1 | /* |
2 | * QEMU ARM CPU -- internal functions and types |
3 | * |
4 | * Copyright (c) 2014 Linaro Ltd |
5 | * |
6 | * This program is free software; you can redistribute it and/or |
7 | * modify it under the terms of the GNU General Public License |
8 | * as published by the Free Software Foundation; either version 2 |
9 | * of the License, or (at your option) any later version. |
10 | * |
11 | * This program is distributed in the hope that it will be useful, |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
14 | * GNU General Public License for more details. |
15 | * |
16 | * You should have received a copy of the GNU General Public License |
17 | * along with this program; if not, see |
18 | * <http://www.gnu.org/licenses/gpl-2.0.html> |
19 | * |
20 | * This header defines functions, types, etc which need to be shared |
21 | * between different source files within target/arm/ but which are |
22 | * private to it and not required by the rest of QEMU. |
23 | */ |
24 | |
25 | #ifndef TARGET_ARM_INTERNALS_H |
26 | #define TARGET_ARM_INTERNALS_H |
27 | |
28 | #include "hw/registerfields.h" |
29 | |
30 | /* register banks for CPU modes */ |
31 | #define BANK_USRSYS 0 |
32 | #define BANK_SVC 1 |
33 | #define BANK_ABT 2 |
34 | #define BANK_UND 3 |
35 | #define BANK_IRQ 4 |
36 | #define BANK_FIQ 5 |
37 | #define BANK_HYP 6 |
38 | #define BANK_MON 7 |
39 | |
40 | static inline bool excp_is_internal(int excp) |
41 | { |
42 | /* Return true if this exception number represents a QEMU-internal |
43 | * exception that will not be passed to the guest. |
44 | */ |
45 | return excp == EXCP_INTERRUPT |
46 | || excp == EXCP_HLT |
47 | || excp == EXCP_DEBUG |
48 | || excp == EXCP_HALTED |
49 | || excp == EXCP_EXCEPTION_EXIT |
50 | || excp == EXCP_KERNEL_TRAP |
51 | || excp == EXCP_SEMIHOST; |
52 | } |
53 | |
54 | /* Scale factor for generic timers, ie number of ns per tick. |
55 | * This gives a 62.5MHz timer. |
56 | */ |
57 | #define GTIMER_SCALE 16 |
58 | |
59 | /* Bit definitions for the v7M CONTROL register */ |
60 | FIELD(V7M_CONTROL, NPRIV, 0, 1) |
61 | FIELD(V7M_CONTROL, SPSEL, 1, 1) |
62 | FIELD(V7M_CONTROL, FPCA, 2, 1) |
63 | FIELD(V7M_CONTROL, SFPA, 3, 1) |
64 | |
65 | /* Bit definitions for v7M exception return payload */ |
66 | FIELD(V7M_EXCRET, ES, 0, 1) |
67 | FIELD(V7M_EXCRET, RES0, 1, 1) |
68 | FIELD(V7M_EXCRET, SPSEL, 2, 1) |
69 | FIELD(V7M_EXCRET, MODE, 3, 1) |
70 | FIELD(V7M_EXCRET, FTYPE, 4, 1) |
71 | FIELD(V7M_EXCRET, DCRS, 5, 1) |
72 | FIELD(V7M_EXCRET, S, 6, 1) |
73 | FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */ |
74 | |
75 | /* Minimum value which is a magic number for exception return */ |
76 | #define EXC_RETURN_MIN_MAGIC 0xff000000 |
77 | /* Minimum number which is a magic number for function or exception return |
78 | * when using v8M security extension |
79 | */ |
80 | #define FNC_RETURN_MIN_MAGIC 0xfefffffe |
81 | |
82 | /* We use a few fake FSR values for internal purposes in M profile. |
83 | * M profile cores don't have A/R format FSRs, but currently our |
84 | * get_phys_addr() code assumes A/R profile and reports failures via |
85 | * an A/R format FSR value. We then translate that into the proper |
86 | * M profile exception and FSR status bit in arm_v7m_cpu_do_interrupt(). |
87 | * Mostly the FSR values we use for this are those defined for v7PMSA, |
88 | * since we share some of that codepath. A few kinds of fault are |
89 | * only for M profile and have no A/R equivalent, though, so we have |
90 | * to pick a value from the reserved range (which we never otherwise |
91 | * generate) to use for these. |
92 | * These values will never be visible to the guest. |
93 | */ |
94 | #define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */ |
95 | #define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */ |
96 | |
97 | /** |
98 | * raise_exception: Raise the specified exception. |
99 | * Raise a guest exception with the specified value, syndrome register |
100 | * and target exception level. This should be called from helper functions, |
101 | * and never returns because we will longjump back up to the CPU main loop. |
102 | */ |
103 | void QEMU_NORETURN raise_exception(CPUARMState *env, uint32_t excp, |
104 | uint32_t syndrome, uint32_t target_el); |
105 | |
106 | /* |
107 | * Similarly, but also use unwinding to restore cpu state. |
108 | */ |
109 | void QEMU_NORETURN raise_exception_ra(CPUARMState *env, uint32_t excp, |
110 | uint32_t syndrome, uint32_t target_el, |
111 | uintptr_t ra); |
112 | |
113 | /* |
114 | * For AArch64, map a given EL to an index in the banked_spsr array. |
115 | * Note that this mapping and the AArch32 mapping defined in bank_number() |
116 | * must agree such that the AArch64<->AArch32 SPSRs have the architecturally |
117 | * mandated mapping between each other. |
118 | */ |
119 | static inline unsigned int aarch64_banked_spsr_index(unsigned int el) |
120 | { |
121 | static const unsigned int map[4] = { |
122 | [1] = BANK_SVC, /* EL1. */ |
123 | [2] = BANK_HYP, /* EL2. */ |
124 | [3] = BANK_MON, /* EL3. */ |
125 | }; |
126 | assert(el >= 1 && el <= 3); |
127 | return map[el]; |
128 | } |
129 | |
130 | /* Map CPU modes onto saved register banks. */ |
131 | static inline int bank_number(int mode) |
132 | { |
133 | switch (mode) { |
134 | case ARM_CPU_MODE_USR: |
135 | case ARM_CPU_MODE_SYS: |
136 | return BANK_USRSYS; |
137 | case ARM_CPU_MODE_SVC: |
138 | return BANK_SVC; |
139 | case ARM_CPU_MODE_ABT: |
140 | return BANK_ABT; |
141 | case ARM_CPU_MODE_UND: |
142 | return BANK_UND; |
143 | case ARM_CPU_MODE_IRQ: |
144 | return BANK_IRQ; |
145 | case ARM_CPU_MODE_FIQ: |
146 | return BANK_FIQ; |
147 | case ARM_CPU_MODE_HYP: |
148 | return BANK_HYP; |
149 | case ARM_CPU_MODE_MON: |
150 | return BANK_MON; |
151 | } |
152 | g_assert_not_reached(); |
153 | } |
154 | |
155 | /** |
156 | * r14_bank_number: Map CPU mode onto register bank for r14 |
157 | * |
158 | * Given an AArch32 CPU mode, return the index into the saved register |
159 | * banks to use for the R14 (LR) in that mode. This is the same as |
160 | * bank_number(), except for the special case of Hyp mode, where |
161 | * R14 is shared with USR and SYS, unlike its R13 and SPSR. |
162 | * This should be used as the index into env->banked_r14[], and |
163 | * bank_number() used for the index into env->banked_r13[] and |
164 | * env->banked_spsr[]. |
165 | */ |
166 | static inline int r14_bank_number(int mode) |
167 | { |
168 | return (mode == ARM_CPU_MODE_HYP) ? BANK_USRSYS : bank_number(mode); |
169 | } |
170 | |
171 | void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu); |
172 | void arm_translate_init(void); |
173 | |
174 | enum arm_fprounding { |
175 | FPROUNDING_TIEEVEN, |
176 | FPROUNDING_POSINF, |
177 | FPROUNDING_NEGINF, |
178 | FPROUNDING_ZERO, |
179 | FPROUNDING_TIEAWAY, |
180 | FPROUNDING_ODD |
181 | }; |
182 | |
183 | int arm_rmode_to_sf(int rmode); |
184 | |
185 | static inline void aarch64_save_sp(CPUARMState *env, int el) |
186 | { |
187 | if (env->pstate & PSTATE_SP) { |
188 | env->sp_el[el] = env->xregs[31]; |
189 | } else { |
190 | env->sp_el[0] = env->xregs[31]; |
191 | } |
192 | } |
193 | |
194 | static inline void aarch64_restore_sp(CPUARMState *env, int el) |
195 | { |
196 | if (env->pstate & PSTATE_SP) { |
197 | env->xregs[31] = env->sp_el[el]; |
198 | } else { |
199 | env->xregs[31] = env->sp_el[0]; |
200 | } |
201 | } |
202 | |
203 | static inline void update_spsel(CPUARMState *env, uint32_t imm) |
204 | { |
205 | unsigned int cur_el = arm_current_el(env); |
206 | /* Update PSTATE SPSel bit; this requires us to update the |
207 | * working stack pointer in xregs[31]. |
208 | */ |
209 | if (!((imm ^ env->pstate) & PSTATE_SP)) { |
210 | return; |
211 | } |
212 | aarch64_save_sp(env, cur_el); |
213 | env->pstate = deposit32(env->pstate, 0, 1, imm); |
214 | |
215 | /* We rely on illegal updates to SPsel from EL0 to get trapped |
216 | * at translation time. |
217 | */ |
218 | assert(cur_el >= 1 && cur_el <= 3); |
219 | aarch64_restore_sp(env, cur_el); |
220 | } |
221 | |
222 | /* |
223 | * arm_pamax |
224 | * @cpu: ARMCPU |
225 | * |
226 | * Returns the implementation defined bit-width of physical addresses. |
227 | * The ARMv8 reference manuals refer to this as PAMax(). |
228 | */ |
229 | static inline unsigned int arm_pamax(ARMCPU *cpu) |
230 | { |
231 | static const unsigned int pamax_map[] = { |
232 | [0] = 32, |
233 | [1] = 36, |
234 | [2] = 40, |
235 | [3] = 42, |
236 | [4] = 44, |
237 | [5] = 48, |
238 | }; |
239 | unsigned int parange = |
240 | FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE); |
241 | |
242 | /* id_aa64mmfr0 is a read-only register so values outside of the |
243 | * supported mappings can be considered an implementation error. */ |
244 | assert(parange < ARRAY_SIZE(pamax_map)); |
245 | return pamax_map[parange]; |
246 | } |
247 | |
248 | /* Return true if extended addresses are enabled. |
249 | * This is always the case if our translation regime is 64 bit, |
250 | * but depends on TTBCR.EAE for 32 bit. |
251 | */ |
252 | static inline bool extended_addresses_enabled(CPUARMState *env) |
253 | { |
254 | TCR *tcr = &env->cp15.tcr_el[arm_is_secure(env) ? 3 : 1]; |
255 | return arm_el_is_aa64(env, 1) || |
256 | (arm_feature(env, ARM_FEATURE_LPAE) && (tcr->raw_tcr & TTBCR_EAE)); |
257 | } |
258 | |
259 | /* Valid Syndrome Register EC field values */ |
260 | enum arm_exception_class { |
261 | EC_UNCATEGORIZED = 0x00, |
262 | EC_WFX_TRAP = 0x01, |
263 | EC_CP15RTTRAP = 0x03, |
264 | EC_CP15RRTTRAP = 0x04, |
265 | EC_CP14RTTRAP = 0x05, |
266 | EC_CP14DTTRAP = 0x06, |
267 | EC_ADVSIMDFPACCESSTRAP = 0x07, |
268 | EC_FPIDTRAP = 0x08, |
269 | EC_PACTRAP = 0x09, |
270 | EC_CP14RRTTRAP = 0x0c, |
271 | EC_BTITRAP = 0x0d, |
272 | EC_ILLEGALSTATE = 0x0e, |
273 | EC_AA32_SVC = 0x11, |
274 | EC_AA32_HVC = 0x12, |
275 | EC_AA32_SMC = 0x13, |
276 | EC_AA64_SVC = 0x15, |
277 | EC_AA64_HVC = 0x16, |
278 | EC_AA64_SMC = 0x17, |
279 | EC_SYSTEMREGISTERTRAP = 0x18, |
280 | EC_SVEACCESSTRAP = 0x19, |
281 | EC_INSNABORT = 0x20, |
282 | EC_INSNABORT_SAME_EL = 0x21, |
283 | EC_PCALIGNMENT = 0x22, |
284 | EC_DATAABORT = 0x24, |
285 | EC_DATAABORT_SAME_EL = 0x25, |
286 | EC_SPALIGNMENT = 0x26, |
287 | EC_AA32_FPTRAP = 0x28, |
288 | EC_AA64_FPTRAP = 0x2c, |
289 | EC_SERROR = 0x2f, |
290 | EC_BREAKPOINT = 0x30, |
291 | EC_BREAKPOINT_SAME_EL = 0x31, |
292 | EC_SOFTWARESTEP = 0x32, |
293 | EC_SOFTWARESTEP_SAME_EL = 0x33, |
294 | EC_WATCHPOINT = 0x34, |
295 | EC_WATCHPOINT_SAME_EL = 0x35, |
296 | EC_AA32_BKPT = 0x38, |
297 | EC_VECTORCATCH = 0x3a, |
298 | EC_AA64_BKPT = 0x3c, |
299 | }; |
300 | |
301 | #define ARM_EL_EC_SHIFT 26 |
302 | #define ARM_EL_IL_SHIFT 25 |
303 | #define ARM_EL_ISV_SHIFT 24 |
304 | #define ARM_EL_IL (1 << ARM_EL_IL_SHIFT) |
305 | #define ARM_EL_ISV (1 << ARM_EL_ISV_SHIFT) |
306 | |
307 | static inline uint32_t syn_get_ec(uint32_t syn) |
308 | { |
309 | return syn >> ARM_EL_EC_SHIFT; |
310 | } |
311 | |
312 | /* Utility functions for constructing various kinds of syndrome value. |
313 | * Note that in general we follow the AArch64 syndrome values; in a |
314 | * few cases the value in HSR for exceptions taken to AArch32 Hyp |
315 | * mode differs slightly, and we fix this up when populating HSR in |
316 | * arm_cpu_do_interrupt_aarch32_hyp(). |
317 | * The exception is FP/SIMD access traps -- these report extra information |
318 | * when taking an exception to AArch32. For those we include the extra coproc |
319 | * and TA fields, and mask them out when taking the exception to AArch64. |
320 | */ |
321 | static inline uint32_t syn_uncategorized(void) |
322 | { |
323 | return (EC_UNCATEGORIZED << ARM_EL_EC_SHIFT) | ARM_EL_IL; |
324 | } |
325 | |
326 | static inline uint32_t syn_aa64_svc(uint32_t imm16) |
327 | { |
328 | return (EC_AA64_SVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff); |
329 | } |
330 | |
331 | static inline uint32_t syn_aa64_hvc(uint32_t imm16) |
332 | { |
333 | return (EC_AA64_HVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff); |
334 | } |
335 | |
336 | static inline uint32_t syn_aa64_smc(uint32_t imm16) |
337 | { |
338 | return (EC_AA64_SMC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff); |
339 | } |
340 | |
341 | static inline uint32_t syn_aa32_svc(uint32_t imm16, bool is_16bit) |
342 | { |
343 | return (EC_AA32_SVC << ARM_EL_EC_SHIFT) | (imm16 & 0xffff) |
344 | | (is_16bit ? 0 : ARM_EL_IL); |
345 | } |
346 | |
347 | static inline uint32_t syn_aa32_hvc(uint32_t imm16) |
348 | { |
349 | return (EC_AA32_HVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff); |
350 | } |
351 | |
352 | static inline uint32_t syn_aa32_smc(void) |
353 | { |
354 | return (EC_AA32_SMC << ARM_EL_EC_SHIFT) | ARM_EL_IL; |
355 | } |
356 | |
357 | static inline uint32_t syn_aa64_bkpt(uint32_t imm16) |
358 | { |
359 | return (EC_AA64_BKPT << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff); |
360 | } |
361 | |
362 | static inline uint32_t syn_aa32_bkpt(uint32_t imm16, bool is_16bit) |
363 | { |
364 | return (EC_AA32_BKPT << ARM_EL_EC_SHIFT) | (imm16 & 0xffff) |
365 | | (is_16bit ? 0 : ARM_EL_IL); |
366 | } |
367 | |
368 | static inline uint32_t syn_aa64_sysregtrap(int op0, int op1, int op2, |
369 | int crn, int crm, int rt, |
370 | int isread) |
371 | { |
372 | return (EC_SYSTEMREGISTERTRAP << ARM_EL_EC_SHIFT) | ARM_EL_IL |
373 | | (op0 << 20) | (op2 << 17) | (op1 << 14) | (crn << 10) | (rt << 5) |
374 | | (crm << 1) | isread; |
375 | } |
376 | |
377 | static inline uint32_t syn_cp14_rt_trap(int cv, int cond, int opc1, int opc2, |
378 | int crn, int crm, int rt, int isread, |
379 | bool is_16bit) |
380 | { |
381 | return (EC_CP14RTTRAP << ARM_EL_EC_SHIFT) |
382 | | (is_16bit ? 0 : ARM_EL_IL) |
383 | | (cv << 24) | (cond << 20) | (opc2 << 17) | (opc1 << 14) |
384 | | (crn << 10) | (rt << 5) | (crm << 1) | isread; |
385 | } |
386 | |
387 | static inline uint32_t syn_cp15_rt_trap(int cv, int cond, int opc1, int opc2, |
388 | int crn, int crm, int rt, int isread, |
389 | bool is_16bit) |
390 | { |
391 | return (EC_CP15RTTRAP << ARM_EL_EC_SHIFT) |
392 | | (is_16bit ? 0 : ARM_EL_IL) |
393 | | (cv << 24) | (cond << 20) | (opc2 << 17) | (opc1 << 14) |
394 | | (crn << 10) | (rt << 5) | (crm << 1) | isread; |
395 | } |
396 | |
397 | static inline uint32_t syn_cp14_rrt_trap(int cv, int cond, int opc1, int crm, |
398 | int rt, int rt2, int isread, |
399 | bool is_16bit) |
400 | { |
401 | return (EC_CP14RRTTRAP << ARM_EL_EC_SHIFT) |
402 | | (is_16bit ? 0 : ARM_EL_IL) |
403 | | (cv << 24) | (cond << 20) | (opc1 << 16) |
404 | | (rt2 << 10) | (rt << 5) | (crm << 1) | isread; |
405 | } |
406 | |
407 | static inline uint32_t syn_cp15_rrt_trap(int cv, int cond, int opc1, int crm, |
408 | int rt, int rt2, int isread, |
409 | bool is_16bit) |
410 | { |
411 | return (EC_CP15RRTTRAP << ARM_EL_EC_SHIFT) |
412 | | (is_16bit ? 0 : ARM_EL_IL) |
413 | | (cv << 24) | (cond << 20) | (opc1 << 16) |
414 | | (rt2 << 10) | (rt << 5) | (crm << 1) | isread; |
415 | } |
416 | |
417 | static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit) |
418 | { |
419 | /* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 coproc == 0xa */ |
420 | return (EC_ADVSIMDFPACCESSTRAP << ARM_EL_EC_SHIFT) |
421 | | (is_16bit ? 0 : ARM_EL_IL) |
422 | | (cv << 24) | (cond << 20) | 0xa; |
423 | } |
424 | |
425 | static inline uint32_t syn_simd_access_trap(int cv, int cond, bool is_16bit) |
426 | { |
427 | /* AArch32 SIMD trap: TA == 1 coproc == 0 */ |
428 | return (EC_ADVSIMDFPACCESSTRAP << ARM_EL_EC_SHIFT) |
429 | | (is_16bit ? 0 : ARM_EL_IL) |
430 | | (cv << 24) | (cond << 20) | (1 << 5); |
431 | } |
432 | |
433 | static inline uint32_t syn_sve_access_trap(void) |
434 | { |
435 | return EC_SVEACCESSTRAP << ARM_EL_EC_SHIFT; |
436 | } |
437 | |
438 | static inline uint32_t syn_pactrap(void) |
439 | { |
440 | return EC_PACTRAP << ARM_EL_EC_SHIFT; |
441 | } |
442 | |
443 | static inline uint32_t syn_btitrap(int btype) |
444 | { |
445 | return (EC_BTITRAP << ARM_EL_EC_SHIFT) | btype; |
446 | } |
447 | |
448 | static inline uint32_t syn_insn_abort(int same_el, int ea, int s1ptw, int fsc) |
449 | { |
450 | return (EC_INSNABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT) |
451 | | ARM_EL_IL | (ea << 9) | (s1ptw << 7) | fsc; |
452 | } |
453 | |
454 | static inline uint32_t syn_data_abort_no_iss(int same_el, |
455 | int ea, int cm, int s1ptw, |
456 | int wnr, int fsc) |
457 | { |
458 | return (EC_DATAABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT) |
459 | | ARM_EL_IL |
460 | | (ea << 9) | (cm << 8) | (s1ptw << 7) | (wnr << 6) | fsc; |
461 | } |
462 | |
463 | static inline uint32_t syn_data_abort_with_iss(int same_el, |
464 | int sas, int sse, int srt, |
465 | int sf, int ar, |
466 | int ea, int cm, int s1ptw, |
467 | int wnr, int fsc, |
468 | bool is_16bit) |
469 | { |
470 | return (EC_DATAABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT) |
471 | | (is_16bit ? 0 : ARM_EL_IL) |
472 | | ARM_EL_ISV | (sas << 22) | (sse << 21) | (srt << 16) |
473 | | (sf << 15) | (ar << 14) |
474 | | (ea << 9) | (cm << 8) | (s1ptw << 7) | (wnr << 6) | fsc; |
475 | } |
476 | |
477 | static inline uint32_t syn_swstep(int same_el, int isv, int ex) |
478 | { |
479 | return (EC_SOFTWARESTEP << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT) |
480 | | ARM_EL_IL | (isv << 24) | (ex << 6) | 0x22; |
481 | } |
482 | |
483 | static inline uint32_t syn_watchpoint(int same_el, int cm, int wnr) |
484 | { |
485 | return (EC_WATCHPOINT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT) |
486 | | ARM_EL_IL | (cm << 8) | (wnr << 6) | 0x22; |
487 | } |
488 | |
489 | static inline uint32_t syn_breakpoint(int same_el) |
490 | { |
491 | return (EC_BREAKPOINT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT) |
492 | | ARM_EL_IL | 0x22; |
493 | } |
494 | |
495 | static inline uint32_t syn_wfx(int cv, int cond, int ti, bool is_16bit) |
496 | { |
497 | return (EC_WFX_TRAP << ARM_EL_EC_SHIFT) | |
498 | (is_16bit ? 0 : (1 << ARM_EL_IL_SHIFT)) | |
499 | (cv << 24) | (cond << 20) | ti; |
500 | } |
501 | |
502 | /* Update a QEMU watchpoint based on the information the guest has set in the |
503 | * DBGWCR<n>_EL1 and DBGWVR<n>_EL1 registers. |
504 | */ |
505 | void hw_watchpoint_update(ARMCPU *cpu, int n); |
506 | /* Update the QEMU watchpoints for every guest watchpoint. This does a |
507 | * complete delete-and-reinstate of the QEMU watchpoint list and so is |
508 | * suitable for use after migration or on reset. |
509 | */ |
510 | void hw_watchpoint_update_all(ARMCPU *cpu); |
511 | /* Update a QEMU breakpoint based on the information the guest has set in the |
512 | * DBGBCR<n>_EL1 and DBGBVR<n>_EL1 registers. |
513 | */ |
514 | void hw_breakpoint_update(ARMCPU *cpu, int n); |
515 | /* Update the QEMU breakpoints for every guest breakpoint. This does a |
516 | * complete delete-and-reinstate of the QEMU breakpoint list and so is |
517 | * suitable for use after migration or on reset. |
518 | */ |
519 | void hw_breakpoint_update_all(ARMCPU *cpu); |
520 | |
521 | /* Callback function for checking if a watchpoint should trigger. */ |
522 | bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp); |
523 | |
524 | /* Adjust addresses (in BE32 mode) before testing against watchpoint |
525 | * addresses. |
526 | */ |
527 | vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len); |
528 | |
529 | /* Callback function for when a watchpoint or breakpoint triggers. */ |
530 | void arm_debug_excp_handler(CPUState *cs); |
531 | |
532 | #if defined(CONFIG_USER_ONLY) || !defined(CONFIG_TCG) |
533 | static inline bool arm_is_psci_call(ARMCPU *cpu, int excp_type) |
534 | { |
535 | return false; |
536 | } |
537 | static inline void arm_handle_psci_call(ARMCPU *cpu) |
538 | { |
539 | g_assert_not_reached(); |
540 | } |
541 | #else |
542 | /* Return true if the r0/x0 value indicates that this SMC/HVC is a PSCI call. */ |
543 | bool arm_is_psci_call(ARMCPU *cpu, int excp_type); |
544 | /* Actually handle a PSCI call */ |
545 | void arm_handle_psci_call(ARMCPU *cpu); |
546 | #endif |
547 | |
548 | /** |
549 | * arm_clear_exclusive: clear the exclusive monitor |
550 | * @env: CPU env |
551 | * Clear the CPU's exclusive monitor, like the guest CLREX instruction. |
552 | */ |
553 | static inline void arm_clear_exclusive(CPUARMState *env) |
554 | { |
555 | env->exclusive_addr = -1; |
556 | } |
557 | |
558 | /** |
559 | * ARMFaultType: type of an ARM MMU fault |
560 | * This corresponds to the v8A pseudocode's Fault enumeration, |
561 | * with extensions for QEMU internal conditions. |
562 | */ |
563 | typedef enum ARMFaultType { |
564 | ARMFault_None, |
565 | ARMFault_AccessFlag, |
566 | ARMFault_Alignment, |
567 | ARMFault_Background, |
568 | ARMFault_Domain, |
569 | ARMFault_Permission, |
570 | ARMFault_Translation, |
571 | ARMFault_AddressSize, |
572 | ARMFault_SyncExternal, |
573 | ARMFault_SyncExternalOnWalk, |
574 | ARMFault_SyncParity, |
575 | ARMFault_SyncParityOnWalk, |
576 | ARMFault_AsyncParity, |
577 | ARMFault_AsyncExternal, |
578 | ARMFault_Debug, |
579 | ARMFault_TLBConflict, |
580 | ARMFault_Lockdown, |
581 | ARMFault_Exclusive, |
582 | ARMFault_ICacheMaint, |
583 | ARMFault_QEMU_NSCExec, /* v8M: NS executing in S&NSC memory */ |
584 | ARMFault_QEMU_SFault, /* v8M: SecureFault INVTRAN, INVEP or AUVIOL */ |
585 | } ARMFaultType; |
586 | |
587 | /** |
588 | * ARMMMUFaultInfo: Information describing an ARM MMU Fault |
589 | * @type: Type of fault |
590 | * @level: Table walk level (for translation, access flag and permission faults) |
591 | * @domain: Domain of the fault address (for non-LPAE CPUs only) |
592 | * @s2addr: Address that caused a fault at stage 2 |
593 | * @stage2: True if we faulted at stage 2 |
594 | * @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk |
595 | * @ea: True if we should set the EA (external abort type) bit in syndrome |
596 | */ |
597 | typedef struct ARMMMUFaultInfo ARMMMUFaultInfo; |
598 | struct ARMMMUFaultInfo { |
599 | ARMFaultType type; |
600 | target_ulong s2addr; |
601 | int level; |
602 | int domain; |
603 | bool stage2; |
604 | bool s1ptw; |
605 | bool ea; |
606 | }; |
607 | |
608 | /** |
609 | * arm_fi_to_sfsc: Convert fault info struct to short-format FSC |
610 | * Compare pseudocode EncodeSDFSC(), though unlike that function |
611 | * we set up a whole FSR-format code including domain field and |
612 | * putting the high bit of the FSC into bit 10. |
613 | */ |
614 | static inline uint32_t arm_fi_to_sfsc(ARMMMUFaultInfo *fi) |
615 | { |
616 | uint32_t fsc; |
617 | |
618 | switch (fi->type) { |
619 | case ARMFault_None: |
620 | return 0; |
621 | case ARMFault_AccessFlag: |
622 | fsc = fi->level == 1 ? 0x3 : 0x6; |
623 | break; |
624 | case ARMFault_Alignment: |
625 | fsc = 0x1; |
626 | break; |
627 | case ARMFault_Permission: |
628 | fsc = fi->level == 1 ? 0xd : 0xf; |
629 | break; |
630 | case ARMFault_Domain: |
631 | fsc = fi->level == 1 ? 0x9 : 0xb; |
632 | break; |
633 | case ARMFault_Translation: |
634 | fsc = fi->level == 1 ? 0x5 : 0x7; |
635 | break; |
636 | case ARMFault_SyncExternal: |
637 | fsc = 0x8 | (fi->ea << 12); |
638 | break; |
639 | case ARMFault_SyncExternalOnWalk: |
640 | fsc = fi->level == 1 ? 0xc : 0xe; |
641 | fsc |= (fi->ea << 12); |
642 | break; |
643 | case ARMFault_SyncParity: |
644 | fsc = 0x409; |
645 | break; |
646 | case ARMFault_SyncParityOnWalk: |
647 | fsc = fi->level == 1 ? 0x40c : 0x40e; |
648 | break; |
649 | case ARMFault_AsyncParity: |
650 | fsc = 0x408; |
651 | break; |
652 | case ARMFault_AsyncExternal: |
653 | fsc = 0x406 | (fi->ea << 12); |
654 | break; |
655 | case ARMFault_Debug: |
656 | fsc = 0x2; |
657 | break; |
658 | case ARMFault_TLBConflict: |
659 | fsc = 0x400; |
660 | break; |
661 | case ARMFault_Lockdown: |
662 | fsc = 0x404; |
663 | break; |
664 | case ARMFault_Exclusive: |
665 | fsc = 0x405; |
666 | break; |
667 | case ARMFault_ICacheMaint: |
668 | fsc = 0x4; |
669 | break; |
670 | case ARMFault_Background: |
671 | fsc = 0x0; |
672 | break; |
673 | case ARMFault_QEMU_NSCExec: |
674 | fsc = M_FAKE_FSR_NSC_EXEC; |
675 | break; |
676 | case ARMFault_QEMU_SFault: |
677 | fsc = M_FAKE_FSR_SFAULT; |
678 | break; |
679 | default: |
680 | /* Other faults can't occur in a context that requires a |
681 | * short-format status code. |
682 | */ |
683 | g_assert_not_reached(); |
684 | } |
685 | |
686 | fsc |= (fi->domain << 4); |
687 | return fsc; |
688 | } |
689 | |
690 | /** |
691 | * arm_fi_to_lfsc: Convert fault info struct to long-format FSC |
692 | * Compare pseudocode EncodeLDFSC(), though unlike that function |
693 | * we fill in also the LPAE bit 9 of a DFSR format. |
694 | */ |
695 | static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi) |
696 | { |
697 | uint32_t fsc; |
698 | |
699 | switch (fi->type) { |
700 | case ARMFault_None: |
701 | return 0; |
702 | case ARMFault_AddressSize: |
703 | fsc = fi->level & 3; |
704 | break; |
705 | case ARMFault_AccessFlag: |
706 | fsc = (fi->level & 3) | (0x2 << 2); |
707 | break; |
708 | case ARMFault_Permission: |
709 | fsc = (fi->level & 3) | (0x3 << 2); |
710 | break; |
711 | case ARMFault_Translation: |
712 | fsc = (fi->level & 3) | (0x1 << 2); |
713 | break; |
714 | case ARMFault_SyncExternal: |
715 | fsc = 0x10 | (fi->ea << 12); |
716 | break; |
717 | case ARMFault_SyncExternalOnWalk: |
718 | fsc = (fi->level & 3) | (0x5 << 2) | (fi->ea << 12); |
719 | break; |
720 | case ARMFault_SyncParity: |
721 | fsc = 0x18; |
722 | break; |
723 | case ARMFault_SyncParityOnWalk: |
724 | fsc = (fi->level & 3) | (0x7 << 2); |
725 | break; |
726 | case ARMFault_AsyncParity: |
727 | fsc = 0x19; |
728 | break; |
729 | case ARMFault_AsyncExternal: |
730 | fsc = 0x11 | (fi->ea << 12); |
731 | break; |
732 | case ARMFault_Alignment: |
733 | fsc = 0x21; |
734 | break; |
735 | case ARMFault_Debug: |
736 | fsc = 0x22; |
737 | break; |
738 | case ARMFault_TLBConflict: |
739 | fsc = 0x30; |
740 | break; |
741 | case ARMFault_Lockdown: |
742 | fsc = 0x34; |
743 | break; |
744 | case ARMFault_Exclusive: |
745 | fsc = 0x35; |
746 | break; |
747 | default: |
748 | /* Other faults can't occur in a context that requires a |
749 | * long-format status code. |
750 | */ |
751 | g_assert_not_reached(); |
752 | } |
753 | |
754 | fsc |= 1 << 9; |
755 | return fsc; |
756 | } |
757 | |
758 | static inline bool arm_extabort_type(MemTxResult result) |
759 | { |
760 | /* The EA bit in syndromes and fault status registers is an |
761 | * IMPDEF classification of external aborts. ARM implementations |
762 | * usually use this to indicate AXI bus Decode error (0) or |
763 | * Slave error (1); in QEMU we follow that. |
764 | */ |
765 | return result != MEMTX_DECODE_ERROR; |
766 | } |
767 | |
768 | bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size, |
769 | MMUAccessType access_type, int mmu_idx, |
770 | bool probe, uintptr_t retaddr); |
771 | |
772 | /* Return true if the stage 1 translation regime is using LPAE format page |
773 | * tables */ |
774 | bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx); |
775 | |
776 | /* Raise a data fault alignment exception for the specified virtual address */ |
777 | void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr, |
778 | MMUAccessType access_type, |
779 | int mmu_idx, uintptr_t retaddr); |
780 | |
781 | /* arm_cpu_do_transaction_failed: handle a memory system error response |
782 | * (eg "no device/memory present at address") by raising an external abort |
783 | * exception |
784 | */ |
785 | void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr, |
786 | vaddr addr, unsigned size, |
787 | MMUAccessType access_type, |
788 | int mmu_idx, MemTxAttrs attrs, |
789 | MemTxResult response, uintptr_t retaddr); |
790 | |
791 | /* Call any registered EL change hooks */ |
792 | static inline void arm_call_pre_el_change_hook(ARMCPU *cpu) |
793 | { |
794 | ARMELChangeHook *hook, *next; |
795 | QLIST_FOREACH_SAFE(hook, &cpu->pre_el_change_hooks, node, next) { |
796 | hook->hook(cpu, hook->opaque); |
797 | } |
798 | } |
799 | static inline void arm_call_el_change_hook(ARMCPU *cpu) |
800 | { |
801 | ARMELChangeHook *hook, *next; |
802 | QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) { |
803 | hook->hook(cpu, hook->opaque); |
804 | } |
805 | } |
806 | |
807 | /* Return true if this address translation regime is secure */ |
808 | static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx) |
809 | { |
810 | switch (mmu_idx) { |
811 | case ARMMMUIdx_S12NSE0: |
812 | case ARMMMUIdx_S12NSE1: |
813 | case ARMMMUIdx_S1NSE0: |
814 | case ARMMMUIdx_S1NSE1: |
815 | case ARMMMUIdx_S1E2: |
816 | case ARMMMUIdx_S2NS: |
817 | case ARMMMUIdx_MPrivNegPri: |
818 | case ARMMMUIdx_MUserNegPri: |
819 | case ARMMMUIdx_MPriv: |
820 | case ARMMMUIdx_MUser: |
821 | return false; |
822 | case ARMMMUIdx_S1E3: |
823 | case ARMMMUIdx_S1SE0: |
824 | case ARMMMUIdx_S1SE1: |
825 | case ARMMMUIdx_MSPrivNegPri: |
826 | case ARMMMUIdx_MSUserNegPri: |
827 | case ARMMMUIdx_MSPriv: |
828 | case ARMMMUIdx_MSUser: |
829 | return true; |
830 | default: |
831 | g_assert_not_reached(); |
832 | } |
833 | } |
834 | |
835 | /* Return the FSR value for a debug exception (watchpoint, hardware |
836 | * breakpoint or BKPT insn) targeting the specified exception level. |
837 | */ |
838 | static inline uint32_t arm_debug_exception_fsr(CPUARMState *env) |
839 | { |
840 | ARMMMUFaultInfo fi = { .type = ARMFault_Debug }; |
841 | int target_el = arm_debug_target_el(env); |
842 | bool using_lpae = false; |
843 | |
844 | if (target_el == 2 || arm_el_is_aa64(env, target_el)) { |
845 | using_lpae = true; |
846 | } else { |
847 | if (arm_feature(env, ARM_FEATURE_LPAE) && |
848 | (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) { |
849 | using_lpae = true; |
850 | } |
851 | } |
852 | |
853 | if (using_lpae) { |
854 | return arm_fi_to_lfsc(&fi); |
855 | } else { |
856 | return arm_fi_to_sfsc(&fi); |
857 | } |
858 | } |
859 | |
860 | /* Note make_memop_idx reserves 4 bits for mmu_idx, and MO_BSWAP is bit 3. |
861 | * Thus a TCGMemOpIdx, without any MO_ALIGN bits, fits in 8 bits. |
862 | */ |
863 | #define MEMOPIDX_SHIFT 8 |
864 | |
865 | /** |
866 | * v7m_using_psp: Return true if using process stack pointer |
867 | * Return true if the CPU is currently using the process stack |
868 | * pointer, or false if it is using the main stack pointer. |
869 | */ |
870 | static inline bool v7m_using_psp(CPUARMState *env) |
871 | { |
872 | /* Handler mode always uses the main stack; for thread mode |
873 | * the CONTROL.SPSEL bit determines the answer. |
874 | * Note that in v7M it is not possible to be in Handler mode with |
875 | * CONTROL.SPSEL non-zero, but in v8M it is, so we must check both. |
876 | */ |
877 | return !arm_v7m_is_handler_mode(env) && |
878 | env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK; |
879 | } |
880 | |
881 | /** |
882 | * v7m_sp_limit: Return SP limit for current CPU state |
883 | * Return the SP limit value for the current CPU security state |
884 | * and stack pointer. |
885 | */ |
886 | static inline uint32_t v7m_sp_limit(CPUARMState *env) |
887 | { |
888 | if (v7m_using_psp(env)) { |
889 | return env->v7m.psplim[env->v7m.secure]; |
890 | } else { |
891 | return env->v7m.msplim[env->v7m.secure]; |
892 | } |
893 | } |
894 | |
895 | /** |
896 | * v7m_cpacr_pass: |
897 | * Return true if the v7M CPACR permits access to the FPU for the specified |
898 | * security state and privilege level. |
899 | */ |
900 | static inline bool v7m_cpacr_pass(CPUARMState *env, |
901 | bool is_secure, bool is_priv) |
902 | { |
903 | switch (extract32(env->v7m.cpacr[is_secure], 20, 2)) { |
904 | case 0: |
905 | case 2: /* UNPREDICTABLE: we treat like 0 */ |
906 | return false; |
907 | case 1: |
908 | return is_priv; |
909 | case 3: |
910 | return true; |
911 | default: |
912 | g_assert_not_reached(); |
913 | } |
914 | } |
915 | |
916 | /** |
917 | * aarch32_mode_name(): Return name of the AArch32 CPU mode |
918 | * @psr: Program Status Register indicating CPU mode |
919 | * |
920 | * Returns, for debug logging purposes, a printable representation |
921 | * of the AArch32 CPU mode ("svc", "usr", etc) as indicated by |
922 | * the low bits of the specified PSR. |
923 | */ |
924 | static inline const char *aarch32_mode_name(uint32_t psr) |
925 | { |
926 | static const char cpu_mode_names[16][4] = { |
927 | "usr" , "fiq" , "irq" , "svc" , "???" , "???" , "mon" , "abt" , |
928 | "???" , "???" , "hyp" , "und" , "???" , "???" , "???" , "sys" |
929 | }; |
930 | |
931 | return cpu_mode_names[psr & 0xf]; |
932 | } |
933 | |
934 | /** |
935 | * arm_cpu_update_virq: Update CPU_INTERRUPT_VIRQ bit in cs->interrupt_request |
936 | * |
937 | * Update the CPU_INTERRUPT_VIRQ bit in cs->interrupt_request, following |
938 | * a change to either the input VIRQ line from the GIC or the HCR_EL2.VI bit. |
939 | * Must be called with the iothread lock held. |
940 | */ |
941 | void arm_cpu_update_virq(ARMCPU *cpu); |
942 | |
943 | /** |
944 | * arm_cpu_update_vfiq: Update CPU_INTERRUPT_VFIQ bit in cs->interrupt_request |
945 | * |
946 | * Update the CPU_INTERRUPT_VFIQ bit in cs->interrupt_request, following |
947 | * a change to either the input VFIQ line from the GIC or the HCR_EL2.VF bit. |
948 | * Must be called with the iothread lock held. |
949 | */ |
950 | void arm_cpu_update_vfiq(ARMCPU *cpu); |
951 | |
952 | /** |
953 | * arm_mmu_idx: |
954 | * @env: The cpu environment |
955 | * |
956 | * Return the full ARMMMUIdx for the current translation regime. |
957 | */ |
958 | ARMMMUIdx arm_mmu_idx(CPUARMState *env); |
959 | |
960 | /** |
961 | * arm_stage1_mmu_idx: |
962 | * @env: The cpu environment |
963 | * |
964 | * Return the ARMMMUIdx for the stage1 traversal for the current regime. |
965 | */ |
966 | #ifdef CONFIG_USER_ONLY |
967 | static inline ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env) |
968 | { |
969 | return ARMMMUIdx_S1NSE0; |
970 | } |
971 | #else |
972 | ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env); |
973 | #endif |
974 | |
975 | /* |
976 | * Parameters of a given virtual address, as extracted from the |
977 | * translation control register (TCR) for a given regime. |
978 | */ |
979 | typedef struct ARMVAParameters { |
980 | unsigned tsz : 8; |
981 | unsigned select : 1; |
982 | bool tbi : 1; |
983 | bool tbid : 1; |
984 | bool epd : 1; |
985 | bool hpd : 1; |
986 | bool using16k : 1; |
987 | bool using64k : 1; |
988 | } ARMVAParameters; |
989 | |
990 | ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va, |
991 | ARMMMUIdx mmu_idx); |
992 | ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, |
993 | ARMMMUIdx mmu_idx, bool data); |
994 | |
995 | static inline int exception_target_el(CPUARMState *env) |
996 | { |
997 | int target_el = MAX(1, arm_current_el(env)); |
998 | |
999 | /* |
1000 | * No such thing as secure EL1 if EL3 is aarch32, |
1001 | * so update the target EL to EL3 in this case. |
1002 | */ |
1003 | if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) { |
1004 | target_el = 3; |
1005 | } |
1006 | |
1007 | return target_el; |
1008 | } |
1009 | |
1010 | #ifndef CONFIG_USER_ONLY |
1011 | |
1012 | /* Security attributes for an address, as returned by v8m_security_lookup. */ |
1013 | typedef struct V8M_SAttributes { |
1014 | bool subpage; /* true if these attrs don't cover the whole TARGET_PAGE */ |
1015 | bool ns; |
1016 | bool nsc; |
1017 | uint8_t sregion; |
1018 | bool srvalid; |
1019 | uint8_t iregion; |
1020 | bool irvalid; |
1021 | } V8M_SAttributes; |
1022 | |
1023 | void v8m_security_lookup(CPUARMState *env, uint32_t address, |
1024 | MMUAccessType access_type, ARMMMUIdx mmu_idx, |
1025 | V8M_SAttributes *sattrs); |
1026 | |
1027 | bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address, |
1028 | MMUAccessType access_type, ARMMMUIdx mmu_idx, |
1029 | hwaddr *phys_ptr, MemTxAttrs *txattrs, |
1030 | int *prot, bool *is_subpage, |
1031 | ARMMMUFaultInfo *fi, uint32_t *mregion); |
1032 | |
1033 | /* Cacheability and shareability attributes for a memory access */ |
1034 | typedef struct ARMCacheAttrs { |
1035 | unsigned int attrs:8; /* as in the MAIR register encoding */ |
1036 | unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */ |
1037 | } ARMCacheAttrs; |
1038 | |
1039 | bool get_phys_addr(CPUARMState *env, target_ulong address, |
1040 | MMUAccessType access_type, ARMMMUIdx mmu_idx, |
1041 | hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, |
1042 | target_ulong *page_size, |
1043 | ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); |
1044 | |
1045 | void arm_log_exception(int idx); |
1046 | |
1047 | #endif /* !CONFIG_USER_ONLY */ |
1048 | |
1049 | #endif |
1050 | |