1 /* 2 * Microblaze MMU emulation for qemu. 3 * 4 * Copyright (c) 2009 Edgar E. Iglesias 5 * Copyright (c) 2009-2012 PetaLogix Qld Pty Ltd. 6 * 7 * This library is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU Lesser General Public 9 * License as published by the Free Software Foundation; either 10 * version 2 of the License, or (at your option) any later version. 11 * 12 * This library is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 * Lesser General Public License for more details. 16 * 17 * You should have received a copy of the GNU Lesser General Public 18 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 19 */ 20 21 #include "qemu/osdep.h" 22 #include "cpu.h" 23 #include "exec/exec-all.h" 24 25 static unsigned int tlb_decode_size(unsigned int f) 26 { 27 static const unsigned int sizes[] = { 28 1 * 1024, 4 * 1024, 16 * 1024, 64 * 1024, 256 * 1024, 29 1 * 1024 * 1024, 4 * 1024 * 1024, 16 * 1024 * 1024 30 }; 31 assert(f < ARRAY_SIZE(sizes)); 32 return sizes[f]; 33 } 34 35 static void mmu_flush_idx(CPUMBState *env, unsigned int idx) 36 { 37 CPUState *cs = env_cpu(env); 38 struct microblaze_mmu *mmu = &env->mmu; 39 unsigned int tlb_size; 40 uint32_t tlb_tag, end, t; 41 42 t = mmu->rams[RAM_TAG][idx]; 43 if (!(t & TLB_VALID)) 44 return; 45 46 tlb_tag = t & TLB_EPN_MASK; 47 tlb_size = tlb_decode_size((t & TLB_PAGESZ_MASK) >> 7); 48 end = tlb_tag + tlb_size; 49 50 while (tlb_tag < end) { 51 tlb_flush_page(cs, tlb_tag); 52 tlb_tag += TARGET_PAGE_SIZE; 53 } 54 } 55 56 static void mmu_change_pid(CPUMBState *env, unsigned int newpid) 57 { 58 struct microblaze_mmu *mmu = &env->mmu; 59 unsigned int i; 60 uint32_t t; 61 62 if (newpid & ~0xff) 63 qemu_log_mask(LOG_GUEST_ERROR, "Illegal rpid=%x\n", newpid); 64 65 for (i = 0; i < ARRAY_SIZE(mmu->rams[RAM_TAG]); i++) { 66 /* Lookup and decode. */ 67 t = mmu->rams[RAM_TAG][i]; 68 if (t & TLB_VALID) { 69 if (mmu->tids[i] && ((mmu->regs[MMU_R_PID] & 0xff) == mmu->tids[i])) 70 mmu_flush_idx(env, i); 71 } 72 } 73 } 74 75 /* rw - 0 = read, 1 = write, 2 = fetch. */ 76 unsigned int mmu_translate(struct microblaze_mmu *mmu, 77 struct microblaze_mmu_lookup *lu, 78 target_ulong vaddr, int rw, int mmu_idx) 79 { 80 unsigned int i, hit = 0; 81 unsigned int tlb_ex = 0, tlb_wr = 0, tlb_zsel; 82 uint64_t tlb_tag, tlb_rpn, mask; 83 uint32_t tlb_size, t0; 84 85 lu->err = ERR_MISS; 86 for (i = 0; i < ARRAY_SIZE(mmu->rams[RAM_TAG]); i++) { 87 uint64_t t, d; 88 89 /* Lookup and decode. */ 90 t = mmu->rams[RAM_TAG][i]; 91 if (t & TLB_VALID) { 92 tlb_size = tlb_decode_size((t & TLB_PAGESZ_MASK) >> 7); 93 if (tlb_size < TARGET_PAGE_SIZE) { 94 qemu_log_mask(LOG_UNIMP, "%d pages not supported\n", tlb_size); 95 abort(); 96 } 97 98 mask = ~((uint64_t)tlb_size - 1); 99 tlb_tag = t & TLB_EPN_MASK; 100 if ((vaddr & mask) != (tlb_tag & mask)) { 101 continue; 102 } 103 if (mmu->tids[i] 104 && ((mmu->regs[MMU_R_PID] & 0xff) != mmu->tids[i])) { 105 continue; 106 } 107 108 /* Bring in the data part. */ 109 d = mmu->rams[RAM_DATA][i]; 110 tlb_ex = d & TLB_EX; 111 tlb_wr = d & TLB_WR; 112 113 /* Now let's see if there is a zone that overrides the protbits. */ 114 tlb_zsel = (d >> 4) & 0xf; 115 t0 = mmu->regs[MMU_R_ZPR] >> (30 - (tlb_zsel * 2)); 116 t0 &= 0x3; 117 118 if (tlb_zsel > mmu->c_mmu_zones) { 119 qemu_log_mask(LOG_GUEST_ERROR, 120 "tlb zone select out of range! %d\n", tlb_zsel); 121 t0 = 1; /* Ignore. */ 122 } 123 124 if (mmu->c_mmu == 1) { 125 t0 = 1; /* Zones are disabled. */ 126 } 127 128 switch (t0) { 129 case 0: 130 if (mmu_idx == MMU_USER_IDX) 131 continue; 132 break; 133 case 2: 134 if (mmu_idx != MMU_USER_IDX) { 135 tlb_ex = 1; 136 tlb_wr = 1; 137 } 138 break; 139 case 3: 140 tlb_ex = 1; 141 tlb_wr = 1; 142 break; 143 default: break; 144 } 145 146 lu->err = ERR_PROT; 147 lu->prot = PAGE_READ; 148 if (tlb_wr) 149 lu->prot |= PAGE_WRITE; 150 else if (rw == 1) 151 goto done; 152 if (tlb_ex) 153 lu->prot |=PAGE_EXEC; 154 else if (rw == 2) { 155 goto done; 156 } 157 158 tlb_rpn = d & TLB_RPN_MASK; 159 160 lu->vaddr = tlb_tag; 161 lu->paddr = tlb_rpn & mmu->c_addr_mask; 162 lu->size = tlb_size; 163 lu->err = ERR_HIT; 164 lu->idx = i; 165 hit = 1; 166 goto done; 167 } 168 } 169 done: 170 qemu_log_mask(CPU_LOG_MMU, 171 "MMU vaddr=%" PRIx64 " rw=%d tlb_wr=%d tlb_ex=%d hit=%d\n", 172 vaddr, rw, tlb_wr, tlb_ex, hit); 173 return hit; 174 } 175 176 /* Writes/reads to the MMU's special regs end up here. */ 177 uint32_t mmu_read(CPUMBState *env, bool ext, uint32_t rn) 178 { 179 unsigned int i; 180 uint32_t r = 0; 181 182 if (env->mmu.c_mmu < 2 || !env->mmu.c_mmu_tlb_access) { 183 qemu_log_mask(LOG_GUEST_ERROR, "MMU access on MMU-less system\n"); 184 return 0; 185 } 186 if (ext && rn != MMU_R_TLBLO) { 187 qemu_log_mask(LOG_GUEST_ERROR, "Extended access only to TLBLO.\n"); 188 return 0; 189 } 190 191 switch (rn) { 192 /* Reads to HI/LO trig reads from the mmu rams. */ 193 case MMU_R_TLBLO: 194 case MMU_R_TLBHI: 195 if (!(env->mmu.c_mmu_tlb_access & 1)) { 196 qemu_log_mask(LOG_GUEST_ERROR, 197 "Invalid access to MMU reg %d\n", rn); 198 return 0; 199 } 200 201 i = env->mmu.regs[MMU_R_TLBX] & 0xff; 202 r = extract64(env->mmu.rams[rn & 1][i], ext * 32, 32); 203 if (rn == MMU_R_TLBHI) 204 env->mmu.regs[MMU_R_PID] = env->mmu.tids[i]; 205 break; 206 case MMU_R_PID: 207 case MMU_R_ZPR: 208 if (!(env->mmu.c_mmu_tlb_access & 1)) { 209 qemu_log_mask(LOG_GUEST_ERROR, 210 "Invalid access to MMU reg %d\n", rn); 211 return 0; 212 } 213 r = env->mmu.regs[rn]; 214 break; 215 case MMU_R_TLBX: 216 r = env->mmu.regs[rn]; 217 break; 218 case MMU_R_TLBSX: 219 qemu_log_mask(LOG_GUEST_ERROR, "TLBSX is write-only.\n"); 220 break; 221 default: 222 qemu_log_mask(LOG_GUEST_ERROR, "Invalid MMU register %d.\n", rn); 223 break; 224 } 225 qemu_log_mask(CPU_LOG_MMU, "%s rn=%d=%x\n", __func__, rn, r); 226 return r; 227 } 228 229 void mmu_write(CPUMBState *env, bool ext, uint32_t rn, uint32_t v) 230 { 231 uint64_t tmp64; 232 unsigned int i; 233 qemu_log_mask(CPU_LOG_MMU, 234 "%s rn=%d=%x old=%x\n", __func__, rn, v, env->mmu.regs[rn]); 235 236 if (env->mmu.c_mmu < 2 || !env->mmu.c_mmu_tlb_access) { 237 qemu_log_mask(LOG_GUEST_ERROR, "MMU access on MMU-less system\n"); 238 return; 239 } 240 if (ext && rn != MMU_R_TLBLO) { 241 qemu_log_mask(LOG_GUEST_ERROR, "Extended access only to TLBLO.\n"); 242 return; 243 } 244 245 switch (rn) { 246 /* Writes to HI/LO trig writes to the mmu rams. */ 247 case MMU_R_TLBLO: 248 case MMU_R_TLBHI: 249 i = env->mmu.regs[MMU_R_TLBX] & 0xff; 250 if (rn == MMU_R_TLBHI) { 251 if (i < 3 && !(v & TLB_VALID) && qemu_loglevel_mask(~0)) 252 qemu_log_mask(LOG_GUEST_ERROR, 253 "invalidating index %x at pc=%" PRIx64 "\n", 254 i, env->sregs[SR_PC]); 255 env->mmu.tids[i] = env->mmu.regs[MMU_R_PID] & 0xff; 256 mmu_flush_idx(env, i); 257 } 258 tmp64 = env->mmu.rams[rn & 1][i]; 259 env->mmu.rams[rn & 1][i] = deposit64(tmp64, ext * 32, 32, v); 260 break; 261 case MMU_R_ZPR: 262 if (env->mmu.c_mmu_tlb_access <= 1) { 263 qemu_log_mask(LOG_GUEST_ERROR, 264 "Invalid access to MMU reg %d\n", rn); 265 return; 266 } 267 268 /* Changes to the zone protection reg flush the QEMU TLB. 269 Fortunately, these are very uncommon. */ 270 if (v != env->mmu.regs[rn]) { 271 tlb_flush(env_cpu(env)); 272 } 273 env->mmu.regs[rn] = v; 274 break; 275 case MMU_R_PID: 276 if (env->mmu.c_mmu_tlb_access <= 1) { 277 qemu_log_mask(LOG_GUEST_ERROR, 278 "Invalid access to MMU reg %d\n", rn); 279 return; 280 } 281 282 if (v != env->mmu.regs[rn]) { 283 mmu_change_pid(env, v); 284 env->mmu.regs[rn] = v; 285 } 286 break; 287 case MMU_R_TLBX: 288 /* Bit 31 is read-only. */ 289 env->mmu.regs[rn] = deposit32(env->mmu.regs[rn], 0, 31, v); 290 break; 291 case MMU_R_TLBSX: 292 { 293 struct microblaze_mmu_lookup lu; 294 int hit; 295 296 if (env->mmu.c_mmu_tlb_access <= 1) { 297 qemu_log_mask(LOG_GUEST_ERROR, 298 "Invalid access to MMU reg %d\n", rn); 299 return; 300 } 301 302 hit = mmu_translate(&env->mmu, &lu, 303 v & TLB_EPN_MASK, 0, cpu_mmu_index(env, false)); 304 if (hit) { 305 env->mmu.regs[MMU_R_TLBX] = lu.idx; 306 } else { 307 env->mmu.regs[MMU_R_TLBX] |= R_TBLX_MISS_MASK; 308 } 309 break; 310 } 311 default: 312 qemu_log_mask(LOG_GUEST_ERROR, "Invalid MMU register %d.\n", rn); 313 break; 314 } 315 } 316 317 void mmu_init(struct microblaze_mmu *mmu) 318 { 319 int i; 320 for (i = 0; i < ARRAY_SIZE(mmu->regs); i++) { 321 mmu->regs[i] = 0; 322 } 323 } 324