]> git.proxmox.com Git - qemu.git/blame - cputlb.c
fw_cfg: Splash image loader can overrun a stack variable, fix
[qemu.git] / cputlb.c
CommitLineData
0cac1b66
BS
1/*
2 * Common CPU TLB handling
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20#include "config.h"
21#include "cpu.h"
022c62cb
PB
22#include "exec/exec-all.h"
23#include "exec/memory.h"
24#include "exec/address-spaces.h"
0cac1b66 25
022c62cb 26#include "exec/cputlb.h"
0cac1b66 27
022c62cb 28#include "exec/memory-internal.h"
0cac1b66
BS
29
30//#define DEBUG_TLB
31//#define DEBUG_TLB_CHECK
32
33/* statistics */
34int tlb_flush_count;
35
36static const CPUTLBEntry s_cputlb_empty_entry = {
37 .addr_read = -1,
38 .addr_write = -1,
39 .addr_code = -1,
40 .addend = -1,
41};
42
43/* NOTE:
44 * If flush_global is true (the usual case), flush all tlb entries.
45 * If flush_global is false, flush (at least) all tlb entries not
46 * marked global.
47 *
48 * Since QEMU doesn't currently implement a global/not-global flag
49 * for tlb entries, at the moment tlb_flush() will also flush all
50 * tlb entries in the flush_global == false case. This is OK because
51 * CPU architectures generally permit an implementation to drop
52 * entries from the TLB at any time, so flushing more entries than
53 * required is only an efficiency issue, not a correctness issue.
54 */
55void tlb_flush(CPUArchState *env, int flush_global)
56{
57 int i;
58
59#if defined(DEBUG_TLB)
60 printf("tlb_flush:\n");
61#endif
62 /* must reset current TB so that interrupts cannot modify the
63 links while we are modifying them */
64 env->current_tb = NULL;
65
66 for (i = 0; i < CPU_TLB_SIZE; i++) {
67 int mmu_idx;
68
69 for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
70 env->tlb_table[mmu_idx][i] = s_cputlb_empty_entry;
71 }
72 }
73
74 memset(env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
75
76 env->tlb_flush_addr = -1;
77 env->tlb_flush_mask = 0;
78 tlb_flush_count++;
79}
80
81static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
82{
83 if (addr == (tlb_entry->addr_read &
84 (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
85 addr == (tlb_entry->addr_write &
86 (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
87 addr == (tlb_entry->addr_code &
88 (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
89 *tlb_entry = s_cputlb_empty_entry;
90 }
91}
92
93void tlb_flush_page(CPUArchState *env, target_ulong addr)
94{
95 int i;
96 int mmu_idx;
97
98#if defined(DEBUG_TLB)
99 printf("tlb_flush_page: " TARGET_FMT_lx "\n", addr);
100#endif
101 /* Check if we need to flush due to large pages. */
102 if ((addr & env->tlb_flush_mask) == env->tlb_flush_addr) {
103#if defined(DEBUG_TLB)
104 printf("tlb_flush_page: forced full flush ("
105 TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
106 env->tlb_flush_addr, env->tlb_flush_mask);
107#endif
108 tlb_flush(env, 1);
109 return;
110 }
111 /* must reset current TB so that interrupts cannot modify the
112 links while we are modifying them */
113 env->current_tb = NULL;
114
115 addr &= TARGET_PAGE_MASK;
116 i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
117 for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
118 tlb_flush_entry(&env->tlb_table[mmu_idx][i], addr);
119 }
120
121 tb_flush_jmp_cache(env, addr);
122}
123
124/* update the TLBs so that writes to code in the virtual page 'addr'
125 can be detected */
126void tlb_protect_code(ram_addr_t ram_addr)
127{
128 cpu_physical_memory_reset_dirty(ram_addr,
129 ram_addr + TARGET_PAGE_SIZE,
130 CODE_DIRTY_FLAG);
131}
132
133/* update the TLB so that writes in physical page 'phys_addr' are no longer
134 tested for self modifying code */
135void tlb_unprotect_code_phys(CPUArchState *env, ram_addr_t ram_addr,
136 target_ulong vaddr)
137{
138 cpu_physical_memory_set_dirty_flags(ram_addr, CODE_DIRTY_FLAG);
139}
140
141static bool tlb_is_dirty_ram(CPUTLBEntry *tlbe)
142{
143 return (tlbe->addr_write & (TLB_INVALID_MASK|TLB_MMIO|TLB_NOTDIRTY)) == 0;
144}
145
146void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry, uintptr_t start,
147 uintptr_t length)
148{
149 uintptr_t addr;
150
151 if (tlb_is_dirty_ram(tlb_entry)) {
152 addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
153 if ((addr - start) < length) {
154 tlb_entry->addr_write |= TLB_NOTDIRTY;
155 }
156 }
157}
158
159static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
160{
161 ram_addr_t ram_addr;
162 void *p;
163
164 if (tlb_is_dirty_ram(tlb_entry)) {
165 p = (void *)(uintptr_t)((tlb_entry->addr_write & TARGET_PAGE_MASK)
166 + tlb_entry->addend);
167 ram_addr = qemu_ram_addr_from_host_nofail(p);
168 if (!cpu_physical_memory_is_dirty(ram_addr)) {
169 tlb_entry->addr_write |= TLB_NOTDIRTY;
170 }
171 }
172}
173
174void cpu_tlb_reset_dirty_all(ram_addr_t start1, ram_addr_t length)
175{
176 CPUArchState *env;
177
178 for (env = first_cpu; env != NULL; env = env->next_cpu) {
179 int mmu_idx;
180
181 for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
182 unsigned int i;
183
184 for (i = 0; i < CPU_TLB_SIZE; i++) {
185 tlb_reset_dirty_range(&env->tlb_table[mmu_idx][i],
186 start1, length);
187 }
188 }
189 }
190}
191
192static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
193{
194 if (tlb_entry->addr_write == (vaddr | TLB_NOTDIRTY)) {
195 tlb_entry->addr_write = vaddr;
196 }
197}
198
199/* update the TLB corresponding to virtual page vaddr
200 so that it is no longer dirty */
201void tlb_set_dirty(CPUArchState *env, target_ulong vaddr)
202{
203 int i;
204 int mmu_idx;
205
206 vaddr &= TARGET_PAGE_MASK;
207 i = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
208 for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
209 tlb_set_dirty1(&env->tlb_table[mmu_idx][i], vaddr);
210 }
211}
212
213/* Our TLB does not support large pages, so remember the area covered by
214 large pages and trigger a full TLB flush if these are invalidated. */
215static void tlb_add_large_page(CPUArchState *env, target_ulong vaddr,
216 target_ulong size)
217{
218 target_ulong mask = ~(size - 1);
219
220 if (env->tlb_flush_addr == (target_ulong)-1) {
221 env->tlb_flush_addr = vaddr & mask;
222 env->tlb_flush_mask = mask;
223 return;
224 }
225 /* Extend the existing region to include the new page.
226 This is a compromise between unnecessary flushes and the cost
227 of maintaining a full variable size TLB. */
228 mask &= env->tlb_flush_mask;
229 while (((env->tlb_flush_addr ^ vaddr) & mask) != 0) {
230 mask <<= 1;
231 }
232 env->tlb_flush_addr &= mask;
233 env->tlb_flush_mask = mask;
234}
235
236/* Add a new TLB entry. At most one entry for a given virtual address
237 is permitted. Only a single TARGET_PAGE_SIZE region is mapped, the
238 supplied size is only used by tlb_flush_page. */
239void tlb_set_page(CPUArchState *env, target_ulong vaddr,
a8170e5e 240 hwaddr paddr, int prot,
0cac1b66
BS
241 int mmu_idx, target_ulong size)
242{
243 MemoryRegionSection *section;
244 unsigned int index;
245 target_ulong address;
246 target_ulong code_address;
247 uintptr_t addend;
248 CPUTLBEntry *te;
a8170e5e 249 hwaddr iotlb;
0cac1b66
BS
250
251 assert(size >= TARGET_PAGE_SIZE);
252 if (size != TARGET_PAGE_SIZE) {
253 tlb_add_large_page(env, vaddr, size);
254 }
ac1970fb 255 section = phys_page_find(address_space_memory.dispatch, paddr >> TARGET_PAGE_BITS);
0cac1b66
BS
256#if defined(DEBUG_TLB)
257 printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x" TARGET_FMT_plx
258 " prot=%x idx=%d pd=0x%08lx\n",
259 vaddr, paddr, prot, mmu_idx, pd);
260#endif
261
262 address = vaddr;
cc5bea60
BS
263 if (!(memory_region_is_ram(section->mr) ||
264 memory_region_is_romd(section->mr))) {
0cac1b66
BS
265 /* IO memory case (romd handled later) */
266 address |= TLB_MMIO;
267 }
cc5bea60
BS
268 if (memory_region_is_ram(section->mr) ||
269 memory_region_is_romd(section->mr)) {
0cac1b66 270 addend = (uintptr_t)memory_region_get_ram_ptr(section->mr)
cc5bea60 271 + memory_region_section_addr(section, paddr);
0cac1b66
BS
272 } else {
273 addend = 0;
274 }
0cac1b66
BS
275
276 code_address = address;
56eb21e1
MF
277 iotlb = memory_region_section_get_iotlb(env, section, vaddr, paddr, prot,
278 &address);
0cac1b66
BS
279
280 index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
281 env->iotlb[mmu_idx][index] = iotlb - vaddr;
282 te = &env->tlb_table[mmu_idx][index];
283 te->addend = addend - vaddr;
284 if (prot & PAGE_READ) {
285 te->addr_read = address;
286 } else {
287 te->addr_read = -1;
288 }
289
290 if (prot & PAGE_EXEC) {
291 te->addr_code = code_address;
292 } else {
293 te->addr_code = -1;
294 }
295 if (prot & PAGE_WRITE) {
296 if ((memory_region_is_ram(section->mr) && section->readonly)
cc5bea60 297 || memory_region_is_romd(section->mr)) {
0cac1b66
BS
298 /* Write access calls the I/O callback. */
299 te->addr_write = address | TLB_MMIO;
300 } else if (memory_region_is_ram(section->mr)
301 && !cpu_physical_memory_is_dirty(
302 section->mr->ram_addr
cc5bea60 303 + memory_region_section_addr(section, paddr))) {
0cac1b66
BS
304 te->addr_write = address | TLB_NOTDIRTY;
305 } else {
306 te->addr_write = address;
307 }
308 } else {
309 te->addr_write = -1;
310 }
311}
312
313/* NOTE: this function can trigger an exception */
314/* NOTE2: the returned address is not exactly the physical address: it
116aae36
PM
315 * is actually a ram_addr_t (in system mode; the user mode emulation
316 * version of this function returns a guest virtual address).
317 */
0cac1b66
BS
318tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
319{
320 int mmu_idx, page_index, pd;
321 void *p;
322 MemoryRegion *mr;
323
324 page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
325 mmu_idx = cpu_mmu_index(env1);
326 if (unlikely(env1->tlb_table[mmu_idx][page_index].addr_code !=
327 (addr & TARGET_PAGE_MASK))) {
0cac1b66 328 cpu_ldub_code(env1, addr);
0cac1b66
BS
329 }
330 pd = env1->iotlb[mmu_idx][page_index] & ~TARGET_PAGE_MASK;
331 mr = iotlb_to_region(pd);
332 if (memory_region_is_unassigned(mr)) {
333#if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_SPARC)
334 cpu_unassigned_access(env1, addr, 0, 1, 0, 4);
335#else
336 cpu_abort(env1, "Trying to execute code outside RAM or ROM at 0x"
337 TARGET_FMT_lx "\n", addr);
338#endif
339 }
340 p = (void *)((uintptr_t)addr + env1->tlb_table[mmu_idx][page_index].addend);
341 return qemu_ram_addr_from_host_nofail(p);
342}
343
344#define MMUSUFFIX _cmmu
345#undef GETPC
346#define GETPC() ((uintptr_t)0)
0cac1b66
BS
347#define SOFTMMU_CODE_ACCESS
348
349#define SHIFT 0
022c62cb 350#include "exec/softmmu_template.h"
0cac1b66
BS
351
352#define SHIFT 1
022c62cb 353#include "exec/softmmu_template.h"
0cac1b66
BS
354
355#define SHIFT 2
022c62cb 356#include "exec/softmmu_template.h"
0cac1b66
BS
357
358#define SHIFT 3
022c62cb 359#include "exec/softmmu_template.h"
0cac1b66
BS
360
361#undef env