2 * PowerPC memory access emulation helpers for QEMU.
4 * Copyright (c) 2003-2007 Jocelyn Mayer
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
22 #include "exec/exec-all.h"
23 #include "qemu/host-utils.h"
24 #include "exec/helper-proto.h"
25 #include "helper_regs.h"
26 #include "exec/cpu_ldst.h"
28 #include "qemu/atomic128.h"
30 /* #define DEBUG_OP */
32 static inline bool needs_byteswap(const CPUPPCState
*env
)
35 return FIELD_EX64(env
->msr
, MSR
, LE
);
37 return !FIELD_EX64(env
->msr
, MSR
, LE
);
41 /*****************************************************************************/
42 /* Memory load and stores */
44 static inline target_ulong
addr_add(CPUPPCState
*env
, target_ulong addr
,
47 #if defined(TARGET_PPC64)
48 if (!msr_is_64bit(env
, env
->msr
)) {
49 return (uint32_t)(addr
+ arg
);
57 static void *probe_contiguous(CPUPPCState
*env
, target_ulong addr
, uint32_t nb
,
58 MMUAccessType access_type
, int mmu_idx
,
62 uint32_t nb_pg1
, nb_pg2
;
64 nb_pg1
= -(addr
| TARGET_PAGE_MASK
);
65 if (likely(nb
<= nb_pg1
)) {
66 /* The entire operation is on a single page. */
67 return probe_access(env
, addr
, nb
, access_type
, mmu_idx
, raddr
);
70 /* The operation spans two pages. */
72 host1
= probe_access(env
, addr
, nb_pg1
, access_type
, mmu_idx
, raddr
);
73 addr
= addr_add(env
, addr
, nb_pg1
);
74 host2
= probe_access(env
, addr
, nb_pg2
, access_type
, mmu_idx
, raddr
);
76 /* If the two host pages are contiguous, optimize. */
77 if (host2
== host1
+ nb_pg1
) {
83 void helper_lmw(CPUPPCState
*env
, target_ulong addr
, uint32_t reg
)
85 uintptr_t raddr
= GETPC();
86 int mmu_idx
= ppc_env_mmu_index(env
, false);
87 void *host
= probe_contiguous(env
, addr
, (32 - reg
) * 4,
88 MMU_DATA_LOAD
, mmu_idx
, raddr
);
91 /* Fast path -- the entire operation is in RAM at host. */
92 for (; reg
< 32; reg
++) {
93 env
->gpr
[reg
] = (uint32_t)ldl_be_p(host
);
97 /* Slow path -- at least some of the operation requires i/o. */
98 for (; reg
< 32; reg
++) {
99 env
->gpr
[reg
] = cpu_ldl_mmuidx_ra(env
, addr
, mmu_idx
, raddr
);
100 addr
= addr_add(env
, addr
, 4);
105 void helper_stmw(CPUPPCState
*env
, target_ulong addr
, uint32_t reg
)
107 uintptr_t raddr
= GETPC();
108 int mmu_idx
= ppc_env_mmu_index(env
, false);
109 void *host
= probe_contiguous(env
, addr
, (32 - reg
) * 4,
110 MMU_DATA_STORE
, mmu_idx
, raddr
);
113 /* Fast path -- the entire operation is in RAM at host. */
114 for (; reg
< 32; reg
++) {
115 stl_be_p(host
, env
->gpr
[reg
]);
119 /* Slow path -- at least some of the operation requires i/o. */
120 for (; reg
< 32; reg
++) {
121 cpu_stl_mmuidx_ra(env
, addr
, env
->gpr
[reg
], mmu_idx
, raddr
);
122 addr
= addr_add(env
, addr
, 4);
127 static void do_lsw(CPUPPCState
*env
, target_ulong addr
, uint32_t nb
,
128 uint32_t reg
, uintptr_t raddr
)
134 if (unlikely(nb
== 0)) {
138 mmu_idx
= ppc_env_mmu_index(env
, false);
139 host
= probe_contiguous(env
, addr
, nb
, MMU_DATA_LOAD
, mmu_idx
, raddr
);
142 /* Fast path -- the entire operation is in RAM at host. */
143 for (; nb
> 3; nb
-= 4) {
144 env
->gpr
[reg
] = (uint32_t)ldl_be_p(host
);
145 reg
= (reg
+ 1) % 32;
152 val
= ldub_p(host
) << 24;
155 val
= lduw_be_p(host
) << 16;
158 val
= (lduw_be_p(host
) << 16) | (ldub_p(host
+ 2) << 8);
162 /* Slow path -- at least some of the operation requires i/o. */
163 for (; nb
> 3; nb
-= 4) {
164 env
->gpr
[reg
] = cpu_ldl_mmuidx_ra(env
, addr
, mmu_idx
, raddr
);
165 reg
= (reg
+ 1) % 32;
166 addr
= addr_add(env
, addr
, 4);
172 val
= cpu_ldub_mmuidx_ra(env
, addr
, mmu_idx
, raddr
) << 24;
175 val
= cpu_lduw_mmuidx_ra(env
, addr
, mmu_idx
, raddr
) << 16;
178 val
= cpu_lduw_mmuidx_ra(env
, addr
, mmu_idx
, raddr
) << 16;
179 addr
= addr_add(env
, addr
, 2);
180 val
|= cpu_ldub_mmuidx_ra(env
, addr
, mmu_idx
, raddr
) << 8;
187 void helper_lsw(CPUPPCState
*env
, target_ulong addr
,
188 uint32_t nb
, uint32_t reg
)
190 do_lsw(env
, addr
, nb
, reg
, GETPC());
194 * PPC32 specification says we must generate an exception if rA is in
195 * the range of registers to be loaded. In an other hand, IBM says
196 * this is valid, but rA won't be loaded. For now, I'll follow the
199 void helper_lswx(CPUPPCState
*env
, target_ulong addr
, uint32_t reg
,
200 uint32_t ra
, uint32_t rb
)
202 if (likely(xer_bc
!= 0)) {
203 int num_used_regs
= DIV_ROUND_UP(xer_bc
, 4);
204 if (unlikely((ra
!= 0 && lsw_reg_in_range(reg
, num_used_regs
, ra
)) ||
205 lsw_reg_in_range(reg
, num_used_regs
, rb
))) {
206 raise_exception_err_ra(env
, POWERPC_EXCP_PROGRAM
,
208 POWERPC_EXCP_INVAL_LSWX
, GETPC());
210 do_lsw(env
, addr
, xer_bc
, reg
, GETPC());
215 void helper_stsw(CPUPPCState
*env
, target_ulong addr
, uint32_t nb
,
218 uintptr_t raddr
= GETPC();
223 if (unlikely(nb
== 0)) {
227 mmu_idx
= ppc_env_mmu_index(env
, false);
228 host
= probe_contiguous(env
, addr
, nb
, MMU_DATA_STORE
, mmu_idx
, raddr
);
231 /* Fast path -- the entire operation is in RAM at host. */
232 for (; nb
> 3; nb
-= 4) {
233 stl_be_p(host
, env
->gpr
[reg
]);
234 reg
= (reg
+ 1) % 32;
240 stb_p(host
, val
>> 24);
243 stw_be_p(host
, val
>> 16);
246 stw_be_p(host
, val
>> 16);
247 stb_p(host
+ 2, val
>> 8);
251 for (; nb
> 3; nb
-= 4) {
252 cpu_stl_mmuidx_ra(env
, addr
, env
->gpr
[reg
], mmu_idx
, raddr
);
253 reg
= (reg
+ 1) % 32;
254 addr
= addr_add(env
, addr
, 4);
259 cpu_stb_mmuidx_ra(env
, addr
, val
>> 24, mmu_idx
, raddr
);
262 cpu_stw_mmuidx_ra(env
, addr
, val
>> 16, mmu_idx
, raddr
);
265 cpu_stw_mmuidx_ra(env
, addr
, val
>> 16, mmu_idx
, raddr
);
266 addr
= addr_add(env
, addr
, 2);
267 cpu_stb_mmuidx_ra(env
, addr
, val
>> 8, mmu_idx
, raddr
);
273 static void dcbz_common(CPUPPCState
*env
, target_ulong addr
,
274 int mmu_idx
, int dcbz_size
, uintptr_t retaddr
)
276 target_ulong mask
= ~(target_ulong
)(dcbz_size
- 1);
282 /* Check reservation */
283 if (unlikely((env
->reserve_addr
& mask
) == addr
)) {
284 env
->reserve_addr
= (target_ulong
)-1ULL;
287 /* Try fast path translate */
288 #ifdef CONFIG_USER_ONLY
289 haddr
= tlb_vaddr_to_host(env
, addr
, MMU_DATA_STORE
, mmu_idx
);
291 haddr
= probe_write(env
, addr
, dcbz_size
, mmu_idx
, retaddr
);
292 if (unlikely(!haddr
)) {
294 for (int i
= 0; i
< dcbz_size
; i
+= 8) {
295 cpu_stq_mmuidx_ra(env
, addr
+ i
, 0, mmu_idx
, retaddr
);
301 set_helper_retaddr(retaddr
);
302 memset(haddr
, 0, dcbz_size
);
303 clear_helper_retaddr();
306 void helper_dcbz(CPUPPCState
*env
, target_ulong addr
, int mmu_idx
)
308 dcbz_common(env
, addr
, mmu_idx
, env
->dcache_line_size
, GETPC());
312 void helper_dcbzl(CPUPPCState
*env
, target_ulong addr
)
314 int dcbz_size
= env
->dcache_line_size
;
317 * The translator checked for POWERPC_EXCP_970.
318 * All that's left is to check HID5.
320 if (((env
->spr
[SPR_970_HID5
] >> 7) & 0x3) == 1) {
324 dcbz_common(env
, addr
, ppc_env_mmu_index(env
, false), dcbz_size
, GETPC());
328 void helper_icbi(CPUPPCState
*env
, target_ulong addr
)
330 addr
&= ~(env
->dcache_line_size
- 1);
332 * Invalidate one cache line :
333 * PowerPC specification says this is to be treated like a load
334 * (not a fetch) by the MMU. To be sure it will be so,
335 * do the load "by hand".
337 cpu_ldl_data_ra(env
, addr
, GETPC());
340 void helper_icbiep(CPUPPCState
*env
, target_ulong addr
)
342 #if !defined(CONFIG_USER_ONLY)
343 /* See comments above */
344 addr
&= ~(env
->dcache_line_size
- 1);
345 cpu_ldl_mmuidx_ra(env
, addr
, PPC_TLB_EPID_LOAD
, GETPC());
349 /* XXX: to be tested */
350 target_ulong
helper_lscbx(CPUPPCState
*env
, target_ulong addr
, uint32_t reg
,
351 uint32_t ra
, uint32_t rb
)
356 for (i
= 0; i
< xer_bc
; i
++) {
357 c
= cpu_ldub_data_ra(env
, addr
, GETPC());
358 addr
= addr_add(env
, addr
, 1);
359 /* ra (if not 0) and rb are never modified */
360 if (likely(reg
!= rb
&& (ra
== 0 || reg
!= ra
))) {
361 env
->gpr
[reg
] = (env
->gpr
[reg
] & ~(0xFF << d
)) | (c
<< d
);
363 if (unlikely(c
== xer_cmp
)) {
366 if (likely(d
!= 0)) {
377 /*****************************************************************************/
378 /* Altivec extension helpers */
388 * We use MSR_LE to determine index ordering in a vector. However,
389 * byteswapping is not simply controlled by MSR_LE. We also need to
390 * take into account endianness of the target. This is done for the
391 * little-endian PPC64 user-mode target.
394 #define LVE(name, access, swap, element) \
395 void helper_##name(CPUPPCState *env, ppc_avr_t *r, \
398 size_t n_elems = ARRAY_SIZE(r->element); \
399 int adjust = HI_IDX * (n_elems - 1); \
400 int sh = sizeof(r->element[0]) >> 1; \
401 int index = (addr & 0xf) >> sh; \
402 if (FIELD_EX64(env->msr, MSR, LE)) { \
403 index = n_elems - index - 1; \
406 if (needs_byteswap(env)) { \
407 r->element[LO_IDX ? index : (adjust - index)] = \
408 swap(access(env, addr, GETPC())); \
410 r->element[LO_IDX ? index : (adjust - index)] = \
411 access(env, addr, GETPC()); \
415 LVE(LVEBX
, cpu_ldub_data_ra
, I
, u8
)
416 LVE(LVEHX
, cpu_lduw_data_ra
, bswap16
, u16
)
417 LVE(LVEWX
, cpu_ldl_data_ra
, bswap32
, u32
)
421 #define STVE(name, access, swap, element) \
422 void helper_##name(CPUPPCState *env, ppc_avr_t *r, \
425 size_t n_elems = ARRAY_SIZE(r->element); \
426 int adjust = HI_IDX * (n_elems - 1); \
427 int sh = sizeof(r->element[0]) >> 1; \
428 int index = (addr & 0xf) >> sh; \
429 if (FIELD_EX64(env->msr, MSR, LE)) { \
430 index = n_elems - index - 1; \
433 if (needs_byteswap(env)) { \
434 access(env, addr, swap(r->element[LO_IDX ? index : \
435 (adjust - index)]), \
438 access(env, addr, r->element[LO_IDX ? index : \
439 (adjust - index)], GETPC()); \
443 STVE(STVEBX
, cpu_stb_data_ra
, I
, u8
)
444 STVE(STVEHX
, cpu_stw_data_ra
, bswap16
, u16
)
445 STVE(STVEWX
, cpu_stl_data_ra
, bswap32
, u32
)
450 #define GET_NB(rb) ((rb >> 56) & 0xFF)
452 #define VSX_LXVL(name, lj) \
453 void helper_##name(CPUPPCState *env, target_ulong addr, \
454 ppc_vsr_t *xt, target_ulong rb) \
457 uint64_t nb = GET_NB(rb); \
460 t.s128 = int128_zero(); \
462 nb = (nb >= 16) ? 16 : nb; \
463 if (FIELD_EX64(env->msr, MSR, LE) && !lj) { \
464 for (i = 16; i > 16 - nb; i--) { \
465 t.VsrB(i - 1) = cpu_ldub_data_ra(env, addr, GETPC()); \
466 addr = addr_add(env, addr, 1); \
469 for (i = 0; i < nb; i++) { \
470 t.VsrB(i) = cpu_ldub_data_ra(env, addr, GETPC()); \
471 addr = addr_add(env, addr, 1); \
482 #define VSX_STXVL(name, lj) \
483 void helper_##name(CPUPPCState *env, target_ulong addr, \
484 ppc_vsr_t *xt, target_ulong rb) \
486 target_ulong nb = GET_NB(rb); \
493 nb = (nb >= 16) ? 16 : nb; \
494 if (FIELD_EX64(env->msr, MSR, LE) && !lj) { \
495 for (i = 16; i > 16 - nb; i--) { \
496 cpu_stb_data_ra(env, addr, xt->VsrB(i - 1), GETPC()); \
497 addr = addr_add(env, addr, 1); \
500 for (i = 0; i < nb; i++) { \
501 cpu_stb_data_ra(env, addr, xt->VsrB(i), GETPC()); \
502 addr = addr_add(env, addr, 1); \
511 #endif /* TARGET_PPC64 */
516 void helper_tbegin(CPUPPCState
*env
)
519 * As a degenerate implementation, always fail tbegin. The reason
520 * given is "Nesting overflow". The "persistent" bit is set,
521 * providing a hint to the error handler to not retry. The TFIAR
522 * captures the address of the failure, which is this tbegin
523 * instruction. Instruction execution will continue with the next
524 * instruction in memory, which is precisely what we want.
527 env
->spr
[SPR_TEXASR
] =
528 (1ULL << TEXASR_FAILURE_PERSISTENT
) |
529 (1ULL << TEXASR_NESTING_OVERFLOW
) |
530 (FIELD_EX64_HV(env
->msr
) << TEXASR_PRIVILEGE_HV
) |
531 (FIELD_EX64(env
->msr
, MSR
, PR
) << TEXASR_PRIVILEGE_PR
) |
532 (1ULL << TEXASR_FAILURE_SUMMARY
) |
533 (1ULL << TEXASR_TFIAR_EXACT
);
534 env
->spr
[SPR_TFIAR
] = env
->nip
| (FIELD_EX64_HV(env
->msr
) << 1) |
535 FIELD_EX64(env
->msr
, MSR
, PR
);
536 env
->spr
[SPR_TFHAR
] = env
->nip
+ 4;
537 env
->crf
[0] = 0xB; /* 0b1010 = transaction failure */