target-s390x/helper.c

   1 /*
   2  *  S/390 helpers
   3  *
   4  *  Copyright (c) 2009 Ulrich Hecht
   5  *  Copyright (c) 2011 Alexander Graf
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "cpu.h"
  22 #include "gdbstub.h"
  23 #include "qemu-timer.h"
  24 #ifndef CONFIG_USER_ONLY
  25 #include "sysemu.h"
  26 #endif
  27
  28 //#define DEBUG_S390
  29 //#define DEBUG_S390_PTE
  30 //#define DEBUG_S390_STDOUT
  31
  32 #ifdef DEBUG_S390
  33 #ifdef DEBUG_S390_STDOUT
  34 #define DPRINTF(fmt, ...) \
  35     do { fprintf(stderr, fmt, ## __VA_ARGS__); \
  36          qemu_log(fmt, ##__VA_ARGS__); } while (0)
  37 #else
  38 #define DPRINTF(fmt, ...) \
  39     do { qemu_log(fmt, ## __VA_ARGS__); } while (0)
  40 #endif
  41 #else
  42 #define DPRINTF(fmt, ...) \
  43     do { } while (0)
  44 #endif
  45
  46 #ifdef DEBUG_S390_PTE
  47 #define PTE_DPRINTF DPRINTF
  48 #else
  49 #define PTE_DPRINTF(fmt, ...) \
  50     do { } while (0)
  51 #endif
  52
  53 #ifndef CONFIG_USER_ONLY
  54 static void s390x_tod_timer(void *opaque)
  55 {
  56     CPUS390XState *env = opaque;
  57
  58     env->pending_int |= INTERRUPT_TOD;
  59     cpu_interrupt(env, CPU_INTERRUPT_HARD);
  60 }
  61
  62 static void s390x_cpu_timer(void *opaque)
  63 {
  64     CPUS390XState *env = opaque;
  65
  66     env->pending_int |= INTERRUPT_CPUTIMER;
  67     cpu_interrupt(env, CPU_INTERRUPT_HARD);
  68 }
  69 #endif
  70
  71 CPUS390XState *cpu_s390x_init(const char *cpu_model)
  72 {
  73     S390CPU *cpu;
  74     CPUS390XState *env;
  75 #if !defined (CONFIG_USER_ONLY)
  76     struct tm tm;
  77 #endif
  78     static int inited = 0;
  79     static int cpu_num = 0;
  80
  81     cpu = S390_CPU(object_new(TYPE_S390_CPU));
  82     env = &cpu->env;
  83     cpu_exec_init(env);
  84     if (tcg_enabled() && !inited) {
  85         inited = 1;
  86         s390x_translate_init();
  87     }
  88
  89 #if !defined(CONFIG_USER_ONLY)
  90     qemu_get_timedate(&tm, 0);
  91     env->tod_offset = TOD_UNIX_EPOCH +
  92                       (time2tod(mktimegm(&tm)) * 1000000000ULL);
  93     env->tod_basetime = 0;
  94     env->tod_timer = qemu_new_timer_ns(vm_clock, s390x_tod_timer, env);
  95     env->cpu_timer = qemu_new_timer_ns(vm_clock, s390x_cpu_timer, env);
  96 #endif
  97     env->cpu_model_str = cpu_model;
  98     env->cpu_num = cpu_num++;
  99     env->ext_index = -1;
 100     cpu_state_reset(env);
 101     qemu_init_vcpu(env);
 102     return env;
 103 }
 104
 105 #if defined(CONFIG_USER_ONLY)
 106
 107 void do_interrupt (CPUS390XState *env)
 108 {
 109     env->exception_index = -1;
 110 }
 111
 112 int cpu_s390x_handle_mmu_fault (CPUS390XState *env, target_ulong address, int rw,
 113                                 int mmu_idx)
 114 {
 115     /* fprintf(stderr,"%s: address 0x%lx rw %d mmu_idx %d\n",
 116             __FUNCTION__, address, rw, mmu_idx); */
 117     env->exception_index = EXCP_ADDR;
 118     env->__excp_addr = address; /* FIXME: find out how this works on a real machine */
 119     return 1;
 120 }
 121
 122 #endif /* CONFIG_USER_ONLY */
 123
 124 void cpu_state_reset(CPUS390XState *env)
 125 {
 126     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
 127         qemu_log("CPU Reset (CPU %d)\n", env->cpu_index);
 128         log_cpu_state(env, 0);
 129     }
 130
 131     memset(env, 0, offsetof(CPUS390XState, breakpoints));
 132     /* FIXME: reset vector? */
 133     tlb_flush(env, 1);
 134     s390_add_running_cpu(env);
 135 }
 136
 137 #ifndef CONFIG_USER_ONLY
 138
 139 /* Ensure to exit the TB after this call! */
 140 static void trigger_pgm_exception(CPUS390XState *env, uint32_t code, uint32_t ilc)
 141 {
 142     env->exception_index = EXCP_PGM;
 143     env->int_pgm_code = code;
 144     env->int_pgm_ilc = ilc;
 145 }
 146
 147 static int trans_bits(CPUS390XState *env, uint64_t mode)
 148 {
 149     int bits = 0;
 150
 151     switch (mode) {
 152     case PSW_ASC_PRIMARY:
 153         bits = 1;
 154         break;
 155     case PSW_ASC_SECONDARY:
 156         bits = 2;
 157         break;
 158     case PSW_ASC_HOME:
 159         bits = 3;
 160         break;
 161     default:
 162         cpu_abort(env, "unknown asc mode\n");
 163         break;
 164     }
 165
 166     return bits;
 167 }
 168
 169 static void trigger_prot_fault(CPUS390XState *env, target_ulong vaddr, uint64_t mode)
 170 {
 171     int ilc = ILC_LATER_INC_2;
 172     int bits = trans_bits(env, mode) | 4;
 173
 174     DPRINTF("%s: vaddr=%016" PRIx64 " bits=%d\n", __FUNCTION__, vaddr, bits);
 175
 176     stq_phys(env->psa + offsetof(LowCore, trans_exc_code), vaddr | bits);
 177     trigger_pgm_exception(env, PGM_PROTECTION, ilc);
 178 }
 179
 180 static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr, uint32_t type,
 181                                uint64_t asc, int rw)
 182 {
 183     int ilc = ILC_LATER;
 184     int bits = trans_bits(env, asc);
 185
 186     if (rw == 2) {
 187         /* code has is undefined ilc */
 188         ilc = 2;
 189     }
 190
 191     DPRINTF("%s: vaddr=%016" PRIx64 " bits=%d\n", __FUNCTION__, vaddr, bits);
 192
 193     stq_phys(env->psa + offsetof(LowCore, trans_exc_code), vaddr | bits);
 194     trigger_pgm_exception(env, type, ilc);
 195 }
 196
 197 static int mmu_translate_asce(CPUS390XState *env, target_ulong vaddr, uint64_t asc,
 198                               uint64_t asce, int level, target_ulong *raddr,
 199                               int *flags, int rw)
 200 {
 201     uint64_t offs = 0;
 202     uint64_t origin;
 203     uint64_t new_asce;
 204
 205     PTE_DPRINTF("%s: 0x%" PRIx64 "\n", __FUNCTION__, asce);
 206
 207     if (((level != _ASCE_TYPE_SEGMENT) && (asce & _REGION_ENTRY_INV)) ||
 208         ((level == _ASCE_TYPE_SEGMENT) && (asce & _SEGMENT_ENTRY_INV))) {
 209         /* XXX different regions have different faults */
 210         DPRINTF("%s: invalid region\n", __FUNCTION__);
 211         trigger_page_fault(env, vaddr, PGM_SEGMENT_TRANS, asc, rw);
 212         return -1;
 213     }
 214
 215     if ((level <= _ASCE_TYPE_MASK) && ((asce & _ASCE_TYPE_MASK) != level)) {
 216         trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw);
 217         return -1;
 218     }
 219
 220     if (asce & _ASCE_REAL_SPACE) {
 221         /* direct mapping */
 222
 223         *raddr = vaddr;
 224         return 0;
 225     }
 226
 227     origin = asce & _ASCE_ORIGIN;
 228
 229     switch (level) {
 230     case _ASCE_TYPE_REGION1 + 4:
 231         offs = (vaddr >> 50) & 0x3ff8;
 232         break;
 233     case _ASCE_TYPE_REGION1:
 234         offs = (vaddr >> 39) & 0x3ff8;
 235         break;
 236     case _ASCE_TYPE_REGION2:
 237         offs = (vaddr >> 28) & 0x3ff8;
 238         break;
 239     case _ASCE_TYPE_REGION3:
 240         offs = (vaddr >> 17) & 0x3ff8;
 241         break;
 242     case _ASCE_TYPE_SEGMENT:
 243         offs = (vaddr >> 9) & 0x07f8;
 244         origin = asce & _SEGMENT_ENTRY_ORIGIN;
 245         break;
 246     }
 247
 248     /* XXX region protection flags */
 249     /* *flags &= ~PAGE_WRITE */
 250
 251     new_asce = ldq_phys(origin + offs);
 252     PTE_DPRINTF("%s: 0x%" PRIx64 " + 0x%" PRIx64 " => 0x%016" PRIx64 "\n",
 253                 __FUNCTION__, origin, offs, new_asce);
 254
 255     if (level != _ASCE_TYPE_SEGMENT) {
 256         /* yet another region */
 257         return mmu_translate_asce(env, vaddr, asc, new_asce, level - 4, raddr,
 258                                   flags, rw);
 259     }
 260
 261     /* PTE */
 262     if (new_asce & _PAGE_INVALID) {
 263         DPRINTF("%s: PTE=0x%" PRIx64 " invalid\n", __FUNCTION__, new_asce);
 264         trigger_page_fault(env, vaddr, PGM_PAGE_TRANS, asc, rw);
 265         return -1;
 266     }
 267
 268     if (new_asce & _PAGE_RO) {
 269         *flags &= ~PAGE_WRITE;
 270     }
 271
 272     *raddr = new_asce & _ASCE_ORIGIN;
 273
 274     PTE_DPRINTF("%s: PTE=0x%" PRIx64 "\n", __FUNCTION__, new_asce);
 275
 276     return 0;
 277 }
 278
 279 static int mmu_translate_asc(CPUS390XState *env, target_ulong vaddr, uint64_t asc,
 280                              target_ulong *raddr, int *flags, int rw)
 281 {
 282     uint64_t asce = 0;
 283     int level, new_level;
 284     int r;
 285
 286     switch (asc) {
 287     case PSW_ASC_PRIMARY:
 288         PTE_DPRINTF("%s: asc=primary\n", __FUNCTION__);
 289         asce = env->cregs[1];
 290         break;
 291     case PSW_ASC_SECONDARY:
 292         PTE_DPRINTF("%s: asc=secondary\n", __FUNCTION__);
 293         asce = env->cregs[7];
 294         break;
 295     case PSW_ASC_HOME:
 296         PTE_DPRINTF("%s: asc=home\n", __FUNCTION__);
 297         asce = env->cregs[13];
 298         break;
 299     }
 300
 301     switch (asce & _ASCE_TYPE_MASK) {
 302     case _ASCE_TYPE_REGION1:
 303         break;
 304     case _ASCE_TYPE_REGION2:
 305         if (vaddr & 0xffe0000000000000ULL) {
 306             DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
 307                         " 0xffe0000000000000ULL\n", __FUNCTION__,
 308                         vaddr);
 309             trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw);
 310             return -1;
 311         }
 312         break;
 313     case _ASCE_TYPE_REGION3:
 314         if (vaddr & 0xfffffc0000000000ULL) {
 315             DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
 316                         " 0xfffffc0000000000ULL\n", __FUNCTION__,
 317                         vaddr);
 318             trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw);
 319             return -1;
 320         }
 321         break;
 322     case _ASCE_TYPE_SEGMENT:
 323         if (vaddr & 0xffffffff80000000ULL) {
 324             DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
 325                         " 0xffffffff80000000ULL\n", __FUNCTION__,
 326                         vaddr);
 327             trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw);
 328             return -1;
 329         }
 330         break;
 331     }
 332
 333     /* fake level above current */
 334     level = asce & _ASCE_TYPE_MASK;
 335     new_level = level + 4;
 336     asce = (asce & ~_ASCE_TYPE_MASK) | (new_level & _ASCE_TYPE_MASK);
 337
 338     r = mmu_translate_asce(env, vaddr, asc, asce, new_level, raddr, flags, rw);
 339
 340     if ((rw == 1) && !(*flags & PAGE_WRITE)) {
 341         trigger_prot_fault(env, vaddr, asc);
 342         return -1;
 343     }
 344
 345     return r;
 346 }
 347
 348 int mmu_translate(CPUS390XState *env, target_ulong vaddr, int rw, uint64_t asc,
 349                   target_ulong *raddr, int *flags)
 350 {
 351     int r = -1;
 352     uint8_t *sk;
 353
 354     *flags = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 355     vaddr &= TARGET_PAGE_MASK;
 356
 357     if (!(env->psw.mask & PSW_MASK_DAT)) {
 358         *raddr = vaddr;
 359         r = 0;
 360         goto out;
 361     }
 362
 363     switch (asc) {
 364     case PSW_ASC_PRIMARY:
 365     case PSW_ASC_HOME:
 366         r = mmu_translate_asc(env, vaddr, asc, raddr, flags, rw);
 367         break;
 368     case PSW_ASC_SECONDARY:
 369         /*
 370          * Instruction: Primary
 371          * Data: Secondary
 372          */
 373         if (rw == 2) {
 374             r = mmu_translate_asc(env, vaddr, PSW_ASC_PRIMARY, raddr, flags,
 375                                   rw);
 376             *flags &= ~(PAGE_READ | PAGE_WRITE);
 377         } else {
 378             r = mmu_translate_asc(env, vaddr, PSW_ASC_SECONDARY, raddr, flags,
 379                                   rw);
 380             *flags &= ~(PAGE_EXEC);
 381         }
 382         break;
 383     case PSW_ASC_ACCREG:
 384     default:
 385         hw_error("guest switched to unknown asc mode\n");
 386         break;
 387     }
 388
 389 out:
 390     /* Convert real address -> absolute address */
 391     if (*raddr < 0x2000) {
 392         *raddr = *raddr + env->psa;
 393     }
 394
 395     if (*raddr <= ram_size) {
 396         sk = &env->storage_keys[*raddr / TARGET_PAGE_SIZE];
 397         if (*flags & PAGE_READ) {
 398             *sk |= SK_R;
 399         }
 400
 401         if (*flags & PAGE_WRITE) {
 402             *sk |= SK_C;
 403         }
 404     }
 405
 406     return r;
 407 }
 408
 409 int cpu_s390x_handle_mmu_fault (CPUS390XState *env, target_ulong _vaddr, int rw,
 410                                 int mmu_idx)
 411 {
 412     uint64_t asc = env->psw.mask & PSW_MASK_ASC;
 413     target_ulong vaddr, raddr;
 414     int prot;
 415
 416     DPRINTF("%s: address 0x%" PRIx64 " rw %d mmu_idx %d\n",
 417             __FUNCTION__, _vaddr, rw, mmu_idx);
 418
 419     _vaddr &= TARGET_PAGE_MASK;
 420     vaddr = _vaddr;
 421
 422     /* 31-Bit mode */
 423     if (!(env->psw.mask & PSW_MASK_64)) {
 424         vaddr &= 0x7fffffff;
 425     }
 426
 427     if (mmu_translate(env, vaddr, rw, asc, &raddr, &prot)) {
 428         /* Translation ended in exception */
 429         return 1;
 430     }
 431
 432     /* check out of RAM access */
 433     if (raddr > (ram_size + virtio_size)) {
 434         DPRINTF("%s: aaddr %" PRIx64 " > ram_size %" PRIx64 "\n", __FUNCTION__,
 435                 (uint64_t)aaddr, (uint64_t)ram_size);
 436         trigger_pgm_exception(env, PGM_ADDRESSING, ILC_LATER);
 437         return 1;
 438     }
 439
 440     DPRINTF("%s: set tlb %" PRIx64 " -> %" PRIx64 " (%x)\n", __FUNCTION__,
 441             (uint64_t)vaddr, (uint64_t)raddr, prot);
 442
 443     tlb_set_page(env, _vaddr, raddr, prot,
 444                  mmu_idx, TARGET_PAGE_SIZE);
 445
 446     return 0;
 447 }
 448
 449 target_phys_addr_t cpu_get_phys_page_debug(CPUS390XState *env, target_ulong vaddr)
 450 {
 451     target_ulong raddr;
 452     int prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 453     int old_exc = env->exception_index;
 454     uint64_t asc = env->psw.mask & PSW_MASK_ASC;
 455
 456     /* 31-Bit mode */
 457     if (!(env->psw.mask & PSW_MASK_64)) {
 458         vaddr &= 0x7fffffff;
 459     }
 460
 461     mmu_translate(env, vaddr, 2, asc, &raddr, &prot);
 462     env->exception_index = old_exc;
 463
 464     return raddr;
 465 }
 466
 467 void load_psw(CPUS390XState *env, uint64_t mask, uint64_t addr)
 468 {
 469     if (mask & PSW_MASK_WAIT) {
 470         if (!(mask & (PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK))) {
 471             if (s390_del_running_cpu(env) == 0) {
 472 #ifndef CONFIG_USER_ONLY
 473                 qemu_system_shutdown_request();
 474 #endif
 475             }
 476         }
 477         env->halted = 1;
 478         env->exception_index = EXCP_HLT;
 479     }
 480
 481     env->psw.addr = addr;
 482     env->psw.mask = mask;
 483     env->cc_op = (mask >> 13) & 3;
 484 }
 485
 486 static uint64_t get_psw_mask(CPUS390XState *env)
 487 {
 488     uint64_t r = env->psw.mask;
 489
 490     env->cc_op = calc_cc(env, env->cc_op, env->cc_src, env->cc_dst, env->cc_vr);
 491
 492     r &= ~(3ULL << 13);
 493     assert(!(env->cc_op & ~3));
 494     r |= env->cc_op << 13;
 495
 496     return r;
 497 }
 498
 499 static void do_svc_interrupt(CPUS390XState *env)
 500 {
 501     uint64_t mask, addr;
 502     LowCore *lowcore;
 503     target_phys_addr_t len = TARGET_PAGE_SIZE;
 504
 505     lowcore = cpu_physical_memory_map(env->psa, &len, 1);
 506
 507     lowcore->svc_code = cpu_to_be16(env->int_svc_code);
 508     lowcore->svc_ilc = cpu_to_be16(env->int_svc_ilc);
 509     lowcore->svc_old_psw.mask = cpu_to_be64(get_psw_mask(env));
 510     lowcore->svc_old_psw.addr = cpu_to_be64(env->psw.addr + (env->int_svc_ilc));
 511     mask = be64_to_cpu(lowcore->svc_new_psw.mask);
 512     addr = be64_to_cpu(lowcore->svc_new_psw.addr);
 513
 514     cpu_physical_memory_unmap(lowcore, len, 1, len);
 515
 516     load_psw(env, mask, addr);
 517 }
 518
 519 static void do_program_interrupt(CPUS390XState *env)
 520 {
 521     uint64_t mask, addr;
 522     LowCore *lowcore;
 523     target_phys_addr_t len = TARGET_PAGE_SIZE;
 524     int ilc = env->int_pgm_ilc;
 525
 526     switch (ilc) {
 527     case ILC_LATER:
 528         ilc = get_ilc(ldub_code(env->psw.addr));
 529         break;
 530     case ILC_LATER_INC:
 531         ilc = get_ilc(ldub_code(env->psw.addr));
 532         env->psw.addr += ilc * 2;
 533         break;
 534     case ILC_LATER_INC_2:
 535         ilc = get_ilc(ldub_code(env->psw.addr)) * 2;
 536         env->psw.addr += ilc;
 537         break;
 538     }
 539
 540     qemu_log("%s: code=0x%x ilc=%d\n", __FUNCTION__, env->int_pgm_code, ilc);
 541
 542     lowcore = cpu_physical_memory_map(env->psa, &len, 1);
 543
 544     lowcore->pgm_ilc = cpu_to_be16(ilc);
 545     lowcore->pgm_code = cpu_to_be16(env->int_pgm_code);
 546     lowcore->program_old_psw.mask = cpu_to_be64(get_psw_mask(env));
 547     lowcore->program_old_psw.addr = cpu_to_be64(env->psw.addr);
 548     mask = be64_to_cpu(lowcore->program_new_psw.mask);
 549     addr = be64_to_cpu(lowcore->program_new_psw.addr);
 550
 551     cpu_physical_memory_unmap(lowcore, len, 1, len);
 552
 553     DPRINTF("%s: %x %x %" PRIx64 " %" PRIx64 "\n", __FUNCTION__,
 554             env->int_pgm_code, ilc, env->psw.mask,
 555             env->psw.addr);
 556
 557     load_psw(env, mask, addr);
 558 }
 559
 560 #define VIRTIO_SUBCODE_64 0x0D00
 561
 562 static void do_ext_interrupt(CPUS390XState *env)
 563 {
 564     uint64_t mask, addr;
 565     LowCore *lowcore;
 566     target_phys_addr_t len = TARGET_PAGE_SIZE;
 567     ExtQueue *q;
 568
 569     if (!(env->psw.mask & PSW_MASK_EXT)) {
 570         cpu_abort(env, "Ext int w/o ext mask\n");
 571     }
 572
 573     if (env->ext_index < 0 || env->ext_index > MAX_EXT_QUEUE) {
 574         cpu_abort(env, "Ext queue overrun: %d\n", env->ext_index);
 575     }
 576
 577     q = &env->ext_queue[env->ext_index];
 578     lowcore = cpu_physical_memory_map(env->psa, &len, 1);
 579
 580     lowcore->ext_int_code = cpu_to_be16(q->code);
 581     lowcore->ext_params = cpu_to_be32(q->param);
 582     lowcore->ext_params2 = cpu_to_be64(q->param64);
 583     lowcore->external_old_psw.mask = cpu_to_be64(get_psw_mask(env));
 584     lowcore->external_old_psw.addr = cpu_to_be64(env->psw.addr);
 585     lowcore->cpu_addr = cpu_to_be16(env->cpu_num | VIRTIO_SUBCODE_64);
 586     mask = be64_to_cpu(lowcore->external_new_psw.mask);
 587     addr = be64_to_cpu(lowcore->external_new_psw.addr);
 588
 589     cpu_physical_memory_unmap(lowcore, len, 1, len);
 590
 591     env->ext_index--;
 592     if (env->ext_index == -1) {
 593         env->pending_int &= ~INTERRUPT_EXT;
 594     }
 595
 596     DPRINTF("%s: %" PRIx64 " %" PRIx64 "\n", __FUNCTION__,
 597             env->psw.mask, env->psw.addr);
 598
 599     load_psw(env, mask, addr);
 600 }
 601
 602 void do_interrupt (CPUS390XState *env)
 603 {
 604     qemu_log("%s: %d at pc=%" PRIx64 "\n", __FUNCTION__, env->exception_index,
 605              env->psw.addr);
 606
 607     s390_add_running_cpu(env);
 608     /* handle external interrupts */
 609     if ((env->psw.mask & PSW_MASK_EXT) &&
 610         env->exception_index == -1) {
 611         if (env->pending_int & INTERRUPT_EXT) {
 612             /* code is already in env */
 613             env->exception_index = EXCP_EXT;
 614         } else if (env->pending_int & INTERRUPT_TOD) {
 615             cpu_inject_ext(env, 0x1004, 0, 0);
 616             env->exception_index = EXCP_EXT;
 617             env->pending_int &= ~INTERRUPT_EXT;
 618             env->pending_int &= ~INTERRUPT_TOD;
 619         } else if (env->pending_int & INTERRUPT_CPUTIMER) {
 620             cpu_inject_ext(env, 0x1005, 0, 0);
 621             env->exception_index = EXCP_EXT;
 622             env->pending_int &= ~INTERRUPT_EXT;
 623             env->pending_int &= ~INTERRUPT_TOD;
 624         }
 625     }
 626
 627     switch (env->exception_index) {
 628     case EXCP_PGM:
 629         do_program_interrupt(env);
 630         break;
 631     case EXCP_SVC:
 632         do_svc_interrupt(env);
 633         break;
 634     case EXCP_EXT:
 635         do_ext_interrupt(env);
 636         break;
 637     }
 638     env->exception_index = -1;
 639
 640     if (!env->pending_int) {
 641         env->interrupt_request &= ~CPU_INTERRUPT_HARD;
 642     }
 643 }
 644
 645 #endif /* CONFIG_USER_ONLY */