2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19 #include "qemu/osdep.h"
20 #include "qapi/error.h"
22 #include "exec/helper-proto.h"
23 #include "sysemu/kvm.h"
25 #include "mmu-hash64.h"
26 #include "mmu-hash32.h"
27 #include "exec/exec-all.h"
28 #include "exec/cpu_ldst.h"
30 #include "helper_regs.h"
34 //#define DEBUG_SOFTWARE_TLB
35 //#define DUMP_PAGE_TABLES
36 //#define FLUSH_ALL_TLBS
39 # define LOG_MMU_STATE(cpu) log_cpu_state_mask(CPU_LOG_MMU, (cpu), 0)
41 # define LOG_MMU_STATE(cpu) do { } while (0)
44 #ifdef DEBUG_SOFTWARE_TLB
45 # define LOG_SWTLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
47 # define LOG_SWTLB(...) do { } while (0)
51 # define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
53 # define LOG_BATS(...) do { } while (0)
56 /*****************************************************************************/
57 /* PowerPC MMU emulation */
59 /* Context used internally during MMU translations */
60 typedef struct mmu_ctx_t mmu_ctx_t
;
62 hwaddr raddr
; /* Real address */
63 hwaddr eaddr
; /* Effective address */
64 int prot
; /* Protection bits */
65 hwaddr hash
[2]; /* Pagetable hash values */
66 target_ulong ptem
; /* Virtual segment ID | API */
67 int key
; /* Access key */
68 int nx
; /* Non-execute area */
71 /* Common routines used by software and hardware TLBs emulation */
72 static inline int pte_is_valid(target_ulong pte0
)
74 return pte0
& 0x80000000 ? 1 : 0;
77 static inline void pte_invalidate(target_ulong
*pte0
)
82 #define PTE_PTEM_MASK 0x7FFFFFBF
83 #define PTE_CHECK_MASK (TARGET_PAGE_MASK | 0x7B)
85 static int pp_check(int key
, int pp
, int nx
)
89 /* Compute access rights */
112 access
= PAGE_READ
| PAGE_WRITE
;
123 static int check_prot(int prot
, int rw
, int access_type
)
127 if (access_type
== ACCESS_CODE
) {
128 if (prot
& PAGE_EXEC
) {
134 if (prot
& PAGE_WRITE
) {
140 if (prot
& PAGE_READ
) {
150 static inline int ppc6xx_tlb_pte_check(mmu_ctx_t
*ctx
, target_ulong pte0
,
151 target_ulong pte1
, int h
, int rw
, int type
)
153 target_ulong ptem
, mmask
;
154 int access
, ret
, pteh
, ptev
, pp
;
157 /* Check validity and table match */
158 ptev
= pte_is_valid(pte0
);
159 pteh
= (pte0
>> 6) & 1;
160 if (ptev
&& h
== pteh
) {
161 /* Check vsid & api */
162 ptem
= pte0
& PTE_PTEM_MASK
;
163 mmask
= PTE_CHECK_MASK
;
164 pp
= pte1
& 0x00000003;
165 if (ptem
== ctx
->ptem
) {
166 if (ctx
->raddr
!= (hwaddr
)-1ULL) {
167 /* all matches should have equal RPN, WIMG & PP */
168 if ((ctx
->raddr
& mmask
) != (pte1
& mmask
)) {
169 qemu_log_mask(CPU_LOG_MMU
, "Bad RPN/WIMG/PP\n");
173 /* Compute access rights */
174 access
= pp_check(ctx
->key
, pp
, ctx
->nx
);
175 /* Keep the matching PTE informations */
178 ret
= check_prot(ctx
->prot
, rw
, type
);
181 qemu_log_mask(CPU_LOG_MMU
, "PTE access granted !\n");
183 /* Access right violation */
184 qemu_log_mask(CPU_LOG_MMU
, "PTE access rejected\n");
192 static int pte_update_flags(mmu_ctx_t
*ctx
, target_ulong
*pte1p
,
197 /* Update page flags */
198 if (!(*pte1p
& 0x00000100)) {
199 /* Update accessed flag */
200 *pte1p
|= 0x00000100;
203 if (!(*pte1p
& 0x00000080)) {
204 if (rw
== 1 && ret
== 0) {
205 /* Update changed flag */
206 *pte1p
|= 0x00000080;
209 /* Force page fault for first write access */
210 ctx
->prot
&= ~PAGE_WRITE
;
217 /* Software driven TLB helpers */
218 static inline int ppc6xx_tlb_getnum(CPUPPCState
*env
, target_ulong eaddr
,
219 int way
, int is_code
)
223 /* Select TLB num in a way from address */
224 nr
= (eaddr
>> TARGET_PAGE_BITS
) & (env
->tlb_per_way
- 1);
226 nr
+= env
->tlb_per_way
* way
;
227 /* 6xx have separate TLBs for instructions and data */
228 if (is_code
&& env
->id_tlbs
== 1) {
235 static inline void ppc6xx_tlb_invalidate_all(CPUPPCState
*env
)
237 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
241 /* LOG_SWTLB("Invalidate all TLBs\n"); */
242 /* Invalidate all defined software TLB */
244 if (env
->id_tlbs
== 1) {
247 for (nr
= 0; nr
< max
; nr
++) {
248 tlb
= &env
->tlb
.tlb6
[nr
];
249 pte_invalidate(&tlb
->pte0
);
251 tlb_flush(CPU(cpu
), 1);
254 static inline void ppc6xx_tlb_invalidate_virt2(CPUPPCState
*env
,
256 int is_code
, int match_epn
)
258 #if !defined(FLUSH_ALL_TLBS)
259 CPUState
*cs
= CPU(ppc_env_get_cpu(env
));
263 /* Invalidate ITLB + DTLB, all ways */
264 for (way
= 0; way
< env
->nb_ways
; way
++) {
265 nr
= ppc6xx_tlb_getnum(env
, eaddr
, way
, is_code
);
266 tlb
= &env
->tlb
.tlb6
[nr
];
267 if (pte_is_valid(tlb
->pte0
) && (match_epn
== 0 || eaddr
== tlb
->EPN
)) {
268 LOG_SWTLB("TLB invalidate %d/%d " TARGET_FMT_lx
"\n", nr
,
270 pte_invalidate(&tlb
->pte0
);
271 tlb_flush_page(cs
, tlb
->EPN
);
275 /* XXX: PowerPC specification say this is valid as well */
276 ppc6xx_tlb_invalidate_all(env
);
280 static inline void ppc6xx_tlb_invalidate_virt(CPUPPCState
*env
,
281 target_ulong eaddr
, int is_code
)
283 ppc6xx_tlb_invalidate_virt2(env
, eaddr
, is_code
, 0);
286 static void ppc6xx_tlb_store(CPUPPCState
*env
, target_ulong EPN
, int way
,
287 int is_code
, target_ulong pte0
, target_ulong pte1
)
292 nr
= ppc6xx_tlb_getnum(env
, EPN
, way
, is_code
);
293 tlb
= &env
->tlb
.tlb6
[nr
];
294 LOG_SWTLB("Set TLB %d/%d EPN " TARGET_FMT_lx
" PTE0 " TARGET_FMT_lx
295 " PTE1 " TARGET_FMT_lx
"\n", nr
, env
->nb_tlb
, EPN
, pte0
, pte1
);
296 /* Invalidate any pending reference in QEMU for this virtual address */
297 ppc6xx_tlb_invalidate_virt2(env
, EPN
, is_code
, 1);
301 /* Store last way for LRU mechanism */
305 static inline int ppc6xx_tlb_check(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
306 target_ulong eaddr
, int rw
, int access_type
)
313 ret
= -1; /* No TLB found */
314 for (way
= 0; way
< env
->nb_ways
; way
++) {
315 nr
= ppc6xx_tlb_getnum(env
, eaddr
, way
,
316 access_type
== ACCESS_CODE
? 1 : 0);
317 tlb
= &env
->tlb
.tlb6
[nr
];
318 /* This test "emulates" the PTE index match for hardware TLBs */
319 if ((eaddr
& TARGET_PAGE_MASK
) != tlb
->EPN
) {
320 LOG_SWTLB("TLB %d/%d %s [" TARGET_FMT_lx
" " TARGET_FMT_lx
321 "] <> " TARGET_FMT_lx
"\n", nr
, env
->nb_tlb
,
322 pte_is_valid(tlb
->pte0
) ? "valid" : "inval",
323 tlb
->EPN
, tlb
->EPN
+ TARGET_PAGE_SIZE
, eaddr
);
326 LOG_SWTLB("TLB %d/%d %s " TARGET_FMT_lx
" <> " TARGET_FMT_lx
" "
327 TARGET_FMT_lx
" %c %c\n", nr
, env
->nb_tlb
,
328 pte_is_valid(tlb
->pte0
) ? "valid" : "inval",
329 tlb
->EPN
, eaddr
, tlb
->pte1
,
330 rw
? 'S' : 'L', access_type
== ACCESS_CODE
? 'I' : 'D');
331 switch (ppc6xx_tlb_pte_check(ctx
, tlb
->pte0
, tlb
->pte1
, 0, rw
, access_type
)) {
333 /* TLB inconsistency */
336 /* Access violation */
346 /* XXX: we should go on looping to check all TLBs consistency
347 * but we can speed-up the whole thing as the
348 * result would be undefined if TLBs are not consistent.
357 LOG_SWTLB("found TLB at addr " TARGET_FMT_plx
" prot=%01x ret=%d\n",
358 ctx
->raddr
& TARGET_PAGE_MASK
, ctx
->prot
, ret
);
359 /* Update page flags */
360 pte_update_flags(ctx
, &env
->tlb
.tlb6
[best
].pte1
, ret
, rw
);
366 /* Perform BAT hit & translation */
367 static inline void bat_size_prot(CPUPPCState
*env
, target_ulong
*blp
,
368 int *validp
, int *protp
, target_ulong
*BATu
,
374 bl
= (*BATu
& 0x00001FFC) << 15;
377 if (((msr_pr
== 0) && (*BATu
& 0x00000002)) ||
378 ((msr_pr
!= 0) && (*BATu
& 0x00000001))) {
380 pp
= *BATl
& 0x00000003;
382 prot
= PAGE_READ
| PAGE_EXEC
;
393 static int get_bat_6xx_tlb(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
394 target_ulong
virtual, int rw
, int type
)
396 target_ulong
*BATlt
, *BATut
, *BATu
, *BATl
;
397 target_ulong BEPIl
, BEPIu
, bl
;
401 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx
"\n", __func__
,
402 type
== ACCESS_CODE
? 'I' : 'D', virtual);
405 BATlt
= env
->IBAT
[1];
406 BATut
= env
->IBAT
[0];
409 BATlt
= env
->DBAT
[1];
410 BATut
= env
->DBAT
[0];
413 for (i
= 0; i
< env
->nb_BATs
; i
++) {
416 BEPIu
= *BATu
& 0xF0000000;
417 BEPIl
= *BATu
& 0x0FFE0000;
418 bat_size_prot(env
, &bl
, &valid
, &prot
, BATu
, BATl
);
419 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx
" BATu " TARGET_FMT_lx
420 " BATl " TARGET_FMT_lx
"\n", __func__
,
421 type
== ACCESS_CODE
? 'I' : 'D', i
, virtual, *BATu
, *BATl
);
422 if ((virtual & 0xF0000000) == BEPIu
&&
423 ((virtual & 0x0FFE0000) & ~bl
) == BEPIl
) {
426 /* Get physical address */
427 ctx
->raddr
= (*BATl
& 0xF0000000) |
428 ((virtual & 0x0FFE0000 & bl
) | (*BATl
& 0x0FFE0000)) |
429 (virtual & 0x0001F000);
430 /* Compute access rights */
432 ret
= check_prot(ctx
->prot
, rw
, type
);
434 LOG_BATS("BAT %d match: r " TARGET_FMT_plx
" prot=%c%c\n",
435 i
, ctx
->raddr
, ctx
->prot
& PAGE_READ
? 'R' : '-',
436 ctx
->prot
& PAGE_WRITE
? 'W' : '-');
443 #if defined(DEBUG_BATS)
444 if (qemu_log_enabled()) {
445 LOG_BATS("no BAT match for " TARGET_FMT_lx
":\n", virtual);
446 for (i
= 0; i
< 4; i
++) {
449 BEPIu
= *BATu
& 0xF0000000;
450 BEPIl
= *BATu
& 0x0FFE0000;
451 bl
= (*BATu
& 0x00001FFC) << 15;
452 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx
" BATu " TARGET_FMT_lx
453 " BATl " TARGET_FMT_lx
"\n\t" TARGET_FMT_lx
" "
454 TARGET_FMT_lx
" " TARGET_FMT_lx
"\n",
455 __func__
, type
== ACCESS_CODE
? 'I' : 'D', i
, virtual,
456 *BATu
, *BATl
, BEPIu
, BEPIl
, bl
);
465 /* Perform segment based translation */
466 static inline int get_segment_6xx_tlb(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
467 target_ulong eaddr
, int rw
, int type
)
471 int ds
, pr
, target_page_bits
;
473 target_ulong sr
, pgidx
;
478 sr
= env
->sr
[eaddr
>> 28];
479 ctx
->key
= (((sr
& 0x20000000) && (pr
!= 0)) ||
480 ((sr
& 0x40000000) && (pr
== 0))) ? 1 : 0;
481 ds
= sr
& 0x80000000 ? 1 : 0;
482 ctx
->nx
= sr
& 0x10000000 ? 1 : 0;
483 vsid
= sr
& 0x00FFFFFF;
484 target_page_bits
= TARGET_PAGE_BITS
;
485 qemu_log_mask(CPU_LOG_MMU
,
486 "Check segment v=" TARGET_FMT_lx
" %d " TARGET_FMT_lx
487 " nip=" TARGET_FMT_lx
" lr=" TARGET_FMT_lx
488 " ir=%d dr=%d pr=%d %d t=%d\n",
489 eaddr
, (int)(eaddr
>> 28), sr
, env
->nip
, env
->lr
, (int)msr_ir
,
490 (int)msr_dr
, pr
!= 0 ? 1 : 0, rw
, type
);
491 pgidx
= (eaddr
& ~SEGMENT_MASK_256M
) >> target_page_bits
;
493 ctx
->ptem
= (vsid
<< 7) | (pgidx
>> 10);
495 qemu_log_mask(CPU_LOG_MMU
,
496 "pte segment: key=%d ds %d nx %d vsid " TARGET_FMT_lx
"\n",
497 ctx
->key
, ds
, ctx
->nx
, vsid
);
500 /* Check if instruction fetch is allowed, if needed */
501 if (type
!= ACCESS_CODE
|| ctx
->nx
== 0) {
502 /* Page address translation */
503 qemu_log_mask(CPU_LOG_MMU
, "htab_base " TARGET_FMT_plx
504 " htab_mask " TARGET_FMT_plx
505 " hash " TARGET_FMT_plx
"\n",
506 env
->htab_base
, env
->htab_mask
, hash
);
508 ctx
->hash
[1] = ~hash
;
510 /* Initialize real address with an invalid value */
511 ctx
->raddr
= (hwaddr
)-1ULL;
512 /* Software TLB search */
513 ret
= ppc6xx_tlb_check(env
, ctx
, eaddr
, rw
, type
);
514 #if defined(DUMP_PAGE_TABLES)
515 if (qemu_loglevel_mask(CPU_LOG_MMU
)) {
516 CPUState
*cs
= ENV_GET_CPU(env
);
518 uint32_t a0
, a1
, a2
, a3
;
520 qemu_log("Page table: " TARGET_FMT_plx
" len " TARGET_FMT_plx
521 "\n", env
->htab_base
, env
->htab_mask
+ 0x80);
522 for (curaddr
= env
->htab_base
;
523 curaddr
< (env
->htab_base
+ env
->htab_mask
+ 0x80);
525 a0
= ldl_phys(cs
->as
, curaddr
);
526 a1
= ldl_phys(cs
->as
, curaddr
+ 4);
527 a2
= ldl_phys(cs
->as
, curaddr
+ 8);
528 a3
= ldl_phys(cs
->as
, curaddr
+ 12);
529 if (a0
!= 0 || a1
!= 0 || a2
!= 0 || a3
!= 0) {
530 qemu_log(TARGET_FMT_plx
": %08x %08x %08x %08x\n",
531 curaddr
, a0
, a1
, a2
, a3
);
537 qemu_log_mask(CPU_LOG_MMU
, "No access allowed\n");
543 qemu_log_mask(CPU_LOG_MMU
, "direct store...\n");
544 /* Direct-store segment : absolutely *BUGGY* for now */
546 /* Direct-store implies a 32-bit MMU.
547 * Check the Segment Register's bus unit ID (BUID).
549 sr
= env
->sr
[eaddr
>> 28];
550 if ((sr
& 0x1FF00000) >> 20 == 0x07f) {
551 /* Memory-forced I/O controller interface access */
552 /* If T=1 and BUID=x'07F', the 601 performs a memory access
553 * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
555 ctx
->raddr
= ((sr
& 0xF) << 28) | (eaddr
& 0x0FFFFFFF);
556 ctx
->prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
562 /* Integer load/store : only access allowed */
565 /* No code fetch is allowed in direct-store areas */
568 /* Floating point load/store */
571 /* lwarx, ldarx or srwcx. */
574 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
575 /* Should make the instruction do no-op.
576 * As it already do no-op, it's quite easy :-)
584 qemu_log_mask(CPU_LOG_MMU
, "ERROR: instruction should not need "
585 "address translation\n");
588 if ((rw
== 1 || ctx
->key
!= 1) && (rw
== 0 || ctx
->key
!= 0)) {
599 /* Generic TLB check function for embedded PowerPC implementations */
600 static int ppcemb_tlb_check(CPUPPCState
*env
, ppcemb_tlb_t
*tlb
,
602 target_ulong address
, uint32_t pid
, int ext
,
607 /* Check valid flag */
608 if (!(tlb
->prot
& PAGE_VALID
)) {
611 mask
= ~(tlb
->size
- 1);
612 LOG_SWTLB("%s: TLB %d address " TARGET_FMT_lx
" PID %u <=> " TARGET_FMT_lx
613 " " TARGET_FMT_lx
" %u %x\n", __func__
, i
, address
, pid
, tlb
->EPN
,
614 mask
, (uint32_t)tlb
->PID
, tlb
->prot
);
616 if (tlb
->PID
!= 0 && tlb
->PID
!= pid
) {
619 /* Check effective address */
620 if ((address
& mask
) != tlb
->EPN
) {
623 *raddrp
= (tlb
->RPN
& mask
) | (address
& ~mask
);
625 /* Extend the physical address to 36 bits */
626 *raddrp
|= (uint64_t)(tlb
->RPN
& 0xF) << 32;
632 /* Generic TLB search function for PowerPC embedded implementations */
633 static int ppcemb_tlb_search(CPUPPCState
*env
, target_ulong address
,
640 /* Default return value is no match */
642 for (i
= 0; i
< env
->nb_tlb
; i
++) {
643 tlb
= &env
->tlb
.tlbe
[i
];
644 if (ppcemb_tlb_check(env
, tlb
, &raddr
, address
, pid
, 0, i
) == 0) {
653 /* Helpers specific to PowerPC 40x implementations */
654 static inline void ppc4xx_tlb_invalidate_all(CPUPPCState
*env
)
656 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
660 for (i
= 0; i
< env
->nb_tlb
; i
++) {
661 tlb
= &env
->tlb
.tlbe
[i
];
662 tlb
->prot
&= ~PAGE_VALID
;
664 tlb_flush(CPU(cpu
), 1);
667 static int mmu40x_get_physical_address(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
668 target_ulong address
, int rw
,
673 int i
, ret
, zsel
, zpr
, pr
;
676 raddr
= (hwaddr
)-1ULL;
678 for (i
= 0; i
< env
->nb_tlb
; i
++) {
679 tlb
= &env
->tlb
.tlbe
[i
];
680 if (ppcemb_tlb_check(env
, tlb
, &raddr
, address
,
681 env
->spr
[SPR_40x_PID
], 0, i
) < 0) {
684 zsel
= (tlb
->attr
>> 4) & 0xF;
685 zpr
= (env
->spr
[SPR_40x_ZPR
] >> (30 - (2 * zsel
))) & 0x3;
686 LOG_SWTLB("%s: TLB %d zsel %d zpr %d rw %d attr %08x\n",
687 __func__
, i
, zsel
, zpr
, rw
, tlb
->attr
);
688 /* Check execute enable bit */
696 /* All accesses granted */
697 ctx
->prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
702 /* Raise Zone protection fault. */
703 env
->spr
[SPR_40x_ESR
] = 1 << 22;
711 /* Check from TLB entry */
712 ctx
->prot
= tlb
->prot
;
713 ret
= check_prot(ctx
->prot
, rw
, access_type
);
715 env
->spr
[SPR_40x_ESR
] = 0;
721 LOG_SWTLB("%s: access granted " TARGET_FMT_lx
" => " TARGET_FMT_plx
722 " %d %d\n", __func__
, address
, ctx
->raddr
, ctx
->prot
,
727 LOG_SWTLB("%s: access refused " TARGET_FMT_lx
" => " TARGET_FMT_plx
728 " %d %d\n", __func__
, address
, raddr
, ctx
->prot
, ret
);
733 void store_40x_sler(CPUPPCState
*env
, uint32_t val
)
735 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
737 /* XXX: TO BE FIXED */
738 if (val
!= 0x00000000) {
739 cpu_abort(CPU(cpu
), "Little-endian regions are not supported by now\n");
741 env
->spr
[SPR_405_SLER
] = val
;
744 static inline int mmubooke_check_tlb(CPUPPCState
*env
, ppcemb_tlb_t
*tlb
,
745 hwaddr
*raddr
, int *prot
,
746 target_ulong address
, int rw
,
747 int access_type
, int i
)
751 if (ppcemb_tlb_check(env
, tlb
, raddr
, address
,
752 env
->spr
[SPR_BOOKE_PID
],
753 !env
->nb_pids
, i
) >= 0) {
757 if (env
->spr
[SPR_BOOKE_PID1
] &&
758 ppcemb_tlb_check(env
, tlb
, raddr
, address
,
759 env
->spr
[SPR_BOOKE_PID1
], 0, i
) >= 0) {
763 if (env
->spr
[SPR_BOOKE_PID2
] &&
764 ppcemb_tlb_check(env
, tlb
, raddr
, address
,
765 env
->spr
[SPR_BOOKE_PID2
], 0, i
) >= 0) {
769 LOG_SWTLB("%s: TLB entry not found\n", __func__
);
775 prot2
= tlb
->prot
& 0xF;
777 prot2
= (tlb
->prot
>> 4) & 0xF;
780 /* Check the address space */
781 if (access_type
== ACCESS_CODE
) {
782 if (msr_ir
!= (tlb
->attr
& 1)) {
783 LOG_SWTLB("%s: AS doesn't match\n", __func__
);
788 if (prot2
& PAGE_EXEC
) {
789 LOG_SWTLB("%s: good TLB!\n", __func__
);
793 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__
, prot2
);
796 if (msr_dr
!= (tlb
->attr
& 1)) {
797 LOG_SWTLB("%s: AS doesn't match\n", __func__
);
802 if ((!rw
&& prot2
& PAGE_READ
) || (rw
&& (prot2
& PAGE_WRITE
))) {
803 LOG_SWTLB("%s: found TLB!\n", __func__
);
807 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__
, prot2
);
814 static int mmubooke_get_physical_address(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
815 target_ulong address
, int rw
,
823 raddr
= (hwaddr
)-1ULL;
824 for (i
= 0; i
< env
->nb_tlb
; i
++) {
825 tlb
= &env
->tlb
.tlbe
[i
];
826 ret
= mmubooke_check_tlb(env
, tlb
, &raddr
, &ctx
->prot
, address
, rw
,
835 LOG_SWTLB("%s: access granted " TARGET_FMT_lx
" => " TARGET_FMT_plx
836 " %d %d\n", __func__
, address
, ctx
->raddr
, ctx
->prot
,
839 LOG_SWTLB("%s: access refused " TARGET_FMT_lx
" => " TARGET_FMT_plx
840 " %d %d\n", __func__
, address
, raddr
, ctx
->prot
, ret
);
846 static void booke206_flush_tlb(CPUPPCState
*env
, int flags
,
847 const int check_iprot
)
849 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
852 ppcmas_tlb_t
*tlb
= env
->tlb
.tlbm
;
854 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
855 if (flags
& (1 << i
)) {
856 tlb_size
= booke206_tlb_size(env
, i
);
857 for (j
= 0; j
< tlb_size
; j
++) {
858 if (!check_iprot
|| !(tlb
[j
].mas1
& MAS1_IPROT
)) {
859 tlb
[j
].mas1
&= ~MAS1_VALID
;
863 tlb
+= booke206_tlb_size(env
, i
);
866 tlb_flush(CPU(cpu
), 1);
869 static hwaddr
booke206_tlb_to_page_size(CPUPPCState
*env
,
874 tlbm_size
= (tlb
->mas1
& MAS1_TSIZE_MASK
) >> MAS1_TSIZE_SHIFT
;
876 return 1024ULL << tlbm_size
;
879 /* TLB check function for MAS based SoftTLBs */
880 static int ppcmas_tlb_check(CPUPPCState
*env
, ppcmas_tlb_t
*tlb
,
881 hwaddr
*raddrp
, target_ulong address
,
888 /* In 32bit mode we can only address 32bit EAs */
889 address
= (uint32_t)address
;
892 /* Check valid flag */
893 if (!(tlb
->mas1
& MAS1_VALID
)) {
897 mask
= ~(booke206_tlb_to_page_size(env
, tlb
) - 1);
898 LOG_SWTLB("%s: TLB ADDR=0x" TARGET_FMT_lx
" PID=0x%x MAS1=0x%x MAS2=0x%"
899 PRIx64
" mask=0x%" HWADDR_PRIx
" MAS7_3=0x%" PRIx64
" MAS8=0x%"
900 PRIx32
"\n", __func__
, address
, pid
, tlb
->mas1
, tlb
->mas2
, mask
,
901 tlb
->mas7_3
, tlb
->mas8
);
904 tlb_pid
= (tlb
->mas1
& MAS1_TID_MASK
) >> MAS1_TID_SHIFT
;
905 if (tlb_pid
!= 0 && tlb_pid
!= pid
) {
909 /* Check effective address */
910 if ((address
& mask
) != (tlb
->mas2
& MAS2_EPN_MASK
)) {
915 *raddrp
= (tlb
->mas7_3
& mask
) | (address
& ~mask
);
921 static int mmubooke206_check_tlb(CPUPPCState
*env
, ppcmas_tlb_t
*tlb
,
922 hwaddr
*raddr
, int *prot
,
923 target_ulong address
, int rw
,
929 if (ppcmas_tlb_check(env
, tlb
, raddr
, address
,
930 env
->spr
[SPR_BOOKE_PID
]) >= 0) {
934 if (env
->spr
[SPR_BOOKE_PID1
] &&
935 ppcmas_tlb_check(env
, tlb
, raddr
, address
,
936 env
->spr
[SPR_BOOKE_PID1
]) >= 0) {
940 if (env
->spr
[SPR_BOOKE_PID2
] &&
941 ppcmas_tlb_check(env
, tlb
, raddr
, address
,
942 env
->spr
[SPR_BOOKE_PID2
]) >= 0) {
946 LOG_SWTLB("%s: TLB entry not found\n", __func__
);
952 if (tlb
->mas7_3
& MAS3_UR
) {
955 if (tlb
->mas7_3
& MAS3_UW
) {
958 if (tlb
->mas7_3
& MAS3_UX
) {
962 if (tlb
->mas7_3
& MAS3_SR
) {
965 if (tlb
->mas7_3
& MAS3_SW
) {
968 if (tlb
->mas7_3
& MAS3_SX
) {
973 /* Check the address space and permissions */
974 if (access_type
== ACCESS_CODE
) {
975 if (msr_ir
!= ((tlb
->mas1
& MAS1_TS
) >> MAS1_TS_SHIFT
)) {
976 LOG_SWTLB("%s: AS doesn't match\n", __func__
);
981 if (prot2
& PAGE_EXEC
) {
982 LOG_SWTLB("%s: good TLB!\n", __func__
);
986 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__
, prot2
);
989 if (msr_dr
!= ((tlb
->mas1
& MAS1_TS
) >> MAS1_TS_SHIFT
)) {
990 LOG_SWTLB("%s: AS doesn't match\n", __func__
);
995 if ((!rw
&& prot2
& PAGE_READ
) || (rw
&& (prot2
& PAGE_WRITE
))) {
996 LOG_SWTLB("%s: found TLB!\n", __func__
);
1000 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__
, prot2
);
1007 static int mmubooke206_get_physical_address(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
1008 target_ulong address
, int rw
,
1016 raddr
= (hwaddr
)-1ULL;
1018 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
1019 int ways
= booke206_tlb_ways(env
, i
);
1021 for (j
= 0; j
< ways
; j
++) {
1022 tlb
= booke206_get_tlbm(env
, i
, address
, j
);
1026 ret
= mmubooke206_check_tlb(env
, tlb
, &raddr
, &ctx
->prot
, address
,
1038 LOG_SWTLB("%s: access granted " TARGET_FMT_lx
" => " TARGET_FMT_plx
1039 " %d %d\n", __func__
, address
, ctx
->raddr
, ctx
->prot
,
1042 LOG_SWTLB("%s: access refused " TARGET_FMT_lx
" => " TARGET_FMT_plx
1043 " %d %d\n", __func__
, address
, raddr
, ctx
->prot
, ret
);
1049 static const char *book3e_tsize_to_str
[32] = {
1050 "1K", "2K", "4K", "8K", "16K", "32K", "64K", "128K", "256K", "512K",
1051 "1M", "2M", "4M", "8M", "16M", "32M", "64M", "128M", "256M", "512M",
1052 "1G", "2G", "4G", "8G", "16G", "32G", "64G", "128G", "256G", "512G",
1056 static void mmubooke_dump_mmu(FILE *f
, fprintf_function cpu_fprintf
,
1059 ppcemb_tlb_t
*entry
;
1062 if (kvm_enabled() && !env
->kvm_sw_tlb
) {
1063 cpu_fprintf(f
, "Cannot access KVM TLB\n");
1067 cpu_fprintf(f
, "\nTLB:\n");
1068 cpu_fprintf(f
, "Effective Physical Size PID Prot "
1071 entry
= &env
->tlb
.tlbe
[0];
1072 for (i
= 0; i
< env
->nb_tlb
; i
++, entry
++) {
1075 uint64_t size
= (uint64_t)entry
->size
;
1078 /* Check valid flag */
1079 if (!(entry
->prot
& PAGE_VALID
)) {
1083 mask
= ~(entry
->size
- 1);
1084 ea
= entry
->EPN
& mask
;
1085 pa
= entry
->RPN
& mask
;
1086 /* Extend the physical address to 36 bits */
1087 pa
|= (hwaddr
)(entry
->RPN
& 0xF) << 32;
1090 snprintf(size_buf
, sizeof(size_buf
), "%3" PRId64
"M", size
/ 1024);
1092 snprintf(size_buf
, sizeof(size_buf
), "%3" PRId64
"k", size
);
1094 cpu_fprintf(f
, "0x%016" PRIx64
" 0x%016" PRIx64
" %s %-5u %08x %08x\n",
1095 (uint64_t)ea
, (uint64_t)pa
, size_buf
, (uint32_t)entry
->PID
,
1096 entry
->prot
, entry
->attr
);
1101 static void mmubooke206_dump_one_tlb(FILE *f
, fprintf_function cpu_fprintf
,
1102 CPUPPCState
*env
, int tlbn
, int offset
,
1105 ppcmas_tlb_t
*entry
;
1108 cpu_fprintf(f
, "\nTLB%d:\n", tlbn
);
1109 cpu_fprintf(f
, "Effective Physical Size TID TS SRWX"
1110 " URWX WIMGE U0123\n");
1112 entry
= &env
->tlb
.tlbm
[offset
];
1113 for (i
= 0; i
< tlbsize
; i
++, entry
++) {
1114 hwaddr ea
, pa
, size
;
1117 if (!(entry
->mas1
& MAS1_VALID
)) {
1121 tsize
= (entry
->mas1
& MAS1_TSIZE_MASK
) >> MAS1_TSIZE_SHIFT
;
1122 size
= 1024ULL << tsize
;
1123 ea
= entry
->mas2
& ~(size
- 1);
1124 pa
= entry
->mas7_3
& ~(size
- 1);
1126 cpu_fprintf(f
, "0x%016" PRIx64
" 0x%016" PRIx64
" %4s %-5u %1u S%c%c%c"
1127 "U%c%c%c %c%c%c%c%c U%c%c%c%c\n",
1128 (uint64_t)ea
, (uint64_t)pa
,
1129 book3e_tsize_to_str
[tsize
],
1130 (entry
->mas1
& MAS1_TID_MASK
) >> MAS1_TID_SHIFT
,
1131 (entry
->mas1
& MAS1_TS
) >> MAS1_TS_SHIFT
,
1132 entry
->mas7_3
& MAS3_SR
? 'R' : '-',
1133 entry
->mas7_3
& MAS3_SW
? 'W' : '-',
1134 entry
->mas7_3
& MAS3_SX
? 'X' : '-',
1135 entry
->mas7_3
& MAS3_UR
? 'R' : '-',
1136 entry
->mas7_3
& MAS3_UW
? 'W' : '-',
1137 entry
->mas7_3
& MAS3_UX
? 'X' : '-',
1138 entry
->mas2
& MAS2_W
? 'W' : '-',
1139 entry
->mas2
& MAS2_I
? 'I' : '-',
1140 entry
->mas2
& MAS2_M
? 'M' : '-',
1141 entry
->mas2
& MAS2_G
? 'G' : '-',
1142 entry
->mas2
& MAS2_E
? 'E' : '-',
1143 entry
->mas7_3
& MAS3_U0
? '0' : '-',
1144 entry
->mas7_3
& MAS3_U1
? '1' : '-',
1145 entry
->mas7_3
& MAS3_U2
? '2' : '-',
1146 entry
->mas7_3
& MAS3_U3
? '3' : '-');
1150 static void mmubooke206_dump_mmu(FILE *f
, fprintf_function cpu_fprintf
,
1156 if (kvm_enabled() && !env
->kvm_sw_tlb
) {
1157 cpu_fprintf(f
, "Cannot access KVM TLB\n");
1161 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
1162 int size
= booke206_tlb_size(env
, i
);
1168 mmubooke206_dump_one_tlb(f
, cpu_fprintf
, env
, i
, offset
, size
);
1173 static void mmu6xx_dump_BATs(FILE *f
, fprintf_function cpu_fprintf
,
1174 CPUPPCState
*env
, int type
)
1176 target_ulong
*BATlt
, *BATut
, *BATu
, *BATl
;
1177 target_ulong BEPIl
, BEPIu
, bl
;
1182 BATlt
= env
->IBAT
[1];
1183 BATut
= env
->IBAT
[0];
1186 BATlt
= env
->DBAT
[1];
1187 BATut
= env
->DBAT
[0];
1191 for (i
= 0; i
< env
->nb_BATs
; i
++) {
1194 BEPIu
= *BATu
& 0xF0000000;
1195 BEPIl
= *BATu
& 0x0FFE0000;
1196 bl
= (*BATu
& 0x00001FFC) << 15;
1197 cpu_fprintf(f
, "%s BAT%d BATu " TARGET_FMT_lx
1198 " BATl " TARGET_FMT_lx
"\n\t" TARGET_FMT_lx
" "
1199 TARGET_FMT_lx
" " TARGET_FMT_lx
"\n",
1200 type
== ACCESS_CODE
? "code" : "data", i
,
1201 *BATu
, *BATl
, BEPIu
, BEPIl
, bl
);
1205 static void mmu6xx_dump_mmu(FILE *f
, fprintf_function cpu_fprintf
,
1210 int type
, way
, entry
, i
;
1212 cpu_fprintf(f
, "HTAB base = 0x%"HWADDR_PRIx
"\n", env
->htab_base
);
1213 cpu_fprintf(f
, "HTAB mask = 0x%"HWADDR_PRIx
"\n", env
->htab_mask
);
1215 cpu_fprintf(f
, "\nSegment registers:\n");
1216 for (i
= 0; i
< 32; i
++) {
1218 if (sr
& 0x80000000) {
1219 cpu_fprintf(f
, "%02d T=%d Ks=%d Kp=%d BUID=0x%03x "
1220 "CNTLR_SPEC=0x%05x\n", i
,
1221 sr
& 0x80000000 ? 1 : 0, sr
& 0x40000000 ? 1 : 0,
1222 sr
& 0x20000000 ? 1 : 0, (uint32_t)((sr
>> 20) & 0x1FF),
1223 (uint32_t)(sr
& 0xFFFFF));
1225 cpu_fprintf(f
, "%02d T=%d Ks=%d Kp=%d N=%d VSID=0x%06x\n", i
,
1226 sr
& 0x80000000 ? 1 : 0, sr
& 0x40000000 ? 1 : 0,
1227 sr
& 0x20000000 ? 1 : 0, sr
& 0x10000000 ? 1 : 0,
1228 (uint32_t)(sr
& 0x00FFFFFF));
1232 cpu_fprintf(f
, "\nBATs:\n");
1233 mmu6xx_dump_BATs(f
, cpu_fprintf
, env
, ACCESS_INT
);
1234 mmu6xx_dump_BATs(f
, cpu_fprintf
, env
, ACCESS_CODE
);
1236 if (env
->id_tlbs
!= 1) {
1237 cpu_fprintf(f
, "ERROR: 6xx MMU should have separated TLB"
1238 " for code and data\n");
1241 cpu_fprintf(f
, "\nTLBs [EPN EPN + SIZE]\n");
1243 for (type
= 0; type
< 2; type
++) {
1244 for (way
= 0; way
< env
->nb_ways
; way
++) {
1245 for (entry
= env
->nb_tlb
* type
+ env
->tlb_per_way
* way
;
1246 entry
< (env
->nb_tlb
* type
+ env
->tlb_per_way
* (way
+ 1));
1249 tlb
= &env
->tlb
.tlb6
[entry
];
1250 cpu_fprintf(f
, "%s TLB %02d/%02d way:%d %s ["
1251 TARGET_FMT_lx
" " TARGET_FMT_lx
"]\n",
1252 type
? "code" : "data", entry
% env
->nb_tlb
,
1254 pte_is_valid(tlb
->pte0
) ? "valid" : "inval",
1255 tlb
->EPN
, tlb
->EPN
+ TARGET_PAGE_SIZE
);
1261 void dump_mmu(FILE *f
, fprintf_function cpu_fprintf
, CPUPPCState
*env
)
1263 switch (env
->mmu_model
) {
1264 case POWERPC_MMU_BOOKE
:
1265 mmubooke_dump_mmu(f
, cpu_fprintf
, env
);
1267 case POWERPC_MMU_BOOKE206
:
1268 mmubooke206_dump_mmu(f
, cpu_fprintf
, env
);
1270 case POWERPC_MMU_SOFT_6xx
:
1271 case POWERPC_MMU_SOFT_74xx
:
1272 mmu6xx_dump_mmu(f
, cpu_fprintf
, env
);
1274 #if defined(TARGET_PPC64)
1275 case POWERPC_MMU_64B
:
1276 case POWERPC_MMU_2_03
:
1277 case POWERPC_MMU_2_06
:
1278 case POWERPC_MMU_2_06a
:
1279 case POWERPC_MMU_2_07
:
1280 case POWERPC_MMU_2_07a
:
1281 dump_slb(f
, cpu_fprintf
, ppc_env_get_cpu(env
));
1285 qemu_log_mask(LOG_UNIMP
, "%s: unimplemented\n", __func__
);
1289 static inline int check_physical(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
1290 target_ulong eaddr
, int rw
)
1295 ctx
->prot
= PAGE_READ
| PAGE_EXEC
;
1297 switch (env
->mmu_model
) {
1298 case POWERPC_MMU_SOFT_6xx
:
1299 case POWERPC_MMU_SOFT_74xx
:
1300 case POWERPC_MMU_SOFT_4xx
:
1301 case POWERPC_MMU_REAL
:
1302 case POWERPC_MMU_BOOKE
:
1303 ctx
->prot
|= PAGE_WRITE
;
1306 case POWERPC_MMU_SOFT_4xx_Z
:
1307 if (unlikely(msr_pe
!= 0)) {
1308 /* 403 family add some particular protections,
1309 * using PBL/PBU registers for accesses with no translation.
1312 /* Check PLB validity */
1313 (env
->pb
[0] < env
->pb
[1] &&
1314 /* and address in plb area */
1315 eaddr
>= env
->pb
[0] && eaddr
< env
->pb
[1]) ||
1316 (env
->pb
[2] < env
->pb
[3] &&
1317 eaddr
>= env
->pb
[2] && eaddr
< env
->pb
[3]) ? 1 : 0;
1318 if (in_plb
^ msr_px
) {
1319 /* Access in protected area */
1321 /* Access is not allowed */
1325 /* Read-write access is allowed */
1326 ctx
->prot
|= PAGE_WRITE
;
1332 /* Caller's checks mean we should never get here for other models */
1340 static int get_physical_address(CPUPPCState
*env
, mmu_ctx_t
*ctx
,
1341 target_ulong eaddr
, int rw
, int access_type
)
1343 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
1345 bool real_mode
= (access_type
== ACCESS_CODE
&& msr_ir
== 0)
1346 || (access_type
!= ACCESS_CODE
&& msr_dr
== 0);
1349 qemu_log("%s\n", __func__
);
1352 switch (env
->mmu_model
) {
1353 case POWERPC_MMU_SOFT_6xx
:
1354 case POWERPC_MMU_SOFT_74xx
:
1356 ret
= check_physical(env
, ctx
, eaddr
, rw
);
1358 /* Try to find a BAT */
1359 if (env
->nb_BATs
!= 0) {
1360 ret
= get_bat_6xx_tlb(env
, ctx
, eaddr
, rw
, access_type
);
1363 /* We didn't match any BAT entry or don't have BATs */
1364 ret
= get_segment_6xx_tlb(env
, ctx
, eaddr
, rw
, access_type
);
1369 case POWERPC_MMU_SOFT_4xx
:
1370 case POWERPC_MMU_SOFT_4xx_Z
:
1372 ret
= check_physical(env
, ctx
, eaddr
, rw
);
1374 ret
= mmu40x_get_physical_address(env
, ctx
, eaddr
,
1378 case POWERPC_MMU_BOOKE
:
1379 ret
= mmubooke_get_physical_address(env
, ctx
, eaddr
,
1382 case POWERPC_MMU_BOOKE206
:
1383 ret
= mmubooke206_get_physical_address(env
, ctx
, eaddr
, rw
,
1386 case POWERPC_MMU_MPC8xx
:
1388 cpu_abort(CPU(cpu
), "MPC8xx MMU model is not implemented\n");
1390 case POWERPC_MMU_REAL
:
1392 ret
= check_physical(env
, ctx
, eaddr
, rw
);
1394 cpu_abort(CPU(cpu
), "PowerPC in real mode do not do any translation\n");
1398 cpu_abort(CPU(cpu
), "Unknown or invalid MMU model\n");
1402 qemu_log("%s address " TARGET_FMT_lx
" => %d " TARGET_FMT_plx
"\n",
1403 __func__
, eaddr
, ret
, ctx
->raddr
);
1409 hwaddr
ppc_cpu_get_phys_page_debug(CPUState
*cs
, vaddr addr
)
1411 PowerPCCPU
*cpu
= POWERPC_CPU(cs
);
1412 CPUPPCState
*env
= &cpu
->env
;
1415 switch (env
->mmu_model
) {
1416 #if defined(TARGET_PPC64)
1417 case POWERPC_MMU_64B
:
1418 case POWERPC_MMU_2_03
:
1419 case POWERPC_MMU_2_06
:
1420 case POWERPC_MMU_2_06a
:
1421 case POWERPC_MMU_2_07
:
1422 case POWERPC_MMU_2_07a
:
1423 return ppc_hash64_get_phys_page_debug(cpu
, addr
);
1426 case POWERPC_MMU_32B
:
1427 case POWERPC_MMU_601
:
1428 return ppc_hash32_get_phys_page_debug(cpu
, addr
);
1434 if (unlikely(get_physical_address(env
, &ctx
, addr
, 0, ACCESS_INT
) != 0)) {
1436 /* Some MMUs have separate TLBs for code and data. If we only try an
1437 * ACCESS_INT, we may not be able to read instructions mapped by code
1438 * TLBs, so we also try a ACCESS_CODE.
1440 if (unlikely(get_physical_address(env
, &ctx
, addr
, 0,
1441 ACCESS_CODE
) != 0)) {
1446 return ctx
.raddr
& TARGET_PAGE_MASK
;
1449 static void booke206_update_mas_tlb_miss(CPUPPCState
*env
, target_ulong address
,
1452 env
->spr
[SPR_BOOKE_MAS0
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_TLBSELD_MASK
;
1453 env
->spr
[SPR_BOOKE_MAS1
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_TSIZED_MASK
;
1454 env
->spr
[SPR_BOOKE_MAS2
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_WIMGED_MASK
;
1455 env
->spr
[SPR_BOOKE_MAS3
] = 0;
1456 env
->spr
[SPR_BOOKE_MAS6
] = 0;
1457 env
->spr
[SPR_BOOKE_MAS7
] = 0;
1460 if (((rw
== 2) && msr_ir
) || ((rw
!= 2) && msr_dr
)) {
1461 env
->spr
[SPR_BOOKE_MAS1
] |= MAS1_TS
;
1462 env
->spr
[SPR_BOOKE_MAS6
] |= MAS6_SAS
;
1465 env
->spr
[SPR_BOOKE_MAS1
] |= MAS1_VALID
;
1466 env
->spr
[SPR_BOOKE_MAS2
] |= address
& MAS2_EPN_MASK
;
1468 switch (env
->spr
[SPR_BOOKE_MAS4
] & MAS4_TIDSELD_PIDZ
) {
1469 case MAS4_TIDSELD_PID0
:
1470 env
->spr
[SPR_BOOKE_MAS1
] |= env
->spr
[SPR_BOOKE_PID
] << MAS1_TID_SHIFT
;
1472 case MAS4_TIDSELD_PID1
:
1473 env
->spr
[SPR_BOOKE_MAS1
] |= env
->spr
[SPR_BOOKE_PID1
] << MAS1_TID_SHIFT
;
1475 case MAS4_TIDSELD_PID2
:
1476 env
->spr
[SPR_BOOKE_MAS1
] |= env
->spr
[SPR_BOOKE_PID2
] << MAS1_TID_SHIFT
;
1480 env
->spr
[SPR_BOOKE_MAS6
] |= env
->spr
[SPR_BOOKE_PID
] << 16;
1482 /* next victim logic */
1483 env
->spr
[SPR_BOOKE_MAS0
] |= env
->last_way
<< MAS0_ESEL_SHIFT
;
1485 env
->last_way
&= booke206_tlb_ways(env
, 0) - 1;
1486 env
->spr
[SPR_BOOKE_MAS0
] |= env
->last_way
<< MAS0_NV_SHIFT
;
1489 /* Perform address translation */
1490 static int cpu_ppc_handle_mmu_fault(CPUPPCState
*env
, target_ulong address
,
1491 int rw
, int mmu_idx
)
1493 CPUState
*cs
= CPU(ppc_env_get_cpu(env
));
1494 PowerPCCPU
*cpu
= POWERPC_CPU(cs
);
1502 access_type
= ACCESS_CODE
;
1505 access_type
= env
->access_type
;
1507 ret
= get_physical_address(env
, &ctx
, address
, rw
, access_type
);
1509 tlb_set_page(cs
, address
& TARGET_PAGE_MASK
,
1510 ctx
.raddr
& TARGET_PAGE_MASK
, ctx
.prot
,
1511 mmu_idx
, TARGET_PAGE_SIZE
);
1513 } else if (ret
< 0) {
1515 if (access_type
== ACCESS_CODE
) {
1518 /* No matches in page tables or TLB */
1519 switch (env
->mmu_model
) {
1520 case POWERPC_MMU_SOFT_6xx
:
1521 cs
->exception_index
= POWERPC_EXCP_IFTLB
;
1522 env
->error_code
= 1 << 18;
1523 env
->spr
[SPR_IMISS
] = address
;
1524 env
->spr
[SPR_ICMP
] = 0x80000000 | ctx
.ptem
;
1526 case POWERPC_MMU_SOFT_74xx
:
1527 cs
->exception_index
= POWERPC_EXCP_IFTLB
;
1529 case POWERPC_MMU_SOFT_4xx
:
1530 case POWERPC_MMU_SOFT_4xx_Z
:
1531 cs
->exception_index
= POWERPC_EXCP_ITLB
;
1532 env
->error_code
= 0;
1533 env
->spr
[SPR_40x_DEAR
] = address
;
1534 env
->spr
[SPR_40x_ESR
] = 0x00000000;
1536 case POWERPC_MMU_BOOKE206
:
1537 booke206_update_mas_tlb_miss(env
, address
, rw
);
1539 case POWERPC_MMU_BOOKE
:
1540 cs
->exception_index
= POWERPC_EXCP_ITLB
;
1541 env
->error_code
= 0;
1542 env
->spr
[SPR_BOOKE_DEAR
] = address
;
1544 case POWERPC_MMU_MPC8xx
:
1546 cpu_abort(cs
, "MPC8xx MMU model is not implemented\n");
1548 case POWERPC_MMU_REAL
:
1549 cpu_abort(cs
, "PowerPC in real mode should never raise "
1550 "any MMU exceptions\n");
1553 cpu_abort(cs
, "Unknown or invalid MMU model\n");
1558 /* Access rights violation */
1559 cs
->exception_index
= POWERPC_EXCP_ISI
;
1560 env
->error_code
= 0x08000000;
1563 /* No execute protection violation */
1564 if ((env
->mmu_model
== POWERPC_MMU_BOOKE
) ||
1565 (env
->mmu_model
== POWERPC_MMU_BOOKE206
)) {
1566 env
->spr
[SPR_BOOKE_ESR
] = 0x00000000;
1568 cs
->exception_index
= POWERPC_EXCP_ISI
;
1569 env
->error_code
= 0x10000000;
1572 /* Direct store exception */
1573 /* No code fetch is allowed in direct-store areas */
1574 cs
->exception_index
= POWERPC_EXCP_ISI
;
1575 env
->error_code
= 0x10000000;
1581 /* No matches in page tables or TLB */
1582 switch (env
->mmu_model
) {
1583 case POWERPC_MMU_SOFT_6xx
:
1585 cs
->exception_index
= POWERPC_EXCP_DSTLB
;
1586 env
->error_code
= 1 << 16;
1588 cs
->exception_index
= POWERPC_EXCP_DLTLB
;
1589 env
->error_code
= 0;
1591 env
->spr
[SPR_DMISS
] = address
;
1592 env
->spr
[SPR_DCMP
] = 0x80000000 | ctx
.ptem
;
1594 env
->error_code
|= ctx
.key
<< 19;
1595 env
->spr
[SPR_HASH1
] = env
->htab_base
+
1596 get_pteg_offset32(cpu
, ctx
.hash
[0]);
1597 env
->spr
[SPR_HASH2
] = env
->htab_base
+
1598 get_pteg_offset32(cpu
, ctx
.hash
[1]);
1600 case POWERPC_MMU_SOFT_74xx
:
1602 cs
->exception_index
= POWERPC_EXCP_DSTLB
;
1604 cs
->exception_index
= POWERPC_EXCP_DLTLB
;
1607 /* Implement LRU algorithm */
1608 env
->error_code
= ctx
.key
<< 19;
1609 env
->spr
[SPR_TLBMISS
] = (address
& ~((target_ulong
)0x3)) |
1610 ((env
->last_way
+ 1) & (env
->nb_ways
- 1));
1611 env
->spr
[SPR_PTEHI
] = 0x80000000 | ctx
.ptem
;
1613 case POWERPC_MMU_SOFT_4xx
:
1614 case POWERPC_MMU_SOFT_4xx_Z
:
1615 cs
->exception_index
= POWERPC_EXCP_DTLB
;
1616 env
->error_code
= 0;
1617 env
->spr
[SPR_40x_DEAR
] = address
;
1619 env
->spr
[SPR_40x_ESR
] = 0x00800000;
1621 env
->spr
[SPR_40x_ESR
] = 0x00000000;
1624 case POWERPC_MMU_MPC8xx
:
1626 cpu_abort(cs
, "MPC8xx MMU model is not implemented\n");
1628 case POWERPC_MMU_BOOKE206
:
1629 booke206_update_mas_tlb_miss(env
, address
, rw
);
1631 case POWERPC_MMU_BOOKE
:
1632 cs
->exception_index
= POWERPC_EXCP_DTLB
;
1633 env
->error_code
= 0;
1634 env
->spr
[SPR_BOOKE_DEAR
] = address
;
1635 env
->spr
[SPR_BOOKE_ESR
] = rw
? ESR_ST
: 0;
1637 case POWERPC_MMU_REAL
:
1638 cpu_abort(cs
, "PowerPC in real mode should never raise "
1639 "any MMU exceptions\n");
1642 cpu_abort(cs
, "Unknown or invalid MMU model\n");
1647 /* Access rights violation */
1648 cs
->exception_index
= POWERPC_EXCP_DSI
;
1649 env
->error_code
= 0;
1650 if (env
->mmu_model
== POWERPC_MMU_SOFT_4xx
1651 || env
->mmu_model
== POWERPC_MMU_SOFT_4xx_Z
) {
1652 env
->spr
[SPR_40x_DEAR
] = address
;
1654 env
->spr
[SPR_40x_ESR
] |= 0x00800000;
1656 } else if ((env
->mmu_model
== POWERPC_MMU_BOOKE
) ||
1657 (env
->mmu_model
== POWERPC_MMU_BOOKE206
)) {
1658 env
->spr
[SPR_BOOKE_DEAR
] = address
;
1659 env
->spr
[SPR_BOOKE_ESR
] = rw
? ESR_ST
: 0;
1661 env
->spr
[SPR_DAR
] = address
;
1663 env
->spr
[SPR_DSISR
] = 0x0A000000;
1665 env
->spr
[SPR_DSISR
] = 0x08000000;
1670 /* Direct store exception */
1671 switch (access_type
) {
1673 /* Floating point load/store */
1674 cs
->exception_index
= POWERPC_EXCP_ALIGN
;
1675 env
->error_code
= POWERPC_EXCP_ALIGN_FP
;
1676 env
->spr
[SPR_DAR
] = address
;
1679 /* lwarx, ldarx or stwcx. */
1680 cs
->exception_index
= POWERPC_EXCP_DSI
;
1681 env
->error_code
= 0;
1682 env
->spr
[SPR_DAR
] = address
;
1684 env
->spr
[SPR_DSISR
] = 0x06000000;
1686 env
->spr
[SPR_DSISR
] = 0x04000000;
1690 /* eciwx or ecowx */
1691 cs
->exception_index
= POWERPC_EXCP_DSI
;
1692 env
->error_code
= 0;
1693 env
->spr
[SPR_DAR
] = address
;
1695 env
->spr
[SPR_DSISR
] = 0x06100000;
1697 env
->spr
[SPR_DSISR
] = 0x04100000;
1701 printf("DSI: invalid exception (%d)\n", ret
);
1702 cs
->exception_index
= POWERPC_EXCP_PROGRAM
;
1704 POWERPC_EXCP_INVAL
| POWERPC_EXCP_INVAL_INVAL
;
1705 env
->spr
[SPR_DAR
] = address
;
1712 printf("%s: set exception to %d %02x\n", __func__
,
1713 cs
->exception
, env
->error_code
);
1721 /*****************************************************************************/
1722 /* BATs management */
1723 #if !defined(FLUSH_ALL_TLBS)
1724 static inline void do_invalidate_BAT(CPUPPCState
*env
, target_ulong BATu
,
1727 CPUState
*cs
= CPU(ppc_env_get_cpu(env
));
1728 target_ulong base
, end
, page
;
1730 base
= BATu
& ~0x0001FFFF;
1731 end
= base
+ mask
+ 0x00020000;
1732 LOG_BATS("Flush BAT from " TARGET_FMT_lx
" to " TARGET_FMT_lx
" ("
1733 TARGET_FMT_lx
")\n", base
, end
, mask
);
1734 for (page
= base
; page
!= end
; page
+= TARGET_PAGE_SIZE
) {
1735 tlb_flush_page(cs
, page
);
1737 LOG_BATS("Flush done\n");
1741 static inline void dump_store_bat(CPUPPCState
*env
, char ID
, int ul
, int nr
,
1744 LOG_BATS("Set %cBAT%d%c to " TARGET_FMT_lx
" (" TARGET_FMT_lx
")\n", ID
,
1745 nr
, ul
== 0 ? 'u' : 'l', value
, env
->nip
);
1748 void helper_store_ibatu(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1751 #if defined(FLUSH_ALL_TLBS)
1752 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
1755 dump_store_bat(env
, 'I', 0, nr
, value
);
1756 if (env
->IBAT
[0][nr
] != value
) {
1757 mask
= (value
<< 15) & 0x0FFE0000UL
;
1758 #if !defined(FLUSH_ALL_TLBS)
1759 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1761 /* When storing valid upper BAT, mask BEPI and BRPN
1762 * and invalidate all TLBs covered by this BAT
1764 mask
= (value
<< 15) & 0x0FFE0000UL
;
1765 env
->IBAT
[0][nr
] = (value
& 0x00001FFFUL
) |
1766 (value
& ~0x0001FFFFUL
& ~mask
);
1767 env
->IBAT
[1][nr
] = (env
->IBAT
[1][nr
] & 0x0000007B) |
1768 (env
->IBAT
[1][nr
] & ~0x0001FFFF & ~mask
);
1769 #if !defined(FLUSH_ALL_TLBS)
1770 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1772 tlb_flush(CPU(cpu
), 1);
1777 void helper_store_ibatl(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1779 dump_store_bat(env
, 'I', 1, nr
, value
);
1780 env
->IBAT
[1][nr
] = value
;
1783 void helper_store_dbatu(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1786 #if defined(FLUSH_ALL_TLBS)
1787 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
1790 dump_store_bat(env
, 'D', 0, nr
, value
);
1791 if (env
->DBAT
[0][nr
] != value
) {
1792 /* When storing valid upper BAT, mask BEPI and BRPN
1793 * and invalidate all TLBs covered by this BAT
1795 mask
= (value
<< 15) & 0x0FFE0000UL
;
1796 #if !defined(FLUSH_ALL_TLBS)
1797 do_invalidate_BAT(env
, env
->DBAT
[0][nr
], mask
);
1799 mask
= (value
<< 15) & 0x0FFE0000UL
;
1800 env
->DBAT
[0][nr
] = (value
& 0x00001FFFUL
) |
1801 (value
& ~0x0001FFFFUL
& ~mask
);
1802 env
->DBAT
[1][nr
] = (env
->DBAT
[1][nr
] & 0x0000007B) |
1803 (env
->DBAT
[1][nr
] & ~0x0001FFFF & ~mask
);
1804 #if !defined(FLUSH_ALL_TLBS)
1805 do_invalidate_BAT(env
, env
->DBAT
[0][nr
], mask
);
1807 tlb_flush(CPU(cpu
), 1);
1812 void helper_store_dbatl(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1814 dump_store_bat(env
, 'D', 1, nr
, value
);
1815 env
->DBAT
[1][nr
] = value
;
1818 void helper_store_601_batu(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1821 #if defined(FLUSH_ALL_TLBS)
1822 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
1826 dump_store_bat(env
, 'I', 0, nr
, value
);
1827 if (env
->IBAT
[0][nr
] != value
) {
1828 #if defined(FLUSH_ALL_TLBS)
1831 mask
= (env
->IBAT
[1][nr
] << 17) & 0x0FFE0000UL
;
1832 if (env
->IBAT
[1][nr
] & 0x40) {
1833 /* Invalidate BAT only if it is valid */
1834 #if !defined(FLUSH_ALL_TLBS)
1835 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1840 /* When storing valid upper BAT, mask BEPI and BRPN
1841 * and invalidate all TLBs covered by this BAT
1843 env
->IBAT
[0][nr
] = (value
& 0x00001FFFUL
) |
1844 (value
& ~0x0001FFFFUL
& ~mask
);
1845 env
->DBAT
[0][nr
] = env
->IBAT
[0][nr
];
1846 if (env
->IBAT
[1][nr
] & 0x40) {
1847 #if !defined(FLUSH_ALL_TLBS)
1848 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1853 #if defined(FLUSH_ALL_TLBS)
1855 tlb_flush(CPU(cpu
), 1);
1861 void helper_store_601_batl(CPUPPCState
*env
, uint32_t nr
, target_ulong value
)
1863 #if !defined(FLUSH_ALL_TLBS)
1866 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
1870 dump_store_bat(env
, 'I', 1, nr
, value
);
1871 if (env
->IBAT
[1][nr
] != value
) {
1872 #if defined(FLUSH_ALL_TLBS)
1875 if (env
->IBAT
[1][nr
] & 0x40) {
1876 #if !defined(FLUSH_ALL_TLBS)
1877 mask
= (env
->IBAT
[1][nr
] << 17) & 0x0FFE0000UL
;
1878 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1884 #if !defined(FLUSH_ALL_TLBS)
1885 mask
= (value
<< 17) & 0x0FFE0000UL
;
1886 do_invalidate_BAT(env
, env
->IBAT
[0][nr
], mask
);
1891 env
->IBAT
[1][nr
] = value
;
1892 env
->DBAT
[1][nr
] = value
;
1893 #if defined(FLUSH_ALL_TLBS)
1895 tlb_flush(CPU(cpu
), 1);
1901 /*****************************************************************************/
1902 /* TLB management */
1903 void ppc_tlb_invalidate_all(CPUPPCState
*env
)
1905 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
1907 switch (env
->mmu_model
) {
1908 case POWERPC_MMU_SOFT_6xx
:
1909 case POWERPC_MMU_SOFT_74xx
:
1910 ppc6xx_tlb_invalidate_all(env
);
1912 case POWERPC_MMU_SOFT_4xx
:
1913 case POWERPC_MMU_SOFT_4xx_Z
:
1914 ppc4xx_tlb_invalidate_all(env
);
1916 case POWERPC_MMU_REAL
:
1917 cpu_abort(CPU(cpu
), "No TLB for PowerPC 4xx in real mode\n");
1919 case POWERPC_MMU_MPC8xx
:
1921 cpu_abort(CPU(cpu
), "MPC8xx MMU model is not implemented\n");
1923 case POWERPC_MMU_BOOKE
:
1924 tlb_flush(CPU(cpu
), 1);
1926 case POWERPC_MMU_BOOKE206
:
1927 booke206_flush_tlb(env
, -1, 0);
1929 case POWERPC_MMU_32B
:
1930 case POWERPC_MMU_601
:
1931 #if defined(TARGET_PPC64)
1932 case POWERPC_MMU_64B
:
1933 case POWERPC_MMU_2_03
:
1934 case POWERPC_MMU_2_06
:
1935 case POWERPC_MMU_2_06a
:
1936 case POWERPC_MMU_2_07
:
1937 case POWERPC_MMU_2_07a
:
1938 env
->tlb_need_flush
= 0;
1939 #endif /* defined(TARGET_PPC64) */
1940 tlb_flush(CPU(cpu
), 1);
1944 cpu_abort(CPU(cpu
), "Unknown MMU model\n");
1949 void ppc_tlb_invalidate_one(CPUPPCState
*env
, target_ulong addr
)
1951 #if !defined(FLUSH_ALL_TLBS)
1952 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
1955 addr
&= TARGET_PAGE_MASK
;
1956 switch (env
->mmu_model
) {
1957 case POWERPC_MMU_SOFT_6xx
:
1958 case POWERPC_MMU_SOFT_74xx
:
1959 ppc6xx_tlb_invalidate_virt(env
, addr
, 0);
1960 if (env
->id_tlbs
== 1) {
1961 ppc6xx_tlb_invalidate_virt(env
, addr
, 1);
1964 case POWERPC_MMU_32B
:
1965 case POWERPC_MMU_601
:
1966 /* tlbie invalidate TLBs for all segments */
1967 addr
&= ~((target_ulong
)-1ULL << 28);
1969 /* XXX: this case should be optimized,
1970 * giving a mask to tlb_flush_page
1972 tlb_flush_page(cs
, addr
| (0x0 << 28));
1973 tlb_flush_page(cs
, addr
| (0x1 << 28));
1974 tlb_flush_page(cs
, addr
| (0x2 << 28));
1975 tlb_flush_page(cs
, addr
| (0x3 << 28));
1976 tlb_flush_page(cs
, addr
| (0x4 << 28));
1977 tlb_flush_page(cs
, addr
| (0x5 << 28));
1978 tlb_flush_page(cs
, addr
| (0x6 << 28));
1979 tlb_flush_page(cs
, addr
| (0x7 << 28));
1980 tlb_flush_page(cs
, addr
| (0x8 << 28));
1981 tlb_flush_page(cs
, addr
| (0x9 << 28));
1982 tlb_flush_page(cs
, addr
| (0xA << 28));
1983 tlb_flush_page(cs
, addr
| (0xB << 28));
1984 tlb_flush_page(cs
, addr
| (0xC << 28));
1985 tlb_flush_page(cs
, addr
| (0xD << 28));
1986 tlb_flush_page(cs
, addr
| (0xE << 28));
1987 tlb_flush_page(cs
, addr
| (0xF << 28));
1989 #if defined(TARGET_PPC64)
1990 case POWERPC_MMU_64B
:
1991 case POWERPC_MMU_2_03
:
1992 case POWERPC_MMU_2_06
:
1993 case POWERPC_MMU_2_06a
:
1994 case POWERPC_MMU_2_07
:
1995 case POWERPC_MMU_2_07a
:
1996 /* tlbie invalidate TLBs for all segments */
1997 /* XXX: given the fact that there are too many segments to invalidate,
1998 * and we still don't have a tlb_flush_mask(env, n, mask) in QEMU,
1999 * we just invalidate all TLBs
2001 env
->tlb_need_flush
= 1;
2003 #endif /* defined(TARGET_PPC64) */
2005 /* Should never reach here with other MMU models */
2009 ppc_tlb_invalidate_all(env
);
2013 /*****************************************************************************/
2014 /* Special registers manipulation */
2015 void ppc_store_sdr1(CPUPPCState
*env
, target_ulong value
)
2017 qemu_log_mask(CPU_LOG_MMU
, "%s: " TARGET_FMT_lx
"\n", __func__
, value
);
2018 assert(!env
->external_htab
);
2019 env
->spr
[SPR_SDR1
] = value
;
2020 #if defined(TARGET_PPC64)
2021 if (env
->mmu_model
& POWERPC_MMU_64
) {
2022 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
2023 Error
*local_err
= NULL
;
2025 ppc_hash64_set_sdr1(cpu
, value
, &local_err
);
2027 error_report_err(local_err
);
2028 error_free(local_err
);
2031 #endif /* defined(TARGET_PPC64) */
2033 /* FIXME: Should check for valid HTABMASK values */
2034 env
->htab_mask
= ((value
& SDR_32_HTABMASK
) << 16) | 0xFFFF;
2035 env
->htab_base
= value
& SDR_32_HTABORG
;
2039 /* Segment registers load and store */
2040 target_ulong
helper_load_sr(CPUPPCState
*env
, target_ulong sr_num
)
2042 #if defined(TARGET_PPC64)
2043 if (env
->mmu_model
& POWERPC_MMU_64
) {
2048 return env
->sr
[sr_num
];
2051 void helper_store_sr(CPUPPCState
*env
, target_ulong srnum
, target_ulong value
)
2053 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
2055 qemu_log_mask(CPU_LOG_MMU
,
2056 "%s: reg=%d " TARGET_FMT_lx
" " TARGET_FMT_lx
"\n", __func__
,
2057 (int)srnum
, value
, env
->sr
[srnum
]);
2058 #if defined(TARGET_PPC64)
2059 if (env
->mmu_model
& POWERPC_MMU_64
) {
2060 uint64_t esid
, vsid
;
2063 esid
= ((uint64_t)(srnum
& 0xf) << 28) | SLB_ESID_V
;
2066 vsid
= (value
& 0xfffffff) << 12;
2068 vsid
|= ((value
>> 27) & 0xf) << 8;
2070 ppc_store_slb(cpu
, srnum
, esid
, vsid
);
2073 if (env
->sr
[srnum
] != value
) {
2074 env
->sr
[srnum
] = value
;
2075 /* Invalidating 256MB of virtual memory in 4kB pages is way longer than
2076 flusing the whole TLB. */
2077 #if !defined(FLUSH_ALL_TLBS) && 0
2079 target_ulong page
, end
;
2080 /* Invalidate 256 MB of virtual memory */
2081 page
= (16 << 20) * srnum
;
2082 end
= page
+ (16 << 20);
2083 for (; page
!= end
; page
+= TARGET_PAGE_SIZE
) {
2084 tlb_flush_page(CPU(cpu
), page
);
2088 tlb_flush(CPU(cpu
), 1);
2093 /* TLB management */
2094 void helper_tlbia(CPUPPCState
*env
)
2096 ppc_tlb_invalidate_all(env
);
2099 void helper_tlbie(CPUPPCState
*env
, target_ulong addr
)
2101 ppc_tlb_invalidate_one(env
, addr
);
2104 void helper_tlbiva(CPUPPCState
*env
, target_ulong addr
)
2106 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
2108 /* tlbiva instruction only exists on BookE */
2109 assert(env
->mmu_model
== POWERPC_MMU_BOOKE
);
2111 cpu_abort(CPU(cpu
), "BookE MMU model is not implemented\n");
2114 /* Software driven TLBs management */
2115 /* PowerPC 602/603 software TLB load instructions helpers */
2116 static void do_6xx_tlb(CPUPPCState
*env
, target_ulong new_EPN
, int is_code
)
2118 target_ulong RPN
, CMP
, EPN
;
2121 RPN
= env
->spr
[SPR_RPA
];
2123 CMP
= env
->spr
[SPR_ICMP
];
2124 EPN
= env
->spr
[SPR_IMISS
];
2126 CMP
= env
->spr
[SPR_DCMP
];
2127 EPN
= env
->spr
[SPR_DMISS
];
2129 way
= (env
->spr
[SPR_SRR1
] >> 17) & 1;
2130 (void)EPN
; /* avoid a compiler warning */
2131 LOG_SWTLB("%s: EPN " TARGET_FMT_lx
" " TARGET_FMT_lx
" PTE0 " TARGET_FMT_lx
2132 " PTE1 " TARGET_FMT_lx
" way %d\n", __func__
, new_EPN
, EPN
, CMP
,
2134 /* Store this TLB */
2135 ppc6xx_tlb_store(env
, (uint32_t)(new_EPN
& TARGET_PAGE_MASK
),
2136 way
, is_code
, CMP
, RPN
);
2139 void helper_6xx_tlbd(CPUPPCState
*env
, target_ulong EPN
)
2141 do_6xx_tlb(env
, EPN
, 0);
2144 void helper_6xx_tlbi(CPUPPCState
*env
, target_ulong EPN
)
2146 do_6xx_tlb(env
, EPN
, 1);
2149 /* PowerPC 74xx software TLB load instructions helpers */
2150 static void do_74xx_tlb(CPUPPCState
*env
, target_ulong new_EPN
, int is_code
)
2152 target_ulong RPN
, CMP
, EPN
;
2155 RPN
= env
->spr
[SPR_PTELO
];
2156 CMP
= env
->spr
[SPR_PTEHI
];
2157 EPN
= env
->spr
[SPR_TLBMISS
] & ~0x3;
2158 way
= env
->spr
[SPR_TLBMISS
] & 0x3;
2159 (void)EPN
; /* avoid a compiler warning */
2160 LOG_SWTLB("%s: EPN " TARGET_FMT_lx
" " TARGET_FMT_lx
" PTE0 " TARGET_FMT_lx
2161 " PTE1 " TARGET_FMT_lx
" way %d\n", __func__
, new_EPN
, EPN
, CMP
,
2163 /* Store this TLB */
2164 ppc6xx_tlb_store(env
, (uint32_t)(new_EPN
& TARGET_PAGE_MASK
),
2165 way
, is_code
, CMP
, RPN
);
2168 void helper_74xx_tlbd(CPUPPCState
*env
, target_ulong EPN
)
2170 do_74xx_tlb(env
, EPN
, 0);
2173 void helper_74xx_tlbi(CPUPPCState
*env
, target_ulong EPN
)
2175 do_74xx_tlb(env
, EPN
, 1);
2178 /*****************************************************************************/
2179 /* PowerPC 601 specific instructions (POWER bridge) */
2181 target_ulong
helper_rac(CPUPPCState
*env
, target_ulong addr
)
2185 target_ulong ret
= 0;
2187 /* We don't have to generate many instances of this instruction,
2188 * as rac is supervisor only.
2190 /* XXX: FIX THIS: Pretend we have no BAT */
2191 nb_BATs
= env
->nb_BATs
;
2193 if (get_physical_address(env
, &ctx
, addr
, 0, ACCESS_INT
) == 0) {
2196 env
->nb_BATs
= nb_BATs
;
2200 static inline target_ulong
booke_tlb_to_page_size(int size
)
2202 return 1024 << (2 * size
);
2205 static inline int booke_page_size_to_tlb(target_ulong page_size
)
2209 switch (page_size
) {
2243 #if defined(TARGET_PPC64)
2244 case 0x000100000000ULL
:
2247 case 0x000400000000ULL
:
2250 case 0x001000000000ULL
:
2253 case 0x004000000000ULL
:
2256 case 0x010000000000ULL
:
2268 /* Helpers for 4xx TLB management */
2269 #define PPC4XX_TLB_ENTRY_MASK 0x0000003f /* Mask for 64 TLB entries */
2271 #define PPC4XX_TLBHI_V 0x00000040
2272 #define PPC4XX_TLBHI_E 0x00000020
2273 #define PPC4XX_TLBHI_SIZE_MIN 0
2274 #define PPC4XX_TLBHI_SIZE_MAX 7
2275 #define PPC4XX_TLBHI_SIZE_DEFAULT 1
2276 #define PPC4XX_TLBHI_SIZE_SHIFT 7
2277 #define PPC4XX_TLBHI_SIZE_MASK 0x00000007
2279 #define PPC4XX_TLBLO_EX 0x00000200
2280 #define PPC4XX_TLBLO_WR 0x00000100
2281 #define PPC4XX_TLBLO_ATTR_MASK 0x000000FF
2282 #define PPC4XX_TLBLO_RPN_MASK 0xFFFFFC00
2284 target_ulong
helper_4xx_tlbre_hi(CPUPPCState
*env
, target_ulong entry
)
2290 entry
&= PPC4XX_TLB_ENTRY_MASK
;
2291 tlb
= &env
->tlb
.tlbe
[entry
];
2293 if (tlb
->prot
& PAGE_VALID
) {
2294 ret
|= PPC4XX_TLBHI_V
;
2296 size
= booke_page_size_to_tlb(tlb
->size
);
2297 if (size
< PPC4XX_TLBHI_SIZE_MIN
|| size
> PPC4XX_TLBHI_SIZE_MAX
) {
2298 size
= PPC4XX_TLBHI_SIZE_DEFAULT
;
2300 ret
|= size
<< PPC4XX_TLBHI_SIZE_SHIFT
;
2301 env
->spr
[SPR_40x_PID
] = tlb
->PID
;
2305 target_ulong
helper_4xx_tlbre_lo(CPUPPCState
*env
, target_ulong entry
)
2310 entry
&= PPC4XX_TLB_ENTRY_MASK
;
2311 tlb
= &env
->tlb
.tlbe
[entry
];
2313 if (tlb
->prot
& PAGE_EXEC
) {
2314 ret
|= PPC4XX_TLBLO_EX
;
2316 if (tlb
->prot
& PAGE_WRITE
) {
2317 ret
|= PPC4XX_TLBLO_WR
;
2322 void helper_4xx_tlbwe_hi(CPUPPCState
*env
, target_ulong entry
,
2325 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
2326 CPUState
*cs
= CPU(cpu
);
2328 target_ulong page
, end
;
2330 LOG_SWTLB("%s entry %d val " TARGET_FMT_lx
"\n", __func__
, (int)entry
,
2332 entry
&= PPC4XX_TLB_ENTRY_MASK
;
2333 tlb
= &env
->tlb
.tlbe
[entry
];
2334 /* Invalidate previous TLB (if it's valid) */
2335 if (tlb
->prot
& PAGE_VALID
) {
2336 end
= tlb
->EPN
+ tlb
->size
;
2337 LOG_SWTLB("%s: invalidate old TLB %d start " TARGET_FMT_lx
" end "
2338 TARGET_FMT_lx
"\n", __func__
, (int)entry
, tlb
->EPN
, end
);
2339 for (page
= tlb
->EPN
; page
< end
; page
+= TARGET_PAGE_SIZE
) {
2340 tlb_flush_page(cs
, page
);
2343 tlb
->size
= booke_tlb_to_page_size((val
>> PPC4XX_TLBHI_SIZE_SHIFT
)
2344 & PPC4XX_TLBHI_SIZE_MASK
);
2345 /* We cannot handle TLB size < TARGET_PAGE_SIZE.
2346 * If this ever occurs, one should use the ppcemb target instead
2347 * of the ppc or ppc64 one
2349 if ((val
& PPC4XX_TLBHI_V
) && tlb
->size
< TARGET_PAGE_SIZE
) {
2350 cpu_abort(cs
, "TLB size " TARGET_FMT_lu
" < %u "
2351 "are not supported (%d)\n",
2352 tlb
->size
, TARGET_PAGE_SIZE
, (int)((val
>> 7) & 0x7));
2354 tlb
->EPN
= val
& ~(tlb
->size
- 1);
2355 if (val
& PPC4XX_TLBHI_V
) {
2356 tlb
->prot
|= PAGE_VALID
;
2357 if (val
& PPC4XX_TLBHI_E
) {
2358 /* XXX: TO BE FIXED */
2360 "Little-endian TLB entries are not supported by now\n");
2363 tlb
->prot
&= ~PAGE_VALID
;
2365 tlb
->PID
= env
->spr
[SPR_40x_PID
]; /* PID */
2366 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx
" EPN " TARGET_FMT_lx
2367 " size " TARGET_FMT_lx
" prot %c%c%c%c PID %d\n", __func__
,
2368 (int)entry
, tlb
->RPN
, tlb
->EPN
, tlb
->size
,
2369 tlb
->prot
& PAGE_READ
? 'r' : '-',
2370 tlb
->prot
& PAGE_WRITE
? 'w' : '-',
2371 tlb
->prot
& PAGE_EXEC
? 'x' : '-',
2372 tlb
->prot
& PAGE_VALID
? 'v' : '-', (int)tlb
->PID
);
2373 /* Invalidate new TLB (if valid) */
2374 if (tlb
->prot
& PAGE_VALID
) {
2375 end
= tlb
->EPN
+ tlb
->size
;
2376 LOG_SWTLB("%s: invalidate TLB %d start " TARGET_FMT_lx
" end "
2377 TARGET_FMT_lx
"\n", __func__
, (int)entry
, tlb
->EPN
, end
);
2378 for (page
= tlb
->EPN
; page
< end
; page
+= TARGET_PAGE_SIZE
) {
2379 tlb_flush_page(cs
, page
);
2384 void helper_4xx_tlbwe_lo(CPUPPCState
*env
, target_ulong entry
,
2389 LOG_SWTLB("%s entry %i val " TARGET_FMT_lx
"\n", __func__
, (int)entry
,
2391 entry
&= PPC4XX_TLB_ENTRY_MASK
;
2392 tlb
= &env
->tlb
.tlbe
[entry
];
2393 tlb
->attr
= val
& PPC4XX_TLBLO_ATTR_MASK
;
2394 tlb
->RPN
= val
& PPC4XX_TLBLO_RPN_MASK
;
2395 tlb
->prot
= PAGE_READ
;
2396 if (val
& PPC4XX_TLBLO_EX
) {
2397 tlb
->prot
|= PAGE_EXEC
;
2399 if (val
& PPC4XX_TLBLO_WR
) {
2400 tlb
->prot
|= PAGE_WRITE
;
2402 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx
" EPN " TARGET_FMT_lx
2403 " size " TARGET_FMT_lx
" prot %c%c%c%c PID %d\n", __func__
,
2404 (int)entry
, tlb
->RPN
, tlb
->EPN
, tlb
->size
,
2405 tlb
->prot
& PAGE_READ
? 'r' : '-',
2406 tlb
->prot
& PAGE_WRITE
? 'w' : '-',
2407 tlb
->prot
& PAGE_EXEC
? 'x' : '-',
2408 tlb
->prot
& PAGE_VALID
? 'v' : '-', (int)tlb
->PID
);
2411 target_ulong
helper_4xx_tlbsx(CPUPPCState
*env
, target_ulong address
)
2413 return ppcemb_tlb_search(env
, address
, env
->spr
[SPR_40x_PID
]);
2416 /* PowerPC 440 TLB management */
2417 void helper_440_tlbwe(CPUPPCState
*env
, uint32_t word
, target_ulong entry
,
2420 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
2422 target_ulong EPN
, RPN
, size
;
2425 LOG_SWTLB("%s word %d entry %d value " TARGET_FMT_lx
"\n",
2426 __func__
, word
, (int)entry
, value
);
2429 tlb
= &env
->tlb
.tlbe
[entry
];
2432 /* Just here to please gcc */
2434 EPN
= value
& 0xFFFFFC00;
2435 if ((tlb
->prot
& PAGE_VALID
) && EPN
!= tlb
->EPN
) {
2439 size
= booke_tlb_to_page_size((value
>> 4) & 0xF);
2440 if ((tlb
->prot
& PAGE_VALID
) && tlb
->size
< size
) {
2445 tlb
->attr
|= (value
>> 8) & 1;
2446 if (value
& 0x200) {
2447 tlb
->prot
|= PAGE_VALID
;
2449 if (tlb
->prot
& PAGE_VALID
) {
2450 tlb
->prot
&= ~PAGE_VALID
;
2454 tlb
->PID
= env
->spr
[SPR_440_MMUCR
] & 0x000000FF;
2455 if (do_flush_tlbs
) {
2456 tlb_flush(CPU(cpu
), 1);
2460 RPN
= value
& 0xFFFFFC0F;
2461 if ((tlb
->prot
& PAGE_VALID
) && tlb
->RPN
!= RPN
) {
2462 tlb_flush(CPU(cpu
), 1);
2467 tlb
->attr
= (tlb
->attr
& 0x1) | (value
& 0x0000FF00);
2468 tlb
->prot
= tlb
->prot
& PAGE_VALID
;
2470 tlb
->prot
|= PAGE_READ
<< 4;
2473 tlb
->prot
|= PAGE_WRITE
<< 4;
2476 tlb
->prot
|= PAGE_EXEC
<< 4;
2479 tlb
->prot
|= PAGE_READ
;
2482 tlb
->prot
|= PAGE_WRITE
;
2485 tlb
->prot
|= PAGE_EXEC
;
2491 target_ulong
helper_440_tlbre(CPUPPCState
*env
, uint32_t word
,
2499 tlb
= &env
->tlb
.tlbe
[entry
];
2502 /* Just here to please gcc */
2505 size
= booke_page_size_to_tlb(tlb
->size
);
2506 if (size
< 0 || size
> 0xF) {
2510 if (tlb
->attr
& 0x1) {
2513 if (tlb
->prot
& PAGE_VALID
) {
2516 env
->spr
[SPR_440_MMUCR
] &= ~0x000000FF;
2517 env
->spr
[SPR_440_MMUCR
] |= tlb
->PID
;
2523 ret
= tlb
->attr
& ~0x1;
2524 if (tlb
->prot
& (PAGE_READ
<< 4)) {
2527 if (tlb
->prot
& (PAGE_WRITE
<< 4)) {
2530 if (tlb
->prot
& (PAGE_EXEC
<< 4)) {
2533 if (tlb
->prot
& PAGE_READ
) {
2536 if (tlb
->prot
& PAGE_WRITE
) {
2539 if (tlb
->prot
& PAGE_EXEC
) {
2547 target_ulong
helper_440_tlbsx(CPUPPCState
*env
, target_ulong address
)
2549 return ppcemb_tlb_search(env
, address
, env
->spr
[SPR_440_MMUCR
] & 0xFF);
2552 /* PowerPC BookE 2.06 TLB management */
2554 static ppcmas_tlb_t
*booke206_cur_tlb(CPUPPCState
*env
)
2556 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
2557 uint32_t tlbncfg
= 0;
2558 int esel
= (env
->spr
[SPR_BOOKE_MAS0
] & MAS0_ESEL_MASK
) >> MAS0_ESEL_SHIFT
;
2559 int ea
= (env
->spr
[SPR_BOOKE_MAS2
] & MAS2_EPN_MASK
);
2562 tlb
= (env
->spr
[SPR_BOOKE_MAS0
] & MAS0_TLBSEL_MASK
) >> MAS0_TLBSEL_SHIFT
;
2563 tlbncfg
= env
->spr
[SPR_BOOKE_TLB0CFG
+ tlb
];
2565 if ((tlbncfg
& TLBnCFG_HES
) && (env
->spr
[SPR_BOOKE_MAS0
] & MAS0_HES
)) {
2566 cpu_abort(CPU(cpu
), "we don't support HES yet\n");
2569 return booke206_get_tlbm(env
, tlb
, ea
, esel
);
2572 void helper_booke_setpid(CPUPPCState
*env
, uint32_t pidn
, target_ulong pid
)
2574 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
2576 env
->spr
[pidn
] = pid
;
2577 /* changing PIDs mean we're in a different address space now */
2578 tlb_flush(CPU(cpu
), 1);
2581 void helper_booke206_tlbwe(CPUPPCState
*env
)
2583 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
2584 uint32_t tlbncfg
, tlbn
;
2586 uint32_t size_tlb
, size_ps
;
2590 switch (env
->spr
[SPR_BOOKE_MAS0
] & MAS0_WQ_MASK
) {
2591 case MAS0_WQ_ALWAYS
:
2592 /* good to go, write that entry */
2595 /* XXX check if reserved */
2600 case MAS0_WQ_CLR_RSRV
:
2601 /* XXX clear entry */
2604 /* no idea what to do */
2608 if (((env
->spr
[SPR_BOOKE_MAS0
] & MAS0_ATSEL
) == MAS0_ATSEL_LRAT
) &&
2610 /* XXX we don't support direct LRAT setting yet */
2611 fprintf(stderr
, "cpu: don't support LRAT setting yet\n");
2615 tlbn
= (env
->spr
[SPR_BOOKE_MAS0
] & MAS0_TLBSEL_MASK
) >> MAS0_TLBSEL_SHIFT
;
2616 tlbncfg
= env
->spr
[SPR_BOOKE_TLB0CFG
+ tlbn
];
2618 tlb
= booke206_cur_tlb(env
);
2621 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
2622 POWERPC_EXCP_INVAL
|
2623 POWERPC_EXCP_INVAL_INVAL
);
2626 /* check that we support the targeted size */
2627 size_tlb
= (env
->spr
[SPR_BOOKE_MAS1
] & MAS1_TSIZE_MASK
) >> MAS1_TSIZE_SHIFT
;
2628 size_ps
= booke206_tlbnps(env
, tlbn
);
2629 if ((env
->spr
[SPR_BOOKE_MAS1
] & MAS1_VALID
) && (tlbncfg
& TLBnCFG_AVAIL
) &&
2630 !(size_ps
& (1 << size_tlb
))) {
2631 helper_raise_exception_err(env
, POWERPC_EXCP_PROGRAM
,
2632 POWERPC_EXCP_INVAL
|
2633 POWERPC_EXCP_INVAL_INVAL
);
2637 cpu_abort(CPU(cpu
), "missing HV implementation\n");
2639 tlb
->mas7_3
= ((uint64_t)env
->spr
[SPR_BOOKE_MAS7
] << 32) |
2640 env
->spr
[SPR_BOOKE_MAS3
];
2641 tlb
->mas1
= env
->spr
[SPR_BOOKE_MAS1
];
2644 if (!(tlbncfg
& TLBnCFG_AVAIL
)) {
2645 /* force !AVAIL TLB entries to correct page size */
2646 tlb
->mas1
&= ~MAS1_TSIZE_MASK
;
2647 /* XXX can be configured in MMUCSR0 */
2648 tlb
->mas1
|= (tlbncfg
& TLBnCFG_MINSIZE
) >> 12;
2651 /* Make a mask from TLB size to discard invalid bits in EPN field */
2652 mask
= ~(booke206_tlb_to_page_size(env
, tlb
) - 1);
2653 /* Add a mask for page attributes */
2654 mask
|= MAS2_ACM
| MAS2_VLE
| MAS2_W
| MAS2_I
| MAS2_M
| MAS2_G
| MAS2_E
;
2657 /* Executing a tlbwe instruction in 32-bit mode will set
2658 * bits 0:31 of the TLB EPN field to zero.
2663 tlb
->mas2
= env
->spr
[SPR_BOOKE_MAS2
] & mask
;
2665 if (!(tlbncfg
& TLBnCFG_IPROT
)) {
2666 /* no IPROT supported by TLB */
2667 tlb
->mas1
&= ~MAS1_IPROT
;
2670 if (booke206_tlb_to_page_size(env
, tlb
) == TARGET_PAGE_SIZE
) {
2671 tlb_flush_page(CPU(cpu
), tlb
->mas2
& MAS2_EPN_MASK
);
2673 tlb_flush(CPU(cpu
), 1);
2677 static inline void booke206_tlb_to_mas(CPUPPCState
*env
, ppcmas_tlb_t
*tlb
)
2679 int tlbn
= booke206_tlbm_to_tlbn(env
, tlb
);
2680 int way
= booke206_tlbm_to_way(env
, tlb
);
2682 env
->spr
[SPR_BOOKE_MAS0
] = tlbn
<< MAS0_TLBSEL_SHIFT
;
2683 env
->spr
[SPR_BOOKE_MAS0
] |= way
<< MAS0_ESEL_SHIFT
;
2684 env
->spr
[SPR_BOOKE_MAS0
] |= env
->last_way
<< MAS0_NV_SHIFT
;
2686 env
->spr
[SPR_BOOKE_MAS1
] = tlb
->mas1
;
2687 env
->spr
[SPR_BOOKE_MAS2
] = tlb
->mas2
;
2688 env
->spr
[SPR_BOOKE_MAS3
] = tlb
->mas7_3
;
2689 env
->spr
[SPR_BOOKE_MAS7
] = tlb
->mas7_3
>> 32;
2692 void helper_booke206_tlbre(CPUPPCState
*env
)
2694 ppcmas_tlb_t
*tlb
= NULL
;
2696 tlb
= booke206_cur_tlb(env
);
2698 env
->spr
[SPR_BOOKE_MAS1
] = 0;
2700 booke206_tlb_to_mas(env
, tlb
);
2704 void helper_booke206_tlbsx(CPUPPCState
*env
, target_ulong address
)
2706 ppcmas_tlb_t
*tlb
= NULL
;
2711 spid
= (env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SPID_MASK
) >> MAS6_SPID_SHIFT
;
2712 sas
= env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SAS
;
2714 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
2715 int ways
= booke206_tlb_ways(env
, i
);
2717 for (j
= 0; j
< ways
; j
++) {
2718 tlb
= booke206_get_tlbm(env
, i
, address
, j
);
2724 if (ppcmas_tlb_check(env
, tlb
, &raddr
, address
, spid
)) {
2728 if (sas
!= ((tlb
->mas1
& MAS1_TS
) >> MAS1_TS_SHIFT
)) {
2732 booke206_tlb_to_mas(env
, tlb
);
2737 /* no entry found, fill with defaults */
2738 env
->spr
[SPR_BOOKE_MAS0
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_TLBSELD_MASK
;
2739 env
->spr
[SPR_BOOKE_MAS1
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_TSIZED_MASK
;
2740 env
->spr
[SPR_BOOKE_MAS2
] = env
->spr
[SPR_BOOKE_MAS4
] & MAS4_WIMGED_MASK
;
2741 env
->spr
[SPR_BOOKE_MAS3
] = 0;
2742 env
->spr
[SPR_BOOKE_MAS7
] = 0;
2744 if (env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SAS
) {
2745 env
->spr
[SPR_BOOKE_MAS1
] |= MAS1_TS
;
2748 env
->spr
[SPR_BOOKE_MAS1
] |= (env
->spr
[SPR_BOOKE_MAS6
] >> 16)
2751 /* next victim logic */
2752 env
->spr
[SPR_BOOKE_MAS0
] |= env
->last_way
<< MAS0_ESEL_SHIFT
;
2754 env
->last_way
&= booke206_tlb_ways(env
, 0) - 1;
2755 env
->spr
[SPR_BOOKE_MAS0
] |= env
->last_way
<< MAS0_NV_SHIFT
;
2758 static inline void booke206_invalidate_ea_tlb(CPUPPCState
*env
, int tlbn
,
2762 int ways
= booke206_tlb_ways(env
, tlbn
);
2765 for (i
= 0; i
< ways
; i
++) {
2766 ppcmas_tlb_t
*tlb
= booke206_get_tlbm(env
, tlbn
, ea
, i
);
2770 mask
= ~(booke206_tlb_to_page_size(env
, tlb
) - 1);
2771 if (((tlb
->mas2
& MAS2_EPN_MASK
) == (ea
& mask
)) &&
2772 !(tlb
->mas1
& MAS1_IPROT
)) {
2773 tlb
->mas1
&= ~MAS1_VALID
;
2778 void helper_booke206_tlbivax(CPUPPCState
*env
, target_ulong address
)
2780 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
2782 if (address
& 0x4) {
2783 /* flush all entries */
2784 if (address
& 0x8) {
2785 /* flush all of TLB1 */
2786 booke206_flush_tlb(env
, BOOKE206_FLUSH_TLB1
, 1);
2788 /* flush all of TLB0 */
2789 booke206_flush_tlb(env
, BOOKE206_FLUSH_TLB0
, 0);
2794 if (address
& 0x8) {
2795 /* flush TLB1 entries */
2796 booke206_invalidate_ea_tlb(env
, 1, address
);
2797 tlb_flush(CPU(cpu
), 1);
2799 /* flush TLB0 entries */
2800 booke206_invalidate_ea_tlb(env
, 0, address
);
2801 tlb_flush_page(CPU(cpu
), address
& MAS2_EPN_MASK
);
2805 void helper_booke206_tlbilx0(CPUPPCState
*env
, target_ulong address
)
2807 /* XXX missing LPID handling */
2808 booke206_flush_tlb(env
, -1, 1);
2811 void helper_booke206_tlbilx1(CPUPPCState
*env
, target_ulong address
)
2813 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
2815 int tid
= (env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SPID
);
2816 ppcmas_tlb_t
*tlb
= env
->tlb
.tlbm
;
2819 /* XXX missing LPID handling */
2820 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
2821 tlb_size
= booke206_tlb_size(env
, i
);
2822 for (j
= 0; j
< tlb_size
; j
++) {
2823 if (!(tlb
[j
].mas1
& MAS1_IPROT
) &&
2824 ((tlb
[j
].mas1
& MAS1_TID_MASK
) == tid
)) {
2825 tlb
[j
].mas1
&= ~MAS1_VALID
;
2828 tlb
+= booke206_tlb_size(env
, i
);
2830 tlb_flush(CPU(cpu
), 1);
2833 void helper_booke206_tlbilx3(CPUPPCState
*env
, target_ulong address
)
2835 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
2838 int tid
= (env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SPID
);
2839 int pid
= tid
>> MAS6_SPID_SHIFT
;
2840 int sgs
= env
->spr
[SPR_BOOKE_MAS5
] & MAS5_SGS
;
2841 int ind
= (env
->spr
[SPR_BOOKE_MAS6
] & MAS6_SIND
) ? MAS1_IND
: 0;
2842 /* XXX check for unsupported isize and raise an invalid opcode then */
2843 int size
= env
->spr
[SPR_BOOKE_MAS6
] & MAS6_ISIZE_MASK
;
2844 /* XXX implement MAV2 handling */
2847 /* XXX missing LPID handling */
2848 /* flush by pid and ea */
2849 for (i
= 0; i
< BOOKE206_MAX_TLBN
; i
++) {
2850 int ways
= booke206_tlb_ways(env
, i
);
2852 for (j
= 0; j
< ways
; j
++) {
2853 tlb
= booke206_get_tlbm(env
, i
, address
, j
);
2857 if ((ppcmas_tlb_check(env
, tlb
, NULL
, address
, pid
) != 0) ||
2858 (tlb
->mas1
& MAS1_IPROT
) ||
2859 ((tlb
->mas1
& MAS1_IND
) != ind
) ||
2860 ((tlb
->mas8
& MAS8_TGS
) != sgs
)) {
2863 if (mav2
&& ((tlb
->mas1
& MAS1_TSIZE_MASK
) != size
)) {
2864 /* XXX only check when MMUCFG[TWC] || TLBnCFG[HES] */
2867 /* XXX e500mc doesn't match SAS, but other cores might */
2868 tlb
->mas1
&= ~MAS1_VALID
;
2871 tlb_flush(CPU(cpu
), 1);
2874 void helper_booke206_tlbflush(CPUPPCState
*env
, target_ulong type
)
2879 flags
|= BOOKE206_FLUSH_TLB1
;
2883 flags
|= BOOKE206_FLUSH_TLB0
;
2886 booke206_flush_tlb(env
, flags
, 1);
2890 void helper_check_tlb_flush(CPUPPCState
*env
)
2892 check_tlb_flush(env
);
2895 /*****************************************************************************/
2897 /* try to fill the TLB and return an exception if error. If retaddr is
2898 NULL, it means that the function was called in C code (i.e. not
2899 from generated code or from helper.c) */
2900 /* XXX: fix it to restore all registers */
2901 void tlb_fill(CPUState
*cs
, target_ulong addr
, int is_write
, int mmu_idx
,
2904 PowerPCCPU
*cpu
= POWERPC_CPU(cs
);
2905 PowerPCCPUClass
*pcc
= POWERPC_CPU_GET_CLASS(cs
);
2906 CPUPPCState
*env
= &cpu
->env
;
2909 if (pcc
->handle_mmu_fault
) {
2910 ret
= pcc
->handle_mmu_fault(cpu
, addr
, is_write
, mmu_idx
);
2912 ret
= cpu_ppc_handle_mmu_fault(env
, addr
, is_write
, mmu_idx
);
2914 if (unlikely(ret
!= 0)) {
2915 if (likely(retaddr
)) {
2916 /* now we have a real cpu fault */
2917 cpu_restore_state(cs
, retaddr
);
2919 helper_raise_exception_err(env
, cs
->exception_index
, env
->error_code
);