2 * S390x MMU related functions
4 * Copyright (c) 2011 Alexander Graf
5 * Copyright (c) 2015 Thomas Huth, IBM Corporation
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
18 #include "qemu/osdep.h"
19 #include "qemu/error-report.h"
20 #include "exec/address-spaces.h"
23 #include "kvm_s390x.h"
24 #include "sysemu/kvm.h"
25 #include "sysemu/tcg.h"
26 #include "exec/exec-all.h"
29 #include "hw/s390x/storage-keys.h"
31 /* Fetch/store bits in the translation exception code: */
33 #define FS_WRITE 0x400
35 static void trigger_access_exception(CPUS390XState
*env
, uint32_t type
,
36 uint32_t ilen
, uint64_t tec
)
38 S390CPU
*cpu
= env_archcpu(env
);
41 kvm_s390_access_exception(cpu
, type
, tec
);
43 CPUState
*cs
= env_cpu(env
);
44 if (type
!= PGM_ADDRESSING
) {
45 stq_phys(cs
->as
, env
->psa
+ offsetof(LowCore
, trans_exc_code
), tec
);
47 trigger_pgm_exception(env
, type
, ilen
);
51 static void trigger_prot_fault(CPUS390XState
*env
, target_ulong vaddr
,
52 uint64_t asc
, int rw
, bool exc
)
56 tec
= vaddr
| (rw
== MMU_DATA_STORE
? FS_WRITE
: FS_READ
) | 4 | asc
>> 46;
62 trigger_access_exception(env
, PGM_PROTECTION
, ILEN_AUTO
, tec
);
65 static void trigger_page_fault(CPUS390XState
*env
, target_ulong vaddr
,
66 uint32_t type
, uint64_t asc
, int rw
, bool exc
)
71 tec
= vaddr
| (rw
== MMU_DATA_STORE
? FS_WRITE
: FS_READ
) | asc
>> 46;
77 /* Code accesses have an undefined ilc. */
78 if (rw
== MMU_INST_FETCH
) {
82 trigger_access_exception(env
, type
, ilen
, tec
);
85 /* check whether the address would be proteted by Low-Address Protection */
86 static bool is_low_address(uint64_t addr
)
88 return addr
<= 511 || (addr
>= 4096 && addr
<= 4607);
91 /* check whether Low-Address Protection is enabled for mmu_translate() */
92 static bool lowprot_enabled(const CPUS390XState
*env
, uint64_t asc
)
94 if (!(env
->cregs
[0] & CR0_LOWPROT
)) {
97 if (!(env
->psw
.mask
& PSW_MASK_DAT
)) {
101 /* Check the private-space control bit */
103 case PSW_ASC_PRIMARY
:
104 return !(env
->cregs
[1] & ASCE_PRIVATE_SPACE
);
105 case PSW_ASC_SECONDARY
:
106 return !(env
->cregs
[7] & ASCE_PRIVATE_SPACE
);
108 return !(env
->cregs
[13] & ASCE_PRIVATE_SPACE
);
110 /* We don't support access register mode */
111 error_report("unsupported addressing mode");
117 * Translate real address to absolute (= physical)
118 * address by taking care of the prefix mapping.
120 target_ulong
mmu_real2abs(CPUS390XState
*env
, target_ulong raddr
)
122 if (raddr
< 0x2000) {
123 return raddr
+ env
->psa
; /* Map the lowcore. */
124 } else if (raddr
>= env
->psa
&& raddr
< env
->psa
+ 0x2000) {
125 return raddr
- env
->psa
; /* Map the 0 page. */
130 /* Decode page table entry (normal 4KB page) */
131 static int mmu_translate_pte(CPUS390XState
*env
, target_ulong vaddr
,
132 uint64_t asc
, uint64_t pt_entry
,
133 target_ulong
*raddr
, int *flags
, int rw
, bool exc
)
135 if (pt_entry
& PAGE_INVALID
) {
136 trigger_page_fault(env
, vaddr
, PGM_PAGE_TRANS
, asc
, rw
, exc
);
139 if (pt_entry
& PAGE_RES0
) {
140 trigger_page_fault(env
, vaddr
, PGM_TRANS_SPEC
, asc
, rw
, exc
);
143 if (pt_entry
& PAGE_RO
) {
144 *flags
&= ~PAGE_WRITE
;
147 *raddr
= pt_entry
& ASCE_ORIGIN
;
151 /* Decode segment table entry */
152 static int mmu_translate_segment(CPUS390XState
*env
, target_ulong vaddr
,
153 uint64_t asc
, uint64_t st_entry
,
154 target_ulong
*raddr
, int *flags
, int rw
,
157 CPUState
*cs
= env_cpu(env
);
158 uint64_t origin
, offs
, pt_entry
;
160 if (st_entry
& SEGMENT_ENTRY_RO
) {
161 *flags
&= ~PAGE_WRITE
;
164 if ((st_entry
& SEGMENT_ENTRY_FC
) && (env
->cregs
[0] & CR0_EDAT
)) {
165 /* Decode EDAT1 segment frame absolute address (1MB page) */
166 *raddr
= (st_entry
& 0xfffffffffff00000ULL
) | (vaddr
& 0xfffff);
170 /* Look up 4KB page entry */
171 origin
= st_entry
& SEGMENT_ENTRY_ORIGIN
;
172 offs
= (vaddr
& VADDR_PX
) >> 9;
173 pt_entry
= ldq_phys(cs
->as
, origin
+ offs
);
174 return mmu_translate_pte(env
, vaddr
, asc
, pt_entry
, raddr
, flags
, rw
, exc
);
177 /* Decode region table entries */
178 static int mmu_translate_region(CPUS390XState
*env
, target_ulong vaddr
,
179 uint64_t asc
, uint64_t entry
, int level
,
180 target_ulong
*raddr
, int *flags
, int rw
,
183 CPUState
*cs
= env_cpu(env
);
184 uint64_t origin
, offs
, new_entry
;
185 const int pchks
[4] = {
186 PGM_SEGMENT_TRANS
, PGM_REG_THIRD_TRANS
,
187 PGM_REG_SEC_TRANS
, PGM_REG_FIRST_TRANS
190 origin
= entry
& REGION_ENTRY_ORIGIN
;
191 offs
= (vaddr
>> (17 + 11 * level
/ 4)) & 0x3ff8;
193 new_entry
= ldq_phys(cs
->as
, origin
+ offs
);
195 if ((new_entry
& REGION_ENTRY_INV
) != 0) {
196 trigger_page_fault(env
, vaddr
, pchks
[level
/ 4], asc
, rw
, exc
);
200 if ((new_entry
& REGION_ENTRY_TYPE_MASK
) != level
) {
201 trigger_page_fault(env
, vaddr
, PGM_TRANS_SPEC
, asc
, rw
, exc
);
205 if (level
== ASCE_TYPE_SEGMENT
) {
206 return mmu_translate_segment(env
, vaddr
, asc
, new_entry
, raddr
, flags
,
210 /* Check region table offset and length */
211 offs
= (vaddr
>> (28 + 11 * (level
- 4) / 4)) & 3;
212 if (offs
< ((new_entry
& REGION_ENTRY_TF
) >> 6)
213 || offs
> (new_entry
& REGION_ENTRY_LENGTH
)) {
214 trigger_page_fault(env
, vaddr
, pchks
[level
/ 4 - 1], asc
, rw
, exc
);
218 if ((env
->cregs
[0] & CR0_EDAT
) && (new_entry
& REGION_ENTRY_RO
)) {
219 *flags
&= ~PAGE_WRITE
;
222 /* yet another region */
223 return mmu_translate_region(env
, vaddr
, asc
, new_entry
, level
- 4,
224 raddr
, flags
, rw
, exc
);
227 static int mmu_translate_asce(CPUS390XState
*env
, target_ulong vaddr
,
228 uint64_t asc
, uint64_t asce
, target_ulong
*raddr
,
229 int *flags
, int rw
, bool exc
)
234 if (asce
& ASCE_REAL_SPACE
) {
240 level
= asce
& ASCE_TYPE_MASK
;
242 case ASCE_TYPE_REGION1
:
243 if ((vaddr
>> 62) > (asce
& ASCE_TABLE_LENGTH
)) {
244 trigger_page_fault(env
, vaddr
, PGM_REG_FIRST_TRANS
, asc
, rw
, exc
);
248 case ASCE_TYPE_REGION2
:
249 if (vaddr
& 0xffe0000000000000ULL
) {
250 trigger_page_fault(env
, vaddr
, PGM_ASCE_TYPE
, asc
, rw
, exc
);
253 if ((vaddr
>> 51 & 3) > (asce
& ASCE_TABLE_LENGTH
)) {
254 trigger_page_fault(env
, vaddr
, PGM_REG_SEC_TRANS
, asc
, rw
, exc
);
258 case ASCE_TYPE_REGION3
:
259 if (vaddr
& 0xfffffc0000000000ULL
) {
260 trigger_page_fault(env
, vaddr
, PGM_ASCE_TYPE
, asc
, rw
, exc
);
263 if ((vaddr
>> 40 & 3) > (asce
& ASCE_TABLE_LENGTH
)) {
264 trigger_page_fault(env
, vaddr
, PGM_REG_THIRD_TRANS
, asc
, rw
, exc
);
268 case ASCE_TYPE_SEGMENT
:
269 if (vaddr
& 0xffffffff80000000ULL
) {
270 trigger_page_fault(env
, vaddr
, PGM_ASCE_TYPE
, asc
, rw
, exc
);
273 if ((vaddr
>> 29 & 3) > (asce
& ASCE_TABLE_LENGTH
)) {
274 trigger_page_fault(env
, vaddr
, PGM_SEGMENT_TRANS
, asc
, rw
, exc
);
280 r
= mmu_translate_region(env
, vaddr
, asc
, asce
, level
, raddr
, flags
, rw
,
282 if (!r
&& rw
== MMU_DATA_STORE
&& !(*flags
& PAGE_WRITE
)) {
283 trigger_prot_fault(env
, vaddr
, asc
, rw
, exc
);
290 static void mmu_handle_skey(target_ulong addr
, int rw
, int *flags
)
292 static S390SKeysClass
*skeyclass
;
293 static S390SKeysState
*ss
;
297 if (unlikely(addr
>= ram_size
)) {
302 ss
= s390_get_skeys_device();
303 skeyclass
= S390_SKEYS_GET_CLASS(ss
);
307 * Whenever we create a new TLB entry, we set the storage key reference
308 * bit. In case we allow write accesses, we set the storage key change
309 * bit. Whenever the guest changes the storage key, we have to flush the
310 * TLBs of all CPUs (the whole TLB or all affected entries), so that the
311 * next reference/change will result in an MMU fault and make us properly
312 * update the storage key here.
314 * Note 1: "record of references ... is not necessarily accurate",
315 * "change bit may be set in case no storing has occurred".
316 * -> We can set reference/change bits even on exceptions.
317 * Note 2: certain accesses seem to ignore storage keys. For example,
318 * DAT translation does not set reference bits for table accesses.
320 * TODO: key-controlled protection. Only CPU accesses make use of the
321 * PSW key. CSS accesses are different - we have to pass in the key.
323 * TODO: we have races between getting and setting the key.
325 rc
= skeyclass
->get_skeys(ss
, addr
/ TARGET_PAGE_SIZE
, 1, &key
);
327 trace_get_skeys_nonzero(rc
);
335 * The TLB entry has to remain write-protected on read-faults if
336 * the storage key does not indicate a change already. Otherwise
337 * we might miss setting the change bit on write accesses.
340 *flags
&= ~PAGE_WRITE
;
347 g_assert_not_reached();
350 /* Any store/fetch sets the reference bit */
353 rc
= skeyclass
->set_skeys(ss
, addr
/ TARGET_PAGE_SIZE
, 1, &key
);
355 trace_set_skeys_nonzero(rc
);
360 * Translate a virtual (logical) address into a physical (absolute) address.
361 * @param vaddr the virtual address
362 * @param rw 0 = read, 1 = write, 2 = code fetch
363 * @param asc address space control (one of the PSW_ASC_* modes)
364 * @param raddr the translated address is stored to this pointer
365 * @param flags the PAGE_READ/WRITE/EXEC flags are stored to this pointer
366 * @param exc true = inject a program check if a fault occurred
367 * @return 0 if the translation was successful, -1 if a fault occurred
369 int mmu_translate(CPUS390XState
*env
, target_ulong vaddr
, int rw
, uint64_t asc
,
370 target_ulong
*raddr
, int *flags
, bool exc
)
376 *flags
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
377 if (is_low_address(vaddr
& TARGET_PAGE_MASK
) && lowprot_enabled(env
, asc
)) {
379 * If any part of this page is currently protected, make sure the
380 * TLB entry will not be reused.
382 * As the protected range is always the first 512 bytes of the
383 * two first pages, we are able to catch all writes to these areas
384 * just by looking at the start address (triggering the tlb miss).
386 *flags
|= PAGE_WRITE_INV
;
387 if (is_low_address(vaddr
) && rw
== MMU_DATA_STORE
) {
389 trigger_access_exception(env
, PGM_PROTECTION
, ILEN_AUTO
, 0);
395 vaddr
&= TARGET_PAGE_MASK
;
397 if (!(env
->psw
.mask
& PSW_MASK_DAT
)) {
403 case PSW_ASC_PRIMARY
:
404 asce
= env
->cregs
[1];
407 asce
= env
->cregs
[13];
409 case PSW_ASC_SECONDARY
:
410 asce
= env
->cregs
[7];
414 hw_error("guest switched to unknown asc mode\n");
418 /* perform the DAT translation */
419 r
= mmu_translate_asce(env
, vaddr
, asc
, asce
, raddr
, flags
, rw
, exc
);
425 /* Convert real address -> absolute address */
426 *raddr
= mmu_real2abs(env
, *raddr
);
428 mmu_handle_skey(*raddr
, rw
, flags
);
433 * translate_pages: Translate a set of consecutive logical page addresses
434 * to absolute addresses. This function is used for TCG and old KVM without
435 * the MEMOP interface.
437 static int translate_pages(S390CPU
*cpu
, vaddr addr
, int nr_pages
,
438 target_ulong
*pages
, bool is_write
)
440 uint64_t asc
= cpu
->env
.psw
.mask
& PSW_MASK_ASC
;
441 CPUS390XState
*env
= &cpu
->env
;
444 for (i
= 0; i
< nr_pages
; i
++) {
445 ret
= mmu_translate(env
, addr
, is_write
, asc
, &pages
[i
], &pflags
, true);
449 if (!address_space_access_valid(&address_space_memory
, pages
[i
],
450 TARGET_PAGE_SIZE
, is_write
,
451 MEMTXATTRS_UNSPECIFIED
)) {
452 trigger_access_exception(env
, PGM_ADDRESSING
, ILEN_AUTO
, 0);
455 addr
+= TARGET_PAGE_SIZE
;
462 * s390_cpu_virt_mem_rw:
463 * @laddr: the logical start address
464 * @ar: the access register number
465 * @hostbuf: buffer in host memory. NULL = do only checks w/o copying
466 * @len: length that should be transferred
467 * @is_write: true = write, false = read
468 * Returns: 0 on success, non-zero if an exception occurred
470 * Copy from/to guest memory using logical addresses. Note that we inject a
471 * program interrupt in case there is an error while accessing the memory.
473 * This function will always return (also for TCG), make sure to call
474 * s390_cpu_virt_mem_handle_exc() to properly exit the CPU loop.
476 int s390_cpu_virt_mem_rw(S390CPU
*cpu
, vaddr laddr
, uint8_t ar
, void *hostbuf
,
477 int len
, bool is_write
)
479 int currlen
, nr_pages
, i
;
484 ret
= kvm_s390_mem_op(cpu
, laddr
, ar
, hostbuf
, len
, is_write
);
490 nr_pages
= (((laddr
& ~TARGET_PAGE_MASK
) + len
- 1) >> TARGET_PAGE_BITS
)
492 pages
= g_malloc(nr_pages
* sizeof(*pages
));
494 ret
= translate_pages(cpu
, laddr
, nr_pages
, pages
, is_write
);
495 if (ret
== 0 && hostbuf
!= NULL
) {
496 /* Copy data by stepping through the area page by page */
497 for (i
= 0; i
< nr_pages
; i
++) {
498 currlen
= MIN(len
, TARGET_PAGE_SIZE
- (laddr
% TARGET_PAGE_SIZE
));
499 cpu_physical_memory_rw(pages
[i
] | (laddr
& ~TARGET_PAGE_MASK
),
500 hostbuf
, currlen
, is_write
);
511 void s390_cpu_virt_mem_handle_exc(S390CPU
*cpu
, uintptr_t ra
)
513 /* KVM will handle the interrupt automatically, TCG has to exit the TB */
516 cpu_loop_exit_restore(CPU(cpu
), ra
);
522 * Translate a real address into a physical (absolute) address.
523 * @param raddr the real address
524 * @param rw 0 = read, 1 = write, 2 = code fetch
525 * @param addr the translated address is stored to this pointer
526 * @param flags the PAGE_READ/WRITE/EXEC flags are stored to this pointer
527 * @return 0 if the translation was successful, < 0 if a fault occurred
529 int mmu_translate_real(CPUS390XState
*env
, target_ulong raddr
, int rw
,
530 target_ulong
*addr
, int *flags
)
532 const bool lowprot_enabled
= env
->cregs
[0] & CR0_LOWPROT
;
534 *flags
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
535 if (is_low_address(raddr
& TARGET_PAGE_MASK
) && lowprot_enabled
) {
536 /* see comment in mmu_translate() how this works */
537 *flags
|= PAGE_WRITE_INV
;
538 if (is_low_address(raddr
) && rw
== MMU_DATA_STORE
) {
539 trigger_access_exception(env
, PGM_PROTECTION
, ILEN_AUTO
, 0);
544 *addr
= mmu_real2abs(env
, raddr
& TARGET_PAGE_MASK
);
546 mmu_handle_skey(*addr
, rw
, flags
);