xref: /openbmc/qemu/target/s390x/mmu_helper.c (revision c39f95dc)
1 /*
2  * S390x MMU related functions
3  *
4  * Copyright (c) 2011 Alexander Graf
5  * Copyright (c) 2015 Thomas Huth, IBM Corporation
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 2 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  */
17 
18 #include "qemu/osdep.h"
19 #include "qemu/error-report.h"
20 #include "exec/address-spaces.h"
21 #include "cpu.h"
22 #include "internal.h"
23 #include "kvm_s390x.h"
24 #include "sysemu/kvm.h"
25 #include "trace.h"
26 #include "hw/s390x/storage-keys.h"
27 
28 /* #define DEBUG_S390 */
29 /* #define DEBUG_S390_PTE */
30 /* #define DEBUG_S390_STDOUT */
31 
32 #ifdef DEBUG_S390
33 #ifdef DEBUG_S390_STDOUT
34 #define DPRINTF(fmt, ...) \
35     do { fprintf(stderr, fmt, ## __VA_ARGS__); \
36          if (qemu_log_separate()) qemu_log(fmt, ##__VA_ARGS__); } while (0)
37 #else
38 #define DPRINTF(fmt, ...) \
39     do { qemu_log(fmt, ## __VA_ARGS__); } while (0)
40 #endif
41 #else
42 #define DPRINTF(fmt, ...) \
43     do { } while (0)
44 #endif
45 
46 #ifdef DEBUG_S390_PTE
47 #define PTE_DPRINTF DPRINTF
48 #else
49 #define PTE_DPRINTF(fmt, ...) \
50     do { } while (0)
51 #endif
52 
53 /* Fetch/store bits in the translation exception code: */
54 #define FS_READ  0x800
55 #define FS_WRITE 0x400
56 
57 static void trigger_access_exception(CPUS390XState *env, uint32_t type,
58                                      uint32_t ilen, uint64_t tec)
59 {
60     S390CPU *cpu = s390_env_get_cpu(env);
61 
62     if (kvm_enabled()) {
63         kvm_s390_access_exception(cpu, type, tec);
64     } else {
65         CPUState *cs = CPU(cpu);
66         stq_phys(cs->as, env->psa + offsetof(LowCore, trans_exc_code), tec);
67         trigger_pgm_exception(env, type, ilen);
68     }
69 }
70 
71 static void trigger_prot_fault(CPUS390XState *env, target_ulong vaddr,
72                                uint64_t asc, int rw, bool exc)
73 {
74     uint64_t tec;
75 
76     tec = vaddr | (rw == MMU_DATA_STORE ? FS_WRITE : FS_READ) | 4 | asc >> 46;
77 
78     DPRINTF("%s: trans_exc_code=%016" PRIx64 "\n", __func__, tec);
79 
80     if (!exc) {
81         return;
82     }
83 
84     trigger_access_exception(env, PGM_PROTECTION, ILEN_AUTO, tec);
85 }
86 
87 static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr,
88                                uint32_t type, uint64_t asc, int rw, bool exc)
89 {
90     int ilen = ILEN_AUTO;
91     uint64_t tec;
92 
93     tec = vaddr | (rw == MMU_DATA_STORE ? FS_WRITE : FS_READ) | asc >> 46;
94 
95     DPRINTF("%s: trans_exc_code=%016" PRIx64 "\n", __func__, tec);
96 
97     if (!exc) {
98         return;
99     }
100 
101     /* Code accesses have an undefined ilc.  */
102     if (rw == MMU_INST_FETCH) {
103         ilen = 2;
104     }
105 
106     trigger_access_exception(env, type, ilen, tec);
107 }
108 
109 /* check whether the address would be proteted by Low-Address Protection */
110 static bool is_low_address(uint64_t addr)
111 {
112     return addr <= 511 || (addr >= 4096 && addr <= 4607);
113 }
114 
115 /* check whether Low-Address Protection is enabled for mmu_translate() */
116 static bool lowprot_enabled(const CPUS390XState *env, uint64_t asc)
117 {
118     if (!(env->cregs[0] & CR0_LOWPROT)) {
119         return false;
120     }
121     if (!(env->psw.mask & PSW_MASK_DAT)) {
122         return true;
123     }
124 
125     /* Check the private-space control bit */
126     switch (asc) {
127     case PSW_ASC_PRIMARY:
128         return !(env->cregs[1] & _ASCE_PRIVATE_SPACE);
129     case PSW_ASC_SECONDARY:
130         return !(env->cregs[7] & _ASCE_PRIVATE_SPACE);
131     case PSW_ASC_HOME:
132         return !(env->cregs[13] & _ASCE_PRIVATE_SPACE);
133     default:
134         /* We don't support access register mode */
135         error_report("unsupported addressing mode");
136         exit(1);
137     }
138 }
139 
140 /**
141  * Translate real address to absolute (= physical)
142  * address by taking care of the prefix mapping.
143  */
144 target_ulong mmu_real2abs(CPUS390XState *env, target_ulong raddr)
145 {
146     if (raddr < 0x2000) {
147         return raddr + env->psa;    /* Map the lowcore. */
148     } else if (raddr >= env->psa && raddr < env->psa + 0x2000) {
149         return raddr - env->psa;    /* Map the 0 page. */
150     }
151     return raddr;
152 }
153 
154 /* Decode page table entry (normal 4KB page) */
155 static int mmu_translate_pte(CPUS390XState *env, target_ulong vaddr,
156                              uint64_t asc, uint64_t pt_entry,
157                              target_ulong *raddr, int *flags, int rw, bool exc)
158 {
159     if (pt_entry & _PAGE_INVALID) {
160         DPRINTF("%s: PTE=0x%" PRIx64 " invalid\n", __func__, pt_entry);
161         trigger_page_fault(env, vaddr, PGM_PAGE_TRANS, asc, rw, exc);
162         return -1;
163     }
164     if (pt_entry & _PAGE_RES0) {
165         trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw, exc);
166         return -1;
167     }
168     if (pt_entry & _PAGE_RO) {
169         *flags &= ~PAGE_WRITE;
170     }
171 
172     *raddr = pt_entry & _ASCE_ORIGIN;
173 
174     PTE_DPRINTF("%s: PTE=0x%" PRIx64 "\n", __func__, pt_entry);
175 
176     return 0;
177 }
178 
179 /* Decode segment table entry */
180 static int mmu_translate_segment(CPUS390XState *env, target_ulong vaddr,
181                                  uint64_t asc, uint64_t st_entry,
182                                  target_ulong *raddr, int *flags, int rw,
183                                  bool exc)
184 {
185     CPUState *cs = CPU(s390_env_get_cpu(env));
186     uint64_t origin, offs, pt_entry;
187 
188     if (st_entry & _SEGMENT_ENTRY_RO) {
189         *flags &= ~PAGE_WRITE;
190     }
191 
192     if ((st_entry & _SEGMENT_ENTRY_FC) && (env->cregs[0] & CR0_EDAT)) {
193         /* Decode EDAT1 segment frame absolute address (1MB page) */
194         *raddr = (st_entry & 0xfffffffffff00000ULL) | (vaddr & 0xfffff);
195         PTE_DPRINTF("%s: SEG=0x%" PRIx64 "\n", __func__, st_entry);
196         return 0;
197     }
198 
199     /* Look up 4KB page entry */
200     origin = st_entry & _SEGMENT_ENTRY_ORIGIN;
201     offs  = (vaddr & VADDR_PX) >> 9;
202     pt_entry = ldq_phys(cs->as, origin + offs);
203     PTE_DPRINTF("%s: 0x%" PRIx64 " + 0x%" PRIx64 " => 0x%016" PRIx64 "\n",
204                 __func__, origin, offs, pt_entry);
205     return mmu_translate_pte(env, vaddr, asc, pt_entry, raddr, flags, rw, exc);
206 }
207 
208 /* Decode region table entries */
209 static int mmu_translate_region(CPUS390XState *env, target_ulong vaddr,
210                                 uint64_t asc, uint64_t entry, int level,
211                                 target_ulong *raddr, int *flags, int rw,
212                                 bool exc)
213 {
214     CPUState *cs = CPU(s390_env_get_cpu(env));
215     uint64_t origin, offs, new_entry;
216     const int pchks[4] = {
217         PGM_SEGMENT_TRANS, PGM_REG_THIRD_TRANS,
218         PGM_REG_SEC_TRANS, PGM_REG_FIRST_TRANS
219     };
220 
221     PTE_DPRINTF("%s: 0x%" PRIx64 "\n", __func__, entry);
222 
223     origin = entry & _REGION_ENTRY_ORIGIN;
224     offs = (vaddr >> (17 + 11 * level / 4)) & 0x3ff8;
225 
226     new_entry = ldq_phys(cs->as, origin + offs);
227     PTE_DPRINTF("%s: 0x%" PRIx64 " + 0x%" PRIx64 " => 0x%016" PRIx64 "\n",
228                 __func__, origin, offs, new_entry);
229 
230     if ((new_entry & _REGION_ENTRY_INV) != 0) {
231         DPRINTF("%s: invalid region\n", __func__);
232         trigger_page_fault(env, vaddr, pchks[level / 4], asc, rw, exc);
233         return -1;
234     }
235 
236     if ((new_entry & _REGION_ENTRY_TYPE_MASK) != level) {
237         trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw, exc);
238         return -1;
239     }
240 
241     if (level == _ASCE_TYPE_SEGMENT) {
242         return mmu_translate_segment(env, vaddr, asc, new_entry, raddr, flags,
243                                      rw, exc);
244     }
245 
246     /* Check region table offset and length */
247     offs = (vaddr >> (28 + 11 * (level - 4) / 4)) & 3;
248     if (offs < ((new_entry & _REGION_ENTRY_TF) >> 6)
249         || offs > (new_entry & _REGION_ENTRY_LENGTH)) {
250         DPRINTF("%s: invalid offset or len (%lx)\n", __func__, new_entry);
251         trigger_page_fault(env, vaddr, pchks[level / 4 - 1], asc, rw, exc);
252         return -1;
253     }
254 
255     if ((env->cregs[0] & CR0_EDAT) && (new_entry & _REGION_ENTRY_RO)) {
256         *flags &= ~PAGE_WRITE;
257     }
258 
259     /* yet another region */
260     return mmu_translate_region(env, vaddr, asc, new_entry, level - 4,
261                                 raddr, flags, rw, exc);
262 }
263 
264 static int mmu_translate_asce(CPUS390XState *env, target_ulong vaddr,
265                               uint64_t asc, uint64_t asce, target_ulong *raddr,
266                               int *flags, int rw, bool exc)
267 {
268     int level;
269     int r;
270 
271     if (asce & _ASCE_REAL_SPACE) {
272         /* direct mapping */
273         *raddr = vaddr;
274         return 0;
275     }
276 
277     level = asce & _ASCE_TYPE_MASK;
278     switch (level) {
279     case _ASCE_TYPE_REGION1:
280         if ((vaddr >> 62) > (asce & _ASCE_TABLE_LENGTH)) {
281             trigger_page_fault(env, vaddr, PGM_REG_FIRST_TRANS, asc, rw, exc);
282             return -1;
283         }
284         break;
285     case _ASCE_TYPE_REGION2:
286         if (vaddr & 0xffe0000000000000ULL) {
287             DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
288                     " 0xffe0000000000000ULL\n", __func__, vaddr);
289             trigger_page_fault(env, vaddr, PGM_ASCE_TYPE, asc, rw, exc);
290             return -1;
291         }
292         if ((vaddr >> 51 & 3) > (asce & _ASCE_TABLE_LENGTH)) {
293             trigger_page_fault(env, vaddr, PGM_REG_SEC_TRANS, asc, rw, exc);
294             return -1;
295         }
296         break;
297     case _ASCE_TYPE_REGION3:
298         if (vaddr & 0xfffffc0000000000ULL) {
299             DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
300                     " 0xfffffc0000000000ULL\n", __func__, vaddr);
301             trigger_page_fault(env, vaddr, PGM_ASCE_TYPE, asc, rw, exc);
302             return -1;
303         }
304         if ((vaddr >> 40 & 3) > (asce & _ASCE_TABLE_LENGTH)) {
305             trigger_page_fault(env, vaddr, PGM_REG_THIRD_TRANS, asc, rw, exc);
306             return -1;
307         }
308         break;
309     case _ASCE_TYPE_SEGMENT:
310         if (vaddr & 0xffffffff80000000ULL) {
311             DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
312                     " 0xffffffff80000000ULL\n", __func__, vaddr);
313             trigger_page_fault(env, vaddr, PGM_ASCE_TYPE, asc, rw, exc);
314             return -1;
315         }
316         if ((vaddr >> 29 & 3) > (asce & _ASCE_TABLE_LENGTH)) {
317             trigger_page_fault(env, vaddr, PGM_SEGMENT_TRANS, asc, rw, exc);
318             return -1;
319         }
320         break;
321     }
322 
323     r = mmu_translate_region(env, vaddr, asc, asce, level, raddr, flags, rw,
324                              exc);
325     if (rw == MMU_DATA_STORE && !(*flags & PAGE_WRITE)) {
326         trigger_prot_fault(env, vaddr, asc, rw, exc);
327         return -1;
328     }
329 
330     return r;
331 }
332 
333 /**
334  * Translate a virtual (logical) address into a physical (absolute) address.
335  * @param vaddr  the virtual address
336  * @param rw     0 = read, 1 = write, 2 = code fetch
337  * @param asc    address space control (one of the PSW_ASC_* modes)
338  * @param raddr  the translated address is stored to this pointer
339  * @param flags  the PAGE_READ/WRITE/EXEC flags are stored to this pointer
340  * @param exc    true = inject a program check if a fault occurred
341  * @return       0 if the translation was successful, -1 if a fault occurred
342  */
343 int mmu_translate(CPUS390XState *env, target_ulong vaddr, int rw, uint64_t asc,
344                   target_ulong *raddr, int *flags, bool exc)
345 {
346     static S390SKeysState *ss;
347     static S390SKeysClass *skeyclass;
348     int r = -1;
349     uint8_t key;
350 
351     if (unlikely(!ss)) {
352         ss = s390_get_skeys_device();
353         skeyclass = S390_SKEYS_GET_CLASS(ss);
354     }
355 
356     *flags = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
357     if (is_low_address(vaddr & TARGET_PAGE_MASK) && lowprot_enabled(env, asc)) {
358         /*
359          * If any part of this page is currently protected, make sure the
360          * TLB entry will not be reused.
361          *
362          * As the protected range is always the first 512 bytes of the
363          * two first pages, we are able to catch all writes to these areas
364          * just by looking at the start address (triggering the tlb miss).
365          */
366         *flags |= PAGE_WRITE_INV;
367         if (is_low_address(vaddr) && rw == MMU_DATA_STORE) {
368             if (exc) {
369                 trigger_access_exception(env, PGM_PROTECTION, ILEN_AUTO, 0);
370             }
371             return -EACCES;
372         }
373     }
374 
375     vaddr &= TARGET_PAGE_MASK;
376 
377     if (!(env->psw.mask & PSW_MASK_DAT)) {
378         *raddr = vaddr;
379         r = 0;
380         goto out;
381     }
382 
383     switch (asc) {
384     case PSW_ASC_PRIMARY:
385         PTE_DPRINTF("%s: asc=primary\n", __func__);
386         r = mmu_translate_asce(env, vaddr, asc, env->cregs[1], raddr, flags,
387                                rw, exc);
388         break;
389     case PSW_ASC_HOME:
390         PTE_DPRINTF("%s: asc=home\n", __func__);
391         r = mmu_translate_asce(env, vaddr, asc, env->cregs[13], raddr, flags,
392                                rw, exc);
393         break;
394     case PSW_ASC_SECONDARY:
395         PTE_DPRINTF("%s: asc=secondary\n", __func__);
396         /*
397          * Instruction: Primary
398          * Data: Secondary
399          */
400         if (rw == MMU_INST_FETCH) {
401             r = mmu_translate_asce(env, vaddr, PSW_ASC_PRIMARY, env->cregs[1],
402                                    raddr, flags, rw, exc);
403             *flags &= ~(PAGE_READ | PAGE_WRITE);
404         } else {
405             r = mmu_translate_asce(env, vaddr, PSW_ASC_SECONDARY, env->cregs[7],
406                                    raddr, flags, rw, exc);
407             *flags &= ~(PAGE_EXEC);
408         }
409         break;
410     case PSW_ASC_ACCREG:
411     default:
412         hw_error("guest switched to unknown asc mode\n");
413         break;
414     }
415 
416  out:
417     /* Convert real address -> absolute address */
418     *raddr = mmu_real2abs(env, *raddr);
419 
420     if (r == 0 && *raddr < ram_size) {
421         if (skeyclass->get_skeys(ss, *raddr / TARGET_PAGE_SIZE, 1, &key)) {
422             trace_get_skeys_nonzero(r);
423             return 0;
424         }
425 
426         if (*flags & PAGE_READ) {
427             key |= SK_R;
428         }
429 
430         if (*flags & PAGE_WRITE) {
431             key |= SK_C;
432         }
433 
434         if (skeyclass->set_skeys(ss, *raddr / TARGET_PAGE_SIZE, 1, &key)) {
435             trace_set_skeys_nonzero(r);
436             return 0;
437         }
438     }
439 
440     return r;
441 }
442 
443 /**
444  * translate_pages: Translate a set of consecutive logical page addresses
445  * to absolute addresses
446  */
447 static int translate_pages(S390CPU *cpu, vaddr addr, int nr_pages,
448                            target_ulong *pages, bool is_write)
449 {
450     uint64_t asc = cpu->env.psw.mask & PSW_MASK_ASC;
451     CPUS390XState *env = &cpu->env;
452     int ret, i, pflags;
453 
454     for (i = 0; i < nr_pages; i++) {
455         ret = mmu_translate(env, addr, is_write, asc, &pages[i], &pflags, true);
456         if (ret) {
457             return ret;
458         }
459         if (!address_space_access_valid(&address_space_memory, pages[i],
460                                         TARGET_PAGE_SIZE, is_write)) {
461             program_interrupt(env, PGM_ADDRESSING, ILEN_AUTO);
462             return -EFAULT;
463         }
464         addr += TARGET_PAGE_SIZE;
465     }
466 
467     return 0;
468 }
469 
470 /**
471  * s390_cpu_virt_mem_rw:
472  * @laddr:     the logical start address
473  * @ar:        the access register number
474  * @hostbuf:   buffer in host memory. NULL = do only checks w/o copying
475  * @len:       length that should be transferred
476  * @is_write:  true = write, false = read
477  * Returns:    0 on success, non-zero if an exception occurred
478  *
479  * Copy from/to guest memory using logical addresses. Note that we inject a
480  * program interrupt in case there is an error while accessing the memory.
481  */
482 int s390_cpu_virt_mem_rw(S390CPU *cpu, vaddr laddr, uint8_t ar, void *hostbuf,
483                          int len, bool is_write)
484 {
485     int currlen, nr_pages, i;
486     target_ulong *pages;
487     int ret;
488 
489     if (kvm_enabled()) {
490         ret = kvm_s390_mem_op(cpu, laddr, ar, hostbuf, len, is_write);
491         if (ret >= 0) {
492             return ret;
493         }
494     }
495 
496     nr_pages = (((laddr & ~TARGET_PAGE_MASK) + len - 1) >> TARGET_PAGE_BITS)
497                + 1;
498     pages = g_malloc(nr_pages * sizeof(*pages));
499 
500     ret = translate_pages(cpu, laddr, nr_pages, pages, is_write);
501     if (ret == 0 && hostbuf != NULL) {
502         /* Copy data by stepping through the area page by page */
503         for (i = 0; i < nr_pages; i++) {
504             currlen = MIN(len, TARGET_PAGE_SIZE - (laddr % TARGET_PAGE_SIZE));
505             cpu_physical_memory_rw(pages[i] | (laddr & ~TARGET_PAGE_MASK),
506                                    hostbuf, currlen, is_write);
507             laddr += currlen;
508             hostbuf += currlen;
509             len -= currlen;
510         }
511     }
512 
513     g_free(pages);
514     return ret;
515 }
516 
517 /**
518  * Translate a real address into a physical (absolute) address.
519  * @param raddr  the real address
520  * @param rw     0 = read, 1 = write, 2 = code fetch
521  * @param addr   the translated address is stored to this pointer
522  * @param flags  the PAGE_READ/WRITE/EXEC flags are stored to this pointer
523  * @return       0 if the translation was successful, < 0 if a fault occurred
524  */
525 int mmu_translate_real(CPUS390XState *env, target_ulong raddr, int rw,
526                        target_ulong *addr, int *flags)
527 {
528     const bool lowprot_enabled = env->cregs[0] & CR0_LOWPROT;
529 
530     *flags = PAGE_READ | PAGE_WRITE;
531     if (is_low_address(raddr & TARGET_PAGE_MASK) && lowprot_enabled) {
532         /* see comment in mmu_translate() how this works */
533         *flags |= PAGE_WRITE_INV;
534         if (is_low_address(raddr) && rw == MMU_DATA_STORE) {
535             trigger_access_exception(env, PGM_PROTECTION, ILEN_AUTO, 0);
536             return -EACCES;
537         }
538     }
539 
540     *addr = mmu_real2abs(env, raddr & TARGET_PAGE_MASK);
541 
542     /* TODO: storage key handling */
543     return 0;
544 }
545