[Qemu-devel] [PATCH 0/4] PPC 40x MMU fixes.

[Qemu-devel] [PATCH 0/4] PPC 40x MMU fixes.

[Edgar E. Iglesias]

Hi,

I've been trying to boot linux on an emulated PPC 405 (Xilinx virtex 4)
board but I ran into trouble with the 40x MMU emulation.

Patch 4 is not the nicest but with this set I can now boot into a shell and
get a pretty stable system.

I'm very noob at ppc so comments are very welcome.

Thanks,
Edgar


Edgar E. Iglesias (4):
  ppc-40x: Get TLB attributes from TLBLO.
  ppc-40x: Correct check for Endian swapping TLB entries.
  ppc-40x: Correct decoding of zone protection bits.
  ppc-40x: Correct ESR for zone protection faults.

 target-ppc/helper.c    |   25 +++++++++++++++++++------
 target-ppc/op_helper.c |   14 ++++++++------
 2 files changed, 27 insertions(+), 12 deletions(-)

[Qemu-devel] [PATCH 1/4] ppc-40x: Get TLB attributes from TLBLO.

[Edgar E. Iglesias]

The ZSEL was incorrectly beeing decoded from TLBHI. Decode it from
TLBLO instead.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
---
 target-ppc/op_helper.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/target-ppc/op_helper.c b/target-ppc/op_helper.c
index cea27f2..3575b29 100644
--- a/target-ppc/op_helper.c
+++ b/target-ppc/op_helper.c
@@ -3990,7 +3990,6 @@ void helper_4xx_tlbwe_hi (target_ulong entry, target_ulong val)
         cpu_abort(env, "Little-endian TLB entries are not supported by now\n");
     }
     tlb->PID = env->spr[SPR_40x_PID]; /* PID */
-    tlb->attr = val & 0xFF;
     LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
               " size " TARGET_FMT_lx " prot %c%c%c%c PID %d\n", __func__,
               (int)entry, tlb->RPN, tlb->EPN, tlb->size,
@@ -4016,6 +4015,7 @@ void helper_4xx_tlbwe_lo (target_ulong entry, target_ulong val)
               val);
     entry &= 0x3F;
     tlb = &env->tlb[entry].tlbe;
+    tlb->attr = val & 0xFF;
     tlb->RPN = val & 0xFFFFFC00;
     tlb->prot = PAGE_READ;
     if (val & 0x200)
-- 
1.6.4.4

[Qemu-devel] [PATCH 2/4] ppc-40x: Correct check for Endian swapping TLB entries.

[Edgar E. Iglesias]

Bailout on 40x TLB entries with endianess swapping only if the entry
is valid.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
---
 target-ppc/op_helper.c |   12 +++++++-----
 1 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/target-ppc/op_helper.c b/target-ppc/op_helper.c
index 3575b29..f905c64 100644
--- a/target-ppc/op_helper.c
+++ b/target-ppc/op_helper.c
@@ -3981,13 +3981,15 @@ void helper_4xx_tlbwe_hi (target_ulong entry, target_ulong val)
                   tlb->size, TARGET_PAGE_SIZE, (int)((val >> 7) & 0x7));
     }
     tlb->EPN = val & ~(tlb->size - 1);
-    if (val & 0x40)
+    if (val & 0x40) {
         tlb->prot |= PAGE_VALID;
-    else
+        if (val & 0x20) {
+            /* XXX: TO BE FIXED */
+            cpu_abort(env,
+                      "Little-endian TLB entries are not supported by now\n");
+        }
+    } else {
         tlb->prot &= ~PAGE_VALID;
-    if (val & 0x20) {
-        /* XXX: TO BE FIXED */
-        cpu_abort(env, "Little-endian TLB entries are not supported by now\n");
     }
     tlb->PID = env->spr[SPR_40x_PID]; /* PID */
     LOG_SWTLB("%s: set up TLB %d RPN " TARGET_FMT_plx " EPN " TARGET_FMT_lx
-- 
1.6.4.4

[Qemu-devel] [PATCH 3/4] ppc-40x: Correct decoding of zone protection bits.

[Edgar E. Iglesias]

The 40x MMU has 15 zones in the ZPR register.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
---
 target-ppc/helper.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/target-ppc/helper.c b/target-ppc/helper.c
index b233d4f..f9b5589 100644
--- a/target-ppc/helper.c
+++ b/target-ppc/helper.c
@@ -1155,7 +1155,7 @@ static int mmu40x_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
                              env->spr[SPR_40x_PID], 0, i) < 0)
             continue;
         zsel = (tlb->attr >> 4) & 0xF;
-        zpr = (env->spr[SPR_40x_ZPR] >> (28 - (2 * zsel))) & 0x3;
+        zpr = (env->spr[SPR_40x_ZPR] >> (30 - (2 * zsel))) & 0x3;
         LOG_SWTLB("%s: TLB %d zsel %d zpr %d rw %d attr %08x\n",
                     __func__, i, zsel, zpr, rw, tlb->attr);
         /* Check execute enable bit */
-- 
1.6.4.4

[Qemu-devel] [PATCH 4/4] ppc-40x: Correct ESR for zone protection faults.

[Edgar E. Iglesias]

Raise the zone protection fault in ESR for TLB faults caused by
zone protection bits.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
---
 target-ppc/helper.c |   23 ++++++++++++++++++-----
 1 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/target-ppc/helper.c b/target-ppc/helper.c
index f9b5589..a4fae31 100644
--- a/target-ppc/helper.c
+++ b/target-ppc/helper.c
@@ -1171,6 +1171,8 @@ static int mmu40x_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
             break;
         case 0x0:
             if (pr != 0) {
+                /* Raise Zone protection fault.  */
+                env->spr[SPR_40x_ESR] = 1 << 22;
                 ctx->prot = 0;
                 ret = -2;
                 break;
@@ -1183,6 +1185,8 @@ static int mmu40x_get_physical_address (CPUState *env, mmu_ctx_t *ctx,
             ctx->prot = tlb->prot;
             ctx->prot |= PAGE_EXEC;
             ret = check_prot(ctx->prot, rw, access_type);
+            if (ret == -2)
+                env->spr[SPR_40x_ESR] = 0;
             break;
         }
         if (ret >= 0) {
@@ -1580,11 +1584,20 @@ int cpu_ppc_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
                 /* Access rights violation */
                 env->exception_index = POWERPC_EXCP_DSI;
                 env->error_code = 0;
-                env->spr[SPR_DAR] = address;
-                if (rw == 1)
-                    env->spr[SPR_DSISR] = 0x0A000000;
-                else
-                    env->spr[SPR_DSISR] = 0x08000000;
+                if (env->mmu_model == POWERPC_MMU_SOFT_4xx
+                    || env->mmu_model == POWERPC_MMU_SOFT_4xx_Z) {
+                    env->spr[SPR_40x_DEAR] = address;
+                    if (rw) {
+                        env->spr[SPR_40x_ESR] |= 0x00800000;
+                    }
+                } else {
+                    env->spr[SPR_DAR] = address;
+                    if (rw == 1) {
+                        env->spr[SPR_DSISR] = 0x0A000000;
+                    } else {
+                        env->spr[SPR_DSISR] = 0x08000000;
+                    }
+                }
                 break;
             case -4:
                 /* Direct store exception */
-- 
1.6.4.4