]> Git Repo - qemu.git/blame - target/ppc/mmu_helper.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.12-20180306' into staging
[qemu.git] / target / ppc / mmu_helper.c
CommitLineData
ec19c4d1
BS		 1/*
2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU.
3 *
4 * Copyright (c) 2003-2007 Jocelyn Mayer
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
0d75590d 19#include "qemu/osdep.h"
ec19c4d1 20#include "cpu.h"
2ef6175a 21#include "exec/helper-proto.h"
9c17d615 22#include "sysemu/kvm.h"
8cbbe385 23#include "kvm_ppc.h"
10b46525 24#include "mmu-hash64.h"
9d7c3f4a 25#include "mmu-hash32.h"
63c91552 26#include "exec/exec-all.h"
f08b6170 27#include "exec/cpu_ldst.h"
508127e2 28#include "exec/log.h"
cd0c6f47 29#include "helper_regs.h"
8d63351f 30#include "qemu/error-report.h"
b2899495 31#include "mmu-book3s-v3.h"
95cb0657 32#include "mmu-radix64.h"
ec19c4d1 33
8cbbe385
BS		 34//#define DEBUG_MMU
35//#define DEBUG_BATS
ec19c4d1 36//#define DEBUG_SOFTWARE_TLB
8cbbe385 37//#define DUMP_PAGE_TABLES
8cbbe385
BS		 38//#define FLUSH_ALL_TLBS
39
40#ifdef DEBUG_MMU
48880da6 41# define LOG_MMU_STATE(cpu) log_cpu_state_mask(CPU_LOG_MMU, (cpu), 0)
8cbbe385 42#else
77710e7a 43# define LOG_MMU_STATE(cpu) do { } while (0)
8cbbe385 44#endif
ec19c4d1
BS		 45
46#ifdef DEBUG_SOFTWARE_TLB
48880da6 47# define LOG_SWTLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
ec19c4d1
BS		 48#else
49# define LOG_SWTLB(...) do { } while (0)
50#endif
51
8cbbe385 52#ifdef DEBUG_BATS
48880da6 53# define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__)
8cbbe385
BS		 54#else
55# define LOG_BATS(...) do { } while (0)
56#endif
57
8cbbe385
BS		 58/*****************************************************************************/
59/* PowerPC MMU emulation */
5dc68eb0
DG		 60
61/* Context used internally during MMU translations */
62typedef struct mmu_ctx_t mmu_ctx_t;
63struct mmu_ctx_t {
64 hwaddr raddr; /* Real address */
65 hwaddr eaddr; /* Effective address */
66 int prot; /* Protection bits */
67 hwaddr hash[2]; /* Pagetable hash values */
68 target_ulong ptem; /* Virtual segment ID | API */
69 int key; /* Access key */
70 int nx; /* Non-execute area */
71};
72
8cbbe385
BS		 73/* Common routines used by software and hardware TLBs emulation */
74static inline int pte_is_valid(target_ulong pte0)
75{
76 return pte0 & 0x80000000 ? 1 : 0;
77}
78
79static inline void pte_invalidate(target_ulong *pte0)
80{
81 *pte0 &= ~0x80000000;
82}
83
8cbbe385
BS		 84#define PTE_PTEM_MASK 0x7FFFFFBF
85#define PTE_CHECK_MASK (TARGET_PAGE_MASK | 0x7B)
8cbbe385 86
496272a7 87static int pp_check(int key, int pp, int nx)
8cbbe385
BS		 88{
89 int access;
90
91 /* Compute access rights */
8cbbe385
BS		 92 access = 0;
93 if (key == 0) {
94 switch (pp) {
95 case 0x0:
96 case 0x1:
97 case 0x2:
98 access |= PAGE_WRITE;
99 /* No break here */
100 case 0x3:
8cbbe385
BS		 101 access |= PAGE_READ;
102 break;
103 }
104 } else {
105 switch (pp) {
106 case 0x0:
8cbbe385
BS		 107 access = 0;
108 break;
109 case 0x1:
110 case 0x3:
111 access = PAGE_READ;
112 break;
113 case 0x2:
114 access = PAGE_READ | PAGE_WRITE;
115 break;
116 }
117 }
118 if (nx == 0) {
119 access |= PAGE_EXEC;
120 }
121
122 return access;
123}
124
496272a7 125static int check_prot(int prot, int rw, int access_type)
8cbbe385
BS		 126{
127 int ret;
128
129 if (access_type == ACCESS_CODE) {
130 if (prot & PAGE_EXEC) {
131 ret = 0;
132 } else {
133 ret = -2;
134 }
135 } else if (rw) {
136 if (prot & PAGE_WRITE) {
137 ret = 0;
138 } else {
139 ret = -2;
140 }
141 } else {
142 if (prot & PAGE_READ) {
143 ret = 0;
144 } else {
145 ret = -2;
146 }
147 }
148
149 return ret;
150}
151
9d7c3f4a
DG		 152static inline int ppc6xx_tlb_pte_check(mmu_ctx_t *ctx, target_ulong pte0,
153 target_ulong pte1, int h, int rw, int type)
8cbbe385
BS		 154{
155 target_ulong ptem, mmask;
156 int access, ret, pteh, ptev, pp;
157
158 ret = -1;
159 /* Check validity and table match */
9d7c3f4a
DG		 160 ptev = pte_is_valid(pte0);
161 pteh = (pte0 >> 6) & 1;
8cbbe385
BS		 162 if (ptev && h == pteh) {
163 /* Check vsid & api */
9d7c3f4a
DG		 164 ptem = pte0 & PTE_PTEM_MASK;
165 mmask = PTE_CHECK_MASK;
166 pp = pte1 & 0x00000003;
8cbbe385 167 if (ptem == ctx->ptem) {
a8170e5e 168 if (ctx->raddr != (hwaddr)-1ULL) {
8cbbe385
BS		 169 /* all matches should have equal RPN, WIMG & PP */
170 if ((ctx->raddr & mmask) != (pte1 & mmask)) {
48880da6 171 qemu_log_mask(CPU_LOG_MMU, "Bad RPN/WIMG/PP\n");
8cbbe385
BS		 172 return -3;
173 }
174 }
175 /* Compute access rights */
176 access = pp_check(ctx->key, pp, ctx->nx);
177 /* Keep the matching PTE informations */
178 ctx->raddr = pte1;
179 ctx->prot = access;
180 ret = check_prot(ctx->prot, rw, type);
181 if (ret == 0) {
182 /* Access granted */
339aaf5b 183 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n");
8cbbe385
BS		 184 } else {
185 /* Access right violation */
339aaf5b 186 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n");
8cbbe385
BS		 187 }
188 }
189 }
190
191 return ret;
192}
193
496272a7
DG		 194static int pte_update_flags(mmu_ctx_t *ctx, target_ulong *pte1p,
195 int ret, int rw)
8cbbe385
BS		 196{
197 int store = 0;
198
199 /* Update page flags */
200 if (!(*pte1p & 0x00000100)) {
201 /* Update accessed flag */
202 *pte1p |= 0x00000100;
203 store = 1;
204 }
205 if (!(*pte1p & 0x00000080)) {
206 if (rw == 1 && ret == 0) {
207 /* Update changed flag */
208 *pte1p |= 0x00000080;
209 store = 1;
210 } else {
211 /* Force page fault for first write access */
212 ctx->prot &= ~PAGE_WRITE;
213 }
214 }
215
216 return store;
217}
218
219/* Software driven TLB helpers */
220static inline int ppc6xx_tlb_getnum(CPUPPCState *env, target_ulong eaddr,
221 int way, int is_code)
222{
223 int nr;
224
225 /* Select TLB num in a way from address */
226 nr = (eaddr >> TARGET_PAGE_BITS) & (env->tlb_per_way - 1);
227 /* Select TLB way */
228 nr += env->tlb_per_way * way;
229 /* 6xx have separate TLBs for instructions and data */
230 if (is_code && env->id_tlbs == 1) {
231 nr += env->nb_tlb;
232 }
233
234 return nr;
235}
236
237static inline void ppc6xx_tlb_invalidate_all(CPUPPCState *env)
238{
00c8cb0a 239 PowerPCCPU *cpu = ppc_env_get_cpu(env);
8cbbe385
BS		 240 ppc6xx_tlb_t *tlb;
241 int nr, max;
242
243 /* LOG_SWTLB("Invalidate all TLBs\n"); */
244 /* Invalidate all defined software TLB */
245 max = env->nb_tlb;
246 if (env->id_tlbs == 1) {
247 max *= 2;
248 }
249 for (nr = 0; nr < max; nr++) {
250 tlb = &env->tlb.tlb6[nr];
251 pte_invalidate(&tlb->pte0);
252 }
d10eb08f 253 tlb_flush(CPU(cpu));
8cbbe385
BS		 254}
255
256static inline void ppc6xx_tlb_invalidate_virt2(CPUPPCState *env,
257 target_ulong eaddr,
258 int is_code, int match_epn)
259{
260#if !defined(FLUSH_ALL_TLBS)
31b030d4 261 CPUState *cs = CPU(ppc_env_get_cpu(env));
8cbbe385
BS		 262 ppc6xx_tlb_t *tlb;
263 int way, nr;
264
265 /* Invalidate ITLB + DTLB, all ways */
266 for (way = 0; way < env->nb_ways; way++) {
267 nr = ppc6xx_tlb_getnum(env, eaddr, way, is_code);
268 tlb = &env->tlb.tlb6[nr];
269 if (pte_is_valid(tlb->pte0) && (match_epn == 0 || eaddr == tlb->EPN)) {
270 LOG_SWTLB("TLB invalidate %d/%d " TARGET_FMT_lx "\n", nr,
271 env->nb_tlb, eaddr);
272 pte_invalidate(&tlb->pte0);
31b030d4 273 tlb_flush_page(cs, tlb->EPN);
8cbbe385
BS		 274 }
275 }
276#else
277 /* XXX: PowerPC specification say this is valid as well */
278 ppc6xx_tlb_invalidate_all(env);
279#endif
280}
281
282static inline void ppc6xx_tlb_invalidate_virt(CPUPPCState *env,
283 target_ulong eaddr, int is_code)
284{
285 ppc6xx_tlb_invalidate_virt2(env, eaddr, is_code, 0);
286}
287
9aa5b158
BS		 288static void ppc6xx_tlb_store(CPUPPCState *env, target_ulong EPN, int way,
289 int is_code, target_ulong pte0, target_ulong pte1)
8cbbe385
BS		 290{
291 ppc6xx_tlb_t *tlb;
292 int nr;
293
294 nr = ppc6xx_tlb_getnum(env, EPN, way, is_code);
295 tlb = &env->tlb.tlb6[nr];
296 LOG_SWTLB("Set TLB %d/%d EPN " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
297 " PTE1 " TARGET_FMT_lx "\n", nr, env->nb_tlb, EPN, pte0, pte1);
298 /* Invalidate any pending reference in QEMU for this virtual address */
299 ppc6xx_tlb_invalidate_virt2(env, EPN, is_code, 1);
300 tlb->pte0 = pte0;
301 tlb->pte1 = pte1;
302 tlb->EPN = EPN;
303 /* Store last way for LRU mechanism */
304 env->last_way = way;
305}
306
307static inline int ppc6xx_tlb_check(CPUPPCState *env, mmu_ctx_t *ctx,
308 target_ulong eaddr, int rw, int access_type)
309{
310 ppc6xx_tlb_t *tlb;
311 int nr, best, way;
312 int ret;
313
314 best = -1;
315 ret = -1; /* No TLB found */
316 for (way = 0; way < env->nb_ways; way++) {
317 nr = ppc6xx_tlb_getnum(env, eaddr, way,
318 access_type == ACCESS_CODE ? 1 : 0);
319 tlb = &env->tlb.tlb6[nr];
320 /* This test "emulates" the PTE index match for hardware TLBs */
321 if ((eaddr & TARGET_PAGE_MASK) != tlb->EPN) {
322 LOG_SWTLB("TLB %d/%d %s [" TARGET_FMT_lx " " TARGET_FMT_lx
323 "] <> " TARGET_FMT_lx "\n", nr, env->nb_tlb,
324 pte_is_valid(tlb->pte0) ? "valid" : "inval",
325 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE, eaddr);
326 continue;
327 }
328 LOG_SWTLB("TLB %d/%d %s " TARGET_FMT_lx " <> " TARGET_FMT_lx " "
329 TARGET_FMT_lx " %c %c\n", nr, env->nb_tlb,
330 pte_is_valid(tlb->pte0) ? "valid" : "inval",
331 tlb->EPN, eaddr, tlb->pte1,
332 rw ? 'S' : 'L', access_type == ACCESS_CODE ? 'I' : 'D');
9d7c3f4a 333 switch (ppc6xx_tlb_pte_check(ctx, tlb->pte0, tlb->pte1, 0, rw, access_type)) {
8cbbe385
BS		 334 case -3:
335 /* TLB inconsistency */
336 return -1;
337 case -2:
338 /* Access violation */
339 ret = -2;
340 best = nr;
341 break;
342 case -1:
343 default:
344 /* No match */
345 break;
346 case 0:
347 /* access granted */
348 /* XXX: we should go on looping to check all TLBs consistency
349 * but we can speed-up the whole thing as the
350 * result would be undefined if TLBs are not consistent.
351 */
352 ret = 0;
353 best = nr;
354 goto done;
355 }
356 }
357 if (best != -1) {
358 done:
359 LOG_SWTLB("found TLB at addr " TARGET_FMT_plx " prot=%01x ret=%d\n",
360 ctx->raddr & TARGET_PAGE_MASK, ctx->prot, ret);
361 /* Update page flags */
362 pte_update_flags(ctx, &env->tlb.tlb6[best].pte1, ret, rw);
363 }
364
365 return ret;
366}
367
368/* Perform BAT hit & translation */
369static inline void bat_size_prot(CPUPPCState *env, target_ulong *blp,
370 int *validp, int *protp, target_ulong *BATu,
371 target_ulong *BATl)
372{
373 target_ulong bl;
374 int pp, valid, prot;
375
376 bl = (*BATu & 0x00001FFC) << 15;
377 valid = 0;
378 prot = 0;
379 if (((msr_pr == 0) && (*BATu & 0x00000002)) ||
380 ((msr_pr != 0) && (*BATu & 0x00000001))) {
381 valid = 1;
382 pp = *BATl & 0x00000003;
383 if (pp != 0) {
384 prot = PAGE_READ | PAGE_EXEC;
385 if (pp == 0x2) {
386 prot |= PAGE_WRITE;
387 }
388 }
389 }
390 *blp = bl;
391 *validp = valid;
392 *protp = prot;
393}
394
98132796
DG		 395static int get_bat_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx,
396 target_ulong virtual, int rw, int type)
8cbbe385
BS		 397{
398 target_ulong *BATlt, *BATut, *BATu, *BATl;
399 target_ulong BEPIl, BEPIu, bl;
400 int i, valid, prot;
401 int ret = -1;
402
403 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__,
404 type == ACCESS_CODE ? 'I' : 'D', virtual);
405 switch (type) {
406 case ACCESS_CODE:
407 BATlt = env->IBAT[1];
408 BATut = env->IBAT[0];
409 break;
410 default:
411 BATlt = env->DBAT[1];
412 BATut = env->DBAT[0];
413 break;
414 }
415 for (i = 0; i < env->nb_BATs; i++) {
416 BATu = &BATut[i];
417 BATl = &BATlt[i];
418 BEPIu = *BATu & 0xF0000000;
419 BEPIl = *BATu & 0x0FFE0000;
98132796 420 bat_size_prot(env, &bl, &valid, &prot, BATu, BATl);
8cbbe385
BS		 421 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
422 " BATl " TARGET_FMT_lx "\n", __func__,
423 type == ACCESS_CODE ? 'I' : 'D', i, virtual, *BATu, *BATl);
424 if ((virtual & 0xF0000000) == BEPIu &&
425 ((virtual & 0x0FFE0000) & ~bl) == BEPIl) {
426 /* BAT matches */
427 if (valid != 0) {
428 /* Get physical address */
429 ctx->raddr = (*BATl & 0xF0000000) |
430 ((virtual & 0x0FFE0000 & bl) | (*BATl & 0x0FFE0000)) |
431 (virtual & 0x0001F000);
432 /* Compute access rights */
433 ctx->prot = prot;
434 ret = check_prot(ctx->prot, rw, type);
435 if (ret == 0) {
436 LOG_BATS("BAT %d match: r " TARGET_FMT_plx " prot=%c%c\n",
437 i, ctx->raddr, ctx->prot & PAGE_READ ? 'R' : '-',
438 ctx->prot & PAGE_WRITE ? 'W' : '-');
439 }
440 break;
441 }
442 }
443 }
444 if (ret < 0) {
445#if defined(DEBUG_BATS)
446 if (qemu_log_enabled()) {
447 LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", virtual);
448 for (i = 0; i < 4; i++) {
449 BATu = &BATut[i];
450 BATl = &BATlt[i];
451 BEPIu = *BATu & 0xF0000000;
452 BEPIl = *BATu & 0x0FFE0000;
453 bl = (*BATu & 0x00001FFC) << 15;
454 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx
455 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
456 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
457 __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual,
458 *BATu, *BATl, BEPIu, BEPIl, bl);
459 }
460 }
461#endif
462 }
463 /* No hit */
464 return ret;
465}
466
8cbbe385 467/* Perform segment based translation */
0480884f
DG		 468static inline int get_segment_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx,
469 target_ulong eaddr, int rw, int type)
8cbbe385 470{
36778660 471 PowerPCCPU *cpu = ppc_env_get_cpu(env);
a8170e5e 472 hwaddr hash;
8cbbe385
BS		 473 target_ulong vsid;
474 int ds, pr, target_page_bits;
0480884f
DG		 475 int ret;
476 target_ulong sr, pgidx;
8cbbe385
BS		 477
478 pr = msr_pr;
479 ctx->eaddr = eaddr;
8cbbe385 480
0480884f
DG		 481 sr = env->sr[eaddr >> 28];
482 ctx->key = (((sr & 0x20000000) && (pr != 0)) ||
483 ((sr & 0x40000000) && (pr == 0))) ? 1 : 0;
484 ds = sr & 0x80000000 ? 1 : 0;
485 ctx->nx = sr & 0x10000000 ? 1 : 0;
486 vsid = sr & 0x00FFFFFF;
487 target_page_bits = TARGET_PAGE_BITS;
339aaf5b
AP		 488 qemu_log_mask(CPU_LOG_MMU,
489 "Check segment v=" TARGET_FMT_lx " %d " TARGET_FMT_lx
490 " nip=" TARGET_FMT_lx " lr=" TARGET_FMT_lx
0480884f
DG		 491 " ir=%d dr=%d pr=%d %d t=%d\n",
492 eaddr, (int)(eaddr >> 28), sr, env->nip, env->lr, (int)msr_ir,
493 (int)msr_dr, pr != 0 ? 1 : 0, rw, type);
494 pgidx = (eaddr & ~SEGMENT_MASK_256M) >> target_page_bits;
495 hash = vsid ^ pgidx;
496 ctx->ptem = (vsid << 7) | (pgidx >> 10);
8cbbe385 497
339aaf5b
AP		 498 qemu_log_mask(CPU_LOG_MMU,
499 "pte segment: key=%d ds %d nx %d vsid " TARGET_FMT_lx "\n",
8cbbe385
BS		 500 ctx->key, ds, ctx->nx, vsid);
501 ret = -1;
502 if (!ds) {
503 /* Check if instruction fetch is allowed, if needed */
504 if (type != ACCESS_CODE || ctx->nx == 0) {
505 /* Page address translation */
339aaf5b
AP		 506 qemu_log_mask(CPU_LOG_MMU, "htab_base " TARGET_FMT_plx
507 " htab_mask " TARGET_FMT_plx
8cbbe385 508 " hash " TARGET_FMT_plx "\n",
36778660 509 ppc_hash32_hpt_base(cpu), ppc_hash32_hpt_mask(cpu), hash);
8cbbe385
BS		 510 ctx->hash[0] = hash;
511 ctx->hash[1] = ~hash;
512
513 /* Initialize real address with an invalid value */
a8170e5e 514 ctx->raddr = (hwaddr)-1ULL;
0480884f
DG		 515 /* Software TLB search */
516 ret = ppc6xx_tlb_check(env, ctx, eaddr, rw, type);
8cbbe385 517#if defined(DUMP_PAGE_TABLES)
9207113d
MCA		 518 if (qemu_loglevel_mask(CPU_LOG_MMU)) {
519 CPUState *cs = ENV_GET_CPU(env);
a8170e5e 520 hwaddr curaddr;
8cbbe385
BS		 521 uint32_t a0, a1, a2, a3;
522
523 qemu_log("Page table: " TARGET_FMT_plx " len " TARGET_FMT_plx
36778660
DG		 524 "\n", ppc_hash32_hpt_base(cpu),
525 ppc_hash32_hpt_mask(env) + 0x80);
526 for (curaddr = ppc_hash32_hpt_base(cpu);
527 curaddr < (ppc_hash32_hpt_base(cpu)
528 + ppc_hash32_hpt_mask(cpu) + 0x80);
8cbbe385 529 curaddr += 16) {
9207113d
MCA		 530 a0 = ldl_phys(cs->as, curaddr);
531 a1 = ldl_phys(cs->as, curaddr + 4);
532 a2 = ldl_phys(cs->as, curaddr + 8);
533 a3 = ldl_phys(cs->as, curaddr + 12);
8cbbe385
BS		 534 if (a0 != 0 || a1 != 0 || a2 != 0 || a3 != 0) {
535 qemu_log(TARGET_FMT_plx ": %08x %08x %08x %08x\n",
536 curaddr, a0, a1, a2, a3);
537 }
538 }
539 }
540#endif
541 } else {
339aaf5b 542 qemu_log_mask(CPU_LOG_MMU, "No access allowed\n");
8cbbe385
BS		 543 ret = -3;
544 }
545 } else {
546 target_ulong sr;
547
339aaf5b 548 qemu_log_mask(CPU_LOG_MMU, "direct store...\n");
8cbbe385
BS		 549 /* Direct-store segment : absolutely *BUGGY* for now */
550
551 /* Direct-store implies a 32-bit MMU.
552 * Check the Segment Register's bus unit ID (BUID).
553 */
554 sr = env->sr[eaddr >> 28];
555 if ((sr & 0x1FF00000) >> 20 == 0x07f) {
556 /* Memory-forced I/O controller interface access */
557 /* If T=1 and BUID=x'07F', the 601 performs a memory access
558 * to SR[28-31] LA[4-31], bypassing all protection mechanisms.
559 */
560 ctx->raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF);
561 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
562 return 0;
563 }
564
565 switch (type) {
566 case ACCESS_INT:
567 /* Integer load/store : only access allowed */
568 break;
569 case ACCESS_CODE:
570 /* No code fetch is allowed in direct-store areas */
571 return -4;
572 case ACCESS_FLOAT:
573 /* Floating point load/store */
574 return -4;
575 case ACCESS_RES:
576 /* lwarx, ldarx or srwcx. */
577 return -4;
578 case ACCESS_CACHE:
579 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
580 /* Should make the instruction do no-op.
581 * As it already do no-op, it's quite easy :-)
582 */
583 ctx->raddr = eaddr;
584 return 0;
585 case ACCESS_EXT:
586 /* eciwx or ecowx */
587 return -4;
588 default:
48880da6
PB		 589 qemu_log_mask(CPU_LOG_MMU, "ERROR: instruction should not need "
590 "address translation\n");
8cbbe385
BS		 591 return -4;
592 }
593 if ((rw == 1 || ctx->key != 1) && (rw == 0 || ctx->key != 0)) {
594 ctx->raddr = eaddr;
595 ret = 2;
596 } else {
597 ret = -2;
598 }
599 }
600
601 return ret;
602}
603
604/* Generic TLB check function for embedded PowerPC implementations */
9aa5b158 605static int ppcemb_tlb_check(CPUPPCState *env, ppcemb_tlb_t *tlb,
a8170e5e 606 hwaddr *raddrp,
9aa5b158
BS		 607 target_ulong address, uint32_t pid, int ext,
608 int i)
8cbbe385
BS		 609{
610 target_ulong mask;
611
612 /* Check valid flag */
613 if (!(tlb->prot & PAGE_VALID)) {
614 return -1;
615 }
616 mask = ~(tlb->size - 1);
617 LOG_SWTLB("%s: TLB %d address " TARGET_FMT_lx " PID %u <=> " TARGET_FMT_lx
618 " " TARGET_FMT_lx " %u %x\n", __func__, i, address, pid, tlb->EPN,
619 mask, (uint32_t)tlb->PID, tlb->prot);
620 /* Check PID */
621 if (tlb->PID != 0 && tlb->PID != pid) {
622 return -1;
623 }
624 /* Check effective address */
625 if ((address & mask) != tlb->EPN) {
626 return -1;
627 }
628 *raddrp = (tlb->RPN & mask) | (address & ~mask);
8cbbe385
BS		 629 if (ext) {
630 /* Extend the physical address to 36 bits */
4be403c8 631 *raddrp |= (uint64_t)(tlb->RPN & 0xF) << 32;
8cbbe385 632 }
8cbbe385
BS		 633
634 return 0;
635}
636
637/* Generic TLB search function for PowerPC embedded implementations */
9aa5b158
BS		 638static int ppcemb_tlb_search(CPUPPCState *env, target_ulong address,
639 uint32_t pid)
8cbbe385
BS		 640{
641 ppcemb_tlb_t *tlb;
a8170e5e 642 hwaddr raddr;
8cbbe385
BS		 643 int i, ret;
644
645 /* Default return value is no match */
646 ret = -1;
647 for (i = 0; i < env->nb_tlb; i++) {
648 tlb = &env->tlb.tlbe[i];
649 if (ppcemb_tlb_check(env, tlb, &raddr, address, pid, 0, i) == 0) {
650 ret = i;
651 break;
652 }
653 }
654
655 return ret;
656}
657
658/* Helpers specific to PowerPC 40x implementations */
659static inline void ppc4xx_tlb_invalidate_all(CPUPPCState *env)
660{
00c8cb0a 661 PowerPCCPU *cpu = ppc_env_get_cpu(env);
8cbbe385
BS		 662 ppcemb_tlb_t *tlb;
663 int i;
664
665 for (i = 0; i < env->nb_tlb; i++) {
666 tlb = &env->tlb.tlbe[i];
667 tlb->prot &= ~PAGE_VALID;
668 }
d10eb08f 669 tlb_flush(CPU(cpu));
8cbbe385
BS		 670}
671
8cbbe385
BS		 672static int mmu40x_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
673 target_ulong address, int rw,
674 int access_type)
675{
676 ppcemb_tlb_t *tlb;
a8170e5e 677 hwaddr raddr;
8cbbe385
BS		 678 int i, ret, zsel, zpr, pr;
679
680 ret = -1;
a8170e5e 681 raddr = (hwaddr)-1ULL;
8cbbe385
BS		 682 pr = msr_pr;
683 for (i = 0; i < env->nb_tlb; i++) {
684 tlb = &env->tlb.tlbe[i];
685 if (ppcemb_tlb_check(env, tlb, &raddr, address,
686 env->spr[SPR_40x_PID], 0, i) < 0) {
687 continue;
688 }
689 zsel = (tlb->attr >> 4) & 0xF;
690 zpr = (env->spr[SPR_40x_ZPR] >> (30 - (2 * zsel))) & 0x3;
691 LOG_SWTLB("%s: TLB %d zsel %d zpr %d rw %d attr %08x\n",
692 __func__, i, zsel, zpr, rw, tlb->attr);
693 /* Check execute enable bit */
694 switch (zpr) {
695 case 0x2:
696 if (pr != 0) {
697 goto check_perms;
698 }
699 /* No break here */
700 case 0x3:
701 /* All accesses granted */
702 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
703 ret = 0;
704 break;
705 case 0x0:
706 if (pr != 0) {
707 /* Raise Zone protection fault. */
708 env->spr[SPR_40x_ESR] = 1 << 22;
709 ctx->prot = 0;
710 ret = -2;
711 break;
712 }
713 /* No break here */
714 case 0x1:
715 check_perms:
716 /* Check from TLB entry */
717 ctx->prot = tlb->prot;
718 ret = check_prot(ctx->prot, rw, access_type);
719 if (ret == -2) {
720 env->spr[SPR_40x_ESR] = 0;
721 }
722 break;
723 }
724 if (ret >= 0) {
725 ctx->raddr = raddr;
726 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
727 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
728 ret);
729 return 0;
730 }
731 }
732 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
733 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
734
735 return ret;
736}
737
738void store_40x_sler(CPUPPCState *env, uint32_t val)
739{
a47dddd7
AF		 740 PowerPCCPU *cpu = ppc_env_get_cpu(env);
741
8cbbe385
BS		 742 /* XXX: TO BE FIXED */
743 if (val != 0x00000000) {
a47dddd7 744 cpu_abort(CPU(cpu), "Little-endian regions are not supported by now\n");
8cbbe385
BS		 745 }
746 env->spr[SPR_405_SLER] = val;
747}
748
749static inline int mmubooke_check_tlb(CPUPPCState *env, ppcemb_tlb_t *tlb,
a8170e5e 750 hwaddr *raddr, int *prot,
8cbbe385
BS		 751 target_ulong address, int rw,
752 int access_type, int i)
753{
754 int ret, prot2;
755
756 if (ppcemb_tlb_check(env, tlb, raddr, address,
757 env->spr[SPR_BOOKE_PID],
758 !env->nb_pids, i) >= 0) {
759 goto found_tlb;
760 }
761
762 if (env->spr[SPR_BOOKE_PID1] &&
763 ppcemb_tlb_check(env, tlb, raddr, address,
764 env->spr[SPR_BOOKE_PID1], 0, i) >= 0) {
765 goto found_tlb;
766 }
767
768 if (env->spr[SPR_BOOKE_PID2] &&
769 ppcemb_tlb_check(env, tlb, raddr, address,
770 env->spr[SPR_BOOKE_PID2], 0, i) >= 0) {
771 goto found_tlb;
772 }
773
774 LOG_SWTLB("%s: TLB entry not found\n", __func__);
775 return -1;
776
777found_tlb:
778
779 if (msr_pr != 0) {
780 prot2 = tlb->prot & 0xF;
781 } else {
782 prot2 = (tlb->prot >> 4) & 0xF;
783 }
784
785 /* Check the address space */
786 if (access_type == ACCESS_CODE) {
787 if (msr_ir != (tlb->attr & 1)) {
788 LOG_SWTLB("%s: AS doesn't match\n", __func__);
789 return -1;
790 }
791
792 *prot = prot2;
793 if (prot2 & PAGE_EXEC) {
794 LOG_SWTLB("%s: good TLB!\n", __func__);
795 return 0;
796 }
797
798 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
799 ret = -3;
800 } else {
801 if (msr_dr != (tlb->attr & 1)) {
802 LOG_SWTLB("%s: AS doesn't match\n", __func__);
803 return -1;
804 }
805
806 *prot = prot2;
807 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
808 LOG_SWTLB("%s: found TLB!\n", __func__);
809 return 0;
810 }
811
812 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
813 ret = -2;
814 }
815
816 return ret;
817}
818
819static int mmubooke_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
820 target_ulong address, int rw,
821 int access_type)
822{
823 ppcemb_tlb_t *tlb;
a8170e5e 824 hwaddr raddr;
8cbbe385
BS		 825 int i, ret;
826
827 ret = -1;
a8170e5e 828 raddr = (hwaddr)-1ULL;
8cbbe385
BS		 829 for (i = 0; i < env->nb_tlb; i++) {
830 tlb = &env->tlb.tlbe[i];
831 ret = mmubooke_check_tlb(env, tlb, &raddr, &ctx->prot, address, rw,
832 access_type, i);
0a4c7740 833 if (ret != -1) {
8cbbe385
BS		 834 break;
835 }
836 }
837
838 if (ret >= 0) {
839 ctx->raddr = raddr;
840 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
841 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
842 ret);
843 } else {
844 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
845 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
846 }
847
848 return ret;
849}
850
6575c289
BS		 851static void booke206_flush_tlb(CPUPPCState *env, int flags,
852 const int check_iprot)
8cbbe385 853{
00c8cb0a 854 PowerPCCPU *cpu = ppc_env_get_cpu(env);
8cbbe385
BS		 855 int tlb_size;
856 int i, j;
857 ppcmas_tlb_t *tlb = env->tlb.tlbm;
858
859 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
860 if (flags & (1 << i)) {
861 tlb_size = booke206_tlb_size(env, i);
862 for (j = 0; j < tlb_size; j++) {
863 if (!check_iprot || !(tlb[j].mas1 & MAS1_IPROT)) {
864 tlb[j].mas1 &= ~MAS1_VALID;
865 }
866 }
867 }
868 tlb += booke206_tlb_size(env, i);
869 }
870
d10eb08f 871 tlb_flush(CPU(cpu));
8cbbe385
BS		 872}
873
6575c289
BS		 874static hwaddr booke206_tlb_to_page_size(CPUPPCState *env,
875 ppcmas_tlb_t *tlb)
8cbbe385
BS		 876{
877 int tlbm_size;
878
879 tlbm_size = (tlb->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
880
881 return 1024ULL << tlbm_size;
882}
883
884/* TLB check function for MAS based SoftTLBs */
213c7180 885static int ppcmas_tlb_check(CPUPPCState *env, ppcmas_tlb_t *tlb,
da89a1cf
AG		 886 hwaddr *raddrp, target_ulong address,
887 uint32_t pid)
8cbbe385 888{
da89a1cf 889 hwaddr mask;
8cbbe385
BS		 890 uint32_t tlb_pid;
891
deb6ed13
AG		 892 if (!msr_cm) {
893 /* In 32bit mode we can only address 32bit EAs */
894 address = (uint32_t)address;
895 }
896
8cbbe385
BS		 897 /* Check valid flag */
898 if (!(tlb->mas1 & MAS1_VALID)) {
899 return -1;
900 }
901
902 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
903 LOG_SWTLB("%s: TLB ADDR=0x" TARGET_FMT_lx " PID=0x%x MAS1=0x%x MAS2=0x%"
9207113d
MCA		 904 PRIx64 " mask=0x%" HWADDR_PRIx " MAS7_3=0x%" PRIx64 " MAS8=0x%"
905 PRIx32 "\n", __func__, address, pid, tlb->mas1, tlb->mas2, mask,
906 tlb->mas7_3, tlb->mas8);
8cbbe385
BS		 907
908 /* Check PID */
909 tlb_pid = (tlb->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT;
910 if (tlb_pid != 0 && tlb_pid != pid) {
911 return -1;
912 }
913
914 /* Check effective address */
915 if ((address & mask) != (tlb->mas2 & MAS2_EPN_MASK)) {
916 return -1;
917 }
918
919 if (raddrp) {
920 *raddrp = (tlb->mas7_3 & mask) | (address & ~mask);
921 }
922
923 return 0;
924}
925
926static int mmubooke206_check_tlb(CPUPPCState *env, ppcmas_tlb_t *tlb,
a8170e5e 927 hwaddr *raddr, int *prot,
8cbbe385
BS		 928 target_ulong address, int rw,
929 int access_type)
930{
931 int ret;
932 int prot2 = 0;
933
934 if (ppcmas_tlb_check(env, tlb, raddr, address,
935 env->spr[SPR_BOOKE_PID]) >= 0) {
936 goto found_tlb;
937 }
938
939 if (env->spr[SPR_BOOKE_PID1] &&
940 ppcmas_tlb_check(env, tlb, raddr, address,
941 env->spr[SPR_BOOKE_PID1]) >= 0) {
942 goto found_tlb;
943 }
944
945 if (env->spr[SPR_BOOKE_PID2] &&
946 ppcmas_tlb_check(env, tlb, raddr, address,
947 env->spr[SPR_BOOKE_PID2]) >= 0) {
948 goto found_tlb;
949 }
950
951 LOG_SWTLB("%s: TLB entry not found\n", __func__);
952 return -1;
953
954found_tlb:
955
956 if (msr_pr != 0) {
957 if (tlb->mas7_3 & MAS3_UR) {
958 prot2 |= PAGE_READ;
959 }
960 if (tlb->mas7_3 & MAS3_UW) {
961 prot2 |= PAGE_WRITE;
962 }
963 if (tlb->mas7_3 & MAS3_UX) {
964 prot2 |= PAGE_EXEC;
965 }
966 } else {
967 if (tlb->mas7_3 & MAS3_SR) {
968 prot2 |= PAGE_READ;
969 }
970 if (tlb->mas7_3 & MAS3_SW) {
971 prot2 |= PAGE_WRITE;
972 }
973 if (tlb->mas7_3 & MAS3_SX) {
974 prot2 |= PAGE_EXEC;
975 }
976 }
977
978 /* Check the address space and permissions */
979 if (access_type == ACCESS_CODE) {
980 if (msr_ir != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
981 LOG_SWTLB("%s: AS doesn't match\n", __func__);
982 return -1;
983 }
984
985 *prot = prot2;
986 if (prot2 & PAGE_EXEC) {
987 LOG_SWTLB("%s: good TLB!\n", __func__);
988 return 0;
989 }
990
991 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2);
992 ret = -3;
993 } else {
994 if (msr_dr != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
995 LOG_SWTLB("%s: AS doesn't match\n", __func__);
996 return -1;
997 }
998
999 *prot = prot2;
1000 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) {
1001 LOG_SWTLB("%s: found TLB!\n", __func__);
1002 return 0;
1003 }
1004
1005 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2);
1006 ret = -2;
1007 }
1008
1009 return ret;
1010}
1011
1012static int mmubooke206_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1013 target_ulong address, int rw,
1014 int access_type)
1015{
1016 ppcmas_tlb_t *tlb;
a8170e5e 1017 hwaddr raddr;
8cbbe385
BS		 1018 int i, j, ret;
1019
1020 ret = -1;
a8170e5e 1021 raddr = (hwaddr)-1ULL;
8cbbe385
BS		 1022
1023 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1024 int ways = booke206_tlb_ways(env, i);
1025
1026 for (j = 0; j < ways; j++) {
1027 tlb = booke206_get_tlbm(env, i, address, j);
1028 if (!tlb) {
1029 continue;
1030 }
1031 ret = mmubooke206_check_tlb(env, tlb, &raddr, &ctx->prot, address,
1032 rw, access_type);
1033 if (ret != -1) {
1034 goto found_tlb;
1035 }
1036 }
1037 }
1038
1039found_tlb:
1040
1041 if (ret >= 0) {
1042 ctx->raddr = raddr;
1043 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx
1044 " %d %d\n", __func__, address, ctx->raddr, ctx->prot,
1045 ret);
1046 } else {
1047 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx
1048 " %d %d\n", __func__, address, raddr, ctx->prot, ret);
1049 }
1050
1051 return ret;
1052}
1053
1054static const char *book3e_tsize_to_str[32] = {
1055 "1K", "2K", "4K", "8K", "16K", "32K", "64K", "128K", "256K", "512K",
1056 "1M", "2M", "4M", "8M", "16M", "32M", "64M", "128M", "256M", "512M",
1057 "1G", "2G", "4G", "8G", "16G", "32G", "64G", "128G", "256G", "512G",
1058 "1T", "2T"
1059};
1060
1061static void mmubooke_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1062 CPUPPCState *env)
1063{
1064 ppcemb_tlb_t *entry;
1065 int i;
1066
1067 if (kvm_enabled() && !env->kvm_sw_tlb) {
1068 cpu_fprintf(f, "Cannot access KVM TLB\n");
1069 return;
1070 }
1071
1072 cpu_fprintf(f, "\nTLB:\n");
1073 cpu_fprintf(f, "Effective Physical Size PID Prot "
1074 "Attr\n");
1075
1076 entry = &env->tlb.tlbe[0];
1077 for (i = 0; i < env->nb_tlb; i++, entry++) {
a8170e5e 1078 hwaddr ea, pa;
8cbbe385
BS		 1079 target_ulong mask;
1080 uint64_t size = (uint64_t)entry->size;
1081 char size_buf[20];
1082
1083 /* Check valid flag */
1084 if (!(entry->prot & PAGE_VALID)) {
1085 continue;
1086 }
1087
1088 mask = ~(entry->size - 1);
1089 ea = entry->EPN & mask;
1090 pa = entry->RPN & mask;
8cbbe385 1091 /* Extend the physical address to 36 bits */
a8170e5e 1092 pa |= (hwaddr)(entry->RPN & 0xF) << 32;
8cbbe385
BS		 1093 size /= 1024;
1094 if (size >= 1024) {
1095 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "M", size / 1024);
1096 } else {
1097 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "k", size);
1098 }
1099 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %s %-5u %08x %08x\n",
1100 (uint64_t)ea, (uint64_t)pa, size_buf, (uint32_t)entry->PID,
1101 entry->prot, entry->attr);
1102 }
1103
1104}
1105
1106static void mmubooke206_dump_one_tlb(FILE *f, fprintf_function cpu_fprintf,
1107 CPUPPCState *env, int tlbn, int offset,
1108 int tlbsize)
1109{
1110 ppcmas_tlb_t *entry;
1111 int i;
1112
1113 cpu_fprintf(f, "\nTLB%d:\n", tlbn);
1114 cpu_fprintf(f, "Effective Physical Size TID TS SRWX"
1115 " URWX WIMGE U0123\n");
1116
1117 entry = &env->tlb.tlbm[offset];
1118 for (i = 0; i < tlbsize; i++, entry++) {
a8170e5e 1119 hwaddr ea, pa, size;
8cbbe385
BS		 1120 int tsize;
1121
1122 if (!(entry->mas1 & MAS1_VALID)) {
1123 continue;
1124 }
1125
1126 tsize = (entry->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
1127 size = 1024ULL << tsize;
1128 ea = entry->mas2 & ~(size - 1);
1129 pa = entry->mas7_3 & ~(size - 1);
1130
1131 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %4s %-5u %1u S%c%c%c"
1132 "U%c%c%c %c%c%c%c%c U%c%c%c%c\n",
1133 (uint64_t)ea, (uint64_t)pa,
1134 book3e_tsize_to_str[tsize],
1135 (entry->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT,
1136 (entry->mas1 & MAS1_TS) >> MAS1_TS_SHIFT,
1137 entry->mas7_3 & MAS3_SR ? 'R' : '-',
1138 entry->mas7_3 & MAS3_SW ? 'W' : '-',
1139 entry->mas7_3 & MAS3_SX ? 'X' : '-',
1140 entry->mas7_3 & MAS3_UR ? 'R' : '-',
1141 entry->mas7_3 & MAS3_UW ? 'W' : '-',
1142 entry->mas7_3 & MAS3_UX ? 'X' : '-',
1143 entry->mas2 & MAS2_W ? 'W' : '-',
1144 entry->mas2 & MAS2_I ? 'I' : '-',
1145 entry->mas2 & MAS2_M ? 'M' : '-',
1146 entry->mas2 & MAS2_G ? 'G' : '-',
1147 entry->mas2 & MAS2_E ? 'E' : '-',
1148 entry->mas7_3 & MAS3_U0 ? '0' : '-',
1149 entry->mas7_3 & MAS3_U1 ? '1' : '-',
1150 entry->mas7_3 & MAS3_U2 ? '2' : '-',
1151 entry->mas7_3 & MAS3_U3 ? '3' : '-');
1152 }
1153}
1154
1155static void mmubooke206_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1156 CPUPPCState *env)
1157{
1158 int offset = 0;
1159 int i;
1160
1161 if (kvm_enabled() && !env->kvm_sw_tlb) {
1162 cpu_fprintf(f, "Cannot access KVM TLB\n");
1163 return;
1164 }
1165
1166 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
1167 int size = booke206_tlb_size(env, i);
1168
1169 if (size == 0) {
1170 continue;
1171 }
1172
1173 mmubooke206_dump_one_tlb(f, cpu_fprintf, env, i, offset, size);
1174 offset += size;
1175 }
1176}
1177
886b7577
FC		 1178static void mmu6xx_dump_BATs(FILE *f, fprintf_function cpu_fprintf,
1179 CPUPPCState *env, int type)
1180{
1181 target_ulong *BATlt, *BATut, *BATu, *BATl;
1182 target_ulong BEPIl, BEPIu, bl;
1183 int i;
1184
1185 switch (type) {
1186 case ACCESS_CODE:
1187 BATlt = env->IBAT[1];
1188 BATut = env->IBAT[0];
1189 break;
1190 default:
1191 BATlt = env->DBAT[1];
1192 BATut = env->DBAT[0];
1193 break;
1194 }
1195
1196 for (i = 0; i < env->nb_BATs; i++) {
1197 BATu = &BATut[i];
1198 BATl = &BATlt[i];
1199 BEPIu = *BATu & 0xF0000000;
1200 BEPIl = *BATu & 0x0FFE0000;
1201 bl = (*BATu & 0x00001FFC) << 15;
1202 cpu_fprintf(f, "%s BAT%d BATu " TARGET_FMT_lx
1203 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " "
1204 TARGET_FMT_lx " " TARGET_FMT_lx "\n",
1205 type == ACCESS_CODE ? "code" : "data", i,
1206 *BATu, *BATl, BEPIu, BEPIl, bl);
1207 }
1208}
1209
1210static void mmu6xx_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
1211 CPUPPCState *env)
1212{
36778660 1213 PowerPCCPU *cpu = ppc_env_get_cpu(env);
886b7577
FC		 1214 ppc6xx_tlb_t *tlb;
1215 target_ulong sr;
1216 int type, way, entry, i;
1217
36778660
DG		 1218 cpu_fprintf(f, "HTAB base = 0x%"HWADDR_PRIx"\n", ppc_hash32_hpt_base(cpu));
1219 cpu_fprintf(f, "HTAB mask = 0x%"HWADDR_PRIx"\n", ppc_hash32_hpt_mask(cpu));
886b7577
FC		 1220
1221 cpu_fprintf(f, "\nSegment registers:\n");
1222 for (i = 0; i < 32; i++) {
1223 sr = env->sr[i];
1224 if (sr & 0x80000000) {
1225 cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d BUID=0x%03x "
1226 "CNTLR_SPEC=0x%05x\n", i,
1227 sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0,
1228 sr & 0x20000000 ? 1 : 0, (uint32_t)((sr >> 20) & 0x1FF),
1229 (uint32_t)(sr & 0xFFFFF));
1230 } else {
1231 cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d N=%d VSID=0x%06x\n", i,
1232 sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0,
1233 sr & 0x20000000 ? 1 : 0, sr & 0x10000000 ? 1 : 0,
1234 (uint32_t)(sr & 0x00FFFFFF));
1235 }
1236 }
1237
1238 cpu_fprintf(f, "\nBATs:\n");
1239 mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_INT);
1240 mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_CODE);
1241
1242 if (env->id_tlbs != 1) {
1243 cpu_fprintf(f, "ERROR: 6xx MMU should have separated TLB"
1244 " for code and data\n");
1245 }
1246
1247 cpu_fprintf(f, "\nTLBs [EPN EPN + SIZE]\n");
1248
1249 for (type = 0; type < 2; type++) {
1250 for (way = 0; way < env->nb_ways; way++) {
1251 for (entry = env->nb_tlb * type + env->tlb_per_way * way;
1252 entry < (env->nb_tlb * type + env->tlb_per_way * (way + 1));
1253 entry++) {
1254
1255 tlb = &env->tlb.tlb6[entry];
1256 cpu_fprintf(f, "%s TLB %02d/%02d way:%d %s ["
1257 TARGET_FMT_lx " " TARGET_FMT_lx "]\n",
1258 type ? "code" : "data", entry % env->nb_tlb,
1259 env->nb_tlb, way,
1260 pte_is_valid(tlb->pte0) ? "valid" : "inval",
1261 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE);
1262 }
1263 }
1264 }
1265}
1266
8cbbe385
BS		 1267void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
1268{
ec975e83 1269 switch (POWERPC_MMU_VER(env->mmu_model)) {
8cbbe385
BS		 1270 case POWERPC_MMU_BOOKE:
1271 mmubooke_dump_mmu(f, cpu_fprintf, env);
1272 break;
1273 case POWERPC_MMU_BOOKE206:
1274 mmubooke206_dump_mmu(f, cpu_fprintf, env);
1275 break;
886b7577
FC		 1276 case POWERPC_MMU_SOFT_6xx:
1277 case POWERPC_MMU_SOFT_74xx:
1278 mmu6xx_dump_mmu(f, cpu_fprintf, env);
1279 break;
8cbbe385 1280#if defined(TARGET_PPC64)
ec975e83
SB		 1281 case POWERPC_MMU_VER_64B:
1282 case POWERPC_MMU_VER_2_03:
1283 case POWERPC_MMU_VER_2_06:
1284 case POWERPC_MMU_VER_2_07:
7ef23068 1285 dump_slb(f, cpu_fprintf, ppc_env_get_cpu(env));
8cbbe385 1286 break;
ec975e83 1287 case POWERPC_MMU_VER_3_00:
b2899495
SJS		 1288 if (ppc64_radix_guest(ppc_env_get_cpu(env))) {
1289 /* TODO - Unsupported */
1290 } else {
1291 dump_slb(f, cpu_fprintf, ppc_env_get_cpu(env));
1292 break;
1293 }
8cbbe385
BS		 1294#endif
1295 default:
1296 qemu_log_mask(LOG_UNIMP, "%s: unimplemented\n", __func__);
1297 }
1298}
1299
1300static inline int check_physical(CPUPPCState *env, mmu_ctx_t *ctx,
1301 target_ulong eaddr, int rw)
1302{
1303 int in_plb, ret;
1304
1305 ctx->raddr = eaddr;
1306 ctx->prot = PAGE_READ | PAGE_EXEC;
1307 ret = 0;
1308 switch (env->mmu_model) {
8cbbe385
BS		 1309 case POWERPC_MMU_SOFT_6xx:
1310 case POWERPC_MMU_SOFT_74xx:
1311 case POWERPC_MMU_SOFT_4xx:
1312 case POWERPC_MMU_REAL:
1313 case POWERPC_MMU_BOOKE:
1314 ctx->prot |= PAGE_WRITE;
1315 break;
629bd516 1316
8cbbe385
BS		 1317 case POWERPC_MMU_SOFT_4xx_Z:
1318 if (unlikely(msr_pe != 0)) {
1319 /* 403 family add some particular protections,
1320 * using PBL/PBU registers for accesses with no translation.
1321 */
1322 in_plb =
1323 /* Check PLB validity */
1324 (env->pb[0] < env->pb[1] &&
1325 /* and address in plb area */
1326 eaddr >= env->pb[0] && eaddr < env->pb[1]) ||
1327 (env->pb[2] < env->pb[3] &&
1328 eaddr >= env->pb[2] && eaddr < env->pb[3]) ? 1 : 0;
1329 if (in_plb ^ msr_px) {
1330 /* Access in protected area */
1331 if (rw == 1) {
1332 /* Access is not allowed */
1333 ret = -2;
1334 }
1335 } else {
1336 /* Read-write access is allowed */
1337 ctx->prot |= PAGE_WRITE;
1338 }
1339 }
1340 break;
629bd516 1341
8cbbe385 1342 default:
629bd516
DG		 1343 /* Caller's checks mean we should never get here for other models */
1344 abort();
8cbbe385
BS		 1345 return -1;
1346 }
1347
1348 return ret;
1349}
1350
6575c289
BS		 1351static int get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx,
1352 target_ulong eaddr, int rw, int access_type)
8cbbe385 1353{
a47dddd7 1354 PowerPCCPU *cpu = ppc_env_get_cpu(env);
44bc9107
DG		 1355 int ret = -1;
1356 bool real_mode = (access_type == ACCESS_CODE && msr_ir == 0)
1357 || (access_type != ACCESS_CODE && msr_dr == 0);
8cbbe385
BS		 1358
1359#if 0
1360 qemu_log("%s\n", __func__);
1361#endif
44bc9107
DG		 1362
1363 switch (env->mmu_model) {
44bc9107
DG		 1364 case POWERPC_MMU_SOFT_6xx:
1365 case POWERPC_MMU_SOFT_74xx:
1366 if (real_mode) {
1367 ret = check_physical(env, ctx, eaddr, rw);
1368 } else {
8cbbe385
BS		 1369 /* Try to find a BAT */
1370 if (env->nb_BATs != 0) {
98132796 1371 ret = get_bat_6xx_tlb(env, ctx, eaddr, rw, access_type);
8cbbe385 1372 }
0480884f
DG		 1373 if (ret < 0) {
1374 /* We didn't match any BAT entry or don't have BATs */
1375 ret = get_segment_6xx_tlb(env, ctx, eaddr, rw, access_type);
1376 }
44bc9107
DG		 1377 }
1378 break;
0480884f 1379
44bc9107
DG		 1380 case POWERPC_MMU_SOFT_4xx:
1381 case POWERPC_MMU_SOFT_4xx_Z:
1382 if (real_mode) {
1383 ret = check_physical(env, ctx, eaddr, rw);
1384 } else {
8cbbe385
BS		 1385 ret = mmu40x_get_physical_address(env, ctx, eaddr,
1386 rw, access_type);
44bc9107
DG		 1387 }
1388 break;
1389 case POWERPC_MMU_BOOKE:
1390 ret = mmubooke_get_physical_address(env, ctx, eaddr,
1391 rw, access_type);
1392 break;
1393 case POWERPC_MMU_BOOKE206:
1394 ret = mmubooke206_get_physical_address(env, ctx, eaddr, rw,
8cbbe385 1395 access_type);
44bc9107
DG		 1396 break;
1397 case POWERPC_MMU_MPC8xx:
1398 /* XXX: TODO */
a47dddd7 1399 cpu_abort(CPU(cpu), "MPC8xx MMU model is not implemented\n");
44bc9107
DG		 1400 break;
1401 case POWERPC_MMU_REAL:
1402 if (real_mode) {
1403 ret = check_physical(env, ctx, eaddr, rw);
1404 } else {
a47dddd7 1405 cpu_abort(CPU(cpu), "PowerPC in real mode do not do any translation\n");
8cbbe385 1406 }
44bc9107
DG		 1407 return -1;
1408 default:
a47dddd7 1409 cpu_abort(CPU(cpu), "Unknown or invalid MMU model\n");
44bc9107 1410 return -1;
8cbbe385
BS		 1411 }
1412#if 0
1413 qemu_log("%s address " TARGET_FMT_lx " => %d " TARGET_FMT_plx "\n",
1414 __func__, eaddr, ret, ctx->raddr);
1415#endif
1416
1417 return ret;
1418}
1419
00b941e5 1420hwaddr ppc_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
8cbbe385 1421{
00b941e5
AF		 1422 PowerPCCPU *cpu = POWERPC_CPU(cs);
1423 CPUPPCState *env = &cpu->env;
8cbbe385
BS		 1424 mmu_ctx_t ctx;
1425
ec975e83 1426 switch (POWERPC_MMU_VER(env->mmu_model)) {
f2ad6be8 1427#if defined(TARGET_PPC64)
ec975e83
SB		 1428 case POWERPC_MMU_VER_64B:
1429 case POWERPC_MMU_VER_2_03:
1430 case POWERPC_MMU_VER_2_06:
1431 case POWERPC_MMU_VER_2_07:
7ef23068 1432 return ppc_hash64_get_phys_page_debug(cpu, addr);
ec975e83 1433 case POWERPC_MMU_VER_3_00:
b2899495 1434 if (ppc64_radix_guest(ppc_env_get_cpu(env))) {
95cb0657 1435 return ppc_radix64_get_phys_page_debug(cpu, addr);
b2899495
SJS		 1436 } else {
1437 return ppc_hash64_get_phys_page_debug(cpu, addr);
1438 }
1439 break;
f2ad6be8
DG		 1440#endif
1441
1442 case POWERPC_MMU_32B:
1443 case POWERPC_MMU_601:
7ef23068 1444 return ppc_hash32_get_phys_page_debug(cpu, addr);
f2ad6be8
DG		 1445
1446 default:
1447 ;
1448 }
1449
8cbbe385 1450 if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT) != 0)) {
b177d8b7
FC		 1451
1452 /* Some MMUs have separate TLBs for code and data. If we only try an
1453 * ACCESS_INT, we may not be able to read instructions mapped by code
1454 * TLBs, so we also try a ACCESS_CODE.
1455 */
1456 if (unlikely(get_physical_address(env, &ctx, addr, 0,
1457 ACCESS_CODE) != 0)) {
1458 return -1;
1459 }
8cbbe385
BS		 1460 }
1461
1462 return ctx.raddr & TARGET_PAGE_MASK;
1463}
1464
1465static void booke206_update_mas_tlb_miss(CPUPPCState *env, target_ulong address,
1466 int rw)
1467{
1468 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
1469 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
1470 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
1471 env->spr[SPR_BOOKE_MAS3] = 0;
1472 env->spr[SPR_BOOKE_MAS6] = 0;
1473 env->spr[SPR_BOOKE_MAS7] = 0;
1474
1475 /* AS */
1476 if (((rw == 2) && msr_ir) || ((rw != 2) && msr_dr)) {
1477 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
1478 env->spr[SPR_BOOKE_MAS6] |= MAS6_SAS;
1479 }
1480
1481 env->spr[SPR_BOOKE_MAS1] |= MAS1_VALID;
1482 env->spr[SPR_BOOKE_MAS2] |= address & MAS2_EPN_MASK;
1483
1484 switch (env->spr[SPR_BOOKE_MAS4] & MAS4_TIDSELD_PIDZ) {
1485 case MAS4_TIDSELD_PID0:
1486 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID] << MAS1_TID_SHIFT;
1487 break;
1488 case MAS4_TIDSELD_PID1:
1489 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID1] << MAS1_TID_SHIFT;
1490 break;
1491 case MAS4_TIDSELD_PID2:
1492 env->spr[SPR_BOOKE_MAS1] |= env->spr[SPR_BOOKE_PID2] << MAS1_TID_SHIFT;
1493 break;
1494 }
1495
1496 env->spr[SPR_BOOKE_MAS6] |= env->spr[SPR_BOOKE_PID] << 16;
1497
1498 /* next victim logic */
1499 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
1500 env->last_way++;
1501 env->last_way &= booke206_tlb_ways(env, 0) - 1;
1502 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
1503}
1504
1505/* Perform address translation */
eb20c1c6
DG		 1506static int cpu_ppc_handle_mmu_fault(CPUPPCState *env, target_ulong address,
1507 int rw, int mmu_idx)
8cbbe385 1508{
27103424 1509 CPUState *cs = CPU(ppc_env_get_cpu(env));
7ef23068 1510 PowerPCCPU *cpu = POWERPC_CPU(cs);
8cbbe385
BS		 1511 mmu_ctx_t ctx;
1512 int access_type;
1513 int ret = 0;
1514
1515 if (rw == 2) {
1516 /* code access */
1517 rw = 0;
1518 access_type = ACCESS_CODE;
1519 } else {
1520 /* data access */
1521 access_type = env->access_type;
1522 }
1523 ret = get_physical_address(env, &ctx, address, rw, access_type);
1524 if (ret == 0) {
0c591eb0 1525 tlb_set_page(cs, address & TARGET_PAGE_MASK,
8cbbe385
BS		 1526 ctx.raddr & TARGET_PAGE_MASK, ctx.prot,
1527 mmu_idx, TARGET_PAGE_SIZE);
1528 ret = 0;
1529 } else if (ret < 0) {
27103424 1530 LOG_MMU_STATE(cs);
8cbbe385
BS		 1531 if (access_type == ACCESS_CODE) {
1532 switch (ret) {
1533 case -1:
1534 /* No matches in page tables or TLB */
1535 switch (env->mmu_model) {
1536 case POWERPC_MMU_SOFT_6xx:
27103424 1537 cs->exception_index = POWERPC_EXCP_IFTLB;
8cbbe385
BS		 1538 env->error_code = 1 << 18;
1539 env->spr[SPR_IMISS] = address;
1540 env->spr[SPR_ICMP] = 0x80000000 | ctx.ptem;
1541 goto tlb_miss;
1542 case POWERPC_MMU_SOFT_74xx:
27103424 1543 cs->exception_index = POWERPC_EXCP_IFTLB;
8cbbe385
BS		 1544 goto tlb_miss_74xx;
1545 case POWERPC_MMU_SOFT_4xx:
1546 case POWERPC_MMU_SOFT_4xx_Z:
27103424 1547 cs->exception_index = POWERPC_EXCP_ITLB;
8cbbe385
BS		 1548 env->error_code = 0;
1549 env->spr[SPR_40x_DEAR] = address;
1550 env->spr[SPR_40x_ESR] = 0x00000000;
1551 break;
8cbbe385 1552 case POWERPC_MMU_BOOKE206:
89fca22f 1553 booke206_update_mas_tlb_miss(env, address, 2);
8cbbe385
BS		 1554 /* fall through */
1555 case POWERPC_MMU_BOOKE:
27103424 1556 cs->exception_index = POWERPC_EXCP_ITLB;
8cbbe385
BS		 1557 env->error_code = 0;
1558 env->spr[SPR_BOOKE_DEAR] = address;
1559 return -1;
1560 case POWERPC_MMU_MPC8xx:
1561 /* XXX: TODO */
a47dddd7 1562 cpu_abort(cs, "MPC8xx MMU model is not implemented\n");
8cbbe385
BS		 1563 break;
1564 case POWERPC_MMU_REAL:
a47dddd7 1565 cpu_abort(cs, "PowerPC in real mode should never raise "
8cbbe385
BS		 1566 "any MMU exceptions\n");
1567 return -1;
1568 default:
a47dddd7 1569 cpu_abort(cs, "Unknown or invalid MMU model\n");
8cbbe385
BS		 1570 return -1;
1571 }
1572 break;
1573 case -2:
1574 /* Access rights violation */
27103424 1575 cs->exception_index = POWERPC_EXCP_ISI;
8cbbe385
BS		 1576 env->error_code = 0x08000000;
1577 break;
1578 case -3:
1579 /* No execute protection violation */
1580 if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1581 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1582 env->spr[SPR_BOOKE_ESR] = 0x00000000;
1583 }
27103424 1584 cs->exception_index = POWERPC_EXCP_ISI;
8cbbe385
BS		 1585 env->error_code = 0x10000000;
1586 break;
1587 case -4:
1588 /* Direct store exception */
1589 /* No code fetch is allowed in direct-store areas */
27103424 1590 cs->exception_index = POWERPC_EXCP_ISI;
8cbbe385
BS		 1591 env->error_code = 0x10000000;
1592 break;
8cbbe385
BS		 1593 }
1594 } else {
1595 switch (ret) {
1596 case -1:
1597 /* No matches in page tables or TLB */
1598 switch (env->mmu_model) {
1599 case POWERPC_MMU_SOFT_6xx:
1600 if (rw == 1) {
27103424 1601 cs->exception_index = POWERPC_EXCP_DSTLB;
8cbbe385
BS		 1602 env->error_code = 1 << 16;
1603 } else {
27103424 1604 cs->exception_index = POWERPC_EXCP_DLTLB;
8cbbe385
BS		 1605 env->error_code = 0;
1606 }
1607 env->spr[SPR_DMISS] = address;
1608 env->spr[SPR_DCMP] = 0x80000000 | ctx.ptem;
1609 tlb_miss:
1610 env->error_code |= ctx.key << 19;
36778660 1611 env->spr[SPR_HASH1] = ppc_hash32_hpt_base(cpu) +
7ef23068 1612 get_pteg_offset32(cpu, ctx.hash[0]);
36778660 1613 env->spr[SPR_HASH2] = ppc_hash32_hpt_base(cpu) +
7ef23068 1614 get_pteg_offset32(cpu, ctx.hash[1]);
8cbbe385
BS		 1615 break;
1616 case POWERPC_MMU_SOFT_74xx:
1617 if (rw == 1) {
27103424 1618 cs->exception_index = POWERPC_EXCP_DSTLB;
8cbbe385 1619 } else {
27103424 1620 cs->exception_index = POWERPC_EXCP_DLTLB;
8cbbe385
BS		 1621 }
1622 tlb_miss_74xx:
1623 /* Implement LRU algorithm */
1624 env->error_code = ctx.key << 19;
1625 env->spr[SPR_TLBMISS] = (address & ~((target_ulong)0x3)) |
1626 ((env->last_way + 1) & (env->nb_ways - 1));
1627 env->spr[SPR_PTEHI] = 0x80000000 | ctx.ptem;
1628 break;
1629 case POWERPC_MMU_SOFT_4xx:
1630 case POWERPC_MMU_SOFT_4xx_Z:
27103424 1631 cs->exception_index = POWERPC_EXCP_DTLB;
8cbbe385
BS		 1632 env->error_code = 0;
1633 env->spr[SPR_40x_DEAR] = address;
1634 if (rw) {
1635 env->spr[SPR_40x_ESR] = 0x00800000;
1636 } else {
1637 env->spr[SPR_40x_ESR] = 0x00000000;
1638 }
1639 break;
8cbbe385
BS		 1640 case POWERPC_MMU_MPC8xx:
1641 /* XXX: TODO */
a47dddd7 1642 cpu_abort(cs, "MPC8xx MMU model is not implemented\n");
8cbbe385
BS		 1643 break;
1644 case POWERPC_MMU_BOOKE206:
1645 booke206_update_mas_tlb_miss(env, address, rw);
1646 /* fall through */
1647 case POWERPC_MMU_BOOKE:
27103424 1648 cs->exception_index = POWERPC_EXCP_DTLB;
8cbbe385
BS		 1649 env->error_code = 0;
1650 env->spr[SPR_BOOKE_DEAR] = address;
1651 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1652 return -1;
1653 case POWERPC_MMU_REAL:
a47dddd7 1654 cpu_abort(cs, "PowerPC in real mode should never raise "
8cbbe385
BS		 1655 "any MMU exceptions\n");
1656 return -1;
1657 default:
a47dddd7 1658 cpu_abort(cs, "Unknown or invalid MMU model\n");
8cbbe385
BS		 1659 return -1;
1660 }
1661 break;
1662 case -2:
1663 /* Access rights violation */
27103424 1664 cs->exception_index = POWERPC_EXCP_DSI;
8cbbe385
BS		 1665 env->error_code = 0;
1666 if (env->mmu_model == POWERPC_MMU_SOFT_4xx
1667 || env->mmu_model == POWERPC_MMU_SOFT_4xx_Z) {
1668 env->spr[SPR_40x_DEAR] = address;
1669 if (rw) {
1670 env->spr[SPR_40x_ESR] |= 0x00800000;
1671 }
1672 } else if ((env->mmu_model == POWERPC_MMU_BOOKE) ||
1673 (env->mmu_model == POWERPC_MMU_BOOKE206)) {
1674 env->spr[SPR_BOOKE_DEAR] = address;
1675 env->spr[SPR_BOOKE_ESR] = rw ? ESR_ST : 0;
1676 } else {
1677 env->spr[SPR_DAR] = address;
1678 if (rw == 1) {
1679 env->spr[SPR_DSISR] = 0x0A000000;
1680 } else {
1681 env->spr[SPR_DSISR] = 0x08000000;
1682 }
1683 }
1684 break;
1685 case -4:
1686 /* Direct store exception */
1687 switch (access_type) {
1688 case ACCESS_FLOAT:
1689 /* Floating point load/store */
27103424 1690 cs->exception_index = POWERPC_EXCP_ALIGN;
8cbbe385
BS		 1691 env->error_code = POWERPC_EXCP_ALIGN_FP;
1692 env->spr[SPR_DAR] = address;
1693 break;
1694 case ACCESS_RES:
1695 /* lwarx, ldarx or stwcx. */
27103424 1696 cs->exception_index = POWERPC_EXCP_DSI;
8cbbe385
BS		 1697 env->error_code = 0;
1698 env->spr[SPR_DAR] = address;
1699 if (rw == 1) {
1700 env->spr[SPR_DSISR] = 0x06000000;
1701 } else {
1702 env->spr[SPR_DSISR] = 0x04000000;
1703 }
1704 break;
1705 case ACCESS_EXT:
1706 /* eciwx or ecowx */
27103424 1707 cs->exception_index = POWERPC_EXCP_DSI;
8cbbe385
BS		 1708 env->error_code = 0;
1709 env->spr[SPR_DAR] = address;
1710 if (rw == 1) {
1711 env->spr[SPR_DSISR] = 0x06100000;
1712 } else {
1713 env->spr[SPR_DSISR] = 0x04100000;
1714 }
1715 break;
1716 default:
1717 printf("DSI: invalid exception (%d)\n", ret);
27103424 1718 cs->exception_index = POWERPC_EXCP_PROGRAM;
8cbbe385
BS		 1719 env->error_code =
1720 POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL;
1721 env->spr[SPR_DAR] = address;
1722 break;
1723 }
1724 break;
8cbbe385
BS		 1725 }
1726 }
1727#if 0
1728 printf("%s: set exception to %d %02x\n", __func__,
27103424 1729 cs->exception, env->error_code);
8cbbe385
BS		 1730#endif
1731 ret = 1;
1732 }
1733
1734 return ret;
1735}
1736
1737/*****************************************************************************/
1738/* BATs management */
1739#if !defined(FLUSH_ALL_TLBS)
1740static inline void do_invalidate_BAT(CPUPPCState *env, target_ulong BATu,
1741 target_ulong mask)
1742{
31b030d4 1743 CPUState *cs = CPU(ppc_env_get_cpu(env));
8cbbe385
BS		 1744 target_ulong base, end, page;
1745
1746 base = BATu & ~0x0001FFFF;
1747 end = base + mask + 0x00020000;
1748 LOG_BATS("Flush BAT from " TARGET_FMT_lx " to " TARGET_FMT_lx " ("
1749 TARGET_FMT_lx ")\n", base, end, mask);
1750 for (page = base; page != end; page += TARGET_PAGE_SIZE) {
31b030d4 1751 tlb_flush_page(cs, page);
8cbbe385
BS		 1752 }
1753 LOG_BATS("Flush done\n");
1754}
1755#endif
1756
1757static inline void dump_store_bat(CPUPPCState *env, char ID, int ul, int nr,
1758 target_ulong value)
1759{
1760 LOG_BATS("Set %cBAT%d%c to " TARGET_FMT_lx " (" TARGET_FMT_lx ")\n", ID,
1761 nr, ul == 0 ? 'u' : 'l', value, env->nip);
1762}
1763
9aa5b158 1764void helper_store_ibatu(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385
BS		 1765{
1766 target_ulong mask;
9207113d
MCA		 1767#if defined(FLUSH_ALL_TLBS)
1768 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1769#endif
8cbbe385
BS		 1770
1771 dump_store_bat(env, 'I', 0, nr, value);
1772 if (env->IBAT[0][nr] != value) {
1773 mask = (value << 15) & 0x0FFE0000UL;
1774#if !defined(FLUSH_ALL_TLBS)
1775 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1776#endif
1777 /* When storing valid upper BAT, mask BEPI and BRPN
1778 * and invalidate all TLBs covered by this BAT
1779 */
1780 mask = (value << 15) & 0x0FFE0000UL;
1781 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1782 (value & ~0x0001FFFFUL & ~mask);
1783 env->IBAT[1][nr] = (env->IBAT[1][nr] & 0x0000007B) |
1784 (env->IBAT[1][nr] & ~0x0001FFFF & ~mask);
1785#if !defined(FLUSH_ALL_TLBS)
1786 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1787#else
d10eb08f 1788 tlb_flush(CPU(cpu));
8cbbe385
BS		 1789#endif
1790 }
1791}
1792
9aa5b158 1793void helper_store_ibatl(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385
BS		 1794{
1795 dump_store_bat(env, 'I', 1, nr, value);
1796 env->IBAT[1][nr] = value;
1797}
1798
9aa5b158 1799void helper_store_dbatu(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385
BS		 1800{
1801 target_ulong mask;
9207113d
MCA		 1802#if defined(FLUSH_ALL_TLBS)
1803 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1804#endif
8cbbe385
BS		 1805
1806 dump_store_bat(env, 'D', 0, nr, value);
1807 if (env->DBAT[0][nr] != value) {
1808 /* When storing valid upper BAT, mask BEPI and BRPN
1809 * and invalidate all TLBs covered by this BAT
1810 */
1811 mask = (value << 15) & 0x0FFE0000UL;
1812#if !defined(FLUSH_ALL_TLBS)
1813 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1814#endif
1815 mask = (value << 15) & 0x0FFE0000UL;
1816 env->DBAT[0][nr] = (value & 0x00001FFFUL) |
1817 (value & ~0x0001FFFFUL & ~mask);
1818 env->DBAT[1][nr] = (env->DBAT[1][nr] & 0x0000007B) |
1819 (env->DBAT[1][nr] & ~0x0001FFFF & ~mask);
1820#if !defined(FLUSH_ALL_TLBS)
1821 do_invalidate_BAT(env, env->DBAT[0][nr], mask);
1822#else
d10eb08f 1823 tlb_flush(CPU(cpu));
8cbbe385
BS		 1824#endif
1825 }
1826}
1827
9aa5b158 1828void helper_store_dbatl(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385
BS		 1829{
1830 dump_store_bat(env, 'D', 1, nr, value);
1831 env->DBAT[1][nr] = value;
1832}
1833
9aa5b158 1834void helper_store_601_batu(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385
BS		 1835{
1836 target_ulong mask;
1837#if defined(FLUSH_ALL_TLBS)
9207113d 1838 PowerPCCPU *cpu = ppc_env_get_cpu(env);
8cbbe385
BS		 1839 int do_inval;
1840#endif
1841
1842 dump_store_bat(env, 'I', 0, nr, value);
1843 if (env->IBAT[0][nr] != value) {
1844#if defined(FLUSH_ALL_TLBS)
1845 do_inval = 0;
1846#endif
1847 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1848 if (env->IBAT[1][nr] & 0x40) {
1849 /* Invalidate BAT only if it is valid */
1850#if !defined(FLUSH_ALL_TLBS)
1851 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1852#else
1853 do_inval = 1;
1854#endif
1855 }
1856 /* When storing valid upper BAT, mask BEPI and BRPN
1857 * and invalidate all TLBs covered by this BAT
1858 */
1859 env->IBAT[0][nr] = (value & 0x00001FFFUL) |
1860 (value & ~0x0001FFFFUL & ~mask);
1861 env->DBAT[0][nr] = env->IBAT[0][nr];
1862 if (env->IBAT[1][nr] & 0x40) {
1863#if !defined(FLUSH_ALL_TLBS)
1864 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1865#else
1866 do_inval = 1;
1867#endif
1868 }
1869#if defined(FLUSH_ALL_TLBS)
1870 if (do_inval) {
d10eb08f 1871 tlb_flush(CPU(cpu));
8cbbe385
BS		 1872 }
1873#endif
1874 }
1875}
1876
9aa5b158 1877void helper_store_601_batl(CPUPPCState *env, uint32_t nr, target_ulong value)
8cbbe385 1878{
cca48a93 1879#if !defined(FLUSH_ALL_TLBS)
8cbbe385 1880 target_ulong mask;
cca48a93 1881#else
9207113d 1882 PowerPCCPU *cpu = ppc_env_get_cpu(env);
8cbbe385
BS		 1883 int do_inval;
1884#endif
1885
1886 dump_store_bat(env, 'I', 1, nr, value);
1887 if (env->IBAT[1][nr] != value) {
1888#if defined(FLUSH_ALL_TLBS)
1889 do_inval = 0;
1890#endif
1891 if (env->IBAT[1][nr] & 0x40) {
1892#if !defined(FLUSH_ALL_TLBS)
1893 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL;
1894 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1895#else
1896 do_inval = 1;
1897#endif
1898 }
1899 if (value & 0x40) {
1900#if !defined(FLUSH_ALL_TLBS)
1901 mask = (value << 17) & 0x0FFE0000UL;
1902 do_invalidate_BAT(env, env->IBAT[0][nr], mask);
1903#else
1904 do_inval = 1;
1905#endif
1906 }
1907 env->IBAT[1][nr] = value;
1908 env->DBAT[1][nr] = value;
1909#if defined(FLUSH_ALL_TLBS)
1910 if (do_inval) {
d10eb08f 1911 tlb_flush(CPU(cpu));
8cbbe385
BS		 1912 }
1913#endif
1914 }
1915}
1916
1917/*****************************************************************************/
1918/* TLB management */
1919void ppc_tlb_invalidate_all(CPUPPCState *env)
1920{
a47dddd7
AF		 1921 PowerPCCPU *cpu = ppc_env_get_cpu(env);
1922
ec975e83
SB		 1923#if defined(TARGET_PPC64)
1924 if (env->mmu_model & POWERPC_MMU_64) {
1925 env->tlb_need_flush = 0;
1926 tlb_flush(CPU(cpu));
1927 } else
1928#endif /* defined(TARGET_PPC64) */
8cbbe385
BS		 1929 switch (env->mmu_model) {
1930 case POWERPC_MMU_SOFT_6xx:
1931 case POWERPC_MMU_SOFT_74xx:
1932 ppc6xx_tlb_invalidate_all(env);
1933 break;
1934 case POWERPC_MMU_SOFT_4xx:
1935 case POWERPC_MMU_SOFT_4xx_Z:
1936 ppc4xx_tlb_invalidate_all(env);
1937 break;
1938 case POWERPC_MMU_REAL:
a47dddd7 1939 cpu_abort(CPU(cpu), "No TLB for PowerPC 4xx in real mode\n");
8cbbe385
BS		 1940 break;
1941 case POWERPC_MMU_MPC8xx:
1942 /* XXX: TODO */
a47dddd7 1943 cpu_abort(CPU(cpu), "MPC8xx MMU model is not implemented\n");
8cbbe385
BS		 1944 break;
1945 case POWERPC_MMU_BOOKE:
d10eb08f 1946 tlb_flush(CPU(cpu));
8cbbe385
BS		 1947 break;
1948 case POWERPC_MMU_BOOKE206:
1949 booke206_flush_tlb(env, -1, 0);
1950 break;
1951 case POWERPC_MMU_32B:
1952 case POWERPC_MMU_601:
c5a8d8f3 1953 env->tlb_need_flush = 0;
d10eb08f 1954 tlb_flush(CPU(cpu));
8cbbe385
BS		 1955 break;
1956 default:
1957 /* XXX: TODO */
ec975e83 1958 cpu_abort(CPU(cpu), "Unknown MMU model %x\n", env->mmu_model);
8cbbe385
BS		 1959 break;
1960 }
1961}
1962
1963void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr)
1964{
1965#if !defined(FLUSH_ALL_TLBS)
1966 addr &= TARGET_PAGE_MASK;
ec975e83
SB		 1967#if defined(TARGET_PPC64)
1968 if (env->mmu_model & POWERPC_MMU_64) {
1969 /* tlbie invalidate TLBs for all segments */
1970 /* XXX: given the fact that there are too many segments to invalidate,
1971 * and we still don't have a tlb_flush_mask(env, n, mask) in QEMU,
1972 * we just invalidate all TLBs
1973 */
1974 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH;
1975 } else
1976#endif /* defined(TARGET_PPC64) */
8cbbe385
BS		 1977 switch (env->mmu_model) {
1978 case POWERPC_MMU_SOFT_6xx:
1979 case POWERPC_MMU_SOFT_74xx:
1980 ppc6xx_tlb_invalidate_virt(env, addr, 0);
1981 if (env->id_tlbs == 1) {
1982 ppc6xx_tlb_invalidate_virt(env, addr, 1);
1983 }
1984 break;
8cbbe385
BS		 1985 case POWERPC_MMU_32B:
1986 case POWERPC_MMU_601:
c5a8d8f3
BH		 1987 /* Actual CPUs invalidate entire congruence classes based on the
1988 * geometry of their TLBs and some OSes take that into account,
1989 * we just mark the TLB to be flushed later (context synchronizing
1990 * event or sync instruction on 32-bit).
3dcfb74f 1991 */
a8a6d53e 1992 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH;
8cbbe385 1993 break;
8cbbe385 1994 default:
041d95f4
DG		 1995 /* Should never reach here with other MMU models */
1996 assert(0);
8cbbe385
BS		 1997 }
1998#else
1999 ppc_tlb_invalidate_all(env);
2000#endif
2001}
2002
2003/*****************************************************************************/
2004/* Special registers manipulation */
8cbbe385
BS		 2005void ppc_store_sdr1(CPUPPCState *env, target_ulong value)
2006{
e57ca75c 2007 PowerPCCPU *cpu = ppc_env_get_cpu(env);
339aaf5b 2008 qemu_log_mask(CPU_LOG_MMU, "%s: " TARGET_FMT_lx "\n", __func__, value);
e57ca75c 2009 assert(!cpu->vhyp);
8cbbe385 2010#if defined(TARGET_PPC64)
2828c4cd 2011 if (env->mmu_model & POWERPC_MMU_64) {
e78308fd 2012 target_ulong sdr_mask = SDR_64_HTABORG | SDR_64_HTABSIZE;
8d63351f 2013 target_ulong htabsize = value & SDR_64_HTABSIZE;
8cbbe385 2014
e78308fd
DG		 2015 if (value & ~sdr_mask) {
2016 error_report("Invalid bits 0x"TARGET_FMT_lx" set in SDR1",
2017 value & ~sdr_mask);
2018 value &= sdr_mask;
2019 }
8d63351f
SJS		 2020 if (htabsize > 28) {
2021 error_report("Invalid HTABSIZE 0x" TARGET_FMT_lx" stored in SDR1",
2022 htabsize);
36778660 2023 return;
8cbbe385 2024 }
8cbbe385 2025 }
36778660
DG		 2026#endif /* defined(TARGET_PPC64) */
2027 /* FIXME: Should check for valid HTABMASK values in 32-bit case */
2028 env->spr[SPR_SDR1] = value;
8cbbe385
BS		 2029}
2030
9aa5b158
BS		 2031/* Segment registers load and store */
2032target_ulong helper_load_sr(CPUPPCState *env, target_ulong sr_num)
8cbbe385 2033{
9aa5b158
BS		 2034#if defined(TARGET_PPC64)
2035 if (env->mmu_model & POWERPC_MMU_64) {
2036 /* XXX */
2037 return 0;
2038 }
8cbbe385 2039#endif
9aa5b158
BS		 2040 return env->sr[sr_num];
2041}
8cbbe385 2042
9aa5b158 2043void helper_store_sr(CPUPPCState *env, target_ulong srnum, target_ulong value)
8cbbe385 2044{
339aaf5b
AP		 2045 qemu_log_mask(CPU_LOG_MMU,
2046 "%s: reg=%d " TARGET_FMT_lx " " TARGET_FMT_lx "\n", __func__,
9aa5b158 2047 (int)srnum, value, env->sr[srnum]);
8cbbe385
BS		 2048#if defined(TARGET_PPC64)
2049 if (env->mmu_model & POWERPC_MMU_64) {
c5a8d8f3 2050 PowerPCCPU *cpu = ppc_env_get_cpu(env);
bcd81230 2051 uint64_t esid, vsid;
8cbbe385
BS		 2052
2053 /* ESID = srnum */
bcd81230 2054 esid = ((uint64_t)(srnum & 0xf) << 28) | SLB_ESID_V;
8cbbe385
BS		 2055
2056 /* VSID = VSID */
bcd81230 2057 vsid = (value & 0xfffffff) << 12;
8cbbe385 2058 /* flags = flags */
bcd81230 2059 vsid |= ((value >> 27) & 0xf) << 8;
8cbbe385 2060
bcd81230 2061 ppc_store_slb(cpu, srnum, esid, vsid);
8cbbe385
BS		 2062 } else
2063#endif
2064 if (env->sr[srnum] != value) {
2065 env->sr[srnum] = value;
2066/* Invalidating 256MB of virtual memory in 4kB pages is way longer than
2067 flusing the whole TLB. */
2068#if !defined(FLUSH_ALL_TLBS) && 0
2069 {
2070 target_ulong page, end;
2071 /* Invalidate 256 MB of virtual memory */
2072 page = (16 << 20) * srnum;
2073 end = page + (16 << 20);
2074 for (; page != end; page += TARGET_PAGE_SIZE) {
00c8cb0a 2075 tlb_flush_page(CPU(cpu), page);
8cbbe385
BS		 2076 }
2077 }
2078#else
a8a6d53e 2079 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH;
8cbbe385
BS		 2080#endif
2081 }
2082}
8cbbe385 2083
ec19c4d1 2084/* TLB management */
c6c7cf05 2085void helper_tlbia(CPUPPCState *env)
ec19c4d1
BS		 2086{
2087 ppc_tlb_invalidate_all(env);
2088}
2089
c6c7cf05 2090void helper_tlbie(CPUPPCState *env, target_ulong addr)
ec19c4d1
BS		 2091{
2092 ppc_tlb_invalidate_one(env, addr);
2093}
2094
4693364f
DG		 2095void helper_tlbiva(CPUPPCState *env, target_ulong addr)
2096{
2097 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2098
2099 /* tlbiva instruction only exists on BookE */
2100 assert(env->mmu_model == POWERPC_MMU_BOOKE);
2101 /* XXX: TODO */
2102 cpu_abort(CPU(cpu), "BookE MMU model is not implemented\n");
2103}
2104
ec19c4d1
BS		 2105/* Software driven TLBs management */
2106/* PowerPC 602/603 software TLB load instructions helpers */
c6c7cf05 2107static void do_6xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
ec19c4d1
BS		 2108{
2109 target_ulong RPN, CMP, EPN;
2110 int way;
2111
2112 RPN = env->spr[SPR_RPA];
2113 if (is_code) {
2114 CMP = env->spr[SPR_ICMP];
2115 EPN = env->spr[SPR_IMISS];
2116 } else {
2117 CMP = env->spr[SPR_DCMP];
2118 EPN = env->spr[SPR_DMISS];
2119 }
2120 way = (env->spr[SPR_SRR1] >> 17) & 1;
2121 (void)EPN; /* avoid a compiler warning */
2122 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2123 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2124 RPN, way);
2125 /* Store this TLB */
2126 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2127 way, is_code, CMP, RPN);
2128}
2129
c6c7cf05 2130void helper_6xx_tlbd(CPUPPCState *env, target_ulong EPN)
ec19c4d1 2131{
c6c7cf05 2132 do_6xx_tlb(env, EPN, 0);
ec19c4d1
BS		 2133}
2134
c6c7cf05 2135void helper_6xx_tlbi(CPUPPCState *env, target_ulong EPN)
ec19c4d1 2136{
c6c7cf05 2137 do_6xx_tlb(env, EPN, 1);
ec19c4d1
BS		 2138}
2139
2140/* PowerPC 74xx software TLB load instructions helpers */
c6c7cf05 2141static void do_74xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code)
ec19c4d1
BS		 2142{
2143 target_ulong RPN, CMP, EPN;
2144 int way;
2145
2146 RPN = env->spr[SPR_PTELO];
2147 CMP = env->spr[SPR_PTEHI];
2148 EPN = env->spr[SPR_TLBMISS] & ~0x3;
2149 way = env->spr[SPR_TLBMISS] & 0x3;
2150 (void)EPN; /* avoid a compiler warning */
2151 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx
2152 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP,
2153 RPN, way);
2154 /* Store this TLB */
2155 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK),
2156 way, is_code, CMP, RPN);
2157}
2158
c6c7cf05 2159void helper_74xx_tlbd(CPUPPCState *env, target_ulong EPN)
ec19c4d1 2160{
c6c7cf05 2161 do_74xx_tlb(env, EPN, 0);
ec19c4d1
BS		 2162}
2163
c6c7cf05 2164void helper_74xx_tlbi(CPUPPCState *env, target_ulong EPN)
ec19c4d1 2165{
c6c7cf05 2166 do_74xx_tlb(env, EPN, 1);
ec19c4d1
BS		 2167}
2168
2169/*****************************************************************************/
2170/* PowerPC 601 specific instructions (POWER bridge) */
2171
c6c7cf05 2172target_ulong helper_rac(CPUPPCState *env, target_ulong addr)
ec19c4d1
BS		 2173{
2174 mmu_ctx_t ctx;
2175 int nb_BATs;
2176 target_ulong ret = 0;
2177
2178 /* We don't have to generate many instances of this instruction,
2179 * as rac is supervisor only.
2180 */
2181 /* XXX: FIX THIS: Pretend we have no BAT */
2182 nb_BATs = env->nb_BATs;
2183 env->nb_BATs = 0;
2184 if (get_physical_address(env, &ctx, addr, 0, ACCESS_INT) == 0) {
2185 ret = ctx.raddr;
2186 }
2187 env->nb_BATs = nb_BATs;
2188 return ret;
2189}
2190
2191static inline target_ulong booke_tlb_to_page_size(int size)
2192{
2193 return 1024 << (2 * size);
2194}
2195
2196static inline int booke_page_size_to_tlb(target_ulong page_size)
2197{
2198 int size;
2199
2200 switch (page_size) {
2201 case 0x00000400UL:
2202 size = 0x0;
2203 break;
2204 case 0x00001000UL:
2205 size = 0x1;
2206 break;
2207 case 0x00004000UL:
2208 size = 0x2;
2209 break;
2210 case 0x00010000UL:
2211 size = 0x3;
2212 break;
2213 case 0x00040000UL:
2214 size = 0x4;
2215 break;
2216 case 0x00100000UL:
2217 size = 0x5;
2218 break;
2219 case 0x00400000UL:
2220 size = 0x6;
2221 break;
2222 case 0x01000000UL:
2223 size = 0x7;
2224 break;
2225 case 0x04000000UL:
2226 size = 0x8;
2227 break;
2228 case 0x10000000UL:
2229 size = 0x9;
2230 break;
2231 case 0x40000000UL:
2232 size = 0xA;
2233 break;
2234#if defined(TARGET_PPC64)
2235 case 0x000100000000ULL:
2236 size = 0xB;
2237 break;
2238 case 0x000400000000ULL:
2239 size = 0xC;
2240 break;
2241 case 0x001000000000ULL:
2242 size = 0xD;
2243 break;
2244 case 0x004000000000ULL:
2245 size = 0xE;
2246 break;
2247 case 0x010000000000ULL:
2248 size = 0xF;
2249 break;
2250#endif
2251 default:
2252 size = -1;
2253 break;
2254 }
2255
2256 return size;
2257}
2258
2259/* Helpers for 4xx TLB management */
2260#define PPC4XX_TLB_ENTRY_MASK 0x0000003f /* Mask for 64 TLB entries */
2261
2262#define PPC4XX_TLBHI_V 0x00000040
2263#define PPC4XX_TLBHI_E 0x00000020
2264#define PPC4XX_TLBHI_SIZE_MIN 0
2265#define PPC4XX_TLBHI_SIZE_MAX 7
2266#define PPC4XX_TLBHI_SIZE_DEFAULT 1
2267#define PPC4XX_TLBHI_SIZE_SHIFT 7
2268#define PPC4XX_TLBHI_SIZE_MASK 0x00000007
2269
2270#define PPC4XX_TLBLO_EX 0x00000200
2271#define PPC4XX_TLBLO_WR 0x00000100
2272#define PPC4XX_TLBLO_ATTR_MASK 0x000000FF
2273#define PPC4XX_TLBLO_RPN_MASK 0xFFFFFC00
2274
c6c7cf05 2275target_ulong helper_4xx_tlbre_hi(CPUPPCState *env, target_ulong entry)
ec19c4d1
BS		 2276{
2277 ppcemb_tlb_t *tlb;
2278 target_ulong ret;
2279 int size;
2280
2281 entry &= PPC4XX_TLB_ENTRY_MASK;
2282 tlb = &env->tlb.tlbe[entry];
2283 ret = tlb->EPN;
2284 if (tlb->prot & PAGE_VALID) {
2285 ret |= PPC4XX_TLBHI_V;
2286 }
2287 size = booke_page_size_to_tlb(tlb->size);
2288 if (size < PPC4XX_TLBHI_SIZE_MIN || size > PPC4XX_TLBHI_SIZE_MAX) {
2289 size = PPC4XX_TLBHI_SIZE_DEFAULT;
2290 }
2291 ret |= size << PPC4XX_TLBHI_SIZE_SHIFT;
2292 env->spr[SPR_40x_PID] = tlb->PID;
2293 return ret;
2294}
2295
c6c7cf05 2296target_ulong helper_4xx_tlbre_lo(CPUPPCState *env, target_ulong entry)
ec19c4d1
BS		 2297{
2298 ppcemb_tlb_t *tlb;
2299 target_ulong ret;
2300
2301 entry &= PPC4XX_TLB_ENTRY_MASK;
2302 tlb = &env->tlb.tlbe[entry];
2303 ret = tlb->RPN;
2304 if (tlb->prot & PAGE_EXEC) {
2305 ret |= PPC4XX_TLBLO_EX;
2306 }
2307 if (tlb->prot & PAGE_WRITE) {
2308 ret |= PPC4XX_TLBLO_WR;
2309 }
2310 return ret;
2311}
2312
c6c7cf05
BS		 2313void helper_4xx_tlbwe_hi(CPUPPCState *env, target_ulong entry,
2314 target_ulong val)
ec19c4d1 2315{
a47dddd7 2316 PowerPCCPU *cpu = ppc_env_get_cpu(env);
31b030d4 2317 CPUState *cs = CPU(cpu);
ec19c4d1
BS		 2318 ppcemb_tlb_t *tlb;
2319 target_ulong page, end;
2320
2321 LOG_SWTLB("%s entry %d val " TARGET_FMT_lx "\n", __func__, (int)entry,
2322 val);
2323 entry &= PPC4XX_TLB_ENTRY_MASK;
2324 tlb = &env->tlb.tlbe[entry];
2325 /* Invalidate previous TLB (if it's valid) */
2326 if (tlb->prot & PAGE_VALID) {
2327 end = tlb->EPN + tlb->size;
2328 LOG_SWTLB("%s: invalidate old TLB %d start " TARGET_FMT_lx " end "
2329 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2330 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
31b030d4 2331 tlb_flush_page(cs, page);
ec19c4d1
BS		 2332 }
2333 }
2334 tlb->size = booke_tlb_to_page_size((val >> PPC4XX_TLBHI_SIZE_SHIFT)
2335 & PPC4XX_TLBHI_SIZE_MASK);
2336 /* We cannot handle TLB size < TARGET_PAGE_SIZE.
2337 * If this ever occurs, one should use the ppcemb target instead
2338 * of the ppc or ppc64 one
2339 */
2340 if ((val & PPC4XX_TLBHI_V) && tlb->size < TARGET_PAGE_SIZE) {
31b030d4 2341 cpu_abort(cs, "TLB size " TARGET_FMT_lu " < %u "
ec19c4d1
BS		 2342 "are not supported (%d)\n",
2343 tlb->size, TARGET_PAGE_SIZE, (int)((val >> 7) & 0x7));
2344 }
2345 tlb->EPN = val & ~(tlb->size - 1);
2346 if (val & PPC4XX_TLBHI_V) {
2347 tlb->prot |= PAGE_VALID;
2348 if (val & PPC4XX_TLBHI_E) {
2349 /* XXX: TO BE FIXED */
31b030d4 2350 cpu_abort(cs,
ec19c4d1
BS		 2351 "Little-endian TLB entries are not supported by now\n");
2352 }
2353 } else {
2354 tlb->prot &= ~PAGE_VALID;
2355 }
2356 tlb->PID = env->spr[SPR_40x_PID]; /* PID */
2357 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2358 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2359 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2360 tlb->prot & PAGE_READ ? 'r' : '-',
2361 tlb->prot & PAGE_WRITE ? 'w' : '-',
2362 tlb->prot & PAGE_EXEC ? 'x' : '-',
2363 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2364 /* Invalidate new TLB (if valid) */
2365 if (tlb->prot & PAGE_VALID) {
2366 end = tlb->EPN + tlb->size;
2367 LOG_SWTLB("%s: invalidate TLB %d start " TARGET_FMT_lx " end "
2368 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end);
2369 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) {
31b030d4 2370 tlb_flush_page(cs, page);
ec19c4d1
BS		 2371 }
2372 }
2373}
2374
c6c7cf05
BS		 2375void helper_4xx_tlbwe_lo(CPUPPCState *env, target_ulong entry,
2376 target_ulong val)
ec19c4d1
BS		 2377{
2378 ppcemb_tlb_t *tlb;
2379
2380 LOG_SWTLB("%s entry %i val " TARGET_FMT_lx "\n", __func__, (int)entry,
2381 val);
2382 entry &= PPC4XX_TLB_ENTRY_MASK;
2383 tlb = &env->tlb.tlbe[entry];
2384 tlb->attr = val & PPC4XX_TLBLO_ATTR_MASK;
2385 tlb->RPN = val & PPC4XX_TLBLO_RPN_MASK;
2386 tlb->prot = PAGE_READ;
2387 if (val & PPC4XX_TLBLO_EX) {
2388 tlb->prot |= PAGE_EXEC;
2389 }
2390 if (val & PPC4XX_TLBLO_WR) {
2391 tlb->prot |= PAGE_WRITE;
2392 }
2393 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
2394 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
2395 (int)entry, tlb->RPN, tlb->EPN, tlb->size,
2396 tlb->prot & PAGE_READ ? 'r' : '-',
2397 tlb->prot & PAGE_WRITE ? 'w' : '-',
2398 tlb->prot & PAGE_EXEC ? 'x' : '-',
2399 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID);
2400}
2401
c6c7cf05 2402target_ulong helper_4xx_tlbsx(CPUPPCState *env, target_ulong address)
ec19c4d1
BS		 2403{
2404 return ppcemb_tlb_search(env, address, env->spr[SPR_40x_PID]);
2405}
2406
2407/* PowerPC 440 TLB management */
c6c7cf05
BS		 2408void helper_440_tlbwe(CPUPPCState *env, uint32_t word, target_ulong entry,
2409 target_ulong value)
ec19c4d1 2410{
00c8cb0a 2411 PowerPCCPU *cpu = ppc_env_get_cpu(env);
ec19c4d1
BS		 2412 ppcemb_tlb_t *tlb;
2413 target_ulong EPN, RPN, size;
2414 int do_flush_tlbs;
2415
2416 LOG_SWTLB("%s word %d entry %d value " TARGET_FMT_lx "\n",
2417 __func__, word, (int)entry, value);
2418 do_flush_tlbs = 0;
2419 entry &= 0x3F;
2420 tlb = &env->tlb.tlbe[entry];
2421 switch (word) {
2422 default:
2423 /* Just here to please gcc */
2424 case 0:
2425 EPN = value & 0xFFFFFC00;
2426 if ((tlb->prot & PAGE_VALID) && EPN != tlb->EPN) {
2427 do_flush_tlbs = 1;
2428 }
2429 tlb->EPN = EPN;
2430 size = booke_tlb_to_page_size((value >> 4) & 0xF);
2431 if ((tlb->prot & PAGE_VALID) && tlb->size < size) {
2432 do_flush_tlbs = 1;
2433 }
2434 tlb->size = size;
2435 tlb->attr &= ~0x1;
2436 tlb->attr |= (value >> 8) & 1;
2437 if (value & 0x200) {
2438 tlb->prot |= PAGE_VALID;
2439 } else {
2440 if (tlb->prot & PAGE_VALID) {
2441 tlb->prot &= ~PAGE_VALID;
2442 do_flush_tlbs = 1;
2443 }
2444 }
2445 tlb->PID = env->spr[SPR_440_MMUCR] & 0x000000FF;
2446 if (do_flush_tlbs) {
d10eb08f 2447 tlb_flush(CPU(cpu));
ec19c4d1
BS		 2448 }
2449 break;
2450 case 1:
2451 RPN = value & 0xFFFFFC0F;
2452 if ((tlb->prot & PAGE_VALID) && tlb->RPN != RPN) {
d10eb08f 2453 tlb_flush(CPU(cpu));
ec19c4d1
BS		 2454 }
2455 tlb->RPN = RPN;
2456 break;
2457 case 2:
2458 tlb->attr = (tlb->attr & 0x1) | (value & 0x0000FF00);
2459 tlb->prot = tlb->prot & PAGE_VALID;
2460 if (value & 0x1) {
2461 tlb->prot |= PAGE_READ << 4;
2462 }
2463 if (value & 0x2) {
2464 tlb->prot |= PAGE_WRITE << 4;
2465 }
2466 if (value & 0x4) {
2467 tlb->prot |= PAGE_EXEC << 4;
2468 }
2469 if (value & 0x8) {
2470 tlb->prot |= PAGE_READ;
2471 }
2472 if (value & 0x10) {
2473 tlb->prot |= PAGE_WRITE;
2474 }
2475 if (value & 0x20) {
2476 tlb->prot |= PAGE_EXEC;
2477 }
2478 break;
2479 }
2480}
2481
c6c7cf05
BS		 2482target_ulong helper_440_tlbre(CPUPPCState *env, uint32_t word,
2483 target_ulong entry)
ec19c4d1
BS		 2484{
2485 ppcemb_tlb_t *tlb;
2486 target_ulong ret;
2487 int size;
2488
2489 entry &= 0x3F;
2490 tlb = &env->tlb.tlbe[entry];
2491 switch (word) {
2492 default:
2493 /* Just here to please gcc */
2494 case 0:
2495 ret = tlb->EPN;
2496 size = booke_page_size_to_tlb(tlb->size);
2497 if (size < 0 || size > 0xF) {
2498 size = 1;
2499 }
2500 ret |= size << 4;
2501 if (tlb->attr & 0x1) {
2502 ret |= 0x100;
2503 }
2504 if (tlb->prot & PAGE_VALID) {
2505 ret |= 0x200;
2506 }
2507 env->spr[SPR_440_MMUCR] &= ~0x000000FF;
2508 env->spr[SPR_440_MMUCR] |= tlb->PID;
2509 break;
2510 case 1:
2511 ret = tlb->RPN;
2512 break;
2513 case 2:
2514 ret = tlb->attr & ~0x1;
2515 if (tlb->prot & (PAGE_READ << 4)) {
2516 ret |= 0x1;
2517 }
2518 if (tlb->prot & (PAGE_WRITE << 4)) {
2519 ret |= 0x2;
2520 }
2521 if (tlb->prot & (PAGE_EXEC << 4)) {
2522 ret |= 0x4;
2523 }
2524 if (tlb->prot & PAGE_READ) {
2525 ret |= 0x8;
2526 }
2527 if (tlb->prot & PAGE_WRITE) {
2528 ret |= 0x10;
2529 }
2530 if (tlb->prot & PAGE_EXEC) {
2531 ret |= 0x20;
2532 }
2533 break;
2534 }
2535 return ret;
2536}
2537
c6c7cf05 2538target_ulong helper_440_tlbsx(CPUPPCState *env, target_ulong address)
ec19c4d1
BS		 2539{
2540 return ppcemb_tlb_search(env, address, env->spr[SPR_440_MMUCR] & 0xFF);
2541}
2542
2543/* PowerPC BookE 2.06 TLB management */
2544
2545static ppcmas_tlb_t *booke206_cur_tlb(CPUPPCState *env)
2546{
a47dddd7 2547 PowerPCCPU *cpu = ppc_env_get_cpu(env);
ec19c4d1
BS		 2548 uint32_t tlbncfg = 0;
2549 int esel = (env->spr[SPR_BOOKE_MAS0] & MAS0_ESEL_MASK) >> MAS0_ESEL_SHIFT;
2550 int ea = (env->spr[SPR_BOOKE_MAS2] & MAS2_EPN_MASK);
2551 int tlb;
2552
2553 tlb = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2554 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlb];
2555
2556 if ((tlbncfg & TLBnCFG_HES) && (env->spr[SPR_BOOKE_MAS0] & MAS0_HES)) {
a47dddd7 2557 cpu_abort(CPU(cpu), "we don't support HES yet\n");
ec19c4d1
BS		 2558 }
2559
2560 return booke206_get_tlbm(env, tlb, ea, esel);
2561}
2562
c6c7cf05 2563void helper_booke_setpid(CPUPPCState *env, uint32_t pidn, target_ulong pid)
ec19c4d1 2564{
00c8cb0a
AF		 2565 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2566
ec19c4d1
BS		 2567 env->spr[pidn] = pid;
2568 /* changing PIDs mean we're in a different address space now */
d10eb08f 2569 tlb_flush(CPU(cpu));
ec19c4d1
BS		 2570}
2571
2e569845
LM		 2572static inline void flush_page(CPUPPCState *env, ppcmas_tlb_t *tlb)
2573{
2574 PowerPCCPU *cpu = ppc_env_get_cpu(env);
2575
2576 if (booke206_tlb_to_page_size(env, tlb) == TARGET_PAGE_SIZE) {
2577 tlb_flush_page(CPU(cpu), tlb->mas2 & MAS2_EPN_MASK);
2578 } else {
2579 tlb_flush(CPU(cpu));
2580 }
2581}
2582
c6c7cf05 2583void helper_booke206_tlbwe(CPUPPCState *env)
ec19c4d1 2584{
a47dddd7 2585 PowerPCCPU *cpu = ppc_env_get_cpu(env);
ec19c4d1
BS		 2586 uint32_t tlbncfg, tlbn;
2587 ppcmas_tlb_t *tlb;
2588 uint32_t size_tlb, size_ps;
77c2cf33
FC		 2589 target_ulong mask;
2590
ec19c4d1
BS		 2591
2592 switch (env->spr[SPR_BOOKE_MAS0] & MAS0_WQ_MASK) {
2593 case MAS0_WQ_ALWAYS:
2594 /* good to go, write that entry */
2595 break;
2596 case MAS0_WQ_COND:
2597 /* XXX check if reserved */
2598 if (0) {
2599 return;
2600 }
2601 break;
2602 case MAS0_WQ_CLR_RSRV:
2603 /* XXX clear entry */
2604 return;
2605 default:
2606 /* no idea what to do */
2607 return;
2608 }
2609
2610 if (((env->spr[SPR_BOOKE_MAS0] & MAS0_ATSEL) == MAS0_ATSEL_LRAT) &&
2611 !msr_gs) {
2612 /* XXX we don't support direct LRAT setting yet */
2613 fprintf(stderr, "cpu: don't support LRAT setting yet\n");
2614 return;
2615 }
2616
2617 tlbn = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT;
2618 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlbn];
2619
2620 tlb = booke206_cur_tlb(env);
2621
2622 if (!tlb) {
8c8966e2
BH		 2623 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
2624 POWERPC_EXCP_INVAL |
2625 POWERPC_EXCP_INVAL_INVAL, GETPC());
ec19c4d1
BS		 2626 }
2627
2628 /* check that we support the targeted size */
2629 size_tlb = (env->spr[SPR_BOOKE_MAS1] & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT;
2630 size_ps = booke206_tlbnps(env, tlbn);
2631 if ((env->spr[SPR_BOOKE_MAS1] & MAS1_VALID) && (tlbncfg & TLBnCFG_AVAIL) &&
2632 !(size_ps & (1 << size_tlb))) {
8c8966e2
BH		 2633 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
2634 POWERPC_EXCP_INVAL |
2635 POWERPC_EXCP_INVAL_INVAL, GETPC());
ec19c4d1
BS		 2636 }
2637
2638 if (msr_gs) {
a47dddd7 2639 cpu_abort(CPU(cpu), "missing HV implementation\n");
ec19c4d1 2640 }
2e569845
LM		 2641
2642 if (tlb->mas1 & MAS1_VALID) {
2643 /* Invalidate the page in QEMU TLB if it was a valid entry.
2644 *
2645 * In "PowerPC e500 Core Family Reference Manual, Rev. 1",
2646 * Section "12.4.2 TLB Write Entry (tlbwe) Instruction":
2647 * (https://www.nxp.com/docs/en/reference-manual/E500CORERM.pdf)
2648 *
2649 * "Note that when an L2 TLB entry is written, it may be displacing an
2650 * already valid entry in the same L2 TLB location (a victim). If a
2651 * valid L1 TLB entry corresponds to the L2 MMU victim entry, that L1
2652 * TLB entry is automatically invalidated." */
2653 flush_page(env, tlb);
2654 }
2655
ec19c4d1
BS		 2656 tlb->mas7_3 = ((uint64_t)env->spr[SPR_BOOKE_MAS7] << 32) |
2657 env->spr[SPR_BOOKE_MAS3];
2658 tlb->mas1 = env->spr[SPR_BOOKE_MAS1];
2659
c449d8ba
KF		 2660 if ((env->spr[SPR_MMUCFG] & MMUCFG_MAVN) == MMUCFG_MAVN_V2) {
2661 /* For TLB which has a fixed size TSIZE is ignored with MAV2 */
2662 booke206_fixed_size_tlbn(env, tlbn, tlb);
2663 } else {
2664 if (!(tlbncfg & TLBnCFG_AVAIL)) {
2665 /* force !AVAIL TLB entries to correct page size */
2666 tlb->mas1 &= ~MAS1_TSIZE_MASK;
2667 /* XXX can be configured in MMUCSR0 */
2668 tlb->mas1 |= (tlbncfg & TLBnCFG_MINSIZE) >> 12;
2669 }
ec19c4d1
BS		 2670 }
2671
77c2cf33
FC		 2672 /* Make a mask from TLB size to discard invalid bits in EPN field */
2673 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2674 /* Add a mask for page attributes */
2675 mask |= MAS2_ACM | MAS2_VLE | MAS2_W | MAS2_I | MAS2_M | MAS2_G | MAS2_E;
2676
2677 if (!msr_cm) {
2678 /* Executing a tlbwe instruction in 32-bit mode will set
2679 * bits 0:31 of the TLB EPN field to zero.
2680 */
2681 mask &= 0xffffffff;
2682 }
2683
2684 tlb->mas2 = env->spr[SPR_BOOKE_MAS2] & mask;
ec19c4d1
BS		 2685
2686 if (!(tlbncfg & TLBnCFG_IPROT)) {
2687 /* no IPROT supported by TLB */
2688 tlb->mas1 &= ~MAS1_IPROT;
2689 }
2690
2e569845 2691 flush_page(env, tlb);
ec19c4d1
BS		 2692}
2693
2694static inline void booke206_tlb_to_mas(CPUPPCState *env, ppcmas_tlb_t *tlb)
2695{
2696 int tlbn = booke206_tlbm_to_tlbn(env, tlb);
2697 int way = booke206_tlbm_to_way(env, tlb);
2698
2699 env->spr[SPR_BOOKE_MAS0] = tlbn << MAS0_TLBSEL_SHIFT;
2700 env->spr[SPR_BOOKE_MAS0] |= way << MAS0_ESEL_SHIFT;
2701 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2702
2703 env->spr[SPR_BOOKE_MAS1] = tlb->mas1;
2704 env->spr[SPR_BOOKE_MAS2] = tlb->mas2;
2705 env->spr[SPR_BOOKE_MAS3] = tlb->mas7_3;
2706 env->spr[SPR_BOOKE_MAS7] = tlb->mas7_3 >> 32;
2707}
2708
c6c7cf05 2709void helper_booke206_tlbre(CPUPPCState *env)
ec19c4d1
BS		 2710{
2711 ppcmas_tlb_t *tlb = NULL;
2712
2713 tlb = booke206_cur_tlb(env);
2714 if (!tlb) {
2715 env->spr[SPR_BOOKE_MAS1] = 0;
2716 } else {
2717 booke206_tlb_to_mas(env, tlb);
2718 }
2719}
2720
c6c7cf05 2721void helper_booke206_tlbsx(CPUPPCState *env, target_ulong address)
ec19c4d1
BS		 2722{
2723 ppcmas_tlb_t *tlb = NULL;
2724 int i, j;
a8170e5e 2725 hwaddr raddr;
ec19c4d1
BS		 2726 uint32_t spid, sas;
2727
2728 spid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID_MASK) >> MAS6_SPID_SHIFT;
2729 sas = env->spr[SPR_BOOKE_MAS6] & MAS6_SAS;
2730
2731 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2732 int ways = booke206_tlb_ways(env, i);
2733
2734 for (j = 0; j < ways; j++) {
2735 tlb = booke206_get_tlbm(env, i, address, j);
2736
2737 if (!tlb) {
2738 continue;
2739 }
2740
2741 if (ppcmas_tlb_check(env, tlb, &raddr, address, spid)) {
2742 continue;
2743 }
2744
2745 if (sas != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) {
2746 continue;
2747 }
2748
2749 booke206_tlb_to_mas(env, tlb);
2750 return;
2751 }
2752 }
2753
2754 /* no entry found, fill with defaults */
2755 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK;
2756 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK;
2757 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK;
2758 env->spr[SPR_BOOKE_MAS3] = 0;
2759 env->spr[SPR_BOOKE_MAS7] = 0;
2760
2761 if (env->spr[SPR_BOOKE_MAS6] & MAS6_SAS) {
2762 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS;
2763 }
2764
2765 env->spr[SPR_BOOKE_MAS1] |= (env->spr[SPR_BOOKE_MAS6] >> 16)
2766 << MAS1_TID_SHIFT;
2767
2768 /* next victim logic */
2769 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT;
2770 env->last_way++;
2771 env->last_way &= booke206_tlb_ways(env, 0) - 1;
2772 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT;
2773}
2774
2775static inline void booke206_invalidate_ea_tlb(CPUPPCState *env, int tlbn,
2776 uint32_t ea)
2777{
2778 int i;
2779 int ways = booke206_tlb_ways(env, tlbn);
2780 target_ulong mask;
2781
2782 for (i = 0; i < ways; i++) {
2783 ppcmas_tlb_t *tlb = booke206_get_tlbm(env, tlbn, ea, i);
2784 if (!tlb) {
2785 continue;
2786 }
2787 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1);
2788 if (((tlb->mas2 & MAS2_EPN_MASK) == (ea & mask)) &&
2789 !(tlb->mas1 & MAS1_IPROT)) {
2790 tlb->mas1 &= ~MAS1_VALID;
2791 }
2792 }
2793}
2794
c6c7cf05 2795void helper_booke206_tlbivax(CPUPPCState *env, target_ulong address)
ec19c4d1 2796{
d76ab5e1 2797 CPUState *cs;
31b030d4 2798
ec19c4d1
BS		 2799 if (address & 0x4) {
2800 /* flush all entries */
2801 if (address & 0x8) {
2802 /* flush all of TLB1 */
2803 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB1, 1);
2804 } else {
2805 /* flush all of TLB0 */
2806 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB0, 0);
2807 }
2808 return;
2809 }
2810
2811 if (address & 0x8) {
2812 /* flush TLB1 entries */
2813 booke206_invalidate_ea_tlb(env, 1, address);
d76ab5e1 2814 CPU_FOREACH(cs) {
d10eb08f 2815 tlb_flush(cs);
d76ab5e1 2816 }
ec19c4d1
BS		 2817 } else {
2818 /* flush TLB0 entries */
2819 booke206_invalidate_ea_tlb(env, 0, address);
d76ab5e1
ND		 2820 CPU_FOREACH(cs) {
2821 tlb_flush_page(cs, address & MAS2_EPN_MASK);
2822 }
ec19c4d1
BS		 2823 }
2824}
2825
c6c7cf05 2826void helper_booke206_tlbilx0(CPUPPCState *env, target_ulong address)
ec19c4d1
BS		 2827{
2828 /* XXX missing LPID handling */
2829 booke206_flush_tlb(env, -1, 1);
2830}
2831
c6c7cf05 2832void helper_booke206_tlbilx1(CPUPPCState *env, target_ulong address)
ec19c4d1 2833{
00c8cb0a 2834 PowerPCCPU *cpu = ppc_env_get_cpu(env);
ec19c4d1
BS		 2835 int i, j;
2836 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
2837 ppcmas_tlb_t *tlb = env->tlb.tlbm;
2838 int tlb_size;
2839
2840 /* XXX missing LPID handling */
2841 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2842 tlb_size = booke206_tlb_size(env, i);
2843 for (j = 0; j < tlb_size; j++) {
2844 if (!(tlb[j].mas1 & MAS1_IPROT) &&
2845 ((tlb[j].mas1 & MAS1_TID_MASK) == tid)) {
2846 tlb[j].mas1 &= ~MAS1_VALID;
2847 }
2848 }
2849 tlb += booke206_tlb_size(env, i);
2850 }
d10eb08f 2851 tlb_flush(CPU(cpu));
ec19c4d1
BS		 2852}
2853
c6c7cf05 2854void helper_booke206_tlbilx3(CPUPPCState *env, target_ulong address)
ec19c4d1 2855{
00c8cb0a 2856 PowerPCCPU *cpu = ppc_env_get_cpu(env);
ec19c4d1
BS		 2857 int i, j;
2858 ppcmas_tlb_t *tlb;
2859 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID);
2860 int pid = tid >> MAS6_SPID_SHIFT;
2861 int sgs = env->spr[SPR_BOOKE_MAS5] & MAS5_SGS;
2862 int ind = (env->spr[SPR_BOOKE_MAS6] & MAS6_SIND) ? MAS1_IND : 0;
2863 /* XXX check for unsupported isize and raise an invalid opcode then */
2864 int size = env->spr[SPR_BOOKE_MAS6] & MAS6_ISIZE_MASK;
2865 /* XXX implement MAV2 handling */
2866 bool mav2 = false;
2867
2868 /* XXX missing LPID handling */
2869 /* flush by pid and ea */
2870 for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
2871 int ways = booke206_tlb_ways(env, i);
2872
2873 for (j = 0; j < ways; j++) {
2874 tlb = booke206_get_tlbm(env, i, address, j);
2875 if (!tlb) {
2876 continue;
2877 }
2878 if ((ppcmas_tlb_check(env, tlb, NULL, address, pid) != 0) ||
2879 (tlb->mas1 & MAS1_IPROT) ||
2880 ((tlb->mas1 & MAS1_IND) != ind) ||
2881 ((tlb->mas8 & MAS8_TGS) != sgs)) {
2882 continue;
2883 }
2884 if (mav2 && ((tlb->mas1 & MAS1_TSIZE_MASK) != size)) {
2885 /* XXX only check when MMUCFG[TWC] || TLBnCFG[HES] */
2886 continue;
2887 }
2888 /* XXX e500mc doesn't match SAS, but other cores might */
2889 tlb->mas1 &= ~MAS1_VALID;
2890 }
2891 }
d10eb08f 2892 tlb_flush(CPU(cpu));
ec19c4d1
BS		 2893}
2894
a721d390 2895void helper_booke206_tlbflush(CPUPPCState *env, target_ulong type)
ec19c4d1
BS		 2896{
2897 int flags = 0;
2898
2899 if (type & 2) {
2900 flags |= BOOKE206_FLUSH_TLB1;
2901 }
2902
2903 if (type & 4) {
2904 flags |= BOOKE206_FLUSH_TLB0;
2905 }
2906
2907 booke206_flush_tlb(env, flags, 1);
2908}
eb20c1c6
DG		 2909
2910
e3cffe6f 2911void helper_check_tlb_flush_local(CPUPPCState *env)
cd0c6f47 2912{
e3cffe6f
ND		 2913 check_tlb_flush(env, false);
2914}
2915
2916void helper_check_tlb_flush_global(CPUPPCState *env)
2917{
2918 check_tlb_flush(env, true);
cd0c6f47
BH		 2919}
2920
eb20c1c6
DG		 2921/*****************************************************************************/
2922
eb20c1c6
DG		 2923/* try to fill the TLB and return an exception if error. If retaddr is
2924 NULL, it means that the function was called in C code (i.e. not
2925 from generated code or from helper.c) */
2926/* XXX: fix it to restore all registers */
98670d47
LV		 2927void tlb_fill(CPUState *cs, target_ulong addr, int size,
2928 MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
eb20c1c6 2929{
d5a11fef
AF		 2930 PowerPCCPU *cpu = POWERPC_CPU(cs);
2931 PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cs);
2932 CPUPPCState *env = &cpu->env;
eb20c1c6
DG		 2933 int ret;
2934
b632a148 2935 if (pcc->handle_mmu_fault) {
b35399bb 2936 ret = pcc->handle_mmu_fault(cpu, addr, access_type, mmu_idx);
b632a148 2937 } else {
b35399bb 2938 ret = cpu_ppc_handle_mmu_fault(env, addr, access_type, mmu_idx);
b632a148 2939 }
eb20c1c6 2940 if (unlikely(ret != 0)) {
bd6fefe7
BH		 2941 raise_exception_err_ra(env, cs->exception_index, env->error_code,
2942 retaddr);
eb20c1c6
DG		 2943 }
2944}
Empty description
This page took 0.784152 seconds and 4 git commands to generate.