2 * MIPS emulation helpers for qemu.
4 * Copyright (c) 2004-2005 Jocelyn Mayer
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301 USA
39 /* no MMU emulation */
40 int no_mmu_map_address (CPUState
*env
, target_ulong
*physical
, int *prot
,
41 target_ulong address
, int rw
, int access_type
)
44 *prot
= PAGE_READ
| PAGE_WRITE
;
48 /* fixed mapping MMU emulation */
49 int fixed_mmu_map_address (CPUState
*env
, target_ulong
*physical
, int *prot
,
50 target_ulong address
, int rw
, int access_type
)
52 if (address
<= (int32_t)0x7FFFFFFFUL
) {
53 if (!(env
->CP0_Status
& (1 << CP0St_ERL
)))
54 *physical
= address
+ 0x40000000UL
;
57 } else if (address
<= (int32_t)0xBFFFFFFFUL
)
58 *physical
= address
& 0x1FFFFFFF;
62 *prot
= PAGE_READ
| PAGE_WRITE
;
66 /* MIPS32/MIPS64 R4000-style MMU emulation */
67 int r4k_map_address (CPUState
*env
, target_ulong
*physical
, int *prot
,
68 target_ulong address
, int rw
, int access_type
)
70 uint8_t ASID
= env
->CP0_EntryHi
& 0xFF;
73 for (i
= 0; i
< env
->tlb
->tlb_in_use
; i
++) {
74 r4k_tlb_t
*tlb
= &env
->tlb
->mmu
.r4k
.tlb
[i
];
75 /* 1k pages are not supported. */
76 target_ulong mask
= tlb
->PageMask
| ~(TARGET_PAGE_MASK
<< 1);
77 target_ulong tag
= address
& ~mask
;
78 target_ulong VPN
= tlb
->VPN
& ~mask
;
79 #if defined(TARGET_MIPS64)
83 /* Check ASID, virtual page number & size */
84 if ((tlb
->G
== 1 || tlb
->ASID
== ASID
) && VPN
== tag
) {
86 int n
= !!(address
& mask
& ~(mask
>> 1));
87 /* Check access rights */
88 if (!(n
? tlb
->V1
: tlb
->V0
))
89 return TLBRET_INVALID
;
90 if (rw
== 0 || (n
? tlb
->D1
: tlb
->D0
)) {
91 *physical
= tlb
->PFN
[n
] | (address
& (mask
>> 1));
93 if (n
? tlb
->D1
: tlb
->D0
)
100 return TLBRET_NOMATCH
;
103 #if !defined(CONFIG_USER_ONLY)
104 static int get_physical_address (CPUState
*env
, target_ulong
*physical
,
105 int *prot
, target_ulong address
,
106 int rw
, int access_type
)
108 /* User mode can only access useg/xuseg */
109 int user_mode
= (env
->hflags
& MIPS_HFLAG_MODE
) == MIPS_HFLAG_UM
;
110 int supervisor_mode
= (env
->hflags
& MIPS_HFLAG_MODE
) == MIPS_HFLAG_SM
;
111 int kernel_mode
= !user_mode
&& !supervisor_mode
;
112 #if defined(TARGET_MIPS64)
113 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
114 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
115 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
117 int ret
= TLBRET_MATCH
;
121 fprintf(logfile
, "user mode %d h %08x\n",
122 user_mode
, env
->hflags
);
126 if (address
<= (int32_t)0x7FFFFFFFUL
) {
128 if (env
->CP0_Status
& (1 << CP0St_ERL
)) {
129 *physical
= address
& 0xFFFFFFFF;
130 *prot
= PAGE_READ
| PAGE_WRITE
;
132 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
134 #if defined(TARGET_MIPS64)
135 } else if (address
< 0x4000000000000000ULL
) {
137 if (UX
&& address
<= (0x3FFFFFFFFFFFFFFFULL
& env
->SEGMask
)) {
138 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
140 ret
= TLBRET_BADADDR
;
142 } else if (address
< 0x8000000000000000ULL
) {
144 if ((supervisor_mode
|| kernel_mode
) &&
145 SX
&& address
<= (0x7FFFFFFFFFFFFFFFULL
& env
->SEGMask
)) {
146 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
148 ret
= TLBRET_BADADDR
;
150 } else if (address
< 0xC000000000000000ULL
) {
152 if (kernel_mode
&& KX
&&
153 (address
& 0x07FFFFFFFFFFFFFFULL
) <= env
->PAMask
) {
154 *physical
= address
& env
->PAMask
;
155 *prot
= PAGE_READ
| PAGE_WRITE
;
157 ret
= TLBRET_BADADDR
;
159 } else if (address
< 0xFFFFFFFF80000000ULL
) {
161 if (kernel_mode
&& KX
&&
162 address
<= (0xFFFFFFFF7FFFFFFFULL
& env
->SEGMask
)) {
163 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
165 ret
= TLBRET_BADADDR
;
168 } else if (address
< (int32_t)0xA0000000UL
) {
171 *physical
= address
- (int32_t)0x80000000UL
;
172 *prot
= PAGE_READ
| PAGE_WRITE
;
174 ret
= TLBRET_BADADDR
;
176 } else if (address
< (int32_t)0xC0000000UL
) {
179 *physical
= address
- (int32_t)0xA0000000UL
;
180 *prot
= PAGE_READ
| PAGE_WRITE
;
182 ret
= TLBRET_BADADDR
;
184 } else if (address
< (int32_t)0xE0000000UL
) {
186 if (supervisor_mode
|| kernel_mode
) {
187 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
189 ret
= TLBRET_BADADDR
;
193 /* XXX: debug segment is not emulated */
195 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
197 ret
= TLBRET_BADADDR
;
202 fprintf(logfile
, TARGET_FMT_lx
" %d %d => " TARGET_FMT_lx
" %d (%d)\n",
203 address
, rw
, access_type
, *physical
, *prot
, ret
);
211 target_phys_addr_t
cpu_get_phys_page_debug(CPUState
*env
, target_ulong addr
)
213 #if defined(CONFIG_USER_ONLY)
216 target_ulong phys_addr
;
219 if (get_physical_address(env
, &phys_addr
, &prot
, addr
, 0, ACCESS_INT
) != 0)
225 int cpu_mips_handle_mmu_fault (CPUState
*env
, target_ulong address
, int rw
,
226 int mmu_idx
, int is_softmmu
)
228 #if !defined(CONFIG_USER_ONLY)
229 target_ulong physical
;
232 int exception
= 0, error_code
= 0;
238 cpu_dump_state(env
, logfile
, fprintf
, 0);
240 fprintf(logfile
, "%s pc " TARGET_FMT_lx
" ad " TARGET_FMT_lx
" rw %d mmu_idx %d smmu %d\n",
241 __func__
, env
->active_tc
.PC
, address
, rw
, mmu_idx
, is_softmmu
);
247 /* XXX: put correct access by using cpu_restore_state()
249 access_type
= ACCESS_INT
;
250 #if defined(CONFIG_USER_ONLY)
251 ret
= TLBRET_NOMATCH
;
253 ret
= get_physical_address(env
, &physical
, &prot
,
254 address
, rw
, access_type
);
256 fprintf(logfile
, "%s address=" TARGET_FMT_lx
" ret %d physical " TARGET_FMT_lx
" prot %d\n",
257 __func__
, address
, ret
, physical
, prot
);
259 if (ret
== TLBRET_MATCH
) {
260 ret
= tlb_set_page(env
, address
& TARGET_PAGE_MASK
,
261 physical
& TARGET_PAGE_MASK
, prot
,
262 mmu_idx
, is_softmmu
);
269 /* Reference to kernel address from user mode or supervisor mode */
270 /* Reference to supervisor address from user mode */
272 exception
= EXCP_AdES
;
274 exception
= EXCP_AdEL
;
277 /* No TLB match for a mapped address */
279 exception
= EXCP_TLBS
;
281 exception
= EXCP_TLBL
;
285 /* TLB match with no valid bit */
287 exception
= EXCP_TLBS
;
289 exception
= EXCP_TLBL
;
292 /* TLB match but 'D' bit is cleared */
293 exception
= EXCP_LTLBL
;
297 /* Raise exception */
298 env
->CP0_BadVAddr
= address
;
299 env
->CP0_Context
= (env
->CP0_Context
& ~0x007fffff) |
300 ((address
>> 9) & 0x007ffff0);
302 (env
->CP0_EntryHi
& 0xFF) | (address
& (TARGET_PAGE_MASK
<< 1));
303 #if defined(TARGET_MIPS64)
304 env
->CP0_EntryHi
&= env
->SEGMask
;
305 env
->CP0_XContext
= (env
->CP0_XContext
& ((~0ULL) << (env
->SEGBITS
- 7))) |
306 ((address
& 0xC00000000000ULL
) >> (55 - env
->SEGBITS
)) |
307 ((address
& ((1ULL << env
->SEGBITS
) - 1) & 0xFFFFFFFFFFFFE000ULL
) >> 9);
309 env
->exception_index
= exception
;
310 env
->error_code
= error_code
;
317 static const char * const excp_names
[EXCP_LAST
+ 1] = {
318 [EXCP_RESET
] = "reset",
319 [EXCP_SRESET
] = "soft reset",
320 [EXCP_DSS
] = "debug single step",
321 [EXCP_DINT
] = "debug interrupt",
322 [EXCP_NMI
] = "non-maskable interrupt",
323 [EXCP_MCHECK
] = "machine check",
324 [EXCP_EXT_INTERRUPT
] = "interrupt",
325 [EXCP_DFWATCH
] = "deferred watchpoint",
326 [EXCP_DIB
] = "debug instruction breakpoint",
327 [EXCP_IWATCH
] = "instruction fetch watchpoint",
328 [EXCP_AdEL
] = "address error load",
329 [EXCP_AdES
] = "address error store",
330 [EXCP_TLBF
] = "TLB refill",
331 [EXCP_IBE
] = "instruction bus error",
332 [EXCP_DBp
] = "debug breakpoint",
333 [EXCP_SYSCALL
] = "syscall",
334 [EXCP_BREAK
] = "break",
335 [EXCP_CpU
] = "coprocessor unusable",
336 [EXCP_RI
] = "reserved instruction",
337 [EXCP_OVERFLOW
] = "arithmetic overflow",
338 [EXCP_TRAP
] = "trap",
339 [EXCP_FPE
] = "floating point",
340 [EXCP_DDBS
] = "debug data break store",
341 [EXCP_DWATCH
] = "data watchpoint",
342 [EXCP_LTLBL
] = "TLB modify",
343 [EXCP_TLBL
] = "TLB load",
344 [EXCP_TLBS
] = "TLB store",
345 [EXCP_DBE
] = "data bus error",
346 [EXCP_DDBL
] = "debug data break load",
347 [EXCP_THREAD
] = "thread",
348 [EXCP_MDMX
] = "MDMX",
349 [EXCP_C2E
] = "precise coprocessor 2",
350 [EXCP_CACHE
] = "cache error",
353 void do_interrupt (CPUState
*env
)
355 #if !defined(CONFIG_USER_ONLY)
360 if (logfile
&& env
->exception_index
!= EXCP_EXT_INTERRUPT
) {
361 if (env
->exception_index
< 0 || env
->exception_index
> EXCP_LAST
)
364 name
= excp_names
[env
->exception_index
];
366 fprintf(logfile
, "%s enter: PC " TARGET_FMT_lx
" EPC " TARGET_FMT_lx
" %s exception\n",
367 __func__
, env
->active_tc
.PC
, env
->CP0_EPC
, name
);
369 if (env
->exception_index
== EXCP_EXT_INTERRUPT
&&
370 (env
->hflags
& MIPS_HFLAG_DM
))
371 env
->exception_index
= EXCP_DINT
;
373 switch (env
->exception_index
) {
375 env
->CP0_Debug
|= 1 << CP0DB_DSS
;
376 /* Debug single step cannot be raised inside a delay slot and
377 resume will always occur on the next instruction
378 (but we assume the pc has always been updated during
379 code translation). */
380 env
->CP0_DEPC
= env
->active_tc
.PC
;
381 goto enter_debug_mode
;
383 env
->CP0_Debug
|= 1 << CP0DB_DINT
;
386 env
->CP0_Debug
|= 1 << CP0DB_DIB
;
389 env
->CP0_Debug
|= 1 << CP0DB_DBp
;
392 env
->CP0_Debug
|= 1 << CP0DB_DDBS
;
395 env
->CP0_Debug
|= 1 << CP0DB_DDBL
;
397 if (env
->hflags
& MIPS_HFLAG_BMASK
) {
398 /* If the exception was raised from a delay slot,
399 come back to the jump. */
400 env
->CP0_DEPC
= env
->active_tc
.PC
- 4;
401 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
403 env
->CP0_DEPC
= env
->active_tc
.PC
;
406 env
->hflags
|= MIPS_HFLAG_DM
| MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
407 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
408 /* EJTAG probe trap enable is not implemented... */
409 if (!(env
->CP0_Status
& (1 << CP0St_EXL
)))
410 env
->CP0_Cause
&= ~(1 << CP0Ca_BD
);
411 env
->active_tc
.PC
= (int32_t)0xBFC00480;
417 env
->CP0_Status
|= (1 << CP0St_SR
);
418 memset(env
->CP0_WatchLo
, 0, sizeof(*env
->CP0_WatchLo
));
421 env
->CP0_Status
|= (1 << CP0St_NMI
);
423 if (env
->hflags
& MIPS_HFLAG_BMASK
) {
424 /* If the exception was raised from a delay slot,
425 come back to the jump. */
426 env
->CP0_ErrorEPC
= env
->active_tc
.PC
- 4;
427 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
429 env
->CP0_ErrorEPC
= env
->active_tc
.PC
;
431 env
->CP0_Status
|= (1 << CP0St_ERL
) | (1 << CP0St_BEV
);
432 env
->hflags
|= MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
433 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
434 if (!(env
->CP0_Status
& (1 << CP0St_EXL
)))
435 env
->CP0_Cause
&= ~(1 << CP0Ca_BD
);
436 env
->active_tc
.PC
= (int32_t)0xBFC00000;
438 case EXCP_EXT_INTERRUPT
:
440 if (env
->CP0_Cause
& (1 << CP0Ca_IV
))
448 if (env
->error_code
== 1 && !(env
->CP0_Status
& (1 << CP0St_EXL
))) {
449 #if defined(TARGET_MIPS64)
450 int R
= env
->CP0_BadVAddr
>> 62;
451 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
452 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
453 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
455 if ((R
== 0 && UX
) || (R
== 1 && SX
) || (R
== 3 && KX
))
464 if (env
->error_code
== 1 && !(env
->CP0_Status
& (1 << CP0St_EXL
))) {
465 #if defined(TARGET_MIPS64)
466 int R
= env
->CP0_BadVAddr
>> 62;
467 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
468 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
469 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
471 if ((R
== 0 && UX
) || (R
== 1 && SX
) || (R
== 3 && KX
))
501 env
->CP0_Cause
= (env
->CP0_Cause
& ~(0x3 << CP0Ca_CE
)) |
502 (env
->error_code
<< CP0Ca_CE
);
521 /* XXX: TODO: manage defered watch exceptions */
531 if (env
->CP0_Status
& (1 << CP0St_BEV
)) {
537 if (!(env
->CP0_Status
& (1 << CP0St_EXL
))) {
538 if (env
->hflags
& MIPS_HFLAG_BMASK
) {
539 /* If the exception was raised from a delay slot,
540 come back to the jump. */
541 env
->CP0_EPC
= env
->active_tc
.PC
- 4;
542 env
->CP0_Cause
|= (1 << CP0Ca_BD
);
544 env
->CP0_EPC
= env
->active_tc
.PC
;
545 env
->CP0_Cause
&= ~(1 << CP0Ca_BD
);
547 env
->CP0_Status
|= (1 << CP0St_EXL
);
548 env
->hflags
|= MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
549 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
551 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
552 if (env
->CP0_Status
& (1 << CP0St_BEV
)) {
553 env
->active_tc
.PC
= (int32_t)0xBFC00200;
555 env
->active_tc
.PC
= (int32_t)(env
->CP0_EBase
& ~0x3ff);
557 env
->active_tc
.PC
+= offset
;
558 env
->CP0_Cause
= (env
->CP0_Cause
& ~(0x1f << CP0Ca_EC
)) | (cause
<< CP0Ca_EC
);
562 fprintf(logfile
, "Invalid MIPS exception %d. Exiting\n",
563 env
->exception_index
);
565 printf("Invalid MIPS exception %d. Exiting\n", env
->exception_index
);
568 if (logfile
&& env
->exception_index
!= EXCP_EXT_INTERRUPT
) {
569 fprintf(logfile
, "%s: PC " TARGET_FMT_lx
" EPC " TARGET_FMT_lx
" cause %d\n"
570 " S %08x C %08x A " TARGET_FMT_lx
" D " TARGET_FMT_lx
"\n",
571 __func__
, env
->active_tc
.PC
, env
->CP0_EPC
, cause
,
572 env
->CP0_Status
, env
->CP0_Cause
, env
->CP0_BadVAddr
,
576 env
->exception_index
= EXCP_NONE
;
579 void r4k_invalidate_tlb (CPUState
*env
, int idx
, int use_extra
)
584 uint8_t ASID
= env
->CP0_EntryHi
& 0xFF;
587 tlb
= &env
->tlb
->mmu
.r4k
.tlb
[idx
];
588 /* The qemu TLB is flushed when the ASID changes, so no need to
589 flush these entries again. */
590 if (tlb
->G
== 0 && tlb
->ASID
!= ASID
) {
594 if (use_extra
&& env
->tlb
->tlb_in_use
< MIPS_TLB_MAX
) {
595 /* For tlbwr, we can shadow the discarded entry into
596 a new (fake) TLB entry, as long as the guest can not
597 tell that it's there. */
598 env
->tlb
->mmu
.r4k
.tlb
[env
->tlb
->tlb_in_use
] = *tlb
;
599 env
->tlb
->tlb_in_use
++;
603 /* 1k pages are not supported. */
604 mask
= tlb
->PageMask
| ~(TARGET_PAGE_MASK
<< 1);
606 addr
= tlb
->VPN
& ~mask
;
607 #if defined(TARGET_MIPS64)
608 if (addr
>= (0xFFFFFFFF80000000ULL
& env
->SEGMask
)) {
609 addr
|= 0x3FFFFF0000000000ULL
;
612 end
= addr
| (mask
>> 1);
614 tlb_flush_page (env
, addr
);
615 addr
+= TARGET_PAGE_SIZE
;
619 addr
= (tlb
->VPN
& ~mask
) | ((mask
>> 1) + 1);
620 #if defined(TARGET_MIPS64)
621 if (addr
>= (0xFFFFFFFF80000000ULL
& env
->SEGMask
)) {
622 addr
|= 0x3FFFFF0000000000ULL
;
626 while (addr
- 1 < end
) {
627 tlb_flush_page (env
, addr
);
628 addr
+= TARGET_PAGE_SIZE
;