2 * PowerPC emulation helpers for qemu.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
30 #include "helper_regs.h"
34 //#define DEBUG_SOFTWARE_TLB
35 //#define DUMP_PAGE_TABLES
36 //#define DEBUG_EXCEPTIONS
37 //#define FLUSH_ALL_TLBS
39 /*****************************************************************************/
40 /* PowerPC MMU emulation */
42 #if defined(CONFIG_USER_ONLY)
43 int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
44 int mmu_idx, int is_softmmu)
46 int exception, error_code;
49 exception = POWERPC_EXCP_ISI;
50 error_code = 0x40000000;
52 exception = POWERPC_EXCP_DSI;
53 error_code = 0x40000000;
55 error_code |= 0x02000000;
56 env->spr[SPR_DAR] = address;
57 env->spr[SPR_DSISR] = error_code;
59 env->exception_index = exception;
60 env->error_code = error_code;
65 target_phys_addr_t cpu_get_phys_page_debug (CPUState *env, target_ulong addr)
71 /* Common routines used by software and hardware TLBs emulation */
72 static always_inline int pte_is_valid (target_ulong pte0)
74 return pte0 & 0x80000000 ? 1 : 0;
77 static always_inline void pte_invalidate (target_ulong *pte0)
82 #if defined(TARGET_PPC64)
83 static always_inline int pte64_is_valid (target_ulong pte0)
85 return pte0 & 0x0000000000000001ULL ? 1 : 0;
88 static always_inline void pte64_invalidate (target_ulong *pte0)
90 *pte0 &= ~0x0000000000000001ULL;
94 #define PTE_PTEM_MASK 0x7FFFFFBF
95 #define PTE_CHECK_MASK (TARGET_PAGE_MASK | 0x7B)
96 #if defined(TARGET_PPC64)
97 #define PTE64_PTEM_MASK 0xFFFFFFFFFFFFFF80ULL
98 #define PTE64_CHECK_MASK (TARGET_PAGE_MASK | 0x7F)
101 static always_inline int pp_check (int key, int pp, int nx)
105 /* Compute access rights */
106 /* When pp is 3/7, the result is undefined. Set it to noaccess */
113 access |= PAGE_WRITE;
131 access = PAGE_READ | PAGE_WRITE;
141 static always_inline int check_prot (int prot, int rw, int access_type)
145 if (access_type == ACCESS_CODE) {
146 if (prot & PAGE_EXEC)
151 if (prot & PAGE_WRITE)
156 if (prot & PAGE_READ)
165 static always_inline int _pte_check (mmu_ctx_t *ctx, int is_64b,
166 target_ulong pte0, target_ulong pte1,
167 int h, int rw, int type)
169 target_ulong ptem, mmask;
170 int access, ret, pteh, ptev, pp;
174 /* Check validity and table match */
175 #if defined(TARGET_PPC64)
177 ptev = pte64_is_valid(pte0);
178 pteh = (pte0 >> 1) & 1;
182 ptev = pte_is_valid(pte0);
183 pteh = (pte0 >> 6) & 1;
185 if (ptev && h == pteh) {
186 /* Check vsid & api */
187 #if defined(TARGET_PPC64)
189 ptem = pte0 & PTE64_PTEM_MASK;
190 mmask = PTE64_CHECK_MASK;
191 pp = (pte1 & 0x00000003) | ((pte1 >> 61) & 0x00000004);
192 ctx->nx |= (pte1 >> 2) & 1; /* No execute bit */
193 ctx->nx |= (pte1 >> 3) & 1; /* Guarded bit */
197 ptem = pte0 & PTE_PTEM_MASK;
198 mmask = PTE_CHECK_MASK;
199 pp = pte1 & 0x00000003;
201 if (ptem == ctx->ptem) {
202 if (ctx->raddr != (target_ulong)-1) {
203 /* all matches should have equal RPN, WIMG & PP */
204 if ((ctx->raddr & mmask) != (pte1 & mmask)) {
206 fprintf(logfile, "Bad RPN/WIMG/PP\n");
210 /* Compute access rights */
211 access = pp_check(ctx->key, pp, ctx->nx);
212 /* Keep the matching PTE informations */
215 ret = check_prot(ctx->prot, rw, type);
218 #if defined (DEBUG_MMU)
220 fprintf(logfile, "PTE access granted !\n");
223 /* Access right violation */
224 #if defined (DEBUG_MMU)
226 fprintf(logfile, "PTE access rejected\n");
235 static int pte32_check (mmu_ctx_t *ctx, target_ulong pte0, target_ulong pte1,
236 int h, int rw, int type)
238 return _pte_check(ctx, 0, pte0, pte1, h, rw, type);
241 #if defined(TARGET_PPC64)
242 static int pte64_check (mmu_ctx_t *ctx, target_ulong pte0, target_ulong pte1,
243 int h, int rw, int type)
245 return _pte_check(ctx, 1, pte0, pte1, h, rw, type);
249 static int pte_update_flags (mmu_ctx_t *ctx, target_ulong *pte1p,
254 /* Update page flags */
255 if (!(*pte1p & 0x00000100)) {
256 /* Update accessed flag */
257 *pte1p |= 0x00000100;
260 if (!(*pte1p & 0x00000080)) {
261 if (rw == 1 && ret == 0) {
262 /* Update changed flag */
263 *pte1p |= 0x00000080;
266 /* Force page fault for first write access */
267 ctx->prot &= ~PAGE_WRITE;
274 /* Software driven TLB helpers */
275 static int ppc6xx_tlb_getnum (CPUState *env, target_ulong eaddr,
276 int way, int is_code)
280 /* Select TLB num in a way from address */
281 nr = (eaddr >> TARGET_PAGE_BITS) & (env->tlb_per_way - 1);
283 nr += env->tlb_per_way * way;
284 /* 6xx have separate TLBs for instructions and data */
285 if (is_code && env->id_tlbs == 1)
291 static void ppc6xx_tlb_invalidate_all (CPUState *env)
296 #if defined (DEBUG_SOFTWARE_TLB) && 0
298 fprintf(logfile, "Invalidate all TLBs\n");
301 /* Invalidate all defined software TLB */
303 if (env->id_tlbs == 1)
305 for (nr = 0; nr < max; nr++) {
306 tlb = &env->tlb[nr].tlb6;
307 pte_invalidate(&tlb->pte0);
312 static always_inline void __ppc6xx_tlb_invalidate_virt (CPUState *env,
317 #if !defined(FLUSH_ALL_TLBS)
321 /* Invalidate ITLB + DTLB, all ways */
322 for (way = 0; way < env->nb_ways; way++) {
323 nr = ppc6xx_tlb_getnum(env, eaddr, way, is_code);
324 tlb = &env->tlb[nr].tlb6;
325 if (pte_is_valid(tlb->pte0) && (match_epn == 0 || eaddr == tlb->EPN)) {
326 #if defined (DEBUG_SOFTWARE_TLB)
328 fprintf(logfile, "TLB invalidate %d/%d " ADDRX "\n",
329 nr, env->nb_tlb, eaddr);
332 pte_invalidate(&tlb->pte0);
333 tlb_flush_page(env, tlb->EPN);
337 /* XXX: PowerPC specification say this is valid as well */
338 ppc6xx_tlb_invalidate_all(env);
342 static void ppc6xx_tlb_invalidate_virt (CPUState *env, target_ulong eaddr,
345 __ppc6xx_tlb_invalidate_virt(env, eaddr, is_code, 0);
348 void ppc6xx_tlb_store (CPUState *env, target_ulong EPN, int way, int is_code,
349 target_ulong pte0, target_ulong pte1)
354 nr = ppc6xx_tlb_getnum(env, EPN, way, is_code);
355 tlb = &env->tlb[nr].tlb6;
356 #if defined (DEBUG_SOFTWARE_TLB)
358 fprintf(logfile, "Set TLB %d/%d EPN " ADDRX " PTE0 " ADDRX
359 " PTE1 " ADDRX "\n", nr, env->nb_tlb, EPN, pte0, pte1);
362 /* Invalidate any pending reference in Qemu for this virtual address */
363 __ppc6xx_tlb_invalidate_virt(env, EPN, is_code, 1);
367 /* Store last way for LRU mechanism */
371 static int ppc6xx_tlb_check (CPUState *env, mmu_ctx_t *ctx,
372 target_ulong eaddr, int rw, int access_type)
379 ret = -1; /* No TLB found */
380 for (way = 0; way < env->nb_ways; way++) {
381 nr = ppc6xx_tlb_getnum(env, eaddr, way,
382 access_type == ACCESS_CODE ? 1 : 0);
383 tlb = &env->tlb[nr].tlb6;
384 /* This test "emulates" the PTE index match for hardware TLBs */
385 if ((eaddr & TARGET_PAGE_MASK) != tlb->EPN) {
386 #if defined (DEBUG_SOFTWARE_TLB)
388 fprintf(logfile, "TLB %d/%d %s [" ADDRX " " ADDRX
391 pte_is_valid(tlb->pte0) ? "valid" : "inval",
392 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE, eaddr);
397 #if defined (DEBUG_SOFTWARE_TLB)
399 fprintf(logfile, "TLB %d/%d %s " ADDRX " <> " ADDRX " " ADDRX
402 pte_is_valid(tlb->pte0) ? "valid" : "inval",
403 tlb->EPN, eaddr, tlb->pte1,
404 rw ? 'S' : 'L', access_type == ACCESS_CODE ? 'I' : 'D');
407 switch (pte32_check(ctx, tlb->pte0, tlb->pte1, 0, rw, access_type)) {
409 /* TLB inconsistency */
412 /* Access violation */
422 /* XXX: we should go on looping to check all TLBs consistency
423 * but we can speed-up the whole thing as the
424 * result would be undefined if TLBs are not consistent.
433 #if defined (DEBUG_SOFTWARE_TLB)
435 fprintf(logfile, "found TLB at addr 0x%08lx prot=0x%01x ret=%d\n",
436 ctx->raddr & TARGET_PAGE_MASK, ctx->prot, ret);
439 /* Update page flags */
440 pte_update_flags(ctx, &env->tlb[best].tlb6.pte1, ret, rw);
446 /* Perform BAT hit & translation */
447 static int get_bat (CPUState *env, mmu_ctx_t *ctx,
448 target_ulong virtual, int rw, int type)
450 target_ulong *BATlt, *BATut, *BATu, *BATl;
451 target_ulong base, BEPIl, BEPIu, bl;
455 #if defined (DEBUG_BATS)
457 fprintf(logfile, "%s: %cBAT v 0x" ADDRX "\n", __func__,
458 type == ACCESS_CODE ? 'I' : 'D', virtual);
464 BATlt = env->IBAT[1];
465 BATut = env->IBAT[0];
468 BATlt = env->DBAT[1];
469 BATut = env->DBAT[0];
472 #if defined (DEBUG_BATS)
474 fprintf(logfile, "%s...: %cBAT v 0x" ADDRX "\n", __func__,
475 type == ACCESS_CODE ? 'I' : 'D', virtual);
478 base = virtual & 0xFFFC0000;
479 for (i = 0; i < 4; i++) {
482 BEPIu = *BATu & 0xF0000000;
483 BEPIl = *BATu & 0x0FFE0000;
484 bl = (*BATu & 0x00001FFC) << 15;
485 #if defined (DEBUG_BATS)
487 fprintf(logfile, "%s: %cBAT%d v 0x" ADDRX " BATu 0x" ADDRX
488 " BATl 0x" ADDRX "\n",
489 __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual,
493 if ((virtual & 0xF0000000) == BEPIu &&
494 ((virtual & 0x0FFE0000) & ~bl) == BEPIl) {
496 if (((pr == 0) && (*BATu & 0x00000002)) ||
497 ((pr != 0) && (*BATu & 0x00000001))) {
498 /* Get physical address */
499 ctx->raddr = (*BATl & 0xF0000000) |
500 ((virtual & 0x0FFE0000 & bl) | (*BATl & 0x0FFE0000)) |
501 (virtual & 0x0001F000);
502 /* Compute access rights */
503 pp = *BATl & 0x00000003;
506 ctx->prot = PAGE_READ | PAGE_EXEC;
508 ctx->prot |= PAGE_WRITE;
510 ret = check_prot(ctx->prot, rw, type);
511 #if defined (DEBUG_BATS)
512 if (ret == 0 && loglevel != 0) {
513 fprintf(logfile, "BAT %d match: r 0x" PADDRX
515 i, ctx->raddr, ctx->prot & PAGE_READ ? 'R' : '-',
516 ctx->prot & PAGE_WRITE ? 'W' : '-');
524 #if defined (DEBUG_BATS)
526 fprintf(logfile, "no BAT match for 0x" ADDRX ":\n", virtual);
527 for (i = 0; i < 4; i++) {
530 BEPIu = *BATu & 0xF0000000;
531 BEPIl = *BATu & 0x0FFE0000;
532 bl = (*BATu & 0x00001FFC) << 15;
533 fprintf(logfile, "%s: %cBAT%d v 0x" ADDRX " BATu 0x" ADDRX
534 " BATl 0x" ADDRX " \n\t"
535 "0x" ADDRX " 0x" ADDRX " 0x" ADDRX "\n",
536 __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual,
537 *BATu, *BATl, BEPIu, BEPIl, bl);
547 /* PTE table lookup */
548 static always_inline int _find_pte (mmu_ctx_t *ctx, int is_64b, int h,
551 target_ulong base, pte0, pte1;
555 ret = -1; /* No entry found */
556 base = ctx->pg_addr[h];
557 for (i = 0; i < 8; i++) {
558 #if defined(TARGET_PPC64)
560 pte0 = ldq_phys(base + (i * 16));
561 pte1 = ldq_phys(base + (i * 16) + 8);
562 r = pte64_check(ctx, pte0, pte1, h, rw, type);
563 #if defined (DEBUG_MMU)
565 fprintf(logfile, "Load pte from 0x" ADDRX " => 0x" ADDRX
566 " 0x" ADDRX " %d %d %d 0x" ADDRX "\n",
567 base + (i * 16), pte0, pte1,
568 (int)(pte0 & 1), h, (int)((pte0 >> 1) & 1),
575 pte0 = ldl_phys(base + (i * 8));
576 pte1 = ldl_phys(base + (i * 8) + 4);
577 r = pte32_check(ctx, pte0, pte1, h, rw, type);
578 #if defined (DEBUG_MMU)
580 fprintf(logfile, "Load pte from 0x" ADDRX " => 0x" ADDRX
581 " 0x" ADDRX " %d %d %d 0x" ADDRX "\n",
582 base + (i * 8), pte0, pte1,
583 (int)(pte0 >> 31), h, (int)((pte0 >> 6) & 1),
590 /* PTE inconsistency */
593 /* Access violation */
603 /* XXX: we should go on looping to check all PTEs consistency
604 * but if we can speed-up the whole thing as the
605 * result would be undefined if PTEs are not consistent.
614 #if defined (DEBUG_MMU)
616 fprintf(logfile, "found PTE at addr 0x" PADDRX " prot=0x%01x "
618 ctx->raddr, ctx->prot, ret);
621 /* Update page flags */
623 if (pte_update_flags(ctx, &pte1, ret, rw) == 1) {
624 #if defined(TARGET_PPC64)
626 stq_phys_notdirty(base + (good * 16) + 8, pte1);
630 stl_phys_notdirty(base + (good * 8) + 4, pte1);
638 static int find_pte32 (mmu_ctx_t *ctx, int h, int rw, int type)
640 return _find_pte(ctx, 0, h, rw, type);
643 #if defined(TARGET_PPC64)
644 static int find_pte64 (mmu_ctx_t *ctx, int h, int rw, int type)
646 return _find_pte(ctx, 1, h, rw, type);
650 static always_inline int find_pte (CPUState *env, mmu_ctx_t *ctx,
651 int h, int rw, int type)
653 #if defined(TARGET_PPC64)
654 if (env->mmu_model == POWERPC_MMU_64B)
655 return find_pte64(ctx, h, rw, type);
658 return find_pte32(ctx, h, rw, type);
661 #if defined(TARGET_PPC64)
662 static inline int slb_is_valid (uint64_t slb64)
664 return slb64 & 0x0000000008000000ULL ? 1 : 0;
667 static inline void slb_invalidate (uint64_t *slb64)
669 *slb64 &= ~0x0000000008000000ULL;
672 static int slb_lookup (CPUPPCState *env, target_ulong eaddr,
673 target_ulong *vsid, target_ulong *page_mask, int *attr)
675 target_phys_addr_t sr_base;
682 sr_base = env->spr[SPR_ASR];
683 #if defined(DEBUG_SLB)
685 fprintf(logfile, "%s: eaddr " ADDRX " base " PADDRX "\n",
686 __func__, eaddr, sr_base);
689 mask = 0x0000000000000000ULL; /* Avoid gcc warning */
690 for (n = 0; n < env->slb_nr; n++) {
691 tmp64 = ldq_phys(sr_base);
692 tmp = ldl_phys(sr_base + 8);
693 #if defined(DEBUG_SLB)
695 fprintf(logfile, "%s: seg %d " PADDRX " %016" PRIx64 " %08"
696 PRIx32 "\n", __func__, n, sr_base, tmp64, tmp);
699 if (slb_is_valid(tmp64)) {
700 /* SLB entry is valid */
701 switch (tmp64 & 0x0000000006000000ULL) {
702 case 0x0000000000000000ULL:
704 mask = 0xFFFFFFFFF0000000ULL;
706 case 0x0000000002000000ULL:
708 mask = 0xFFFF000000000000ULL;
710 case 0x0000000004000000ULL:
711 case 0x0000000006000000ULL:
712 /* Reserved => segment is invalid */
715 if ((eaddr & mask) == (tmp64 & mask)) {
717 *vsid = ((tmp64 << 24) | (tmp >> 8)) & 0x0003FFFFFFFFFFFFULL;
730 void ppc_slb_invalidate_all (CPUPPCState *env)
732 target_phys_addr_t sr_base;
734 int n, do_invalidate;
737 sr_base = env->spr[SPR_ASR];
738 /* XXX: Warning: slbia never invalidates the first segment */
739 for (n = 1; n < env->slb_nr; n++) {
740 tmp64 = ldq_phys(sr_base);
741 if (slb_is_valid(tmp64)) {
742 slb_invalidate(&tmp64);
743 stq_phys(sr_base, tmp64);
744 /* XXX: given the fact that segment size is 256 MB or 1TB,
745 * and we still don't have a tlb_flush_mask(env, n, mask)
746 * in Qemu, we just invalidate all TLBs
756 void ppc_slb_invalidate_one (CPUPPCState *env, uint64_t T0)
758 target_phys_addr_t sr_base;
759 target_ulong vsid, page_mask;
764 n = slb_lookup(env, T0, &vsid, &page_mask, &attr);
766 sr_base = env->spr[SPR_ASR];
768 tmp64 = ldq_phys(sr_base);
769 if (slb_is_valid(tmp64)) {
770 slb_invalidate(&tmp64);
771 stq_phys(sr_base, tmp64);
772 /* XXX: given the fact that segment size is 256 MB or 1TB,
773 * and we still don't have a tlb_flush_mask(env, n, mask)
774 * in Qemu, we just invalidate all TLBs
781 target_ulong ppc_load_slb (CPUPPCState *env, int slb_nr)
783 target_phys_addr_t sr_base;
788 sr_base = env->spr[SPR_ASR];
789 sr_base += 12 * slb_nr;
790 tmp64 = ldq_phys(sr_base);
791 tmp = ldl_phys(sr_base + 8);
792 if (tmp64 & 0x0000000008000000ULL) {
793 /* SLB entry is valid */
794 /* Copy SLB bits 62:88 to Rt 37:63 (VSID 23:49) */
795 rt = tmp >> 8; /* 65:88 => 40:63 */
796 rt |= (tmp64 & 0x7) << 24; /* 62:64 => 37:39 */
797 /* Copy SLB bits 89:92 to Rt 33:36 (KsKpNL) */
798 rt |= ((tmp >> 4) & 0xF) << 27;
802 #if defined(DEBUG_SLB)
804 fprintf(logfile, "%s: " PADDRX " %016" PRIx64 " %08" PRIx32 " => %d "
805 ADDRX "\n", __func__, sr_base, tmp64, tmp, slb_nr, rt);
812 void ppc_store_slb (CPUPPCState *env, int slb_nr, target_ulong rs)
814 target_phys_addr_t sr_base;
818 sr_base = env->spr[SPR_ASR];
819 sr_base += 12 * slb_nr;
820 /* Copy Rs bits 37:63 to SLB 62:88 */
822 tmp64 = (rs >> 24) & 0x7;
823 /* Copy Rs bits 33:36 to SLB 89:92 */
824 tmp |= ((rs >> 27) & 0xF) << 4;
825 /* Set the valid bit */
828 tmp64 |= (uint32_t)slb_nr << 28;
829 #if defined(DEBUG_SLB)
831 fprintf(logfile, "%s: %d " ADDRX " => " PADDRX " %016" PRIx64 " %08"
832 PRIx32 "\n", __func__, slb_nr, rs, sr_base, tmp64, tmp);
835 /* Write SLB entry to memory */
836 stq_phys(sr_base, tmp64);
837 stl_phys(sr_base + 8, tmp);
839 #endif /* defined(TARGET_PPC64) */
841 /* Perform segment based translation */
842 static always_inline target_phys_addr_t get_pgaddr (target_phys_addr_t sdr1,
844 target_phys_addr_t hash,
845 target_phys_addr_t mask)
847 return (sdr1 & ((target_ulong)(-1ULL) << sdr_sh)) | (hash & mask);
850 static int get_segment (CPUState *env, mmu_ctx_t *ctx,
851 target_ulong eaddr, int rw, int type)
853 target_phys_addr_t sdr, hash, mask, sdr_mask, htab_mask;
854 target_ulong sr, vsid, vsid_mask, pgidx, page_mask;
855 #if defined(TARGET_PPC64)
858 int ds, vsid_sh, sdr_sh, pr;
862 #if defined(TARGET_PPC64)
863 if (env->mmu_model == POWERPC_MMU_64B) {
864 #if defined (DEBUG_MMU)
866 fprintf(logfile, "Check SLBs\n");
869 ret = slb_lookup(env, eaddr, &vsid, &page_mask, &attr);
872 ctx->key = ((attr & 0x40) && (pr != 0)) ||
873 ((attr & 0x80) && (pr == 0)) ? 1 : 0;
875 ctx->nx = attr & 0x20 ? 1 : 0;
876 vsid_mask = 0x00003FFFFFFFFF80ULL;
881 #endif /* defined(TARGET_PPC64) */
883 sr = env->sr[eaddr >> 28];
884 page_mask = 0x0FFFFFFF;
885 ctx->key = (((sr & 0x20000000) && (pr != 0)) ||
886 ((sr & 0x40000000) && (pr == 0))) ? 1 : 0;
887 ds = sr & 0x80000000 ? 1 : 0;
888 ctx->nx = sr & 0x10000000 ? 1 : 0;
889 vsid = sr & 0x00FFFFFF;
890 vsid_mask = 0x01FFFFC0;
894 #if defined (DEBUG_MMU)
896 fprintf(logfile, "Check segment v=0x" ADDRX " %d 0x" ADDRX
897 " nip=0x" ADDRX " lr=0x" ADDRX
898 " ir=%d dr=%d pr=%d %d t=%d\n",
899 eaddr, (int)(eaddr >> 28), sr, env->nip,
900 env->lr, (int)msr_ir, (int)msr_dr, pr != 0 ? 1 : 0,
905 #if defined (DEBUG_MMU)
907 fprintf(logfile, "pte segment: key=%d ds %d nx %d vsid " ADDRX "\n",
908 ctx->key, ds, ctx->nx, vsid);
913 /* Check if instruction fetch is allowed, if needed */
914 if (type != ACCESS_CODE || ctx->nx == 0) {
915 /* Page address translation */
916 /* Primary table address */
918 pgidx = (eaddr & page_mask) >> TARGET_PAGE_BITS;
919 #if defined(TARGET_PPC64)
920 if (env->mmu_model == POWERPC_MMU_64B) {
921 htab_mask = 0x0FFFFFFF >> (28 - (sdr & 0x1F));
922 /* XXX: this is false for 1 TB segments */
923 hash = ((vsid ^ pgidx) << vsid_sh) & vsid_mask;
927 htab_mask = sdr & 0x000001FF;
928 hash = ((vsid ^ pgidx) << vsid_sh) & vsid_mask;
930 mask = (htab_mask << sdr_sh) | sdr_mask;
931 #if defined (DEBUG_MMU)
933 fprintf(logfile, "sdr " PADDRX " sh %d hash " PADDRX " mask "
934 PADDRX " " ADDRX "\n", sdr, sdr_sh, hash, mask,
938 ctx->pg_addr[0] = get_pgaddr(sdr, sdr_sh, hash, mask);
939 /* Secondary table address */
940 hash = (~hash) & vsid_mask;
941 #if defined (DEBUG_MMU)
943 fprintf(logfile, "sdr " PADDRX " sh %d hash " PADDRX " mask "
944 PADDRX "\n", sdr, sdr_sh, hash, mask);
947 ctx->pg_addr[1] = get_pgaddr(sdr, sdr_sh, hash, mask);
948 #if defined(TARGET_PPC64)
949 if (env->mmu_model == POWERPC_MMU_64B) {
950 /* Only 5 bits of the page index are used in the AVPN */
951 ctx->ptem = (vsid << 12) | ((pgidx >> 4) & 0x0F80);
955 ctx->ptem = (vsid << 7) | (pgidx >> 10);
957 /* Initialize real address with an invalid value */
958 ctx->raddr = (target_ulong)-1;
959 if (unlikely(env->mmu_model == POWERPC_MMU_SOFT_6xx ||
960 env->mmu_model == POWERPC_MMU_SOFT_74xx)) {
961 /* Software TLB search */
962 ret = ppc6xx_tlb_check(env, ctx, eaddr, rw, type);
964 #if defined (DEBUG_MMU)
966 fprintf(logfile, "0 sdr1=0x" PADDRX " vsid=0x%06x "
967 "api=0x%04x hash=0x%07x pg_addr=0x" PADDRX "\n",
968 sdr, (uint32_t)vsid, (uint32_t)pgidx,
969 (uint32_t)hash, ctx->pg_addr[0]);
972 /* Primary table lookup */
973 ret = find_pte(env, ctx, 0, rw, type);
975 /* Secondary table lookup */
976 #if defined (DEBUG_MMU)
977 if (eaddr != 0xEFFFFFFF && loglevel != 0) {
979 "1 sdr1=0x" PADDRX " vsid=0x%06x api=0x%04x "
980 "hash=0x%05x pg_addr=0x" PADDRX "\n",
981 sdr, (uint32_t)vsid, (uint32_t)pgidx,
982 (uint32_t)hash, ctx->pg_addr[1]);
985 ret2 = find_pte(env, ctx, 1, rw, type);
990 #if defined (DUMP_PAGE_TABLES)
992 target_phys_addr_t curaddr;
993 uint32_t a0, a1, a2, a3;
995 "Page table: " PADDRX " len " PADDRX "\n",
997 for (curaddr = sdr; curaddr < (sdr + mask + 0x80);
999 a0 = ldl_phys(curaddr);
1000 a1 = ldl_phys(curaddr + 4);
1001 a2 = ldl_phys(curaddr + 8);
1002 a3 = ldl_phys(curaddr + 12);
1003 if (a0 != 0 || a1 != 0 || a2 != 0 || a3 != 0) {
1005 PADDRX ": %08x %08x %08x %08x\n",
1006 curaddr, a0, a1, a2, a3);
1012 #if defined (DEBUG_MMU)
1014 fprintf(logfile, "No access allowed\n");
1019 #if defined (DEBUG_MMU)
1021 fprintf(logfile, "direct store...\n");
1023 /* Direct-store segment : absolutely *BUGGY* for now */
1026 /* Integer load/store : only access allowed */
1029 /* No code fetch is allowed in direct-store areas */
1032 /* Floating point load/store */
1035 /* lwarx, ldarx or srwcx. */
1038 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
1039 /* Should make the instruction do no-op.
1040 * As it already do no-op, it's quite easy :-)
1045 /* eciwx or ecowx */
1049 fprintf(logfile, "ERROR: instruction should not need "
1050 "address translation\n");
1054 if ((rw == 1 || ctx->key != 1) && (rw == 0 || ctx->key != 0)) {
1065 /* Generic TLB check function for embedded PowerPC implementations */
1066 static int ppcemb_tlb_check (CPUState *env, ppcemb_tlb_t *tlb,
1067 target_phys_addr_t *raddrp,
1068 target_ulong address,
1069 uint32_t pid, int ext, int i)
1073 /* Check valid flag */
1074 if (!(tlb->prot & PAGE_VALID)) {
1076 fprintf(logfile, "%s: TLB %d not valid\n", __func__, i);
1079 mask = ~(tlb->size - 1);
1080 #if defined (DEBUG_SOFTWARE_TLB)
1081 if (loglevel != 0) {
1082 fprintf(logfile, "%s: TLB %d address " ADDRX " PID %d <=> "
1083 ADDRX " " ADDRX " %d\n",
1084 __func__, i, address, pid, tlb->EPN, mask, (int)tlb->PID);
1088 if (tlb->PID != 0 && tlb->PID != pid)
1090 /* Check effective address */
1091 if ((address & mask) != tlb->EPN)
1093 *raddrp = (tlb->RPN & mask) | (address & ~mask);
1094 #if (TARGET_PHYS_ADDR_BITS >= 36)
1096 /* Extend the physical address to 36 bits */
1097 *raddrp |= (target_phys_addr_t)(tlb->RPN & 0xF) << 32;
1104 /* Generic TLB search function for PowerPC embedded implementations */
1105 int ppcemb_tlb_search (CPUPPCState *env, target_ulong address, uint32_t pid)
1108 target_phys_addr_t raddr;
1111 /* Default return value is no match */
1113 for (i = 0; i < env->nb_tlb; i++) {
1114 tlb = &env->tlb[i].tlbe;
1115 if (ppcemb_tlb_check(env, tlb, &raddr, address, pid, 0, i) == 0) {
1124 /* Helpers specific to PowerPC 40x implementations */
1125 static void ppc4xx_tlb_invalidate_all (CPUState *env)
1130 for (i = 0; i < env->nb_tlb; i++) {
1131 tlb = &env->tlb[i].tlbe;
1132 tlb->prot &= ~PAGE_VALID;
1137 static void ppc4xx_tlb_invalidate_virt (CPUState *env, target_ulong eaddr,
1140 #if !defined(FLUSH_ALL_TLBS)
1142 target_phys_addr_t raddr;
1143 target_ulong page, end;
1146 for (i = 0; i < env->nb_tlb; i++) {
1147 tlb = &env->tlb[i].tlbe;
1148 if (ppcemb_tlb_check(env, tlb, &raddr, eaddr, pid, 0, i) == 0) {
1149 end = tlb->EPN + tlb->size;
1150 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE)
1151 tlb_flush_page(env, page);
1152 tlb->prot &= ~PAGE_VALID;
1157 ppc4xx_tlb_invalidate_all(env);
1161 int mmu40x_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
1162 target_ulong address, int rw, int access_type)
1165 target_phys_addr_t raddr;
1166 int i, ret, zsel, zpr, pr;
1171 for (i = 0; i < env->nb_tlb; i++) {
1172 tlb = &env->tlb[i].tlbe;
1173 if (ppcemb_tlb_check(env, tlb, &raddr, address,
1174 env->spr[SPR_40x_PID], 0, i) < 0)
1176 zsel = (tlb->attr >> 4) & 0xF;
1177 zpr = (env->spr[SPR_40x_ZPR] >> (28 - (2 * zsel))) & 0x3;
1178 #if defined (DEBUG_SOFTWARE_TLB)
1179 if (loglevel != 0) {
1180 fprintf(logfile, "%s: TLB %d zsel %d zpr %d rw %d attr %08x\n",
1181 __func__, i, zsel, zpr, rw, tlb->attr);
1184 /* Check execute enable bit */
1191 /* All accesses granted */
1192 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
1204 /* Check from TLB entry */
1205 /* XXX: there is a problem here or in the TLB fill code... */
1206 ctx->prot = tlb->prot;
1207 ctx->prot |= PAGE_EXEC;
1208 ret = check_prot(ctx->prot, rw, access_type);
1213 #if defined (DEBUG_SOFTWARE_TLB)
1214 if (loglevel != 0) {
1215 fprintf(logfile, "%s: access granted " ADDRX " => " REGX
1216 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
1223 #if defined (DEBUG_SOFTWARE_TLB)
1224 if (loglevel != 0) {
1225 fprintf(logfile, "%s: access refused " ADDRX " => " REGX
1226 " %d %d\n", __func__, address, raddr, ctx->prot,
1234 void store_40x_sler (CPUPPCState *env, uint32_t val)
1236 /* XXX: TO BE FIXED */
1237 if (val != 0x00000000) {
1238 cpu_abort(env, "Little-endian regions are not supported by now\n");
1240 env->spr[SPR_405_SLER] = val;
1243 int mmubooke_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
1244 target_ulong address, int rw,
1248 target_phys_addr_t raddr;
1253 for (i = 0; i < env->nb_tlb; i++) {
1254 tlb = &env->tlb[i].tlbe;
1255 if (ppcemb_tlb_check(env, tlb, &raddr, address,
1256 env->spr[SPR_BOOKE_PID], 1, i) < 0)
1259 prot = tlb->prot & 0xF;
1261 prot = (tlb->prot >> 4) & 0xF;
1262 /* Check the address space */
1263 if (access_type == ACCESS_CODE) {
1264 if (msr_ir != (tlb->attr & 1))
1267 if (prot & PAGE_EXEC) {
1273 if (msr_dr != (tlb->attr & 1))
1276 if ((!rw && prot & PAGE_READ) || (rw && (prot & PAGE_WRITE))) {
1289 static int check_physical (CPUState *env, mmu_ctx_t *ctx,
1290 target_ulong eaddr, int rw)
1295 ctx->prot = PAGE_READ | PAGE_EXEC;
1297 switch (env->mmu_model) {
1298 case POWERPC_MMU_32B:
1299 case POWERPC_MMU_SOFT_6xx:
1300 case POWERPC_MMU_SOFT_74xx:
1301 case POWERPC_MMU_SOFT_4xx:
1302 case POWERPC_MMU_REAL_4xx:
1303 case POWERPC_MMU_BOOKE:
1304 ctx->prot |= PAGE_WRITE;
1306 #if defined(TARGET_PPC64)
1307 case POWERPC_MMU_64B:
1308 /* Real address are 60 bits long */
1309 ctx->raddr &= 0x0FFFFFFFFFFFFFFFULL;
1310 ctx->prot |= PAGE_WRITE;
1313 case POWERPC_MMU_SOFT_4xx_Z:
1314 if (unlikely(msr_pe != 0)) {
1315 /* 403 family add some particular protections,
1316 * using PBL/PBU registers for accesses with no translation.
1319 /* Check PLB validity */
1320 (env->pb[0] < env->pb[1] &&
1321 /* and address in plb area */
1322 eaddr >= env->pb[0] && eaddr < env->pb[1]) ||
1323 (env->pb[2] < env->pb[3] &&
1324 eaddr >= env->pb[2] && eaddr < env->pb[3]) ? 1 : 0;
1325 if (in_plb ^ msr_px) {
1326 /* Access in protected area */
1328 /* Access is not allowed */
1332 /* Read-write access is allowed */
1333 ctx->prot |= PAGE_WRITE;
1337 case POWERPC_MMU_BOOKE_FSL:
1339 cpu_abort(env, "BookE FSL MMU model not implemented\n");
1342 cpu_abort(env, "Unknown or invalid MMU model\n");
1349 int get_physical_address (CPUState *env, mmu_ctx_t *ctx, target_ulong eaddr,
1350 int rw, int access_type, int check_BATs)
1355 if (loglevel != 0) {
1356 fprintf(logfile, "%s\n", __func__);
1359 if ((access_type == ACCESS_CODE && msr_ir == 0) ||
1360 (access_type != ACCESS_CODE && msr_dr == 0)) {
1361 /* No address translation */
1362 ret = check_physical(env, ctx, eaddr, rw);
1365 switch (env->mmu_model) {
1366 case POWERPC_MMU_32B:
1367 case POWERPC_MMU_SOFT_6xx:
1368 case POWERPC_MMU_SOFT_74xx:
1369 /* Try to find a BAT */
1371 ret = get_bat(env, ctx, eaddr, rw, access_type);
1373 #if defined(TARGET_PPC64)
1374 case POWERPC_MMU_64B:
1377 /* We didn't match any BAT entry or don't have BATs */
1378 ret = get_segment(env, ctx, eaddr, rw, access_type);
1381 case POWERPC_MMU_SOFT_4xx:
1382 case POWERPC_MMU_SOFT_4xx_Z:
1383 ret = mmu40x_get_physical_address(env, ctx, eaddr,
1386 case POWERPC_MMU_BOOKE:
1387 ret = mmubooke_get_physical_address(env, ctx, eaddr,
1390 case POWERPC_MMU_BOOKE_FSL:
1392 cpu_abort(env, "BookE FSL MMU model not implemented\n");
1394 case POWERPC_MMU_REAL_4xx:
1395 cpu_abort(env, "PowerPC 401 does not do any translation\n");
1398 cpu_abort(env, "Unknown or invalid MMU model\n");
1403 if (loglevel != 0) {
1404 fprintf(logfile, "%s address " ADDRX " => %d " PADDRX "\n",
1405 __func__, eaddr, ret, ctx->raddr);
1412 target_phys_addr_t cpu_get_phys_page_debug (CPUState *env, target_ulong addr)
1416 if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT, 1) != 0))
1419 return ctx.raddr & TARGET_PAGE_MASK;
1422 /* Perform address translation */
1423 int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
1424 int mmu_idx, int is_softmmu)
1433 access_type = ACCESS_CODE;
1436 /* XXX: put correct access by using cpu_restore_state()
1438 access_type = ACCESS_INT;
1439 // access_type = env->access_type;
1441 ret = get_physical_address(env, &ctx, address, rw, access_type, 1);
1443 ret = tlb_set_page_exec(env, address & TARGET_PAGE_MASK,
1444 ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
1445 mmu_idx, is_softmmu);
1446 } else if (ret < 0) {
1447 #if defined (DEBUG_MMU)
1449 cpu_dump_state(env, logfile, fprintf, 0);
1451 if (access_type == ACCESS_CODE) {
1454 /* No matches in page tables or TLB */
1455 switch (env->mmu_model) {
1456 case POWERPC_MMU_SOFT_6xx:
1457 env->exception_index = POWERPC_EXCP_IFTLB;
1458 env->error_code = 1 << 18;
1459 env->spr[SPR_IMISS] = address;
1460 env->spr[SPR_ICMP] = 0x80000000 | ctx.ptem;
1462 case POWERPC_MMU_SOFT_74xx:
1463 env->exception_index = POWERPC_EXCP_IFTLB;
1465 case POWERPC_MMU_SOFT_4xx:
1466 case POWERPC_MMU_SOFT_4xx_Z:
1467 env->exception_index = POWERPC_EXCP_ITLB;
1468 env->error_code = 0;
1469 env->spr[SPR_40x_DEAR] = address;
1470 env->spr[SPR_40x_ESR] = 0x00000000;
1472 case POWERPC_MMU_32B:
1473 #if defined(TARGET_PPC64)
1474 case POWERPC_MMU_64B:
1476 env->exception_index = POWERPC_EXCP_ISI;
1477 env->error_code = 0x40000000;
1479 case POWERPC_MMU_BOOKE:
1481 cpu_abort(env, "MMU model not implemented\n");
1483 case POWERPC_MMU_BOOKE_FSL:
1485 cpu_abort(env, "MMU model not implemented\n");
1487 case POWERPC_MMU_REAL_4xx:
1488 cpu_abort(env, "PowerPC 401 should never raise any MMU "
1492 cpu_abort(env, "Unknown or invalid MMU model\n");
1497 /* Access rights violation */
1498 env->exception_index = POWERPC_EXCP_ISI;
1499 env->error_code = 0x08000000;
1502 /* No execute protection violation */
1503 env->exception_index = POWERPC_EXCP_ISI;
1504 env->error_code = 0x10000000;
1507 /* Direct store exception */
1508 /* No code fetch is allowed in direct-store areas */
1509 env->exception_index = POWERPC_EXCP_ISI;
1510 env->error_code = 0x10000000;
1512 #if defined(TARGET_PPC64)
1514 /* No match in segment table */
1515 env->exception_index = POWERPC_EXCP_ISEG;
1516 env->error_code = 0;
1523 /* No matches in page tables or TLB */
1524 switch (env->mmu_model) {
1525 case POWERPC_MMU_SOFT_6xx:
1527 env->exception_index = POWERPC_EXCP_DSTLB;
1528 env->error_code = 1 << 16;
1530 env->exception_index = POWERPC_EXCP_DLTLB;
1531 env->error_code = 0;
1533 env->spr[SPR_DMISS] = address;
1534 env->spr[SPR_DCMP] = 0x80000000 | ctx.ptem;
1536 env->error_code |= ctx.key << 19;
1537 env->spr[SPR_HASH1] = ctx.pg_addr[0];
1538 env->spr[SPR_HASH2] = ctx.pg_addr[1];
1540 case POWERPC_MMU_SOFT_74xx:
1542 env->exception_index = POWERPC_EXCP_DSTLB;
1544 env->exception_index = POWERPC_EXCP_DLTLB;
1547 /* Implement LRU algorithm */
1548 env->error_code = ctx.key << 19;
1549 env->spr[SPR_TLBMISS] = (address & ~((target_ulong)0x3)) |
1550 ((env->last_way + 1) & (env->nb_ways - 1));
1551 env->spr[SPR_PTEHI] = 0x80000000 | ctx.ptem;
1553 case POWERPC_MMU_SOFT_4xx:
1554 case POWERPC_MMU_SOFT_4xx_Z:
1555 env->exception_index = POWERPC_EXCP_DTLB;
1556 env->error_code = 0;
1557 env->spr[SPR_40x_DEAR] = address;
1559 env->spr[SPR_40x_ESR] = 0x00800000;
1561 env->spr[SPR_40x_ESR] = 0x00000000;
1563 case POWERPC_MMU_32B:
1564 #if defined(TARGET_PPC64)
1565 case POWERPC_MMU_64B:
1567 env->exception_index = POWERPC_EXCP_DSI;
1568 env->error_code = 0;
1569 env->spr[SPR_DAR] = address;
1571 env->spr[SPR_DSISR] = 0x42000000;
1573 env->spr[SPR_DSISR] = 0x40000000;
1575 case POWERPC_MMU_BOOKE:
1577 cpu_abort(env, "MMU model not implemented\n");
1579 case POWERPC_MMU_BOOKE_FSL:
1581 cpu_abort(env, "MMU model not implemented\n");
1583 case POWERPC_MMU_REAL_4xx:
1584 cpu_abort(env, "PowerPC 401 should never raise any MMU "
1588 cpu_abort(env, "Unknown or invalid MMU model\n");
1593 /* Access rights violation */
1594 env->exception_index = POWERPC_EXCP_DSI;
1595 env->error_code = 0;
1596 env->spr[SPR_DAR] = address;
1598 env->spr[SPR_DSISR] = 0x0A000000;
1600 env->spr[SPR_DSISR] = 0x08000000;
1603 /* Direct store exception */
1604 switch (access_type) {
1606 /* Floating point load/store */
1607 env->exception_index = POWERPC_EXCP_ALIGN;
1608 env->error_code = POWERPC_EXCP_ALIGN_FP;
1609 env->spr[SPR_DAR] = address;
1612 /* lwarx, ldarx or stwcx. */
1613 env->exception_index = POWERPC_EXCP_DSI;
1614 env->error_code = 0;
1615 env->spr[SPR_DAR] = address;
1617 env->spr[SPR_DSISR] = 0x06000000;
1619 env->spr[SPR_DSISR] = 0x04000000;
1622 /* eciwx or ecowx */
1623 env->exception_index = POWERPC_EXCP_DSI;
1624 env->error_code = 0;
1625 env->spr[SPR_DAR] = address;
1627 env->spr[SPR_DSISR] = 0x06100000;
1629 env->spr[SPR_DSISR] = 0x04100000;
1632 printf("DSI: invalid exception (%d)\n", ret);
1633 env->exception_index = POWERPC_EXCP_PROGRAM;
1635 POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL;
1636 env->spr[SPR_DAR] = address;
1640 #if defined(TARGET_PPC64)
1642 /* No match in segment table */
1643 env->exception_index = POWERPC_EXCP_DSEG;
1644 env->error_code = 0;
1645 env->spr[SPR_DAR] = address;
1651 printf("%s: set exception to %d %02x\n", __func__,
1652 env->exception, env->error_code);
1660 /*****************************************************************************/
1661 /* BATs management */
1662 #if !defined(FLUSH_ALL_TLBS)
1663 static always_inline void do_invalidate_BAT (CPUPPCState *env,
1667 target_ulong base, end, page;
1669 base = BATu & ~0x0001FFFF;
1670 end = base + mask + 0x00020000;
1671 #if defined (DEBUG_BATS)
1672 if (loglevel != 0) {
1673 fprintf(logfile, "Flush BAT from " ADDRX " to " ADDRX " (" ADDRX ")\n",
1677 for (page = base; page != end; page += TARGET_PAGE_SIZE)
1678 tlb_flush_page(env, page);
1679 #if defined (DEBUG_BATS)
1681 fprintf(logfile, "Flush done\n");
1686 static always_inline void dump_store_bat (CPUPPCState *env, char ID,
1687 int ul, int nr, target_ulong value)
1689 #if defined (DEBUG_BATS)
1690 if (loglevel != 0) {
1691 fprintf(logfile, "Set %cBAT%d%c to 0x" ADDRX " (0x" ADDRX ")\n",
1692 ID, nr, ul == 0 ? 'u' : 'l', value, env->nip);
1697 target_ulong do_load_ibatu (CPUPPCState *env, int nr)
1699 return env->IBAT[0][nr];
1702 target_ulong do_load_ibatl (CPUPPCState *env, int nr)
1704 return env->IBAT[1][nr];
1707 void do_store_ibatu (CPUPPCState *env, int nr, target_ulong value)
1711 dump_store_bat(env, 'I', 0, nr, value);
1712 if (env->IBAT[0][nr] != value) {
1713 mask = (value << 15) & 0x0FFE0000UL;
1714 #if !defined(FLUSH_ALL_TLBS)
1715 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1717 /* When storing valid upper BAT, mask BEPI and BRPN
1718 * and invalidate all TLBs covered by this BAT
1720 mask = (value << 15) & 0x0FFE0000UL;
1721 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1722 (value & ~0x0001FFFFUL & ~mask);
1723 env->IBAT[1][nr] = (env->IBAT[1][nr] & 0x0000007B) |
1724 (env->IBAT[1][nr] & ~0x0001FFFF & ~mask);
1725 #if !defined(FLUSH_ALL_TLBS)
1726 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1733 void do_store_ibatl (CPUPPCState *env, int nr, target_ulong value)
1735 dump_store_bat(env, 'I', 1, nr, value);
1736 env->IBAT[1][nr] = value;
1739 target_ulong do_load_dbatu (CPUPPCState *env, int nr)
1741 return env->DBAT[0][nr];
1744 target_ulong do_load_dbatl (CPUPPCState *env, int nr)
1746 return env->DBAT[1][nr];
1749 void do_store_dbatu (CPUPPCState *env, int nr, target_ulong value)
1753 dump_store_bat(env, 'D', 0, nr, value);
1754 if (env->DBAT[0][nr] != value) {
1755 /* When storing valid upper BAT, mask BEPI and BRPN
1756 * and invalidate all TLBs covered by this BAT
1758 mask = (value << 15) & 0x0FFE0000UL;
1759 #if !defined(FLUSH_ALL_TLBS)
1760 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1762 mask = (value << 15) & 0x0FFE0000UL;
1763 env->DBAT[0][nr] = (value & 0x00001FFFUL) |
1764 (value & ~0x0001FFFFUL & ~mask);
1765 env->DBAT[1][nr] = (env->DBAT[1][nr] & 0x0000007B) |
1766 (env->DBAT[1][nr] & ~0x0001FFFF & ~mask);
1767 #if !defined(FLUSH_ALL_TLBS)
1768 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1775 void do_store_dbatl (CPUPPCState *env, int nr, target_ulong value)
1777 dump_store_bat(env, 'D', 1, nr, value);
1778 env->DBAT[1][nr] = value;
1781 /*****************************************************************************/
1782 /* TLB management */
1783 void ppc_tlb_invalidate_all (CPUPPCState *env)
1785 switch (env->mmu_model) {
1786 case POWERPC_MMU_SOFT_6xx:
1787 case POWERPC_MMU_SOFT_74xx:
1788 ppc6xx_tlb_invalidate_all(env);
1790 case POWERPC_MMU_SOFT_4xx:
1791 case POWERPC_MMU_SOFT_4xx_Z:
1792 ppc4xx_tlb_invalidate_all(env);
1794 case POWERPC_MMU_REAL_4xx:
1795 cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
1797 case POWERPC_MMU_BOOKE:
1799 cpu_abort(env, "MMU model not implemented\n");
1801 case POWERPC_MMU_BOOKE_FSL:
1803 cpu_abort(env, "MMU model not implemented\n");
1805 case POWERPC_MMU_32B:
1806 #if defined(TARGET_PPC64)
1807 case POWERPC_MMU_64B:
1808 #endif /* defined(TARGET_PPC64) */
1813 cpu_abort(env, "Unknown MMU model\n");
1818 void ppc_tlb_invalidate_one (CPUPPCState *env, target_ulong addr)
1820 #if !defined(FLUSH_ALL_TLBS)
1821 addr &= TARGET_PAGE_MASK;
1822 switch (env->mmu_model) {
1823 case POWERPC_MMU_SOFT_6xx:
1824 case POWERPC_MMU_SOFT_74xx:
1825 ppc6xx_tlb_invalidate_virt(env, addr, 0);
1826 if (env->id_tlbs == 1)
1827 ppc6xx_tlb_invalidate_virt(env, addr, 1);
1829 case POWERPC_MMU_SOFT_4xx:
1830 case POWERPC_MMU_SOFT_4xx_Z:
1831 ppc4xx_tlb_invalidate_virt(env, addr, env->spr[SPR_40x_PID]);
1833 case POWERPC_MMU_REAL_4xx:
1834 cpu_abort(env, "No TLB for PowerPC 4xx in real mode\n");
1836 case POWERPC_MMU_BOOKE:
1838 cpu_abort(env, "MMU model not implemented\n");
1840 case POWERPC_MMU_BOOKE_FSL:
1842 cpu_abort(env, "MMU model not implemented\n");
1844 case POWERPC_MMU_32B:
1845 /* tlbie invalidate TLBs for all segments */
1846 addr &= ~((target_ulong)-1 << 28);
1847 /* XXX: this case should be optimized,
1848 * giving a mask to tlb_flush_page
1850 tlb_flush_page(env, addr | (0x0 << 28));
1851 tlb_flush_page(env, addr | (0x1 << 28));
1852 tlb_flush_page(env, addr | (0x2 << 28));
1853 tlb_flush_page(env, addr | (0x3 << 28));
1854 tlb_flush_page(env, addr | (0x4 << 28));
1855 tlb_flush_page(env, addr | (0x5 << 28));
1856 tlb_flush_page(env, addr | (0x6 << 28));
1857 tlb_flush_page(env, addr | (0x7 << 28));
1858 tlb_flush_page(env, addr | (0x8 << 28));
1859 tlb_flush_page(env, addr | (0x9 << 28));
1860 tlb_flush_page(env, addr | (0xA << 28));
1861 tlb_flush_page(env, addr | (0xB << 28));
1862 tlb_flush_page(env, addr | (0xC << 28));
1863 tlb_flush_page(env, addr | (0xD << 28));
1864 tlb_flush_page(env, addr | (0xE << 28));
1865 tlb_flush_page(env, addr | (0xF << 28));
1867 #if defined(TARGET_PPC64)
1868 case POWERPC_MMU_64B:
1869 /* tlbie invalidate TLBs for all segments */
1870 /* XXX: given the fact that there are too many segments to invalidate,
1871 * and we still don't have a tlb_flush_mask(env, n, mask) in Qemu,
1872 * we just invalidate all TLBs
1876 #endif /* defined(TARGET_PPC64) */
1879 cpu_abort(env, "Unknown MMU model\n");
1883 ppc_tlb_invalidate_all(env);
1887 /*****************************************************************************/
1888 /* Special registers manipulation */
1889 #if defined(TARGET_PPC64)
1890 target_ulong ppc_load_asr (CPUPPCState *env)
1895 void ppc_store_asr (CPUPPCState *env, target_ulong value)
1897 if (env->asr != value) {
1904 target_ulong do_load_sdr1 (CPUPPCState *env)
1909 void do_store_sdr1 (CPUPPCState *env, target_ulong value)
1911 #if defined (DEBUG_MMU)
1912 if (loglevel != 0) {
1913 fprintf(logfile, "%s: 0x" ADDRX "\n", __func__, value);
1916 if (env->sdr1 != value) {
1917 /* XXX: for PowerPC 64, should check that the HTABSIZE value
1926 target_ulong do_load_sr (CPUPPCState *env, int srnum)
1928 return env->sr[srnum];
1932 void do_store_sr (CPUPPCState *env, int srnum, target_ulong value)
1934 #if defined (DEBUG_MMU)
1935 if (loglevel != 0) {
1936 fprintf(logfile, "%s: reg=%d 0x" ADDRX " " ADDRX "\n",
1937 __func__, srnum, value, env->sr[srnum]);
1940 if (env->sr[srnum] != value) {
1941 env->sr[srnum] = value;
1942 #if !defined(FLUSH_ALL_TLBS) && 0
1944 target_ulong page, end;
1945 /* Invalidate 256 MB of virtual memory */
1946 page = (16 << 20) * srnum;
1947 end = page + (16 << 20);
1948 for (; page != end; page += TARGET_PAGE_SIZE)
1949 tlb_flush_page(env, page);
1956 #endif /* !defined (CONFIG_USER_ONLY) */
1958 target_ulong ppc_load_xer (CPUPPCState *env)
1960 return hreg_load_xer(env);
1963 void ppc_store_xer (CPUPPCState *env, target_ulong value)
1965 hreg_store_xer(env, value);
1968 /* GDBstub can read and write MSR... */
1969 void ppc_store_msr (CPUPPCState *env, target_ulong value)
1971 hreg_store_msr(env, value);
1974 /*****************************************************************************/
1975 /* Exception processing */
1976 #if defined (CONFIG_USER_ONLY)
1977 void do_interrupt (CPUState *env)
1979 env->exception_index = POWERPC_EXCP_NONE;
1980 env->error_code = 0;
1983 void ppc_hw_interrupt (CPUState *env)
1985 env->exception_index = POWERPC_EXCP_NONE;
1986 env->error_code = 0;
1988 #else /* defined (CONFIG_USER_ONLY) */
1989 static void dump_syscall (CPUState *env)
1991 fprintf(logfile, "syscall r0=0x" REGX " r3=0x" REGX " r4=0x" REGX
1992 " r5=0x" REGX " r6=0x" REGX " nip=0x" ADDRX "\n",
1993 env->gpr[0], env->gpr[3], env->gpr[4],
1994 env->gpr[5], env->gpr[6], env->nip);
1997 /* Note that this function should be greatly optimized
1998 * when called with a constant excp, from ppc_hw_interrupt
2000 static always_inline void powerpc_excp (CPUState *env,
2001 int excp_model, int excp)
2003 target_ulong msr, new_msr, vector;
2004 int srr0, srr1, asrr0, asrr1;
2005 #if defined(TARGET_PPC64H)
2006 int lpes0, lpes1, lev;
2008 lpes0 = (env->spr[SPR_LPCR] >> 1) & 1;
2009 lpes1 = (env->spr[SPR_LPCR] >> 2) & 1;
2012 if (loglevel & CPU_LOG_INT) {
2013 fprintf(logfile, "Raise exception at 0x" ADDRX " => 0x%08x (%02x)\n",
2014 env->nip, excp, env->error_code);
2022 msr &= ~((target_ulong)0x783F0000);
2024 case POWERPC_EXCP_NONE:
2025 /* Should never happen */
2027 case POWERPC_EXCP_CRITICAL: /* Critical input */
2028 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2029 switch (excp_model) {
2030 case POWERPC_EXCP_40x:
2031 srr0 = SPR_40x_SRR2;
2032 srr1 = SPR_40x_SRR3;
2034 case POWERPC_EXCP_BOOKE:
2035 srr0 = SPR_BOOKE_CSRR0;
2036 srr1 = SPR_BOOKE_CSRR1;
2038 case POWERPC_EXCP_G2:
2044 case POWERPC_EXCP_MCHECK: /* Machine check exception */
2046 /* Machine check exception is not enabled.
2047 * Enter checkstop state.
2049 if (loglevel != 0) {
2050 fprintf(logfile, "Machine check while not allowed. "
2051 "Entering checkstop state\n");
2053 fprintf(stderr, "Machine check while not allowed. "
2054 "Entering checkstop state\n");
2057 env->interrupt_request |= CPU_INTERRUPT_EXITTB;
2059 new_msr &= ~((target_ulong)1 << MSR_RI);
2060 new_msr &= ~((target_ulong)1 << MSR_ME);
2061 #if defined(TARGET_PPC64H)
2062 new_msr |= (target_ulong)1 << MSR_HV;
2064 /* XXX: should also have something loaded in DAR / DSISR */
2065 switch (excp_model) {
2066 case POWERPC_EXCP_40x:
2067 srr0 = SPR_40x_SRR2;
2068 srr1 = SPR_40x_SRR3;
2070 case POWERPC_EXCP_BOOKE:
2071 srr0 = SPR_BOOKE_MCSRR0;
2072 srr1 = SPR_BOOKE_MCSRR1;
2073 asrr0 = SPR_BOOKE_CSRR0;
2074 asrr1 = SPR_BOOKE_CSRR1;
2080 case POWERPC_EXCP_DSI: /* Data storage exception */
2081 #if defined (DEBUG_EXCEPTIONS)
2082 if (loglevel != 0) {
2083 fprintf(logfile, "DSI exception: DSISR=0x" ADDRX" DAR=0x" ADDRX
2084 "\n", env->spr[SPR_DSISR], env->spr[SPR_DAR]);
2087 new_msr &= ~((target_ulong)1 << MSR_RI);
2088 #if defined(TARGET_PPC64H)
2090 new_msr |= (target_ulong)1 << MSR_HV;
2093 case POWERPC_EXCP_ISI: /* Instruction storage exception */
2094 #if defined (DEBUG_EXCEPTIONS)
2095 if (loglevel != 0) {
2096 fprintf(logfile, "ISI exception: msr=0x" ADDRX ", nip=0x" ADDRX
2097 "\n", msr, env->nip);
2100 new_msr &= ~((target_ulong)1 << MSR_RI);
2101 #if defined(TARGET_PPC64H)
2103 new_msr |= (target_ulong)1 << MSR_HV;
2105 msr |= env->error_code;
2107 case POWERPC_EXCP_EXTERNAL: /* External input */
2108 new_msr &= ~((target_ulong)1 << MSR_RI);
2109 #if defined(TARGET_PPC64H)
2111 new_msr |= (target_ulong)1 << MSR_HV;
2114 case POWERPC_EXCP_ALIGN: /* Alignment exception */
2115 new_msr &= ~((target_ulong)1 << MSR_RI);
2116 #if defined(TARGET_PPC64H)
2118 new_msr |= (target_ulong)1 << MSR_HV;
2120 /* XXX: this is false */
2121 /* Get rS/rD and rA from faulting opcode */
2122 env->spr[SPR_DSISR] |= (ldl_code((env->nip - 4)) & 0x03FF0000) >> 16;
2124 case POWERPC_EXCP_PROGRAM: /* Program exception */
2125 switch (env->error_code & ~0xF) {
2126 case POWERPC_EXCP_FP:
2127 if ((msr_fe0 == 0 && msr_fe1 == 0) || msr_fp == 0) {
2128 #if defined (DEBUG_EXCEPTIONS)
2129 if (loglevel != 0) {
2130 fprintf(logfile, "Ignore floating point exception\n");
2135 new_msr &= ~((target_ulong)1 << MSR_RI);
2136 #if defined(TARGET_PPC64H)
2138 new_msr |= (target_ulong)1 << MSR_HV;
2142 env->fpscr[7] |= 0x8;
2143 /* Finally, update FEX */
2144 if ((((env->fpscr[7] & 0x3) << 3) | (env->fpscr[6] >> 1)) &
2145 ((env->fpscr[1] << 1) | (env->fpscr[0] >> 3)))
2146 env->fpscr[7] |= 0x4;
2147 if (msr_fe0 != msr_fe1) {
2152 case POWERPC_EXCP_INVAL:
2153 #if defined (DEBUG_EXCEPTIONS)
2154 if (loglevel != 0) {
2155 fprintf(logfile, "Invalid instruction at 0x" ADDRX "\n",
2159 new_msr &= ~((target_ulong)1 << MSR_RI);
2160 #if defined(TARGET_PPC64H)
2162 new_msr |= (target_ulong)1 << MSR_HV;
2166 case POWERPC_EXCP_PRIV:
2167 new_msr &= ~((target_ulong)1 << MSR_RI);
2168 #if defined(TARGET_PPC64H)
2170 new_msr |= (target_ulong)1 << MSR_HV;
2174 case POWERPC_EXCP_TRAP:
2175 new_msr &= ~((target_ulong)1 << MSR_RI);
2176 #if defined(TARGET_PPC64H)
2178 new_msr |= (target_ulong)1 << MSR_HV;
2183 /* Should never occur */
2184 cpu_abort(env, "Invalid program exception %d. Aborting\n",
2189 case POWERPC_EXCP_FPU: /* Floating-point unavailable exception */
2190 new_msr &= ~((target_ulong)1 << MSR_RI);
2191 #if defined(TARGET_PPC64H)
2193 new_msr |= (target_ulong)1 << MSR_HV;
2196 case POWERPC_EXCP_SYSCALL: /* System call exception */
2197 /* NOTE: this is a temporary hack to support graphics OSI
2198 calls from the MOL driver */
2199 /* XXX: To be removed */
2200 if (env->gpr[3] == 0x113724fa && env->gpr[4] == 0x77810f9b &&
2202 if (env->osi_call(env) != 0)
2205 if (loglevel & CPU_LOG_INT) {
2208 new_msr &= ~((target_ulong)1 << MSR_RI);
2209 #if defined(TARGET_PPC64H)
2210 lev = env->error_code;
2211 if (lev == 1 || (lpes0 == 0 && lpes1 == 0))
2212 new_msr |= (target_ulong)1 << MSR_HV;
2215 case POWERPC_EXCP_APU: /* Auxiliary processor unavailable */
2216 new_msr &= ~((target_ulong)1 << MSR_RI);
2218 case POWERPC_EXCP_DECR: /* Decrementer exception */
2219 new_msr &= ~((target_ulong)1 << MSR_RI);
2220 #if defined(TARGET_PPC64H)
2222 new_msr |= (target_ulong)1 << MSR_HV;
2225 case POWERPC_EXCP_FIT: /* Fixed-interval timer interrupt */
2227 #if defined (DEBUG_EXCEPTIONS)
2229 fprintf(logfile, "FIT exception\n");
2231 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2233 case POWERPC_EXCP_WDT: /* Watchdog timer interrupt */
2234 #if defined (DEBUG_EXCEPTIONS)
2236 fprintf(logfile, "WDT exception\n");
2238 switch (excp_model) {
2239 case POWERPC_EXCP_BOOKE:
2240 srr0 = SPR_BOOKE_CSRR0;
2241 srr1 = SPR_BOOKE_CSRR1;
2246 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2248 case POWERPC_EXCP_DTLB: /* Data TLB error */
2249 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2251 case POWERPC_EXCP_ITLB: /* Instruction TLB error */
2252 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2254 case POWERPC_EXCP_DEBUG: /* Debug interrupt */
2255 switch (excp_model) {
2256 case POWERPC_EXCP_BOOKE:
2257 srr0 = SPR_BOOKE_DSRR0;
2258 srr1 = SPR_BOOKE_DSRR1;
2259 asrr0 = SPR_BOOKE_CSRR0;
2260 asrr1 = SPR_BOOKE_CSRR1;
2266 cpu_abort(env, "Debug exception is not implemented yet !\n");
2268 #if defined(TARGET_PPCEMB)
2269 case POWERPC_EXCP_SPEU: /* SPE/embedded floating-point unavailable */
2270 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2272 case POWERPC_EXCP_EFPDI: /* Embedded floating-point data interrupt */
2274 cpu_abort(env, "Embedded floating point data exception "
2275 "is not implemented yet !\n");
2277 case POWERPC_EXCP_EFPRI: /* Embedded floating-point round interrupt */
2279 cpu_abort(env, "Embedded floating point round exception "
2280 "is not implemented yet !\n");
2282 case POWERPC_EXCP_EPERFM: /* Embedded performance monitor interrupt */
2283 new_msr &= ~((target_ulong)1 << MSR_RI);
2286 "Performance counter exception is not implemented yet !\n");
2288 case POWERPC_EXCP_DOORI: /* Embedded doorbell interrupt */
2291 "Embedded doorbell interrupt is not implemented yet !\n");
2293 case POWERPC_EXCP_DOORCI: /* Embedded doorbell critical interrupt */
2294 switch (excp_model) {
2295 case POWERPC_EXCP_BOOKE:
2296 srr0 = SPR_BOOKE_CSRR0;
2297 srr1 = SPR_BOOKE_CSRR1;
2303 cpu_abort(env, "Embedded doorbell critical interrupt "
2304 "is not implemented yet !\n");
2306 #endif /* defined(TARGET_PPCEMB) */
2307 case POWERPC_EXCP_RESET: /* System reset exception */
2308 new_msr &= ~((target_ulong)1 << MSR_RI);
2309 #if defined(TARGET_PPC64H)
2310 new_msr |= (target_ulong)1 << MSR_HV;
2313 #if defined(TARGET_PPC64)
2314 case POWERPC_EXCP_DSEG: /* Data segment exception */
2315 new_msr &= ~((target_ulong)1 << MSR_RI);
2316 #if defined(TARGET_PPC64H)
2318 new_msr |= (target_ulong)1 << MSR_HV;
2321 case POWERPC_EXCP_ISEG: /* Instruction segment exception */
2322 new_msr &= ~((target_ulong)1 << MSR_RI);
2323 #if defined(TARGET_PPC64H)
2325 new_msr |= (target_ulong)1 << MSR_HV;
2328 #endif /* defined(TARGET_PPC64) */
2329 #if defined(TARGET_PPC64H)
2330 case POWERPC_EXCP_HDECR: /* Hypervisor decrementer exception */
2333 new_msr |= (target_ulong)1 << MSR_HV;
2336 case POWERPC_EXCP_TRACE: /* Trace exception */
2337 new_msr &= ~((target_ulong)1 << MSR_RI);
2338 #if defined(TARGET_PPC64H)
2340 new_msr |= (target_ulong)1 << MSR_HV;
2343 #if defined(TARGET_PPC64H)
2344 case POWERPC_EXCP_HDSI: /* Hypervisor data storage exception */
2347 new_msr |= (target_ulong)1 << MSR_HV;
2349 case POWERPC_EXCP_HISI: /* Hypervisor instruction storage exception */
2352 new_msr |= (target_ulong)1 << MSR_HV;
2354 case POWERPC_EXCP_HDSEG: /* Hypervisor data segment exception */
2357 new_msr |= (target_ulong)1 << MSR_HV;
2359 case POWERPC_EXCP_HISEG: /* Hypervisor instruction segment exception */
2362 new_msr |= (target_ulong)1 << MSR_HV;
2364 #endif /* defined(TARGET_PPC64H) */
2365 case POWERPC_EXCP_VPU: /* Vector unavailable exception */
2366 new_msr &= ~((target_ulong)1 << MSR_RI);
2367 #if defined(TARGET_PPC64H)
2369 new_msr |= (target_ulong)1 << MSR_HV;
2372 case POWERPC_EXCP_PIT: /* Programmable interval timer interrupt */
2373 #if defined (DEBUG_EXCEPTIONS)
2375 fprintf(logfile, "PIT exception\n");
2377 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2379 case POWERPC_EXCP_IO: /* IO error exception */
2381 cpu_abort(env, "601 IO error exception is not implemented yet !\n");
2383 case POWERPC_EXCP_RUNM: /* Run mode exception */
2385 cpu_abort(env, "601 run mode exception is not implemented yet !\n");
2387 case POWERPC_EXCP_EMUL: /* Emulation trap exception */
2389 cpu_abort(env, "602 emulation trap exception "
2390 "is not implemented yet !\n");
2392 case POWERPC_EXCP_IFTLB: /* Instruction fetch TLB error */
2393 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2394 #if defined(TARGET_PPC64H) /* XXX: check this */
2396 new_msr |= (target_ulong)1 << MSR_HV;
2398 switch (excp_model) {
2399 case POWERPC_EXCP_602:
2400 case POWERPC_EXCP_603:
2401 case POWERPC_EXCP_603E:
2402 case POWERPC_EXCP_G2:
2404 case POWERPC_EXCP_7x5:
2406 case POWERPC_EXCP_74xx:
2409 cpu_abort(env, "Invalid instruction TLB miss exception\n");
2413 case POWERPC_EXCP_DLTLB: /* Data load TLB miss */
2414 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2415 #if defined(TARGET_PPC64H) /* XXX: check this */
2417 new_msr |= (target_ulong)1 << MSR_HV;
2419 switch (excp_model) {
2420 case POWERPC_EXCP_602:
2421 case POWERPC_EXCP_603:
2422 case POWERPC_EXCP_603E:
2423 case POWERPC_EXCP_G2:
2425 case POWERPC_EXCP_7x5:
2427 case POWERPC_EXCP_74xx:
2430 cpu_abort(env, "Invalid data load TLB miss exception\n");
2434 case POWERPC_EXCP_DSTLB: /* Data store TLB miss */
2435 new_msr &= ~((target_ulong)1 << MSR_RI); /* XXX: check this */
2436 #if defined(TARGET_PPC64H) /* XXX: check this */
2438 new_msr |= (target_ulong)1 << MSR_HV;
2440 switch (excp_model) {
2441 case POWERPC_EXCP_602:
2442 case POWERPC_EXCP_603:
2443 case POWERPC_EXCP_603E:
2444 case POWERPC_EXCP_G2:
2446 /* Swap temporary saved registers with GPRs */
2447 if (!(new_msr & ((target_ulong)1 << MSR_TGPR))) {
2448 new_msr |= (target_ulong)1 << MSR_TGPR;
2449 hreg_swap_gpr_tgpr(env);
2452 case POWERPC_EXCP_7x5:
2454 #if defined (DEBUG_SOFTWARE_TLB)
2455 if (loglevel != 0) {
2456 const unsigned char *es;
2457 target_ulong *miss, *cmp;
2459 if (excp == POWERPC_EXCP_IFTLB) {
2462 miss = &env->spr[SPR_IMISS];
2463 cmp = &env->spr[SPR_ICMP];
2465 if (excp == POWERPC_EXCP_DLTLB)
2470 miss = &env->spr[SPR_DMISS];
2471 cmp = &env->spr[SPR_DCMP];
2473 fprintf(logfile, "6xx %sTLB miss: %cM " ADDRX " %cC " ADDRX
2474 " H1 " ADDRX " H2 " ADDRX " %08x\n",
2475 es, en, *miss, en, *cmp,
2476 env->spr[SPR_HASH1], env->spr[SPR_HASH2],
2480 msr |= env->crf[0] << 28;
2481 msr |= env->error_code; /* key, D/I, S/L bits */
2482 /* Set way using a LRU mechanism */
2483 msr |= ((env->last_way + 1) & (env->nb_ways - 1)) << 17;
2485 case POWERPC_EXCP_74xx:
2487 #if defined (DEBUG_SOFTWARE_TLB)
2488 if (loglevel != 0) {
2489 const unsigned char *es;
2490 target_ulong *miss, *cmp;
2492 if (excp == POWERPC_EXCP_IFTLB) {
2495 miss = &env->spr[SPR_TLBMISS];
2496 cmp = &env->spr[SPR_PTEHI];
2498 if (excp == POWERPC_EXCP_DLTLB)
2503 miss = &env->spr[SPR_TLBMISS];
2504 cmp = &env->spr[SPR_PTEHI];
2506 fprintf(logfile, "74xx %sTLB miss: %cM " ADDRX " %cC " ADDRX
2508 es, en, *miss, en, *cmp, env->error_code);
2511 msr |= env->error_code; /* key bit */
2514 cpu_abort(env, "Invalid data store TLB miss exception\n");
2518 case POWERPC_EXCP_FPA: /* Floating-point assist exception */
2520 cpu_abort(env, "Floating point assist exception "
2521 "is not implemented yet !\n");
2523 case POWERPC_EXCP_IABR: /* Instruction address breakpoint */
2525 cpu_abort(env, "IABR exception is not implemented yet !\n");
2527 case POWERPC_EXCP_SMI: /* System management interrupt */
2529 cpu_abort(env, "SMI exception is not implemented yet !\n");
2531 case POWERPC_EXCP_THERM: /* Thermal interrupt */
2533 cpu_abort(env, "Thermal management exception "
2534 "is not implemented yet !\n");
2536 case POWERPC_EXCP_PERFM: /* Embedded performance monitor interrupt */
2537 new_msr &= ~((target_ulong)1 << MSR_RI);
2538 #if defined(TARGET_PPC64H)
2540 new_msr |= (target_ulong)1 << MSR_HV;
2544 "Performance counter exception is not implemented yet !\n");
2546 case POWERPC_EXCP_VPUA: /* Vector assist exception */
2548 cpu_abort(env, "VPU assist exception is not implemented yet !\n");
2550 case POWERPC_EXCP_SOFTP: /* Soft patch exception */
2553 "970 soft-patch exception is not implemented yet !\n");
2555 case POWERPC_EXCP_MAINT: /* Maintenance exception */
2558 "970 maintenance exception is not implemented yet !\n");
2562 cpu_abort(env, "Invalid PowerPC exception %d. Aborting\n", excp);
2565 /* save current instruction location */
2566 env->spr[srr0] = env->nip - 4;
2569 /* save next instruction location */
2570 env->spr[srr0] = env->nip;
2574 env->spr[srr1] = msr;
2575 /* If any alternate SRR register are defined, duplicate saved values */
2577 env->spr[asrr0] = env->spr[srr0];
2579 env->spr[asrr1] = env->spr[srr1];
2580 /* If we disactivated any translation, flush TLBs */
2581 if (new_msr & ((1 << MSR_IR) | (1 << MSR_DR)))
2583 /* reload MSR with correct bits */
2584 new_msr &= ~((target_ulong)1 << MSR_EE);
2585 new_msr &= ~((target_ulong)1 << MSR_PR);
2586 new_msr &= ~((target_ulong)1 << MSR_FP);
2587 new_msr &= ~((target_ulong)1 << MSR_FE0);
2588 new_msr &= ~((target_ulong)1 << MSR_SE);
2589 new_msr &= ~((target_ulong)1 << MSR_BE);
2590 new_msr &= ~((target_ulong)1 << MSR_FE1);
2591 new_msr &= ~((target_ulong)1 << MSR_IR);
2592 new_msr &= ~((target_ulong)1 << MSR_DR);
2593 #if 0 /* Fix this: not on all targets */
2594 new_msr &= ~((target_ulong)1 << MSR_PMM);
2596 new_msr &= ~((target_ulong)1 << MSR_LE);
2598 new_msr |= (target_ulong)1 << MSR_LE;
2600 new_msr &= ~((target_ulong)1 << MSR_LE);
2601 /* Jump to handler */
2602 vector = env->excp_vectors[excp];
2603 if (vector == (target_ulong)-1) {
2604 cpu_abort(env, "Raised an exception without defined vector %d\n",
2607 vector |= env->excp_prefix;
2608 #if defined(TARGET_PPC64)
2609 if (excp_model == POWERPC_EXCP_BOOKE) {
2611 new_msr &= ~((target_ulong)1 << MSR_CM);
2612 vector = (uint32_t)vector;
2614 new_msr |= (target_ulong)1 << MSR_CM;
2618 new_msr &= ~((target_ulong)1 << MSR_SF);
2619 vector = (uint32_t)vector;
2621 new_msr |= (target_ulong)1 << MSR_SF;
2625 /* XXX: we don't use hreg_store_msr here as already have treated
2626 * any special case that could occur. Just store MSR and update hflags
2629 hreg_compute_hflags(env);
2631 /* Reset exception state */
2632 env->exception_index = POWERPC_EXCP_NONE;
2633 env->error_code = 0;
2636 void do_interrupt (CPUState *env)
2638 powerpc_excp(env, env->excp_model, env->exception_index);
2641 void ppc_hw_interrupt (CPUPPCState *env)
2643 #if defined(TARGET_PPC64H)
2648 if (loglevel & CPU_LOG_INT) {
2649 fprintf(logfile, "%s: %p pending %08x req %08x me %d ee %d\n",
2650 __func__, env, env->pending_interrupts,
2651 env->interrupt_request, (int)msr_me, (int)msr_ee);
2654 /* External reset */
2655 if (env->pending_interrupts & (1 << PPC_INTERRUPT_RESET)) {
2656 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_RESET);
2657 powerpc_excp(env, env->excp_model, POWERPC_EXCP_RESET);
2660 /* Machine check exception */
2661 if (env->pending_interrupts & (1 << PPC_INTERRUPT_MCK)) {
2662 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_MCK);
2663 powerpc_excp(env, env->excp_model, POWERPC_EXCP_MCHECK);
2667 /* External debug exception */
2668 if (env->pending_interrupts & (1 << PPC_INTERRUPT_DEBUG)) {
2669 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DEBUG);
2670 powerpc_excp(env, env->excp_model, POWERPC_EXCP_DEBUG);
2674 #if defined(TARGET_PPC64H)
2675 hdice = env->spr[SPR_LPCR] & 1;
2676 if ((msr_ee != 0 || msr_hv == 0 || msr_pr != 0) && hdice != 0) {
2677 /* Hypervisor decrementer exception */
2678 if (env->pending_interrupts & (1 << PPC_INTERRUPT_HDECR)) {
2679 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_HDECR);
2680 powerpc_excp(env, env->excp_model, POWERPC_EXCP_HDECR);
2686 /* External critical interrupt */
2687 if (env->pending_interrupts & (1 << PPC_INTERRUPT_CEXT)) {
2688 /* Taking a critical external interrupt does not clear the external
2689 * critical interrupt status
2692 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_CEXT);
2694 powerpc_excp(env, env->excp_model, POWERPC_EXCP_CRITICAL);
2699 /* Watchdog timer on embedded PowerPC */
2700 if (env->pending_interrupts & (1 << PPC_INTERRUPT_WDT)) {
2701 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_WDT);
2702 powerpc_excp(env, env->excp_model, POWERPC_EXCP_WDT);
2705 #if defined(TARGET_PPCEMB)
2706 if (env->pending_interrupts & (1 << PPC_INTERRUPT_CDOORBELL)) {
2707 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_CDOORBELL);
2708 powerpc_excp(env, env->excp_model, POWERPC_EXCP_DOORCI);
2712 #if defined(TARGET_PPCEMB)
2713 /* External interrupt */
2714 if (env->pending_interrupts & (1 << PPC_INTERRUPT_EXT)) {
2715 /* Taking an external interrupt does not clear the external
2719 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_EXT);
2721 powerpc_excp(env, env->excp_model, POWERPC_EXCP_EXTERNAL);
2725 /* Fixed interval timer on embedded PowerPC */
2726 if (env->pending_interrupts & (1 << PPC_INTERRUPT_FIT)) {
2727 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_FIT);
2728 powerpc_excp(env, env->excp_model, POWERPC_EXCP_FIT);
2731 /* Programmable interval timer on embedded PowerPC */
2732 if (env->pending_interrupts & (1 << PPC_INTERRUPT_PIT)) {
2733 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_PIT);
2734 powerpc_excp(env, env->excp_model, POWERPC_EXCP_PIT);
2737 /* Decrementer exception */
2738 if (env->pending_interrupts & (1 << PPC_INTERRUPT_DECR)) {
2739 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DECR);
2740 powerpc_excp(env, env->excp_model, POWERPC_EXCP_DECR);
2743 #if !defined(TARGET_PPCEMB)
2744 /* External interrupt */
2745 if (env->pending_interrupts & (1 << PPC_INTERRUPT_EXT)) {
2746 /* Taking an external interrupt does not clear the external
2750 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_EXT);
2752 powerpc_excp(env, env->excp_model, POWERPC_EXCP_EXTERNAL);
2756 #if defined(TARGET_PPCEMB)
2757 if (env->pending_interrupts & (1 << PPC_INTERRUPT_DOORBELL)) {
2758 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DOORBELL);
2759 powerpc_excp(env, env->excp_model, POWERPC_EXCP_DOORI);
2763 if (env->pending_interrupts & (1 << PPC_INTERRUPT_PERFM)) {
2764 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_PERFM);
2765 powerpc_excp(env, env->excp_model, POWERPC_EXCP_PERFM);
2768 /* Thermal interrupt */
2769 if (env->pending_interrupts & (1 << PPC_INTERRUPT_THERM)) {
2770 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_THERM);
2771 powerpc_excp(env, env->excp_model, POWERPC_EXCP_THERM);
2776 #endif /* !CONFIG_USER_ONLY */
2778 void cpu_dump_EA (target_ulong EA)
2788 fprintf(f, "Memory access at address " ADDRX "\n", EA);
2791 void cpu_dump_rfi (target_ulong RA, target_ulong msr)
2801 fprintf(f, "Return from exception at " ADDRX " with flags " ADDRX "\n",
2805 void cpu_ppc_reset (void *opaque)
2811 msr = (target_ulong)0;
2812 #if defined(TARGET_PPC64)
2813 msr |= (target_ulong)0 << MSR_HV; /* Should be 1... */
2815 msr |= (target_ulong)0 << MSR_AP; /* TO BE CHECKED */
2816 msr |= (target_ulong)0 << MSR_SA; /* TO BE CHECKED */
2817 msr |= (target_ulong)1 << MSR_EP;
2818 #if defined (DO_SINGLE_STEP) && 0
2819 /* Single step trace mode */
2820 msr |= (target_ulong)1 << MSR_SE;
2821 msr |= (target_ulong)1 << MSR_BE;
2823 #if defined(CONFIG_USER_ONLY)
2824 msr |= (target_ulong)1 << MSR_FP; /* Allow floating point usage */
2825 msr |= (target_ulong)1 << MSR_PR;
2827 env->nip = env->hreset_vector | env->excp_prefix;
2828 if (env->mmu_model != POWERPC_MMU_REAL_4xx)
2829 ppc_tlb_invalidate_all(env);
2832 hreg_compute_hflags(env);
2834 /* Be sure no exception or interrupt is pending */
2835 env->pending_interrupts = 0;
2836 env->exception_index = POWERPC_EXCP_NONE;
2837 env->error_code = 0;
2838 /* Flush all TLBs */
2842 CPUPPCState *cpu_ppc_init (void)
2846 env = qemu_mallocz(sizeof(CPUPPCState));
2854 void cpu_ppc_close (CPUPPCState *env)
2856 /* Should also remove all opcode tables... */