target-xtensa/helper.c

   1 /*
   2  * Copyright (c) 2011, Max Filippov, Open Source and Linux Lab.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions are met:
   7  *     * Redistributions of source code must retain the above copyright
   8  *       notice, this list of conditions and the following disclaimer.
   9  *     * Redistributions in binary form must reproduce the above copyright
  10  *       notice, this list of conditions and the following disclaimer in the
  11  *       documentation and/or other materials provided with the distribution.
  12  *     * Neither the name of the Open Source and Linux Lab nor the
  13  *       names of its contributors may be used to endorse or promote products
  14  *       derived from this software without specific prior written permission.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  17  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  19  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  20  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  21  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  22  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  23  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  25  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  26  */
  27
  28 #include "cpu.h"
  29 #include "exec-all.h"
  30 #include "gdbstub.h"
  31 #include "qemu-common.h"
  32 #include "host-utils.h"
  33 #if !defined(CONFIG_USER_ONLY)
  34 #include "hw/loader.h"
  35 #endif
  36
  37 #define XTREG(idx, ofs, bi, sz, al, no, flags, cp, typ, grp, name, \
  38         a1, a2, a3, a4, a5, a6) \
  39     { .targno = (no), .type = (typ), .group = (grp) },
  40
  41 static void reset_mmu(CPUState *env);
  42
  43 void cpu_reset(CPUXtensaState *env)
  44 {
  45     env->exception_taken = 0;
  46     env->pc = env->config->exception_vector[EXC_RESET];
  47     env->sregs[LITBASE] &= ~1;
  48     env->sregs[PS] = xtensa_option_enabled(env->config,
  49             XTENSA_OPTION_INTERRUPT) ? 0x1f : 0x10;
  50     env->sregs[VECBASE] = env->config->vecbase;
  51
  52     env->pending_irq_level = 0;
  53     reset_mmu(env);
  54 }
  55
  56 static const XtensaConfig core_config[] = {
  57     {
  58         .name = "sample-xtensa-core",
  59         .options = -1 ^
  60             (XTENSA_OPTION_BIT(XTENSA_OPTION_HW_ALIGNMENT) |
  61              XTENSA_OPTION_BIT(XTENSA_OPTION_MMU)),
  62         .gdb_regmap = {
  63             .num_regs = 176,
  64             .num_core_regs = 117,
  65             .reg = {
  66 #include "gdb-config-sample-xtensa-core.c"
  67             }
  68         },
  69         .nareg = 64,
  70         .ndepc = 1,
  71         .excm_level = 16,
  72         .vecbase = 0x5fff8400,
  73         .exception_vector = {
  74             [EXC_RESET] = 0x5fff8000,
  75             [EXC_WINDOW_OVERFLOW4] = 0x5fff8400,
  76             [EXC_WINDOW_UNDERFLOW4] = 0x5fff8440,
  77             [EXC_WINDOW_OVERFLOW8] = 0x5fff8480,
  78             [EXC_WINDOW_UNDERFLOW8] = 0x5fff84c0,
  79             [EXC_WINDOW_OVERFLOW12] = 0x5fff8500,
  80             [EXC_WINDOW_UNDERFLOW12] = 0x5fff8540,
  81             [EXC_KERNEL] = 0x5fff861c,
  82             [EXC_USER] = 0x5fff863c,
  83             [EXC_DOUBLE] = 0x5fff865c,
  84         },
  85         .ninterrupt = 13,
  86         .nlevel = 6,
  87         .interrupt_vector = {
  88             0,
  89             0,
  90             0x5fff857c,
  91             0x5fff859c,
  92             0x5fff85bc,
  93             0x5fff85dc,
  94             0x5fff85fc,
  95         },
  96         .level_mask = {
  97             [4] = 1,
  98         },
  99         .interrupt = {
 100             [0] = {
 101                 .level = 4,
 102                 .inttype = INTTYPE_TIMER,
 103             },
 104         },
 105         .nccompare = 1,
 106         .timerint = {
 107             [0] = 0,
 108         },
 109         .clock_freq_khz = 912000,
 110     }, {
 111         .name = "dc232b",
 112         .options = -1 ^
 113             (XTENSA_OPTION_BIT(XTENSA_OPTION_HW_ALIGNMENT) |
 114              XTENSA_OPTION_BIT(XTENSA_OPTION_REGION_PROTECTION) |
 115              XTENSA_OPTION_BIT(XTENSA_OPTION_REGION_TRANSLATION)),
 116         .gdb_regmap = {
 117             .num_regs = 120,
 118             .num_core_regs = 52,
 119             .reg = {
 120 #include "gdb-config-dc232b.c"
 121             }
 122         },
 123         .nareg = 32,
 124         .ndepc = 1,
 125         .excm_level = 3,
 126         .vecbase = 0xd0000000,
 127         .exception_vector = {
 128             [EXC_RESET] = 0xfe000000,
 129             [EXC_WINDOW_OVERFLOW4] = 0xd0000000,
 130             [EXC_WINDOW_UNDERFLOW4] = 0xd0000040,
 131             [EXC_WINDOW_OVERFLOW8] = 0xd0000080,
 132             [EXC_WINDOW_UNDERFLOW8] = 0xd00000c0,
 133             [EXC_WINDOW_OVERFLOW12] = 0xd0000100,
 134             [EXC_WINDOW_UNDERFLOW12] = 0xd0000140,
 135             [EXC_KERNEL] = 0xd0000300,
 136             [EXC_USER] = 0xd0000340,
 137             [EXC_DOUBLE] = 0xd00003c0,
 138         },
 139         .ninterrupt = 22,
 140         .nlevel = 6,
 141         .interrupt_vector = {
 142             0,
 143             0,
 144             0xd0000180,
 145             0xd00001c0,
 146             0xd0000200,
 147             0xd0000240,
 148             0xd0000280,
 149             0xd00002c0,
 150         },
 151         .level_mask = {
 152             [1] = 0x1f80ff,
 153             [2] = 0x000100,
 154             [3] = 0x200e00,
 155             [4] = 0x001000,
 156             [5] = 0x002000,
 157             [6] = 0x000000,
 158             [7] = 0x004000,
 159         },
 160         .inttype_mask = {
 161             [INTTYPE_EDGE] = 0x3f8000,
 162             [INTTYPE_NMI] = 0x4000,
 163             [INTTYPE_SOFTWARE] = 0x880,
 164         },
 165         .interrupt = {
 166             [0] = {
 167                 .level = 1,
 168                 .inttype = INTTYPE_LEVEL,
 169             },
 170             [1] = {
 171                 .level = 1,
 172                 .inttype = INTTYPE_LEVEL,
 173             },
 174             [2] = {
 175                 .level = 1,
 176                 .inttype = INTTYPE_LEVEL,
 177             },
 178             [3] = {
 179                 .level = 1,
 180                 .inttype = INTTYPE_LEVEL,
 181             },
 182             [4] = {
 183                 .level = 1,
 184                 .inttype = INTTYPE_LEVEL,
 185             },
 186             [5] = {
 187                 .level = 1,
 188                 .inttype = INTTYPE_LEVEL,
 189             },
 190             [6] = {
 191                 .level = 1,
 192                 .inttype = INTTYPE_TIMER,
 193             },
 194             [7] = {
 195                 .level = 1,
 196                 .inttype = INTTYPE_SOFTWARE,
 197             },
 198             [8] = {
 199                 .level = 2,
 200                 .inttype = INTTYPE_LEVEL,
 201             },
 202             [9] = {
 203                 .level = 3,
 204                 .inttype = INTTYPE_LEVEL,
 205             },
 206             [10] = {
 207                 .level = 3,
 208                 .inttype = INTTYPE_TIMER,
 209             },
 210             [11] = {
 211                 .level = 3,
 212                 .inttype = INTTYPE_SOFTWARE,
 213             },
 214             [12] = {
 215                 .level = 4,
 216                 .inttype = INTTYPE_LEVEL,
 217             },
 218             [13] = {
 219                 .level = 5,
 220                 .inttype = INTTYPE_TIMER,
 221             },
 222             [14] = {
 223                 .level = 7,
 224                 .inttype = INTTYPE_NMI,
 225             },
 226             [15] = {
 227                 .level = 1,
 228                 .inttype = INTTYPE_EDGE,
 229             },
 230             [16] = {
 231                 .level = 1,
 232                 .inttype = INTTYPE_EDGE,
 233             },
 234             [17] = {
 235                 .level = 1,
 236                 .inttype = INTTYPE_EDGE,
 237             },
 238             [18] = {
 239                 .level = 1,
 240                 .inttype = INTTYPE_EDGE,
 241             },
 242             [19] = {
 243                 .level = 1,
 244                 .inttype = INTTYPE_EDGE,
 245             },
 246             [20] = {
 247                 .level = 1,
 248                 .inttype = INTTYPE_EDGE,
 249             },
 250             [21] = {
 251                 .level = 3,
 252                 .inttype = INTTYPE_EDGE,
 253             },
 254         },
 255         .nccompare = 3,
 256         .timerint = {
 257             [0] = 6,
 258             [1] = 10,
 259             [2] = 13,
 260         },
 261         .clock_freq_khz = 912000,
 262         .itlb = {
 263             .nways = 7,
 264             .way_size = {
 265                 4, 4, 4, 4, 4, 2, 2,
 266             },
 267             .varway56 = false,
 268             .nrefillentries = 16,
 269         },
 270         .dtlb = {
 271             .nways = 10,
 272             .way_size = {
 273                 4, 4, 4, 4, 4, 2, 2, 1, 1, 1,
 274             },
 275             .varway56 = false,
 276             .nrefillentries = 16,
 277         },
 278     },
 279 };
 280
 281 CPUXtensaState *cpu_xtensa_init(const char *cpu_model)
 282 {
 283     static int tcg_inited;
 284     CPUXtensaState *env;
 285     const XtensaConfig *config = NULL;
 286     int i;
 287
 288     for (i = 0; i < ARRAY_SIZE(core_config); ++i)
 289         if (strcmp(core_config[i].name, cpu_model) == 0) {
 290             config = core_config + i;
 291             break;
 292         }
 293
 294     if (config == NULL) {
 295         return NULL;
 296     }
 297
 298     env = g_malloc0(sizeof(*env));
 299     env->config = config;
 300     cpu_exec_init(env);
 301
 302     if (!tcg_inited) {
 303         tcg_inited = 1;
 304         xtensa_translate_init();
 305     }
 306
 307     xtensa_irq_init(env);
 308     qemu_init_vcpu(env);
 309     return env;
 310 }
 311
 312
 313 void xtensa_cpu_list(FILE *f, fprintf_function cpu_fprintf)
 314 {
 315     int i;
 316     cpu_fprintf(f, "Available CPUs:\n");
 317     for (i = 0; i < ARRAY_SIZE(core_config); ++i) {
 318         cpu_fprintf(f, "  %s\n", core_config[i].name);
 319     }
 320 }
 321
 322 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 323 {
 324     uint32_t paddr;
 325     uint32_t page_size;
 326     unsigned access;
 327
 328     if (xtensa_get_physical_addr(env, addr, 0, 0,
 329                 &paddr, &page_size, &access) == 0) {
 330         return paddr;
 331     }
 332     if (xtensa_get_physical_addr(env, addr, 2, 0,
 333                 &paddr, &page_size, &access) == 0) {
 334         return paddr;
 335     }
 336     return ~0;
 337 }
 338
 339 static uint32_t relocated_vector(CPUState *env, uint32_t vector)
 340 {
 341     if (xtensa_option_enabled(env->config,
 342                 XTENSA_OPTION_RELOCATABLE_VECTOR)) {
 343         return vector - env->config->vecbase + env->sregs[VECBASE];
 344     } else {
 345         return vector;
 346     }
 347 }
 348
 349 /*!
 350  * Handle penging IRQ.
 351  * For the high priority interrupt jump to the corresponding interrupt vector.
 352  * For the level-1 interrupt convert it to either user, kernel or double
 353  * exception with the 'level-1 interrupt' exception cause.
 354  */
 355 static void handle_interrupt(CPUState *env)
 356 {
 357     int level = env->pending_irq_level;
 358
 359     if (level > xtensa_get_cintlevel(env) &&
 360             level <= env->config->nlevel &&
 361             (env->config->level_mask[level] &
 362              env->sregs[INTSET] &
 363              env->sregs[INTENABLE])) {
 364         if (level > 1) {
 365             env->sregs[EPC1 + level - 1] = env->pc;
 366             env->sregs[EPS2 + level - 2] = env->sregs[PS];
 367             env->sregs[PS] =
 368                 (env->sregs[PS] & ~PS_INTLEVEL) | level | PS_EXCM;
 369             env->pc = relocated_vector(env,
 370                     env->config->interrupt_vector[level]);
 371         } else {
 372             env->sregs[EXCCAUSE] = LEVEL1_INTERRUPT_CAUSE;
 373
 374             if (env->sregs[PS] & PS_EXCM) {
 375                 if (env->config->ndepc) {
 376                     env->sregs[DEPC] = env->pc;
 377                 } else {
 378                     env->sregs[EPC1] = env->pc;
 379                 }
 380                 env->exception_index = EXC_DOUBLE;
 381             } else {
 382                 env->sregs[EPC1] = env->pc;
 383                 env->exception_index =
 384                     (env->sregs[PS] & PS_UM) ? EXC_USER : EXC_KERNEL;
 385             }
 386             env->sregs[PS] |= PS_EXCM;
 387         }
 388         env->exception_taken = 1;
 389     }
 390 }
 391
 392 void do_interrupt(CPUState *env)
 393 {
 394     if (env->exception_index == EXC_IRQ) {
 395         qemu_log_mask(CPU_LOG_INT,
 396                 "%s(EXC_IRQ) level = %d, cintlevel = %d, "
 397                 "pc = %08x, a0 = %08x, ps = %08x, "
 398                 "intset = %08x, intenable = %08x, "
 399                 "ccount = %08x\n",
 400                 __func__, env->pending_irq_level, xtensa_get_cintlevel(env),
 401                 env->pc, env->regs[0], env->sregs[PS],
 402                 env->sregs[INTSET], env->sregs[INTENABLE],
 403                 env->sregs[CCOUNT]);
 404         handle_interrupt(env);
 405     }
 406
 407     switch (env->exception_index) {
 408     case EXC_WINDOW_OVERFLOW4:
 409     case EXC_WINDOW_UNDERFLOW4:
 410     case EXC_WINDOW_OVERFLOW8:
 411     case EXC_WINDOW_UNDERFLOW8:
 412     case EXC_WINDOW_OVERFLOW12:
 413     case EXC_WINDOW_UNDERFLOW12:
 414     case EXC_KERNEL:
 415     case EXC_USER:
 416     case EXC_DOUBLE:
 417         qemu_log_mask(CPU_LOG_INT, "%s(%d) "
 418                 "pc = %08x, a0 = %08x, ps = %08x, ccount = %08x\n",
 419                 __func__, env->exception_index,
 420                 env->pc, env->regs[0], env->sregs[PS], env->sregs[CCOUNT]);
 421         if (env->config->exception_vector[env->exception_index]) {
 422             env->pc = relocated_vector(env,
 423                     env->config->exception_vector[env->exception_index]);
 424             env->exception_taken = 1;
 425         } else {
 426             qemu_log("%s(pc = %08x) bad exception_index: %d\n",
 427                     __func__, env->pc, env->exception_index);
 428         }
 429         break;
 430
 431     case EXC_IRQ:
 432         break;
 433
 434     default:
 435         qemu_log("%s(pc = %08x) unknown exception_index: %d\n",
 436                 __func__, env->pc, env->exception_index);
 437         break;
 438     }
 439     check_interrupts(env);
 440 }
 441
 442 static void reset_tlb_mmu_all_ways(CPUState *env,
 443         const xtensa_tlb *tlb, xtensa_tlb_entry entry[][MAX_TLB_WAY_SIZE])
 444 {
 445     unsigned wi, ei;
 446
 447     for (wi = 0; wi < tlb->nways; ++wi) {
 448         for (ei = 0; ei < tlb->way_size[wi]; ++ei) {
 449             entry[wi][ei].asid = 0;
 450             entry[wi][ei].variable = true;
 451         }
 452     }
 453 }
 454
 455 static void reset_tlb_mmu_ways56(CPUState *env,
 456         const xtensa_tlb *tlb, xtensa_tlb_entry entry[][MAX_TLB_WAY_SIZE])
 457 {
 458     if (!tlb->varway56) {
 459         static const xtensa_tlb_entry way5[] = {
 460             {
 461                 .vaddr = 0xd0000000,
 462                 .paddr = 0,
 463                 .asid = 1,
 464                 .attr = 7,
 465                 .variable = false,
 466             }, {
 467                 .vaddr = 0xd8000000,
 468                 .paddr = 0,
 469                 .asid = 1,
 470                 .attr = 3,
 471                 .variable = false,
 472             }
 473         };
 474         static const xtensa_tlb_entry way6[] = {
 475             {
 476                 .vaddr = 0xe0000000,
 477                 .paddr = 0xf0000000,
 478                 .asid = 1,
 479                 .attr = 7,
 480                 .variable = false,
 481             }, {
 482                 .vaddr = 0xf0000000,
 483                 .paddr = 0xf0000000,
 484                 .asid = 1,
 485                 .attr = 3,
 486                 .variable = false,
 487             }
 488         };
 489         memcpy(entry[5], way5, sizeof(way5));
 490         memcpy(entry[6], way6, sizeof(way6));
 491     } else {
 492         uint32_t ei;
 493         for (ei = 0; ei < 8; ++ei) {
 494             entry[6][ei].vaddr = ei << 29;
 495             entry[6][ei].paddr = ei << 29;
 496             entry[6][ei].asid = 1;
 497             entry[6][ei].attr = 2;
 498         }
 499     }
 500 }
 501
 502 static void reset_tlb_region_way0(CPUState *env,
 503         xtensa_tlb_entry entry[][MAX_TLB_WAY_SIZE])
 504 {
 505     unsigned ei;
 506
 507     for (ei = 0; ei < 8; ++ei) {
 508         entry[0][ei].vaddr = ei << 29;
 509         entry[0][ei].paddr = ei << 29;
 510         entry[0][ei].asid = 1;
 511         entry[0][ei].attr = 2;
 512         entry[0][ei].variable = true;
 513     }
 514 }
 515
 516 static void reset_mmu(CPUState *env)
 517 {
 518     if (xtensa_option_enabled(env->config, XTENSA_OPTION_MMU)) {
 519         env->sregs[RASID] = 0x04030201;
 520         env->sregs[ITLBCFG] = 0;
 521         env->sregs[DTLBCFG] = 0;
 522         env->autorefill_idx = 0;
 523         reset_tlb_mmu_all_ways(env, &env->config->itlb, env->itlb);
 524         reset_tlb_mmu_all_ways(env, &env->config->dtlb, env->dtlb);
 525         reset_tlb_mmu_ways56(env, &env->config->itlb, env->itlb);
 526         reset_tlb_mmu_ways56(env, &env->config->dtlb, env->dtlb);
 527     } else {
 528         reset_tlb_region_way0(env, env->itlb);
 529         reset_tlb_region_way0(env, env->dtlb);
 530     }
 531 }
 532
 533 static unsigned get_ring(const CPUState *env, uint8_t asid)
 534 {
 535     unsigned i;
 536     for (i = 0; i < 4; ++i) {
 537         if (((env->sregs[RASID] >> i * 8) & 0xff) == asid) {
 538             return i;
 539         }
 540     }
 541     return 0xff;
 542 }
 543
 544 /*!
 545  * Lookup xtensa TLB for the given virtual address.
 546  * See ISA, 4.6.2.2
 547  *
 548  * \param pwi: [out] way index
 549  * \param pei: [out] entry index
 550  * \param pring: [out] access ring
 551  * \return 0 if ok, exception cause code otherwise
 552  */
 553 int xtensa_tlb_lookup(const CPUState *env, uint32_t addr, bool dtlb,
 554         uint32_t *pwi, uint32_t *pei, uint8_t *pring)
 555 {
 556     const xtensa_tlb *tlb = dtlb ?
 557         &env->config->dtlb : &env->config->itlb;
 558     const xtensa_tlb_entry (*entry)[MAX_TLB_WAY_SIZE] = dtlb ?
 559         env->dtlb : env->itlb;
 560
 561     int nhits = 0;
 562     unsigned wi;
 563
 564     for (wi = 0; wi < tlb->nways; ++wi) {
 565         uint32_t vpn;
 566         uint32_t ei;
 567         split_tlb_entry_spec_way(env, addr, dtlb, &vpn, wi, &ei);
 568         if (entry[wi][ei].vaddr == vpn && entry[wi][ei].asid) {
 569             unsigned ring = get_ring(env, entry[wi][ei].asid);
 570             if (ring < 4) {
 571                 if (++nhits > 1) {
 572                     return dtlb ?
 573                         LOAD_STORE_TLB_MULTI_HIT_CAUSE :
 574                         INST_TLB_MULTI_HIT_CAUSE;
 575                 }
 576                 *pwi = wi;
 577                 *pei = ei;
 578                 *pring = ring;
 579             }
 580         }
 581     }
 582     return nhits ? 0 :
 583         (dtlb ? LOAD_STORE_TLB_MISS_CAUSE : INST_TLB_MISS_CAUSE);
 584 }
 585
 586 /*!
 587  * Convert MMU ATTR to PAGE_{READ,WRITE,EXEC} mask.
 588  * See ISA, 4.6.5.10
 589  */
 590 static unsigned mmu_attr_to_access(uint32_t attr)
 591 {
 592     unsigned access = 0;
 593     if (attr < 12) {
 594         access |= PAGE_READ;
 595         if (attr & 0x1) {
 596             access |= PAGE_EXEC;
 597         }
 598         if (attr & 0x2) {
 599             access |= PAGE_WRITE;
 600         }
 601     } else if (attr == 13) {
 602         access |= PAGE_READ | PAGE_WRITE;
 603     }
 604     return access;
 605 }
 606
 607 /*!
 608  * Convert region protection ATTR to PAGE_{READ,WRITE,EXEC} mask.
 609  * See ISA, 4.6.3.3
 610  */
 611 static unsigned region_attr_to_access(uint32_t attr)
 612 {
 613     unsigned access = 0;
 614     if ((attr < 6 && attr != 3) || attr == 14) {
 615         access |= PAGE_READ | PAGE_WRITE;
 616     }
 617     if (attr > 0 && attr < 6) {
 618         access |= PAGE_EXEC;
 619     }
 620     return access;
 621 }
 622
 623 static bool is_access_granted(unsigned access, int is_write)
 624 {
 625     switch (is_write) {
 626     case 0:
 627         return access & PAGE_READ;
 628
 629     case 1:
 630         return access & PAGE_WRITE;
 631
 632     case 2:
 633         return access & PAGE_EXEC;
 634
 635     default:
 636         return 0;
 637     }
 638 }
 639
 640 static int autorefill_mmu(CPUState *env, uint32_t vaddr, bool dtlb,
 641         uint32_t *wi, uint32_t *ei, uint8_t *ring);
 642
 643 static int get_physical_addr_mmu(CPUState *env,
 644         uint32_t vaddr, int is_write, int mmu_idx,
 645         uint32_t *paddr, uint32_t *page_size, unsigned *access)
 646 {
 647     bool dtlb = is_write != 2;
 648     uint32_t wi;
 649     uint32_t ei;
 650     uint8_t ring;
 651     int ret = xtensa_tlb_lookup(env, vaddr, dtlb, &wi, &ei, &ring);
 652
 653     if ((ret == INST_TLB_MISS_CAUSE || ret == LOAD_STORE_TLB_MISS_CAUSE) &&
 654             (mmu_idx != 0 || ((vaddr ^ env->sregs[PTEVADDR]) & 0xffc00000)) &&
 655             autorefill_mmu(env, vaddr, dtlb, &wi, &ei, &ring) == 0) {
 656         ret = 0;
 657     }
 658     if (ret != 0) {
 659         return ret;
 660     }
 661
 662     const xtensa_tlb_entry *entry =
 663         xtensa_tlb_get_entry(env, dtlb, wi, ei);
 664
 665     if (ring < mmu_idx) {
 666         return dtlb ?
 667             LOAD_STORE_PRIVILEGE_CAUSE :
 668             INST_FETCH_PRIVILEGE_CAUSE;
 669     }
 670
 671     *access = mmu_attr_to_access(entry->attr);
 672     if (!is_access_granted(*access, is_write)) {
 673         return dtlb ?
 674             (is_write ?
 675              STORE_PROHIBITED_CAUSE :
 676              LOAD_PROHIBITED_CAUSE) :
 677             INST_FETCH_PROHIBITED_CAUSE;
 678     }
 679
 680     *paddr = entry->paddr | (vaddr & ~xtensa_tlb_get_addr_mask(env, dtlb, wi));
 681     *page_size = ~xtensa_tlb_get_addr_mask(env, dtlb, wi) + 1;
 682
 683     return 0;
 684 }
 685
 686 static int autorefill_mmu(CPUState *env, uint32_t vaddr, bool dtlb,
 687         uint32_t *wi, uint32_t *ei, uint8_t *ring)
 688 {
 689     uint32_t paddr;
 690     uint32_t page_size;
 691     unsigned access;
 692     uint32_t pt_vaddr =
 693         (env->sregs[PTEVADDR] | (vaddr >> 10)) & 0xfffffffc;
 694     int ret = get_physical_addr_mmu(env, pt_vaddr, 0, 0,
 695             &paddr, &page_size, &access);
 696
 697     qemu_log("%s: trying autorefill(%08x) -> %08x\n", __func__,
 698             vaddr, ret ? ~0 : paddr);
 699
 700     if (ret == 0) {
 701         uint32_t vpn;
 702         uint32_t pte = ldl_phys(paddr);
 703
 704         *ring = (pte >> 4) & 0x3;
 705         *wi = (++env->autorefill_idx) & 0x3;
 706         split_tlb_entry_spec_way(env, vaddr, dtlb, &vpn, *wi, ei);
 707         xtensa_tlb_set_entry(env, dtlb, *wi, *ei, vpn, pte);
 708         qemu_log("%s: autorefill(%08x): %08x -> %08x\n",
 709                 __func__, vaddr, vpn, pte);
 710     }
 711     return ret;
 712 }
 713
 714 static int get_physical_addr_region(CPUState *env,
 715         uint32_t vaddr, int is_write, int mmu_idx,
 716         uint32_t *paddr, uint32_t *page_size, unsigned *access)
 717 {
 718     bool dtlb = is_write != 2;
 719     uint32_t wi = 0;
 720     uint32_t ei = (vaddr >> 29) & 0x7;
 721     const xtensa_tlb_entry *entry =
 722         xtensa_tlb_get_entry(env, dtlb, wi, ei);
 723
 724     *access = region_attr_to_access(entry->attr);
 725     if (!is_access_granted(*access, is_write)) {
 726         return dtlb ?
 727             (is_write ?
 728              STORE_PROHIBITED_CAUSE :
 729              LOAD_PROHIBITED_CAUSE) :
 730             INST_FETCH_PROHIBITED_CAUSE;
 731     }
 732
 733     *paddr = entry->paddr | (vaddr & ~REGION_PAGE_MASK);
 734     *page_size = ~REGION_PAGE_MASK + 1;
 735
 736     return 0;
 737 }
 738
 739 /*!
 740  * Convert virtual address to physical addr.
 741  * MMU may issue pagewalk and change xtensa autorefill TLB way entry.
 742  *
 743  * \return 0 if ok, exception cause code otherwise
 744  */
 745 int xtensa_get_physical_addr(CPUState *env,
 746         uint32_t vaddr, int is_write, int mmu_idx,
 747         uint32_t *paddr, uint32_t *page_size, unsigned *access)
 748 {
 749     if (xtensa_option_enabled(env->config, XTENSA_OPTION_MMU)) {
 750         return get_physical_addr_mmu(env, vaddr, is_write, mmu_idx,
 751                 paddr, page_size, access);
 752     } else if (xtensa_option_bits_enabled(env->config,
 753                 XTENSA_OPTION_BIT(XTENSA_OPTION_REGION_PROTECTION) |
 754                 XTENSA_OPTION_BIT(XTENSA_OPTION_REGION_TRANSLATION))) {
 755         return get_physical_addr_region(env, vaddr, is_write, mmu_idx,
 756                 paddr, page_size, access);
 757     } else {
 758         *paddr = vaddr;
 759         *page_size = TARGET_PAGE_SIZE;
 760         *access = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 761         return 0;
 762     }
 763 }