2 * PowerPC exception emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19 #include "qemu/osdep.h"
20 #include "qemu/main-loop.h"
22 #include "exec/helper-proto.h"
23 #include "exec/exec-all.h"
24 #include "exec/cpu_ldst.h"
26 #include "helper_regs.h"
29 //#define DEBUG_SOFTWARE_TLB
30 //#define DEBUG_EXCEPTIONS
32 #ifdef DEBUG_EXCEPTIONS
33 # define LOG_EXCP(...) qemu_log(__VA_ARGS__)
35 # define LOG_EXCP(...) do { } while (0)
38 /*****************************************************************************/
39 /* Exception processing */
40 #if defined(CONFIG_USER_ONLY)
41 void ppc_cpu_do_interrupt(CPUState
*cs
)
43 PowerPCCPU
*cpu
= POWERPC_CPU(cs
);
44 CPUPPCState
*env
= &cpu
->env
;
46 cs
->exception_index
= POWERPC_EXCP_NONE
;
50 static void ppc_hw_interrupt(CPUPPCState
*env
)
52 CPUState
*cs
= CPU(ppc_env_get_cpu(env
));
54 cs
->exception_index
= POWERPC_EXCP_NONE
;
57 #else /* defined(CONFIG_USER_ONLY) */
58 static inline void dump_syscall(CPUPPCState
*env
)
60 qemu_log_mask(CPU_LOG_INT
, "syscall r0=%016" PRIx64
" r3=%016" PRIx64
61 " r4=%016" PRIx64
" r5=%016" PRIx64
" r6=%016" PRIx64
62 " nip=" TARGET_FMT_lx
"\n",
63 ppc_dump_gpr(env
, 0), ppc_dump_gpr(env
, 3),
64 ppc_dump_gpr(env
, 4), ppc_dump_gpr(env
, 5),
65 ppc_dump_gpr(env
, 6), env
->nip
);
68 static int powerpc_reset_wakeup(CPUState
*cs
, CPUPPCState
*env
, int excp
,
71 /* We no longer are in a PM state */
72 env
->resume_as_sreset
= false;
74 /* Pretend to be returning from doze always as we don't lose state */
75 *msr
|= (0x1ull
<< (63 - 47));
77 /* Machine checks are sent normally */
78 if (excp
== POWERPC_EXCP_MCHECK
) {
82 case POWERPC_EXCP_RESET
:
83 *msr
|= 0x4ull
<< (63 - 45);
85 case POWERPC_EXCP_EXTERNAL
:
86 *msr
|= 0x8ull
<< (63 - 45);
88 case POWERPC_EXCP_DECR
:
89 *msr
|= 0x6ull
<< (63 - 45);
91 case POWERPC_EXCP_SDOOR
:
92 *msr
|= 0x5ull
<< (63 - 45);
94 case POWERPC_EXCP_SDOOR_HV
:
95 *msr
|= 0x3ull
<< (63 - 45);
97 case POWERPC_EXCP_HV_MAINT
:
98 *msr
|= 0xaull
<< (63 - 45);
100 case POWERPC_EXCP_HVIRT
:
101 *msr
|= 0x9ull
<< (63 - 45);
104 cpu_abort(cs
, "Unsupported exception %d in Power Save mode\n",
107 return POWERPC_EXCP_RESET
;
110 static uint64_t ppc_excp_vector_offset(CPUState
*cs
, int ail
)
118 case AIL_C000_0000_0000_4000
:
119 offset
= 0xc000000000004000ull
;
122 cpu_abort(cs
, "Invalid AIL combination %d\n", ail
);
129 /* Note that this function should be greatly optimized
130 * when called with a constant excp, from ppc_hw_interrupt
132 static inline void powerpc_excp(PowerPCCPU
*cpu
, int excp_model
, int excp
)
134 CPUState
*cs
= CPU(cpu
);
135 CPUPPCState
*env
= &cpu
->env
;
136 target_ulong msr
, new_msr
, vector
;
137 int srr0
, srr1
, asrr0
, asrr1
, lev
, ail
;
140 qemu_log_mask(CPU_LOG_INT
, "Raise exception at " TARGET_FMT_lx
141 " => %08x (%02x)\n", env
->nip
, excp
, env
->error_code
);
143 /* new srr1 value excluding must-be-zero bits */
144 if (excp_model
== POWERPC_EXCP_BOOKE
) {
147 msr
= env
->msr
& ~0x783f0000ULL
;
150 /* new interrupt handler msr preserves existing HV and ME unless
151 * explicitly overriden
153 new_msr
= env
->msr
& (((target_ulong
)1 << MSR_ME
) | MSR_HVB
);
155 /* target registers */
162 * check for special resume at 0x100 from doze/nap/sleep/winkle on
165 if (env
->resume_as_sreset
) {
166 excp
= powerpc_reset_wakeup(cs
, env
, excp
, &msr
);
169 /* Exception targetting modifiers
171 * LPES0 is supported on POWER7/8/9
172 * LPES1 is not supported (old iSeries mode)
174 * On anything else, we behave as if LPES0 is 1
175 * (externals don't alter MSR:HV)
177 * AIL is initialized here but can be cleared by
178 * selected exceptions
180 #if defined(TARGET_PPC64)
181 if (excp_model
== POWERPC_EXCP_POWER7
||
182 excp_model
== POWERPC_EXCP_POWER8
||
183 excp_model
== POWERPC_EXCP_POWER9
) {
184 lpes0
= !!(env
->spr
[SPR_LPCR
] & LPCR_LPES0
);
185 if (excp_model
!= POWERPC_EXCP_POWER7
) {
186 ail
= (env
->spr
[SPR_LPCR
] & LPCR_AIL
) >> LPCR_AIL_SHIFT
;
191 #endif /* defined(TARGET_PPC64) */
197 /* Hypervisor emulation assistance interrupt only exists on server
198 * arch 2.05 server or later. We also don't want to generate it if
199 * we don't have HVB in msr_mask (PAPR mode).
201 if (excp
== POWERPC_EXCP_HV_EMU
202 #if defined(TARGET_PPC64)
203 && !((env
->mmu_model
& POWERPC_MMU_64
) && (env
->msr_mask
& MSR_HVB
))
204 #endif /* defined(TARGET_PPC64) */
207 excp
= POWERPC_EXCP_PROGRAM
;
211 case POWERPC_EXCP_NONE
:
212 /* Should never happen */
214 case POWERPC_EXCP_CRITICAL
: /* Critical input */
215 switch (excp_model
) {
216 case POWERPC_EXCP_40x
:
220 case POWERPC_EXCP_BOOKE
:
221 srr0
= SPR_BOOKE_CSRR0
;
222 srr1
= SPR_BOOKE_CSRR1
;
224 case POWERPC_EXCP_G2
:
230 case POWERPC_EXCP_MCHECK
: /* Machine check exception */
232 /* Machine check exception is not enabled.
233 * Enter checkstop state.
235 fprintf(stderr
, "Machine check while not allowed. "
236 "Entering checkstop state\n");
237 if (qemu_log_separate()) {
238 qemu_log("Machine check while not allowed. "
239 "Entering checkstop state\n");
242 cpu_interrupt_exittb(cs
);
244 if (env
->msr_mask
& MSR_HVB
) {
245 /* ISA specifies HV, but can be delivered to guest with HV clear
246 * (e.g., see FWNMI in PAPR).
248 new_msr
|= (target_ulong
)MSR_HVB
;
252 /* machine check exceptions don't have ME set */
253 new_msr
&= ~((target_ulong
)1 << MSR_ME
);
255 /* XXX: should also have something loaded in DAR / DSISR */
256 switch (excp_model
) {
257 case POWERPC_EXCP_40x
:
261 case POWERPC_EXCP_BOOKE
:
262 /* FIXME: choose one or the other based on CPU type */
263 srr0
= SPR_BOOKE_MCSRR0
;
264 srr1
= SPR_BOOKE_MCSRR1
;
265 asrr0
= SPR_BOOKE_CSRR0
;
266 asrr1
= SPR_BOOKE_CSRR1
;
272 case POWERPC_EXCP_DSI
: /* Data storage exception */
273 LOG_EXCP("DSI exception: DSISR=" TARGET_FMT_lx
" DAR=" TARGET_FMT_lx
274 "\n", env
->spr
[SPR_DSISR
], env
->spr
[SPR_DAR
]);
276 case POWERPC_EXCP_ISI
: /* Instruction storage exception */
277 LOG_EXCP("ISI exception: msr=" TARGET_FMT_lx
", nip=" TARGET_FMT_lx
278 "\n", msr
, env
->nip
);
279 msr
|= env
->error_code
;
281 case POWERPC_EXCP_EXTERNAL
: /* External input */
285 new_msr
|= (target_ulong
)MSR_HVB
;
286 new_msr
|= env
->msr
& ((target_ulong
)1 << MSR_RI
);
290 if (env
->mpic_proxy
) {
291 /* IACK the IRQ on delivery */
292 env
->spr
[SPR_BOOKE_EPR
] = ldl_phys(cs
->as
, env
->mpic_iack
);
295 case POWERPC_EXCP_ALIGN
: /* Alignment exception */
296 /* Get rS/rD and rA from faulting opcode */
297 /* Note: the opcode fields will not be set properly for a direct
298 * store load/store, but nobody cares as nobody actually uses
299 * direct store segments.
301 env
->spr
[SPR_DSISR
] |= (env
->error_code
& 0x03FF0000) >> 16;
303 case POWERPC_EXCP_PROGRAM
: /* Program exception */
304 switch (env
->error_code
& ~0xF) {
305 case POWERPC_EXCP_FP
:
306 if ((msr_fe0
== 0 && msr_fe1
== 0) || msr_fp
== 0) {
307 LOG_EXCP("Ignore floating point exception\n");
308 cs
->exception_index
= POWERPC_EXCP_NONE
;
313 /* FP exceptions always have NIP pointing to the faulting
314 * instruction, so always use store_next and claim we are
315 * precise in the MSR.
318 env
->spr
[SPR_BOOKE_ESR
] = ESR_FP
;
320 case POWERPC_EXCP_INVAL
:
321 LOG_EXCP("Invalid instruction at " TARGET_FMT_lx
"\n", env
->nip
);
323 env
->spr
[SPR_BOOKE_ESR
] = ESR_PIL
;
325 case POWERPC_EXCP_PRIV
:
327 env
->spr
[SPR_BOOKE_ESR
] = ESR_PPR
;
329 case POWERPC_EXCP_TRAP
:
331 env
->spr
[SPR_BOOKE_ESR
] = ESR_PTR
;
334 /* Should never occur */
335 cpu_abort(cs
, "Invalid program exception %d. Aborting\n",
340 case POWERPC_EXCP_SYSCALL
: /* System call exception */
342 lev
= env
->error_code
;
344 /* We need to correct the NIP which in this case is supposed
345 * to point to the next instruction
349 /* "PAPR mode" built-in hypercall emulation */
350 if ((lev
== 1) && cpu
->vhyp
) {
351 PPCVirtualHypervisorClass
*vhc
=
352 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu
->vhyp
);
353 vhc
->hypercall(cpu
->vhyp
, cpu
);
357 new_msr
|= (target_ulong
)MSR_HVB
;
360 case POWERPC_EXCP_FPU
: /* Floating-point unavailable exception */
361 case POWERPC_EXCP_APU
: /* Auxiliary processor unavailable */
362 case POWERPC_EXCP_DECR
: /* Decrementer exception */
364 case POWERPC_EXCP_FIT
: /* Fixed-interval timer interrupt */
366 LOG_EXCP("FIT exception\n");
368 case POWERPC_EXCP_WDT
: /* Watchdog timer interrupt */
369 LOG_EXCP("WDT exception\n");
370 switch (excp_model
) {
371 case POWERPC_EXCP_BOOKE
:
372 srr0
= SPR_BOOKE_CSRR0
;
373 srr1
= SPR_BOOKE_CSRR1
;
379 case POWERPC_EXCP_DTLB
: /* Data TLB error */
380 case POWERPC_EXCP_ITLB
: /* Instruction TLB error */
382 case POWERPC_EXCP_DEBUG
: /* Debug interrupt */
383 if (env
->flags
& POWERPC_FLAG_DE
) {
384 /* FIXME: choose one or the other based on CPU type */
385 srr0
= SPR_BOOKE_DSRR0
;
386 srr1
= SPR_BOOKE_DSRR1
;
387 asrr0
= SPR_BOOKE_CSRR0
;
388 asrr1
= SPR_BOOKE_CSRR1
;
389 /* DBSR already modified by caller */
391 cpu_abort(cs
, "Debug exception triggered on unsupported model\n");
394 case POWERPC_EXCP_SPEU
: /* SPE/embedded floating-point unavailable */
395 env
->spr
[SPR_BOOKE_ESR
] = ESR_SPV
;
397 case POWERPC_EXCP_EFPDI
: /* Embedded floating-point data interrupt */
399 cpu_abort(cs
, "Embedded floating point data exception "
400 "is not implemented yet !\n");
401 env
->spr
[SPR_BOOKE_ESR
] = ESR_SPV
;
403 case POWERPC_EXCP_EFPRI
: /* Embedded floating-point round interrupt */
405 cpu_abort(cs
, "Embedded floating point round exception "
406 "is not implemented yet !\n");
407 env
->spr
[SPR_BOOKE_ESR
] = ESR_SPV
;
409 case POWERPC_EXCP_EPERFM
: /* Embedded performance monitor interrupt */
412 "Performance counter exception is not implemented yet !\n");
414 case POWERPC_EXCP_DOORI
: /* Embedded doorbell interrupt */
416 case POWERPC_EXCP_DOORCI
: /* Embedded doorbell critical interrupt */
417 srr0
= SPR_BOOKE_CSRR0
;
418 srr1
= SPR_BOOKE_CSRR1
;
420 case POWERPC_EXCP_RESET
: /* System reset exception */
421 /* A power-saving exception sets ME, otherwise it is unchanged */
423 /* indicate that we resumed from power save mode */
425 new_msr
|= ((target_ulong
)1 << MSR_ME
);
427 if (env
->msr_mask
& MSR_HVB
) {
428 /* ISA specifies HV, but can be delivered to guest with HV clear
429 * (e.g., see FWNMI in PAPR, NMI injection in QEMU).
431 new_msr
|= (target_ulong
)MSR_HVB
;
434 cpu_abort(cs
, "Trying to deliver power-saving system reset "
435 "exception %d with no HV support\n", excp
);
440 case POWERPC_EXCP_DSEG
: /* Data segment exception */
441 case POWERPC_EXCP_ISEG
: /* Instruction segment exception */
442 case POWERPC_EXCP_TRACE
: /* Trace exception */
444 case POWERPC_EXCP_HDECR
: /* Hypervisor decrementer exception */
445 case POWERPC_EXCP_HDSI
: /* Hypervisor data storage exception */
446 case POWERPC_EXCP_HISI
: /* Hypervisor instruction storage exception */
447 case POWERPC_EXCP_HDSEG
: /* Hypervisor data segment exception */
448 case POWERPC_EXCP_HISEG
: /* Hypervisor instruction segment exception */
449 case POWERPC_EXCP_SDOOR_HV
: /* Hypervisor Doorbell interrupt */
450 case POWERPC_EXCP_HV_EMU
:
451 case POWERPC_EXCP_HVIRT
: /* Hypervisor virtualization */
454 new_msr
|= (target_ulong
)MSR_HVB
;
455 new_msr
|= env
->msr
& ((target_ulong
)1 << MSR_RI
);
457 case POWERPC_EXCP_VPU
: /* Vector unavailable exception */
458 case POWERPC_EXCP_VSXU
: /* VSX unavailable exception */
459 case POWERPC_EXCP_FU
: /* Facility unavailable exception */
461 env
->spr
[SPR_FSCR
] |= ((target_ulong
)env
->error_code
<< 56);
464 case POWERPC_EXCP_PIT
: /* Programmable interval timer interrupt */
465 LOG_EXCP("PIT exception\n");
467 case POWERPC_EXCP_IO
: /* IO error exception */
469 cpu_abort(cs
, "601 IO error exception is not implemented yet !\n");
471 case POWERPC_EXCP_RUNM
: /* Run mode exception */
473 cpu_abort(cs
, "601 run mode exception is not implemented yet !\n");
475 case POWERPC_EXCP_EMUL
: /* Emulation trap exception */
477 cpu_abort(cs
, "602 emulation trap exception "
478 "is not implemented yet !\n");
480 case POWERPC_EXCP_IFTLB
: /* Instruction fetch TLB error */
481 switch (excp_model
) {
482 case POWERPC_EXCP_602
:
483 case POWERPC_EXCP_603
:
484 case POWERPC_EXCP_603E
:
485 case POWERPC_EXCP_G2
:
487 case POWERPC_EXCP_7x5
:
489 case POWERPC_EXCP_74xx
:
492 cpu_abort(cs
, "Invalid instruction TLB miss exception\n");
496 case POWERPC_EXCP_DLTLB
: /* Data load TLB miss */
497 switch (excp_model
) {
498 case POWERPC_EXCP_602
:
499 case POWERPC_EXCP_603
:
500 case POWERPC_EXCP_603E
:
501 case POWERPC_EXCP_G2
:
503 case POWERPC_EXCP_7x5
:
505 case POWERPC_EXCP_74xx
:
508 cpu_abort(cs
, "Invalid data load TLB miss exception\n");
512 case POWERPC_EXCP_DSTLB
: /* Data store TLB miss */
513 switch (excp_model
) {
514 case POWERPC_EXCP_602
:
515 case POWERPC_EXCP_603
:
516 case POWERPC_EXCP_603E
:
517 case POWERPC_EXCP_G2
:
519 /* Swap temporary saved registers with GPRs */
520 if (!(new_msr
& ((target_ulong
)1 << MSR_TGPR
))) {
521 new_msr
|= (target_ulong
)1 << MSR_TGPR
;
522 hreg_swap_gpr_tgpr(env
);
525 case POWERPC_EXCP_7x5
:
527 #if defined(DEBUG_SOFTWARE_TLB)
528 if (qemu_log_enabled()) {
530 target_ulong
*miss
, *cmp
;
533 if (excp
== POWERPC_EXCP_IFTLB
) {
536 miss
= &env
->spr
[SPR_IMISS
];
537 cmp
= &env
->spr
[SPR_ICMP
];
539 if (excp
== POWERPC_EXCP_DLTLB
) {
545 miss
= &env
->spr
[SPR_DMISS
];
546 cmp
= &env
->spr
[SPR_DCMP
];
548 qemu_log("6xx %sTLB miss: %cM " TARGET_FMT_lx
" %cC "
549 TARGET_FMT_lx
" H1 " TARGET_FMT_lx
" H2 "
550 TARGET_FMT_lx
" %08x\n", es
, en
, *miss
, en
, *cmp
,
551 env
->spr
[SPR_HASH1
], env
->spr
[SPR_HASH2
],
555 msr
|= env
->crf
[0] << 28;
556 msr
|= env
->error_code
; /* key, D/I, S/L bits */
557 /* Set way using a LRU mechanism */
558 msr
|= ((env
->last_way
+ 1) & (env
->nb_ways
- 1)) << 17;
560 case POWERPC_EXCP_74xx
:
562 #if defined(DEBUG_SOFTWARE_TLB)
563 if (qemu_log_enabled()) {
565 target_ulong
*miss
, *cmp
;
568 if (excp
== POWERPC_EXCP_IFTLB
) {
571 miss
= &env
->spr
[SPR_TLBMISS
];
572 cmp
= &env
->spr
[SPR_PTEHI
];
574 if (excp
== POWERPC_EXCP_DLTLB
) {
580 miss
= &env
->spr
[SPR_TLBMISS
];
581 cmp
= &env
->spr
[SPR_PTEHI
];
583 qemu_log("74xx %sTLB miss: %cM " TARGET_FMT_lx
" %cC "
584 TARGET_FMT_lx
" %08x\n", es
, en
, *miss
, en
, *cmp
,
588 msr
|= env
->error_code
; /* key bit */
591 cpu_abort(cs
, "Invalid data store TLB miss exception\n");
595 case POWERPC_EXCP_FPA
: /* Floating-point assist exception */
597 cpu_abort(cs
, "Floating point assist exception "
598 "is not implemented yet !\n");
600 case POWERPC_EXCP_DABR
: /* Data address breakpoint */
602 cpu_abort(cs
, "DABR exception is not implemented yet !\n");
604 case POWERPC_EXCP_IABR
: /* Instruction address breakpoint */
606 cpu_abort(cs
, "IABR exception is not implemented yet !\n");
608 case POWERPC_EXCP_SMI
: /* System management interrupt */
610 cpu_abort(cs
, "SMI exception is not implemented yet !\n");
612 case POWERPC_EXCP_THERM
: /* Thermal interrupt */
614 cpu_abort(cs
, "Thermal management exception "
615 "is not implemented yet !\n");
617 case POWERPC_EXCP_PERFM
: /* Embedded performance monitor interrupt */
620 "Performance counter exception is not implemented yet !\n");
622 case POWERPC_EXCP_VPUA
: /* Vector assist exception */
624 cpu_abort(cs
, "VPU assist exception is not implemented yet !\n");
626 case POWERPC_EXCP_SOFTP
: /* Soft patch exception */
629 "970 soft-patch exception is not implemented yet !\n");
631 case POWERPC_EXCP_MAINT
: /* Maintenance exception */
634 "970 maintenance exception is not implemented yet !\n");
636 case POWERPC_EXCP_MEXTBR
: /* Maskable external breakpoint */
638 cpu_abort(cs
, "Maskable external exception "
639 "is not implemented yet !\n");
641 case POWERPC_EXCP_NMEXTBR
: /* Non maskable external breakpoint */
643 cpu_abort(cs
, "Non maskable external exception "
644 "is not implemented yet !\n");
648 cpu_abort(cs
, "Invalid PowerPC exception %d. Aborting\n", excp
);
653 env
->spr
[srr0
] = env
->nip
;
656 env
->spr
[srr1
] = msr
;
659 if (!(env
->msr_mask
& MSR_HVB
)) {
660 if (new_msr
& MSR_HVB
) {
661 cpu_abort(cs
, "Trying to deliver HV exception (MSR) %d with "
662 "no HV support\n", excp
);
664 if (srr0
== SPR_HSRR0
) {
665 cpu_abort(cs
, "Trying to deliver HV exception (HSRR) %d with "
666 "no HV support\n", excp
);
670 /* If any alternate SRR register are defined, duplicate saved values */
672 env
->spr
[asrr0
] = env
->spr
[srr0
];
675 env
->spr
[asrr1
] = env
->spr
[srr1
];
678 /* Sort out endianness of interrupt, this differs depending on the
679 * CPU, the HV mode, etc...
682 if (excp_model
== POWERPC_EXCP_POWER7
) {
683 if (!(new_msr
& MSR_HVB
) && (env
->spr
[SPR_LPCR
] & LPCR_ILE
)) {
684 new_msr
|= (target_ulong
)1 << MSR_LE
;
686 } else if (excp_model
== POWERPC_EXCP_POWER8
) {
687 if (new_msr
& MSR_HVB
) {
688 if (env
->spr
[SPR_HID0
] & HID0_HILE
) {
689 new_msr
|= (target_ulong
)1 << MSR_LE
;
691 } else if (env
->spr
[SPR_LPCR
] & LPCR_ILE
) {
692 new_msr
|= (target_ulong
)1 << MSR_LE
;
694 } else if (excp_model
== POWERPC_EXCP_POWER9
) {
695 if (new_msr
& MSR_HVB
) {
696 if (env
->spr
[SPR_HID0
] & HID0_POWER9_HILE
) {
697 new_msr
|= (target_ulong
)1 << MSR_LE
;
699 } else if (env
->spr
[SPR_LPCR
] & LPCR_ILE
) {
700 new_msr
|= (target_ulong
)1 << MSR_LE
;
702 } else if (msr_ile
) {
703 new_msr
|= (target_ulong
)1 << MSR_LE
;
707 new_msr
|= (target_ulong
)1 << MSR_LE
;
711 /* Jump to handler */
712 vector
= env
->excp_vectors
[excp
];
713 if (vector
== (target_ulong
)-1ULL) {
714 cpu_abort(cs
, "Raised an exception without defined vector %d\n",
717 vector
|= env
->excp_prefix
;
719 /* AIL only works if there is no HV transition and we are running with
720 * translations enabled
722 if (!((msr
>> MSR_IR
) & 1) || !((msr
>> MSR_DR
) & 1) ||
723 ((new_msr
& MSR_HVB
) && !(msr
& MSR_HVB
))) {
728 new_msr
|= (1 << MSR_IR
) | (1 << MSR_DR
);
729 vector
|= ppc_excp_vector_offset(cs
, ail
);
732 #if defined(TARGET_PPC64)
733 if (excp_model
== POWERPC_EXCP_BOOKE
) {
734 if (env
->spr
[SPR_BOOKE_EPCR
] & EPCR_ICM
) {
735 /* Cat.64-bit: EPCR.ICM is copied to MSR.CM */
736 new_msr
|= (target_ulong
)1 << MSR_CM
;
738 vector
= (uint32_t)vector
;
741 if (!msr_isf
&& !(env
->mmu_model
& POWERPC_MMU_64
)) {
742 vector
= (uint32_t)vector
;
744 new_msr
|= (target_ulong
)1 << MSR_SF
;
748 /* We don't use hreg_store_msr here as already have treated
749 * any special case that could occur. Just store MSR and update hflags
751 * Note: We *MUST* not use hreg_store_msr() as-is anyway because it
752 * will prevent setting of the HV bit which some exceptions might need
755 env
->msr
= new_msr
& env
->msr_mask
;
756 hreg_compute_hflags(env
);
758 /* Reset exception state */
759 cs
->exception_index
= POWERPC_EXCP_NONE
;
762 /* Reset the reservation */
763 env
->reserve_addr
= -1;
765 /* Any interrupt is context synchronizing, check if TCG TLB
766 * needs a delayed flush on ppc64
768 check_tlb_flush(env
, false);
771 void ppc_cpu_do_interrupt(CPUState
*cs
)
773 PowerPCCPU
*cpu
= POWERPC_CPU(cs
);
774 CPUPPCState
*env
= &cpu
->env
;
776 powerpc_excp(cpu
, env
->excp_model
, cs
->exception_index
);
779 static void ppc_hw_interrupt(CPUPPCState
*env
)
781 PowerPCCPU
*cpu
= ppc_env_get_cpu(env
);
785 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_RESET
)) {
786 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_RESET
);
787 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_RESET
);
790 /* Machine check exception */
791 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_MCK
)) {
792 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_MCK
);
793 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_MCHECK
);
797 /* External debug exception */
798 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_DEBUG
)) {
799 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_DEBUG
);
800 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_DEBUG
);
806 * For interrupts that gate on MSR:EE, we need to do something a
807 * bit more subtle, as we need to let them through even when EE is
808 * clear when coming out of some power management states (in order
809 * for them to become a 0x100).
811 async_deliver
= (msr_ee
!= 0) || env
->resume_as_sreset
;
813 /* Hypervisor decrementer exception */
814 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_HDECR
)) {
815 /* LPCR will be clear when not supported so this will work */
816 bool hdice
= !!(env
->spr
[SPR_LPCR
] & LPCR_HDICE
);
817 if ((async_deliver
|| msr_hv
== 0) && hdice
) {
818 /* HDEC clears on delivery */
819 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_HDECR
);
820 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_HDECR
);
825 /* Hypervisor virtualization interrupt */
826 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_HVIRT
)) {
827 /* LPCR will be clear when not supported so this will work */
828 bool hvice
= !!(env
->spr
[SPR_LPCR
] & LPCR_HVICE
);
829 if ((async_deliver
|| msr_hv
== 0) && hvice
) {
830 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_HVIRT
);
835 /* External interrupt can ignore MSR:EE under some circumstances */
836 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_EXT
)) {
837 bool lpes0
= !!(env
->spr
[SPR_LPCR
] & LPCR_LPES0
);
838 bool heic
= !!(env
->spr
[SPR_LPCR
] & LPCR_HEIC
);
839 /* HEIC blocks delivery to the hypervisor */
840 if ((async_deliver
&& !(heic
&& msr_hv
&& !msr_pr
)) ||
841 (env
->has_hv_mode
&& msr_hv
== 0 && !lpes0
)) {
842 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_EXTERNAL
);
847 /* External critical interrupt */
848 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_CEXT
)) {
849 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_CRITICAL
);
853 if (async_deliver
!= 0) {
854 /* Watchdog timer on embedded PowerPC */
855 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_WDT
)) {
856 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_WDT
);
857 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_WDT
);
860 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_CDOORBELL
)) {
861 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_CDOORBELL
);
862 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_DOORCI
);
865 /* Fixed interval timer on embedded PowerPC */
866 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_FIT
)) {
867 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_FIT
);
868 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_FIT
);
871 /* Programmable interval timer on embedded PowerPC */
872 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_PIT
)) {
873 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_PIT
);
874 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_PIT
);
877 /* Decrementer exception */
878 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_DECR
)) {
879 if (ppc_decr_clear_on_delivery(env
)) {
880 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_DECR
);
882 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_DECR
);
885 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_DOORBELL
)) {
886 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_DOORBELL
);
887 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_DOORI
);
890 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_HDOORBELL
)) {
891 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_HDOORBELL
);
892 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_SDOOR_HV
);
895 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_PERFM
)) {
896 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_PERFM
);
897 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_PERFM
);
900 /* Thermal interrupt */
901 if (env
->pending_interrupts
& (1 << PPC_INTERRUPT_THERM
)) {
902 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_THERM
);
903 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_THERM
);
908 if (env
->resume_as_sreset
) {
910 * This is a bug ! It means that has_work took us out of halt without
911 * anything to deliver while in a PM state that requires getting
914 * This means we will incorrectly execute past the power management
915 * instruction instead of triggering a reset.
917 * It generally means a discrepancy between the wakup conditions in the
918 * processor has_work implementation and the logic in this function.
920 cpu_abort(CPU(ppc_env_get_cpu(env
)),
921 "Wakeup from PM state but interrupt Undelivered");
925 void ppc_cpu_do_system_reset(CPUState
*cs
)
927 PowerPCCPU
*cpu
= POWERPC_CPU(cs
);
928 CPUPPCState
*env
= &cpu
->env
;
930 powerpc_excp(cpu
, env
->excp_model
, POWERPC_EXCP_RESET
);
932 #endif /* !CONFIG_USER_ONLY */
934 bool ppc_cpu_exec_interrupt(CPUState
*cs
, int interrupt_request
)
936 PowerPCCPU
*cpu
= POWERPC_CPU(cs
);
937 CPUPPCState
*env
= &cpu
->env
;
939 if (interrupt_request
& CPU_INTERRUPT_HARD
) {
940 ppc_hw_interrupt(env
);
941 if (env
->pending_interrupts
== 0) {
942 cs
->interrupt_request
&= ~CPU_INTERRUPT_HARD
;
949 #if defined(DEBUG_OP)
950 static void cpu_dump_rfi(target_ulong RA
, target_ulong msr
)
952 qemu_log("Return from exception at " TARGET_FMT_lx
" with flags "
953 TARGET_FMT_lx
"\n", RA
, msr
);
957 /*****************************************************************************/
958 /* Exceptions processing helpers */
960 void raise_exception_err_ra(CPUPPCState
*env
, uint32_t exception
,
961 uint32_t error_code
, uintptr_t raddr
)
963 CPUState
*cs
= CPU(ppc_env_get_cpu(env
));
965 cs
->exception_index
= exception
;
966 env
->error_code
= error_code
;
967 cpu_loop_exit_restore(cs
, raddr
);
970 void raise_exception_err(CPUPPCState
*env
, uint32_t exception
,
973 raise_exception_err_ra(env
, exception
, error_code
, 0);
976 void raise_exception(CPUPPCState
*env
, uint32_t exception
)
978 raise_exception_err_ra(env
, exception
, 0, 0);
981 void raise_exception_ra(CPUPPCState
*env
, uint32_t exception
,
984 raise_exception_err_ra(env
, exception
, 0, raddr
);
987 void helper_raise_exception_err(CPUPPCState
*env
, uint32_t exception
,
990 raise_exception_err_ra(env
, exception
, error_code
, 0);
993 void helper_raise_exception(CPUPPCState
*env
, uint32_t exception
)
995 raise_exception_err_ra(env
, exception
, 0, 0);
998 #if !defined(CONFIG_USER_ONLY)
999 void helper_store_msr(CPUPPCState
*env
, target_ulong val
)
1001 uint32_t excp
= hreg_store_msr(env
, val
, 0);
1004 CPUState
*cs
= CPU(ppc_env_get_cpu(env
));
1005 cpu_interrupt_exittb(cs
);
1006 raise_exception(env
, excp
);
1010 #if defined(TARGET_PPC64)
1011 void helper_pminsn(CPUPPCState
*env
, powerpc_pm_insn_t insn
)
1015 cs
= CPU(ppc_env_get_cpu(env
));
1018 /* The architecture specifies that HDEC interrupts are
1019 * discarded in PM states
1021 env
->pending_interrupts
&= ~(1 << PPC_INTERRUPT_HDECR
);
1023 /* Condition for waking up at 0x100 */
1024 env
->resume_as_sreset
= (insn
!= PPC_PM_STOP
) ||
1025 (env
->spr
[SPR_PSSCR
] & PSSCR_EC
);
1027 #endif /* defined(TARGET_PPC64) */
1029 static inline void do_rfi(CPUPPCState
*env
, target_ulong nip
, target_ulong msr
)
1031 CPUState
*cs
= CPU(ppc_env_get_cpu(env
));
1033 /* MSR:POW cannot be set by any form of rfi */
1034 msr
&= ~(1ULL << MSR_POW
);
1036 #if defined(TARGET_PPC64)
1037 /* Switching to 32-bit ? Crop the nip */
1038 if (!msr_is_64bit(env
, msr
)) {
1039 nip
= (uint32_t)nip
;
1042 nip
= (uint32_t)nip
;
1044 /* XXX: beware: this is false if VLE is supported */
1045 env
->nip
= nip
& ~((target_ulong
)0x00000003);
1046 hreg_store_msr(env
, msr
, 1);
1047 #if defined(DEBUG_OP)
1048 cpu_dump_rfi(env
->nip
, env
->msr
);
1050 /* No need to raise an exception here,
1051 * as rfi is always the last insn of a TB
1053 cpu_interrupt_exittb(cs
);
1054 /* Reset the reservation */
1055 env
->reserve_addr
= -1;
1057 /* Context synchronizing: check if TCG TLB needs flush */
1058 check_tlb_flush(env
, false);
1061 void helper_rfi(CPUPPCState
*env
)
1063 do_rfi(env
, env
->spr
[SPR_SRR0
], env
->spr
[SPR_SRR1
] & 0xfffffffful
);
1066 #define MSR_BOOK3S_MASK
1067 #if defined(TARGET_PPC64)
1068 void helper_rfid(CPUPPCState
*env
)
1070 /* The architeture defines a number of rules for which bits
1071 * can change but in practice, we handle this in hreg_store_msr()
1072 * which will be called by do_rfi(), so there is no need to filter
1075 do_rfi(env
, env
->spr
[SPR_SRR0
], env
->spr
[SPR_SRR1
]);
1078 void helper_hrfid(CPUPPCState
*env
)
1080 do_rfi(env
, env
->spr
[SPR_HSRR0
], env
->spr
[SPR_HSRR1
]);
1084 /*****************************************************************************/
1085 /* Embedded PowerPC specific helpers */
1086 void helper_40x_rfci(CPUPPCState
*env
)
1088 do_rfi(env
, env
->spr
[SPR_40x_SRR2
], env
->spr
[SPR_40x_SRR3
]);
1091 void helper_rfci(CPUPPCState
*env
)
1093 do_rfi(env
, env
->spr
[SPR_BOOKE_CSRR0
], env
->spr
[SPR_BOOKE_CSRR1
]);
1096 void helper_rfdi(CPUPPCState
*env
)
1098 /* FIXME: choose CSRR1 or DSRR1 based on cpu type */
1099 do_rfi(env
, env
->spr
[SPR_BOOKE_DSRR0
], env
->spr
[SPR_BOOKE_DSRR1
]);
1102 void helper_rfmci(CPUPPCState
*env
)
1104 /* FIXME: choose CSRR1 or MCSRR1 based on cpu type */
1105 do_rfi(env
, env
->spr
[SPR_BOOKE_MCSRR0
], env
->spr
[SPR_BOOKE_MCSRR1
]);
1109 void helper_tw(CPUPPCState
*env
, target_ulong arg1
, target_ulong arg2
,
1112 if (!likely(!(((int32_t)arg1
< (int32_t)arg2
&& (flags
& 0x10)) ||
1113 ((int32_t)arg1
> (int32_t)arg2
&& (flags
& 0x08)) ||
1114 ((int32_t)arg1
== (int32_t)arg2
&& (flags
& 0x04)) ||
1115 ((uint32_t)arg1
< (uint32_t)arg2
&& (flags
& 0x02)) ||
1116 ((uint32_t)arg1
> (uint32_t)arg2
&& (flags
& 0x01))))) {
1117 raise_exception_err_ra(env
, POWERPC_EXCP_PROGRAM
,
1118 POWERPC_EXCP_TRAP
, GETPC());
1122 #if defined(TARGET_PPC64)
1123 void helper_td(CPUPPCState
*env
, target_ulong arg1
, target_ulong arg2
,
1126 if (!likely(!(((int64_t)arg1
< (int64_t)arg2
&& (flags
& 0x10)) ||
1127 ((int64_t)arg1
> (int64_t)arg2
&& (flags
& 0x08)) ||
1128 ((int64_t)arg1
== (int64_t)arg2
&& (flags
& 0x04)) ||
1129 ((uint64_t)arg1
< (uint64_t)arg2
&& (flags
& 0x02)) ||
1130 ((uint64_t)arg1
> (uint64_t)arg2
&& (flags
& 0x01))))) {
1131 raise_exception_err_ra(env
, POWERPC_EXCP_PROGRAM
,
1132 POWERPC_EXCP_TRAP
, GETPC());
1137 #if !defined(CONFIG_USER_ONLY)
1138 /*****************************************************************************/
1139 /* PowerPC 601 specific instructions (POWER bridge) */
1141 void helper_rfsvc(CPUPPCState
*env
)
1143 do_rfi(env
, env
->lr
, env
->ctr
& 0x0000FFFF);
1146 /* Embedded.Processor Control */
1147 static int dbell2irq(target_ulong rb
)
1149 int msg
= rb
& DBELL_TYPE_MASK
;
1153 case DBELL_TYPE_DBELL
:
1154 irq
= PPC_INTERRUPT_DOORBELL
;
1156 case DBELL_TYPE_DBELL_CRIT
:
1157 irq
= PPC_INTERRUPT_CDOORBELL
;
1159 case DBELL_TYPE_G_DBELL
:
1160 case DBELL_TYPE_G_DBELL_CRIT
:
1161 case DBELL_TYPE_G_DBELL_MC
:
1170 void helper_msgclr(CPUPPCState
*env
, target_ulong rb
)
1172 int irq
= dbell2irq(rb
);
1178 env
->pending_interrupts
&= ~(1 << irq
);
1181 void helper_msgsnd(target_ulong rb
)
1183 int irq
= dbell2irq(rb
);
1184 int pir
= rb
& DBELL_PIRTAG_MASK
;
1191 qemu_mutex_lock_iothread();
1193 PowerPCCPU
*cpu
= POWERPC_CPU(cs
);
1194 CPUPPCState
*cenv
= &cpu
->env
;
1196 if ((rb
& DBELL_BRDCAST
) || (cenv
->spr
[SPR_BOOKE_PIR
] == pir
)) {
1197 cenv
->pending_interrupts
|= 1 << irq
;
1198 cpu_interrupt(cs
, CPU_INTERRUPT_HARD
);
1201 qemu_mutex_unlock_iothread();
1204 /* Server Processor Control */
1205 static int book3s_dbell2irq(target_ulong rb
)
1207 int msg
= rb
& DBELL_TYPE_MASK
;
1209 /* A Directed Hypervisor Doorbell message is sent only if the
1210 * message type is 5. All other types are reserved and the
1211 * instruction is a no-op */
1212 return msg
== DBELL_TYPE_DBELL_SERVER
? PPC_INTERRUPT_HDOORBELL
: -1;
1215 void helper_book3s_msgclr(CPUPPCState
*env
, target_ulong rb
)
1217 int irq
= book3s_dbell2irq(rb
);
1223 env
->pending_interrupts
&= ~(1 << irq
);
1226 void helper_book3s_msgsnd(target_ulong rb
)
1228 int irq
= book3s_dbell2irq(rb
);
1229 int pir
= rb
& DBELL_PROCIDTAG_MASK
;
1236 qemu_mutex_lock_iothread();
1238 PowerPCCPU
*cpu
= POWERPC_CPU(cs
);
1239 CPUPPCState
*cenv
= &cpu
->env
;
1241 /* TODO: broadcast message to all threads of the same processor */
1242 if (cenv
->spr_cb
[SPR_PIR
].default_value
== pir
) {
1243 cenv
->pending_interrupts
|= 1 << irq
;
1244 cpu_interrupt(cs
, CPU_INTERRUPT_HARD
);
1247 qemu_mutex_unlock_iothread();
1251 void ppc_cpu_do_unaligned_access(CPUState
*cs
, vaddr vaddr
,
1252 MMUAccessType access_type
,
1253 int mmu_idx
, uintptr_t retaddr
)
1255 CPUPPCState
*env
= cs
->env_ptr
;
1258 /* Restore state and reload the insn we executed, for filling in DSISR. */
1259 cpu_restore_state(cs
, retaddr
, true);
1260 insn
= cpu_ldl_code(env
, env
->nip
);
1262 cs
->exception_index
= POWERPC_EXCP_ALIGN
;
1263 env
->error_code
= insn
& 0x03FF0000;