slirp: fix use-after-free
[qemu-kvm/fedora.git] / target-sh4 / helper.c
blob088d36a5f7414785dd585f28f916eb0dbafef62a
1 /*
2 * SH4 emulation
4 * Copyright (c) 2005 Samuel Tardieu
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19 #include <stdarg.h>
20 #include <stdlib.h>
21 #include <stdio.h>
22 #include <string.h>
23 #include <inttypes.h>
24 #include <signal.h>
26 #include "cpu.h"
27 #include "exec-all.h"
28 #include "hw/sh_intc.h"
30 #if defined(CONFIG_USER_ONLY)
32 void do_interrupt (CPUState *env)
34 env->exception_index = -1;
37 int cpu_sh4_handle_mmu_fault(CPUState * env, target_ulong address, int rw,
38 int mmu_idx, int is_softmmu)
40 env->tea = address;
41 env->exception_index = 0;
42 switch (rw) {
43 case 0:
44 env->exception_index = 0x0a0;
45 break;
46 case 1:
47 env->exception_index = 0x0c0;
48 break;
49 case 2:
50 env->exception_index = 0x0a0;
51 break;
53 return 1;
56 target_phys_addr_t cpu_get_phys_page_debug(CPUState * env, target_ulong addr)
58 return addr;
61 int cpu_sh4_is_cached(CPUSH4State * env, target_ulong addr)
63 /* For user mode, only U0 area is cachable. */
64 return !(addr & 0x80000000);
67 #else /* !CONFIG_USER_ONLY */
69 #define MMU_OK 0
70 #define MMU_ITLB_MISS (-1)
71 #define MMU_ITLB_MULTIPLE (-2)
72 #define MMU_ITLB_VIOLATION (-3)
73 #define MMU_DTLB_MISS_READ (-4)
74 #define MMU_DTLB_MISS_WRITE (-5)
75 #define MMU_DTLB_INITIAL_WRITE (-6)
76 #define MMU_DTLB_VIOLATION_READ (-7)
77 #define MMU_DTLB_VIOLATION_WRITE (-8)
78 #define MMU_DTLB_MULTIPLE (-9)
79 #define MMU_DTLB_MISS (-10)
80 #define MMU_IADDR_ERROR (-11)
81 #define MMU_DADDR_ERROR_READ (-12)
82 #define MMU_DADDR_ERROR_WRITE (-13)
84 void do_interrupt(CPUState * env)
86 int do_irq = env->interrupt_request & CPU_INTERRUPT_HARD;
87 int do_exp, irq_vector = env->exception_index;
89 /* prioritize exceptions over interrupts */
91 do_exp = env->exception_index != -1;
92 do_irq = do_irq && (env->exception_index == -1);
94 if (env->sr & SR_BL) {
95 if (do_exp && env->exception_index != 0x1e0) {
96 env->exception_index = 0x000; /* masked exception -> reset */
98 if (do_irq && !env->intr_at_halt) {
99 return; /* masked */
101 env->intr_at_halt = 0;
104 if (do_irq) {
105 irq_vector = sh_intc_get_pending_vector(env->intc_handle,
106 (env->sr >> 4) & 0xf);
107 if (irq_vector == -1) {
108 return; /* masked */
112 if (qemu_loglevel_mask(CPU_LOG_INT)) {
113 const char *expname;
114 switch (env->exception_index) {
115 case 0x0e0:
116 expname = "addr_error";
117 break;
118 case 0x040:
119 expname = "tlb_miss";
120 break;
121 case 0x0a0:
122 expname = "tlb_violation";
123 break;
124 case 0x180:
125 expname = "illegal_instruction";
126 break;
127 case 0x1a0:
128 expname = "slot_illegal_instruction";
129 break;
130 case 0x800:
131 expname = "fpu_disable";
132 break;
133 case 0x820:
134 expname = "slot_fpu";
135 break;
136 case 0x100:
137 expname = "data_write";
138 break;
139 case 0x060:
140 expname = "dtlb_miss_write";
141 break;
142 case 0x0c0:
143 expname = "dtlb_violation_write";
144 break;
145 case 0x120:
146 expname = "fpu_exception";
147 break;
148 case 0x080:
149 expname = "initial_page_write";
150 break;
151 case 0x160:
152 expname = "trapa";
153 break;
154 default:
155 expname = do_irq ? "interrupt" : "???";
156 break;
158 qemu_log("exception 0x%03x [%s] raised\n",
159 irq_vector, expname);
160 log_cpu_state(env, 0);
163 env->ssr = env->sr;
164 env->spc = env->pc;
165 env->sgr = env->gregs[15];
166 env->sr |= SR_BL | SR_MD | SR_RB;
168 if (env->flags & (DELAY_SLOT | DELAY_SLOT_CONDITIONAL)) {
169 /* Branch instruction should be executed again before delay slot. */
170 env->spc -= 2;
171 /* Clear flags for exception/interrupt routine. */
172 env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL | DELAY_SLOT_TRUE);
174 if (env->flags & DELAY_SLOT_CLEARME)
175 env->flags = 0;
177 if (do_exp) {
178 env->expevt = env->exception_index;
179 switch (env->exception_index) {
180 case 0x000:
181 case 0x020:
182 case 0x140:
183 env->sr &= ~SR_FD;
184 env->sr |= 0xf << 4; /* IMASK */
185 env->pc = 0xa0000000;
186 break;
187 case 0x040:
188 case 0x060:
189 env->pc = env->vbr + 0x400;
190 break;
191 case 0x160:
192 env->spc += 2; /* special case for TRAPA */
193 /* fall through */
194 default:
195 env->pc = env->vbr + 0x100;
196 break;
198 return;
201 if (do_irq) {
202 env->intevt = irq_vector;
203 env->pc = env->vbr + 0x600;
204 return;
208 static void update_itlb_use(CPUState * env, int itlbnb)
210 uint8_t or_mask = 0, and_mask = (uint8_t) - 1;
212 switch (itlbnb) {
213 case 0:
214 and_mask = 0x1f;
215 break;
216 case 1:
217 and_mask = 0xe7;
218 or_mask = 0x80;
219 break;
220 case 2:
221 and_mask = 0xfb;
222 or_mask = 0x50;
223 break;
224 case 3:
225 or_mask = 0x2c;
226 break;
229 env->mmucr &= (and_mask << 24) | 0x00ffffff;
230 env->mmucr |= (or_mask << 24);
233 static int itlb_replacement(CPUState * env)
235 if ((env->mmucr & 0xe0000000) == 0xe0000000)
236 return 0;
237 if ((env->mmucr & 0x98000000) == 0x18000000)
238 return 1;
239 if ((env->mmucr & 0x54000000) == 0x04000000)
240 return 2;
241 if ((env->mmucr & 0x2c000000) == 0x00000000)
242 return 3;
243 assert(0);
246 /* Find the corresponding entry in the right TLB
247 Return entry, MMU_DTLB_MISS or MMU_DTLB_MULTIPLE
249 static int find_tlb_entry(CPUState * env, target_ulong address,
250 tlb_t * entries, uint8_t nbtlb, int use_asid)
252 int match = MMU_DTLB_MISS;
253 uint32_t start, end;
254 uint8_t asid;
255 int i;
257 asid = env->pteh & 0xff;
259 for (i = 0; i < nbtlb; i++) {
260 if (!entries[i].v)
261 continue; /* Invalid entry */
262 if (!entries[i].sh && use_asid && entries[i].asid != asid)
263 continue; /* Bad ASID */
264 #if 0
265 switch (entries[i].sz) {
266 case 0:
267 size = 1024; /* 1kB */
268 break;
269 case 1:
270 size = 4 * 1024; /* 4kB */
271 break;
272 case 2:
273 size = 64 * 1024; /* 64kB */
274 break;
275 case 3:
276 size = 1024 * 1024; /* 1MB */
277 break;
278 default:
279 assert(0);
281 #endif
282 start = (entries[i].vpn << 10) & ~(entries[i].size - 1);
283 end = start + entries[i].size - 1;
284 if (address >= start && address <= end) { /* Match */
285 if (match != MMU_DTLB_MISS)
286 return MMU_DTLB_MULTIPLE; /* Multiple match */
287 match = i;
290 return match;
293 static int same_tlb_entry_exists(const tlb_t * haystack, uint8_t nbtlb,
294 const tlb_t * needle)
296 int i;
297 for (i = 0; i < nbtlb; i++)
298 if (!memcmp(&haystack[i], needle, sizeof(tlb_t)))
299 return 1;
300 return 0;
303 static void increment_urc(CPUState * env)
305 uint8_t urb, urc;
307 /* Increment URC */
308 urb = ((env->mmucr) >> 18) & 0x3f;
309 urc = ((env->mmucr) >> 10) & 0x3f;
310 urc++;
311 if ((urb > 0 && urc > urb) || urc > (UTLB_SIZE - 1))
312 urc = 0;
313 env->mmucr = (env->mmucr & 0xffff03ff) | (urc << 10);
316 /* Find itlb entry - update itlb from utlb if necessary and asked for
317 Return entry, MMU_ITLB_MISS, MMU_ITLB_MULTIPLE or MMU_DTLB_MULTIPLE
318 Update the itlb from utlb if update is not 0
320 static int find_itlb_entry(CPUState * env, target_ulong address,
321 int use_asid, int update)
323 int e, n;
325 e = find_tlb_entry(env, address, env->itlb, ITLB_SIZE, use_asid);
326 if (e == MMU_DTLB_MULTIPLE)
327 e = MMU_ITLB_MULTIPLE;
328 else if (e == MMU_DTLB_MISS && update) {
329 e = find_tlb_entry(env, address, env->utlb, UTLB_SIZE, use_asid);
330 if (e >= 0) {
331 tlb_t * ientry;
332 n = itlb_replacement(env);
333 ientry = &env->itlb[n];
334 if (ientry->v) {
335 if (!same_tlb_entry_exists(env->utlb, UTLB_SIZE, ientry))
336 tlb_flush_page(env, ientry->vpn << 10);
338 *ientry = env->utlb[e];
339 e = n;
340 } else if (e == MMU_DTLB_MISS)
341 e = MMU_ITLB_MISS;
342 } else if (e == MMU_DTLB_MISS)
343 e = MMU_ITLB_MISS;
344 if (e >= 0)
345 update_itlb_use(env, e);
346 return e;
349 /* Find utlb entry
350 Return entry, MMU_DTLB_MISS, MMU_DTLB_MULTIPLE */
351 static int find_utlb_entry(CPUState * env, target_ulong address, int use_asid)
353 /* per utlb access */
354 increment_urc(env);
356 /* Return entry */
357 return find_tlb_entry(env, address, env->utlb, UTLB_SIZE, use_asid);
360 /* Match address against MMU
361 Return MMU_OK, MMU_DTLB_MISS_READ, MMU_DTLB_MISS_WRITE,
362 MMU_DTLB_INITIAL_WRITE, MMU_DTLB_VIOLATION_READ,
363 MMU_DTLB_VIOLATION_WRITE, MMU_ITLB_MISS,
364 MMU_ITLB_MULTIPLE, MMU_ITLB_VIOLATION,
365 MMU_IADDR_ERROR, MMU_DADDR_ERROR_READ, MMU_DADDR_ERROR_WRITE.
367 static int get_mmu_address(CPUState * env, target_ulong * physical,
368 int *prot, target_ulong address,
369 int rw, int access_type)
371 int use_asid, n;
372 tlb_t *matching = NULL;
374 use_asid = (env->mmucr & MMUCR_SV) == 0 || (env->sr & SR_MD) == 0;
376 if (rw == 2) {
377 n = find_itlb_entry(env, address, use_asid, 1);
378 if (n >= 0) {
379 matching = &env->itlb[n];
380 if ((env->sr & SR_MD) & !(matching->pr & 2))
381 n = MMU_ITLB_VIOLATION;
382 else
383 *prot = PAGE_READ;
385 } else {
386 n = find_utlb_entry(env, address, use_asid);
387 if (n >= 0) {
388 matching = &env->utlb[n];
389 switch ((matching->pr << 1) | ((env->sr & SR_MD) ? 1 : 0)) {
390 case 0: /* 000 */
391 case 2: /* 010 */
392 n = (rw == 1) ? MMU_DTLB_VIOLATION_WRITE :
393 MMU_DTLB_VIOLATION_READ;
394 break;
395 case 1: /* 001 */
396 case 4: /* 100 */
397 case 5: /* 101 */
398 if (rw == 1)
399 n = MMU_DTLB_VIOLATION_WRITE;
400 else
401 *prot = PAGE_READ;
402 break;
403 case 3: /* 011 */
404 case 6: /* 110 */
405 case 7: /* 111 */
406 *prot = (rw == 1)? PAGE_WRITE : PAGE_READ;
407 break;
409 } else if (n == MMU_DTLB_MISS) {
410 n = (rw == 1) ? MMU_DTLB_MISS_WRITE :
411 MMU_DTLB_MISS_READ;
414 if (n >= 0) {
415 *physical = ((matching->ppn << 10) & ~(matching->size - 1)) |
416 (address & (matching->size - 1));
417 if ((rw == 1) & !matching->d)
418 n = MMU_DTLB_INITIAL_WRITE;
419 else
420 n = MMU_OK;
422 return n;
425 static int get_physical_address(CPUState * env, target_ulong * physical,
426 int *prot, target_ulong address,
427 int rw, int access_type)
429 /* P1, P2 and P4 areas do not use translation */
430 if ((address >= 0x80000000 && address < 0xc0000000) ||
431 address >= 0xe0000000) {
432 if (!(env->sr & SR_MD)
433 && (address < 0xe0000000 || address > 0xe4000000)) {
434 /* Unauthorized access in user mode (only store queues are available) */
435 fprintf(stderr, "Unauthorized access\n");
436 if (rw == 0)
437 return MMU_DADDR_ERROR_READ;
438 else if (rw == 1)
439 return MMU_DADDR_ERROR_WRITE;
440 else
441 return MMU_IADDR_ERROR;
443 if (address >= 0x80000000 && address < 0xc0000000) {
444 /* Mask upper 3 bits for P1 and P2 areas */
445 *physical = address & 0x1fffffff;
446 } else {
447 *physical = address;
449 *prot = PAGE_READ | PAGE_WRITE;
450 return MMU_OK;
453 /* If MMU is disabled, return the corresponding physical page */
454 if (!env->mmucr & MMUCR_AT) {
455 *physical = address & 0x1FFFFFFF;
456 *prot = PAGE_READ | PAGE_WRITE;
457 return MMU_OK;
460 /* We need to resort to the MMU */
461 return get_mmu_address(env, physical, prot, address, rw, access_type);
464 int cpu_sh4_handle_mmu_fault(CPUState * env, target_ulong address, int rw,
465 int mmu_idx, int is_softmmu)
467 target_ulong physical, page_offset, page_size;
468 int prot, ret, access_type;
470 access_type = ACCESS_INT;
471 ret =
472 get_physical_address(env, &physical, &prot, address, rw,
473 access_type);
475 if (ret != MMU_OK) {
476 env->tea = address;
477 switch (ret) {
478 case MMU_ITLB_MISS:
479 case MMU_DTLB_MISS_READ:
480 env->exception_index = 0x040;
481 break;
482 case MMU_DTLB_MULTIPLE:
483 case MMU_ITLB_MULTIPLE:
484 env->exception_index = 0x140;
485 break;
486 case MMU_ITLB_VIOLATION:
487 env->exception_index = 0x0a0;
488 break;
489 case MMU_DTLB_MISS_WRITE:
490 env->exception_index = 0x060;
491 break;
492 case MMU_DTLB_INITIAL_WRITE:
493 env->exception_index = 0x080;
494 break;
495 case MMU_DTLB_VIOLATION_READ:
496 env->exception_index = 0x0a0;
497 break;
498 case MMU_DTLB_VIOLATION_WRITE:
499 env->exception_index = 0x0c0;
500 break;
501 case MMU_IADDR_ERROR:
502 case MMU_DADDR_ERROR_READ:
503 env->exception_index = 0x0c0;
504 break;
505 case MMU_DADDR_ERROR_WRITE:
506 env->exception_index = 0x100;
507 break;
508 default:
509 assert(0);
511 return 1;
514 page_size = TARGET_PAGE_SIZE;
515 page_offset =
516 (address - (address & TARGET_PAGE_MASK)) & ~(page_size - 1);
517 address = (address & TARGET_PAGE_MASK) + page_offset;
518 physical = (physical & TARGET_PAGE_MASK) + page_offset;
520 return tlb_set_page(env, address, physical, prot, mmu_idx, is_softmmu);
523 target_phys_addr_t cpu_get_phys_page_debug(CPUState * env, target_ulong addr)
525 target_ulong physical;
526 int prot;
528 get_physical_address(env, &physical, &prot, addr, 0, 0);
529 return physical;
532 void cpu_load_tlb(CPUSH4State * env)
534 int n = cpu_mmucr_urc(env->mmucr);
535 tlb_t * entry = &env->utlb[n];
537 if (entry->v) {
538 /* Overwriting valid entry in utlb. */
539 target_ulong address = entry->vpn << 10;
540 if (!same_tlb_entry_exists(env->itlb, ITLB_SIZE, entry)) {
541 tlb_flush_page(env, address);
545 /* Take values into cpu status from registers. */
546 entry->asid = (uint8_t)cpu_pteh_asid(env->pteh);
547 entry->vpn = cpu_pteh_vpn(env->pteh);
548 entry->v = (uint8_t)cpu_ptel_v(env->ptel);
549 entry->ppn = cpu_ptel_ppn(env->ptel);
550 entry->sz = (uint8_t)cpu_ptel_sz(env->ptel);
551 switch (entry->sz) {
552 case 0: /* 00 */
553 entry->size = 1024; /* 1K */
554 break;
555 case 1: /* 01 */
556 entry->size = 1024 * 4; /* 4K */
557 break;
558 case 2: /* 10 */
559 entry->size = 1024 * 64; /* 64K */
560 break;
561 case 3: /* 11 */
562 entry->size = 1024 * 1024; /* 1M */
563 break;
564 default:
565 assert(0);
566 break;
568 entry->sh = (uint8_t)cpu_ptel_sh(env->ptel);
569 entry->c = (uint8_t)cpu_ptel_c(env->ptel);
570 entry->pr = (uint8_t)cpu_ptel_pr(env->ptel);
571 entry->d = (uint8_t)cpu_ptel_d(env->ptel);
572 entry->wt = (uint8_t)cpu_ptel_wt(env->ptel);
573 entry->sa = (uint8_t)cpu_ptea_sa(env->ptea);
574 entry->tc = (uint8_t)cpu_ptea_tc(env->ptea);
577 void cpu_sh4_write_mmaped_utlb_addr(CPUSH4State *s, target_phys_addr_t addr,
578 uint32_t mem_value)
580 int associate = addr & 0x0000080;
581 uint32_t vpn = (mem_value & 0xfffffc00) >> 10;
582 uint8_t d = (uint8_t)((mem_value & 0x00000200) >> 9);
583 uint8_t v = (uint8_t)((mem_value & 0x00000100) >> 8);
584 uint8_t asid = (uint8_t)(mem_value & 0x000000ff);
585 int use_asid = (s->mmucr & MMUCR_SV) == 0 || (s->sr & SR_MD) == 0;
587 if (associate) {
588 int i;
589 tlb_t * utlb_match_entry = NULL;
590 int needs_tlb_flush = 0;
592 /* search UTLB */
593 for (i = 0; i < UTLB_SIZE; i++) {
594 tlb_t * entry = &s->utlb[i];
595 if (!entry->v)
596 continue;
598 if (entry->vpn == vpn
599 && (!use_asid || entry->asid == asid || entry->sh)) {
600 if (utlb_match_entry) {
601 /* Multiple TLB Exception */
602 s->exception_index = 0x140;
603 s->tea = addr;
604 break;
606 if (entry->v && !v)
607 needs_tlb_flush = 1;
608 entry->v = v;
609 entry->d = d;
610 utlb_match_entry = entry;
612 increment_urc(s); /* per utlb access */
615 /* search ITLB */
616 for (i = 0; i < ITLB_SIZE; i++) {
617 tlb_t * entry = &s->itlb[i];
618 if (entry->vpn == vpn
619 && (!use_asid || entry->asid == asid || entry->sh)) {
620 if (entry->v && !v)
621 needs_tlb_flush = 1;
622 if (utlb_match_entry)
623 *entry = *utlb_match_entry;
624 else
625 entry->v = v;
626 break;
630 if (needs_tlb_flush)
631 tlb_flush_page(s, vpn << 10);
633 } else {
634 int index = (addr & 0x00003f00) >> 8;
635 tlb_t * entry = &s->utlb[index];
636 if (entry->v) {
637 /* Overwriting valid entry in utlb. */
638 target_ulong address = entry->vpn << 10;
639 if (!same_tlb_entry_exists(s->itlb, ITLB_SIZE, entry)) {
640 tlb_flush_page(s, address);
643 entry->asid = asid;
644 entry->vpn = vpn;
645 entry->d = d;
646 entry->v = v;
647 increment_urc(s);
651 int cpu_sh4_is_cached(CPUSH4State * env, target_ulong addr)
653 int n;
654 int use_asid = (env->mmucr & MMUCR_SV) == 0 || (env->sr & SR_MD) == 0;
656 /* check area */
657 if (env->sr & SR_MD) {
658 /* For previledged mode, P2 and P4 area is not cachable. */
659 if ((0xA0000000 <= addr && addr < 0xC0000000) || 0xE0000000 <= addr)
660 return 0;
661 } else {
662 /* For user mode, only U0 area is cachable. */
663 if (0x80000000 <= addr)
664 return 0;
668 * TODO : Evaluate CCR and check if the cache is on or off.
669 * Now CCR is not in CPUSH4State, but in SH7750State.
670 * When you move the ccr inot CPUSH4State, the code will be
671 * as follows.
673 #if 0
674 /* check if operand cache is enabled or not. */
675 if (!(env->ccr & 1))
676 return 0;
677 #endif
679 /* if MMU is off, no check for TLB. */
680 if (env->mmucr & MMUCR_AT)
681 return 1;
683 /* check TLB */
684 n = find_tlb_entry(env, addr, env->itlb, ITLB_SIZE, use_asid);
685 if (n >= 0)
686 return env->itlb[n].c;
688 n = find_tlb_entry(env, addr, env->utlb, UTLB_SIZE, use_asid);
689 if (n >= 0)
690 return env->utlb[n].c;
692 return 0;
695 #endif