xref: /qemu/target/sparc/ldst_helper.c (revision b83a80e8)
1 /*
2  * Helpers for loads and stores
3  *
4  *  Copyright (c) 2003-2005 Fabrice Bellard
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "cpu.h"
22 #include "tcg/tcg.h"
23 #include "exec/helper-proto.h"
24 #include "exec/exec-all.h"
25 #include "exec/cpu_ldst.h"
26 #include "asi.h"
27 
28 //#define DEBUG_MMU
29 //#define DEBUG_MXCC
30 //#define DEBUG_UNASSIGNED
31 //#define DEBUG_ASI
32 //#define DEBUG_CACHE_CONTROL
33 
34 #ifdef DEBUG_MMU
35 #define DPRINTF_MMU(fmt, ...)                                   \
36     do { printf("MMU: " fmt , ## __VA_ARGS__); } while (0)
37 #else
38 #define DPRINTF_MMU(fmt, ...) do {} while (0)
39 #endif
40 
41 #ifdef DEBUG_MXCC
42 #define DPRINTF_MXCC(fmt, ...)                                  \
43     do { printf("MXCC: " fmt , ## __VA_ARGS__); } while (0)
44 #else
45 #define DPRINTF_MXCC(fmt, ...) do {} while (0)
46 #endif
47 
48 #ifdef DEBUG_ASI
49 #define DPRINTF_ASI(fmt, ...)                                   \
50     do { printf("ASI: " fmt , ## __VA_ARGS__); } while (0)
51 #endif
52 
53 #ifdef DEBUG_CACHE_CONTROL
54 #define DPRINTF_CACHE_CONTROL(fmt, ...)                                 \
55     do { printf("CACHE_CONTROL: " fmt , ## __VA_ARGS__); } while (0)
56 #else
57 #define DPRINTF_CACHE_CONTROL(fmt, ...) do {} while (0)
58 #endif
59 
60 #ifdef TARGET_SPARC64
61 #ifndef TARGET_ABI32
62 #define AM_CHECK(env1) ((env1)->pstate & PS_AM)
63 #else
64 #define AM_CHECK(env1) (1)
65 #endif
66 #endif
67 
68 #define QT0 (env->qt0)
69 #define QT1 (env->qt1)
70 
71 #if defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY)
72 /* Calculates TSB pointer value for fault page size
73  * UltraSPARC IIi has fixed sizes (8k or 64k) for the page pointers
74  * UA2005 holds the page size configuration in mmu_ctx registers */
75 static uint64_t ultrasparc_tsb_pointer(CPUSPARCState *env,
76                                        const SparcV9MMU *mmu, const int idx)
77 {
78     uint64_t tsb_register;
79     int page_size;
80     if (cpu_has_hypervisor(env)) {
81         int tsb_index = 0;
82         int ctx = mmu->tag_access & 0x1fffULL;
83         uint64_t ctx_register = mmu->sun4v_ctx_config[ctx ? 1 : 0];
84         tsb_index = idx;
85         tsb_index |= ctx ? 2 : 0;
86         page_size = idx ? ctx_register >> 8 : ctx_register;
87         page_size &= 7;
88         tsb_register = mmu->sun4v_tsb_pointers[tsb_index];
89     } else {
90         page_size = idx;
91         tsb_register = mmu->tsb;
92     }
93     int tsb_split = (tsb_register & 0x1000ULL) ? 1 : 0;
94     int tsb_size  = tsb_register & 0xf;
95 
96     uint64_t tsb_base_mask = (~0x1fffULL) << tsb_size;
97 
98     /* move va bits to correct position,
99      * the context bits will be masked out later */
100     uint64_t va = mmu->tag_access >> (3 * page_size + 9);
101 
102     /* calculate tsb_base mask and adjust va if split is in use */
103     if (tsb_split) {
104         if (idx == 0) {
105             va &= ~(1ULL << (13 + tsb_size));
106         } else {
107             va |= (1ULL << (13 + tsb_size));
108         }
109         tsb_base_mask <<= 1;
110     }
111 
112     return ((tsb_register & tsb_base_mask) | (va & ~tsb_base_mask)) & ~0xfULL;
113 }
114 
115 /* Calculates tag target register value by reordering bits
116    in tag access register */
117 static uint64_t ultrasparc_tag_target(uint64_t tag_access_register)
118 {
119     return ((tag_access_register & 0x1fff) << 48) | (tag_access_register >> 22);
120 }
121 
122 static void replace_tlb_entry(SparcTLBEntry *tlb,
123                               uint64_t tlb_tag, uint64_t tlb_tte,
124                               CPUSPARCState *env)
125 {
126     target_ulong mask, size, va, offset;
127 
128     /* flush page range if translation is valid */
129     if (TTE_IS_VALID(tlb->tte)) {
130         CPUState *cs = env_cpu(env);
131 
132         size = 8192ULL << 3 * TTE_PGSIZE(tlb->tte);
133         mask = 1ULL + ~size;
134 
135         va = tlb->tag & mask;
136 
137         for (offset = 0; offset < size; offset += TARGET_PAGE_SIZE) {
138             tlb_flush_page(cs, va + offset);
139         }
140     }
141 
142     tlb->tag = tlb_tag;
143     tlb->tte = tlb_tte;
144 }
145 
146 static void demap_tlb(SparcTLBEntry *tlb, target_ulong demap_addr,
147                       const char *strmmu, CPUSPARCState *env1)
148 {
149     unsigned int i;
150     target_ulong mask;
151     uint64_t context;
152 
153     int is_demap_context = (demap_addr >> 6) & 1;
154 
155     /* demap context */
156     switch ((demap_addr >> 4) & 3) {
157     case 0: /* primary */
158         context = env1->dmmu.mmu_primary_context;
159         break;
160     case 1: /* secondary */
161         context = env1->dmmu.mmu_secondary_context;
162         break;
163     case 2: /* nucleus */
164         context = 0;
165         break;
166     case 3: /* reserved */
167     default:
168         return;
169     }
170 
171     for (i = 0; i < 64; i++) {
172         if (TTE_IS_VALID(tlb[i].tte)) {
173 
174             if (is_demap_context) {
175                 /* will remove non-global entries matching context value */
176                 if (TTE_IS_GLOBAL(tlb[i].tte) ||
177                     !tlb_compare_context(&tlb[i], context)) {
178                     continue;
179                 }
180             } else {
181                 /* demap page
182                    will remove any entry matching VA */
183                 mask = 0xffffffffffffe000ULL;
184                 mask <<= 3 * ((tlb[i].tte >> 61) & 3);
185 
186                 if (!compare_masked(demap_addr, tlb[i].tag, mask)) {
187                     continue;
188                 }
189 
190                 /* entry should be global or matching context value */
191                 if (!TTE_IS_GLOBAL(tlb[i].tte) &&
192                     !tlb_compare_context(&tlb[i], context)) {
193                     continue;
194                 }
195             }
196 
197             replace_tlb_entry(&tlb[i], 0, 0, env1);
198 #ifdef DEBUG_MMU
199             DPRINTF_MMU("%s demap invalidated entry [%02u]\n", strmmu, i);
200             dump_mmu(env1);
201 #endif
202         }
203     }
204 }
205 
206 static uint64_t sun4v_tte_to_sun4u(CPUSPARCState *env, uint64_t tag,
207                                    uint64_t sun4v_tte)
208 {
209     uint64_t sun4u_tte;
210     if (!(cpu_has_hypervisor(env) && (tag & TLB_UST1_IS_SUN4V_BIT))) {
211         /* is already in the sun4u format */
212         return sun4v_tte;
213     }
214     sun4u_tte = TTE_PA(sun4v_tte) | (sun4v_tte & TTE_VALID_BIT);
215     sun4u_tte |= (sun4v_tte & 3ULL) << 61; /* TTE_PGSIZE */
216     sun4u_tte |= CONVERT_BIT(sun4v_tte, TTE_NFO_BIT_UA2005, TTE_NFO_BIT);
217     sun4u_tte |= CONVERT_BIT(sun4v_tte, TTE_USED_BIT_UA2005, TTE_USED_BIT);
218     sun4u_tte |= CONVERT_BIT(sun4v_tte, TTE_W_OK_BIT_UA2005, TTE_W_OK_BIT);
219     sun4u_tte |= CONVERT_BIT(sun4v_tte, TTE_SIDEEFFECT_BIT_UA2005,
220                              TTE_SIDEEFFECT_BIT);
221     sun4u_tte |= CONVERT_BIT(sun4v_tte, TTE_PRIV_BIT_UA2005, TTE_PRIV_BIT);
222     sun4u_tte |= CONVERT_BIT(sun4v_tte, TTE_LOCKED_BIT_UA2005, TTE_LOCKED_BIT);
223     return sun4u_tte;
224 }
225 
226 static void replace_tlb_1bit_lru(SparcTLBEntry *tlb,
227                                  uint64_t tlb_tag, uint64_t tlb_tte,
228                                  const char *strmmu, CPUSPARCState *env1,
229                                  uint64_t addr)
230 {
231     unsigned int i, replace_used;
232 
233     tlb_tte = sun4v_tte_to_sun4u(env1, addr, tlb_tte);
234     if (cpu_has_hypervisor(env1)) {
235         uint64_t new_vaddr = tlb_tag & ~0x1fffULL;
236         uint64_t new_size = 8192ULL << 3 * TTE_PGSIZE(tlb_tte);
237         uint32_t new_ctx = tlb_tag & 0x1fffU;
238         for (i = 0; i < 64; i++) {
239             uint32_t ctx = tlb[i].tag & 0x1fffU;
240             /* check if new mapping overlaps an existing one */
241             if (new_ctx == ctx) {
242                 uint64_t vaddr = tlb[i].tag & ~0x1fffULL;
243                 uint64_t size = 8192ULL << 3 * TTE_PGSIZE(tlb[i].tte);
244                 if (new_vaddr == vaddr
245                     || (new_vaddr < vaddr + size
246                         && vaddr < new_vaddr + new_size)) {
247                     DPRINTF_MMU("auto demap entry [%d] %lx->%lx\n", i, vaddr,
248                                 new_vaddr);
249                     replace_tlb_entry(&tlb[i], tlb_tag, tlb_tte, env1);
250                     return;
251                 }
252             }
253 
254         }
255     }
256     /* Try replacing invalid entry */
257     for (i = 0; i < 64; i++) {
258         if (!TTE_IS_VALID(tlb[i].tte)) {
259             replace_tlb_entry(&tlb[i], tlb_tag, tlb_tte, env1);
260 #ifdef DEBUG_MMU
261             DPRINTF_MMU("%s lru replaced invalid entry [%i]\n", strmmu, i);
262             dump_mmu(env1);
263 #endif
264             return;
265         }
266     }
267 
268     /* All entries are valid, try replacing unlocked entry */
269 
270     for (replace_used = 0; replace_used < 2; ++replace_used) {
271 
272         /* Used entries are not replaced on first pass */
273 
274         for (i = 0; i < 64; i++) {
275             if (!TTE_IS_LOCKED(tlb[i].tte) && !TTE_IS_USED(tlb[i].tte)) {
276 
277                 replace_tlb_entry(&tlb[i], tlb_tag, tlb_tte, env1);
278 #ifdef DEBUG_MMU
279                 DPRINTF_MMU("%s lru replaced unlocked %s entry [%i]\n",
280                             strmmu, (replace_used ? "used" : "unused"), i);
281                 dump_mmu(env1);
282 #endif
283                 return;
284             }
285         }
286 
287         /* Now reset used bit and search for unused entries again */
288 
289         for (i = 0; i < 64; i++) {
290             TTE_SET_UNUSED(tlb[i].tte);
291         }
292     }
293 
294 #ifdef DEBUG_MMU
295     DPRINTF_MMU("%s lru replacement: no free entries available, "
296                 "replacing the last one\n", strmmu);
297 #endif
298     /* corner case: the last entry is replaced anyway */
299     replace_tlb_entry(&tlb[63], tlb_tag, tlb_tte, env1);
300 }
301 
302 #endif
303 
304 #ifdef TARGET_SPARC64
305 /* returns true if access using this ASI is to have address translated by MMU
306    otherwise access is to raw physical address */
307 /* TODO: check sparc32 bits */
308 static inline int is_translating_asi(int asi)
309 {
310     /* Ultrasparc IIi translating asi
311        - note this list is defined by cpu implementation
312     */
313     switch (asi) {
314     case 0x04 ... 0x11:
315     case 0x16 ... 0x19:
316     case 0x1E ... 0x1F:
317     case 0x24 ... 0x2C:
318     case 0x70 ... 0x73:
319     case 0x78 ... 0x79:
320     case 0x80 ... 0xFF:
321         return 1;
322 
323     default:
324         return 0;
325     }
326 }
327 
328 static inline target_ulong address_mask(CPUSPARCState *env1, target_ulong addr)
329 {
330     if (AM_CHECK(env1)) {
331         addr &= 0xffffffffULL;
332     }
333     return addr;
334 }
335 
336 static inline target_ulong asi_address_mask(CPUSPARCState *env,
337                                             int asi, target_ulong addr)
338 {
339     if (is_translating_asi(asi)) {
340         addr = address_mask(env, addr);
341     }
342     return addr;
343 }
344 
345 #ifndef CONFIG_USER_ONLY
346 static inline void do_check_asi(CPUSPARCState *env, int asi, uintptr_t ra)
347 {
348     /* ASIs >= 0x80 are user mode.
349      * ASIs >= 0x30 are hyper mode (or super if hyper is not available).
350      * ASIs <= 0x2f are super mode.
351      */
352     if (asi < 0x80
353         && !cpu_hypervisor_mode(env)
354         && (!cpu_supervisor_mode(env)
355             || (asi >= 0x30 && cpu_has_hypervisor(env)))) {
356         cpu_raise_exception_ra(env, TT_PRIV_ACT, ra);
357     }
358 }
359 #endif /* !CONFIG_USER_ONLY */
360 #endif
361 
362 static void do_check_align(CPUSPARCState *env, target_ulong addr,
363                            uint32_t align, uintptr_t ra)
364 {
365     if (addr & align) {
366         cpu_raise_exception_ra(env, TT_UNALIGNED, ra);
367     }
368 }
369 
370 void helper_check_align(CPUSPARCState *env, target_ulong addr, uint32_t align)
371 {
372     do_check_align(env, addr, align, GETPC());
373 }
374 
375 #if !defined(TARGET_SPARC64) && !defined(CONFIG_USER_ONLY) &&   \
376     defined(DEBUG_MXCC)
377 static void dump_mxcc(CPUSPARCState *env)
378 {
379     printf("mxccdata: %016" PRIx64 " %016" PRIx64 " %016" PRIx64 " %016" PRIx64
380            "\n",
381            env->mxccdata[0], env->mxccdata[1],
382            env->mxccdata[2], env->mxccdata[3]);
383     printf("mxccregs: %016" PRIx64 " %016" PRIx64 " %016" PRIx64 " %016" PRIx64
384            "\n"
385            "          %016" PRIx64 " %016" PRIx64 " %016" PRIx64 " %016" PRIx64
386            "\n",
387            env->mxccregs[0], env->mxccregs[1],
388            env->mxccregs[2], env->mxccregs[3],
389            env->mxccregs[4], env->mxccregs[5],
390            env->mxccregs[6], env->mxccregs[7]);
391 }
392 #endif
393 
394 #if (defined(TARGET_SPARC64) || !defined(CONFIG_USER_ONLY))     \
395     && defined(DEBUG_ASI)
396 static void dump_asi(const char *txt, target_ulong addr, int asi, int size,
397                      uint64_t r1)
398 {
399     switch (size) {
400     case 1:
401         DPRINTF_ASI("%s "TARGET_FMT_lx " asi 0x%02x = %02" PRIx64 "\n", txt,
402                     addr, asi, r1 & 0xff);
403         break;
404     case 2:
405         DPRINTF_ASI("%s "TARGET_FMT_lx " asi 0x%02x = %04" PRIx64 "\n", txt,
406                     addr, asi, r1 & 0xffff);
407         break;
408     case 4:
409         DPRINTF_ASI("%s "TARGET_FMT_lx " asi 0x%02x = %08" PRIx64 "\n", txt,
410                     addr, asi, r1 & 0xffffffff);
411         break;
412     case 8:
413         DPRINTF_ASI("%s "TARGET_FMT_lx " asi 0x%02x = %016" PRIx64 "\n", txt,
414                     addr, asi, r1);
415         break;
416     }
417 }
418 #endif
419 
420 #ifndef CONFIG_USER_ONLY
421 #ifndef TARGET_SPARC64
422 static void sparc_raise_mmu_fault(CPUState *cs, hwaddr addr,
423                                   bool is_write, bool is_exec, int is_asi,
424                                   unsigned size, uintptr_t retaddr)
425 {
426     SPARCCPU *cpu = SPARC_CPU(cs);
427     CPUSPARCState *env = &cpu->env;
428     int fault_type;
429 
430 #ifdef DEBUG_UNASSIGNED
431     if (is_asi) {
432         printf("Unassigned mem %s access of %d byte%s to " TARGET_FMT_plx
433                " asi 0x%02x from " TARGET_FMT_lx "\n",
434                is_exec ? "exec" : is_write ? "write" : "read", size,
435                size == 1 ? "" : "s", addr, is_asi, env->pc);
436     } else {
437         printf("Unassigned mem %s access of %d byte%s to " TARGET_FMT_plx
438                " from " TARGET_FMT_lx "\n",
439                is_exec ? "exec" : is_write ? "write" : "read", size,
440                size == 1 ? "" : "s", addr, env->pc);
441     }
442 #endif
443     /* Don't overwrite translation and access faults */
444     fault_type = (env->mmuregs[3] & 0x1c) >> 2;
445     if ((fault_type > 4) || (fault_type == 0)) {
446         env->mmuregs[3] = 0; /* Fault status register */
447         if (is_asi) {
448             env->mmuregs[3] |= 1 << 16;
449         }
450         if (env->psrs) {
451             env->mmuregs[3] |= 1 << 5;
452         }
453         if (is_exec) {
454             env->mmuregs[3] |= 1 << 6;
455         }
456         if (is_write) {
457             env->mmuregs[3] |= 1 << 7;
458         }
459         env->mmuregs[3] |= (5 << 2) | 2;
460         /* SuperSPARC will never place instruction fault addresses in the FAR */
461         if (!is_exec) {
462             env->mmuregs[4] = addr; /* Fault address register */
463         }
464     }
465     /* overflow (same type fault was not read before another fault) */
466     if (fault_type == ((env->mmuregs[3] & 0x1c)) >> 2) {
467         env->mmuregs[3] |= 1;
468     }
469 
470     if ((env->mmuregs[0] & MMU_E) && !(env->mmuregs[0] & MMU_NF)) {
471         int tt = is_exec ? TT_CODE_ACCESS : TT_DATA_ACCESS;
472         cpu_raise_exception_ra(env, tt, retaddr);
473     }
474 
475     /*
476      * flush neverland mappings created during no-fault mode,
477      * so the sequential MMU faults report proper fault types
478      */
479     if (env->mmuregs[0] & MMU_NF) {
480         tlb_flush(cs);
481     }
482 }
483 #else
484 static void sparc_raise_mmu_fault(CPUState *cs, hwaddr addr,
485                                   bool is_write, bool is_exec, int is_asi,
486                                   unsigned size, uintptr_t retaddr)
487 {
488     SPARCCPU *cpu = SPARC_CPU(cs);
489     CPUSPARCState *env = &cpu->env;
490 
491 #ifdef DEBUG_UNASSIGNED
492     printf("Unassigned mem access to " TARGET_FMT_plx " from " TARGET_FMT_lx
493            "\n", addr, env->pc);
494 #endif
495 
496     if (is_exec) { /* XXX has_hypervisor */
497         if (env->lsu & (IMMU_E)) {
498             cpu_raise_exception_ra(env, TT_CODE_ACCESS, retaddr);
499         } else if (cpu_has_hypervisor(env) && !(env->hpstate & HS_PRIV)) {
500             cpu_raise_exception_ra(env, TT_INSN_REAL_TRANSLATION_MISS, retaddr);
501         }
502     } else {
503         if (env->lsu & (DMMU_E)) {
504             cpu_raise_exception_ra(env, TT_DATA_ACCESS, retaddr);
505         } else if (cpu_has_hypervisor(env) && !(env->hpstate & HS_PRIV)) {
506             cpu_raise_exception_ra(env, TT_DATA_REAL_TRANSLATION_MISS, retaddr);
507         }
508     }
509 }
510 #endif
511 #endif
512 
513 #ifndef TARGET_SPARC64
514 #ifndef CONFIG_USER_ONLY
515 
516 
517 /* Leon3 cache control */
518 
519 static void leon3_cache_control_st(CPUSPARCState *env, target_ulong addr,
520                                    uint64_t val, int size)
521 {
522     DPRINTF_CACHE_CONTROL("st addr:%08x, val:%" PRIx64 ", size:%d\n",
523                           addr, val, size);
524 
525     if (size != 4) {
526         DPRINTF_CACHE_CONTROL("32bits only\n");
527         return;
528     }
529 
530     switch (addr) {
531     case 0x00:              /* Cache control */
532 
533         /* These values must always be read as zeros */
534         val &= ~CACHE_CTRL_FD;
535         val &= ~CACHE_CTRL_FI;
536         val &= ~CACHE_CTRL_IB;
537         val &= ~CACHE_CTRL_IP;
538         val &= ~CACHE_CTRL_DP;
539 
540         env->cache_control = val;
541         break;
542     case 0x04:              /* Instruction cache configuration */
543     case 0x08:              /* Data cache configuration */
544         /* Read Only */
545         break;
546     default:
547         DPRINTF_CACHE_CONTROL("write unknown register %08x\n", addr);
548         break;
549     };
550 }
551 
552 static uint64_t leon3_cache_control_ld(CPUSPARCState *env, target_ulong addr,
553                                        int size)
554 {
555     uint64_t ret = 0;
556 
557     if (size != 4) {
558         DPRINTF_CACHE_CONTROL("32bits only\n");
559         return 0;
560     }
561 
562     switch (addr) {
563     case 0x00:              /* Cache control */
564         ret = env->cache_control;
565         break;
566 
567         /* Configuration registers are read and only always keep those
568            predefined values */
569 
570     case 0x04:              /* Instruction cache configuration */
571         ret = 0x10220000;
572         break;
573     case 0x08:              /* Data cache configuration */
574         ret = 0x18220000;
575         break;
576     default:
577         DPRINTF_CACHE_CONTROL("read unknown register %08x\n", addr);
578         break;
579     };
580     DPRINTF_CACHE_CONTROL("ld addr:%08x, ret:0x%" PRIx64 ", size:%d\n",
581                           addr, ret, size);
582     return ret;
583 }
584 
585 uint64_t helper_ld_asi(CPUSPARCState *env, target_ulong addr,
586                        int asi, uint32_t memop)
587 {
588     int size = 1 << (memop & MO_SIZE);
589     int sign = memop & MO_SIGN;
590     CPUState *cs = env_cpu(env);
591     uint64_t ret = 0;
592 #if defined(DEBUG_MXCC) || defined(DEBUG_ASI)
593     uint32_t last_addr = addr;
594 #endif
595 
596     do_check_align(env, addr, size - 1, GETPC());
597     switch (asi) {
598     case ASI_M_MXCC: /* SuperSparc MXCC registers, or... */
599     /* case ASI_LEON_CACHEREGS:  Leon3 cache control */
600         switch (addr) {
601         case 0x00:          /* Leon3 Cache Control */
602         case 0x08:          /* Leon3 Instruction Cache config */
603         case 0x0C:          /* Leon3 Date Cache config */
604             if (env->def.features & CPU_FEATURE_CACHE_CTRL) {
605                 ret = leon3_cache_control_ld(env, addr, size);
606             }
607             break;
608         case 0x01c00a00: /* MXCC control register */
609             if (size == 8) {
610                 ret = env->mxccregs[3];
611             } else {
612                 qemu_log_mask(LOG_UNIMP,
613                               "%08x: unimplemented access size: %d\n", addr,
614                               size);
615             }
616             break;
617         case 0x01c00a04: /* MXCC control register */
618             if (size == 4) {
619                 ret = env->mxccregs[3];
620             } else {
621                 qemu_log_mask(LOG_UNIMP,
622                               "%08x: unimplemented access size: %d\n", addr,
623                               size);
624             }
625             break;
626         case 0x01c00c00: /* Module reset register */
627             if (size == 8) {
628                 ret = env->mxccregs[5];
629                 /* should we do something here? */
630             } else {
631                 qemu_log_mask(LOG_UNIMP,
632                               "%08x: unimplemented access size: %d\n", addr,
633                               size);
634             }
635             break;
636         case 0x01c00f00: /* MBus port address register */
637             if (size == 8) {
638                 ret = env->mxccregs[7];
639             } else {
640                 qemu_log_mask(LOG_UNIMP,
641                               "%08x: unimplemented access size: %d\n", addr,
642                               size);
643             }
644             break;
645         default:
646             qemu_log_mask(LOG_UNIMP,
647                           "%08x: unimplemented address, size: %d\n", addr,
648                           size);
649             break;
650         }
651         DPRINTF_MXCC("asi = %d, size = %d, sign = %d, "
652                      "addr = %08x -> ret = %" PRIx64 ","
653                      "addr = %08x\n", asi, size, sign, last_addr, ret, addr);
654 #ifdef DEBUG_MXCC
655         dump_mxcc(env);
656 #endif
657         break;
658     case ASI_M_FLUSH_PROBE: /* SuperSparc MMU probe */
659     case ASI_LEON_MMUFLUSH: /* LEON3 MMU probe */
660         {
661             int mmulev;
662 
663             mmulev = (addr >> 8) & 15;
664             if (mmulev > 4) {
665                 ret = 0;
666             } else {
667                 ret = mmu_probe(env, addr, mmulev);
668             }
669             DPRINTF_MMU("mmu_probe: 0x%08x (lev %d) -> 0x%08" PRIx64 "\n",
670                         addr, mmulev, ret);
671         }
672         break;
673     case ASI_M_MMUREGS: /* SuperSparc MMU regs */
674     case ASI_LEON_MMUREGS: /* LEON3 MMU regs */
675         {
676             int reg = (addr >> 8) & 0x1f;
677 
678             ret = env->mmuregs[reg];
679             if (reg == 3) { /* Fault status cleared on read */
680                 env->mmuregs[3] = 0;
681             } else if (reg == 0x13) { /* Fault status read */
682                 ret = env->mmuregs[3];
683             } else if (reg == 0x14) { /* Fault address read */
684                 ret = env->mmuregs[4];
685             }
686             DPRINTF_MMU("mmu_read: reg[%d] = 0x%08" PRIx64 "\n", reg, ret);
687         }
688         break;
689     case ASI_M_TLBDIAG: /* Turbosparc ITLB Diagnostic */
690     case ASI_M_DIAGS:   /* Turbosparc DTLB Diagnostic */
691     case ASI_M_IODIAG:  /* Turbosparc IOTLB Diagnostic */
692         break;
693     case ASI_KERNELTXT: /* Supervisor code access */
694         switch (size) {
695         case 1:
696             ret = cpu_ldub_code(env, addr);
697             break;
698         case 2:
699             ret = cpu_lduw_code(env, addr);
700             break;
701         default:
702         case 4:
703             ret = cpu_ldl_code(env, addr);
704             break;
705         case 8:
706             ret = cpu_ldq_code(env, addr);
707             break;
708         }
709         break;
710     case ASI_M_TXTC_TAG:   /* SparcStation 5 I-cache tag */
711     case ASI_M_TXTC_DATA:  /* SparcStation 5 I-cache data */
712     case ASI_M_DATAC_TAG:  /* SparcStation 5 D-cache tag */
713     case ASI_M_DATAC_DATA: /* SparcStation 5 D-cache data */
714         break;
715     case 0x21 ... 0x2f: /* MMU passthrough, 0x100000000 to 0xfffffffff */
716     {
717         MemTxResult result;
718         hwaddr access_addr = (hwaddr)addr | ((hwaddr)(asi & 0xf) << 32);
719 
720         switch (size) {
721         case 1:
722             ret = address_space_ldub(cs->as, access_addr,
723                                      MEMTXATTRS_UNSPECIFIED, &result);
724             break;
725         case 2:
726             ret = address_space_lduw(cs->as, access_addr,
727                                      MEMTXATTRS_UNSPECIFIED, &result);
728             break;
729         default:
730         case 4:
731             ret = address_space_ldl(cs->as, access_addr,
732                                     MEMTXATTRS_UNSPECIFIED, &result);
733             break;
734         case 8:
735             ret = address_space_ldq(cs->as, access_addr,
736                                     MEMTXATTRS_UNSPECIFIED, &result);
737             break;
738         }
739 
740         if (result != MEMTX_OK) {
741             sparc_raise_mmu_fault(cs, access_addr, false, false, false,
742                                   size, GETPC());
743         }
744         break;
745     }
746     case 0x30: /* Turbosparc secondary cache diagnostic */
747     case 0x31: /* Turbosparc RAM snoop */
748     case 0x32: /* Turbosparc page table descriptor diagnostic */
749     case 0x39: /* data cache diagnostic register */
750         ret = 0;
751         break;
752     case 0x38: /* SuperSPARC MMU Breakpoint Control Registers */
753         {
754             int reg = (addr >> 8) & 3;
755 
756             switch (reg) {
757             case 0: /* Breakpoint Value (Addr) */
758                 ret = env->mmubpregs[reg];
759                 break;
760             case 1: /* Breakpoint Mask */
761                 ret = env->mmubpregs[reg];
762                 break;
763             case 2: /* Breakpoint Control */
764                 ret = env->mmubpregs[reg];
765                 break;
766             case 3: /* Breakpoint Status */
767                 ret = env->mmubpregs[reg];
768                 env->mmubpregs[reg] = 0ULL;
769                 break;
770             }
771             DPRINTF_MMU("read breakpoint reg[%d] 0x%016" PRIx64 "\n", reg,
772                         ret);
773         }
774         break;
775     case 0x49: /* SuperSPARC MMU Counter Breakpoint Value */
776         ret = env->mmubpctrv;
777         break;
778     case 0x4a: /* SuperSPARC MMU Counter Breakpoint Control */
779         ret = env->mmubpctrc;
780         break;
781     case 0x4b: /* SuperSPARC MMU Counter Breakpoint Status */
782         ret = env->mmubpctrs;
783         break;
784     case 0x4c: /* SuperSPARC MMU Breakpoint Action */
785         ret = env->mmubpaction;
786         break;
787     case ASI_USERTXT: /* User code access, XXX */
788     default:
789         sparc_raise_mmu_fault(cs, addr, false, false, asi, size, GETPC());
790         ret = 0;
791         break;
792 
793     case ASI_USERDATA: /* User data access */
794     case ASI_KERNELDATA: /* Supervisor data access */
795     case ASI_P: /* Implicit primary context data access (v9 only?) */
796     case ASI_M_BYPASS:    /* MMU passthrough */
797     case ASI_LEON_BYPASS: /* LEON MMU passthrough */
798         /* These are always handled inline.  */
799         g_assert_not_reached();
800     }
801     if (sign) {
802         switch (size) {
803         case 1:
804             ret = (int8_t) ret;
805             break;
806         case 2:
807             ret = (int16_t) ret;
808             break;
809         case 4:
810             ret = (int32_t) ret;
811             break;
812         default:
813             break;
814         }
815     }
816 #ifdef DEBUG_ASI
817     dump_asi("read ", last_addr, asi, size, ret);
818 #endif
819     return ret;
820 }
821 
822 void helper_st_asi(CPUSPARCState *env, target_ulong addr, uint64_t val,
823                    int asi, uint32_t memop)
824 {
825     int size = 1 << (memop & MO_SIZE);
826     CPUState *cs = env_cpu(env);
827 
828     do_check_align(env, addr, size - 1, GETPC());
829     switch (asi) {
830     case ASI_M_MXCC: /* SuperSparc MXCC registers, or... */
831     /* case ASI_LEON_CACHEREGS:  Leon3 cache control */
832         switch (addr) {
833         case 0x00:          /* Leon3 Cache Control */
834         case 0x08:          /* Leon3 Instruction Cache config */
835         case 0x0C:          /* Leon3 Date Cache config */
836             if (env->def.features & CPU_FEATURE_CACHE_CTRL) {
837                 leon3_cache_control_st(env, addr, val, size);
838             }
839             break;
840 
841         case 0x01c00000: /* MXCC stream data register 0 */
842             if (size == 8) {
843                 env->mxccdata[0] = val;
844             } else {
845                 qemu_log_mask(LOG_UNIMP,
846                               "%08x: unimplemented access size: %d\n", addr,
847                               size);
848             }
849             break;
850         case 0x01c00008: /* MXCC stream data register 1 */
851             if (size == 8) {
852                 env->mxccdata[1] = val;
853             } else {
854                 qemu_log_mask(LOG_UNIMP,
855                               "%08x: unimplemented access size: %d\n", addr,
856                               size);
857             }
858             break;
859         case 0x01c00010: /* MXCC stream data register 2 */
860             if (size == 8) {
861                 env->mxccdata[2] = val;
862             } else {
863                 qemu_log_mask(LOG_UNIMP,
864                               "%08x: unimplemented access size: %d\n", addr,
865                               size);
866             }
867             break;
868         case 0x01c00018: /* MXCC stream data register 3 */
869             if (size == 8) {
870                 env->mxccdata[3] = val;
871             } else {
872                 qemu_log_mask(LOG_UNIMP,
873                               "%08x: unimplemented access size: %d\n", addr,
874                               size);
875             }
876             break;
877         case 0x01c00100: /* MXCC stream source */
878         {
879             int i;
880 
881             if (size == 8) {
882                 env->mxccregs[0] = val;
883             } else {
884                 qemu_log_mask(LOG_UNIMP,
885                               "%08x: unimplemented access size: %d\n", addr,
886                               size);
887             }
888 
889             for (i = 0; i < 4; i++) {
890                 MemTxResult result;
891                 hwaddr access_addr = (env->mxccregs[0] & 0xffffffffULL) + 8 * i;
892 
893                 env->mxccdata[i] = address_space_ldq(cs->as,
894                                                      access_addr,
895                                                      MEMTXATTRS_UNSPECIFIED,
896                                                      &result);
897                 if (result != MEMTX_OK) {
898                     /* TODO: investigate whether this is the right behaviour */
899                     sparc_raise_mmu_fault(cs, access_addr, false, false,
900                                           false, size, GETPC());
901                 }
902             }
903             break;
904         }
905         case 0x01c00200: /* MXCC stream destination */
906         {
907             int i;
908 
909             if (size == 8) {
910                 env->mxccregs[1] = val;
911             } else {
912                 qemu_log_mask(LOG_UNIMP,
913                               "%08x: unimplemented access size: %d\n", addr,
914                               size);
915             }
916 
917             for (i = 0; i < 4; i++) {
918                 MemTxResult result;
919                 hwaddr access_addr = (env->mxccregs[1] & 0xffffffffULL) + 8 * i;
920 
921                 address_space_stq(cs->as, access_addr, env->mxccdata[i],
922                                   MEMTXATTRS_UNSPECIFIED, &result);
923 
924                 if (result != MEMTX_OK) {
925                     /* TODO: investigate whether this is the right behaviour */
926                     sparc_raise_mmu_fault(cs, access_addr, true, false,
927                                           false, size, GETPC());
928                 }
929             }
930             break;
931         }
932         case 0x01c00a00: /* MXCC control register */
933             if (size == 8) {
934                 env->mxccregs[3] = val;
935             } else {
936                 qemu_log_mask(LOG_UNIMP,
937                               "%08x: unimplemented access size: %d\n", addr,
938                               size);
939             }
940             break;
941         case 0x01c00a04: /* MXCC control register */
942             if (size == 4) {
943                 env->mxccregs[3] = (env->mxccregs[3] & 0xffffffff00000000ULL)
944                     | val;
945             } else {
946                 qemu_log_mask(LOG_UNIMP,
947                               "%08x: unimplemented access size: %d\n", addr,
948                               size);
949             }
950             break;
951         case 0x01c00e00: /* MXCC error register  */
952             /* writing a 1 bit clears the error */
953             if (size == 8) {
954                 env->mxccregs[6] &= ~val;
955             } else {
956                 qemu_log_mask(LOG_UNIMP,
957                               "%08x: unimplemented access size: %d\n", addr,
958                               size);
959             }
960             break;
961         case 0x01c00f00: /* MBus port address register */
962             if (size == 8) {
963                 env->mxccregs[7] = val;
964             } else {
965                 qemu_log_mask(LOG_UNIMP,
966                               "%08x: unimplemented access size: %d\n", addr,
967                               size);
968             }
969             break;
970         default:
971             qemu_log_mask(LOG_UNIMP,
972                           "%08x: unimplemented address, size: %d\n", addr,
973                           size);
974             break;
975         }
976         DPRINTF_MXCC("asi = %d, size = %d, addr = %08x, val = %" PRIx64 "\n",
977                      asi, size, addr, val);
978 #ifdef DEBUG_MXCC
979         dump_mxcc(env);
980 #endif
981         break;
982     case ASI_M_FLUSH_PROBE: /* SuperSparc MMU flush */
983     case ASI_LEON_MMUFLUSH: /* LEON3 MMU flush */
984         {
985             int mmulev;
986 
987             mmulev = (addr >> 8) & 15;
988             DPRINTF_MMU("mmu flush level %d\n", mmulev);
989             switch (mmulev) {
990             case 0: /* flush page */
991                 tlb_flush_page(cs, addr & 0xfffff000);
992                 break;
993             case 1: /* flush segment (256k) */
994             case 2: /* flush region (16M) */
995             case 3: /* flush context (4G) */
996             case 4: /* flush entire */
997                 tlb_flush(cs);
998                 break;
999             default:
1000                 break;
1001             }
1002 #ifdef DEBUG_MMU
1003             dump_mmu(env);
1004 #endif
1005         }
1006         break;
1007     case ASI_M_MMUREGS: /* write MMU regs */
1008     case ASI_LEON_MMUREGS: /* LEON3 write MMU regs */
1009         {
1010             int reg = (addr >> 8) & 0x1f;
1011             uint32_t oldreg;
1012 
1013             oldreg = env->mmuregs[reg];
1014             switch (reg) {
1015             case 0: /* Control Register */
1016                 env->mmuregs[reg] = (env->mmuregs[reg] & 0xff000000) |
1017                     (val & 0x00ffffff);
1018                 /* Mappings generated during no-fault mode
1019                    are invalid in normal mode.  */
1020                 if ((oldreg ^ env->mmuregs[reg])
1021                     & (MMU_NF | env->def.mmu_bm)) {
1022                     tlb_flush(cs);
1023                 }
1024                 break;
1025             case 1: /* Context Table Pointer Register */
1026                 env->mmuregs[reg] = val & env->def.mmu_ctpr_mask;
1027                 break;
1028             case 2: /* Context Register */
1029                 env->mmuregs[reg] = val & env->def.mmu_cxr_mask;
1030                 if (oldreg != env->mmuregs[reg]) {
1031                     /* we flush when the MMU context changes because
1032                        QEMU has no MMU context support */
1033                     tlb_flush(cs);
1034                 }
1035                 break;
1036             case 3: /* Synchronous Fault Status Register with Clear */
1037             case 4: /* Synchronous Fault Address Register */
1038                 break;
1039             case 0x10: /* TLB Replacement Control Register */
1040                 env->mmuregs[reg] = val & env->def.mmu_trcr_mask;
1041                 break;
1042             case 0x13: /* Synchronous Fault Status Register with Read
1043                           and Clear */
1044                 env->mmuregs[3] = val & env->def.mmu_sfsr_mask;
1045                 break;
1046             case 0x14: /* Synchronous Fault Address Register */
1047                 env->mmuregs[4] = val;
1048                 break;
1049             default:
1050                 env->mmuregs[reg] = val;
1051                 break;
1052             }
1053             if (oldreg != env->mmuregs[reg]) {
1054                 DPRINTF_MMU("mmu change reg[%d]: 0x%08x -> 0x%08x\n",
1055                             reg, oldreg, env->mmuregs[reg]);
1056             }
1057 #ifdef DEBUG_MMU
1058             dump_mmu(env);
1059 #endif
1060         }
1061         break;
1062     case ASI_M_TLBDIAG: /* Turbosparc ITLB Diagnostic */
1063     case ASI_M_DIAGS:   /* Turbosparc DTLB Diagnostic */
1064     case ASI_M_IODIAG:  /* Turbosparc IOTLB Diagnostic */
1065         break;
1066     case ASI_M_TXTC_TAG:   /* I-cache tag */
1067     case ASI_M_TXTC_DATA:  /* I-cache data */
1068     case ASI_M_DATAC_TAG:  /* D-cache tag */
1069     case ASI_M_DATAC_DATA: /* D-cache data */
1070     case ASI_M_FLUSH_PAGE:   /* I/D-cache flush page */
1071     case ASI_M_FLUSH_SEG:    /* I/D-cache flush segment */
1072     case ASI_M_FLUSH_REGION: /* I/D-cache flush region */
1073     case ASI_M_FLUSH_CTX:    /* I/D-cache flush context */
1074     case ASI_M_FLUSH_USER:   /* I/D-cache flush user */
1075         break;
1076     case 0x21 ... 0x2f: /* MMU passthrough, 0x100000000 to 0xfffffffff */
1077         {
1078             MemTxResult result;
1079             hwaddr access_addr = (hwaddr)addr | ((hwaddr)(asi & 0xf) << 32);
1080 
1081             switch (size) {
1082             case 1:
1083                 address_space_stb(cs->as, access_addr, val,
1084                                   MEMTXATTRS_UNSPECIFIED, &result);
1085                 break;
1086             case 2:
1087                 address_space_stw(cs->as, access_addr, val,
1088                                   MEMTXATTRS_UNSPECIFIED, &result);
1089                 break;
1090             case 4:
1091             default:
1092                 address_space_stl(cs->as, access_addr, val,
1093                                   MEMTXATTRS_UNSPECIFIED, &result);
1094                 break;
1095             case 8:
1096                 address_space_stq(cs->as, access_addr, val,
1097                                   MEMTXATTRS_UNSPECIFIED, &result);
1098                 break;
1099             }
1100             if (result != MEMTX_OK) {
1101                 sparc_raise_mmu_fault(cs, access_addr, true, false, false,
1102                                       size, GETPC());
1103             }
1104         }
1105         break;
1106     case 0x30: /* store buffer tags or Turbosparc secondary cache diagnostic */
1107     case 0x31: /* store buffer data, Ross RT620 I-cache flush or
1108                   Turbosparc snoop RAM */
1109     case 0x32: /* store buffer control or Turbosparc page table
1110                   descriptor diagnostic */
1111     case 0x36: /* I-cache flash clear */
1112     case 0x37: /* D-cache flash clear */
1113         break;
1114     case 0x38: /* SuperSPARC MMU Breakpoint Control Registers*/
1115         {
1116             int reg = (addr >> 8) & 3;
1117 
1118             switch (reg) {
1119             case 0: /* Breakpoint Value (Addr) */
1120                 env->mmubpregs[reg] = (val & 0xfffffffffULL);
1121                 break;
1122             case 1: /* Breakpoint Mask */
1123                 env->mmubpregs[reg] = (val & 0xfffffffffULL);
1124                 break;
1125             case 2: /* Breakpoint Control */
1126                 env->mmubpregs[reg] = (val & 0x7fULL);
1127                 break;
1128             case 3: /* Breakpoint Status */
1129                 env->mmubpregs[reg] = (val & 0xfULL);
1130                 break;
1131             }
1132             DPRINTF_MMU("write breakpoint reg[%d] 0x%016x\n", reg,
1133                         env->mmuregs[reg]);
1134         }
1135         break;
1136     case 0x49: /* SuperSPARC MMU Counter Breakpoint Value */
1137         env->mmubpctrv = val & 0xffffffff;
1138         break;
1139     case 0x4a: /* SuperSPARC MMU Counter Breakpoint Control */
1140         env->mmubpctrc = val & 0x3;
1141         break;
1142     case 0x4b: /* SuperSPARC MMU Counter Breakpoint Status */
1143         env->mmubpctrs = val & 0x3;
1144         break;
1145     case 0x4c: /* SuperSPARC MMU Breakpoint Action */
1146         env->mmubpaction = val & 0x1fff;
1147         break;
1148     case ASI_USERTXT: /* User code access, XXX */
1149     case ASI_KERNELTXT: /* Supervisor code access, XXX */
1150     default:
1151         sparc_raise_mmu_fault(cs, addr, true, false, asi, size, GETPC());
1152         break;
1153 
1154     case ASI_USERDATA: /* User data access */
1155     case ASI_KERNELDATA: /* Supervisor data access */
1156     case ASI_P:
1157     case ASI_M_BYPASS:    /* MMU passthrough */
1158     case ASI_LEON_BYPASS: /* LEON MMU passthrough */
1159     case ASI_M_BCOPY: /* Block copy, sta access */
1160     case ASI_M_BFILL: /* Block fill, stda access */
1161         /* These are always handled inline.  */
1162         g_assert_not_reached();
1163     }
1164 #ifdef DEBUG_ASI
1165     dump_asi("write", addr, asi, size, val);
1166 #endif
1167 }
1168 
1169 #endif /* CONFIG_USER_ONLY */
1170 #else /* TARGET_SPARC64 */
1171 
1172 #ifdef CONFIG_USER_ONLY
1173 uint64_t helper_ld_asi(CPUSPARCState *env, target_ulong addr,
1174                        int asi, uint32_t memop)
1175 {
1176     int size = 1 << (memop & MO_SIZE);
1177     int sign = memop & MO_SIGN;
1178     uint64_t ret = 0;
1179 
1180     if (asi < 0x80) {
1181         cpu_raise_exception_ra(env, TT_PRIV_ACT, GETPC());
1182     }
1183     do_check_align(env, addr, size - 1, GETPC());
1184     addr = asi_address_mask(env, asi, addr);
1185 
1186     switch (asi) {
1187     case ASI_PNF:  /* Primary no-fault */
1188     case ASI_PNFL: /* Primary no-fault LE */
1189     case ASI_SNF:  /* Secondary no-fault */
1190     case ASI_SNFL: /* Secondary no-fault LE */
1191         if (page_check_range(addr, size, PAGE_READ) == -1) {
1192             ret = 0;
1193             break;
1194         }
1195         switch (size) {
1196         case 1:
1197             ret = cpu_ldub_data(env, addr);
1198             break;
1199         case 2:
1200             ret = cpu_lduw_data(env, addr);
1201             break;
1202         case 4:
1203             ret = cpu_ldl_data(env, addr);
1204             break;
1205         case 8:
1206             ret = cpu_ldq_data(env, addr);
1207             break;
1208         default:
1209             g_assert_not_reached();
1210         }
1211         break;
1212         break;
1213 
1214     case ASI_P: /* Primary */
1215     case ASI_PL: /* Primary LE */
1216     case ASI_S:  /* Secondary */
1217     case ASI_SL: /* Secondary LE */
1218         /* These are always handled inline.  */
1219         g_assert_not_reached();
1220 
1221     default:
1222         cpu_raise_exception_ra(env, TT_DATA_ACCESS, GETPC());
1223     }
1224 
1225     /* Convert from little endian */
1226     switch (asi) {
1227     case ASI_PNFL: /* Primary no-fault LE */
1228     case ASI_SNFL: /* Secondary no-fault LE */
1229         switch (size) {
1230         case 2:
1231             ret = bswap16(ret);
1232             break;
1233         case 4:
1234             ret = bswap32(ret);
1235             break;
1236         case 8:
1237             ret = bswap64(ret);
1238             break;
1239         }
1240     }
1241 
1242     /* Convert to signed number */
1243     if (sign) {
1244         switch (size) {
1245         case 1:
1246             ret = (int8_t) ret;
1247             break;
1248         case 2:
1249             ret = (int16_t) ret;
1250             break;
1251         case 4:
1252             ret = (int32_t) ret;
1253             break;
1254         }
1255     }
1256 #ifdef DEBUG_ASI
1257     dump_asi("read", addr, asi, size, ret);
1258 #endif
1259     return ret;
1260 }
1261 
1262 void helper_st_asi(CPUSPARCState *env, target_ulong addr, target_ulong val,
1263                    int asi, uint32_t memop)
1264 {
1265     int size = 1 << (memop & MO_SIZE);
1266 #ifdef DEBUG_ASI
1267     dump_asi("write", addr, asi, size, val);
1268 #endif
1269     if (asi < 0x80) {
1270         cpu_raise_exception_ra(env, TT_PRIV_ACT, GETPC());
1271     }
1272     do_check_align(env, addr, size - 1, GETPC());
1273 
1274     switch (asi) {
1275     case ASI_P:  /* Primary */
1276     case ASI_PL: /* Primary LE */
1277     case ASI_S:  /* Secondary */
1278     case ASI_SL: /* Secondary LE */
1279         /* These are always handled inline.  */
1280         g_assert_not_reached();
1281 
1282     case ASI_PNF:  /* Primary no-fault, RO */
1283     case ASI_SNF:  /* Secondary no-fault, RO */
1284     case ASI_PNFL: /* Primary no-fault LE, RO */
1285     case ASI_SNFL: /* Secondary no-fault LE, RO */
1286     default:
1287         cpu_raise_exception_ra(env, TT_DATA_ACCESS, GETPC());
1288     }
1289 }
1290 
1291 #else /* CONFIG_USER_ONLY */
1292 
1293 uint64_t helper_ld_asi(CPUSPARCState *env, target_ulong addr,
1294                        int asi, uint32_t memop)
1295 {
1296     int size = 1 << (memop & MO_SIZE);
1297     int sign = memop & MO_SIGN;
1298     CPUState *cs = env_cpu(env);
1299     uint64_t ret = 0;
1300 #if defined(DEBUG_ASI)
1301     target_ulong last_addr = addr;
1302 #endif
1303 
1304     asi &= 0xff;
1305 
1306     do_check_asi(env, asi, GETPC());
1307     do_check_align(env, addr, size - 1, GETPC());
1308     addr = asi_address_mask(env, asi, addr);
1309 
1310     switch (asi) {
1311     case ASI_PNF:
1312     case ASI_PNFL:
1313     case ASI_SNF:
1314     case ASI_SNFL:
1315         {
1316             MemOpIdx oi;
1317             int idx = (env->pstate & PS_PRIV
1318                        ? (asi & 1 ? MMU_KERNEL_SECONDARY_IDX : MMU_KERNEL_IDX)
1319                        : (asi & 1 ? MMU_USER_SECONDARY_IDX : MMU_USER_IDX));
1320 
1321             if (cpu_get_phys_page_nofault(env, addr, idx) == -1ULL) {
1322 #ifdef DEBUG_ASI
1323                 dump_asi("read ", last_addr, asi, size, ret);
1324 #endif
1325                 /* exception_index is set in get_physical_address_data. */
1326                 cpu_raise_exception_ra(env, cs->exception_index, GETPC());
1327             }
1328             oi = make_memop_idx(memop, idx);
1329             switch (size) {
1330             case 1:
1331                 ret = cpu_ldb_mmu(env, addr, oi, GETPC());
1332                 break;
1333             case 2:
1334                 if (asi & 8) {
1335                     ret = cpu_ldw_le_mmu(env, addr, oi, GETPC());
1336                 } else {
1337                     ret = cpu_ldw_be_mmu(env, addr, oi, GETPC());
1338                 }
1339                 break;
1340             case 4:
1341                 if (asi & 8) {
1342                     ret = cpu_ldl_le_mmu(env, addr, oi, GETPC());
1343                 } else {
1344                     ret = cpu_ldl_be_mmu(env, addr, oi, GETPC());
1345                 }
1346                 break;
1347             case 8:
1348                 if (asi & 8) {
1349                     ret = cpu_ldq_le_mmu(env, addr, oi, GETPC());
1350                 } else {
1351                     ret = cpu_ldq_be_mmu(env, addr, oi, GETPC());
1352                 }
1353                 break;
1354             default:
1355                 g_assert_not_reached();
1356             }
1357         }
1358         break;
1359 
1360     case ASI_AIUP:  /* As if user primary */
1361     case ASI_AIUS:  /* As if user secondary */
1362     case ASI_AIUPL: /* As if user primary LE */
1363     case ASI_AIUSL: /* As if user secondary LE */
1364     case ASI_P:  /* Primary */
1365     case ASI_S:  /* Secondary */
1366     case ASI_PL: /* Primary LE */
1367     case ASI_SL: /* Secondary LE */
1368     case ASI_REAL:      /* Bypass */
1369     case ASI_REAL_IO:   /* Bypass, non-cacheable */
1370     case ASI_REAL_L:    /* Bypass LE */
1371     case ASI_REAL_IO_L: /* Bypass, non-cacheable LE */
1372     case ASI_N:  /* Nucleus */
1373     case ASI_NL: /* Nucleus Little Endian (LE) */
1374     case ASI_NUCLEUS_QUAD_LDD:   /* Nucleus quad LDD 128 bit atomic */
1375     case ASI_NUCLEUS_QUAD_LDD_L: /* Nucleus quad LDD 128 bit atomic LE */
1376     case ASI_TWINX_AIUP:   /* As if user primary, twinx */
1377     case ASI_TWINX_AIUS:   /* As if user secondary, twinx */
1378     case ASI_TWINX_REAL:   /* Real address, twinx */
1379     case ASI_TWINX_AIUP_L: /* As if user primary, twinx, LE */
1380     case ASI_TWINX_AIUS_L: /* As if user secondary, twinx, LE */
1381     case ASI_TWINX_REAL_L: /* Real address, twinx, LE */
1382     case ASI_TWINX_N:  /* Nucleus, twinx */
1383     case ASI_TWINX_NL: /* Nucleus, twinx, LE */
1384     /* ??? From the UA2011 document; overlaps BLK_INIT_QUAD_LDD_* */
1385     case ASI_TWINX_P:  /* Primary, twinx */
1386     case ASI_TWINX_PL: /* Primary, twinx, LE */
1387     case ASI_TWINX_S:  /* Secondary, twinx */
1388     case ASI_TWINX_SL: /* Secondary, twinx, LE */
1389         /* These are always handled inline.  */
1390         g_assert_not_reached();
1391 
1392     case ASI_UPA_CONFIG: /* UPA config */
1393         /* XXX */
1394         break;
1395     case ASI_LSU_CONTROL: /* LSU */
1396         ret = env->lsu;
1397         break;
1398     case ASI_IMMU: /* I-MMU regs */
1399         {
1400             int reg = (addr >> 3) & 0xf;
1401             switch (reg) {
1402             case 0:
1403                 /* 0x00 I-TSB Tag Target register */
1404                 ret = ultrasparc_tag_target(env->immu.tag_access);
1405                 break;
1406             case 3: /* SFSR */
1407                 ret = env->immu.sfsr;
1408                 break;
1409             case 5: /* TSB access */
1410                 ret = env->immu.tsb;
1411                 break;
1412             case 6:
1413                 /* 0x30 I-TSB Tag Access register */
1414                 ret = env->immu.tag_access;
1415                 break;
1416             default:
1417                 sparc_raise_mmu_fault(cs, addr, false, false, 1, size, GETPC());
1418                 ret = 0;
1419             }
1420             break;
1421         }
1422     case ASI_IMMU_TSB_8KB_PTR: /* I-MMU 8k TSB pointer */
1423         {
1424             /* env->immuregs[5] holds I-MMU TSB register value
1425                env->immuregs[6] holds I-MMU Tag Access register value */
1426             ret = ultrasparc_tsb_pointer(env, &env->immu, 0);
1427             break;
1428         }
1429     case ASI_IMMU_TSB_64KB_PTR: /* I-MMU 64k TSB pointer */
1430         {
1431             /* env->immuregs[5] holds I-MMU TSB register value
1432                env->immuregs[6] holds I-MMU Tag Access register value */
1433             ret = ultrasparc_tsb_pointer(env, &env->immu, 1);
1434             break;
1435         }
1436     case ASI_ITLB_DATA_ACCESS: /* I-MMU data access */
1437         {
1438             int reg = (addr >> 3) & 0x3f;
1439 
1440             ret = env->itlb[reg].tte;
1441             break;
1442         }
1443     case ASI_ITLB_TAG_READ: /* I-MMU tag read */
1444         {
1445             int reg = (addr >> 3) & 0x3f;
1446 
1447             ret = env->itlb[reg].tag;
1448             break;
1449         }
1450     case ASI_DMMU: /* D-MMU regs */
1451         {
1452             int reg = (addr >> 3) & 0xf;
1453             switch (reg) {
1454             case 0:
1455                 /* 0x00 D-TSB Tag Target register */
1456                 ret = ultrasparc_tag_target(env->dmmu.tag_access);
1457                 break;
1458             case 1: /* 0x08 Primary Context */
1459                 ret = env->dmmu.mmu_primary_context;
1460                 break;
1461             case 2: /* 0x10 Secondary Context */
1462                 ret = env->dmmu.mmu_secondary_context;
1463                 break;
1464             case 3: /* SFSR */
1465                 ret = env->dmmu.sfsr;
1466                 break;
1467             case 4: /* 0x20 SFAR */
1468                 ret = env->dmmu.sfar;
1469                 break;
1470             case 5: /* 0x28 TSB access */
1471                 ret = env->dmmu.tsb;
1472                 break;
1473             case 6: /* 0x30 D-TSB Tag Access register */
1474                 ret = env->dmmu.tag_access;
1475                 break;
1476             case 7:
1477                 ret = env->dmmu.virtual_watchpoint;
1478                 break;
1479             case 8:
1480                 ret = env->dmmu.physical_watchpoint;
1481                 break;
1482             default:
1483                 sparc_raise_mmu_fault(cs, addr, false, false, 1, size, GETPC());
1484                 ret = 0;
1485             }
1486             break;
1487         }
1488     case ASI_DMMU_TSB_8KB_PTR: /* D-MMU 8k TSB pointer */
1489         {
1490             /* env->dmmuregs[5] holds D-MMU TSB register value
1491                env->dmmuregs[6] holds D-MMU Tag Access register value */
1492             ret = ultrasparc_tsb_pointer(env, &env->dmmu, 0);
1493             break;
1494         }
1495     case ASI_DMMU_TSB_64KB_PTR: /* D-MMU 64k TSB pointer */
1496         {
1497             /* env->dmmuregs[5] holds D-MMU TSB register value
1498                env->dmmuregs[6] holds D-MMU Tag Access register value */
1499             ret = ultrasparc_tsb_pointer(env, &env->dmmu, 1);
1500             break;
1501         }
1502     case ASI_DTLB_DATA_ACCESS: /* D-MMU data access */
1503         {
1504             int reg = (addr >> 3) & 0x3f;
1505 
1506             ret = env->dtlb[reg].tte;
1507             break;
1508         }
1509     case ASI_DTLB_TAG_READ: /* D-MMU tag read */
1510         {
1511             int reg = (addr >> 3) & 0x3f;
1512 
1513             ret = env->dtlb[reg].tag;
1514             break;
1515         }
1516     case ASI_INTR_DISPATCH_STAT: /* Interrupt dispatch, RO */
1517         break;
1518     case ASI_INTR_RECEIVE: /* Interrupt data receive */
1519         ret = env->ivec_status;
1520         break;
1521     case ASI_INTR_R: /* Incoming interrupt vector, RO */
1522         {
1523             int reg = (addr >> 4) & 0x3;
1524             if (reg < 3) {
1525                 ret = env->ivec_data[reg];
1526             }
1527             break;
1528         }
1529     case ASI_SCRATCHPAD: /* UA2005 privileged scratchpad */
1530         if (unlikely((addr >= 0x20) && (addr < 0x30))) {
1531             /* Hyperprivileged access only */
1532             sparc_raise_mmu_fault(cs, addr, false, false, 1, size, GETPC());
1533         }
1534         /* fall through */
1535     case ASI_HYP_SCRATCHPAD: /* UA2005 hyperprivileged scratchpad */
1536         {
1537             unsigned int i = (addr >> 3) & 0x7;
1538             ret = env->scratch[i];
1539             break;
1540         }
1541     case ASI_MMU: /* UA2005 Context ID registers */
1542         switch ((addr >> 3) & 0x3) {
1543         case 1:
1544             ret = env->dmmu.mmu_primary_context;
1545             break;
1546         case 2:
1547             ret = env->dmmu.mmu_secondary_context;
1548             break;
1549         default:
1550           sparc_raise_mmu_fault(cs, addr, true, false, 1, size, GETPC());
1551         }
1552         break;
1553     case ASI_DCACHE_DATA:     /* D-cache data */
1554     case ASI_DCACHE_TAG:      /* D-cache tag access */
1555     case ASI_ESTATE_ERROR_EN: /* E-cache error enable */
1556     case ASI_AFSR:            /* E-cache asynchronous fault status */
1557     case ASI_AFAR:            /* E-cache asynchronous fault address */
1558     case ASI_EC_TAG_DATA:     /* E-cache tag data */
1559     case ASI_IC_INSTR:        /* I-cache instruction access */
1560     case ASI_IC_TAG:          /* I-cache tag access */
1561     case ASI_IC_PRE_DECODE:   /* I-cache predecode */
1562     case ASI_IC_NEXT_FIELD:   /* I-cache LRU etc. */
1563     case ASI_EC_W:            /* E-cache tag */
1564     case ASI_EC_R:            /* E-cache tag */
1565         break;
1566     case ASI_DMMU_TSB_DIRECT_PTR: /* D-MMU data pointer */
1567     case ASI_ITLB_DATA_IN:        /* I-MMU data in, WO */
1568     case ASI_IMMU_DEMAP:          /* I-MMU demap, WO */
1569     case ASI_DTLB_DATA_IN:        /* D-MMU data in, WO */
1570     case ASI_DMMU_DEMAP:          /* D-MMU demap, WO */
1571     case ASI_INTR_W:              /* Interrupt vector, WO */
1572     default:
1573         sparc_raise_mmu_fault(cs, addr, false, false, 1, size, GETPC());
1574         ret = 0;
1575         break;
1576     }
1577 
1578     /* Convert to signed number */
1579     if (sign) {
1580         switch (size) {
1581         case 1:
1582             ret = (int8_t) ret;
1583             break;
1584         case 2:
1585             ret = (int16_t) ret;
1586             break;
1587         case 4:
1588             ret = (int32_t) ret;
1589             break;
1590         default:
1591             break;
1592         }
1593     }
1594 #ifdef DEBUG_ASI
1595     dump_asi("read ", last_addr, asi, size, ret);
1596 #endif
1597     return ret;
1598 }
1599 
1600 void helper_st_asi(CPUSPARCState *env, target_ulong addr, target_ulong val,
1601                    int asi, uint32_t memop)
1602 {
1603     int size = 1 << (memop & MO_SIZE);
1604     CPUState *cs = env_cpu(env);
1605 
1606 #ifdef DEBUG_ASI
1607     dump_asi("write", addr, asi, size, val);
1608 #endif
1609 
1610     asi &= 0xff;
1611 
1612     do_check_asi(env, asi, GETPC());
1613     do_check_align(env, addr, size - 1, GETPC());
1614     addr = asi_address_mask(env, asi, addr);
1615 
1616     switch (asi) {
1617     case ASI_AIUP:  /* As if user primary */
1618     case ASI_AIUS:  /* As if user secondary */
1619     case ASI_AIUPL: /* As if user primary LE */
1620     case ASI_AIUSL: /* As if user secondary LE */
1621     case ASI_P:  /* Primary */
1622     case ASI_S:  /* Secondary */
1623     case ASI_PL: /* Primary LE */
1624     case ASI_SL: /* Secondary LE */
1625     case ASI_REAL:      /* Bypass */
1626     case ASI_REAL_IO:   /* Bypass, non-cacheable */
1627     case ASI_REAL_L:    /* Bypass LE */
1628     case ASI_REAL_IO_L: /* Bypass, non-cacheable LE */
1629     case ASI_N:  /* Nucleus */
1630     case ASI_NL: /* Nucleus Little Endian (LE) */
1631     case ASI_NUCLEUS_QUAD_LDD:   /* Nucleus quad LDD 128 bit atomic */
1632     case ASI_NUCLEUS_QUAD_LDD_L: /* Nucleus quad LDD 128 bit atomic LE */
1633     case ASI_TWINX_AIUP:   /* As if user primary, twinx */
1634     case ASI_TWINX_AIUS:   /* As if user secondary, twinx */
1635     case ASI_TWINX_REAL:   /* Real address, twinx */
1636     case ASI_TWINX_AIUP_L: /* As if user primary, twinx, LE */
1637     case ASI_TWINX_AIUS_L: /* As if user secondary, twinx, LE */
1638     case ASI_TWINX_REAL_L: /* Real address, twinx, LE */
1639     case ASI_TWINX_N:  /* Nucleus, twinx */
1640     case ASI_TWINX_NL: /* Nucleus, twinx, LE */
1641     /* ??? From the UA2011 document; overlaps BLK_INIT_QUAD_LDD_* */
1642     case ASI_TWINX_P:  /* Primary, twinx */
1643     case ASI_TWINX_PL: /* Primary, twinx, LE */
1644     case ASI_TWINX_S:  /* Secondary, twinx */
1645     case ASI_TWINX_SL: /* Secondary, twinx, LE */
1646         /* These are always handled inline.  */
1647         g_assert_not_reached();
1648     /* these ASIs have different functions on UltraSPARC-IIIi
1649      * and UA2005 CPUs. Use the explicit numbers to avoid confusion
1650      */
1651     case 0x31:
1652     case 0x32:
1653     case 0x39:
1654     case 0x3a:
1655         if (cpu_has_hypervisor(env)) {
1656             /* UA2005
1657              * ASI_DMMU_CTX_ZERO_TSB_BASE_PS0
1658              * ASI_DMMU_CTX_ZERO_TSB_BASE_PS1
1659              * ASI_DMMU_CTX_NONZERO_TSB_BASE_PS0
1660              * ASI_DMMU_CTX_NONZERO_TSB_BASE_PS1
1661              */
1662             int idx = ((asi & 2) >> 1) | ((asi & 8) >> 2);
1663             env->dmmu.sun4v_tsb_pointers[idx] = val;
1664         } else {
1665             helper_raise_exception(env, TT_ILL_INSN);
1666         }
1667         break;
1668     case 0x33:
1669     case 0x3b:
1670         if (cpu_has_hypervisor(env)) {
1671             /* UA2005
1672              * ASI_DMMU_CTX_ZERO_CONFIG
1673              * ASI_DMMU_CTX_NONZERO_CONFIG
1674              */
1675             env->dmmu.sun4v_ctx_config[(asi & 8) >> 3] = val;
1676         } else {
1677             helper_raise_exception(env, TT_ILL_INSN);
1678         }
1679         break;
1680     case 0x35:
1681     case 0x36:
1682     case 0x3d:
1683     case 0x3e:
1684         if (cpu_has_hypervisor(env)) {
1685             /* UA2005
1686              * ASI_IMMU_CTX_ZERO_TSB_BASE_PS0
1687              * ASI_IMMU_CTX_ZERO_TSB_BASE_PS1
1688              * ASI_IMMU_CTX_NONZERO_TSB_BASE_PS0
1689              * ASI_IMMU_CTX_NONZERO_TSB_BASE_PS1
1690              */
1691             int idx = ((asi & 2) >> 1) | ((asi & 8) >> 2);
1692             env->immu.sun4v_tsb_pointers[idx] = val;
1693         } else {
1694             helper_raise_exception(env, TT_ILL_INSN);
1695         }
1696       break;
1697     case 0x37:
1698     case 0x3f:
1699         if (cpu_has_hypervisor(env)) {
1700             /* UA2005
1701              * ASI_IMMU_CTX_ZERO_CONFIG
1702              * ASI_IMMU_CTX_NONZERO_CONFIG
1703              */
1704             env->immu.sun4v_ctx_config[(asi & 8) >> 3] = val;
1705         } else {
1706           helper_raise_exception(env, TT_ILL_INSN);
1707         }
1708         break;
1709     case ASI_UPA_CONFIG: /* UPA config */
1710         /* XXX */
1711         return;
1712     case ASI_LSU_CONTROL: /* LSU */
1713         env->lsu = val & (DMMU_E | IMMU_E);
1714         return;
1715     case ASI_IMMU: /* I-MMU regs */
1716         {
1717             int reg = (addr >> 3) & 0xf;
1718             uint64_t oldreg;
1719 
1720             oldreg = env->immu.mmuregs[reg];
1721             switch (reg) {
1722             case 0: /* RO */
1723                 return;
1724             case 1: /* Not in I-MMU */
1725             case 2:
1726                 return;
1727             case 3: /* SFSR */
1728                 if ((val & 1) == 0) {
1729                     val = 0; /* Clear SFSR */
1730                 }
1731                 env->immu.sfsr = val;
1732                 break;
1733             case 4: /* RO */
1734                 return;
1735             case 5: /* TSB access */
1736                 DPRINTF_MMU("immu TSB write: 0x%016" PRIx64 " -> 0x%016"
1737                             PRIx64 "\n", env->immu.tsb, val);
1738                 env->immu.tsb = val;
1739                 break;
1740             case 6: /* Tag access */
1741                 env->immu.tag_access = val;
1742                 break;
1743             case 7:
1744             case 8:
1745                 return;
1746             default:
1747                 sparc_raise_mmu_fault(cs, addr, true, false, 1, size, GETPC());
1748                 break;
1749             }
1750 
1751             if (oldreg != env->immu.mmuregs[reg]) {
1752                 DPRINTF_MMU("immu change reg[%d]: 0x%016" PRIx64 " -> 0x%016"
1753                             PRIx64 "\n", reg, oldreg, env->immuregs[reg]);
1754             }
1755 #ifdef DEBUG_MMU
1756             dump_mmu(env);
1757 #endif
1758             return;
1759         }
1760     case ASI_ITLB_DATA_IN: /* I-MMU data in */
1761         /* ignore real translation entries */
1762         if (!(addr & TLB_UST1_IS_REAL_BIT)) {
1763             replace_tlb_1bit_lru(env->itlb, env->immu.tag_access,
1764                                  val, "immu", env, addr);
1765         }
1766         return;
1767     case ASI_ITLB_DATA_ACCESS: /* I-MMU data access */
1768         {
1769             /* TODO: auto demap */
1770 
1771             unsigned int i = (addr >> 3) & 0x3f;
1772 
1773             /* ignore real translation entries */
1774             if (!(addr & TLB_UST1_IS_REAL_BIT)) {
1775                 replace_tlb_entry(&env->itlb[i], env->immu.tag_access,
1776                                   sun4v_tte_to_sun4u(env, addr, val), env);
1777             }
1778 #ifdef DEBUG_MMU
1779             DPRINTF_MMU("immu data access replaced entry [%i]\n", i);
1780             dump_mmu(env);
1781 #endif
1782             return;
1783         }
1784     case ASI_IMMU_DEMAP: /* I-MMU demap */
1785         demap_tlb(env->itlb, addr, "immu", env);
1786         return;
1787     case ASI_DMMU: /* D-MMU regs */
1788         {
1789             int reg = (addr >> 3) & 0xf;
1790             uint64_t oldreg;
1791 
1792             oldreg = env->dmmu.mmuregs[reg];
1793             switch (reg) {
1794             case 0: /* RO */
1795             case 4:
1796                 return;
1797             case 3: /* SFSR */
1798                 if ((val & 1) == 0) {
1799                     val = 0; /* Clear SFSR, Fault address */
1800                     env->dmmu.sfar = 0;
1801                 }
1802                 env->dmmu.sfsr = val;
1803                 break;
1804             case 1: /* Primary context */
1805                 env->dmmu.mmu_primary_context = val;
1806                 /* can be optimized to only flush MMU_USER_IDX
1807                    and MMU_KERNEL_IDX entries */
1808                 tlb_flush(cs);
1809                 break;
1810             case 2: /* Secondary context */
1811                 env->dmmu.mmu_secondary_context = val;
1812                 /* can be optimized to only flush MMU_USER_SECONDARY_IDX
1813                    and MMU_KERNEL_SECONDARY_IDX entries */
1814                 tlb_flush(cs);
1815                 break;
1816             case 5: /* TSB access */
1817                 DPRINTF_MMU("dmmu TSB write: 0x%016" PRIx64 " -> 0x%016"
1818                             PRIx64 "\n", env->dmmu.tsb, val);
1819                 env->dmmu.tsb = val;
1820                 break;
1821             case 6: /* Tag access */
1822                 env->dmmu.tag_access = val;
1823                 break;
1824             case 7: /* Virtual Watchpoint */
1825                 env->dmmu.virtual_watchpoint = val;
1826                 break;
1827             case 8: /* Physical Watchpoint */
1828                 env->dmmu.physical_watchpoint = val;
1829                 break;
1830             default:
1831                 sparc_raise_mmu_fault(cs, addr, true, false, 1, size, GETPC());
1832                 break;
1833             }
1834 
1835             if (oldreg != env->dmmu.mmuregs[reg]) {
1836                 DPRINTF_MMU("dmmu change reg[%d]: 0x%016" PRIx64 " -> 0x%016"
1837                             PRIx64 "\n", reg, oldreg, env->dmmuregs[reg]);
1838             }
1839 #ifdef DEBUG_MMU
1840             dump_mmu(env);
1841 #endif
1842             return;
1843         }
1844     case ASI_DTLB_DATA_IN: /* D-MMU data in */
1845       /* ignore real translation entries */
1846       if (!(addr & TLB_UST1_IS_REAL_BIT)) {
1847           replace_tlb_1bit_lru(env->dtlb, env->dmmu.tag_access,
1848                                val, "dmmu", env, addr);
1849       }
1850       return;
1851     case ASI_DTLB_DATA_ACCESS: /* D-MMU data access */
1852         {
1853             unsigned int i = (addr >> 3) & 0x3f;
1854 
1855             /* ignore real translation entries */
1856             if (!(addr & TLB_UST1_IS_REAL_BIT)) {
1857                 replace_tlb_entry(&env->dtlb[i], env->dmmu.tag_access,
1858                                   sun4v_tte_to_sun4u(env, addr, val), env);
1859             }
1860 #ifdef DEBUG_MMU
1861             DPRINTF_MMU("dmmu data access replaced entry [%i]\n", i);
1862             dump_mmu(env);
1863 #endif
1864             return;
1865         }
1866     case ASI_DMMU_DEMAP: /* D-MMU demap */
1867         demap_tlb(env->dtlb, addr, "dmmu", env);
1868         return;
1869     case ASI_INTR_RECEIVE: /* Interrupt data receive */
1870         env->ivec_status = val & 0x20;
1871         return;
1872     case ASI_SCRATCHPAD: /* UA2005 privileged scratchpad */
1873         if (unlikely((addr >= 0x20) && (addr < 0x30))) {
1874             /* Hyperprivileged access only */
1875             sparc_raise_mmu_fault(cs, addr, true, false, 1, size, GETPC());
1876         }
1877         /* fall through */
1878     case ASI_HYP_SCRATCHPAD: /* UA2005 hyperprivileged scratchpad */
1879         {
1880             unsigned int i = (addr >> 3) & 0x7;
1881             env->scratch[i] = val;
1882             return;
1883         }
1884     case ASI_MMU: /* UA2005 Context ID registers */
1885         {
1886           switch ((addr >> 3) & 0x3) {
1887           case 1:
1888               env->dmmu.mmu_primary_context = val;
1889               env->immu.mmu_primary_context = val;
1890               tlb_flush_by_mmuidx(cs,
1891                                   (1 << MMU_USER_IDX) | (1 << MMU_KERNEL_IDX));
1892               break;
1893           case 2:
1894               env->dmmu.mmu_secondary_context = val;
1895               env->immu.mmu_secondary_context = val;
1896               tlb_flush_by_mmuidx(cs,
1897                                   (1 << MMU_USER_SECONDARY_IDX) |
1898                                   (1 << MMU_KERNEL_SECONDARY_IDX));
1899               break;
1900           default:
1901               sparc_raise_mmu_fault(cs, addr, true, false, 1, size, GETPC());
1902           }
1903         }
1904         return;
1905     case ASI_QUEUE: /* UA2005 CPU mondo queue */
1906     case ASI_DCACHE_DATA: /* D-cache data */
1907     case ASI_DCACHE_TAG: /* D-cache tag access */
1908     case ASI_ESTATE_ERROR_EN: /* E-cache error enable */
1909     case ASI_AFSR: /* E-cache asynchronous fault status */
1910     case ASI_AFAR: /* E-cache asynchronous fault address */
1911     case ASI_EC_TAG_DATA: /* E-cache tag data */
1912     case ASI_IC_INSTR: /* I-cache instruction access */
1913     case ASI_IC_TAG: /* I-cache tag access */
1914     case ASI_IC_PRE_DECODE: /* I-cache predecode */
1915     case ASI_IC_NEXT_FIELD: /* I-cache LRU etc. */
1916     case ASI_EC_W: /* E-cache tag */
1917     case ASI_EC_R: /* E-cache tag */
1918         return;
1919     case ASI_IMMU_TSB_8KB_PTR: /* I-MMU 8k TSB pointer, RO */
1920     case ASI_IMMU_TSB_64KB_PTR: /* I-MMU 64k TSB pointer, RO */
1921     case ASI_ITLB_TAG_READ: /* I-MMU tag read, RO */
1922     case ASI_DMMU_TSB_8KB_PTR: /* D-MMU 8k TSB pointer, RO */
1923     case ASI_DMMU_TSB_64KB_PTR: /* D-MMU 64k TSB pointer, RO */
1924     case ASI_DMMU_TSB_DIRECT_PTR: /* D-MMU data pointer, RO */
1925     case ASI_DTLB_TAG_READ: /* D-MMU tag read, RO */
1926     case ASI_INTR_DISPATCH_STAT: /* Interrupt dispatch, RO */
1927     case ASI_INTR_R: /* Incoming interrupt vector, RO */
1928     case ASI_PNF: /* Primary no-fault, RO */
1929     case ASI_SNF: /* Secondary no-fault, RO */
1930     case ASI_PNFL: /* Primary no-fault LE, RO */
1931     case ASI_SNFL: /* Secondary no-fault LE, RO */
1932     default:
1933         sparc_raise_mmu_fault(cs, addr, true, false, 1, size, GETPC());
1934         return;
1935     }
1936 }
1937 #endif /* CONFIG_USER_ONLY */
1938 #endif /* TARGET_SPARC64 */
1939 
1940 #if !defined(CONFIG_USER_ONLY)
1941 
1942 void sparc_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
1943                                      vaddr addr, unsigned size,
1944                                      MMUAccessType access_type,
1945                                      int mmu_idx, MemTxAttrs attrs,
1946                                      MemTxResult response, uintptr_t retaddr)
1947 {
1948     bool is_write = access_type == MMU_DATA_STORE;
1949     bool is_exec = access_type == MMU_INST_FETCH;
1950     bool is_asi = false;
1951 
1952     sparc_raise_mmu_fault(cs, physaddr, is_write, is_exec,
1953                           is_asi, size, retaddr);
1954 }
1955 #endif
1956