[mirror_qemu.git] / target / s390x / mmu_helper.c

/*
 * S390x MMU related functions
 *
 * Copyright (c) 2011 Alexander Graf
 * Copyright (c) 2015 Thomas Huth, IBM Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 */

#include "qemu/osdep.h"
#include "qemu/error-report.h"
#include "exec/address-spaces.h"
#include "cpu.h"
#include "internal.h"
#include "kvm_s390x.h"
#include "sysemu/kvm.h"
#include "sysemu/tcg.h"
#include "exec/exec-all.h"
#include "trace.h"
#include "hw/s390x/storage-keys.h"

/* #define DEBUG_S390 */
/* #define DEBUG_S390_PTE */
/* #define DEBUG_S390_STDOUT */

#ifdef DEBUG_S390
#ifdef DEBUG_S390_STDOUT
#define DPRINTF(fmt, ...) \
    do { fprintf(stderr, fmt, ## __VA_ARGS__); \
         if (qemu_log_separate()) qemu_log(fmt, ##__VA_ARGS__); } while (0)
#else
#define DPRINTF(fmt, ...) \
    do { qemu_log(fmt, ## __VA_ARGS__); } while (0)
#endif
#else
#define DPRINTF(fmt, ...) \
    do { } while (0)
#endif

#ifdef DEBUG_S390_PTE
#define PTE_DPRINTF DPRINTF
#else
#define PTE_DPRINTF(fmt, ...) \
    do { } while (0)
#endif

/* Fetch/store bits in the translation exception code: */
#define FS_READ  0x800
#define FS_WRITE 0x400

static void trigger_access_exception(CPUS390XState *env, uint32_t type,
                                     uint32_t ilen, uint64_t tec)
{
    S390CPU *cpu = env_archcpu(env);

    if (kvm_enabled()) {
        kvm_s390_access_exception(cpu, type, tec);
    } else {
        CPUState *cs = env_cpu(env);
        if (type != PGM_ADDRESSING) {
            stq_phys(cs->as, env->psa + offsetof(LowCore, trans_exc_code), tec);
        }
        trigger_pgm_exception(env, type, ilen);
    }
}

static void trigger_prot_fault(CPUS390XState *env, target_ulong vaddr,
                               uint64_t asc, int rw, bool exc)
{
    uint64_t tec;

    tec = vaddr | (rw == MMU_DATA_STORE ? FS_WRITE : FS_READ) | 4 | asc >> 46;

    DPRINTF("%s: trans_exc_code=%016" PRIx64 "\n", __func__, tec);

    if (!exc) {
        return;
    }

    trigger_access_exception(env, PGM_PROTECTION, ILEN_AUTO, tec);
}

static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr,
                               uint32_t type, uint64_t asc, int rw, bool exc)
{
    int ilen = ILEN_AUTO;
    uint64_t tec;

    tec = vaddr | (rw == MMU_DATA_STORE ? FS_WRITE : FS_READ) | asc >> 46;

    DPRINTF("%s: trans_exc_code=%016" PRIx64 "\n", __func__, tec);

    if (!exc) {
        return;
    }

    /* Code accesses have an undefined ilc.  */
    if (rw == MMU_INST_FETCH) {
        ilen = 2;
    }

    trigger_access_exception(env, type, ilen, tec);
}

/* check whether the address would be proteted by Low-Address Protection */
static bool is_low_address(uint64_t addr)
{
    return addr <= 511 || (addr >= 4096 && addr <= 4607);
}

/* check whether Low-Address Protection is enabled for mmu_translate() */
static bool lowprot_enabled(const CPUS390XState *env, uint64_t asc)
{
    if (!(env->cregs[0] & CR0_LOWPROT)) {
        return false;
    }
    if (!(env->psw.mask & PSW_MASK_DAT)) {
        return true;
    }

    /* Check the private-space control bit */
    switch (asc) {
    case PSW_ASC_PRIMARY:
        return !(env->cregs[1] & ASCE_PRIVATE_SPACE);
    case PSW_ASC_SECONDARY:
        return !(env->cregs[7] & ASCE_PRIVATE_SPACE);
    case PSW_ASC_HOME:
        return !(env->cregs[13] & ASCE_PRIVATE_SPACE);
    default:
        /* We don't support access register mode */
        error_report("unsupported addressing mode");
        exit(1);
    }
}

/**
 * Translate real address to absolute (= physical)
 * address by taking care of the prefix mapping.
 */
target_ulong mmu_real2abs(CPUS390XState *env, target_ulong raddr)
{
    if (raddr < 0x2000) {
        return raddr + env->psa;    /* Map the lowcore. */
    } else if (raddr >= env->psa && raddr < env->psa + 0x2000) {
        return raddr - env->psa;    /* Map the 0 page. */
    }
    return raddr;
}

/* Decode page table entry (normal 4KB page) */
static int mmu_translate_pte(CPUS390XState *env, target_ulong vaddr,
                             uint64_t asc, uint64_t pt_entry,
                             target_ulong *raddr, int *flags, int rw, bool exc)
{
    if (pt_entry & PAGE_INVALID) {
        DPRINTF("%s: PTE=0x%" PRIx64 " invalid\n", __func__, pt_entry);
        trigger_page_fault(env, vaddr, PGM_PAGE_TRANS, asc, rw, exc);
        return -1;
    }
    if (pt_entry & PAGE_RES0) {
        trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw, exc);
        return -1;
    }
    if (pt_entry & PAGE_RO) {
        *flags &= ~PAGE_WRITE;
    }

    *raddr = pt_entry & ASCE_ORIGIN;

    PTE_DPRINTF("%s: PTE=0x%" PRIx64 "\n", __func__, pt_entry);

    return 0;
}

/* Decode segment table entry */
static int mmu_translate_segment(CPUS390XState *env, target_ulong vaddr,
                                 uint64_t asc, uint64_t st_entry,
                                 target_ulong *raddr, int *flags, int rw,
                                 bool exc)
{
    CPUState *cs = env_cpu(env);
    uint64_t origin, offs, pt_entry;

    if (st_entry & SEGMENT_ENTRY_RO) {
        *flags &= ~PAGE_WRITE;
    }

    if ((st_entry & SEGMENT_ENTRY_FC) && (env->cregs[0] & CR0_EDAT)) {
        /* Decode EDAT1 segment frame absolute address (1MB page) */
        *raddr = (st_entry & 0xfffffffffff00000ULL) | (vaddr & 0xfffff);
        PTE_DPRINTF("%s: SEG=0x%" PRIx64 "\n", __func__, st_entry);
        return 0;
    }

    /* Look up 4KB page entry */
    origin = st_entry & SEGMENT_ENTRY_ORIGIN;
    offs  = (vaddr & VADDR_PX) >> 9;
    pt_entry = ldq_phys(cs->as, origin + offs);
    PTE_DPRINTF("%s: 0x%" PRIx64 " + 0x%" PRIx64 " => 0x%016" PRIx64 "\n",
                __func__, origin, offs, pt_entry);
    return mmu_translate_pte(env, vaddr, asc, pt_entry, raddr, flags, rw, exc);
}

/* Decode region table entries */
static int mmu_translate_region(CPUS390XState *env, target_ulong vaddr,
                                uint64_t asc, uint64_t entry, int level,
                                target_ulong *raddr, int *flags, int rw,
                                bool exc)
{
    CPUState *cs = env_cpu(env);
    uint64_t origin, offs, new_entry;
    const int pchks[4] = {
        PGM_SEGMENT_TRANS, PGM_REG_THIRD_TRANS,
        PGM_REG_SEC_TRANS, PGM_REG_FIRST_TRANS
    };

    PTE_DPRINTF("%s: 0x%" PRIx64 "\n", __func__, entry);

    origin = entry & REGION_ENTRY_ORIGIN;
    offs = (vaddr >> (17 + 11 * level / 4)) & 0x3ff8;

    new_entry = ldq_phys(cs->as, origin + offs);
    PTE_DPRINTF("%s: 0x%" PRIx64 " + 0x%" PRIx64 " => 0x%016" PRIx64 "\n",
                __func__, origin, offs, new_entry);

    if ((new_entry & REGION_ENTRY_INV) != 0) {
        DPRINTF("%s: invalid region\n", __func__);
        trigger_page_fault(env, vaddr, pchks[level / 4], asc, rw, exc);
        return -1;
    }

    if ((new_entry & REGION_ENTRY_TYPE_MASK) != level) {
        trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw, exc);
        return -1;
    }

    if (level == ASCE_TYPE_SEGMENT) {
        return mmu_translate_segment(env, vaddr, asc, new_entry, raddr, flags,
                                     rw, exc);
    }

    /* Check region table offset and length */
    offs = (vaddr >> (28 + 11 * (level - 4) / 4)) & 3;
    if (offs < ((new_entry & REGION_ENTRY_TF) >> 6)
        || offs > (new_entry & REGION_ENTRY_LENGTH)) {
        DPRINTF("%s: invalid offset or len (%lx)\n", __func__, new_entry);
        trigger_page_fault(env, vaddr, pchks[level / 4 - 1], asc, rw, exc);
        return -1;
    }

    if ((env->cregs[0] & CR0_EDAT) && (new_entry & REGION_ENTRY_RO)) {
        *flags &= ~PAGE_WRITE;
    }

    /* yet another region */
    return mmu_translate_region(env, vaddr, asc, new_entry, level - 4,
                                raddr, flags, rw, exc);
}

static int mmu_translate_asce(CPUS390XState *env, target_ulong vaddr,
                              uint64_t asc, uint64_t asce, target_ulong *raddr,
                              int *flags, int rw, bool exc)
{
    int level;
    int r;

    if (asce & ASCE_REAL_SPACE) {
        /* direct mapping */
        *raddr = vaddr;
        return 0;
    }

    level = asce & ASCE_TYPE_MASK;
    switch (level) {
    case ASCE_TYPE_REGION1:
        if ((vaddr >> 62) > (asce & ASCE_TABLE_LENGTH)) {
            trigger_page_fault(env, vaddr, PGM_REG_FIRST_TRANS, asc, rw, exc);
            return -1;
        }
        break;
    case ASCE_TYPE_REGION2:
        if (vaddr & 0xffe0000000000000ULL) {
            DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
                    " 0xffe0000000000000ULL\n", __func__, vaddr);
            trigger_page_fault(env, vaddr, PGM_ASCE_TYPE, asc, rw, exc);
            return -1;
        }
        if ((vaddr >> 51 & 3) > (asce & ASCE_TABLE_LENGTH)) {
            trigger_page_fault(env, vaddr, PGM_REG_SEC_TRANS, asc, rw, exc);
            return -1;
        }
        break;
    case ASCE_TYPE_REGION3:
        if (vaddr & 0xfffffc0000000000ULL) {
            DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
                    " 0xfffffc0000000000ULL\n", __func__, vaddr);
            trigger_page_fault(env, vaddr, PGM_ASCE_TYPE, asc, rw, exc);
            return -1;
        }
        if ((vaddr >> 40 & 3) > (asce & ASCE_TABLE_LENGTH)) {
            trigger_page_fault(env, vaddr, PGM_REG_THIRD_TRANS, asc, rw, exc);
            return -1;
        }
        break;
    case ASCE_TYPE_SEGMENT:
        if (vaddr & 0xffffffff80000000ULL) {
            DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
                    " 0xffffffff80000000ULL\n", __func__, vaddr);
            trigger_page_fault(env, vaddr, PGM_ASCE_TYPE, asc, rw, exc);
            return -1;
        }
        if ((vaddr >> 29 & 3) > (asce & ASCE_TABLE_LENGTH)) {
            trigger_page_fault(env, vaddr, PGM_SEGMENT_TRANS, asc, rw, exc);
            return -1;
        }
        break;
    }

    r = mmu_translate_region(env, vaddr, asc, asce, level, raddr, flags, rw,
                             exc);
    if (!r && rw == MMU_DATA_STORE && !(*flags & PAGE_WRITE)) {
        trigger_prot_fault(env, vaddr, asc, rw, exc);
        return -1;
    }

    return r;
}

/**
 * Translate a virtual (logical) address into a physical (absolute) address.
 * @param vaddr  the virtual address
 * @param rw     0 = read, 1 = write, 2 = code fetch
 * @param asc    address space control (one of the PSW_ASC_* modes)
 * @param raddr  the translated address is stored to this pointer
 * @param flags  the PAGE_READ/WRITE/EXEC flags are stored to this pointer
 * @param exc    true = inject a program check if a fault occurred
 * @return       0 if the translation was successful, -1 if a fault occurred
 */
int mmu_translate(CPUS390XState *env, target_ulong vaddr, int rw, uint64_t asc,
                  target_ulong *raddr, int *flags, bool exc)
{
    static S390SKeysState *ss;
    static S390SKeysClass *skeyclass;
    int r = -1;
    uint8_t key;

    if (unlikely(!ss)) {
        ss = s390_get_skeys_device();
        skeyclass = S390_SKEYS_GET_CLASS(ss);
    }

    *flags = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
    if (is_low_address(vaddr & TARGET_PAGE_MASK) && lowprot_enabled(env, asc)) {
        /*
         * If any part of this page is currently protected, make sure the
         * TLB entry will not be reused.
         *
         * As the protected range is always the first 512 bytes of the
         * two first pages, we are able to catch all writes to these areas
         * just by looking at the start address (triggering the tlb miss).
         */
        *flags |= PAGE_WRITE_INV;
        if (is_low_address(vaddr) && rw == MMU_DATA_STORE) {
            if (exc) {
                trigger_access_exception(env, PGM_PROTECTION, ILEN_AUTO, 0);
            }
            return -EACCES;
        }
    }

    vaddr &= TARGET_PAGE_MASK;

    if (!(env->psw.mask & PSW_MASK_DAT)) {
        *raddr = vaddr;
        r = 0;
        goto out;
    }

    switch (asc) {
    case PSW_ASC_PRIMARY:
        PTE_DPRINTF("%s: asc=primary\n", __func__);
        r = mmu_translate_asce(env, vaddr, asc, env->cregs[1], raddr, flags,
                               rw, exc);
        break;
    case PSW_ASC_HOME:
        PTE_DPRINTF("%s: asc=home\n", __func__);
        r = mmu_translate_asce(env, vaddr, asc, env->cregs[13], raddr, flags,
                               rw, exc);
        break;
    case PSW_ASC_SECONDARY:
        PTE_DPRINTF("%s: asc=secondary\n", __func__);
        /*
         * Instruction: Primary
         * Data: Secondary
         */
        if (rw == MMU_INST_FETCH) {
            r = mmu_translate_asce(env, vaddr, PSW_ASC_PRIMARY, env->cregs[1],
                                   raddr, flags, rw, exc);
            *flags &= ~(PAGE_READ | PAGE_WRITE);
        } else {
            r = mmu_translate_asce(env, vaddr, PSW_ASC_SECONDARY, env->cregs[7],
                                   raddr, flags, rw, exc);
            *flags &= ~(PAGE_EXEC);
        }
        break;
    case PSW_ASC_ACCREG:
    default:
        hw_error("guest switched to unknown asc mode\n");
        break;
    }

 out:
    /* Convert real address -> absolute address */
    *raddr = mmu_real2abs(env, *raddr);

    if (r == 0 && *raddr < ram_size) {
        if (skeyclass->get_skeys(ss, *raddr / TARGET_PAGE_SIZE, 1, &key)) {
            trace_get_skeys_nonzero(r);
            return 0;
        }

        if (*flags & PAGE_READ) {
            key |= SK_R;
        }

        if (*flags & PAGE_WRITE) {
            key |= SK_C;
        }

        if (skeyclass->set_skeys(ss, *raddr / TARGET_PAGE_SIZE, 1, &key)) {
            trace_set_skeys_nonzero(r);
            return 0;
        }
    }

    return r;
}

/**
 * translate_pages: Translate a set of consecutive logical page addresses
 * to absolute addresses. This function is used for TCG and old KVM without
 * the MEMOP interface.
 */
static int translate_pages(S390CPU *cpu, vaddr addr, int nr_pages,
                           target_ulong *pages, bool is_write)
{
    uint64_t asc = cpu->env.psw.mask & PSW_MASK_ASC;
    CPUS390XState *env = &cpu->env;
    int ret, i, pflags;

    for (i = 0; i < nr_pages; i++) {
        ret = mmu_translate(env, addr, is_write, asc, &pages[i], &pflags, true);
        if (ret) {
            return ret;
        }
        if (!address_space_access_valid(&address_space_memory, pages[i],
                                        TARGET_PAGE_SIZE, is_write,
                                        MEMTXATTRS_UNSPECIFIED)) {
            trigger_access_exception(env, PGM_ADDRESSING, ILEN_AUTO, 0);
            return -EFAULT;
        }
        addr += TARGET_PAGE_SIZE;
    }

    return 0;
}

/**
 * s390_cpu_virt_mem_rw:
 * @laddr:     the logical start address
 * @ar:        the access register number
 * @hostbuf:   buffer in host memory. NULL = do only checks w/o copying
 * @len:       length that should be transferred
 * @is_write:  true = write, false = read
 * Returns:    0 on success, non-zero if an exception occurred
 *
 * Copy from/to guest memory using logical addresses. Note that we inject a
 * program interrupt in case there is an error while accessing the memory.
 *
 * This function will always return (also for TCG), make sure to call
 * s390_cpu_virt_mem_handle_exc() to properly exit the CPU loop.
 */
int s390_cpu_virt_mem_rw(S390CPU *cpu, vaddr laddr, uint8_t ar, void *hostbuf,
                         int len, bool is_write)
{
    int currlen, nr_pages, i;
    target_ulong *pages;
    int ret;

    if (kvm_enabled()) {
        ret = kvm_s390_mem_op(cpu, laddr, ar, hostbuf, len, is_write);
        if (ret >= 0) {
            return ret;
        }
    }

    nr_pages = (((laddr & ~TARGET_PAGE_MASK) + len - 1) >> TARGET_PAGE_BITS)
               + 1;
    pages = g_malloc(nr_pages * sizeof(*pages));

    ret = translate_pages(cpu, laddr, nr_pages, pages, is_write);
    if (ret == 0 && hostbuf != NULL) {
        /* Copy data by stepping through the area page by page */
        for (i = 0; i < nr_pages; i++) {
            currlen = MIN(len, TARGET_PAGE_SIZE - (laddr % TARGET_PAGE_SIZE));
            cpu_physical_memory_rw(pages[i] | (laddr & ~TARGET_PAGE_MASK),
                                   hostbuf, currlen, is_write);
            laddr += currlen;
            hostbuf += currlen;
            len -= currlen;
        }
    }

    g_free(pages);
    return ret;
}

void s390_cpu_virt_mem_handle_exc(S390CPU *cpu, uintptr_t ra)
{
    /* KVM will handle the interrupt automatically, TCG has to exit the TB */
#ifdef CONFIG_TCG
    if (tcg_enabled()) {
        cpu_loop_exit_restore(CPU(cpu), ra);
    }
#endif
}

/**
 * Translate a real address into a physical (absolute) address.
 * @param raddr  the real address
 * @param rw     0 = read, 1 = write, 2 = code fetch
 * @param addr   the translated address is stored to this pointer
 * @param flags  the PAGE_READ/WRITE/EXEC flags are stored to this pointer
 * @return       0 if the translation was successful, < 0 if a fault occurred
 */
int mmu_translate_real(CPUS390XState *env, target_ulong raddr, int rw,
                       target_ulong *addr, int *flags)
{
    const bool lowprot_enabled = env->cregs[0] & CR0_LOWPROT;

    *flags = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
    if (is_low_address(raddr & TARGET_PAGE_MASK) && lowprot_enabled) {
        /* see comment in mmu_translate() how this works */
        *flags |= PAGE_WRITE_INV;
        if (is_low_address(raddr) && rw == MMU_DATA_STORE) {
            trigger_access_exception(env, PGM_PROTECTION, ILEN_AUTO, 0);
            return -EACCES;
        }
    }

    *addr = mmu_real2abs(env, raddr & TARGET_PAGE_MASK);

    /* TODO: storage key handling */
    return 0;
}
Commit	Line	Data
dfebd7a7 TH	1	/*
	2	* S390x MMU related functions
	3	*
	4	* Copyright (c) 2011 Alexander Graf
	5	* Copyright (c) 2015 Thomas Huth, IBM Corporation
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License as published by
	9	* the Free Software Foundation; either version 2 of the License, or
	10	* (at your option) any later version.
	11	*
	12	* This program is distributed in the hope that it will be useful,
	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	15	* GNU General Public License for more details.
	16	*/
	17
9615495a	18	#include "qemu/osdep.h"
c3edd628 TH	19	#include "qemu/error-report.h"
c3edd628 TH	20	#include "exec/address-spaces.h"
dfebd7a7	21	#include "cpu.h"
4e58b838	22	#include "internal.h"
f16bbb9b	23	#include "kvm_s390x.h"
fba0a593	24	#include "sysemu/kvm.h"
14a48c1d	25	#include "sysemu/tcg.h"
98ee9bed	26	#include "exec/exec-all.h"
0f5f6691 JH	27	#include "trace.h"
0f5f6691 JH	28	#include "hw/s390x/storage-keys.h"
dfebd7a7 TH	29
	30	/* #define DEBUG_S390 */
	31	/* #define DEBUG_S390_PTE */
	32	/* #define DEBUG_S390_STDOUT */
	33
	34	#ifdef DEBUG_S390
	35	#ifdef DEBUG_S390_STDOUT
	36	#define DPRINTF(fmt, ...) \
	37	do { fprintf(stderr, fmt, ## __VA_ARGS__); \
013a2942	38	if (qemu_log_separate()) qemu_log(fmt, ##__VA_ARGS__); } while (0)
dfebd7a7 TH	39	#else
	40	#define DPRINTF(fmt, ...) \
	41	do { qemu_log(fmt, ## __VA_ARGS__); } while (0)
	42	#endif
	43	#else
	44	#define DPRINTF(fmt, ...) \
	45	do { } while (0)
	46	#endif
	47
	48	#ifdef DEBUG_S390_PTE
	49	#define PTE_DPRINTF DPRINTF
	50	#else
	51	#define PTE_DPRINTF(fmt, ...) \
	52	do { } while (0)
	53	#endif
	54
bab58bf0 TH	55	/* Fetch/store bits in the translation exception code: */
	56	#define FS_READ 0x800
	57	#define FS_WRITE 0x400
dfebd7a7	58
801cdd35 TH	59	static void trigger_access_exception(CPUS390XState *env, uint32_t type,
	60	uint32_t ilen, uint64_t tec)
	61	{
dc79e928	62	S390CPU *cpu = env_archcpu(env);
801cdd35 TH	63
	64	if (kvm_enabled()) {
	65	kvm_s390_access_exception(cpu, type, tec);
	66	} else {
dc79e928	67	CPUState *cs = env_cpu(env);
820613b1 DH	68	if (type != PGM_ADDRESSING) {
	69	stq_phys(cs->as, env->psa + offsetof(LowCore, trans_exc_code), tec);
	70	}
801cdd35 TH	71	trigger_pgm_exception(env, type, ilen);
	72	}
	73	}
	74
dfebd7a7	75	static void trigger_prot_fault(CPUS390XState *env, target_ulong vaddr,
bab58bf0	76	uint64_t asc, int rw, bool exc)
dfebd7a7	77	{
bab58bf0	78	uint64_t tec;
dfebd7a7	79
217a4acb	80	tec = vaddr \| (rw == MMU_DATA_STORE ? FS_WRITE : FS_READ) \| 4 \| asc >> 46;
bab58bf0 TH	81
bab58bf0 TH	82	DPRINTF("%s: trans_exc_code=%016" PRIx64 "\n", __func__, tec);
dfebd7a7	83
e3e09d87 TH	84	if (!exc) {
	85	return;
	86	}
	87
becf8217	88	trigger_access_exception(env, PGM_PROTECTION, ILEN_AUTO, tec);
dfebd7a7 TH	89	}
	90
	91	static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr,
e3e09d87	92	uint32_t type, uint64_t asc, int rw, bool exc)
dfebd7a7	93	{
becf8217	94	int ilen = ILEN_AUTO;
bab58bf0 TH	95	uint64_t tec;
bab58bf0 TH	96
217a4acb	97	tec = vaddr \| (rw == MMU_DATA_STORE ? FS_WRITE : FS_READ) \| asc >> 46;
dfebd7a7	98
c5b2ee4c	99	DPRINTF("%s: trans_exc_code=%016" PRIx64 "\n", __func__, tec);
e3e09d87 TH	100
	101	if (!exc) {
	102	return;
	103	}
	104
dfebd7a7	105	/* Code accesses have an undefined ilc. */
217a4acb	106	if (rw == MMU_INST_FETCH) {
dfebd7a7 TH	107	ilen = 2;
	108	}
	109
801cdd35	110	trigger_access_exception(env, type, ilen, tec);
dfebd7a7 TH	111	}
dfebd7a7 TH	112
2bcf0183 DH	113	/* check whether the address would be proteted by Low-Address Protection */
	114	static bool is_low_address(uint64_t addr)
	115	{
	116	return addr <= 511 \|\| (addr >= 4096 && addr <= 4607);
	117	}
	118
	119	/* check whether Low-Address Protection is enabled for mmu_translate() */
	120	static bool lowprot_enabled(const CPUS390XState *env, uint64_t asc)
	121	{
	122	if (!(env->cregs[0] & CR0_LOWPROT)) {
	123	return false;
	124	}
	125	if (!(env->psw.mask & PSW_MASK_DAT)) {
	126	return true;
	127	}
	128
	129	/* Check the private-space control bit */
	130	switch (asc) {
	131	case PSW_ASC_PRIMARY:
adab99be	132	return !(env->cregs[1] & ASCE_PRIVATE_SPACE);
2bcf0183	133	case PSW_ASC_SECONDARY:
adab99be	134	return !(env->cregs[7] & ASCE_PRIVATE_SPACE);
2bcf0183	135	case PSW_ASC_HOME:
adab99be	136	return !(env->cregs[13] & ASCE_PRIVATE_SPACE);
2bcf0183 DH	137	default:
	138	/* We don't support access register mode */
	139	error_report("unsupported addressing mode");
	140	exit(1);
	141	}
	142	}
	143
dfebd7a7 TH	144	/**
	145	* Translate real address to absolute (= physical)
	146	* address by taking care of the prefix mapping.
	147	*/
f79f1ca4	148	target_ulong mmu_real2abs(CPUS390XState *env, target_ulong raddr)
dfebd7a7 TH	149	{
	150	if (raddr < 0x2000) {
	151	return raddr + env->psa; /* Map the lowcore. */
	152	} else if (raddr >= env->psa && raddr < env->psa + 0x2000) {
	153	return raddr - env->psa; /* Map the 0 page. */
	154	}
	155	return raddr;
	156	}
	157
	158	/* Decode page table entry (normal 4KB page) */
	159	static int mmu_translate_pte(CPUS390XState *env, target_ulong vaddr,
ede59855	160	uint64_t asc, uint64_t pt_entry,
e3e09d87	161	target_ulong raddr, int flags, int rw, bool exc)
dfebd7a7	162	{
adab99be	163	if (pt_entry & PAGE_INVALID) {
ede59855	164	DPRINTF("%s: PTE=0x%" PRIx64 " invalid\n", __func__, pt_entry);
e3e09d87	165	trigger_page_fault(env, vaddr, PGM_PAGE_TRANS, asc, rw, exc);
dfebd7a7 TH	166	return -1;
dfebd7a7 TH	167	}
adab99be	168	if (pt_entry & PAGE_RES0) {
b4ecbf80 TH	169	trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw, exc);
	170	return -1;
	171	}
adab99be	172	if (pt_entry & PAGE_RO) {
dfebd7a7 TH	173	*flags &= ~PAGE_WRITE;
	174	}
	175
adab99be	176	*raddr = pt_entry & ASCE_ORIGIN;
dfebd7a7	177
ede59855	178	PTE_DPRINTF("%s: PTE=0x%" PRIx64 "\n", __func__, pt_entry);
dfebd7a7 TH	179
	180	return 0;
	181	}
	182
f8f84e93 TH	183	/* Decode segment table entry */
	184	static int mmu_translate_segment(CPUS390XState *env, target_ulong vaddr,
	185	uint64_t asc, uint64_t st_entry,
e3e09d87 TH	186	target_ulong raddr, int flags, int rw,
e3e09d87 TH	187	bool exc)
dfebd7a7	188	{
dc79e928	189	CPUState *cs = env_cpu(env);
f8f84e93	190	uint64_t origin, offs, pt_entry;
dfebd7a7	191
adab99be	192	if (st_entry & SEGMENT_ENTRY_RO) {
dfebd7a7 TH	193	*flags &= ~PAGE_WRITE;
	194	}
	195
adab99be	196	if ((st_entry & SEGMENT_ENTRY_FC) && (env->cregs[0] & CR0_EDAT)) {
f8f84e93 TH	197	/* Decode EDAT1 segment frame absolute address (1MB page) */
	198	*raddr = (st_entry & 0xfffffffffff00000ULL) \| (vaddr & 0xfffff);
	199	PTE_DPRINTF("%s: SEG=0x%" PRIx64 "\n", __func__, st_entry);
	200	return 0;
	201	}
dfebd7a7	202
f8f84e93	203	/* Look up 4KB page entry */
adab99be	204	origin = st_entry & SEGMENT_ENTRY_ORIGIN;
f8f84e93 TH	205	offs = (vaddr & VADDR_PX) >> 9;
	206	pt_entry = ldq_phys(cs->as, origin + offs);
	207	PTE_DPRINTF("%s: 0x%" PRIx64 " + 0x%" PRIx64 " => 0x%016" PRIx64 "\n",
	208	__func__, origin, offs, pt_entry);
e3e09d87	209	return mmu_translate_pte(env, vaddr, asc, pt_entry, raddr, flags, rw, exc);
dfebd7a7 TH	210	}
dfebd7a7 TH	211
f8f84e93 TH	212	/* Decode region table entries */
	213	static int mmu_translate_region(CPUS390XState *env, target_ulong vaddr,
	214	uint64_t asc, uint64_t entry, int level,
e3e09d87 TH	215	target_ulong raddr, int flags, int rw,
e3e09d87 TH	216	bool exc)
dfebd7a7	217	{
dc79e928	218	CPUState *cs = env_cpu(env);
f8f84e93	219	uint64_t origin, offs, new_entry;
5d180439 TH	220	const int pchks[4] = {
	221	PGM_SEGMENT_TRANS, PGM_REG_THIRD_TRANS,
	222	PGM_REG_SEC_TRANS, PGM_REG_FIRST_TRANS
	223	};
f8f84e93 TH	224
f8f84e93 TH	225	PTE_DPRINTF("%s: 0x%" PRIx64 "\n", __func__, entry);
dfebd7a7	226
adab99be	227	origin = entry & REGION_ENTRY_ORIGIN;
f8f84e93 TH	228	offs = (vaddr >> (17 + 11 * level / 4)) & 0x3ff8;
	229
	230	new_entry = ldq_phys(cs->as, origin + offs);
	231	PTE_DPRINTF("%s: 0x%" PRIx64 " + 0x%" PRIx64 " => 0x%016" PRIx64 "\n",
	232	__func__, origin, offs, new_entry);
dfebd7a7	233
adab99be	234	if ((new_entry & REGION_ENTRY_INV) != 0) {
dfebd7a7	235	DPRINTF("%s: invalid region\n", __func__);
5a123b3c	236	trigger_page_fault(env, vaddr, pchks[level / 4], asc, rw, exc);
dfebd7a7 TH	237	return -1;
	238	}
	239
adab99be	240	if ((new_entry & REGION_ENTRY_TYPE_MASK) != level) {
e3e09d87	241	trigger_page_fault(env, vaddr, PGM_TRANS_SPEC, asc, rw, exc);
dfebd7a7 TH	242	return -1;
	243	}
	244
adab99be	245	if (level == ASCE_TYPE_SEGMENT) {
f8f84e93	246	return mmu_translate_segment(env, vaddr, asc, new_entry, raddr, flags,
e3e09d87	247	rw, exc);
dfebd7a7	248	}
f8f84e93	249
5d180439 TH	250	/* Check region table offset and length */
5d180439 TH	251	offs = (vaddr >> (28 + 11 * (level - 4) / 4)) & 3;
adab99be TH	252	if (offs < ((new_entry & REGION_ENTRY_TF) >> 6)
adab99be TH	253	\|\| offs > (new_entry & REGION_ENTRY_LENGTH)) {
5d180439	254	DPRINTF("%s: invalid offset or len (%lx)\n", __func__, new_entry);
e3e09d87	255	trigger_page_fault(env, vaddr, pchks[level / 4 - 1], asc, rw, exc);
5d180439 TH	256	return -1;
	257	}
	258
adab99be	259	if ((env->cregs[0] & CR0_EDAT) && (new_entry & REGION_ENTRY_RO)) {
43d49b01 TH	260	*flags &= ~PAGE_WRITE;
	261	}
	262
f8f84e93 TH	263	/* yet another region */
f8f84e93 TH	264	return mmu_translate_region(env, vaddr, asc, new_entry, level - 4,
e3e09d87	265	raddr, flags, rw, exc);
dfebd7a7 TH	266	}
dfebd7a7 TH	267
9d77309c TH	268	static int mmu_translate_asce(CPUS390XState *env, target_ulong vaddr,
	269	uint64_t asc, uint64_t asce, target_ulong *raddr,
	270	int *flags, int rw, bool exc)
dfebd7a7	271	{
f8f84e93	272	int level;
dfebd7a7 TH	273	int r;
dfebd7a7 TH	274
adab99be	275	if (asce & ASCE_REAL_SPACE) {
89a41e0a TH	276	/* direct mapping */
	277	*raddr = vaddr;
	278	return 0;
	279	}
	280
adab99be	281	level = asce & ASCE_TYPE_MASK;
f8f84e93	282	switch (level) {
adab99be TH	283	case ASCE_TYPE_REGION1:
adab99be TH	284	if ((vaddr >> 62) > (asce & ASCE_TABLE_LENGTH)) {
e3e09d87	285	trigger_page_fault(env, vaddr, PGM_REG_FIRST_TRANS, asc, rw, exc);
5d180439 TH	286	return -1;
5d180439 TH	287	}
dfebd7a7	288	break;
adab99be	289	case ASCE_TYPE_REGION2:
dfebd7a7 TH	290	if (vaddr & 0xffe0000000000000ULL) {
	291	DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
	292	" 0xffe0000000000000ULL\n", __func__, vaddr);
d267571b	293	trigger_page_fault(env, vaddr, PGM_ASCE_TYPE, asc, rw, exc);
dfebd7a7 TH	294	return -1;
dfebd7a7 TH	295	}
adab99be	296	if ((vaddr >> 51 & 3) > (asce & ASCE_TABLE_LENGTH)) {
e3e09d87	297	trigger_page_fault(env, vaddr, PGM_REG_SEC_TRANS, asc, rw, exc);
5d180439 TH	298	return -1;
5d180439 TH	299	}
dfebd7a7	300	break;
adab99be	301	case ASCE_TYPE_REGION3:
dfebd7a7 TH	302	if (vaddr & 0xfffffc0000000000ULL) {
	303	DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
	304	" 0xfffffc0000000000ULL\n", __func__, vaddr);
d267571b	305	trigger_page_fault(env, vaddr, PGM_ASCE_TYPE, asc, rw, exc);
dfebd7a7 TH	306	return -1;
dfebd7a7 TH	307	}
adab99be	308	if ((vaddr >> 40 & 3) > (asce & ASCE_TABLE_LENGTH)) {
e3e09d87	309	trigger_page_fault(env, vaddr, PGM_REG_THIRD_TRANS, asc, rw, exc);
5d180439 TH	310	return -1;
5d180439 TH	311	}
dfebd7a7	312	break;
adab99be	313	case ASCE_TYPE_SEGMENT:
dfebd7a7 TH	314	if (vaddr & 0xffffffff80000000ULL) {
	315	DPRINTF("%s: vaddr doesn't fit 0x%16" PRIx64
	316	" 0xffffffff80000000ULL\n", __func__, vaddr);
d267571b	317	trigger_page_fault(env, vaddr, PGM_ASCE_TYPE, asc, rw, exc);
dfebd7a7 TH	318	return -1;
dfebd7a7 TH	319	}
adab99be	320	if ((vaddr >> 29 & 3) > (asce & ASCE_TABLE_LENGTH)) {
e3e09d87	321	trigger_page_fault(env, vaddr, PGM_SEGMENT_TRANS, asc, rw, exc);
5d180439 TH	322	return -1;
5d180439 TH	323	}
dfebd7a7 TH	324	break;
	325	}
	326
e3e09d87 TH	327	r = mmu_translate_region(env, vaddr, asc, asce, level, raddr, flags, rw,
e3e09d87 TH	328	exc);
61a17fea	329	if (!r && rw == MMU_DATA_STORE && !(*flags & PAGE_WRITE)) {
bab58bf0	330	trigger_prot_fault(env, vaddr, asc, rw, exc);
dfebd7a7 TH	331	return -1;
	332	}
	333
	334	return r;
	335	}
	336
e3e09d87 TH	337	/**
	338	* Translate a virtual (logical) address into a physical (absolute) address.
	339	* @param vaddr the virtual address
	340	* @param rw 0 = read, 1 = write, 2 = code fetch
	341	* @param asc address space control (one of the PSW_ASC_* modes)
	342	* @param raddr the translated address is stored to this pointer
	343	* @param flags the PAGE_READ/WRITE/EXEC flags are stored to this pointer
631b22ea SW	344	* @param exc true = inject a program check if a fault occurred
631b22ea SW	345	* @return 0 if the translation was successful, -1 if a fault occurred
e3e09d87	346	*/
dfebd7a7	347	int mmu_translate(CPUS390XState *env, target_ulong vaddr, int rw, uint64_t asc,
e3e09d87	348	target_ulong raddr, int flags, bool exc)
dfebd7a7	349	{
0f5f6691 JH	350	static S390SKeysState *ss;
0f5f6691 JH	351	static S390SKeysClass *skeyclass;
dfebd7a7	352	int r = -1;
0f5f6691 JH	353	uint8_t key;
	354
	355	if (unlikely(!ss)) {
	356	ss = s390_get_skeys_device();
	357	skeyclass = S390_SKEYS_GET_CLASS(ss);
	358	}
dfebd7a7 TH	359
dfebd7a7 TH	360	*flags = PAGE_READ \| PAGE_WRITE \| PAGE_EXEC;
2bcf0183 DH	361	if (is_low_address(vaddr & TARGET_PAGE_MASK) && lowprot_enabled(env, asc)) {
	362	/*
	363	* If any part of this page is currently protected, make sure the
	364	* TLB entry will not be reused.
	365	*
	366	* As the protected range is always the first 512 bytes of the
	367	* two first pages, we are able to catch all writes to these areas
	368	* just by looking at the start address (triggering the tlb miss).
	369	*/
	370	*flags \|= PAGE_WRITE_INV;
	371	if (is_low_address(vaddr) && rw == MMU_DATA_STORE) {
	372	if (exc) {
	373	trigger_access_exception(env, PGM_PROTECTION, ILEN_AUTO, 0);
	374	}
	375	return -EACCES;
	376	}
	377	}
	378
dfebd7a7 TH	379	vaddr &= TARGET_PAGE_MASK;
	380
	381	if (!(env->psw.mask & PSW_MASK_DAT)) {
	382	*raddr = vaddr;
	383	r = 0;
	384	goto out;
	385	}
	386
	387	switch (asc) {
	388	case PSW_ASC_PRIMARY:
9d77309c TH	389	PTE_DPRINTF("%s: asc=primary\n", __func__);
	390	r = mmu_translate_asce(env, vaddr, asc, env->cregs[1], raddr, flags,
	391	rw, exc);
	392	break;
dfebd7a7	393	case PSW_ASC_HOME:
9d77309c TH	394	PTE_DPRINTF("%s: asc=home\n", __func__);
	395	r = mmu_translate_asce(env, vaddr, asc, env->cregs[13], raddr, flags,
	396	rw, exc);
dfebd7a7 TH	397	break;
dfebd7a7 TH	398	case PSW_ASC_SECONDARY:
9d77309c	399	PTE_DPRINTF("%s: asc=secondary\n", __func__);
dfebd7a7 TH	400	/*
	401	* Instruction: Primary
	402	* Data: Secondary
	403	*/
217a4acb	404	if (rw == MMU_INST_FETCH) {
9d77309c TH	405	r = mmu_translate_asce(env, vaddr, PSW_ASC_PRIMARY, env->cregs[1],
9d77309c TH	406	raddr, flags, rw, exc);
dfebd7a7 TH	407	*flags &= ~(PAGE_READ \| PAGE_WRITE);
dfebd7a7 TH	408	} else {
9d77309c TH	409	r = mmu_translate_asce(env, vaddr, PSW_ASC_SECONDARY, env->cregs[7],
9d77309c TH	410	raddr, flags, rw, exc);
dfebd7a7 TH	411	*flags &= ~(PAGE_EXEC);
	412	}
	413	break;
	414	case PSW_ASC_ACCREG:
	415	default:
	416	hw_error("guest switched to unknown asc mode\n");
	417	break;
	418	}
	419
	420	out:
	421	/* Convert real address -> absolute address */
	422	raddr = mmu_real2abs(env, raddr);
	423
0f5f6691 JH	424	if (r == 0 && *raddr < ram_size) {
	425	if (skeyclass->get_skeys(ss, *raddr / TARGET_PAGE_SIZE, 1, &key)) {
	426	trace_get_skeys_nonzero(r);
	427	return 0;
	428	}
	429
dfebd7a7	430	if (*flags & PAGE_READ) {
0f5f6691	431	key \|= SK_R;
dfebd7a7 TH	432	}
	433
	434	if (*flags & PAGE_WRITE) {
0f5f6691 JH	435	key \|= SK_C;
	436	}
	437
	438	if (skeyclass->set_skeys(ss, *raddr / TARGET_PAGE_SIZE, 1, &key)) {
	439	trace_set_skeys_nonzero(r);
	440	return 0;
dfebd7a7 TH	441	}
	442	}
	443
	444	return r;
	445	}
c3edd628	446
c3edd628 TH	447	/**
c3edd628 TH	448	* translate_pages: Translate a set of consecutive logical page addresses
820613b1 DH	449	* to absolute addresses. This function is used for TCG and old KVM without
820613b1 DH	450	* the MEMOP interface.
c3edd628 TH	451	*/
	452	static int translate_pages(S390CPU *cpu, vaddr addr, int nr_pages,
	453	target_ulong *pages, bool is_write)
	454	{
c3edd628 TH	455	uint64_t asc = cpu->env.psw.mask & PSW_MASK_ASC;
	456	CPUS390XState *env = &cpu->env;
	457	int ret, i, pflags;
	458
	459	for (i = 0; i < nr_pages; i++) {
c3edd628 TH	460	ret = mmu_translate(env, addr, is_write, asc, &pages[i], &pflags, true);
	461	if (ret) {
	462	return ret;
	463	}
	464	if (!address_space_access_valid(&address_space_memory, pages[i],
fddffa42 PM	465	TARGET_PAGE_SIZE, is_write,
fddffa42 PM	466	MEMTXATTRS_UNSPECIFIED)) {
820613b1	467	trigger_access_exception(env, PGM_ADDRESSING, ILEN_AUTO, 0);
c3edd628 TH	468	return -EFAULT;
	469	}
	470	addr += TARGET_PAGE_SIZE;
	471	}
	472
	473	return 0;
	474	}
	475
	476	/**
	477	* s390_cpu_virt_mem_rw:
	478	* @laddr: the logical start address
6cb1e49d	479	* @ar: the access register number
c3edd628	480	* @hostbuf: buffer in host memory. NULL = do only checks w/o copying
631b22ea	481	* @len: length that should be transferred
c3edd628	482	* @is_write: true = write, false = read
631b22ea	483	* Returns: 0 on success, non-zero if an exception occurred
c3edd628 TH	484	*
	485	* Copy from/to guest memory using logical addresses. Note that we inject a
	486	* program interrupt in case there is an error while accessing the memory.
98ee9bed DH	487	*
	488	* This function will always return (also for TCG), make sure to call
	489	* s390_cpu_virt_mem_handle_exc() to properly exit the CPU loop.
c3edd628	490	*/
6cb1e49d	491	int s390_cpu_virt_mem_rw(S390CPU cpu, vaddr laddr, uint8_t ar, void hostbuf,
c3edd628 TH	492	int len, bool is_write)
	493	{
	494	int currlen, nr_pages, i;
	495	target_ulong *pages;
	496	int ret;
	497
a9bcd1b8	498	if (kvm_enabled()) {
6cb1e49d	499	ret = kvm_s390_mem_op(cpu, laddr, ar, hostbuf, len, is_write);
a9bcd1b8 TH	500	if (ret >= 0) {
	501	return ret;
	502	}
	503	}
	504
c3edd628 TH	505	nr_pages = (((laddr & ~TARGET_PAGE_MASK) + len - 1) >> TARGET_PAGE_BITS)
	506	+ 1;
	507	pages = g_malloc(nr_pages * sizeof(*pages));
	508
	509	ret = translate_pages(cpu, laddr, nr_pages, pages, is_write);
	510	if (ret == 0 && hostbuf != NULL) {
	511	/* Copy data by stepping through the area page by page */
	512	for (i = 0; i < nr_pages; i++) {
	513	currlen = MIN(len, TARGET_PAGE_SIZE - (laddr % TARGET_PAGE_SIZE));
	514	cpu_physical_memory_rw(pages[i] \| (laddr & ~TARGET_PAGE_MASK),
	515	hostbuf, currlen, is_write);
	516	laddr += currlen;
	517	hostbuf += currlen;
	518	len -= currlen;
	519	}
	520	}
	521
	522	g_free(pages);
	523	return ret;
	524	}
fb66944d	525
98ee9bed DH	526	void s390_cpu_virt_mem_handle_exc(S390CPU *cpu, uintptr_t ra)
	527	{
	528	/* KVM will handle the interrupt automatically, TCG has to exit the TB */
	529	#ifdef CONFIG_TCG
	530	if (tcg_enabled()) {
	531	cpu_loop_exit_restore(CPU(cpu), ra);
	532	}
	533	#endif
	534	}
	535
fb66944d DH	536	/**
	537	* Translate a real address into a physical (absolute) address.
	538	* @param raddr the real address
	539	* @param rw 0 = read, 1 = write, 2 = code fetch
	540	* @param addr the translated address is stored to this pointer
	541	* @param flags the PAGE_READ/WRITE/EXEC flags are stored to this pointer
	542	* @return 0 if the translation was successful, < 0 if a fault occurred
	543	*/
	544	int mmu_translate_real(CPUS390XState *env, target_ulong raddr, int rw,
	545	target_ulong addr, int flags)
	546	{
2bcf0183 DH	547	const bool lowprot_enabled = env->cregs[0] & CR0_LOWPROT;
2bcf0183 DH	548
f26852aa	549	*flags = PAGE_READ \| PAGE_WRITE \| PAGE_EXEC;
2bcf0183 DH	550	if (is_low_address(raddr & TARGET_PAGE_MASK) && lowprot_enabled) {
	551	/* see comment in mmu_translate() how this works */
	552	*flags \|= PAGE_WRITE_INV;
	553	if (is_low_address(raddr) && rw == MMU_DATA_STORE) {
	554	trigger_access_exception(env, PGM_PROTECTION, ILEN_AUTO, 0);
	555	return -EACCES;
	556	}
	557	}
	558
	559	*addr = mmu_real2abs(env, raddr & TARGET_PAGE_MASK);
fb66944d DH	560
	561	/* TODO: storage key handling */
	562	return 0;
	563	}