2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "sysemu/kvm.h"
23 #include "mmu-hash64.h"
24 #include "mmu-hash32.h"
28 //#define DEBUG_SOFTWARE_TLB
29 //#define DUMP_PAGE_TABLES
30 //#define DEBUG_SOFTWARE_TLB
31 //#define FLUSH_ALL_TLBS
34 # define LOG_MMU(...) qemu_log(__VA_ARGS__)
35 # define LOG_MMU_STATE(env) log_cpu_state((env), 0)
37 # define LOG_MMU(...) do { } while (0)
38 # define LOG_MMU_STATE(...) do { } while (0)
41 #ifdef DEBUG_SOFTWARE_TLB
42 # define LOG_SWTLB(...) qemu_log(__VA_ARGS__)
44 # define LOG_SWTLB(...) do { } while (0)
48 # define LOG_BATS(...) qemu_log(__VA_ARGS__)
50 # define LOG_BATS(...) do { } while (0)
53 /*****************************************************************************/
54 /* PowerPC MMU emulation */
56 /* Context used internally during MMU translations */
57 typedef struct mmu_ctx_t mmu_ctx_t
;
59 hwaddr raddr
; /* Real address */
60 hwaddr eaddr
; /* Effective address */
61 int prot
; /* Protection bits */
62 hwaddr hash
[2]; /* Pagetable hash values */
63 target_ulong ptem
; /* Virtual segment ID | API */
64 int key
; /* Access key */
65 int nx
; /* Non-execute area */
68 /* Common routines used by software and hardware TLBs emulation */
69 static inline int pte_is_valid(target_ulong pte0
)
71 return pte0
& 0x80000000 ? 1 : 0;
74 static inline void pte_invalidate(target_ulong
*pte0
)
79 #define PTE_PTEM_MASK 0x7FFFFFBF
80 #define PTE_CHECK_MASK (TARGET_PAGE_MASK | 0x7B)
82 static int pp_check(int key
, int pp
, int nx
)
86 /* Compute access rights */
109 access
= PAGE_READ
| PAGE_WRITE
;
120 static int check_prot(int prot
, int rw
, int access_type
)
124 if (access_type
== ACCESS_CODE
) {
125 if (prot
& PAGE_EXEC
) {
131 if (prot
& PAGE_WRITE
) {
137 if (prot
& PAGE_READ
) {
147 static inline int ppc6xx_tlb_pte_check(mmu_ctx_t
*ctx
, target_ulong pte0
,
148 target_ulong pte1
, int h
, int rw
, int type
)
150 target_ulong ptem
, mmask
;
151 int access
, ret
, pteh
, ptev
, pp
;
154 /* Check validity and table match */
155 ptev
= pte_is_valid(pte0
);
156 pteh
= (pte0
>> 6) & 1;
157 if (ptev
&& h
== pteh
) {
158 /* Check vsid & api */
159 ptem
= pte0
& PTE_PTEM_MASK
;
160 mmask
= PTE_CHECK_MASK
;
161 pp
= pte1
& 0x00000003;
162 if (ptem
== ctx
->ptem
) {
163 if (ctx
->raddr
!= (hwaddr
)-1ULL) {
164 /* all matches should have equal RPN, WIMG & PP */
165 if ((ctx
->raddr
& mmask
) != (pte1
& mmask
)) {
166 qemu_log("Bad RPN/WIMG/PP\n");
170 /* Compute access rights */
171 access
= pp_check(ctx
->key
, pp
, ctx
->nx
);
172 /* Keep the matching PTE informations */
175 ret
= check_prot(ctx
->prot
, rw
, type
);
178 LOG_MMU("PTE access granted !\n");
180 /* Access right violation */
181 LOG_MMU("PTE access rejected\n");
189 static int pte_update_flags(mmu_ctx_t
*ctx
, target_ulong
*pte1p
,
194 /* Update page flags */
195 if (!(*pte1p
& 0x00000100)) {
196 /* Update accessed flag */
197 *pte1p
|= 0x00000100;
200 if (!(*pte1p
& 0x00000080)) {
201 if (rw
== 1 && ret
== 0) {
202 /* Update changed flag */
203 *pte1p
|= 0x00000080;
206 /* Force page fault for first write access */
207 ctx
->prot
&= ~PAGE_WRITE
;
214 /* Software driven TLB helpers */
215 static inline int ppc6xx_tlb_getnum(CPUPPCState
*env
, target_ulong eaddr
,
216 int way
, int is_code
)
220 /* Select TLB num in a way from address */
221 nr
= (eaddr
>> TARGET_PAGE_BITS
) & (env
->tlb_per_way
- 1);
223 nr
+= env
->tlb_per_way
* way
;
224 /* 6xx have separate TLBs for instructions and data */
225 if (is_code
&& env
->id_tlbs
== 1) {
232 static inline void ppc6xx_tlb_invalidate_all(CPUPPCState
*env
)
237 /* LOG_SWTLB("Invalidate all TLBs\n"); */
238 /* Invalidate all defined software TLB */
240 if (env
->id_tlbs
== 1) {
243 for (nr
= 0; nr
< max
; nr
++) {
244 tlb
= &env
->tlb
.tlb6
[nr
];
245 pte_invalidate(&tlb
->pte0
);
250 static inline void ppc6xx_tlb_invalidate_virt2(CPUPPCState
*env
,
252 int is_code
, int match_epn
)
254 #if !defined(FLUSH_ALL_TLBS)
258 /* Invalidate ITLB + DTLB, all ways */
259 for (way
= 0; way
< env
->nb_ways
; way
++) {
260 nr
= ppc6xx_tlb_getnum(env
, eaddr
, way
, is_code
);
261 tlb
= &env
->tlb
.tlb6
[nr
];
262 if (pte_is_valid(tlb
->pte0
) && (match_epn
== 0 || eaddr
== tlb
->EPN
)) {
263 LOG_SWTLB("TLB invalidate %d/%d " TARGET_FMT_lx
"\n", nr
,
265 pte_invalidate(&tlb
->pte0
);
266 tlb_flush_page(env
, tlb
->EPN
);
270 /* XXX: PowerPC specification say this is valid as well */
271 ppc6xx_tlb_invalidate_all(env
);
275 static inline void ppc6xx_tlb_invalidate_virt(CPUPPCState
*env
,
276 target_ulong eaddr
, int is_code
)
278 ppc6xx_tlb_invalidate_virt2(env
, eaddr
, is_code
, 0);
281 static void ppc6xx_tlb_store(CPUPPCState
*env
, target_ulong EPN
, int way
,
282 int is_code
, target_ulong pte0
, target_ulong pte1
)
287 nr
= ppc6xx_tlb_getnum(env
, EPN
, way
, is_code
);
288 tlb
= &env
->tlb
.tlb6
[nr
];
289 LOG_SWTLB("Set TLB %d/%d EPN " TARGET_FMT_lx
" PTE0 " TARGET_FMT_lx
290 " PTE1 " TARGET_FMT_lx
"\n", nr
, env
->nb_tlb
, EPN
, pte0
, pte1
);
291 /* Invalidate any pending reference in QEMU for this virtual address */
292 ppc6xx_tlb_invalidate_virt2(env
, EPN
, is_code
, 1);
296 /* Store last way for LRU mechanism */
300 static inline int ppc6xx_tlb_check(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
301 target_ulong eaddr
, int rw
, int access_type
)
308 ret
= -1; /* No TLB found */
309 for (way
= 0; way
< env
->nb_ways
; way
++) {
310 nr
= ppc6xx_tlb_getnum(env
, eaddr
, way
,
311 access_type
== ACCESS_CODE
? 1 : 0);
312 tlb
= &env
->tlb
.tlb6
[nr
];
313 /* This test "emulates" the PTE index match for hardware TLBs */
314 if ((eaddr
& TARGET_PAGE_MASK
) != tlb
->EPN
) {
315 LOG_SWTLB("TLB %d/%d %s [" TARGET_FMT_lx
" " TARGET_FMT_lx
316 "] <> " TARGET_FMT_lx
"\n", nr
, env
->nb_tlb
,
317 pte_is_valid(tlb
->pte0
) ? "valid" : "inval",
318 tlb
->EPN
, tlb
->EPN
+ TARGET_PAGE_SIZE
, eaddr
);
321 LOG_SWTLB("TLB %d/%d %s " TARGET_FMT_lx
" <> " TARGET_FMT_lx
" "
322 TARGET_FMT_lx
" %c %c\n", nr
, env
->nb_tlb
,
323 pte_is_valid(tlb
->pte0
) ? "valid" : "inval",
324 tlb
->EPN
, eaddr
, tlb
->pte1
,
325 rw
? 'S' : 'L', access_type
== ACCESS_CODE
? 'I' : 'D');
326 switch (ppc6xx_tlb_pte_check(ctx
, tlb
->pte0
, tlb
->pte1
, 0, rw
, access_type
)) {
328 /* TLB inconsistency */
331 /* Access violation */
341 /* XXX: we should go on looping to check all TLBs consistency
342 * but we can speed-up the whole thing as the
343 * result would be undefined if TLBs are not consistent.
352 LOG_SWTLB("found TLB at addr " TARGET_FMT_plx
" prot=%01x ret=%d\n",
353 ctx
->raddr
& TARGET_PAGE_MASK
, ctx
->prot
, ret
);
354 /* Update page flags */
355 pte_update_flags(ctx
, &env
->tlb
.tlb6
[best
].pte1
, ret
, rw
);
361 /* Perform BAT hit & translation */
362 static inline void bat_size_prot(CPUPPCState
*env
, target_ulong
*blp
,
363 int *validp
, int *protp
, target_ulong
*BATu
,
369 bl
= (*BATu
& 0x00001FFC) << 15;
372 if (((msr_pr
== 0) && (*BATu
& 0x00000002)) ||
373 ((msr_pr
!= 0) && (*BATu
& 0x00000001))) {
375 pp
= *BATl
& 0x00000003;
377 prot
= PAGE_READ
| PAGE_EXEC
;
388 static int get_bat_6xx_tlb(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
389 target_ulong
virtual, int rw
, int type
)
391 target_ulong
*BATlt
, *BATut
, *BATu
, *BATl
;
392 target_ulong BEPIl
, BEPIu
, bl
;
396 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx
"\n", __func__
,
397 type
== ACCESS_CODE
? 'I' : 'D', virtual);
400 BATlt
= env
->IBAT
[1];
401 BATut
= env
->IBAT
[0];
404 BATlt
= env
->DBAT
[1];
405 BATut
= env
->DBAT
[0];
408 for (i
= 0; i
< env
->nb_BATs
; i
++) {
411 BEPIu
= *BATu
& 0xF0000000;
412 BEPIl
= *BATu
& 0x0FFE0000;
413 bat_size_prot(env
, &bl
, &valid
, &prot
, BATu
, BATl
);
414 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx
" BATu " TARGET_FMT_lx
415 " BATl " TARGET_FMT_lx
"\n", __func__
,
416 type
== ACCESS_CODE
? 'I' : 'D', i
, virtual, *BATu
, *BATl
);
417 if ((virtual & 0xF0000000) == BEPIu
&&
418 ((virtual & 0x0FFE0000) & ~bl
) == BEPIl
) {
421 /* Get physical address */
422 ctx
->raddr
= (*BATl
& 0xF0000000) |
423 ((virtual & 0x0FFE0000 & bl
) | (*BATl
& 0x0FFE0000)) |
424 (virtual & 0x0001F000);
425 /* Compute access rights */
427 ret
= check_prot(ctx
->prot
, rw
, type
);
429 LOG_BATS("BAT %d match: r " TARGET_FMT_plx
" prot=%c%c\n",
430 i
, ctx
->raddr
, ctx
->prot
& PAGE_READ
? 'R' : '-',
431 ctx
->prot
& PAGE_WRITE
? 'W' : '-');
438 #if defined(DEBUG_BATS)
439 if (qemu_log_enabled()) {
440 LOG_BATS("no BAT match for " TARGET_FMT_lx
":\n", virtual);
441 for (i
= 0; i
< 4; i
++) {
444 BEPIu
= *BATu
& 0xF0000000;
445 BEPIl
= *BATu
& 0x0FFE0000;
446 bl
= (*BATu
& 0x00001FFC) << 15;
447 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx
" BATu " TARGET_FMT_lx
448 " BATl " TARGET_FMT_lx
"\n\t" TARGET_FMT_lx
" "
449 TARGET_FMT_lx
" " TARGET_FMT_lx
"\n",
450 __func__
, type
== ACCESS_CODE
? 'I' : 'D', i
, virtual,
451 *BATu
, *BATl
, BEPIu
, BEPIl
, bl
);
460 /* Perform segment based translation */
461 static inline int get_segment_6xx_tlb(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
462 target_ulong eaddr
, int rw
, int type
)
466 int ds
, pr
, target_page_bits
;
468 target_ulong sr
, pgidx
;
473 sr
= env
->sr
[eaddr
>> 28];
474 ctx
->key
= (((sr
& 0x20000000) && (pr
!= 0)) ||
475 ((sr
& 0x40000000) && (pr
== 0))) ? 1 : 0;
476 ds
= sr
& 0x80000000 ? 1 : 0;
477 ctx
->nx
= sr
& 0x10000000 ? 1 : 0;
478 vsid
= sr
& 0x00FFFFFF;
479 target_page_bits
= TARGET_PAGE_BITS
;
480 LOG_MMU("Check segment v=" TARGET_FMT_lx
" %d " TARGET_FMT_lx
" nip="
481 TARGET_FMT_lx
" lr=" TARGET_FMT_lx
482 " ir=%d dr=%d pr=%d %d t=%d\n",
483 eaddr
, (int)(eaddr
>> 28), sr
, env
->nip
, env
->lr
, (int)msr_ir
,
484 (int)msr_dr
, pr
!= 0 ? 1 : 0, rw
, type
);
485 pgidx
= (eaddr
& ~SEGMENT_MASK_256M
) >> target_page_bits
;
487 ctx
->ptem
= (vsid
<< 7) | (pgidx
>> 10);
489 LOG_MMU("pte segment: key=%d ds %d nx %d vsid " TARGET_FMT_lx
"\n",
490 ctx
->key
, ds
, ctx
->nx
, vsid
);
493 /* Check if instruction fetch is allowed, if needed */
494 if (type
!= ACCESS_CODE
|| ctx
->nx
== 0) {
495 /* Page address translation */
496 LOG_MMU("htab_base " TARGET_FMT_plx
" htab_mask " TARGET_FMT_plx
497 " hash " TARGET_FMT_plx
"\n",
498 env
->htab_base
, env
->htab_mask
, hash
);
500 ctx
->hash
[1] = ~hash
;
502 /* Initialize real address with an invalid value */
503 ctx
->raddr
= (hwaddr
)-1ULL;
504 /* Software TLB search */
505 ret
= ppc6xx_tlb_check(env
, ctx
, eaddr
, rw
, type
);
506 #if defined(DUMP_PAGE_TABLES)
507 if (qemu_log_enabled()) {
509 uint32_t a0
, a1
, a2
, a3
;
511 qemu_log("Page table: " TARGET_FMT_plx
" len " TARGET_FMT_plx
512 "\n", sdr
, mask
+ 0x80);
513 for (curaddr
= sdr
; curaddr
< (sdr
+ mask
+ 0x80);
515 a0
= ldl_phys(curaddr
);
516 a1
= ldl_phys(curaddr
+ 4);
517 a2
= ldl_phys(curaddr
+ 8);
518 a3
= ldl_phys(curaddr
+ 12);
519 if (a0
!= 0 || a1
!= 0 || a2
!= 0 || a3
!= 0) {
520 qemu_log(TARGET_FMT_plx
": %08x %08x %08x %08x\n",
521 curaddr
, a0
, a1
, a2
, a3
);
527 LOG_MMU("No access allowed\n");
533 LOG_MMU("direct store...\n");
534 /* Direct-store segment : absolutely *BUGGY* for now */
536 /* Direct-store implies a 32-bit MMU.
537 * Check the Segment Register's bus unit ID (BUID).
539 sr
= env
->sr
[eaddr
>> 28];
540 if ((sr
& 0x1FF00000) >> 20 == 0x07f) {
541 /* Memory-forced I/O controller interface access */
542 /* If T=1 and BUID=x'07F', the 601 performs a memory access
543 * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
545 ctx
->raddr
= ((sr
& 0xF) << 28) | (eaddr
& 0x0FFFFFFF);
546 ctx
->prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
552 /* Integer load/store : only access allowed */
555 /* No code fetch is allowed in direct-store areas */
558 /* Floating point load/store */
561 /* lwarx, ldarx or srwcx. */
564 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
565 /* Should make the instruction do no-op.
566 * As it already do no-op, it's quite easy :-)
574 qemu_log("ERROR: instruction should not need "
575 "address translation\n");
578 if ((rw
== 1 || ctx
->key
!= 1) && (rw
== 0 || ctx
->key
!= 0)) {
589 /* Generic TLB check function for embedded PowerPC implementations */
590 static int ppcemb_tlb_check(CPUPPCState
*env
, ppcemb_tlb_t
*tlb
,
592 target_ulong address
, uint32_t pid
, int ext
,
597 /* Check valid flag */
598 if (!(tlb
->prot
& PAGE_VALID
)) {
601 mask
= ~(tlb
->size
- 1);
602 LOG_SWTLB("%s: TLB %d address " TARGET_FMT_lx
" PID %u <=> " TARGET_FMT_lx
603 " " TARGET_FMT_lx
" %u %x\n", __func__
, i
, address
, pid
, tlb
->EPN
,
604 mask
, (uint32_t)tlb
->PID
, tlb
->prot
);
606 if (tlb
->PID
!= 0 && tlb
->PID
!= pid
) {
609 /* Check effective address */
610 if ((address
& mask
) != tlb
->EPN
) {
613 *raddrp
= (tlb
->RPN
& mask
) | (address
& ~mask
);
615 /* Extend the physical address to 36 bits */
616 *raddrp
|= (uint64_t)(tlb
->RPN
& 0xF) << 32;
622 /* Generic TLB search function for PowerPC embedded implementations */
623 static int ppcemb_tlb_search(CPUPPCState
*env
, target_ulong address
,
630 /* Default return value is no match */
632 for (i
= 0; i
< env
->nb_tlb
; i
++) {
633 tlb
= &env
->tlb
.tlbe
[i
];
634 if (ppcemb_tlb_check(env
, tlb
, &raddr
, address
, pid
, 0, i
) == 0) {
643 /* Helpers specific to PowerPC 40x implementations */
644 static inline void ppc4xx_tlb_invalidate_all(CPUPPCState
*env
)
649 for (i
= 0; i
< env
->nb_tlb
; i
++) {
650 tlb
= &env
->tlb
.tlbe
[i
];
651 tlb
->prot
&= ~PAGE_VALID
;
656 static inline void ppc4xx_tlb_invalidate_virt(CPUPPCState
*env
,
657 target_ulong eaddr
, uint32_t pid
)
659 #if !defined(FLUSH_ALL_TLBS)
662 target_ulong page
, end
;
665 for (i
= 0; i
< env
->nb_tlb
; i
++) {
666 tlb
= &env
->tlb
.tlbe
[i
];
667 if (ppcemb_tlb_check(env
, tlb
, &raddr
, eaddr
, pid
, 0, i
) == 0) {
668 end
= tlb
->EPN
+ tlb
->size
;
669 for (page
= tlb
->EPN
; page
< end
; page
+= TARGET_PAGE_SIZE
) {
670 tlb_flush_page(env
, page
);
672 tlb
->prot
&= ~PAGE_VALID
;
677 ppc4xx_tlb_invalidate_all(env
);
681 static int mmu40x_get_physical_address(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
682 target_ulong address
, int rw
,
687 int i
, ret
, zsel
, zpr
, pr
;
690 raddr
= (hwaddr
)-1ULL;
692 for (i
= 0; i
< env
->nb_tlb
; i
++) {
693 tlb
= &env
->tlb
.tlbe
[i
];
694 if (ppcemb_tlb_check(env
, tlb
, &raddr
, address
,
695 env
->spr
[SPR_40x_PID
], 0, i
) < 0) {
698 zsel
= (tlb
->attr
>> 4) & 0xF;
699 zpr
= (env
->spr
[SPR_40x_ZPR
] >> (30 - (2 * zsel
))) & 0x3;
700 LOG_SWTLB("%s: TLB %d zsel %d zpr %d rw %d attr %08x\n",
701 __func__
, i
, zsel
, zpr
, rw
, tlb
->attr
);
702 /* Check execute enable bit */
710 /* All accesses granted */
711 ctx
->prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
716 /* Raise Zone protection fault. */
717 env
->spr
[SPR_40x_ESR
] = 1 << 22;
725 /* Check from TLB entry */
726 ctx
->prot
= tlb
->prot
;
727 ret
= check_prot(ctx
->prot
, rw
, access_type
);
729 env
->spr
[SPR_40x_ESR
] = 0;
735 LOG_SWTLB("%s: access granted " TARGET_FMT_lx
" => " TARGET_FMT_plx
736 " %d %d\n", __func__
, address
, ctx
->raddr
, ctx
->prot
,
741 LOG_SWTLB("%s: access refused " TARGET_FMT_lx
" => " TARGET_FMT_plx
742 " %d %d\n", __func__
, address
, raddr
, ctx
->prot
, ret
);
747 void store_40x_sler(CPUPPCState
*env
, uint32_t val
)
749 /* XXX: TO BE FIXED */
750 if (val
!= 0x00000000) {
751 cpu_abort(env
, "Little-endian regions are not supported by now\n");
753 env
->spr
[SPR_405_SLER
] = val
;
756 static inline int mmubooke_check_tlb(CPUPPCState
*env
, ppcemb_tlb_t
*tlb
,
757 hwaddr
*raddr
, int *prot
,
758 target_ulong address
, int rw
,
759 int access_type
, int i
)
763 if (ppcemb_tlb_check(env
, tlb
, raddr
, address
,
764 env
->spr
[SPR_BOOKE_PID
],
765 !env
->nb_pids
, i
) >= 0) {
769 if (env
->spr
[SPR_BOOKE_PID1
] &&
770 ppcemb_tlb_check(env
, tlb
, raddr
, address
,
771 env
->spr
[SPR_BOOKE_PID1
], 0, i
) >= 0) {
775 if (env
->spr
[SPR_BOOKE_PID2
] &&
776 ppcemb_tlb_check(env
, tlb
, raddr
, address
,
777 env
->spr
[SPR_BOOKE_PID2
], 0, i
) >= 0) {
781 LOG_SWTLB("%s: TLB entry not found\n", __func__
);
787 prot2
= tlb
->prot
& 0xF;
789 prot2
= (tlb
->prot
>> 4) & 0xF;
792 /* Check the address space */
793 if (access_type
== ACCESS_CODE
) {
794 if (msr_ir
!= (tlb
->attr
& 1)) {
795 LOG_SWTLB("%s: AS doesn't match\n", __func__
);
800 if (prot2
& PAGE_EXEC
) {
801 LOG_SWTLB("%s: good TLB!\n", __func__
);
805 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__
, prot2
);
808 if (msr_dr
!= (tlb
->attr
& 1)) {
809 LOG_SWTLB("%s: AS doesn't match\n", __func__
);
814 if ((!rw
&& prot2
& PAGE_READ
) || (rw
&& (prot2
& PAGE_WRITE
))) {
815 LOG_SWTLB("%s: found TLB!\n", __func__
);
819 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__
, prot2
);
826 static int mmubooke_get_physical_address(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
827 target_ulong address
, int rw
,
835 raddr
= (hwaddr
)-1ULL;
836 for (i
= 0; i
< env
->nb_tlb
; i
++) {
837 tlb
= &env
->tlb
.tlbe
[i
];
838 ret
= mmubooke_check_tlb(env
, tlb
, &raddr
, &ctx
->prot
, address
, rw
,
847 LOG_SWTLB("%s: access granted " TARGET_FMT_lx
" => " TARGET_FMT_plx
848 " %d %d\n", __func__
, address
, ctx
->raddr
, ctx
->prot
,
851 LOG_SWTLB("%s: access refused " TARGET_FMT_lx
" => " TARGET_FMT_plx
852 " %d %d\n", __func__
, address
, raddr
, ctx
->prot
, ret
);
858 static void booke206_flush_tlb(CPUPPCState
*env
, int flags
,
859 const int check_iprot
)
863 ppcmas_tlb_t
*tlb
= env
->tlb
.tlbm
;
865 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
866 if (flags
& (1 << i
)) {
867 tlb_size
= booke206_tlb_size(env
, i
);
868 for (j
= 0; j
< tlb_size
; j
++) {
869 if (!check_iprot
|| !(tlb
[j
].mas1
& MAS1_IPROT
)) {
870 tlb
[j
].mas1
&= ~MAS1_VALID
;
874 tlb
+= booke206_tlb_size(env
, i
);
880 static hwaddr
booke206_tlb_to_page_size(CPUPPCState
*env
,
885 tlbm_size
= (tlb
->mas1
& MAS1_TSIZE_MASK
) >> MAS1_TSIZE_SHIFT
;
887 return 1024ULL << tlbm_size
;
890 /* TLB check function for MAS based SoftTLBs */
891 static int ppcmas_tlb_check(CPUPPCState
*env
, ppcmas_tlb_t
*tlb
,
893 target_ulong address
, uint32_t pid
)
898 /* Check valid flag */
899 if (!(tlb
->mas1
& MAS1_VALID
)) {
903 mask
= ~(booke206_tlb_to_page_size(env
, tlb
) - 1);
904 LOG_SWTLB("%s: TLB ADDR=0x" TARGET_FMT_lx
" PID=0x%x MAS1=0x%x MAS2=0x%"
905 PRIx64
" mask=0x" TARGET_FMT_lx
" MAS7_3=0x%" PRIx64
" MAS8=%x\n",
906 __func__
, address
, pid
, tlb
->mas1
, tlb
->mas2
, mask
, tlb
->mas7_3
,
910 tlb_pid
= (tlb
->mas1
& MAS1_TID_MASK
) >> MAS1_TID_SHIFT
;
911 if (tlb_pid
!= 0 && tlb_pid
!= pid
) {
915 /* Check effective address */
916 if ((address
& mask
) != (tlb
->mas2
& MAS2_EPN_MASK
)) {
921 *raddrp
= (tlb
->mas7_3
& mask
) | (address
& ~mask
);
927 static int mmubooke206_check_tlb(CPUPPCState
*env
, ppcmas_tlb_t
*tlb
,
928 hwaddr
*raddr
, int *prot
,
929 target_ulong address
, int rw
,
935 if (ppcmas_tlb_check(env
, tlb
, raddr
, address
,
936 env
->spr
[SPR_BOOKE_PID
]) >= 0) {
940 if (env
->spr
[SPR_BOOKE_PID1
] &&
941 ppcmas_tlb_check(env
, tlb
, raddr
, address
,
942 env
->spr
[SPR_BOOKE_PID1
]) >= 0) {
946 if (env
->spr
[SPR_BOOKE_PID2
] &&
947 ppcmas_tlb_check(env
, tlb
, raddr
, address
,
948 env
->spr
[SPR_BOOKE_PID2
]) >= 0) {
952 LOG_SWTLB("%s: TLB entry not found\n", __func__
);
958 if (tlb
->mas7_3
& MAS3_UR
) {
961 if (tlb
->mas7_3
& MAS3_UW
) {
964 if (tlb
->mas7_3
& MAS3_UX
) {
968 if (tlb
->mas7_3
& MAS3_SR
) {
971 if (tlb
->mas7_3
& MAS3_SW
) {
974 if (tlb
->mas7_3
& MAS3_SX
) {
979 /* Check the address space and permissions */
980 if (access_type
== ACCESS_CODE
) {
981 if (msr_ir
!= ((tlb
->mas1
& MAS1_TS
) >> MAS1_TS_SHIFT
)) {
982 LOG_SWTLB("%s: AS doesn't match\n", __func__
);
987 if (prot2
& PAGE_EXEC
) {
988 LOG_SWTLB("%s: good TLB!\n", __func__
);
992 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__
, prot2
);
995 if (msr_dr
!= ((tlb
->mas1
& MAS1_TS
) >> MAS1_TS_SHIFT
)) {
996 LOG_SWTLB("%s: AS doesn't match\n", __func__
);
1001 if ((!rw
&& prot2
& PAGE_READ
) || (rw
&& (prot2
& PAGE_WRITE
))) {
1002 LOG_SWTLB("%s: found TLB!\n", __func__
);
1006 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__
, prot2
);
1013 static int mmubooke206_get_physical_address(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
1014 target_ulong address
, int rw
,
1022 raddr
= (hwaddr
)-1ULL;
1024 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
1025 int ways
= booke206_tlb_ways(env
, i
);
1027 for (j
= 0; j
< ways
; j
++) {
1028 tlb
= booke206_get_tlbm(env
, i
, address
, j
);
1032 ret
= mmubooke206_check_tlb(env
, tlb
, &raddr
, &ctx
->prot
, address
,
1044 LOG_SWTLB("%s: access granted " TARGET_FMT_lx
" => " TARGET_FMT_plx
1045 " %d %d\n", __func__
, address
, ctx
->raddr
, ctx
->prot
,
1048 LOG_SWTLB("%s: access refused " TARGET_FMT_lx
" => " TARGET_FMT_plx
1049 " %d %d\n", __func__
, address
, raddr
, ctx
->prot
, ret
);
1055 static const char *book3e_tsize_to_str
[32] = {
1056 "1K", "2K", "4K", "8K", "16K", "32K", "64K", "128K", "256K", "512K",
1057 "1M", "2M", "4M", "8M", "16M", "32M", "64M", "128M", "256M", "512M",
1058 "1G", "2G", "4G", "8G", "16G", "32G", "64G", "128G", "256G", "512G",
1062 static void mmubooke_dump_mmu(FILE *f
, fprintf_function cpu_fprintf
,
1065 ppcemb_tlb_t
*entry
;
1068 if (kvm_enabled() && !env
->kvm_sw_tlb
) {
1069 cpu_fprintf(f
, "Cannot access KVM TLB\n");
1073 cpu_fprintf(f
, "\nTLB:\n");
1074 cpu_fprintf(f
, "Effective Physical Size PID Prot "
1077 entry
= &env
->tlb
.tlbe
[0];
1078 for (i
= 0; i
< env
->nb_tlb
; i
++, entry
++) {
1081 uint64_t size
= (uint64_t)entry
->size
;
1084 /* Check valid flag */
1085 if (!(entry
->prot
& PAGE_VALID
)) {
1089 mask
= ~(entry
->size
- 1);
1090 ea
= entry
->EPN
& mask
;
1091 pa
= entry
->RPN
& mask
;
1092 /* Extend the physical address to 36 bits */
1093 pa
|= (hwaddr
)(entry
->RPN
& 0xF) << 32;
1096 snprintf(size_buf
, sizeof(size_buf
), "%3" PRId64
"M", size
/ 1024);
1098 snprintf(size_buf
, sizeof(size_buf
), "%3" PRId64
"k", size
);
1100 cpu_fprintf(f
, "0x%016" PRIx64
" 0x%016" PRIx64
" %s %-5u %08x %08x\n",
1101 (uint64_t)ea
, (uint64_t)pa
, size_buf
, (uint32_t)entry
->PID
,
1102 entry
->prot
, entry
->attr
);
1107 static void mmubooke206_dump_one_tlb(FILE *f
, fprintf_function cpu_fprintf
,
1108 CPUPPCState
*env
, int tlbn
, int offset
,
1111 ppcmas_tlb_t
*entry
;
1114 cpu_fprintf(f
, "\nTLB%d:\n", tlbn
);
1115 cpu_fprintf(f
, "Effective Physical Size TID TS SRWX"
1116 " URWX WIMGE U0123\n");
1118 entry
= &env
->tlb
.tlbm
[offset
];
1119 for (i
= 0; i
< tlbsize
; i
++, entry
++) {
1120 hwaddr ea
, pa
, size
;
1123 if (!(entry
->mas1
& MAS1_VALID
)) {
1127 tsize
= (entry
->mas1
& MAS1_TSIZE_MASK
) >> MAS1_TSIZE_SHIFT
;
1128 size
= 1024ULL << tsize
;
1129 ea
= entry
->mas2
& ~(size
- 1);
1130 pa
= entry
->mas7_3
& ~(size
- 1);
1132 cpu_fprintf(f
, "0x%016" PRIx64
" 0x%016" PRIx64
" %4s %-5u %1u S%c%c%c"
1133 "U%c%c%c %c%c%c%c%c U%c%c%c%c\n",
1134 (uint64_t)ea
, (uint64_t)pa
,
1135 book3e_tsize_to_str
[tsize
],
1136 (entry
->mas1
& MAS1_TID_MASK
) >> MAS1_TID_SHIFT
,
1137 (entry
->mas1
& MAS1_TS
) >> MAS1_TS_SHIFT
,
1138 entry
->mas7_3
& MAS3_SR
? 'R' : '-',
1139 entry
->mas7_3
& MAS3_SW
? 'W' : '-',
1140 entry
->mas7_3
& MAS3_SX
? 'X' : '-',
1141 entry
->mas7_3
& MAS3_UR
? 'R' : '-',
1142 entry
->mas7_3
& MAS3_UW
? 'W' : '-',
1143 entry
->mas7_3
& MAS3_UX
? 'X' : '-',
1144 entry
->mas2
& MAS2_W
? 'W' : '-',
1145 entry
->mas2
& MAS2_I
? 'I' : '-',
1146 entry
->mas2
& MAS2_M
? 'M' : '-',
1147 entry
->mas2
& MAS2_G
? 'G' : '-',
1148 entry
->mas2
& MAS2_E
? 'E' : '-',
1149 entry
->mas7_3
& MAS3_U0
? '0' : '-',
1150 entry
->mas7_3
& MAS3_U1
? '1' : '-',
1151 entry
->mas7_3
& MAS3_U2
? '2' : '-',
1152 entry
->mas7_3
& MAS3_U3
? '3' : '-');
1156 static void mmubooke206_dump_mmu(FILE *f
, fprintf_function cpu_fprintf
,
1162 if (kvm_enabled() && !env
->kvm_sw_tlb
) {
1163 cpu_fprintf(f
, "Cannot access KVM TLB\n");
1167 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
1168 int size
= booke206_tlb_size(env
, i
);
1174 mmubooke206_dump_one_tlb(f
, cpu_fprintf
, env
, i
, offset
, size
);
1179 void dump_mmu(FILE *f
, fprintf_function cpu_fprintf
, CPUPPCState
*env
)
1181 switch (env
->mmu_model
) {
1182 case POWERPC_MMU_BOOKE
:
1183 mmubooke_dump_mmu(f
, cpu_fprintf
, env
);
1185 case POWERPC_MMU_BOOKE206
:
1186 mmubooke206_dump_mmu(f
, cpu_fprintf
, env
);
1188 #if defined(TARGET_PPC64)
1189 case POWERPC_MMU_64B
:
1190 case POWERPC_MMU_2_06
:
1191 case POWERPC_MMU_2_06d
:
1192 dump_slb(f
, cpu_fprintf
, env
);
1196 qemu_log_mask(LOG_UNIMP
, "%s: unimplemented\n", __func__
);
1200 static inline int check_physical(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
1201 target_ulong eaddr
, int rw
)
1206 ctx
->prot
= PAGE_READ
| PAGE_EXEC
;
1208 switch (env
->mmu_model
) {
1209 case POWERPC_MMU_SOFT_6xx
:
1210 case POWERPC_MMU_SOFT_74xx
:
1211 case POWERPC_MMU_SOFT_4xx
:
1212 case POWERPC_MMU_REAL
:
1213 case POWERPC_MMU_BOOKE
:
1214 ctx
->prot
|= PAGE_WRITE
;
1217 case POWERPC_MMU_SOFT_4xx_Z
:
1218 if (unlikely(msr_pe
!= 0)) {
1219 /* 403 family add some particular protections,
1220 * using PBL/PBU registers for accesses with no translation.
1223 /* Check PLB validity */
1224 (env
->pb
[0] < env
->pb
[1] &&
1225 /* and address in plb area */
1226 eaddr
>= env
->pb
[0] && eaddr
< env
->pb
[1]) ||
1227 (env
->pb
[2] < env
->pb
[3] &&
1228 eaddr
>= env
->pb
[2] && eaddr
< env
->pb
[3]) ? 1 : 0;
1229 if (in_plb
^ msr_px
) {
1230 /* Access in protected area */
1232 /* Access is not allowed */
1236 /* Read-write access is allowed */
1237 ctx
->prot
|= PAGE_WRITE
;
1243 /* Caller's checks mean we should never get here for other models */
1251 static int get_physical_address(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
1252 target_ulong eaddr
, int rw
, int access_type
)
1255 bool real_mode
= (access_type
== ACCESS_CODE
&& msr_ir
== 0)
1256 || (access_type
!= ACCESS_CODE
&& msr_dr
== 0);
1259 qemu_log("%s\n", __func__
);
1262 switch (env
->mmu_model
) {
1263 case POWERPC_MMU_SOFT_6xx
:
1264 case POWERPC_MMU_SOFT_74xx
:
1266 ret
= check_physical(env
, ctx
, eaddr
, rw
);
1268 /* Try to find a BAT */
1269 if (env
->nb_BATs
!= 0) {
1270 ret
= get_bat_6xx_tlb(env
, ctx
, eaddr
, rw
, access_type
);
1273 /* We didn't match any BAT entry or don't have BATs */
1274 ret
= get_segment_6xx_tlb(env
, ctx
, eaddr
, rw
, access_type
);
1279 case POWERPC_MMU_SOFT_4xx
:
1280 case POWERPC_MMU_SOFT_4xx_Z
:
1282 ret
= check_physical(env
, ctx
, eaddr
, rw
);
1284 ret
= mmu40x_get_physical_address(env
, ctx
, eaddr
,
1288 case POWERPC_MMU_BOOKE
:
1289 ret
= mmubooke_get_physical_address(env
, ctx
, eaddr
,
1292 case POWERPC_MMU_BOOKE206
:
1293 ret
= mmubooke206_get_physical_address(env
, ctx
, eaddr
, rw
,
1296 case POWERPC_MMU_MPC8xx
:
1298 cpu_abort(env
, "MPC8xx MMU model is not implemented\n");
1300 case POWERPC_MMU_REAL
:
1302 ret
= check_physical(env
, ctx
, eaddr
, rw
);
1304 cpu_abort(env
, "PowerPC in real mode do not do any translation\n");
1308 cpu_abort(env
, "Unknown or invalid MMU model\n");
1312 qemu_log("%s address " TARGET_FMT_lx
" => %d " TARGET_FMT_plx
"\n",
1313 __func__
, eaddr
, ret
, ctx
->raddr
);
1319 hwaddr
cpu_get_phys_page_debug(CPUPPCState
*env
, target_ulong addr
)
1323 switch (env
->mmu_model
) {
1324 #if defined(TARGET_PPC64)
1325 case POWERPC_MMU_64B
:
1326 case POWERPC_MMU_2_06
:
1327 case POWERPC_MMU_2_06d
:
1328 return ppc_hash64_get_phys_page_debug(env
, addr
);
1331 case POWERPC_MMU_32B
:
1332 case POWERPC_MMU_601
:
1333 return ppc_hash32_get_phys_page_debug(env
, addr
);
1339 if (unlikely(get_physical_address(env
, &ctx
, addr
, 0, ACCESS_INT
) != 0)) {
1343 return ctx
.raddr
& TARGET_PAGE_MASK
;
1346 static void booke206_update_mas_tlb_miss(CPUPPCState
*env
, target_ulong address
,
1349 env
->spr
[SPR_BOOKE_MAS0
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_TLBSELD_MASK
;
1350 env
->spr
[SPR_BOOKE_MAS1
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_TSIZED_MASK
;
1351 env
->spr
[SPR_BOOKE_MAS2
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_WIMGED_MASK
;
1352 env
->spr
[SPR_BOOKE_MAS3
] = 0;
1353 env
->spr
[SPR_BOOKE_MAS6
] = 0;
1354 env
->spr
[SPR_BOOKE_MAS7
] = 0;
1357 if (((rw
== 2) && msr_ir
) || ((rw
!= 2) && msr_dr
)) {
1358 env
->spr
[SPR_BOOKE_MAS1
] |= MAS1_TS
;
1359 env
->spr
[SPR_BOOKE_MAS6
] |= MAS6_SAS
;
1362 env
->spr
[SPR_BOOKE_MAS1
] |= MAS1_VALID
;
1363 env
->spr
[SPR_BOOKE_MAS2
] |= address
& MAS2_EPN_MASK
;
1365 switch (env
->spr
[SPR_BOOKE_MAS4
] & MAS4_TIDSELD_PIDZ
) {
1366 case MAS4_TIDSELD_PID0
:
1367 env
->spr
[SPR_BOOKE_MAS1
] |= env
->spr
[SPR_BOOKE_PID
] << MAS1_TID_SHIFT
;
1369 case MAS4_TIDSELD_PID1
:
1370 env
->spr
[SPR_BOOKE_MAS1
] |= env
->spr
[SPR_BOOKE_PID1
] << MAS1_TID_SHIFT
;
1372 case MAS4_TIDSELD_PID2
:
1373 env
->spr
[SPR_BOOKE_MAS1
] |= env
->spr
[SPR_BOOKE_PID2
] << MAS1_TID_SHIFT
;
1377 env
->spr
[SPR_BOOKE_MAS6
] |= env
->spr
[SPR_BOOKE_PID
] << 16;
1379 /* next victim logic */
1380 env
->spr
[SPR_BOOKE_MAS0
] |= env
->last_way
<< MAS0_ESEL_SHIFT
;
1382 env
->last_way
&= booke206_tlb_ways(env
, 0) - 1;
1383 env
->spr
[SPR_BOOKE_MAS0
] |= env
->last_way
<< MAS0_NV_SHIFT
;
1386 /* Perform address translation */
1387 static int cpu_ppc_handle_mmu_fault(CPUPPCState
*env
, target_ulong address
,
1388 int rw
, int mmu_idx
)
1394 switch (env
->mmu_model
) {
1395 #if defined(TARGET_PPC64)
1396 case POWERPC_MMU_64B
:
1397 case POWERPC_MMU_2_06
:
1398 case POWERPC_MMU_2_06d
:
1399 return ppc_hash64_handle_mmu_fault(env
, address
, rw
, mmu_idx
);
1402 case POWERPC_MMU_32B
:
1403 case POWERPC_MMU_601
:
1404 return ppc_hash32_handle_mmu_fault(env
, address
, rw
, mmu_idx
);
1407 ; /* Otherwise fall through to the general code below */
1413 access_type
= ACCESS_CODE
;
1416 access_type
= env
->access_type
;
1418 ret
= get_physical_address(env
, &ctx
, address
, rw
, access_type
);
1420 tlb_set_page(env
, address
& TARGET_PAGE_MASK
,
1421 ctx
.raddr
& TARGET_PAGE_MASK
, ctx
.prot
,
1422 mmu_idx
, TARGET_PAGE_SIZE
);
1424 } else if (ret
< 0) {
1426 if (access_type
== ACCESS_CODE
) {
1429 /* No matches in page tables or TLB */
1430 switch (env
->mmu_model
) {
1431 case POWERPC_MMU_SOFT_6xx
:
1432 env
->exception_index
= POWERPC_EXCP_IFTLB
;
1433 env
->error_code
= 1 << 18;
1434 env
->spr
[SPR_IMISS
] = address
;
1435 env
->spr
[SPR_ICMP
] = 0x80000000 | ctx
.ptem
;
1437 case POWERPC_MMU_SOFT_74xx
:
1438 env
->exception_index
= POWERPC_EXCP_IFTLB
;
1440 case POWERPC_MMU_SOFT_4xx
:
1441 case POWERPC_MMU_SOFT_4xx_Z
:
1442 env
->exception_index
= POWERPC_EXCP_ITLB
;
1443 env
->error_code
= 0;
1444 env
->spr
[SPR_40x_DEAR
] = address
;
1445 env
->spr
[SPR_40x_ESR
] = 0x00000000;
1447 case POWERPC_MMU_BOOKE206
:
1448 booke206_update_mas_tlb_miss(env
, address
, rw
);
1450 case POWERPC_MMU_BOOKE
:
1451 env
->exception_index
= POWERPC_EXCP_ITLB
;
1452 env
->error_code
= 0;
1453 env
->spr
[SPR_BOOKE_DEAR
] = address
;
1455 case POWERPC_MMU_MPC8xx
:
1457 cpu_abort(env
, "MPC8xx MMU model is not implemented\n");
1459 case POWERPC_MMU_REAL
:
1460 cpu_abort(env
, "PowerPC in real mode should never raise "
1461 "any MMU exceptions\n");
1464 cpu_abort(env
, "Unknown or invalid MMU model\n");
1469 /* Access rights violation */
1470 env
->exception_index
= POWERPC_EXCP_ISI
;
1471 env
->error_code
= 0x08000000;
1474 /* No execute protection violation */
1475 if ((env
->mmu_model
== POWERPC_MMU_BOOKE
) ||
1476 (env
->mmu_model
== POWERPC_MMU_BOOKE206
)) {
1477 env
->spr
[SPR_BOOKE_ESR
] = 0x00000000;
1479 env
->exception_index
= POWERPC_EXCP_ISI
;
1480 env
->error_code
= 0x10000000;
1483 /* Direct store exception */
1484 /* No code fetch is allowed in direct-store areas */
1485 env
->exception_index
= POWERPC_EXCP_ISI
;
1486 env
->error_code
= 0x10000000;
1492 /* No matches in page tables or TLB */
1493 switch (env
->mmu_model
) {
1494 case POWERPC_MMU_SOFT_6xx
:
1496 env
->exception_index
= POWERPC_EXCP_DSTLB
;
1497 env
->error_code
= 1 << 16;
1499 env
->exception_index
= POWERPC_EXCP_DLTLB
;
1500 env
->error_code
= 0;
1502 env
->spr
[SPR_DMISS
] = address
;
1503 env
->spr
[SPR_DCMP
] = 0x80000000 | ctx
.ptem
;
1505 env
->error_code
|= ctx
.key
<< 19;
1506 env
->spr
[SPR_HASH1
] = env
->htab_base
+
1507 get_pteg_offset32(env
, ctx
.hash
[0]);
1508 env
->spr
[SPR_HASH2
] = env
->htab_base
+
1509 get_pteg_offset32(env
, ctx
.hash
[1]);
1511 case POWERPC_MMU_SOFT_74xx
:
1513 env
->exception_index
= POWERPC_EXCP_DSTLB
;
1515 env
->exception_index
= POWERPC_EXCP_DLTLB
;
1518 /* Implement LRU algorithm */
1519 env
->error_code
= ctx
.key
<< 19;
1520 env
->spr
[SPR_TLBMISS
] = (address
& ~((target_ulong
)0x3)) |
1521 ((env
->last_way
+ 1) & (env
->nb_ways
- 1));
1522 env
->spr
[SPR_PTEHI
] = 0x80000000 | ctx
.ptem
;
1524 case POWERPC_MMU_SOFT_4xx
:
1525 case POWERPC_MMU_SOFT_4xx_Z
:
1526 env
->exception_index
= POWERPC_EXCP_DTLB
;
1527 env
->error_code
= 0;
1528 env
->spr
[SPR_40x_DEAR
] = address
;
1530 env
->spr
[SPR_40x_ESR
] = 0x00800000;
1532 env
->spr
[SPR_40x_ESR
] = 0x00000000;
1535 case POWERPC_MMU_MPC8xx
:
1537 cpu_abort(env
, "MPC8xx MMU model is not implemented\n");
1539 case POWERPC_MMU_BOOKE206
:
1540 booke206_update_mas_tlb_miss(env
, address
, rw
);
1542 case POWERPC_MMU_BOOKE
:
1543 env
->exception_index
= POWERPC_EXCP_DTLB
;
1544 env
->error_code
= 0;
1545 env
->spr
[SPR_BOOKE_DEAR
] = address
;
1546 env
->spr
[SPR_BOOKE_ESR
] = rw
? ESR_ST
: 0;
1548 case POWERPC_MMU_REAL
:
1549 cpu_abort(env
, "PowerPC in real mode should never raise "
1550 "any MMU exceptions\n");
1553 cpu_abort(env
, "Unknown or invalid MMU model\n");
1558 /* Access rights violation */
1559 env
->exception_index
= POWERPC_EXCP_DSI
;
1560 env
->error_code
= 0;
1561 if (env
->mmu_model
== POWERPC_MMU_SOFT_4xx
1562 || env
->mmu_model
== POWERPC_MMU_SOFT_4xx_Z
) {
1563 env
->spr
[SPR_40x_DEAR
] = address
;
1565 env
->spr
[SPR_40x_ESR
] |= 0x00800000;
1567 } else if ((env
->mmu_model
== POWERPC_MMU_BOOKE
) ||
1568 (env
->mmu_model
== POWERPC_MMU_BOOKE206
)) {
1569 env
->spr
[SPR_BOOKE_DEAR
] = address
;
1570 env
->spr
[SPR_BOOKE_ESR
] = rw
? ESR_ST
: 0;
1572 env
->spr
[SPR_DAR
] = address
;
1574 env
->spr
[SPR_DSISR
] = 0x0A000000;
1576 env
->spr
[SPR_DSISR
] = 0x08000000;
1581 /* Direct store exception */
1582 switch (access_type
) {
1584 /* Floating point load/store */
1585 env
->exception_index
= POWERPC_EXCP_ALIGN
;
1586 env
->error_code
= POWERPC_EXCP_ALIGN_FP
;
1587 env
->spr
[SPR_DAR
] = address
;
1590 /* lwarx, ldarx or stwcx. */
1591 env
->exception_index
= POWERPC_EXCP_DSI
;
1592 env
->error_code
= 0;
1593 env
->spr
[SPR_DAR
] = address
;
1595 env
->spr
[SPR_DSISR
] = 0x06000000;
1597 env
->spr
[SPR_DSISR
] = 0x04000000;
1601 /* eciwx or ecowx */
1602 env
->exception_index
= POWERPC_EXCP_DSI
;
1603 env
->error_code
= 0;
1604 env
->spr
[SPR_DAR
] = address
;
1606 env
->spr
[SPR_DSISR
] = 0x06100000;
1608 env
->spr
[SPR_DSISR
] = 0x04100000;
1612 printf("DSI: invalid exception (%d)\n", ret
);
1613 env
->exception_index
= POWERPC_EXCP_PROGRAM
;
1615 POWERPC_EXCP_INVAL
| POWERPC_EXCP_INVAL_INVAL
;
1616 env
->spr
[SPR_DAR
] = address
;
1623 printf("%s: set exception to %d %02x\n", __func__
,
1624 env
->exception
, env
->error_code
);
1632 /*****************************************************************************/
1633 /* BATs management */
1634 #if !defined(FLUSH_ALL_TLBS)
1635 static inline void do_invalidate_BAT(CPUPPCState
*env
, target_ulong BATu
,
1638 target_ulong base
, end
, page
;
1640 base
= BATu
& ~0x0001FFFF;
1641 end
= base
+ mask
+ 0x00020000;
1642 LOG_BATS("Flush BAT from " TARGET_FMT_lx
" to " TARGET_FMT_lx
" ("
1643 TARGET_FMT_lx
")\n", base
, end
, mask
);
1644 for (page
= base
; page
!= end
; page
+= TARGET_PAGE_SIZE
) {
1645 tlb_flush_page(env
, page
);
1647 LOG_BATS("Flush done\n");
1651 static inline void dump_store_bat(CPUPPCState
*env
, char ID
, int ul
, int nr
,
1654 LOG_BATS("Set %cBAT%d%c to " TARGET_FMT_lx
" (" TARGET_FMT_lx
")\n", ID
,
1655 nr
, ul
== 0 ? 'u' : 'l', value
, env
->nip
);
1658 void helper_store_ibatu(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1662 dump_store_bat(env
, 'I', 0, nr
, value
);
1663 if (env
->IBAT
[0][nr
] != value
) {
1664 mask
= (value
<< 15) & 0x0FFE0000UL
;
1665 #if !defined(FLUSH_ALL_TLBS)
1666 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1668 /* When storing valid upper BAT, mask BEPI and BRPN
1669 * and invalidate all TLBs covered by this BAT
1671 mask
= (value
<< 15) & 0x0FFE0000UL
;
1672 env
->IBAT
[0][nr
] = (value
& 0x00001FFFUL
) |
1673 (value
& ~0x0001FFFFUL
& ~mask
);
1674 env
->IBAT
[1][nr
] = (env
->IBAT
[1][nr
] & 0x0000007B) |
1675 (env
->IBAT
[1][nr
] & ~0x0001FFFF & ~mask
);
1676 #if !defined(FLUSH_ALL_TLBS)
1677 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1684 void helper_store_ibatl(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1686 dump_store_bat(env
, 'I', 1, nr
, value
);
1687 env
->IBAT
[1][nr
] = value
;
1690 void helper_store_dbatu(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1694 dump_store_bat(env
, 'D', 0, nr
, value
);
1695 if (env
->DBAT
[0][nr
] != value
) {
1696 /* When storing valid upper BAT, mask BEPI and BRPN
1697 * and invalidate all TLBs covered by this BAT
1699 mask
= (value
<< 15) & 0x0FFE0000UL
;
1700 #if !defined(FLUSH_ALL_TLBS)
1701 do_invalidate_BAT(env
, env
->DBAT
[0][nr
], mask
);
1703 mask
= (value
<< 15) & 0x0FFE0000UL
;
1704 env
->DBAT
[0][nr
] = (value
& 0x00001FFFUL
) |
1705 (value
& ~0x0001FFFFUL
& ~mask
);
1706 env
->DBAT
[1][nr
] = (env
->DBAT
[1][nr
] & 0x0000007B) |
1707 (env
->DBAT
[1][nr
] & ~0x0001FFFF & ~mask
);
1708 #if !defined(FLUSH_ALL_TLBS)
1709 do_invalidate_BAT(env
, env
->DBAT
[0][nr
], mask
);
1716 void helper_store_dbatl(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1718 dump_store_bat(env
, 'D', 1, nr
, value
);
1719 env
->DBAT
[1][nr
] = value
;
1722 void helper_store_601_batu(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1725 #if defined(FLUSH_ALL_TLBS)
1729 dump_store_bat(env
, 'I', 0, nr
, value
);
1730 if (env
->IBAT
[0][nr
] != value
) {
1731 #if defined(FLUSH_ALL_TLBS)
1734 mask
= (env
->IBAT
[1][nr
] << 17) & 0x0FFE0000UL
;
1735 if (env
->IBAT
[1][nr
] & 0x40) {
1736 /* Invalidate BAT only if it is valid */
1737 #if !defined(FLUSH_ALL_TLBS)
1738 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1743 /* When storing valid upper BAT, mask BEPI and BRPN
1744 * and invalidate all TLBs covered by this BAT
1746 env
->IBAT
[0][nr
] = (value
& 0x00001FFFUL
) |
1747 (value
& ~0x0001FFFFUL
& ~mask
);
1748 env
->DBAT
[0][nr
] = env
->IBAT
[0][nr
];
1749 if (env
->IBAT
[1][nr
] & 0x40) {
1750 #if !defined(FLUSH_ALL_TLBS)
1751 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1756 #if defined(FLUSH_ALL_TLBS)
1764 void helper_store_601_batl(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1766 #if !defined(FLUSH_ALL_TLBS)
1772 dump_store_bat(env
, 'I', 1, nr
, value
);
1773 if (env
->IBAT
[1][nr
] != value
) {
1774 #if defined(FLUSH_ALL_TLBS)
1777 if (env
->IBAT
[1][nr
] & 0x40) {
1778 #if !defined(FLUSH_ALL_TLBS)
1779 mask
= (env
->IBAT
[1][nr
] << 17) & 0x0FFE0000UL
;
1780 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1786 #if !defined(FLUSH_ALL_TLBS)
1787 mask
= (value
<< 17) & 0x0FFE0000UL
;
1788 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1793 env
->IBAT
[1][nr
] = value
;
1794 env
->DBAT
[1][nr
] = value
;
1795 #if defined(FLUSH_ALL_TLBS)
1803 /*****************************************************************************/
1804 /* TLB management */
1805 void ppc_tlb_invalidate_all(CPUPPCState
*env
)
1807 switch (env
->mmu_model
) {
1808 case POWERPC_MMU_SOFT_6xx
:
1809 case POWERPC_MMU_SOFT_74xx
:
1810 ppc6xx_tlb_invalidate_all(env
);
1812 case POWERPC_MMU_SOFT_4xx
:
1813 case POWERPC_MMU_SOFT_4xx_Z
:
1814 ppc4xx_tlb_invalidate_all(env
);
1816 case POWERPC_MMU_REAL
:
1817 cpu_abort(env
, "No TLB for PowerPC 4xx in real mode\n");
1819 case POWERPC_MMU_MPC8xx
:
1821 cpu_abort(env
, "MPC8xx MMU model is not implemented\n");
1823 case POWERPC_MMU_BOOKE
:
1826 case POWERPC_MMU_BOOKE206
:
1827 booke206_flush_tlb(env
, -1, 0);
1829 case POWERPC_MMU_32B
:
1830 case POWERPC_MMU_601
:
1831 #if defined(TARGET_PPC64)
1832 case POWERPC_MMU_64B
:
1833 case POWERPC_MMU_2_06
:
1834 case POWERPC_MMU_2_06d
:
1835 #endif /* defined(TARGET_PPC64) */
1840 cpu_abort(env
, "Unknown MMU model\n");
1845 void ppc_tlb_invalidate_one(CPUPPCState
*env
, target_ulong addr
)
1847 #if !defined(FLUSH_ALL_TLBS)
1848 addr
&= TARGET_PAGE_MASK
;
1849 switch (env
->mmu_model
) {
1850 case POWERPC_MMU_SOFT_6xx
:
1851 case POWERPC_MMU_SOFT_74xx
:
1852 ppc6xx_tlb_invalidate_virt(env
, addr
, 0);
1853 if (env
->id_tlbs
== 1) {
1854 ppc6xx_tlb_invalidate_virt(env
, addr
, 1);
1857 case POWERPC_MMU_SOFT_4xx
:
1858 case POWERPC_MMU_SOFT_4xx_Z
:
1859 ppc4xx_tlb_invalidate_virt(env
, addr
, env
->spr
[SPR_40x_PID
]);
1861 case POWERPC_MMU_REAL
:
1862 cpu_abort(env
, "No TLB for PowerPC 4xx in real mode\n");
1864 case POWERPC_MMU_MPC8xx
:
1866 cpu_abort(env
, "MPC8xx MMU model is not implemented\n");
1868 case POWERPC_MMU_BOOKE
:
1870 cpu_abort(env
, "BookE MMU model is not implemented\n");
1872 case POWERPC_MMU_BOOKE206
:
1874 cpu_abort(env
, "BookE 2.06 MMU model is not implemented\n");
1876 case POWERPC_MMU_32B
:
1877 case POWERPC_MMU_601
:
1878 /* tlbie invalidate TLBs for all segments */
1879 addr
&= ~((target_ulong
)-1ULL << 28);
1880 /* XXX: this case should be optimized,
1881 * giving a mask to tlb_flush_page
1883 tlb_flush_page(env
, addr
| (0x0 << 28));
1884 tlb_flush_page(env
, addr
| (0x1 << 28));
1885 tlb_flush_page(env
, addr
| (0x2 << 28));
1886 tlb_flush_page(env
, addr
| (0x3 << 28));
1887 tlb_flush_page(env
, addr
| (0x4 << 28));
1888 tlb_flush_page(env
, addr
| (0x5 << 28));
1889 tlb_flush_page(env
, addr
| (0x6 << 28));
1890 tlb_flush_page(env
, addr
| (0x7 << 28));
1891 tlb_flush_page(env
, addr
| (0x8 << 28));
1892 tlb_flush_page(env
, addr
| (0x9 << 28));
1893 tlb_flush_page(env
, addr
| (0xA << 28));
1894 tlb_flush_page(env
, addr
| (0xB << 28));
1895 tlb_flush_page(env
, addr
| (0xC << 28));
1896 tlb_flush_page(env
, addr
| (0xD << 28));
1897 tlb_flush_page(env
, addr
| (0xE << 28));
1898 tlb_flush_page(env
, addr
| (0xF << 28));
1900 #if defined(TARGET_PPC64)
1901 case POWERPC_MMU_64B
:
1902 case POWERPC_MMU_2_06
:
1903 case POWERPC_MMU_2_06d
:
1904 /* tlbie invalidate TLBs for all segments */
1905 /* XXX: given the fact that there are too many segments to invalidate,
1906 * and we still don't have a tlb_flush_mask(env, n, mask) in QEMU,
1907 * we just invalidate all TLBs
1911 #endif /* defined(TARGET_PPC64) */
1914 cpu_abort(env
, "Unknown MMU model\n");
1918 ppc_tlb_invalidate_all(env
);
1922 /*****************************************************************************/
1923 /* Special registers manipulation */
1924 void ppc_store_sdr1(CPUPPCState
*env
, target_ulong value
)
1926 LOG_MMU("%s: " TARGET_FMT_lx
"\n", __func__
, value
);
1927 if (env
->spr
[SPR_SDR1
] != value
) {
1928 env
->spr
[SPR_SDR1
] = value
;
1929 #if defined(TARGET_PPC64)
1930 if (env
->mmu_model
& POWERPC_MMU_64
) {
1931 target_ulong htabsize
= value
& SDR_64_HTABSIZE
;
1933 if (htabsize
> 28) {
1934 fprintf(stderr
, "Invalid HTABSIZE 0x" TARGET_FMT_lx
1935 " stored in SDR1\n", htabsize
);
1938 env
->htab_mask
= (1ULL << (htabsize
+ 18)) - 1;
1939 env
->htab_base
= value
& SDR_64_HTABORG
;
1941 #endif /* defined(TARGET_PPC64) */
1943 /* FIXME: Should check for valid HTABMASK values */
1944 env
->htab_mask
= ((value
& SDR_32_HTABMASK
) << 16) | 0xFFFF;
1945 env
->htab_base
= value
& SDR_32_HTABORG
;
1951 /* Segment registers load and store */
1952 target_ulong
helper_load_sr(CPUPPCState
*env
, target_ulong sr_num
)
1954 #if defined(TARGET_PPC64)
1955 if (env
->mmu_model
& POWERPC_MMU_64
) {
1960 return env
->sr
[sr_num
];
1963 void helper_store_sr(CPUPPCState
*env
, target_ulong srnum
, target_ulong value
)
1965 LOG_MMU("%s: reg=%d " TARGET_FMT_lx
" " TARGET_FMT_lx
"\n", __func__
,
1966 (int)srnum
, value
, env
->sr
[srnum
]);
1967 #if defined(TARGET_PPC64)
1968 if (env
->mmu_model
& POWERPC_MMU_64
) {
1969 uint64_t rb
= 0, rs
= 0;
1972 rb
|= ((uint32_t)srnum
& 0xf) << 28;
1973 /* Set the valid bit */
1976 rb
|= (uint32_t)srnum
;
1979 rs
|= (value
& 0xfffffff) << 12;
1981 rs
|= ((value
>> 27) & 0xf) << 8;
1983 ppc_store_slb(env
, rb
, rs
);
1986 if (env
->sr
[srnum
] != value
) {
1987 env
->sr
[srnum
] = value
;
1988 /* Invalidating 256MB of virtual memory in 4kB pages is way longer than
1989 flusing the whole TLB. */
1990 #if !defined(FLUSH_ALL_TLBS) && 0
1992 target_ulong page
, end
;
1993 /* Invalidate 256 MB of virtual memory */
1994 page
= (16 << 20) * srnum
;
1995 end
= page
+ (16 << 20);
1996 for (; page
!= end
; page
+= TARGET_PAGE_SIZE
) {
1997 tlb_flush_page(env
, page
);
2006 /* TLB management */
2007 void helper_tlbia(CPUPPCState
*env
)
2009 ppc_tlb_invalidate_all(env
);
2012 void helper_tlbie(CPUPPCState
*env
, target_ulong addr
)
2014 ppc_tlb_invalidate_one(env
, addr
);
2017 /* Software driven TLBs management */
2018 /* PowerPC 602/603 software TLB load instructions helpers */
2019 static void do_6xx_tlb(CPUPPCState
*env
, target_ulong new_EPN
, int is_code
)
2021 target_ulong RPN
, CMP
, EPN
;
2024 RPN
= env
->spr
[SPR_RPA
];
2026 CMP
= env
->spr
[SPR_ICMP
];
2027 EPN
= env
->spr
[SPR_IMISS
];
2029 CMP
= env
->spr
[SPR_DCMP
];
2030 EPN
= env
->spr
[SPR_DMISS
];
2032 way
= (env
->spr
[SPR_SRR1
] >> 17) & 1;
2033 (void)EPN
; /* avoid a compiler warning */
2034 LOG_SWTLB("%s: EPN " TARGET_FMT_lx
" " TARGET_FMT_lx
" PTE0 " TARGET_FMT_lx
2035 " PTE1 " TARGET_FMT_lx
" way %d\n", __func__
, new_EPN
, EPN
, CMP
,
2037 /* Store this TLB */
2038 ppc6xx_tlb_store(env
, (uint32_t)(new_EPN
& TARGET_PAGE_MASK
),
2039 way
, is_code
, CMP
, RPN
);
2042 void helper_6xx_tlbd(CPUPPCState
*env
, target_ulong EPN
)
2044 do_6xx_tlb(env
, EPN
, 0);
2047 void helper_6xx_tlbi(CPUPPCState
*env
, target_ulong EPN
)
2049 do_6xx_tlb(env
, EPN
, 1);
2052 /* PowerPC 74xx software TLB load instructions helpers */
2053 static void do_74xx_tlb(CPUPPCState
*env
, target_ulong new_EPN
, int is_code
)
2055 target_ulong RPN
, CMP
, EPN
;
2058 RPN
= env
->spr
[SPR_PTELO
];
2059 CMP
= env
->spr
[SPR_PTEHI
];
2060 EPN
= env
->spr
[SPR_TLBMISS
] & ~0x3;
2061 way
= env
->spr
[SPR_TLBMISS
] & 0x3;
2062 (void)EPN
; /* avoid a compiler warning */
2063 LOG_SWTLB("%s: EPN " TARGET_FMT_lx
" " TARGET_FMT_lx
" PTE0 " TARGET_FMT_lx
2064 " PTE1 " TARGET_FMT_lx
" way %d\n", __func__
, new_EPN
, EPN
, CMP
,
2066 /* Store this TLB */
2067 ppc6xx_tlb_store(env
, (uint32_t)(new_EPN
& TARGET_PAGE_MASK
),
2068 way
, is_code
, CMP
, RPN
);
2071 void helper_74xx_tlbd(CPUPPCState
*env
, target_ulong EPN
)
2073 do_74xx_tlb(env
, EPN
, 0);
2076 void helper_74xx_tlbi(CPUPPCState
*env
, target_ulong EPN
)
2078 do_74xx_tlb(env
, EPN
, 1);
2081 /*****************************************************************************/
2082 /* PowerPC 601 specific instructions (POWER bridge) */
2084 target_ulong
helper_rac(CPUPPCState
*env
, target_ulong addr
)
2088 target_ulong ret
= 0;
2090 /* We don't have to generate many instances of this instruction,
2091 * as rac is supervisor only.
2093 /* XXX: FIX THIS: Pretend we have no BAT */
2094 nb_BATs
= env
->nb_BATs
;
2096 if (get_physical_address(env
, &ctx
, addr
, 0, ACCESS_INT
) == 0) {
2099 env
->nb_BATs
= nb_BATs
;
2103 static inline target_ulong
booke_tlb_to_page_size(int size
)
2105 return 1024 << (2 * size
);
2108 static inline int booke_page_size_to_tlb(target_ulong page_size
)
2112 switch (page_size
) {
2146 #if defined(TARGET_PPC64)
2147 case 0x000100000000ULL
:
2150 case 0x000400000000ULL
:
2153 case 0x001000000000ULL
:
2156 case 0x004000000000ULL
:
2159 case 0x010000000000ULL
:
2171 /* Helpers for 4xx TLB management */
2172 #define PPC4XX_TLB_ENTRY_MASK 0x0000003f /* Mask for 64 TLB entries */
2174 #define PPC4XX_TLBHI_V 0x00000040
2175 #define PPC4XX_TLBHI_E 0x00000020
2176 #define PPC4XX_TLBHI_SIZE_MIN 0
2177 #define PPC4XX_TLBHI_SIZE_MAX 7
2178 #define PPC4XX_TLBHI_SIZE_DEFAULT 1
2179 #define PPC4XX_TLBHI_SIZE_SHIFT 7
2180 #define PPC4XX_TLBHI_SIZE_MASK 0x00000007
2182 #define PPC4XX_TLBLO_EX 0x00000200
2183 #define PPC4XX_TLBLO_WR 0x00000100
2184 #define PPC4XX_TLBLO_ATTR_MASK 0x000000FF
2185 #define PPC4XX_TLBLO_RPN_MASK 0xFFFFFC00
2187 target_ulong
helper_4xx_tlbre_hi(CPUPPCState
*env
, target_ulong entry
)
2193 entry
&= PPC4XX_TLB_ENTRY_MASK
;
2194 tlb
= &env
->tlb
.tlbe
[entry
];
2196 if (tlb
->prot
& PAGE_VALID
) {
2197 ret
|= PPC4XX_TLBHI_V
;
2199 size
= booke_page_size_to_tlb(tlb
->size
);
2200 if (size
< PPC4XX_TLBHI_SIZE_MIN
|| size
> PPC4XX_TLBHI_SIZE_MAX
) {
2201 size
= PPC4XX_TLBHI_SIZE_DEFAULT
;
2203 ret
|= size
<< PPC4XX_TLBHI_SIZE_SHIFT
;
2204 env
->spr
[SPR_40x_PID
] = tlb
->PID
;
2208 target_ulong
helper_4xx_tlbre_lo(CPUPPCState
*env
, target_ulong entry
)
2213 entry
&= PPC4XX_TLB_ENTRY_MASK
;
2214 tlb
= &env
->tlb
.tlbe
[entry
];
2216 if (tlb
->prot
& PAGE_EXEC
) {
2217 ret
|= PPC4XX_TLBLO_EX
;
2219 if (tlb
->prot
& PAGE_WRITE
) {
2220 ret
|= PPC4XX_TLBLO_WR
;
2225 void helper_4xx_tlbwe_hi(CPUPPCState
*env
, target_ulong entry
,
2229 target_ulong page
, end
;
2231 LOG_SWTLB("%s entry %d val " TARGET_FMT_lx
"\n", __func__
, (int)entry
,
2233 entry
&= PPC4XX_TLB_ENTRY_MASK
;
2234 tlb
= &env
->tlb
.tlbe
[entry
];
2235 /* Invalidate previous TLB (if it's valid) */
2236 if (tlb
->prot
& PAGE_VALID
) {
2237 end
= tlb
->EPN
+ tlb
->size
;
2238 LOG_SWTLB("%s: invalidate old TLB %d start " TARGET_FMT_lx
" end "
2239 TARGET_FMT_lx
"\n", __func__
, (int)entry
, tlb
->EPN
, end
);
2240 for (page
= tlb
->EPN
; page
< end
; page
+= TARGET_PAGE_SIZE
) {
2241 tlb_flush_page(env
, page
);
2244 tlb
->size
= booke_tlb_to_page_size((val
>> PPC4XX_TLBHI_SIZE_SHIFT
)
2245 & PPC4XX_TLBHI_SIZE_MASK
);
2246 /* We cannot handle TLB size < TARGET_PAGE_SIZE.
2247 * If this ever occurs, one should use the ppcemb target instead
2248 * of the ppc or ppc64 one
2250 if ((val
& PPC4XX_TLBHI_V
) && tlb
->size
< TARGET_PAGE_SIZE
) {
2251 cpu_abort(env
, "TLB size " TARGET_FMT_lu
" < %u "
2252 "are not supported (%d)\n",
2253 tlb
->size
, TARGET_PAGE_SIZE
, (int)((val
>> 7) & 0x7));
2255 tlb
->EPN
= val
& ~(tlb
->size
- 1);
2256 if (val
& PPC4XX_TLBHI_V
) {
2257 tlb
->prot
|= PAGE_VALID
;
2258 if (val
& PPC4XX_TLBHI_E
) {
2259 /* XXX: TO BE FIXED */
2261 "Little-endian TLB entries are not supported by now\n");
2264 tlb
->prot
&= ~PAGE_VALID
;
2266 tlb
->PID
= env
->spr
[SPR_40x_PID
]; /* PID */
2267 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx
" EPN " TARGET_FMT_lx
2268 " size " TARGET_FMT_lx
" prot %c%c%c%c PID %d\n", __func__
,
2269 (int)entry
, tlb
->RPN
, tlb
->EPN
, tlb
->size
,
2270 tlb
->prot
& PAGE_READ
? 'r' : '-',
2271 tlb
->prot
& PAGE_WRITE
? 'w' : '-',
2272 tlb
->prot
& PAGE_EXEC
? 'x' : '-',
2273 tlb
->prot
& PAGE_VALID
? 'v' : '-', (int)tlb
->PID
);
2274 /* Invalidate new TLB (if valid) */
2275 if (tlb
->prot
& PAGE_VALID
) {
2276 end
= tlb
->EPN
+ tlb
->size
;
2277 LOG_SWTLB("%s: invalidate TLB %d start " TARGET_FMT_lx
" end "
2278 TARGET_FMT_lx
"\n", __func__
, (int)entry
, tlb
->EPN
, end
);
2279 for (page
= tlb
->EPN
; page
< end
; page
+= TARGET_PAGE_SIZE
) {
2280 tlb_flush_page(env
, page
);
2285 void helper_4xx_tlbwe_lo(CPUPPCState
*env
, target_ulong entry
,
2290 LOG_SWTLB("%s entry %i val " TARGET_FMT_lx
"\n", __func__
, (int)entry
,
2292 entry
&= PPC4XX_TLB_ENTRY_MASK
;
2293 tlb
= &env
->tlb
.tlbe
[entry
];
2294 tlb
->attr
= val
& PPC4XX_TLBLO_ATTR_MASK
;
2295 tlb
->RPN
= val
& PPC4XX_TLBLO_RPN_MASK
;
2296 tlb
->prot
= PAGE_READ
;
2297 if (val
& PPC4XX_TLBLO_EX
) {
2298 tlb
->prot
|= PAGE_EXEC
;
2300 if (val
& PPC4XX_TLBLO_WR
) {
2301 tlb
->prot
|= PAGE_WRITE
;
2303 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx
" EPN " TARGET_FMT_lx
2304 " size " TARGET_FMT_lx
" prot %c%c%c%c PID %d\n", __func__
,
2305 (int)entry
, tlb
->RPN
, tlb
->EPN
, tlb
->size
,
2306 tlb
->prot
& PAGE_READ
? 'r' : '-',
2307 tlb
->prot
& PAGE_WRITE
? 'w' : '-',
2308 tlb
->prot
& PAGE_EXEC
? 'x' : '-',
2309 tlb
->prot
& PAGE_VALID
? 'v' : '-', (int)tlb
->PID
);
2312 target_ulong
helper_4xx_tlbsx(CPUPPCState
*env
, target_ulong address
)
2314 return ppcemb_tlb_search(env
, address
, env
->spr
[SPR_40x_PID
]);
2317 /* PowerPC 440 TLB management */
2318 void helper_440_tlbwe(CPUPPCState
*env
, uint32_t word
, target_ulong entry
,
2322 target_ulong EPN
, RPN
, size
;
2325 LOG_SWTLB("%s word %d entry %d value " TARGET_FMT_lx
"\n",
2326 __func__
, word
, (int)entry
, value
);
2329 tlb
= &env
->tlb
.tlbe
[entry
];
2332 /* Just here to please gcc */
2334 EPN
= value
& 0xFFFFFC00;
2335 if ((tlb
->prot
& PAGE_VALID
) && EPN
!= tlb
->EPN
) {
2339 size
= booke_tlb_to_page_size((value
>> 4) & 0xF);
2340 if ((tlb
->prot
& PAGE_VALID
) && tlb
->size
< size
) {
2345 tlb
->attr
|= (value
>> 8) & 1;
2346 if (value
& 0x200) {
2347 tlb
->prot
|= PAGE_VALID
;
2349 if (tlb
->prot
& PAGE_VALID
) {
2350 tlb
->prot
&= ~PAGE_VALID
;
2354 tlb
->PID
= env
->spr
[SPR_440_MMUCR
] & 0x000000FF;
2355 if (do_flush_tlbs
) {
2360 RPN
= value
& 0xFFFFFC0F;
2361 if ((tlb
->prot
& PAGE_VALID
) && tlb
->RPN
!= RPN
) {
2367 tlb
->attr
= (tlb
->attr
& 0x1) | (value
& 0x0000FF00);
2368 tlb
->prot
= tlb
->prot
& PAGE_VALID
;
2370 tlb
->prot
|= PAGE_READ
<< 4;
2373 tlb
->prot
|= PAGE_WRITE
<< 4;
2376 tlb
->prot
|= PAGE_EXEC
<< 4;
2379 tlb
->prot
|= PAGE_READ
;
2382 tlb
->prot
|= PAGE_WRITE
;
2385 tlb
->prot
|= PAGE_EXEC
;
2391 target_ulong
helper_440_tlbre(CPUPPCState
*env
, uint32_t word
,
2399 tlb
= &env
->tlb
.tlbe
[entry
];
2402 /* Just here to please gcc */
2405 size
= booke_page_size_to_tlb(tlb
->size
);
2406 if (size
< 0 || size
> 0xF) {
2410 if (tlb
->attr
& 0x1) {
2413 if (tlb
->prot
& PAGE_VALID
) {
2416 env
->spr
[SPR_440_MMUCR
] &= ~0x000000FF;
2417 env
->spr
[SPR_440_MMUCR
] |= tlb
->PID
;
2423 ret
= tlb
->attr
& ~0x1;
2424 if (tlb
->prot
& (PAGE_READ
<< 4)) {
2427 if (tlb
->prot
& (PAGE_WRITE
<< 4)) {
2430 if (tlb
->prot
& (PAGE_EXEC
<< 4)) {
2433 if (tlb
->prot
& PAGE_READ
) {
2436 if (tlb
->prot
& PAGE_WRITE
) {
2439 if (tlb
->prot
& PAGE_EXEC
) {
2447 target_ulong
helper_440_tlbsx(CPUPPCState
*env
, target_ulong address
)
2449 return ppcemb_tlb_search(env
, address
, env
->spr
[SPR_440_MMUCR
] & 0xFF);
2452 /* PowerPC BookE 2.06 TLB management */
2454 static ppcmas_tlb_t
*booke206_cur_tlb(CPUPPCState
*env
)
2456 uint32_t tlbncfg
= 0;
2457 int esel
= (env
->spr
[SPR_BOOKE_MAS0
] & MAS0_ESEL_MASK
) >> MAS0_ESEL_SHIFT
;
2458 int ea
= (env
->spr
[SPR_BOOKE_MAS2
] & MAS2_EPN_MASK
);
2461 tlb
= (env
->spr
[SPR_BOOKE_MAS0
] & MAS0_TLBSEL_MASK
) >> MAS0_TLBSEL_SHIFT
;
2462 tlbncfg
= env
->spr
[SPR_BOOKE_TLB0CFG
+ tlb
];
2464 if ((tlbncfg
& TLBnCFG_HES
) && (env
->spr
[SPR_BOOKE_MAS0
] & MAS0_HES
)) {
2465 cpu_abort(env
, "we don't support HES yet\n");
2468 return booke206_get_tlbm(env
, tlb
, ea
, esel
);
2471 void helper_booke_setpid(CPUPPCState
*env
, uint32_t pidn
, target_ulong pid
)
2473 env
->spr
[pidn
] = pid
;
2474 /* changing PIDs mean we're in a different address space now */
2478 void helper_booke206_tlbwe(CPUPPCState
*env
)
2480 uint32_t tlbncfg
, tlbn
;
2482 uint32_t size_tlb
, size_ps
;
2486 switch (env
->spr
[SPR_BOOKE_MAS0
] & MAS0_WQ_MASK
) {
2487 case MAS0_WQ_ALWAYS
:
2488 /* good to go, write that entry */
2491 /* XXX check if reserved */
2496 case MAS0_WQ_CLR_RSRV
:
2497 /* XXX clear entry */
2500 /* no idea what to do */
2504 if (((env
->spr
[SPR_BOOKE_MAS0
] & MAS0_ATSEL
) == MAS0_ATSEL_LRAT
) &&
2506 /* XXX we don't support direct LRAT setting yet */
2507 fprintf(stderr
, "cpu: don't support LRAT setting yet\n");
2511 tlbn
= (env
->spr
[SPR_BOOKE_MAS0
] & MAS0_TLBSEL_MASK
) >> MAS0_TLBSEL_SHIFT
;
2512 tlbncfg
= env
->spr
[SPR_BOOKE_TLB0CFG
+ tlbn
];
2514 tlb
= booke206_cur_tlb(env
);
2517 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
2518 POWERPC_EXCP_INVAL
|
2519 POWERPC_EXCP_INVAL_INVAL
);
2522 /* check that we support the targeted size */
2523 size_tlb
= (env
->spr
[SPR_BOOKE_MAS1
] & MAS1_TSIZE_MASK
) >> MAS1_TSIZE_SHIFT
;
2524 size_ps
= booke206_tlbnps(env
, tlbn
);
2525 if ((env
->spr
[SPR_BOOKE_MAS1
] & MAS1_VALID
) && (tlbncfg
& TLBnCFG_AVAIL
) &&
2526 !(size_ps
& (1 << size_tlb
))) {
2527 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
2528 POWERPC_EXCP_INVAL
|
2529 POWERPC_EXCP_INVAL_INVAL
);
2533 cpu_abort(env
, "missing HV implementation\n");
2535 tlb
->mas7_3
= ((uint64_t)env
->spr
[SPR_BOOKE_MAS7
] << 32) |
2536 env
->spr
[SPR_BOOKE_MAS3
];
2537 tlb
->mas1
= env
->spr
[SPR_BOOKE_MAS1
];
2540 if (!(tlbncfg
& TLBnCFG_AVAIL
)) {
2541 /* force !AVAIL TLB entries to correct page size */
2542 tlb
->mas1
&= ~MAS1_TSIZE_MASK
;
2543 /* XXX can be configured in MMUCSR0 */
2544 tlb
->mas1
|= (tlbncfg
& TLBnCFG_MINSIZE
) >> 12;
2547 /* Make a mask from TLB size to discard invalid bits in EPN field */
2548 mask
= ~(booke206_tlb_to_page_size(env
, tlb
) - 1);
2549 /* Add a mask for page attributes */
2550 mask
|= MAS2_ACM
| MAS2_VLE
| MAS2_W
| MAS2_I
| MAS2_M
| MAS2_G
| MAS2_E
;
2553 /* Executing a tlbwe instruction in 32-bit mode will set
2554 * bits 0:31 of the TLB EPN field to zero.
2559 tlb
->mas2
= env
->spr
[SPR_BOOKE_MAS2
] & mask
;
2561 if (!(tlbncfg
& TLBnCFG_IPROT
)) {
2562 /* no IPROT supported by TLB */
2563 tlb
->mas1
&= ~MAS1_IPROT
;
2566 if (booke206_tlb_to_page_size(env
, tlb
) == TARGET_PAGE_SIZE
) {
2567 tlb_flush_page(env
, tlb
->mas2
& MAS2_EPN_MASK
);
2573 static inline void booke206_tlb_to_mas(CPUPPCState
*env
, ppcmas_tlb_t
*tlb
)
2575 int tlbn
= booke206_tlbm_to_tlbn(env
, tlb
);
2576 int way
= booke206_tlbm_to_way(env
, tlb
);
2578 env
->spr
[SPR_BOOKE_MAS0
] = tlbn
<< MAS0_TLBSEL_SHIFT
;
2579 env
->spr
[SPR_BOOKE_MAS0
] |= way
<< MAS0_ESEL_SHIFT
;
2580 env
->spr
[SPR_BOOKE_MAS0
] |= env
->last_way
<< MAS0_NV_SHIFT
;
2582 env
->spr
[SPR_BOOKE_MAS1
] = tlb
->mas1
;
2583 env
->spr
[SPR_BOOKE_MAS2
] = tlb
->mas2
;
2584 env
->spr
[SPR_BOOKE_MAS3
] = tlb
->mas7_3
;
2585 env
->spr
[SPR_BOOKE_MAS7
] = tlb
->mas7_3
>> 32;
2588 void helper_booke206_tlbre(CPUPPCState
*env
)
2590 ppcmas_tlb_t
*tlb
= NULL
;
2592 tlb
= booke206_cur_tlb(env
);
2594 env
->spr
[SPR_BOOKE_MAS1
] = 0;
2596 booke206_tlb_to_mas(env
, tlb
);
2600 void helper_booke206_tlbsx(CPUPPCState
*env
, target_ulong address
)
2602 ppcmas_tlb_t
*tlb
= NULL
;
2607 spid
= (env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SPID_MASK
) >> MAS6_SPID_SHIFT
;
2608 sas
= env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SAS
;
2610 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
2611 int ways
= booke206_tlb_ways(env
, i
);
2613 for (j
= 0; j
< ways
; j
++) {
2614 tlb
= booke206_get_tlbm(env
, i
, address
, j
);
2620 if (ppcmas_tlb_check(env
, tlb
, &raddr
, address
, spid
)) {
2624 if (sas
!= ((tlb
->mas1
& MAS1_TS
) >> MAS1_TS_SHIFT
)) {
2628 booke206_tlb_to_mas(env
, tlb
);
2633 /* no entry found, fill with defaults */
2634 env
->spr
[SPR_BOOKE_MAS0
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_TLBSELD_MASK
;
2635 env
->spr
[SPR_BOOKE_MAS1
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_TSIZED_MASK
;
2636 env
->spr
[SPR_BOOKE_MAS2
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_WIMGED_MASK
;
2637 env
->spr
[SPR_BOOKE_MAS3
] = 0;
2638 env
->spr
[SPR_BOOKE_MAS7
] = 0;
2640 if (env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SAS
) {
2641 env
->spr
[SPR_BOOKE_MAS1
] |= MAS1_TS
;
2644 env
->spr
[SPR_BOOKE_MAS1
] |= (env
->spr
[SPR_BOOKE_MAS6
] >> 16)
2647 /* next victim logic */
2648 env
->spr
[SPR_BOOKE_MAS0
] |= env
->last_way
<< MAS0_ESEL_SHIFT
;
2650 env
->last_way
&= booke206_tlb_ways(env
, 0) - 1;
2651 env
->spr
[SPR_BOOKE_MAS0
] |= env
->last_way
<< MAS0_NV_SHIFT
;
2654 static inline void booke206_invalidate_ea_tlb(CPUPPCState
*env
, int tlbn
,
2658 int ways
= booke206_tlb_ways(env
, tlbn
);
2661 for (i
= 0; i
< ways
; i
++) {
2662 ppcmas_tlb_t
*tlb
= booke206_get_tlbm(env
, tlbn
, ea
, i
);
2666 mask
= ~(booke206_tlb_to_page_size(env
, tlb
) - 1);
2667 if (((tlb
->mas2
& MAS2_EPN_MASK
) == (ea
& mask
)) &&
2668 !(tlb
->mas1
& MAS1_IPROT
)) {
2669 tlb
->mas1
&= ~MAS1_VALID
;
2674 void helper_booke206_tlbivax(CPUPPCState
*env
, target_ulong address
)
2676 if (address
& 0x4) {
2677 /* flush all entries */
2678 if (address
& 0x8) {
2679 /* flush all of TLB1 */
2680 booke206_flush_tlb(env
, BOOKE206_FLUSH_TLB1
, 1);
2682 /* flush all of TLB0 */
2683 booke206_flush_tlb(env
, BOOKE206_FLUSH_TLB0
, 0);
2688 if (address
& 0x8) {
2689 /* flush TLB1 entries */
2690 booke206_invalidate_ea_tlb(env
, 1, address
);
2693 /* flush TLB0 entries */
2694 booke206_invalidate_ea_tlb(env
, 0, address
);
2695 tlb_flush_page(env
, address
& MAS2_EPN_MASK
);
2699 void helper_booke206_tlbilx0(CPUPPCState
*env
, target_ulong address
)
2701 /* XXX missing LPID handling */
2702 booke206_flush_tlb(env
, -1, 1);
2705 void helper_booke206_tlbilx1(CPUPPCState
*env
, target_ulong address
)
2708 int tid
= (env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SPID
);
2709 ppcmas_tlb_t
*tlb
= env
->tlb
.tlbm
;
2712 /* XXX missing LPID handling */
2713 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
2714 tlb_size
= booke206_tlb_size(env
, i
);
2715 for (j
= 0; j
< tlb_size
; j
++) {
2716 if (!(tlb
[j
].mas1
& MAS1_IPROT
) &&
2717 ((tlb
[j
].mas1
& MAS1_TID_MASK
) == tid
)) {
2718 tlb
[j
].mas1
&= ~MAS1_VALID
;
2721 tlb
+= booke206_tlb_size(env
, i
);
2726 void helper_booke206_tlbilx3(CPUPPCState
*env
, target_ulong address
)
2730 int tid
= (env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SPID
);
2731 int pid
= tid
>> MAS6_SPID_SHIFT
;
2732 int sgs
= env
->spr
[SPR_BOOKE_MAS5
] & MAS5_SGS
;
2733 int ind
= (env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SIND
) ? MAS1_IND
: 0;
2734 /* XXX check for unsupported isize and raise an invalid opcode then */
2735 int size
= env
->spr
[SPR_BOOKE_MAS6
] & MAS6_ISIZE_MASK
;
2736 /* XXX implement MAV2 handling */
2739 /* XXX missing LPID handling */
2740 /* flush by pid and ea */
2741 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
2742 int ways
= booke206_tlb_ways(env
, i
);
2744 for (j
= 0; j
< ways
; j
++) {
2745 tlb
= booke206_get_tlbm(env
, i
, address
, j
);
2749 if ((ppcmas_tlb_check(env
, tlb
, NULL
, address
, pid
) != 0) ||
2750 (tlb
->mas1
& MAS1_IPROT
) ||
2751 ((tlb
->mas1
& MAS1_IND
) != ind
) ||
2752 ((tlb
->mas8
& MAS8_TGS
) != sgs
)) {
2755 if (mav2
&& ((tlb
->mas1
& MAS1_TSIZE_MASK
) != size
)) {
2756 /* XXX only check when MMUCFG[TWC] || TLBnCFG[HES] */
2759 /* XXX e500mc doesn't match SAS, but other cores might */
2760 tlb
->mas1
&= ~MAS1_VALID
;
2766 void helper_booke206_tlbflush(CPUPPCState
*env
, uint32_t type
)
2771 flags
|= BOOKE206_FLUSH_TLB1
;
2775 flags
|= BOOKE206_FLUSH_TLB0
;
2778 booke206_flush_tlb(env
, flags
, 1);
2782 /*****************************************************************************/
2784 #define MMUSUFFIX _mmu
2787 #include "exec/softmmu_template.h"
2790 #include "exec/softmmu_template.h"
2793 #include "exec/softmmu_template.h"
2796 #include "exec/softmmu_template.h"
2798 /* try to fill the TLB and return an exception if error. If retaddr is
2799 NULL, it means that the function was called in C code (i.e. not
2800 from generated code or from helper.c) */
2801 /* XXX: fix it to restore all registers */
2802 void tlb_fill(CPUPPCState
*env
, target_ulong addr
, int is_write
, int mmu_idx
,
2807 ret
= cpu_ppc_handle_mmu_fault(env
, addr
, is_write
, mmu_idx
);
2808 if (unlikely(ret
!= 0)) {
2809 if (likely(retaddr
)) {
2810 /* now we have a real cpu fault */
2811 cpu_restore_state(env
, retaddr
);
2813 helper_raise_exception_err(env
, env
->exception_index
, env
->error_code
);