2 * MIPS emulation helpers for qemu.
4 * Copyright (c) 2004-2005 Jocelyn Mayer
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
39 /* no MMU emulation */
40 int no_mmu_map_address (CPUState
*env
, target_ulong
*physical
, int *prot
,
41 target_ulong address
, int rw
, int access_type
)
44 *prot
= PAGE_READ
| PAGE_WRITE
;
48 /* fixed mapping MMU emulation */
49 int fixed_mmu_map_address (CPUState
*env
, target_ulong
*physical
, int *prot
,
50 target_ulong address
, int rw
, int access_type
)
52 if (address
<= (int32_t)0x7FFFFFFFUL
) {
53 if (!(env
->CP0_Status
& (1 << CP0St_ERL
)))
54 *physical
= address
+ 0x40000000UL
;
57 } else if (address
<= (int32_t)0xBFFFFFFFUL
)
58 *physical
= address
& 0x1FFFFFFF;
62 *prot
= PAGE_READ
| PAGE_WRITE
;
66 /* MIPS32/MIPS64 R4000-style MMU emulation */
67 int r4k_map_address (CPUState
*env
, target_ulong
*physical
, int *prot
,
68 target_ulong address
, int rw
, int access_type
)
70 uint8_t ASID
= env
->CP0_EntryHi
& 0xFF;
73 for (i
= 0; i
< env
->tlb
->tlb_in_use
; i
++) {
74 r4k_tlb_t
*tlb
= &env
->tlb
->mmu
.r4k
.tlb
[i
];
75 /* 1k pages are not supported. */
76 target_ulong mask
= tlb
->PageMask
| ~(TARGET_PAGE_MASK
<< 1);
77 target_ulong tag
= address
& ~mask
;
78 target_ulong VPN
= tlb
->VPN
& ~mask
;
79 #if defined(TARGET_MIPS64)
83 /* Check ASID, virtual page number & size */
84 if ((tlb
->G
== 1 || tlb
->ASID
== ASID
) && VPN
== tag
) {
86 int n
= !!(address
& mask
& ~(mask
>> 1));
87 /* Check access rights */
88 if (!(n
? tlb
->V1
: tlb
->V0
))
89 return TLBRET_INVALID
;
90 if (rw
== 0 || (n
? tlb
->D1
: tlb
->D0
)) {
91 *physical
= tlb
->PFN
[n
] | (address
& (mask
>> 1));
93 if (n
? tlb
->D1
: tlb
->D0
)
100 return TLBRET_NOMATCH
;
103 static int get_physical_address (CPUState
*env
, target_ulong
*physical
,
104 int *prot
, target_ulong address
,
105 int rw
, int access_type
)
107 /* User mode can only access useg/xuseg */
108 int user_mode
= (env
->hflags
& MIPS_HFLAG_MODE
) == MIPS_HFLAG_UM
;
109 int supervisor_mode
= (env
->hflags
& MIPS_HFLAG_MODE
) == MIPS_HFLAG_SM
;
110 int kernel_mode
= !user_mode
&& !supervisor_mode
;
111 #if defined(TARGET_MIPS64)
112 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
113 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
114 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
116 int ret
= TLBRET_MATCH
;
120 fprintf(logfile
, "user mode %d h %08x\n",
121 user_mode
, env
->hflags
);
125 if (address
<= (int32_t)0x7FFFFFFFUL
) {
127 if (env
->CP0_Status
& (1 << CP0St_ERL
)) {
128 *physical
= address
& 0xFFFFFFFF;
129 *prot
= PAGE_READ
| PAGE_WRITE
;
131 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
133 #if defined(TARGET_MIPS64)
134 } else if (address
< 0x4000000000000000ULL
) {
136 if (UX
&& address
<= (0x3FFFFFFFFFFFFFFFULL
& env
->SEGMask
)) {
137 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
139 ret
= TLBRET_BADADDR
;
141 } else if (address
< 0x8000000000000000ULL
) {
143 if ((supervisor_mode
|| kernel_mode
) &&
144 SX
&& address
<= (0x7FFFFFFFFFFFFFFFULL
& env
->SEGMask
)) {
145 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
147 ret
= TLBRET_BADADDR
;
149 } else if (address
< 0xC000000000000000ULL
) {
151 if (kernel_mode
&& KX
&&
152 (address
& 0x07FFFFFFFFFFFFFFULL
) <= env
->PAMask
) {
153 *physical
= address
& env
->PAMask
;
154 *prot
= PAGE_READ
| PAGE_WRITE
;
156 ret
= TLBRET_BADADDR
;
158 } else if (address
< 0xFFFFFFFF80000000ULL
) {
160 if (kernel_mode
&& KX
&&
161 address
<= (0xFFFFFFFF7FFFFFFFULL
& env
->SEGMask
)) {
162 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
164 ret
= TLBRET_BADADDR
;
167 } else if (address
< (int32_t)0xA0000000UL
) {
170 *physical
= address
- (int32_t)0x80000000UL
;
171 *prot
= PAGE_READ
| PAGE_WRITE
;
173 ret
= TLBRET_BADADDR
;
175 } else if (address
< (int32_t)0xC0000000UL
) {
178 *physical
= address
- (int32_t)0xA0000000UL
;
179 *prot
= PAGE_READ
| PAGE_WRITE
;
181 ret
= TLBRET_BADADDR
;
183 } else if (address
< (int32_t)0xE0000000UL
) {
185 if (supervisor_mode
|| kernel_mode
) {
186 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
188 ret
= TLBRET_BADADDR
;
192 /* XXX: debug segment is not emulated */
194 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
196 ret
= TLBRET_BADADDR
;
201 fprintf(logfile
, TARGET_FMT_lx
" %d %d => " TARGET_FMT_lx
" %d (%d)\n",
202 address
, rw
, access_type
, *physical
, *prot
, ret
);
209 #if defined(CONFIG_USER_ONLY)
210 target_phys_addr_t
cpu_get_phys_page_debug(CPUState
*env
, target_ulong addr
)
215 target_phys_addr_t
cpu_get_phys_page_debug(CPUState
*env
, target_ulong addr
)
217 target_ulong phys_addr
;
220 if (get_physical_address(env
, &phys_addr
, &prot
, addr
, 0, ACCESS_INT
) != 0)
225 void cpu_mips_init_mmu (CPUState
*env
)
228 #endif /* !defined(CONFIG_USER_ONLY) */
230 int cpu_mips_handle_mmu_fault (CPUState
*env
, target_ulong address
, int rw
,
231 int mmu_idx
, int is_softmmu
)
233 target_ulong physical
;
235 int exception
= 0, error_code
= 0;
241 cpu_dump_state(env
, logfile
, fprintf
, 0);
243 fprintf(logfile
, "%s pc " TARGET_FMT_lx
" ad " TARGET_FMT_lx
" rw %d mmu_idx %d smmu %d\n",
244 __func__
, env
->PC
[env
->current_tc
], address
, rw
, mmu_idx
, is_softmmu
);
250 /* XXX: put correct access by using cpu_restore_state()
252 access_type
= ACCESS_INT
;
253 if (env
->user_mode_only
) {
254 /* user mode only emulation */
255 ret
= TLBRET_NOMATCH
;
258 ret
= get_physical_address(env
, &physical
, &prot
,
259 address
, rw
, access_type
);
261 fprintf(logfile
, "%s address=" TARGET_FMT_lx
" ret %d physical " TARGET_FMT_lx
" prot %d\n",
262 __func__
, address
, ret
, physical
, prot
);
264 if (ret
== TLBRET_MATCH
) {
265 ret
= tlb_set_page(env
, address
& TARGET_PAGE_MASK
,
266 physical
& TARGET_PAGE_MASK
, prot
,
267 mmu_idx
, is_softmmu
);
268 } else if (ret
< 0) {
273 /* Reference to kernel address from user mode or supervisor mode */
274 /* Reference to supervisor address from user mode */
276 exception
= EXCP_AdES
;
278 exception
= EXCP_AdEL
;
281 /* No TLB match for a mapped address */
283 exception
= EXCP_TLBS
;
285 exception
= EXCP_TLBL
;
289 /* TLB match with no valid bit */
291 exception
= EXCP_TLBS
;
293 exception
= EXCP_TLBL
;
296 /* TLB match but 'D' bit is cleared */
297 exception
= EXCP_LTLBL
;
301 /* Raise exception */
302 env
->CP0_BadVAddr
= address
;
303 env
->CP0_Context
= (env
->CP0_Context
& ~0x007fffff) |
304 ((address
>> 9) & 0x007ffff0);
306 (env
->CP0_EntryHi
& 0xFF) | (address
& (TARGET_PAGE_MASK
<< 1));
307 #if defined(TARGET_MIPS64)
308 env
->CP0_EntryHi
&= env
->SEGMask
;
309 env
->CP0_XContext
= (env
->CP0_XContext
& ((~0ULL) << (env
->SEGBITS
- 7))) |
310 ((address
& 0xC00000000000ULL
) >> (env
->SEGBITS
- 9)) |
311 ((address
& ((1ULL << env
->SEGBITS
) - 1) & 0xFFFFFFFFFFFFE000ULL
) >> 9);
313 env
->exception_index
= exception
;
314 env
->error_code
= error_code
;
321 #if !defined(CONFIG_USER_ONLY)
322 static struct _excp_names
{
325 } excp_names
[EXCP_LAST
+ 1] = {
326 { EXCP_RESET
, "reset" },
327 { EXCP_SRESET
, "soft reset" },
328 { EXCP_DSS
, "debug single step" },
329 { EXCP_DINT
, "debug interrupt" },
330 { EXCP_NMI
, "non-maskable interrupt" },
331 { EXCP_MCHECK
, "machine check" },
332 { EXCP_EXT_INTERRUPT
, "interrupt" },
333 { EXCP_DFWATCH
, "deferred watchpoint" },
334 { EXCP_DIB
, "debug instruction breakpoint" },
335 { EXCP_IWATCH
, "instruction fetch watchpoint" },
336 { EXCP_AdEL
, "address error load" },
337 { EXCP_AdES
, "address error store" },
338 { EXCP_TLBF
, "TLB refill" },
339 { EXCP_IBE
, "instruction bus error" },
340 { EXCP_DBp
, "debug breakpoint" },
341 { EXCP_SYSCALL
, "syscall" },
342 { EXCP_BREAK
, "break" },
343 { EXCP_CpU
, "coprocessor unusable" },
344 { EXCP_RI
, "reserved instruction" },
345 { EXCP_OVERFLOW
, "arithmetic overflow" },
346 { EXCP_TRAP
, "trap" },
347 { EXCP_FPE
, "floating point" },
348 { EXCP_DDBS
, "debug data break store" },
349 { EXCP_DWATCH
, "data watchpoint" },
350 { EXCP_LTLBL
, "TLB modify" },
351 { EXCP_TLBL
, "TLB load" },
352 { EXCP_TLBS
, "TLB store" },
353 { EXCP_DBE
, "data bus error" },
354 { EXCP_DDBL
, "debug data break load" },
355 { EXCP_THREAD
, "thread" },
356 { EXCP_MDMX
, "MDMX" },
357 { EXCP_C2E
, "precise coprocessor 2" },
358 { EXCP_CACHE
, "cache error" },
362 void do_interrupt (CPUState
*env
)
364 #if !defined(CONFIG_USER_ONLY)
369 if (logfile
&& env
->exception_index
!= EXCP_EXT_INTERRUPT
) {
370 if (env
->exception_index
< 0 || env
->exception_index
> EXCP_LAST
)
373 name
= excp_names
[env
->exception_index
].name
;
375 fprintf(logfile
, "%s enter: PC " TARGET_FMT_lx
" EPC " TARGET_FMT_lx
" %s exception\n",
376 __func__
, env
->PC
[env
->current_tc
], env
->CP0_EPC
, name
);
378 if (env
->exception_index
== EXCP_EXT_INTERRUPT
&&
379 (env
->hflags
& MIPS_HFLAG_DM
))
380 env
->exception_index
= EXCP_DINT
;
382 switch (env
->exception_index
) {
384 env
->CP0_Debug
|= 1 << CP0DB_DSS
;
385 /* Debug single step cannot be raised inside a delay slot and
386 * resume will always occur on the next instruction
387 * (but we assume the pc has always been updated during
390 env
->CP0_DEPC
= env
->PC
[env
->current_tc
];
391 goto enter_debug_mode
;
393 env
->CP0_Debug
|= 1 << CP0DB_DINT
;
396 env
->CP0_Debug
|= 1 << CP0DB_DIB
;
399 env
->CP0_Debug
|= 1 << CP0DB_DBp
;
402 env
->CP0_Debug
|= 1 << CP0DB_DDBS
;
405 env
->CP0_Debug
|= 1 << CP0DB_DDBL
;
407 if (env
->hflags
& MIPS_HFLAG_BMASK
) {
408 /* If the exception was raised from a delay slot,
409 come back to the jump. */
410 env
->CP0_DEPC
= env
->PC
[env
->current_tc
] - 4;
411 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
413 env
->CP0_DEPC
= env
->PC
[env
->current_tc
];
416 env
->hflags
|= MIPS_HFLAG_DM
| MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
417 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
418 /* EJTAG probe trap enable is not implemented... */
419 if (!(env
->CP0_Status
& (1 << CP0St_EXL
)))
420 env
->CP0_Cause
&= ~(1 << CP0Ca_BD
);
421 env
->PC
[env
->current_tc
] = (int32_t)0xBFC00480;
427 env
->CP0_Status
|= (1 << CP0St_SR
);
428 memset(env
->CP0_WatchLo
, 0, sizeof(*env
->CP0_WatchLo
));
431 env
->CP0_Status
|= (1 << CP0St_NMI
);
433 if (env
->hflags
& MIPS_HFLAG_BMASK
) {
434 /* If the exception was raised from a delay slot,
435 come back to the jump. */
436 env
->CP0_ErrorEPC
= env
->PC
[env
->current_tc
] - 4;
437 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
439 env
->CP0_ErrorEPC
= env
->PC
[env
->current_tc
];
441 env
->CP0_Status
|= (1 << CP0St_ERL
) | (1 << CP0St_BEV
);
442 env
->hflags
|= MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
443 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
444 if (!(env
->CP0_Status
& (1 << CP0St_EXL
)))
445 env
->CP0_Cause
&= ~(1 << CP0Ca_BD
);
446 env
->PC
[env
->current_tc
] = (int32_t)0xBFC00000;
451 case EXCP_EXT_INTERRUPT
:
453 if (env
->CP0_Cause
& (1 << CP0Ca_IV
))
458 /* XXX: TODO: manage defered watch exceptions */
468 if (env
->error_code
== 1 && !(env
->CP0_Status
& (1 << CP0St_EXL
))) {
469 #if defined(TARGET_MIPS64)
470 int R
= env
->CP0_BadVAddr
>> 62;
471 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
472 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
473 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
475 if ((R
== 0 && UX
) || (R
== 1 && SX
) || (R
== 3 && KX
))
499 env
->CP0_Cause
= (env
->CP0_Cause
& ~(0x3 << CP0Ca_CE
)) |
500 (env
->error_code
<< CP0Ca_CE
);
516 if (env
->error_code
== 1 && !(env
->CP0_Status
& (1 << CP0St_EXL
))) {
517 #if defined(TARGET_MIPS64)
518 int R
= env
->CP0_BadVAddr
>> 62;
519 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
520 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
521 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
523 if ((R
== 0 && UX
) || (R
== 1 && SX
) || (R
== 3 && KX
))
533 if (!(env
->CP0_Status
& (1 << CP0St_EXL
))) {
534 if (env
->hflags
& MIPS_HFLAG_BMASK
) {
535 /* If the exception was raised from a delay slot,
536 come back to the jump. */
537 env
->CP0_EPC
= env
->PC
[env
->current_tc
] - 4;
538 env
->CP0_Cause
|= (1 << CP0Ca_BD
);
540 env
->CP0_EPC
= env
->PC
[env
->current_tc
];
541 env
->CP0_Cause
&= ~(1 << CP0Ca_BD
);
543 env
->CP0_Status
|= (1 << CP0St_EXL
);
544 env
->hflags
|= MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
545 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
547 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
548 if (env
->CP0_Status
& (1 << CP0St_BEV
)) {
549 env
->PC
[env
->current_tc
] = (int32_t)0xBFC00200;
551 env
->PC
[env
->current_tc
] = (int32_t)(env
->CP0_EBase
& ~0x3ff);
553 env
->PC
[env
->current_tc
] += offset
;
554 env
->CP0_Cause
= (env
->CP0_Cause
& ~(0x1f << CP0Ca_EC
)) | (cause
<< CP0Ca_EC
);
558 fprintf(logfile
, "Invalid MIPS exception %d. Exiting\n",
559 env
->exception_index
);
561 printf("Invalid MIPS exception %d. Exiting\n", env
->exception_index
);
564 if (logfile
&& env
->exception_index
!= EXCP_EXT_INTERRUPT
) {
565 fprintf(logfile
, "%s: PC " TARGET_FMT_lx
" EPC " TARGET_FMT_lx
" cause %d\n"
566 " S %08x C %08x A " TARGET_FMT_lx
" D " TARGET_FMT_lx
"\n",
567 __func__
, env
->PC
[env
->current_tc
], env
->CP0_EPC
, cause
,
568 env
->CP0_Status
, env
->CP0_Cause
, env
->CP0_BadVAddr
,
571 #endif /* !defined(CONFIG_USER_ONLY) */
572 env
->exception_index
= EXCP_NONE
;
575 void r4k_invalidate_tlb (CPUState
*env
, int idx
, int use_extra
)
580 uint8_t ASID
= env
->CP0_EntryHi
& 0xFF;
583 tlb
= &env
->tlb
->mmu
.r4k
.tlb
[idx
];
584 /* The qemu TLB is flushed when the ASID changes, so no need to
585 flush these entries again. */
586 if (tlb
->G
== 0 && tlb
->ASID
!= ASID
) {
590 if (use_extra
&& env
->tlb
->tlb_in_use
< MIPS_TLB_MAX
) {
591 /* For tlbwr, we can shadow the discarded entry into
592 a new (fake) TLB entry, as long as the guest can not
593 tell that it's there. */
594 env
->tlb
->mmu
.r4k
.tlb
[env
->tlb
->tlb_in_use
] = *tlb
;
595 env
->tlb
->tlb_in_use
++;
599 /* 1k pages are not supported. */
600 mask
= tlb
->PageMask
| ~(TARGET_PAGE_MASK
<< 1);
602 addr
= tlb
->VPN
& ~mask
;
603 #if defined(TARGET_MIPS64)
604 if (addr
>= (0xFFFFFFFF80000000ULL
& env
->SEGMask
)) {
605 addr
|= 0x3FFFFF0000000000ULL
;
608 end
= addr
| (mask
>> 1);
610 tlb_flush_page (env
, addr
);
611 addr
+= TARGET_PAGE_SIZE
;
615 addr
= (tlb
->VPN
& ~mask
) | ((mask
>> 1) + 1);
616 #if defined(TARGET_MIPS64)
617 if (addr
>= (0xFFFFFFFF80000000ULL
& env
->SEGMask
)) {
618 addr
|= 0x3FFFFF0000000000ULL
;
623 tlb_flush_page (env
, addr
);
624 addr
+= TARGET_PAGE_SIZE
;