| 1 | /* |
| 2 | * Sparc MMU helpers |
| 3 | * |
| 4 | * Copyright (c) 2003-2005 Fabrice Bellard |
| 5 | * |
| 6 | * This library is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU Lesser General Public |
| 8 | * License as published by the Free Software Foundation; either |
| 9 | * version 2.1 of the License, or (at your option) any later version. |
| 10 | * |
| 11 | * This library is distributed in the hope that it will be useful, |
| 12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 14 | * Lesser General Public License for more details. |
| 15 | * |
| 16 | * You should have received a copy of the GNU Lesser General Public |
| 17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. |
| 18 | */ |
| 19 | |
| 20 | #include "qemu/osdep.h" |
| 21 | #include "qemu/log.h" |
| 22 | #include "cpu.h" |
| 23 | #include "exec/cputlb.h" |
| 24 | #include "accel/tcg/cpu-loop.h" |
| 25 | #include "accel/tcg/cpu-mmu-index.h" |
| 26 | #include "exec/page-protection.h" |
| 27 | #include "exec/target_page.h" |
| 28 | #include "exec/tlb-flags.h" |
| 29 | #include "system/memory.h" |
| 30 | #include "qemu/qemu-print.h" |
| 31 | #include "trace.h" |
| 32 | |
| 33 | /* Sparc MMU emulation */ |
| 34 | |
| 35 | #ifndef TARGET_SPARC64 |
| 36 | /* |
| 37 | * Sparc V8 Reference MMU (SRMMU) |
| 38 | */ |
| 39 | static const int access_table[8][8] = { |
| 40 | { 0, 0, 0, 0, 8, 0, 12, 12 }, |
| 41 | { 0, 0, 0, 0, 8, 0, 0, 0 }, |
| 42 | { 8, 8, 0, 0, 0, 8, 12, 12 }, |
| 43 | { 8, 8, 0, 0, 0, 8, 0, 0 }, |
| 44 | { 8, 0, 8, 0, 8, 8, 12, 12 }, |
| 45 | { 8, 0, 8, 0, 8, 0, 8, 0 }, |
| 46 | { 8, 8, 8, 0, 8, 8, 12, 12 }, |
| 47 | { 8, 8, 8, 0, 8, 8, 8, 0 } |
| 48 | }; |
| 49 | |
| 50 | static const int perm_table[2][8] = { |
| 51 | { |
| 52 | PAGE_READ, |
| 53 | PAGE_READ | PAGE_WRITE, |
| 54 | PAGE_READ | PAGE_EXEC, |
| 55 | PAGE_READ | PAGE_WRITE | PAGE_EXEC, |
| 56 | PAGE_EXEC, |
| 57 | PAGE_READ | PAGE_WRITE, |
| 58 | PAGE_READ | PAGE_EXEC, |
| 59 | PAGE_READ | PAGE_WRITE | PAGE_EXEC |
| 60 | }, |
| 61 | { |
| 62 | PAGE_READ, |
| 63 | PAGE_READ | PAGE_WRITE, |
| 64 | PAGE_READ | PAGE_EXEC, |
| 65 | PAGE_READ | PAGE_WRITE | PAGE_EXEC, |
| 66 | PAGE_EXEC, |
| 67 | PAGE_READ, |
| 68 | 0, |
| 69 | 0, |
| 70 | } |
| 71 | }; |
| 72 | |
| 73 | static int get_physical_address(CPUSPARCState *env, CPUTLBEntryFull *full, |
| 74 | int *access_index, target_ulong address, |
| 75 | int rw, int mmu_idx) |
| 76 | { |
| 77 | int access_perms = 0; |
| 78 | hwaddr pde_ptr; |
| 79 | uint32_t pde; |
| 80 | int error_code = 0, is_dirty, is_user; |
| 81 | unsigned long page_offset; |
| 82 | CPUState *cs = env_cpu(env); |
| 83 | MemTxResult result; |
| 84 | |
| 85 | is_user = mmu_idx == MMU_USER_IDX; |
| 86 | |
| 87 | if (mmu_idx == MMU_PHYS_IDX) { |
| 88 | full->lg_page_size = TARGET_PAGE_BITS; |
| 89 | /* Boot mode: instruction fetches are taken from PROM */ |
| 90 | if (rw == 2 && (env->mmuregs[0] & env->def.mmu_bm)) { |
| 91 | full->phys_addr = env->prom_addr | (address & 0x7ffffULL); |
| 92 | full->prot = PAGE_READ | PAGE_EXEC; |
| 93 | return 0; |
| 94 | } |
| 95 | full->phys_addr = address; |
| 96 | full->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; |
| 97 | return 0; |
| 98 | } |
| 99 | |
| 100 | *access_index = ((rw & 1) << 2) | (rw & 2) | (is_user ? 0 : 1); |
| 101 | full->phys_addr = 0xffffffffffff0000ULL; |
| 102 | |
| 103 | /* SPARC reference MMU table walk: Context table->L1->L2->PTE */ |
| 104 | /* Context base + context number */ |
| 105 | pde_ptr = (env->mmuregs[1] << 4) + (env->mmuregs[2] << 2); |
| 106 | pde = address_space_ldl_be(cs->as, pde_ptr, |
| 107 | MEMTXATTRS_UNSPECIFIED, &result); |
| 108 | if (result != MEMTX_OK) { |
| 109 | return 4 << 2; /* Translation fault, L = 0 */ |
| 110 | } |
| 111 | |
| 112 | /* Ctx pde */ |
| 113 | switch (pde & PTE_ENTRYTYPE_MASK) { |
| 114 | default: |
| 115 | case 0: /* Invalid */ |
| 116 | return 1 << 2; |
| 117 | case 2: /* L0 PTE, maybe should not happen? */ |
| 118 | case 3: /* Reserved */ |
| 119 | return 4 << 2; |
| 120 | case 1: /* L0 PDE */ |
| 121 | pde_ptr = ((address >> 22) & ~3) + ((pde & ~3) << 4); |
| 122 | pde = address_space_ldl_be(cs->as, pde_ptr, |
| 123 | MEMTXATTRS_UNSPECIFIED, &result); |
| 124 | if (result != MEMTX_OK) { |
| 125 | return (1 << 8) | (4 << 2); /* Translation fault, L = 1 */ |
| 126 | } |
| 127 | |
| 128 | switch (pde & PTE_ENTRYTYPE_MASK) { |
| 129 | default: |
| 130 | case 0: /* Invalid */ |
| 131 | return (1 << 8) | (1 << 2); |
| 132 | case 3: /* Reserved */ |
| 133 | return (1 << 8) | (4 << 2); |
| 134 | case 1: /* L1 PDE */ |
| 135 | pde_ptr = ((address & 0xfc0000) >> 16) + ((pde & ~3) << 4); |
| 136 | pde = address_space_ldl_be(cs->as, pde_ptr, |
| 137 | MEMTXATTRS_UNSPECIFIED, &result); |
| 138 | if (result != MEMTX_OK) { |
| 139 | return (2 << 8) | (4 << 2); /* Translation fault, L = 2 */ |
| 140 | } |
| 141 | |
| 142 | switch (pde & PTE_ENTRYTYPE_MASK) { |
| 143 | default: |
| 144 | case 0: /* Invalid */ |
| 145 | return (2 << 8) | (1 << 2); |
| 146 | case 3: /* Reserved */ |
| 147 | return (2 << 8) | (4 << 2); |
| 148 | case 1: /* L2 PDE */ |
| 149 | pde_ptr = ((address & 0x3f000) >> 10) + ((pde & ~3) << 4); |
| 150 | pde = address_space_ldl_be(cs->as, pde_ptr, |
| 151 | MEMTXATTRS_UNSPECIFIED, &result); |
| 152 | if (result != MEMTX_OK) { |
| 153 | return (3 << 8) | (4 << 2); /* Translation fault, L = 3 */ |
| 154 | } |
| 155 | |
| 156 | switch (pde & PTE_ENTRYTYPE_MASK) { |
| 157 | default: |
| 158 | case 0: /* Invalid */ |
| 159 | return (3 << 8) | (1 << 2); |
| 160 | case 1: /* PDE, should not happen */ |
| 161 | case 3: /* Reserved */ |
| 162 | return (3 << 8) | (4 << 2); |
| 163 | case 2: /* L3 PTE */ |
| 164 | page_offset = 0; |
| 165 | } |
| 166 | full->lg_page_size = TARGET_PAGE_BITS; |
| 167 | break; |
| 168 | case 2: /* L2 PTE */ |
| 169 | page_offset = address & 0x3f000; |
| 170 | full->lg_page_size = 18; |
| 171 | } |
| 172 | break; |
| 173 | case 2: /* L1 PTE */ |
| 174 | page_offset = address & 0xfff000; |
| 175 | full->lg_page_size = 24; |
| 176 | break; |
| 177 | } |
| 178 | } |
| 179 | |
| 180 | /* check access */ |
| 181 | access_perms = (pde & PTE_ACCESS_MASK) >> PTE_ACCESS_SHIFT; |
| 182 | error_code = access_table[*access_index][access_perms]; |
| 183 | if (error_code && !((env->mmuregs[0] & MMU_NF) && is_user)) { |
| 184 | return error_code; |
| 185 | } |
| 186 | |
| 187 | /* update page modified and dirty bits */ |
| 188 | is_dirty = (rw & 1) && !(pde & PG_MODIFIED_MASK); |
| 189 | if (!(pde & PG_ACCESSED_MASK) || is_dirty) { |
| 190 | pde |= PG_ACCESSED_MASK; |
| 191 | if (is_dirty) { |
| 192 | pde |= PG_MODIFIED_MASK; |
| 193 | } |
| 194 | address_space_stl_be(cs->as, pde_ptr, pde, |
| 195 | MEMTXATTRS_UNSPECIFIED, &result); |
| 196 | assert(result == MEMTX_OK); |
| 197 | } |
| 198 | |
| 199 | /* the page can be put in the TLB */ |
| 200 | full->prot = perm_table[is_user][access_perms]; |
| 201 | if (!(pde & PG_MODIFIED_MASK)) { |
| 202 | /* only set write access if already dirty... otherwise wait |
| 203 | for dirty access */ |
| 204 | full->prot &= ~PAGE_WRITE; |
| 205 | } |
| 206 | |
| 207 | /* Even if large ptes, we map only one 4KB page in the cache to |
| 208 | avoid filling it too fast */ |
| 209 | full->phys_addr = ((hwaddr)(pde & PTE_ADDR_MASK) << 4) + page_offset; |
| 210 | return error_code; |
| 211 | } |
| 212 | |
| 213 | /* Perform address translation */ |
| 214 | bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size, |
| 215 | MMUAccessType access_type, int mmu_idx, |
| 216 | bool probe, uintptr_t retaddr) |
| 217 | { |
| 218 | CPUSPARCState *env = cpu_env(cs); |
| 219 | CPUTLBEntryFull full = {}; |
| 220 | target_ulong vaddr; |
| 221 | int error_code = 0, access_index; |
| 222 | |
| 223 | /* |
| 224 | * TODO: If we ever need tlb_vaddr_to_host for this target, |
| 225 | * then we must figure out how to manipulate FSR and FAR |
| 226 | * when both MMU_NF and probe are set. In the meantime, |
| 227 | * do not support this use case. |
| 228 | */ |
| 229 | assert(!probe); |
| 230 | |
| 231 | address &= TARGET_PAGE_MASK; |
| 232 | error_code = get_physical_address(env, &full, &access_index, |
| 233 | address, access_type, mmu_idx); |
| 234 | vaddr = address; |
| 235 | if (likely(error_code == 0)) { |
| 236 | qemu_log_mask(CPU_LOG_MMU, |
| 237 | "Translate at %" VADDR_PRIx " -> " |
| 238 | HWADDR_FMT_plx ", vaddr " TARGET_FMT_lx "\n", |
| 239 | address, full.phys_addr, vaddr); |
| 240 | tlb_set_page_full(cs, mmu_idx, vaddr, &full); |
| 241 | return true; |
| 242 | } |
| 243 | |
| 244 | if (env->mmuregs[3]) { /* Fault status register */ |
| 245 | env->mmuregs[3] = 1; /* overflow (not read before another fault) */ |
| 246 | } |
| 247 | env->mmuregs[3] |= (access_index << 5) | error_code | 2; |
| 248 | env->mmuregs[4] = address; /* Fault address register */ |
| 249 | |
| 250 | if ((env->mmuregs[0] & MMU_NF) || env->psret == 0) { |
| 251 | /* No fault mode: if a mapping is available, just override |
| 252 | permissions. If no mapping is available, redirect accesses to |
| 253 | neverland. Fake/overridden mappings will be flushed when |
| 254 | switching to normal mode. */ |
| 255 | full.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; |
| 256 | tlb_set_page_full(cs, mmu_idx, vaddr, &full); |
| 257 | return true; |
| 258 | } else { |
| 259 | if (access_type == MMU_INST_FETCH) { |
| 260 | cs->exception_index = TT_TFAULT; |
| 261 | } else { |
| 262 | cs->exception_index = TT_DFAULT; |
| 263 | } |
| 264 | cpu_loop_exit_restore(cs, retaddr); |
| 265 | } |
| 266 | } |
| 267 | |
| 268 | target_ulong mmu_probe(CPUSPARCState *env, target_ulong address, int mmulev) |
| 269 | { |
| 270 | CPUState *cs = env_cpu(env); |
| 271 | hwaddr pde_ptr; |
| 272 | uint32_t pde; |
| 273 | MemTxResult result; |
| 274 | |
| 275 | /* |
| 276 | * TODO: MMU probe operations are supposed to set the fault |
| 277 | * status registers, but we don't do this. |
| 278 | */ |
| 279 | |
| 280 | /* Context base + context number */ |
| 281 | pde_ptr = (hwaddr)(env->mmuregs[1] << 4) + |
| 282 | (env->mmuregs[2] << 2); |
| 283 | pde = address_space_ldl_be(cs->as, pde_ptr, |
| 284 | MEMTXATTRS_UNSPECIFIED, &result); |
| 285 | if (result != MEMTX_OK) { |
| 286 | return 0; |
| 287 | } |
| 288 | |
| 289 | switch (pde & PTE_ENTRYTYPE_MASK) { |
| 290 | default: |
| 291 | case 0: /* Invalid */ |
| 292 | case 2: /* PTE, maybe should not happen? */ |
| 293 | case 3: /* Reserved */ |
| 294 | return 0; |
| 295 | case 1: /* L1 PDE */ |
| 296 | if (mmulev == 3) { |
| 297 | return pde; |
| 298 | } |
| 299 | pde_ptr = ((address >> 22) & ~3) + ((pde & ~3) << 4); |
| 300 | pde = address_space_ldl_be(cs->as, pde_ptr, |
| 301 | MEMTXATTRS_UNSPECIFIED, &result); |
| 302 | if (result != MEMTX_OK) { |
| 303 | return 0; |
| 304 | } |
| 305 | |
| 306 | switch (pde & PTE_ENTRYTYPE_MASK) { |
| 307 | default: |
| 308 | case 0: /* Invalid */ |
| 309 | case 3: /* Reserved */ |
| 310 | return 0; |
| 311 | case 2: /* L1 PTE */ |
| 312 | return pde; |
| 313 | case 1: /* L2 PDE */ |
| 314 | if (mmulev == 2) { |
| 315 | return pde; |
| 316 | } |
| 317 | pde_ptr = ((address & 0xfc0000) >> 16) + ((pde & ~3) << 4); |
| 318 | pde = address_space_ldl_be(cs->as, pde_ptr, |
| 319 | MEMTXATTRS_UNSPECIFIED, &result); |
| 320 | if (result != MEMTX_OK) { |
| 321 | return 0; |
| 322 | } |
| 323 | |
| 324 | switch (pde & PTE_ENTRYTYPE_MASK) { |
| 325 | default: |
| 326 | case 0: /* Invalid */ |
| 327 | case 3: /* Reserved */ |
| 328 | return 0; |
| 329 | case 2: /* L2 PTE */ |
| 330 | return pde; |
| 331 | case 1: /* L3 PDE */ |
| 332 | if (mmulev == 1) { |
| 333 | return pde; |
| 334 | } |
| 335 | pde_ptr = ((address & 0x3f000) >> 10) + ((pde & ~3) << 4); |
| 336 | pde = address_space_ldl_be(cs->as, pde_ptr, |
| 337 | MEMTXATTRS_UNSPECIFIED, &result); |
| 338 | if (result != MEMTX_OK) { |
| 339 | return 0; |
| 340 | } |
| 341 | |
| 342 | switch (pde & PTE_ENTRYTYPE_MASK) { |
| 343 | default: |
| 344 | case 0: /* Invalid */ |
| 345 | case 1: /* PDE, should not happen */ |
| 346 | case 3: /* Reserved */ |
| 347 | return 0; |
| 348 | case 2: /* L3 PTE */ |
| 349 | return pde; |
| 350 | } |
| 351 | } |
| 352 | } |
| 353 | } |
| 354 | return 0; |
| 355 | } |
| 356 | |
| 357 | void dump_mmu(CPUSPARCState *env) |
| 358 | { |
| 359 | CPUState *cs = env_cpu(env); |
| 360 | target_ulong va, va1, va2; |
| 361 | unsigned int n, m, o; |
| 362 | hwaddr pa; |
| 363 | uint32_t pde; |
| 364 | TranslateForDebugResult tres; |
| 365 | |
| 366 | qemu_printf("Root ptr: " HWADDR_FMT_plx ", ctx: %d\n", |
| 367 | (hwaddr)env->mmuregs[1] << 4, env->mmuregs[2]); |
| 368 | for (n = 0, va = 0; n < 256; n++, va += 16 * 1024 * 1024) { |
| 369 | pde = mmu_probe(env, va, 2); |
| 370 | if (pde) { |
| 371 | if (!cpu_translate_for_debug(cs, va, &tres)) { |
| 372 | pa = -1; |
| 373 | } else { |
| 374 | pa = tres.physaddr; |
| 375 | } |
| 376 | qemu_printf("VA: " TARGET_FMT_lx ", PA: " HWADDR_FMT_plx |
| 377 | " PDE: " TARGET_FMT_lx "\n", va, pa, pde); |
| 378 | for (m = 0, va1 = va; m < 64; m++, va1 += 256 * 1024) { |
| 379 | pde = mmu_probe(env, va1, 1); |
| 380 | if (pde) { |
| 381 | if (!cpu_translate_for_debug(cs, va1, &tres)) { |
| 382 | pa = -1; |
| 383 | } else { |
| 384 | pa = tres.physaddr; |
| 385 | } |
| 386 | qemu_printf(" VA: " TARGET_FMT_lx ", PA: " |
| 387 | HWADDR_FMT_plx " PDE: " TARGET_FMT_lx "\n", |
| 388 | va1, pa, pde); |
| 389 | for (o = 0, va2 = va1; o < 64; o++, va2 += 4 * 1024) { |
| 390 | pde = mmu_probe(env, va2, 0); |
| 391 | if (pde) { |
| 392 | if (!cpu_translate_for_debug(cs, va2, &tres)) { |
| 393 | pa = -1; |
| 394 | } else { |
| 395 | pa = tres.physaddr; |
| 396 | } |
| 397 | qemu_printf(" VA: " TARGET_FMT_lx ", PA: " |
| 398 | HWADDR_FMT_plx " PTE: " |
| 399 | TARGET_FMT_lx "\n", |
| 400 | va2, pa, pde); |
| 401 | } |
| 402 | } |
| 403 | } |
| 404 | } |
| 405 | } |
| 406 | } |
| 407 | } |
| 408 | |
| 409 | /* Gdb expects all registers windows to be flushed in ram. This function handles |
| 410 | * reads (and only reads) in stack frames as if windows were flushed. We assume |
| 411 | * that the sparc ABI is followed. |
| 412 | */ |
| 413 | int sparc_cpu_memory_rw_debug(CPUState *cs, vaddr address, |
| 414 | uint8_t *buf, size_t len, bool is_write) |
| 415 | { |
| 416 | CPUSPARCState *env = cpu_env(cs); |
| 417 | target_ulong addr = address; |
| 418 | int i; |
| 419 | int len1; |
| 420 | int cwp = env->cwp; |
| 421 | |
| 422 | if (!is_write) { |
| 423 | for (i = 0; i < env->nwindows; i++) { |
| 424 | int off; |
| 425 | target_ulong fp = env->regbase[cwp * 16 + 22]; |
| 426 | |
| 427 | /* Assume fp == 0 means end of frame. */ |
| 428 | if (fp == 0) { |
| 429 | break; |
| 430 | } |
| 431 | |
| 432 | cwp = cpu_cwp_inc(env, cwp + 1); |
| 433 | |
| 434 | /* Invalid window ? */ |
| 435 | if (env->wim & (1 << cwp)) { |
| 436 | break; |
| 437 | } |
| 438 | |
| 439 | /* According to the ABI, the stack is growing downward. */ |
| 440 | if (addr + len < fp) { |
| 441 | break; |
| 442 | } |
| 443 | |
| 444 | /* Not in this frame. */ |
| 445 | if (addr > fp + 64) { |
| 446 | continue; |
| 447 | } |
| 448 | |
| 449 | /* Handle access before this window. */ |
| 450 | if (addr < fp) { |
| 451 | len1 = fp - addr; |
| 452 | if (cpu_memory_rw_debug(cs, addr, buf, len1, is_write) != 0) { |
| 453 | return -1; |
| 454 | } |
| 455 | addr += len1; |
| 456 | len -= len1; |
| 457 | buf += len1; |
| 458 | } |
| 459 | |
| 460 | /* Access byte per byte to registers. Not very efficient but speed |
| 461 | * is not critical. |
| 462 | */ |
| 463 | off = addr - fp; |
| 464 | len1 = 64 - off; |
| 465 | |
| 466 | if (len1 > len) { |
| 467 | len1 = len; |
| 468 | } |
| 469 | |
| 470 | for (; len1; len1--) { |
| 471 | int reg = cwp * 16 + 8 + (off >> 2); |
| 472 | union { |
| 473 | uint32_t v; |
| 474 | uint8_t c[4]; |
| 475 | } u; |
| 476 | u.v = cpu_to_be32(env->regbase[reg]); |
| 477 | *buf++ = u.c[off & 3]; |
| 478 | addr++; |
| 479 | len--; |
| 480 | off++; |
| 481 | } |
| 482 | |
| 483 | if (len == 0) { |
| 484 | return 0; |
| 485 | } |
| 486 | } |
| 487 | } |
| 488 | return cpu_memory_rw_debug(cs, addr, buf, len, is_write); |
| 489 | } |
| 490 | |
| 491 | #else /* !TARGET_SPARC64 */ |
| 492 | |
| 493 | /* 41 bit physical address space */ |
| 494 | static inline hwaddr ultrasparc_truncate_physical(uint64_t x) |
| 495 | { |
| 496 | return x & 0x1ffffffffffULL; |
| 497 | } |
| 498 | |
| 499 | /* |
| 500 | * UltraSparc IIi I/DMMUs |
| 501 | */ |
| 502 | |
| 503 | /* Returns true if TTE tag is valid and matches virtual address value |
| 504 | in context requires virtual address mask value calculated from TTE |
| 505 | entry size */ |
| 506 | static inline int ultrasparc_tag_match(SparcTLBEntry *tlb, |
| 507 | uint64_t address, uint64_t context, |
| 508 | hwaddr *physical) |
| 509 | { |
| 510 | uint64_t mask = -(8192ULL << 3 * TTE_PGSIZE(tlb->tte)); |
| 511 | |
| 512 | /* valid, context match, virtual address match? */ |
| 513 | if (TTE_IS_VALID(tlb->tte) && |
| 514 | (TTE_IS_GLOBAL(tlb->tte) || tlb_compare_context(tlb, context)) |
| 515 | && compare_masked(address, tlb->tag, mask)) { |
| 516 | /* decode physical address */ |
| 517 | *physical = ((tlb->tte & mask) | (address & ~mask)) & 0x1ffffffe000ULL; |
| 518 | return 1; |
| 519 | } |
| 520 | |
| 521 | return 0; |
| 522 | } |
| 523 | |
| 524 | static uint64_t build_sfsr(CPUSPARCState *env, int mmu_idx, int rw) |
| 525 | { |
| 526 | uint64_t sfsr = SFSR_VALID_BIT; |
| 527 | |
| 528 | switch (mmu_idx) { |
| 529 | case MMU_PHYS_IDX: |
| 530 | sfsr |= SFSR_CT_NOTRANS; |
| 531 | break; |
| 532 | case MMU_USER_IDX: |
| 533 | case MMU_KERNEL_IDX: |
| 534 | sfsr |= SFSR_CT_PRIMARY; |
| 535 | break; |
| 536 | case MMU_USER_SECONDARY_IDX: |
| 537 | case MMU_KERNEL_SECONDARY_IDX: |
| 538 | sfsr |= SFSR_CT_SECONDARY; |
| 539 | break; |
| 540 | case MMU_NUCLEUS_IDX: |
| 541 | sfsr |= SFSR_CT_NUCLEUS; |
| 542 | break; |
| 543 | default: |
| 544 | g_assert_not_reached(); |
| 545 | } |
| 546 | |
| 547 | if (rw == 1) { |
| 548 | sfsr |= SFSR_WRITE_BIT; |
| 549 | } else if (rw == 4) { |
| 550 | sfsr |= SFSR_NF_BIT; |
| 551 | } |
| 552 | |
| 553 | if (env->pstate & PS_PRIV) { |
| 554 | sfsr |= SFSR_PR_BIT; |
| 555 | } |
| 556 | |
| 557 | if (env->dmmu.sfsr & SFSR_VALID_BIT) { /* Fault status register */ |
| 558 | sfsr |= SFSR_OW_BIT; /* overflow (not read before another fault) */ |
| 559 | } |
| 560 | |
| 561 | /* FIXME: ASI field in SFSR must be set */ |
| 562 | |
| 563 | return sfsr; |
| 564 | } |
| 565 | |
| 566 | static int get_physical_address_data(CPUSPARCState *env, CPUTLBEntryFull *full, |
| 567 | target_ulong address, int rw, int mmu_idx) |
| 568 | { |
| 569 | CPUState *cs = env_cpu(env); |
| 570 | unsigned int i; |
| 571 | uint64_t sfsr; |
| 572 | uint64_t context; |
| 573 | bool is_user = false; |
| 574 | |
| 575 | sfsr = build_sfsr(env, mmu_idx, rw); |
| 576 | |
| 577 | switch (mmu_idx) { |
| 578 | case MMU_PHYS_IDX: |
| 579 | g_assert_not_reached(); |
| 580 | case MMU_USER_IDX: |
| 581 | is_user = true; |
| 582 | /* fallthru */ |
| 583 | case MMU_KERNEL_IDX: |
| 584 | context = env->dmmu.mmu_primary_context & 0x1fff; |
| 585 | break; |
| 586 | case MMU_USER_SECONDARY_IDX: |
| 587 | is_user = true; |
| 588 | /* fallthru */ |
| 589 | case MMU_KERNEL_SECONDARY_IDX: |
| 590 | context = env->dmmu.mmu_secondary_context & 0x1fff; |
| 591 | break; |
| 592 | default: |
| 593 | context = 0; |
| 594 | break; |
| 595 | } |
| 596 | |
| 597 | for (i = 0; i < 64; i++) { |
| 598 | /* ctx match, vaddr match, valid? */ |
| 599 | if (ultrasparc_tag_match(&env->dtlb[i], address, context, |
| 600 | &full->phys_addr)) { |
| 601 | int do_fault = 0; |
| 602 | |
| 603 | if (TTE_IS_IE(env->dtlb[i].tte)) { |
| 604 | full->tlb_fill_flags |= TLB_BSWAP; |
| 605 | } |
| 606 | |
| 607 | /* access ok? */ |
| 608 | /* multiple bits in SFSR.FT may be set on TT_DFAULT */ |
| 609 | if (TTE_IS_PRIV(env->dtlb[i].tte) && is_user) { |
| 610 | do_fault = 1; |
| 611 | sfsr |= SFSR_FT_PRIV_BIT; /* privilege violation */ |
| 612 | trace_mmu_helper_dfault(address, context, mmu_idx, env->tl); |
| 613 | } |
| 614 | if (rw == 4) { |
| 615 | if (TTE_IS_SIDEEFFECT(env->dtlb[i].tte)) { |
| 616 | do_fault = 1; |
| 617 | sfsr |= SFSR_FT_NF_E_BIT; |
| 618 | } |
| 619 | } else { |
| 620 | if (TTE_IS_NFO(env->dtlb[i].tte)) { |
| 621 | do_fault = 1; |
| 622 | sfsr |= SFSR_FT_NFO_BIT; |
| 623 | } |
| 624 | } |
| 625 | |
| 626 | if (do_fault) { |
| 627 | /* faults above are reported with TT_DFAULT. */ |
| 628 | cs->exception_index = TT_DFAULT; |
| 629 | } else if (!TTE_IS_W_OK(env->dtlb[i].tte) && (rw == 1)) { |
| 630 | do_fault = 1; |
| 631 | cs->exception_index = TT_DPROT; |
| 632 | |
| 633 | trace_mmu_helper_dprot(address, context, mmu_idx, env->tl); |
| 634 | } |
| 635 | |
| 636 | if (!do_fault) { |
| 637 | full->prot = PAGE_READ; |
| 638 | if (TTE_IS_W_OK(env->dtlb[i].tte)) { |
| 639 | full->prot |= PAGE_WRITE; |
| 640 | } |
| 641 | |
| 642 | TTE_SET_USED(env->dtlb[i].tte); |
| 643 | |
| 644 | return 0; |
| 645 | } |
| 646 | |
| 647 | env->dmmu.sfsr = sfsr; |
| 648 | env->dmmu.sfar = address; /* Fault address register */ |
| 649 | env->dmmu.tag_access = (address & ~0x1fffULL) | context; |
| 650 | return 1; |
| 651 | } |
| 652 | } |
| 653 | |
| 654 | trace_mmu_helper_dmiss(address, context); |
| 655 | |
| 656 | /* |
| 657 | * On MMU misses: |
| 658 | * - UltraSPARC IIi: SFSR and SFAR unmodified |
| 659 | * - JPS1: SFAR updated and some fields of SFSR updated |
| 660 | */ |
| 661 | env->dmmu.tag_access = (address & ~0x1fffULL) | context; |
| 662 | cs->exception_index = TT_DMISS; |
| 663 | return 1; |
| 664 | } |
| 665 | |
| 666 | static int get_physical_address_code(CPUSPARCState *env, CPUTLBEntryFull *full, |
| 667 | target_ulong address, int mmu_idx) |
| 668 | { |
| 669 | CPUState *cs = env_cpu(env); |
| 670 | unsigned int i; |
| 671 | uint64_t context; |
| 672 | bool is_user = false; |
| 673 | |
| 674 | switch (mmu_idx) { |
| 675 | case MMU_PHYS_IDX: |
| 676 | case MMU_USER_SECONDARY_IDX: |
| 677 | case MMU_KERNEL_SECONDARY_IDX: |
| 678 | g_assert_not_reached(); |
| 679 | case MMU_USER_IDX: |
| 680 | is_user = true; |
| 681 | /* fallthru */ |
| 682 | case MMU_KERNEL_IDX: |
| 683 | context = env->dmmu.mmu_primary_context & 0x1fff; |
| 684 | break; |
| 685 | default: |
| 686 | context = 0; |
| 687 | break; |
| 688 | } |
| 689 | |
| 690 | if (env->tl == 0) { |
| 691 | /* PRIMARY context */ |
| 692 | context = env->dmmu.mmu_primary_context & 0x1fff; |
| 693 | } else { |
| 694 | /* NUCLEUS context */ |
| 695 | context = 0; |
| 696 | } |
| 697 | |
| 698 | for (i = 0; i < 64; i++) { |
| 699 | /* ctx match, vaddr match, valid? */ |
| 700 | if (ultrasparc_tag_match(&env->itlb[i], |
| 701 | address, context, &full->phys_addr)) { |
| 702 | /* access ok? */ |
| 703 | if (TTE_IS_PRIV(env->itlb[i].tte) && is_user) { |
| 704 | /* Fault status register */ |
| 705 | if (env->immu.sfsr & SFSR_VALID_BIT) { |
| 706 | env->immu.sfsr = SFSR_OW_BIT; /* overflow (not read before |
| 707 | another fault) */ |
| 708 | } else { |
| 709 | env->immu.sfsr = 0; |
| 710 | } |
| 711 | if (env->pstate & PS_PRIV) { |
| 712 | env->immu.sfsr |= SFSR_PR_BIT; |
| 713 | } |
| 714 | if (env->tl > 0) { |
| 715 | env->immu.sfsr |= SFSR_CT_NUCLEUS; |
| 716 | } |
| 717 | |
| 718 | /* FIXME: ASI field in SFSR must be set */ |
| 719 | env->immu.sfsr |= SFSR_FT_PRIV_BIT | SFSR_VALID_BIT; |
| 720 | cs->exception_index = TT_TFAULT; |
| 721 | |
| 722 | env->immu.tag_access = (address & ~0x1fffULL) | context; |
| 723 | |
| 724 | trace_mmu_helper_tfault(address, context); |
| 725 | |
| 726 | return 1; |
| 727 | } |
| 728 | full->prot = PAGE_EXEC; |
| 729 | TTE_SET_USED(env->itlb[i].tte); |
| 730 | return 0; |
| 731 | } |
| 732 | } |
| 733 | |
| 734 | trace_mmu_helper_tmiss(address, context); |
| 735 | |
| 736 | /* Context is stored in DMMU (dmmuregs[1]) also for IMMU */ |
| 737 | env->immu.tag_access = (address & ~0x1fffULL) | context; |
| 738 | cs->exception_index = TT_TMISS; |
| 739 | return 1; |
| 740 | } |
| 741 | |
| 742 | static int get_physical_address(CPUSPARCState *env, CPUTLBEntryFull *full, |
| 743 | int *access_index, target_ulong address, |
| 744 | int rw, int mmu_idx) |
| 745 | { |
| 746 | /* ??? We treat everything as a small page, then explicitly flush |
| 747 | everything when an entry is evicted. */ |
| 748 | full->lg_page_size = TARGET_PAGE_BITS; |
| 749 | |
| 750 | /* safety net to catch wrong softmmu index use from dynamic code */ |
| 751 | if (env->tl > 0 && mmu_idx != MMU_NUCLEUS_IDX) { |
| 752 | if (rw == 2) { |
| 753 | trace_mmu_helper_get_phys_addr_code(env->tl, mmu_idx, |
| 754 | env->dmmu.mmu_primary_context, |
| 755 | env->dmmu.mmu_secondary_context, |
| 756 | address); |
| 757 | } else { |
| 758 | trace_mmu_helper_get_phys_addr_data(env->tl, mmu_idx, |
| 759 | env->dmmu.mmu_primary_context, |
| 760 | env->dmmu.mmu_secondary_context, |
| 761 | address); |
| 762 | } |
| 763 | } |
| 764 | |
| 765 | if (mmu_idx == MMU_PHYS_IDX) { |
| 766 | full->phys_addr = ultrasparc_truncate_physical(address); |
| 767 | full->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; |
| 768 | return 0; |
| 769 | } |
| 770 | |
| 771 | if (rw == 2) { |
| 772 | return get_physical_address_code(env, full, address, mmu_idx); |
| 773 | } else { |
| 774 | return get_physical_address_data(env, full, address, rw, mmu_idx); |
| 775 | } |
| 776 | } |
| 777 | |
| 778 | /* Perform address translation */ |
| 779 | bool sparc_cpu_tlb_fill(CPUState *cs, vaddr address, int size, |
| 780 | MMUAccessType access_type, int mmu_idx, |
| 781 | bool probe, uintptr_t retaddr) |
| 782 | { |
| 783 | CPUSPARCState *env = cpu_env(cs); |
| 784 | CPUTLBEntryFull full = {}; |
| 785 | int error_code = 0, access_index; |
| 786 | |
| 787 | address &= TARGET_PAGE_MASK; |
| 788 | error_code = get_physical_address(env, &full, &access_index, |
| 789 | address, access_type, mmu_idx); |
| 790 | if (likely(error_code == 0)) { |
| 791 | trace_mmu_helper_mmu_fault(address, full.phys_addr, mmu_idx, env->tl, |
| 792 | env->dmmu.mmu_primary_context, |
| 793 | env->dmmu.mmu_secondary_context); |
| 794 | tlb_set_page_full(cs, mmu_idx, address, &full); |
| 795 | return true; |
| 796 | } |
| 797 | if (probe) { |
| 798 | return false; |
| 799 | } |
| 800 | cpu_loop_exit_restore(cs, retaddr); |
| 801 | } |
| 802 | |
| 803 | void dump_mmu(CPUSPARCState *env) |
| 804 | { |
| 805 | unsigned int i; |
| 806 | const char *mask; |
| 807 | |
| 808 | qemu_printf("MMU contexts: Primary: %" PRId64 ", Secondary: %" |
| 809 | PRId64 "\n", |
| 810 | env->dmmu.mmu_primary_context, |
| 811 | env->dmmu.mmu_secondary_context); |
| 812 | qemu_printf("DMMU Tag Access: %" PRIx64 ", TSB Tag Target: %" PRIx64 |
| 813 | "\n", env->dmmu.tag_access, env->dmmu.tsb_tag_target); |
| 814 | if ((env->lsu & DMMU_E) == 0) { |
| 815 | qemu_printf("DMMU disabled\n"); |
| 816 | } else { |
| 817 | qemu_printf("DMMU dump\n"); |
| 818 | for (i = 0; i < 64; i++) { |
| 819 | switch (TTE_PGSIZE(env->dtlb[i].tte)) { |
| 820 | default: |
| 821 | case 0x0: |
| 822 | mask = " 8k"; |
| 823 | break; |
| 824 | case 0x1: |
| 825 | mask = " 64k"; |
| 826 | break; |
| 827 | case 0x2: |
| 828 | mask = "512k"; |
| 829 | break; |
| 830 | case 0x3: |
| 831 | mask = " 4M"; |
| 832 | break; |
| 833 | } |
| 834 | if (TTE_IS_VALID(env->dtlb[i].tte)) { |
| 835 | qemu_printf("[%02u] VA: %" PRIx64 ", PA: %llx" |
| 836 | ", %s, %s, %s, %s, ie %s, ctx %" PRId64 " %s\n", |
| 837 | i, |
| 838 | env->dtlb[i].tag & (uint64_t)~0x1fffULL, |
| 839 | TTE_PA(env->dtlb[i].tte), |
| 840 | mask, |
| 841 | TTE_IS_PRIV(env->dtlb[i].tte) ? "priv" : "user", |
| 842 | TTE_IS_W_OK(env->dtlb[i].tte) ? "RW" : "RO", |
| 843 | TTE_IS_LOCKED(env->dtlb[i].tte) ? |
| 844 | "locked" : "unlocked", |
| 845 | TTE_IS_IE(env->dtlb[i].tte) ? |
| 846 | "yes" : "no", |
| 847 | env->dtlb[i].tag & (uint64_t)0x1fffULL, |
| 848 | TTE_IS_GLOBAL(env->dtlb[i].tte) ? |
| 849 | "global" : "local"); |
| 850 | } |
| 851 | } |
| 852 | } |
| 853 | if ((env->lsu & IMMU_E) == 0) { |
| 854 | qemu_printf("IMMU disabled\n"); |
| 855 | } else { |
| 856 | qemu_printf("IMMU dump\n"); |
| 857 | for (i = 0; i < 64; i++) { |
| 858 | switch (TTE_PGSIZE(env->itlb[i].tte)) { |
| 859 | default: |
| 860 | case 0x0: |
| 861 | mask = " 8k"; |
| 862 | break; |
| 863 | case 0x1: |
| 864 | mask = " 64k"; |
| 865 | break; |
| 866 | case 0x2: |
| 867 | mask = "512k"; |
| 868 | break; |
| 869 | case 0x3: |
| 870 | mask = " 4M"; |
| 871 | break; |
| 872 | } |
| 873 | if (TTE_IS_VALID(env->itlb[i].tte)) { |
| 874 | qemu_printf("[%02u] VA: %" PRIx64 ", PA: %llx" |
| 875 | ", %s, %s, %s, ctx %" PRId64 " %s\n", |
| 876 | i, |
| 877 | env->itlb[i].tag & (uint64_t)~0x1fffULL, |
| 878 | TTE_PA(env->itlb[i].tte), |
| 879 | mask, |
| 880 | TTE_IS_PRIV(env->itlb[i].tte) ? "priv" : "user", |
| 881 | TTE_IS_LOCKED(env->itlb[i].tte) ? |
| 882 | "locked" : "unlocked", |
| 883 | env->itlb[i].tag & (uint64_t)0x1fffULL, |
| 884 | TTE_IS_GLOBAL(env->itlb[i].tte) ? |
| 885 | "global" : "local"); |
| 886 | } |
| 887 | } |
| 888 | } |
| 889 | } |
| 890 | |
| 891 | #endif /* TARGET_SPARC64 */ |
| 892 | |
| 893 | static int cpu_sparc_get_phys_page(CPUSPARCState *env, hwaddr *phys, |
| 894 | target_ulong addr, int rw, int mmu_idx) |
| 895 | { |
| 896 | CPUTLBEntryFull full = {}; |
| 897 | int access_index, ret; |
| 898 | |
| 899 | ret = get_physical_address(env, &full, &access_index, addr, rw, mmu_idx); |
| 900 | if (ret == 0) { |
| 901 | *phys = full.phys_addr; |
| 902 | } |
| 903 | return ret; |
| 904 | } |
| 905 | |
| 906 | #if defined(TARGET_SPARC64) |
| 907 | hwaddr cpu_get_phys_page_nofault(CPUSPARCState *env, target_ulong addr, |
| 908 | int mmu_idx) |
| 909 | { |
| 910 | hwaddr phys_addr; |
| 911 | |
| 912 | if (cpu_sparc_get_phys_page(env, &phys_addr, addr, 4, mmu_idx) != 0) { |
| 913 | return -1; |
| 914 | } |
| 915 | return phys_addr; |
| 916 | } |
| 917 | #endif |
| 918 | |
| 919 | hwaddr sparc_cpu_get_phys_addr_debug(CPUState *cs, vaddr addr) |
| 920 | { |
| 921 | CPUSPARCState *env = cpu_env(cs); |
| 922 | hwaddr phys_addr; |
| 923 | int mmu_idx = cpu_mmu_index(cs, false); |
| 924 | |
| 925 | if (cpu_sparc_get_phys_page(env, &phys_addr, addr, 2, mmu_idx) != 0) { |
| 926 | if (cpu_sparc_get_phys_page(env, &phys_addr, addr, 0, mmu_idx) != 0) { |
| 927 | return -1; |
| 928 | } |
| 929 | } |
| 930 | return phys_addr | (addr & ~TARGET_PAGE_MASK); |
| 931 | } |
| 932 | |
| 933 | G_NORETURN void sparc_cpu_do_unaligned_access(CPUState *cs, vaddr addr, |
| 934 | MMUAccessType access_type, |
| 935 | int mmu_idx, |
| 936 | uintptr_t retaddr) |
| 937 | { |
| 938 | CPUSPARCState *env = cpu_env(cs); |
| 939 | |
| 940 | #ifdef TARGET_SPARC64 |
| 941 | env->dmmu.sfsr = build_sfsr(env, mmu_idx, access_type); |
| 942 | env->dmmu.sfar = addr; |
| 943 | #else |
| 944 | env->mmuregs[4] = addr; |
| 945 | #endif |
| 946 | |
| 947 | cpu_raise_exception_ra(env, TT_UNALIGNED, retaddr); |
| 948 | } |