xref: /openbmc/qemu/target/ppc/excp_helper.c (revision e0091133)
1 /*
2  *  PowerPC exception emulation helpers for QEMU.
3  *
4  *  Copyright (c) 2003-2007 Jocelyn Mayer
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  */
19 #include "qemu/osdep.h"
20 #include "qemu/main-loop.h"
21 #include "qemu/log.h"
22 #include "cpu.h"
23 #include "exec/exec-all.h"
24 #include "internal.h"
25 #include "helper_regs.h"
26 #include "hw/ppc/ppc.h"
27 
28 #include "trace.h"
29 
30 #ifdef CONFIG_TCG
31 #include "exec/helper-proto.h"
32 #include "exec/cpu_ldst.h"
33 #endif
34 
35 /*****************************************************************************/
36 /* Exception processing */
37 #if !defined(CONFIG_USER_ONLY)
38 
39 static const char *powerpc_excp_name(int excp)
40 {
41     switch (excp) {
42     case POWERPC_EXCP_CRITICAL: return "CRITICAL";
43     case POWERPC_EXCP_MCHECK:   return "MCHECK";
44     case POWERPC_EXCP_DSI:      return "DSI";
45     case POWERPC_EXCP_ISI:      return "ISI";
46     case POWERPC_EXCP_EXTERNAL: return "EXTERNAL";
47     case POWERPC_EXCP_ALIGN:    return "ALIGN";
48     case POWERPC_EXCP_PROGRAM:  return "PROGRAM";
49     case POWERPC_EXCP_FPU:      return "FPU";
50     case POWERPC_EXCP_SYSCALL:  return "SYSCALL";
51     case POWERPC_EXCP_APU:      return "APU";
52     case POWERPC_EXCP_DECR:     return "DECR";
53     case POWERPC_EXCP_FIT:      return "FIT";
54     case POWERPC_EXCP_WDT:      return "WDT";
55     case POWERPC_EXCP_DTLB:     return "DTLB";
56     case POWERPC_EXCP_ITLB:     return "ITLB";
57     case POWERPC_EXCP_DEBUG:    return "DEBUG";
58     case POWERPC_EXCP_SPEU:     return "SPEU";
59     case POWERPC_EXCP_EFPDI:    return "EFPDI";
60     case POWERPC_EXCP_EFPRI:    return "EFPRI";
61     case POWERPC_EXCP_EPERFM:   return "EPERFM";
62     case POWERPC_EXCP_DOORI:    return "DOORI";
63     case POWERPC_EXCP_DOORCI:   return "DOORCI";
64     case POWERPC_EXCP_GDOORI:   return "GDOORI";
65     case POWERPC_EXCP_GDOORCI:  return "GDOORCI";
66     case POWERPC_EXCP_HYPPRIV:  return "HYPPRIV";
67     case POWERPC_EXCP_RESET:    return "RESET";
68     case POWERPC_EXCP_DSEG:     return "DSEG";
69     case POWERPC_EXCP_ISEG:     return "ISEG";
70     case POWERPC_EXCP_HDECR:    return "HDECR";
71     case POWERPC_EXCP_TRACE:    return "TRACE";
72     case POWERPC_EXCP_HDSI:     return "HDSI";
73     case POWERPC_EXCP_HISI:     return "HISI";
74     case POWERPC_EXCP_HDSEG:    return "HDSEG";
75     case POWERPC_EXCP_HISEG:    return "HISEG";
76     case POWERPC_EXCP_VPU:      return "VPU";
77     case POWERPC_EXCP_PIT:      return "PIT";
78     case POWERPC_EXCP_EMUL:     return "EMUL";
79     case POWERPC_EXCP_IFTLB:    return "IFTLB";
80     case POWERPC_EXCP_DLTLB:    return "DLTLB";
81     case POWERPC_EXCP_DSTLB:    return "DSTLB";
82     case POWERPC_EXCP_FPA:      return "FPA";
83     case POWERPC_EXCP_DABR:     return "DABR";
84     case POWERPC_EXCP_IABR:     return "IABR";
85     case POWERPC_EXCP_SMI:      return "SMI";
86     case POWERPC_EXCP_PERFM:    return "PERFM";
87     case POWERPC_EXCP_THERM:    return "THERM";
88     case POWERPC_EXCP_VPUA:     return "VPUA";
89     case POWERPC_EXCP_SOFTP:    return "SOFTP";
90     case POWERPC_EXCP_MAINT:    return "MAINT";
91     case POWERPC_EXCP_MEXTBR:   return "MEXTBR";
92     case POWERPC_EXCP_NMEXTBR:  return "NMEXTBR";
93     case POWERPC_EXCP_ITLBE:    return "ITLBE";
94     case POWERPC_EXCP_DTLBE:    return "DTLBE";
95     case POWERPC_EXCP_VSXU:     return "VSXU";
96     case POWERPC_EXCP_FU:       return "FU";
97     case POWERPC_EXCP_HV_EMU:   return "HV_EMU";
98     case POWERPC_EXCP_HV_MAINT: return "HV_MAINT";
99     case POWERPC_EXCP_HV_FU:    return "HV_FU";
100     case POWERPC_EXCP_SDOOR:    return "SDOOR";
101     case POWERPC_EXCP_SDOOR_HV: return "SDOOR_HV";
102     case POWERPC_EXCP_HVIRT:    return "HVIRT";
103     case POWERPC_EXCP_SYSCALL_VECTORED: return "SYSCALL_VECTORED";
104     default:
105         g_assert_not_reached();
106     }
107 }
108 
109 static void dump_syscall(CPUPPCState *env)
110 {
111     qemu_log_mask(CPU_LOG_INT, "syscall r0=%016" PRIx64
112                   " r3=%016" PRIx64 " r4=%016" PRIx64 " r5=%016" PRIx64
113                   " r6=%016" PRIx64 " r7=%016" PRIx64 " r8=%016" PRIx64
114                   " nip=" TARGET_FMT_lx "\n",
115                   ppc_dump_gpr(env, 0), ppc_dump_gpr(env, 3),
116                   ppc_dump_gpr(env, 4), ppc_dump_gpr(env, 5),
117                   ppc_dump_gpr(env, 6), ppc_dump_gpr(env, 7),
118                   ppc_dump_gpr(env, 8), env->nip);
119 }
120 
121 static void dump_hcall(CPUPPCState *env)
122 {
123     qemu_log_mask(CPU_LOG_INT, "hypercall r3=%016" PRIx64
124                   " r4=%016" PRIx64 " r5=%016" PRIx64 " r6=%016" PRIx64
125                   " r7=%016" PRIx64 " r8=%016" PRIx64 " r9=%016" PRIx64
126                   " r10=%016" PRIx64 " r11=%016" PRIx64 " r12=%016" PRIx64
127                   " nip=" TARGET_FMT_lx "\n",
128                   ppc_dump_gpr(env, 3), ppc_dump_gpr(env, 4),
129                   ppc_dump_gpr(env, 5), ppc_dump_gpr(env, 6),
130                   ppc_dump_gpr(env, 7), ppc_dump_gpr(env, 8),
131                   ppc_dump_gpr(env, 9), ppc_dump_gpr(env, 10),
132                   ppc_dump_gpr(env, 11), ppc_dump_gpr(env, 12),
133                   env->nip);
134 }
135 
136 static void ppc_excp_debug_sw_tlb(CPUPPCState *env, int excp)
137 {
138     const char *es;
139     target_ulong *miss, *cmp;
140     int en;
141 
142     if (!qemu_loglevel_mask(CPU_LOG_MMU)) {
143         return;
144     }
145 
146     if (excp == POWERPC_EXCP_IFTLB) {
147         es = "I";
148         en = 'I';
149         miss = &env->spr[SPR_IMISS];
150         cmp = &env->spr[SPR_ICMP];
151     } else {
152         if (excp == POWERPC_EXCP_DLTLB) {
153             es = "DL";
154         } else {
155             es = "DS";
156         }
157         en = 'D';
158         miss = &env->spr[SPR_DMISS];
159         cmp = &env->spr[SPR_DCMP];
160     }
161     qemu_log("6xx %sTLB miss: %cM " TARGET_FMT_lx " %cC "
162              TARGET_FMT_lx " H1 " TARGET_FMT_lx " H2 "
163              TARGET_FMT_lx " %08x\n", es, en, *miss, en, *cmp,
164              env->spr[SPR_HASH1], env->spr[SPR_HASH2],
165              env->error_code);
166 }
167 
168 #if defined(TARGET_PPC64)
169 static int powerpc_reset_wakeup(CPUState *cs, CPUPPCState *env, int excp,
170                                 target_ulong *msr)
171 {
172     /* We no longer are in a PM state */
173     env->resume_as_sreset = false;
174 
175     /* Pretend to be returning from doze always as we don't lose state */
176     *msr |= SRR1_WS_NOLOSS;
177 
178     /* Machine checks are sent normally */
179     if (excp == POWERPC_EXCP_MCHECK) {
180         return excp;
181     }
182     switch (excp) {
183     case POWERPC_EXCP_RESET:
184         *msr |= SRR1_WAKERESET;
185         break;
186     case POWERPC_EXCP_EXTERNAL:
187         *msr |= SRR1_WAKEEE;
188         break;
189     case POWERPC_EXCP_DECR:
190         *msr |= SRR1_WAKEDEC;
191         break;
192     case POWERPC_EXCP_SDOOR:
193         *msr |= SRR1_WAKEDBELL;
194         break;
195     case POWERPC_EXCP_SDOOR_HV:
196         *msr |= SRR1_WAKEHDBELL;
197         break;
198     case POWERPC_EXCP_HV_MAINT:
199         *msr |= SRR1_WAKEHMI;
200         break;
201     case POWERPC_EXCP_HVIRT:
202         *msr |= SRR1_WAKEHVI;
203         break;
204     default:
205         cpu_abort(cs, "Unsupported exception %d in Power Save mode\n",
206                   excp);
207     }
208     return POWERPC_EXCP_RESET;
209 }
210 
211 /*
212  * AIL - Alternate Interrupt Location, a mode that allows interrupts to be
213  * taken with the MMU on, and which uses an alternate location (e.g., so the
214  * kernel/hv can map the vectors there with an effective address).
215  *
216  * An interrupt is considered to be taken "with AIL" or "AIL applies" if they
217  * are delivered in this way. AIL requires the LPCR to be set to enable this
218  * mode, and then a number of conditions have to be true for AIL to apply.
219  *
220  * First of all, SRESET, MCE, and HMI are always delivered without AIL, because
221  * they specifically want to be in real mode (e.g., the MCE might be signaling
222  * a SLB multi-hit which requires SLB flush before the MMU can be enabled).
223  *
224  * After that, behaviour depends on the current MSR[IR], MSR[DR], MSR[HV],
225  * whether or not the interrupt changes MSR[HV] from 0 to 1, and the current
226  * radix mode (LPCR[HR]).
227  *
228  * POWER8, POWER9 with LPCR[HR]=0
229  * | LPCR[AIL] | MSR[IR||DR] | MSR[HV] | new MSR[HV] | AIL |
230  * +-----------+-------------+---------+-------------+-----+
231  * | a         | 00/01/10    | x       | x           | 0   |
232  * | a         | 11          | 0       | 1           | 0   |
233  * | a         | 11          | 1       | 1           | a   |
234  * | a         | 11          | 0       | 0           | a   |
235  * +-------------------------------------------------------+
236  *
237  * POWER9 with LPCR[HR]=1
238  * | LPCR[AIL] | MSR[IR||DR] | MSR[HV] | new MSR[HV] | AIL |
239  * +-----------+-------------+---------+-------------+-----+
240  * | a         | 00/01/10    | x       | x           | 0   |
241  * | a         | 11          | x       | x           | a   |
242  * +-------------------------------------------------------+
243  *
244  * The difference with POWER9 being that MSR[HV] 0->1 interrupts can be sent to
245  * the hypervisor in AIL mode if the guest is radix. This is good for
246  * performance but allows the guest to influence the AIL of hypervisor
247  * interrupts using its MSR, and also the hypervisor must disallow guest
248  * interrupts (MSR[HV] 0->0) from using AIL if the hypervisor does not want to
249  * use AIL for its MSR[HV] 0->1 interrupts.
250  *
251  * POWER10 addresses those issues with a new LPCR[HAIL] bit that is applied to
252  * interrupts that begin execution with MSR[HV]=1 (so both MSR[HV] 0->1 and
253  * MSR[HV] 1->1).
254  *
255  * HAIL=1 is equivalent to AIL=3, for interrupts delivered with MSR[HV]=1.
256  *
257  * POWER10 behaviour is
258  * | LPCR[AIL] | LPCR[HAIL] | MSR[IR||DR] | MSR[HV] | new MSR[HV] | AIL |
259  * +-----------+------------+-------------+---------+-------------+-----+
260  * | a         | h          | 00/01/10    | 0       | 0           | 0   |
261  * | a         | h          | 11          | 0       | 0           | a   |
262  * | a         | h          | x           | 0       | 1           | h   |
263  * | a         | h          | 00/01/10    | 1       | 1           | 0   |
264  * | a         | h          | 11          | 1       | 1           | h   |
265  * +--------------------------------------------------------------------+
266  */
267 static void ppc_excp_apply_ail(PowerPCCPU *cpu, int excp, target_ulong msr,
268                                target_ulong *new_msr, target_ulong *vector)
269 {
270     PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
271     CPUPPCState *env = &cpu->env;
272     bool mmu_all_on = ((msr >> MSR_IR) & 1) && ((msr >> MSR_DR) & 1);
273     bool hv_escalation = !(msr & MSR_HVB) && (*new_msr & MSR_HVB);
274     int ail = 0;
275 
276     if (excp == POWERPC_EXCP_MCHECK ||
277         excp == POWERPC_EXCP_RESET ||
278         excp == POWERPC_EXCP_HV_MAINT) {
279         /* SRESET, MCE, HMI never apply AIL */
280         return;
281     }
282 
283     if (!(pcc->lpcr_mask & LPCR_AIL)) {
284         /* This CPU does not have AIL */
285         return;
286     }
287 
288     /* P8 & P9 */
289     if (!(pcc->lpcr_mask & LPCR_HAIL)) {
290         if (!mmu_all_on) {
291             /* AIL only works if MSR[IR] and MSR[DR] are both enabled. */
292             return;
293         }
294         if (hv_escalation && !(env->spr[SPR_LPCR] & LPCR_HR)) {
295             /*
296              * AIL does not work if there is a MSR[HV] 0->1 transition and the
297              * partition is in HPT mode. For radix guests, such interrupts are
298              * allowed to be delivered to the hypervisor in ail mode.
299              */
300             return;
301         }
302 
303         ail = (env->spr[SPR_LPCR] & LPCR_AIL) >> LPCR_AIL_SHIFT;
304         if (ail == 0) {
305             return;
306         }
307         if (ail == 1) {
308             /* AIL=1 is reserved, treat it like AIL=0 */
309             return;
310         }
311 
312     /* P10 and up */
313     } else {
314         if (!mmu_all_on && !hv_escalation) {
315             /*
316              * AIL works for HV interrupts even with guest MSR[IR/DR] disabled.
317              * Guest->guest and HV->HV interrupts do require MMU on.
318              */
319             return;
320         }
321 
322         if (*new_msr & MSR_HVB) {
323             if (!(env->spr[SPR_LPCR] & LPCR_HAIL)) {
324                 /* HV interrupts depend on LPCR[HAIL] */
325                 return;
326             }
327             ail = 3; /* HAIL=1 gives AIL=3 behaviour for HV interrupts */
328         } else {
329             ail = (env->spr[SPR_LPCR] & LPCR_AIL) >> LPCR_AIL_SHIFT;
330         }
331         if (ail == 0) {
332             return;
333         }
334         if (ail == 1 || ail == 2) {
335             /* AIL=1 and AIL=2 are reserved, treat them like AIL=0 */
336             return;
337         }
338     }
339 
340     /*
341      * AIL applies, so the new MSR gets IR and DR set, and an offset applied
342      * to the new IP.
343      */
344     *new_msr |= (1 << MSR_IR) | (1 << MSR_DR);
345 
346     if (excp != POWERPC_EXCP_SYSCALL_VECTORED) {
347         if (ail == 2) {
348             *vector |= 0x0000000000018000ull;
349         } else if (ail == 3) {
350             *vector |= 0xc000000000004000ull;
351         }
352     } else {
353         /*
354          * scv AIL is a little different. AIL=2 does not change the address,
355          * only the MSR. AIL=3 replaces the 0x17000 base with 0xc...3000.
356          */
357         if (ail == 3) {
358             *vector &= ~0x0000000000017000ull; /* Un-apply the base offset */
359             *vector |= 0xc000000000003000ull; /* Apply scv's AIL=3 offset */
360         }
361     }
362 }
363 #endif
364 
365 static void powerpc_reset_excp_state(PowerPCCPU *cpu)
366 {
367     CPUState *cs = CPU(cpu);
368     CPUPPCState *env = &cpu->env;
369 
370     /* Reset exception state */
371     cs->exception_index = POWERPC_EXCP_NONE;
372     env->error_code = 0;
373 }
374 
375 static void powerpc_set_excp_state(PowerPCCPU *cpu, target_ulong vector,
376                                    target_ulong msr)
377 {
378     CPUPPCState *env = &cpu->env;
379 
380     assert((msr & env->msr_mask) == msr);
381 
382     /*
383      * We don't use hreg_store_msr here as already have treated any
384      * special case that could occur. Just store MSR and update hflags
385      *
386      * Note: We *MUST* not use hreg_store_msr() as-is anyway because it
387      * will prevent setting of the HV bit which some exceptions might need
388      * to do.
389      */
390     env->nip = vector;
391     env->msr = msr;
392     hreg_compute_hflags(env);
393     ppc_maybe_interrupt(env);
394 
395     powerpc_reset_excp_state(cpu);
396 
397     /*
398      * Any interrupt is context synchronizing, check if TCG TLB needs
399      * a delayed flush on ppc64
400      */
401     check_tlb_flush(env, false);
402 
403     /* Reset the reservation */
404     env->reserve_addr = -1;
405 }
406 
407 static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
408 {
409     CPUState *cs = CPU(cpu);
410     CPUPPCState *env = &cpu->env;
411     target_ulong msr, new_msr, vector;
412     int srr0, srr1;
413 
414     /* new srr1 value excluding must-be-zero bits */
415     msr = env->msr & ~0x783f0000ULL;
416 
417     /*
418      * new interrupt handler msr preserves existing ME unless
419      * explicitly overriden.
420      */
421     new_msr = env->msr & (((target_ulong)1 << MSR_ME));
422 
423     /* target registers */
424     srr0 = SPR_SRR0;
425     srr1 = SPR_SRR1;
426 
427     /*
428      * Hypervisor emulation assistance interrupt only exists on server
429      * arch 2.05 server or later.
430      */
431     if (excp == POWERPC_EXCP_HV_EMU) {
432         excp = POWERPC_EXCP_PROGRAM;
433     }
434 
435     vector = env->excp_vectors[excp];
436     if (vector == (target_ulong)-1ULL) {
437         cpu_abort(cs, "Raised an exception without defined vector %d\n",
438                   excp);
439     }
440 
441     vector |= env->excp_prefix;
442 
443     switch (excp) {
444     case POWERPC_EXCP_CRITICAL:    /* Critical input                         */
445         srr0 = SPR_40x_SRR2;
446         srr1 = SPR_40x_SRR3;
447         break;
448     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
449         if (!FIELD_EX64(env->msr, MSR, ME)) {
450             /*
451              * Machine check exception is not enabled.  Enter
452              * checkstop state.
453              */
454             fprintf(stderr, "Machine check while not allowed. "
455                     "Entering checkstop state\n");
456             if (qemu_log_separate()) {
457                 qemu_log("Machine check while not allowed. "
458                         "Entering checkstop state\n");
459             }
460             cs->halted = 1;
461             cpu_interrupt_exittb(cs);
462         }
463 
464         /* machine check exceptions don't have ME set */
465         new_msr &= ~((target_ulong)1 << MSR_ME);
466 
467         srr0 = SPR_40x_SRR2;
468         srr1 = SPR_40x_SRR3;
469         break;
470     case POWERPC_EXCP_DSI:       /* Data storage exception                   */
471         trace_ppc_excp_dsi(env->spr[SPR_40x_ESR], env->spr[SPR_40x_DEAR]);
472         break;
473     case POWERPC_EXCP_ISI:       /* Instruction storage exception            */
474         trace_ppc_excp_isi(msr, env->nip);
475         break;
476     case POWERPC_EXCP_EXTERNAL:  /* External input                           */
477         break;
478     case POWERPC_EXCP_ALIGN:     /* Alignment exception                      */
479         break;
480     case POWERPC_EXCP_PROGRAM:   /* Program exception                        */
481         switch (env->error_code & ~0xF) {
482         case POWERPC_EXCP_FP:
483             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
484                 trace_ppc_excp_fp_ignore();
485                 powerpc_reset_excp_state(cpu);
486                 return;
487             }
488             env->spr[SPR_40x_ESR] = ESR_FP;
489             break;
490         case POWERPC_EXCP_INVAL:
491             trace_ppc_excp_inval(env->nip);
492             env->spr[SPR_40x_ESR] = ESR_PIL;
493             break;
494         case POWERPC_EXCP_PRIV:
495             env->spr[SPR_40x_ESR] = ESR_PPR;
496             break;
497         case POWERPC_EXCP_TRAP:
498             env->spr[SPR_40x_ESR] = ESR_PTR;
499             break;
500         default:
501             cpu_abort(cs, "Invalid program exception %d. Aborting\n",
502                       env->error_code);
503             break;
504         }
505         break;
506     case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
507         dump_syscall(env);
508 
509         /*
510          * We need to correct the NIP which in this case is supposed
511          * to point to the next instruction
512          */
513         env->nip += 4;
514         break;
515     case POWERPC_EXCP_FIT:       /* Fixed-interval timer interrupt           */
516         trace_ppc_excp_print("FIT");
517         break;
518     case POWERPC_EXCP_WDT:       /* Watchdog timer interrupt                 */
519         trace_ppc_excp_print("WDT");
520         break;
521     case POWERPC_EXCP_DTLB:      /* Data TLB error                           */
522     case POWERPC_EXCP_ITLB:      /* Instruction TLB error                    */
523         break;
524     case POWERPC_EXCP_PIT:       /* Programmable interval timer interrupt    */
525         trace_ppc_excp_print("PIT");
526         break;
527     case POWERPC_EXCP_DEBUG:     /* Debug interrupt                          */
528         cpu_abort(cs, "%s exception not implemented\n",
529                   powerpc_excp_name(excp));
530         break;
531     default:
532         cpu_abort(cs, "Invalid PowerPC exception %d. Aborting\n", excp);
533         break;
534     }
535 
536     /* Save PC */
537     env->spr[srr0] = env->nip;
538 
539     /* Save MSR */
540     env->spr[srr1] = msr;
541 
542     powerpc_set_excp_state(cpu, vector, new_msr);
543 }
544 
545 static void powerpc_excp_6xx(PowerPCCPU *cpu, int excp)
546 {
547     CPUState *cs = CPU(cpu);
548     CPUPPCState *env = &cpu->env;
549     target_ulong msr, new_msr, vector;
550 
551     /* new srr1 value excluding must-be-zero bits */
552     msr = env->msr & ~0x783f0000ULL;
553 
554     /*
555      * new interrupt handler msr preserves existing ME unless
556      * explicitly overriden
557      */
558     new_msr = env->msr & ((target_ulong)1 << MSR_ME);
559 
560     /*
561      * Hypervisor emulation assistance interrupt only exists on server
562      * arch 2.05 server or later.
563      */
564     if (excp == POWERPC_EXCP_HV_EMU) {
565         excp = POWERPC_EXCP_PROGRAM;
566     }
567 
568     vector = env->excp_vectors[excp];
569     if (vector == (target_ulong)-1ULL) {
570         cpu_abort(cs, "Raised an exception without defined vector %d\n",
571                   excp);
572     }
573 
574     vector |= env->excp_prefix;
575 
576     switch (excp) {
577     case POWERPC_EXCP_CRITICAL:    /* Critical input                         */
578         break;
579     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
580         if (!FIELD_EX64(env->msr, MSR, ME)) {
581             /*
582              * Machine check exception is not enabled.  Enter
583              * checkstop state.
584              */
585             fprintf(stderr, "Machine check while not allowed. "
586                     "Entering checkstop state\n");
587             if (qemu_log_separate()) {
588                 qemu_log("Machine check while not allowed. "
589                         "Entering checkstop state\n");
590             }
591             cs->halted = 1;
592             cpu_interrupt_exittb(cs);
593         }
594 
595         /* machine check exceptions don't have ME set */
596         new_msr &= ~((target_ulong)1 << MSR_ME);
597 
598         break;
599     case POWERPC_EXCP_DSI:       /* Data storage exception                   */
600         trace_ppc_excp_dsi(env->spr[SPR_DSISR], env->spr[SPR_DAR]);
601         break;
602     case POWERPC_EXCP_ISI:       /* Instruction storage exception            */
603         trace_ppc_excp_isi(msr, env->nip);
604         msr |= env->error_code;
605         break;
606     case POWERPC_EXCP_EXTERNAL:  /* External input                           */
607         break;
608     case POWERPC_EXCP_ALIGN:     /* Alignment exception                      */
609         /* Get rS/rD and rA from faulting opcode */
610         /*
611          * Note: the opcode fields will not be set properly for a
612          * direct store load/store, but nobody cares as nobody
613          * actually uses direct store segments.
614          */
615         env->spr[SPR_DSISR] |= (env->error_code & 0x03FF0000) >> 16;
616         break;
617     case POWERPC_EXCP_PROGRAM:   /* Program exception                        */
618         switch (env->error_code & ~0xF) {
619         case POWERPC_EXCP_FP:
620             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
621                 trace_ppc_excp_fp_ignore();
622                 powerpc_reset_excp_state(cpu);
623                 return;
624             }
625 
626             /*
627              * FP exceptions always have NIP pointing to the faulting
628              * instruction, so always use store_next and claim we are
629              * precise in the MSR.
630              */
631             msr |= 0x00100000;
632             break;
633         case POWERPC_EXCP_INVAL:
634             trace_ppc_excp_inval(env->nip);
635             msr |= 0x00080000;
636             break;
637         case POWERPC_EXCP_PRIV:
638             msr |= 0x00040000;
639             break;
640         case POWERPC_EXCP_TRAP:
641             msr |= 0x00020000;
642             break;
643         default:
644             /* Should never occur */
645             cpu_abort(cs, "Invalid program exception %d. Aborting\n",
646                       env->error_code);
647             break;
648         }
649         break;
650     case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
651         dump_syscall(env);
652 
653         /*
654          * We need to correct the NIP which in this case is supposed
655          * to point to the next instruction
656          */
657         env->nip += 4;
658         break;
659     case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
660     case POWERPC_EXCP_DECR:      /* Decrementer exception                    */
661         break;
662     case POWERPC_EXCP_DTLB:      /* Data TLB error                           */
663     case POWERPC_EXCP_ITLB:      /* Instruction TLB error                    */
664         break;
665     case POWERPC_EXCP_RESET:     /* System reset exception                   */
666         if (FIELD_EX64(env->msr, MSR, POW)) {
667             cpu_abort(cs, "Trying to deliver power-saving system reset "
668                       "exception %d with no HV support\n", excp);
669         }
670         break;
671     case POWERPC_EXCP_TRACE:     /* Trace exception                          */
672         break;
673     case POWERPC_EXCP_IFTLB:     /* Instruction fetch TLB error              */
674     case POWERPC_EXCP_DLTLB:     /* Data load TLB miss                       */
675     case POWERPC_EXCP_DSTLB:     /* Data store TLB miss                      */
676         /* Swap temporary saved registers with GPRs */
677         if (!(new_msr & ((target_ulong)1 << MSR_TGPR))) {
678             new_msr |= (target_ulong)1 << MSR_TGPR;
679             hreg_swap_gpr_tgpr(env);
680         }
681 
682         ppc_excp_debug_sw_tlb(env, excp);
683 
684         msr |= env->crf[0] << 28;
685         msr |= env->error_code; /* key, D/I, S/L bits */
686         /* Set way using a LRU mechanism */
687         msr |= ((env->last_way + 1) & (env->nb_ways - 1)) << 17;
688         break;
689     case POWERPC_EXCP_FPA:       /* Floating-point assist exception          */
690     case POWERPC_EXCP_DABR:      /* Data address breakpoint                  */
691     case POWERPC_EXCP_IABR:      /* Instruction address breakpoint           */
692     case POWERPC_EXCP_SMI:       /* System management interrupt              */
693     case POWERPC_EXCP_MEXTBR:    /* Maskable external breakpoint             */
694     case POWERPC_EXCP_NMEXTBR:   /* Non maskable external breakpoint         */
695         cpu_abort(cs, "%s exception not implemented\n",
696                   powerpc_excp_name(excp));
697         break;
698     default:
699         cpu_abort(cs, "Invalid PowerPC exception %d. Aborting\n", excp);
700         break;
701     }
702 
703     /*
704      * Sort out endianness of interrupt, this differs depending on the
705      * CPU, the HV mode, etc...
706      */
707     if (ppc_interrupts_little_endian(cpu, !!(new_msr & MSR_HVB))) {
708         new_msr |= (target_ulong)1 << MSR_LE;
709     }
710 
711     /* Save PC */
712     env->spr[SPR_SRR0] = env->nip;
713 
714     /* Save MSR */
715     env->spr[SPR_SRR1] = msr;
716 
717     powerpc_set_excp_state(cpu, vector, new_msr);
718 }
719 
720 static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
721 {
722     CPUState *cs = CPU(cpu);
723     CPUPPCState *env = &cpu->env;
724     target_ulong msr, new_msr, vector;
725 
726     /* new srr1 value excluding must-be-zero bits */
727     msr = env->msr & ~0x783f0000ULL;
728 
729     /*
730      * new interrupt handler msr preserves existing ME unless
731      * explicitly overriden
732      */
733     new_msr = env->msr & ((target_ulong)1 << MSR_ME);
734 
735     /*
736      * Hypervisor emulation assistance interrupt only exists on server
737      * arch 2.05 server or later.
738      */
739     if (excp == POWERPC_EXCP_HV_EMU) {
740         excp = POWERPC_EXCP_PROGRAM;
741     }
742 
743     vector = env->excp_vectors[excp];
744     if (vector == (target_ulong)-1ULL) {
745         cpu_abort(cs, "Raised an exception without defined vector %d\n",
746                   excp);
747     }
748 
749     vector |= env->excp_prefix;
750 
751     switch (excp) {
752     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
753         if (!FIELD_EX64(env->msr, MSR, ME)) {
754             /*
755              * Machine check exception is not enabled.  Enter
756              * checkstop state.
757              */
758             fprintf(stderr, "Machine check while not allowed. "
759                     "Entering checkstop state\n");
760             if (qemu_log_separate()) {
761                 qemu_log("Machine check while not allowed. "
762                         "Entering checkstop state\n");
763             }
764             cs->halted = 1;
765             cpu_interrupt_exittb(cs);
766         }
767 
768         /* machine check exceptions don't have ME set */
769         new_msr &= ~((target_ulong)1 << MSR_ME);
770 
771         break;
772     case POWERPC_EXCP_DSI:       /* Data storage exception                   */
773         trace_ppc_excp_dsi(env->spr[SPR_DSISR], env->spr[SPR_DAR]);
774         break;
775     case POWERPC_EXCP_ISI:       /* Instruction storage exception            */
776         trace_ppc_excp_isi(msr, env->nip);
777         msr |= env->error_code;
778         break;
779     case POWERPC_EXCP_EXTERNAL:  /* External input                           */
780         break;
781     case POWERPC_EXCP_ALIGN:     /* Alignment exception                      */
782         /* Get rS/rD and rA from faulting opcode */
783         /*
784          * Note: the opcode fields will not be set properly for a
785          * direct store load/store, but nobody cares as nobody
786          * actually uses direct store segments.
787          */
788         env->spr[SPR_DSISR] |= (env->error_code & 0x03FF0000) >> 16;
789         break;
790     case POWERPC_EXCP_PROGRAM:   /* Program exception                        */
791         switch (env->error_code & ~0xF) {
792         case POWERPC_EXCP_FP:
793             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
794                 trace_ppc_excp_fp_ignore();
795                 powerpc_reset_excp_state(cpu);
796                 return;
797             }
798 
799             /*
800              * FP exceptions always have NIP pointing to the faulting
801              * instruction, so always use store_next and claim we are
802              * precise in the MSR.
803              */
804             msr |= 0x00100000;
805             break;
806         case POWERPC_EXCP_INVAL:
807             trace_ppc_excp_inval(env->nip);
808             msr |= 0x00080000;
809             break;
810         case POWERPC_EXCP_PRIV:
811             msr |= 0x00040000;
812             break;
813         case POWERPC_EXCP_TRAP:
814             msr |= 0x00020000;
815             break;
816         default:
817             /* Should never occur */
818             cpu_abort(cs, "Invalid program exception %d. Aborting\n",
819                       env->error_code);
820             break;
821         }
822         break;
823     case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
824     {
825         int lev = env->error_code;
826 
827         if (lev == 1 && cpu->vhyp) {
828             dump_hcall(env);
829         } else {
830             dump_syscall(env);
831         }
832 
833         /*
834          * We need to correct the NIP which in this case is supposed
835          * to point to the next instruction
836          */
837         env->nip += 4;
838 
839         /*
840          * The Virtual Open Firmware (VOF) relies on the 'sc 1'
841          * instruction to communicate with QEMU. The pegasos2 machine
842          * uses VOF and the 7xx CPUs, so although the 7xx don't have
843          * HV mode, we need to keep hypercall support.
844          */
845         if (lev == 1 && cpu->vhyp) {
846             PPCVirtualHypervisorClass *vhc =
847                 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
848             vhc->hypercall(cpu->vhyp, cpu);
849             return;
850         }
851 
852         break;
853     }
854     case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
855     case POWERPC_EXCP_DECR:      /* Decrementer exception                    */
856         break;
857     case POWERPC_EXCP_RESET:     /* System reset exception                   */
858         if (FIELD_EX64(env->msr, MSR, POW)) {
859             cpu_abort(cs, "Trying to deliver power-saving system reset "
860                       "exception %d with no HV support\n", excp);
861         }
862         break;
863     case POWERPC_EXCP_TRACE:     /* Trace exception                          */
864         break;
865     case POWERPC_EXCP_IFTLB:     /* Instruction fetch TLB error              */
866     case POWERPC_EXCP_DLTLB:     /* Data load TLB miss                       */
867     case POWERPC_EXCP_DSTLB:     /* Data store TLB miss                      */
868         ppc_excp_debug_sw_tlb(env, excp);
869 
870         msr |= env->crf[0] << 28;
871         msr |= env->error_code; /* key, D/I, S/L bits */
872         /* Set way using a LRU mechanism */
873         msr |= ((env->last_way + 1) & (env->nb_ways - 1)) << 17;
874 
875         break;
876     case POWERPC_EXCP_IABR:      /* Instruction address breakpoint           */
877     case POWERPC_EXCP_SMI:       /* System management interrupt              */
878     case POWERPC_EXCP_THERM:     /* Thermal interrupt                        */
879     case POWERPC_EXCP_PERFM:     /* Embedded performance monitor interrupt   */
880         cpu_abort(cs, "%s exception not implemented\n",
881                   powerpc_excp_name(excp));
882         break;
883     default:
884         cpu_abort(cs, "Invalid PowerPC exception %d. Aborting\n", excp);
885         break;
886     }
887 
888     /*
889      * Sort out endianness of interrupt, this differs depending on the
890      * CPU, the HV mode, etc...
891      */
892     if (ppc_interrupts_little_endian(cpu, !!(new_msr & MSR_HVB))) {
893         new_msr |= (target_ulong)1 << MSR_LE;
894     }
895 
896     /* Save PC */
897     env->spr[SPR_SRR0] = env->nip;
898 
899     /* Save MSR */
900     env->spr[SPR_SRR1] = msr;
901 
902     powerpc_set_excp_state(cpu, vector, new_msr);
903 }
904 
905 static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
906 {
907     CPUState *cs = CPU(cpu);
908     CPUPPCState *env = &cpu->env;
909     target_ulong msr, new_msr, vector;
910 
911     /* new srr1 value excluding must-be-zero bits */
912     msr = env->msr & ~0x783f0000ULL;
913 
914     /*
915      * new interrupt handler msr preserves existing ME unless
916      * explicitly overriden
917      */
918     new_msr = env->msr & ((target_ulong)1 << MSR_ME);
919 
920     /*
921      * Hypervisor emulation assistance interrupt only exists on server
922      * arch 2.05 server or later.
923      */
924     if (excp == POWERPC_EXCP_HV_EMU) {
925         excp = POWERPC_EXCP_PROGRAM;
926     }
927 
928     vector = env->excp_vectors[excp];
929     if (vector == (target_ulong)-1ULL) {
930         cpu_abort(cs, "Raised an exception without defined vector %d\n",
931                   excp);
932     }
933 
934     vector |= env->excp_prefix;
935 
936     switch (excp) {
937     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
938         if (!FIELD_EX64(env->msr, MSR, ME)) {
939             /*
940              * Machine check exception is not enabled.  Enter
941              * checkstop state.
942              */
943             fprintf(stderr, "Machine check while not allowed. "
944                     "Entering checkstop state\n");
945             if (qemu_log_separate()) {
946                 qemu_log("Machine check while not allowed. "
947                         "Entering checkstop state\n");
948             }
949             cs->halted = 1;
950             cpu_interrupt_exittb(cs);
951         }
952 
953         /* machine check exceptions don't have ME set */
954         new_msr &= ~((target_ulong)1 << MSR_ME);
955 
956         break;
957     case POWERPC_EXCP_DSI:       /* Data storage exception                   */
958         trace_ppc_excp_dsi(env->spr[SPR_DSISR], env->spr[SPR_DAR]);
959         break;
960     case POWERPC_EXCP_ISI:       /* Instruction storage exception            */
961         trace_ppc_excp_isi(msr, env->nip);
962         msr |= env->error_code;
963         break;
964     case POWERPC_EXCP_EXTERNAL:  /* External input                           */
965         break;
966     case POWERPC_EXCP_ALIGN:     /* Alignment exception                      */
967         /* Get rS/rD and rA from faulting opcode */
968         /*
969          * Note: the opcode fields will not be set properly for a
970          * direct store load/store, but nobody cares as nobody
971          * actually uses direct store segments.
972          */
973         env->spr[SPR_DSISR] |= (env->error_code & 0x03FF0000) >> 16;
974         break;
975     case POWERPC_EXCP_PROGRAM:   /* Program exception                        */
976         switch (env->error_code & ~0xF) {
977         case POWERPC_EXCP_FP:
978             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
979                 trace_ppc_excp_fp_ignore();
980                 powerpc_reset_excp_state(cpu);
981                 return;
982             }
983 
984             /*
985              * FP exceptions always have NIP pointing to the faulting
986              * instruction, so always use store_next and claim we are
987              * precise in the MSR.
988              */
989             msr |= 0x00100000;
990             break;
991         case POWERPC_EXCP_INVAL:
992             trace_ppc_excp_inval(env->nip);
993             msr |= 0x00080000;
994             break;
995         case POWERPC_EXCP_PRIV:
996             msr |= 0x00040000;
997             break;
998         case POWERPC_EXCP_TRAP:
999             msr |= 0x00020000;
1000             break;
1001         default:
1002             /* Should never occur */
1003             cpu_abort(cs, "Invalid program exception %d. Aborting\n",
1004                       env->error_code);
1005             break;
1006         }
1007         break;
1008     case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
1009     {
1010         int lev = env->error_code;
1011 
1012         if ((lev == 1) && cpu->vhyp) {
1013             dump_hcall(env);
1014         } else {
1015             dump_syscall(env);
1016         }
1017 
1018         /*
1019          * We need to correct the NIP which in this case is supposed
1020          * to point to the next instruction
1021          */
1022         env->nip += 4;
1023 
1024         /*
1025          * The Virtual Open Firmware (VOF) relies on the 'sc 1'
1026          * instruction to communicate with QEMU. The pegasos2 machine
1027          * uses VOF and the 74xx CPUs, so although the 74xx don't have
1028          * HV mode, we need to keep hypercall support.
1029          */
1030         if ((lev == 1) && cpu->vhyp) {
1031             PPCVirtualHypervisorClass *vhc =
1032                 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
1033             vhc->hypercall(cpu->vhyp, cpu);
1034             return;
1035         }
1036 
1037         break;
1038     }
1039     case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
1040     case POWERPC_EXCP_DECR:      /* Decrementer exception                    */
1041         break;
1042     case POWERPC_EXCP_RESET:     /* System reset exception                   */
1043         if (FIELD_EX64(env->msr, MSR, POW)) {
1044             cpu_abort(cs, "Trying to deliver power-saving system reset "
1045                       "exception %d with no HV support\n", excp);
1046         }
1047         break;
1048     case POWERPC_EXCP_TRACE:     /* Trace exception                          */
1049         break;
1050     case POWERPC_EXCP_VPU:       /* Vector unavailable exception             */
1051         break;
1052     case POWERPC_EXCP_IABR:      /* Instruction address breakpoint           */
1053     case POWERPC_EXCP_SMI:       /* System management interrupt              */
1054     case POWERPC_EXCP_THERM:     /* Thermal interrupt                        */
1055     case POWERPC_EXCP_PERFM:     /* Embedded performance monitor interrupt   */
1056     case POWERPC_EXCP_VPUA:      /* Vector assist exception                  */
1057         cpu_abort(cs, "%s exception not implemented\n",
1058                   powerpc_excp_name(excp));
1059         break;
1060     default:
1061         cpu_abort(cs, "Invalid PowerPC exception %d. Aborting\n", excp);
1062         break;
1063     }
1064 
1065     /*
1066      * Sort out endianness of interrupt, this differs depending on the
1067      * CPU, the HV mode, etc...
1068      */
1069     if (ppc_interrupts_little_endian(cpu, !!(new_msr & MSR_HVB))) {
1070         new_msr |= (target_ulong)1 << MSR_LE;
1071     }
1072 
1073     /* Save PC */
1074     env->spr[SPR_SRR0] = env->nip;
1075 
1076     /* Save MSR */
1077     env->spr[SPR_SRR1] = msr;
1078 
1079     powerpc_set_excp_state(cpu, vector, new_msr);
1080 }
1081 
1082 static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
1083 {
1084     CPUState *cs = CPU(cpu);
1085     CPUPPCState *env = &cpu->env;
1086     target_ulong msr, new_msr, vector;
1087     int srr0, srr1;
1088 
1089     msr = env->msr;
1090 
1091     /*
1092      * new interrupt handler msr preserves existing ME unless
1093      * explicitly overriden
1094      */
1095     new_msr = env->msr & ((target_ulong)1 << MSR_ME);
1096 
1097     /* target registers */
1098     srr0 = SPR_SRR0;
1099     srr1 = SPR_SRR1;
1100 
1101     /*
1102      * Hypervisor emulation assistance interrupt only exists on server
1103      * arch 2.05 server or later.
1104      */
1105     if (excp == POWERPC_EXCP_HV_EMU) {
1106         excp = POWERPC_EXCP_PROGRAM;
1107     }
1108 
1109 #ifdef TARGET_PPC64
1110     /*
1111      * SPEU and VPU share the same IVOR but they exist in different
1112      * processors. SPEU is e500v1/2 only and VPU is e6500 only.
1113      */
1114     if (excp == POWERPC_EXCP_VPU) {
1115         excp = POWERPC_EXCP_SPEU;
1116     }
1117 #endif
1118 
1119     vector = env->excp_vectors[excp];
1120     if (vector == (target_ulong)-1ULL) {
1121         cpu_abort(cs, "Raised an exception without defined vector %d\n",
1122                   excp);
1123     }
1124 
1125     vector |= env->excp_prefix;
1126 
1127     switch (excp) {
1128     case POWERPC_EXCP_CRITICAL:    /* Critical input                         */
1129         srr0 = SPR_BOOKE_CSRR0;
1130         srr1 = SPR_BOOKE_CSRR1;
1131         break;
1132     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
1133         if (!FIELD_EX64(env->msr, MSR, ME)) {
1134             /*
1135              * Machine check exception is not enabled.  Enter
1136              * checkstop state.
1137              */
1138             fprintf(stderr, "Machine check while not allowed. "
1139                     "Entering checkstop state\n");
1140             if (qemu_log_separate()) {
1141                 qemu_log("Machine check while not allowed. "
1142                         "Entering checkstop state\n");
1143             }
1144             cs->halted = 1;
1145             cpu_interrupt_exittb(cs);
1146         }
1147 
1148         /* machine check exceptions don't have ME set */
1149         new_msr &= ~((target_ulong)1 << MSR_ME);
1150 
1151         /* FIXME: choose one or the other based on CPU type */
1152         srr0 = SPR_BOOKE_MCSRR0;
1153         srr1 = SPR_BOOKE_MCSRR1;
1154 
1155         env->spr[SPR_BOOKE_CSRR0] = env->nip;
1156         env->spr[SPR_BOOKE_CSRR1] = msr;
1157 
1158         break;
1159     case POWERPC_EXCP_DSI:       /* Data storage exception                   */
1160         trace_ppc_excp_dsi(env->spr[SPR_BOOKE_ESR], env->spr[SPR_BOOKE_DEAR]);
1161         break;
1162     case POWERPC_EXCP_ISI:       /* Instruction storage exception            */
1163         trace_ppc_excp_isi(msr, env->nip);
1164         break;
1165     case POWERPC_EXCP_EXTERNAL:  /* External input                           */
1166         if (env->mpic_proxy) {
1167             /* IACK the IRQ on delivery */
1168             env->spr[SPR_BOOKE_EPR] = ldl_phys(cs->as, env->mpic_iack);
1169         }
1170         break;
1171     case POWERPC_EXCP_ALIGN:     /* Alignment exception                      */
1172         break;
1173     case POWERPC_EXCP_PROGRAM:   /* Program exception                        */
1174         switch (env->error_code & ~0xF) {
1175         case POWERPC_EXCP_FP:
1176             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
1177                 trace_ppc_excp_fp_ignore();
1178                 powerpc_reset_excp_state(cpu);
1179                 return;
1180             }
1181 
1182             /*
1183              * FP exceptions always have NIP pointing to the faulting
1184              * instruction, so always use store_next and claim we are
1185              * precise in the MSR.
1186              */
1187             msr |= 0x00100000;
1188             env->spr[SPR_BOOKE_ESR] = ESR_FP;
1189             break;
1190         case POWERPC_EXCP_INVAL:
1191             trace_ppc_excp_inval(env->nip);
1192             msr |= 0x00080000;
1193             env->spr[SPR_BOOKE_ESR] = ESR_PIL;
1194             break;
1195         case POWERPC_EXCP_PRIV:
1196             msr |= 0x00040000;
1197             env->spr[SPR_BOOKE_ESR] = ESR_PPR;
1198             break;
1199         case POWERPC_EXCP_TRAP:
1200             msr |= 0x00020000;
1201             env->spr[SPR_BOOKE_ESR] = ESR_PTR;
1202             break;
1203         default:
1204             /* Should never occur */
1205             cpu_abort(cs, "Invalid program exception %d. Aborting\n",
1206                       env->error_code);
1207             break;
1208         }
1209         break;
1210     case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
1211         dump_syscall(env);
1212 
1213         /*
1214          * We need to correct the NIP which in this case is supposed
1215          * to point to the next instruction
1216          */
1217         env->nip += 4;
1218         break;
1219     case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
1220     case POWERPC_EXCP_APU:       /* Auxiliary processor unavailable          */
1221     case POWERPC_EXCP_DECR:      /* Decrementer exception                    */
1222         break;
1223     case POWERPC_EXCP_FIT:       /* Fixed-interval timer interrupt           */
1224         /* FIT on 4xx */
1225         trace_ppc_excp_print("FIT");
1226         break;
1227     case POWERPC_EXCP_WDT:       /* Watchdog timer interrupt                 */
1228         trace_ppc_excp_print("WDT");
1229         srr0 = SPR_BOOKE_CSRR0;
1230         srr1 = SPR_BOOKE_CSRR1;
1231         break;
1232     case POWERPC_EXCP_DTLB:      /* Data TLB error                           */
1233     case POWERPC_EXCP_ITLB:      /* Instruction TLB error                    */
1234         break;
1235     case POWERPC_EXCP_DEBUG:     /* Debug interrupt                          */
1236         if (env->flags & POWERPC_FLAG_DE) {
1237             /* FIXME: choose one or the other based on CPU type */
1238             srr0 = SPR_BOOKE_DSRR0;
1239             srr1 = SPR_BOOKE_DSRR1;
1240 
1241             env->spr[SPR_BOOKE_CSRR0] = env->nip;
1242             env->spr[SPR_BOOKE_CSRR1] = msr;
1243 
1244             /* DBSR already modified by caller */
1245         } else {
1246             cpu_abort(cs, "Debug exception triggered on unsupported model\n");
1247         }
1248         break;
1249     case POWERPC_EXCP_SPEU:   /* SPE/embedded floating-point unavailable/VPU  */
1250         env->spr[SPR_BOOKE_ESR] = ESR_SPV;
1251         break;
1252     case POWERPC_EXCP_DOORI:     /* Embedded doorbell interrupt              */
1253         break;
1254     case POWERPC_EXCP_DOORCI:    /* Embedded doorbell critical interrupt     */
1255         srr0 = SPR_BOOKE_CSRR0;
1256         srr1 = SPR_BOOKE_CSRR1;
1257         break;
1258     case POWERPC_EXCP_RESET:     /* System reset exception                   */
1259         if (FIELD_EX64(env->msr, MSR, POW)) {
1260             cpu_abort(cs, "Trying to deliver power-saving system reset "
1261                       "exception %d with no HV support\n", excp);
1262         }
1263         break;
1264     case POWERPC_EXCP_EFPDI:     /* Embedded floating-point data interrupt   */
1265     case POWERPC_EXCP_EFPRI:     /* Embedded floating-point round interrupt  */
1266         cpu_abort(cs, "%s exception not implemented\n",
1267                   powerpc_excp_name(excp));
1268         break;
1269     default:
1270         cpu_abort(cs, "Invalid PowerPC exception %d. Aborting\n", excp);
1271         break;
1272     }
1273 
1274 #if defined(TARGET_PPC64)
1275     if (env->spr[SPR_BOOKE_EPCR] & EPCR_ICM) {
1276         /* Cat.64-bit: EPCR.ICM is copied to MSR.CM */
1277         new_msr |= (target_ulong)1 << MSR_CM;
1278     } else {
1279         vector = (uint32_t)vector;
1280     }
1281 #endif
1282 
1283     /* Save PC */
1284     env->spr[srr0] = env->nip;
1285 
1286     /* Save MSR */
1287     env->spr[srr1] = msr;
1288 
1289     powerpc_set_excp_state(cpu, vector, new_msr);
1290 }
1291 
1292 /*
1293  * When running a nested HV guest under vhyp, external interrupts are
1294  * delivered as HVIRT.
1295  */
1296 static bool books_vhyp_promotes_external_to_hvirt(PowerPCCPU *cpu)
1297 {
1298     if (cpu->vhyp) {
1299         return vhyp_cpu_in_nested(cpu);
1300     }
1301     return false;
1302 }
1303 
1304 #ifdef TARGET_PPC64
1305 /*
1306  * When running under vhyp, hcalls are always intercepted and sent to the
1307  * vhc->hypercall handler.
1308  */
1309 static bool books_vhyp_handles_hcall(PowerPCCPU *cpu)
1310 {
1311     if (cpu->vhyp) {
1312         return !vhyp_cpu_in_nested(cpu);
1313     }
1314     return false;
1315 }
1316 
1317 /*
1318  * When running a nested KVM HV guest under vhyp, HV exceptions are not
1319  * delivered to the guest (because there is no concept of HV support), but
1320  * rather they are sent tothe vhyp to exit from the L2 back to the L1 and
1321  * return from the H_ENTER_NESTED hypercall.
1322  */
1323 static bool books_vhyp_handles_hv_excp(PowerPCCPU *cpu)
1324 {
1325     if (cpu->vhyp) {
1326         return vhyp_cpu_in_nested(cpu);
1327     }
1328     return false;
1329 }
1330 
1331 static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
1332 {
1333     CPUState *cs = CPU(cpu);
1334     CPUPPCState *env = &cpu->env;
1335     target_ulong msr, new_msr, vector;
1336     int srr0, srr1, lev = -1;
1337 
1338     /* new srr1 value excluding must-be-zero bits */
1339     msr = env->msr & ~0x783f0000ULL;
1340 
1341     /*
1342      * new interrupt handler msr preserves existing HV and ME unless
1343      * explicitly overriden
1344      */
1345     new_msr = env->msr & (((target_ulong)1 << MSR_ME) | MSR_HVB);
1346 
1347     /* target registers */
1348     srr0 = SPR_SRR0;
1349     srr1 = SPR_SRR1;
1350 
1351     /*
1352      * check for special resume at 0x100 from doze/nap/sleep/winkle on
1353      * P7/P8/P9
1354      */
1355     if (env->resume_as_sreset) {
1356         excp = powerpc_reset_wakeup(cs, env, excp, &msr);
1357     }
1358 
1359     /*
1360      * We don't want to generate a Hypervisor Emulation Assistance
1361      * Interrupt if we don't have HVB in msr_mask (PAPR mode).
1362      */
1363     if (excp == POWERPC_EXCP_HV_EMU && !(env->msr_mask & MSR_HVB)) {
1364         excp = POWERPC_EXCP_PROGRAM;
1365     }
1366 
1367     vector = env->excp_vectors[excp];
1368     if (vector == (target_ulong)-1ULL) {
1369         cpu_abort(cs, "Raised an exception without defined vector %d\n",
1370                   excp);
1371     }
1372 
1373     vector |= env->excp_prefix;
1374 
1375     switch (excp) {
1376     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
1377         if (!FIELD_EX64(env->msr, MSR, ME)) {
1378             /*
1379              * Machine check exception is not enabled.  Enter
1380              * checkstop state.
1381              */
1382             fprintf(stderr, "Machine check while not allowed. "
1383                     "Entering checkstop state\n");
1384             if (qemu_log_separate()) {
1385                 qemu_log("Machine check while not allowed. "
1386                         "Entering checkstop state\n");
1387             }
1388             cs->halted = 1;
1389             cpu_interrupt_exittb(cs);
1390         }
1391         if (env->msr_mask & MSR_HVB) {
1392             /*
1393              * ISA specifies HV, but can be delivered to guest with HV
1394              * clear (e.g., see FWNMI in PAPR).
1395              */
1396             new_msr |= (target_ulong)MSR_HVB;
1397         }
1398 
1399         /* machine check exceptions don't have ME set */
1400         new_msr &= ~((target_ulong)1 << MSR_ME);
1401 
1402         break;
1403     case POWERPC_EXCP_DSI:       /* Data storage exception                   */
1404         trace_ppc_excp_dsi(env->spr[SPR_DSISR], env->spr[SPR_DAR]);
1405         break;
1406     case POWERPC_EXCP_ISI:       /* Instruction storage exception            */
1407         trace_ppc_excp_isi(msr, env->nip);
1408         msr |= env->error_code;
1409         break;
1410     case POWERPC_EXCP_EXTERNAL:  /* External input                           */
1411     {
1412         bool lpes0;
1413 
1414         /*
1415          * LPES0 is only taken into consideration if we support HV
1416          * mode for this CPU.
1417          */
1418         if (!env->has_hv_mode) {
1419             break;
1420         }
1421 
1422         lpes0 = !!(env->spr[SPR_LPCR] & LPCR_LPES0);
1423 
1424         if (!lpes0) {
1425             new_msr |= (target_ulong)MSR_HVB;
1426             new_msr |= env->msr & ((target_ulong)1 << MSR_RI);
1427             srr0 = SPR_HSRR0;
1428             srr1 = SPR_HSRR1;
1429         }
1430 
1431         break;
1432     }
1433     case POWERPC_EXCP_ALIGN:     /* Alignment exception                      */
1434         /* Get rS/rD and rA from faulting opcode */
1435         /*
1436          * Note: the opcode fields will not be set properly for a
1437          * direct store load/store, but nobody cares as nobody
1438          * actually uses direct store segments.
1439          */
1440         env->spr[SPR_DSISR] |= (env->error_code & 0x03FF0000) >> 16;
1441         break;
1442     case POWERPC_EXCP_PROGRAM:   /* Program exception                        */
1443         switch (env->error_code & ~0xF) {
1444         case POWERPC_EXCP_FP:
1445             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
1446                 trace_ppc_excp_fp_ignore();
1447                 powerpc_reset_excp_state(cpu);
1448                 return;
1449             }
1450 
1451             /*
1452              * FP exceptions always have NIP pointing to the faulting
1453              * instruction, so always use store_next and claim we are
1454              * precise in the MSR.
1455              */
1456             msr |= 0x00100000;
1457             break;
1458         case POWERPC_EXCP_INVAL:
1459             trace_ppc_excp_inval(env->nip);
1460             msr |= 0x00080000;
1461             break;
1462         case POWERPC_EXCP_PRIV:
1463             msr |= 0x00040000;
1464             break;
1465         case POWERPC_EXCP_TRAP:
1466             msr |= 0x00020000;
1467             break;
1468         default:
1469             /* Should never occur */
1470             cpu_abort(cs, "Invalid program exception %d. Aborting\n",
1471                       env->error_code);
1472             break;
1473         }
1474         break;
1475     case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
1476         lev = env->error_code;
1477 
1478         if ((lev == 1) && cpu->vhyp) {
1479             dump_hcall(env);
1480         } else {
1481             dump_syscall(env);
1482         }
1483 
1484         /*
1485          * We need to correct the NIP which in this case is supposed
1486          * to point to the next instruction
1487          */
1488         env->nip += 4;
1489 
1490         /* "PAPR mode" built-in hypercall emulation */
1491         if ((lev == 1) && books_vhyp_handles_hcall(cpu)) {
1492             PPCVirtualHypervisorClass *vhc =
1493                 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
1494             vhc->hypercall(cpu->vhyp, cpu);
1495             return;
1496         }
1497         if (lev == 1) {
1498             new_msr |= (target_ulong)MSR_HVB;
1499         }
1500         break;
1501     case POWERPC_EXCP_SYSCALL_VECTORED: /* scv exception                     */
1502         lev = env->error_code;
1503         dump_syscall(env);
1504         env->nip += 4;
1505         new_msr |= env->msr & ((target_ulong)1 << MSR_EE);
1506         new_msr |= env->msr & ((target_ulong)1 << MSR_RI);
1507 
1508         vector += lev * 0x20;
1509 
1510         env->lr = env->nip;
1511         env->ctr = msr;
1512         break;
1513     case POWERPC_EXCP_FPU:       /* Floating-point unavailable exception     */
1514     case POWERPC_EXCP_DECR:      /* Decrementer exception                    */
1515         break;
1516     case POWERPC_EXCP_RESET:     /* System reset exception                   */
1517         /* A power-saving exception sets ME, otherwise it is unchanged */
1518         if (FIELD_EX64(env->msr, MSR, POW)) {
1519             /* indicate that we resumed from power save mode */
1520             msr |= 0x10000;
1521             new_msr |= ((target_ulong)1 << MSR_ME);
1522         }
1523         if (env->msr_mask & MSR_HVB) {
1524             /*
1525              * ISA specifies HV, but can be delivered to guest with HV
1526              * clear (e.g., see FWNMI in PAPR, NMI injection in QEMU).
1527              */
1528             new_msr |= (target_ulong)MSR_HVB;
1529         } else {
1530             if (FIELD_EX64(env->msr, MSR, POW)) {
1531                 cpu_abort(cs, "Trying to deliver power-saving system reset "
1532                           "exception %d with no HV support\n", excp);
1533             }
1534         }
1535         break;
1536     case POWERPC_EXCP_DSEG:      /* Data segment exception                   */
1537     case POWERPC_EXCP_ISEG:      /* Instruction segment exception            */
1538     case POWERPC_EXCP_TRACE:     /* Trace exception                          */
1539         break;
1540     case POWERPC_EXCP_HISI:      /* Hypervisor instruction storage exception */
1541         msr |= env->error_code;
1542         /* fall through */
1543     case POWERPC_EXCP_HDECR:     /* Hypervisor decrementer exception         */
1544     case POWERPC_EXCP_HDSI:      /* Hypervisor data storage exception        */
1545     case POWERPC_EXCP_SDOOR_HV:  /* Hypervisor Doorbell interrupt            */
1546     case POWERPC_EXCP_HV_EMU:
1547     case POWERPC_EXCP_HVIRT:     /* Hypervisor virtualization                */
1548         srr0 = SPR_HSRR0;
1549         srr1 = SPR_HSRR1;
1550         new_msr |= (target_ulong)MSR_HVB;
1551         new_msr |= env->msr & ((target_ulong)1 << MSR_RI);
1552         break;
1553     case POWERPC_EXCP_VPU:       /* Vector unavailable exception             */
1554     case POWERPC_EXCP_VSXU:       /* VSX unavailable exception               */
1555     case POWERPC_EXCP_FU:         /* Facility unavailable exception          */
1556         env->spr[SPR_FSCR] |= ((target_ulong)env->error_code << 56);
1557         break;
1558     case POWERPC_EXCP_HV_FU:     /* Hypervisor Facility Unavailable Exception */
1559         env->spr[SPR_HFSCR] |= ((target_ulong)env->error_code << FSCR_IC_POS);
1560         srr0 = SPR_HSRR0;
1561         srr1 = SPR_HSRR1;
1562         new_msr |= (target_ulong)MSR_HVB;
1563         new_msr |= env->msr & ((target_ulong)1 << MSR_RI);
1564         break;
1565     case POWERPC_EXCP_PERFM_EBB:        /* Performance Monitor EBB Exception  */
1566     case POWERPC_EXCP_EXTERNAL_EBB:     /* External EBB Exception             */
1567         env->spr[SPR_BESCR] &= ~BESCR_GE;
1568 
1569         /*
1570          * Save NIP for rfebb insn in SPR_EBBRR. Next nip is
1571          * stored in the EBB Handler SPR_EBBHR.
1572          */
1573         env->spr[SPR_EBBRR] = env->nip;
1574         powerpc_set_excp_state(cpu, env->spr[SPR_EBBHR], env->msr);
1575 
1576         /*
1577          * This exception is handled in userspace. No need to proceed.
1578          */
1579         return;
1580     case POWERPC_EXCP_THERM:     /* Thermal interrupt                        */
1581     case POWERPC_EXCP_PERFM:     /* Embedded performance monitor interrupt   */
1582     case POWERPC_EXCP_VPUA:      /* Vector assist exception                  */
1583     case POWERPC_EXCP_MAINT:     /* Maintenance exception                    */
1584     case POWERPC_EXCP_SDOOR:     /* Doorbell interrupt                       */
1585     case POWERPC_EXCP_HV_MAINT:  /* Hypervisor Maintenance exception         */
1586         cpu_abort(cs, "%s exception not implemented\n",
1587                   powerpc_excp_name(excp));
1588         break;
1589     default:
1590         cpu_abort(cs, "Invalid PowerPC exception %d. Aborting\n", excp);
1591         break;
1592     }
1593 
1594     /*
1595      * Sort out endianness of interrupt, this differs depending on the
1596      * CPU, the HV mode, etc...
1597      */
1598     if (ppc_interrupts_little_endian(cpu, !!(new_msr & MSR_HVB))) {
1599         new_msr |= (target_ulong)1 << MSR_LE;
1600     }
1601 
1602     new_msr |= (target_ulong)1 << MSR_SF;
1603 
1604     if (excp != POWERPC_EXCP_SYSCALL_VECTORED) {
1605         /* Save PC */
1606         env->spr[srr0] = env->nip;
1607 
1608         /* Save MSR */
1609         env->spr[srr1] = msr;
1610     }
1611 
1612     if ((new_msr & MSR_HVB) && books_vhyp_handles_hv_excp(cpu)) {
1613         PPCVirtualHypervisorClass *vhc =
1614             PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
1615         /* Deliver interrupt to L1 by returning from the H_ENTER_NESTED call */
1616         vhc->deliver_hv_excp(cpu, excp);
1617 
1618         powerpc_reset_excp_state(cpu);
1619 
1620     } else {
1621         /* Sanity check */
1622         if (!(env->msr_mask & MSR_HVB) && srr0 == SPR_HSRR0) {
1623             cpu_abort(cs, "Trying to deliver HV exception (HSRR) %d with "
1624                       "no HV support\n", excp);
1625         }
1626 
1627         /* This can update new_msr and vector if AIL applies */
1628         ppc_excp_apply_ail(cpu, excp, msr, &new_msr, &vector);
1629 
1630         powerpc_set_excp_state(cpu, vector, new_msr);
1631     }
1632 }
1633 #else
1634 static inline void powerpc_excp_books(PowerPCCPU *cpu, int excp)
1635 {
1636     g_assert_not_reached();
1637 }
1638 #endif
1639 
1640 static void powerpc_excp(PowerPCCPU *cpu, int excp)
1641 {
1642     CPUState *cs = CPU(cpu);
1643     CPUPPCState *env = &cpu->env;
1644 
1645     if (excp <= POWERPC_EXCP_NONE || excp >= POWERPC_EXCP_NB) {
1646         cpu_abort(cs, "Invalid PowerPC exception %d. Aborting\n", excp);
1647     }
1648 
1649     qemu_log_mask(CPU_LOG_INT, "Raise exception at " TARGET_FMT_lx
1650                   " => %s (%d) error=%02x\n", env->nip, powerpc_excp_name(excp),
1651                   excp, env->error_code);
1652 
1653     switch (env->excp_model) {
1654     case POWERPC_EXCP_40x:
1655         powerpc_excp_40x(cpu, excp);
1656         break;
1657     case POWERPC_EXCP_6xx:
1658         powerpc_excp_6xx(cpu, excp);
1659         break;
1660     case POWERPC_EXCP_7xx:
1661         powerpc_excp_7xx(cpu, excp);
1662         break;
1663     case POWERPC_EXCP_74xx:
1664         powerpc_excp_74xx(cpu, excp);
1665         break;
1666     case POWERPC_EXCP_BOOKE:
1667         powerpc_excp_booke(cpu, excp);
1668         break;
1669     case POWERPC_EXCP_970:
1670     case POWERPC_EXCP_POWER7:
1671     case POWERPC_EXCP_POWER8:
1672     case POWERPC_EXCP_POWER9:
1673     case POWERPC_EXCP_POWER10:
1674         powerpc_excp_books(cpu, excp);
1675         break;
1676     default:
1677         g_assert_not_reached();
1678     }
1679 }
1680 
1681 void ppc_cpu_do_interrupt(CPUState *cs)
1682 {
1683     PowerPCCPU *cpu = POWERPC_CPU(cs);
1684 
1685     powerpc_excp(cpu, cs->exception_index);
1686 }
1687 
1688 #if defined(TARGET_PPC64)
1689 #define P7_UNUSED_INTERRUPTS \
1690     (PPC_INTERRUPT_RESET | PPC_INTERRUPT_HVIRT | PPC_INTERRUPT_CEXT |       \
1691      PPC_INTERRUPT_WDT | PPC_INTERRUPT_CDOORBELL | PPC_INTERRUPT_FIT |      \
1692      PPC_INTERRUPT_PIT | PPC_INTERRUPT_DOORBELL | PPC_INTERRUPT_HDOORBELL | \
1693      PPC_INTERRUPT_THERM | PPC_INTERRUPT_EBB)
1694 
1695 static int p7_interrupt_powersave(CPUPPCState *env)
1696 {
1697     if ((env->pending_interrupts & PPC_INTERRUPT_EXT) &&
1698         (env->spr[SPR_LPCR] & LPCR_P7_PECE0)) {
1699         return PPC_INTERRUPT_EXT;
1700     }
1701     if ((env->pending_interrupts & PPC_INTERRUPT_DECR) &&
1702         (env->spr[SPR_LPCR] & LPCR_P7_PECE1)) {
1703         return PPC_INTERRUPT_DECR;
1704     }
1705     if ((env->pending_interrupts & PPC_INTERRUPT_MCK) &&
1706         (env->spr[SPR_LPCR] & LPCR_P7_PECE2)) {
1707         return PPC_INTERRUPT_MCK;
1708     }
1709     if ((env->pending_interrupts & PPC_INTERRUPT_HMI) &&
1710         (env->spr[SPR_LPCR] & LPCR_P7_PECE2)) {
1711         return PPC_INTERRUPT_HMI;
1712     }
1713     if (env->pending_interrupts & PPC_INTERRUPT_RESET) {
1714         return PPC_INTERRUPT_RESET;
1715     }
1716     return 0;
1717 }
1718 
1719 static int p7_next_unmasked_interrupt(CPUPPCState *env)
1720 {
1721     PowerPCCPU *cpu = env_archcpu(env);
1722     CPUState *cs = CPU(cpu);
1723     /* Ignore MSR[EE] when coming out of some power management states */
1724     bool msr_ee = FIELD_EX64(env->msr, MSR, EE) || env->resume_as_sreset;
1725 
1726     assert((env->pending_interrupts & P7_UNUSED_INTERRUPTS) == 0);
1727 
1728     if (cs->halted) {
1729         /* LPCR[PECE] controls which interrupts can exit power-saving mode */
1730         return p7_interrupt_powersave(env);
1731     }
1732 
1733     /* Machine check exception */
1734     if (env->pending_interrupts & PPC_INTERRUPT_MCK) {
1735         return PPC_INTERRUPT_MCK;
1736     }
1737 
1738     /* Hypervisor decrementer exception */
1739     if (env->pending_interrupts & PPC_INTERRUPT_HDECR) {
1740         /* LPCR will be clear when not supported so this will work */
1741         bool hdice = !!(env->spr[SPR_LPCR] & LPCR_HDICE);
1742         if ((msr_ee || !FIELD_EX64_HV(env->msr)) && hdice) {
1743             /* HDEC clears on delivery */
1744             return PPC_INTERRUPT_HDECR;
1745         }
1746     }
1747 
1748     /* External interrupt can ignore MSR:EE under some circumstances */
1749     if (env->pending_interrupts & PPC_INTERRUPT_EXT) {
1750         bool lpes0 = !!(env->spr[SPR_LPCR] & LPCR_LPES0);
1751         bool heic = !!(env->spr[SPR_LPCR] & LPCR_HEIC);
1752         /* HEIC blocks delivery to the hypervisor */
1753         if ((msr_ee && !(heic && FIELD_EX64_HV(env->msr) &&
1754             !FIELD_EX64(env->msr, MSR, PR))) ||
1755             (env->has_hv_mode && !FIELD_EX64_HV(env->msr) && !lpes0)) {
1756             return PPC_INTERRUPT_EXT;
1757         }
1758     }
1759     if (msr_ee != 0) {
1760         /* Decrementer exception */
1761         if (env->pending_interrupts & PPC_INTERRUPT_DECR) {
1762             return PPC_INTERRUPT_DECR;
1763         }
1764         if (env->pending_interrupts & PPC_INTERRUPT_PERFM) {
1765             return PPC_INTERRUPT_PERFM;
1766         }
1767     }
1768 
1769     return 0;
1770 }
1771 
1772 #define P8_UNUSED_INTERRUPTS \
1773     (PPC_INTERRUPT_RESET | PPC_INTERRUPT_DEBUG | PPC_INTERRUPT_HVIRT |  \
1774     PPC_INTERRUPT_CEXT | PPC_INTERRUPT_WDT | PPC_INTERRUPT_CDOORBELL |  \
1775     PPC_INTERRUPT_FIT | PPC_INTERRUPT_PIT | PPC_INTERRUPT_THERM)
1776 
1777 static int p8_interrupt_powersave(CPUPPCState *env)
1778 {
1779     if ((env->pending_interrupts & PPC_INTERRUPT_EXT) &&
1780         (env->spr[SPR_LPCR] & LPCR_P8_PECE2)) {
1781         return PPC_INTERRUPT_EXT;
1782     }
1783     if ((env->pending_interrupts & PPC_INTERRUPT_DECR) &&
1784         (env->spr[SPR_LPCR] & LPCR_P8_PECE3)) {
1785         return PPC_INTERRUPT_DECR;
1786     }
1787     if ((env->pending_interrupts & PPC_INTERRUPT_MCK) &&
1788         (env->spr[SPR_LPCR] & LPCR_P8_PECE4)) {
1789         return PPC_INTERRUPT_MCK;
1790     }
1791     if ((env->pending_interrupts & PPC_INTERRUPT_HMI) &&
1792         (env->spr[SPR_LPCR] & LPCR_P8_PECE4)) {
1793         return PPC_INTERRUPT_HMI;
1794     }
1795     if ((env->pending_interrupts & PPC_INTERRUPT_DOORBELL) &&
1796         (env->spr[SPR_LPCR] & LPCR_P8_PECE0)) {
1797         return PPC_INTERRUPT_DOORBELL;
1798     }
1799     if ((env->pending_interrupts & PPC_INTERRUPT_HDOORBELL) &&
1800         (env->spr[SPR_LPCR] & LPCR_P8_PECE1)) {
1801         return PPC_INTERRUPT_HDOORBELL;
1802     }
1803     if (env->pending_interrupts & PPC_INTERRUPT_RESET) {
1804         return PPC_INTERRUPT_RESET;
1805     }
1806     return 0;
1807 }
1808 
1809 static int p8_next_unmasked_interrupt(CPUPPCState *env)
1810 {
1811     PowerPCCPU *cpu = env_archcpu(env);
1812     CPUState *cs = CPU(cpu);
1813     /* Ignore MSR[EE] when coming out of some power management states */
1814     bool msr_ee = FIELD_EX64(env->msr, MSR, EE) || env->resume_as_sreset;
1815 
1816     assert((env->pending_interrupts & P8_UNUSED_INTERRUPTS) == 0);
1817 
1818     if (cs->halted) {
1819         /* LPCR[PECE] controls which interrupts can exit power-saving mode */
1820         return p8_interrupt_powersave(env);
1821     }
1822 
1823     /* Machine check exception */
1824     if (env->pending_interrupts & PPC_INTERRUPT_MCK) {
1825         return PPC_INTERRUPT_MCK;
1826     }
1827 
1828     /* Hypervisor decrementer exception */
1829     if (env->pending_interrupts & PPC_INTERRUPT_HDECR) {
1830         /* LPCR will be clear when not supported so this will work */
1831         bool hdice = !!(env->spr[SPR_LPCR] & LPCR_HDICE);
1832         if ((msr_ee || !FIELD_EX64_HV(env->msr)) && hdice) {
1833             /* HDEC clears on delivery */
1834             return PPC_INTERRUPT_HDECR;
1835         }
1836     }
1837 
1838     /* External interrupt can ignore MSR:EE under some circumstances */
1839     if (env->pending_interrupts & PPC_INTERRUPT_EXT) {
1840         bool lpes0 = !!(env->spr[SPR_LPCR] & LPCR_LPES0);
1841         bool heic = !!(env->spr[SPR_LPCR] & LPCR_HEIC);
1842         /* HEIC blocks delivery to the hypervisor */
1843         if ((msr_ee && !(heic && FIELD_EX64_HV(env->msr) &&
1844             !FIELD_EX64(env->msr, MSR, PR))) ||
1845             (env->has_hv_mode && !FIELD_EX64_HV(env->msr) && !lpes0)) {
1846             return PPC_INTERRUPT_EXT;
1847         }
1848     }
1849     if (msr_ee != 0) {
1850         /* Decrementer exception */
1851         if (env->pending_interrupts & PPC_INTERRUPT_DECR) {
1852             return PPC_INTERRUPT_DECR;
1853         }
1854         if (env->pending_interrupts & PPC_INTERRUPT_DOORBELL) {
1855             return PPC_INTERRUPT_DOORBELL;
1856         }
1857         if (env->pending_interrupts & PPC_INTERRUPT_HDOORBELL) {
1858             return PPC_INTERRUPT_HDOORBELL;
1859         }
1860         if (env->pending_interrupts & PPC_INTERRUPT_PERFM) {
1861             return PPC_INTERRUPT_PERFM;
1862         }
1863         /* EBB exception */
1864         if (env->pending_interrupts & PPC_INTERRUPT_EBB) {
1865             /*
1866              * EBB exception must be taken in problem state and
1867              * with BESCR_GE set.
1868              */
1869             if (FIELD_EX64(env->msr, MSR, PR) &&
1870                 (env->spr[SPR_BESCR] & BESCR_GE)) {
1871                 return PPC_INTERRUPT_EBB;
1872             }
1873         }
1874     }
1875 
1876     return 0;
1877 }
1878 
1879 #define P9_UNUSED_INTERRUPTS \
1880     (PPC_INTERRUPT_RESET | PPC_INTERRUPT_DEBUG | PPC_INTERRUPT_CEXT |   \
1881      PPC_INTERRUPT_WDT | PPC_INTERRUPT_CDOORBELL | PPC_INTERRUPT_FIT |  \
1882      PPC_INTERRUPT_PIT | PPC_INTERRUPT_THERM)
1883 
1884 static int p9_interrupt_powersave(CPUPPCState *env)
1885 {
1886     /* External Exception */
1887     if ((env->pending_interrupts & PPC_INTERRUPT_EXT) &&
1888         (env->spr[SPR_LPCR] & LPCR_EEE)) {
1889         bool heic = !!(env->spr[SPR_LPCR] & LPCR_HEIC);
1890         if (!heic || !FIELD_EX64_HV(env->msr) ||
1891             FIELD_EX64(env->msr, MSR, PR)) {
1892             return PPC_INTERRUPT_EXT;
1893         }
1894     }
1895     /* Decrementer Exception */
1896     if ((env->pending_interrupts & PPC_INTERRUPT_DECR) &&
1897         (env->spr[SPR_LPCR] & LPCR_DEE)) {
1898         return PPC_INTERRUPT_DECR;
1899     }
1900     /* Machine Check or Hypervisor Maintenance Exception */
1901     if (env->spr[SPR_LPCR] & LPCR_OEE) {
1902         if (env->pending_interrupts & PPC_INTERRUPT_MCK) {
1903             return PPC_INTERRUPT_MCK;
1904         }
1905         if (env->pending_interrupts & PPC_INTERRUPT_HMI) {
1906             return PPC_INTERRUPT_HMI;
1907         }
1908     }
1909     /* Privileged Doorbell Exception */
1910     if ((env->pending_interrupts & PPC_INTERRUPT_DOORBELL) &&
1911         (env->spr[SPR_LPCR] & LPCR_PDEE)) {
1912         return PPC_INTERRUPT_DOORBELL;
1913     }
1914     /* Hypervisor Doorbell Exception */
1915     if ((env->pending_interrupts & PPC_INTERRUPT_HDOORBELL) &&
1916         (env->spr[SPR_LPCR] & LPCR_HDEE)) {
1917         return PPC_INTERRUPT_HDOORBELL;
1918     }
1919     /* Hypervisor virtualization exception */
1920     if ((env->pending_interrupts & PPC_INTERRUPT_HVIRT) &&
1921         (env->spr[SPR_LPCR] & LPCR_HVEE)) {
1922         return PPC_INTERRUPT_HVIRT;
1923     }
1924     if (env->pending_interrupts & PPC_INTERRUPT_RESET) {
1925         return PPC_INTERRUPT_RESET;
1926     }
1927     return 0;
1928 }
1929 
1930 static int p9_next_unmasked_interrupt(CPUPPCState *env)
1931 {
1932     PowerPCCPU *cpu = env_archcpu(env);
1933     CPUState *cs = CPU(cpu);
1934     /* Ignore MSR[EE] when coming out of some power management states */
1935     bool msr_ee = FIELD_EX64(env->msr, MSR, EE) || env->resume_as_sreset;
1936 
1937     assert((env->pending_interrupts & P9_UNUSED_INTERRUPTS) == 0);
1938 
1939     if (cs->halted) {
1940         if (env->spr[SPR_PSSCR] & PSSCR_EC) {
1941             /*
1942              * When PSSCR[EC] is set, LPCR[PECE] controls which interrupts can
1943              * wakeup the processor
1944              */
1945             return p9_interrupt_powersave(env);
1946         } else {
1947             /*
1948              * When it's clear, any system-caused exception exits power-saving
1949              * mode, even the ones that gate on MSR[EE].
1950              */
1951             msr_ee = true;
1952         }
1953     }
1954 
1955     /* Machine check exception */
1956     if (env->pending_interrupts & PPC_INTERRUPT_MCK) {
1957         return PPC_INTERRUPT_MCK;
1958     }
1959 
1960     /* Hypervisor decrementer exception */
1961     if (env->pending_interrupts & PPC_INTERRUPT_HDECR) {
1962         /* LPCR will be clear when not supported so this will work */
1963         bool hdice = !!(env->spr[SPR_LPCR] & LPCR_HDICE);
1964         if ((msr_ee || !FIELD_EX64_HV(env->msr)) && hdice) {
1965             /* HDEC clears on delivery */
1966             return PPC_INTERRUPT_HDECR;
1967         }
1968     }
1969 
1970     /* Hypervisor virtualization interrupt */
1971     if (env->pending_interrupts & PPC_INTERRUPT_HVIRT) {
1972         /* LPCR will be clear when not supported so this will work */
1973         bool hvice = !!(env->spr[SPR_LPCR] & LPCR_HVICE);
1974         if ((msr_ee || !FIELD_EX64_HV(env->msr)) && hvice) {
1975             return PPC_INTERRUPT_HVIRT;
1976         }
1977     }
1978 
1979     /* External interrupt can ignore MSR:EE under some circumstances */
1980     if (env->pending_interrupts & PPC_INTERRUPT_EXT) {
1981         bool lpes0 = !!(env->spr[SPR_LPCR] & LPCR_LPES0);
1982         bool heic = !!(env->spr[SPR_LPCR] & LPCR_HEIC);
1983         /* HEIC blocks delivery to the hypervisor */
1984         if ((msr_ee && !(heic && FIELD_EX64_HV(env->msr) &&
1985             !FIELD_EX64(env->msr, MSR, PR))) ||
1986             (env->has_hv_mode && !FIELD_EX64_HV(env->msr) && !lpes0)) {
1987             return PPC_INTERRUPT_EXT;
1988         }
1989     }
1990     if (msr_ee != 0) {
1991         /* Decrementer exception */
1992         if (env->pending_interrupts & PPC_INTERRUPT_DECR) {
1993             return PPC_INTERRUPT_DECR;
1994         }
1995         if (env->pending_interrupts & PPC_INTERRUPT_DOORBELL) {
1996             return PPC_INTERRUPT_DOORBELL;
1997         }
1998         if (env->pending_interrupts & PPC_INTERRUPT_HDOORBELL) {
1999             return PPC_INTERRUPT_HDOORBELL;
2000         }
2001         if (env->pending_interrupts & PPC_INTERRUPT_PERFM) {
2002             return PPC_INTERRUPT_PERFM;
2003         }
2004         /* EBB exception */
2005         if (env->pending_interrupts & PPC_INTERRUPT_EBB) {
2006             /*
2007              * EBB exception must be taken in problem state and
2008              * with BESCR_GE set.
2009              */
2010             if (FIELD_EX64(env->msr, MSR, PR) &&
2011                 (env->spr[SPR_BESCR] & BESCR_GE)) {
2012                 return PPC_INTERRUPT_EBB;
2013             }
2014         }
2015     }
2016 
2017     return 0;
2018 }
2019 #endif
2020 
2021 static int ppc_next_unmasked_interrupt_generic(CPUPPCState *env)
2022 {
2023     bool async_deliver;
2024 
2025     /* External reset */
2026     if (env->pending_interrupts & PPC_INTERRUPT_RESET) {
2027         return PPC_INTERRUPT_RESET;
2028     }
2029     /* Machine check exception */
2030     if (env->pending_interrupts & PPC_INTERRUPT_MCK) {
2031         return PPC_INTERRUPT_MCK;
2032     }
2033 #if 0 /* TODO */
2034     /* External debug exception */
2035     if (env->pending_interrupts & PPC_INTERRUPT_DEBUG) {
2036         return PPC_INTERRUPT_DEBUG;
2037     }
2038 #endif
2039 
2040     /*
2041      * For interrupts that gate on MSR:EE, we need to do something a
2042      * bit more subtle, as we need to let them through even when EE is
2043      * clear when coming out of some power management states (in order
2044      * for them to become a 0x100).
2045      */
2046     async_deliver = FIELD_EX64(env->msr, MSR, EE) || env->resume_as_sreset;
2047 
2048     /* Hypervisor decrementer exception */
2049     if (env->pending_interrupts & PPC_INTERRUPT_HDECR) {
2050         /* LPCR will be clear when not supported so this will work */
2051         bool hdice = !!(env->spr[SPR_LPCR] & LPCR_HDICE);
2052         if ((async_deliver || !FIELD_EX64_HV(env->msr)) && hdice) {
2053             /* HDEC clears on delivery */
2054             return PPC_INTERRUPT_HDECR;
2055         }
2056     }
2057 
2058     /* Hypervisor virtualization interrupt */
2059     if (env->pending_interrupts & PPC_INTERRUPT_HVIRT) {
2060         /* LPCR will be clear when not supported so this will work */
2061         bool hvice = !!(env->spr[SPR_LPCR] & LPCR_HVICE);
2062         if ((async_deliver || !FIELD_EX64_HV(env->msr)) && hvice) {
2063             return PPC_INTERRUPT_HVIRT;
2064         }
2065     }
2066 
2067     /* External interrupt can ignore MSR:EE under some circumstances */
2068     if (env->pending_interrupts & PPC_INTERRUPT_EXT) {
2069         bool lpes0 = !!(env->spr[SPR_LPCR] & LPCR_LPES0);
2070         bool heic = !!(env->spr[SPR_LPCR] & LPCR_HEIC);
2071         /* HEIC blocks delivery to the hypervisor */
2072         if ((async_deliver && !(heic && FIELD_EX64_HV(env->msr) &&
2073             !FIELD_EX64(env->msr, MSR, PR))) ||
2074             (env->has_hv_mode && !FIELD_EX64_HV(env->msr) && !lpes0)) {
2075             return PPC_INTERRUPT_EXT;
2076         }
2077     }
2078     if (FIELD_EX64(env->msr, MSR, CE)) {
2079         /* External critical interrupt */
2080         if (env->pending_interrupts & PPC_INTERRUPT_CEXT) {
2081             return PPC_INTERRUPT_CEXT;
2082         }
2083     }
2084     if (async_deliver != 0) {
2085         /* Watchdog timer on embedded PowerPC */
2086         if (env->pending_interrupts & PPC_INTERRUPT_WDT) {
2087             return PPC_INTERRUPT_WDT;
2088         }
2089         if (env->pending_interrupts & PPC_INTERRUPT_CDOORBELL) {
2090             return PPC_INTERRUPT_CDOORBELL;
2091         }
2092         /* Fixed interval timer on embedded PowerPC */
2093         if (env->pending_interrupts & PPC_INTERRUPT_FIT) {
2094             return PPC_INTERRUPT_FIT;
2095         }
2096         /* Programmable interval timer on embedded PowerPC */
2097         if (env->pending_interrupts & PPC_INTERRUPT_PIT) {
2098             return PPC_INTERRUPT_PIT;
2099         }
2100         /* Decrementer exception */
2101         if (env->pending_interrupts & PPC_INTERRUPT_DECR) {
2102             return PPC_INTERRUPT_DECR;
2103         }
2104         if (env->pending_interrupts & PPC_INTERRUPT_DOORBELL) {
2105             return PPC_INTERRUPT_DOORBELL;
2106         }
2107         if (env->pending_interrupts & PPC_INTERRUPT_HDOORBELL) {
2108             return PPC_INTERRUPT_HDOORBELL;
2109         }
2110         if (env->pending_interrupts & PPC_INTERRUPT_PERFM) {
2111             return PPC_INTERRUPT_PERFM;
2112         }
2113         /* Thermal interrupt */
2114         if (env->pending_interrupts & PPC_INTERRUPT_THERM) {
2115             return PPC_INTERRUPT_THERM;
2116         }
2117         /* EBB exception */
2118         if (env->pending_interrupts & PPC_INTERRUPT_EBB) {
2119             /*
2120              * EBB exception must be taken in problem state and
2121              * with BESCR_GE set.
2122              */
2123             if (FIELD_EX64(env->msr, MSR, PR) &&
2124                 (env->spr[SPR_BESCR] & BESCR_GE)) {
2125                 return PPC_INTERRUPT_EBB;
2126             }
2127         }
2128     }
2129 
2130     return 0;
2131 }
2132 
2133 static int ppc_next_unmasked_interrupt(CPUPPCState *env)
2134 {
2135     switch (env->excp_model) {
2136 #if defined(TARGET_PPC64)
2137     case POWERPC_EXCP_POWER7:
2138         return p7_next_unmasked_interrupt(env);
2139     case POWERPC_EXCP_POWER8:
2140         return p8_next_unmasked_interrupt(env);
2141     case POWERPC_EXCP_POWER9:
2142     case POWERPC_EXCP_POWER10:
2143         return p9_next_unmasked_interrupt(env);
2144 #endif
2145     default:
2146         return ppc_next_unmasked_interrupt_generic(env);
2147     }
2148 }
2149 
2150 /*
2151  * Sets CPU_INTERRUPT_HARD if there is at least one unmasked interrupt to be
2152  * delivered and clears CPU_INTERRUPT_HARD otherwise.
2153  *
2154  * This method is called by ppc_set_interrupt when an interrupt is raised or
2155  * lowered, and should also be called whenever an interrupt masking condition
2156  * is changed, e.g.:
2157  *  - When relevant bits of MSR are altered, like EE, HV, PR, etc.;
2158  *  - When relevant bits of LPCR are altered, like PECE, HDICE, HVICE, etc.;
2159  *  - When PSSCR[EC] or env->resume_as_sreset are changed;
2160  *  - When cs->halted is changed and the CPU has a different interrupt masking
2161  *    logic in power-saving mode (e.g., POWER7/8/9/10);
2162  */
2163 void ppc_maybe_interrupt(CPUPPCState *env)
2164 {
2165     CPUState *cs = env_cpu(env);
2166     bool locked = false;
2167 
2168     if (!qemu_mutex_iothread_locked()) {
2169         locked = true;
2170         qemu_mutex_lock_iothread();
2171     }
2172 
2173     if (ppc_next_unmasked_interrupt(env)) {
2174         cpu_interrupt(cs, CPU_INTERRUPT_HARD);
2175     } else {
2176         cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
2177     }
2178 
2179     if (locked) {
2180         qemu_mutex_unlock_iothread();
2181     }
2182 }
2183 
2184 #if defined(TARGET_PPC64)
2185 static void p7_deliver_interrupt(CPUPPCState *env, int interrupt)
2186 {
2187     PowerPCCPU *cpu = env_archcpu(env);
2188     CPUState *cs = env_cpu(env);
2189 
2190     switch (interrupt) {
2191     case PPC_INTERRUPT_MCK: /* Machine check exception */
2192         env->pending_interrupts &= ~PPC_INTERRUPT_MCK;
2193         powerpc_excp(cpu, POWERPC_EXCP_MCHECK);
2194         break;
2195 
2196     case PPC_INTERRUPT_HDECR: /* Hypervisor decrementer exception */
2197         /* HDEC clears on delivery */
2198         env->pending_interrupts &= ~PPC_INTERRUPT_HDECR;
2199         powerpc_excp(cpu, POWERPC_EXCP_HDECR);
2200         break;
2201 
2202     case PPC_INTERRUPT_EXT:
2203         if (books_vhyp_promotes_external_to_hvirt(cpu)) {
2204             powerpc_excp(cpu, POWERPC_EXCP_HVIRT);
2205         } else {
2206             powerpc_excp(cpu, POWERPC_EXCP_EXTERNAL);
2207         }
2208         break;
2209 
2210     case PPC_INTERRUPT_DECR: /* Decrementer exception */
2211         powerpc_excp(cpu, POWERPC_EXCP_DECR);
2212         break;
2213     case PPC_INTERRUPT_PERFM:
2214         env->pending_interrupts &= ~PPC_INTERRUPT_PERFM;
2215         powerpc_excp(cpu, POWERPC_EXCP_PERFM);
2216         break;
2217     case 0:
2218         /*
2219          * This is a bug ! It means that has_work took us out of halt without
2220          * anything to deliver while in a PM state that requires getting
2221          * out via a 0x100
2222          *
2223          * This means we will incorrectly execute past the power management
2224          * instruction instead of triggering a reset.
2225          *
2226          * It generally means a discrepancy between the wakeup conditions in the
2227          * processor has_work implementation and the logic in this function.
2228          */
2229         assert(!env->resume_as_sreset);
2230         break;
2231     default:
2232         cpu_abort(cs, "Invalid PowerPC interrupt %d. Aborting\n", interrupt);
2233     }
2234 }
2235 
2236 static void p8_deliver_interrupt(CPUPPCState *env, int interrupt)
2237 {
2238     PowerPCCPU *cpu = env_archcpu(env);
2239     CPUState *cs = env_cpu(env);
2240 
2241     switch (interrupt) {
2242     case PPC_INTERRUPT_MCK: /* Machine check exception */
2243         env->pending_interrupts &= ~PPC_INTERRUPT_MCK;
2244         powerpc_excp(cpu, POWERPC_EXCP_MCHECK);
2245         break;
2246 
2247     case PPC_INTERRUPT_HDECR: /* Hypervisor decrementer exception */
2248         /* HDEC clears on delivery */
2249         env->pending_interrupts &= ~PPC_INTERRUPT_HDECR;
2250         powerpc_excp(cpu, POWERPC_EXCP_HDECR);
2251         break;
2252 
2253     case PPC_INTERRUPT_EXT:
2254         if (books_vhyp_promotes_external_to_hvirt(cpu)) {
2255             powerpc_excp(cpu, POWERPC_EXCP_HVIRT);
2256         } else {
2257             powerpc_excp(cpu, POWERPC_EXCP_EXTERNAL);
2258         }
2259         break;
2260 
2261     case PPC_INTERRUPT_DECR: /* Decrementer exception */
2262         powerpc_excp(cpu, POWERPC_EXCP_DECR);
2263         break;
2264     case PPC_INTERRUPT_DOORBELL:
2265         env->pending_interrupts &= ~PPC_INTERRUPT_DOORBELL;
2266         if (is_book3s_arch2x(env)) {
2267             powerpc_excp(cpu, POWERPC_EXCP_SDOOR);
2268         } else {
2269             powerpc_excp(cpu, POWERPC_EXCP_DOORI);
2270         }
2271         break;
2272     case PPC_INTERRUPT_HDOORBELL:
2273         env->pending_interrupts &= ~PPC_INTERRUPT_HDOORBELL;
2274         powerpc_excp(cpu, POWERPC_EXCP_SDOOR_HV);
2275         break;
2276     case PPC_INTERRUPT_PERFM:
2277         env->pending_interrupts &= ~PPC_INTERRUPT_PERFM;
2278         powerpc_excp(cpu, POWERPC_EXCP_PERFM);
2279         break;
2280     case PPC_INTERRUPT_EBB: /* EBB exception */
2281         env->pending_interrupts &= ~PPC_INTERRUPT_EBB;
2282         if (env->spr[SPR_BESCR] & BESCR_PMEO) {
2283             powerpc_excp(cpu, POWERPC_EXCP_PERFM_EBB);
2284         } else if (env->spr[SPR_BESCR] & BESCR_EEO) {
2285             powerpc_excp(cpu, POWERPC_EXCP_EXTERNAL_EBB);
2286         }
2287         break;
2288     case 0:
2289         /*
2290          * This is a bug ! It means that has_work took us out of halt without
2291          * anything to deliver while in a PM state that requires getting
2292          * out via a 0x100
2293          *
2294          * This means we will incorrectly execute past the power management
2295          * instruction instead of triggering a reset.
2296          *
2297          * It generally means a discrepancy between the wakeup conditions in the
2298          * processor has_work implementation and the logic in this function.
2299          */
2300         assert(!env->resume_as_sreset);
2301         break;
2302     default:
2303         cpu_abort(cs, "Invalid PowerPC interrupt %d. Aborting\n", interrupt);
2304     }
2305 }
2306 
2307 static void p9_deliver_interrupt(CPUPPCState *env, int interrupt)
2308 {
2309     PowerPCCPU *cpu = env_archcpu(env);
2310     CPUState *cs = env_cpu(env);
2311 
2312     if (cs->halted && !(env->spr[SPR_PSSCR] & PSSCR_EC) &&
2313         !FIELD_EX64(env->msr, MSR, EE)) {
2314         /*
2315          * A pending interrupt took us out of power-saving, but MSR[EE] says
2316          * that we should return to NIP+4 instead of delivering it.
2317          */
2318         return;
2319     }
2320 
2321     switch (interrupt) {
2322     case PPC_INTERRUPT_MCK: /* Machine check exception */
2323         env->pending_interrupts &= ~PPC_INTERRUPT_MCK;
2324         powerpc_excp(cpu, POWERPC_EXCP_MCHECK);
2325         break;
2326 
2327     case PPC_INTERRUPT_HDECR: /* Hypervisor decrementer exception */
2328         /* HDEC clears on delivery */
2329         env->pending_interrupts &= ~PPC_INTERRUPT_HDECR;
2330         powerpc_excp(cpu, POWERPC_EXCP_HDECR);
2331         break;
2332     case PPC_INTERRUPT_HVIRT: /* Hypervisor virtualization interrupt */
2333         powerpc_excp(cpu, POWERPC_EXCP_HVIRT);
2334         break;
2335 
2336     case PPC_INTERRUPT_EXT:
2337         if (books_vhyp_promotes_external_to_hvirt(cpu)) {
2338             powerpc_excp(cpu, POWERPC_EXCP_HVIRT);
2339         } else {
2340             powerpc_excp(cpu, POWERPC_EXCP_EXTERNAL);
2341         }
2342         break;
2343 
2344     case PPC_INTERRUPT_DECR: /* Decrementer exception */
2345         powerpc_excp(cpu, POWERPC_EXCP_DECR);
2346         break;
2347     case PPC_INTERRUPT_DOORBELL:
2348         env->pending_interrupts &= ~PPC_INTERRUPT_DOORBELL;
2349         powerpc_excp(cpu, POWERPC_EXCP_SDOOR);
2350         break;
2351     case PPC_INTERRUPT_HDOORBELL:
2352         env->pending_interrupts &= ~PPC_INTERRUPT_HDOORBELL;
2353         powerpc_excp(cpu, POWERPC_EXCP_SDOOR_HV);
2354         break;
2355     case PPC_INTERRUPT_PERFM:
2356         env->pending_interrupts &= ~PPC_INTERRUPT_PERFM;
2357         powerpc_excp(cpu, POWERPC_EXCP_PERFM);
2358         break;
2359     case PPC_INTERRUPT_EBB: /* EBB exception */
2360         env->pending_interrupts &= ~PPC_INTERRUPT_EBB;
2361         if (env->spr[SPR_BESCR] & BESCR_PMEO) {
2362             powerpc_excp(cpu, POWERPC_EXCP_PERFM_EBB);
2363         } else if (env->spr[SPR_BESCR] & BESCR_EEO) {
2364             powerpc_excp(cpu, POWERPC_EXCP_EXTERNAL_EBB);
2365         }
2366         break;
2367     case 0:
2368         /*
2369          * This is a bug ! It means that has_work took us out of halt without
2370          * anything to deliver while in a PM state that requires getting
2371          * out via a 0x100
2372          *
2373          * This means we will incorrectly execute past the power management
2374          * instruction instead of triggering a reset.
2375          *
2376          * It generally means a discrepancy between the wakeup conditions in the
2377          * processor has_work implementation and the logic in this function.
2378          */
2379         assert(!env->resume_as_sreset);
2380         break;
2381     default:
2382         cpu_abort(cs, "Invalid PowerPC interrupt %d. Aborting\n", interrupt);
2383     }
2384 }
2385 #endif
2386 
2387 static void ppc_deliver_interrupt_generic(CPUPPCState *env, int interrupt)
2388 {
2389     PowerPCCPU *cpu = env_archcpu(env);
2390     CPUState *cs = env_cpu(env);
2391 
2392     switch (interrupt) {
2393     case PPC_INTERRUPT_RESET: /* External reset */
2394         env->pending_interrupts &= ~PPC_INTERRUPT_RESET;
2395         powerpc_excp(cpu, POWERPC_EXCP_RESET);
2396         break;
2397     case PPC_INTERRUPT_MCK: /* Machine check exception */
2398         env->pending_interrupts &= ~PPC_INTERRUPT_MCK;
2399         powerpc_excp(cpu, POWERPC_EXCP_MCHECK);
2400         break;
2401 
2402     case PPC_INTERRUPT_HDECR: /* Hypervisor decrementer exception */
2403         /* HDEC clears on delivery */
2404         env->pending_interrupts &= ~PPC_INTERRUPT_HDECR;
2405         powerpc_excp(cpu, POWERPC_EXCP_HDECR);
2406         break;
2407     case PPC_INTERRUPT_HVIRT: /* Hypervisor virtualization interrupt */
2408         powerpc_excp(cpu, POWERPC_EXCP_HVIRT);
2409         break;
2410 
2411     case PPC_INTERRUPT_EXT:
2412         if (books_vhyp_promotes_external_to_hvirt(cpu)) {
2413             powerpc_excp(cpu, POWERPC_EXCP_HVIRT);
2414         } else {
2415             powerpc_excp(cpu, POWERPC_EXCP_EXTERNAL);
2416         }
2417         break;
2418     case PPC_INTERRUPT_CEXT: /* External critical interrupt */
2419         powerpc_excp(cpu, POWERPC_EXCP_CRITICAL);
2420         break;
2421 
2422     case PPC_INTERRUPT_WDT: /* Watchdog timer on embedded PowerPC */
2423         env->pending_interrupts &= ~PPC_INTERRUPT_WDT;
2424         powerpc_excp(cpu, POWERPC_EXCP_WDT);
2425         break;
2426     case PPC_INTERRUPT_CDOORBELL:
2427         env->pending_interrupts &= ~PPC_INTERRUPT_CDOORBELL;
2428         powerpc_excp(cpu, POWERPC_EXCP_DOORCI);
2429         break;
2430     case PPC_INTERRUPT_FIT: /* Fixed interval timer on embedded PowerPC */
2431         env->pending_interrupts &= ~PPC_INTERRUPT_FIT;
2432         powerpc_excp(cpu, POWERPC_EXCP_FIT);
2433         break;
2434     case PPC_INTERRUPT_PIT: /* Programmable interval timer on embedded ppc */
2435         env->pending_interrupts &= ~PPC_INTERRUPT_PIT;
2436         powerpc_excp(cpu, POWERPC_EXCP_PIT);
2437         break;
2438     case PPC_INTERRUPT_DECR: /* Decrementer exception */
2439         if (ppc_decr_clear_on_delivery(env)) {
2440             env->pending_interrupts &= ~PPC_INTERRUPT_DECR;
2441         }
2442         powerpc_excp(cpu, POWERPC_EXCP_DECR);
2443         break;
2444     case PPC_INTERRUPT_DOORBELL:
2445         env->pending_interrupts &= ~PPC_INTERRUPT_DOORBELL;
2446         if (is_book3s_arch2x(env)) {
2447             powerpc_excp(cpu, POWERPC_EXCP_SDOOR);
2448         } else {
2449             powerpc_excp(cpu, POWERPC_EXCP_DOORI);
2450         }
2451         break;
2452     case PPC_INTERRUPT_HDOORBELL:
2453         env->pending_interrupts &= ~PPC_INTERRUPT_HDOORBELL;
2454         powerpc_excp(cpu, POWERPC_EXCP_SDOOR_HV);
2455         break;
2456     case PPC_INTERRUPT_PERFM:
2457         env->pending_interrupts &= ~PPC_INTERRUPT_PERFM;
2458         powerpc_excp(cpu, POWERPC_EXCP_PERFM);
2459         break;
2460     case PPC_INTERRUPT_THERM:  /* Thermal interrupt */
2461         env->pending_interrupts &= ~PPC_INTERRUPT_THERM;
2462         powerpc_excp(cpu, POWERPC_EXCP_THERM);
2463         break;
2464     case PPC_INTERRUPT_EBB: /* EBB exception */
2465         env->pending_interrupts &= ~PPC_INTERRUPT_EBB;
2466         if (env->spr[SPR_BESCR] & BESCR_PMEO) {
2467             powerpc_excp(cpu, POWERPC_EXCP_PERFM_EBB);
2468         } else if (env->spr[SPR_BESCR] & BESCR_EEO) {
2469             powerpc_excp(cpu, POWERPC_EXCP_EXTERNAL_EBB);
2470         }
2471         break;
2472     case 0:
2473         /*
2474          * This is a bug ! It means that has_work took us out of halt without
2475          * anything to deliver while in a PM state that requires getting
2476          * out via a 0x100
2477          *
2478          * This means we will incorrectly execute past the power management
2479          * instruction instead of triggering a reset.
2480          *
2481          * It generally means a discrepancy between the wakeup conditions in the
2482          * processor has_work implementation and the logic in this function.
2483          */
2484         assert(!env->resume_as_sreset);
2485         break;
2486     default:
2487         cpu_abort(cs, "Invalid PowerPC interrupt %d. Aborting\n", interrupt);
2488     }
2489 }
2490 
2491 static void ppc_deliver_interrupt(CPUPPCState *env, int interrupt)
2492 {
2493     switch (env->excp_model) {
2494 #if defined(TARGET_PPC64)
2495     case POWERPC_EXCP_POWER7:
2496         p7_deliver_interrupt(env, interrupt);
2497         break;
2498     case POWERPC_EXCP_POWER8:
2499         p8_deliver_interrupt(env, interrupt);
2500         break;
2501     case POWERPC_EXCP_POWER9:
2502     case POWERPC_EXCP_POWER10:
2503         p9_deliver_interrupt(env, interrupt);
2504         break;
2505 #endif
2506     default:
2507         ppc_deliver_interrupt_generic(env, interrupt);
2508     }
2509 }
2510 
2511 void ppc_cpu_do_system_reset(CPUState *cs)
2512 {
2513     PowerPCCPU *cpu = POWERPC_CPU(cs);
2514 
2515     powerpc_excp(cpu, POWERPC_EXCP_RESET);
2516 }
2517 
2518 void ppc_cpu_do_fwnmi_machine_check(CPUState *cs, target_ulong vector)
2519 {
2520     PowerPCCPU *cpu = POWERPC_CPU(cs);
2521     CPUPPCState *env = &cpu->env;
2522     target_ulong msr = 0;
2523 
2524     /*
2525      * Set MSR and NIP for the handler, SRR0/1, DAR and DSISR have already
2526      * been set by KVM.
2527      */
2528     msr = (1ULL << MSR_ME);
2529     msr |= env->msr & (1ULL << MSR_SF);
2530     if (ppc_interrupts_little_endian(cpu, false)) {
2531         msr |= (1ULL << MSR_LE);
2532     }
2533 
2534     /* Anything for nested required here? MSR[HV] bit? */
2535 
2536     powerpc_set_excp_state(cpu, vector, msr);
2537 }
2538 
2539 bool ppc_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
2540 {
2541     PowerPCCPU *cpu = POWERPC_CPU(cs);
2542     CPUPPCState *env = &cpu->env;
2543     int interrupt;
2544 
2545     if ((interrupt_request & CPU_INTERRUPT_HARD) == 0) {
2546         return false;
2547     }
2548 
2549     interrupt = ppc_next_unmasked_interrupt(env);
2550     if (interrupt == 0) {
2551         return false;
2552     }
2553 
2554     ppc_deliver_interrupt(env, interrupt);
2555     if (env->pending_interrupts == 0) {
2556         cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
2557     }
2558     return true;
2559 }
2560 
2561 #endif /* !CONFIG_USER_ONLY */
2562 
2563 /*****************************************************************************/
2564 /* Exceptions processing helpers */
2565 
2566 void raise_exception_err_ra(CPUPPCState *env, uint32_t exception,
2567                             uint32_t error_code, uintptr_t raddr)
2568 {
2569     CPUState *cs = env_cpu(env);
2570 
2571     cs->exception_index = exception;
2572     env->error_code = error_code;
2573     cpu_loop_exit_restore(cs, raddr);
2574 }
2575 
2576 void raise_exception_err(CPUPPCState *env, uint32_t exception,
2577                          uint32_t error_code)
2578 {
2579     raise_exception_err_ra(env, exception, error_code, 0);
2580 }
2581 
2582 void raise_exception(CPUPPCState *env, uint32_t exception)
2583 {
2584     raise_exception_err_ra(env, exception, 0, 0);
2585 }
2586 
2587 void raise_exception_ra(CPUPPCState *env, uint32_t exception,
2588                         uintptr_t raddr)
2589 {
2590     raise_exception_err_ra(env, exception, 0, raddr);
2591 }
2592 
2593 #ifdef CONFIG_TCG
2594 void helper_raise_exception_err(CPUPPCState *env, uint32_t exception,
2595                                 uint32_t error_code)
2596 {
2597     raise_exception_err_ra(env, exception, error_code, 0);
2598 }
2599 
2600 void helper_raise_exception(CPUPPCState *env, uint32_t exception)
2601 {
2602     raise_exception_err_ra(env, exception, 0, 0);
2603 }
2604 #endif
2605 
2606 #if !defined(CONFIG_USER_ONLY)
2607 #ifdef CONFIG_TCG
2608 void helper_store_msr(CPUPPCState *env, target_ulong val)
2609 {
2610     uint32_t excp = hreg_store_msr(env, val, 0);
2611 
2612     if (excp != 0) {
2613         CPUState *cs = env_cpu(env);
2614         cpu_interrupt_exittb(cs);
2615         raise_exception(env, excp);
2616     }
2617 }
2618 
2619 void helper_ppc_maybe_interrupt(CPUPPCState *env)
2620 {
2621     ppc_maybe_interrupt(env);
2622 }
2623 
2624 #if defined(TARGET_PPC64)
2625 void helper_scv(CPUPPCState *env, uint32_t lev)
2626 {
2627     if (env->spr[SPR_FSCR] & (1ull << FSCR_SCV)) {
2628         raise_exception_err(env, POWERPC_EXCP_SYSCALL_VECTORED, lev);
2629     } else {
2630         raise_exception_err(env, POWERPC_EXCP_FU, FSCR_IC_SCV);
2631     }
2632 }
2633 
2634 void helper_pminsn(CPUPPCState *env, powerpc_pm_insn_t insn)
2635 {
2636     CPUState *cs;
2637 
2638     cs = env_cpu(env);
2639     cs->halted = 1;
2640 
2641     /* Condition for waking up at 0x100 */
2642     env->resume_as_sreset = (insn != PPC_PM_STOP) ||
2643         (env->spr[SPR_PSSCR] & PSSCR_EC);
2644 
2645     ppc_maybe_interrupt(env);
2646 }
2647 #endif /* defined(TARGET_PPC64) */
2648 
2649 static void do_rfi(CPUPPCState *env, target_ulong nip, target_ulong msr)
2650 {
2651     CPUState *cs = env_cpu(env);
2652 
2653     /* MSR:POW cannot be set by any form of rfi */
2654     msr &= ~(1ULL << MSR_POW);
2655 
2656     /* MSR:TGPR cannot be set by any form of rfi */
2657     if (env->flags & POWERPC_FLAG_TGPR)
2658         msr &= ~(1ULL << MSR_TGPR);
2659 
2660 #if defined(TARGET_PPC64)
2661     /* Switching to 32-bit ? Crop the nip */
2662     if (!msr_is_64bit(env, msr)) {
2663         nip = (uint32_t)nip;
2664     }
2665 #else
2666     nip = (uint32_t)nip;
2667 #endif
2668     /* XXX: beware: this is false if VLE is supported */
2669     env->nip = nip & ~((target_ulong)0x00000003);
2670     hreg_store_msr(env, msr, 1);
2671     trace_ppc_excp_rfi(env->nip, env->msr);
2672     /*
2673      * No need to raise an exception here, as rfi is always the last
2674      * insn of a TB
2675      */
2676     cpu_interrupt_exittb(cs);
2677     /* Reset the reservation */
2678     env->reserve_addr = -1;
2679 
2680     /* Context synchronizing: check if TCG TLB needs flush */
2681     check_tlb_flush(env, false);
2682 }
2683 
2684 void helper_rfi(CPUPPCState *env)
2685 {
2686     do_rfi(env, env->spr[SPR_SRR0], env->spr[SPR_SRR1] & 0xfffffffful);
2687 }
2688 
2689 #if defined(TARGET_PPC64)
2690 void helper_rfid(CPUPPCState *env)
2691 {
2692     /*
2693      * The architecture defines a number of rules for which bits can
2694      * change but in practice, we handle this in hreg_store_msr()
2695      * which will be called by do_rfi(), so there is no need to filter
2696      * here
2697      */
2698     do_rfi(env, env->spr[SPR_SRR0], env->spr[SPR_SRR1]);
2699 }
2700 
2701 void helper_rfscv(CPUPPCState *env)
2702 {
2703     do_rfi(env, env->lr, env->ctr);
2704 }
2705 
2706 void helper_hrfid(CPUPPCState *env)
2707 {
2708     do_rfi(env, env->spr[SPR_HSRR0], env->spr[SPR_HSRR1]);
2709 }
2710 #endif
2711 
2712 #if defined(TARGET_PPC64) && !defined(CONFIG_USER_ONLY)
2713 void helper_rfebb(CPUPPCState *env, target_ulong s)
2714 {
2715     target_ulong msr = env->msr;
2716 
2717     /*
2718      * Handling of BESCR bits 32:33 according to PowerISA v3.1:
2719      *
2720      * "If BESCR 32:33 != 0b00 the instruction is treated as if
2721      *  the instruction form were invalid."
2722      */
2723     if (env->spr[SPR_BESCR] & BESCR_INVALID) {
2724         raise_exception_err(env, POWERPC_EXCP_PROGRAM,
2725                             POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL);
2726     }
2727 
2728     env->nip = env->spr[SPR_EBBRR];
2729 
2730     /* Switching to 32-bit ? Crop the nip */
2731     if (!msr_is_64bit(env, msr)) {
2732         env->nip = (uint32_t)env->spr[SPR_EBBRR];
2733     }
2734 
2735     if (s) {
2736         env->spr[SPR_BESCR] |= BESCR_GE;
2737     } else {
2738         env->spr[SPR_BESCR] &= ~BESCR_GE;
2739     }
2740 }
2741 
2742 /*
2743  * Triggers or queues an 'ebb_excp' EBB exception. All checks
2744  * but FSCR, HFSCR and msr_pr must be done beforehand.
2745  *
2746  * PowerISA v3.1 isn't clear about whether an EBB should be
2747  * postponed or cancelled if the EBB facility is unavailable.
2748  * Our assumption here is that the EBB is cancelled if both
2749  * FSCR and HFSCR EBB facilities aren't available.
2750  */
2751 static void do_ebb(CPUPPCState *env, int ebb_excp)
2752 {
2753     PowerPCCPU *cpu = env_archcpu(env);
2754 
2755     /*
2756      * FSCR_EBB and FSCR_IC_EBB are the same bits used with
2757      * HFSCR.
2758      */
2759     helper_fscr_facility_check(env, FSCR_EBB, 0, FSCR_IC_EBB);
2760     helper_hfscr_facility_check(env, FSCR_EBB, "EBB", FSCR_IC_EBB);
2761 
2762     if (ebb_excp == POWERPC_EXCP_PERFM_EBB) {
2763         env->spr[SPR_BESCR] |= BESCR_PMEO;
2764     } else if (ebb_excp == POWERPC_EXCP_EXTERNAL_EBB) {
2765         env->spr[SPR_BESCR] |= BESCR_EEO;
2766     }
2767 
2768     if (FIELD_EX64(env->msr, MSR, PR)) {
2769         powerpc_excp(cpu, ebb_excp);
2770     } else {
2771         ppc_set_irq(cpu, PPC_INTERRUPT_EBB, 1);
2772     }
2773 }
2774 
2775 void raise_ebb_perfm_exception(CPUPPCState *env)
2776 {
2777     bool perfm_ebb_enabled = env->spr[SPR_POWER_MMCR0] & MMCR0_EBE &&
2778                              env->spr[SPR_BESCR] & BESCR_PME &&
2779                              env->spr[SPR_BESCR] & BESCR_GE;
2780 
2781     if (!perfm_ebb_enabled) {
2782         return;
2783     }
2784 
2785     do_ebb(env, POWERPC_EXCP_PERFM_EBB);
2786 }
2787 #endif
2788 
2789 /*****************************************************************************/
2790 /* Embedded PowerPC specific helpers */
2791 void helper_40x_rfci(CPUPPCState *env)
2792 {
2793     do_rfi(env, env->spr[SPR_40x_SRR2], env->spr[SPR_40x_SRR3]);
2794 }
2795 
2796 void helper_rfci(CPUPPCState *env)
2797 {
2798     do_rfi(env, env->spr[SPR_BOOKE_CSRR0], env->spr[SPR_BOOKE_CSRR1]);
2799 }
2800 
2801 void helper_rfdi(CPUPPCState *env)
2802 {
2803     /* FIXME: choose CSRR1 or DSRR1 based on cpu type */
2804     do_rfi(env, env->spr[SPR_BOOKE_DSRR0], env->spr[SPR_BOOKE_DSRR1]);
2805 }
2806 
2807 void helper_rfmci(CPUPPCState *env)
2808 {
2809     /* FIXME: choose CSRR1 or MCSRR1 based on cpu type */
2810     do_rfi(env, env->spr[SPR_BOOKE_MCSRR0], env->spr[SPR_BOOKE_MCSRR1]);
2811 }
2812 #endif /* CONFIG_TCG */
2813 #endif /* !defined(CONFIG_USER_ONLY) */
2814 
2815 #ifdef CONFIG_TCG
2816 void helper_tw(CPUPPCState *env, target_ulong arg1, target_ulong arg2,
2817                uint32_t flags)
2818 {
2819     if (!likely(!(((int32_t)arg1 < (int32_t)arg2 && (flags & 0x10)) ||
2820                   ((int32_t)arg1 > (int32_t)arg2 && (flags & 0x08)) ||
2821                   ((int32_t)arg1 == (int32_t)arg2 && (flags & 0x04)) ||
2822                   ((uint32_t)arg1 < (uint32_t)arg2 && (flags & 0x02)) ||
2823                   ((uint32_t)arg1 > (uint32_t)arg2 && (flags & 0x01))))) {
2824         raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
2825                                POWERPC_EXCP_TRAP, GETPC());
2826     }
2827 }
2828 
2829 #if defined(TARGET_PPC64)
2830 void helper_td(CPUPPCState *env, target_ulong arg1, target_ulong arg2,
2831                uint32_t flags)
2832 {
2833     if (!likely(!(((int64_t)arg1 < (int64_t)arg2 && (flags & 0x10)) ||
2834                   ((int64_t)arg1 > (int64_t)arg2 && (flags & 0x08)) ||
2835                   ((int64_t)arg1 == (int64_t)arg2 && (flags & 0x04)) ||
2836                   ((uint64_t)arg1 < (uint64_t)arg2 && (flags & 0x02)) ||
2837                   ((uint64_t)arg1 > (uint64_t)arg2 && (flags & 0x01))))) {
2838         raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,
2839                                POWERPC_EXCP_TRAP, GETPC());
2840     }
2841 }
2842 #endif
2843 #endif
2844 
2845 static uint32_t helper_SIMON_LIKE_32_64(uint32_t x, uint64_t key, uint32_t lane)
2846 {
2847     const uint16_t c = 0xfffc;
2848     const uint64_t z0 = 0xfa2561cdf44ac398ULL;
2849     uint16_t z = 0, temp;
2850     uint16_t k[32], eff_k[32], xleft[33], xright[33], fxleft[32];
2851 
2852     for (int i = 3; i >= 0; i--) {
2853         k[i] = key & 0xffff;
2854         key >>= 16;
2855     }
2856     xleft[0] = x & 0xffff;
2857     xright[0] = (x >> 16) & 0xffff;
2858 
2859     for (int i = 0; i < 28; i++) {
2860         z = (z0 >> (63 - i)) & 1;
2861         temp = ror16(k[i + 3], 3) ^ k[i + 1];
2862         k[i + 4] = c ^ z ^ k[i] ^ temp ^ ror16(temp, 1);
2863     }
2864 
2865     for (int i = 0; i < 8; i++) {
2866         eff_k[4 * i + 0] = k[4 * i + ((0 + lane) % 4)];
2867         eff_k[4 * i + 1] = k[4 * i + ((1 + lane) % 4)];
2868         eff_k[4 * i + 2] = k[4 * i + ((2 + lane) % 4)];
2869         eff_k[4 * i + 3] = k[4 * i + ((3 + lane) % 4)];
2870     }
2871 
2872     for (int i = 0; i < 32; i++) {
2873         fxleft[i] = (rol16(xleft[i], 1) &
2874             rol16(xleft[i], 8)) ^ rol16(xleft[i], 2);
2875         xleft[i + 1] = xright[i] ^ fxleft[i] ^ eff_k[i];
2876         xright[i + 1] = xleft[i];
2877     }
2878 
2879     return (((uint32_t)xright[32]) << 16) | xleft[32];
2880 }
2881 
2882 static uint64_t hash_digest(uint64_t ra, uint64_t rb, uint64_t key)
2883 {
2884     uint64_t stage0_h = 0ULL, stage0_l = 0ULL;
2885     uint64_t stage1_h, stage1_l;
2886 
2887     for (int i = 0; i < 4; i++) {
2888         stage0_h |= ror64(rb & 0xff, 8 * (2 * i + 1));
2889         stage0_h |= ((ra >> 32) & 0xff) << (8 * 2 * i);
2890         stage0_l |= ror64((rb >> 32) & 0xff, 8 * (2 * i + 1));
2891         stage0_l |= (ra & 0xff) << (8 * 2 * i);
2892         rb >>= 8;
2893         ra >>= 8;
2894     }
2895 
2896     stage1_h = (uint64_t)helper_SIMON_LIKE_32_64(stage0_h >> 32, key, 0) << 32;
2897     stage1_h |= helper_SIMON_LIKE_32_64(stage0_h, key, 1);
2898     stage1_l = (uint64_t)helper_SIMON_LIKE_32_64(stage0_l >> 32, key, 2) << 32;
2899     stage1_l |= helper_SIMON_LIKE_32_64(stage0_l, key, 3);
2900 
2901     return stage1_h ^ stage1_l;
2902 }
2903 
2904 #include "qemu/guest-random.h"
2905 
2906 #define HELPER_HASH(op, key, store)                                           \
2907 void helper_##op(CPUPPCState *env, target_ulong ea, target_ulong ra,          \
2908                  target_ulong rb)                                             \
2909 {                                                                             \
2910     uint64_t calculated_hash = hash_digest(ra, rb, key), loaded_hash;         \
2911                                                                               \
2912     if (store) {                                                              \
2913         cpu_stq_data_ra(env, ea, calculated_hash, GETPC());                   \
2914     } else {                                                                  \
2915         loaded_hash = cpu_ldq_data_ra(env, ea, GETPC());                      \
2916         if (loaded_hash != calculated_hash) {                                 \
2917             raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM,                 \
2918                 POWERPC_EXCP_TRAP, GETPC());                                  \
2919         }                                                                     \
2920     }                                                                         \
2921 }
2922 
2923 HELPER_HASH(HASHST, env->spr[SPR_HASHKEYR], true)
2924 HELPER_HASH(HASHCHK, env->spr[SPR_HASHKEYR], false)
2925 HELPER_HASH(HASHSTP, env->spr[SPR_HASHPKEYR], true)
2926 HELPER_HASH(HASHCHKP, env->spr[SPR_HASHPKEYR], false)
2927 
2928 #if !defined(CONFIG_USER_ONLY)
2929 
2930 #ifdef CONFIG_TCG
2931 
2932 /* Embedded.Processor Control */
2933 static int dbell2irq(target_ulong rb)
2934 {
2935     int msg = rb & DBELL_TYPE_MASK;
2936     int irq = -1;
2937 
2938     switch (msg) {
2939     case DBELL_TYPE_DBELL:
2940         irq = PPC_INTERRUPT_DOORBELL;
2941         break;
2942     case DBELL_TYPE_DBELL_CRIT:
2943         irq = PPC_INTERRUPT_CDOORBELL;
2944         break;
2945     case DBELL_TYPE_G_DBELL:
2946     case DBELL_TYPE_G_DBELL_CRIT:
2947     case DBELL_TYPE_G_DBELL_MC:
2948         /* XXX implement */
2949     default:
2950         break;
2951     }
2952 
2953     return irq;
2954 }
2955 
2956 void helper_msgclr(CPUPPCState *env, target_ulong rb)
2957 {
2958     int irq = dbell2irq(rb);
2959 
2960     if (irq < 0) {
2961         return;
2962     }
2963 
2964     ppc_set_irq(env_archcpu(env), irq, 0);
2965 }
2966 
2967 void helper_msgsnd(target_ulong rb)
2968 {
2969     int irq = dbell2irq(rb);
2970     int pir = rb & DBELL_PIRTAG_MASK;
2971     CPUState *cs;
2972 
2973     if (irq < 0) {
2974         return;
2975     }
2976 
2977     qemu_mutex_lock_iothread();
2978     CPU_FOREACH(cs) {
2979         PowerPCCPU *cpu = POWERPC_CPU(cs);
2980         CPUPPCState *cenv = &cpu->env;
2981 
2982         if ((rb & DBELL_BRDCAST) || (cenv->spr[SPR_BOOKE_PIR] == pir)) {
2983             ppc_set_irq(cpu, irq, 1);
2984         }
2985     }
2986     qemu_mutex_unlock_iothread();
2987 }
2988 
2989 /* Server Processor Control */
2990 
2991 static bool dbell_type_server(target_ulong rb)
2992 {
2993     /*
2994      * A Directed Hypervisor Doorbell message is sent only if the
2995      * message type is 5. All other types are reserved and the
2996      * instruction is a no-op
2997      */
2998     return (rb & DBELL_TYPE_MASK) == DBELL_TYPE_DBELL_SERVER;
2999 }
3000 
3001 void helper_book3s_msgclr(CPUPPCState *env, target_ulong rb)
3002 {
3003     if (!dbell_type_server(rb)) {
3004         return;
3005     }
3006 
3007     ppc_set_irq(env_archcpu(env), PPC_INTERRUPT_HDOORBELL, 0);
3008 }
3009 
3010 static void book3s_msgsnd_common(int pir, int irq)
3011 {
3012     CPUState *cs;
3013 
3014     qemu_mutex_lock_iothread();
3015     CPU_FOREACH(cs) {
3016         PowerPCCPU *cpu = POWERPC_CPU(cs);
3017         CPUPPCState *cenv = &cpu->env;
3018 
3019         /* TODO: broadcast message to all threads of the same  processor */
3020         if (cenv->spr_cb[SPR_PIR].default_value == pir) {
3021             ppc_set_irq(cpu, irq, 1);
3022         }
3023     }
3024     qemu_mutex_unlock_iothread();
3025 }
3026 
3027 void helper_book3s_msgsnd(target_ulong rb)
3028 {
3029     int pir = rb & DBELL_PROCIDTAG_MASK;
3030 
3031     if (!dbell_type_server(rb)) {
3032         return;
3033     }
3034 
3035     book3s_msgsnd_common(pir, PPC_INTERRUPT_HDOORBELL);
3036 }
3037 
3038 #if defined(TARGET_PPC64)
3039 void helper_book3s_msgclrp(CPUPPCState *env, target_ulong rb)
3040 {
3041     helper_hfscr_facility_check(env, HFSCR_MSGP, "msgclrp", HFSCR_IC_MSGP);
3042 
3043     if (!dbell_type_server(rb)) {
3044         return;
3045     }
3046 
3047     ppc_set_irq(env_archcpu(env), PPC_INTERRUPT_HDOORBELL, 0);
3048 }
3049 
3050 /*
3051  * sends a message to other threads that are on the same
3052  * multi-threaded processor
3053  */
3054 void helper_book3s_msgsndp(CPUPPCState *env, target_ulong rb)
3055 {
3056     int pir = env->spr_cb[SPR_PIR].default_value;
3057 
3058     helper_hfscr_facility_check(env, HFSCR_MSGP, "msgsndp", HFSCR_IC_MSGP);
3059 
3060     if (!dbell_type_server(rb)) {
3061         return;
3062     }
3063 
3064     /* TODO: TCG supports only one thread */
3065 
3066     book3s_msgsnd_common(pir, PPC_INTERRUPT_DOORBELL);
3067 }
3068 #endif /* TARGET_PPC64 */
3069 
3070 void ppc_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
3071                                  MMUAccessType access_type,
3072                                  int mmu_idx, uintptr_t retaddr)
3073 {
3074     CPUPPCState *env = cs->env_ptr;
3075     uint32_t insn;
3076 
3077     /* Restore state and reload the insn we executed, for filling in DSISR.  */
3078     cpu_restore_state(cs, retaddr);
3079     insn = cpu_ldl_code(env, env->nip);
3080 
3081     switch (env->mmu_model) {
3082     case POWERPC_MMU_SOFT_4xx:
3083         env->spr[SPR_40x_DEAR] = vaddr;
3084         break;
3085     case POWERPC_MMU_BOOKE:
3086     case POWERPC_MMU_BOOKE206:
3087         env->spr[SPR_BOOKE_DEAR] = vaddr;
3088         break;
3089     default:
3090         env->spr[SPR_DAR] = vaddr;
3091         break;
3092     }
3093 
3094     cs->exception_index = POWERPC_EXCP_ALIGN;
3095     env->error_code = insn & 0x03FF0000;
3096     cpu_loop_exit(cs);
3097 }
3098 #endif /* CONFIG_TCG */
3099 #endif /* !CONFIG_USER_ONLY */
3100