2 * MIPS emulation helpers for qemu.
4 * Copyright (c) 2004-2005 Jocelyn Mayer
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301 USA
38 /* no MMU emulation */
39 int no_mmu_map_address (CPUState
*env
, target_ulong
*physical
, int *prot
,
40 target_ulong address
, int rw
, int access_type
)
43 *prot
= PAGE_READ
| PAGE_WRITE
;
47 /* fixed mapping MMU emulation */
48 int fixed_mmu_map_address (CPUState
*env
, target_ulong
*physical
, int *prot
,
49 target_ulong address
, int rw
, int access_type
)
51 if (address
<= (int32_t)0x7FFFFFFFUL
) {
52 if (!(env
->CP0_Status
& (1 << CP0St_ERL
)))
53 *physical
= address
+ 0x40000000UL
;
56 } else if (address
<= (int32_t)0xBFFFFFFFUL
)
57 *physical
= address
& 0x1FFFFFFF;
61 *prot
= PAGE_READ
| PAGE_WRITE
;
65 /* MIPS32/MIPS64 R4000-style MMU emulation */
66 int r4k_map_address (CPUState
*env
, target_ulong
*physical
, int *prot
,
67 target_ulong address
, int rw
, int access_type
)
69 uint8_t ASID
= env
->CP0_EntryHi
& 0xFF;
72 for (i
= 0; i
< env
->tlb
->tlb_in_use
; i
++) {
73 r4k_tlb_t
*tlb
= &env
->tlb
->mmu
.r4k
.tlb
[i
];
74 /* 1k pages are not supported. */
75 target_ulong mask
= tlb
->PageMask
| ~(TARGET_PAGE_MASK
<< 1);
76 target_ulong tag
= address
& ~mask
;
77 target_ulong VPN
= tlb
->VPN
& ~mask
;
78 #if defined(TARGET_MIPS64)
82 /* Check ASID, virtual page number & size */
83 if ((tlb
->G
== 1 || tlb
->ASID
== ASID
) && VPN
== tag
) {
85 int n
= !!(address
& mask
& ~(mask
>> 1));
86 /* Check access rights */
87 if (!(n
? tlb
->V1
: tlb
->V0
))
88 return TLBRET_INVALID
;
89 if (rw
== 0 || (n
? tlb
->D1
: tlb
->D0
)) {
90 *physical
= tlb
->PFN
[n
] | (address
& (mask
>> 1));
92 if (n
? tlb
->D1
: tlb
->D0
)
99 return TLBRET_NOMATCH
;
102 #if !defined(CONFIG_USER_ONLY)
103 static int get_physical_address (CPUState
*env
, target_ulong
*physical
,
104 int *prot
, target_ulong address
,
105 int rw
, int access_type
)
107 /* User mode can only access useg/xuseg */
108 int user_mode
= (env
->hflags
& MIPS_HFLAG_MODE
) == MIPS_HFLAG_UM
;
109 int supervisor_mode
= (env
->hflags
& MIPS_HFLAG_MODE
) == MIPS_HFLAG_SM
;
110 int kernel_mode
= !user_mode
&& !supervisor_mode
;
111 #if defined(TARGET_MIPS64)
112 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
113 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
114 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
116 int ret
= TLBRET_MATCH
;
119 qemu_log("user mode %d h %08x\n", user_mode
, env
->hflags
);
122 if (address
<= (int32_t)0x7FFFFFFFUL
) {
124 if (env
->CP0_Status
& (1 << CP0St_ERL
)) {
125 *physical
= address
& 0xFFFFFFFF;
126 *prot
= PAGE_READ
| PAGE_WRITE
;
128 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
130 #if defined(TARGET_MIPS64)
131 } else if (address
< 0x4000000000000000ULL
) {
133 if (UX
&& address
<= (0x3FFFFFFFFFFFFFFFULL
& env
->SEGMask
)) {
134 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
136 ret
= TLBRET_BADADDR
;
138 } else if (address
< 0x8000000000000000ULL
) {
140 if ((supervisor_mode
|| kernel_mode
) &&
141 SX
&& address
<= (0x7FFFFFFFFFFFFFFFULL
& env
->SEGMask
)) {
142 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
144 ret
= TLBRET_BADADDR
;
146 } else if (address
< 0xC000000000000000ULL
) {
148 if (kernel_mode
&& KX
&&
149 (address
& 0x07FFFFFFFFFFFFFFULL
) <= env
->PAMask
) {
150 *physical
= address
& env
->PAMask
;
151 *prot
= PAGE_READ
| PAGE_WRITE
;
153 ret
= TLBRET_BADADDR
;
155 } else if (address
< 0xFFFFFFFF80000000ULL
) {
157 if (kernel_mode
&& KX
&&
158 address
<= (0xFFFFFFFF7FFFFFFFULL
& env
->SEGMask
)) {
159 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
161 ret
= TLBRET_BADADDR
;
164 } else if (address
< (int32_t)0xA0000000UL
) {
167 *physical
= address
- (int32_t)0x80000000UL
;
168 *prot
= PAGE_READ
| PAGE_WRITE
;
170 ret
= TLBRET_BADADDR
;
172 } else if (address
< (int32_t)0xC0000000UL
) {
175 *physical
= address
- (int32_t)0xA0000000UL
;
176 *prot
= PAGE_READ
| PAGE_WRITE
;
178 ret
= TLBRET_BADADDR
;
180 } else if (address
< (int32_t)0xE0000000UL
) {
182 if (supervisor_mode
|| kernel_mode
) {
183 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
185 ret
= TLBRET_BADADDR
;
189 /* XXX: debug segment is not emulated */
191 ret
= env
->tlb
->map_address(env
, physical
, prot
, address
, rw
, access_type
);
193 ret
= TLBRET_BADADDR
;
197 qemu_log(TARGET_FMT_lx
" %d %d => " TARGET_FMT_lx
" %d (%d)\n",
198 address
, rw
, access_type
, *physical
, *prot
, ret
);
206 target_phys_addr_t
cpu_get_phys_page_debug(CPUState
*env
, target_ulong addr
)
208 #if defined(CONFIG_USER_ONLY)
211 target_ulong phys_addr
;
214 if (get_physical_address(env
, &phys_addr
, &prot
, addr
, 0, ACCESS_INT
) != 0)
220 int cpu_mips_handle_mmu_fault (CPUState
*env
, target_ulong address
, int rw
,
221 int mmu_idx
, int is_softmmu
)
223 #if !defined(CONFIG_USER_ONLY)
224 target_ulong physical
;
227 int exception
= 0, error_code
= 0;
232 log_cpu_state(env
, 0);
234 qemu_log("%s pc " TARGET_FMT_lx
" ad " TARGET_FMT_lx
" rw %d mmu_idx %d smmu %d\n",
235 __func__
, env
->active_tc
.PC
, address
, rw
, mmu_idx
, is_softmmu
);
240 /* XXX: put correct access by using cpu_restore_state()
242 access_type
= ACCESS_INT
;
243 #if defined(CONFIG_USER_ONLY)
244 ret
= TLBRET_NOMATCH
;
246 ret
= get_physical_address(env
, &physical
, &prot
,
247 address
, rw
, access_type
);
248 qemu_log("%s address=" TARGET_FMT_lx
" ret %d physical " TARGET_FMT_lx
" prot %d\n",
249 __func__
, address
, ret
, physical
, prot
);
250 if (ret
== TLBRET_MATCH
) {
251 ret
= tlb_set_page(env
, address
& TARGET_PAGE_MASK
,
252 physical
& TARGET_PAGE_MASK
, prot
,
253 mmu_idx
, is_softmmu
);
260 /* Reference to kernel address from user mode or supervisor mode */
261 /* Reference to supervisor address from user mode */
263 exception
= EXCP_AdES
;
265 exception
= EXCP_AdEL
;
268 /* No TLB match for a mapped address */
270 exception
= EXCP_TLBS
;
272 exception
= EXCP_TLBL
;
276 /* TLB match with no valid bit */
278 exception
= EXCP_TLBS
;
280 exception
= EXCP_TLBL
;
283 /* TLB match but 'D' bit is cleared */
284 exception
= EXCP_LTLBL
;
288 /* Raise exception */
289 env
->CP0_BadVAddr
= address
;
290 env
->CP0_Context
= (env
->CP0_Context
& ~0x007fffff) |
291 ((address
>> 9) & 0x007ffff0);
293 (env
->CP0_EntryHi
& 0xFF) | (address
& (TARGET_PAGE_MASK
<< 1));
294 #if defined(TARGET_MIPS64)
295 env
->CP0_EntryHi
&= env
->SEGMask
;
296 env
->CP0_XContext
= (env
->CP0_XContext
& ((~0ULL) << (env
->SEGBITS
- 7))) |
297 ((address
& 0xC00000000000ULL
) >> (55 - env
->SEGBITS
)) |
298 ((address
& ((1ULL << env
->SEGBITS
) - 1) & 0xFFFFFFFFFFFFE000ULL
) >> 9);
300 env
->exception_index
= exception
;
301 env
->error_code
= error_code
;
308 static const char * const excp_names
[EXCP_LAST
+ 1] = {
309 [EXCP_RESET
] = "reset",
310 [EXCP_SRESET
] = "soft reset",
311 [EXCP_DSS
] = "debug single step",
312 [EXCP_DINT
] = "debug interrupt",
313 [EXCP_NMI
] = "non-maskable interrupt",
314 [EXCP_MCHECK
] = "machine check",
315 [EXCP_EXT_INTERRUPT
] = "interrupt",
316 [EXCP_DFWATCH
] = "deferred watchpoint",
317 [EXCP_DIB
] = "debug instruction breakpoint",
318 [EXCP_IWATCH
] = "instruction fetch watchpoint",
319 [EXCP_AdEL
] = "address error load",
320 [EXCP_AdES
] = "address error store",
321 [EXCP_TLBF
] = "TLB refill",
322 [EXCP_IBE
] = "instruction bus error",
323 [EXCP_DBp
] = "debug breakpoint",
324 [EXCP_SYSCALL
] = "syscall",
325 [EXCP_BREAK
] = "break",
326 [EXCP_CpU
] = "coprocessor unusable",
327 [EXCP_RI
] = "reserved instruction",
328 [EXCP_OVERFLOW
] = "arithmetic overflow",
329 [EXCP_TRAP
] = "trap",
330 [EXCP_FPE
] = "floating point",
331 [EXCP_DDBS
] = "debug data break store",
332 [EXCP_DWATCH
] = "data watchpoint",
333 [EXCP_LTLBL
] = "TLB modify",
334 [EXCP_TLBL
] = "TLB load",
335 [EXCP_TLBS
] = "TLB store",
336 [EXCP_DBE
] = "data bus error",
337 [EXCP_DDBL
] = "debug data break load",
338 [EXCP_THREAD
] = "thread",
339 [EXCP_MDMX
] = "MDMX",
340 [EXCP_C2E
] = "precise coprocessor 2",
341 [EXCP_CACHE
] = "cache error",
344 void do_interrupt (CPUState
*env
)
346 #if !defined(CONFIG_USER_ONLY)
351 if (qemu_log_enabled() && env
->exception_index
!= EXCP_EXT_INTERRUPT
) {
352 if (env
->exception_index
< 0 || env
->exception_index
> EXCP_LAST
)
355 name
= excp_names
[env
->exception_index
];
357 qemu_log("%s enter: PC " TARGET_FMT_lx
" EPC " TARGET_FMT_lx
" %s exception\n",
358 __func__
, env
->active_tc
.PC
, env
->CP0_EPC
, name
);
360 if (env
->exception_index
== EXCP_EXT_INTERRUPT
&&
361 (env
->hflags
& MIPS_HFLAG_DM
))
362 env
->exception_index
= EXCP_DINT
;
364 switch (env
->exception_index
) {
366 env
->CP0_Debug
|= 1 << CP0DB_DSS
;
367 /* Debug single step cannot be raised inside a delay slot and
368 resume will always occur on the next instruction
369 (but we assume the pc has always been updated during
370 code translation). */
371 env
->CP0_DEPC
= env
->active_tc
.PC
;
372 goto enter_debug_mode
;
374 env
->CP0_Debug
|= 1 << CP0DB_DINT
;
377 env
->CP0_Debug
|= 1 << CP0DB_DIB
;
380 env
->CP0_Debug
|= 1 << CP0DB_DBp
;
383 env
->CP0_Debug
|= 1 << CP0DB_DDBS
;
386 env
->CP0_Debug
|= 1 << CP0DB_DDBL
;
388 if (env
->hflags
& MIPS_HFLAG_BMASK
) {
389 /* If the exception was raised from a delay slot,
390 come back to the jump. */
391 env
->CP0_DEPC
= env
->active_tc
.PC
- 4;
392 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
394 env
->CP0_DEPC
= env
->active_tc
.PC
;
397 env
->hflags
|= MIPS_HFLAG_DM
| MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
398 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
399 /* EJTAG probe trap enable is not implemented... */
400 if (!(env
->CP0_Status
& (1 << CP0St_EXL
)))
401 env
->CP0_Cause
&= ~(1 << CP0Ca_BD
);
402 env
->active_tc
.PC
= (int32_t)0xBFC00480;
408 env
->CP0_Status
|= (1 << CP0St_SR
);
409 memset(env
->CP0_WatchLo
, 0, sizeof(*env
->CP0_WatchLo
));
412 env
->CP0_Status
|= (1 << CP0St_NMI
);
414 if (env
->hflags
& MIPS_HFLAG_BMASK
) {
415 /* If the exception was raised from a delay slot,
416 come back to the jump. */
417 env
->CP0_ErrorEPC
= env
->active_tc
.PC
- 4;
418 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
420 env
->CP0_ErrorEPC
= env
->active_tc
.PC
;
422 env
->CP0_Status
|= (1 << CP0St_ERL
) | (1 << CP0St_BEV
);
423 env
->hflags
|= MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
424 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
425 if (!(env
->CP0_Status
& (1 << CP0St_EXL
)))
426 env
->CP0_Cause
&= ~(1 << CP0Ca_BD
);
427 env
->active_tc
.PC
= (int32_t)0xBFC00000;
429 case EXCP_EXT_INTERRUPT
:
431 if (env
->CP0_Cause
& (1 << CP0Ca_IV
))
439 if (env
->error_code
== 1 && !(env
->CP0_Status
& (1 << CP0St_EXL
))) {
440 #if defined(TARGET_MIPS64)
441 int R
= env
->CP0_BadVAddr
>> 62;
442 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
443 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
444 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
446 if ((R
== 0 && UX
) || (R
== 1 && SX
) || (R
== 3 && KX
))
455 if (env
->error_code
== 1 && !(env
->CP0_Status
& (1 << CP0St_EXL
))) {
456 #if defined(TARGET_MIPS64)
457 int R
= env
->CP0_BadVAddr
>> 62;
458 int UX
= (env
->CP0_Status
& (1 << CP0St_UX
)) != 0;
459 int SX
= (env
->CP0_Status
& (1 << CP0St_SX
)) != 0;
460 int KX
= (env
->CP0_Status
& (1 << CP0St_KX
)) != 0;
462 if ((R
== 0 && UX
) || (R
== 1 && SX
) || (R
== 3 && KX
))
492 env
->CP0_Cause
= (env
->CP0_Cause
& ~(0x3 << CP0Ca_CE
)) |
493 (env
->error_code
<< CP0Ca_CE
);
512 /* XXX: TODO: manage defered watch exceptions */
522 if (env
->CP0_Status
& (1 << CP0St_BEV
)) {
528 if (!(env
->CP0_Status
& (1 << CP0St_EXL
))) {
529 if (env
->hflags
& MIPS_HFLAG_BMASK
) {
530 /* If the exception was raised from a delay slot,
531 come back to the jump. */
532 env
->CP0_EPC
= env
->active_tc
.PC
- 4;
533 env
->CP0_Cause
|= (1 << CP0Ca_BD
);
535 env
->CP0_EPC
= env
->active_tc
.PC
;
536 env
->CP0_Cause
&= ~(1 << CP0Ca_BD
);
538 env
->CP0_Status
|= (1 << CP0St_EXL
);
539 env
->hflags
|= MIPS_HFLAG_64
| MIPS_HFLAG_CP0
;
540 env
->hflags
&= ~(MIPS_HFLAG_KSU
);
542 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
543 if (env
->CP0_Status
& (1 << CP0St_BEV
)) {
544 env
->active_tc
.PC
= (int32_t)0xBFC00200;
546 env
->active_tc
.PC
= (int32_t)(env
->CP0_EBase
& ~0x3ff);
548 env
->active_tc
.PC
+= offset
;
549 env
->CP0_Cause
= (env
->CP0_Cause
& ~(0x1f << CP0Ca_EC
)) | (cause
<< CP0Ca_EC
);
552 qemu_log("Invalid MIPS exception %d. Exiting\n", env
->exception_index
);
553 printf("Invalid MIPS exception %d. Exiting\n", env
->exception_index
);
556 if (qemu_log_enabled() && env
->exception_index
!= EXCP_EXT_INTERRUPT
) {
557 qemu_log("%s: PC " TARGET_FMT_lx
" EPC " TARGET_FMT_lx
" cause %d\n"
558 " S %08x C %08x A " TARGET_FMT_lx
" D " TARGET_FMT_lx
"\n",
559 __func__
, env
->active_tc
.PC
, env
->CP0_EPC
, cause
,
560 env
->CP0_Status
, env
->CP0_Cause
, env
->CP0_BadVAddr
,
564 env
->exception_index
= EXCP_NONE
;
567 void r4k_invalidate_tlb (CPUState
*env
, int idx
, int use_extra
)
572 uint8_t ASID
= env
->CP0_EntryHi
& 0xFF;
575 tlb
= &env
->tlb
->mmu
.r4k
.tlb
[idx
];
576 /* The qemu TLB is flushed when the ASID changes, so no need to
577 flush these entries again. */
578 if (tlb
->G
== 0 && tlb
->ASID
!= ASID
) {
582 if (use_extra
&& env
->tlb
->tlb_in_use
< MIPS_TLB_MAX
) {
583 /* For tlbwr, we can shadow the discarded entry into
584 a new (fake) TLB entry, as long as the guest can not
585 tell that it's there. */
586 env
->tlb
->mmu
.r4k
.tlb
[env
->tlb
->tlb_in_use
] = *tlb
;
587 env
->tlb
->tlb_in_use
++;
591 /* 1k pages are not supported. */
592 mask
= tlb
->PageMask
| ~(TARGET_PAGE_MASK
<< 1);
594 addr
= tlb
->VPN
& ~mask
;
595 #if defined(TARGET_MIPS64)
596 if (addr
>= (0xFFFFFFFF80000000ULL
& env
->SEGMask
)) {
597 addr
|= 0x3FFFFF0000000000ULL
;
600 end
= addr
| (mask
>> 1);
602 tlb_flush_page (env
, addr
);
603 addr
+= TARGET_PAGE_SIZE
;
607 addr
= (tlb
->VPN
& ~mask
) | ((mask
>> 1) + 1);
608 #if defined(TARGET_MIPS64)
609 if (addr
>= (0xFFFFFFFF80000000ULL
& env
->SEGMask
)) {
610 addr
|= 0x3FFFFF0000000000ULL
;
614 while (addr
- 1 < end
) {
615 tlb_flush_page (env
, addr
);
616 addr
+= TARGET_PAGE_SIZE
;