?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ohci: split reset method in 3 parts
[qemu/ar7.git] / target-ppc / mmu_helper.c
blob52176916bab4abd720f24c35953a2c24bc1bb51e
1 /*
2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
3 *
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19 #include "cpu.h"
20 #include "exec/helper-proto.h"
21 #include "sysemu/kvm.h"
22 #include "kvm_ppc.h"
23 #include "mmu-hash64.h"
24 #include "mmu-hash32.h"
25 #include "exec/cpu_ldst.h"
26
27 //#define DEBUG_MMU
28 //#define DEBUG_BATS
29 //#define DEBUG_SOFTWARE_TLB
30 //#define DUMP_PAGE_TABLES
31 //#define FLUSH_ALL_TLBS
32
33 #ifdef DEBUG_MMU
34 # define LOG_MMU_STATE(cpu) log_cpu_state_mask(CPU_LOG_MMU, (cpu), 0)
35 #else
36 # define LOG_MMU_STATE(cpu) do { } while (0)
37 #endif
38
39 #ifdef DEBUG_SOFTWARE_TLB
40 # define LOG_SWTLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
41 #else
42 # define LOG_SWTLB(...) do { } while (0)
43 #endif
44
45 #ifdef DEBUG_BATS
46 # define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
47 #else
48 # define LOG_BATS(...) do { } while (0)
49 #endif
50
51 /*****************************************************************************/
52 /* PowerPC MMU emulation */
53
54 /* Context used internally during MMU translations */
55 typedef struct mmu_ctx_t mmu_ctx_t;
56 struct mmu_ctx_t {
57 hwaddr raddr; /* Real address */
58 hwaddr eaddr; /* Effective address */
59 int prot; /* Protection bits */
60 hwaddr hash[2]; /* Pagetable hash values */
61 target_ulong ptem; /* Virtual segment ID | API */
62 int key; /* Access key */
63 int nx; /* Non-execute area */
64 };
65
66 /* Common routines used by software and hardware TLBs emulation */
67 static inline int pte_is_valid(target_ulong pte0)
68 {
69 return pte0 & 0x80000000 ? 1 : 0;
70 }
71
72 static inline void pte_invalidate(target_ulong *pte0)
73 {
74 *pte0 &= ~0x80000000;
75 }
76
77 #define PTE_PTEM_MASK 0x7FFFFFBF
78 #define PTE_CHECK_MASK (TARGET_PAGE_MASK | 0x7B)
79
80 static int pp_check(int key, int pp, int nx)
81 {
82 int access;
83
84 /* Compute access rights */
85 access = 0;
86 if (key == 0) {
87 switch (pp) {
88 case 0x0:
89 case 0x1:
90 case 0x2:
91 access |= PAGE_WRITE;
92 /* No break here */
93 case 0x3:
94 access |= PAGE_READ;
95 break;
96 }
97 } else {
98 switch (pp) {
99 case 0x0:
100 access = 0;
101 break;
102 case 0x1:
103 case 0x3:
104 access = PAGE_READ;
105 break;
106 case 0x2:
107 access = PAGE_READ | PAGE_WRITE;
108 break;
109 }
110 }
111 if (nx == 0) {
112 access |= PAGE_EXEC;
113 }
114
115 return access;
116 }
117
118 static int check_prot(int prot, int rw, int access_type)
119 {
120 int ret;
121
122 if (access_type == ACCESS_CODE) {
123 if (prot & PAGE_EXEC) {
124 ret = 0;
125 } else {
126 ret = -2;
127 }
128 } else if (rw) {
129 if (prot & PAGE_WRITE) {
130 ret = 0;
131 } else {
132 ret = -2;
133 }
134 } else {
135 if (prot & PAGE_READ) {
136 ret = 0;
137 } else {
138 ret = -2;
139 }
140 }
141
142 return ret;
143 }
144
145 static inline int ppc6xx_tlb_pte_check(mmu_ctx_t *ctx, target_ulong pte0,
146 target_ulong pte1, int h, int rw, int type)
147 {
148 target_ulong ptem, mmask;
149 int access, ret, pteh, ptev, pp;
150
151 ret = -1;
152 /* Check validity and table match */
153 ptev = pte_is_valid(pte0);
154 pteh = (pte0 >> 6) & 1;
155 if (ptev && h == pteh) {
156 /* Check vsid & api */
157 ptem = pte0 & PTE_PTEM_MASK;
158 mmask = PTE_CHECK_MASK;
159 pp = pte1 & 0x00000003;
160 if (ptem == ctx->ptem) {
161 if (ctx->raddr != (hwaddr)-1ULL) {
162 /* all matches should have equal RPN, WIMG & PP */
163 if ((ctx->raddr & mmask) != (pte1 & mmask)) {
164 qemu_log_mask(CPU_LOG_MMU, "Bad RPN/WIMG/PP\n");
165 return -3;
166 }
167 }
168 /* Compute access rights */
169 access = pp_check(ctx->key, pp, ctx->nx);
170 /* Keep the matching PTE informations */
171 ctx->raddr = pte1;
172 ctx->prot = access;
173 ret = check_prot(ctx->prot, rw, type);
174 if (ret == 0) {
175 /* Access granted */
176 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
177 } else {
178 /* Access right violation */
179 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
180 }
181 }
182 }
183
184 return ret;
185 }
186
187 static int pte_update_flags(mmu_ctx_t *ctx, target_ulong *pte1p,
188 int ret, int rw)
189 {
190 int store = 0;
191
192 /* Update page flags */
193 if (!(*pte1p & 0x00000100)) {
194 /* Update accessed flag */
195 *pte1p |= 0x00000100;
196 store = 1;
197 }
198 if (!(*pte1p & 0x00000080)) {
199 if (rw == 1 && ret == 0) {
200 /* Update changed flag */
201 *pte1p |= 0x00000080;
202 store = 1;
203 } else {
204 /* Force page fault for first write access */
205 ctx->prot &= ~PAGE_WRITE;
206 }
207 }
208
209 return store;
210 }
211
212 /* Software driven TLB helpers */
213 static inline int ppc6xx_tlb_getnum(CPUPPCState *env, target_ulong eaddr,
214 int way, int is_code)
215 {
216 int nr;
217
218 /* Select TLB num in a way from address */
219 nr = (eaddr >> TARGET_PAGE_BITS) & (env->tlb_per_way - 1);
220 /* Select TLB way */
221 nr += env->tlb_per_way * way;
222 /* 6xx have separate TLBs for instructions and data */
223 if (is_code && env->id_tlbs == 1) {
224 nr += env->nb_tlb;
225 }
226
227 return nr;
228 }
229
230 static inline void ppc6xx_tlb_invalidate_all(CPUPPCState *env)
231 {
232 PowerPCCPU *cpu = ppc_env_get_cpu(env);
233 ppc6xx_tlb_t *tlb;
234 int nr, max;
235
236 /* LOG_SWTLB("Invalidate all TLBs\n"); */
237 /* Invalidate all defined software TLB */
238 max = env->nb_tlb;
239 if (env->id_tlbs == 1) {
240 max *= 2;
241 }
242 for (nr = 0; nr < max; nr++) {
243 tlb = &env->tlb.tlb6[nr];
244 pte_invalidate(&tlb->pte0);
245 }
246 tlb_flush(CPU(cpu), 1);
247 }
248
249 static inline void ppc6xx_tlb_invalidate_virt2(CPUPPCState *env,
250 target_ulong eaddr,
251 int is_code, int match_epn)
252 {
253 #if !defined(FLUSH_ALL_TLBS)
254 CPUState *cs = CPU(ppc_env_get_cpu(env));
255 ppc6xx_tlb_t *tlb;
256 int way, nr;
257
258 /* Invalidate ITLB + DTLB, all ways */
259 for (way = 0; way < env->nb_ways; way++) {
260 nr = ppc6xx_tlb_getnum(env, eaddr, way, is_code);
261 tlb = &env->tlb.tlb6[nr];
262 if (pte_is_valid(tlb->pte0) && (match_epn == 0 || eaddr == tlb->EPN)) {
263 LOG_SWTLB("TLB invalidate %d/%d " TARGET_FMT_lx "\n", nr,
264 env->nb_tlb, eaddr);
265 pte_invalidate(&tlb->pte0);
266 tlb_flush_page(cs, tlb->EPN);
267 }
268 }
269 #else
270 /* XXX: PowerPC specification say this is valid as well */
271 ppc6xx_tlb_invalidate_all(env);
272 #endif
273 }
274
275 static inline void ppc6xx_tlb_invalidate_virt(CPUPPCState *env,
276 target_ulong eaddr, int is_code)
277 {
278 ppc6xx_tlb_invalidate_virt2(env, eaddr, is_code, 0);
279 }
280
281 static void ppc6xx_tlb_store(CPUPPCState *env, target_ulong EPN, int way,
282 int is_code, target_ulong pte0, target_ulong pte1)
283 {
284 ppc6xx_tlb_t *tlb;
285 int nr;
286
287 nr = ppc6xx_tlb_getnum(env, EPN, way, is_code);
288 tlb = &env->tlb.tlb6[nr];
289 LOG_SWTLB("Set TLB %d/%d EPN " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
290 " PTE1 " TARGET_FMT_lx "\n", nr, env->nb_tlb, EPN, pte0, pte1);
291 /* Invalidate any pending reference in QEMU for this virtual address */
292 ppc6xx_tlb_invalidate_virt2(env, EPN, is_code, 1);
293 tlb->pte0 = pte0;
294 tlb->pte1 = pte1;
295 tlb->EPN = EPN;
296 /* Store last way for LRU mechanism */
297 env->last_way = way;
298 }
299
300 static inline int ppc6xx_tlb_check(CPUPPCState *env, mmu_ctx_t *ctx,
301 target_ulong eaddr, int rw, int access_type)
302 {
303 ppc6xx_tlb_t *tlb;
304 int nr, best, way;
305 int ret;
306
307 best = -1;
308 ret = -1; /* No TLB found */
309 for (way = 0; way < env->nb_ways; way++) {
310 nr = ppc6xx_tlb_getnum(env, eaddr, way,
311 access_type == ACCESS_CODE ? 1 : 0);
312 tlb = &env->tlb.tlb6[nr];
313 /* This test "emulates" the PTE index match for hardware TLBs */
314 if ((eaddr & TARGET_PAGE_MASK) != tlb->EPN) {
315 LOG_SWTLB("TLB %d/%d %s [" TARGET_FMT_lx " " TARGET_FMT_lx
316 "] <> " TARGET_FMT_lx "\n", nr, env->nb_tlb,
317 pte_is_valid(tlb->pte0) ? "valid" : "inval",
318 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE, eaddr);
319 continue;
320 }
321 LOG_SWTLB("TLB %d/%d %s " TARGET_FMT_lx " <> " TARGET_FMT_lx " "
322 TARGET_FMT_lx " %c %c\n", nr, env->nb_tlb,
323 pte_is_valid(tlb->pte0) ? "valid" : "inval",
324 tlb->EPN, eaddr, tlb->pte1,
325 rw ? 'S' : 'L', access_type == ACCESS_CODE ? 'I' : 'D');
326 switch (ppc6xx_tlb_pte_check(ctx, tlb->pte0, tlb->pte1, 0, rw, access_type)) {
327 case -3:
328 /* TLB inconsistency */
329 return -1;
330 case -2:
331 /* Access violation */
332 ret = -2;
333 best = nr;
334 break;
335 case -1:
336 default:
337 /* No match */
338 break;
339 case 0:
340 /* access granted */
341 /* XXX: we should go on looping to check all TLBs consistency
342 * but we can speed-up the whole thing as the
343 * result would be undefined if TLBs are not consistent.
344 */
345 ret = 0;
346 best = nr;
347 goto done;
348 }
349 }
350 if (best != -1) {
351 done:
352 LOG_SWTLB("found TLB at addr " TARGET_FMT_plx " prot=%01x ret=%d\n",
353 ctx->raddr & TARGET_PAGE_MASK, ctx->prot, ret);
354 /* Update page flags */
355 pte_update_flags(ctx, &env->tlb.tlb6[best].pte1, ret, rw);
356 }
357
358 return ret;
359 }
360
361 /* Perform BAT hit & translation */
362 static inline void bat_size_prot(CPUPPCState *env, target_ulong *blp,
363 int *validp, int *protp, target_ulong *BATu,
364 target_ulong *BATl)
365 {
366 target_ulong bl;
367 int pp, valid, prot;
368
369 bl = (*BATu & 0x00001FFC) << 15;
370 valid = 0;
371 prot = 0;
372 if (((msr_pr == 0) && (*BATu & 0x00000002)) ||
373 ((msr_pr != 0) && (*BATu & 0x00000001))) {
374 valid = 1;
375 pp = *BATl & 0x00000003;
376 if (pp != 0) {
377 prot = PAGE_READ | PAGE_EXEC;
378 if (pp == 0x2) {
379 prot |= PAGE_WRITE;
380 }
381 }
382 }
383 *blp = bl;
384 *validp = valid;
385 *protp = prot;
386 }
387
388 static int get_bat_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx,
389 target_ulong virtual, int rw, int type)
390 {
391 target_ulong *BATlt, *BATut, *BATu, *BATl;
392 target_ulong BEPIl, BEPIu, bl;
393 int i, valid, prot;
394 int ret = -1;
395
396 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
397 type == ACCESS_CODE ? 'I' : 'D', virtual);
398 switch (type) {
399 case ACCESS_CODE:
400 BATlt = env->IBAT[1];
401 BATut = env->IBAT[0];
402 break;
403 default:
404 BATlt = env->DBAT[1];
405 BATut = env->DBAT[0];
406 break;
407 }
408 for (i = 0; i < env->nb_BATs; i++) {
409 BATu = &BATut[i];
410 BATl = &BATlt[i];
411 BEPIu = *BATu & 0xF0000000;
412 BEPIl = *BATu & 0x0FFE0000;
413 bat_size_prot(env, &bl, &valid, &prot, BATu, BATl);
414 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
415 " BATl " TARGET_FMT_lx "\n", __func__,
416 type == ACCESS_CODE ? 'I' : 'D', i, virtual, *BATu, *BATl);
417 if ((virtual & 0xF0000000) == BEPIu &&
418 ((virtual & 0x0FFE0000) & ~bl) == BEPIl) {
419 /* BAT matches */
420 if (valid != 0) {
421 /* Get physical address */
422 ctx->raddr = (*BATl & 0xF0000000) |
423 ((virtual & 0x0FFE0000 & bl) | (*BATl & 0x0FFE0000)) |
424 (virtual & 0x0001F000);
425 /* Compute access rights */
426 ctx->prot = prot;
427 ret = check_prot(ctx->prot, rw, type);
428 if (ret == 0) {
429 LOG_BATS("BAT %d match: r " TARGET_FMT_plx " prot=%c%c\n",
430 i, ctx->raddr, ctx->prot & PAGE_READ ? 'R' : '-',
431 ctx->prot & PAGE_WRITE ? 'W' : '-');
432 }
433 break;
434 }
435 }
436 }
437 if (ret < 0) {
438 #if defined(DEBUG_BATS)
439 if (qemu_log_enabled()) {
440 LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", virtual);
441 for (i = 0; i < 4; i++) {
442 BATu = &BATut[i];
443 BATl = &BATlt[i];
444 BEPIu = *BATu & 0xF0000000;
445 BEPIl = *BATu & 0x0FFE0000;
446 bl = (*BATu & 0x00001FFC) << 15;
447 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
448 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
449 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
450 __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual,
451 *BATu, *BATl, BEPIu, BEPIl, bl);
452 }
453 }
454 #endif
455 }
456 /* No hit */
457 return ret;
458 }
459
460 /* Perform segment based translation */
461 static inline int get_segment_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx,
462 target_ulong eaddr, int rw, int type)
463 {
464 hwaddr hash;
465 target_ulong vsid;
466 int ds, pr, target_page_bits;
467 int ret;
468 target_ulong sr, pgidx;
469
470 pr = msr_pr;
471 ctx->eaddr = eaddr;
472
473 sr = env->sr[eaddr >> 28];
474 ctx->key = (((sr & 0x20000000) && (pr != 0)) ||
475 ((sr & 0x40000000) && (pr == 0))) ? 1 : 0;
476 ds = sr & 0x80000000 ? 1 : 0;
477 ctx->nx = sr & 0x10000000 ? 1 : 0;
478 vsid = sr & 0x00FFFFFF;
479 target_page_bits = TARGET_PAGE_BITS;
480 qemu_log_mask(CPU_LOG_MMU,
481 "Check segment v=" TARGET_FMT_lx " %d " TARGET_FMT_lx
482 " nip=" TARGET_FMT_lx " lr=" TARGET_FMT_lx
483 " ir=%d dr=%d pr=%d %d t=%d\n",
484 eaddr, (int)(eaddr >> 28), sr, env->nip, env->lr, (int)msr_ir,
485 (int)msr_dr, pr != 0 ? 1 : 0, rw, type);
486 pgidx = (eaddr & ~SEGMENT_MASK_256M) >> target_page_bits;
487 hash = vsid ^ pgidx;
488 ctx->ptem = (vsid << 7) | (pgidx >> 10);
489
490 qemu_log_mask(CPU_LOG_MMU,
491 "pte segment: key=%d ds %d nx %d vsid " TARGET_FMT_lx "\n",
492 ctx->key, ds, ctx->nx, vsid);
493 ret = -1;
494 if (!ds) {
495 /* Check if instruction fetch is allowed, if needed */
496 if (type != ACCESS_CODE || ctx->nx == 0) {
497 /* Page address translation */
498 qemu_log_mask(CPU_LOG_MMU, "htab_base " TARGET_FMT_plx
499 " htab_mask " TARGET_FMT_plx
500 " hash " TARGET_FMT_plx "\n",
501 env->htab_base, env->htab_mask, hash);
502 ctx->hash[0] = hash;
503 ctx->hash[1] = ~hash;
504
505 /* Initialize real address with an invalid value */
506 ctx->raddr = (hwaddr)-1ULL;
507 /* Software TLB search */
508 ret = ppc6xx_tlb_check(env, ctx, eaddr, rw, type);
509 #if defined(DUMP_PAGE_TABLES)
510 if (qemu_log_mask(CPU_LOG_MMU)) {
511 hwaddr curaddr;
512 uint32_t a0, a1, a2, a3;
513
514 qemu_log("Page table: " TARGET_FMT_plx " len " TARGET_FMT_plx
515 "\n", sdr, mask + 0x80);
516 for (curaddr = sdr; curaddr < (sdr + mask + 0x80);
517 curaddr += 16) {
518 a0 = ldl_phys(curaddr);
519 a1 = ldl_phys(curaddr + 4);
520 a2 = ldl_phys(curaddr + 8);
521 a3 = ldl_phys(curaddr + 12);
522 if (a0 != 0 || a1 != 0 || a2 != 0 || a3 != 0) {
523 qemu_log(TARGET_FMT_plx ": %08x %08x %08x %08x\n",
524 curaddr, a0, a1, a2, a3);
525 }
526 }
527 }
528 #endif
529 } else {
530 qemu_log_mask(CPU_LOG_MMU, "No access allowed\n");
531 ret = -3;
532 }
533 } else {
534 target_ulong sr;
535
536 qemu_log_mask(CPU_LOG_MMU, "direct store...\n");
537 /* Direct-store segment : absolutely *BUGGY* for now */
538
539 /* Direct-store implies a 32-bit MMU.
540 * Check the Segment Register's bus unit ID (BUID).
541 */
542 sr = env->sr[eaddr >> 28];
543 if ((sr & 0x1FF00000) >> 20 == 0x07f) {
544 /* Memory-forced I/O controller interface access */
545 /* If T=1 and BUID=x'07F', the 601 performs a memory access
546 * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
547 */
548 ctx->raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
549 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
550 return 0;
551 }
552
553 switch (type) {
554 case ACCESS_INT:
555 /* Integer load/store : only access allowed */
556 break;
557 case ACCESS_CODE:
558 /* No code fetch is allowed in direct-store areas */
559 return -4;
560 case ACCESS_FLOAT:
561 /* Floating point load/store */
562 return -4;
563 case ACCESS_RES:
564 /* lwarx, ldarx or srwcx. */
565 return -4;
566 case ACCESS_CACHE:
567 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
568 /* Should make the instruction do no-op.
569 * As it already do no-op, it's quite easy :-)
570 */
571 ctx->raddr = eaddr;
572 return 0;
573 case ACCESS_EXT:
574 /* eciwx or ecowx */
575 return -4;
576 default:
577 qemu_log_mask(CPU_LOG_MMU, "ERROR: instruction should not need "
578 "address translation\n");
579 return -4;
580 }
581 if ((rw == 1 || ctx->key != 1) && (rw == 0 || ctx->key != 0)) {
582 ctx->raddr = eaddr;
583 ret = 2;
584 } else {
585 ret = -2;
586 }
587 }
588
589 return ret;
590 }
591
592 /* Generic TLB check function for embedded PowerPC implementations */
593 static int ppcemb_tlb_check(CPUPPCState *env, ppcemb_tlb_t *tlb,
594 hwaddr *raddrp,
595 target_ulong address, uint32_t pid, int ext,
596 int i)
597 {
598 target_ulong mask;
599
600 /* Check valid flag */
601 if (!(tlb->prot & PAGE_VALID)) {
602 return -1;
603 }
604 mask = ~(tlb->size - 1);
605 LOG_SWTLB("%s: TLB %d address " TARGET_FMT_lx " PID %u <=> " TARGET_FMT_lx
606 " " TARGET_FMT_lx " %u %x\n", __func__, i, address, pid, tlb->EPN,
607 mask, (uint32_t)tlb->PID, tlb->prot);
608 /* Check PID */
609 if (tlb->PID != 0 && tlb->PID != pid) {
610 return -1;
611 }
612 /* Check effective address */
613 if ((address & mask) != tlb->EPN) {
614 return -1;
615 }
616 *raddrp = (tlb->RPN & mask) | (address & ~mask);
617 if (ext) {
618 /* Extend the physical address to 36 bits */
619 *raddrp |= (uint64_t)(tlb->RPN & 0xF) << 32;
620 }
621
622 return 0;
623 }
624
625 /* Generic TLB search function for PowerPC embedded implementations */
626 static int ppcemb_tlb_search(CPUPPCState *env, target_ulong address,
627 uint32_t pid)
628 {
629 ppcemb_tlb_t *tlb;
630 hwaddr raddr;
631 int i, ret;
632
633 /* Default return value is no match */
634 ret = -1;
635 for (i = 0; i < env->nb_tlb; i++) {
636 tlb = &env->tlb.tlbe[i];
637 if (ppcemb_tlb_check(env, tlb, &raddr, address, pid, 0, i) == 0) {
638 ret = i;
639 break;
640 }
641 }
642
643 return ret;
644 }
645
646 /* Helpers specific to PowerPC 40x implementations */
647 static inline void ppc4xx_tlb_invalidate_all(CPUPPCState *env)
648 {
649 PowerPCCPU *cpu = ppc_env_get_cpu(env);
650 ppcemb_tlb_t *tlb;
651 int i;
652
653 for (i = 0; i < env->nb_tlb; i++) {
654 tlb = &env->tlb.tlbe[i];
655 tlb->prot &= ~PAGE_VALID;
656 }
657 tlb_flush(CPU(cpu), 1);
658 }
659
660 static inline void ppc4xx_tlb_invalidate_virt(CPUPPCState *env,
661 target_ulong eaddr, uint32_t pid)
662 {
663 #if !defined(FLUSH_ALL_TLBS)
664 CPUState *cs = CPU(ppc_env_get_cpu(env));
665 ppcemb_tlb_t *tlb;
666 hwaddr raddr;
667 target_ulong page, end;
668 int i;
669
670 for (i = 0; i < env->nb_tlb; i++) {
671 tlb = &env->tlb.tlbe[i];
672 if (ppcemb_tlb_check(env, tlb, &raddr, eaddr, pid, 0, i) == 0) {
673 end = tlb->EPN + tlb->size;
674 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
675 tlb_flush_page(cs, page);
676 }
677 tlb->prot &= ~PAGE_VALID;
678 break;
679 }
680 }
681 #else
682 ppc4xx_tlb_invalidate_all(env);
683 #endif
684 }
685
686 static int mmu40x_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
687 target_ulong address, int rw,
688 int access_type)
689 {
690 ppcemb_tlb_t *tlb;
691 hwaddr raddr;
692 int i, ret, zsel, zpr, pr;
693
694 ret = -1;
695 raddr = (hwaddr)-1ULL;
696 pr = msr_pr;
697 for (i = 0; i < env->nb_tlb; i++) {
698 tlb = &env->tlb.tlbe[i];
699 if (ppcemb_tlb_check(env, tlb, &raddr, address,
700 env->spr[SPR_40x_PID], 0, i) < 0) {
701 continue;
702 }
703 zsel = (tlb->attr >> 4) & 0xF;
704 zpr = (env->spr[SPR_40x_ZPR] >> (30 - (2 * zsel))) & 0x3;
705 LOG_SWTLB("%s: TLB %d zsel %d zpr %d rw %d attr %08x\n",
706 __func__, i, zsel, zpr, rw, tlb->attr);
707 /* Check execute enable bit */
708 switch (zpr) {
709 case 0x2:
710 if (pr != 0) {
711 goto check_perms;
712 }
713 /* No break here */
714 case 0x3:
715 /* All accesses granted */
716 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
717 ret = 0;
718 break;
719 case 0x0:
720 if (pr != 0) {
721 /* Raise Zone protection fault. */
722 env->spr[SPR_40x_ESR] = 1 << 22;
723 ctx->prot = 0;
724 ret = -2;
725 break;
726 }
727 /* No break here */
728 case 0x1:
729 check_perms:
730 /* Check from TLB entry */
731 ctx->prot = tlb->prot;
732 ret = check_prot(ctx->prot, rw, access_type);
733 if (ret == -2) {
734 env->spr[SPR_40x_ESR] = 0;
735 }
736 break;
737 }
738 if (ret >= 0) {
739 ctx->raddr = raddr;
740 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
741 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
742 ret);
743 return 0;
744 }
745 }
746 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
747 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
748
749 return ret;
750 }
751
752 void store_40x_sler(CPUPPCState *env, uint32_t val)
753 {
754 PowerPCCPU *cpu = ppc_env_get_cpu(env);
755
756 /* XXX: TO BE FIXED */
757 if (val != 0x00000000) {
758 cpu_abort(CPU(cpu), "Little-endian regions are not supported by now\n");
759 }
760 env->spr[SPR_405_SLER] = val;
761 }
762
763 static inline int mmubooke_check_tlb(CPUPPCState *env, ppcemb_tlb_t *tlb,
764 hwaddr *raddr, int *prot,
765 target_ulong address, int rw,
766 int access_type, int i)
767 {
768 int ret, prot2;
769
770 if (ppcemb_tlb_check(env, tlb, raddr, address,
771 env->spr[SPR_BOOKE_PID],
772 !env->nb_pids, i) >= 0) {
773 goto found_tlb;
774 }
775
776 if (env->spr[SPR_BOOKE_PID1] &&
777 ppcemb_tlb_check(env, tlb, raddr, address,
778 env->spr[SPR_BOOKE_PID1], 0, i) >= 0) {
779 goto found_tlb;
780 }
781
782 if (env->spr[SPR_BOOKE_PID2] &&
783 ppcemb_tlb_check(env, tlb, raddr, address,
784 env->spr[SPR_BOOKE_PID2], 0, i) >= 0) {
785 goto found_tlb;
786 }
787
788 LOG_SWTLB("%s: TLB entry not found\n", __func__);
789 return -1;
790
791 found_tlb:
792
793 if (msr_pr != 0) {
794 prot2 = tlb->prot & 0xF;
795 } else {
796 prot2 = (tlb->prot >> 4) & 0xF;
797 }
798
799 /* Check the address space */
800 if (access_type == ACCESS_CODE) {
801 if (msr_ir != (tlb->attr & 1)) {
802 LOG_SWTLB("%s: AS doesn't match\n", __func__);
803 return -1;
804 }
805
806 *prot = prot2;
807 if (prot2 & PAGE_EXEC) {
808 LOG_SWTLB("%s: good TLB!\n", __func__);
809 return 0;
810 }
811
812 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
813 ret = -3;
814 } else {
815 if (msr_dr != (tlb->attr & 1)) {
816 LOG_SWTLB("%s: AS doesn't match\n", __func__);
817 return -1;
818 }
819
820 *prot = prot2;
821 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
822 LOG_SWTLB("%s: found TLB!\n", __func__);
823 return 0;
824 }
825
826 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
827 ret = -2;
828 }
829
830 return ret;
831 }
832
833 static int mmubooke_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
834 target_ulong address, int rw,
835 int access_type)
836 {
837 ppcemb_tlb_t *tlb;
838 hwaddr raddr;
839 int i, ret;
840
841 ret = -1;
842 raddr = (hwaddr)-1ULL;
843 for (i = 0; i < env->nb_tlb; i++) {
844 tlb = &env->tlb.tlbe[i];
845 ret = mmubooke_check_tlb(env, tlb, &raddr, &ctx->prot, address, rw,
846 access_type, i);
847 if (!ret) {
848 break;
849 }
850 }
851
852 if (ret >= 0) {
853 ctx->raddr = raddr;
854 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
855 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
856 ret);
857 } else {
858 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
859 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
860 }
861
862 return ret;
863 }
864
865 static void booke206_flush_tlb(CPUPPCState *env, int flags,
866 const int check_iprot)
867 {
868 PowerPCCPU *cpu = ppc_env_get_cpu(env);
869 int tlb_size;
870 int i, j;
871 ppcmas_tlb_t *tlb = env->tlb.tlbm;
872
873 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
874 if (flags & (1 << i)) {
875 tlb_size = booke206_tlb_size(env, i);
876 for (j = 0; j < tlb_size; j++) {
877 if (!check_iprot || !(tlb[j].mas1 & MAS1_IPROT)) {
878 tlb[j].mas1 &= ~MAS1_VALID;
879 }
880 }
881 }
882 tlb += booke206_tlb_size(env, i);
883 }
884
885 tlb_flush(CPU(cpu), 1);
886 }
887
888 static hwaddr booke206_tlb_to_page_size(CPUPPCState *env,
889 ppcmas_tlb_t *tlb)
890 {
891 int tlbm_size;
892
893 tlbm_size = (tlb->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
894
895 return 1024ULL << tlbm_size;
896 }
897
898 /* TLB check function for MAS based SoftTLBs */
899 static int ppcmas_tlb_check(CPUPPCState *env, ppcmas_tlb_t *tlb,
900 hwaddr *raddrp, target_ulong address,
901 uint32_t pid)
902 {
903 hwaddr mask;
904 uint32_t tlb_pid;
905
906 if (!msr_cm) {
907 /* In 32bit mode we can only address 32bit EAs */
908 address = (uint32_t)address;
909 }
910
911 /* Check valid flag */
912 if (!(tlb->mas1 & MAS1_VALID)) {
913 return -1;
914 }
915
916 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
917 LOG_SWTLB("%s: TLB ADDR=0x" TARGET_FMT_lx " PID=0x%x MAS1=0x%x MAS2=0x%"
918 PRIx64 " mask=0x" TARGET_FMT_lx " MAS7_3=0x%" PRIx64 " MAS8=%x\n",
919 __func__, address, pid, tlb->mas1, tlb->mas2, mask, tlb->mas7_3,
920 tlb->mas8);
921
922 /* Check PID */
923 tlb_pid = (tlb->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT;
924 if (tlb_pid != 0 && tlb_pid != pid) {
925 return -1;
926 }
927
928 /* Check effective address */
929 if ((address & mask) != (tlb->mas2 & MAS2_EPN_MASK)) {
930 return -1;
931 }
932
933 if (raddrp) {
934 *raddrp = (tlb->mas7_3 & mask) | (address & ~mask);
935 }
936
937 return 0;
938 }
939
940 static int mmubooke206_check_tlb(CPUPPCState *env, ppcmas_tlb_t *tlb,
941 hwaddr *raddr, int *prot,
942 target_ulong address, int rw,
943 int access_type)
944 {
945 int ret;
946 int prot2 = 0;
947
948 if (ppcmas_tlb_check(env, tlb, raddr, address,
949 env->spr[SPR_BOOKE_PID]) >= 0) {
950 goto found_tlb;
951 }
952
953 if (env->spr[SPR_BOOKE_PID1] &&
954 ppcmas_tlb_check(env, tlb, raddr, address,
955 env->spr[SPR_BOOKE_PID1]) >= 0) {
956 goto found_tlb;
957 }
958
959 if (env->spr[SPR_BOOKE_PID2] &&
960 ppcmas_tlb_check(env, tlb, raddr, address,
961 env->spr[SPR_BOOKE_PID2]) >= 0) {
962 goto found_tlb;
963 }
964
965 LOG_SWTLB("%s: TLB entry not found\n", __func__);
966 return -1;
967
968 found_tlb:
969
970 if (msr_pr != 0) {
971 if (tlb->mas7_3 & MAS3_UR) {
972 prot2 |= PAGE_READ;
973 }
974 if (tlb->mas7_3 & MAS3_UW) {
975 prot2 |= PAGE_WRITE;
976 }
977 if (tlb->mas7_3 & MAS3_UX) {
978 prot2 |= PAGE_EXEC;
979 }
980 } else {
981 if (tlb->mas7_3 & MAS3_SR) {
982 prot2 |= PAGE_READ;
983 }
984 if (tlb->mas7_3 & MAS3_SW) {
985 prot2 |= PAGE_WRITE;
986 }
987 if (tlb->mas7_3 & MAS3_SX) {
988 prot2 |= PAGE_EXEC;
989 }
990 }
991
992 /* Check the address space and permissions */
993 if (access_type == ACCESS_CODE) {
994 if (msr_ir != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
995 LOG_SWTLB("%s: AS doesn't match\n", __func__);
996 return -1;
997 }
998
999 *prot = prot2;
1000 if (prot2 & PAGE_EXEC) {
1001 LOG_SWTLB("%s: good TLB!\n", __func__);
1002 return 0;
1003 }
1004
1005 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
1006 ret = -3;
1007 } else {
1008 if (msr_dr != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
1009 LOG_SWTLB("%s: AS doesn't match\n", __func__);
1010 return -1;
1011 }
1012
1013 *prot = prot2;
1014 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
1015 LOG_SWTLB("%s: found TLB!\n", __func__);
1016 return 0;
1017 }
1018
1019 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
1020 ret = -2;
1021 }
1022
1023 return ret;
1024 }
1025
1026 static int mmubooke206_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1027 target_ulong address, int rw,
1028 int access_type)
1029 {
1030 ppcmas_tlb_t *tlb;
1031 hwaddr raddr;
1032 int i, j, ret;
1033
1034 ret = -1;
1035 raddr = (hwaddr)-1ULL;
1036
1037 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1038 int ways = booke206_tlb_ways(env, i);
1039
1040 for (j = 0; j < ways; j++) {
1041 tlb = booke206_get_tlbm(env, i, address, j);
1042 if (!tlb) {
1043 continue;
1044 }
1045 ret = mmubooke206_check_tlb(env, tlb, &raddr, &ctx->prot, address,
1046 rw, access_type);
1047 if (ret != -1) {
1048 goto found_tlb;
1049 }
1050 }
1051 }
1052
1053 found_tlb:
1054
1055 if (ret >= 0) {
1056 ctx->raddr = raddr;
1057 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
1058 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
1059 ret);
1060 } else {
1061 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
1062 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
1063 }
1064
1065 return ret;
1066 }
1067
1068 static const char *book3e_tsize_to_str[32] = {
1069 "1K", "2K", "4K", "8K", "16K", "32K", "64K", "128K", "256K", "512K",
1070 "1M", "2M", "4M", "8M", "16M", "32M", "64M", "128M", "256M", "512M",
1071 "1G", "2G", "4G", "8G", "16G", "32G", "64G", "128G", "256G", "512G",
1072 "1T", "2T"
1073 };
1074
1075 static void mmubooke_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1076 CPUPPCState *env)
1077 {
1078 ppcemb_tlb_t *entry;
1079 int i;
1080
1081 if (kvm_enabled() && !env->kvm_sw_tlb) {
1082 cpu_fprintf(f, "Cannot access KVM TLB\n");
1083 return;
1084 }
1085
1086 cpu_fprintf(f, "\nTLB:\n");
1087 cpu_fprintf(f, "Effective Physical Size PID Prot "
1088 "Attr\n");
1089
1090 entry = &env->tlb.tlbe[0];
1091 for (i = 0; i < env->nb_tlb; i++, entry++) {
1092 hwaddr ea, pa;
1093 target_ulong mask;
1094 uint64_t size = (uint64_t)entry->size;
1095 char size_buf[20];
1096
1097 /* Check valid flag */
1098 if (!(entry->prot & PAGE_VALID)) {
1099 continue;
1100 }
1101
1102 mask = ~(entry->size - 1);
1103 ea = entry->EPN & mask;
1104 pa = entry->RPN & mask;
1105 /* Extend the physical address to 36 bits */
1106 pa |= (hwaddr)(entry->RPN & 0xF) << 32;
1107 size /= 1024;
1108 if (size >= 1024) {
1109 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "M", size / 1024);
1110 } else {
1111 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "k", size);
1112 }
1113 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %s %-5u %08x %08x\n",
1114 (uint64_t)ea, (uint64_t)pa, size_buf, (uint32_t)entry->PID,
1115 entry->prot, entry->attr);
1116 }
1117
1118 }
1119
1120 static void mmubooke206_dump_one_tlb(FILE *f, fprintf_function cpu_fprintf,
1121 CPUPPCState *env, int tlbn, int offset,
1122 int tlbsize)
1123 {
1124 ppcmas_tlb_t *entry;
1125 int i;
1126
1127 cpu_fprintf(f, "\nTLB%d:\n", tlbn);
1128 cpu_fprintf(f, "Effective Physical Size TID TS SRWX"
1129 " URWX WIMGE U0123\n");
1130
1131 entry = &env->tlb.tlbm[offset];
1132 for (i = 0; i < tlbsize; i++, entry++) {
1133 hwaddr ea, pa, size;
1134 int tsize;
1135
1136 if (!(entry->mas1 & MAS1_VALID)) {
1137 continue;
1138 }
1139
1140 tsize = (entry->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
1141 size = 1024ULL << tsize;
1142 ea = entry->mas2 & ~(size - 1);
1143 pa = entry->mas7_3 & ~(size - 1);
1144
1145 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %4s %-5u %1u S%c%c%c"
1146 "U%c%c%c %c%c%c%c%c U%c%c%c%c\n",
1147 (uint64_t)ea, (uint64_t)pa,
1148 book3e_tsize_to_str[tsize],
1149 (entry->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT,
1150 (entry->mas1 & MAS1_TS) >> MAS1_TS_SHIFT,
1151 entry->mas7_3 & MAS3_SR ? 'R' : '-',
1152 entry->mas7_3 & MAS3_SW ? 'W' : '-',
1153 entry->mas7_3 & MAS3_SX ? 'X' : '-',
1154 entry->mas7_3 & MAS3_UR ? 'R' : '-',
1155 entry->mas7_3 & MAS3_UW ? 'W' : '-',
1156 entry->mas7_3 & MAS3_UX ? 'X' : '-',
1157 entry->mas2 & MAS2_W ? 'W' : '-',
1158 entry->mas2 & MAS2_I ? 'I' : '-',
1159 entry->mas2 & MAS2_M ? 'M' : '-',
1160 entry->mas2 & MAS2_G ? 'G' : '-',
1161 entry->mas2 & MAS2_E ? 'E' : '-',
1162 entry->mas7_3 & MAS3_U0 ? '0' : '-',
1163 entry->mas7_3 & MAS3_U1 ? '1' : '-',
1164 entry->mas7_3 & MAS3_U2 ? '2' : '-',
1165 entry->mas7_3 & MAS3_U3 ? '3' : '-');
1166 }
1167 }
1168
1169 static void mmubooke206_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1170 CPUPPCState *env)
1171 {
1172 int offset = 0;
1173 int i;
1174
1175 if (kvm_enabled() && !env->kvm_sw_tlb) {
1176 cpu_fprintf(f, "Cannot access KVM TLB\n");
1177 return;
1178 }
1179
1180 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1181 int size = booke206_tlb_size(env, i);
1182
1183 if (size == 0) {
1184 continue;
1185 }
1186
1187 mmubooke206_dump_one_tlb(f, cpu_fprintf, env, i, offset, size);
1188 offset += size;
1189 }
1190 }
1191
1192 static void mmu6xx_dump_BATs(FILE *f, fprintf_function cpu_fprintf,
1193 CPUPPCState *env, int type)
1194 {
1195 target_ulong *BATlt, *BATut, *BATu, *BATl;
1196 target_ulong BEPIl, BEPIu, bl;
1197 int i;
1198
1199 switch (type) {
1200 case ACCESS_CODE:
1201 BATlt = env->IBAT[1];
1202 BATut = env->IBAT[0];
1203 break;
1204 default:
1205 BATlt = env->DBAT[1];
1206 BATut = env->DBAT[0];
1207 break;
1208 }
1209
1210 for (i = 0; i < env->nb_BATs; i++) {
1211 BATu = &BATut[i];
1212 BATl = &BATlt[i];
1213 BEPIu = *BATu & 0xF0000000;
1214 BEPIl = *BATu & 0x0FFE0000;
1215 bl = (*BATu & 0x00001FFC) << 15;
1216 cpu_fprintf(f, "%s BAT%d BATu " TARGET_FMT_lx
1217 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
1218 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
1219 type == ACCESS_CODE ? "code" : "data", i,
1220 *BATu, *BATl, BEPIu, BEPIl, bl);
1221 }
1222 }
1223
1224 static void mmu6xx_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1225 CPUPPCState *env)
1226 {
1227 ppc6xx_tlb_t *tlb;
1228 target_ulong sr;
1229 int type, way, entry, i;
1230
1231 cpu_fprintf(f, "HTAB base = 0x%"HWADDR_PRIx"\n", env->htab_base);
1232 cpu_fprintf(f, "HTAB mask = 0x%"HWADDR_PRIx"\n", env->htab_mask);
1233
1234 cpu_fprintf(f, "\nSegment registers:\n");
1235 for (i = 0; i < 32; i++) {
1236 sr = env->sr[i];
1237 if (sr & 0x80000000) {
1238 cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d BUID=0x%03x "
1239 "CNTLR_SPEC=0x%05x\n", i,
1240 sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0,
1241 sr & 0x20000000 ? 1 : 0, (uint32_t)((sr >> 20) & 0x1FF),
1242 (uint32_t)(sr & 0xFFFFF));
1243 } else {
1244 cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d N=%d VSID=0x%06x\n", i,
1245 sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0,
1246 sr & 0x20000000 ? 1 : 0, sr & 0x10000000 ? 1 : 0,
1247 (uint32_t)(sr & 0x00FFFFFF));
1248 }
1249 }
1250
1251 cpu_fprintf(f, "\nBATs:\n");
1252 mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_INT);
1253 mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_CODE);
1254
1255 if (env->id_tlbs != 1) {
1256 cpu_fprintf(f, "ERROR: 6xx MMU should have separated TLB"
1257 " for code and data\n");
1258 }
1259
1260 cpu_fprintf(f, "\nTLBs [EPN EPN + SIZE]\n");
1261
1262 for (type = 0; type < 2; type++) {
1263 for (way = 0; way < env->nb_ways; way++) {
1264 for (entry = env->nb_tlb * type + env->tlb_per_way * way;
1265 entry < (env->nb_tlb * type + env->tlb_per_way * (way + 1));
1266 entry++) {
1267
1268 tlb = &env->tlb.tlb6[entry];
1269 cpu_fprintf(f, "%s TLB %02d/%02d way:%d %s ["
1270 TARGET_FMT_lx " " TARGET_FMT_lx "]\n",
1271 type ? "code" : "data", entry % env->nb_tlb,
1272 env->nb_tlb, way,
1273 pte_is_valid(tlb->pte0) ? "valid" : "inval",
1274 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE);
1275 }
1276 }
1277 }
1278 }
1279
1280 void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
1281 {
1282 switch (env->mmu_model) {
1283 case POWERPC_MMU_BOOKE:
1284 mmubooke_dump_mmu(f, cpu_fprintf, env);
1285 break;
1286 case POWERPC_MMU_BOOKE206:
1287 mmubooke206_dump_mmu(f, cpu_fprintf, env);
1288 break;
1289 case POWERPC_MMU_SOFT_6xx:
1290 case POWERPC_MMU_SOFT_74xx:
1291 mmu6xx_dump_mmu(f, cpu_fprintf, env);
1292 break;
1293 #if defined(TARGET_PPC64)
1294 case POWERPC_MMU_64B:
1295 case POWERPC_MMU_2_03:
1296 case POWERPC_MMU_2_06:
1297 case POWERPC_MMU_2_06a:
1298 case POWERPC_MMU_2_07:
1299 case POWERPC_MMU_2_07a:
1300 dump_slb(f, cpu_fprintf, env);
1301 break;
1302 #endif
1303 default:
1304 qemu_log_mask(LOG_UNIMP, "%s: unimplemented\n", __func__);
1305 }
1306 }
1307
1308 static inline int check_physical(CPUPPCState *env, mmu_ctx_t *ctx,
1309 target_ulong eaddr, int rw)
1310 {
1311 int in_plb, ret;
1312
1313 ctx->raddr = eaddr;
1314 ctx->prot = PAGE_READ | PAGE_EXEC;
1315 ret = 0;
1316 switch (env->mmu_model) {
1317 case POWERPC_MMU_SOFT_6xx:
1318 case POWERPC_MMU_SOFT_74xx:
1319 case POWERPC_MMU_SOFT_4xx:
1320 case POWERPC_MMU_REAL:
1321 case POWERPC_MMU_BOOKE:
1322 ctx->prot |= PAGE_WRITE;
1323 break;
1324
1325 case POWERPC_MMU_SOFT_4xx_Z:
1326 if (unlikely(msr_pe != 0)) {
1327 /* 403 family add some particular protections,
1328 * using PBL/PBU registers for accesses with no translation.
1329 */
1330 in_plb =
1331 /* Check PLB validity */
1332 (env->pb[0] < env->pb[1] &&
1333 /* and address in plb area */
1334 eaddr >= env->pb[0] && eaddr < env->pb[1]) ||
1335 (env->pb[2] < env->pb[3] &&
1336 eaddr >= env->pb[2] && eaddr < env->pb[3]) ? 1 : 0;
1337 if (in_plb ^ msr_px) {
1338 /* Access in protected area */
1339 if (rw == 1) {
1340 /* Access is not allowed */
1341 ret = -2;
1342 }
1343 } else {
1344 /* Read-write access is allowed */
1345 ctx->prot |= PAGE_WRITE;
1346 }
1347 }
1348 break;
1349
1350 default:
1351 /* Caller's checks mean we should never get here for other models */
1352 abort();
1353 return -1;
1354 }
1355
1356 return ret;
1357 }
1358
1359 static int get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1360 target_ulong eaddr, int rw, int access_type)
1361 {
1362 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1363 int ret = -1;
1364 bool real_mode = (access_type == ACCESS_CODE && msr_ir == 0)
1365 || (access_type != ACCESS_CODE && msr_dr == 0);
1366
1367 #if 0
1368 qemu_log("%s\n", __func__);
1369 #endif
1370
1371 switch (env->mmu_model) {
1372 case POWERPC_MMU_SOFT_6xx:
1373 case POWERPC_MMU_SOFT_74xx:
1374 if (real_mode) {
1375 ret = check_physical(env, ctx, eaddr, rw);
1376 } else {
1377 /* Try to find a BAT */
1378 if (env->nb_BATs != 0) {
1379 ret = get_bat_6xx_tlb(env, ctx, eaddr, rw, access_type);
1380 }
1381 if (ret < 0) {
1382 /* We didn't match any BAT entry or don't have BATs */
1383 ret = get_segment_6xx_tlb(env, ctx, eaddr, rw, access_type);
1384 }
1385 }
1386 break;
1387
1388 case POWERPC_MMU_SOFT_4xx:
1389 case POWERPC_MMU_SOFT_4xx_Z:
1390 if (real_mode) {
1391 ret = check_physical(env, ctx, eaddr, rw);
1392 } else {
1393 ret = mmu40x_get_physical_address(env, ctx, eaddr,
1394 rw, access_type);
1395 }
1396 break;
1397 case POWERPC_MMU_BOOKE:
1398 ret = mmubooke_get_physical_address(env, ctx, eaddr,
1399 rw, access_type);
1400 break;
1401 case POWERPC_MMU_BOOKE206:
1402 ret = mmubooke206_get_physical_address(env, ctx, eaddr, rw,
1403 access_type);
1404 break;
1405 case POWERPC_MMU_MPC8xx:
1406 /* XXX: TODO */
1407 cpu_abort(CPU(cpu), "MPC8xx MMU model is not implemented\n");
1408 break;
1409 case POWERPC_MMU_REAL:
1410 if (real_mode) {
1411 ret = check_physical(env, ctx, eaddr, rw);
1412 } else {
1413 cpu_abort(CPU(cpu), "PowerPC in real mode do not do any translation\n");
1414 }
1415 return -1;
1416 default:
1417 cpu_abort(CPU(cpu), "Unknown or invalid MMU model\n");
1418 return -1;
1419 }
1420 #if 0
1421 qemu_log("%s address " TARGET_FMT_lx " => %d " TARGET_FMT_plx "\n",
1422 __func__, eaddr, ret, ctx->raddr);
1423 #endif
1424
1425 return ret;
1426 }
1427
1428 hwaddr ppc_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
1429 {
1430 PowerPCCPU *cpu = POWERPC_CPU(cs);
1431 CPUPPCState *env = &cpu->env;
1432 mmu_ctx_t ctx;
1433
1434 switch (env->mmu_model) {
1435 #if defined(TARGET_PPC64)
1436 case POWERPC_MMU_64B:
1437 case POWERPC_MMU_2_03:
1438 case POWERPC_MMU_2_06:
1439 case POWERPC_MMU_2_06a:
1440 case POWERPC_MMU_2_07:
1441 case POWERPC_MMU_2_07a:
1442 return ppc_hash64_get_phys_page_debug(env, addr);
1443 #endif
1444
1445 case POWERPC_MMU_32B:
1446 case POWERPC_MMU_601:
1447 return ppc_hash32_get_phys_page_debug(env, addr);
1448
1449 default:
1450 ;
1451 }
1452
1453 if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT) != 0)) {
1454
1455 /* Some MMUs have separate TLBs for code and data. If we only try an
1456 * ACCESS_INT, we may not be able to read instructions mapped by code
1457 * TLBs, so we also try a ACCESS_CODE.
1458 */
1459 if (unlikely(get_physical_address(env, &ctx, addr, 0,
1460 ACCESS_CODE) != 0)) {
1461 return -1;
1462 }
1463 }
1464
1465 return ctx.raddr & TARGET_PAGE_MASK;
1466 }
1467
1468 static void booke206_update_mas_tlb_miss(CPUPPCState *env, target_ulong address,
1469 int rw)
1470 {
1471 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
1472 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
1473 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
1474 env->spr[SPR_BOOKE_MAS3] = 0;
1475 env->spr[SPR_BOOKE_MAS6] = 0;
1476 env->spr[SPR_BOOKE_MAS7] = 0;
1477
1478 /* AS */
1479 if (((rw == 2) && msr_ir) || ((rw != 2) && msr_dr)) {
1480 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
1481 env->spr[SPR_BOOKE_MAS6] |= MAS6_SAS;
1482 }
1483
1484 env->spr[SPR_BOOKE_MAS1] |= MAS1_VALID;
1485 env->spr[SPR_BOOKE_MAS2] |= address & MAS2_EPN_MASK;
1486
1487 switch (env->spr[SPR_BOOKE_MAS4] & MAS4_TIDSELD_PIDZ) {
1488 case MAS4_TIDSELD_PID0:
1489 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID] << MAS1_TID_SHIFT;
1490 break;
1491 case MAS4_TIDSELD_PID1:
1492 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID1] << MAS1_TID_SHIFT;
1493 break;
1494 case MAS4_TIDSELD_PID2:
1495 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID2] << MAS1_TID_SHIFT;
1496 break;
1497 }
1498
1499 env->spr[SPR_BOOKE_MAS6] |= env->spr[SPR_BOOKE_PID] << 16;
1500
1501 /* next victim logic */
1502 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
1503 env->last_way++;
1504 env->last_way &= booke206_tlb_ways(env, 0) - 1;
1505 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
1506 }
1507
1508 /* Perform address translation */
1509 static int cpu_ppc_handle_mmu_fault(CPUPPCState *env, target_ulong address,
1510 int rw, int mmu_idx)
1511 {
1512 CPUState *cs = CPU(ppc_env_get_cpu(env));
1513 mmu_ctx_t ctx;
1514 int access_type;
1515 int ret = 0;
1516
1517 if (rw == 2) {
1518 /* code access */
1519 rw = 0;
1520 access_type = ACCESS_CODE;
1521 } else {
1522 /* data access */
1523 access_type = env->access_type;
1524 }
1525 ret = get_physical_address(env, &ctx, address, rw, access_type);
1526 if (ret == 0) {
1527 tlb_set_page(cs, address & TARGET_PAGE_MASK,
1528 ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
1529 mmu_idx, TARGET_PAGE_SIZE);
1530 ret = 0;
1531 } else if (ret < 0) {
1532 LOG_MMU_STATE(cs);
1533 if (access_type == ACCESS_CODE) {
1534 switch (ret) {
1535 case -1:
1536 /* No matches in page tables or TLB */
1537 switch (env->mmu_model) {
1538 case POWERPC_MMU_SOFT_6xx:
1539 cs->exception_index = POWERPC_EXCP_IFTLB;
1540 env->error_code = 1 << 18;
1541 env->spr[SPR_IMISS] = address;
1542 env->spr[SPR_ICMP] = 0x80000000 | ctx.ptem;
1543 goto tlb_miss;
1544 case POWERPC_MMU_SOFT_74xx:
1545 cs->exception_index = POWERPC_EXCP_IFTLB;
1546 goto tlb_miss_74xx;
1547 case POWERPC_MMU_SOFT_4xx:
1548 case POWERPC_MMU_SOFT_4xx_Z:
1549 cs->exception_index = POWERPC_EXCP_ITLB;
1550 env->error_code = 0;
1551 env->spr[SPR_40x_DEAR] = address;
1552 env->spr[SPR_40x_ESR] = 0x00000000;
1553 break;
1554 case POWERPC_MMU_BOOKE206:
1555 booke206_update_mas_tlb_miss(env, address, rw);
1556 /* fall through */
1557 case POWERPC_MMU_BOOKE:
1558 cs->exception_index = POWERPC_EXCP_ITLB;
1559 env->error_code = 0;
1560 env->spr[SPR_BOOKE_DEAR] = address;
1561 return -1;
1562 case POWERPC_MMU_MPC8xx:
1563 /* XXX: TODO */
1564 cpu_abort(cs, "MPC8xx MMU model is not implemented\n");
1565 break;
1566 case POWERPC_MMU_REAL:
1567 cpu_abort(cs, "PowerPC in real mode should never raise "
1568 "any MMU exceptions\n");
1569 return -1;
1570 default:
1571 cpu_abort(cs, "Unknown or invalid MMU model\n");
1572 return -1;
1573 }
1574 break;
1575 case -2:
1576 /* Access rights violation */
1577 cs->exception_index = POWERPC_EXCP_ISI;
1578 env->error_code = 0x08000000;
1579 break;
1580 case -3:
1581 /* No execute protection violation */
1582 if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1583 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1584 env->spr[SPR_BOOKE_ESR] = 0x00000000;
1585 }
1586 cs->exception_index = POWERPC_EXCP_ISI;
1587 env->error_code = 0x10000000;
1588 break;
1589 case -4:
1590 /* Direct store exception */
1591 /* No code fetch is allowed in direct-store areas */
1592 cs->exception_index = POWERPC_EXCP_ISI;
1593 env->error_code = 0x10000000;
1594 break;
1595 }
1596 } else {
1597 switch (ret) {
1598 case -1:
1599 /* No matches in page tables or TLB */
1600 switch (env->mmu_model) {
1601 case POWERPC_MMU_SOFT_6xx:
1602 if (rw == 1) {
1603 cs->exception_index = POWERPC_EXCP_DSTLB;
1604 env->error_code = 1 << 16;
1605 } else {
1606 cs->exception_index = POWERPC_EXCP_DLTLB;
1607 env->error_code = 0;
1608 }
1609 env->spr[SPR_DMISS] = address;
1610 env->spr[SPR_DCMP] = 0x80000000 | ctx.ptem;
1611 tlb_miss:
1612 env->error_code |= ctx.key << 19;
1613 env->spr[SPR_HASH1] = env->htab_base +
1614 get_pteg_offset32(env, ctx.hash[0]);
1615 env->spr[SPR_HASH2] = env->htab_base +
1616 get_pteg_offset32(env, ctx.hash[1]);
1617 break;
1618 case POWERPC_MMU_SOFT_74xx:
1619 if (rw == 1) {
1620 cs->exception_index = POWERPC_EXCP_DSTLB;
1621 } else {
1622 cs->exception_index = POWERPC_EXCP_DLTLB;
1623 }
1624 tlb_miss_74xx:
1625 /* Implement LRU algorithm */
1626 env->error_code = ctx.key << 19;
1627 env->spr[SPR_TLBMISS] = (address & ~((target_ulong)0x3)) |
1628 ((env->last_way + 1) & (env->nb_ways - 1));
1629 env->spr[SPR_PTEHI] = 0x80000000 | ctx.ptem;
1630 break;
1631 case POWERPC_MMU_SOFT_4xx:
1632 case POWERPC_MMU_SOFT_4xx_Z:
1633 cs->exception_index = POWERPC_EXCP_DTLB;
1634 env->error_code = 0;
1635 env->spr[SPR_40x_DEAR] = address;
1636 if (rw) {
1637 env->spr[SPR_40x_ESR] = 0x00800000;
1638 } else {
1639 env->spr[SPR_40x_ESR] = 0x00000000;
1640 }
1641 break;
1642 case POWERPC_MMU_MPC8xx:
1643 /* XXX: TODO */
1644 cpu_abort(cs, "MPC8xx MMU model is not implemented\n");
1645 break;
1646 case POWERPC_MMU_BOOKE206:
1647 booke206_update_mas_tlb_miss(env, address, rw);
1648 /* fall through */
1649 case POWERPC_MMU_BOOKE:
1650 cs->exception_index = POWERPC_EXCP_DTLB;
1651 env->error_code = 0;
1652 env->spr[SPR_BOOKE_DEAR] = address;
1653 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1654 return -1;
1655 case POWERPC_MMU_REAL:
1656 cpu_abort(cs, "PowerPC in real mode should never raise "
1657 "any MMU exceptions\n");
1658 return -1;
1659 default:
1660 cpu_abort(cs, "Unknown or invalid MMU model\n");
1661 return -1;
1662 }
1663 break;
1664 case -2:
1665 /* Access rights violation */
1666 cs->exception_index = POWERPC_EXCP_DSI;
1667 env->error_code = 0;
1668 if (env->mmu_model == POWERPC_MMU_SOFT_4xx
1669 || env->mmu_model == POWERPC_MMU_SOFT_4xx_Z) {
1670 env->spr[SPR_40x_DEAR] = address;
1671 if (rw) {
1672 env->spr[SPR_40x_ESR] |= 0x00800000;
1673 }
1674 } else if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1675 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1676 env->spr[SPR_BOOKE_DEAR] = address;
1677 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1678 } else {
1679 env->spr[SPR_DAR] = address;
1680 if (rw == 1) {
1681 env->spr[SPR_DSISR] = 0x0A000000;
1682 } else {
1683 env->spr[SPR_DSISR] = 0x08000000;
1684 }
1685 }
1686 break;
1687 case -4:
1688 /* Direct store exception */
1689 switch (access_type) {
1690 case ACCESS_FLOAT:
1691 /* Floating point load/store */
1692 cs->exception_index = POWERPC_EXCP_ALIGN;
1693 env->error_code = POWERPC_EXCP_ALIGN_FP;
1694 env->spr[SPR_DAR] = address;
1695 break;
1696 case ACCESS_RES:
1697 /* lwarx, ldarx or stwcx. */
1698 cs->exception_index = POWERPC_EXCP_DSI;
1699 env->error_code = 0;
1700 env->spr[SPR_DAR] = address;
1701 if (rw == 1) {
1702 env->spr[SPR_DSISR] = 0x06000000;
1703 } else {
1704 env->spr[SPR_DSISR] = 0x04000000;
1705 }
1706 break;
1707 case ACCESS_EXT:
1708 /* eciwx or ecowx */
1709 cs->exception_index = POWERPC_EXCP_DSI;
1710 env->error_code = 0;
1711 env->spr[SPR_DAR] = address;
1712 if (rw == 1) {
1713 env->spr[SPR_DSISR] = 0x06100000;
1714 } else {
1715 env->spr[SPR_DSISR] = 0x04100000;
1716 }
1717 break;
1718 default:
1719 printf("DSI: invalid exception (%d)\n", ret);
1720 cs->exception_index = POWERPC_EXCP_PROGRAM;
1721 env->error_code =
1722 POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL;
1723 env->spr[SPR_DAR] = address;
1724 break;
1725 }
1726 break;
1727 }
1728 }
1729 #if 0
1730 printf("%s: set exception to %d %02x\n", __func__,
1731 cs->exception, env->error_code);
1732 #endif
1733 ret = 1;
1734 }
1735
1736 return ret;
1737 }
1738
1739 /*****************************************************************************/
1740 /* BATs management */
1741 #if !defined(FLUSH_ALL_TLBS)
1742 static inline void do_invalidate_BAT(CPUPPCState *env, target_ulong BATu,
1743 target_ulong mask)
1744 {
1745 CPUState *cs = CPU(ppc_env_get_cpu(env));
1746 target_ulong base, end, page;
1747
1748 base = BATu & ~0x0001FFFF;
1749 end = base + mask + 0x00020000;
1750 LOG_BATS("Flush BAT from " TARGET_FMT_lx " to " TARGET_FMT_lx " ("
1751 TARGET_FMT_lx ")\n", base, end, mask);
1752 for (page = base; page != end; page += TARGET_PAGE_SIZE) {
1753 tlb_flush_page(cs, page);
1754 }
1755 LOG_BATS("Flush done\n");
1756 }
1757 #endif
1758
1759 static inline void dump_store_bat(CPUPPCState *env, char ID, int ul, int nr,
1760 target_ulong value)
1761 {
1762 LOG_BATS("Set %cBAT%d%c to " TARGET_FMT_lx " (" TARGET_FMT_lx ")\n", ID,
1763 nr, ul == 0 ? 'u' : 'l', value, env->nip);
1764 }
1765
1766 void helper_store_ibatu(CPUPPCState *env, uint32_t nr, target_ulong value)
1767 {
1768 target_ulong mask;
1769
1770 dump_store_bat(env, 'I', 0, nr, value);
1771 if (env->IBAT[0][nr] != value) {
1772 mask = (value << 15) & 0x0FFE0000UL;
1773 #if !defined(FLUSH_ALL_TLBS)
1774 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1775 #endif
1776 /* When storing valid upper BAT, mask BEPI and BRPN
1777 * and invalidate all TLBs covered by this BAT
1778 */
1779 mask = (value << 15) & 0x0FFE0000UL;
1780 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1781 (value & ~0x0001FFFFUL & ~mask);
1782 env->IBAT[1][nr] = (env->IBAT[1][nr] & 0x0000007B) |
1783 (env->IBAT[1][nr] & ~0x0001FFFF & ~mask);
1784 #if !defined(FLUSH_ALL_TLBS)
1785 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1786 #else
1787 tlb_flush(env, 1);
1788 #endif
1789 }
1790 }
1791
1792 void helper_store_ibatl(CPUPPCState *env, uint32_t nr, target_ulong value)
1793 {
1794 dump_store_bat(env, 'I', 1, nr, value);
1795 env->IBAT[1][nr] = value;
1796 }
1797
1798 void helper_store_dbatu(CPUPPCState *env, uint32_t nr, target_ulong value)
1799 {
1800 target_ulong mask;
1801
1802 dump_store_bat(env, 'D', 0, nr, value);
1803 if (env->DBAT[0][nr] != value) {
1804 /* When storing valid upper BAT, mask BEPI and BRPN
1805 * and invalidate all TLBs covered by this BAT
1806 */
1807 mask = (value << 15) & 0x0FFE0000UL;
1808 #if !defined(FLUSH_ALL_TLBS)
1809 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1810 #endif
1811 mask = (value << 15) & 0x0FFE0000UL;
1812 env->DBAT[0][nr] = (value & 0x00001FFFUL) |
1813 (value & ~0x0001FFFFUL & ~mask);
1814 env->DBAT[1][nr] = (env->DBAT[1][nr] & 0x0000007B) |
1815 (env->DBAT[1][nr] & ~0x0001FFFF & ~mask);
1816 #if !defined(FLUSH_ALL_TLBS)
1817 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1818 #else
1819 tlb_flush(env, 1);
1820 #endif
1821 }
1822 }
1823
1824 void helper_store_dbatl(CPUPPCState *env, uint32_t nr, target_ulong value)
1825 {
1826 dump_store_bat(env, 'D', 1, nr, value);
1827 env->DBAT[1][nr] = value;
1828 }
1829
1830 void helper_store_601_batu(CPUPPCState *env, uint32_t nr, target_ulong value)
1831 {
1832 target_ulong mask;
1833 #if defined(FLUSH_ALL_TLBS)
1834 int do_inval;
1835 #endif
1836
1837 dump_store_bat(env, 'I', 0, nr, value);
1838 if (env->IBAT[0][nr] != value) {
1839 #if defined(FLUSH_ALL_TLBS)
1840 do_inval = 0;
1841 #endif
1842 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1843 if (env->IBAT[1][nr] & 0x40) {
1844 /* Invalidate BAT only if it is valid */
1845 #if !defined(FLUSH_ALL_TLBS)
1846 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1847 #else
1848 do_inval = 1;
1849 #endif
1850 }
1851 /* When storing valid upper BAT, mask BEPI and BRPN
1852 * and invalidate all TLBs covered by this BAT
1853 */
1854 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1855 (value & ~0x0001FFFFUL & ~mask);
1856 env->DBAT[0][nr] = env->IBAT[0][nr];
1857 if (env->IBAT[1][nr] & 0x40) {
1858 #if !defined(FLUSH_ALL_TLBS)
1859 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1860 #else
1861 do_inval = 1;
1862 #endif
1863 }
1864 #if defined(FLUSH_ALL_TLBS)
1865 if (do_inval) {
1866 tlb_flush(env, 1);
1867 }
1868 #endif
1869 }
1870 }
1871
1872 void helper_store_601_batl(CPUPPCState *env, uint32_t nr, target_ulong value)
1873 {
1874 #if !defined(FLUSH_ALL_TLBS)
1875 target_ulong mask;
1876 #else
1877 int do_inval;
1878 #endif
1879
1880 dump_store_bat(env, 'I', 1, nr, value);
1881 if (env->IBAT[1][nr] != value) {
1882 #if defined(FLUSH_ALL_TLBS)
1883 do_inval = 0;
1884 #endif
1885 if (env->IBAT[1][nr] & 0x40) {
1886 #if !defined(FLUSH_ALL_TLBS)
1887 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1888 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1889 #else
1890 do_inval = 1;
1891 #endif
1892 }
1893 if (value & 0x40) {
1894 #if !defined(FLUSH_ALL_TLBS)
1895 mask = (value << 17) & 0x0FFE0000UL;
1896 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1897 #else
1898 do_inval = 1;
1899 #endif
1900 }
1901 env->IBAT[1][nr] = value;
1902 env->DBAT[1][nr] = value;
1903 #if defined(FLUSH_ALL_TLBS)
1904 if (do_inval) {
1905 tlb_flush(env, 1);
1906 }
1907 #endif
1908 }
1909 }
1910
1911 /*****************************************************************************/
1912 /* TLB management */
1913 void ppc_tlb_invalidate_all(CPUPPCState *env)
1914 {
1915 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1916
1917 switch (env->mmu_model) {
1918 case POWERPC_MMU_SOFT_6xx:
1919 case POWERPC_MMU_SOFT_74xx:
1920 ppc6xx_tlb_invalidate_all(env);
1921 break;
1922 case POWERPC_MMU_SOFT_4xx:
1923 case POWERPC_MMU_SOFT_4xx_Z:
1924 ppc4xx_tlb_invalidate_all(env);
1925 break;
1926 case POWERPC_MMU_REAL:
1927 cpu_abort(CPU(cpu), "No TLB for PowerPC 4xx in real mode\n");
1928 break;
1929 case POWERPC_MMU_MPC8xx:
1930 /* XXX: TODO */
1931 cpu_abort(CPU(cpu), "MPC8xx MMU model is not implemented\n");
1932 break;
1933 case POWERPC_MMU_BOOKE:
1934 tlb_flush(CPU(cpu), 1);
1935 break;
1936 case POWERPC_MMU_BOOKE206:
1937 booke206_flush_tlb(env, -1, 0);
1938 break;
1939 case POWERPC_MMU_32B:
1940 case POWERPC_MMU_601:
1941 #if defined(TARGET_PPC64)
1942 case POWERPC_MMU_64B:
1943 case POWERPC_MMU_2_03:
1944 case POWERPC_MMU_2_06:
1945 case POWERPC_MMU_2_06a:
1946 case POWERPC_MMU_2_07:
1947 case POWERPC_MMU_2_07a:
1948 #endif /* defined(TARGET_PPC64) */
1949 tlb_flush(CPU(cpu), 1);
1950 break;
1951 default:
1952 /* XXX: TODO */
1953 cpu_abort(CPU(cpu), "Unknown MMU model\n");
1954 break;
1955 }
1956 }
1957
1958 void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
1959 {
1960 #if !defined(FLUSH_ALL_TLBS)
1961 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1962 CPUState *cs;
1963
1964 addr &= TARGET_PAGE_MASK;
1965 switch (env->mmu_model) {
1966 case POWERPC_MMU_SOFT_6xx:
1967 case POWERPC_MMU_SOFT_74xx:
1968 ppc6xx_tlb_invalidate_virt(env, addr, 0);
1969 if (env->id_tlbs == 1) {
1970 ppc6xx_tlb_invalidate_virt(env, addr, 1);
1971 }
1972 break;
1973 case POWERPC_MMU_SOFT_4xx:
1974 case POWERPC_MMU_SOFT_4xx_Z:
1975 ppc4xx_tlb_invalidate_virt(env, addr, env->spr[SPR_40x_PID]);
1976 break;
1977 case POWERPC_MMU_REAL:
1978 cpu_abort(CPU(cpu), "No TLB for PowerPC 4xx in real mode\n");
1979 break;
1980 case POWERPC_MMU_MPC8xx:
1981 /* XXX: TODO */
1982 cpu_abort(CPU(cpu), "MPC8xx MMU model is not implemented\n");
1983 break;
1984 case POWERPC_MMU_BOOKE:
1985 /* XXX: TODO */
1986 cpu_abort(CPU(cpu), "BookE MMU model is not implemented\n");
1987 break;
1988 case POWERPC_MMU_BOOKE206:
1989 /* XXX: TODO */
1990 cpu_abort(CPU(cpu), "BookE 2.06 MMU model is not implemented\n");
1991 break;
1992 case POWERPC_MMU_32B:
1993 case POWERPC_MMU_601:
1994 /* tlbie invalidate TLBs for all segments */
1995 addr &= ~((target_ulong)-1ULL << 28);
1996 cs = CPU(cpu);
1997 /* XXX: this case should be optimized,
1998 * giving a mask to tlb_flush_page
1999 */
2000 tlb_flush_page(cs, addr | (0x0 << 28));
2001 tlb_flush_page(cs, addr | (0x1 << 28));
2002 tlb_flush_page(cs, addr | (0x2 << 28));
2003 tlb_flush_page(cs, addr | (0x3 << 28));
2004 tlb_flush_page(cs, addr | (0x4 << 28));
2005 tlb_flush_page(cs, addr | (0x5 << 28));
2006 tlb_flush_page(cs, addr | (0x6 << 28));
2007 tlb_flush_page(cs, addr | (0x7 << 28));
2008 tlb_flush_page(cs, addr | (0x8 << 28));
2009 tlb_flush_page(cs, addr | (0x9 << 28));
2010 tlb_flush_page(cs, addr | (0xA << 28));
2011 tlb_flush_page(cs, addr | (0xB << 28));
2012 tlb_flush_page(cs, addr | (0xC << 28));
2013 tlb_flush_page(cs, addr | (0xD << 28));
2014 tlb_flush_page(cs, addr | (0xE << 28));
2015 tlb_flush_page(cs, addr | (0xF << 28));
2016 break;
2017 #if defined(TARGET_PPC64)
2018 case POWERPC_MMU_64B:
2019 case POWERPC_MMU_2_03:
2020 case POWERPC_MMU_2_06:
2021 case POWERPC_MMU_2_06a:
2022 case POWERPC_MMU_2_07:
2023 case POWERPC_MMU_2_07a:
2024 /* tlbie invalidate TLBs for all segments */
2025 /* XXX: given the fact that there are too many segments to invalidate,
2026 * and we still don't have a tlb_flush_mask(env, n, mask) in QEMU,
2027 * we just invalidate all TLBs
2028 */
2029 tlb_flush(CPU(cpu), 1);
2030 break;
2031 #endif /* defined(TARGET_PPC64) */
2032 default:
2033 /* XXX: TODO */
2034 cpu_abort(CPU(cpu), "Unknown MMU model\n");
2035 break;
2036 }
2037 #else
2038 ppc_tlb_invalidate_all(env);
2039 #endif
2040 }
2041
2042 /*****************************************************************************/
2043 /* Special registers manipulation */
2044 void ppc_store_sdr1(CPUPPCState *env, target_ulong value)
2045 {
2046 qemu_log_mask(CPU_LOG_MMU, "%s: " TARGET_FMT_lx "\n", __func__, value);
2047 assert(!env->external_htab);
2048 env->spr[SPR_SDR1] = value;
2049 #if defined(TARGET_PPC64)
2050 if (env->mmu_model & POWERPC_MMU_64) {
2051 target_ulong htabsize = value & SDR_64_HTABSIZE;
2052
2053 if (htabsize > 28) {
2054 fprintf(stderr, "Invalid HTABSIZE 0x" TARGET_FMT_lx
2055 " stored in SDR1\n", htabsize);
2056 htabsize = 28;
2057 }
2058 env->htab_mask = (1ULL << (htabsize + 18 - 7)) - 1;
2059 env->htab_base = value & SDR_64_HTABORG;
2060 } else
2061 #endif /* defined(TARGET_PPC64) */
2062 {
2063 /* FIXME: Should check for valid HTABMASK values */
2064 env->htab_mask = ((value & SDR_32_HTABMASK) << 16) | 0xFFFF;
2065 env->htab_base = value & SDR_32_HTABORG;
2066 }
2067 }
2068
2069 /* Segment registers load and store */
2070 target_ulong helper_load_sr(CPUPPCState *env, target_ulong sr_num)
2071 {
2072 #if defined(TARGET_PPC64)
2073 if (env->mmu_model & POWERPC_MMU_64) {
2074 /* XXX */
2075 return 0;
2076 }
2077 #endif
2078 return env->sr[sr_num];
2079 }
2080
2081 void helper_store_sr(CPUPPCState *env, target_ulong srnum, target_ulong value)
2082 {
2083 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2084
2085 qemu_log_mask(CPU_LOG_MMU,
2086 "%s: reg=%d " TARGET_FMT_lx " " TARGET_FMT_lx "\n", __func__,
2087 (int)srnum, value, env->sr[srnum]);
2088 #if defined(TARGET_PPC64)
2089 if (env->mmu_model & POWERPC_MMU_64) {
2090 uint64_t rb = 0, rs = 0;
2091
2092 /* ESID = srnum */
2093 rb |= ((uint32_t)srnum & 0xf) << 28;
2094 /* Set the valid bit */
2095 rb |= SLB_ESID_V;
2096 /* Index = ESID */
2097 rb |= (uint32_t)srnum;
2098
2099 /* VSID = VSID */
2100 rs |= (value & 0xfffffff) << 12;
2101 /* flags = flags */
2102 rs |= ((value >> 27) & 0xf) << 8;
2103
2104 ppc_store_slb(env, rb, rs);
2105 } else
2106 #endif
2107 if (env->sr[srnum] != value) {
2108 env->sr[srnum] = value;
2109 /* Invalidating 256MB of virtual memory in 4kB pages is way longer than
2110 flusing the whole TLB. */
2111 #if !defined(FLUSH_ALL_TLBS) && 0
2112 {
2113 target_ulong page, end;
2114 /* Invalidate 256 MB of virtual memory */
2115 page = (16 << 20) * srnum;
2116 end = page + (16 << 20);
2117 for (; page != end; page += TARGET_PAGE_SIZE) {
2118 tlb_flush_page(CPU(cpu), page);
2119 }
2120 }
2121 #else
2122 tlb_flush(CPU(cpu), 1);
2123 #endif
2124 }
2125 }
2126
2127 /* TLB management */
2128 void helper_tlbia(CPUPPCState *env)
2129 {
2130 ppc_tlb_invalidate_all(env);
2131 }
2132
2133 void helper_tlbie(CPUPPCState *env, target_ulong addr)
2134 {
2135 ppc_tlb_invalidate_one(env, addr);
2136 }
2137
2138 /* Software driven TLBs management */
2139 /* PowerPC 602/603 software TLB load instructions helpers */
2140 static void do_6xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
2141 {
2142 target_ulong RPN, CMP, EPN;
2143 int way;
2144
2145 RPN = env->spr[SPR_RPA];
2146 if (is_code) {
2147 CMP = env->spr[SPR_ICMP];
2148 EPN = env->spr[SPR_IMISS];
2149 } else {
2150 CMP = env->spr[SPR_DCMP];
2151 EPN = env->spr[SPR_DMISS];
2152 }
2153 way = (env->spr[SPR_SRR1] >> 17) & 1;
2154 (void)EPN; /* avoid a compiler warning */
2155 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2156 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2157 RPN, way);
2158 /* Store this TLB */
2159 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2160 way, is_code, CMP, RPN);
2161 }
2162
2163 void helper_6xx_tlbd(CPUPPCState *env, target_ulong EPN)
2164 {
2165 do_6xx_tlb(env, EPN, 0);
2166 }
2167
2168 void helper_6xx_tlbi(CPUPPCState *env, target_ulong EPN)
2169 {
2170 do_6xx_tlb(env, EPN, 1);
2171 }
2172
2173 /* PowerPC 74xx software TLB load instructions helpers */
2174 static void do_74xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
2175 {
2176 target_ulong RPN, CMP, EPN;
2177 int way;
2178
2179 RPN = env->spr[SPR_PTELO];
2180 CMP = env->spr[SPR_PTEHI];
2181 EPN = env->spr[SPR_TLBMISS] & ~0x3;
2182 way = env->spr[SPR_TLBMISS] & 0x3;
2183 (void)EPN; /* avoid a compiler warning */
2184 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2185 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2186 RPN, way);
2187 /* Store this TLB */
2188 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2189 way, is_code, CMP, RPN);
2190 }
2191
2192 void helper_74xx_tlbd(CPUPPCState *env, target_ulong EPN)
2193 {
2194 do_74xx_tlb(env, EPN, 0);
2195 }
2196
2197 void helper_74xx_tlbi(CPUPPCState *env, target_ulong EPN)
2198 {
2199 do_74xx_tlb(env, EPN, 1);
2200 }
2201
2202 /*****************************************************************************/
2203 /* PowerPC 601 specific instructions (POWER bridge) */
2204
2205 target_ulong helper_rac(CPUPPCState *env, target_ulong addr)
2206 {
2207 mmu_ctx_t ctx;
2208 int nb_BATs;
2209 target_ulong ret = 0;
2210
2211 /* We don't have to generate many instances of this instruction,
2212 * as rac is supervisor only.
2213 */
2214 /* XXX: FIX THIS: Pretend we have no BAT */
2215 nb_BATs = env->nb_BATs;
2216 env->nb_BATs = 0;
2217 if (get_physical_address(env, &ctx, addr, 0, ACCESS_INT) == 0) {
2218 ret = ctx.raddr;
2219 }
2220 env->nb_BATs = nb_BATs;
2221 return ret;
2222 }
2223
2224 static inline target_ulong booke_tlb_to_page_size(int size)
2225 {
2226 return 1024 << (2 * size);
2227 }
2228
2229 static inline int booke_page_size_to_tlb(target_ulong page_size)
2230 {
2231 int size;
2232
2233 switch (page_size) {
2234 case 0x00000400UL:
2235 size = 0x0;
2236 break;
2237 case 0x00001000UL:
2238 size = 0x1;
2239 break;
2240 case 0x00004000UL:
2241 size = 0x2;
2242 break;
2243 case 0x00010000UL:
2244 size = 0x3;
2245 break;
2246 case 0x00040000UL:
2247 size = 0x4;
2248 break;
2249 case 0x00100000UL:
2250 size = 0x5;
2251 break;
2252 case 0x00400000UL:
2253 size = 0x6;
2254 break;
2255 case 0x01000000UL:
2256 size = 0x7;
2257 break;
2258 case 0x04000000UL:
2259 size = 0x8;
2260 break;
2261 case 0x10000000UL:
2262 size = 0x9;
2263 break;
2264 case 0x40000000UL:
2265 size = 0xA;
2266 break;
2267 #if defined(TARGET_PPC64)
2268 case 0x000100000000ULL:
2269 size = 0xB;
2270 break;
2271 case 0x000400000000ULL:
2272 size = 0xC;
2273 break;
2274 case 0x001000000000ULL:
2275 size = 0xD;
2276 break;
2277 case 0x004000000000ULL:
2278 size = 0xE;
2279 break;
2280 case 0x010000000000ULL:
2281 size = 0xF;
2282 break;
2283 #endif
2284 default:
2285 size = -1;
2286 break;
2287 }
2288
2289 return size;
2290 }
2291
2292 /* Helpers for 4xx TLB management */
2293 #define PPC4XX_TLB_ENTRY_MASK 0x0000003f /* Mask for 64 TLB entries */
2294
2295 #define PPC4XX_TLBHI_V 0x00000040
2296 #define PPC4XX_TLBHI_E 0x00000020
2297 #define PPC4XX_TLBHI_SIZE_MIN 0
2298 #define PPC4XX_TLBHI_SIZE_MAX 7
2299 #define PPC4XX_TLBHI_SIZE_DEFAULT 1
2300 #define PPC4XX_TLBHI_SIZE_SHIFT 7
2301 #define PPC4XX_TLBHI_SIZE_MASK 0x00000007
2302
2303 #define PPC4XX_TLBLO_EX 0x00000200
2304 #define PPC4XX_TLBLO_WR 0x00000100
2305 #define PPC4XX_TLBLO_ATTR_MASK 0x000000FF
2306 #define PPC4XX_TLBLO_RPN_MASK 0xFFFFFC00
2307
2308 target_ulong helper_4xx_tlbre_hi(CPUPPCState *env, target_ulong entry)
2309 {
2310 ppcemb_tlb_t *tlb;
2311 target_ulong ret;
2312 int size;
2313
2314 entry &= PPC4XX_TLB_ENTRY_MASK;
2315 tlb = &env->tlb.tlbe[entry];
2316 ret = tlb->EPN;
2317 if (tlb->prot & PAGE_VALID) {
2318 ret |= PPC4XX_TLBHI_V;
2319 }
2320 size = booke_page_size_to_tlb(tlb->size);
2321 if (size < PPC4XX_TLBHI_SIZE_MIN || size > PPC4XX_TLBHI_SIZE_MAX) {
2322 size = PPC4XX_TLBHI_SIZE_DEFAULT;
2323 }
2324 ret |= size << PPC4XX_TLBHI_SIZE_SHIFT;
2325 env->spr[SPR_40x_PID] = tlb->PID;
2326 return ret;
2327 }
2328
2329 target_ulong helper_4xx_tlbre_lo(CPUPPCState *env, target_ulong entry)
2330 {
2331 ppcemb_tlb_t *tlb;
2332 target_ulong ret;
2333
2334 entry &= PPC4XX_TLB_ENTRY_MASK;
2335 tlb = &env->tlb.tlbe[entry];
2336 ret = tlb->RPN;
2337 if (tlb->prot & PAGE_EXEC) {
2338 ret |= PPC4XX_TLBLO_EX;
2339 }
2340 if (tlb->prot & PAGE_WRITE) {
2341 ret |= PPC4XX_TLBLO_WR;
2342 }
2343 return ret;
2344 }
2345
2346 void helper_4xx_tlbwe_hi(CPUPPCState *env, target_ulong entry,
2347 target_ulong val)
2348 {
2349 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2350 CPUState *cs = CPU(cpu);
2351 ppcemb_tlb_t *tlb;
2352 target_ulong page, end;
2353
2354 LOG_SWTLB("%s entry %d val " TARGET_FMT_lx "\n", __func__, (int)entry,
2355 val);
2356 entry &= PPC4XX_TLB_ENTRY_MASK;
2357 tlb = &env->tlb.tlbe[entry];
2358 /* Invalidate previous TLB (if it's valid) */
2359 if (tlb->prot & PAGE_VALID) {
2360 end = tlb->EPN + tlb->size;
2361 LOG_SWTLB("%s: invalidate old TLB %d start " TARGET_FMT_lx " end "
2362 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2363 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
2364 tlb_flush_page(cs, page);
2365 }
2366 }
2367 tlb->size = booke_tlb_to_page_size((val >> PPC4XX_TLBHI_SIZE_SHIFT)
2368 & PPC4XX_TLBHI_SIZE_MASK);
2369 /* We cannot handle TLB size < TARGET_PAGE_SIZE.
2370 * If this ever occurs, one should use the ppcemb target instead
2371 * of the ppc or ppc64 one
2372 */
2373 if ((val & PPC4XX_TLBHI_V) && tlb->size < TARGET_PAGE_SIZE) {
2374 cpu_abort(cs, "TLB size " TARGET_FMT_lu " < %u "
2375 "are not supported (%d)\n",
2376 tlb->size, TARGET_PAGE_SIZE, (int)((val >> 7) & 0x7));
2377 }
2378 tlb->EPN = val & ~(tlb->size - 1);
2379 if (val & PPC4XX_TLBHI_V) {
2380 tlb->prot |= PAGE_VALID;
2381 if (val & PPC4XX_TLBHI_E) {
2382 /* XXX: TO BE FIXED */
2383 cpu_abort(cs,
2384 "Little-endian TLB entries are not supported by now\n");
2385 }
2386 } else {
2387 tlb->prot &= ~PAGE_VALID;
2388 }
2389 tlb->PID = env->spr[SPR_40x_PID]; /* PID */
2390 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2391 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2392 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2393 tlb->prot & PAGE_READ ? 'r' : '-',
2394 tlb->prot & PAGE_WRITE ? 'w' : '-',
2395 tlb->prot & PAGE_EXEC ? 'x' : '-',
2396 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2397 /* Invalidate new TLB (if valid) */
2398 if (tlb->prot & PAGE_VALID) {
2399 end = tlb->EPN + tlb->size;
2400 LOG_SWTLB("%s: invalidate TLB %d start " TARGET_FMT_lx " end "
2401 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2402 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
2403 tlb_flush_page(cs, page);
2404 }
2405 }
2406 }
2407
2408 void helper_4xx_tlbwe_lo(CPUPPCState *env, target_ulong entry,
2409 target_ulong val)
2410 {
2411 ppcemb_tlb_t *tlb;
2412
2413 LOG_SWTLB("%s entry %i val " TARGET_FMT_lx "\n", __func__, (int)entry,
2414 val);
2415 entry &= PPC4XX_TLB_ENTRY_MASK;
2416 tlb = &env->tlb.tlbe[entry];
2417 tlb->attr = val & PPC4XX_TLBLO_ATTR_MASK;
2418 tlb->RPN = val & PPC4XX_TLBLO_RPN_MASK;
2419 tlb->prot = PAGE_READ;
2420 if (val & PPC4XX_TLBLO_EX) {
2421 tlb->prot |= PAGE_EXEC;
2422 }
2423 if (val & PPC4XX_TLBLO_WR) {
2424 tlb->prot |= PAGE_WRITE;
2425 }
2426 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2427 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2428 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2429 tlb->prot & PAGE_READ ? 'r' : '-',
2430 tlb->prot & PAGE_WRITE ? 'w' : '-',
2431 tlb->prot & PAGE_EXEC ? 'x' : '-',
2432 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2433 }
2434
2435 target_ulong helper_4xx_tlbsx(CPUPPCState *env, target_ulong address)
2436 {
2437 return ppcemb_tlb_search(env, address, env->spr[SPR_40x_PID]);
2438 }
2439
2440 /* PowerPC 440 TLB management */
2441 void helper_440_tlbwe(CPUPPCState *env, uint32_t word, target_ulong entry,
2442 target_ulong value)
2443 {
2444 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2445 ppcemb_tlb_t *tlb;
2446 target_ulong EPN, RPN, size;
2447 int do_flush_tlbs;
2448
2449 LOG_SWTLB("%s word %d entry %d value " TARGET_FMT_lx "\n",
2450 __func__, word, (int)entry, value);
2451 do_flush_tlbs = 0;
2452 entry &= 0x3F;
2453 tlb = &env->tlb.tlbe[entry];
2454 switch (word) {
2455 default:
2456 /* Just here to please gcc */
2457 case 0:
2458 EPN = value & 0xFFFFFC00;
2459 if ((tlb->prot & PAGE_VALID) && EPN != tlb->EPN) {
2460 do_flush_tlbs = 1;
2461 }
2462 tlb->EPN = EPN;
2463 size = booke_tlb_to_page_size((value >> 4) & 0xF);
2464 if ((tlb->prot & PAGE_VALID) && tlb->size < size) {
2465 do_flush_tlbs = 1;
2466 }
2467 tlb->size = size;
2468 tlb->attr &= ~0x1;
2469 tlb->attr |= (value >> 8) & 1;
2470 if (value & 0x200) {
2471 tlb->prot |= PAGE_VALID;
2472 } else {
2473 if (tlb->prot & PAGE_VALID) {
2474 tlb->prot &= ~PAGE_VALID;
2475 do_flush_tlbs = 1;
2476 }
2477 }
2478 tlb->PID = env->spr[SPR_440_MMUCR] & 0x000000FF;
2479 if (do_flush_tlbs) {
2480 tlb_flush(CPU(cpu), 1);
2481 }
2482 break;
2483 case 1:
2484 RPN = value & 0xFFFFFC0F;
2485 if ((tlb->prot & PAGE_VALID) && tlb->RPN != RPN) {
2486 tlb_flush(CPU(cpu), 1);
2487 }
2488 tlb->RPN = RPN;
2489 break;
2490 case 2:
2491 tlb->attr = (tlb->attr & 0x1) | (value & 0x0000FF00);
2492 tlb->prot = tlb->prot & PAGE_VALID;
2493 if (value & 0x1) {
2494 tlb->prot |= PAGE_READ << 4;
2495 }
2496 if (value & 0x2) {
2497 tlb->prot |= PAGE_WRITE << 4;
2498 }
2499 if (value & 0x4) {
2500 tlb->prot |= PAGE_EXEC << 4;
2501 }
2502 if (value & 0x8) {
2503 tlb->prot |= PAGE_READ;
2504 }
2505 if (value & 0x10) {
2506 tlb->prot |= PAGE_WRITE;
2507 }
2508 if (value & 0x20) {
2509 tlb->prot |= PAGE_EXEC;
2510 }
2511 break;
2512 }
2513 }
2514
2515 target_ulong helper_440_tlbre(CPUPPCState *env, uint32_t word,
2516 target_ulong entry)
2517 {
2518 ppcemb_tlb_t *tlb;
2519 target_ulong ret;
2520 int size;
2521
2522 entry &= 0x3F;
2523 tlb = &env->tlb.tlbe[entry];
2524 switch (word) {
2525 default:
2526 /* Just here to please gcc */
2527 case 0:
2528 ret = tlb->EPN;
2529 size = booke_page_size_to_tlb(tlb->size);
2530 if (size < 0 || size > 0xF) {
2531 size = 1;
2532 }
2533 ret |= size << 4;
2534 if (tlb->attr & 0x1) {
2535 ret |= 0x100;
2536 }
2537 if (tlb->prot & PAGE_VALID) {
2538 ret |= 0x200;
2539 }
2540 env->spr[SPR_440_MMUCR] &= ~0x000000FF;
2541 env->spr[SPR_440_MMUCR] |= tlb->PID;
2542 break;
2543 case 1:
2544 ret = tlb->RPN;
2545 break;
2546 case 2:
2547 ret = tlb->attr & ~0x1;
2548 if (tlb->prot & (PAGE_READ << 4)) {
2549 ret |= 0x1;
2550 }
2551 if (tlb->prot & (PAGE_WRITE << 4)) {
2552 ret |= 0x2;
2553 }
2554 if (tlb->prot & (PAGE_EXEC << 4)) {
2555 ret |= 0x4;
2556 }
2557 if (tlb->prot & PAGE_READ) {
2558 ret |= 0x8;
2559 }
2560 if (tlb->prot & PAGE_WRITE) {
2561 ret |= 0x10;
2562 }
2563 if (tlb->prot & PAGE_EXEC) {
2564 ret |= 0x20;
2565 }
2566 break;
2567 }
2568 return ret;
2569 }
2570
2571 target_ulong helper_440_tlbsx(CPUPPCState *env, target_ulong address)
2572 {
2573 return ppcemb_tlb_search(env, address, env->spr[SPR_440_MMUCR] & 0xFF);
2574 }
2575
2576 /* PowerPC BookE 2.06 TLB management */
2577
2578 static ppcmas_tlb_t *booke206_cur_tlb(CPUPPCState *env)
2579 {
2580 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2581 uint32_t tlbncfg = 0;
2582 int esel = (env->spr[SPR_BOOKE_MAS0] & MAS0_ESEL_MASK) >> MAS0_ESEL_SHIFT;
2583 int ea = (env->spr[SPR_BOOKE_MAS2] & MAS2_EPN_MASK);
2584 int tlb;
2585
2586 tlb = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2587 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlb];
2588
2589 if ((tlbncfg & TLBnCFG_HES) && (env->spr[SPR_BOOKE_MAS0] & MAS0_HES)) {
2590 cpu_abort(CPU(cpu), "we don't support HES yet\n");
2591 }
2592
2593 return booke206_get_tlbm(env, tlb, ea, esel);
2594 }
2595
2596 void helper_booke_setpid(CPUPPCState *env, uint32_t pidn, target_ulong pid)
2597 {
2598 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2599
2600 env->spr[pidn] = pid;
2601 /* changing PIDs mean we're in a different address space now */
2602 tlb_flush(CPU(cpu), 1);
2603 }
2604
2605 void helper_booke206_tlbwe(CPUPPCState *env)
2606 {
2607 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2608 uint32_t tlbncfg, tlbn;
2609 ppcmas_tlb_t *tlb;
2610 uint32_t size_tlb, size_ps;
2611 target_ulong mask;
2612
2613
2614 switch (env->spr[SPR_BOOKE_MAS0] & MAS0_WQ_MASK) {
2615 case MAS0_WQ_ALWAYS:
2616 /* good to go, write that entry */
2617 break;
2618 case MAS0_WQ_COND:
2619 /* XXX check if reserved */
2620 if (0) {
2621 return;
2622 }
2623 break;
2624 case MAS0_WQ_CLR_RSRV:
2625 /* XXX clear entry */
2626 return;
2627 default:
2628 /* no idea what to do */
2629 return;
2630 }
2631
2632 if (((env->spr[SPR_BOOKE_MAS0] & MAS0_ATSEL) == MAS0_ATSEL_LRAT) &&
2633 !msr_gs) {
2634 /* XXX we don't support direct LRAT setting yet */
2635 fprintf(stderr, "cpu: don't support LRAT setting yet\n");
2636 return;
2637 }
2638
2639 tlbn = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2640 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlbn];
2641
2642 tlb = booke206_cur_tlb(env);
2643
2644 if (!tlb) {
2645 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
2646 POWERPC_EXCP_INVAL |
2647 POWERPC_EXCP_INVAL_INVAL);
2648 }
2649
2650 /* check that we support the targeted size */
2651 size_tlb = (env->spr[SPR_BOOKE_MAS1] & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
2652 size_ps = booke206_tlbnps(env, tlbn);
2653 if ((env->spr[SPR_BOOKE_MAS1] & MAS1_VALID) && (tlbncfg & TLBnCFG_AVAIL) &&
2654 !(size_ps & (1 << size_tlb))) {
2655 helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,
2656 POWERPC_EXCP_INVAL |
2657 POWERPC_EXCP_INVAL_INVAL);
2658 }
2659
2660 if (msr_gs) {
2661 cpu_abort(CPU(cpu), "missing HV implementation\n");
2662 }
2663 tlb->mas7_3 = ((uint64_t)env->spr[SPR_BOOKE_MAS7] << 32) |
2664 env->spr[SPR_BOOKE_MAS3];
2665 tlb->mas1 = env->spr[SPR_BOOKE_MAS1];
2666
2667 /* MAV 1.0 only */
2668 if (!(tlbncfg & TLBnCFG_AVAIL)) {
2669 /* force !AVAIL TLB entries to correct page size */
2670 tlb->mas1 &= ~MAS1_TSIZE_MASK;
2671 /* XXX can be configured in MMUCSR0 */
2672 tlb->mas1 |= (tlbncfg & TLBnCFG_MINSIZE) >> 12;
2673 }
2674
2675 /* Make a mask from TLB size to discard invalid bits in EPN field */
2676 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2677 /* Add a mask for page attributes */
2678 mask |= MAS2_ACM | MAS2_VLE | MAS2_W | MAS2_I | MAS2_M | MAS2_G | MAS2_E;
2679
2680 if (!msr_cm) {
2681 /* Executing a tlbwe instruction in 32-bit mode will set
2682 * bits 0:31 of the TLB EPN field to zero.
2683 */
2684 mask &= 0xffffffff;
2685 }
2686
2687 tlb->mas2 = env->spr[SPR_BOOKE_MAS2] & mask;
2688
2689 if (!(tlbncfg & TLBnCFG_IPROT)) {
2690 /* no IPROT supported by TLB */
2691 tlb->mas1 &= ~MAS1_IPROT;
2692 }
2693
2694 if (booke206_tlb_to_page_size(env, tlb) == TARGET_PAGE_SIZE) {
2695 tlb_flush_page(CPU(cpu), tlb->mas2 & MAS2_EPN_MASK);
2696 } else {
2697 tlb_flush(CPU(cpu), 1);
2698 }
2699 }
2700
2701 static inline void booke206_tlb_to_mas(CPUPPCState *env, ppcmas_tlb_t *tlb)
2702 {
2703 int tlbn = booke206_tlbm_to_tlbn(env, tlb);
2704 int way = booke206_tlbm_to_way(env, tlb);
2705
2706 env->spr[SPR_BOOKE_MAS0] = tlbn << MAS0_TLBSEL_SHIFT;
2707 env->spr[SPR_BOOKE_MAS0] |= way << MAS0_ESEL_SHIFT;
2708 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2709
2710 env->spr[SPR_BOOKE_MAS1] = tlb->mas1;
2711 env->spr[SPR_BOOKE_MAS2] = tlb->mas2;
2712 env->spr[SPR_BOOKE_MAS3] = tlb->mas7_3;
2713 env->spr[SPR_BOOKE_MAS7] = tlb->mas7_3 >> 32;
2714 }
2715
2716 void helper_booke206_tlbre(CPUPPCState *env)
2717 {
2718 ppcmas_tlb_t *tlb = NULL;
2719
2720 tlb = booke206_cur_tlb(env);
2721 if (!tlb) {
2722 env->spr[SPR_BOOKE_MAS1] = 0;
2723 } else {
2724 booke206_tlb_to_mas(env, tlb);
2725 }
2726 }
2727
2728 void helper_booke206_tlbsx(CPUPPCState *env, target_ulong address)
2729 {
2730 ppcmas_tlb_t *tlb = NULL;
2731 int i, j;
2732 hwaddr raddr;
2733 uint32_t spid, sas;
2734
2735 spid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID_MASK) >> MAS6_SPID_SHIFT;
2736 sas = env->spr[SPR_BOOKE_MAS6] & MAS6_SAS;
2737
2738 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2739 int ways = booke206_tlb_ways(env, i);
2740
2741 for (j = 0; j < ways; j++) {
2742 tlb = booke206_get_tlbm(env, i, address, j);
2743
2744 if (!tlb) {
2745 continue;
2746 }
2747
2748 if (ppcmas_tlb_check(env, tlb, &raddr, address, spid)) {
2749 continue;
2750 }
2751
2752 if (sas != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
2753 continue;
2754 }
2755
2756 booke206_tlb_to_mas(env, tlb);
2757 return;
2758 }
2759 }
2760
2761 /* no entry found, fill with defaults */
2762 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
2763 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
2764 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
2765 env->spr[SPR_BOOKE_MAS3] = 0;
2766 env->spr[SPR_BOOKE_MAS7] = 0;
2767
2768 if (env->spr[SPR_BOOKE_MAS6] & MAS6_SAS) {
2769 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
2770 }
2771
2772 env->spr[SPR_BOOKE_MAS1] |= (env->spr[SPR_BOOKE_MAS6] >> 16)
2773 << MAS1_TID_SHIFT;
2774
2775 /* next victim logic */
2776 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
2777 env->last_way++;
2778 env->last_way &= booke206_tlb_ways(env, 0) - 1;
2779 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2780 }
2781
2782 static inline void booke206_invalidate_ea_tlb(CPUPPCState *env, int tlbn,
2783 uint32_t ea)
2784 {
2785 int i;
2786 int ways = booke206_tlb_ways(env, tlbn);
2787 target_ulong mask;
2788
2789 for (i = 0; i < ways; i++) {
2790 ppcmas_tlb_t *tlb = booke206_get_tlbm(env, tlbn, ea, i);
2791 if (!tlb) {
2792 continue;
2793 }
2794 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2795 if (((tlb->mas2 & MAS2_EPN_MASK) == (ea & mask)) &&
2796 !(tlb->mas1 & MAS1_IPROT)) {
2797 tlb->mas1 &= ~MAS1_VALID;
2798 }
2799 }
2800 }
2801
2802 void helper_booke206_tlbivax(CPUPPCState *env, target_ulong address)
2803 {
2804 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2805
2806 if (address & 0x4) {
2807 /* flush all entries */
2808 if (address & 0x8) {
2809 /* flush all of TLB1 */
2810 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB1, 1);
2811 } else {
2812 /* flush all of TLB0 */
2813 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB0, 0);
2814 }
2815 return;
2816 }
2817
2818 if (address & 0x8) {
2819 /* flush TLB1 entries */
2820 booke206_invalidate_ea_tlb(env, 1, address);
2821 tlb_flush(CPU(cpu), 1);
2822 } else {
2823 /* flush TLB0 entries */
2824 booke206_invalidate_ea_tlb(env, 0, address);
2825 tlb_flush_page(CPU(cpu), address & MAS2_EPN_MASK);
2826 }
2827 }
2828
2829 void helper_booke206_tlbilx0(CPUPPCState *env, target_ulong address)
2830 {
2831 /* XXX missing LPID handling */
2832 booke206_flush_tlb(env, -1, 1);
2833 }
2834
2835 void helper_booke206_tlbilx1(CPUPPCState *env, target_ulong address)
2836 {
2837 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2838 int i, j;
2839 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
2840 ppcmas_tlb_t *tlb = env->tlb.tlbm;
2841 int tlb_size;
2842
2843 /* XXX missing LPID handling */
2844 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2845 tlb_size = booke206_tlb_size(env, i);
2846 for (j = 0; j < tlb_size; j++) {
2847 if (!(tlb[j].mas1 & MAS1_IPROT) &&
2848 ((tlb[j].mas1 & MAS1_TID_MASK) == tid)) {
2849 tlb[j].mas1 &= ~MAS1_VALID;
2850 }
2851 }
2852 tlb += booke206_tlb_size(env, i);
2853 }
2854 tlb_flush(CPU(cpu), 1);
2855 }
2856
2857 void helper_booke206_tlbilx3(CPUPPCState *env, target_ulong address)
2858 {
2859 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2860 int i, j;
2861 ppcmas_tlb_t *tlb;
2862 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
2863 int pid = tid >> MAS6_SPID_SHIFT;
2864 int sgs = env->spr[SPR_BOOKE_MAS5] & MAS5_SGS;
2865 int ind = (env->spr[SPR_BOOKE_MAS6] & MAS6_SIND) ? MAS1_IND : 0;
2866 /* XXX check for unsupported isize and raise an invalid opcode then */
2867 int size = env->spr[SPR_BOOKE_MAS6] & MAS6_ISIZE_MASK;
2868 /* XXX implement MAV2 handling */
2869 bool mav2 = false;
2870
2871 /* XXX missing LPID handling */
2872 /* flush by pid and ea */
2873 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2874 int ways = booke206_tlb_ways(env, i);
2875
2876 for (j = 0; j < ways; j++) {
2877 tlb = booke206_get_tlbm(env, i, address, j);
2878 if (!tlb) {
2879 continue;
2880 }
2881 if ((ppcmas_tlb_check(env, tlb, NULL, address, pid) != 0) ||
2882 (tlb->mas1 & MAS1_IPROT) ||
2883 ((tlb->mas1 & MAS1_IND) != ind) ||
2884 ((tlb->mas8 & MAS8_TGS) != sgs)) {
2885 continue;
2886 }
2887 if (mav2 && ((tlb->mas1 & MAS1_TSIZE_MASK) != size)) {
2888 /* XXX only check when MMUCFG[TWC] || TLBnCFG[HES] */
2889 continue;
2890 }
2891 /* XXX e500mc doesn't match SAS, but other cores might */
2892 tlb->mas1 &= ~MAS1_VALID;
2893 }
2894 }
2895 tlb_flush(CPU(cpu), 1);
2896 }
2897
2898 void helper_booke206_tlbflush(CPUPPCState *env, target_ulong type)
2899 {
2900 int flags = 0;
2901
2902 if (type & 2) {
2903 flags |= BOOKE206_FLUSH_TLB1;
2904 }
2905
2906 if (type & 4) {
2907 flags |= BOOKE206_FLUSH_TLB0;
2908 }
2909
2910 booke206_flush_tlb(env, flags, 1);
2911 }
2912
2913
2914 /*****************************************************************************/
2915
2916 /* try to fill the TLB and return an exception if error. If retaddr is
2917 NULL, it means that the function was called in C code (i.e. not
2918 from generated code or from helper.c) */
2919 /* XXX: fix it to restore all registers */
2920 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
2921 uintptr_t retaddr)
2922 {
2923 PowerPCCPU *cpu = POWERPC_CPU(cs);
2924 PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cs);
2925 CPUPPCState *env = &cpu->env;
2926 int ret;
2927
2928 if (pcc->handle_mmu_fault) {
2929 ret = pcc->handle_mmu_fault(cpu, addr, is_write, mmu_idx);
2930 } else {
2931 ret = cpu_ppc_handle_mmu_fault(env, addr, is_write, mmu_idx);
2932 }
2933 if (unlikely(ret != 0)) {
2934 if (likely(retaddr)) {
2935 /* now we have a real cpu fault */
2936 cpu_restore_state(cs, retaddr);
2937 }
2938 helper_raise_exception_err(env, cs->exception_index, env->error_code);
2939 }
2940 }
AR7 emulation for QEMU