[Qemu-ppc] [PATCH 21/32] mmu-hash64: Don't keep looking for PTEs after we find a match

[David Gibson]

BEHAVIOUR CHANGE

The ppc hash mmu hashes each virtual address to a primary and secondary
possible hash bucket (aka PTE group or PTEG) each with 8 PTEs.  Then we
need a linear search through the PTEs to find the correct one for the
virtual address we're translating.

It is a programming error for the guest to insert multiple PTEs mapping the
same virtual address into a PTEG - in this case the ppc architecture says
the MMU can either act as if just one was present, or give a machine check.
Currently our code takes the first matching PTE in a PTEG if it finds a
successful translation.  But if a matching PTE is found, but permission
bits don't allow the access, we keep looking through the PTEG, checking
that any other matching PTEs contain an identical translation.

That behaviour is perhaps not exactly wrong, but it's certainly not useful.
This patch changes it to always just find the first matching PTE in a PTEG.

In addition, if we get a permissions problem on the primary PTEG, we then
search the secondary PTEG.  This is incorrect - a permission denying PTE
in the primary PTEG should not be overwritten by an access granting PTE in
the secondary (although again, it would be a programming error for the
guest to set up such a situation anyway).  So additionally we update the
code to only search the secondary PTEG if no matching PTE is found in the
primary at all.

Signed-off-by: David Gibson <address@hidden>
---
 target-ppc/mmu-hash64.c |   42 +++++-------------------------------------
 1 file changed, 5 insertions(+), 37 deletions(-)

diff --git a/target-ppc/mmu-hash64.c b/target-ppc/mmu-hash64.c
index 14585c0..03c8d29 100644
--- a/target-ppc/mmu-hash64.c
+++ b/target-ppc/mmu-hash64.c
@@ -231,8 +231,6 @@ target_ulong helper_load_slb_vsid(CPUPPCState *env, 
target_ulong rb)
  * 64-bit hash table MMU handling
  */
 
-#define PTE64_CHECK_MASK (TARGET_PAGE_MASK | 0x7F)
-
 static int ppc_hash64_pp_check(int key, int pp, bool nx)
 {
     int access;
@@ -304,7 +302,6 @@ static int ppc_hash64_check_prot(int prot, int rwx)
 static int pte64_check(struct mmu_ctx_hash64 *ctx, target_ulong pte0,
                        target_ulong pte1, int h, int rwx)
 {
-    target_ulong mmask;
     int access, ret, pp;
 
     ret = -1;
@@ -313,18 +310,10 @@ static int pte64_check(struct mmu_ctx_hash64 *ctx, 
target_ulong pte0,
         bool nx;
 
         /* Check vsid & api */
-        mmask = PTE64_CHECK_MASK;
         pp = (pte1 & HPTE_R_PP) | ((pte1 & HPTE_R_PP0) >> 61);
         /* No execute if either noexec or guarded bits set */
         nx = (pte1 & HPTE_R_N) || (pte1 & HPTE_R_G);
         if (HPTE_V_COMPARE(pte0, ctx->ptem)) {
-            if (ctx->raddr != (hwaddr)-1ULL) {
-                /* all matches should have equal RPN, WIMG & PP */
-                if ((ctx->raddr & mmask) != (pte1 & mmask)) {
-                    qemu_log("Bad RPN/WIMG/PP\n");
-                    return -3;
-                }
-            }
             /* Compute access rights */
             access = ppc_hash64_pp_check(ctx->key, pp, nx);
             /* Keep the matching PTE informations */
@@ -388,34 +377,15 @@ static int find_pte64(CPUPPCState *env, struct 
mmu_ctx_hash64 *ctx,
         r = pte64_check(ctx, pte0, pte1, h, rwx);
         LOG_MMU("Load pte from %016" HWADDR_PRIx " => " TARGET_FMT_lx " "
                 TARGET_FMT_lx " %d %d %d " TARGET_FMT_lx "\n",
-                pteg_off + (i * 16), pte0, pte1, (int)(pte0 & 1), h,
-                (int)((pte0 >> 1) & 1), ctx->ptem);
-        switch (r) {
-        case -3:
-            /* PTE inconsistency */
-            return -1;
-        case -2:
-            /* Access violation */
-            ret = -2;
+                pteg_off + (i * 16), pte0, pte1, !!(pte0 & HPTE_V_VALID),
+                h, !!(pte0 & HPTE_V_SECONDARY), ctx->ptem);
+        if (r != -1) {
+            ret = r;
             good = i;
             break;
-        case -1:
-        default:
-            /* No PTE match */
-            break;
-        case 0:
-            /* access granted */
-            /* XXX: we should go on looping to check all PTEs consistency
-             *      but if we can speed-up the whole thing as the
-             *      result would be undefined if PTEs are not consistent.
-             */
-            ret = 0;
-            good = i;
-            goto done;
         }
     }
     if (good != -1) {
-    done:
         LOG_MMU("found PTE at addr %08" HWADDR_PRIx " prot=%01x ret=%d\n",
                 ctx->raddr, ctx->prot, ret);
         /* Update page flags */
@@ -503,8 +473,6 @@ static int ppc_hash64_translate(CPUPPCState *env, struct 
mmu_ctx_hash64 *ctx,
     ctx->hash[0] = hash;
     ctx->hash[1] = ~hash;
 
-    /* Initialize real address with an invalid value */
-    ctx->raddr = (hwaddr)-1ULL;
     LOG_MMU("0 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
             " vsid=" TARGET_FMT_lx " ptem=" TARGET_FMT_lx
             " hash=" TARGET_FMT_plx "\n",
@@ -512,7 +480,7 @@ static int ppc_hash64_translate(CPUPPCState *env, struct 
mmu_ctx_hash64 *ctx,
             ctx->hash[0]);
     /* Primary table lookup */
     ret = find_pte64(env, ctx, eaddr, 0, rwx, target_page_bits);
-    if (ret < 0) {
+    if (ret == -1) {
         /* Secondary table lookup */
         LOG_MMU("1 htab=" TARGET_FMT_plx "/" TARGET_FMT_plx
                 " vsid=" TARGET_FMT_lx " api=" TARGET_FMT_lx
-- 
1.7.10.4