1 /*

     2  *  CRIS mmu emulation.

     3  *

     4  *  Copyright (c) 2007 AXIS Communications AB

     5  *  Written by Edgar E. Iglesias.

     6  *

     7  * This library is free software; you can redistribute it and/or

     8  * modify it under the terms of the GNU Lesser General Public

     9  * License as published by the Free Software Foundation; either

    10  * version 2 of the License, or (at your option) any later version.

    11  *

    12  * This library is distributed in the hope that it will be useful,

    13  * but WITHOUT ANY WARRANTY; without even the implied warranty of

    14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

    15  * Lesser General Public License for more details.

    16  *

    17  * You should have received a copy of the GNU Lesser General Public

    18  * License along with this library; if not, write to the Free Software

    19  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

    20  */

    21 

    22 #ifndef CONFIG_USER_ONLY

    23 

    24 #include <stdio.h>

    25 #include <string.h>

    26 #include <stdlib.h>

    27 

    28 #include "config.h"

    29 #include "cpu.h"

    30 #include "mmu.h"

    31 #include "exec-all.h"

    32 

    33 #ifdef DEBUG

    34 #define D(x) x

    35 #else

    36 #define D(x)

    37 #endif

    38 

    39 void cris_mmu_init(CPUState *env)

    40 {

    41 	env->mmu_rand_lfsr = 0xcccc;

    42 }

    43 

    44 #define SR_POLYNOM 0x8805

    45 static inline unsigned int compute_polynom(unsigned int sr)

    46 {

    47 	unsigned int i;

    48 	unsigned int f;

    49 

    50 	f = 0;

    51 	for (i = 0; i < 16; i++)

    52 		f += ((SR_POLYNOM >> i) & 1) & ((sr >> i) & 1);

    53 

    54 	return f;

    55 }

    56 

    57 static inline int cris_mmu_enabled(uint32_t rw_gc_cfg)

    58 {

    59 	return (rw_gc_cfg & 12) != 0;

    60 }

    61 

    62 static inline int cris_mmu_segmented_addr(int seg, uint32_t rw_mm_cfg)

    63 {

    64 	return (1 << seg) & rw_mm_cfg;

    65 }

    66 

    67 static uint32_t cris_mmu_translate_seg(CPUState *env, int seg)

    68 {

    69 	uint32_t base;

    70 	int i;

    71 

    72 	if (seg < 8)

    73 		base = env->sregs[SFR_RW_MM_KBASE_LO];

    74 	else

    75 		base = env->sregs[SFR_RW_MM_KBASE_HI];

    76 

    77 	i = seg & 7;

    78 	base >>= i * 4;

    79 	base &= 15;

    80 

    81 	base <<= 28;

    82 	return base;

    83 }

    84 /* Used by the tlb decoder.  */

    85 #define EXTRACT_FIELD(src, start, end) \

    86 	    (((src) >> start) & ((1 << (end - start + 1)) - 1))

    87 

    88 static inline void set_field(uint32_t *dst, unsigned int val, 

    89 			     unsigned int offset, unsigned int width)

    90 {

    91 	uint32_t mask;

    92 

    93 	mask = (1 << width) - 1;

    94 	mask <<= offset;

    95 	val <<= offset;

    96 

    97 	val &= mask;

    98 	*dst &= ~(mask);

    99 	*dst |= val;

   100 }

   101 

   102 #ifdef DEBUG

   103 static void dump_tlb(CPUState *env, int mmu)

   104 {

   105 	int set;

   106 	int idx;

   107 	uint32_t hi, lo, tlb_vpn, tlb_pfn;

   108 

   109 	for (set = 0; set < 4; set++) {

   110 		for (idx = 0; idx < 16; idx++) {

   111 			lo = env->tlbsets[mmu][set][idx].lo;

   112 			hi = env->tlbsets[mmu][set][idx].hi;

   113 			tlb_vpn = EXTRACT_FIELD(hi, 13, 31);

   114 			tlb_pfn = EXTRACT_FIELD(lo, 13, 31);

   115 

   116 			printf ("TLB: [%d][%d] hi=%x lo=%x v=%x p=%x\n", 

   117 					set, idx, hi, lo, tlb_vpn, tlb_pfn);

   118 		}

   119 	}

   120 }

   121 #endif

   122 

   123 /* rw 0 = read, 1 = write, 2 = exec.  */

   124 static int cris_mmu_translate_page(struct cris_mmu_result_t *res,

   125 				   CPUState *env, uint32_t vaddr,

   126 				   int rw, int usermode)

   127 {

   128 	unsigned int vpage;

   129 	unsigned int idx;

   130 	uint32_t pid, lo, hi;

   131 	uint32_t tlb_vpn, tlb_pfn = 0;

   132 	int tlb_pid, tlb_g, tlb_v, tlb_k, tlb_w, tlb_x;

   133 	int cfg_v, cfg_k, cfg_w, cfg_x;	

   134 	int set, match = 0;

   135 	uint32_t r_cause;

   136 	uint32_t r_cfg;

   137 	int rwcause;

   138 	int mmu = 1; /* Data mmu is default.  */

   139 	int vect_base;

   140 

   141 	r_cause = env->sregs[SFR_R_MM_CAUSE];

   142 	r_cfg = env->sregs[SFR_RW_MM_CFG];

   143 	pid = env->pregs[PR_PID] & 0xff;

   144 

   145 	switch (rw) {

   146 		case 2: rwcause = CRIS_MMU_ERR_EXEC; mmu = 0; break;

   147 		case 1: rwcause = CRIS_MMU_ERR_WRITE; break;

   148 		default:

   149 		case 0: rwcause = CRIS_MMU_ERR_READ; break;

   150 	}

   151 

   152 	/* I exception vectors 4 - 7, D 8 - 11.  */

   153 	vect_base = (mmu + 1) * 4;

   154 

   155 	vpage = vaddr >> 13;

   156 

   157 	/* We know the index which to check on each set.

   158 	   Scan both I and D.  */

   159 #if 0

   160 	for (set = 0; set < 4; set++) {

   161 		for (idx = 0; idx < 16; idx++) {

   162 			lo = env->tlbsets[mmu][set][idx].lo;

   163 			hi = env->tlbsets[mmu][set][idx].hi;

   164 			tlb_vpn = EXTRACT_FIELD(hi, 13, 31);

   165 			tlb_pfn = EXTRACT_FIELD(lo, 13, 31);

   166 

   167 			printf ("TLB: [%d][%d] hi=%x lo=%x v=%x p=%x\n", 

   168 					set, idx, hi, lo, tlb_vpn, tlb_pfn);

   169 		}

   170 	}

   171 #endif

   172 

   173 	idx = vpage & 15;

   174 	for (set = 0; set < 4; set++)

   175 	{

   176 		lo = env->tlbsets[mmu][set][idx].lo;

   177 		hi = env->tlbsets[mmu][set][idx].hi;

   178 

   179 		tlb_vpn = hi >> 13;

   180 		tlb_pid = EXTRACT_FIELD(hi, 0, 7);

   181 		tlb_g  = EXTRACT_FIELD(lo, 4, 4);

   182 

   183 		D(fprintf(logfile, 

   184 			 "TLB[%d][%d][%d] v=%x vpage=%x lo=%x hi=%x\n", 

   185 			 mmu, set, idx, tlb_vpn, vpage, lo, hi));

   186 		if ((tlb_g || (tlb_pid == pid))

   187 		    && tlb_vpn == vpage) {

   188 			match = 1;

   189 			break;

   190 		}

   191 	}

   192 

   193 	res->bf_vec = vect_base;

   194 	if (match) {

   195 		cfg_w  = EXTRACT_FIELD(r_cfg, 19, 19);

   196 		cfg_k  = EXTRACT_FIELD(r_cfg, 18, 18);

   197 		cfg_x  = EXTRACT_FIELD(r_cfg, 17, 17);

   198 		cfg_v  = EXTRACT_FIELD(r_cfg, 16, 16);

   199 

   200 		tlb_pfn = EXTRACT_FIELD(lo, 13, 31);

   201 		tlb_v = EXTRACT_FIELD(lo, 3, 3);

   202 		tlb_k = EXTRACT_FIELD(lo, 2, 2);

   203 		tlb_w = EXTRACT_FIELD(lo, 1, 1);

   204 		tlb_x = EXTRACT_FIELD(lo, 0, 0);

   205 

   206 		/*

   207 		set_exception_vector(0x04, i_mmu_refill);

   208 		set_exception_vector(0x05, i_mmu_invalid);

   209 		set_exception_vector(0x06, i_mmu_access);

   210 		set_exception_vector(0x07, i_mmu_execute);

   211 		set_exception_vector(0x08, d_mmu_refill);

   212 		set_exception_vector(0x09, d_mmu_invalid);

   213 		set_exception_vector(0x0a, d_mmu_access);

   214 		set_exception_vector(0x0b, d_mmu_write);

   215 		*/

   216 		if (cfg_k && tlb_k && usermode) {

   217 			D(printf ("tlb: kernel protected %x lo=%x pc=%x\n", 

   218 				  vaddr, lo, env->pc));

   219 			match = 0;

   220 			res->bf_vec = vect_base + 2;

   221 		} else if (rw == 1 && cfg_w && !tlb_w) {

   222 			D(printf ("tlb: write protected %x lo=%x pc=%x\n", 

   223 				  vaddr, lo, env->pc));

   224 			match = 0;

   225 			/* write accesses never go through the I mmu.  */

   226 			res->bf_vec = vect_base + 3;

   227 		} else if (rw == 2 && cfg_x && !tlb_x) {

   228 			D(printf ("tlb: exec protected %x lo=%x pc=%x\n", 

   229 				 vaddr, lo, env->pc));

   230 			match = 0;

   231 			res->bf_vec = vect_base + 3;

   232 		} else if (cfg_v && !tlb_v) {

   233 			D(printf ("tlb: invalid %x\n", vaddr));

   234 			match = 0;

   235 			res->bf_vec = vect_base + 1;

   236 		}

   237 

   238 		res->prot = 0;

   239 		if (match) {

   240 			res->prot |= PAGE_READ;

   241 			if (tlb_w)

   242 				res->prot |= PAGE_WRITE;

   243 			if (tlb_x)

   244 				res->prot |= PAGE_EXEC;

   245 		}

   246 		else

   247 			D(dump_tlb(env, mmu));

   248 	} else {

   249 		/* If refill, provide a randomized set.  */

   250 		set = env->mmu_rand_lfsr & 3;

   251 	}

   252 

   253 	if (!match) {

   254 		unsigned int f;

   255 

   256 		/* Update lfsr at every fault.  */

   257 		f = compute_polynom(env->mmu_rand_lfsr);

   258 		env->mmu_rand_lfsr >>= 1;

   259 		env->mmu_rand_lfsr |= (f << 15);

   260 		env->mmu_rand_lfsr &= 0xffff;

   261 		

   262 		/* Compute index.  */

   263 		idx = vpage & 15;

   264 

   265 		/* Update RW_MM_TLB_SEL.  */

   266 		env->sregs[SFR_RW_MM_TLB_SEL] = 0;

   267 		set_field(&env->sregs[SFR_RW_MM_TLB_SEL], idx, 0, 4);

   268 		set_field(&env->sregs[SFR_RW_MM_TLB_SEL], set, 4, 2);

   269 

   270 		/* Update RW_MM_CAUSE.  */

   271 		set_field(&r_cause, rwcause, 8, 2);

   272 		set_field(&r_cause, vpage, 13, 19);

   273 		set_field(&r_cause, pid, 0, 8);

   274 		env->sregs[SFR_R_MM_CAUSE] = r_cause;

   275 		D(printf("refill vaddr=%x pc=%x\n", vaddr, env->pc));

   276 	}

   277 

   278 	D(printf ("%s rw=%d mtch=%d pc=%x va=%x vpn=%x tlbvpn=%x pfn=%x pid=%x"

   279 		  " %x cause=%x sel=%x sp=%x %x %x\n",

   280 		  __func__, rw, match, env->pc,

   281 		  vaddr, vpage,

   282 		  tlb_vpn, tlb_pfn, tlb_pid, 

   283 		  pid,

   284 		  r_cause,

   285 		  env->sregs[SFR_RW_MM_TLB_SEL],

   286 		  env->regs[R_SP], env->pregs[PR_USP], env->ksp));

   287 

   288 	res->pfn = tlb_pfn;

   289 	return !match;

   290 }

   291 

   292 void cris_mmu_flush_pid(CPUState *env, uint32_t pid)

   293 {

   294 	target_ulong vaddr;

   295 	unsigned int idx;

   296 	uint32_t lo, hi;

   297 	uint32_t tlb_vpn;

   298 	int tlb_pid, tlb_g, tlb_v, tlb_k;

   299 	unsigned int set;

   300 	unsigned int mmu;

   301 

   302 	pid &= 0xff;

   303 	for (mmu = 0; mmu < 2; mmu++) {

   304 		for (set = 0; set < 4; set++)

   305 		{

   306 			for (idx = 0; idx < 16; idx++) {

   307 				lo = env->tlbsets[mmu][set][idx].lo;

   308 				hi = env->tlbsets[mmu][set][idx].hi;

   309 				

   310 				tlb_vpn = EXTRACT_FIELD(hi, 13, 31);

   311 				tlb_pid = EXTRACT_FIELD(hi, 0, 7);

   312 				tlb_g  = EXTRACT_FIELD(lo, 4, 4);

   313 				tlb_v = EXTRACT_FIELD(lo, 3, 3);

   314 				tlb_k = EXTRACT_FIELD(lo, 2, 2);

   315 

   316 				/* Kernel protected areas need to be flushed

   317 				   as well.  */

   318 				if (tlb_v && !tlb_g && (tlb_pid == pid || tlb_k)) {

   319 					vaddr = tlb_vpn << TARGET_PAGE_BITS;

   320 					D(fprintf(logfile,

   321 						  "flush pid=%x vaddr=%x\n", 

   322 						  pid, vaddr));

   323 					tlb_flush_page(env, vaddr);

   324 				}

   325 			}

   326 		}

   327 	}

   328 }

   329 

   330 int cris_mmu_translate(struct cris_mmu_result_t *res,

   331 		       CPUState *env, uint32_t vaddr,

   332 		       int rw, int mmu_idx)

   333 {

   334 	uint32_t phy = vaddr;

   335 	int seg;

   336 	int miss = 0;

   337 	int is_user = mmu_idx == MMU_USER_IDX;

   338 	uint32_t old_srs;

   339 

   340 	old_srs= env->pregs[PR_SRS];

   341 

   342 	/* rw == 2 means exec, map the access to the insn mmu.  */

   343 	env->pregs[PR_SRS] = rw == 2 ? 1 : 2;

   344 

   345 	if (!cris_mmu_enabled(env->sregs[SFR_RW_GC_CFG])) {

   346 		res->phy = vaddr;

   347 		res->prot = PAGE_BITS;

   348 		goto done;

   349 	}

   350 

   351 	seg = vaddr >> 28;

   352 	if (cris_mmu_segmented_addr(seg, env->sregs[SFR_RW_MM_CFG]))

   353 	{

   354 		uint32_t base;

   355 

   356 		miss = 0;

   357 		base = cris_mmu_translate_seg(env, seg);

   358 		phy = base | (0x0fffffff & vaddr);

   359 		res->phy = phy;

   360 		res->prot = PAGE_BITS;

   361 	}

   362 	else

   363 	{

   364 		miss = cris_mmu_translate_page(res, env, vaddr, rw, is_user);

   365 		phy = (res->pfn << 13);

   366 		res->phy = phy;

   367 	}

   368   done:

   369 	env->pregs[PR_SRS] = old_srs;

   370 	return miss;

   371 }

   372 #endif