2 * Microblaze MMU emulation for qemu.
4 * Copyright (c) 2009 Edgar E. Iglesias
5 * Copyright (c) 2009-2012 PetaLogix Qld Pty Ltd.
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
24 #include "exec/exec-all.h"
25 #include "exec/page-protection.h"
27 static unsigned int tlb_decode_size(unsigned int f
)
29 static const unsigned int sizes
[] = {
30 1 * 1024, 4 * 1024, 16 * 1024, 64 * 1024, 256 * 1024,
31 1 * 1024 * 1024, 4 * 1024 * 1024, 16 * 1024 * 1024
33 assert(f
< ARRAY_SIZE(sizes
));
37 static void mmu_flush_idx(CPUMBState
*env
, unsigned int idx
)
39 CPUState
*cs
= env_cpu(env
);
40 MicroBlazeMMU
*mmu
= &env
->mmu
;
41 unsigned int tlb_size
;
42 uint32_t tlb_tag
, end
, t
;
44 t
= mmu
->rams
[RAM_TAG
][idx
];
48 tlb_tag
= t
& TLB_EPN_MASK
;
49 tlb_size
= tlb_decode_size((t
& TLB_PAGESZ_MASK
) >> 7);
50 end
= tlb_tag
+ tlb_size
;
52 while (tlb_tag
< end
) {
53 tlb_flush_page(cs
, tlb_tag
);
54 tlb_tag
+= TARGET_PAGE_SIZE
;
58 static void mmu_change_pid(CPUMBState
*env
, unsigned int newpid
)
60 MicroBlazeMMU
*mmu
= &env
->mmu
;
65 qemu_log_mask(LOG_GUEST_ERROR
, "Illegal rpid=%x\n", newpid
);
67 for (i
= 0; i
< ARRAY_SIZE(mmu
->rams
[RAM_TAG
]); i
++) {
68 /* Lookup and decode. */
69 t
= mmu
->rams
[RAM_TAG
][i
];
71 if (mmu
->tids
[i
] && ((mmu
->regs
[MMU_R_PID
] & 0xff) == mmu
->tids
[i
]))
72 mmu_flush_idx(env
, i
);
77 /* rw - 0 = read, 1 = write, 2 = fetch. */
78 unsigned int mmu_translate(MicroBlazeCPU
*cpu
, MicroBlazeMMULookup
*lu
,
79 target_ulong vaddr
, MMUAccessType rw
, int mmu_idx
)
81 MicroBlazeMMU
*mmu
= &cpu
->env
.mmu
;
82 unsigned int i
, hit
= 0;
83 unsigned int tlb_ex
= 0, tlb_wr
= 0, tlb_zsel
;
84 uint64_t tlb_tag
, tlb_rpn
, mask
;
85 uint32_t tlb_size
, t0
;
88 for (i
= 0; i
< ARRAY_SIZE(mmu
->rams
[RAM_TAG
]); i
++) {
91 /* Lookup and decode. */
92 t
= mmu
->rams
[RAM_TAG
][i
];
94 tlb_size
= tlb_decode_size((t
& TLB_PAGESZ_MASK
) >> 7);
95 if (tlb_size
< TARGET_PAGE_SIZE
) {
96 qemu_log_mask(LOG_UNIMP
, "%d pages not supported\n", tlb_size
);
100 mask
= ~((uint64_t)tlb_size
- 1);
101 tlb_tag
= t
& TLB_EPN_MASK
;
102 if ((vaddr
& mask
) != (tlb_tag
& mask
)) {
106 && ((mmu
->regs
[MMU_R_PID
] & 0xff) != mmu
->tids
[i
])) {
110 /* Bring in the data part. */
111 d
= mmu
->rams
[RAM_DATA
][i
];
115 /* Now let's see if there is a zone that overrides the protbits. */
116 tlb_zsel
= (d
>> 4) & 0xf;
117 t0
= mmu
->regs
[MMU_R_ZPR
] >> (30 - (tlb_zsel
* 2));
120 if (tlb_zsel
> cpu
->cfg
.mmu_zones
) {
121 qemu_log_mask(LOG_GUEST_ERROR
,
122 "tlb zone select out of range! %d\n", tlb_zsel
);
123 t0
= 1; /* Ignore. */
126 if (cpu
->cfg
.mmu
== 1) {
127 t0
= 1; /* Zones are disabled. */
132 if (mmu_idx
== MMU_USER_IDX
)
136 if (mmu_idx
!= MMU_USER_IDX
) {
149 lu
->prot
= PAGE_READ
;
151 lu
->prot
|= PAGE_WRITE
;
155 lu
->prot
|=PAGE_EXEC
;
160 tlb_rpn
= d
& TLB_RPN_MASK
;
163 lu
->paddr
= tlb_rpn
& cpu
->cfg
.addr_mask
;
172 qemu_log_mask(CPU_LOG_MMU
,
173 "MMU vaddr=%" PRIx64
" rw=%d tlb_wr=%d tlb_ex=%d hit=%d\n",
174 vaddr
, rw
, tlb_wr
, tlb_ex
, hit
);
178 /* Writes/reads to the MMU's special regs end up here. */
179 uint32_t mmu_read(CPUMBState
*env
, bool ext
, uint32_t rn
)
181 MicroBlazeCPU
*cpu
= env_archcpu(env
);
185 if (cpu
->cfg
.mmu
< 2 || !cpu
->cfg
.mmu_tlb_access
) {
186 qemu_log_mask(LOG_GUEST_ERROR
, "MMU access on MMU-less system\n");
189 if (ext
&& rn
!= MMU_R_TLBLO
) {
190 qemu_log_mask(LOG_GUEST_ERROR
, "Extended access only to TLBLO.\n");
195 /* Reads to HI/LO trig reads from the mmu rams. */
198 if (!(cpu
->cfg
.mmu_tlb_access
& 1)) {
199 qemu_log_mask(LOG_GUEST_ERROR
,
200 "Invalid access to MMU reg %d\n", rn
);
204 i
= env
->mmu
.regs
[MMU_R_TLBX
] & 0xff;
205 r
= extract64(env
->mmu
.rams
[rn
& 1][i
], ext
* 32, 32);
206 if (rn
== MMU_R_TLBHI
)
207 env
->mmu
.regs
[MMU_R_PID
] = env
->mmu
.tids
[i
];
211 if (!(cpu
->cfg
.mmu_tlb_access
& 1)) {
212 qemu_log_mask(LOG_GUEST_ERROR
,
213 "Invalid access to MMU reg %d\n", rn
);
216 r
= env
->mmu
.regs
[rn
];
219 r
= env
->mmu
.regs
[rn
];
222 qemu_log_mask(LOG_GUEST_ERROR
, "TLBSX is write-only.\n");
225 qemu_log_mask(LOG_GUEST_ERROR
, "Invalid MMU register %d.\n", rn
);
228 qemu_log_mask(CPU_LOG_MMU
, "%s rn=%d=%x\n", __func__
, rn
, r
);
232 void mmu_write(CPUMBState
*env
, bool ext
, uint32_t rn
, uint32_t v
)
234 MicroBlazeCPU
*cpu
= env_archcpu(env
);
238 qemu_log_mask(CPU_LOG_MMU
,
239 "%s rn=%d=%x old=%x\n", __func__
, rn
, v
,
240 rn
< 3 ? env
->mmu
.regs
[rn
] : env
->mmu
.regs
[MMU_R_TLBX
]);
242 if (cpu
->cfg
.mmu
< 2 || !cpu
->cfg
.mmu_tlb_access
) {
243 qemu_log_mask(LOG_GUEST_ERROR
, "MMU access on MMU-less system\n");
246 if (ext
&& rn
!= MMU_R_TLBLO
) {
247 qemu_log_mask(LOG_GUEST_ERROR
, "Extended access only to TLBLO.\n");
252 /* Writes to HI/LO trig writes to the mmu rams. */
255 i
= env
->mmu
.regs
[MMU_R_TLBX
] & 0xff;
256 if (rn
== MMU_R_TLBHI
) {
257 if (i
< 3 && !(v
& TLB_VALID
) && qemu_loglevel_mask(~0))
258 qemu_log_mask(LOG_GUEST_ERROR
,
259 "invalidating index %x at pc=%x\n",
261 env
->mmu
.tids
[i
] = env
->mmu
.regs
[MMU_R_PID
] & 0xff;
262 mmu_flush_idx(env
, i
);
264 tmp64
= env
->mmu
.rams
[rn
& 1][i
];
265 env
->mmu
.rams
[rn
& 1][i
] = deposit64(tmp64
, ext
* 32, 32, v
);
268 if (cpu
->cfg
.mmu_tlb_access
<= 1) {
269 qemu_log_mask(LOG_GUEST_ERROR
,
270 "Invalid access to MMU reg %d\n", rn
);
274 /* Changes to the zone protection reg flush the QEMU TLB.
275 Fortunately, these are very uncommon. */
276 if (v
!= env
->mmu
.regs
[rn
]) {
277 tlb_flush(env_cpu(env
));
279 env
->mmu
.regs
[rn
] = v
;
282 if (cpu
->cfg
.mmu_tlb_access
<= 1) {
283 qemu_log_mask(LOG_GUEST_ERROR
,
284 "Invalid access to MMU reg %d\n", rn
);
288 if (v
!= env
->mmu
.regs
[rn
]) {
289 mmu_change_pid(env
, v
);
290 env
->mmu
.regs
[rn
] = v
;
294 /* Bit 31 is read-only. */
295 env
->mmu
.regs
[rn
] = deposit32(env
->mmu
.regs
[rn
], 0, 31, v
);
299 MicroBlazeMMULookup lu
;
302 if (cpu
->cfg
.mmu_tlb_access
<= 1) {
303 qemu_log_mask(LOG_GUEST_ERROR
,
304 "Invalid access to MMU reg %d\n", rn
);
308 hit
= mmu_translate(cpu
, &lu
, v
& TLB_EPN_MASK
,
309 0, cpu_mmu_index(env_cpu(env
), false));
311 env
->mmu
.regs
[MMU_R_TLBX
] = lu
.idx
;
313 env
->mmu
.regs
[MMU_R_TLBX
] |= R_TBLX_MISS_MASK
;
318 qemu_log_mask(LOG_GUEST_ERROR
, "Invalid MMU register %d.\n", rn
);
323 void mmu_init(MicroBlazeMMU
*mmu
)
326 for (i
= 0; i
< ARRAY_SIZE(mmu
->regs
); i
++) {