1 /* 2 * PowerPC MMU, TLB, SLB and BAT emulation helpers for QEMU. 3 * 4 * Copyright (c) 2003-2007 Jocelyn Mayer 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 #include "qemu/osdep.h" 20 #include "qemu/units.h" 21 #include "cpu.h" 22 #include "exec/helper-proto.h" 23 #include "sysemu/kvm.h" 24 #include "kvm_ppc.h" 25 #include "mmu-hash64.h" 26 #include "mmu-hash32.h" 27 #include "exec/exec-all.h" 28 #include "exec/cpu_ldst.h" 29 #include "exec/log.h" 30 #include "helper_regs.h" 31 #include "qemu/error-report.h" 32 #include "mmu-book3s-v3.h" 33 #include "mmu-radix64.h" 34 35 //#define DEBUG_MMU 36 //#define DEBUG_BATS 37 //#define DEBUG_SOFTWARE_TLB 38 //#define DUMP_PAGE_TABLES 39 //#define FLUSH_ALL_TLBS 40 41 #ifdef DEBUG_MMU 42 # define LOG_MMU_STATE(cpu) log_cpu_state_mask(CPU_LOG_MMU, (cpu), 0) 43 #else 44 # define LOG_MMU_STATE(cpu) do { } while (0) 45 #endif 46 47 #ifdef DEBUG_SOFTWARE_TLB 48 # define LOG_SWTLB(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__) 49 #else 50 # define LOG_SWTLB(...) do { } while (0) 51 #endif 52 53 #ifdef DEBUG_BATS 54 # define LOG_BATS(...) qemu_log_mask(CPU_LOG_MMU, __VA_ARGS__) 55 #else 56 # define LOG_BATS(...) do { } while (0) 57 #endif 58 59 /*****************************************************************************/ 60 /* PowerPC MMU emulation */ 61 62 /* Context used internally during MMU translations */ 63 typedef struct mmu_ctx_t mmu_ctx_t; 64 struct mmu_ctx_t { 65 hwaddr raddr; /* Real address */ 66 hwaddr eaddr; /* Effective address */ 67 int prot; /* Protection bits */ 68 hwaddr hash[2]; /* Pagetable hash values */ 69 target_ulong ptem; /* Virtual segment ID | API */ 70 int key; /* Access key */ 71 int nx; /* Non-execute area */ 72 }; 73 74 /* Common routines used by software and hardware TLBs emulation */ 75 static inline int pte_is_valid(target_ulong pte0) 76 { 77 return pte0 & 0x80000000 ? 1 : 0; 78 } 79 80 static inline void pte_invalidate(target_ulong *pte0) 81 { 82 *pte0 &= ~0x80000000; 83 } 84 85 #define PTE_PTEM_MASK 0x7FFFFFBF 86 #define PTE_CHECK_MASK (TARGET_PAGE_MASK | 0x7B) 87 88 static int pp_check(int key, int pp, int nx) 89 { 90 int access; 91 92 /* Compute access rights */ 93 access = 0; 94 if (key == 0) { 95 switch (pp) { 96 case 0x0: 97 case 0x1: 98 case 0x2: 99 access |= PAGE_WRITE; 100 /* No break here */ 101 case 0x3: 102 access |= PAGE_READ; 103 break; 104 } 105 } else { 106 switch (pp) { 107 case 0x0: 108 access = 0; 109 break; 110 case 0x1: 111 case 0x3: 112 access = PAGE_READ; 113 break; 114 case 0x2: 115 access = PAGE_READ | PAGE_WRITE; 116 break; 117 } 118 } 119 if (nx == 0) { 120 access |= PAGE_EXEC; 121 } 122 123 return access; 124 } 125 126 static int check_prot(int prot, int rw, int access_type) 127 { 128 int ret; 129 130 if (access_type == ACCESS_CODE) { 131 if (prot & PAGE_EXEC) { 132 ret = 0; 133 } else { 134 ret = -2; 135 } 136 } else if (rw) { 137 if (prot & PAGE_WRITE) { 138 ret = 0; 139 } else { 140 ret = -2; 141 } 142 } else { 143 if (prot & PAGE_READ) { 144 ret = 0; 145 } else { 146 ret = -2; 147 } 148 } 149 150 return ret; 151 } 152 153 static inline int ppc6xx_tlb_pte_check(mmu_ctx_t *ctx, target_ulong pte0, 154 target_ulong pte1, int h, int rw, int type) 155 { 156 target_ulong ptem, mmask; 157 int access, ret, pteh, ptev, pp; 158 159 ret = -1; 160 /* Check validity and table match */ 161 ptev = pte_is_valid(pte0); 162 pteh = (pte0 >> 6) & 1; 163 if (ptev && h == pteh) { 164 /* Check vsid & api */ 165 ptem = pte0 & PTE_PTEM_MASK; 166 mmask = PTE_CHECK_MASK; 167 pp = pte1 & 0x00000003; 168 if (ptem == ctx->ptem) { 169 if (ctx->raddr != (hwaddr)-1ULL) { 170 /* all matches should have equal RPN, WIMG & PP */ 171 if ((ctx->raddr & mmask) != (pte1 & mmask)) { 172 qemu_log_mask(CPU_LOG_MMU, "Bad RPN/WIMG/PP\n"); 173 return -3; 174 } 175 } 176 /* Compute access rights */ 177 access = pp_check(ctx->key, pp, ctx->nx); 178 /* Keep the matching PTE informations */ 179 ctx->raddr = pte1; 180 ctx->prot = access; 181 ret = check_prot(ctx->prot, rw, type); 182 if (ret == 0) { 183 /* Access granted */ 184 qemu_log_mask(CPU_LOG_MMU, "PTE access granted !\n"); 185 } else { 186 /* Access right violation */ 187 qemu_log_mask(CPU_LOG_MMU, "PTE access rejected\n"); 188 } 189 } 190 } 191 192 return ret; 193 } 194 195 static int pte_update_flags(mmu_ctx_t *ctx, target_ulong *pte1p, 196 int ret, int rw) 197 { 198 int store = 0; 199 200 /* Update page flags */ 201 if (!(*pte1p & 0x00000100)) { 202 /* Update accessed flag */ 203 *pte1p |= 0x00000100; 204 store = 1; 205 } 206 if (!(*pte1p & 0x00000080)) { 207 if (rw == 1 && ret == 0) { 208 /* Update changed flag */ 209 *pte1p |= 0x00000080; 210 store = 1; 211 } else { 212 /* Force page fault for first write access */ 213 ctx->prot &= ~PAGE_WRITE; 214 } 215 } 216 217 return store; 218 } 219 220 /* Software driven TLB helpers */ 221 static inline int ppc6xx_tlb_getnum(CPUPPCState *env, target_ulong eaddr, 222 int way, int is_code) 223 { 224 int nr; 225 226 /* Select TLB num in a way from address */ 227 nr = (eaddr >> TARGET_PAGE_BITS) & (env->tlb_per_way - 1); 228 /* Select TLB way */ 229 nr += env->tlb_per_way * way; 230 /* 6xx have separate TLBs for instructions and data */ 231 if (is_code && env->id_tlbs == 1) { 232 nr += env->nb_tlb; 233 } 234 235 return nr; 236 } 237 238 static inline void ppc6xx_tlb_invalidate_all(CPUPPCState *env) 239 { 240 PowerPCCPU *cpu = ppc_env_get_cpu(env); 241 ppc6xx_tlb_t *tlb; 242 int nr, max; 243 244 /* LOG_SWTLB("Invalidate all TLBs\n"); */ 245 /* Invalidate all defined software TLB */ 246 max = env->nb_tlb; 247 if (env->id_tlbs == 1) { 248 max *= 2; 249 } 250 for (nr = 0; nr < max; nr++) { 251 tlb = &env->tlb.tlb6[nr]; 252 pte_invalidate(&tlb->pte0); 253 } 254 tlb_flush(CPU(cpu)); 255 } 256 257 static inline void ppc6xx_tlb_invalidate_virt2(CPUPPCState *env, 258 target_ulong eaddr, 259 int is_code, int match_epn) 260 { 261 #if !defined(FLUSH_ALL_TLBS) 262 CPUState *cs = CPU(ppc_env_get_cpu(env)); 263 ppc6xx_tlb_t *tlb; 264 int way, nr; 265 266 /* Invalidate ITLB + DTLB, all ways */ 267 for (way = 0; way < env->nb_ways; way++) { 268 nr = ppc6xx_tlb_getnum(env, eaddr, way, is_code); 269 tlb = &env->tlb.tlb6[nr]; 270 if (pte_is_valid(tlb->pte0) && (match_epn == 0 || eaddr == tlb->EPN)) { 271 LOG_SWTLB("TLB invalidate %d/%d " TARGET_FMT_lx "\n", nr, 272 env->nb_tlb, eaddr); 273 pte_invalidate(&tlb->pte0); 274 tlb_flush_page(cs, tlb->EPN); 275 } 276 } 277 #else 278 /* XXX: PowerPC specification say this is valid as well */ 279 ppc6xx_tlb_invalidate_all(env); 280 #endif 281 } 282 283 static inline void ppc6xx_tlb_invalidate_virt(CPUPPCState *env, 284 target_ulong eaddr, int is_code) 285 { 286 ppc6xx_tlb_invalidate_virt2(env, eaddr, is_code, 0); 287 } 288 289 static void ppc6xx_tlb_store(CPUPPCState *env, target_ulong EPN, int way, 290 int is_code, target_ulong pte0, target_ulong pte1) 291 { 292 ppc6xx_tlb_t *tlb; 293 int nr; 294 295 nr = ppc6xx_tlb_getnum(env, EPN, way, is_code); 296 tlb = &env->tlb.tlb6[nr]; 297 LOG_SWTLB("Set TLB %d/%d EPN " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx 298 " PTE1 " TARGET_FMT_lx "\n", nr, env->nb_tlb, EPN, pte0, pte1); 299 /* Invalidate any pending reference in QEMU for this virtual address */ 300 ppc6xx_tlb_invalidate_virt2(env, EPN, is_code, 1); 301 tlb->pte0 = pte0; 302 tlb->pte1 = pte1; 303 tlb->EPN = EPN; 304 /* Store last way for LRU mechanism */ 305 env->last_way = way; 306 } 307 308 static inline int ppc6xx_tlb_check(CPUPPCState *env, mmu_ctx_t *ctx, 309 target_ulong eaddr, int rw, int access_type) 310 { 311 ppc6xx_tlb_t *tlb; 312 int nr, best, way; 313 int ret; 314 315 best = -1; 316 ret = -1; /* No TLB found */ 317 for (way = 0; way < env->nb_ways; way++) { 318 nr = ppc6xx_tlb_getnum(env, eaddr, way, 319 access_type == ACCESS_CODE ? 1 : 0); 320 tlb = &env->tlb.tlb6[nr]; 321 /* This test "emulates" the PTE index match for hardware TLBs */ 322 if ((eaddr & TARGET_PAGE_MASK) != tlb->EPN) { 323 LOG_SWTLB("TLB %d/%d %s [" TARGET_FMT_lx " " TARGET_FMT_lx 324 "] <> " TARGET_FMT_lx "\n", nr, env->nb_tlb, 325 pte_is_valid(tlb->pte0) ? "valid" : "inval", 326 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE, eaddr); 327 continue; 328 } 329 LOG_SWTLB("TLB %d/%d %s " TARGET_FMT_lx " <> " TARGET_FMT_lx " " 330 TARGET_FMT_lx " %c %c\n", nr, env->nb_tlb, 331 pte_is_valid(tlb->pte0) ? "valid" : "inval", 332 tlb->EPN, eaddr, tlb->pte1, 333 rw ? 'S' : 'L', access_type == ACCESS_CODE ? 'I' : 'D'); 334 switch (ppc6xx_tlb_pte_check(ctx, tlb->pte0, tlb->pte1, 0, rw, access_type)) { 335 case -3: 336 /* TLB inconsistency */ 337 return -1; 338 case -2: 339 /* Access violation */ 340 ret = -2; 341 best = nr; 342 break; 343 case -1: 344 default: 345 /* No match */ 346 break; 347 case 0: 348 /* access granted */ 349 /* XXX: we should go on looping to check all TLBs consistency 350 * but we can speed-up the whole thing as the 351 * result would be undefined if TLBs are not consistent. 352 */ 353 ret = 0; 354 best = nr; 355 goto done; 356 } 357 } 358 if (best != -1) { 359 done: 360 LOG_SWTLB("found TLB at addr " TARGET_FMT_plx " prot=%01x ret=%d\n", 361 ctx->raddr & TARGET_PAGE_MASK, ctx->prot, ret); 362 /* Update page flags */ 363 pte_update_flags(ctx, &env->tlb.tlb6[best].pte1, ret, rw); 364 } 365 366 return ret; 367 } 368 369 /* Perform BAT hit & translation */ 370 static inline void bat_size_prot(CPUPPCState *env, target_ulong *blp, 371 int *validp, int *protp, target_ulong *BATu, 372 target_ulong *BATl) 373 { 374 target_ulong bl; 375 int pp, valid, prot; 376 377 bl = (*BATu & 0x00001FFC) << 15; 378 valid = 0; 379 prot = 0; 380 if (((msr_pr == 0) && (*BATu & 0x00000002)) || 381 ((msr_pr != 0) && (*BATu & 0x00000001))) { 382 valid = 1; 383 pp = *BATl & 0x00000003; 384 if (pp != 0) { 385 prot = PAGE_READ | PAGE_EXEC; 386 if (pp == 0x2) { 387 prot |= PAGE_WRITE; 388 } 389 } 390 } 391 *blp = bl; 392 *validp = valid; 393 *protp = prot; 394 } 395 396 static int get_bat_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx, 397 target_ulong virtual, int rw, int type) 398 { 399 target_ulong *BATlt, *BATut, *BATu, *BATl; 400 target_ulong BEPIl, BEPIu, bl; 401 int i, valid, prot; 402 int ret = -1; 403 404 LOG_BATS("%s: %cBAT v " TARGET_FMT_lx "\n", __func__, 405 type == ACCESS_CODE ? 'I' : 'D', virtual); 406 switch (type) { 407 case ACCESS_CODE: 408 BATlt = env->IBAT[1]; 409 BATut = env->IBAT[0]; 410 break; 411 default: 412 BATlt = env->DBAT[1]; 413 BATut = env->DBAT[0]; 414 break; 415 } 416 for (i = 0; i < env->nb_BATs; i++) { 417 BATu = &BATut[i]; 418 BATl = &BATlt[i]; 419 BEPIu = *BATu & 0xF0000000; 420 BEPIl = *BATu & 0x0FFE0000; 421 bat_size_prot(env, &bl, &valid, &prot, BATu, BATl); 422 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx 423 " BATl " TARGET_FMT_lx "\n", __func__, 424 type == ACCESS_CODE ? 'I' : 'D', i, virtual, *BATu, *BATl); 425 if ((virtual & 0xF0000000) == BEPIu && 426 ((virtual & 0x0FFE0000) & ~bl) == BEPIl) { 427 /* BAT matches */ 428 if (valid != 0) { 429 /* Get physical address */ 430 ctx->raddr = (*BATl & 0xF0000000) | 431 ((virtual & 0x0FFE0000 & bl) | (*BATl & 0x0FFE0000)) | 432 (virtual & 0x0001F000); 433 /* Compute access rights */ 434 ctx->prot = prot; 435 ret = check_prot(ctx->prot, rw, type); 436 if (ret == 0) { 437 LOG_BATS("BAT %d match: r " TARGET_FMT_plx " prot=%c%c\n", 438 i, ctx->raddr, ctx->prot & PAGE_READ ? 'R' : '-', 439 ctx->prot & PAGE_WRITE ? 'W' : '-'); 440 } 441 break; 442 } 443 } 444 } 445 if (ret < 0) { 446 #if defined(DEBUG_BATS) 447 if (qemu_log_enabled()) { 448 LOG_BATS("no BAT match for " TARGET_FMT_lx ":\n", virtual); 449 for (i = 0; i < 4; i++) { 450 BATu = &BATut[i]; 451 BATl = &BATlt[i]; 452 BEPIu = *BATu & 0xF0000000; 453 BEPIl = *BATu & 0x0FFE0000; 454 bl = (*BATu & 0x00001FFC) << 15; 455 LOG_BATS("%s: %cBAT%d v " TARGET_FMT_lx " BATu " TARGET_FMT_lx 456 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " " 457 TARGET_FMT_lx " " TARGET_FMT_lx "\n", 458 __func__, type == ACCESS_CODE ? 'I' : 'D', i, virtual, 459 *BATu, *BATl, BEPIu, BEPIl, bl); 460 } 461 } 462 #endif 463 } 464 /* No hit */ 465 return ret; 466 } 467 468 /* Perform segment based translation */ 469 static inline int get_segment_6xx_tlb(CPUPPCState *env, mmu_ctx_t *ctx, 470 target_ulong eaddr, int rw, int type) 471 { 472 PowerPCCPU *cpu = ppc_env_get_cpu(env); 473 hwaddr hash; 474 target_ulong vsid; 475 int ds, pr, target_page_bits; 476 int ret; 477 target_ulong sr, pgidx; 478 479 pr = msr_pr; 480 ctx->eaddr = eaddr; 481 482 sr = env->sr[eaddr >> 28]; 483 ctx->key = (((sr & 0x20000000) && (pr != 0)) || 484 ((sr & 0x40000000) && (pr == 0))) ? 1 : 0; 485 ds = sr & 0x80000000 ? 1 : 0; 486 ctx->nx = sr & 0x10000000 ? 1 : 0; 487 vsid = sr & 0x00FFFFFF; 488 target_page_bits = TARGET_PAGE_BITS; 489 qemu_log_mask(CPU_LOG_MMU, 490 "Check segment v=" TARGET_FMT_lx " %d " TARGET_FMT_lx 491 " nip=" TARGET_FMT_lx " lr=" TARGET_FMT_lx 492 " ir=%d dr=%d pr=%d %d t=%d\n", 493 eaddr, (int)(eaddr >> 28), sr, env->nip, env->lr, (int)msr_ir, 494 (int)msr_dr, pr != 0 ? 1 : 0, rw, type); 495 pgidx = (eaddr & ~SEGMENT_MASK_256M) >> target_page_bits; 496 hash = vsid ^ pgidx; 497 ctx->ptem = (vsid << 7) | (pgidx >> 10); 498 499 qemu_log_mask(CPU_LOG_MMU, 500 "pte segment: key=%d ds %d nx %d vsid " TARGET_FMT_lx "\n", 501 ctx->key, ds, ctx->nx, vsid); 502 ret = -1; 503 if (!ds) { 504 /* Check if instruction fetch is allowed, if needed */ 505 if (type != ACCESS_CODE || ctx->nx == 0) { 506 /* Page address translation */ 507 qemu_log_mask(CPU_LOG_MMU, "htab_base " TARGET_FMT_plx 508 " htab_mask " TARGET_FMT_plx 509 " hash " TARGET_FMT_plx "\n", 510 ppc_hash32_hpt_base(cpu), ppc_hash32_hpt_mask(cpu), hash); 511 ctx->hash[0] = hash; 512 ctx->hash[1] = ~hash; 513 514 /* Initialize real address with an invalid value */ 515 ctx->raddr = (hwaddr)-1ULL; 516 /* Software TLB search */ 517 ret = ppc6xx_tlb_check(env, ctx, eaddr, rw, type); 518 #if defined(DUMP_PAGE_TABLES) 519 if (qemu_loglevel_mask(CPU_LOG_MMU)) { 520 CPUState *cs = ENV_GET_CPU(env); 521 hwaddr curaddr; 522 uint32_t a0, a1, a2, a3; 523 524 qemu_log("Page table: " TARGET_FMT_plx " len " TARGET_FMT_plx 525 "\n", ppc_hash32_hpt_base(cpu), 526 ppc_hash32_hpt_mask(env) + 0x80); 527 for (curaddr = ppc_hash32_hpt_base(cpu); 528 curaddr < (ppc_hash32_hpt_base(cpu) 529 + ppc_hash32_hpt_mask(cpu) + 0x80); 530 curaddr += 16) { 531 a0 = ldl_phys(cs->as, curaddr); 532 a1 = ldl_phys(cs->as, curaddr + 4); 533 a2 = ldl_phys(cs->as, curaddr + 8); 534 a3 = ldl_phys(cs->as, curaddr + 12); 535 if (a0 != 0 || a1 != 0 || a2 != 0 || a3 != 0) { 536 qemu_log(TARGET_FMT_plx ": %08x %08x %08x %08x\n", 537 curaddr, a0, a1, a2, a3); 538 } 539 } 540 } 541 #endif 542 } else { 543 qemu_log_mask(CPU_LOG_MMU, "No access allowed\n"); 544 ret = -3; 545 } 546 } else { 547 target_ulong sr; 548 549 qemu_log_mask(CPU_LOG_MMU, "direct store...\n"); 550 /* Direct-store segment : absolutely *BUGGY* for now */ 551 552 /* Direct-store implies a 32-bit MMU. 553 * Check the Segment Register's bus unit ID (BUID). 554 */ 555 sr = env->sr[eaddr >> 28]; 556 if ((sr & 0x1FF00000) >> 20 == 0x07f) { 557 /* Memory-forced I/O controller interface access */ 558 /* If T=1 and BUID=x'07F', the 601 performs a memory access 559 * to SR[28-31] LA[4-31], bypassing all protection mechanisms. 560 */ 561 ctx->raddr = ((sr & 0xF) << 28) | (eaddr & 0x0FFFFFFF); 562 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 563 return 0; 564 } 565 566 switch (type) { 567 case ACCESS_INT: 568 /* Integer load/store : only access allowed */ 569 break; 570 case ACCESS_CODE: 571 /* No code fetch is allowed in direct-store areas */ 572 return -4; 573 case ACCESS_FLOAT: 574 /* Floating point load/store */ 575 return -4; 576 case ACCESS_RES: 577 /* lwarx, ldarx or srwcx. */ 578 return -4; 579 case ACCESS_CACHE: 580 /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */ 581 /* Should make the instruction do no-op. 582 * As it already do no-op, it's quite easy :-) 583 */ 584 ctx->raddr = eaddr; 585 return 0; 586 case ACCESS_EXT: 587 /* eciwx or ecowx */ 588 return -4; 589 default: 590 qemu_log_mask(CPU_LOG_MMU, "ERROR: instruction should not need " 591 "address translation\n"); 592 return -4; 593 } 594 if ((rw == 1 || ctx->key != 1) && (rw == 0 || ctx->key != 0)) { 595 ctx->raddr = eaddr; 596 ret = 2; 597 } else { 598 ret = -2; 599 } 600 } 601 602 return ret; 603 } 604 605 /* Generic TLB check function for embedded PowerPC implementations */ 606 static int ppcemb_tlb_check(CPUPPCState *env, ppcemb_tlb_t *tlb, 607 hwaddr *raddrp, 608 target_ulong address, uint32_t pid, int ext, 609 int i) 610 { 611 target_ulong mask; 612 613 /* Check valid flag */ 614 if (!(tlb->prot & PAGE_VALID)) { 615 return -1; 616 } 617 mask = ~(tlb->size - 1); 618 LOG_SWTLB("%s: TLB %d address " TARGET_FMT_lx " PID %u <=> " TARGET_FMT_lx 619 " " TARGET_FMT_lx " %u %x\n", __func__, i, address, pid, tlb->EPN, 620 mask, (uint32_t)tlb->PID, tlb->prot); 621 /* Check PID */ 622 if (tlb->PID != 0 && tlb->PID != pid) { 623 return -1; 624 } 625 /* Check effective address */ 626 if ((address & mask) != tlb->EPN) { 627 return -1; 628 } 629 *raddrp = (tlb->RPN & mask) | (address & ~mask); 630 if (ext) { 631 /* Extend the physical address to 36 bits */ 632 *raddrp |= (uint64_t)(tlb->RPN & 0xF) << 32; 633 } 634 635 return 0; 636 } 637 638 /* Generic TLB search function for PowerPC embedded implementations */ 639 static int ppcemb_tlb_search(CPUPPCState *env, target_ulong address, 640 uint32_t pid) 641 { 642 ppcemb_tlb_t *tlb; 643 hwaddr raddr; 644 int i, ret; 645 646 /* Default return value is no match */ 647 ret = -1; 648 for (i = 0; i < env->nb_tlb; i++) { 649 tlb = &env->tlb.tlbe[i]; 650 if (ppcemb_tlb_check(env, tlb, &raddr, address, pid, 0, i) == 0) { 651 ret = i; 652 break; 653 } 654 } 655 656 return ret; 657 } 658 659 /* Helpers specific to PowerPC 40x implementations */ 660 static inline void ppc4xx_tlb_invalidate_all(CPUPPCState *env) 661 { 662 PowerPCCPU *cpu = ppc_env_get_cpu(env); 663 ppcemb_tlb_t *tlb; 664 int i; 665 666 for (i = 0; i < env->nb_tlb; i++) { 667 tlb = &env->tlb.tlbe[i]; 668 tlb->prot &= ~PAGE_VALID; 669 } 670 tlb_flush(CPU(cpu)); 671 } 672 673 static int mmu40x_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx, 674 target_ulong address, int rw, 675 int access_type) 676 { 677 ppcemb_tlb_t *tlb; 678 hwaddr raddr; 679 int i, ret, zsel, zpr, pr; 680 681 ret = -1; 682 raddr = (hwaddr)-1ULL; 683 pr = msr_pr; 684 for (i = 0; i < env->nb_tlb; i++) { 685 tlb = &env->tlb.tlbe[i]; 686 if (ppcemb_tlb_check(env, tlb, &raddr, address, 687 env->spr[SPR_40x_PID], 0, i) < 0) { 688 continue; 689 } 690 zsel = (tlb->attr >> 4) & 0xF; 691 zpr = (env->spr[SPR_40x_ZPR] >> (30 - (2 * zsel))) & 0x3; 692 LOG_SWTLB("%s: TLB %d zsel %d zpr %d rw %d attr %08x\n", 693 __func__, i, zsel, zpr, rw, tlb->attr); 694 /* Check execute enable bit */ 695 switch (zpr) { 696 case 0x2: 697 if (pr != 0) { 698 goto check_perms; 699 } 700 /* No break here */ 701 case 0x3: 702 /* All accesses granted */ 703 ctx->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 704 ret = 0; 705 break; 706 case 0x0: 707 if (pr != 0) { 708 /* Raise Zone protection fault. */ 709 env->spr[SPR_40x_ESR] = 1 << 22; 710 ctx->prot = 0; 711 ret = -2; 712 break; 713 } 714 /* No break here */ 715 case 0x1: 716 check_perms: 717 /* Check from TLB entry */ 718 ctx->prot = tlb->prot; 719 ret = check_prot(ctx->prot, rw, access_type); 720 if (ret == -2) { 721 env->spr[SPR_40x_ESR] = 0; 722 } 723 break; 724 } 725 if (ret >= 0) { 726 ctx->raddr = raddr; 727 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx 728 " %d %d\n", __func__, address, ctx->raddr, ctx->prot, 729 ret); 730 return 0; 731 } 732 } 733 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx 734 " %d %d\n", __func__, address, raddr, ctx->prot, ret); 735 736 return ret; 737 } 738 739 void store_40x_sler(CPUPPCState *env, uint32_t val) 740 { 741 PowerPCCPU *cpu = ppc_env_get_cpu(env); 742 743 /* XXX: TO BE FIXED */ 744 if (val != 0x00000000) { 745 cpu_abort(CPU(cpu), "Little-endian regions are not supported by now\n"); 746 } 747 env->spr[SPR_405_SLER] = val; 748 } 749 750 static inline int mmubooke_check_tlb(CPUPPCState *env, ppcemb_tlb_t *tlb, 751 hwaddr *raddr, int *prot, 752 target_ulong address, int rw, 753 int access_type, int i) 754 { 755 int ret, prot2; 756 757 if (ppcemb_tlb_check(env, tlb, raddr, address, 758 env->spr[SPR_BOOKE_PID], 759 !env->nb_pids, i) >= 0) { 760 goto found_tlb; 761 } 762 763 if (env->spr[SPR_BOOKE_PID1] && 764 ppcemb_tlb_check(env, tlb, raddr, address, 765 env->spr[SPR_BOOKE_PID1], 0, i) >= 0) { 766 goto found_tlb; 767 } 768 769 if (env->spr[SPR_BOOKE_PID2] && 770 ppcemb_tlb_check(env, tlb, raddr, address, 771 env->spr[SPR_BOOKE_PID2], 0, i) >= 0) { 772 goto found_tlb; 773 } 774 775 LOG_SWTLB("%s: TLB entry not found\n", __func__); 776 return -1; 777 778 found_tlb: 779 780 if (msr_pr != 0) { 781 prot2 = tlb->prot & 0xF; 782 } else { 783 prot2 = (tlb->prot >> 4) & 0xF; 784 } 785 786 /* Check the address space */ 787 if (access_type == ACCESS_CODE) { 788 if (msr_ir != (tlb->attr & 1)) { 789 LOG_SWTLB("%s: AS doesn't match\n", __func__); 790 return -1; 791 } 792 793 *prot = prot2; 794 if (prot2 & PAGE_EXEC) { 795 LOG_SWTLB("%s: good TLB!\n", __func__); 796 return 0; 797 } 798 799 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2); 800 ret = -3; 801 } else { 802 if (msr_dr != (tlb->attr & 1)) { 803 LOG_SWTLB("%s: AS doesn't match\n", __func__); 804 return -1; 805 } 806 807 *prot = prot2; 808 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) { 809 LOG_SWTLB("%s: found TLB!\n", __func__); 810 return 0; 811 } 812 813 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2); 814 ret = -2; 815 } 816 817 return ret; 818 } 819 820 static int mmubooke_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx, 821 target_ulong address, int rw, 822 int access_type) 823 { 824 ppcemb_tlb_t *tlb; 825 hwaddr raddr; 826 int i, ret; 827 828 ret = -1; 829 raddr = (hwaddr)-1ULL; 830 for (i = 0; i < env->nb_tlb; i++) { 831 tlb = &env->tlb.tlbe[i]; 832 ret = mmubooke_check_tlb(env, tlb, &raddr, &ctx->prot, address, rw, 833 access_type, i); 834 if (ret != -1) { 835 break; 836 } 837 } 838 839 if (ret >= 0) { 840 ctx->raddr = raddr; 841 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx 842 " %d %d\n", __func__, address, ctx->raddr, ctx->prot, 843 ret); 844 } else { 845 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx 846 " %d %d\n", __func__, address, raddr, ctx->prot, ret); 847 } 848 849 return ret; 850 } 851 852 static void booke206_flush_tlb(CPUPPCState *env, int flags, 853 const int check_iprot) 854 { 855 PowerPCCPU *cpu = ppc_env_get_cpu(env); 856 int tlb_size; 857 int i, j; 858 ppcmas_tlb_t *tlb = env->tlb.tlbm; 859 860 for (i = 0; i < BOOKE206_MAX_TLBN; i++) { 861 if (flags & (1 << i)) { 862 tlb_size = booke206_tlb_size(env, i); 863 for (j = 0; j < tlb_size; j++) { 864 if (!check_iprot || !(tlb[j].mas1 & MAS1_IPROT)) { 865 tlb[j].mas1 &= ~MAS1_VALID; 866 } 867 } 868 } 869 tlb += booke206_tlb_size(env, i); 870 } 871 872 tlb_flush(CPU(cpu)); 873 } 874 875 static hwaddr booke206_tlb_to_page_size(CPUPPCState *env, 876 ppcmas_tlb_t *tlb) 877 { 878 int tlbm_size; 879 880 tlbm_size = (tlb->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT; 881 882 return 1024ULL << tlbm_size; 883 } 884 885 /* TLB check function for MAS based SoftTLBs */ 886 static int ppcmas_tlb_check(CPUPPCState *env, ppcmas_tlb_t *tlb, 887 hwaddr *raddrp, target_ulong address, 888 uint32_t pid) 889 { 890 hwaddr mask; 891 uint32_t tlb_pid; 892 893 if (!msr_cm) { 894 /* In 32bit mode we can only address 32bit EAs */ 895 address = (uint32_t)address; 896 } 897 898 /* Check valid flag */ 899 if (!(tlb->mas1 & MAS1_VALID)) { 900 return -1; 901 } 902 903 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1); 904 LOG_SWTLB("%s: TLB ADDR=0x" TARGET_FMT_lx " PID=0x%x MAS1=0x%x MAS2=0x%" 905 PRIx64 " mask=0x%" HWADDR_PRIx " MAS7_3=0x%" PRIx64 " MAS8=0x%" 906 PRIx32 "\n", __func__, address, pid, tlb->mas1, tlb->mas2, mask, 907 tlb->mas7_3, tlb->mas8); 908 909 /* Check PID */ 910 tlb_pid = (tlb->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT; 911 if (tlb_pid != 0 && tlb_pid != pid) { 912 return -1; 913 } 914 915 /* Check effective address */ 916 if ((address & mask) != (tlb->mas2 & MAS2_EPN_MASK)) { 917 return -1; 918 } 919 920 if (raddrp) { 921 *raddrp = (tlb->mas7_3 & mask) | (address & ~mask); 922 } 923 924 return 0; 925 } 926 927 static bool is_epid_mmu(int mmu_idx) 928 { 929 return mmu_idx == PPC_TLB_EPID_STORE || mmu_idx == PPC_TLB_EPID_LOAD; 930 } 931 932 static uint32_t mmubooke206_esr(int mmu_idx, bool rw) 933 { 934 uint32_t esr = 0; 935 if (rw) { 936 esr |= ESR_ST; 937 } 938 if (is_epid_mmu(mmu_idx)) { 939 esr |= ESR_EPID; 940 } 941 return esr; 942 } 943 944 /* Get EPID register given the mmu_idx. If this is regular load, 945 * construct the EPID access bits from current processor state */ 946 947 /* Get the effective AS and PR bits and the PID. The PID is returned only if 948 * EPID load is requested, otherwise the caller must detect the correct EPID. 949 * Return true if valid EPID is returned. */ 950 static bool mmubooke206_get_as(CPUPPCState *env, 951 int mmu_idx, uint32_t *epid_out, 952 bool *as_out, bool *pr_out) 953 { 954 if (is_epid_mmu(mmu_idx)) { 955 uint32_t epidr; 956 if (mmu_idx == PPC_TLB_EPID_STORE) { 957 epidr = env->spr[SPR_BOOKE_EPSC]; 958 } else { 959 epidr = env->spr[SPR_BOOKE_EPLC]; 960 } 961 *epid_out = (epidr & EPID_EPID) >> EPID_EPID_SHIFT; 962 *as_out = !!(epidr & EPID_EAS); 963 *pr_out = !!(epidr & EPID_EPR); 964 return true; 965 } else { 966 *as_out = msr_ds; 967 *pr_out = msr_pr; 968 return false; 969 } 970 } 971 972 /* Check if the tlb found by hashing really matches */ 973 static int mmubooke206_check_tlb(CPUPPCState *env, ppcmas_tlb_t *tlb, 974 hwaddr *raddr, int *prot, 975 target_ulong address, int rw, 976 int access_type, int mmu_idx) 977 { 978 int ret; 979 int prot2 = 0; 980 uint32_t epid; 981 bool as, pr; 982 bool use_epid = mmubooke206_get_as(env, mmu_idx, &epid, &as, &pr); 983 984 if (!use_epid) { 985 if (ppcmas_tlb_check(env, tlb, raddr, address, 986 env->spr[SPR_BOOKE_PID]) >= 0) { 987 goto found_tlb; 988 } 989 990 if (env->spr[SPR_BOOKE_PID1] && 991 ppcmas_tlb_check(env, tlb, raddr, address, 992 env->spr[SPR_BOOKE_PID1]) >= 0) { 993 goto found_tlb; 994 } 995 996 if (env->spr[SPR_BOOKE_PID2] && 997 ppcmas_tlb_check(env, tlb, raddr, address, 998 env->spr[SPR_BOOKE_PID2]) >= 0) { 999 goto found_tlb; 1000 } 1001 } else { 1002 if (ppcmas_tlb_check(env, tlb, raddr, address, epid) >= 0) { 1003 goto found_tlb; 1004 } 1005 } 1006 1007 LOG_SWTLB("%s: TLB entry not found\n", __func__); 1008 return -1; 1009 1010 found_tlb: 1011 1012 if (pr) { 1013 if (tlb->mas7_3 & MAS3_UR) { 1014 prot2 |= PAGE_READ; 1015 } 1016 if (tlb->mas7_3 & MAS3_UW) { 1017 prot2 |= PAGE_WRITE; 1018 } 1019 if (tlb->mas7_3 & MAS3_UX) { 1020 prot2 |= PAGE_EXEC; 1021 } 1022 } else { 1023 if (tlb->mas7_3 & MAS3_SR) { 1024 prot2 |= PAGE_READ; 1025 } 1026 if (tlb->mas7_3 & MAS3_SW) { 1027 prot2 |= PAGE_WRITE; 1028 } 1029 if (tlb->mas7_3 & MAS3_SX) { 1030 prot2 |= PAGE_EXEC; 1031 } 1032 } 1033 1034 /* Check the address space and permissions */ 1035 if (access_type == ACCESS_CODE) { 1036 /* There is no way to fetch code using epid load */ 1037 assert(!use_epid); 1038 if (msr_ir != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) { 1039 LOG_SWTLB("%s: AS doesn't match\n", __func__); 1040 return -1; 1041 } 1042 1043 *prot = prot2; 1044 if (prot2 & PAGE_EXEC) { 1045 LOG_SWTLB("%s: good TLB!\n", __func__); 1046 return 0; 1047 } 1048 1049 LOG_SWTLB("%s: no PAGE_EXEC: %x\n", __func__, prot2); 1050 ret = -3; 1051 } else { 1052 if (as != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) { 1053 LOG_SWTLB("%s: AS doesn't match\n", __func__); 1054 return -1; 1055 } 1056 1057 *prot = prot2; 1058 if ((!rw && prot2 & PAGE_READ) || (rw && (prot2 & PAGE_WRITE))) { 1059 LOG_SWTLB("%s: found TLB!\n", __func__); 1060 return 0; 1061 } 1062 1063 LOG_SWTLB("%s: PAGE_READ/WRITE doesn't match: %x\n", __func__, prot2); 1064 ret = -2; 1065 } 1066 1067 return ret; 1068 } 1069 1070 static int mmubooke206_get_physical_address(CPUPPCState *env, mmu_ctx_t *ctx, 1071 target_ulong address, int rw, 1072 int access_type, int mmu_idx) 1073 { 1074 ppcmas_tlb_t *tlb; 1075 hwaddr raddr; 1076 int i, j, ret; 1077 1078 ret = -1; 1079 raddr = (hwaddr)-1ULL; 1080 1081 for (i = 0; i < BOOKE206_MAX_TLBN; i++) { 1082 int ways = booke206_tlb_ways(env, i); 1083 1084 for (j = 0; j < ways; j++) { 1085 tlb = booke206_get_tlbm(env, i, address, j); 1086 if (!tlb) { 1087 continue; 1088 } 1089 ret = mmubooke206_check_tlb(env, tlb, &raddr, &ctx->prot, address, 1090 rw, access_type, mmu_idx); 1091 if (ret != -1) { 1092 goto found_tlb; 1093 } 1094 } 1095 } 1096 1097 found_tlb: 1098 1099 if (ret >= 0) { 1100 ctx->raddr = raddr; 1101 LOG_SWTLB("%s: access granted " TARGET_FMT_lx " => " TARGET_FMT_plx 1102 " %d %d\n", __func__, address, ctx->raddr, ctx->prot, 1103 ret); 1104 } else { 1105 LOG_SWTLB("%s: access refused " TARGET_FMT_lx " => " TARGET_FMT_plx 1106 " %d %d\n", __func__, address, raddr, ctx->prot, ret); 1107 } 1108 1109 return ret; 1110 } 1111 1112 static const char *book3e_tsize_to_str[32] = { 1113 "1K", "2K", "4K", "8K", "16K", "32K", "64K", "128K", "256K", "512K", 1114 "1M", "2M", "4M", "8M", "16M", "32M", "64M", "128M", "256M", "512M", 1115 "1G", "2G", "4G", "8G", "16G", "32G", "64G", "128G", "256G", "512G", 1116 "1T", "2T" 1117 }; 1118 1119 static void mmubooke_dump_mmu(FILE *f, fprintf_function cpu_fprintf, 1120 CPUPPCState *env) 1121 { 1122 ppcemb_tlb_t *entry; 1123 int i; 1124 1125 if (kvm_enabled() && !env->kvm_sw_tlb) { 1126 cpu_fprintf(f, "Cannot access KVM TLB\n"); 1127 return; 1128 } 1129 1130 cpu_fprintf(f, "\nTLB:\n"); 1131 cpu_fprintf(f, "Effective Physical Size PID Prot " 1132 "Attr\n"); 1133 1134 entry = &env->tlb.tlbe[0]; 1135 for (i = 0; i < env->nb_tlb; i++, entry++) { 1136 hwaddr ea, pa; 1137 target_ulong mask; 1138 uint64_t size = (uint64_t)entry->size; 1139 char size_buf[20]; 1140 1141 /* Check valid flag */ 1142 if (!(entry->prot & PAGE_VALID)) { 1143 continue; 1144 } 1145 1146 mask = ~(entry->size - 1); 1147 ea = entry->EPN & mask; 1148 pa = entry->RPN & mask; 1149 /* Extend the physical address to 36 bits */ 1150 pa |= (hwaddr)(entry->RPN & 0xF) << 32; 1151 if (size >= 1 * MiB) { 1152 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "M", size / MiB); 1153 } else { 1154 snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "k", size / KiB); 1155 } 1156 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %s %-5u %08x %08x\n", 1157 (uint64_t)ea, (uint64_t)pa, size_buf, (uint32_t)entry->PID, 1158 entry->prot, entry->attr); 1159 } 1160 1161 } 1162 1163 static void mmubooke206_dump_one_tlb(FILE *f, fprintf_function cpu_fprintf, 1164 CPUPPCState *env, int tlbn, int offset, 1165 int tlbsize) 1166 { 1167 ppcmas_tlb_t *entry; 1168 int i; 1169 1170 cpu_fprintf(f, "\nTLB%d:\n", tlbn); 1171 cpu_fprintf(f, "Effective Physical Size TID TS SRWX" 1172 " URWX WIMGE U0123\n"); 1173 1174 entry = &env->tlb.tlbm[offset]; 1175 for (i = 0; i < tlbsize; i++, entry++) { 1176 hwaddr ea, pa, size; 1177 int tsize; 1178 1179 if (!(entry->mas1 & MAS1_VALID)) { 1180 continue; 1181 } 1182 1183 tsize = (entry->mas1 & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT; 1184 size = 1024ULL << tsize; 1185 ea = entry->mas2 & ~(size - 1); 1186 pa = entry->mas7_3 & ~(size - 1); 1187 1188 cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %4s %-5u %1u S%c%c%c" 1189 "U%c%c%c %c%c%c%c%c U%c%c%c%c\n", 1190 (uint64_t)ea, (uint64_t)pa, 1191 book3e_tsize_to_str[tsize], 1192 (entry->mas1 & MAS1_TID_MASK) >> MAS1_TID_SHIFT, 1193 (entry->mas1 & MAS1_TS) >> MAS1_TS_SHIFT, 1194 entry->mas7_3 & MAS3_SR ? 'R' : '-', 1195 entry->mas7_3 & MAS3_SW ? 'W' : '-', 1196 entry->mas7_3 & MAS3_SX ? 'X' : '-', 1197 entry->mas7_3 & MAS3_UR ? 'R' : '-', 1198 entry->mas7_3 & MAS3_UW ? 'W' : '-', 1199 entry->mas7_3 & MAS3_UX ? 'X' : '-', 1200 entry->mas2 & MAS2_W ? 'W' : '-', 1201 entry->mas2 & MAS2_I ? 'I' : '-', 1202 entry->mas2 & MAS2_M ? 'M' : '-', 1203 entry->mas2 & MAS2_G ? 'G' : '-', 1204 entry->mas2 & MAS2_E ? 'E' : '-', 1205 entry->mas7_3 & MAS3_U0 ? '0' : '-', 1206 entry->mas7_3 & MAS3_U1 ? '1' : '-', 1207 entry->mas7_3 & MAS3_U2 ? '2' : '-', 1208 entry->mas7_3 & MAS3_U3 ? '3' : '-'); 1209 } 1210 } 1211 1212 static void mmubooke206_dump_mmu(FILE *f, fprintf_function cpu_fprintf, 1213 CPUPPCState *env) 1214 { 1215 int offset = 0; 1216 int i; 1217 1218 if (kvm_enabled() && !env->kvm_sw_tlb) { 1219 cpu_fprintf(f, "Cannot access KVM TLB\n"); 1220 return; 1221 } 1222 1223 for (i = 0; i < BOOKE206_MAX_TLBN; i++) { 1224 int size = booke206_tlb_size(env, i); 1225 1226 if (size == 0) { 1227 continue; 1228 } 1229 1230 mmubooke206_dump_one_tlb(f, cpu_fprintf, env, i, offset, size); 1231 offset += size; 1232 } 1233 } 1234 1235 static void mmu6xx_dump_BATs(FILE *f, fprintf_function cpu_fprintf, 1236 CPUPPCState *env, int type) 1237 { 1238 target_ulong *BATlt, *BATut, *BATu, *BATl; 1239 target_ulong BEPIl, BEPIu, bl; 1240 int i; 1241 1242 switch (type) { 1243 case ACCESS_CODE: 1244 BATlt = env->IBAT[1]; 1245 BATut = env->IBAT[0]; 1246 break; 1247 default: 1248 BATlt = env->DBAT[1]; 1249 BATut = env->DBAT[0]; 1250 break; 1251 } 1252 1253 for (i = 0; i < env->nb_BATs; i++) { 1254 BATu = &BATut[i]; 1255 BATl = &BATlt[i]; 1256 BEPIu = *BATu & 0xF0000000; 1257 BEPIl = *BATu & 0x0FFE0000; 1258 bl = (*BATu & 0x00001FFC) << 15; 1259 cpu_fprintf(f, "%s BAT%d BATu " TARGET_FMT_lx 1260 " BATl " TARGET_FMT_lx "\n\t" TARGET_FMT_lx " " 1261 TARGET_FMT_lx " " TARGET_FMT_lx "\n", 1262 type == ACCESS_CODE ? "code" : "data", i, 1263 *BATu, *BATl, BEPIu, BEPIl, bl); 1264 } 1265 } 1266 1267 static void mmu6xx_dump_mmu(FILE *f, fprintf_function cpu_fprintf, 1268 CPUPPCState *env) 1269 { 1270 PowerPCCPU *cpu = ppc_env_get_cpu(env); 1271 ppc6xx_tlb_t *tlb; 1272 target_ulong sr; 1273 int type, way, entry, i; 1274 1275 cpu_fprintf(f, "HTAB base = 0x%"HWADDR_PRIx"\n", ppc_hash32_hpt_base(cpu)); 1276 cpu_fprintf(f, "HTAB mask = 0x%"HWADDR_PRIx"\n", ppc_hash32_hpt_mask(cpu)); 1277 1278 cpu_fprintf(f, "\nSegment registers:\n"); 1279 for (i = 0; i < 32; i++) { 1280 sr = env->sr[i]; 1281 if (sr & 0x80000000) { 1282 cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d BUID=0x%03x " 1283 "CNTLR_SPEC=0x%05x\n", i, 1284 sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0, 1285 sr & 0x20000000 ? 1 : 0, (uint32_t)((sr >> 20) & 0x1FF), 1286 (uint32_t)(sr & 0xFFFFF)); 1287 } else { 1288 cpu_fprintf(f, "%02d T=%d Ks=%d Kp=%d N=%d VSID=0x%06x\n", i, 1289 sr & 0x80000000 ? 1 : 0, sr & 0x40000000 ? 1 : 0, 1290 sr & 0x20000000 ? 1 : 0, sr & 0x10000000 ? 1 : 0, 1291 (uint32_t)(sr & 0x00FFFFFF)); 1292 } 1293 } 1294 1295 cpu_fprintf(f, "\nBATs:\n"); 1296 mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_INT); 1297 mmu6xx_dump_BATs(f, cpu_fprintf, env, ACCESS_CODE); 1298 1299 if (env->id_tlbs != 1) { 1300 cpu_fprintf(f, "ERROR: 6xx MMU should have separated TLB" 1301 " for code and data\n"); 1302 } 1303 1304 cpu_fprintf(f, "\nTLBs [EPN EPN + SIZE]\n"); 1305 1306 for (type = 0; type < 2; type++) { 1307 for (way = 0; way < env->nb_ways; way++) { 1308 for (entry = env->nb_tlb * type + env->tlb_per_way * way; 1309 entry < (env->nb_tlb * type + env->tlb_per_way * (way + 1)); 1310 entry++) { 1311 1312 tlb = &env->tlb.tlb6[entry]; 1313 cpu_fprintf(f, "%s TLB %02d/%02d way:%d %s [" 1314 TARGET_FMT_lx " " TARGET_FMT_lx "]\n", 1315 type ? "code" : "data", entry % env->nb_tlb, 1316 env->nb_tlb, way, 1317 pte_is_valid(tlb->pte0) ? "valid" : "inval", 1318 tlb->EPN, tlb->EPN + TARGET_PAGE_SIZE); 1319 } 1320 } 1321 } 1322 } 1323 1324 void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env) 1325 { 1326 switch (env->mmu_model) { 1327 case POWERPC_MMU_BOOKE: 1328 mmubooke_dump_mmu(f, cpu_fprintf, env); 1329 break; 1330 case POWERPC_MMU_BOOKE206: 1331 mmubooke206_dump_mmu(f, cpu_fprintf, env); 1332 break; 1333 case POWERPC_MMU_SOFT_6xx: 1334 case POWERPC_MMU_SOFT_74xx: 1335 mmu6xx_dump_mmu(f, cpu_fprintf, env); 1336 break; 1337 #if defined(TARGET_PPC64) 1338 case POWERPC_MMU_64B: 1339 case POWERPC_MMU_2_03: 1340 case POWERPC_MMU_2_06: 1341 case POWERPC_MMU_2_07: 1342 dump_slb(f, cpu_fprintf, ppc_env_get_cpu(env)); 1343 break; 1344 case POWERPC_MMU_3_00: 1345 if (ppc64_radix_guest(ppc_env_get_cpu(env))) { 1346 /* TODO - Unsupported */ 1347 } else { 1348 dump_slb(f, cpu_fprintf, ppc_env_get_cpu(env)); 1349 break; 1350 } 1351 #endif 1352 default: 1353 qemu_log_mask(LOG_UNIMP, "%s: unimplemented\n", __func__); 1354 } 1355 } 1356 1357 static inline int check_physical(CPUPPCState *env, mmu_ctx_t *ctx, 1358 target_ulong eaddr, int rw) 1359 { 1360 int in_plb, ret; 1361 1362 ctx->raddr = eaddr; 1363 ctx->prot = PAGE_READ | PAGE_EXEC; 1364 ret = 0; 1365 switch (env->mmu_model) { 1366 case POWERPC_MMU_SOFT_6xx: 1367 case POWERPC_MMU_SOFT_74xx: 1368 case POWERPC_MMU_SOFT_4xx: 1369 case POWERPC_MMU_REAL: 1370 case POWERPC_MMU_BOOKE: 1371 ctx->prot |= PAGE_WRITE; 1372 break; 1373 1374 case POWERPC_MMU_SOFT_4xx_Z: 1375 if (unlikely(msr_pe != 0)) { 1376 /* 403 family add some particular protections, 1377 * using PBL/PBU registers for accesses with no translation. 1378 */ 1379 in_plb = 1380 /* Check PLB validity */ 1381 (env->pb[0] < env->pb[1] && 1382 /* and address in plb area */ 1383 eaddr >= env->pb[0] && eaddr < env->pb[1]) || 1384 (env->pb[2] < env->pb[3] && 1385 eaddr >= env->pb[2] && eaddr < env->pb[3]) ? 1 : 0; 1386 if (in_plb ^ msr_px) { 1387 /* Access in protected area */ 1388 if (rw == 1) { 1389 /* Access is not allowed */ 1390 ret = -2; 1391 } 1392 } else { 1393 /* Read-write access is allowed */ 1394 ctx->prot |= PAGE_WRITE; 1395 } 1396 } 1397 break; 1398 1399 default: 1400 /* Caller's checks mean we should never get here for other models */ 1401 abort(); 1402 return -1; 1403 } 1404 1405 return ret; 1406 } 1407 1408 static int get_physical_address_wtlb( 1409 CPUPPCState *env, mmu_ctx_t *ctx, 1410 target_ulong eaddr, int rw, int access_type, 1411 int mmu_idx) 1412 { 1413 PowerPCCPU *cpu = ppc_env_get_cpu(env); 1414 int ret = -1; 1415 bool real_mode = (access_type == ACCESS_CODE && msr_ir == 0) 1416 || (access_type != ACCESS_CODE && msr_dr == 0); 1417 1418 switch (env->mmu_model) { 1419 case POWERPC_MMU_SOFT_6xx: 1420 case POWERPC_MMU_SOFT_74xx: 1421 if (real_mode) { 1422 ret = check_physical(env, ctx, eaddr, rw); 1423 } else { 1424 /* Try to find a BAT */ 1425 if (env->nb_BATs != 0) { 1426 ret = get_bat_6xx_tlb(env, ctx, eaddr, rw, access_type); 1427 } 1428 if (ret < 0) { 1429 /* We didn't match any BAT entry or don't have BATs */ 1430 ret = get_segment_6xx_tlb(env, ctx, eaddr, rw, access_type); 1431 } 1432 } 1433 break; 1434 1435 case POWERPC_MMU_SOFT_4xx: 1436 case POWERPC_MMU_SOFT_4xx_Z: 1437 if (real_mode) { 1438 ret = check_physical(env, ctx, eaddr, rw); 1439 } else { 1440 ret = mmu40x_get_physical_address(env, ctx, eaddr, 1441 rw, access_type); 1442 } 1443 break; 1444 case POWERPC_MMU_BOOKE: 1445 ret = mmubooke_get_physical_address(env, ctx, eaddr, 1446 rw, access_type); 1447 break; 1448 case POWERPC_MMU_BOOKE206: 1449 ret = mmubooke206_get_physical_address(env, ctx, eaddr, rw, 1450 access_type, mmu_idx); 1451 break; 1452 case POWERPC_MMU_MPC8xx: 1453 /* XXX: TODO */ 1454 cpu_abort(CPU(cpu), "MPC8xx MMU model is not implemented\n"); 1455 break; 1456 case POWERPC_MMU_REAL: 1457 if (real_mode) { 1458 ret = check_physical(env, ctx, eaddr, rw); 1459 } else { 1460 cpu_abort(CPU(cpu), "PowerPC in real mode do not do any translation\n"); 1461 } 1462 return -1; 1463 default: 1464 cpu_abort(CPU(cpu), "Unknown or invalid MMU model\n"); 1465 return -1; 1466 } 1467 1468 return ret; 1469 } 1470 1471 static int get_physical_address( 1472 CPUPPCState *env, mmu_ctx_t *ctx, 1473 target_ulong eaddr, int rw, int access_type) 1474 { 1475 return get_physical_address_wtlb(env, ctx, eaddr, rw, access_type, 0); 1476 } 1477 1478 hwaddr ppc_cpu_get_phys_page_debug(CPUState *cs, vaddr addr) 1479 { 1480 PowerPCCPU *cpu = POWERPC_CPU(cs); 1481 CPUPPCState *env = &cpu->env; 1482 mmu_ctx_t ctx; 1483 1484 switch (env->mmu_model) { 1485 #if defined(TARGET_PPC64) 1486 case POWERPC_MMU_64B: 1487 case POWERPC_MMU_2_03: 1488 case POWERPC_MMU_2_06: 1489 case POWERPC_MMU_2_07: 1490 return ppc_hash64_get_phys_page_debug(cpu, addr); 1491 case POWERPC_MMU_3_00: 1492 if (ppc64_radix_guest(ppc_env_get_cpu(env))) { 1493 return ppc_radix64_get_phys_page_debug(cpu, addr); 1494 } else { 1495 return ppc_hash64_get_phys_page_debug(cpu, addr); 1496 } 1497 break; 1498 #endif 1499 1500 case POWERPC_MMU_32B: 1501 case POWERPC_MMU_601: 1502 return ppc_hash32_get_phys_page_debug(cpu, addr); 1503 1504 default: 1505 ; 1506 } 1507 1508 if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT) != 0)) { 1509 1510 /* Some MMUs have separate TLBs for code and data. If we only try an 1511 * ACCESS_INT, we may not be able to read instructions mapped by code 1512 * TLBs, so we also try a ACCESS_CODE. 1513 */ 1514 if (unlikely(get_physical_address(env, &ctx, addr, 0, 1515 ACCESS_CODE) != 0)) { 1516 return -1; 1517 } 1518 } 1519 1520 return ctx.raddr & TARGET_PAGE_MASK; 1521 } 1522 1523 static void booke206_update_mas_tlb_miss(CPUPPCState *env, target_ulong address, 1524 int rw, int mmu_idx) 1525 { 1526 uint32_t epid; 1527 bool as, pr; 1528 uint32_t missed_tid = 0; 1529 bool use_epid = mmubooke206_get_as(env, mmu_idx, &epid, &as, &pr); 1530 if (rw == 2) { 1531 as = msr_ir; 1532 } 1533 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK; 1534 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK; 1535 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK; 1536 env->spr[SPR_BOOKE_MAS3] = 0; 1537 env->spr[SPR_BOOKE_MAS6] = 0; 1538 env->spr[SPR_BOOKE_MAS7] = 0; 1539 1540 /* AS */ 1541 if (as) { 1542 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS; 1543 env->spr[SPR_BOOKE_MAS6] |= MAS6_SAS; 1544 } 1545 1546 env->spr[SPR_BOOKE_MAS1] |= MAS1_VALID; 1547 env->spr[SPR_BOOKE_MAS2] |= address & MAS2_EPN_MASK; 1548 1549 if (!use_epid) { 1550 switch (env->spr[SPR_BOOKE_MAS4] & MAS4_TIDSELD_PIDZ) { 1551 case MAS4_TIDSELD_PID0: 1552 missed_tid = env->spr[SPR_BOOKE_PID]; 1553 break; 1554 case MAS4_TIDSELD_PID1: 1555 missed_tid = env->spr[SPR_BOOKE_PID1]; 1556 break; 1557 case MAS4_TIDSELD_PID2: 1558 missed_tid = env->spr[SPR_BOOKE_PID2]; 1559 break; 1560 } 1561 env->spr[SPR_BOOKE_MAS6] |= env->spr[SPR_BOOKE_PID] << 16; 1562 } else { 1563 missed_tid = epid; 1564 env->spr[SPR_BOOKE_MAS6] |= missed_tid << 16; 1565 } 1566 env->spr[SPR_BOOKE_MAS1] |= (missed_tid << MAS1_TID_SHIFT); 1567 1568 1569 /* next victim logic */ 1570 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT; 1571 env->last_way++; 1572 env->last_way &= booke206_tlb_ways(env, 0) - 1; 1573 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT; 1574 } 1575 1576 /* Perform address translation */ 1577 static int cpu_ppc_handle_mmu_fault(CPUPPCState *env, target_ulong address, 1578 int rw, int mmu_idx) 1579 { 1580 CPUState *cs = CPU(ppc_env_get_cpu(env)); 1581 PowerPCCPU *cpu = POWERPC_CPU(cs); 1582 mmu_ctx_t ctx; 1583 int access_type; 1584 int ret = 0; 1585 1586 if (rw == 2) { 1587 /* code access */ 1588 rw = 0; 1589 access_type = ACCESS_CODE; 1590 } else { 1591 /* data access */ 1592 access_type = env->access_type; 1593 } 1594 ret = get_physical_address_wtlb(env, &ctx, address, rw, 1595 access_type, mmu_idx); 1596 if (ret == 0) { 1597 tlb_set_page(cs, address & TARGET_PAGE_MASK, 1598 ctx.raddr & TARGET_PAGE_MASK, ctx.prot, 1599 mmu_idx, TARGET_PAGE_SIZE); 1600 ret = 0; 1601 } else if (ret < 0) { 1602 LOG_MMU_STATE(cs); 1603 if (access_type == ACCESS_CODE) { 1604 switch (ret) { 1605 case -1: 1606 /* No matches in page tables or TLB */ 1607 switch (env->mmu_model) { 1608 case POWERPC_MMU_SOFT_6xx: 1609 cs->exception_index = POWERPC_EXCP_IFTLB; 1610 env->error_code = 1 << 18; 1611 env->spr[SPR_IMISS] = address; 1612 env->spr[SPR_ICMP] = 0x80000000 | ctx.ptem; 1613 goto tlb_miss; 1614 case POWERPC_MMU_SOFT_74xx: 1615 cs->exception_index = POWERPC_EXCP_IFTLB; 1616 goto tlb_miss_74xx; 1617 case POWERPC_MMU_SOFT_4xx: 1618 case POWERPC_MMU_SOFT_4xx_Z: 1619 cs->exception_index = POWERPC_EXCP_ITLB; 1620 env->error_code = 0; 1621 env->spr[SPR_40x_DEAR] = address; 1622 env->spr[SPR_40x_ESR] = 0x00000000; 1623 break; 1624 case POWERPC_MMU_BOOKE206: 1625 booke206_update_mas_tlb_miss(env, address, 2, mmu_idx); 1626 /* fall through */ 1627 case POWERPC_MMU_BOOKE: 1628 cs->exception_index = POWERPC_EXCP_ITLB; 1629 env->error_code = 0; 1630 env->spr[SPR_BOOKE_DEAR] = address; 1631 env->spr[SPR_BOOKE_ESR] = mmubooke206_esr(mmu_idx, 0); 1632 return -1; 1633 case POWERPC_MMU_MPC8xx: 1634 /* XXX: TODO */ 1635 cpu_abort(cs, "MPC8xx MMU model is not implemented\n"); 1636 break; 1637 case POWERPC_MMU_REAL: 1638 cpu_abort(cs, "PowerPC in real mode should never raise " 1639 "any MMU exceptions\n"); 1640 return -1; 1641 default: 1642 cpu_abort(cs, "Unknown or invalid MMU model\n"); 1643 return -1; 1644 } 1645 break; 1646 case -2: 1647 /* Access rights violation */ 1648 cs->exception_index = POWERPC_EXCP_ISI; 1649 env->error_code = 0x08000000; 1650 break; 1651 case -3: 1652 /* No execute protection violation */ 1653 if ((env->mmu_model == POWERPC_MMU_BOOKE) || 1654 (env->mmu_model == POWERPC_MMU_BOOKE206)) { 1655 env->spr[SPR_BOOKE_ESR] = 0x00000000; 1656 } 1657 cs->exception_index = POWERPC_EXCP_ISI; 1658 env->error_code = 0x10000000; 1659 break; 1660 case -4: 1661 /* Direct store exception */ 1662 /* No code fetch is allowed in direct-store areas */ 1663 cs->exception_index = POWERPC_EXCP_ISI; 1664 env->error_code = 0x10000000; 1665 break; 1666 } 1667 } else { 1668 switch (ret) { 1669 case -1: 1670 /* No matches in page tables or TLB */ 1671 switch (env->mmu_model) { 1672 case POWERPC_MMU_SOFT_6xx: 1673 if (rw == 1) { 1674 cs->exception_index = POWERPC_EXCP_DSTLB; 1675 env->error_code = 1 << 16; 1676 } else { 1677 cs->exception_index = POWERPC_EXCP_DLTLB; 1678 env->error_code = 0; 1679 } 1680 env->spr[SPR_DMISS] = address; 1681 env->spr[SPR_DCMP] = 0x80000000 | ctx.ptem; 1682 tlb_miss: 1683 env->error_code |= ctx.key << 19; 1684 env->spr[SPR_HASH1] = ppc_hash32_hpt_base(cpu) + 1685 get_pteg_offset32(cpu, ctx.hash[0]); 1686 env->spr[SPR_HASH2] = ppc_hash32_hpt_base(cpu) + 1687 get_pteg_offset32(cpu, ctx.hash[1]); 1688 break; 1689 case POWERPC_MMU_SOFT_74xx: 1690 if (rw == 1) { 1691 cs->exception_index = POWERPC_EXCP_DSTLB; 1692 } else { 1693 cs->exception_index = POWERPC_EXCP_DLTLB; 1694 } 1695 tlb_miss_74xx: 1696 /* Implement LRU algorithm */ 1697 env->error_code = ctx.key << 19; 1698 env->spr[SPR_TLBMISS] = (address & ~((target_ulong)0x3)) | 1699 ((env->last_way + 1) & (env->nb_ways - 1)); 1700 env->spr[SPR_PTEHI] = 0x80000000 | ctx.ptem; 1701 break; 1702 case POWERPC_MMU_SOFT_4xx: 1703 case POWERPC_MMU_SOFT_4xx_Z: 1704 cs->exception_index = POWERPC_EXCP_DTLB; 1705 env->error_code = 0; 1706 env->spr[SPR_40x_DEAR] = address; 1707 if (rw) { 1708 env->spr[SPR_40x_ESR] = 0x00800000; 1709 } else { 1710 env->spr[SPR_40x_ESR] = 0x00000000; 1711 } 1712 break; 1713 case POWERPC_MMU_MPC8xx: 1714 /* XXX: TODO */ 1715 cpu_abort(cs, "MPC8xx MMU model is not implemented\n"); 1716 break; 1717 case POWERPC_MMU_BOOKE206: 1718 booke206_update_mas_tlb_miss(env, address, rw, mmu_idx); 1719 /* fall through */ 1720 case POWERPC_MMU_BOOKE: 1721 cs->exception_index = POWERPC_EXCP_DTLB; 1722 env->error_code = 0; 1723 env->spr[SPR_BOOKE_DEAR] = address; 1724 env->spr[SPR_BOOKE_ESR] = mmubooke206_esr(mmu_idx, rw); 1725 return -1; 1726 case POWERPC_MMU_REAL: 1727 cpu_abort(cs, "PowerPC in real mode should never raise " 1728 "any MMU exceptions\n"); 1729 return -1; 1730 default: 1731 cpu_abort(cs, "Unknown or invalid MMU model\n"); 1732 return -1; 1733 } 1734 break; 1735 case -2: 1736 /* Access rights violation */ 1737 cs->exception_index = POWERPC_EXCP_DSI; 1738 env->error_code = 0; 1739 if (env->mmu_model == POWERPC_MMU_SOFT_4xx 1740 || env->mmu_model == POWERPC_MMU_SOFT_4xx_Z) { 1741 env->spr[SPR_40x_DEAR] = address; 1742 if (rw) { 1743 env->spr[SPR_40x_ESR] |= 0x00800000; 1744 } 1745 } else if ((env->mmu_model == POWERPC_MMU_BOOKE) || 1746 (env->mmu_model == POWERPC_MMU_BOOKE206)) { 1747 env->spr[SPR_BOOKE_DEAR] = address; 1748 env->spr[SPR_BOOKE_ESR] = mmubooke206_esr(mmu_idx, rw); 1749 } else { 1750 env->spr[SPR_DAR] = address; 1751 if (rw == 1) { 1752 env->spr[SPR_DSISR] = 0x0A000000; 1753 } else { 1754 env->spr[SPR_DSISR] = 0x08000000; 1755 } 1756 } 1757 break; 1758 case -4: 1759 /* Direct store exception */ 1760 switch (access_type) { 1761 case ACCESS_FLOAT: 1762 /* Floating point load/store */ 1763 cs->exception_index = POWERPC_EXCP_ALIGN; 1764 env->error_code = POWERPC_EXCP_ALIGN_FP; 1765 env->spr[SPR_DAR] = address; 1766 break; 1767 case ACCESS_RES: 1768 /* lwarx, ldarx or stwcx. */ 1769 cs->exception_index = POWERPC_EXCP_DSI; 1770 env->error_code = 0; 1771 env->spr[SPR_DAR] = address; 1772 if (rw == 1) { 1773 env->spr[SPR_DSISR] = 0x06000000; 1774 } else { 1775 env->spr[SPR_DSISR] = 0x04000000; 1776 } 1777 break; 1778 case ACCESS_EXT: 1779 /* eciwx or ecowx */ 1780 cs->exception_index = POWERPC_EXCP_DSI; 1781 env->error_code = 0; 1782 env->spr[SPR_DAR] = address; 1783 if (rw == 1) { 1784 env->spr[SPR_DSISR] = 0x06100000; 1785 } else { 1786 env->spr[SPR_DSISR] = 0x04100000; 1787 } 1788 break; 1789 default: 1790 printf("DSI: invalid exception (%d)\n", ret); 1791 cs->exception_index = POWERPC_EXCP_PROGRAM; 1792 env->error_code = 1793 POWERPC_EXCP_INVAL | POWERPC_EXCP_INVAL_INVAL; 1794 env->spr[SPR_DAR] = address; 1795 break; 1796 } 1797 break; 1798 } 1799 } 1800 ret = 1; 1801 } 1802 1803 return ret; 1804 } 1805 1806 /*****************************************************************************/ 1807 /* BATs management */ 1808 #if !defined(FLUSH_ALL_TLBS) 1809 static inline void do_invalidate_BAT(CPUPPCState *env, target_ulong BATu, 1810 target_ulong mask) 1811 { 1812 CPUState *cs = CPU(ppc_env_get_cpu(env)); 1813 target_ulong base, end, page; 1814 1815 base = BATu & ~0x0001FFFF; 1816 end = base + mask + 0x00020000; 1817 LOG_BATS("Flush BAT from " TARGET_FMT_lx " to " TARGET_FMT_lx " (" 1818 TARGET_FMT_lx ")\n", base, end, mask); 1819 for (page = base; page != end; page += TARGET_PAGE_SIZE) { 1820 tlb_flush_page(cs, page); 1821 } 1822 LOG_BATS("Flush done\n"); 1823 } 1824 #endif 1825 1826 static inline void dump_store_bat(CPUPPCState *env, char ID, int ul, int nr, 1827 target_ulong value) 1828 { 1829 LOG_BATS("Set %cBAT%d%c to " TARGET_FMT_lx " (" TARGET_FMT_lx ")\n", ID, 1830 nr, ul == 0 ? 'u' : 'l', value, env->nip); 1831 } 1832 1833 void helper_store_ibatu(CPUPPCState *env, uint32_t nr, target_ulong value) 1834 { 1835 target_ulong mask; 1836 #if defined(FLUSH_ALL_TLBS) 1837 PowerPCCPU *cpu = ppc_env_get_cpu(env); 1838 #endif 1839 1840 dump_store_bat(env, 'I', 0, nr, value); 1841 if (env->IBAT[0][nr] != value) { 1842 mask = (value << 15) & 0x0FFE0000UL; 1843 #if !defined(FLUSH_ALL_TLBS) 1844 do_invalidate_BAT(env, env->IBAT[0][nr], mask); 1845 #endif 1846 /* When storing valid upper BAT, mask BEPI and BRPN 1847 * and invalidate all TLBs covered by this BAT 1848 */ 1849 mask = (value << 15) & 0x0FFE0000UL; 1850 env->IBAT[0][nr] = (value & 0x00001FFFUL) | 1851 (value & ~0x0001FFFFUL & ~mask); 1852 env->IBAT[1][nr] = (env->IBAT[1][nr] & 0x0000007B) | 1853 (env->IBAT[1][nr] & ~0x0001FFFF & ~mask); 1854 #if !defined(FLUSH_ALL_TLBS) 1855 do_invalidate_BAT(env, env->IBAT[0][nr], mask); 1856 #else 1857 tlb_flush(CPU(cpu)); 1858 #endif 1859 } 1860 } 1861 1862 void helper_store_ibatl(CPUPPCState *env, uint32_t nr, target_ulong value) 1863 { 1864 dump_store_bat(env, 'I', 1, nr, value); 1865 env->IBAT[1][nr] = value; 1866 } 1867 1868 void helper_store_dbatu(CPUPPCState *env, uint32_t nr, target_ulong value) 1869 { 1870 target_ulong mask; 1871 #if defined(FLUSH_ALL_TLBS) 1872 PowerPCCPU *cpu = ppc_env_get_cpu(env); 1873 #endif 1874 1875 dump_store_bat(env, 'D', 0, nr, value); 1876 if (env->DBAT[0][nr] != value) { 1877 /* When storing valid upper BAT, mask BEPI and BRPN 1878 * and invalidate all TLBs covered by this BAT 1879 */ 1880 mask = (value << 15) & 0x0FFE0000UL; 1881 #if !defined(FLUSH_ALL_TLBS) 1882 do_invalidate_BAT(env, env->DBAT[0][nr], mask); 1883 #endif 1884 mask = (value << 15) & 0x0FFE0000UL; 1885 env->DBAT[0][nr] = (value & 0x00001FFFUL) | 1886 (value & ~0x0001FFFFUL & ~mask); 1887 env->DBAT[1][nr] = (env->DBAT[1][nr] & 0x0000007B) | 1888 (env->DBAT[1][nr] & ~0x0001FFFF & ~mask); 1889 #if !defined(FLUSH_ALL_TLBS) 1890 do_invalidate_BAT(env, env->DBAT[0][nr], mask); 1891 #else 1892 tlb_flush(CPU(cpu)); 1893 #endif 1894 } 1895 } 1896 1897 void helper_store_dbatl(CPUPPCState *env, uint32_t nr, target_ulong value) 1898 { 1899 dump_store_bat(env, 'D', 1, nr, value); 1900 env->DBAT[1][nr] = value; 1901 } 1902 1903 void helper_store_601_batu(CPUPPCState *env, uint32_t nr, target_ulong value) 1904 { 1905 target_ulong mask; 1906 #if defined(FLUSH_ALL_TLBS) 1907 PowerPCCPU *cpu = ppc_env_get_cpu(env); 1908 int do_inval; 1909 #endif 1910 1911 dump_store_bat(env, 'I', 0, nr, value); 1912 if (env->IBAT[0][nr] != value) { 1913 #if defined(FLUSH_ALL_TLBS) 1914 do_inval = 0; 1915 #endif 1916 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL; 1917 if (env->IBAT[1][nr] & 0x40) { 1918 /* Invalidate BAT only if it is valid */ 1919 #if !defined(FLUSH_ALL_TLBS) 1920 do_invalidate_BAT(env, env->IBAT[0][nr], mask); 1921 #else 1922 do_inval = 1; 1923 #endif 1924 } 1925 /* When storing valid upper BAT, mask BEPI and BRPN 1926 * and invalidate all TLBs covered by this BAT 1927 */ 1928 env->IBAT[0][nr] = (value & 0x00001FFFUL) | 1929 (value & ~0x0001FFFFUL & ~mask); 1930 env->DBAT[0][nr] = env->IBAT[0][nr]; 1931 if (env->IBAT[1][nr] & 0x40) { 1932 #if !defined(FLUSH_ALL_TLBS) 1933 do_invalidate_BAT(env, env->IBAT[0][nr], mask); 1934 #else 1935 do_inval = 1; 1936 #endif 1937 } 1938 #if defined(FLUSH_ALL_TLBS) 1939 if (do_inval) { 1940 tlb_flush(CPU(cpu)); 1941 } 1942 #endif 1943 } 1944 } 1945 1946 void helper_store_601_batl(CPUPPCState *env, uint32_t nr, target_ulong value) 1947 { 1948 #if !defined(FLUSH_ALL_TLBS) 1949 target_ulong mask; 1950 #else 1951 PowerPCCPU *cpu = ppc_env_get_cpu(env); 1952 int do_inval; 1953 #endif 1954 1955 dump_store_bat(env, 'I', 1, nr, value); 1956 if (env->IBAT[1][nr] != value) { 1957 #if defined(FLUSH_ALL_TLBS) 1958 do_inval = 0; 1959 #endif 1960 if (env->IBAT[1][nr] & 0x40) { 1961 #if !defined(FLUSH_ALL_TLBS) 1962 mask = (env->IBAT[1][nr] << 17) & 0x0FFE0000UL; 1963 do_invalidate_BAT(env, env->IBAT[0][nr], mask); 1964 #else 1965 do_inval = 1; 1966 #endif 1967 } 1968 if (value & 0x40) { 1969 #if !defined(FLUSH_ALL_TLBS) 1970 mask = (value << 17) & 0x0FFE0000UL; 1971 do_invalidate_BAT(env, env->IBAT[0][nr], mask); 1972 #else 1973 do_inval = 1; 1974 #endif 1975 } 1976 env->IBAT[1][nr] = value; 1977 env->DBAT[1][nr] = value; 1978 #if defined(FLUSH_ALL_TLBS) 1979 if (do_inval) { 1980 tlb_flush(CPU(cpu)); 1981 } 1982 #endif 1983 } 1984 } 1985 1986 /*****************************************************************************/ 1987 /* TLB management */ 1988 void ppc_tlb_invalidate_all(CPUPPCState *env) 1989 { 1990 PowerPCCPU *cpu = ppc_env_get_cpu(env); 1991 1992 #if defined(TARGET_PPC64) 1993 if (env->mmu_model & POWERPC_MMU_64) { 1994 env->tlb_need_flush = 0; 1995 tlb_flush(CPU(cpu)); 1996 } else 1997 #endif /* defined(TARGET_PPC64) */ 1998 switch (env->mmu_model) { 1999 case POWERPC_MMU_SOFT_6xx: 2000 case POWERPC_MMU_SOFT_74xx: 2001 ppc6xx_tlb_invalidate_all(env); 2002 break; 2003 case POWERPC_MMU_SOFT_4xx: 2004 case POWERPC_MMU_SOFT_4xx_Z: 2005 ppc4xx_tlb_invalidate_all(env); 2006 break; 2007 case POWERPC_MMU_REAL: 2008 cpu_abort(CPU(cpu), "No TLB for PowerPC 4xx in real mode\n"); 2009 break; 2010 case POWERPC_MMU_MPC8xx: 2011 /* XXX: TODO */ 2012 cpu_abort(CPU(cpu), "MPC8xx MMU model is not implemented\n"); 2013 break; 2014 case POWERPC_MMU_BOOKE: 2015 tlb_flush(CPU(cpu)); 2016 break; 2017 case POWERPC_MMU_BOOKE206: 2018 booke206_flush_tlb(env, -1, 0); 2019 break; 2020 case POWERPC_MMU_32B: 2021 case POWERPC_MMU_601: 2022 env->tlb_need_flush = 0; 2023 tlb_flush(CPU(cpu)); 2024 break; 2025 default: 2026 /* XXX: TODO */ 2027 cpu_abort(CPU(cpu), "Unknown MMU model %x\n", env->mmu_model); 2028 break; 2029 } 2030 } 2031 2032 void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr) 2033 { 2034 #if !defined(FLUSH_ALL_TLBS) 2035 addr &= TARGET_PAGE_MASK; 2036 #if defined(TARGET_PPC64) 2037 if (env->mmu_model & POWERPC_MMU_64) { 2038 /* tlbie invalidate TLBs for all segments */ 2039 /* XXX: given the fact that there are too many segments to invalidate, 2040 * and we still don't have a tlb_flush_mask(env, n, mask) in QEMU, 2041 * we just invalidate all TLBs 2042 */ 2043 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH; 2044 } else 2045 #endif /* defined(TARGET_PPC64) */ 2046 switch (env->mmu_model) { 2047 case POWERPC_MMU_SOFT_6xx: 2048 case POWERPC_MMU_SOFT_74xx: 2049 ppc6xx_tlb_invalidate_virt(env, addr, 0); 2050 if (env->id_tlbs == 1) { 2051 ppc6xx_tlb_invalidate_virt(env, addr, 1); 2052 } 2053 break; 2054 case POWERPC_MMU_32B: 2055 case POWERPC_MMU_601: 2056 /* Actual CPUs invalidate entire congruence classes based on the 2057 * geometry of their TLBs and some OSes take that into account, 2058 * we just mark the TLB to be flushed later (context synchronizing 2059 * event or sync instruction on 32-bit). 2060 */ 2061 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH; 2062 break; 2063 default: 2064 /* Should never reach here with other MMU models */ 2065 assert(0); 2066 } 2067 #else 2068 ppc_tlb_invalidate_all(env); 2069 #endif 2070 } 2071 2072 /*****************************************************************************/ 2073 /* Special registers manipulation */ 2074 void ppc_store_sdr1(CPUPPCState *env, target_ulong value) 2075 { 2076 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2077 qemu_log_mask(CPU_LOG_MMU, "%s: " TARGET_FMT_lx "\n", __func__, value); 2078 assert(!cpu->vhyp); 2079 #if defined(TARGET_PPC64) 2080 if (env->mmu_model & POWERPC_MMU_64) { 2081 target_ulong sdr_mask = SDR_64_HTABORG | SDR_64_HTABSIZE; 2082 target_ulong htabsize = value & SDR_64_HTABSIZE; 2083 2084 if (value & ~sdr_mask) { 2085 error_report("Invalid bits 0x"TARGET_FMT_lx" set in SDR1", 2086 value & ~sdr_mask); 2087 value &= sdr_mask; 2088 } 2089 if (htabsize > 28) { 2090 error_report("Invalid HTABSIZE 0x" TARGET_FMT_lx" stored in SDR1", 2091 htabsize); 2092 return; 2093 } 2094 } 2095 #endif /* defined(TARGET_PPC64) */ 2096 /* FIXME: Should check for valid HTABMASK values in 32-bit case */ 2097 env->spr[SPR_SDR1] = value; 2098 } 2099 2100 #if defined(TARGET_PPC64) 2101 void ppc_store_ptcr(CPUPPCState *env, target_ulong value) 2102 { 2103 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2104 target_ulong ptcr_mask = PTCR_PATB | PTCR_PATS; 2105 target_ulong patbsize = value & PTCR_PATS; 2106 2107 qemu_log_mask(CPU_LOG_MMU, "%s: " TARGET_FMT_lx "\n", __func__, value); 2108 2109 assert(!cpu->vhyp); 2110 assert(env->mmu_model & POWERPC_MMU_3_00); 2111 2112 if (value & ~ptcr_mask) { 2113 error_report("Invalid bits 0x"TARGET_FMT_lx" set in PTCR", 2114 value & ~ptcr_mask); 2115 value &= ptcr_mask; 2116 } 2117 2118 if (patbsize > 24) { 2119 error_report("Invalid Partition Table size 0x" TARGET_FMT_lx 2120 " stored in PTCR", patbsize); 2121 return; 2122 } 2123 2124 env->spr[SPR_PTCR] = value; 2125 } 2126 2127 #endif /* defined(TARGET_PPC64) */ 2128 2129 /* Segment registers load and store */ 2130 target_ulong helper_load_sr(CPUPPCState *env, target_ulong sr_num) 2131 { 2132 #if defined(TARGET_PPC64) 2133 if (env->mmu_model & POWERPC_MMU_64) { 2134 /* XXX */ 2135 return 0; 2136 } 2137 #endif 2138 return env->sr[sr_num]; 2139 } 2140 2141 void helper_store_sr(CPUPPCState *env, target_ulong srnum, target_ulong value) 2142 { 2143 qemu_log_mask(CPU_LOG_MMU, 2144 "%s: reg=%d " TARGET_FMT_lx " " TARGET_FMT_lx "\n", __func__, 2145 (int)srnum, value, env->sr[srnum]); 2146 #if defined(TARGET_PPC64) 2147 if (env->mmu_model & POWERPC_MMU_64) { 2148 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2149 uint64_t esid, vsid; 2150 2151 /* ESID = srnum */ 2152 esid = ((uint64_t)(srnum & 0xf) << 28) | SLB_ESID_V; 2153 2154 /* VSID = VSID */ 2155 vsid = (value & 0xfffffff) << 12; 2156 /* flags = flags */ 2157 vsid |= ((value >> 27) & 0xf) << 8; 2158 2159 ppc_store_slb(cpu, srnum, esid, vsid); 2160 } else 2161 #endif 2162 if (env->sr[srnum] != value) { 2163 env->sr[srnum] = value; 2164 /* Invalidating 256MB of virtual memory in 4kB pages is way longer than 2165 flusing the whole TLB. */ 2166 #if !defined(FLUSH_ALL_TLBS) && 0 2167 { 2168 target_ulong page, end; 2169 /* Invalidate 256 MB of virtual memory */ 2170 page = (16 << 20) * srnum; 2171 end = page + (16 << 20); 2172 for (; page != end; page += TARGET_PAGE_SIZE) { 2173 tlb_flush_page(CPU(cpu), page); 2174 } 2175 } 2176 #else 2177 env->tlb_need_flush |= TLB_NEED_LOCAL_FLUSH; 2178 #endif 2179 } 2180 } 2181 2182 /* TLB management */ 2183 void helper_tlbia(CPUPPCState *env) 2184 { 2185 ppc_tlb_invalidate_all(env); 2186 } 2187 2188 void helper_tlbie(CPUPPCState *env, target_ulong addr) 2189 { 2190 ppc_tlb_invalidate_one(env, addr); 2191 } 2192 2193 void helper_tlbiva(CPUPPCState *env, target_ulong addr) 2194 { 2195 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2196 2197 /* tlbiva instruction only exists on BookE */ 2198 assert(env->mmu_model == POWERPC_MMU_BOOKE); 2199 /* XXX: TODO */ 2200 cpu_abort(CPU(cpu), "BookE MMU model is not implemented\n"); 2201 } 2202 2203 /* Software driven TLBs management */ 2204 /* PowerPC 602/603 software TLB load instructions helpers */ 2205 static void do_6xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code) 2206 { 2207 target_ulong RPN, CMP, EPN; 2208 int way; 2209 2210 RPN = env->spr[SPR_RPA]; 2211 if (is_code) { 2212 CMP = env->spr[SPR_ICMP]; 2213 EPN = env->spr[SPR_IMISS]; 2214 } else { 2215 CMP = env->spr[SPR_DCMP]; 2216 EPN = env->spr[SPR_DMISS]; 2217 } 2218 way = (env->spr[SPR_SRR1] >> 17) & 1; 2219 (void)EPN; /* avoid a compiler warning */ 2220 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx 2221 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP, 2222 RPN, way); 2223 /* Store this TLB */ 2224 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK), 2225 way, is_code, CMP, RPN); 2226 } 2227 2228 void helper_6xx_tlbd(CPUPPCState *env, target_ulong EPN) 2229 { 2230 do_6xx_tlb(env, EPN, 0); 2231 } 2232 2233 void helper_6xx_tlbi(CPUPPCState *env, target_ulong EPN) 2234 { 2235 do_6xx_tlb(env, EPN, 1); 2236 } 2237 2238 /* PowerPC 74xx software TLB load instructions helpers */ 2239 static void do_74xx_tlb(CPUPPCState *env, target_ulong new_EPN, int is_code) 2240 { 2241 target_ulong RPN, CMP, EPN; 2242 int way; 2243 2244 RPN = env->spr[SPR_PTELO]; 2245 CMP = env->spr[SPR_PTEHI]; 2246 EPN = env->spr[SPR_TLBMISS] & ~0x3; 2247 way = env->spr[SPR_TLBMISS] & 0x3; 2248 (void)EPN; /* avoid a compiler warning */ 2249 LOG_SWTLB("%s: EPN " TARGET_FMT_lx " " TARGET_FMT_lx " PTE0 " TARGET_FMT_lx 2250 " PTE1 " TARGET_FMT_lx " way %d\n", __func__, new_EPN, EPN, CMP, 2251 RPN, way); 2252 /* Store this TLB */ 2253 ppc6xx_tlb_store(env, (uint32_t)(new_EPN & TARGET_PAGE_MASK), 2254 way, is_code, CMP, RPN); 2255 } 2256 2257 void helper_74xx_tlbd(CPUPPCState *env, target_ulong EPN) 2258 { 2259 do_74xx_tlb(env, EPN, 0); 2260 } 2261 2262 void helper_74xx_tlbi(CPUPPCState *env, target_ulong EPN) 2263 { 2264 do_74xx_tlb(env, EPN, 1); 2265 } 2266 2267 /*****************************************************************************/ 2268 /* PowerPC 601 specific instructions (POWER bridge) */ 2269 2270 target_ulong helper_rac(CPUPPCState *env, target_ulong addr) 2271 { 2272 mmu_ctx_t ctx; 2273 int nb_BATs; 2274 target_ulong ret = 0; 2275 2276 /* We don't have to generate many instances of this instruction, 2277 * as rac is supervisor only. 2278 */ 2279 /* XXX: FIX THIS: Pretend we have no BAT */ 2280 nb_BATs = env->nb_BATs; 2281 env->nb_BATs = 0; 2282 if (get_physical_address(env, &ctx, addr, 0, ACCESS_INT) == 0) { 2283 ret = ctx.raddr; 2284 } 2285 env->nb_BATs = nb_BATs; 2286 return ret; 2287 } 2288 2289 static inline target_ulong booke_tlb_to_page_size(int size) 2290 { 2291 return 1024 << (2 * size); 2292 } 2293 2294 static inline int booke_page_size_to_tlb(target_ulong page_size) 2295 { 2296 int size; 2297 2298 switch (page_size) { 2299 case 0x00000400UL: 2300 size = 0x0; 2301 break; 2302 case 0x00001000UL: 2303 size = 0x1; 2304 break; 2305 case 0x00004000UL: 2306 size = 0x2; 2307 break; 2308 case 0x00010000UL: 2309 size = 0x3; 2310 break; 2311 case 0x00040000UL: 2312 size = 0x4; 2313 break; 2314 case 0x00100000UL: 2315 size = 0x5; 2316 break; 2317 case 0x00400000UL: 2318 size = 0x6; 2319 break; 2320 case 0x01000000UL: 2321 size = 0x7; 2322 break; 2323 case 0x04000000UL: 2324 size = 0x8; 2325 break; 2326 case 0x10000000UL: 2327 size = 0x9; 2328 break; 2329 case 0x40000000UL: 2330 size = 0xA; 2331 break; 2332 #if defined(TARGET_PPC64) 2333 case 0x000100000000ULL: 2334 size = 0xB; 2335 break; 2336 case 0x000400000000ULL: 2337 size = 0xC; 2338 break; 2339 case 0x001000000000ULL: 2340 size = 0xD; 2341 break; 2342 case 0x004000000000ULL: 2343 size = 0xE; 2344 break; 2345 case 0x010000000000ULL: 2346 size = 0xF; 2347 break; 2348 #endif 2349 default: 2350 size = -1; 2351 break; 2352 } 2353 2354 return size; 2355 } 2356 2357 /* Helpers for 4xx TLB management */ 2358 #define PPC4XX_TLB_ENTRY_MASK 0x0000003f /* Mask for 64 TLB entries */ 2359 2360 #define PPC4XX_TLBHI_V 0x00000040 2361 #define PPC4XX_TLBHI_E 0x00000020 2362 #define PPC4XX_TLBHI_SIZE_MIN 0 2363 #define PPC4XX_TLBHI_SIZE_MAX 7 2364 #define PPC4XX_TLBHI_SIZE_DEFAULT 1 2365 #define PPC4XX_TLBHI_SIZE_SHIFT 7 2366 #define PPC4XX_TLBHI_SIZE_MASK 0x00000007 2367 2368 #define PPC4XX_TLBLO_EX 0x00000200 2369 #define PPC4XX_TLBLO_WR 0x00000100 2370 #define PPC4XX_TLBLO_ATTR_MASK 0x000000FF 2371 #define PPC4XX_TLBLO_RPN_MASK 0xFFFFFC00 2372 2373 target_ulong helper_4xx_tlbre_hi(CPUPPCState *env, target_ulong entry) 2374 { 2375 ppcemb_tlb_t *tlb; 2376 target_ulong ret; 2377 int size; 2378 2379 entry &= PPC4XX_TLB_ENTRY_MASK; 2380 tlb = &env->tlb.tlbe[entry]; 2381 ret = tlb->EPN; 2382 if (tlb->prot & PAGE_VALID) { 2383 ret |= PPC4XX_TLBHI_V; 2384 } 2385 size = booke_page_size_to_tlb(tlb->size); 2386 if (size < PPC4XX_TLBHI_SIZE_MIN || size > PPC4XX_TLBHI_SIZE_MAX) { 2387 size = PPC4XX_TLBHI_SIZE_DEFAULT; 2388 } 2389 ret |= size << PPC4XX_TLBHI_SIZE_SHIFT; 2390 env->spr[SPR_40x_PID] = tlb->PID; 2391 return ret; 2392 } 2393 2394 target_ulong helper_4xx_tlbre_lo(CPUPPCState *env, target_ulong entry) 2395 { 2396 ppcemb_tlb_t *tlb; 2397 target_ulong ret; 2398 2399 entry &= PPC4XX_TLB_ENTRY_MASK; 2400 tlb = &env->tlb.tlbe[entry]; 2401 ret = tlb->RPN; 2402 if (tlb->prot & PAGE_EXEC) { 2403 ret |= PPC4XX_TLBLO_EX; 2404 } 2405 if (tlb->prot & PAGE_WRITE) { 2406 ret |= PPC4XX_TLBLO_WR; 2407 } 2408 return ret; 2409 } 2410 2411 void helper_4xx_tlbwe_hi(CPUPPCState *env, target_ulong entry, 2412 target_ulong val) 2413 { 2414 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2415 CPUState *cs = CPU(cpu); 2416 ppcemb_tlb_t *tlb; 2417 target_ulong page, end; 2418 2419 LOG_SWTLB("%s entry %d val " TARGET_FMT_lx "\n", __func__, (int)entry, 2420 val); 2421 entry &= PPC4XX_TLB_ENTRY_MASK; 2422 tlb = &env->tlb.tlbe[entry]; 2423 /* Invalidate previous TLB (if it's valid) */ 2424 if (tlb->prot & PAGE_VALID) { 2425 end = tlb->EPN + tlb->size; 2426 LOG_SWTLB("%s: invalidate old TLB %d start " TARGET_FMT_lx " end " 2427 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end); 2428 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) { 2429 tlb_flush_page(cs, page); 2430 } 2431 } 2432 tlb->size = booke_tlb_to_page_size((val >> PPC4XX_TLBHI_SIZE_SHIFT) 2433 & PPC4XX_TLBHI_SIZE_MASK); 2434 /* We cannot handle TLB size < TARGET_PAGE_SIZE. 2435 * If this ever occurs, we should implement TARGET_PAGE_BITS_VARY 2436 */ 2437 if ((val & PPC4XX_TLBHI_V) && tlb->size < TARGET_PAGE_SIZE) { 2438 cpu_abort(cs, "TLB size " TARGET_FMT_lu " < %u " 2439 "are not supported (%d)\n" 2440 "Please implement TARGET_PAGE_BITS_VARY\n", 2441 tlb->size, TARGET_PAGE_SIZE, (int)((val >> 7) & 0x7)); 2442 } 2443 tlb->EPN = val & ~(tlb->size - 1); 2444 if (val & PPC4XX_TLBHI_V) { 2445 tlb->prot |= PAGE_VALID; 2446 if (val & PPC4XX_TLBHI_E) { 2447 /* XXX: TO BE FIXED */ 2448 cpu_abort(cs, 2449 "Little-endian TLB entries are not supported by now\n"); 2450 } 2451 } else { 2452 tlb->prot &= ~PAGE_VALID; 2453 } 2454 tlb->PID = env->spr[SPR_40x_PID]; /* PID */ 2455 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx 2456 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__, 2457 (int)entry, tlb->RPN, tlb->EPN, tlb->size, 2458 tlb->prot & PAGE_READ ? 'r' : '-', 2459 tlb->prot & PAGE_WRITE ? 'w' : '-', 2460 tlb->prot & PAGE_EXEC ? 'x' : '-', 2461 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID); 2462 /* Invalidate new TLB (if valid) */ 2463 if (tlb->prot & PAGE_VALID) { 2464 end = tlb->EPN + tlb->size; 2465 LOG_SWTLB("%s: invalidate TLB %d start " TARGET_FMT_lx " end " 2466 TARGET_FMT_lx "\n", __func__, (int)entry, tlb->EPN, end); 2467 for (page = tlb->EPN; page < end; page += TARGET_PAGE_SIZE) { 2468 tlb_flush_page(cs, page); 2469 } 2470 } 2471 } 2472 2473 void helper_4xx_tlbwe_lo(CPUPPCState *env, target_ulong entry, 2474 target_ulong val) 2475 { 2476 ppcemb_tlb_t *tlb; 2477 2478 LOG_SWTLB("%s entry %i val " TARGET_FMT_lx "\n", __func__, (int)entry, 2479 val); 2480 entry &= PPC4XX_TLB_ENTRY_MASK; 2481 tlb = &env->tlb.tlbe[entry]; 2482 tlb->attr = val & PPC4XX_TLBLO_ATTR_MASK; 2483 tlb->RPN = val & PPC4XX_TLBLO_RPN_MASK; 2484 tlb->prot = PAGE_READ; 2485 if (val & PPC4XX_TLBLO_EX) { 2486 tlb->prot |= PAGE_EXEC; 2487 } 2488 if (val & PPC4XX_TLBLO_WR) { 2489 tlb->prot |= PAGE_WRITE; 2490 } 2491 LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx 2492 " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__, 2493 (int)entry, tlb->RPN, tlb->EPN, tlb->size, 2494 tlb->prot & PAGE_READ ? 'r' : '-', 2495 tlb->prot & PAGE_WRITE ? 'w' : '-', 2496 tlb->prot & PAGE_EXEC ? 'x' : '-', 2497 tlb->prot & PAGE_VALID ? 'v' : '-', (int)tlb->PID); 2498 } 2499 2500 target_ulong helper_4xx_tlbsx(CPUPPCState *env, target_ulong address) 2501 { 2502 return ppcemb_tlb_search(env, address, env->spr[SPR_40x_PID]); 2503 } 2504 2505 /* PowerPC 440 TLB management */ 2506 void helper_440_tlbwe(CPUPPCState *env, uint32_t word, target_ulong entry, 2507 target_ulong value) 2508 { 2509 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2510 ppcemb_tlb_t *tlb; 2511 target_ulong EPN, RPN, size; 2512 int do_flush_tlbs; 2513 2514 LOG_SWTLB("%s word %d entry %d value " TARGET_FMT_lx "\n", 2515 __func__, word, (int)entry, value); 2516 do_flush_tlbs = 0; 2517 entry &= 0x3F; 2518 tlb = &env->tlb.tlbe[entry]; 2519 switch (word) { 2520 default: 2521 /* Just here to please gcc */ 2522 case 0: 2523 EPN = value & 0xFFFFFC00; 2524 if ((tlb->prot & PAGE_VALID) && EPN != tlb->EPN) { 2525 do_flush_tlbs = 1; 2526 } 2527 tlb->EPN = EPN; 2528 size = booke_tlb_to_page_size((value >> 4) & 0xF); 2529 if ((tlb->prot & PAGE_VALID) && tlb->size < size) { 2530 do_flush_tlbs = 1; 2531 } 2532 tlb->size = size; 2533 tlb->attr &= ~0x1; 2534 tlb->attr |= (value >> 8) & 1; 2535 if (value & 0x200) { 2536 tlb->prot |= PAGE_VALID; 2537 } else { 2538 if (tlb->prot & PAGE_VALID) { 2539 tlb->prot &= ~PAGE_VALID; 2540 do_flush_tlbs = 1; 2541 } 2542 } 2543 tlb->PID = env->spr[SPR_440_MMUCR] & 0x000000FF; 2544 if (do_flush_tlbs) { 2545 tlb_flush(CPU(cpu)); 2546 } 2547 break; 2548 case 1: 2549 RPN = value & 0xFFFFFC0F; 2550 if ((tlb->prot & PAGE_VALID) && tlb->RPN != RPN) { 2551 tlb_flush(CPU(cpu)); 2552 } 2553 tlb->RPN = RPN; 2554 break; 2555 case 2: 2556 tlb->attr = (tlb->attr & 0x1) | (value & 0x0000FF00); 2557 tlb->prot = tlb->prot & PAGE_VALID; 2558 if (value & 0x1) { 2559 tlb->prot |= PAGE_READ << 4; 2560 } 2561 if (value & 0x2) { 2562 tlb->prot |= PAGE_WRITE << 4; 2563 } 2564 if (value & 0x4) { 2565 tlb->prot |= PAGE_EXEC << 4; 2566 } 2567 if (value & 0x8) { 2568 tlb->prot |= PAGE_READ; 2569 } 2570 if (value & 0x10) { 2571 tlb->prot |= PAGE_WRITE; 2572 } 2573 if (value & 0x20) { 2574 tlb->prot |= PAGE_EXEC; 2575 } 2576 break; 2577 } 2578 } 2579 2580 target_ulong helper_440_tlbre(CPUPPCState *env, uint32_t word, 2581 target_ulong entry) 2582 { 2583 ppcemb_tlb_t *tlb; 2584 target_ulong ret; 2585 int size; 2586 2587 entry &= 0x3F; 2588 tlb = &env->tlb.tlbe[entry]; 2589 switch (word) { 2590 default: 2591 /* Just here to please gcc */ 2592 case 0: 2593 ret = tlb->EPN; 2594 size = booke_page_size_to_tlb(tlb->size); 2595 if (size < 0 || size > 0xF) { 2596 size = 1; 2597 } 2598 ret |= size << 4; 2599 if (tlb->attr & 0x1) { 2600 ret |= 0x100; 2601 } 2602 if (tlb->prot & PAGE_VALID) { 2603 ret |= 0x200; 2604 } 2605 env->spr[SPR_440_MMUCR] &= ~0x000000FF; 2606 env->spr[SPR_440_MMUCR] |= tlb->PID; 2607 break; 2608 case 1: 2609 ret = tlb->RPN; 2610 break; 2611 case 2: 2612 ret = tlb->attr & ~0x1; 2613 if (tlb->prot & (PAGE_READ << 4)) { 2614 ret |= 0x1; 2615 } 2616 if (tlb->prot & (PAGE_WRITE << 4)) { 2617 ret |= 0x2; 2618 } 2619 if (tlb->prot & (PAGE_EXEC << 4)) { 2620 ret |= 0x4; 2621 } 2622 if (tlb->prot & PAGE_READ) { 2623 ret |= 0x8; 2624 } 2625 if (tlb->prot & PAGE_WRITE) { 2626 ret |= 0x10; 2627 } 2628 if (tlb->prot & PAGE_EXEC) { 2629 ret |= 0x20; 2630 } 2631 break; 2632 } 2633 return ret; 2634 } 2635 2636 target_ulong helper_440_tlbsx(CPUPPCState *env, target_ulong address) 2637 { 2638 return ppcemb_tlb_search(env, address, env->spr[SPR_440_MMUCR] & 0xFF); 2639 } 2640 2641 /* PowerPC BookE 2.06 TLB management */ 2642 2643 static ppcmas_tlb_t *booke206_cur_tlb(CPUPPCState *env) 2644 { 2645 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2646 uint32_t tlbncfg = 0; 2647 int esel = (env->spr[SPR_BOOKE_MAS0] & MAS0_ESEL_MASK) >> MAS0_ESEL_SHIFT; 2648 int ea = (env->spr[SPR_BOOKE_MAS2] & MAS2_EPN_MASK); 2649 int tlb; 2650 2651 tlb = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT; 2652 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlb]; 2653 2654 if ((tlbncfg & TLBnCFG_HES) && (env->spr[SPR_BOOKE_MAS0] & MAS0_HES)) { 2655 cpu_abort(CPU(cpu), "we don't support HES yet\n"); 2656 } 2657 2658 return booke206_get_tlbm(env, tlb, ea, esel); 2659 } 2660 2661 void helper_booke_setpid(CPUPPCState *env, uint32_t pidn, target_ulong pid) 2662 { 2663 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2664 2665 env->spr[pidn] = pid; 2666 /* changing PIDs mean we're in a different address space now */ 2667 tlb_flush(CPU(cpu)); 2668 } 2669 2670 void helper_booke_set_eplc(CPUPPCState *env, target_ulong val) 2671 { 2672 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2673 env->spr[SPR_BOOKE_EPLC] = val & EPID_MASK; 2674 tlb_flush_by_mmuidx(CPU(cpu), 1 << PPC_TLB_EPID_LOAD); 2675 } 2676 void helper_booke_set_epsc(CPUPPCState *env, target_ulong val) 2677 { 2678 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2679 env->spr[SPR_BOOKE_EPSC] = val & EPID_MASK; 2680 tlb_flush_by_mmuidx(CPU(cpu), 1 << PPC_TLB_EPID_STORE); 2681 } 2682 2683 static inline void flush_page(CPUPPCState *env, ppcmas_tlb_t *tlb) 2684 { 2685 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2686 2687 if (booke206_tlb_to_page_size(env, tlb) == TARGET_PAGE_SIZE) { 2688 tlb_flush_page(CPU(cpu), tlb->mas2 & MAS2_EPN_MASK); 2689 } else { 2690 tlb_flush(CPU(cpu)); 2691 } 2692 } 2693 2694 void helper_booke206_tlbwe(CPUPPCState *env) 2695 { 2696 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2697 uint32_t tlbncfg, tlbn; 2698 ppcmas_tlb_t *tlb; 2699 uint32_t size_tlb, size_ps; 2700 target_ulong mask; 2701 2702 2703 switch (env->spr[SPR_BOOKE_MAS0] & MAS0_WQ_MASK) { 2704 case MAS0_WQ_ALWAYS: 2705 /* good to go, write that entry */ 2706 break; 2707 case MAS0_WQ_COND: 2708 /* XXX check if reserved */ 2709 if (0) { 2710 return; 2711 } 2712 break; 2713 case MAS0_WQ_CLR_RSRV: 2714 /* XXX clear entry */ 2715 return; 2716 default: 2717 /* no idea what to do */ 2718 return; 2719 } 2720 2721 if (((env->spr[SPR_BOOKE_MAS0] & MAS0_ATSEL) == MAS0_ATSEL_LRAT) && 2722 !msr_gs) { 2723 /* XXX we don't support direct LRAT setting yet */ 2724 fprintf(stderr, "cpu: don't support LRAT setting yet\n"); 2725 return; 2726 } 2727 2728 tlbn = (env->spr[SPR_BOOKE_MAS0] & MAS0_TLBSEL_MASK) >> MAS0_TLBSEL_SHIFT; 2729 tlbncfg = env->spr[SPR_BOOKE_TLB0CFG + tlbn]; 2730 2731 tlb = booke206_cur_tlb(env); 2732 2733 if (!tlb) { 2734 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 2735 POWERPC_EXCP_INVAL | 2736 POWERPC_EXCP_INVAL_INVAL, GETPC()); 2737 } 2738 2739 /* check that we support the targeted size */ 2740 size_tlb = (env->spr[SPR_BOOKE_MAS1] & MAS1_TSIZE_MASK) >> MAS1_TSIZE_SHIFT; 2741 size_ps = booke206_tlbnps(env, tlbn); 2742 if ((env->spr[SPR_BOOKE_MAS1] & MAS1_VALID) && (tlbncfg & TLBnCFG_AVAIL) && 2743 !(size_ps & (1 << size_tlb))) { 2744 raise_exception_err_ra(env, POWERPC_EXCP_PROGRAM, 2745 POWERPC_EXCP_INVAL | 2746 POWERPC_EXCP_INVAL_INVAL, GETPC()); 2747 } 2748 2749 if (msr_gs) { 2750 cpu_abort(CPU(cpu), "missing HV implementation\n"); 2751 } 2752 2753 if (tlb->mas1 & MAS1_VALID) { 2754 /* Invalidate the page in QEMU TLB if it was a valid entry. 2755 * 2756 * In "PowerPC e500 Core Family Reference Manual, Rev. 1", 2757 * Section "12.4.2 TLB Write Entry (tlbwe) Instruction": 2758 * (https://www.nxp.com/docs/en/reference-manual/E500CORERM.pdf) 2759 * 2760 * "Note that when an L2 TLB entry is written, it may be displacing an 2761 * already valid entry in the same L2 TLB location (a victim). If a 2762 * valid L1 TLB entry corresponds to the L2 MMU victim entry, that L1 2763 * TLB entry is automatically invalidated." */ 2764 flush_page(env, tlb); 2765 } 2766 2767 tlb->mas7_3 = ((uint64_t)env->spr[SPR_BOOKE_MAS7] << 32) | 2768 env->spr[SPR_BOOKE_MAS3]; 2769 tlb->mas1 = env->spr[SPR_BOOKE_MAS1]; 2770 2771 if ((env->spr[SPR_MMUCFG] & MMUCFG_MAVN) == MMUCFG_MAVN_V2) { 2772 /* For TLB which has a fixed size TSIZE is ignored with MAV2 */ 2773 booke206_fixed_size_tlbn(env, tlbn, tlb); 2774 } else { 2775 if (!(tlbncfg & TLBnCFG_AVAIL)) { 2776 /* force !AVAIL TLB entries to correct page size */ 2777 tlb->mas1 &= ~MAS1_TSIZE_MASK; 2778 /* XXX can be configured in MMUCSR0 */ 2779 tlb->mas1 |= (tlbncfg & TLBnCFG_MINSIZE) >> 12; 2780 } 2781 } 2782 2783 /* Make a mask from TLB size to discard invalid bits in EPN field */ 2784 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1); 2785 /* Add a mask for page attributes */ 2786 mask |= MAS2_ACM | MAS2_VLE | MAS2_W | MAS2_I | MAS2_M | MAS2_G | MAS2_E; 2787 2788 if (!msr_cm) { 2789 /* Executing a tlbwe instruction in 32-bit mode will set 2790 * bits 0:31 of the TLB EPN field to zero. 2791 */ 2792 mask &= 0xffffffff; 2793 } 2794 2795 tlb->mas2 = env->spr[SPR_BOOKE_MAS2] & mask; 2796 2797 if (!(tlbncfg & TLBnCFG_IPROT)) { 2798 /* no IPROT supported by TLB */ 2799 tlb->mas1 &= ~MAS1_IPROT; 2800 } 2801 2802 flush_page(env, tlb); 2803 } 2804 2805 static inline void booke206_tlb_to_mas(CPUPPCState *env, ppcmas_tlb_t *tlb) 2806 { 2807 int tlbn = booke206_tlbm_to_tlbn(env, tlb); 2808 int way = booke206_tlbm_to_way(env, tlb); 2809 2810 env->spr[SPR_BOOKE_MAS0] = tlbn << MAS0_TLBSEL_SHIFT; 2811 env->spr[SPR_BOOKE_MAS0] |= way << MAS0_ESEL_SHIFT; 2812 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT; 2813 2814 env->spr[SPR_BOOKE_MAS1] = tlb->mas1; 2815 env->spr[SPR_BOOKE_MAS2] = tlb->mas2; 2816 env->spr[SPR_BOOKE_MAS3] = tlb->mas7_3; 2817 env->spr[SPR_BOOKE_MAS7] = tlb->mas7_3 >> 32; 2818 } 2819 2820 void helper_booke206_tlbre(CPUPPCState *env) 2821 { 2822 ppcmas_tlb_t *tlb = NULL; 2823 2824 tlb = booke206_cur_tlb(env); 2825 if (!tlb) { 2826 env->spr[SPR_BOOKE_MAS1] = 0; 2827 } else { 2828 booke206_tlb_to_mas(env, tlb); 2829 } 2830 } 2831 2832 void helper_booke206_tlbsx(CPUPPCState *env, target_ulong address) 2833 { 2834 ppcmas_tlb_t *tlb = NULL; 2835 int i, j; 2836 hwaddr raddr; 2837 uint32_t spid, sas; 2838 2839 spid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID_MASK) >> MAS6_SPID_SHIFT; 2840 sas = env->spr[SPR_BOOKE_MAS6] & MAS6_SAS; 2841 2842 for (i = 0; i < BOOKE206_MAX_TLBN; i++) { 2843 int ways = booke206_tlb_ways(env, i); 2844 2845 for (j = 0; j < ways; j++) { 2846 tlb = booke206_get_tlbm(env, i, address, j); 2847 2848 if (!tlb) { 2849 continue; 2850 } 2851 2852 if (ppcmas_tlb_check(env, tlb, &raddr, address, spid)) { 2853 continue; 2854 } 2855 2856 if (sas != ((tlb->mas1 & MAS1_TS) >> MAS1_TS_SHIFT)) { 2857 continue; 2858 } 2859 2860 booke206_tlb_to_mas(env, tlb); 2861 return; 2862 } 2863 } 2864 2865 /* no entry found, fill with defaults */ 2866 env->spr[SPR_BOOKE_MAS0] = env->spr[SPR_BOOKE_MAS4] & MAS4_TLBSELD_MASK; 2867 env->spr[SPR_BOOKE_MAS1] = env->spr[SPR_BOOKE_MAS4] & MAS4_TSIZED_MASK; 2868 env->spr[SPR_BOOKE_MAS2] = env->spr[SPR_BOOKE_MAS4] & MAS4_WIMGED_MASK; 2869 env->spr[SPR_BOOKE_MAS3] = 0; 2870 env->spr[SPR_BOOKE_MAS7] = 0; 2871 2872 if (env->spr[SPR_BOOKE_MAS6] & MAS6_SAS) { 2873 env->spr[SPR_BOOKE_MAS1] |= MAS1_TS; 2874 } 2875 2876 env->spr[SPR_BOOKE_MAS1] |= (env->spr[SPR_BOOKE_MAS6] >> 16) 2877 << MAS1_TID_SHIFT; 2878 2879 /* next victim logic */ 2880 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_ESEL_SHIFT; 2881 env->last_way++; 2882 env->last_way &= booke206_tlb_ways(env, 0) - 1; 2883 env->spr[SPR_BOOKE_MAS0] |= env->last_way << MAS0_NV_SHIFT; 2884 } 2885 2886 static inline void booke206_invalidate_ea_tlb(CPUPPCState *env, int tlbn, 2887 uint32_t ea) 2888 { 2889 int i; 2890 int ways = booke206_tlb_ways(env, tlbn); 2891 target_ulong mask; 2892 2893 for (i = 0; i < ways; i++) { 2894 ppcmas_tlb_t *tlb = booke206_get_tlbm(env, tlbn, ea, i); 2895 if (!tlb) { 2896 continue; 2897 } 2898 mask = ~(booke206_tlb_to_page_size(env, tlb) - 1); 2899 if (((tlb->mas2 & MAS2_EPN_MASK) == (ea & mask)) && 2900 !(tlb->mas1 & MAS1_IPROT)) { 2901 tlb->mas1 &= ~MAS1_VALID; 2902 } 2903 } 2904 } 2905 2906 void helper_booke206_tlbivax(CPUPPCState *env, target_ulong address) 2907 { 2908 CPUState *cs; 2909 2910 if (address & 0x4) { 2911 /* flush all entries */ 2912 if (address & 0x8) { 2913 /* flush all of TLB1 */ 2914 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB1, 1); 2915 } else { 2916 /* flush all of TLB0 */ 2917 booke206_flush_tlb(env, BOOKE206_FLUSH_TLB0, 0); 2918 } 2919 return; 2920 } 2921 2922 if (address & 0x8) { 2923 /* flush TLB1 entries */ 2924 booke206_invalidate_ea_tlb(env, 1, address); 2925 CPU_FOREACH(cs) { 2926 tlb_flush(cs); 2927 } 2928 } else { 2929 /* flush TLB0 entries */ 2930 booke206_invalidate_ea_tlb(env, 0, address); 2931 CPU_FOREACH(cs) { 2932 tlb_flush_page(cs, address & MAS2_EPN_MASK); 2933 } 2934 } 2935 } 2936 2937 void helper_booke206_tlbilx0(CPUPPCState *env, target_ulong address) 2938 { 2939 /* XXX missing LPID handling */ 2940 booke206_flush_tlb(env, -1, 1); 2941 } 2942 2943 void helper_booke206_tlbilx1(CPUPPCState *env, target_ulong address) 2944 { 2945 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2946 int i, j; 2947 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID); 2948 ppcmas_tlb_t *tlb = env->tlb.tlbm; 2949 int tlb_size; 2950 2951 /* XXX missing LPID handling */ 2952 for (i = 0; i < BOOKE206_MAX_TLBN; i++) { 2953 tlb_size = booke206_tlb_size(env, i); 2954 for (j = 0; j < tlb_size; j++) { 2955 if (!(tlb[j].mas1 & MAS1_IPROT) && 2956 ((tlb[j].mas1 & MAS1_TID_MASK) == tid)) { 2957 tlb[j].mas1 &= ~MAS1_VALID; 2958 } 2959 } 2960 tlb += booke206_tlb_size(env, i); 2961 } 2962 tlb_flush(CPU(cpu)); 2963 } 2964 2965 void helper_booke206_tlbilx3(CPUPPCState *env, target_ulong address) 2966 { 2967 PowerPCCPU *cpu = ppc_env_get_cpu(env); 2968 int i, j; 2969 ppcmas_tlb_t *tlb; 2970 int tid = (env->spr[SPR_BOOKE_MAS6] & MAS6_SPID); 2971 int pid = tid >> MAS6_SPID_SHIFT; 2972 int sgs = env->spr[SPR_BOOKE_MAS5] & MAS5_SGS; 2973 int ind = (env->spr[SPR_BOOKE_MAS6] & MAS6_SIND) ? MAS1_IND : 0; 2974 /* XXX check for unsupported isize and raise an invalid opcode then */ 2975 int size = env->spr[SPR_BOOKE_MAS6] & MAS6_ISIZE_MASK; 2976 /* XXX implement MAV2 handling */ 2977 bool mav2 = false; 2978 2979 /* XXX missing LPID handling */ 2980 /* flush by pid and ea */ 2981 for (i = 0; i < BOOKE206_MAX_TLBN; i++) { 2982 int ways = booke206_tlb_ways(env, i); 2983 2984 for (j = 0; j < ways; j++) { 2985 tlb = booke206_get_tlbm(env, i, address, j); 2986 if (!tlb) { 2987 continue; 2988 } 2989 if ((ppcmas_tlb_check(env, tlb, NULL, address, pid) != 0) || 2990 (tlb->mas1 & MAS1_IPROT) || 2991 ((tlb->mas1 & MAS1_IND) != ind) || 2992 ((tlb->mas8 & MAS8_TGS) != sgs)) { 2993 continue; 2994 } 2995 if (mav2 && ((tlb->mas1 & MAS1_TSIZE_MASK) != size)) { 2996 /* XXX only check when MMUCFG[TWC] || TLBnCFG[HES] */ 2997 continue; 2998 } 2999 /* XXX e500mc doesn't match SAS, but other cores might */ 3000 tlb->mas1 &= ~MAS1_VALID; 3001 } 3002 } 3003 tlb_flush(CPU(cpu)); 3004 } 3005 3006 void helper_booke206_tlbflush(CPUPPCState *env, target_ulong type) 3007 { 3008 int flags = 0; 3009 3010 if (type & 2) { 3011 flags |= BOOKE206_FLUSH_TLB1; 3012 } 3013 3014 if (type & 4) { 3015 flags |= BOOKE206_FLUSH_TLB0; 3016 } 3017 3018 booke206_flush_tlb(env, flags, 1); 3019 } 3020 3021 3022 void helper_check_tlb_flush_local(CPUPPCState *env) 3023 { 3024 check_tlb_flush(env, false); 3025 } 3026 3027 void helper_check_tlb_flush_global(CPUPPCState *env) 3028 { 3029 check_tlb_flush(env, true); 3030 } 3031 3032 /*****************************************************************************/ 3033 3034 /* try to fill the TLB and return an exception if error. If retaddr is 3035 NULL, it means that the function was called in C code (i.e. not 3036 from generated code or from helper.c) */ 3037 /* XXX: fix it to restore all registers */ 3038 void tlb_fill(CPUState *cs, target_ulong addr, int size, 3039 MMUAccessType access_type, int mmu_idx, uintptr_t retaddr) 3040 { 3041 PowerPCCPU *cpu = POWERPC_CPU(cs); 3042 PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cs); 3043 CPUPPCState *env = &cpu->env; 3044 int ret; 3045 3046 if (pcc->handle_mmu_fault) { 3047 ret = pcc->handle_mmu_fault(cpu, addr, access_type, mmu_idx); 3048 } else { 3049 ret = cpu_ppc_handle_mmu_fault(env, addr, access_type, mmu_idx); 3050 } 3051 if (unlikely(ret != 0)) { 3052 raise_exception_err_ra(env, cs->exception_index, env->error_code, 3053 retaddr); 3054 } 3055 } 3056