1 /* 2 * HPPA memory access helper routines 3 * 4 * Copyright (c) 2017 Helge Deller 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2.1 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 #include "qemu/osdep.h" 21 #include "qemu/log.h" 22 #include "cpu.h" 23 #include "exec/exec-all.h" 24 #include "exec/cputlb.h" 25 #include "accel/tcg/cpu-mmu-index.h" 26 #include "accel/tcg/probe.h" 27 #include "exec/page-protection.h" 28 #include "exec/target_page.h" 29 #include "exec/helper-proto.h" 30 #include "hw/core/cpu.h" 31 #include "trace.h" 32 33 hwaddr hppa_abs_to_phys_pa2_w1(vaddr addr) 34 { 35 /* 36 * Figure H-8 "62-bit Absolute Accesses when PSW W-bit is 1" describes 37 * an algorithm in which a 62-bit absolute address is transformed to 38 * a 64-bit physical address. This must then be combined with that 39 * pictured in Figure H-11 "Physical Address Space Mapping", in which 40 * the full physical address is truncated to the N-bit physical address 41 * supported by the implementation. 42 * 43 * Since the supported physical address space is below 54 bits, the 44 * H-8 algorithm is moot and all that is left is to truncate. 45 */ 46 QEMU_BUILD_BUG_ON(TARGET_PHYS_ADDR_SPACE_BITS > 54); 47 return sextract64(addr, 0, TARGET_PHYS_ADDR_SPACE_BITS); 48 } 49 50 hwaddr hppa_abs_to_phys_pa2_w0(vaddr addr) 51 { 52 /* 53 * See Figure H-10, "Absolute Accesses when PSW W-bit is 0", 54 * combined with Figure H-11, as above. 55 */ 56 if (likely(extract32(addr, 28, 4) != 0xf)) { 57 /* Memory address space */ 58 addr = (uint32_t)addr; 59 } else if (extract32(addr, 24, 4) != 0) { 60 /* I/O address space */ 61 addr = (int32_t)addr; 62 } else { 63 /* 64 * PDC address space: 65 * Figures H-10 and H-11 of the parisc2.0 spec do not specify 66 * where to map into the 64-bit PDC address space. 67 * We map with an offset which equals the 32-bit address, which 68 * is what can be seen on physical machines too. 69 */ 70 addr = (uint32_t)addr; 71 addr |= -1ull << (TARGET_PHYS_ADDR_SPACE_BITS - 4); 72 } 73 return addr; 74 } 75 76 static HPPATLBEntry *hppa_find_tlb(CPUHPPAState *env, vaddr addr) 77 { 78 IntervalTreeNode *i = interval_tree_iter_first(&env->tlb_root, addr, addr); 79 80 if (i) { 81 HPPATLBEntry *ent = container_of(i, HPPATLBEntry, itree); 82 trace_hppa_tlb_find_entry(env, ent, ent->entry_valid, 83 ent->itree.start, ent->itree.last, ent->pa); 84 return ent; 85 } 86 trace_hppa_tlb_find_entry_not_found(env, addr); 87 return NULL; 88 } 89 90 static void hppa_flush_tlb_ent(CPUHPPAState *env, HPPATLBEntry *ent, 91 bool force_flush_btlb) 92 { 93 CPUState *cs = env_cpu(env); 94 bool is_btlb; 95 96 if (!ent->entry_valid) { 97 return; 98 } 99 100 trace_hppa_tlb_flush_ent(env, ent, ent->itree.start, 101 ent->itree.last, ent->pa); 102 103 tlb_flush_range_by_mmuidx(cs, ent->itree.start, 104 ent->itree.last - ent->itree.start + 1, 105 HPPA_MMU_FLUSH_MASK, TARGET_LONG_BITS); 106 107 /* Never clear BTLBs, unless forced to do so. */ 108 is_btlb = ent < &env->tlb[HPPA_BTLB_ENTRIES(env)]; 109 if (is_btlb && !force_flush_btlb) { 110 return; 111 } 112 113 interval_tree_remove(&ent->itree, &env->tlb_root); 114 memset(ent, 0, sizeof(*ent)); 115 116 if (!is_btlb) { 117 ent->unused_next = env->tlb_unused; 118 env->tlb_unused = ent; 119 } 120 } 121 122 static void hppa_flush_tlb_range(CPUHPPAState *env, vaddr va_b, vaddr va_e) 123 { 124 IntervalTreeNode *i, *n; 125 126 i = interval_tree_iter_first(&env->tlb_root, va_b, va_e); 127 for (; i ; i = n) { 128 HPPATLBEntry *ent = container_of(i, HPPATLBEntry, itree); 129 130 /* 131 * Find the next entry now: In the normal case the current entry 132 * will be removed, but in the BTLB case it will remain. 133 */ 134 n = interval_tree_iter_next(i, va_b, va_e); 135 hppa_flush_tlb_ent(env, ent, false); 136 } 137 } 138 139 static HPPATLBEntry *hppa_alloc_tlb_ent(CPUHPPAState *env) 140 { 141 HPPATLBEntry *ent = env->tlb_unused; 142 143 if (ent == NULL) { 144 uint32_t btlb_entries = HPPA_BTLB_ENTRIES(env); 145 uint32_t i = env->tlb_last; 146 147 if (i < btlb_entries || i >= ARRAY_SIZE(env->tlb)) { 148 i = btlb_entries; 149 } 150 env->tlb_last = i + 1; 151 152 ent = &env->tlb[i]; 153 hppa_flush_tlb_ent(env, ent, false); 154 } 155 156 env->tlb_unused = ent->unused_next; 157 return ent; 158 } 159 160 #define ACCESS_ID_MASK 0xffff 161 162 /* Return the set of protections allowed by a PID match. */ 163 static int match_prot_id_1(uint32_t access_id, uint32_t prot_id) 164 { 165 if (((access_id ^ (prot_id >> 1)) & ACCESS_ID_MASK) == 0) { 166 return (prot_id & 1 167 ? PAGE_EXEC | PAGE_READ 168 : PAGE_EXEC | PAGE_READ | PAGE_WRITE); 169 } 170 return 0; 171 } 172 173 static int match_prot_id32(CPUHPPAState *env, uint32_t access_id) 174 { 175 int r, i; 176 177 for (i = CR_PID1; i <= CR_PID4; ++i) { 178 r = match_prot_id_1(access_id, env->cr[i]); 179 if (r) { 180 return r; 181 } 182 } 183 return 0; 184 } 185 186 static int match_prot_id64(CPUHPPAState *env, uint32_t access_id) 187 { 188 int r, i; 189 190 for (i = CR_PID1; i <= CR_PID4; ++i) { 191 r = match_prot_id_1(access_id, env->cr[i]); 192 if (r) { 193 return r; 194 } 195 r = match_prot_id_1(access_id, env->cr[i] >> 32); 196 if (r) { 197 return r; 198 } 199 } 200 return 0; 201 } 202 203 int hppa_get_physical_address(CPUHPPAState *env, vaddr addr, int mmu_idx, 204 int type, MemOp mop, hwaddr *pphys, int *pprot) 205 { 206 hwaddr phys; 207 int prot, r_prot, w_prot, x_prot, priv; 208 HPPATLBEntry *ent; 209 int ret = -1; 210 211 /* Virtual translation disabled. Map absolute to physical. */ 212 if (MMU_IDX_MMU_DISABLED(mmu_idx)) { 213 switch (mmu_idx) { 214 case MMU_ABS_W_IDX: 215 phys = hppa_abs_to_phys_pa2_w1(addr); 216 break; 217 case MMU_ABS_IDX: 218 if (hppa_is_pa20(env)) { 219 phys = hppa_abs_to_phys_pa2_w0(addr); 220 } else { 221 phys = (uint32_t)addr; 222 } 223 break; 224 default: 225 g_assert_not_reached(); 226 } 227 prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 228 goto egress_align; 229 } 230 231 /* Find a valid tlb entry that matches the virtual address. */ 232 ent = hppa_find_tlb(env, addr); 233 if (ent == NULL) { 234 phys = 0; 235 prot = 0; 236 ret = (type == PAGE_EXEC) ? EXCP_ITLB_MISS : EXCP_DTLB_MISS; 237 goto egress; 238 } 239 240 /* We now know the physical address. */ 241 phys = ent->pa + (addr - ent->itree.start); 242 243 /* Map TLB access_rights field to QEMU protection. */ 244 priv = MMU_IDX_TO_PRIV(mmu_idx); 245 r_prot = (priv <= ent->ar_pl1) * PAGE_READ; 246 w_prot = (priv <= ent->ar_pl2) * PAGE_WRITE; 247 x_prot = (ent->ar_pl2 <= priv && priv <= ent->ar_pl1) * PAGE_EXEC; 248 switch (ent->ar_type) { 249 case 0: /* read-only: data page */ 250 prot = r_prot; 251 break; 252 case 1: /* read/write: dynamic data page */ 253 prot = r_prot | w_prot; 254 break; 255 case 2: /* read/execute: normal code page */ 256 prot = r_prot | x_prot; 257 break; 258 case 3: /* read/write/execute: dynamic code page */ 259 prot = r_prot | w_prot | x_prot; 260 break; 261 default: /* execute: promote to privilege level type & 3 */ 262 prot = x_prot; 263 break; 264 } 265 266 /* 267 * No guest access type indicates a non-architectural access from 268 * within QEMU. Bypass checks for access, D, B, P and T bits. 269 */ 270 if (type == 0) { 271 goto egress; 272 } 273 274 if (unlikely(!(prot & type))) { 275 /* Not allowed -- Inst/Data Memory Access Rights Fault. */ 276 ret = (type & PAGE_EXEC) ? EXCP_IMP : EXCP_DMAR; 277 goto egress; 278 } 279 280 /* access_id == 0 means public page and no check is performed */ 281 if (ent->access_id && MMU_IDX_TO_P(mmu_idx)) { 282 int access_prot = (hppa_is_pa20(env) 283 ? match_prot_id64(env, ent->access_id) 284 : match_prot_id32(env, ent->access_id)); 285 if (unlikely(!(type & access_prot))) { 286 /* Not allowed -- Inst/Data Memory Protection Id Fault. */ 287 ret = type & PAGE_EXEC ? EXCP_IMP : EXCP_DMPI; 288 goto egress; 289 } 290 /* Otherwise exclude permissions not allowed (i.e WD). */ 291 prot &= access_prot; 292 } 293 294 /* 295 * In reverse priority order, check for conditions which raise faults. 296 * Remove PROT bits that cover the condition we want to check, 297 * so that the resulting PROT will force a re-check of the 298 * architectural TLB entry for the next access. 299 */ 300 if (unlikely(ent->t)) { 301 prot &= PAGE_EXEC; 302 if (!(type & PAGE_EXEC)) { 303 /* The T bit is set -- Page Reference Fault. */ 304 ret = EXCP_PAGE_REF; 305 } 306 } 307 if (unlikely(!ent->d)) { 308 prot &= PAGE_READ | PAGE_EXEC; 309 if (type & PAGE_WRITE) { 310 /* The D bit is not set -- TLB Dirty Bit Fault. */ 311 ret = EXCP_TLB_DIRTY; 312 } 313 } 314 if (unlikely(ent->b)) { 315 prot &= PAGE_READ | PAGE_EXEC; 316 if (type & PAGE_WRITE) { 317 /* 318 * The B bit is set -- Data Memory Break Fault. 319 * Except when PSW_X is set, allow this single access to succeed. 320 * The write bit will be invalidated for subsequent accesses. 321 */ 322 if (env->psw_xb & PSW_X) { 323 prot |= PAGE_WRITE_INV; 324 } else { 325 ret = EXCP_DMB; 326 } 327 } 328 } 329 330 egress_align: 331 if (addr & ((1u << memop_alignment_bits(mop)) - 1)) { 332 ret = EXCP_UNALIGN; 333 } 334 335 egress: 336 *pphys = phys; 337 *pprot = prot; 338 trace_hppa_tlb_get_physical_address(env, ret, prot, addr, phys); 339 return ret; 340 } 341 342 hwaddr hppa_cpu_get_phys_page_debug(CPUState *cs, vaddr addr) 343 { 344 HPPACPU *cpu = HPPA_CPU(cs); 345 hwaddr phys; 346 int prot, excp, mmu_idx; 347 348 /* If the (data) mmu is disabled, bypass translation. */ 349 /* ??? We really ought to know if the code mmu is disabled too, 350 in order to get the correct debugging dumps. */ 351 mmu_idx = (cpu->env.psw & PSW_D ? MMU_KERNEL_IDX : 352 cpu->env.psw & PSW_W ? MMU_ABS_W_IDX : MMU_ABS_IDX); 353 354 excp = hppa_get_physical_address(&cpu->env, addr, mmu_idx, 0, 0, 355 &phys, &prot); 356 357 /* Since we're translating for debugging, the only error that is a 358 hard error is no translation at all. Otherwise, while a real cpu 359 access might not have permission, the debugger does. */ 360 return excp == EXCP_DTLB_MISS ? -1 : phys; 361 } 362 363 void hppa_set_ior_and_isr(CPUHPPAState *env, vaddr addr, bool mmu_disabled) 364 { 365 if (env->psw & PSW_Q) { 366 /* 367 * For pa1.x, the offset and space never overlap, and so we 368 * simply extract the high and low part of the virtual address. 369 * 370 * For pa2.0, the formation of these are described in section 371 * "Interruption Parameter Registers", page 2-15. 372 */ 373 env->cr[CR_IOR] = (uint32_t)addr; 374 env->cr[CR_ISR] = addr >> 32; 375 376 if (hppa_is_pa20(env)) { 377 if (mmu_disabled) { 378 /* 379 * If data translation was disabled, the ISR contains 380 * the upper portion of the abs address, zero-extended. 381 */ 382 env->cr[CR_ISR] &= 0x3fffffff; 383 } else { 384 /* 385 * If data translation was enabled, the upper two bits 386 * of the IOR (the b field) are equal to the two space 387 * bits from the base register used to form the gva. 388 */ 389 uint64_t b; 390 391 b = env->unwind_breg ? env->gr[env->unwind_breg] : 0; 392 b >>= (env->psw & PSW_W ? 62 : 30); 393 env->cr[CR_IOR] |= b << 62; 394 } 395 } 396 } 397 } 398 399 G_NORETURN static void 400 raise_exception_with_ior(CPUHPPAState *env, int excp, uintptr_t retaddr, 401 vaddr addr, bool mmu_disabled) 402 { 403 CPUState *cs = env_cpu(env); 404 405 cs->exception_index = excp; 406 cpu_restore_state(cs, retaddr); 407 hppa_set_ior_and_isr(env, addr, mmu_disabled); 408 409 cpu_loop_exit(cs); 410 } 411 412 void hppa_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr, 413 vaddr addr, unsigned size, 414 MMUAccessType access_type, 415 int mmu_idx, MemTxAttrs attrs, 416 MemTxResult response, uintptr_t retaddr) 417 { 418 CPUHPPAState *env = cpu_env(cs); 419 420 qemu_log_mask(LOG_GUEST_ERROR, "HPMC at " TARGET_FMT_lx ":" TARGET_FMT_lx 421 " while accessing I/O at %#08" HWADDR_PRIx "\n", 422 env->iasq_f, env->iaoq_f, physaddr); 423 424 /* FIXME: Enable HPMC exceptions when firmware has clean device probing */ 425 if (0) { 426 raise_exception_with_ior(env, EXCP_HPMC, retaddr, addr, 427 MMU_IDX_MMU_DISABLED(mmu_idx)); 428 } 429 } 430 431 bool hppa_cpu_tlb_fill_align(CPUState *cs, CPUTLBEntryFull *out, vaddr addr, 432 MMUAccessType type, int mmu_idx, 433 MemOp memop, int size, bool probe, uintptr_t ra) 434 { 435 CPUHPPAState *env = cpu_env(cs); 436 int prot, excp, a_prot; 437 hwaddr phys; 438 439 switch (type) { 440 case MMU_INST_FETCH: 441 a_prot = PAGE_EXEC; 442 break; 443 case MMU_DATA_STORE: 444 a_prot = PAGE_WRITE; 445 break; 446 default: 447 a_prot = PAGE_READ; 448 break; 449 } 450 451 excp = hppa_get_physical_address(env, addr, mmu_idx, a_prot, memop, 452 &phys, &prot); 453 if (unlikely(excp >= 0)) { 454 if (probe) { 455 return false; 456 } 457 trace_hppa_tlb_fill_excp(env, addr, size, type, mmu_idx); 458 459 /* Failure. Raise the indicated exception. */ 460 raise_exception_with_ior(env, excp, ra, addr, 461 MMU_IDX_MMU_DISABLED(mmu_idx)); 462 } 463 464 trace_hppa_tlb_fill_success(env, addr & TARGET_PAGE_MASK, 465 phys & TARGET_PAGE_MASK, size, type, mmu_idx); 466 467 /* 468 * Success! Store the translation into the QEMU TLB. 469 * Note that we always install a single-page entry, because that 470 * is what works best with softmmu -- anything else will trigger 471 * the large page protection mask. We do not require this, 472 * because we record the large page here in the hppa tlb. 473 */ 474 memset(out, 0, sizeof(*out)); 475 out->phys_addr = phys; 476 out->prot = prot; 477 out->attrs = MEMTXATTRS_UNSPECIFIED; 478 out->lg_page_size = TARGET_PAGE_BITS; 479 480 return true; 481 } 482 483 /* Insert (Insn/Data) TLB Address. Note this is PA 1.1 only. */ 484 void HELPER(itlba_pa11)(CPUHPPAState *env, target_ulong addr, target_ulong reg) 485 { 486 HPPATLBEntry *ent; 487 488 /* Zap any old entries covering ADDR. */ 489 addr &= TARGET_PAGE_MASK; 490 hppa_flush_tlb_range(env, addr, addr + TARGET_PAGE_SIZE - 1); 491 492 ent = env->tlb_partial; 493 if (ent == NULL) { 494 ent = hppa_alloc_tlb_ent(env); 495 env->tlb_partial = ent; 496 } 497 498 /* Note that ent->entry_valid == 0 already. */ 499 ent->itree.start = addr; 500 ent->itree.last = addr + TARGET_PAGE_SIZE - 1; 501 ent->pa = extract32(reg, 5, 20) << TARGET_PAGE_BITS; 502 trace_hppa_tlb_itlba(env, ent, ent->itree.start, ent->itree.last, ent->pa); 503 } 504 505 static void set_access_bits_pa11(CPUHPPAState *env, HPPATLBEntry *ent, 506 target_ulong reg) 507 { 508 ent->access_id = extract32(reg, 1, 18); 509 ent->u = extract32(reg, 19, 1); 510 ent->ar_pl2 = extract32(reg, 20, 2); 511 ent->ar_pl1 = extract32(reg, 22, 2); 512 ent->ar_type = extract32(reg, 24, 3); 513 ent->b = extract32(reg, 27, 1); 514 ent->d = extract32(reg, 28, 1); 515 ent->t = extract32(reg, 29, 1); 516 ent->entry_valid = 1; 517 518 interval_tree_insert(&ent->itree, &env->tlb_root); 519 trace_hppa_tlb_itlbp(env, ent, ent->access_id, ent->u, ent->ar_pl2, 520 ent->ar_pl1, ent->ar_type, ent->b, ent->d, ent->t); 521 } 522 523 /* Insert (Insn/Data) TLB Protection. Note this is PA 1.1 only. */ 524 void HELPER(itlbp_pa11)(CPUHPPAState *env, target_ulong addr, target_ulong reg) 525 { 526 HPPATLBEntry *ent = env->tlb_partial; 527 528 if (ent) { 529 env->tlb_partial = NULL; 530 if (ent->itree.start <= addr && addr <= ent->itree.last) { 531 set_access_bits_pa11(env, ent, reg); 532 return; 533 } 534 } 535 qemu_log_mask(LOG_GUEST_ERROR, "ITLBP not following ITLBA\n"); 536 } 537 538 static void itlbt_pa20(CPUHPPAState *env, target_ulong r1, 539 target_ulong r2, vaddr va_b) 540 { 541 HPPATLBEntry *ent; 542 vaddr va_e; 543 uint64_t va_size; 544 int mask_shift; 545 546 mask_shift = 2 * (r1 & 0xf); 547 va_size = (uint64_t)TARGET_PAGE_SIZE << mask_shift; 548 va_b &= -va_size; 549 va_e = va_b + va_size - 1; 550 551 hppa_flush_tlb_range(env, va_b, va_e); 552 ent = hppa_alloc_tlb_ent(env); 553 554 ent->itree.start = va_b; 555 ent->itree.last = va_e; 556 557 /* Extract all 52 bits present in the page table entry. */ 558 ent->pa = r1 << (TARGET_PAGE_BITS - 5); 559 /* Align per the page size. */ 560 ent->pa &= TARGET_PAGE_MASK << mask_shift; 561 /* Ignore the bits beyond physical address space. */ 562 ent->pa = sextract64(ent->pa, 0, TARGET_PHYS_ADDR_SPACE_BITS); 563 564 ent->t = extract64(r2, 61, 1); 565 ent->d = extract64(r2, 60, 1); 566 ent->b = extract64(r2, 59, 1); 567 ent->ar_type = extract64(r2, 56, 3); 568 ent->ar_pl1 = extract64(r2, 54, 2); 569 ent->ar_pl2 = extract64(r2, 52, 2); 570 ent->u = extract64(r2, 51, 1); 571 /* o = bit 50 */ 572 /* p = bit 49 */ 573 ent->access_id = extract64(r2, 1, 31); 574 ent->entry_valid = 1; 575 576 interval_tree_insert(&ent->itree, &env->tlb_root); 577 trace_hppa_tlb_itlba(env, ent, ent->itree.start, ent->itree.last, ent->pa); 578 trace_hppa_tlb_itlbp(env, ent, ent->access_id, ent->u, 579 ent->ar_pl2, ent->ar_pl1, ent->ar_type, 580 ent->b, ent->d, ent->t); 581 } 582 583 void HELPER(idtlbt_pa20)(CPUHPPAState *env, target_ulong r1, target_ulong r2) 584 { 585 vaddr va_b = deposit64(env->cr[CR_IOR], 32, 32, env->cr[CR_ISR]); 586 itlbt_pa20(env, r1, r2, va_b); 587 } 588 589 void HELPER(iitlbt_pa20)(CPUHPPAState *env, target_ulong r1, target_ulong r2) 590 { 591 vaddr va_b = deposit64(env->cr[CR_IIAOQ], 32, 32, env->cr[CR_IIASQ]); 592 itlbt_pa20(env, r1, r2, va_b); 593 } 594 595 /* Purge (Insn/Data) TLB. */ 596 static void ptlb_work(CPUState *cpu, run_on_cpu_data data) 597 { 598 vaddr start = data.target_ptr; 599 vaddr end; 600 601 /* 602 * PA2.0 allows a range of pages encoded into GR[b], which we have 603 * copied into the bottom bits of the otherwise page-aligned address. 604 * PA1.x will always provide zero here, for a single page flush. 605 */ 606 end = start & 0xf; 607 start &= TARGET_PAGE_MASK; 608 end = (vaddr)TARGET_PAGE_SIZE << (2 * end); 609 end = start + end - 1; 610 611 hppa_flush_tlb_range(cpu_env(cpu), start, end); 612 } 613 614 /* This is local to the current cpu. */ 615 void HELPER(ptlb_l)(CPUHPPAState *env, target_ulong addr) 616 { 617 trace_hppa_tlb_ptlb_local(env); 618 ptlb_work(env_cpu(env), RUN_ON_CPU_TARGET_PTR(addr)); 619 } 620 621 /* This is synchronous across all processors. */ 622 void HELPER(ptlb)(CPUHPPAState *env, target_ulong addr) 623 { 624 CPUState *src = env_cpu(env); 625 CPUState *cpu; 626 bool wait = false; 627 628 trace_hppa_tlb_ptlb(env); 629 run_on_cpu_data data = RUN_ON_CPU_TARGET_PTR(addr); 630 631 CPU_FOREACH(cpu) { 632 if (cpu != src) { 633 async_run_on_cpu(cpu, ptlb_work, data); 634 wait = true; 635 } 636 } 637 if (wait) { 638 async_safe_run_on_cpu(src, ptlb_work, data); 639 } else { 640 ptlb_work(src, data); 641 } 642 } 643 644 void hppa_ptlbe(CPUHPPAState *env) 645 { 646 uint32_t btlb_entries = HPPA_BTLB_ENTRIES(env); 647 uint32_t i; 648 649 /* Zap the (non-btlb) tlb entries themselves. */ 650 memset(&env->tlb[btlb_entries], 0, 651 sizeof(env->tlb) - btlb_entries * sizeof(env->tlb[0])); 652 env->tlb_last = btlb_entries; 653 env->tlb_partial = NULL; 654 655 /* Put them all onto the unused list. */ 656 env->tlb_unused = &env->tlb[btlb_entries]; 657 for (i = btlb_entries; i < ARRAY_SIZE(env->tlb) - 1; ++i) { 658 env->tlb[i].unused_next = &env->tlb[i + 1]; 659 } 660 661 /* Re-initialize the interval tree with only the btlb entries. */ 662 memset(&env->tlb_root, 0, sizeof(env->tlb_root)); 663 for (i = 0; i < btlb_entries; ++i) { 664 if (env->tlb[i].entry_valid) { 665 interval_tree_insert(&env->tlb[i].itree, &env->tlb_root); 666 } 667 } 668 669 tlb_flush_by_mmuidx(env_cpu(env), HPPA_MMU_FLUSH_MASK); 670 } 671 672 /* Purge (Insn/Data) TLB entry. This affects an implementation-defined 673 number of pages/entries (we choose all), and is local to the cpu. */ 674 void HELPER(ptlbe)(CPUHPPAState *env) 675 { 676 trace_hppa_tlb_ptlbe(env); 677 qemu_log_mask(CPU_LOG_MMU, "FLUSH ALL TLB ENTRIES\n"); 678 hppa_ptlbe(env); 679 } 680 681 void cpu_hppa_change_prot_id(CPUHPPAState *env) 682 { 683 tlb_flush_by_mmuidx(env_cpu(env), HPPA_MMU_FLUSH_P_MASK); 684 } 685 686 void HELPER(change_prot_id)(CPUHPPAState *env) 687 { 688 cpu_hppa_change_prot_id(env); 689 } 690 691 target_ulong HELPER(lpa)(CPUHPPAState *env, target_ulong addr) 692 { 693 hwaddr phys; 694 int prot, excp; 695 696 excp = hppa_get_physical_address(env, addr, MMU_KERNEL_IDX, 0, 0, 697 &phys, &prot); 698 if (excp >= 0) { 699 if (excp == EXCP_DTLB_MISS) { 700 excp = EXCP_NA_DTLB_MISS; 701 } 702 trace_hppa_tlb_lpa_failed(env, addr); 703 raise_exception_with_ior(env, excp, GETPC(), addr, false); 704 } 705 trace_hppa_tlb_lpa_success(env, addr, phys); 706 return phys; 707 } 708 709 /* 710 * diag_btlb() emulates the PDC PDC_BLOCK_TLB firmware call to 711 * allow operating systems to modify the Block TLB (BTLB) entries. 712 * For implementation details see page 1-13 in 713 * https://parisc.wiki.kernel.org/images-parisc/e/ef/Pdc11-v0.96-Ch1-procs.pdf 714 */ 715 void HELPER(diag_btlb)(CPUHPPAState *env) 716 { 717 unsigned int phys_page, len, slot; 718 int mmu_idx = cpu_mmu_index(env_cpu(env), 0); 719 uintptr_t ra = GETPC(); 720 HPPATLBEntry *btlb; 721 uint64_t virt_page; 722 uint32_t *vaddr; 723 uint32_t btlb_entries = HPPA_BTLB_ENTRIES(env); 724 725 /* BTLBs are not supported on 64-bit CPUs */ 726 if (btlb_entries == 0) { 727 env->gr[28] = -1; /* nonexistent procedure */ 728 return; 729 } 730 731 env->gr[28] = 0; /* PDC_OK */ 732 733 switch (env->gr[25]) { 734 case 0: 735 /* return BTLB parameters */ 736 qemu_log_mask(CPU_LOG_MMU, "PDC_BLOCK_TLB: PDC_BTLB_INFO\n"); 737 vaddr = probe_access(env, env->gr[24], 4 * sizeof(uint32_t), 738 MMU_DATA_STORE, mmu_idx, ra); 739 if (vaddr == NULL) { 740 env->gr[28] = -10; /* invalid argument */ 741 } else { 742 vaddr[0] = cpu_to_be32(1); 743 vaddr[1] = cpu_to_be32(16 * 1024); 744 vaddr[2] = cpu_to_be32(PA10_BTLB_FIXED); 745 vaddr[3] = cpu_to_be32(PA10_BTLB_VARIABLE); 746 } 747 break; 748 case 1: 749 /* insert BTLB entry */ 750 virt_page = env->gr[24]; /* upper 32 bits */ 751 virt_page <<= 32; 752 virt_page |= env->gr[23]; /* lower 32 bits */ 753 phys_page = env->gr[22]; 754 len = env->gr[21]; 755 slot = env->gr[19]; 756 qemu_log_mask(CPU_LOG_MMU, "PDC_BLOCK_TLB: PDC_BTLB_INSERT " 757 "0x%08llx-0x%08llx: vpage 0x%llx for phys page 0x%04x len %d " 758 "into slot %d\n", 759 (long long) virt_page << TARGET_PAGE_BITS, 760 (long long) (virt_page + len) << TARGET_PAGE_BITS, 761 (long long) virt_page, phys_page, len, slot); 762 if (slot < btlb_entries) { 763 btlb = &env->tlb[slot]; 764 765 /* Force flush of possibly existing BTLB entry. */ 766 hppa_flush_tlb_ent(env, btlb, true); 767 768 /* Create new BTLB entry */ 769 btlb->itree.start = virt_page << TARGET_PAGE_BITS; 770 btlb->itree.last = btlb->itree.start + len * TARGET_PAGE_SIZE - 1; 771 btlb->pa = phys_page << TARGET_PAGE_BITS; 772 set_access_bits_pa11(env, btlb, env->gr[20]); 773 btlb->t = 0; 774 btlb->d = 1; 775 } else { 776 env->gr[28] = -10; /* invalid argument */ 777 } 778 break; 779 case 2: 780 /* Purge BTLB entry */ 781 slot = env->gr[22]; 782 qemu_log_mask(CPU_LOG_MMU, "PDC_BLOCK_TLB: PDC_BTLB_PURGE slot %d\n", 783 slot); 784 if (slot < btlb_entries) { 785 btlb = &env->tlb[slot]; 786 hppa_flush_tlb_ent(env, btlb, true); 787 } else { 788 env->gr[28] = -10; /* invalid argument */ 789 } 790 break; 791 case 3: 792 /* Purge all BTLB entries */ 793 qemu_log_mask(CPU_LOG_MMU, "PDC_BLOCK_TLB: PDC_BTLB_PURGE_ALL\n"); 794 for (slot = 0; slot < btlb_entries; slot++) { 795 btlb = &env->tlb[slot]; 796 hppa_flush_tlb_ent(env, btlb, true); 797 } 798 break; 799 default: 800 env->gr[28] = -2; /* nonexistent option */ 801 break; 802 } 803 } 804 805 uint64_t HELPER(b_gate_priv)(CPUHPPAState *env, uint64_t iaoq_f) 806 { 807 uint64_t gva = hppa_form_gva(env, env->iasq_f, iaoq_f); 808 HPPATLBEntry *ent = hppa_find_tlb(env, gva); 809 810 if (ent == NULL) { 811 raise_exception_with_ior(env, EXCP_ITLB_MISS, GETPC(), gva, false); 812 } 813 814 /* 815 * There should be no need to check page permissions, as that will 816 * already have been done by tb_lookup via get_page_addr_code. 817 * All we need at this point is to check the ar_type. 818 * 819 * No change for non-gateway pages or for priv decrease. 820 */ 821 if (ent->ar_type & 4) { 822 int old_priv = iaoq_f & 3; 823 int new_priv = ent->ar_type & 3; 824 825 if (new_priv < old_priv) { 826 iaoq_f = (iaoq_f & -4) | new_priv; 827 } 828 } 829 return iaoq_f; 830 } 831 832 void HELPER(update_gva_offset_mask)(CPUHPPAState *env) 833 { 834 update_gva_offset_mask(env); 835 } 836