cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

helper.c (24935B)


      1/*
      2 *  SH4 emulation
      3 *
      4 *  Copyright (c) 2005 Samuel Tardieu
      5 *
      6 * This library is free software; you can redistribute it and/or
      7 * modify it under the terms of the GNU Lesser General Public
      8 * License as published by the Free Software Foundation; either
      9 * version 2.1 of the License, or (at your option) any later version.
     10 *
     11 * This library is distributed in the hope that it will be useful,
     12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
     13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     14 * Lesser General Public License for more details.
     15 *
     16 * You should have received a copy of the GNU Lesser General Public
     17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
     18 */
     19
     20#include "qemu/osdep.h"
     21
     22#include "cpu.h"
     23#include "exec/exec-all.h"
     24#include "exec/log.h"
     25
     26#if !defined(CONFIG_USER_ONLY)
     27#include "hw/sh4/sh_intc.h"
     28#include "sysemu/runstate.h"
     29#endif
     30
     31#define MMU_OK                   0
     32#define MMU_ITLB_MISS            (-1)
     33#define MMU_ITLB_MULTIPLE        (-2)
     34#define MMU_ITLB_VIOLATION       (-3)
     35#define MMU_DTLB_MISS_READ       (-4)
     36#define MMU_DTLB_MISS_WRITE      (-5)
     37#define MMU_DTLB_INITIAL_WRITE   (-6)
     38#define MMU_DTLB_VIOLATION_READ  (-7)
     39#define MMU_DTLB_VIOLATION_WRITE (-8)
     40#define MMU_DTLB_MULTIPLE        (-9)
     41#define MMU_DTLB_MISS            (-10)
     42#define MMU_IADDR_ERROR          (-11)
     43#define MMU_DADDR_ERROR_READ     (-12)
     44#define MMU_DADDR_ERROR_WRITE    (-13)
     45
     46#if defined(CONFIG_USER_ONLY)
     47
     48int cpu_sh4_is_cached(CPUSH4State *env, target_ulong addr)
     49{
     50    /* For user mode, only U0 area is cacheable. */
     51    return !(addr & 0x80000000);
     52}
     53
     54#else /* !CONFIG_USER_ONLY */
     55
     56void superh_cpu_do_interrupt(CPUState *cs)
     57{
     58    SuperHCPU *cpu = SUPERH_CPU(cs);
     59    CPUSH4State *env = &cpu->env;
     60    int do_irq = cs->interrupt_request & CPU_INTERRUPT_HARD;
     61    int do_exp, irq_vector = cs->exception_index;
     62
     63    /* prioritize exceptions over interrupts */
     64
     65    do_exp = cs->exception_index != -1;
     66    do_irq = do_irq && (cs->exception_index == -1);
     67
     68    if (env->sr & (1u << SR_BL)) {
     69        if (do_exp && cs->exception_index != 0x1e0) {
     70            /* In theory a masked exception generates a reset exception,
     71               which in turn jumps to the reset vector. However this only
     72               works when using a bootloader. When using a kernel and an
     73               initrd, they need to be reloaded and the program counter
     74               should be loaded with the kernel entry point.
     75               qemu_system_reset_request takes care of that.  */
     76            qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
     77            return;
     78        }
     79        if (do_irq && !env->in_sleep) {
     80            return; /* masked */
     81        }
     82    }
     83    env->in_sleep = 0;
     84
     85    if (do_irq) {
     86        irq_vector = sh_intc_get_pending_vector(env->intc_handle,
     87						(env->sr >> 4) & 0xf);
     88        if (irq_vector == -1) {
     89            return; /* masked */
     90	}
     91    }
     92
     93    if (qemu_loglevel_mask(CPU_LOG_INT)) {
     94	const char *expname;
     95        switch (cs->exception_index) {
     96	case 0x0e0:
     97	    expname = "addr_error";
     98	    break;
     99	case 0x040:
    100	    expname = "tlb_miss";
    101	    break;
    102	case 0x0a0:
    103	    expname = "tlb_violation";
    104	    break;
    105	case 0x180:
    106	    expname = "illegal_instruction";
    107	    break;
    108	case 0x1a0:
    109	    expname = "slot_illegal_instruction";
    110	    break;
    111	case 0x800:
    112	    expname = "fpu_disable";
    113	    break;
    114	case 0x820:
    115	    expname = "slot_fpu";
    116	    break;
    117	case 0x100:
    118	    expname = "data_write";
    119	    break;
    120	case 0x060:
    121	    expname = "dtlb_miss_write";
    122	    break;
    123	case 0x0c0:
    124	    expname = "dtlb_violation_write";
    125	    break;
    126	case 0x120:
    127	    expname = "fpu_exception";
    128	    break;
    129	case 0x080:
    130	    expname = "initial_page_write";
    131	    break;
    132	case 0x160:
    133	    expname = "trapa";
    134	    break;
    135	default:
    136            expname = do_irq ? "interrupt" : "???";
    137            break;
    138	}
    139	qemu_log("exception 0x%03x [%s] raised\n",
    140		  irq_vector, expname);
    141        log_cpu_state(cs, 0);
    142    }
    143
    144    env->ssr = cpu_read_sr(env);
    145    env->spc = env->pc;
    146    env->sgr = env->gregs[15];
    147    env->sr |= (1u << SR_BL) | (1u << SR_MD) | (1u << SR_RB);
    148    env->lock_addr = -1;
    149
    150    if (env->flags & DELAY_SLOT_MASK) {
    151        /* Branch instruction should be executed again before delay slot. */
    152	env->spc -= 2;
    153	/* Clear flags for exception/interrupt routine. */
    154        env->flags &= ~DELAY_SLOT_MASK;
    155    }
    156
    157    if (do_exp) {
    158        env->expevt = cs->exception_index;
    159        switch (cs->exception_index) {
    160        case 0x000:
    161        case 0x020:
    162        case 0x140:
    163            env->sr &= ~(1u << SR_FD);
    164            env->sr |= 0xf << 4; /* IMASK */
    165            env->pc = 0xa0000000;
    166            break;
    167        case 0x040:
    168        case 0x060:
    169            env->pc = env->vbr + 0x400;
    170            break;
    171        case 0x160:
    172            env->spc += 2; /* special case for TRAPA */
    173            /* fall through */
    174        default:
    175            env->pc = env->vbr + 0x100;
    176            break;
    177        }
    178        return;
    179    }
    180
    181    if (do_irq) {
    182        env->intevt = irq_vector;
    183        env->pc = env->vbr + 0x600;
    184        return;
    185    }
    186}
    187
    188static void update_itlb_use(CPUSH4State * env, int itlbnb)
    189{
    190    uint8_t or_mask = 0, and_mask = (uint8_t) - 1;
    191
    192    switch (itlbnb) {
    193    case 0:
    194	and_mask = 0x1f;
    195	break;
    196    case 1:
    197	and_mask = 0xe7;
    198	or_mask = 0x80;
    199	break;
    200    case 2:
    201	and_mask = 0xfb;
    202	or_mask = 0x50;
    203	break;
    204    case 3:
    205	or_mask = 0x2c;
    206	break;
    207    }
    208
    209    env->mmucr &= (and_mask << 24) | 0x00ffffff;
    210    env->mmucr |= (or_mask << 24);
    211}
    212
    213static int itlb_replacement(CPUSH4State * env)
    214{
    215    if ((env->mmucr & 0xe0000000) == 0xe0000000) {
    216	return 0;
    217    }
    218    if ((env->mmucr & 0x98000000) == 0x18000000) {
    219	return 1;
    220    }
    221    if ((env->mmucr & 0x54000000) == 0x04000000) {
    222	return 2;
    223    }
    224    if ((env->mmucr & 0x2c000000) == 0x00000000) {
    225	return 3;
    226    }
    227    cpu_abort(env_cpu(env), "Unhandled itlb_replacement");
    228}
    229
    230/* Find the corresponding entry in the right TLB
    231   Return entry, MMU_DTLB_MISS or MMU_DTLB_MULTIPLE
    232*/
    233static int find_tlb_entry(CPUSH4State * env, target_ulong address,
    234			  tlb_t * entries, uint8_t nbtlb, int use_asid)
    235{
    236    int match = MMU_DTLB_MISS;
    237    uint32_t start, end;
    238    uint8_t asid;
    239    int i;
    240
    241    asid = env->pteh & 0xff;
    242
    243    for (i = 0; i < nbtlb; i++) {
    244	if (!entries[i].v)
    245	    continue;		/* Invalid entry */
    246	if (!entries[i].sh && use_asid && entries[i].asid != asid)
    247	    continue;		/* Bad ASID */
    248	start = (entries[i].vpn << 10) & ~(entries[i].size - 1);
    249	end = start + entries[i].size - 1;
    250	if (address >= start && address <= end) {	/* Match */
    251	    if (match != MMU_DTLB_MISS)
    252		return MMU_DTLB_MULTIPLE;	/* Multiple match */
    253	    match = i;
    254	}
    255    }
    256    return match;
    257}
    258
    259static void increment_urc(CPUSH4State * env)
    260{
    261    uint8_t urb, urc;
    262
    263    /* Increment URC */
    264    urb = ((env->mmucr) >> 18) & 0x3f;
    265    urc = ((env->mmucr) >> 10) & 0x3f;
    266    urc++;
    267    if ((urb > 0 && urc > urb) || urc > (UTLB_SIZE - 1))
    268	urc = 0;
    269    env->mmucr = (env->mmucr & 0xffff03ff) | (urc << 10);
    270}
    271
    272/* Copy and utlb entry into itlb
    273   Return entry
    274*/
    275static int copy_utlb_entry_itlb(CPUSH4State *env, int utlb)
    276{
    277    int itlb;
    278
    279    tlb_t * ientry;
    280    itlb = itlb_replacement(env);
    281    ientry = &env->itlb[itlb];
    282    if (ientry->v) {
    283        tlb_flush_page(env_cpu(env), ientry->vpn << 10);
    284    }
    285    *ientry = env->utlb[utlb];
    286    update_itlb_use(env, itlb);
    287    return itlb;
    288}
    289
    290/* Find itlb entry
    291   Return entry, MMU_ITLB_MISS, MMU_ITLB_MULTIPLE or MMU_DTLB_MULTIPLE
    292*/
    293static int find_itlb_entry(CPUSH4State * env, target_ulong address,
    294                           int use_asid)
    295{
    296    int e;
    297
    298    e = find_tlb_entry(env, address, env->itlb, ITLB_SIZE, use_asid);
    299    if (e == MMU_DTLB_MULTIPLE) {
    300	e = MMU_ITLB_MULTIPLE;
    301    } else if (e == MMU_DTLB_MISS) {
    302	e = MMU_ITLB_MISS;
    303    } else if (e >= 0) {
    304	update_itlb_use(env, e);
    305    }
    306    return e;
    307}
    308
    309/* Find utlb entry
    310   Return entry, MMU_DTLB_MISS, MMU_DTLB_MULTIPLE */
    311static int find_utlb_entry(CPUSH4State * env, target_ulong address, int use_asid)
    312{
    313    /* per utlb access */
    314    increment_urc(env);
    315
    316    /* Return entry */
    317    return find_tlb_entry(env, address, env->utlb, UTLB_SIZE, use_asid);
    318}
    319
    320/* Match address against MMU
    321   Return MMU_OK, MMU_DTLB_MISS_READ, MMU_DTLB_MISS_WRITE,
    322   MMU_DTLB_INITIAL_WRITE, MMU_DTLB_VIOLATION_READ,
    323   MMU_DTLB_VIOLATION_WRITE, MMU_ITLB_MISS,
    324   MMU_ITLB_MULTIPLE, MMU_ITLB_VIOLATION,
    325   MMU_IADDR_ERROR, MMU_DADDR_ERROR_READ, MMU_DADDR_ERROR_WRITE.
    326*/
    327static int get_mmu_address(CPUSH4State * env, target_ulong * physical,
    328                           int *prot, target_ulong address,
    329                           MMUAccessType access_type)
    330{
    331    int use_asid, n;
    332    tlb_t *matching = NULL;
    333
    334    use_asid = !(env->mmucr & MMUCR_SV) || !(env->sr & (1u << SR_MD));
    335
    336    if (access_type == MMU_INST_FETCH) {
    337        n = find_itlb_entry(env, address, use_asid);
    338        if (n >= 0) {
    339            matching = &env->itlb[n];
    340            if (!(env->sr & (1u << SR_MD)) && !(matching->pr & 2)) {
    341                n = MMU_ITLB_VIOLATION;
    342            } else {
    343                *prot = PAGE_EXEC;
    344            }
    345        } else {
    346            n = find_utlb_entry(env, address, use_asid);
    347            if (n >= 0) {
    348                n = copy_utlb_entry_itlb(env, n);
    349                matching = &env->itlb[n];
    350                if (!(env->sr & (1u << SR_MD)) && !(matching->pr & 2)) {
    351                    n = MMU_ITLB_VIOLATION;
    352                } else {
    353                    *prot = PAGE_READ | PAGE_EXEC;
    354                    if ((matching->pr & 1) && matching->d) {
    355                        *prot |= PAGE_WRITE;
    356                    }
    357                }
    358            } else if (n == MMU_DTLB_MULTIPLE) {
    359                n = MMU_ITLB_MULTIPLE;
    360            } else if (n == MMU_DTLB_MISS) {
    361                n = MMU_ITLB_MISS;
    362            }
    363        }
    364    } else {
    365        n = find_utlb_entry(env, address, use_asid);
    366        if (n >= 0) {
    367            matching = &env->utlb[n];
    368            if (!(env->sr & (1u << SR_MD)) && !(matching->pr & 2)) {
    369                n = (access_type == MMU_DATA_STORE)
    370                    ? MMU_DTLB_VIOLATION_WRITE : MMU_DTLB_VIOLATION_READ;
    371            } else if ((access_type == MMU_DATA_STORE) && !(matching->pr & 1)) {
    372                n = MMU_DTLB_VIOLATION_WRITE;
    373            } else if ((access_type == MMU_DATA_STORE) && !matching->d) {
    374                n = MMU_DTLB_INITIAL_WRITE;
    375            } else {
    376                *prot = PAGE_READ;
    377                if ((matching->pr & 1) && matching->d) {
    378                    *prot |= PAGE_WRITE;
    379                }
    380            }
    381        } else if (n == MMU_DTLB_MISS) {
    382            n = (access_type == MMU_DATA_STORE)
    383                ? MMU_DTLB_MISS_WRITE : MMU_DTLB_MISS_READ;
    384        }
    385    }
    386    if (n >= 0) {
    387        n = MMU_OK;
    388        *physical = ((matching->ppn << 10) & ~(matching->size - 1))
    389                    | (address & (matching->size - 1));
    390    }
    391    return n;
    392}
    393
    394static int get_physical_address(CPUSH4State * env, target_ulong * physical,
    395                                int *prot, target_ulong address,
    396                                MMUAccessType access_type)
    397{
    398    /* P1, P2 and P4 areas do not use translation */
    399    if ((address >= 0x80000000 && address < 0xc0000000) || address >= 0xe0000000) {
    400        if (!(env->sr & (1u << SR_MD))
    401                && (address < 0xe0000000 || address >= 0xe4000000)) {
    402            /* Unauthorized access in user mode (only store queues are available) */
    403            qemu_log_mask(LOG_GUEST_ERROR, "Unauthorized access\n");
    404            if (access_type == MMU_DATA_LOAD) {
    405                return MMU_DADDR_ERROR_READ;
    406            } else if (access_type == MMU_DATA_STORE) {
    407                return MMU_DADDR_ERROR_WRITE;
    408            } else {
    409                return MMU_IADDR_ERROR;
    410            }
    411        }
    412        if (address >= 0x80000000 && address < 0xc0000000) {
    413            /* Mask upper 3 bits for P1 and P2 areas */
    414            *physical = address & 0x1fffffff;
    415        } else {
    416            *physical = address;
    417        }
    418        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
    419        return MMU_OK;
    420    }
    421
    422    /* If MMU is disabled, return the corresponding physical page */
    423    if (!(env->mmucr & MMUCR_AT)) {
    424        *physical = address & 0x1FFFFFFF;
    425        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
    426        return MMU_OK;
    427    }
    428
    429    /* We need to resort to the MMU */
    430    return get_mmu_address(env, physical, prot, address, access_type);
    431}
    432
    433hwaddr superh_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
    434{
    435    SuperHCPU *cpu = SUPERH_CPU(cs);
    436    target_ulong physical;
    437    int prot;
    438
    439    if (get_physical_address(&cpu->env, &physical, &prot, addr, MMU_DATA_LOAD)
    440            == MMU_OK) {
    441        return physical;
    442    }
    443
    444    return -1;
    445}
    446
    447void cpu_load_tlb(CPUSH4State * env)
    448{
    449    CPUState *cs = env_cpu(env);
    450    int n = cpu_mmucr_urc(env->mmucr);
    451    tlb_t * entry = &env->utlb[n];
    452
    453    if (entry->v) {
    454        /* Overwriting valid entry in utlb. */
    455        target_ulong address = entry->vpn << 10;
    456        tlb_flush_page(cs, address);
    457    }
    458
    459    /* Take values into cpu status from registers. */
    460    entry->asid = (uint8_t)cpu_pteh_asid(env->pteh);
    461    entry->vpn  = cpu_pteh_vpn(env->pteh);
    462    entry->v    = (uint8_t)cpu_ptel_v(env->ptel);
    463    entry->ppn  = cpu_ptel_ppn(env->ptel);
    464    entry->sz   = (uint8_t)cpu_ptel_sz(env->ptel);
    465    switch (entry->sz) {
    466    case 0: /* 00 */
    467        entry->size = 1024; /* 1K */
    468        break;
    469    case 1: /* 01 */
    470        entry->size = 1024 * 4; /* 4K */
    471        break;
    472    case 2: /* 10 */
    473        entry->size = 1024 * 64; /* 64K */
    474        break;
    475    case 3: /* 11 */
    476        entry->size = 1024 * 1024; /* 1M */
    477        break;
    478    default:
    479        cpu_abort(cs, "Unhandled load_tlb");
    480        break;
    481    }
    482    entry->sh   = (uint8_t)cpu_ptel_sh(env->ptel);
    483    entry->c    = (uint8_t)cpu_ptel_c(env->ptel);
    484    entry->pr   = (uint8_t)cpu_ptel_pr(env->ptel);
    485    entry->d    = (uint8_t)cpu_ptel_d(env->ptel);
    486    entry->wt   = (uint8_t)cpu_ptel_wt(env->ptel);
    487    entry->sa   = (uint8_t)cpu_ptea_sa(env->ptea);
    488    entry->tc   = (uint8_t)cpu_ptea_tc(env->ptea);
    489}
    490
    491 void cpu_sh4_invalidate_tlb(CPUSH4State *s)
    492{
    493    int i;
    494
    495    /* UTLB */
    496    for (i = 0; i < UTLB_SIZE; i++) {
    497        tlb_t * entry = &s->utlb[i];
    498        entry->v = 0;
    499    }
    500    /* ITLB */
    501    for (i = 0; i < ITLB_SIZE; i++) {
    502        tlb_t * entry = &s->itlb[i];
    503        entry->v = 0;
    504    }
    505
    506    tlb_flush(env_cpu(s));
    507}
    508
    509uint32_t cpu_sh4_read_mmaped_itlb_addr(CPUSH4State *s,
    510                                       hwaddr addr)
    511{
    512    int index = (addr & 0x00000300) >> 8;
    513    tlb_t * entry = &s->itlb[index];
    514
    515    return (entry->vpn  << 10) |
    516           (entry->v    <<  8) |
    517           (entry->asid);
    518}
    519
    520void cpu_sh4_write_mmaped_itlb_addr(CPUSH4State *s, hwaddr addr,
    521				    uint32_t mem_value)
    522{
    523    uint32_t vpn = (mem_value & 0xfffffc00) >> 10;
    524    uint8_t v = (uint8_t)((mem_value & 0x00000100) >> 8);
    525    uint8_t asid = (uint8_t)(mem_value & 0x000000ff);
    526
    527    int index = (addr & 0x00000300) >> 8;
    528    tlb_t * entry = &s->itlb[index];
    529    if (entry->v) {
    530        /* Overwriting valid entry in itlb. */
    531        target_ulong address = entry->vpn << 10;
    532        tlb_flush_page(env_cpu(s), address);
    533    }
    534    entry->asid = asid;
    535    entry->vpn = vpn;
    536    entry->v = v;
    537}
    538
    539uint32_t cpu_sh4_read_mmaped_itlb_data(CPUSH4State *s,
    540                                       hwaddr addr)
    541{
    542    int array = (addr & 0x00800000) >> 23;
    543    int index = (addr & 0x00000300) >> 8;
    544    tlb_t * entry = &s->itlb[index];
    545
    546    if (array == 0) {
    547        /* ITLB Data Array 1 */
    548        return (entry->ppn << 10) |
    549               (entry->v   <<  8) |
    550               (entry->pr  <<  5) |
    551               ((entry->sz & 1) <<  6) |
    552               ((entry->sz & 2) <<  4) |
    553               (entry->c   <<  3) |
    554               (entry->sh  <<  1);
    555    } else {
    556        /* ITLB Data Array 2 */
    557        return (entry->tc << 1) |
    558               (entry->sa);
    559    }
    560}
    561
    562void cpu_sh4_write_mmaped_itlb_data(CPUSH4State *s, hwaddr addr,
    563                                    uint32_t mem_value)
    564{
    565    int array = (addr & 0x00800000) >> 23;
    566    int index = (addr & 0x00000300) >> 8;
    567    tlb_t * entry = &s->itlb[index];
    568
    569    if (array == 0) {
    570        /* ITLB Data Array 1 */
    571        if (entry->v) {
    572            /* Overwriting valid entry in utlb. */
    573            target_ulong address = entry->vpn << 10;
    574            tlb_flush_page(env_cpu(s), address);
    575        }
    576        entry->ppn = (mem_value & 0x1ffffc00) >> 10;
    577        entry->v   = (mem_value & 0x00000100) >> 8;
    578        entry->sz  = (mem_value & 0x00000080) >> 6 |
    579                     (mem_value & 0x00000010) >> 4;
    580        entry->pr  = (mem_value & 0x00000040) >> 5;
    581        entry->c   = (mem_value & 0x00000008) >> 3;
    582        entry->sh  = (mem_value & 0x00000002) >> 1;
    583    } else {
    584        /* ITLB Data Array 2 */
    585        entry->tc  = (mem_value & 0x00000008) >> 3;
    586        entry->sa  = (mem_value & 0x00000007);
    587    }
    588}
    589
    590uint32_t cpu_sh4_read_mmaped_utlb_addr(CPUSH4State *s,
    591                                       hwaddr addr)
    592{
    593    int index = (addr & 0x00003f00) >> 8;
    594    tlb_t * entry = &s->utlb[index];
    595
    596    increment_urc(s); /* per utlb access */
    597
    598    return (entry->vpn  << 10) |
    599           (entry->v    <<  8) |
    600           (entry->asid);
    601}
    602
    603void cpu_sh4_write_mmaped_utlb_addr(CPUSH4State *s, hwaddr addr,
    604				    uint32_t mem_value)
    605{
    606    int associate = addr & 0x0000080;
    607    uint32_t vpn = (mem_value & 0xfffffc00) >> 10;
    608    uint8_t d = (uint8_t)((mem_value & 0x00000200) >> 9);
    609    uint8_t v = (uint8_t)((mem_value & 0x00000100) >> 8);
    610    uint8_t asid = (uint8_t)(mem_value & 0x000000ff);
    611    int use_asid = !(s->mmucr & MMUCR_SV) || !(s->sr & (1u << SR_MD));
    612
    613    if (associate) {
    614        int i;
    615	tlb_t * utlb_match_entry = NULL;
    616	int needs_tlb_flush = 0;
    617
    618	/* search UTLB */
    619	for (i = 0; i < UTLB_SIZE; i++) {
    620            tlb_t * entry = &s->utlb[i];
    621            if (!entry->v)
    622	        continue;
    623
    624            if (entry->vpn == vpn
    625                && (!use_asid || entry->asid == asid || entry->sh)) {
    626	        if (utlb_match_entry) {
    627                    CPUState *cs = env_cpu(s);
    628
    629		    /* Multiple TLB Exception */
    630                    cs->exception_index = 0x140;
    631		    s->tea = addr;
    632		    break;
    633	        }
    634		if (entry->v && !v)
    635		    needs_tlb_flush = 1;
    636		entry->v = v;
    637		entry->d = d;
    638	        utlb_match_entry = entry;
    639	    }
    640	    increment_urc(s); /* per utlb access */
    641	}
    642
    643	/* search ITLB */
    644	for (i = 0; i < ITLB_SIZE; i++) {
    645            tlb_t * entry = &s->itlb[i];
    646            if (entry->vpn == vpn
    647                && (!use_asid || entry->asid == asid || entry->sh)) {
    648	        if (entry->v && !v)
    649		    needs_tlb_flush = 1;
    650	        if (utlb_match_entry)
    651		    *entry = *utlb_match_entry;
    652	        else
    653		    entry->v = v;
    654		break;
    655	    }
    656	}
    657
    658        if (needs_tlb_flush) {
    659            tlb_flush_page(env_cpu(s), vpn << 10);
    660        }
    661    } else {
    662        int index = (addr & 0x00003f00) >> 8;
    663        tlb_t * entry = &s->utlb[index];
    664	if (entry->v) {
    665            CPUState *cs = env_cpu(s);
    666
    667	    /* Overwriting valid entry in utlb. */
    668            target_ulong address = entry->vpn << 10;
    669            tlb_flush_page(cs, address);
    670	}
    671	entry->asid = asid;
    672	entry->vpn = vpn;
    673	entry->d = d;
    674	entry->v = v;
    675	increment_urc(s);
    676    }
    677}
    678
    679uint32_t cpu_sh4_read_mmaped_utlb_data(CPUSH4State *s,
    680                                       hwaddr addr)
    681{
    682    int array = (addr & 0x00800000) >> 23;
    683    int index = (addr & 0x00003f00) >> 8;
    684    tlb_t * entry = &s->utlb[index];
    685
    686    increment_urc(s); /* per utlb access */
    687
    688    if (array == 0) {
    689        /* ITLB Data Array 1 */
    690        return (entry->ppn << 10) |
    691               (entry->v   <<  8) |
    692               (entry->pr  <<  5) |
    693               ((entry->sz & 1) <<  6) |
    694               ((entry->sz & 2) <<  4) |
    695               (entry->c   <<  3) |
    696               (entry->d   <<  2) |
    697               (entry->sh  <<  1) |
    698               (entry->wt);
    699    } else {
    700        /* ITLB Data Array 2 */
    701        return (entry->tc << 1) |
    702               (entry->sa);
    703    }
    704}
    705
    706void cpu_sh4_write_mmaped_utlb_data(CPUSH4State *s, hwaddr addr,
    707                                    uint32_t mem_value)
    708{
    709    int array = (addr & 0x00800000) >> 23;
    710    int index = (addr & 0x00003f00) >> 8;
    711    tlb_t * entry = &s->utlb[index];
    712
    713    increment_urc(s); /* per utlb access */
    714
    715    if (array == 0) {
    716        /* UTLB Data Array 1 */
    717        if (entry->v) {
    718            /* Overwriting valid entry in utlb. */
    719            target_ulong address = entry->vpn << 10;
    720            tlb_flush_page(env_cpu(s), address);
    721        }
    722        entry->ppn = (mem_value & 0x1ffffc00) >> 10;
    723        entry->v   = (mem_value & 0x00000100) >> 8;
    724        entry->sz  = (mem_value & 0x00000080) >> 6 |
    725                     (mem_value & 0x00000010) >> 4;
    726        entry->pr  = (mem_value & 0x00000060) >> 5;
    727        entry->c   = (mem_value & 0x00000008) >> 3;
    728        entry->d   = (mem_value & 0x00000004) >> 2;
    729        entry->sh  = (mem_value & 0x00000002) >> 1;
    730        entry->wt  = (mem_value & 0x00000001);
    731    } else {
    732        /* UTLB Data Array 2 */
    733        entry->tc = (mem_value & 0x00000008) >> 3;
    734        entry->sa = (mem_value & 0x00000007);
    735    }
    736}
    737
    738int cpu_sh4_is_cached(CPUSH4State * env, target_ulong addr)
    739{
    740    int n;
    741    int use_asid = !(env->mmucr & MMUCR_SV) || !(env->sr & (1u << SR_MD));
    742
    743    /* check area */
    744    if (env->sr & (1u << SR_MD)) {
    745        /* For privileged mode, P2 and P4 area is not cacheable. */
    746        if ((0xA0000000 <= addr && addr < 0xC0000000) || 0xE0000000 <= addr)
    747            return 0;
    748    } else {
    749        /* For user mode, only U0 area is cacheable. */
    750        if (0x80000000 <= addr)
    751            return 0;
    752    }
    753
    754    /*
    755     * TODO : Evaluate CCR and check if the cache is on or off.
    756     *        Now CCR is not in CPUSH4State, but in SH7750State.
    757     *        When you move the ccr into CPUSH4State, the code will be
    758     *        as follows.
    759     */
    760#if 0
    761    /* check if operand cache is enabled or not. */
    762    if (!(env->ccr & 1))
    763        return 0;
    764#endif
    765
    766    /* if MMU is off, no check for TLB. */
    767    if (env->mmucr & MMUCR_AT)
    768        return 1;
    769
    770    /* check TLB */
    771    n = find_tlb_entry(env, addr, env->itlb, ITLB_SIZE, use_asid);
    772    if (n >= 0)
    773        return env->itlb[n].c;
    774
    775    n = find_tlb_entry(env, addr, env->utlb, UTLB_SIZE, use_asid);
    776    if (n >= 0)
    777        return env->utlb[n].c;
    778
    779    return 0;
    780}
    781
    782bool superh_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
    783{
    784    if (interrupt_request & CPU_INTERRUPT_HARD) {
    785        SuperHCPU *cpu = SUPERH_CPU(cs);
    786        CPUSH4State *env = &cpu->env;
    787
    788        /* Delay slots are indivisible, ignore interrupts */
    789        if (env->flags & DELAY_SLOT_MASK) {
    790            return false;
    791        } else {
    792            superh_cpu_do_interrupt(cs);
    793            return true;
    794        }
    795    }
    796    return false;
    797}
    798
    799#endif /* !CONFIG_USER_ONLY */
    800
    801bool superh_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
    802                         MMUAccessType access_type, int mmu_idx,
    803                         bool probe, uintptr_t retaddr)
    804{
    805    SuperHCPU *cpu = SUPERH_CPU(cs);
    806    CPUSH4State *env = &cpu->env;
    807    int ret;
    808
    809#ifdef CONFIG_USER_ONLY
    810    ret = (access_type == MMU_DATA_STORE ? MMU_DTLB_VIOLATION_WRITE :
    811           access_type == MMU_INST_FETCH ? MMU_ITLB_VIOLATION :
    812           MMU_DTLB_VIOLATION_READ);
    813#else
    814    target_ulong physical;
    815    int prot;
    816
    817    ret = get_physical_address(env, &physical, &prot, address, access_type);
    818
    819    if (ret == MMU_OK) {
    820        address &= TARGET_PAGE_MASK;
    821        physical &= TARGET_PAGE_MASK;
    822        tlb_set_page(cs, address, physical, prot, mmu_idx, TARGET_PAGE_SIZE);
    823        return true;
    824    }
    825    if (probe) {
    826        return false;
    827    }
    828
    829    if (ret != MMU_DTLB_MULTIPLE && ret != MMU_ITLB_MULTIPLE) {
    830        env->pteh = (env->pteh & PTEH_ASID_MASK) | (address & PTEH_VPN_MASK);
    831    }
    832#endif
    833
    834    env->tea = address;
    835    switch (ret) {
    836    case MMU_ITLB_MISS:
    837    case MMU_DTLB_MISS_READ:
    838        cs->exception_index = 0x040;
    839        break;
    840    case MMU_DTLB_MULTIPLE:
    841    case MMU_ITLB_MULTIPLE:
    842        cs->exception_index = 0x140;
    843        break;
    844    case MMU_ITLB_VIOLATION:
    845        cs->exception_index = 0x0a0;
    846        break;
    847    case MMU_DTLB_MISS_WRITE:
    848        cs->exception_index = 0x060;
    849        break;
    850    case MMU_DTLB_INITIAL_WRITE:
    851        cs->exception_index = 0x080;
    852        break;
    853    case MMU_DTLB_VIOLATION_READ:
    854        cs->exception_index = 0x0a0;
    855        break;
    856    case MMU_DTLB_VIOLATION_WRITE:
    857        cs->exception_index = 0x0c0;
    858        break;
    859    case MMU_IADDR_ERROR:
    860    case MMU_DADDR_ERROR_READ:
    861        cs->exception_index = 0x0e0;
    862        break;
    863    case MMU_DADDR_ERROR_WRITE:
    864        cs->exception_index = 0x100;
    865        break;
    866    default:
    867        cpu_abort(cs, "Unhandled MMU fault");
    868    }
    869    cpu_loop_exit_restore(cs, retaddr);
    870}