?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
libqtest: Inline g_assert_no_errno()
[qemu/armbru.git] / target / ppc / mmu_helper.c
blob04f8317ea1324afdd7322ac141fe1186c468b805
1 /*
2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
3 *
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19 #include "qemu/osdep.h"
20 #include "qemu/units.h"
21 #include "cpu.h"
22 #include "exec/helper-proto.h"
23 #include "sysemu/kvm.h"
24 #include "kvm_ppc.h"
25 #include "mmu-hash64.h"
26 #include "mmu-hash32.h"
27 #include "exec/exec-all.h"
28 #include "exec/cpu_ldst.h"
29 #include "exec/log.h"
30 #include "helper_regs.h"
31 #include "qemu/error-report.h"
32 #include "mmu-book3s-v3.h"
33 #include "mmu-radix64.h"
34
35 //#define DEBUG_MMU
36 //#define DEBUG_BATS
37 //#define DEBUG_SOFTWARE_TLB
38 //#define DUMP_PAGE_TABLES
39 //#define FLUSH_ALL_TLBS
40
41 #ifdef DEBUG_MMU
42 # define LOG_MMU_STATE(cpu) log_cpu_state_mask(CPU_LOG_MMU, (cpu), 0)
43 #else
44 # define LOG_MMU_STATE(cpu) do { } while (0)
45 #endif
46
47 #ifdef DEBUG_SOFTWARE_TLB
48 # define LOG_SWTLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
49 #else
50 # define LOG_SWTLB(...) do { } while (0)
51 #endif
52
53 #ifdef DEBUG_BATS
54 # define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
55 #else
56 # define LOG_BATS(...) do { } while (0)
57 #endif
58
59 /*****************************************************************************/
60 /* PowerPC MMU emulation */
61
62 /* Context used internally during MMU translations */
63 typedef struct mmu_ctx_t mmu_ctx_t;
64 struct mmu_ctx_t {
65 hwaddr raddr; /* Real address */
66 hwaddr eaddr; /* Effective address */
67 int prot; /* Protection bits */
68 hwaddr hash[2]; /* Pagetable hash values */
69 target_ulong ptem; /* Virtual segment ID | API */
70 int key; /* Access key */
71 int nx; /* Non-execute area */
72 };
73
74 /* Common routines used by software and hardware TLBs emulation */
75 static inline int pte_is_valid(target_ulong pte0)
76 {
77 return pte0 & 0x80000000 ? 1 : 0;
78 }
79
80 static inline void pte_invalidate(target_ulong *pte0)
81 {
82 *pte0 &= ~0x80000000;
83 }
84
85 #define PTE_PTEM_MASK 0x7FFFFFBF
86 #define PTE_CHECK_MASK (TARGET_PAGE_MASK | 0x7B)
87
88 static int pp_check(int key, int pp, int nx)
89 {
90 int access;
91
92 /* Compute access rights */
93 access = 0;
94 if (key == 0) {
95 switch (pp) {
96 case 0x0:
97 case 0x1:
98 case 0x2:
99 access |= PAGE_WRITE;
100 /* No break here */
101 case 0x3:
102 access |= PAGE_READ;
103 break;
104 }
105 } else {
106 switch (pp) {
107 case 0x0:
108 access = 0;
109 break;
110 case 0x1:
111 case 0x3:
112 access = PAGE_READ;
113 break;
114 case 0x2:
115 access = PAGE_READ | PAGE_WRITE;
116 break;
117 }
118 }
119 if (nx == 0) {
120 access |= PAGE_EXEC;
121 }
122
123 return access;
124 }
125
126 static int check_prot(int prot, int rw, int access_type)
127 {
128 int ret;
129
130 if (access_type == ACCESS_CODE) {
131 if (prot & PAGE_EXEC) {
132 ret = 0;
133 } else {
134 ret = -2;
135 }
136 } else if (rw) {
137 if (prot & PAGE_WRITE) {
138 ret = 0;
139 } else {
140 ret = -2;
141 }
142 } else {
143 if (prot & PAGE_READ) {
144 ret = 0;
145 } else {
146 ret = -2;
147 }
148 }
149
150 return ret;
151 }
152
153 static inline int ppc6xx_tlb_pte_check(mmu_ctx_t *ctx, target_ulong pte0,
154 target_ulong pte1, int h, int rw, int type)
155 {
156 target_ulong ptem, mmask;
157 int access, ret, pteh, ptev, pp;
158
159 ret = -1;
160 /* Check validity and table match */
161 ptev = pte_is_valid(pte0);
162 pteh = (pte0 >> 6) & 1;
163 if (ptev && h == pteh) {
164 /* Check vsid & api */
165 ptem = pte0 & PTE_PTEM_MASK;
166 mmask = PTE_CHECK_MASK;
167 pp = pte1 & 0x00000003;
168 if (ptem == ctx->ptem) {
169 if (ctx->raddr != (hwaddr)-1ULL) {
170 /* all matches should have equal RPN, WIMG & PP */
171 if ((ctx->raddr & mmask) != (pte1 & mmask)) {
172 qemu_log_mask(CPU_LOG_MMU, "Bad RPN/WIMG/PP\n");
173 return -3;
174 }
175 }
176 /* Compute access rights */
177 access = pp_check(ctx->key, pp, ctx->nx);
178 /* Keep the matching PTE informations */
179 ctx->raddr = pte1;
180 ctx->prot = access;
181 ret = check_prot(ctx->prot, rw, type);
182 if (ret == 0) {
183 /* Access granted */
184 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
185 } else {
186 /* Access right violation */
187 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
188 }
189 }
190 }
191
192 return ret;
193 }
194
195 static int pte_update_flags(mmu_ctx_t *ctx, target_ulong *pte1p,
196 int ret, int rw)
197 {
198 int store = 0;
199
200 /* Update page flags */
201 if (!(*pte1p & 0x00000100)) {
202 /* Update accessed flag */
203 *pte1p |= 0x00000100;
204 store = 1;
205 }
206 if (!(*pte1p & 0x00000080)) {
207 if (rw == 1 && ret == 0) {
208 /* Update changed flag */
209 *pte1p |= 0x00000080;
210 store = 1;
211 } else {
212 /* Force page fault for first write access */
213 ctx->prot &= ~PAGE_WRITE;
214 }
215 }
216
217 return store;
218 }
219
220 /* Software driven TLB helpers */
221 static inline int ppc6xx_tlb_getnum(CPUPPCState *env, target_ulong eaddr,
222 int way, int is_code)
223 {
224 int nr;
225
226 /* Select TLB num in a way from address */
227 nr = (eaddr >> TARGET_PAGE_BITS) & (env->tlb_per_way - 1);
228 /* Select TLB way */
229 nr += env->tlb_per_way * way;
230 /* 6xx have separate TLBs for instructions and data */
231 if (is_code && env->id_tlbs == 1) {
232 nr += env->nb_tlb;
233 }
234
235 return nr;
236 }
237
238 static inline void ppc6xx_tlb_invalidate_all(CPUPPCState *env)
239 {
240 PowerPCCPU *cpu = ppc_env_get_cpu(env);
241 ppc6xx_tlb_t *tlb;
242 int nr, max;
243
244 /* LOG_SWTLB("Invalidate all TLBs\n"); */
245 /* Invalidate all defined software TLB */
246 max = env->nb_tlb;
247 if (env->id_tlbs == 1) {
248 max *= 2;
249 }
250 for (nr = 0; nr < max; nr++) {
251 tlb = &env->tlb.tlb6[nr];
252 pte_invalidate(&tlb->pte0);
253 }
254 tlb_flush(CPU(cpu));
255 }
256
257 static inline void ppc6xx_tlb_invalidate_virt2(CPUPPCState *env,
258 target_ulong eaddr,
259 int is_code, int match_epn)
260 {
261 #if !defined(FLUSH_ALL_TLBS)
262 CPUState *cs = CPU(ppc_env_get_cpu(env));
263 ppc6xx_tlb_t *tlb;
264 int way, nr;
265
266 /* Invalidate ITLB + DTLB, all ways */
267 for (way = 0; way < env->nb_ways; way++) {
268 nr = ppc6xx_tlb_getnum(env, eaddr, way, is_code);
269 tlb = &env->tlb.tlb6[nr];
270 if (pte_is_valid(tlb->pte0) && (match_epn == 0 || eaddr == tlb->EPN)) {
271 LOG_SWTLB("TLB invalidate %d/%d " TARGET_FMT_lx "\n", nr,
272 env->nb_tlb, eaddr);
273 pte_invalidate(&tlb->pte0);
274 tlb_flush_page(cs, tlb->EPN);
275 }
276 }
277 #else
278 /* XXX: PowerPC specification say this is valid as well */
279 ppc6xx_tlb_invalidate_all(env);
280 #endif
281 }
282
283 static inline void ppc6xx_tlb_invalidate_virt(CPUPPCState *env,
284 target_ulong eaddr, int is_code)
285 {
286 ppc6xx_tlb_invalidate_virt2(env, eaddr, is_code, 0);
287 }
288
289 static void ppc6xx_tlb_store(CPUPPCState *env, target_ulong EPN, int way,
290 int is_code, target_ulong pte0, target_ulong pte1)
291 {
292 ppc6xx_tlb_t *tlb;
293 int nr;
294
295 nr = ppc6xx_tlb_getnum(env, EPN, way, is_code);
296 tlb = &env->tlb.tlb6[nr];
297 LOG_SWTLB("Set TLB %d/%d EPN " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
298 " PTE1 " TARGET_FMT_lx "\n", nr, env->nb_tlb, EPN, pte0, pte1);
299 /* Invalidate any pending reference in QEMU for this virtual address */
300 ppc6xx_tlb_invalidate_virt2(env, EPN, is_code, 1);
301 tlb->pte0 = pte0;
302 tlb->pte1 = pte1;
303 tlb->EPN = EPN;
304 /* Store last way for LRU mechanism */
305 env->last_way = way;
306 }
307
308 static inline int ppc6xx_tlb_check(CPUPPCState *env, mmu_ctx_t *ctx,
309 target_ulong eaddr, int rw, int access_type)
310 {
311 ppc6xx_tlb_t *tlb;
312 int nr, best, way;
313 int ret;
314
315 best = -1;
316 ret = -1; /* No TLB found */
317 for (way = 0; way < env->nb_ways; way++) {
318 nr = ppc6xx_tlb_getnum(env, eaddr, way,
319 access_type == ACCESS_CODE ? 1 : 0);
320 tlb = &env->tlb.tlb6[nr];
321 /* This test "emulates" the PTE index match for hardware TLBs */
322 if ((eaddr & TARGET_PAGE_MASK) != tlb->EPN) {
323 LOG_SWTLB("TLB %d/%d %s [" TARGET_FMT_lx " " TARGET_FMT_lx
324 "] <> " TARGET_FMT_lx "\n", nr, env->nb_tlb,
325 pte_is_valid(tlb->pte0) ? "valid" : "inval",
326 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE, eaddr);
327 continue;
328 }
329 LOG_SWTLB("TLB %d/%d %s " TARGET_FMT_lx " <> " TARGET_FMT_lx " "
330 TARGET_FMT_lx " %c %c\n", nr, env->nb_tlb,
331 pte_is_valid(tlb->pte0) ? "valid" : "inval",
332 tlb->EPN, eaddr, tlb->pte1,
333 rw ? 'S' : 'L', access_type == ACCESS_CODE ? 'I' : 'D');
334 switch (ppc6xx_tlb_pte_check(ctx, tlb->pte0, tlb->pte1, 0, rw, access_type)) {
335 case -3:
336 /* TLB inconsistency */
337 return -1;
338 case -2:
339 /* Access violation */
340 ret = -2;
341 best = nr;
342 break;
343 case -1:
344 default:
345 /* No match */
346 break;
347 case 0:
348 /* access granted */
349 /* XXX: we should go on looping to check all TLBs consistency
350 * but we can speed-up the whole thing as the
351 * result would be undefined if TLBs are not consistent.
352 */
353 ret = 0;
354 best = nr;
355 goto done;
356 }
357 }
358 if (best != -1) {
359 done:
360 LOG_SWTLB("found TLB at addr " TARGET_FMT_plx " prot=%01x ret=%d\n",
361 ctx->raddr & TARGET_PAGE_MASK, ctx->prot, ret);
362 /* Update page flags */
363 pte_update_flags(ctx, &env->tlb.tlb6[best].pte1, ret, rw);
364 }
365
366 return ret;
367 }
368
369 /* Perform BAT hit & translation */
370 static inline void bat_size_prot(CPUPPCState *env, target_ulong *blp,
371 int *validp, int *protp, target_ulong *BATu,
372 target_ulong *BATl)
373 {
374 target_ulong bl;
375 int pp, valid, prot;
376
377 bl = (*BATu & 0x00001FFC) << 15;
378 valid = 0;
379 prot = 0;
380 if (((msr_pr == 0) && (*BATu & 0x00000002)) ||
381 ((msr_pr != 0) && (*BATu & 0x00000001))) {
382 valid = 1;
383 pp = *BATl & 0x00000003;
384 if (pp != 0) {
385 prot = PAGE_READ | PAGE_EXEC;
386 if (pp == 0x2) {
387 prot |= PAGE_WRITE;
388 }
389 }
390 }
391 *blp = bl;
392 *validp = valid;
393 *protp = prot;
394 }
395
396 static int get_bat_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx,
397 target_ulong virtual, int rw, int type)
398 {
399 target_ulong *BATlt, *BATut, *BATu, *BATl;
400 target_ulong BEPIl, BEPIu, bl;
401 int i, valid, prot;
402 int ret = -1;
403
404 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
405 type == ACCESS_CODE ? 'I' : 'D', virtual);
406 switch (type) {
407 case ACCESS_CODE:
408 BATlt = env->IBAT[1];
409 BATut = env->IBAT[0];
410 break;
411 default:
412 BATlt = env->DBAT[1];
413 BATut = env->DBAT[0];
414 break;
415 }
416 for (i = 0; i < env->nb_BATs; i++) {
417 BATu = &BATut[i];
418 BATl = &BATlt[i];
419 BEPIu = *BATu & 0xF0000000;
420 BEPIl = *BATu & 0x0FFE0000;
421 bat_size_prot(env, &bl, &valid, &prot, BATu, BATl);
422 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
423 " BATl " TARGET_FMT_lx "\n", __func__,
424 type == ACCESS_CODE ? 'I' : 'D', i, virtual, *BATu, *BATl);
425 if ((virtual & 0xF0000000) == BEPIu &&
426 ((virtual & 0x0FFE0000) & ~bl) == BEPIl) {
427 /* BAT matches */
428 if (valid != 0) {
429 /* Get physical address */
430 ctx->raddr = (*BATl & 0xF0000000) |
431 ((virtual & 0x0FFE0000 & bl) | (*BATl & 0x0FFE0000)) |
432 (virtual & 0x0001F000);
433 /* Compute access rights */
434 ctx->prot = prot;
435 ret = check_prot(ctx->prot, rw, type);
436 if (ret == 0) {
437 LOG_BATS("BAT %d match: r " TARGET_FMT_plx " prot=%c%c\n",
438 i, ctx->raddr, ctx->prot & PAGE_READ ? 'R' : '-',
439 ctx->prot & PAGE_WRITE ? 'W' : '-');
440 }
441 break;
442 }
443 }
444 }
445 if (ret < 0) {
446 #if defined(DEBUG_BATS)
447 if (qemu_log_enabled()) {
448 LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", virtual);
449 for (i = 0; i < 4; i++) {
450 BATu = &BATut[i];
451 BATl = &BATlt[i];
452 BEPIu = *BATu & 0xF0000000;
453 BEPIl = *BATu & 0x0FFE0000;
454 bl = (*BATu & 0x00001FFC) << 15;
455 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
456 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
457 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
458 __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual,
459 *BATu, *BATl, BEPIu, BEPIl, bl);
460 }
461 }
462 #endif
463 }
464 /* No hit */
465 return ret;
466 }
467
468 /* Perform segment based translation */
469 static inline int get_segment_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx,
470 target_ulong eaddr, int rw, int type)
471 {
472 PowerPCCPU *cpu = ppc_env_get_cpu(env);
473 hwaddr hash;
474 target_ulong vsid;
475 int ds, pr, target_page_bits;
476 int ret;
477 target_ulong sr, pgidx;
478
479 pr = msr_pr;
480 ctx->eaddr = eaddr;
481
482 sr = env->sr[eaddr >> 28];
483 ctx->key = (((sr & 0x20000000) && (pr != 0)) ||
484 ((sr & 0x40000000) && (pr == 0))) ? 1 : 0;
485 ds = sr & 0x80000000 ? 1 : 0;
486 ctx->nx = sr & 0x10000000 ? 1 : 0;
487 vsid = sr & 0x00FFFFFF;
488 target_page_bits = TARGET_PAGE_BITS;
489 qemu_log_mask(CPU_LOG_MMU,
490 "Check segment v=" TARGET_FMT_lx " %d " TARGET_FMT_lx
491 " nip=" TARGET_FMT_lx " lr=" TARGET_FMT_lx
492 " ir=%d dr=%d pr=%d %d t=%d\n",
493 eaddr, (int)(eaddr >> 28), sr, env->nip, env->lr, (int)msr_ir,
494 (int)msr_dr, pr != 0 ? 1 : 0, rw, type);
495 pgidx = (eaddr & ~SEGMENT_MASK_256M) >> target_page_bits;
496 hash = vsid ^ pgidx;
497 ctx->ptem = (vsid << 7) | (pgidx >> 10);
498
499 qemu_log_mask(CPU_LOG_MMU,
500 "pte segment: key=%d ds %d nx %d vsid " TARGET_FMT_lx "\n",
501 ctx->key, ds, ctx->nx, vsid);
502 ret = -1;
503 if (!ds) {
504 /* Check if instruction fetch is allowed, if needed */
505 if (type != ACCESS_CODE || ctx->nx == 0) {
506 /* Page address translation */
507 qemu_log_mask(CPU_LOG_MMU, "htab_base " TARGET_FMT_plx
508 " htab_mask " TARGET_FMT_plx
509 " hash " TARGET_FMT_plx "\n",
510 ppc_hash32_hpt_base(cpu), ppc_hash32_hpt_mask(cpu), hash);
511 ctx->hash[0] = hash;
512 ctx->hash[1] = ~hash;
513
514 /* Initialize real address with an invalid value */
515 ctx->raddr = (hwaddr)-1ULL;
516 /* Software TLB search */
517 ret = ppc6xx_tlb_check(env, ctx, eaddr, rw, type);
518 #if defined(DUMP_PAGE_TABLES)
519 if (qemu_loglevel_mask(CPU_LOG_MMU)) {
520 CPUState *cs = ENV_GET_CPU(env);
521 hwaddr curaddr;
522 uint32_t a0, a1, a2, a3;
523
524 qemu_log("Page table: " TARGET_FMT_plx " len " TARGET_FMT_plx
525 "\n", ppc_hash32_hpt_base(cpu),
526 ppc_hash32_hpt_mask(env) + 0x80);
527 for (curaddr = ppc_hash32_hpt_base(cpu);
528 curaddr < (ppc_hash32_hpt_base(cpu)
529 + ppc_hash32_hpt_mask(cpu) + 0x80);
530 curaddr += 16) {
531 a0 = ldl_phys(cs->as, curaddr);
532 a1 = ldl_phys(cs->as, curaddr + 4);
533 a2 = ldl_phys(cs->as, curaddr + 8);
534 a3 = ldl_phys(cs->as, curaddr + 12);
535 if (a0 != 0 || a1 != 0 || a2 != 0 || a3 != 0) {
536 qemu_log(TARGET_FMT_plx ": %08x %08x %08x %08x\n",
537 curaddr, a0, a1, a2, a3);
538 }
539 }
540 }
541 #endif
542 } else {
543 qemu_log_mask(CPU_LOG_MMU, "No access allowed\n");
544 ret = -3;
545 }
546 } else {
547 target_ulong sr;
548
549 qemu_log_mask(CPU_LOG_MMU, "direct store...\n");
550 /* Direct-store segment : absolutely *BUGGY* for now */
551
552 /* Direct-store implies a 32-bit MMU.
553 * Check the Segment Register's bus unit ID (BUID).
554 */
555 sr = env->sr[eaddr >> 28];
556 if ((sr & 0x1FF00000) >> 20 == 0x07f) {
557 /* Memory-forced I/O controller interface access */
558 /* If T=1 and BUID=x'07F', the 601 performs a memory access
559 * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
560 */
561 ctx->raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
562 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
563 return 0;
564 }
565
566 switch (type) {
567 case ACCESS_INT:
568 /* Integer load/store : only access allowed */
569 break;
570 case ACCESS_CODE:
571 /* No code fetch is allowed in direct-store areas */
572 return -4;
573 case ACCESS_FLOAT:
574 /* Floating point load/store */
575 return -4;
576 case ACCESS_RES:
577 /* lwarx, ldarx or srwcx. */
578 return -4;
579 case ACCESS_CACHE:
580 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
581 /* Should make the instruction do no-op.
582 * As it already do no-op, it's quite easy :-)
583 */
584 ctx->raddr = eaddr;
585 return 0;
586 case ACCESS_EXT:
587 /* eciwx or ecowx */
588 return -4;
589 default:
590 qemu_log_mask(CPU_LOG_MMU, "ERROR: instruction should not need "
591 "address translation\n");
592 return -4;
593 }
594 if ((rw == 1 || ctx->key != 1) && (rw == 0 || ctx->key != 0)) {
595 ctx->raddr = eaddr;
596 ret = 2;
597 } else {
598 ret = -2;
599 }
600 }
601
602 return ret;
603 }
604
605 /* Generic TLB check function for embedded PowerPC implementations */
606 static int ppcemb_tlb_check(CPUPPCState *env, ppcemb_tlb_t *tlb,
607 hwaddr *raddrp,
608 target_ulong address, uint32_t pid, int ext,
609 int i)
610 {
611 target_ulong mask;
612
613 /* Check valid flag */
614 if (!(tlb->prot & PAGE_VALID)) {
615 return -1;
616 }
617 mask = ~(tlb->size - 1);
618 LOG_SWTLB("%s: TLB %d address " TARGET_FMT_lx " PID %u <=> " TARGET_FMT_lx
619 " " TARGET_FMT_lx " %u %x\n", __func__, i, address, pid, tlb->EPN,
620 mask, (uint32_t)tlb->PID, tlb->prot);
621 /* Check PID */
622 if (tlb->PID != 0 && tlb->PID != pid) {
623 return -1;
624 }
625 /* Check effective address */
626 if ((address & mask) != tlb->EPN) {
627 return -1;
628 }
629 *raddrp = (tlb->RPN & mask) | (address & ~mask);
630 if (ext) {
631 /* Extend the physical address to 36 bits */
632 *raddrp |= (uint64_t)(tlb->RPN & 0xF) << 32;
633 }
634
635 return 0;
636 }
637
638 /* Generic TLB search function for PowerPC embedded implementations */
639 static int ppcemb_tlb_search(CPUPPCState *env, target_ulong address,
640 uint32_t pid)
641 {
642 ppcemb_tlb_t *tlb;
643 hwaddr raddr;
644 int i, ret;
645
646 /* Default return value is no match */
647 ret = -1;
648 for (i = 0; i < env->nb_tlb; i++) {
649 tlb = &env->tlb.tlbe[i];
650 if (ppcemb_tlb_check(env, tlb, &raddr, address, pid, 0, i) == 0) {
651 ret = i;
652 break;
653 }
654 }
655
656 return ret;
657 }
658
659 /* Helpers specific to PowerPC 40x implementations */
660 static inline void ppc4xx_tlb_invalidate_all(CPUPPCState *env)
661 {
662 PowerPCCPU *cpu = ppc_env_get_cpu(env);
663 ppcemb_tlb_t *tlb;
664 int i;
665
666 for (i = 0; i < env->nb_tlb; i++) {
667 tlb = &env->tlb.tlbe[i];
668 tlb->prot &= ~PAGE_VALID;
669 }
670 tlb_flush(CPU(cpu));
671 }
672
673 static int mmu40x_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
674 target_ulong address, int rw,
675 int access_type)
676 {
677 ppcemb_tlb_t *tlb;
678 hwaddr raddr;
679 int i, ret, zsel, zpr, pr;
680
681 ret = -1;
682 raddr = (hwaddr)-1ULL;
683 pr = msr_pr;
684 for (i = 0; i < env->nb_tlb; i++) {
685 tlb = &env->tlb.tlbe[i];
686 if (ppcemb_tlb_check(env, tlb, &raddr, address,
687 env->spr[SPR_40x_PID], 0, i) < 0) {
688 continue;
689 }
690 zsel = (tlb->attr >> 4) & 0xF;
691 zpr = (env->spr[SPR_40x_ZPR] >> (30 - (2 * zsel))) & 0x3;
692 LOG_SWTLB("%s: TLB %d zsel %d zpr %d rw %d attr %08x\n",
693 __func__, i, zsel, zpr, rw, tlb->attr);
694 /* Check execute enable bit */
695 switch (zpr) {
696 case 0x2:
697 if (pr != 0) {
698 goto check_perms;
699 }
700 /* No break here */
701 case 0x3:
702 /* All accesses granted */
703 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
704 ret = 0;
705 break;
706 case 0x0:
707 if (pr != 0) {
708 /* Raise Zone protection fault. */
709 env->spr[SPR_40x_ESR] = 1 << 22;
710 ctx->prot = 0;
711 ret = -2;
712 break;
713 }
714 /* No break here */
715 case 0x1:
716 check_perms:
717 /* Check from TLB entry */
718 ctx->prot = tlb->prot;
719 ret = check_prot(ctx->prot, rw, access_type);
720 if (ret == -2) {
721 env->spr[SPR_40x_ESR] = 0;
722 }
723 break;
724 }
725 if (ret >= 0) {
726 ctx->raddr = raddr;
727 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
728 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
729 ret);
730 return 0;
731 }
732 }
733 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
734 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
735
736 return ret;
737 }
738
739 void store_40x_sler(CPUPPCState *env, uint32_t val)
740 {
741 PowerPCCPU *cpu = ppc_env_get_cpu(env);
742
743 /* XXX: TO BE FIXED */
744 if (val != 0x00000000) {
745 cpu_abort(CPU(cpu), "Little-endian regions are not supported by now\n");
746 }
747 env->spr[SPR_405_SLER] = val;
748 }
749
750 static inline int mmubooke_check_tlb(CPUPPCState *env, ppcemb_tlb_t *tlb,
751 hwaddr *raddr, int *prot,
752 target_ulong address, int rw,
753 int access_type, int i)
754 {
755 int ret, prot2;
756
757 if (ppcemb_tlb_check(env, tlb, raddr, address,
758 env->spr[SPR_BOOKE_PID],
759 !env->nb_pids, i) >= 0) {
760 goto found_tlb;
761 }
762
763 if (env->spr[SPR_BOOKE_PID1] &&
764 ppcemb_tlb_check(env, tlb, raddr, address,
765 env->spr[SPR_BOOKE_PID1], 0, i) >= 0) {
766 goto found_tlb;
767 }
768
769 if (env->spr[SPR_BOOKE_PID2] &&
770 ppcemb_tlb_check(env, tlb, raddr, address,
771 env->spr[SPR_BOOKE_PID2], 0, i) >= 0) {
772 goto found_tlb;
773 }
774
775 LOG_SWTLB("%s: TLB entry not found\n", __func__);
776 return -1;
777
778 found_tlb:
779
780 if (msr_pr != 0) {
781 prot2 = tlb->prot & 0xF;
782 } else {
783 prot2 = (tlb->prot >> 4) & 0xF;
784 }
785
786 /* Check the address space */
787 if (access_type == ACCESS_CODE) {
788 if (msr_ir != (tlb->attr & 1)) {
789 LOG_SWTLB("%s: AS doesn't match\n", __func__);
790 return -1;
791 }
792
793 *prot = prot2;
794 if (prot2 & PAGE_EXEC) {
795 LOG_SWTLB("%s: good TLB!\n", __func__);
796 return 0;
797 }
798
799 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
800 ret = -3;
801 } else {
802 if (msr_dr != (tlb->attr & 1)) {
803 LOG_SWTLB("%s: AS doesn't match\n", __func__);
804 return -1;
805 }
806
807 *prot = prot2;
808 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
809 LOG_SWTLB("%s: found TLB!\n", __func__);
810 return 0;
811 }
812
813 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
814 ret = -2;
815 }
816
817 return ret;
818 }
819
820 static int mmubooke_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
821 target_ulong address, int rw,
822 int access_type)
823 {
824 ppcemb_tlb_t *tlb;
825 hwaddr raddr;
826 int i, ret;
827
828 ret = -1;
829 raddr = (hwaddr)-1ULL;
830 for (i = 0; i < env->nb_tlb; i++) {
831 tlb = &env->tlb.tlbe[i];
832 ret = mmubooke_check_tlb(env, tlb, &raddr, &ctx->prot, address, rw,
833 access_type, i);
834 if (ret != -1) {
835 break;
836 }
837 }
838
839 if (ret >= 0) {
840 ctx->raddr = raddr;
841 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
842 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
843 ret);
844 } else {
845 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
846 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
847 }
848
849 return ret;
850 }
851
852 static void booke206_flush_tlb(CPUPPCState *env, int flags,
853 const int check_iprot)
854 {
855 PowerPCCPU *cpu = ppc_env_get_cpu(env);
856 int tlb_size;
857 int i, j;
858 ppcmas_tlb_t *tlb = env->tlb.tlbm;
859
860 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
861 if (flags & (1 << i)) {
862 tlb_size = booke206_tlb_size(env, i);
863 for (j = 0; j < tlb_size; j++) {
864 if (!check_iprot || !(tlb[j].mas1 & MAS1_IPROT)) {
865 tlb[j].mas1 &= ~MAS1_VALID;
866 }
867 }
868 }
869 tlb += booke206_tlb_size(env, i);
870 }
871
872 tlb_flush(CPU(cpu));
873 }
874
875 static hwaddr booke206_tlb_to_page_size(CPUPPCState *env,
876 ppcmas_tlb_t *tlb)
877 {
878 int tlbm_size;
879
880 tlbm_size = (tlb->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
881
882 return 1024ULL << tlbm_size;
883 }
884
885 /* TLB check function for MAS based SoftTLBs */
886 static int ppcmas_tlb_check(CPUPPCState *env, ppcmas_tlb_t *tlb,
887 hwaddr *raddrp, target_ulong address,
888 uint32_t pid)
889 {
890 hwaddr mask;
891 uint32_t tlb_pid;
892
893 if (!msr_cm) {
894 /* In 32bit mode we can only address 32bit EAs */
895 address = (uint32_t)address;
896 }
897
898 /* Check valid flag */
899 if (!(tlb->mas1 & MAS1_VALID)) {
900 return -1;
901 }
902
903 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
904 LOG_SWTLB("%s: TLB ADDR=0x" TARGET_FMT_lx " PID=0x%x MAS1=0x%x MAS2=0x%"
905 PRIx64 " mask=0x%" HWADDR_PRIx " MAS7_3=0x%" PRIx64 " MAS8=0x%"
906 PRIx32 "\n", __func__, address, pid, tlb->mas1, tlb->mas2, mask,
907 tlb->mas7_3, tlb->mas8);
908
909 /* Check PID */
910 tlb_pid = (tlb->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT;
911 if (tlb_pid != 0 && tlb_pid != pid) {
912 return -1;
913 }
914
915 /* Check effective address */
916 if ((address & mask) != (tlb->mas2 & MAS2_EPN_MASK)) {
917 return -1;
918 }
919
920 if (raddrp) {
921 *raddrp = (tlb->mas7_3 & mask) | (address & ~mask);
922 }
923
924 return 0;
925 }
926
927 static int mmubooke206_check_tlb(CPUPPCState *env, ppcmas_tlb_t *tlb,
928 hwaddr *raddr, int *prot,
929 target_ulong address, int rw,
930 int access_type)
931 {
932 int ret;
933 int prot2 = 0;
934
935 if (ppcmas_tlb_check(env, tlb, raddr, address,
936 env->spr[SPR_BOOKE_PID]) >= 0) {
937 goto found_tlb;
938 }
939
940 if (env->spr[SPR_BOOKE_PID1] &&
941 ppcmas_tlb_check(env, tlb, raddr, address,
942 env->spr[SPR_BOOKE_PID1]) >= 0) {
943 goto found_tlb;
944 }
945
946 if (env->spr[SPR_BOOKE_PID2] &&
947 ppcmas_tlb_check(env, tlb, raddr, address,
948 env->spr[SPR_BOOKE_PID2]) >= 0) {
949 goto found_tlb;
950 }
951
952 LOG_SWTLB("%s: TLB entry not found\n", __func__);
953 return -1;
954
955 found_tlb:
956
957 if (msr_pr != 0) {
958 if (tlb->mas7_3 & MAS3_UR) {
959 prot2 |= PAGE_READ;
960 }
961 if (tlb->mas7_3 & MAS3_UW) {
962 prot2 |= PAGE_WRITE;
963 }
964 if (tlb->mas7_3 & MAS3_UX) {
965 prot2 |= PAGE_EXEC;
966 }
967 } else {
968 if (tlb->mas7_3 & MAS3_SR) {
969 prot2 |= PAGE_READ;
970 }
971 if (tlb->mas7_3 & MAS3_SW) {
972 prot2 |= PAGE_WRITE;
973 }
974 if (tlb->mas7_3 & MAS3_SX) {
975 prot2 |= PAGE_EXEC;
976 }
977 }
978
979 /* Check the address space and permissions */
980 if (access_type == ACCESS_CODE) {
981 if (msr_ir != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
982 LOG_SWTLB("%s: AS doesn't match\n", __func__);
983 return -1;
984 }
985
986 *prot = prot2;
987 if (prot2 & PAGE_EXEC) {
988 LOG_SWTLB("%s: good TLB!\n", __func__);
989 return 0;
990 }
991
992 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
993 ret = -3;
994 } else {
995 if (msr_dr != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
996 LOG_SWTLB("%s: AS doesn't match\n", __func__);
997 return -1;
998 }
999
1000 *prot = prot2;
1001 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
1002 LOG_SWTLB("%s: found TLB!\n", __func__);
1003 return 0;
1004 }
1005
1006 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
1007 ret = -2;
1008 }
1009
1010 return ret;
1011 }
1012
1013 static int mmubooke206_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1014 target_ulong address, int rw,
1015 int access_type)
1016 {
1017 ppcmas_tlb_t *tlb;
1018 hwaddr raddr;
1019 int i, j, ret;
1020
1021 ret = -1;
1022 raddr = (hwaddr)-1ULL;
1023
1024 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1025 int ways = booke206_tlb_ways(env, i);
1026
1027 for (j = 0; j < ways; j++) {
1028 tlb = booke206_get_tlbm(env, i, address, j);
1029 if (!tlb) {
1030 continue;
1031 }
1032 ret = mmubooke206_check_tlb(env, tlb, &raddr, &ctx->prot, address,
1033 rw, access_type);
1034 if (ret != -1) {
1035 goto found_tlb;
1036 }
1037 }
1038 }
1039
1040 found_tlb:
1041
1042 if (ret >= 0) {
1043 ctx->raddr = raddr;
1044 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
1045 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
1046 ret);
1047 } else {
1048 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
1049 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
1050 }
1051
1052 return ret;
1053 }
1054
1055 static const char *book3e_tsize_to_str[32] = {
1056 "1K", "2K", "4K", "8K", "16K", "32K", "64K", "128K", "256K", "512K",
1057 "1M", "2M", "4M", "8M", "16M", "32M", "64M", "128M", "256M", "512M",
1058 "1G", "2G", "4G", "8G", "16G", "32G", "64G", "128G", "256G", "512G",
1059 "1T", "2T"
1060 };
1061
1062 static void mmubooke_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1063 CPUPPCState *env)
1064 {
1065 ppcemb_tlb_t *entry;
1066 int i;
1067
1068 if (kvm_enabled() && !env->kvm_sw_tlb) {
1069 cpu_fprintf(f, "Cannot access KVM TLB\n");
1070 return;
1071 }
1072
1073 cpu_fprintf(f, "\nTLB:\n");
1074 cpu_fprintf(f, "Effective Physical Size PID Prot "
1075 "Attr\n");
1076
1077 entry = &env->tlb.tlbe[0];
1078 for (i = 0; i < env->nb_tlb; i++, entry++) {
1079 hwaddr ea, pa;
1080 target_ulong mask;
1081 uint64_t size = (uint64_t)entry->size;
1082 char size_buf[20];
1083
1084 /* Check valid flag */
1085 if (!(entry->prot & PAGE_VALID)) {
1086 continue;
1087 }
1088
1089 mask = ~(entry->size - 1);
1090 ea = entry->EPN & mask;
1091 pa = entry->RPN & mask;
1092 /* Extend the physical address to 36 bits */
1093 pa |= (hwaddr)(entry->RPN & 0xF) << 32;
1094 if (size >= 1 * MiB) {
1095 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "M", size / MiB);
1096 } else {
1097 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "k", size / KiB);
1098 }
1099 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %s %-5u %08x %08x\n",
1100 (uint64_t)ea, (uint64_t)pa, size_buf, (uint32_t)entry->PID,
1101 entry->prot, entry->attr);
1102 }
1103
1104 }
1105
1106 static void mmubooke206_dump_one_tlb(FILE *f, fprintf_function cpu_fprintf,
1107 CPUPPCState *env, int tlbn, int offset,
1108 int tlbsize)
1109 {
1110 ppcmas_tlb_t *entry;
1111 int i;
1112
1113 cpu_fprintf(f, "\nTLB%d:\n", tlbn);
1114 cpu_fprintf(f, "Effective Physical Size TID TS SRWX"
1115 " URWX WIMGE U0123\n");
1116
1117 entry = &env->tlb.tlbm[offset];
1118 for (i = 0; i < tlbsize; i++, entry++) {
1119 hwaddr ea, pa, size;
1120 int tsize;
1121
1122 if (!(entry->mas1 & MAS1_VALID)) {
1123 continue;
1124 }
1125
1126 tsize = (entry->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
1127 size = 1024ULL << tsize;
1128 ea = entry->mas2 & ~(size - 1);
1129 pa = entry->mas7_3 & ~(size - 1);
1130
1131 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %4s %-5u %1u S%c%c%c"
1132 "U%c%c%c %c%c%c%c%c U%c%c%c%c\n",
1133 (uint64_t)ea, (uint64_t)pa,
1134 book3e_tsize_to_str[tsize],
1135 (entry->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT,
1136 (entry->mas1 & MAS1_TS) >> MAS1_TS_SHIFT,
1137 entry->mas7_3 & MAS3_SR ? 'R' : '-',
1138 entry->mas7_3 & MAS3_SW ? 'W' : '-',
1139 entry->mas7_3 & MAS3_SX ? 'X' : '-',
1140 entry->mas7_3 & MAS3_UR ? 'R' : '-',
1141 entry->mas7_3 & MAS3_UW ? 'W' : '-',
1142 entry->mas7_3 & MAS3_UX ? 'X' : '-',
1143 entry->mas2 & MAS2_W ? 'W' : '-',
1144 entry->mas2 & MAS2_I ? 'I' : '-',
1145 entry->mas2 & MAS2_M ? 'M' : '-',
1146 entry->mas2 & MAS2_G ? 'G' : '-',
1147 entry->mas2 & MAS2_E ? 'E' : '-',
1148 entry->mas7_3 & MAS3_U0 ? '0' : '-',
1149 entry->mas7_3 & MAS3_U1 ? '1' : '-',
1150 entry->mas7_3 & MAS3_U2 ? '2' : '-',
1151 entry->mas7_3 & MAS3_U3 ? '3' : '-');
1152 }
1153 }
1154
1155 static void mmubooke206_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1156 CPUPPCState *env)
1157 {
1158 int offset = 0;
1159 int i;
1160
1161 if (kvm_enabled() && !env->kvm_sw_tlb) {
1162 cpu_fprintf(f, "Cannot access KVM TLB\n");
1163 return;
1164 }
1165
1166 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1167 int size = booke206_tlb_size(env, i);
1168
1169 if (size == 0) {
1170 continue;
1171 }
1172
1173 mmubooke206_dump_one_tlb(f, cpu_fprintf, env, i, offset, size);
1174 offset += size;
1175 }
1176 }
1177
1178 static void mmu6xx_dump_BATs(FILE *f, fprintf_function cpu_fprintf,
1179 CPUPPCState *env, int type)
1180 {
1181 target_ulong *BATlt, *BATut, *BATu, *BATl;
1182 target_ulong BEPIl, BEPIu, bl;
1183 int i;
1184
1185 switch (type) {
1186 case ACCESS_CODE:
1187 BATlt = env->IBAT[1];
1188 BATut = env->IBAT[0];
1189 break;
1190 default:
1191 BATlt = env->DBAT[1];
1192 BATut = env->DBAT[0];
1193 break;
1194 }
1195
1196 for (i = 0; i < env->nb_BATs; i++) {
1197 BATu = &BATut[i];
1198 BATl = &BATlt[i];
1199 BEPIu = *BATu & 0xF0000000;
1200 BEPIl = *BATu & 0x0FFE0000;
1201 bl = (*BATu & 0x00001FFC) << 15;
1202 cpu_fprintf(f, "%s BAT%d BATu " TARGET_FMT_lx
1203 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
1204 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
1205 type == ACCESS_CODE ? "code" : "data", i,
1206 *BATu, *BATl, BEPIu, BEPIl, bl);
1207 }
1208 }
1209
1210 static void mmu6xx_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1211 CPUPPCState *env)
1212 {
1213 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1214 ppc6xx_tlb_t *tlb;
1215 target_ulong sr;
1216 int type, way, entry, i;
1217
1218 cpu_fprintf(f, "HTAB base = 0x%"HWADDR_PRIx"\n", ppc_hash32_hpt_base(cpu));
1219 cpu_fprintf(f, "HTAB mask = 0x%"HWADDR_PRIx"\n", ppc_hash32_hpt_mask(cpu));
1220
1221 cpu_fprintf(f, "\nSegment registers:\n");
1222 for (i = 0; i < 32; i++) {
1223 sr = env->sr[i];
1224 if (sr & 0x80000000) {
1225 cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d BUID=0x%03x "
1226 "CNTLR_SPEC=0x%05x\n", i,
1227 sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0,
1228 sr & 0x20000000 ? 1 : 0, (uint32_t)((sr >> 20) & 0x1FF),
1229 (uint32_t)(sr & 0xFFFFF));
1230 } else {
1231 cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d N=%d VSID=0x%06x\n", i,
1232 sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0,
1233 sr & 0x20000000 ? 1 : 0, sr & 0x10000000 ? 1 : 0,
1234 (uint32_t)(sr & 0x00FFFFFF));
1235 }
1236 }
1237
1238 cpu_fprintf(f, "\nBATs:\n");
1239 mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_INT);
1240 mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_CODE);
1241
1242 if (env->id_tlbs != 1) {
1243 cpu_fprintf(f, "ERROR: 6xx MMU should have separated TLB"
1244 " for code and data\n");
1245 }
1246
1247 cpu_fprintf(f, "\nTLBs [EPN EPN + SIZE]\n");
1248
1249 for (type = 0; type < 2; type++) {
1250 for (way = 0; way < env->nb_ways; way++) {
1251 for (entry = env->nb_tlb * type + env->tlb_per_way * way;
1252 entry < (env->nb_tlb * type + env->tlb_per_way * (way + 1));
1253 entry++) {
1254
1255 tlb = &env->tlb.tlb6[entry];
1256 cpu_fprintf(f, "%s TLB %02d/%02d way:%d %s ["
1257 TARGET_FMT_lx " " TARGET_FMT_lx "]\n",
1258 type ? "code" : "data", entry % env->nb_tlb,
1259 env->nb_tlb, way,
1260 pte_is_valid(tlb->pte0) ? "valid" : "inval",
1261 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE);
1262 }
1263 }
1264 }
1265 }
1266
1267 void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
1268 {
1269 switch (env->mmu_model) {
1270 case POWERPC_MMU_BOOKE:
1271 mmubooke_dump_mmu(f, cpu_fprintf, env);
1272 break;
1273 case POWERPC_MMU_BOOKE206:
1274 mmubooke206_dump_mmu(f, cpu_fprintf, env);
1275 break;
1276 case POWERPC_MMU_SOFT_6xx:
1277 case POWERPC_MMU_SOFT_74xx:
1278 mmu6xx_dump_mmu(f, cpu_fprintf, env);
1279 break;
1280 #if defined(TARGET_PPC64)
1281 case POWERPC_MMU_64B:
1282 case POWERPC_MMU_2_03:
1283 case POWERPC_MMU_2_06:
1284 case POWERPC_MMU_2_07:
1285 dump_slb(f, cpu_fprintf, ppc_env_get_cpu(env));
1286 break;
1287 case POWERPC_MMU_3_00:
1288 if (ppc64_radix_guest(ppc_env_get_cpu(env))) {
1289 /* TODO - Unsupported */
1290 } else {
1291 dump_slb(f, cpu_fprintf, ppc_env_get_cpu(env));
1292 break;
1293 }
1294 #endif
1295 default:
1296 qemu_log_mask(LOG_UNIMP, "%s: unimplemented\n", __func__);
1297 }
1298 }
1299
1300 static inline int check_physical(CPUPPCState *env, mmu_ctx_t *ctx,
1301 target_ulong eaddr, int rw)
1302 {
1303 int in_plb, ret;
1304
1305 ctx->raddr = eaddr;
1306 ctx->prot = PAGE_READ | PAGE_EXEC;
1307 ret = 0;
1308 switch (env->mmu_model) {
1309 case POWERPC_MMU_SOFT_6xx:
1310 case POWERPC_MMU_SOFT_74xx:
1311 case POWERPC_MMU_SOFT_4xx:
1312 case POWERPC_MMU_REAL:
1313 case POWERPC_MMU_BOOKE:
1314 ctx->prot |= PAGE_WRITE;
1315 break;
1316
1317 case POWERPC_MMU_SOFT_4xx_Z:
1318 if (unlikely(msr_pe != 0)) {
1319 /* 403 family add some particular protections,
1320 * using PBL/PBU registers for accesses with no translation.
1321 */
1322 in_plb =
1323 /* Check PLB validity */
1324 (env->pb[0] < env->pb[1] &&
1325 /* and address in plb area */
1326 eaddr >= env->pb[0] && eaddr < env->pb[1]) ||
1327 (env->pb[2] < env->pb[3] &&
1328 eaddr >= env->pb[2] && eaddr < env->pb[3]) ? 1 : 0;
1329 if (in_plb ^ msr_px) {
1330 /* Access in protected area */
1331 if (rw == 1) {
1332 /* Access is not allowed */
1333 ret = -2;
1334 }
1335 } else {
1336 /* Read-write access is allowed */
1337 ctx->prot |= PAGE_WRITE;
1338 }
1339 }
1340 break;
1341
1342 default:
1343 /* Caller's checks mean we should never get here for other models */
1344 abort();
1345 return -1;
1346 }
1347
1348 return ret;
1349 }
1350
1351 static int get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1352 target_ulong eaddr, int rw, int access_type)
1353 {
1354 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1355 int ret = -1;
1356 bool real_mode = (access_type == ACCESS_CODE && msr_ir == 0)
1357 || (access_type != ACCESS_CODE && msr_dr == 0);
1358
1359 #if 0
1360 qemu_log("%s\n", __func__);
1361 #endif
1362
1363 switch (env->mmu_model) {
1364 case POWERPC_MMU_SOFT_6xx:
1365 case POWERPC_MMU_SOFT_74xx:
1366 if (real_mode) {
1367 ret = check_physical(env, ctx, eaddr, rw);
1368 } else {
1369 /* Try to find a BAT */
1370 if (env->nb_BATs != 0) {
1371 ret = get_bat_6xx_tlb(env, ctx, eaddr, rw, access_type);
1372 }
1373 if (ret < 0) {
1374 /* We didn't match any BAT entry or don't have BATs */
1375 ret = get_segment_6xx_tlb(env, ctx, eaddr, rw, access_type);
1376 }
1377 }
1378 break;
1379
1380 case POWERPC_MMU_SOFT_4xx:
1381 case POWERPC_MMU_SOFT_4xx_Z:
1382 if (real_mode) {
1383 ret = check_physical(env, ctx, eaddr, rw);
1384 } else {
1385 ret = mmu40x_get_physical_address(env, ctx, eaddr,
1386 rw, access_type);
1387 }
1388 break;
1389 case POWERPC_MMU_BOOKE:
1390 ret = mmubooke_get_physical_address(env, ctx, eaddr,
1391 rw, access_type);
1392 break;
1393 case POWERPC_MMU_BOOKE206:
1394 ret = mmubooke206_get_physical_address(env, ctx, eaddr, rw,
1395 access_type);
1396 break;
1397 case POWERPC_MMU_MPC8xx:
1398 /* XXX: TODO */
1399 cpu_abort(CPU(cpu), "MPC8xx MMU model is not implemented\n");
1400 break;
1401 case POWERPC_MMU_REAL:
1402 if (real_mode) {
1403 ret = check_physical(env, ctx, eaddr, rw);
1404 } else {
1405 cpu_abort(CPU(cpu), "PowerPC in real mode do not do any translation\n");
1406 }
1407 return -1;
1408 default:
1409 cpu_abort(CPU(cpu), "Unknown or invalid MMU model\n");
1410 return -1;
1411 }
1412 #if 0
1413 qemu_log("%s address " TARGET_FMT_lx " => %d " TARGET_FMT_plx "\n",
1414 __func__, eaddr, ret, ctx->raddr);
1415 #endif
1416
1417 return ret;
1418 }
1419
1420 hwaddr ppc_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
1421 {
1422 PowerPCCPU *cpu = POWERPC_CPU(cs);
1423 CPUPPCState *env = &cpu->env;
1424 mmu_ctx_t ctx;
1425
1426 switch (env->mmu_model) {
1427 #if defined(TARGET_PPC64)
1428 case POWERPC_MMU_64B:
1429 case POWERPC_MMU_2_03:
1430 case POWERPC_MMU_2_06:
1431 case POWERPC_MMU_2_07:
1432 return ppc_hash64_get_phys_page_debug(cpu, addr);
1433 case POWERPC_MMU_3_00:
1434 if (ppc64_radix_guest(ppc_env_get_cpu(env))) {
1435 return ppc_radix64_get_phys_page_debug(cpu, addr);
1436 } else {
1437 return ppc_hash64_get_phys_page_debug(cpu, addr);
1438 }
1439 break;
1440 #endif
1441
1442 case POWERPC_MMU_32B:
1443 case POWERPC_MMU_601:
1444 return ppc_hash32_get_phys_page_debug(cpu, addr);
1445
1446 default:
1447 ;
1448 }
1449
1450 if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT) != 0)) {
1451
1452 /* Some MMUs have separate TLBs for code and data. If we only try an
1453 * ACCESS_INT, we may not be able to read instructions mapped by code
1454 * TLBs, so we also try a ACCESS_CODE.
1455 */
1456 if (unlikely(get_physical_address(env, &ctx, addr, 0,
1457 ACCESS_CODE) != 0)) {
1458 return -1;
1459 }
1460 }
1461
1462 return ctx.raddr & TARGET_PAGE_MASK;
1463 }
1464
1465 static void booke206_update_mas_tlb_miss(CPUPPCState *env, target_ulong address,
1466 int rw)
1467 {
1468 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
1469 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
1470 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
1471 env->spr[SPR_BOOKE_MAS3] = 0;
1472 env->spr[SPR_BOOKE_MAS6] = 0;
1473 env->spr[SPR_BOOKE_MAS7] = 0;
1474
1475 /* AS */
1476 if (((rw == 2) && msr_ir) || ((rw != 2) && msr_dr)) {
1477 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
1478 env->spr[SPR_BOOKE_MAS6] |= MAS6_SAS;
1479 }
1480
1481 env->spr[SPR_BOOKE_MAS1] |= MAS1_VALID;
1482 env->spr[SPR_BOOKE_MAS2] |= address & MAS2_EPN_MASK;
1483
1484 switch (env->spr[SPR_BOOKE_MAS4] & MAS4_TIDSELD_PIDZ) {
1485 case MAS4_TIDSELD_PID0:
1486 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID] << MAS1_TID_SHIFT;
1487 break;
1488 case MAS4_TIDSELD_PID1:
1489 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID1] << MAS1_TID_SHIFT;
1490 break;
1491 case MAS4_TIDSELD_PID2:
1492 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID2] << MAS1_TID_SHIFT;
1493 break;
1494 }
1495
1496 env->spr[SPR_BOOKE_MAS6] |= env->spr[SPR_BOOKE_PID] << 16;
1497
1498 /* next victim logic */
1499 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
1500 env->last_way++;
1501 env->last_way &= booke206_tlb_ways(env, 0) - 1;
1502 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
1503 }
1504
1505 /* Perform address translation */
1506 static int cpu_ppc_handle_mmu_fault(CPUPPCState *env, target_ulong address,
1507 int rw, int mmu_idx)
1508 {
1509 CPUState *cs = CPU(ppc_env_get_cpu(env));
1510 PowerPCCPU *cpu = POWERPC_CPU(cs);
1511 mmu_ctx_t ctx;
1512 int access_type;
1513 int ret = 0;
1514
1515 if (rw == 2) {
1516 /* code access */
1517 rw = 0;
1518 access_type = ACCESS_CODE;
1519 } else {
1520 /* data access */
1521 access_type = env->access_type;
1522 }
1523 ret = get_physical_address(env, &ctx, address, rw, access_type);
1524 if (ret == 0) {
1525 tlb_set_page(cs, address & TARGET_PAGE_MASK,
1526 ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
1527 mmu_idx, TARGET_PAGE_SIZE);
1528 ret = 0;
1529 } else if (ret < 0) {
1530 LOG_MMU_STATE(cs);
1531 if (access_type == ACCESS_CODE) {
1532 switch (ret) {
1533 case -1:
1534 /* No matches in page tables or TLB */
1535 switch (env->mmu_model) {
1536 case POWERPC_MMU_SOFT_6xx:
1537 cs->exception_index = POWERPC_EXCP_IFTLB;
1538 env->error_code = 1 << 18;
1539 env->spr[SPR_IMISS] = address;
1540 env->spr[SPR_ICMP] = 0x80000000 | ctx.ptem;
1541 goto tlb_miss;
1542 case POWERPC_MMU_SOFT_74xx:
1543 cs->exception_index = POWERPC_EXCP_IFTLB;
1544 goto tlb_miss_74xx;
1545 case POWERPC_MMU_SOFT_4xx:
1546 case POWERPC_MMU_SOFT_4xx_Z:
1547 cs->exception_index = POWERPC_EXCP_ITLB;
1548 env->error_code = 0;
1549 env->spr[SPR_40x_DEAR] = address;
1550 env->spr[SPR_40x_ESR] = 0x00000000;
1551 break;
1552 case POWERPC_MMU_BOOKE206:
1553 booke206_update_mas_tlb_miss(env, address, 2);
1554 /* fall through */
1555 case POWERPC_MMU_BOOKE:
1556 cs->exception_index = POWERPC_EXCP_ITLB;
1557 env->error_code = 0;
1558 env->spr[SPR_BOOKE_DEAR] = address;
1559 return -1;
1560 case POWERPC_MMU_MPC8xx:
1561 /* XXX: TODO */
1562 cpu_abort(cs, "MPC8xx MMU model is not implemented\n");
1563 break;
1564 case POWERPC_MMU_REAL:
1565 cpu_abort(cs, "PowerPC in real mode should never raise "
1566 "any MMU exceptions\n");
1567 return -1;
1568 default:
1569 cpu_abort(cs, "Unknown or invalid MMU model\n");
1570 return -1;
1571 }
1572 break;
1573 case -2:
1574 /* Access rights violation */
1575 cs->exception_index = POWERPC_EXCP_ISI;
1576 env->error_code = 0x08000000;
1577 break;
1578 case -3:
1579 /* No execute protection violation */
1580 if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1581 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1582 env->spr[SPR_BOOKE_ESR] = 0x00000000;
1583 }
1584 cs->exception_index = POWERPC_EXCP_ISI;
1585 env->error_code = 0x10000000;
1586 break;
1587 case -4:
1588 /* Direct store exception */
1589 /* No code fetch is allowed in direct-store areas */
1590 cs->exception_index = POWERPC_EXCP_ISI;
1591 env->error_code = 0x10000000;
1592 break;
1593 }
1594 } else {
1595 switch (ret) {
1596 case -1:
1597 /* No matches in page tables or TLB */
1598 switch (env->mmu_model) {
1599 case POWERPC_MMU_SOFT_6xx:
1600 if (rw == 1) {
1601 cs->exception_index = POWERPC_EXCP_DSTLB;
1602 env->error_code = 1 << 16;
1603 } else {
1604 cs->exception_index = POWERPC_EXCP_DLTLB;
1605 env->error_code = 0;
1606 }
1607 env->spr[SPR_DMISS] = address;
1608 env->spr[SPR_DCMP] = 0x80000000 | ctx.ptem;
1609 tlb_miss:
1610 env->error_code |= ctx.key << 19;
1611 env->spr[SPR_HASH1] = ppc_hash32_hpt_base(cpu) +
1612 get_pteg_offset32(cpu, ctx.hash[0]);
1613 env->spr[SPR_HASH2] = ppc_hash32_hpt_base(cpu) +
1614 get_pteg_offset32(cpu, ctx.hash[1]);
1615 break;
1616 case POWERPC_MMU_SOFT_74xx:
1617 if (rw == 1) {
1618 cs->exception_index = POWERPC_EXCP_DSTLB;
1619 } else {
1620 cs->exception_index = POWERPC_EXCP_DLTLB;
1621 }
1622 tlb_miss_74xx:
1623 /* Implement LRU algorithm */
1624 env->error_code = ctx.key << 19;
1625 env->spr[SPR_TLBMISS] = (address & ~((target_ulong)0x3)) |
1626 ((env->last_way + 1) & (env->nb_ways - 1));
1627 env->spr[SPR_PTEHI] = 0x80000000 | ctx.ptem;
1628 break;
1629 case POWERPC_MMU_SOFT_4xx:
1630 case POWERPC_MMU_SOFT_4xx_Z:
1631 cs->exception_index = POWERPC_EXCP_DTLB;
1632 env->error_code = 0;
1633 env->spr[SPR_40x_DEAR] = address;
1634 if (rw) {
1635 env->spr[SPR_40x_ESR] = 0x00800000;
1636 } else {
1637 env->spr[SPR_40x_ESR] = 0x00000000;
1638 }
1639 break;
1640 case POWERPC_MMU_MPC8xx:
1641 /* XXX: TODO */
1642 cpu_abort(cs, "MPC8xx MMU model is not implemented\n");
1643 break;
1644 case POWERPC_MMU_BOOKE206:
1645 booke206_update_mas_tlb_miss(env, address, rw);
1646 /* fall through */
1647 case POWERPC_MMU_BOOKE:
1648 cs->exception_index = POWERPC_EXCP_DTLB;
1649 env->error_code = 0;
1650 env->spr[SPR_BOOKE_DEAR] = address;
1651 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1652 return -1;
1653 case POWERPC_MMU_REAL:
1654 cpu_abort(cs, "PowerPC in real mode should never raise "
1655 "any MMU exceptions\n");
1656 return -1;
1657 default:
1658 cpu_abort(cs, "Unknown or invalid MMU model\n");
1659 return -1;
1660 }
1661 break;
1662 case -2:
1663 /* Access rights violation */
1664 cs->exception_index = POWERPC_EXCP_DSI;
1665 env->error_code = 0;
1666 if (env->mmu_model == POWERPC_MMU_SOFT_4xx
1667 || env->mmu_model == POWERPC_MMU_SOFT_4xx_Z) {
1668 env->spr[SPR_40x_DEAR] = address;
1669 if (rw) {
1670 env->spr[SPR_40x_ESR] |= 0x00800000;
1671 }
1672 } else if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1673 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1674 env->spr[SPR_BOOKE_DEAR] = address;
1675 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1676 } else {
1677 env->spr[SPR_DAR] = address;
1678 if (rw == 1) {
1679 env->spr[SPR_DSISR] = 0x0A000000;
1680 } else {
1681 env->spr[SPR_DSISR] = 0x08000000;
1682 }
1683 }
1684 break;
1685 case -4:
1686 /* Direct store exception */
1687 switch (access_type) {
1688 case ACCESS_FLOAT:
1689 /* Floating point load/store */
1690 cs->exception_index = POWERPC_EXCP_ALIGN;
1691 env->error_code = POWERPC_EXCP_ALIGN_FP;
1692 env->spr[SPR_DAR] = address;
1693 break;
1694 case ACCESS_RES:
1695 /* lwarx, ldarx or stwcx. */
1696 cs->exception_index = POWERPC_EXCP_DSI;
1697 env->error_code = 0;
1698 env->spr[SPR_DAR] = address;
1699 if (rw == 1) {
1700 env->spr[SPR_DSISR] = 0x06000000;
1701 } else {
1702 env->spr[SPR_DSISR] = 0x04000000;
1703 }
1704 break;
1705 case ACCESS_EXT:
1706 /* eciwx or ecowx */
1707 cs->exception_index = POWERPC_EXCP_DSI;
1708 env->error_code = 0;
1709 env->spr[SPR_DAR] = address;
1710 if (rw == 1) {
1711 env->spr[SPR_DSISR] = 0x06100000;
1712 } else {
1713 env->spr[SPR_DSISR] = 0x04100000;
1714 }
1715 break;
1716 default:
1717 printf("DSI: invalid exception (%d)\n", ret);
1718 cs->exception_index = POWERPC_EXCP_PROGRAM;
1719 env->error_code =
1720 POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL;
1721 env->spr[SPR_DAR] = address;
1722 break;
1723 }
1724 break;
1725 }
1726 }
1727 #if 0
1728 printf("%s: set exception to %d %02x\n", __func__,
1729 cs->exception, env->error_code);
1730 #endif
1731 ret = 1;
1732 }
1733
1734 return ret;
1735 }
1736
1737 /*****************************************************************************/
1738 /* BATs management */
1739 #if !defined(FLUSH_ALL_TLBS)
1740 static inline void do_invalidate_BAT(CPUPPCState *env, target_ulong BATu,
1741 target_ulong mask)
1742 {
1743 CPUState *cs = CPU(ppc_env_get_cpu(env));
1744 target_ulong base, end, page;
1745
1746 base = BATu & ~0x0001FFFF;
1747 end = base + mask + 0x00020000;
1748 LOG_BATS("Flush BAT from " TARGET_FMT_lx " to " TARGET_FMT_lx " ("
1749 TARGET_FMT_lx ")\n", base, end, mask);
1750 for (page = base; page != end; page += TARGET_PAGE_SIZE) {
1751 tlb_flush_page(cs, page);
1752 }
1753 LOG_BATS("Flush done\n");
1754 }
1755 #endif
1756
1757 static inline void dump_store_bat(CPUPPCState *env, char ID, int ul, int nr,
1758 target_ulong value)
1759 {
1760 LOG_BATS("Set %cBAT%d%c to " TARGET_FMT_lx " (" TARGET_FMT_lx ")\n", ID,
1761 nr, ul == 0 ? 'u' : 'l', value, env->nip);
1762 }
1763
1764 void helper_store_ibatu(CPUPPCState *env, uint32_t nr, target_ulong value)
1765 {
1766 target_ulong mask;
1767 #if defined(FLUSH_ALL_TLBS)
1768 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1769 #endif
1770
1771 dump_store_bat(env, 'I', 0, nr, value);
1772 if (env->IBAT[0][nr] != value) {
1773 mask = (value << 15) & 0x0FFE0000UL;
1774 #if !defined(FLUSH_ALL_TLBS)
1775 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1776 #endif
1777 /* When storing valid upper BAT, mask BEPI and BRPN
1778 * and invalidate all TLBs covered by this BAT
1779 */
1780 mask = (value << 15) & 0x0FFE0000UL;
1781 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1782 (value & ~0x0001FFFFUL & ~mask);
1783 env->IBAT[1][nr] = (env->IBAT[1][nr] & 0x0000007B) |
1784 (env->IBAT[1][nr] & ~0x0001FFFF & ~mask);
1785 #if !defined(FLUSH_ALL_TLBS)
1786 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1787 #else
1788 tlb_flush(CPU(cpu));
1789 #endif
1790 }
1791 }
1792
1793 void helper_store_ibatl(CPUPPCState *env, uint32_t nr, target_ulong value)
1794 {
1795 dump_store_bat(env, 'I', 1, nr, value);
1796 env->IBAT[1][nr] = value;
1797 }
1798
1799 void helper_store_dbatu(CPUPPCState *env, uint32_t nr, target_ulong value)
1800 {
1801 target_ulong mask;
1802 #if defined(FLUSH_ALL_TLBS)
1803 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1804 #endif
1805
1806 dump_store_bat(env, 'D', 0, nr, value);
1807 if (env->DBAT[0][nr] != value) {
1808 /* When storing valid upper BAT, mask BEPI and BRPN
1809 * and invalidate all TLBs covered by this BAT
1810 */
1811 mask = (value << 15) & 0x0FFE0000UL;
1812 #if !defined(FLUSH_ALL_TLBS)
1813 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1814 #endif
1815 mask = (value << 15) & 0x0FFE0000UL;
1816 env->DBAT[0][nr] = (value & 0x00001FFFUL) |
1817 (value & ~0x0001FFFFUL & ~mask);
1818 env->DBAT[1][nr] = (env->DBAT[1][nr] & 0x0000007B) |
1819 (env->DBAT[1][nr] & ~0x0001FFFF & ~mask);
1820 #if !defined(FLUSH_ALL_TLBS)
1821 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1822 #else
1823 tlb_flush(CPU(cpu));
1824 #endif
1825 }
1826 }
1827
1828 void helper_store_dbatl(CPUPPCState *env, uint32_t nr, target_ulong value)
1829 {
1830 dump_store_bat(env, 'D', 1, nr, value);
1831 env->DBAT[1][nr] = value;
1832 }
1833
1834 void helper_store_601_batu(CPUPPCState *env, uint32_t nr, target_ulong value)
1835 {
1836 target_ulong mask;
1837 #if defined(FLUSH_ALL_TLBS)
1838 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1839 int do_inval;
1840 #endif
1841
1842 dump_store_bat(env, 'I', 0, nr, value);
1843 if (env->IBAT[0][nr] != value) {
1844 #if defined(FLUSH_ALL_TLBS)
1845 do_inval = 0;
1846 #endif
1847 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1848 if (env->IBAT[1][nr] & 0x40) {
1849 /* Invalidate BAT only if it is valid */
1850 #if !defined(FLUSH_ALL_TLBS)
1851 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1852 #else
1853 do_inval = 1;
1854 #endif
1855 }
1856 /* When storing valid upper BAT, mask BEPI and BRPN
1857 * and invalidate all TLBs covered by this BAT
1858 */
1859 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1860 (value & ~0x0001FFFFUL & ~mask);
1861 env->DBAT[0][nr] = env->IBAT[0][nr];
1862 if (env->IBAT[1][nr] & 0x40) {
1863 #if !defined(FLUSH_ALL_TLBS)
1864 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1865 #else
1866 do_inval = 1;
1867 #endif
1868 }
1869 #if defined(FLUSH_ALL_TLBS)
1870 if (do_inval) {
1871 tlb_flush(CPU(cpu));
1872 }
1873 #endif
1874 }
1875 }
1876
1877 void helper_store_601_batl(CPUPPCState *env, uint32_t nr, target_ulong value)
1878 {
1879 #if !defined(FLUSH_ALL_TLBS)
1880 target_ulong mask;
1881 #else
1882 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1883 int do_inval;
1884 #endif
1885
1886 dump_store_bat(env, 'I', 1, nr, value);
1887 if (env->IBAT[1][nr] != value) {
1888 #if defined(FLUSH_ALL_TLBS)
1889 do_inval = 0;
1890 #endif
1891 if (env->IBAT[1][nr] & 0x40) {
1892 #if !defined(FLUSH_ALL_TLBS)
1893 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1894 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1895 #else
1896 do_inval = 1;
1897 #endif
1898 }
1899 if (value & 0x40) {
1900 #if !defined(FLUSH_ALL_TLBS)
1901 mask = (value << 17) & 0x0FFE0000UL;
1902 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1903 #else
1904 do_inval = 1;
1905 #endif
1906 }
1907 env->IBAT[1][nr] = value;
1908 env->DBAT[1][nr] = value;
1909 #if defined(FLUSH_ALL_TLBS)
1910 if (do_inval) {
1911 tlb_flush(CPU(cpu));
1912 }
1913 #endif
1914 }
1915 }
1916
1917 /*****************************************************************************/
1918 /* TLB management */
1919 void ppc_tlb_invalidate_all(CPUPPCState *env)
1920 {
1921 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1922
1923 #if defined(TARGET_PPC64)
1924 if (env->mmu_model & POWERPC_MMU_64) {
1925 env->tlb_need_flush = 0;
1926 tlb_flush(CPU(cpu));
1927 } else
1928 #endif /* defined(TARGET_PPC64) */
1929 switch (env->mmu_model) {
1930 case POWERPC_MMU_SOFT_6xx:
1931 case POWERPC_MMU_SOFT_74xx:
1932 ppc6xx_tlb_invalidate_all(env);
1933 break;
1934 case POWERPC_MMU_SOFT_4xx:
1935 case POWERPC_MMU_SOFT_4xx_Z:
1936 ppc4xx_tlb_invalidate_all(env);
1937 break;
1938 case POWERPC_MMU_REAL:
1939 cpu_abort(CPU(cpu), "No TLB for PowerPC 4xx in real mode\n");
1940 break;
1941 case POWERPC_MMU_MPC8xx:
1942 /* XXX: TODO */
1943 cpu_abort(CPU(cpu), "MPC8xx MMU model is not implemented\n");
1944 break;
1945 case POWERPC_MMU_BOOKE:
1946 tlb_flush(CPU(cpu));
1947 break;
1948 case POWERPC_MMU_BOOKE206:
1949 booke206_flush_tlb(env, -1, 0);
1950 break;
1951 case POWERPC_MMU_32B:
1952 case POWERPC_MMU_601:
1953 env->tlb_need_flush = 0;
1954 tlb_flush(CPU(cpu));
1955 break;
1956 default:
1957 /* XXX: TODO */
1958 cpu_abort(CPU(cpu), "Unknown MMU model %x\n", env->mmu_model);
1959 break;
1960 }
1961 }
1962
1963 void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
1964 {
1965 #if !defined(FLUSH_ALL_TLBS)
1966 addr &= TARGET_PAGE_MASK;
1967 #if defined(TARGET_PPC64)
1968 if (env->mmu_model & POWERPC_MMU_64) {
1969 /* tlbie invalidate TLBs for all segments */
1970 /* XXX: given the fact that there are too many segments to invalidate,
1971 * and we still don't have a tlb_flush_mask(env, n, mask) in QEMU,
1972 * we just invalidate all TLBs
1973 */
1974 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH;
1975 } else
1976 #endif /* defined(TARGET_PPC64) */
1977 switch (env->mmu_model) {
1978 case POWERPC_MMU_SOFT_6xx:
1979 case POWERPC_MMU_SOFT_74xx:
1980 ppc6xx_tlb_invalidate_virt(env, addr, 0);
1981 if (env->id_tlbs == 1) {
1982 ppc6xx_tlb_invalidate_virt(env, addr, 1);
1983 }
1984 break;
1985 case POWERPC_MMU_32B:
1986 case POWERPC_MMU_601:
1987 /* Actual CPUs invalidate entire congruence classes based on the
1988 * geometry of their TLBs and some OSes take that into account,
1989 * we just mark the TLB to be flushed later (context synchronizing
1990 * event or sync instruction on 32-bit).
1991 */
1992 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH;
1993 break;
1994 default:
1995 /* Should never reach here with other MMU models */
1996 assert(0);
1997 }
1998 #else
1999 ppc_tlb_invalidate_all(env);
2000 #endif
2001 }
2002
2003 /*****************************************************************************/
2004 /* Special registers manipulation */
2005 void ppc_store_sdr1(CPUPPCState *env, target_ulong value)
2006 {
2007 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2008 qemu_log_mask(CPU_LOG_MMU, "%s: " TARGET_FMT_lx "\n", __func__, value);
2009 assert(!cpu->vhyp);
2010 #if defined(TARGET_PPC64)
2011 if (env->mmu_model & POWERPC_MMU_64) {
2012 target_ulong sdr_mask = SDR_64_HTABORG | SDR_64_HTABSIZE;
2013 target_ulong htabsize = value & SDR_64_HTABSIZE;
2014
2015 if (value & ~sdr_mask) {
2016 error_report("Invalid bits 0x"TARGET_FMT_lx" set in SDR1",
2017 value & ~sdr_mask);
2018 value &= sdr_mask;
2019 }
2020 if (htabsize > 28) {
2021 error_report("Invalid HTABSIZE 0x" TARGET_FMT_lx" stored in SDR1",
2022 htabsize);
2023 return;
2024 }
2025 }
2026 #endif /* defined(TARGET_PPC64) */
2027 /* FIXME: Should check for valid HTABMASK values in 32-bit case */
2028 env->spr[SPR_SDR1] = value;
2029 }
2030
2031 #if defined(TARGET_PPC64)
2032 void ppc_store_ptcr(CPUPPCState *env, target_ulong value)
2033 {
2034 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2035 target_ulong ptcr_mask = PTCR_PATB | PTCR_PATS;
2036 target_ulong patbsize = value & PTCR_PATS;
2037
2038 qemu_log_mask(CPU_LOG_MMU, "%s: " TARGET_FMT_lx "\n", __func__, value);
2039
2040 assert(!cpu->vhyp);
2041 assert(env->mmu_model & POWERPC_MMU_3_00);
2042
2043 if (value & ~ptcr_mask) {
2044 error_report("Invalid bits 0x"TARGET_FMT_lx" set in PTCR",
2045 value & ~ptcr_mask);
2046 value &= ptcr_mask;
2047 }
2048
2049 if (patbsize > 24) {
2050 error_report("Invalid Partition Table size 0x" TARGET_FMT_lx
2051 " stored in PTCR", patbsize);
2052 return;
2053 }
2054
2055 env->spr[SPR_PTCR] = value;
2056 }
2057
2058 #endif /* defined(TARGET_PPC64) */
2059
2060 /* Segment registers load and store */
2061 target_ulong helper_load_sr(CPUPPCState *env, target_ulong sr_num)
2062 {
2063 #if defined(TARGET_PPC64)
2064 if (env->mmu_model & POWERPC_MMU_64) {
2065 /* XXX */
2066 return 0;
2067 }
2068 #endif
2069 return env->sr[sr_num];
2070 }
2071
2072 void helper_store_sr(CPUPPCState *env, target_ulong srnum, target_ulong value)
2073 {
2074 qemu_log_mask(CPU_LOG_MMU,
2075 "%s: reg=%d " TARGET_FMT_lx " " TARGET_FMT_lx "\n", __func__,
2076 (int)srnum, value, env->sr[srnum]);
2077 #if defined(TARGET_PPC64)
2078 if (env->mmu_model & POWERPC_MMU_64) {
2079 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2080 uint64_t esid, vsid;
2081
2082 /* ESID = srnum */
2083 esid = ((uint64_t)(srnum & 0xf) << 28) | SLB_ESID_V;
2084
2085 /* VSID = VSID */
2086 vsid = (value & 0xfffffff) << 12;
2087 /* flags = flags */
2088 vsid |= ((value >> 27) & 0xf) << 8;
2089
2090 ppc_store_slb(cpu, srnum, esid, vsid);
2091 } else
2092 #endif
2093 if (env->sr[srnum] != value) {
2094 env->sr[srnum] = value;
2095 /* Invalidating 256MB of virtual memory in 4kB pages is way longer than
2096 flusing the whole TLB. */
2097 #if !defined(FLUSH_ALL_TLBS) && 0
2098 {
2099 target_ulong page, end;
2100 /* Invalidate 256 MB of virtual memory */
2101 page = (16 << 20) * srnum;
2102 end = page + (16 << 20);
2103 for (; page != end; page += TARGET_PAGE_SIZE) {
2104 tlb_flush_page(CPU(cpu), page);
2105 }
2106 }
2107 #else
2108 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH;
2109 #endif
2110 }
2111 }
2112
2113 /* TLB management */
2114 void helper_tlbia(CPUPPCState *env)
2115 {
2116 ppc_tlb_invalidate_all(env);
2117 }
2118
2119 void helper_tlbie(CPUPPCState *env, target_ulong addr)
2120 {
2121 ppc_tlb_invalidate_one(env, addr);
2122 }
2123
2124 void helper_tlbiva(CPUPPCState *env, target_ulong addr)
2125 {
2126 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2127
2128 /* tlbiva instruction only exists on BookE */
2129 assert(env->mmu_model == POWERPC_MMU_BOOKE);
2130 /* XXX: TODO */
2131 cpu_abort(CPU(cpu), "BookE MMU model is not implemented\n");
2132 }
2133
2134 /* Software driven TLBs management */
2135 /* PowerPC 602/603 software TLB load instructions helpers */
2136 static void do_6xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
2137 {
2138 target_ulong RPN, CMP, EPN;
2139 int way;
2140
2141 RPN = env->spr[SPR_RPA];
2142 if (is_code) {
2143 CMP = env->spr[SPR_ICMP];
2144 EPN = env->spr[SPR_IMISS];
2145 } else {
2146 CMP = env->spr[SPR_DCMP];
2147 EPN = env->spr[SPR_DMISS];
2148 }
2149 way = (env->spr[SPR_SRR1] >> 17) & 1;
2150 (void)EPN; /* avoid a compiler warning */
2151 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2152 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2153 RPN, way);
2154 /* Store this TLB */
2155 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2156 way, is_code, CMP, RPN);
2157 }
2158
2159 void helper_6xx_tlbd(CPUPPCState *env, target_ulong EPN)
2160 {
2161 do_6xx_tlb(env, EPN, 0);
2162 }
2163
2164 void helper_6xx_tlbi(CPUPPCState *env, target_ulong EPN)
2165 {
2166 do_6xx_tlb(env, EPN, 1);
2167 }
2168
2169 /* PowerPC 74xx software TLB load instructions helpers */
2170 static void do_74xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
2171 {
2172 target_ulong RPN, CMP, EPN;
2173 int way;
2174
2175 RPN = env->spr[SPR_PTELO];
2176 CMP = env->spr[SPR_PTEHI];
2177 EPN = env->spr[SPR_TLBMISS] & ~0x3;
2178 way = env->spr[SPR_TLBMISS] & 0x3;
2179 (void)EPN; /* avoid a compiler warning */
2180 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2181 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2182 RPN, way);
2183 /* Store this TLB */
2184 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2185 way, is_code, CMP, RPN);
2186 }
2187
2188 void helper_74xx_tlbd(CPUPPCState *env, target_ulong EPN)
2189 {
2190 do_74xx_tlb(env, EPN, 0);
2191 }
2192
2193 void helper_74xx_tlbi(CPUPPCState *env, target_ulong EPN)
2194 {
2195 do_74xx_tlb(env, EPN, 1);
2196 }
2197
2198 /*****************************************************************************/
2199 /* PowerPC 601 specific instructions (POWER bridge) */
2200
2201 target_ulong helper_rac(CPUPPCState *env, target_ulong addr)
2202 {
2203 mmu_ctx_t ctx;
2204 int nb_BATs;
2205 target_ulong ret = 0;
2206
2207 /* We don't have to generate many instances of this instruction,
2208 * as rac is supervisor only.
2209 */
2210 /* XXX: FIX THIS: Pretend we have no BAT */
2211 nb_BATs = env->nb_BATs;
2212 env->nb_BATs = 0;
2213 if (get_physical_address(env, &ctx, addr, 0, ACCESS_INT) == 0) {
2214 ret = ctx.raddr;
2215 }
2216 env->nb_BATs = nb_BATs;
2217 return ret;
2218 }
2219
2220 static inline target_ulong booke_tlb_to_page_size(int size)
2221 {
2222 return 1024 << (2 * size);
2223 }
2224
2225 static inline int booke_page_size_to_tlb(target_ulong page_size)
2226 {
2227 int size;
2228
2229 switch (page_size) {
2230 case 0x00000400UL:
2231 size = 0x0;
2232 break;
2233 case 0x00001000UL:
2234 size = 0x1;
2235 break;
2236 case 0x00004000UL:
2237 size = 0x2;
2238 break;
2239 case 0x00010000UL:
2240 size = 0x3;
2241 break;
2242 case 0x00040000UL:
2243 size = 0x4;
2244 break;
2245 case 0x00100000UL:
2246 size = 0x5;
2247 break;
2248 case 0x00400000UL:
2249 size = 0x6;
2250 break;
2251 case 0x01000000UL:
2252 size = 0x7;
2253 break;
2254 case 0x04000000UL:
2255 size = 0x8;
2256 break;
2257 case 0x10000000UL:
2258 size = 0x9;
2259 break;
2260 case 0x40000000UL:
2261 size = 0xA;
2262 break;
2263 #if defined(TARGET_PPC64)
2264 case 0x000100000000ULL:
2265 size = 0xB;
2266 break;
2267 case 0x000400000000ULL:
2268 size = 0xC;
2269 break;
2270 case 0x001000000000ULL:
2271 size = 0xD;
2272 break;
2273 case 0x004000000000ULL:
2274 size = 0xE;
2275 break;
2276 case 0x010000000000ULL:
2277 size = 0xF;
2278 break;
2279 #endif
2280 default:
2281 size = -1;
2282 break;
2283 }
2284
2285 return size;
2286 }
2287
2288 /* Helpers for 4xx TLB management */
2289 #define PPC4XX_TLB_ENTRY_MASK 0x0000003f /* Mask for 64 TLB entries */
2290
2291 #define PPC4XX_TLBHI_V 0x00000040
2292 #define PPC4XX_TLBHI_E 0x00000020
2293 #define PPC4XX_TLBHI_SIZE_MIN 0
2294 #define PPC4XX_TLBHI_SIZE_MAX 7
2295 #define PPC4XX_TLBHI_SIZE_DEFAULT 1
2296 #define PPC4XX_TLBHI_SIZE_SHIFT 7
2297 #define PPC4XX_TLBHI_SIZE_MASK 0x00000007
2298
2299 #define PPC4XX_TLBLO_EX 0x00000200
2300 #define PPC4XX_TLBLO_WR 0x00000100
2301 #define PPC4XX_TLBLO_ATTR_MASK 0x000000FF
2302 #define PPC4XX_TLBLO_RPN_MASK 0xFFFFFC00
2303
2304 target_ulong helper_4xx_tlbre_hi(CPUPPCState *env, target_ulong entry)
2305 {
2306 ppcemb_tlb_t *tlb;
2307 target_ulong ret;
2308 int size;
2309
2310 entry &= PPC4XX_TLB_ENTRY_MASK;
2311 tlb = &env->tlb.tlbe[entry];
2312 ret = tlb->EPN;
2313 if (tlb->prot & PAGE_VALID) {
2314 ret |= PPC4XX_TLBHI_V;
2315 }
2316 size = booke_page_size_to_tlb(tlb->size);
2317 if (size < PPC4XX_TLBHI_SIZE_MIN || size > PPC4XX_TLBHI_SIZE_MAX) {
2318 size = PPC4XX_TLBHI_SIZE_DEFAULT;
2319 }
2320 ret |= size << PPC4XX_TLBHI_SIZE_SHIFT;
2321 env->spr[SPR_40x_PID] = tlb->PID;
2322 return ret;
2323 }
2324
2325 target_ulong helper_4xx_tlbre_lo(CPUPPCState *env, target_ulong entry)
2326 {
2327 ppcemb_tlb_t *tlb;
2328 target_ulong ret;
2329
2330 entry &= PPC4XX_TLB_ENTRY_MASK;
2331 tlb = &env->tlb.tlbe[entry];
2332 ret = tlb->RPN;
2333 if (tlb->prot & PAGE_EXEC) {
2334 ret |= PPC4XX_TLBLO_EX;
2335 }
2336 if (tlb->prot & PAGE_WRITE) {
2337 ret |= PPC4XX_TLBLO_WR;
2338 }
2339 return ret;
2340 }
2341
2342 void helper_4xx_tlbwe_hi(CPUPPCState *env, target_ulong entry,
2343 target_ulong val)
2344 {
2345 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2346 CPUState *cs = CPU(cpu);
2347 ppcemb_tlb_t *tlb;
2348 target_ulong page, end;
2349
2350 LOG_SWTLB("%s entry %d val " TARGET_FMT_lx "\n", __func__, (int)entry,
2351 val);
2352 entry &= PPC4XX_TLB_ENTRY_MASK;
2353 tlb = &env->tlb.tlbe[entry];
2354 /* Invalidate previous TLB (if it's valid) */
2355 if (tlb->prot & PAGE_VALID) {
2356 end = tlb->EPN + tlb->size;
2357 LOG_SWTLB("%s: invalidate old TLB %d start " TARGET_FMT_lx " end "
2358 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2359 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
2360 tlb_flush_page(cs, page);
2361 }
2362 }
2363 tlb->size = booke_tlb_to_page_size((val >> PPC4XX_TLBHI_SIZE_SHIFT)
2364 & PPC4XX_TLBHI_SIZE_MASK);
2365 /* We cannot handle TLB size < TARGET_PAGE_SIZE.
2366 * If this ever occurs, we should implement TARGET_PAGE_BITS_VARY
2367 */
2368 if ((val & PPC4XX_TLBHI_V) && tlb->size < TARGET_PAGE_SIZE) {
2369 cpu_abort(cs, "TLB size " TARGET_FMT_lu " < %u "
2370 "are not supported (%d)\n"
2371 "Please implement TARGET_PAGE_BITS_VARY\n",
2372 tlb->size, TARGET_PAGE_SIZE, (int)((val >> 7) & 0x7));
2373 }
2374 tlb->EPN = val & ~(tlb->size - 1);
2375 if (val & PPC4XX_TLBHI_V) {
2376 tlb->prot |= PAGE_VALID;
2377 if (val & PPC4XX_TLBHI_E) {
2378 /* XXX: TO BE FIXED */
2379 cpu_abort(cs,
2380 "Little-endian TLB entries are not supported by now\n");
2381 }
2382 } else {
2383 tlb->prot &= ~PAGE_VALID;
2384 }
2385 tlb->PID = env->spr[SPR_40x_PID]; /* PID */
2386 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2387 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2388 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2389 tlb->prot & PAGE_READ ? 'r' : '-',
2390 tlb->prot & PAGE_WRITE ? 'w' : '-',
2391 tlb->prot & PAGE_EXEC ? 'x' : '-',
2392 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2393 /* Invalidate new TLB (if valid) */
2394 if (tlb->prot & PAGE_VALID) {
2395 end = tlb->EPN + tlb->size;
2396 LOG_SWTLB("%s: invalidate TLB %d start " TARGET_FMT_lx " end "
2397 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2398 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
2399 tlb_flush_page(cs, page);
2400 }
2401 }
2402 }
2403
2404 void helper_4xx_tlbwe_lo(CPUPPCState *env, target_ulong entry,
2405 target_ulong val)
2406 {
2407 ppcemb_tlb_t *tlb;
2408
2409 LOG_SWTLB("%s entry %i val " TARGET_FMT_lx "\n", __func__, (int)entry,
2410 val);
2411 entry &= PPC4XX_TLB_ENTRY_MASK;
2412 tlb = &env->tlb.tlbe[entry];
2413 tlb->attr = val & PPC4XX_TLBLO_ATTR_MASK;
2414 tlb->RPN = val & PPC4XX_TLBLO_RPN_MASK;
2415 tlb->prot = PAGE_READ;
2416 if (val & PPC4XX_TLBLO_EX) {
2417 tlb->prot |= PAGE_EXEC;
2418 }
2419 if (val & PPC4XX_TLBLO_WR) {
2420 tlb->prot |= PAGE_WRITE;
2421 }
2422 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2423 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2424 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2425 tlb->prot & PAGE_READ ? 'r' : '-',
2426 tlb->prot & PAGE_WRITE ? 'w' : '-',
2427 tlb->prot & PAGE_EXEC ? 'x' : '-',
2428 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2429 }
2430
2431 target_ulong helper_4xx_tlbsx(CPUPPCState *env, target_ulong address)
2432 {
2433 return ppcemb_tlb_search(env, address, env->spr[SPR_40x_PID]);
2434 }
2435
2436 /* PowerPC 440 TLB management */
2437 void helper_440_tlbwe(CPUPPCState *env, uint32_t word, target_ulong entry,
2438 target_ulong value)
2439 {
2440 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2441 ppcemb_tlb_t *tlb;
2442 target_ulong EPN, RPN, size;
2443 int do_flush_tlbs;
2444
2445 LOG_SWTLB("%s word %d entry %d value " TARGET_FMT_lx "\n",
2446 __func__, word, (int)entry, value);
2447 do_flush_tlbs = 0;
2448 entry &= 0x3F;
2449 tlb = &env->tlb.tlbe[entry];
2450 switch (word) {
2451 default:
2452 /* Just here to please gcc */
2453 case 0:
2454 EPN = value & 0xFFFFFC00;
2455 if ((tlb->prot & PAGE_VALID) && EPN != tlb->EPN) {
2456 do_flush_tlbs = 1;
2457 }
2458 tlb->EPN = EPN;
2459 size = booke_tlb_to_page_size((value >> 4) & 0xF);
2460 if ((tlb->prot & PAGE_VALID) && tlb->size < size) {
2461 do_flush_tlbs = 1;
2462 }
2463 tlb->size = size;
2464 tlb->attr &= ~0x1;
2465 tlb->attr |= (value >> 8) & 1;
2466 if (value & 0x200) {
2467 tlb->prot |= PAGE_VALID;
2468 } else {
2469 if (tlb->prot & PAGE_VALID) {
2470 tlb->prot &= ~PAGE_VALID;
2471 do_flush_tlbs = 1;
2472 }
2473 }
2474 tlb->PID = env->spr[SPR_440_MMUCR] & 0x000000FF;
2475 if (do_flush_tlbs) {
2476 tlb_flush(CPU(cpu));
2477 }
2478 break;
2479 case 1:
2480 RPN = value & 0xFFFFFC0F;
2481 if ((tlb->prot & PAGE_VALID) && tlb->RPN != RPN) {
2482 tlb_flush(CPU(cpu));
2483 }
2484 tlb->RPN = RPN;
2485 break;
2486 case 2:
2487 tlb->attr = (tlb->attr & 0x1) | (value & 0x0000FF00);
2488 tlb->prot = tlb->prot & PAGE_VALID;
2489 if (value & 0x1) {
2490 tlb->prot |= PAGE_READ << 4;
2491 }
2492 if (value & 0x2) {
2493 tlb->prot |= PAGE_WRITE << 4;
2494 }
2495 if (value & 0x4) {
2496 tlb->prot |= PAGE_EXEC << 4;
2497 }
2498 if (value & 0x8) {
2499 tlb->prot |= PAGE_READ;
2500 }
2501 if (value & 0x10) {
2502 tlb->prot |= PAGE_WRITE;
2503 }
2504 if (value & 0x20) {
2505 tlb->prot |= PAGE_EXEC;
2506 }
2507 break;
2508 }
2509 }
2510
2511 target_ulong helper_440_tlbre(CPUPPCState *env, uint32_t word,
2512 target_ulong entry)
2513 {
2514 ppcemb_tlb_t *tlb;
2515 target_ulong ret;
2516 int size;
2517
2518 entry &= 0x3F;
2519 tlb = &env->tlb.tlbe[entry];
2520 switch (word) {
2521 default:
2522 /* Just here to please gcc */
2523 case 0:
2524 ret = tlb->EPN;
2525 size = booke_page_size_to_tlb(tlb->size);
2526 if (size < 0 || size > 0xF) {
2527 size = 1;
2528 }
2529 ret |= size << 4;
2530 if (tlb->attr & 0x1) {
2531 ret |= 0x100;
2532 }
2533 if (tlb->prot & PAGE_VALID) {
2534 ret |= 0x200;
2535 }
2536 env->spr[SPR_440_MMUCR] &= ~0x000000FF;
2537 env->spr[SPR_440_MMUCR] |= tlb->PID;
2538 break;
2539 case 1:
2540 ret = tlb->RPN;
2541 break;
2542 case 2:
2543 ret = tlb->attr & ~0x1;
2544 if (tlb->prot & (PAGE_READ << 4)) {
2545 ret |= 0x1;
2546 }
2547 if (tlb->prot & (PAGE_WRITE << 4)) {
2548 ret |= 0x2;
2549 }
2550 if (tlb->prot & (PAGE_EXEC << 4)) {
2551 ret |= 0x4;
2552 }
2553 if (tlb->prot & PAGE_READ) {
2554 ret |= 0x8;
2555 }
2556 if (tlb->prot & PAGE_WRITE) {
2557 ret |= 0x10;
2558 }
2559 if (tlb->prot & PAGE_EXEC) {
2560 ret |= 0x20;
2561 }
2562 break;
2563 }
2564 return ret;
2565 }
2566
2567 target_ulong helper_440_tlbsx(CPUPPCState *env, target_ulong address)
2568 {
2569 return ppcemb_tlb_search(env, address, env->spr[SPR_440_MMUCR] & 0xFF);
2570 }
2571
2572 /* PowerPC BookE 2.06 TLB management */
2573
2574 static ppcmas_tlb_t *booke206_cur_tlb(CPUPPCState *env)
2575 {
2576 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2577 uint32_t tlbncfg = 0;
2578 int esel = (env->spr[SPR_BOOKE_MAS0] & MAS0_ESEL_MASK) >> MAS0_ESEL_SHIFT;
2579 int ea = (env->spr[SPR_BOOKE_MAS2] & MAS2_EPN_MASK);
2580 int tlb;
2581
2582 tlb = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2583 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlb];
2584
2585 if ((tlbncfg & TLBnCFG_HES) && (env->spr[SPR_BOOKE_MAS0] & MAS0_HES)) {
2586 cpu_abort(CPU(cpu), "we don't support HES yet\n");
2587 }
2588
2589 return booke206_get_tlbm(env, tlb, ea, esel);
2590 }
2591
2592 void helper_booke_setpid(CPUPPCState *env, uint32_t pidn, target_ulong pid)
2593 {
2594 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2595
2596 env->spr[pidn] = pid;
2597 /* changing PIDs mean we're in a different address space now */
2598 tlb_flush(CPU(cpu));
2599 }
2600
2601 static inline void flush_page(CPUPPCState *env, ppcmas_tlb_t *tlb)
2602 {
2603 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2604
2605 if (booke206_tlb_to_page_size(env, tlb) == TARGET_PAGE_SIZE) {
2606 tlb_flush_page(CPU(cpu), tlb->mas2 & MAS2_EPN_MASK);
2607 } else {
2608 tlb_flush(CPU(cpu));
2609 }
2610 }
2611
2612 void helper_booke206_tlbwe(CPUPPCState *env)
2613 {
2614 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2615 uint32_t tlbncfg, tlbn;
2616 ppcmas_tlb_t *tlb;
2617 uint32_t size_tlb, size_ps;
2618 target_ulong mask;
2619
2620
2621 switch (env->spr[SPR_BOOKE_MAS0] & MAS0_WQ_MASK) {
2622 case MAS0_WQ_ALWAYS:
2623 /* good to go, write that entry */
2624 break;
2625 case MAS0_WQ_COND:
2626 /* XXX check if reserved */
2627 if (0) {
2628 return;
2629 }
2630 break;
2631 case MAS0_WQ_CLR_RSRV:
2632 /* XXX clear entry */
2633 return;
2634 default:
2635 /* no idea what to do */
2636 return;
2637 }
2638
2639 if (((env->spr[SPR_BOOKE_MAS0] & MAS0_ATSEL) == MAS0_ATSEL_LRAT) &&
2640 !msr_gs) {
2641 /* XXX we don't support direct LRAT setting yet */
2642 fprintf(stderr, "cpu: don't support LRAT setting yet\n");
2643 return;
2644 }
2645
2646 tlbn = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2647 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlbn];
2648
2649 tlb = booke206_cur_tlb(env);
2650
2651 if (!tlb) {
2652 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
2653 POWERPC_EXCP_INVAL |
2654 POWERPC_EXCP_INVAL_INVAL, GETPC());
2655 }
2656
2657 /* check that we support the targeted size */
2658 size_tlb = (env->spr[SPR_BOOKE_MAS1] & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
2659 size_ps = booke206_tlbnps(env, tlbn);
2660 if ((env->spr[SPR_BOOKE_MAS1] & MAS1_VALID) && (tlbncfg & TLBnCFG_AVAIL) &&
2661 !(size_ps & (1 << size_tlb))) {
2662 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
2663 POWERPC_EXCP_INVAL |
2664 POWERPC_EXCP_INVAL_INVAL, GETPC());
2665 }
2666
2667 if (msr_gs) {
2668 cpu_abort(CPU(cpu), "missing HV implementation\n");
2669 }
2670
2671 if (tlb->mas1 & MAS1_VALID) {
2672 /* Invalidate the page in QEMU TLB if it was a valid entry.
2673 *
2674 * In "PowerPC e500 Core Family Reference Manual, Rev. 1",
2675 * Section "12.4.2 TLB Write Entry (tlbwe) Instruction":
2676 * (https://www.nxp.com/docs/en/reference-manual/E500CORERM.pdf)
2677 *
2678 * "Note that when an L2 TLB entry is written, it may be displacing an
2679 * already valid entry in the same L2 TLB location (a victim). If a
2680 * valid L1 TLB entry corresponds to the L2 MMU victim entry, that L1
2681 * TLB entry is automatically invalidated." */
2682 flush_page(env, tlb);
2683 }
2684
2685 tlb->mas7_3 = ((uint64_t)env->spr[SPR_BOOKE_MAS7] << 32) |
2686 env->spr[SPR_BOOKE_MAS3];
2687 tlb->mas1 = env->spr[SPR_BOOKE_MAS1];
2688
2689 if ((env->spr[SPR_MMUCFG] & MMUCFG_MAVN) == MMUCFG_MAVN_V2) {
2690 /* For TLB which has a fixed size TSIZE is ignored with MAV2 */
2691 booke206_fixed_size_tlbn(env, tlbn, tlb);
2692 } else {
2693 if (!(tlbncfg & TLBnCFG_AVAIL)) {
2694 /* force !AVAIL TLB entries to correct page size */
2695 tlb->mas1 &= ~MAS1_TSIZE_MASK;
2696 /* XXX can be configured in MMUCSR0 */
2697 tlb->mas1 |= (tlbncfg & TLBnCFG_MINSIZE) >> 12;
2698 }
2699 }
2700
2701 /* Make a mask from TLB size to discard invalid bits in EPN field */
2702 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2703 /* Add a mask for page attributes */
2704 mask |= MAS2_ACM | MAS2_VLE | MAS2_W | MAS2_I | MAS2_M | MAS2_G | MAS2_E;
2705
2706 if (!msr_cm) {
2707 /* Executing a tlbwe instruction in 32-bit mode will set
2708 * bits 0:31 of the TLB EPN field to zero.
2709 */
2710 mask &= 0xffffffff;
2711 }
2712
2713 tlb->mas2 = env->spr[SPR_BOOKE_MAS2] & mask;
2714
2715 if (!(tlbncfg & TLBnCFG_IPROT)) {
2716 /* no IPROT supported by TLB */
2717 tlb->mas1 &= ~MAS1_IPROT;
2718 }
2719
2720 flush_page(env, tlb);
2721 }
2722
2723 static inline void booke206_tlb_to_mas(CPUPPCState *env, ppcmas_tlb_t *tlb)
2724 {
2725 int tlbn = booke206_tlbm_to_tlbn(env, tlb);
2726 int way = booke206_tlbm_to_way(env, tlb);
2727
2728 env->spr[SPR_BOOKE_MAS0] = tlbn << MAS0_TLBSEL_SHIFT;
2729 env->spr[SPR_BOOKE_MAS0] |= way << MAS0_ESEL_SHIFT;
2730 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2731
2732 env->spr[SPR_BOOKE_MAS1] = tlb->mas1;
2733 env->spr[SPR_BOOKE_MAS2] = tlb->mas2;
2734 env->spr[SPR_BOOKE_MAS3] = tlb->mas7_3;
2735 env->spr[SPR_BOOKE_MAS7] = tlb->mas7_3 >> 32;
2736 }
2737
2738 void helper_booke206_tlbre(CPUPPCState *env)
2739 {
2740 ppcmas_tlb_t *tlb = NULL;
2741
2742 tlb = booke206_cur_tlb(env);
2743 if (!tlb) {
2744 env->spr[SPR_BOOKE_MAS1] = 0;
2745 } else {
2746 booke206_tlb_to_mas(env, tlb);
2747 }
2748 }
2749
2750 void helper_booke206_tlbsx(CPUPPCState *env, target_ulong address)
2751 {
2752 ppcmas_tlb_t *tlb = NULL;
2753 int i, j;
2754 hwaddr raddr;
2755 uint32_t spid, sas;
2756
2757 spid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID_MASK) >> MAS6_SPID_SHIFT;
2758 sas = env->spr[SPR_BOOKE_MAS6] & MAS6_SAS;
2759
2760 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2761 int ways = booke206_tlb_ways(env, i);
2762
2763 for (j = 0; j < ways; j++) {
2764 tlb = booke206_get_tlbm(env, i, address, j);
2765
2766 if (!tlb) {
2767 continue;
2768 }
2769
2770 if (ppcmas_tlb_check(env, tlb, &raddr, address, spid)) {
2771 continue;
2772 }
2773
2774 if (sas != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
2775 continue;
2776 }
2777
2778 booke206_tlb_to_mas(env, tlb);
2779 return;
2780 }
2781 }
2782
2783 /* no entry found, fill with defaults */
2784 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
2785 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
2786 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
2787 env->spr[SPR_BOOKE_MAS3] = 0;
2788 env->spr[SPR_BOOKE_MAS7] = 0;
2789
2790 if (env->spr[SPR_BOOKE_MAS6] & MAS6_SAS) {
2791 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
2792 }
2793
2794 env->spr[SPR_BOOKE_MAS1] |= (env->spr[SPR_BOOKE_MAS6] >> 16)
2795 << MAS1_TID_SHIFT;
2796
2797 /* next victim logic */
2798 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
2799 env->last_way++;
2800 env->last_way &= booke206_tlb_ways(env, 0) - 1;
2801 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2802 }
2803
2804 static inline void booke206_invalidate_ea_tlb(CPUPPCState *env, int tlbn,
2805 uint32_t ea)
2806 {
2807 int i;
2808 int ways = booke206_tlb_ways(env, tlbn);
2809 target_ulong mask;
2810
2811 for (i = 0; i < ways; i++) {
2812 ppcmas_tlb_t *tlb = booke206_get_tlbm(env, tlbn, ea, i);
2813 if (!tlb) {
2814 continue;
2815 }
2816 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2817 if (((tlb->mas2 & MAS2_EPN_MASK) == (ea & mask)) &&
2818 !(tlb->mas1 & MAS1_IPROT)) {
2819 tlb->mas1 &= ~MAS1_VALID;
2820 }
2821 }
2822 }
2823
2824 void helper_booke206_tlbivax(CPUPPCState *env, target_ulong address)
2825 {
2826 CPUState *cs;
2827
2828 if (address & 0x4) {
2829 /* flush all entries */
2830 if (address & 0x8) {
2831 /* flush all of TLB1 */
2832 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB1, 1);
2833 } else {
2834 /* flush all of TLB0 */
2835 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB0, 0);
2836 }
2837 return;
2838 }
2839
2840 if (address & 0x8) {
2841 /* flush TLB1 entries */
2842 booke206_invalidate_ea_tlb(env, 1, address);
2843 CPU_FOREACH(cs) {
2844 tlb_flush(cs);
2845 }
2846 } else {
2847 /* flush TLB0 entries */
2848 booke206_invalidate_ea_tlb(env, 0, address);
2849 CPU_FOREACH(cs) {
2850 tlb_flush_page(cs, address & MAS2_EPN_MASK);
2851 }
2852 }
2853 }
2854
2855 void helper_booke206_tlbilx0(CPUPPCState *env, target_ulong address)
2856 {
2857 /* XXX missing LPID handling */
2858 booke206_flush_tlb(env, -1, 1);
2859 }
2860
2861 void helper_booke206_tlbilx1(CPUPPCState *env, target_ulong address)
2862 {
2863 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2864 int i, j;
2865 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
2866 ppcmas_tlb_t *tlb = env->tlb.tlbm;
2867 int tlb_size;
2868
2869 /* XXX missing LPID handling */
2870 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2871 tlb_size = booke206_tlb_size(env, i);
2872 for (j = 0; j < tlb_size; j++) {
2873 if (!(tlb[j].mas1 & MAS1_IPROT) &&
2874 ((tlb[j].mas1 & MAS1_TID_MASK) == tid)) {
2875 tlb[j].mas1 &= ~MAS1_VALID;
2876 }
2877 }
2878 tlb += booke206_tlb_size(env, i);
2879 }
2880 tlb_flush(CPU(cpu));
2881 }
2882
2883 void helper_booke206_tlbilx3(CPUPPCState *env, target_ulong address)
2884 {
2885 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2886 int i, j;
2887 ppcmas_tlb_t *tlb;
2888 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
2889 int pid = tid >> MAS6_SPID_SHIFT;
2890 int sgs = env->spr[SPR_BOOKE_MAS5] & MAS5_SGS;
2891 int ind = (env->spr[SPR_BOOKE_MAS6] & MAS6_SIND) ? MAS1_IND : 0;
2892 /* XXX check for unsupported isize and raise an invalid opcode then */
2893 int size = env->spr[SPR_BOOKE_MAS6] & MAS6_ISIZE_MASK;
2894 /* XXX implement MAV2 handling */
2895 bool mav2 = false;
2896
2897 /* XXX missing LPID handling */
2898 /* flush by pid and ea */
2899 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2900 int ways = booke206_tlb_ways(env, i);
2901
2902 for (j = 0; j < ways; j++) {
2903 tlb = booke206_get_tlbm(env, i, address, j);
2904 if (!tlb) {
2905 continue;
2906 }
2907 if ((ppcmas_tlb_check(env, tlb, NULL, address, pid) != 0) ||
2908 (tlb->mas1 & MAS1_IPROT) ||
2909 ((tlb->mas1 & MAS1_IND) != ind) ||
2910 ((tlb->mas8 & MAS8_TGS) != sgs)) {
2911 continue;
2912 }
2913 if (mav2 && ((tlb->mas1 & MAS1_TSIZE_MASK) != size)) {
2914 /* XXX only check when MMUCFG[TWC] || TLBnCFG[HES] */
2915 continue;
2916 }
2917 /* XXX e500mc doesn't match SAS, but other cores might */
2918 tlb->mas1 &= ~MAS1_VALID;
2919 }
2920 }
2921 tlb_flush(CPU(cpu));
2922 }
2923
2924 void helper_booke206_tlbflush(CPUPPCState *env, target_ulong type)
2925 {
2926 int flags = 0;
2927
2928 if (type & 2) {
2929 flags |= BOOKE206_FLUSH_TLB1;
2930 }
2931
2932 if (type & 4) {
2933 flags |= BOOKE206_FLUSH_TLB0;
2934 }
2935
2936 booke206_flush_tlb(env, flags, 1);
2937 }
2938
2939
2940 void helper_check_tlb_flush_local(CPUPPCState *env)
2941 {
2942 check_tlb_flush(env, false);
2943 }
2944
2945 void helper_check_tlb_flush_global(CPUPPCState *env)
2946 {
2947 check_tlb_flush(env, true);
2948 }
2949
2950 /*****************************************************************************/
2951
2952 /* try to fill the TLB and return an exception if error. If retaddr is
2953 NULL, it means that the function was called in C code (i.e. not
2954 from generated code or from helper.c) */
2955 /* XXX: fix it to restore all registers */
2956 void tlb_fill(CPUState *cs, target_ulong addr, int size,
2957 MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
2958 {
2959 PowerPCCPU *cpu = POWERPC_CPU(cs);
2960 PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cs);
2961 CPUPPCState *env = &cpu->env;
2962 int ret;
2963
2964 if (pcc->handle_mmu_fault) {
2965 ret = pcc->handle_mmu_fault(cpu, addr, access_type, mmu_idx);
2966 } else {
2967 ret = cpu_ppc_handle_mmu_fault(env, addr, access_type, mmu_idx);
2968 }
2969 if (unlikely(ret != 0)) {
2970 raise_exception_err_ra(env, cs->exception_index, env->error_code,
2971 retaddr);
2972 }
2973 }
armbru's QEMU hackery