xref: /openbmc/qemu/target/microblaze/mmu.c (revision 873f9ca3857cfeeef45441b116c91156736d529c) 
1  /*
2   *  Microblaze MMU emulation for qemu.
3   *
4   *  Copyright (c) 2009 Edgar E. Iglesias
5   *  Copyright (c) 2009-2012 PetaLogix Qld Pty Ltd.
6   *
7   * This library is free software; you can redistribute it and/or
8   * modify it under the terms of the GNU Lesser General Public
9   * License as published by the Free Software Foundation; either
10   * version 2.1 of the License, or (at your option) any later version.
11   *
12   * This library is distributed in the hope that it will be useful,
13   * but WITHOUT ANY WARRANTY; without even the implied warranty of
14   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15   * Lesser General Public License for more details.
16   *
17   * You should have received a copy of the GNU Lesser General Public
18   * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19   */
20  
21  #include "qemu/osdep.h"
22  #include "qemu/log.h"
23  #include "cpu.h"
24  #include "exec/exec-all.h"
25  #include "exec/page-protection.h"
26  
tlb_decode_size(unsigned int f)27  static unsigned int tlb_decode_size(unsigned int f)
28  {
29      static const unsigned int sizes[] = {
30          1 * 1024, 4 * 1024, 16 * 1024, 64 * 1024, 256 * 1024,
31          1 * 1024 * 1024, 4 * 1024 * 1024, 16 * 1024 * 1024
32      };
33      assert(f < ARRAY_SIZE(sizes));
34      return sizes[f];
35  }
36  
mmu_flush_idx(CPUMBState * env,unsigned int idx)37  static void mmu_flush_idx(CPUMBState *env, unsigned int idx)
38  {
39      CPUState *cs = env_cpu(env);
40      MicroBlazeMMU *mmu = &env->mmu;
41      unsigned int tlb_size;
42      uint32_t tlb_tag, end, t;
43  
44      t = mmu->rams[RAM_TAG][idx];
45      if (!(t & TLB_VALID))
46          return;
47  
48      tlb_tag = t & TLB_EPN_MASK;
49      tlb_size = tlb_decode_size((t & TLB_PAGESZ_MASK) >> 7);
50      end = tlb_tag + tlb_size;
51  
52      while (tlb_tag < end) {
53          tlb_flush_page(cs, tlb_tag);
54          tlb_tag += TARGET_PAGE_SIZE;
55      }
56  }
57  
mmu_change_pid(CPUMBState * env,unsigned int newpid)58  static void mmu_change_pid(CPUMBState *env, unsigned int newpid)
59  {
60      MicroBlazeMMU *mmu = &env->mmu;
61      unsigned int i;
62      uint32_t t;
63  
64      if (newpid & ~0xff)
65          qemu_log_mask(LOG_GUEST_ERROR, "Illegal rpid=%x\n", newpid);
66  
67      for (i = 0; i < ARRAY_SIZE(mmu->rams[RAM_TAG]); i++) {
68          /* Lookup and decode.  */
69          t = mmu->rams[RAM_TAG][i];
70          if (t & TLB_VALID) {
71              if (mmu->tids[i] && ((mmu->regs[MMU_R_PID] & 0xff) == mmu->tids[i]))
72                  mmu_flush_idx(env, i);
73          }
74      }
75  }
76  
77  /* rw - 0 = read, 1 = write, 2 = fetch.  */
mmu_translate(MicroBlazeCPU * cpu,MicroBlazeMMULookup * lu,target_ulong vaddr,MMUAccessType rw,int mmu_idx)78  unsigned int mmu_translate(MicroBlazeCPU *cpu, MicroBlazeMMULookup *lu,
79                             target_ulong vaddr, MMUAccessType rw, int mmu_idx)
80  {
81      MicroBlazeMMU *mmu = &cpu->env.mmu;
82      unsigned int i, hit = 0;
83      unsigned int tlb_ex = 0, tlb_wr = 0, tlb_zsel;
84      uint64_t tlb_tag, tlb_rpn, mask;
85      uint32_t tlb_size, t0;
86  
87      lu->err = ERR_MISS;
88      for (i = 0; i < ARRAY_SIZE(mmu->rams[RAM_TAG]); i++) {
89          uint64_t t, d;
90  
91          /* Lookup and decode.  */
92          t = mmu->rams[RAM_TAG][i];
93          if (t & TLB_VALID) {
94              tlb_size = tlb_decode_size((t & TLB_PAGESZ_MASK) >> 7);
95              if (tlb_size < TARGET_PAGE_SIZE) {
96                  qemu_log_mask(LOG_UNIMP, "%d pages not supported\n", tlb_size);
97                  abort();
98              }
99  
100              mask = ~((uint64_t)tlb_size - 1);
101              tlb_tag = t & TLB_EPN_MASK;
102              if ((vaddr & mask) != (tlb_tag & mask)) {
103                  continue;
104              }
105              if (mmu->tids[i]
106                  && ((mmu->regs[MMU_R_PID] & 0xff) != mmu->tids[i])) {
107                  continue;
108              }
109  
110              /* Bring in the data part.  */
111              d = mmu->rams[RAM_DATA][i];
112              tlb_ex = d & TLB_EX;
113              tlb_wr = d & TLB_WR;
114  
115              /* Now let's see if there is a zone that overrides the protbits.  */
116              tlb_zsel = (d >> 4) & 0xf;
117              t0 = mmu->regs[MMU_R_ZPR] >> (30 - (tlb_zsel * 2));
118              t0 &= 0x3;
119  
120              if (tlb_zsel > cpu->cfg.mmu_zones) {
121                  qemu_log_mask(LOG_GUEST_ERROR,
122                                "tlb zone select out of range! %d\n", tlb_zsel);
123                  t0 = 1; /* Ignore.  */
124              }
125  
126              if (cpu->cfg.mmu == 1) {
127                  t0 = 1; /* Zones are disabled.  */
128              }
129  
130              switch (t0) {
131                  case 0:
132                      if (mmu_idx == MMU_USER_IDX)
133                          continue;
134                      break;
135                  case 2:
136                      if (mmu_idx != MMU_USER_IDX) {
137                          tlb_ex = 1;
138                          tlb_wr = 1;
139                      }
140                      break;
141                  case 3:
142                      tlb_ex = 1;
143                      tlb_wr = 1;
144                      break;
145                  default: break;
146              }
147  
148              lu->err = ERR_PROT;
149              lu->prot = PAGE_READ;
150              if (tlb_wr)
151                  lu->prot |= PAGE_WRITE;
152              else if (rw == 1)
153                  goto done;
154              if (tlb_ex)
155                  lu->prot |=PAGE_EXEC;
156              else if (rw == 2) {
157                  goto done;
158              }
159  
160              tlb_rpn = d & TLB_RPN_MASK;
161  
162              lu->vaddr = tlb_tag;
163              lu->paddr = tlb_rpn & cpu->cfg.addr_mask;
164              lu->size = tlb_size;
165              lu->err = ERR_HIT;
166              lu->idx = i;
167              hit = 1;
168              goto done;
169          }
170      }
171  done:
172      qemu_log_mask(CPU_LOG_MMU,
173                    "MMU vaddr=%" PRIx64 " rw=%d tlb_wr=%d tlb_ex=%d hit=%d\n",
174                    vaddr, rw, tlb_wr, tlb_ex, hit);
175      return hit;
176  }
177  
178  /* Writes/reads to the MMU's special regs end up here.  */
mmu_read(CPUMBState * env,bool ext,uint32_t rn)179  uint32_t mmu_read(CPUMBState *env, bool ext, uint32_t rn)
180  {
181      MicroBlazeCPU *cpu = env_archcpu(env);
182      unsigned int i;
183      uint32_t r = 0;
184  
185      if (cpu->cfg.mmu < 2 || !cpu->cfg.mmu_tlb_access) {
186          qemu_log_mask(LOG_GUEST_ERROR, "MMU access on MMU-less system\n");
187          return 0;
188      }
189      if (ext && rn != MMU_R_TLBLO) {
190          qemu_log_mask(LOG_GUEST_ERROR, "Extended access only to TLBLO.\n");
191          return 0;
192      }
193  
194      switch (rn) {
195          /* Reads to HI/LO trig reads from the mmu rams.  */
196          case MMU_R_TLBLO:
197          case MMU_R_TLBHI:
198              if (!(cpu->cfg.mmu_tlb_access & 1)) {
199                  qemu_log_mask(LOG_GUEST_ERROR,
200                                "Invalid access to MMU reg %d\n", rn);
201                  return 0;
202              }
203  
204              i = env->mmu.regs[MMU_R_TLBX] & 0xff;
205              r = extract64(env->mmu.rams[rn & 1][i], ext * 32, 32);
206              if (rn == MMU_R_TLBHI)
207                  env->mmu.regs[MMU_R_PID] = env->mmu.tids[i];
208              break;
209          case MMU_R_PID:
210          case MMU_R_ZPR:
211              if (!(cpu->cfg.mmu_tlb_access & 1)) {
212                  qemu_log_mask(LOG_GUEST_ERROR,
213                                "Invalid access to MMU reg %d\n", rn);
214                  return 0;
215              }
216              r = env->mmu.regs[rn];
217              break;
218          case MMU_R_TLBX:
219              r = env->mmu.regs[rn];
220              break;
221          case MMU_R_TLBSX:
222              qemu_log_mask(LOG_GUEST_ERROR, "TLBSX is write-only.\n");
223              break;
224          default:
225              qemu_log_mask(LOG_GUEST_ERROR, "Invalid MMU register %d.\n", rn);
226              break;
227      }
228      qemu_log_mask(CPU_LOG_MMU, "%s rn=%d=%x\n", __func__, rn, r);
229      return r;
230  }
231  
mmu_write(CPUMBState * env,bool ext,uint32_t rn,uint32_t v)232  void mmu_write(CPUMBState *env, bool ext, uint32_t rn, uint32_t v)
233  {
234      MicroBlazeCPU *cpu = env_archcpu(env);
235      uint64_t tmp64;
236      unsigned int i;
237  
238      qemu_log_mask(CPU_LOG_MMU,
239                    "%s rn=%d=%x old=%x\n", __func__, rn, v,
240                    rn < 3 ? env->mmu.regs[rn] : env->mmu.regs[MMU_R_TLBX]);
241  
242      if (cpu->cfg.mmu < 2 || !cpu->cfg.mmu_tlb_access) {
243          qemu_log_mask(LOG_GUEST_ERROR, "MMU access on MMU-less system\n");
244          return;
245      }
246      if (ext && rn != MMU_R_TLBLO) {
247          qemu_log_mask(LOG_GUEST_ERROR, "Extended access only to TLBLO.\n");
248          return;
249      }
250  
251      switch (rn) {
252          /* Writes to HI/LO trig writes to the mmu rams.  */
253          case MMU_R_TLBLO:
254          case MMU_R_TLBHI:
255              i = env->mmu.regs[MMU_R_TLBX] & 0xff;
256              if (rn == MMU_R_TLBHI) {
257                  if (i < 3 && !(v & TLB_VALID) && qemu_loglevel_mask(~0))
258                      qemu_log_mask(LOG_GUEST_ERROR,
259                                    "invalidating index %x at pc=%x\n",
260                                    i, env->pc);
261                  env->mmu.tids[i] = env->mmu.regs[MMU_R_PID] & 0xff;
262                  mmu_flush_idx(env, i);
263              }
264              tmp64 = env->mmu.rams[rn & 1][i];
265              env->mmu.rams[rn & 1][i] = deposit64(tmp64, ext * 32, 32, v);
266              break;
267          case MMU_R_ZPR:
268              if (cpu->cfg.mmu_tlb_access <= 1) {
269                  qemu_log_mask(LOG_GUEST_ERROR,
270                                "Invalid access to MMU reg %d\n", rn);
271                  return;
272              }
273  
274              /* Changes to the zone protection reg flush the QEMU TLB.
275                 Fortunately, these are very uncommon.  */
276              if (v != env->mmu.regs[rn]) {
277                  tlb_flush(env_cpu(env));
278              }
279              env->mmu.regs[rn] = v;
280              break;
281          case MMU_R_PID:
282              if (cpu->cfg.mmu_tlb_access <= 1) {
283                  qemu_log_mask(LOG_GUEST_ERROR,
284                                "Invalid access to MMU reg %d\n", rn);
285                  return;
286              }
287  
288              if (v != env->mmu.regs[rn]) {
289                  mmu_change_pid(env, v);
290                  env->mmu.regs[rn] = v;
291              }
292              break;
293          case MMU_R_TLBX:
294              /* Bit 31 is read-only.  */
295              env->mmu.regs[rn] = deposit32(env->mmu.regs[rn], 0, 31, v);
296              break;
297          case MMU_R_TLBSX:
298          {
299              MicroBlazeMMULookup lu;
300              int hit;
301  
302              if (cpu->cfg.mmu_tlb_access <= 1) {
303                  qemu_log_mask(LOG_GUEST_ERROR,
304                                "Invalid access to MMU reg %d\n", rn);
305                  return;
306              }
307  
308              hit = mmu_translate(cpu, &lu, v & TLB_EPN_MASK,
309                                  0, cpu_mmu_index(env_cpu(env), false));
310              if (hit) {
311                  env->mmu.regs[MMU_R_TLBX] = lu.idx;
312              } else {
313                  env->mmu.regs[MMU_R_TLBX] |= R_TBLX_MISS_MASK;
314              }
315              break;
316          }
317          default:
318              qemu_log_mask(LOG_GUEST_ERROR, "Invalid MMU register %d.\n", rn);
319              break;
320     }
321  }
322  
mmu_init(MicroBlazeMMU * mmu)323  void mmu_init(MicroBlazeMMU *mmu)
324  {
325      int i;
326      for (i = 0; i < ARRAY_SIZE(mmu->regs); i++) {
327          mmu->regs[i] = 0;
328      }
329  }
330