->mmu_model) {
1779 case POWERPC_MMU_SOFT_6xx:
1780 if (rw == 1) {
1781 env->exception_index = POWERPC_EXCP_DSTLB;
1782 env->error_code = 1 << 16;
1783 } else {
1784 env->exception_index = POWERPC_EXCP_DLTLB;
1785 env->error_code = 0;
1786 }
1787 env->spr[SPR_DMISS] = address;
1788 env->spr[SPR_DCMP] = 0x80000000 | ctx.ptem;
1789 tlb_miss:
1790 env->error_code |= ctx.key << 19;
1791 env->spr[SPR_HASH1] = env->htab_base +
1792 get_pteg_offset(env, ctx.hash[0], HASH_PTE_SIZE_32);
1793 env->spr[SPR_HASH2] = env->htab_base +
1794 get_pteg_offset(env, ctx.hash[1], HASH_PTE_SIZE_32);
1795 break;
1796 case POWERPC_MMU_SOFT_74xx:
1797 if (rw == 1) {
1798 env->exception_index = POWERPC_EXCP_DSTLB;
1799 } else {
1800 env->exception_index = POWERPC_EXCP_DLTLB;
1801 }
1802 tlb_miss_74xx:
1803 /* Implement LRU algorithm */
1804 env->error_code = ctx.key << 19;
1805 env->spr[SPR_TLBMISS] = (address & ~((target_ulong)0x3)) |
1806 ((env->last_way + 1) & (env->nb_ways - 1));
1807 env->spr[SPR_PTEHI] = 0x80000000 | ctx.ptem;
1808 break;
1809 case POWERPC_MMU_SOFT_4xx:
1810 case POWERPC_MMU_SOFT_4xx_Z:
1811 env->exception_index = POWERPC_EXCP_DTLB;
1812 env->error_code = 0;
1813 env->spr[SPR_40x_DEAR] = address;
1814 if (rw) {
1815 env->spr[SPR_40x_ESR] = 0x00800000;
1816 } else {
1817 env->spr[SPR_40x_ESR] = 0x00000000;
1818 }
1819 break;
1820 case POWERPC_MMU_32B:
1821 case POWERPC_MMU_601:
1822 #if defined(TARGET_PPC64)
1823 case POWERPC_MMU_64B:
1824 case POWERPC_MMU_2_06:
1825 case POWERPC_MMU_2_06d:
1826 #endif
1827 env->exception_index = POWERPC_EXCP_DSI;
1828 env->error_code = 0;
1829 env->spr[SPR_DAR] = address;
1830 if (rw == 1) {
1831 env->spr[SPR_DSISR] = 0x42000000;
1832 } else {
1833 env->spr[SPR_DSISR] = 0x40000000;
1834 }
1835 break;
1836 case POWERPC_MMU_MPC8xx:
1837 /* XXX: TODO */
1838 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
1839 break;
1840 case POWERPC_MMU_BOOKE206:
1841 booke206_update_mas_tlb_miss(env, address, rw);
1842 /* fall through */
1843 case POWERPC_MMU_BOOKE:
1844 env->exception_index = POWERPC_EXCP_DTLB;
1845 env->error_code = 0;
1846 env->spr[SPR_BOOKE_DEAR] = address;
1847 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1848 return -1;
1849 case POWERPC_MMU_REAL:
1850 cpu_abort(env, "PowerPC in real mode should never raise "
1851 "any MMU exceptions\n");
1852 return -1;
1853 default:
1854 cpu_abort(env, "Unknown or invalid MMU model\n");
1855 return -1;
1856 }
1857 break;
1858 case -2:
1859 /* Access rights violation */
1860 env->exception_index = POWERPC_EXCP_DSI;
1861 env->error_code = 0;
1862 if (env->mmu_model == POWERPC_MMU_SOFT_4xx
1863 || env->mmu_model == POWERPC_MMU_SOFT_4xx_Z) {
1864 env->spr[SPR_40x_DEAR] = address;
1865 if (rw) {
1866 env->spr[SPR_40x_ESR] |= 0x00800000;
1867 }
1868 } else if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1869 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1870 env->spr[SPR_BOOKE_DEAR] = address;
1871 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1872 } else {
1873 env->spr[SPR_DAR] = address;
1874 if (rw == 1) {
1875 env->spr[SPR_DSISR] = 0x0A000000;
1876 } else {
1877 env->spr[SPR_DSISR] = 0x08000000;
1878 }
1879 }
1880 break;
1881 case -4:
1882 /* Direct store exception */
1883 switch (access_type) {
1884 case ACCESS_FLOAT:
1885 /* Floating point load/store */
1886 env->exception_index = POWERPC_EXCP_ALIGN;
1887 env->error_code = POWERPC_EXCP_ALIGN_FP;
1888 env->spr[SPR_DAR] = address;
1889 break;
1890 case ACCESS_RES:
1891 /* lwarx, ldarx or stwcx. */
1892 env->exception_index = POWERPC_EXCP_DSI;
1893 env->error_code = 0;
1894 env->spr[SPR_DAR] = address;
1895 if (rw == 1) {
1896 env->spr[SPR_DSISR] = 0x06000000;
1897 } else {
1898 env->spr[SPR_DSISR] = 0x04000000;
1899 }
1900 break;
1901 case ACCESS_EXT:
1902 /* eciwx or ecowx */
1903 env->exception_index = POWERPC_EXCP_DSI;
1904 env->error_code = 0;
1905 env->spr[SPR_DAR] = address;
1906 if (rw == 1) {
1907 env->spr[SPR_DSISR] = 0x06100000;
1908 } else {
1909 env->spr[SPR_DSISR] = 0x04100000;
1910 }
1911 break;
1912 default:
1913 printf("DSI: invalid exception (%d)\n", ret);
1914 env->exception_index = POWERPC_EXCP_PROGRAM;
1915 env->error_code =
1916 POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL;
1917 env->spr[SPR_DAR] = address;
1918 break;
1919 }
1920 break;
1921 #if defined(TARGET_PPC64)
1922 case -5:
1923 /* No match in segment table */
1924 env->exception_index = POWERPC_EXCP_DSEG;
1925 env->error_code = 0;
1926 env->spr[SPR_DAR] = address;
1927 break;
1928 #endif
1929 }
1930 }
1931 #if 0
1932 printf("%s: set exception to %d %02x\n", __func__,
1933 env->exception, env->error_code);
1934 #endif
1935 ret = 1;
1936 }
1937
1938 return ret;
1939 }
1940
1941 /*****************************************************************************/
1942 /* BATs management */
1943 #if !defined(FLUSH_ALL_TLBS)
1944 static inline void do_invalidate_BAT(CPUPPCState *env, target_ulong BATu,
1945 target_ulong mask)
1946 {
1947 target_ulong base, end, page;
1948
1949 base = BATu & ~0x0001FFFF;
1950 end = base + mask + 0x00020000;
1951 LOG_BATS("Flush BAT from " TARGET_FMT_lx " to " TARGET_FMT_lx " ("
1952 TARGET_FMT_lx ")\n", base, end, mask);
1953 for (page = base; page != end; page += TARGET_PAGE_SIZE) {
1954 tlb_flush_page(env, page);
1955 }
1956 LOG_BATS("Flush done\n");
1957 }
1958 #endif
1959
1960 static inline void dump_store_bat(CPUPPCState *env, char ID, int ul, int nr,
1961 target_ulong value)
1962 {
1963 LOG_BATS("Set %cBAT%d%c to " TARGET_FMT_lx " (" TARGET_FMT_lx ")\n", ID,
1964 nr, ul == 0 ? 'u' : 'l', value, env->nip);
1965 }
1966
1967 void helper_store_ibatu(CPUPPCState *env, uint32_t nr, target_ulong value)
1968 {
1969 target_ulong mask;
1970
1971 dump_store_bat(env, 'I', 0, nr, value);
1972 if (env->IBAT[0][nr] != value) {
1973 mask = (value << 15) & 0x0FFE0000UL;
1974 #if !defined(FLUSH_ALL_TLBS)
1975 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1976 #endif
1977 /* When storing valid upper BAT, mask BEPI and BRPN
1978 * and invalidate all TLBs covered by this BAT
1979 */
1980 mask = (value << 15) & 0x0FFE0000UL;
1981 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1982 (value & ~0x0001FFFFUL & ~mask);
1983 env->IBAT[1][nr] = (env->IBAT[1][nr] & 0x0000007B) |
1984 (env->IBAT[1][nr] & ~0x0001FFFF & ~mask);
1985 #if !defined(FLUSH_ALL_TLBS)
1986 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1987 #else
1988 tlb_flush(env, 1);
1989 #endif
1990 }
1991 }
1992
1993 void helper_store_ibatl(CPUPPCState *env, uint32_t nr, target_ulong value)
1994 {
1995 dump_store_bat(env, 'I', 1, nr, value);
1996 env->IBAT[1][nr] = value;
1997 }
1998
1999 void helper_store_dbatu(CPUPPCState *env, uint32_t nr, target_ulong value)
2000 {
2001 target_ulong mask;
2002
2003 dump_store_bat(env, 'D', 0, nr, value);
2004 if (env->DBAT[0][nr] != value) {
2005 /* When storing valid upper BAT, mask BEPI and BRPN
2006 * and invalidate all TLBs covered by this BAT
2007 */
2008 mask = (value << 15) & 0x0FFE0000UL;
2009 #if !defined(FLUSH_ALL_TLBS)
2010 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
2011 #endif
2012 mask = (value << 15) & 0x0FFE0000UL;
2013 env->DBAT[0][nr] = (value & 0x00001FFFUL) |
2014 (value & ~0x0001FFFFUL & ~mask);
2015 env->DBAT[1][nr] = (env->DBAT[1][nr] & 0x0000007B) |
2016 (env->DBAT[1][nr] & ~0x0001FFFF & ~mask);
2017 #if !defined(FLUSH_ALL_TLBS)
2018 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
2019 #else
2020 tlb_flush(env, 1);
2021 #endif
2022 }
2023 }
2024
2025 void helper_store_dbatl(CPUPPCState *env, uint32_t nr, target_ulong value)
2026 {
2027 dump_store_bat(env, 'D', 1, nr, value);
2028 env->DBAT[1][nr] = value;
2029 }
2030
2031 void helper_store_601_batu(CPUPPCState *env, uint32_t nr, target_ulong value)
2032 {
2033 target_ulong mask;
2034 #if defined(FLUSH_ALL_TLBS)
2035 int do_inval;
2036 #endif
2037
2038 dump_store_bat(env, 'I', 0, nr, value);
2039 if (env->IBAT[0][nr] != value) {
2040 #if defined(FLUSH_ALL_TLBS)
2041 do_inval = 0;
2042 #endif
2043 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
2044 if (env->IBAT[1][nr] & 0x40) {
2045 /* Invalidate BAT only if it is valid */
2046 #if !defined(FLUSH_ALL_TLBS)
2047 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
2048 #else
2049 do_inval = 1;
2050 #endif
2051 }
2052 /* When storing valid upper BAT, mask BEPI and BRPN
2053 * and invalidate all TLBs covered by this BAT
2054 */
2055 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
2056 (value & ~0x0001FFFFUL & ~mask);
2057 env->DBAT[0][nr] = env->IBAT[0][nr];
2058 if (env->IBAT[1][nr] & 0x40) {
2059 #if !defined(FLUSH_ALL_TLBS)
2060 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
2061 #else
2062 do_inval = 1;
2063 #endif
2064 }
2065 #if defined(FLUSH_ALL_TLBS)
2066 if (do_inval) {
2067 tlb_flush(env, 1);
2068 }
2069 #endif
2070 }
2071 }
2072
2073 void helper_store_601_batl(CPUPPCState *env, uint32_t nr, target_ulong value)
2074 {
2075 #if !defined(FLUSH_ALL_TLBS)
2076 target_ulong mask;
2077 #else
2078 int do_inval;
2079 #endif
2080
2081 dump_store_bat(env, 'I', 1, nr, value);
2082 if (env->IBAT[1][nr] != value) {
2083 #if defined(FLUSH_ALL_TLBS)
2084 do_inval = 0;
2085 #endif
2086 if (env->IBAT[1][nr] & 0x40) {
2087 #if !defined(FLUSH_ALL_TLBS)
2088 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
2089 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
2090 #else
2091 do_inval = 1;
2092 #endif
2093 }
2094 if (value & 0x40) {
2095 #if !defined(FLUSH_ALL_TLBS)
2096 mask = (value << 17) & 0x0FFE0000UL;
2097 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
2098 #else
2099 do_inval = 1;
2100 #endif
2101 }
2102 env->IBAT[1][nr] = value;
2103 env->DBAT[1][nr] = value;
2104 #if defined(FLUSH_ALL_TLBS)
2105 if (do_inval) {
2106 tlb_flush(env, 1);
2107 }
2108 #endif
2109 }
2110 }
2111
2112 /*****************************************************************************/
2113 /* TLB management */
2114 void ppc_tlb_invalidate_all(CPUPPCState *env)
2115 {
2116 switch (env->mmu_model) {
2117 case POWERPC_MMU_SOFT_6xx:
2118 case POWERPC_MMU_SOFT_74xx:
2119 ppc6xx_tlb_invalidate_all(env);
2120 break;
2121 case POWERPC_MMU_SOFT_4xx:
2122 case POWERPC_MMU_SOFT_4xx_Z:
2123 ppc4xx_tlb_invalidate_all(env);
2124 break;
2125 case POWERPC_MMU_REAL:
2126 cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
2127 break;
2128 case POWERPC_MMU_MPC8xx:
2129 /* XXX: TODO */
2130 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
2131 break;
2132 case POWERPC_MMU_BOOKE:
2133 tlb_flush(env, 1);
2134 break;
2135 case POWERPC_MMU_BOOKE206:
2136 booke206_flush_tlb(env, -1, 0);
2137 break;
2138 case POWERPC_MMU_32B:
2139 case POWERPC_MMU_601:
2140 #if defined(TARGET_PPC64)
2141 case POWERPC_MMU_64B:
2142 case POWERPC_MMU_2_06:
2143 case POWERPC_MMU_2_06d:
2144 #endif /* defined(TARGET_PPC64) */
2145 tlb_flush(env, 1);
2146 break;
2147 default:
2148 /* XXX: TODO */
2149 cpu_abort(env, "Unknown MMU model\n");
2150 break;
2151 }
2152 }
2153
2154 void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
2155 {
2156 #if !defined(FLUSH_ALL_TLBS)
2157 addr &= TARGET_PAGE_MASK;
2158 switch (env->mmu_model) {
2159 case POWERPC_MMU_SOFT_6xx:
2160 case POWERPC_MMU_SOFT_74xx:
2161 ppc6xx_tlb_invalidate_virt(env, addr, 0);
2162 if (env->id_tlbs == 1) {
2163 ppc6xx_tlb_invalidate_virt(env, addr, 1);
2164 }
2165 break;
2166 case POWERPC_MMU_SOFT_4xx:
2167 case POWERPC_MMU_SOFT_4xx_Z:
2168 ppc4xx_tlb_invalidate_virt(env, addr, env->spr[SPR_40x_PID]);
2169 break;
2170 case POWERPC_MMU_REAL:
2171 cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
2172 break;
2173 case POWERPC_MMU_MPC8xx:
2174 /* XXX: TODO */
2175 cpu_abort(env, "MPC8xx MMU model is not implemented\n");
2176 break;
2177 case POWERPC_MMU_BOOKE:
2178 /* XXX: TODO */
2179 cpu_abort(env, "BookE MMU model is not implemented\n");
2180 break;
2181 case POWERPC_MMU_BOOKE206:
2182 /* XXX: TODO */
2183 cpu_abort(env, "BookE 2.06 MMU model is not implemented\n");
2184 break;
2185 case POWERPC_MMU_32B:
2186 case POWERPC_MMU_601:
2187 /* tlbie invalidate TLBs for all segments */
2188 addr &= ~((target_ulong)-1ULL << 28);
2189 /* XXX: this case should be optimized,
2190 * giving a mask to tlb_flush_page
2191 */
2192 tlb_flush_page(env, addr | (0x0 << 28));
2193 tlb_flush_page(env, addr | (0x1 << 28));
2194 tlb_flush_page(env, addr | (0x2 << 28));
2195 tlb_flush_page(env, addr | (0x3 << 28));
2196 tlb_flush_page(env, addr | (0x4 << 28));
2197 tlb_flush_page(env, addr | (0x5 << 28));
2198 tlb_flush_page(env, addr | (0x6 << 28));
2199 tlb_flush_page(env, addr | (0x7 << 28));
2200 tlb_flush_page(env, addr | (0x8 << 28));
2201 tlb_flush_page(env, addr | (0x9 << 28));
2202 tlb_flush_page(env, addr | (0xA << 28));
2203 tlb_flush_page(env, addr | (0xB << 28));
2204 tlb_flush_page(env, addr | (0xC << 28));
2205 tlb_flush_page(env, addr | (0xD << 28));
2206 tlb_flush_page(env, addr | (0xE << 28));
2207 tlb_flush_page(env, addr | (0xF << 28));
2208 break;
2209 #if defined(TARGET_PPC64)
2210 case POWERPC_MMU_64B:
2211 case POWERPC_MMU_2_06:
2212 case POWERPC_MMU_2_06d:
2213 /* tlbie invalidate TLBs for all segments */
2214 /* XXX: given the fact that there are too many segments to invalidate,
2215 * and we still don't have a tlb_flush_mask(env, n, mask) in QEMU,
2216 * we just invalidate all TLBs
2217 */
2218 tlb_flush(env, 1);
2219 break;
2220 #endif /* defined(TARGET_PPC64) */
2221 default:
2222 /* XXX: TODO */
2223 cpu_abort(env, "Unknown MMU model\n");
2224 break;
2225 }
2226 #else
2227 ppc_tlb_invalidate_all(env);
2228 #endif
2229 }
2230
2231 /*****************************************************************************/
2232 /* Special registers manipulation */
2233 void ppc_store_sdr1(CPUPPCState *env, target_ulong value)
2234 {
2235 LOG_MMU("%s: " TARGET_FMT_lx "\n", __func__, value);
2236 if (env->spr[SPR_SDR1] != value) {
2237 env->spr[SPR_SDR1] = value;
2238 #if defined(TARGET_PPC64)
2239 if (env->mmu_model & POWERPC_MMU_64) {
2240 target_ulong htabsize = value & SDR_64_HTABSIZE;
2241
2242 if (htabsize > 28) {
2243 fprintf(stderr, "Invalid HTABSIZE 0x" TARGET_FMT_lx
2244 " stored in SDR1\n", htabsize);
2245 htabsize = 28;
2246 }
2247 env->htab_mask = (1ULL << (htabsize + 18)) - 1;
2248 env->htab_base = value & SDR_64_HTABORG;
2249 } else
2250 #endif /* defined(TARGET_PPC64) */
2251 {
2252 /* FIXME: Should check for valid HTABMASK values */
2253 env->htab_mask = ((value & SDR_32_HTABMASK) << 16) | 0xFFFF;
2254 env->htab_base = value & SDR_32_HTABORG;
2255 }
2256 tlb_flush(env, 1);
2257 }
2258 }
2259
2260 /* Segment registers load and store */
2261 target_ulong helper_load_sr(CPUPPCState *env, target_ulong sr_num)
2262 {
2263 #if defined(TARGET_PPC64)
2264 if (env->mmu_model & POWERPC_MMU_64) {
2265 /* XXX */
2266 return 0;
2267 }
2268 #endif
2269 return env->sr[sr_num];
2270 }
2271
2272 void helper_store_sr(CPUPPCState *env, target_ulong srnum, target_ulong value)
2273 {
2274 LOG_MMU("%s: reg=%d " TARGET_FMT_lx " " TARGET_FMT_lx "\n", __func__,
2275 (int)srnum, value, env->sr[srnum]);
2276 #if defined(TARGET_PPC64)
2277 if (env->mmu_model & POWERPC_MMU_64) {
2278 uint64_t rb = 0, rs = 0;
2279
2280 /* ESID = srnum */
2281 rb |= ((uint32_t)srnum & 0xf) << 28;
2282 /* Set the valid bit */
2283 rb |= 1 << 27;
2284 /* Index = ESID */
2285 rb |= (uint32_t)srnum;
2286
2287 /* VSID = VSID */
2288 rs |= (value & 0xfffffff) << 12;
2289 /* flags = flags */
2290 rs |= ((value >> 27) & 0xf) << 8;
2291
2292 ppc_store_slb(env, rb, rs);
2293 } else
2294 #endif
2295 if (env->sr[srnum] != value) {
2296 env->sr[srnum] = value;
2297 /* Invalidating 256MB of virtual memory in 4kB pages is way longer than
2298 flusing the whole TLB. */
2299 #if !defined(FLUSH_ALL_TLBS) && 0
2300 {
2301 target_ulong page, end;
2302 /* Invalidate 256 MB of virtual memory */
2303 page = (16 << 20) * srnum;
2304 end = page + (16 << 20);
2305 for (; page != end; page += TARGET_PAGE_SIZE) {
2306 tlb_flush_page(env, page);
2307 }
2308 }
2309 #else
2310 tlb_flush(env, 1);
2311 #endif
2312 }
2313 }
2314 #endif /* !defined(CONFIG_USER_ONLY) */
2315
2316 #if !defined(CONFIG_USER_ONLY)
2317 /* TLB management */
2318 void helper_tlbia(CPUPPCState *env)
2319 {
2320 ppc_tlb_invalidate_all(env);
2321 }
2322
2323 void helper_tlbie(CPUPPCState *env, target_ulong addr)
2324 {
2325 ppc_tlb_invalidate_one(env, addr);
2326 }
2327
2328 /* Software driven TLBs management */
2329 /* PowerPC 602/603 software TLB load instructions helpers */
2330 static void do_6xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
2331 {
2332 target_ulong RPN, CMP, EPN;
2333 int way;
2334
2335 RPN = env->spr[SPR_RPA];
2336 if (is_code) {
2337 CMP = env->spr[SPR_ICMP];
2338 EPN = env->spr[SPR_IMISS];
2339 } else {
2340 CMP = env->spr[SPR_DCMP];
2341 EPN = env->spr[SPR_DMISS];
2342 }
2343 way = (env->spr[SPR_SRR1] >> 17) & 1;
2344 (void)EPN; /* avoid a compiler warning */
2345 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2346 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2347 RPN, way);
2348 /* Store this TLB */
2349 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2350 way, is_code, CMP, RPN);
2351 }
2352
2353 void helper_6xx_tlbd(CPUPPCState *env, target_ulong EPN)
2354 {
2355 do_6xx_tlb(env, EPN, 0);
2356 }
2357
2358 void helper_6xx_tlbi(CPUPPCState *env, target_ulong EPN)
2359 {
2360 do_6xx_tlb(env, EPN, 1);
2361 }
2362
2363 /* PowerPC 74xx software TLB load instructions helpers */
2364 static void do_74xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
2365 {
2366 target_ulong RPN, CMP, EPN;
2367 int way;
2368
2369 RPN = env->spr[SPR_PTELO];
2370 CMP = env->spr[SPR_PTEHI];
2371 EPN = env->spr[SPR_TLBMISS] & ~0x3;
2372 way = env->spr[SPR_TLBMISS] & 0x3;
2373 (void)EPN; /* avoid a compiler warning */
2374 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2375 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2376 RPN, way);
2377 /* Store this TLB */
2378 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2379 way, is_code, CMP, RPN);
2380 }
2381
2382 void helper_74xx_tlbd(CPUPPCState *env, target_ulong EPN)
2383 {
2384 do_74xx_tlb(env, EPN, 0);
2385 }
2386
2387 void helper_74xx_tlbi(CPUPPCState *env, target_ulong EPN)
2388 {
2389 do_74xx_tlb(env, EPN, 1);
2390 }
2391
2392 /*****************************************************************************/
2393 /* PowerPC 601 specific instructions (POWER bridge) */
2394
2395 target_ulong helper_rac(CPUPPCState *env, target_ulong addr)
2396 {
2397 mmu_ctx_t ctx;
2398 int nb_BATs;
2399 target_ulong ret = 0;
2400
2401 /* We don't have to generate many instances of this instruction,
2402 * as rac is supervisor only.
2403 */
2404 /* XXX: FIX THIS: Pretend we have no BAT */
2405 nb_BATs = env->nb_BATs;
2406 env->nb_BATs = 0;
2407 if (get_physical_address(env, &ctx, addr, 0, ACCESS_INT) == 0) {
2408 ret = ctx.raddr;
2409 }
2410 env->nb_BATs = nb_BATs;
2411 return ret;
2412 }
2413
2414 static inline target_ulong booke_tlb_to_page_size(int size)
2415 {
2416 return 1024 << (2 * size);
2417 }
2418
2419 static inline int booke_page_size_to_tlb(target_ulong page_size)
2420 {
2421 int size;
2422
2423 switch (page_size) {
2424 case 0x00000400UL:
2425 size = 0x0;
2426 break;
2427 case 0x00001000UL:
2428 size = 0x1;
2429 break;
2430 case 0x00004000UL:
2431 size = 0x2;
2432 break;
2433 case 0x00010000UL:
2434 size = 0x3;
2435 break;
2436 case 0x00040000UL:
2437 size = 0x4;
2438 break;
2439 case 0x00100000UL:
2440 size = 0x5;
2441 break;
2442 case 0x00400000UL:
2443 size = 0x6;
2444 break;
2445 case 0x01000000UL:
2446 size = 0x7;
2447 break;
2448 case 0x04000000UL:
2449 size = 0x8;
2450 break;
2451 case 0x10000000UL:
2452 size = 0x9;
2453 break;
2454 case 0x40000000UL:
2455 size = 0xA;
2456 break;
2457 #if defined(TARGET_PPC64)
2458 case 0x000100000000ULL:
2459 size = 0xB;
2460 break;
2461 case 0x000400000000ULL:
2462 size = 0xC;
2463 break;
2464 case 0x001000000000ULL:
2465 size = 0xD;
2466 break;
2467 case 0x004000000000ULL:
2468 size = 0xE;
2469 break;
2470 case 0x010000000000ULL:
2471 size = 0xF;
2472 break;
2473 #endif
2474 default:
2475 size = -1;
2476 break;
2477 }
2478
2479 return size;
2480 }
2481
2482 /* Helpers for 4xx TLB management */
2483 #define PPC4XX_TLB_ENTRY_MASK 0x0000003f /* Mask for 64 TLB entries */
2484
2485 #define PPC4XX_TLBHI_V 0x00000040
2486 #define PPC4XX_TLBHI_E 0x00000020
2487 #define PPC4XX_TLBHI_SIZE_MIN 0
2488 #define PPC4XX_TLBHI_SIZE_MAX 7
2489 #define PPC4XX_TLBHI_SIZE_DEFAULT 1
2490 #define PPC4XX_TLBHI_SIZE_SHIFT 7
2491 #define PPC4XX_TLBHI_SIZE_MASK 0x00000007
2492
2493 #define PPC4XX_TLBLO_EX 0x00000200
2494 #define PPC4XX_TLBLO_WR 0x00000100
2495 #define PPC4XX_TLBLO_ATTR_MASK 0x000000FF
2496 #define PPC4XX_TLBLO_RPN_MASK 0xFFFFFC00
2497
2498 target_ulong helper_4xx_tlbre_hi(CPUPPCState *env, target_ulong entry)
2499 {
2500 ppcemb_tlb_t *tlb;
2501 target_ulong ret;
2502 int size;
2503
2504 entry &= PPC4XX_TLB_ENTRY_MASK;
2505 tlb = &env->tlb.tlbe[entry];
2506 ret = tlb->EPN;
2507 if (tlb->prot & PAGE_VALID) {
2508 ret |= PPC4XX_TLBHI_V;
2509 }
2510 size = booke_page_size_to_tlb(tlb->size);
2511 if (size < PPC4XX_TLBHI_SIZE_MIN || size > PPC4XX_TLBHI_SIZE_MAX) {
2512 size = PPC4XX_TLBHI_SIZE_DEFAULT;
2513 }
2514 ret |= size << PPC4XX_TLBHI_SIZE_SHIFT;
2515 env->spr[SPR_40x_PID] = tlb->PID;
2516 return ret;
2517 }
2518
2519 target_ulong helper_4xx_tlbre_lo(CPUPPCState *env, target_ulong entry)
2520 {
2521 ppcemb_tlb_t *tlb;
2522 target_ulong ret;
2523
2524 entry &= PPC4XX_TLB_ENTRY_MASK;
2525 tlb = &env->tlb.tlbe[entry];
2526 ret = tlb->RPN;
2527 if (tlb->prot & PAGE_EXEC) {
2528 ret |= PPC4XX_TLBLO_EX;
2529 }
2530 if (tlb->prot & PAGE_WRITE) {
2531 ret |= PPC4XX_TLBLO_WR;
2532 }
2533 return ret;
2534 }
2535
2536 void helper_4xx_tlbwe_hi(CPUPPCState *env, target_ulong entry,
2537 target_ulong val)
2538 {
2539 ppcemb_tlb_t *tlb;
2540 target_ulong page, end;
2541
2542 LOG_SWTLB("%s entry %d val " TARGET_FMT_lx "\n", __func__, (int)entry,
2543 val);
2544 entry &= PPC4XX_TLB_ENTRY_MASK;
2545 tlb = &env->tlb.tlbe[entry];
2546 /* Invalidate previous TLB (if it's valid) */
2547 if (tlb->prot & PAGE_VALID) {
2548 end = tlb->EPN + tlb->size;
2549 LOG_SWTLB("%s: invalidate old TLB %d start " TARGET_FMT_lx " end "
2550 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2551 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
2552 tlb_flush_page(env, page);
2553 }
2554 }
2555 tlb->size = booke_tlb_to_page_size((val >> PPC4XX_TLBHI_SIZE_SHIFT)
2556 & PPC4XX_TLBHI_SIZE_MASK);
2557 /* We cannot handle TLB size < TARGET_PAGE_SIZE.
2558 * If this ever occurs, one should use the ppcemb target instead
2559 * of the ppc or ppc64 one
2560 */
2561 if ((val & PPC4XX_TLBHI_V) && tlb->size < TARGET_PAGE_SIZE) {
2562 cpu_abort(env, "TLB size " TARGET_FMT_lu " < %u "
2563 "are not supported (%d)\n",
2564 tlb->size, TARGET_PAGE_SIZE, (int)((val >> 7) & 0x7));
2565 }
2566 tlb->EPN = val & ~(tlb->size - 1);
2567 if (val & PPC4XX_TLBHI_V) {
2568 tlb->prot |= PAGE_VALID;
2569 if (val & PPC4XX_TLBHI_E) {
2570 /* XXX: TO BE FIXED */
2571 cpu_abort(env,
2572 "Little-endian TLB entries are not supported by now\n");
2573 }
2574 } else {
2575 tlb->prot &= ~PAGE_VALID;
2576 }
2577 tlb->PID = env->spr[SPR_40x_PID]; /* PID */
2578 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2579 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2580 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2581 tlb->prot & PAGE_READ ? 'r' : '-',
2582 tlb->prot & PAGE_WRITE ? 'w' : '-',
2583 tlb->prot & PAGE_EXEC ? 'x' : '-',
2584 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2585 /* Invalidate new TLB (if valid) */
2586 if (tlb->prot & PAGE_VALID) {
2587 end = tlb->EPN + tlb->size;
2588 LOG_SWTLB("%s: invalidate TLB %d start " TARGET_FMT_lx " end "
2589 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2590 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
2591 tlb_flush_page(env, page);
2592 }
2593 }
2594 }
2595
2596 void helper_4xx_tlbwe_lo(CPUPPCState *env, target_ulong entry,
2597 target_ulong val)
2598 {
2599 ppcemb_tlb_t *tlb;
2600
2601 LOG_SWTLB("%s entry %i val " TARGET_FMT_lx "\n", __func__, (int)entry,
2602 val);
2603 entry &= PPC4XX_TLB_ENTRY_MASK;
2604 tlb = &env->tlb.tlbe[entry];
2605 tlb->attr = val & PPC4XX_TLBLO_ATTR_MASK;
2606 tlb->RPN = val & PPC4XX_TLBLO_RPN_MASK;
2607 tlb->prot = PAGE_READ;
2608 if (val & PPC4XX_TLBLO_EX) {
2609 tlb->prot |= PAGE_EXEC;
2610 }
2611 if (val & PPC4XX_TLBLO_WR) {
2612 tlb->prot |= PAGE_WRITE;
2613 }
2614 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2615 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2616 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2617 tlb->prot & PAGE_READ ? 'r' : '-',
2618 tlb->prot & PAGE_WRITE ? 'w' : '-',
2619 tlb->prot & PAGE_EXEC ? 'x' : '-',
2620 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2621 }
2622
2623 target_ulong helper_4xx_tlbsx(CPUPPCState *env, target_ulong address)
2624 {
2625 return ppcemb_tlb_search(env, address, env->spr[SPR_40x_PID]);
2626 }
2627
2628 /* PowerPC 440 TLB management */
2629 void helper_440_tlbwe(CPUPPCState *env, uint32_t word, target_ulong entry,
2630 target_ulong value)
2631 {
2632 ppcemb_tlb_t *tlb;
2633 target_ulong EPN, RPN, size;
2634 int do_flush_tlbs;
2635
2636 LOG_SWTLB("%s word %d entry %d value " TARGET_FMT_lx "\n",
2637 __func__, word, (int)entry, value);
2638 do_flush_tlbs = 0;
2639 entry &= 0x3F;
2640 tlb = &env->tlb.tlbe[entry];
2641 switch (word) {
2642 default:
2643 /* Just here to please gcc */
2644 case 0:
2645 EPN = value & 0xFFFFFC00;
2646 if ((tlb->prot & PAGE_VALID) && EPN != tlb->EPN) {
2647 do_flush_tlbs = 1;
2648 }
2649 tlb->EPN = EPN;
2650 size = booke_tlb_to_page_size((value >> 4) & 0xF);
2651 if ((tlb->prot & PAGE_VALID) && tlb->size < size) {
2652 do_flush_tlbs = 1;
2653 }
2654 tlb->size = size;
2655 tlb->attr &= ~0x1;
2656 tlb->attr |= (value >> 8) & 1;
2657 if (value & 0x200) {
2658 tlb->prot |= PAGE_VALID;
2659 } else {
2660 if (tlb->prot & PAGE_VALID) {
2661 tlb->prot &= ~PAGE_VALID;
2662 do_flush_tlbs = 1;
2663 }
2664 }
2665 tlb->PID = env->spr[SPR_440_MMUCR] & 0x000000FF;
2666 if (do_flush_tlbs) {
2667 tlb_flush(env, 1);
2668 }
2669 break;
2670 case 1:
2671 RPN = value & 0xFFFFFC0F;
2672 if ((tlb->prot & PAGE_VALID) && tlb->RPN != RPN) {
2673 tlb_flush(env, 1);
2674 }
2675 tlb->RPN = RPN;
2676 break;
2677 case 2:
2678 tlb->attr = (tlb->attr & 0x1) | (value & 0x0000FF00);
2679 tlb->prot = tlb->prot & PAGE_VALID;
2680 if (value & 0x1) {
2681 tlb->prot |= PAGE_READ << 4;
2682 }
2683 if (value & 0x2) {
2684 tlb->prot |= PAGE_WRITE << 4;
2685 }
2686 if (value & 0x4) {
2687 tlb->prot |= PAGE_EXEC << 4;
2688 }
2689 if (value & 0x8) {
2690 tlb->prot |= PAGE_READ;
2691 }
2692 if (value & 0x10) {
2693 tlb->prot |= PAGE_WRITE;
2694 }
2695 if (value & 0x20) {
2696 tlb->prot |= PAGE_EXEC;
2697 }
2698 break;
2699 }
2700 }
2701
2702 target_ulong helper_440_tlbre(CPUPPCState *env, uint32_t word,
2703 target_ulong entry)
2704 {
2705 ppcemb_tlb_t *tlb;
2706 target_ulong ret;
2707 int size;
2708
2709 entry &= 0x3F;
2710 tlb = &env->tlb.tlbe[entry];
2711 switch (word) {
2712 default:
2713 /* Just here to please gcc */
2714 case 0:
2715 ret = tlb->EPN;
2716 size = booke_page_size_to_tlb(tlb->size);
2717 if (size < 0 || size > 0xF) {
2718 size = 1;
2719 }
2720 ret |= size << 4;
2721 if (tlb->attr & 0x1) {
2722 ret |= 0x100;
2723 }
2724 if (tlb->prot & PAGE_VALID) {
2725 ret |= 0x200;
2726 }
2727 env->spr[SPR_440_MMUCR] &= ~0x000000FF;
2728 env->spr[SPR_440_MMUCR] |= tlb->PID;
2729 break;
2730 case 1:
2731 ret = tlb->RPN;
2732 break;
2733 case 2:
2734 ret = tlb->attr & ~0x1;
2735 if (tlb->prot & (PAGE_READ << 4)) {
2736 ret |= 0x1;
2737 }
2738 if (tlb->prot & (PAGE_WRITE << 4)) {
2739 ret |= 0x2;
2740 }
2741 if (tlb->prot & (PAGE_EXEC << 4)) {
2742 ret |= 0x4;
2743 }
2744 if (tlb->prot & PAGE_READ) {
2745 ret |= 0x8;
2746 }
2747 if (tlb->prot & PAGE_WRITE) {
2748 ret |= 0x10;
2749 }
2750 if (tlb->prot & PAGE_EXEC) {
2751 ret |= 0x20;
2752 }
2753 break;
2754 }
2755 return ret;
2756 }
2757
2758 target_ulong helper_440_tlbsx(CPUPPCState *env, target_ulong address)
2759 {
2760 return ppcemb_tlb_search(env, address, env->spr[SPR_440_MMUCR] & 0xFF);
2761 }
2762
2763 /* PowerPC BookE 2.06 TLB management */
2764
2765 static ppcmas_tlb_t *booke206_cur_tlb(CPUPPCState *env)
2766 {
2767 uint32_t tlbncfg = 0;
2768 int esel = (env->spr[SPR_BOOKE_MAS0] & MAS0_ESEL_MASK) >> MAS0_ESEL_SHIFT;
2769 int ea = (env->spr[SPR_BOOKE_MAS2] & MAS2_EPN_MASK);
2770 int tlb;
2771
2772 tlb = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2773 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlb];
2774
2775 if ((tlbncfg & TLBnCFG_HES) && (env->spr[SPR_BOOKE_MAS0] & MAS0_HES)) {
2776 cpu_abort(env, "we don't support HES yet\n");
2777 }
2778
2779 return booke206_get_tlbm(env, tlb, ea, esel);
2780 }
2781
2782 void helper_booke_setpid(CPUPPCState *env, uint32_t pidn, target_ulong pid)
2783 {
2784 env->spr[pidn] = pid;
2785 /* changing PIDs mean we're in a different address space now */
2786 tlb_flush(env, 1);
2787 }
2788
2789 void helper_booke206_tlbwe(CPUPPCState *env)
2790 {
2791 uint32_t tlbncfg, tlbn;
2792 ppcmas_tlb_t *tlb;
2793 uint32_t size_tlb, size_ps;
2794 target_ulong mask;
2795
2796
2797 switch (env->spr[SPR_BOOKE_MAS0] & MAS0_WQ_MASK) {
2798 case MAS0_WQ_ALWAYS:
2799 /* good to go, write that entry */
2800 break;
2801 case MAS0_WQ_COND:
2802 /* XXX check if reserved */
2803 if (0) {
2804 return;
2805 }
2806 break;
2807 case MAS0_WQ_CLR_RSRV:
2808 /* XXX clear entry */
2809 return;
2810 default:
2811 /* no idea what to do */
2812 return;
2813 }
2814
2815 if (((env->spr[SPR_BOOKE_MAS0] & MAS0_ATSEL) == MAS0_ATSEL_LRAT) &&
2816 !msr_gs) {
2817 /* XXX we don't support direct LRAT setting yet */
2818 fprintf(stderr, "cpu: don't support LRAT setting yet\n");
2819 return;
2820 }
2821
2822 tlbn = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2823 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlbn];
2824
2825 tlb = booke206_cur_tlb(env);
2826
2827 if (!tlb) {
2828 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
2829 POWERPC_EXCP_INVAL |
2830 POWERPC_EXCP_INVAL_INVAL);
2831 }
2832
2833 /* check that we support the targeted size */
2834 size_tlb = (env->spr[SPR_BOOKE_MAS1] & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
2835 size_ps = booke206_tlbnps(env, tlbn);
2836 if ((env->spr[SPR_BOOKE_MAS1] & MAS1_VALID) && (tlbncfg & TLBnCFG_AVAIL) &&
2837 !(size_ps & (1 << size_tlb))) {
2838 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
2839 POWERPC_EXCP_INVAL |
2840 POWERPC_EXCP_INVAL_INVAL);
2841 }
2842
2843 if (msr_gs) {
2844 cpu_abort(env, "missing HV implementation\n");
2845 }
2846 tlb->mas7_3 = ((uint64_t)env->spr[SPR_BOOKE_MAS7] << 32) |
2847 env->spr[SPR_BOOKE_MAS3];
2848 tlb->mas1 = env->spr[SPR_BOOKE_MAS1];
2849
2850 /* MAV 1.0 only */
2851 if (!(tlbncfg & TLBnCFG_AVAIL)) {
2852 /* force !AVAIL TLB entries to correct page size */
2853 tlb->mas1 &= ~MAS1_TSIZE_MASK;
2854 /* XXX can be configured in MMUCSR0 */
2855 tlb->mas1 |= (tlbncfg & TLBnCFG_MINSIZE) >> 12;
2856 }
2857
2858 /* Make a mask from TLB size to discard invalid bits in EPN field */
2859 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2860 /* Add a mask for page attributes */
2861 mask |= MAS2_ACM | MAS2_VLE | MAS2_W | MAS2_I | MAS2_M | MAS2_G | MAS2_E;
2862
2863 if (!msr_cm) {
2864 /* Executing a tlbwe instruction in 32-bit mode will set
2865 * bits 0:31 of the TLB EPN field to zero.
2866 */
2867 mask &= 0xffffffff;
2868 }
2869
2870 tlb->mas2 = env->spr[SPR_BOOKE_MAS2] & mask;
2871
2872 if (!(tlbncfg & TLBnCFG_IPROT)) {
2873 /* no IPROT supported by TLB */
2874 tlb->mas1 &= ~MAS1_IPROT;
2875 }
2876
2877 if (booke206_tlb_to_page_size(env, tlb) == TARGET_PAGE_SIZE) {
2878 tlb_flush_page(env, tlb->mas2 & MAS2_EPN_MASK);
2879 } else {
2880 tlb_flush(env, 1);
2881 }
2882 }
2883
2884 static inline void booke206_tlb_to_mas(CPUPPCState *env, ppcmas_tlb_t *tlb)
2885 {
2886 int tlbn = booke206_tlbm_to_tlbn(env, tlb);
2887 int way = booke206_tlbm_to_way(env, tlb);
2888
2889 env->spr[SPR_BOOKE_MAS0] = tlbn << MAS0_TLBSEL_SHIFT;
2890 env->spr[SPR_BOOKE_MAS0] |= way << MAS0_ESEL_SHIFT;
2891 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2892
2893 env->spr[SPR_BOOKE_MAS1] = tlb->mas1;
2894 env->spr[SPR_BOOKE_MAS2] = tlb->mas2;
2895 env->spr[SPR_BOOKE_MAS3] = tlb->mas7_3;
2896 env->spr[SPR_BOOKE_MAS7] = tlb->mas7_3 >> 32;
2897 }
2898
2899 void helper_booke206_tlbre(CPUPPCState *env)
2900 {
2901 ppcmas_tlb_t *tlb = NULL;
2902
2903 tlb = booke206_cur_tlb(env);
2904 if (!tlb) {
2905 env->spr[SPR_BOOKE_MAS1] = 0;
2906 } else {
2907 booke206_tlb_to_mas(env, tlb);
2908 }
2909 }
2910
2911 void helper_booke206_tlbsx(CPUPPCState *env, target_ulong address)
2912 {
2913 ppcmas_tlb_t *tlb = NULL;
2914 int i, j;
2915 hwaddr raddr;
2916 uint32_t spid, sas;
2917
2918 spid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID_MASK) >> MAS6_SPID_SHIFT;
2919 sas = env->spr[SPR_BOOKE_MAS6] & MAS6_SAS;
2920
2921 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2922 int ways = booke206_tlb_ways(env, i);
2923
2924 for (j = 0; j < ways; j++) {
2925 tlb = booke206_get_tlbm(env, i, address, j);
2926
2927 if (!tlb) {
2928 continue;
2929 }
2930
2931 if (ppcmas_tlb_check(env, tlb, &raddr, address, spid)) {
2932 continue;
2933 }
2934
2935 if (sas != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
2936 continue;
2937 }
2938
2939 booke206_tlb_to_mas(env, tlb);
2940 return;
2941 }
2942 }
2943
2944 /* no entry found, fill with defaults */
2945 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
2946 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
2947 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
2948 env->spr[SPR_BOOKE_MAS3] = 0;
2949 env->spr[SPR_BOOKE_MAS7] = 0;
2950
2951 if (env->spr[SPR_BOOKE_MAS6] & MAS6_SAS) {
2952 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
2953 }
2954
2955 env->spr[SPR_BOOKE_MAS1] |= (env->spr[SPR_BOOKE_MAS6] >> 16)
2956 << MAS1_TID_SHIFT;
2957
2958 /* next victim logic */
2959 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
2960 env->last_way++;
2961 env->last_way &= booke206_tlb_ways(env, 0) - 1;
2962 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2963 }
2964
2965 static inline void booke206_invalidate_ea_tlb(CPUPPCState *env, int tlbn,
2966 uint32_t ea)
2967 {
2968 int i;
2969 int ways = booke206_tlb_ways(env, tlbn);
2970 target_ulong mask;
2971
2972 for (i = 0; i < ways; i++) {
2973 ppcmas_tlb_t *tlb = booke206_get_tlbm(env, tlbn, ea, i);
2974 if (!tlb) {
2975 continue;
2976 }
2977 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2978 if (((tlb->mas2 & MAS2_EPN_MASK) == (ea & mask)) &&
2979 !(tlb->mas1 & MAS1_IPROT)) {
2980 tlb->mas1 &= ~MAS1_VALID;
2981 }
2982 }
2983 }
2984
2985 void helper_booke206_tlbivax(CPUPPCState *env, target_ulong address)
2986 {
2987 if (address & 0x4) {
2988 /* flush all entries */
2989 if (address & 0x8) {
2990 /* flush all of TLB1 */
2991 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB1, 1);
2992 } else {
2993 /* flush all of TLB0 */
2994 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB0, 0);
2995 }
2996 return;
2997 }
2998
2999 if (address & 0x8) {
3000 /* flush TLB1 entries */
3001 booke206_invalidate_ea_tlb(env, 1, address);
3002 tlb_flush(env, 1);
3003 } else {
3004 /* flush TLB0 entries */
3005 booke206_invalidate_ea_tlb(env, 0, address);
3006 tlb_flush_page(env, address & MAS2_EPN_MASK);
3007 }
3008 }
3009
3010 void helper_booke206_tlbilx0(CPUPPCState *env, target_ulong address)
3011 {
3012 /* XXX missing LPID handling */
3013 booke206_flush_tlb(env, -1, 1);
3014 }
3015
3016 void helper_booke206_tlbilx1(CPUPPCState *env, target_ulong address)
3017 {
3018 int i, j;
3019 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
3020 ppcmas_tlb_t *tlb = env->tlb.tlbm;
3021 int tlb_size;
3022
3023 /* XXX missing LPID handling */
3024 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
3025 tlb_size = booke206_tlb_size(env, i);
3026 for (j = 0; j < tlb_size; j++) {
3027 if (!(tlb[j].mas1 & MAS1_IPROT) &&
3028 ((tlb[j].mas1 & MAS1_TID_MASK) == tid)) {
3029 tlb[j].mas1 &= ~MAS1_VALID;
3030 }
3031 }
3032 tlb += booke206_tlb_size(env, i);
3033 }
3034 tlb_flush(env, 1);
3035 }
3036
3037 void helper_booke206_tlbilx3(CPUPPCState *env, target_ulong address)
3038 {
3039 int i, j;
3040 ppcmas_tlb_t *tlb;
3041 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
3042 int pid = tid >> MAS6_SPID_SHIFT;
3043 int sgs = env->spr[SPR_BOOKE_MAS5] & MAS5_SGS;
3044 int ind = (env->spr[SPR_BOOKE_MAS6] & MAS6_SIND) ? MAS1_IND : 0;
3045 /* XXX check for unsupported isize and raise an invalid opcode then */
3046 int size = env->spr[SPR_BOOKE_MAS6] & MAS6_ISIZE_MASK;
3047 /* XXX implement MAV2 handling */
3048 bool mav2 = false;
3049
3050 /* XXX missing LPID handling */
3051 /* flush by pid and ea */
3052 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
3053 int ways = booke206_tlb_ways(env, i);
3054
3055 for (j = 0; j < ways; j++) {
3056 tlb = booke206_get_tlbm(env, i, address, j);
3057 if (!tlb) {
3058 continue;
3059 }
3060 if ((ppcmas_tlb_check(env, tlb, NULL, address, pid) != 0) ||
3061 (tlb->mas1 & MAS1_IPROT) ||
3062 ((tlb->mas1 & MAS1_IND) != ind) ||
3063 ((tlb->mas8 & MAS8_TGS) != sgs)) {
3064 continue;
3065 }
3066 if (mav2 && ((tlb->mas1 & MAS1_TSIZE_MASK) != size)) {
3067 /* XXX only check when MMUCFG[TWC] || TLBnCFG[HES] */
3068 continue;
3069 }
3070 /* XXX e500mc doesn't match SAS, but other cores might */
3071 tlb->mas1 &= ~MAS1_VALID;
3072 }
3073 }
3074 tlb_flush(env, 1);
3075 }
3076
3077 void helper_booke206_tlbflush(CPUPPCState *env, uint32_t type)
3078 {
3079 int flags = 0;
3080
3081 if (type & 2) {
3082 flags |= BOOKE206_FLUSH_TLB1;
3083 }
3084
3085 if (type & 4) {
3086 flags |= BOOKE206_FLUSH_TLB0;
3087 }
3088
3089 booke206_flush_tlb(env, flags, 1);
3090 }
3091 #endif
QEMU mirror