+ uint32_t pte0, pte1, keep = 0, access = 0;
+ int i, good = -1, store = 0;
+ int ret = -1; /* No entry found */
+
+ for (i = 0; i < 8; i++) {
+ pte0 = ldl_phys(base + (i * 8));
+ pte1 = ldl_phys(base + (i * 8) + 4);
+#if defined (DEBUG_MMU)
+ if (loglevel > 0) {
+ fprintf(logfile, "Load pte from 0x%08x => 0x%08x 0x%08x "
+ "%d %d %d 0x%08x\n", base + (i * 8), pte0, pte1,
+ pte0 >> 31, h, (pte0 >> 6) & 1, va);
+ }
+#endif
+ /* Check validity and table match */
+ if (pte0 & 0x80000000 && (h == ((pte0 >> 6) & 1))) {
+ /* Check vsid & api */
+ if ((pte0 & 0x7FFFFFBF) == va) {
+ if (good == -1) {
+ good = i;
+ keep = pte1;
+ } else {
+ /* All matches should have equal RPN, WIMG & PP */
+ if ((keep & 0xFFFFF07B) != (pte1 & 0xFFFFF07B)) {
+ if (loglevel > 0)
+ fprintf(logfile, "Bad RPN/WIMG/PP\n");
+ return -1;
+ }
+ }
+ /* Check access rights */
+ if (key == 0) {
+ access = PAGE_READ;
+ if ((pte1 & 0x00000003) != 0x3)
+ access |= PAGE_WRITE;
+ } else {
+ switch (pte1 & 0x00000003) {
+ case 0x0:
+ access = 0;
+ break;
+ case 0x1:
+ case 0x3:
+ access = PAGE_READ;
+ break;
+ case 0x2:
+ access = PAGE_READ | PAGE_WRITE;
+ break;
+ }
+ }
+ if (ret < 0) {
+ if ((rw == 0 && (access & PAGE_READ)) ||
+ (rw == 1 && (access & PAGE_WRITE))) {
+#if defined (DEBUG_MMU)
+ if (loglevel > 0)
+ fprintf(logfile, "PTE access granted !\n");
+#endif
+ good = i;
+ keep = pte1;
+ ret = 0;
+ } else {
+ /* Access right violation */
+ ret = -2;
+#if defined (DEBUG_MMU)
+ if (loglevel > 0)
+ fprintf(logfile, "PTE access rejected\n");
+#endif
+ }
+ *prot = access;
+ }
+ }
+ }
+ }
+ if (good != -1) {
+ *RPN = keep & 0xFFFFF000;
+#if defined (DEBUG_MMU)
+ if (loglevel > 0) {
+ fprintf(logfile, "found PTE at addr 0x%08x prot=0x%01x ret=%d\n",
+ *RPN, *prot, ret);
+ }
+#endif
+ /* Update page flags */
+ if (!(keep & 0x00000100)) {
+ /* Access flag */
+ keep |= 0x00000100;
+ store = 1;
+ }
+ if (!(keep & 0x00000080)) {
+ if (rw && ret == 0) {
+ /* Change flag */
+ keep |= 0x00000080;
+ store = 1;
+ } else {
+ /* Force page fault for first write access */
+ *prot &= ~PAGE_WRITE;
+ }
+ }
+ if (store) {
+ stl_phys_notdirty(base + (good * 8) + 4, keep);
+ }
+ }
+
+ return ret;
+}
+
+static inline uint32_t get_pgaddr (uint32_t sdr1, uint32_t hash, uint32_t mask)
+{
+ return (sdr1 & 0xFFFF0000) | (hash & mask);
+}
+
+/* Perform segment based translation */
+static int get_segment (CPUState *env, uint32_t *real, int *prot,
+ uint32_t virtual, int rw, int type)
+{
+ uint32_t pg_addr, sdr, ptem, vsid, pgidx;
+ uint32_t hash, mask;
+ uint32_t sr;
+ int key;
+ int ret = -1, ret2;
+
+ sr = env->sr[virtual >> 28];
+#if defined (DEBUG_MMU)
+ if (loglevel > 0) {
+ fprintf(logfile, "Check segment v=0x%08x %d 0x%08x nip=0x%08x "
+ "lr=0x%08x ir=%d dr=%d pr=%d %d t=%d\n",
+ virtual, virtual >> 28, sr, env->nip,
+ env->lr, msr_ir, msr_dr, msr_pr, rw, type);
+ }
+#endif
+ key = (((sr & 0x20000000) && msr_pr == 1) ||
+ ((sr & 0x40000000) && msr_pr == 0)) ? 1 : 0;
+ if ((sr & 0x80000000) == 0) {
+#if defined (DEBUG_MMU)
+ if (loglevel > 0)
+ fprintf(logfile, "pte segment: key=%d n=0x%08x\n",
+ key, sr & 0x10000000);
+#endif
+ /* Check if instruction fetch is allowed, if needed */
+ if (type != ACCESS_CODE || (sr & 0x10000000) == 0) {
+ /* Page address translation */
+ vsid = sr & 0x00FFFFFF;
+ pgidx = (virtual >> 12) & 0xFFFF;
+ sdr = env->sdr1;
+ hash = ((vsid ^ pgidx) & 0x0007FFFF) << 6;
+ mask = ((sdr & 0x000001FF) << 16) | 0xFFC0;
+ pg_addr = get_pgaddr(sdr, hash, mask);
+ ptem = (vsid << 7) | (pgidx >> 10);
+#if defined (DEBUG_MMU)
+ if (loglevel > 0) {
+ fprintf(logfile, "0 sdr1=0x%08x vsid=0x%06x api=0x%04x "
+ "hash=0x%07x pg_addr=0x%08x\n", sdr, vsid, pgidx, hash,
+ pg_addr);
+ }
+#endif
+ /* Primary table lookup */
+ ret = find_pte(real, prot, pg_addr, ptem, 0, key, rw);
+ if (ret < 0) {
+ /* Secondary table lookup */
+ hash = (~hash) & 0x01FFFFC0;
+ pg_addr = get_pgaddr(sdr, hash, mask);
+#if defined (DEBUG_MMU)
+ if (virtual != 0xEFFFFFFF && loglevel > 0) {
+ fprintf(logfile, "1 sdr1=0x%08x vsid=0x%06x api=0x%04x "
+ "hash=0x%05x pg_addr=0x%08x\n", sdr, vsid, pgidx,
+ hash, pg_addr);
+ }
+#endif
+ ret2 = find_pte(real, prot, pg_addr, ptem, 1, key, rw);
+ if (ret2 != -1)
+ ret = ret2;
+ }
+ } else {
+#if defined (DEBUG_MMU)
+ if (loglevel > 0)
+ fprintf(logfile, "No access allowed\n");
+#endif
+ ret = -3;
+ }
+ } else {
+#if defined (DEBUG_MMU)
+ if (loglevel > 0)
+ fprintf(logfile, "direct store...\n");
+#endif
+ /* Direct-store segment : absolutely *BUGGY* for now */
+ switch (type) {
+ case ACCESS_INT:
+ /* Integer load/store : only access allowed */
+ break;
+ case ACCESS_CODE:
+ /* No code fetch is allowed in direct-store areas */
+ return -4;
+ case ACCESS_FLOAT:
+ /* Floating point load/store */
+ return -4;
+ case ACCESS_RES:
+ /* lwarx, ldarx or srwcx. */
+ return -4;
+ case ACCESS_CACHE:
+ /* dcba, dcbt, dcbtst, dcbf, dcbi, dcbst, dcbz, or icbi */
+ /* Should make the instruction do no-op.
+ * As it already do no-op, it's quite easy :-)
+ */
+ *real = virtual;
+ return 0;
+ case ACCESS_EXT:
+ /* eciwx or ecowx */
+ return -4;
+ default:
+ if (logfile) {
+ fprintf(logfile, "ERROR: instruction should not need "
+ "address translation\n");
+ }
+ printf("ERROR: instruction should not need "
+ "address translation\n");
+ return -4;
+ }
+ if ((rw == 1 || key != 1) && (rw == 0 || key != 0)) {
+ *real = virtual;
+ ret = 2;
+ } else {
+ ret = -2;
+ }
+ }
+
+ return ret;
+}
+
+static int get_physical_address (CPUState *env, uint32_t *physical, int *prot,
+ uint32_t address, int rw, int access_type)
+{
+ int ret;
+#if 0
+ if (loglevel > 0) {
+ fprintf(logfile, "%s\n", __func__);
+ }
+#endif
+ if ((access_type == ACCESS_CODE && msr_ir == 0) ||
+ (access_type != ACCESS_CODE && msr_dr == 0)) {
+ /* No address translation */
+ *physical = address & ~0xFFF;
+ *prot = PAGE_READ | PAGE_WRITE;
+ ret = 0;
+ } else {
+ /* Try to find a BAT */
+ ret = get_bat(env, physical, prot, address, rw, access_type);
+ if (ret < 0) {
+ /* We didn't match any BAT entry */
+ ret = get_segment(env, physical, prot, address, rw, access_type);
+ }
+ }
+#if 0
+ if (loglevel > 0) {
+ fprintf(logfile, "%s address %08x => %08x\n",
+ __func__, address, *physical);
+ }
+#endif
+ return ret;
+}
+
+target_ulong cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
+{
+ uint32_t phys_addr;
+ int prot;
+
+ if (get_physical_address(env, &phys_addr, &prot, addr, 0, ACCESS_INT) != 0)
+ return -1;
+ return phys_addr;
+}
+
+/* Perform address translation */
+int cpu_ppc_handle_mmu_fault (CPUState *env, uint32_t address, int rw,
+ int is_user, int is_softmmu)
+{
+ uint32_t physical;
+ int prot;
+ int exception = 0, error_code = 0;
+ int access_type;
+ int ret = 0;
+
+ if (rw == 2) {
+ /* code access */
+ rw = 0;
+ access_type = ACCESS_CODE;
+ } else {
+ /* data access */
+ /* XXX: put correct access by using cpu_restore_state()
+ correctly */
+ access_type = ACCESS_INT;
+ // access_type = env->access_type;
+ }
+ if (env->user_mode_only) {
+ /* user mode only emulation */
+ ret = -2;
+ goto do_fault;
+ }
+ ret = get_physical_address(env, &physical, &prot,
+ address, rw, access_type);
+ if (ret == 0) {
+ ret = tlb_set_page(env, address & ~0xFFF, physical, prot,
+ is_user, is_softmmu);
+ } else if (ret < 0) {
+ do_fault:
+#if defined (DEBUG_MMU)
+ if (loglevel > 0)
+ cpu_dump_state(env, logfile, fprintf, 0);
+#endif
+ if (access_type == ACCESS_CODE) {
+ exception = EXCP_ISI;
+ switch (ret) {
+ case -1:
+ /* No matches in page tables */
+ error_code = 0x40000000;
+ break;
+ case -2:
+ /* Access rights violation */
+ error_code = 0x08000000;
+ break;
+ case -3:
+ /* No execute protection violation */
+ error_code = 0x10000000;
+ break;
+ case -4:
+ /* Direct store exception */
+ /* No code fetch is allowed in direct-store areas */
+ error_code = 0x10000000;
+ break;
+ case -5:
+ /* No match in segment table */
+ exception = EXCP_ISEG;
+ error_code = 0;
+ break;
+ }
+ } else {
+ exception = EXCP_DSI;
+ switch (ret) {
+ case -1:
+ /* No matches in page tables */
+ error_code = 0x40000000;
+ break;
+ case -2:
+ /* Access rights violation */
+ error_code = 0x08000000;
+ break;
+ case -4:
+ /* Direct store exception */
+ switch (access_type) {
+ case ACCESS_FLOAT:
+ /* Floating point load/store */
+ exception = EXCP_ALIGN;
+ error_code = EXCP_ALIGN_FP;
+ break;
+ case ACCESS_RES:
+ /* lwarx, ldarx or srwcx. */
+ error_code = 0x04000000;
+ break;
+ case ACCESS_EXT:
+ /* eciwx or ecowx */
+ error_code = 0x04100000;
+ break;
+ default:
+ printf("DSI: invalid exception (%d)\n", ret);
+ exception = EXCP_PROGRAM;
+ error_code = EXCP_INVAL | EXCP_INVAL_INVAL;
+ break;
+ }
+ break;
+ case -5:
+ /* No match in segment table */
+ exception = EXCP_DSEG;
+ error_code = 0;
+ break;
+ }
+ if (exception == EXCP_DSI && rw == 1)
+ error_code |= 0x02000000;
+ /* Store fault address */
+ env->spr[SPR_DAR] = address;
+ env->spr[SPR_DSISR] = error_code;
+ }
+#if 0
+ printf("%s: set exception to %d %02x\n",
+ __func__, exception, error_code);
+#endif
+ env->exception_index = exception;
+ env->error_code = error_code;
+ ret = 1;
+ }
+ return ret;
+}
+#endif
+
+/*****************************************************************************/
+/* BATs management */
+#if !defined(FLUSH_ALL_TLBS)
+static inline void do_invalidate_BAT (CPUPPCState *env,
+ target_ulong BATu, target_ulong mask)
+{
+ target_ulong base, end, page;
+ base = BATu & ~0x0001FFFF;
+ end = base + mask + 0x00020000;
+#if defined (DEBUG_BATS)
+ if (loglevel != 0)
+ fprintf(logfile, "Flush BAT from %08x to %08x (%08x)\n", base, end, mask);
+#endif
+ for (page = base; page != end; page += TARGET_PAGE_SIZE)
+ tlb_flush_page(env, page);
+#if defined (DEBUG_BATS)
+ if (loglevel != 0)
+ fprintf(logfile, "Flush done\n");
+#endif
+}
+#endif
+
+static inline void dump_store_bat (CPUPPCState *env, char ID, int ul, int nr,
+ target_ulong value)
+{
+#if defined (DEBUG_BATS)
+ if (loglevel != 0) {
+ fprintf(logfile, "Set %cBAT%d%c to 0x%08lx (0x%08lx)\n",
+ ID, nr, ul == 0 ? 'u' : 'l', (unsigned long)value,
+ (unsigned long)env->nip);
+ }
+#endif
+}
+
+target_ulong do_load_ibatu (CPUPPCState *env, int nr)
+{
+ return env->IBAT[0][nr];
+}
+
+target_ulong do_load_ibatl (CPUPPCState *env, int nr)
+{
+ return env->IBAT[1][nr];
+}