blob: b654bee4682b987e1562b35fa550edade90e7263 [file] [log] [blame]
Peter Maydellccd38082014-04-15 19:18:37 +01001/*
2 * QEMU ARM CPU -- internal functions and types
3 *
4 * Copyright (c) 2014 Linaro Ltd
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version 2
9 * of the License, or (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see
18 * <http://www.gnu.org/licenses/gpl-2.0.html>
19 *
20 * This header defines functions, types, etc which need to be shared
Thomas Huthfcf5ef22016-10-11 08:56:52 +020021 * between different source files within target/arm/ but which are
Peter Maydellccd38082014-04-15 19:18:37 +010022 * private to it and not required by the rest of QEMU.
23 */
24
25#ifndef TARGET_ARM_INTERNALS_H
26#define TARGET_ARM_INTERNALS_H
27
Michael Davidsaverabc24d82017-01-27 15:20:21 +000028#include "hw/registerfields.h"
Richard Henderson28f32502021-04-16 11:31:02 -070029#include "tcg/tcg-gvec-desc.h"
Richard Henderson1fe27852021-02-12 10:48:56 -080030#include "syndrome.h"
Michael Davidsaverabc24d82017-01-27 15:20:21 +000031
Soren Brinkmann99a99c12015-11-03 13:49:41 +000032/* register banks for CPU modes */
33#define BANK_USRSYS 0
34#define BANK_SVC 1
35#define BANK_ABT 2
36#define BANK_UND 3
37#define BANK_IRQ 4
38#define BANK_FIQ 5
39#define BANK_HYP 6
40#define BANK_MON 7
41
Peter Maydelld4a2dc62014-04-15 19:18:38 +010042static inline bool excp_is_internal(int excp)
43{
44 /* Return true if this exception number represents a QEMU-internal
45 * exception that will not be passed to the guest.
46 */
47 return excp == EXCP_INTERRUPT
48 || excp == EXCP_HLT
49 || excp == EXCP_DEBUG
50 || excp == EXCP_HALTED
51 || excp == EXCP_EXCEPTION_EXIT
52 || excp == EXCP_KERNEL_TRAP
Emilio G. Cota05188cc2016-06-27 15:02:16 -040053 || excp == EXCP_SEMIHOST;
Peter Maydelld4a2dc62014-04-15 19:18:38 +010054}
55
Peter Maydellccd38082014-04-15 19:18:37 +010056/* Scale factor for generic timers, ie number of ns per tick.
57 * This gives a 62.5MHz timer.
58 */
59#define GTIMER_SCALE 16
60
Michael Davidsaverabc24d82017-01-27 15:20:21 +000061/* Bit definitions for the v7M CONTROL register */
62FIELD(V7M_CONTROL, NPRIV, 0, 1)
63FIELD(V7M_CONTROL, SPSEL, 1, 1)
64FIELD(V7M_CONTROL, FPCA, 2, 1)
Peter Maydell3e3fa232017-10-09 14:48:33 +010065FIELD(V7M_CONTROL, SFPA, 3, 1)
Michael Davidsaverabc24d82017-01-27 15:20:21 +000066
Peter Maydell4d1e7a42017-09-14 18:43:17 +010067/* Bit definitions for v7M exception return payload */
68FIELD(V7M_EXCRET, ES, 0, 1)
69FIELD(V7M_EXCRET, RES0, 1, 1)
70FIELD(V7M_EXCRET, SPSEL, 2, 1)
71FIELD(V7M_EXCRET, MODE, 3, 1)
72FIELD(V7M_EXCRET, FTYPE, 4, 1)
73FIELD(V7M_EXCRET, DCRS, 5, 1)
74FIELD(V7M_EXCRET, S, 6, 1)
75FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
76
Peter Maydelld02a8692017-10-09 14:48:34 +010077/* Minimum value which is a magic number for exception return */
78#define EXC_RETURN_MIN_MAGIC 0xff000000
79/* Minimum number which is a magic number for function or exception return
80 * when using v8M security extension
81 */
82#define FNC_RETURN_MIN_MAGIC 0xfefffffe
83
Richard Henderson8b7a5bb2022-04-26 22:19:26 -070084/* Bit definitions for DBGWCRn and DBGWCRn_EL1 */
85FIELD(DBGWCR, E, 0, 1)
86FIELD(DBGWCR, PAC, 1, 2)
87FIELD(DBGWCR, LSC, 3, 2)
88FIELD(DBGWCR, BAS, 5, 8)
89FIELD(DBGWCR, HMC, 13, 1)
90FIELD(DBGWCR, SSC, 14, 2)
91FIELD(DBGWCR, LBN, 16, 4)
92FIELD(DBGWCR, WT, 20, 1)
93FIELD(DBGWCR, MASK, 24, 5)
94FIELD(DBGWCR, SSCE, 29, 1)
95
Peter Maydell35337cc2017-10-06 16:46:49 +010096/* We use a few fake FSR values for internal purposes in M profile.
97 * M profile cores don't have A/R format FSRs, but currently our
98 * get_phys_addr() code assumes A/R profile and reports failures via
99 * an A/R format FSR value. We then translate that into the proper
100 * M profile exception and FSR status bit in arm_v7m_cpu_do_interrupt().
101 * Mostly the FSR values we use for this are those defined for v7PMSA,
102 * since we share some of that codepath. A few kinds of fault are
103 * only for M profile and have no A/R equivalent, though, so we have
104 * to pick a value from the reserved range (which we never otherwise
105 * generate) to use for these.
106 * These values will never be visible to the guest.
107 */
108#define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */
109#define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */
110
Peter Maydell597610e2018-10-08 14:55:04 +0100111/**
112 * raise_exception: Raise the specified exception.
113 * Raise a guest exception with the specified value, syndrome register
114 * and target exception level. This should be called from helper functions,
115 * and never returns because we will longjump back up to the CPU main loop.
116 */
Marc-André Lureau89057702022-04-20 17:26:02 +0400117G_NORETURN void raise_exception(CPUARMState *env, uint32_t excp,
118 uint32_t syndrome, uint32_t target_el);
Peter Maydell597610e2018-10-08 14:55:04 +0100119
Edgar E. Iglesias2a923c42014-05-27 17:09:52 +0100120/*
Richard Henderson7469f6c2019-01-21 10:23:11 +0000121 * Similarly, but also use unwinding to restore cpu state.
122 */
Marc-André Lureau89057702022-04-20 17:26:02 +0400123G_NORETURN void raise_exception_ra(CPUARMState *env, uint32_t excp,
Richard Henderson7469f6c2019-01-21 10:23:11 +0000124 uint32_t syndrome, uint32_t target_el,
125 uintptr_t ra);
126
127/*
Edgar E. Iglesias2a923c42014-05-27 17:09:52 +0100128 * For AArch64, map a given EL to an index in the banked_spsr array.
Peter Maydell7847f9e2015-04-01 17:57:29 +0100129 * Note that this mapping and the AArch32 mapping defined in bank_number()
130 * must agree such that the AArch64<->AArch32 SPSRs have the architecturally
131 * mandated mapping between each other.
Edgar E. Iglesias2a923c42014-05-27 17:09:52 +0100132 */
133static inline unsigned int aarch64_banked_spsr_index(unsigned int el)
134{
135 static const unsigned int map[4] = {
Soren Brinkmann99a99c12015-11-03 13:49:41 +0000136 [1] = BANK_SVC, /* EL1. */
137 [2] = BANK_HYP, /* EL2. */
138 [3] = BANK_MON, /* EL3. */
Edgar E. Iglesias2a923c42014-05-27 17:09:52 +0100139 };
140 assert(el >= 1 && el <= 3);
141 return map[el];
142}
143
Peter Maydellc7665682016-02-18 14:16:16 +0000144/* Map CPU modes onto saved register banks. */
145static inline int bank_number(int mode)
146{
147 switch (mode) {
148 case ARM_CPU_MODE_USR:
149 case ARM_CPU_MODE_SYS:
150 return BANK_USRSYS;
151 case ARM_CPU_MODE_SVC:
152 return BANK_SVC;
153 case ARM_CPU_MODE_ABT:
154 return BANK_ABT;
155 case ARM_CPU_MODE_UND:
156 return BANK_UND;
157 case ARM_CPU_MODE_IRQ:
158 return BANK_IRQ;
159 case ARM_CPU_MODE_FIQ:
160 return BANK_FIQ;
161 case ARM_CPU_MODE_HYP:
162 return BANK_HYP;
163 case ARM_CPU_MODE_MON:
164 return BANK_MON;
165 }
166 g_assert_not_reached();
167}
168
Peter Maydell593cfa22018-11-13 10:47:59 +0000169/**
170 * r14_bank_number: Map CPU mode onto register bank for r14
171 *
172 * Given an AArch32 CPU mode, return the index into the saved register
173 * banks to use for the R14 (LR) in that mode. This is the same as
174 * bank_number(), except for the special case of Hyp mode, where
175 * R14 is shared with USR and SYS, unlike its R13 and SPSR.
176 * This should be used as the index into env->banked_r14[], and
177 * bank_number() used for the index into env->banked_r13[] and
178 * env->banked_spsr[].
179 */
180static inline int r14_bank_number(int mode)
181{
182 return (mode == ARM_CPU_MODE_HYP) ? BANK_USRSYS : bank_number(mode);
183}
184
Peter Maydellccd38082014-04-15 19:18:37 +0100185void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
186void arm_translate_init(void);
187
Claudio Fontana78271682021-02-04 17:39:23 +0100188#ifdef CONFIG_TCG
Richard Henderson8349d2a2021-02-13 13:03:12 +0000189void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
Claudio Fontana78271682021-02-04 17:39:23 +0100190#endif /* CONFIG_TCG */
191
Richard Hendersonce440582021-07-23 10:33:43 -1000192/**
193 * aarch64_sve_zcr_get_valid_len:
194 * @cpu: cpu context
195 * @start_len: maximum len to consider
196 *
197 * Return the maximum supported sve vector length <= @start_len.
198 * Note that both @start_len and the return value are in units
199 * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
200 */
201uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
Claudio Fontana78271682021-02-04 17:39:23 +0100202
Peter Maydellccd38082014-04-15 19:18:37 +0100203enum arm_fprounding {
204 FPROUNDING_TIEEVEN,
205 FPROUNDING_POSINF,
206 FPROUNDING_NEGINF,
207 FPROUNDING_ZERO,
208 FPROUNDING_TIEAWAY,
209 FPROUNDING_ODD
210};
211
212int arm_rmode_to_sf(int rmode);
213
Edgar E. Iglesias9208b962014-08-04 14:41:54 +0100214static inline void aarch64_save_sp(CPUARMState *env, int el)
215{
216 if (env->pstate & PSTATE_SP) {
217 env->sp_el[el] = env->xregs[31];
218 } else {
219 env->sp_el[0] = env->xregs[31];
220 }
221}
222
223static inline void aarch64_restore_sp(CPUARMState *env, int el)
224{
225 if (env->pstate & PSTATE_SP) {
226 env->xregs[31] = env->sp_el[el];
227 } else {
228 env->xregs[31] = env->sp_el[0];
229 }
230}
231
Peter Maydellf502cfc2014-04-15 19:18:43 +0100232static inline void update_spsel(CPUARMState *env, uint32_t imm)
233{
Greg Bellowsdcbff192014-10-24 12:19:14 +0100234 unsigned int cur_el = arm_current_el(env);
Peter Maydellf502cfc2014-04-15 19:18:43 +0100235 /* Update PSTATE SPSel bit; this requires us to update the
236 * working stack pointer in xregs[31].
237 */
238 if (!((imm ^ env->pstate) & PSTATE_SP)) {
239 return;
240 }
Edgar E. Iglesias9208b962014-08-04 14:41:54 +0100241 aarch64_save_sp(env, cur_el);
Peter Maydellf502cfc2014-04-15 19:18:43 +0100242 env->pstate = deposit32(env->pstate, 0, 1, imm);
243
Edgar E. Iglesias61d4b212014-05-27 17:09:54 +0100244 /* We rely on illegal updates to SPsel from EL0 to get trapped
245 * at translation time.
Peter Maydellf502cfc2014-04-15 19:18:43 +0100246 */
Edgar E. Iglesias61d4b212014-05-27 17:09:54 +0100247 assert(cur_el >= 1 && cur_el <= 3);
Edgar E. Iglesias9208b962014-08-04 14:41:54 +0100248 aarch64_restore_sp(env, cur_el);
Peter Maydellf502cfc2014-04-15 19:18:43 +0100249}
250
Edgar E. Iglesias1853d5a2015-10-26 14:02:00 +0100251/*
252 * arm_pamax
253 * @cpu: ARMCPU
254 *
255 * Returns the implementation defined bit-width of physical addresses.
256 * The ARMv8 reference manuals refer to this as PAMax().
257 */
Richard Henderson71a77252022-03-01 11:59:44 -1000258unsigned int arm_pamax(ARMCPU *cpu);
Edgar E. Iglesias1853d5a2015-10-26 14:02:00 +0100259
Peter Maydell73c52112014-09-12 14:06:49 +0100260/* Return true if extended addresses are enabled.
261 * This is always the case if our translation regime is 64 bit,
262 * but depends on TTBCR.EAE for 32 bit.
263 */
264static inline bool extended_addresses_enabled(CPUARMState *env)
265{
Fabian Aggeler11f136e2014-12-11 12:07:51 +0000266 TCR *tcr = &env->cp15.tcr_el[arm_is_secure(env) ? 3 : 1];
267 return arm_el_is_aa64(env, 1) ||
268 (arm_feature(env, ARM_FEATURE_LPAE) && (tcr->raw_tcr & TTBCR_EAE));
Peter Maydell73c52112014-09-12 14:06:49 +0100269}
270
Peter Maydell9ee98ce2014-09-12 14:06:49 +0100271/* Update a QEMU watchpoint based on the information the guest has set in the
272 * DBGWCR<n>_EL1 and DBGWVR<n>_EL1 registers.
273 */
274void hw_watchpoint_update(ARMCPU *cpu, int n);
275/* Update the QEMU watchpoints for every guest watchpoint. This does a
276 * complete delete-and-reinstate of the QEMU watchpoint list and so is
277 * suitable for use after migration or on reset.
278 */
279void hw_watchpoint_update_all(ARMCPU *cpu);
Peter Maydell46747d12014-09-29 18:48:46 +0100280/* Update a QEMU breakpoint based on the information the guest has set in the
281 * DBGBCR<n>_EL1 and DBGBVR<n>_EL1 registers.
282 */
283void hw_breakpoint_update(ARMCPU *cpu, int n);
284/* Update the QEMU breakpoints for every guest breakpoint. This does a
285 * complete delete-and-reinstate of the QEMU breakpoint list and so is
286 * suitable for use after migration or on reset.
287 */
288void hw_breakpoint_update_all(ARMCPU *cpu);
Peter Maydell9ee98ce2014-09-12 14:06:49 +0100289
Richard Hendersonb00d86b2021-07-19 08:19:26 -1000290/* Callback function for checking if a breakpoint should trigger. */
291bool arm_debug_check_breakpoint(CPUState *cs);
292
Sergey Fedorov38261212016-02-11 11:17:32 +0000293/* Callback function for checking if a watchpoint should trigger. */
294bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
295
Julian Brown40612002017-02-07 18:29:59 +0000296/* Adjust addresses (in BE32 mode) before testing against watchpoint
297 * addresses.
298 */
299vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len);
300
Peter Maydell3ff6fc92014-09-12 14:06:49 +0100301/* Callback function for when a watchpoint or breakpoint triggers. */
302void arm_debug_excp_handler(CPUState *cs);
303
Philippe Mathieu-Daudé21fbea82019-07-01 17:26:22 +0100304#if defined(CONFIG_USER_ONLY) || !defined(CONFIG_TCG)
Rob Herring98128602014-10-24 12:19:13 +0100305static inline bool arm_is_psci_call(ARMCPU *cpu, int excp_type)
306{
307 return false;
308}
Philippe Mathieu-Daudé21fbea82019-07-01 17:26:22 +0100309static inline void arm_handle_psci_call(ARMCPU *cpu)
310{
311 g_assert_not_reached();
312}
Rob Herring98128602014-10-24 12:19:13 +0100313#else
314/* Return true if the r0/x0 value indicates that this SMC/HVC is a PSCI call. */
315bool arm_is_psci_call(ARMCPU *cpu, int excp_type);
316/* Actually handle a PSCI call */
317void arm_handle_psci_call(ARMCPU *cpu);
318#endif
319
Edgar E. Iglesiase14b5a22015-10-26 14:02:03 +0100320/**
Peter Maydelldc3c4c12017-09-14 18:43:16 +0100321 * arm_clear_exclusive: clear the exclusive monitor
322 * @env: CPU env
323 * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
324 */
325static inline void arm_clear_exclusive(CPUARMState *env)
326{
327 env->exclusive_addr = -1;
328}
329
330/**
Peter Maydell1fa498f2017-12-13 17:59:24 +0000331 * ARMFaultType: type of an ARM MMU fault
332 * This corresponds to the v8A pseudocode's Fault enumeration,
333 * with extensions for QEMU internal conditions.
334 */
335typedef enum ARMFaultType {
336 ARMFault_None,
337 ARMFault_AccessFlag,
338 ARMFault_Alignment,
339 ARMFault_Background,
340 ARMFault_Domain,
341 ARMFault_Permission,
342 ARMFault_Translation,
343 ARMFault_AddressSize,
344 ARMFault_SyncExternal,
345 ARMFault_SyncExternalOnWalk,
346 ARMFault_SyncParity,
347 ARMFault_SyncParityOnWalk,
348 ARMFault_AsyncParity,
349 ARMFault_AsyncExternal,
350 ARMFault_Debug,
351 ARMFault_TLBConflict,
352 ARMFault_Lockdown,
353 ARMFault_Exclusive,
354 ARMFault_ICacheMaint,
355 ARMFault_QEMU_NSCExec, /* v8M: NS executing in S&NSC memory */
356 ARMFault_QEMU_SFault, /* v8M: SecureFault INVTRAN, INVEP or AUVIOL */
357} ARMFaultType;
358
359/**
Edgar E. Iglesiase14b5a22015-10-26 14:02:03 +0100360 * ARMMMUFaultInfo: Information describing an ARM MMU Fault
Peter Maydell1fa498f2017-12-13 17:59:24 +0000361 * @type: Type of fault
362 * @level: Table walk level (for translation, access flag and permission faults)
363 * @domain: Domain of the fault address (for non-LPAE CPUs only)
Edgar E. Iglesiase14b5a22015-10-26 14:02:03 +0100364 * @s2addr: Address that caused a fault at stage 2
365 * @stage2: True if we faulted at stage 2
366 * @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk
RĂ©mi Denis-Courmont98612482021-01-12 12:45:07 +0200367 * @s1ns: True if we faulted on a non-secure IPA while in secure state
Peter Maydellc528af72017-09-04 15:21:55 +0100368 * @ea: True if we should set the EA (external abort type) bit in syndrome
Edgar E. Iglesiase14b5a22015-10-26 14:02:03 +0100369 */
370typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
371struct ARMMMUFaultInfo {
Peter Maydell1fa498f2017-12-13 17:59:24 +0000372 ARMFaultType type;
Edgar E. Iglesiase14b5a22015-10-26 14:02:03 +0100373 target_ulong s2addr;
Peter Maydell1fa498f2017-12-13 17:59:24 +0000374 int level;
375 int domain;
Edgar E. Iglesiase14b5a22015-10-26 14:02:03 +0100376 bool stage2;
377 bool s1ptw;
RĂ©mi Denis-Courmont98612482021-01-12 12:45:07 +0200378 bool s1ns;
Peter Maydellc528af72017-09-04 15:21:55 +0100379 bool ea;
Edgar E. Iglesiase14b5a22015-10-26 14:02:03 +0100380};
381
Peter Maydell1fa498f2017-12-13 17:59:24 +0000382/**
383 * arm_fi_to_sfsc: Convert fault info struct to short-format FSC
384 * Compare pseudocode EncodeSDFSC(), though unlike that function
385 * we set up a whole FSR-format code including domain field and
386 * putting the high bit of the FSC into bit 10.
387 */
388static inline uint32_t arm_fi_to_sfsc(ARMMMUFaultInfo *fi)
389{
390 uint32_t fsc;
391
392 switch (fi->type) {
393 case ARMFault_None:
394 return 0;
395 case ARMFault_AccessFlag:
396 fsc = fi->level == 1 ? 0x3 : 0x6;
397 break;
398 case ARMFault_Alignment:
399 fsc = 0x1;
400 break;
401 case ARMFault_Permission:
402 fsc = fi->level == 1 ? 0xd : 0xf;
403 break;
404 case ARMFault_Domain:
405 fsc = fi->level == 1 ? 0x9 : 0xb;
406 break;
407 case ARMFault_Translation:
408 fsc = fi->level == 1 ? 0x5 : 0x7;
409 break;
410 case ARMFault_SyncExternal:
411 fsc = 0x8 | (fi->ea << 12);
412 break;
413 case ARMFault_SyncExternalOnWalk:
414 fsc = fi->level == 1 ? 0xc : 0xe;
415 fsc |= (fi->ea << 12);
416 break;
417 case ARMFault_SyncParity:
418 fsc = 0x409;
419 break;
420 case ARMFault_SyncParityOnWalk:
421 fsc = fi->level == 1 ? 0x40c : 0x40e;
422 break;
423 case ARMFault_AsyncParity:
424 fsc = 0x408;
425 break;
426 case ARMFault_AsyncExternal:
427 fsc = 0x406 | (fi->ea << 12);
428 break;
429 case ARMFault_Debug:
430 fsc = 0x2;
431 break;
432 case ARMFault_TLBConflict:
433 fsc = 0x400;
434 break;
435 case ARMFault_Lockdown:
436 fsc = 0x404;
437 break;
438 case ARMFault_Exclusive:
439 fsc = 0x405;
440 break;
441 case ARMFault_ICacheMaint:
442 fsc = 0x4;
443 break;
444 case ARMFault_Background:
445 fsc = 0x0;
446 break;
447 case ARMFault_QEMU_NSCExec:
448 fsc = M_FAKE_FSR_NSC_EXEC;
449 break;
450 case ARMFault_QEMU_SFault:
451 fsc = M_FAKE_FSR_SFAULT;
452 break;
453 default:
454 /* Other faults can't occur in a context that requires a
455 * short-format status code.
456 */
457 g_assert_not_reached();
458 }
459
460 fsc |= (fi->domain << 4);
461 return fsc;
462}
463
464/**
465 * arm_fi_to_lfsc: Convert fault info struct to long-format FSC
466 * Compare pseudocode EncodeLDFSC(), though unlike that function
467 * we fill in also the LPAE bit 9 of a DFSR format.
468 */
469static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
470{
471 uint32_t fsc;
472
473 switch (fi->type) {
474 case ARMFault_None:
475 return 0;
476 case ARMFault_AddressSize:
Richard Henderson13e481c2022-03-01 11:59:51 -1000477 assert(fi->level >= -1 && fi->level <= 3);
478 if (fi->level < 0) {
479 fsc = 0b101001;
480 } else {
481 fsc = fi->level;
482 }
Peter Maydell1fa498f2017-12-13 17:59:24 +0000483 break;
484 case ARMFault_AccessFlag:
Richard Henderson13e481c2022-03-01 11:59:51 -1000485 assert(fi->level >= 0 && fi->level <= 3);
486 fsc = 0b001000 | fi->level;
Peter Maydell1fa498f2017-12-13 17:59:24 +0000487 break;
488 case ARMFault_Permission:
Richard Henderson13e481c2022-03-01 11:59:51 -1000489 assert(fi->level >= 0 && fi->level <= 3);
490 fsc = 0b001100 | fi->level;
Peter Maydell1fa498f2017-12-13 17:59:24 +0000491 break;
492 case ARMFault_Translation:
Richard Henderson13e481c2022-03-01 11:59:51 -1000493 assert(fi->level >= -1 && fi->level <= 3);
494 if (fi->level < 0) {
495 fsc = 0b101011;
496 } else {
497 fsc = 0b000100 | fi->level;
498 }
Peter Maydell1fa498f2017-12-13 17:59:24 +0000499 break;
500 case ARMFault_SyncExternal:
501 fsc = 0x10 | (fi->ea << 12);
502 break;
503 case ARMFault_SyncExternalOnWalk:
Richard Henderson13e481c2022-03-01 11:59:51 -1000504 assert(fi->level >= -1 && fi->level <= 3);
505 if (fi->level < 0) {
506 fsc = 0b010011;
507 } else {
508 fsc = 0b010100 | fi->level;
509 }
510 fsc |= fi->ea << 12;
Peter Maydell1fa498f2017-12-13 17:59:24 +0000511 break;
512 case ARMFault_SyncParity:
513 fsc = 0x18;
514 break;
515 case ARMFault_SyncParityOnWalk:
Richard Henderson13e481c2022-03-01 11:59:51 -1000516 assert(fi->level >= -1 && fi->level <= 3);
517 if (fi->level < 0) {
518 fsc = 0b011011;
519 } else {
520 fsc = 0b011100 | fi->level;
521 }
Peter Maydell1fa498f2017-12-13 17:59:24 +0000522 break;
523 case ARMFault_AsyncParity:
524 fsc = 0x19;
525 break;
526 case ARMFault_AsyncExternal:
527 fsc = 0x11 | (fi->ea << 12);
528 break;
529 case ARMFault_Alignment:
530 fsc = 0x21;
531 break;
532 case ARMFault_Debug:
533 fsc = 0x22;
534 break;
535 case ARMFault_TLBConflict:
536 fsc = 0x30;
537 break;
538 case ARMFault_Lockdown:
539 fsc = 0x34;
540 break;
541 case ARMFault_Exclusive:
542 fsc = 0x35;
543 break;
544 default:
545 /* Other faults can't occur in a context that requires a
546 * long-format status code.
547 */
548 g_assert_not_reached();
549 }
550
551 fsc |= 1 << 9;
552 return fsc;
553}
554
Peter Maydell3b39d732018-01-16 13:28:11 +0000555static inline bool arm_extabort_type(MemTxResult result)
556{
557 /* The EA bit in syndromes and fault status registers is an
558 * IMPDEF classification of external aborts. ARM implementations
559 * usually use this to indicate AXI bus Decode error (0) or
560 * Slave error (1); in QEMU we follow that.
561 */
562 return result != MEMTX_DECODE_ERROR;
563}
564
Richard Henderson9b12b6b2021-09-17 18:23:07 -0700565#ifdef CONFIG_USER_ONLY
566void arm_cpu_record_sigsegv(CPUState *cpu, vaddr addr,
567 MMUAccessType access_type,
568 bool maperr, uintptr_t ra);
Richard Henderson39a099c2021-07-23 12:22:54 -1000569void arm_cpu_record_sigbus(CPUState *cpu, vaddr addr,
570 MMUAccessType access_type, uintptr_t ra);
Richard Henderson9b12b6b2021-09-17 18:23:07 -0700571#else
Richard Henderson7350d552019-04-02 15:12:58 +0700572bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
573 MMUAccessType access_type, int mmu_idx,
574 bool probe, uintptr_t retaddr);
Richard Henderson9b12b6b2021-09-17 18:23:07 -0700575#endif
Richard Henderson7350d552019-04-02 15:12:58 +0700576
Richard Hendersonb9f60332020-02-07 14:04:24 +0000577static inline int arm_to_core_mmu_idx(ARMMMUIdx mmu_idx)
578{
579 return mmu_idx & ARM_MMU_IDX_COREIDX_MASK;
580}
581
582static inline ARMMMUIdx core_to_arm_mmu_idx(CPUARMState *env, int mmu_idx)
583{
584 if (arm_feature(env, ARM_FEATURE_M)) {
585 return mmu_idx | ARM_MMU_IDX_M;
586 } else {
587 return mmu_idx | ARM_MMU_IDX_A;
588 }
589}
590
Richard Henderson20dc67c2020-03-05 16:09:20 +0000591static inline ARMMMUIdx core_to_aa64_mmu_idx(int mmu_idx)
592{
593 /* AArch64 is always a-profile. */
594 return mmu_idx | ARM_MMU_IDX_A;
595}
596
Richard Hendersonb9f60332020-02-07 14:04:24 +0000597int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx);
598
599/*
600 * Return the MMU index for a v7M CPU with all relevant information
601 * manually specified.
602 */
603ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
604 bool secstate, bool priv, bool negpri);
605
606/*
607 * Return the MMU index for a v7M CPU in the specified security and
608 * privilege state.
609 */
610ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
611 bool secstate, bool priv);
612
613/* Return the MMU index for a v7M CPU in the specified security state */
614ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate);
615
Alvise Rigodeb2db92016-01-15 11:37:42 +0100616/* Return true if the stage 1 translation regime is using LPAE format page
617 * tables */
618bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx);
Andrew Baumann30901472015-12-17 13:37:13 +0000619
620/* Raise a data fault alignment exception for the specified virtual address */
Marc-André Lureau89057702022-04-20 17:26:02 +0400621G_NORETURN void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
622 MMUAccessType access_type,
623 int mmu_idx, uintptr_t retaddr);
Andrew Baumann30901472015-12-17 13:37:13 +0000624
Peter Maydellc79c0a32017-09-07 13:54:55 +0100625/* arm_cpu_do_transaction_failed: handle a memory system error response
626 * (eg "no device/memory present at address") by raising an external abort
627 * exception
628 */
629void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
630 vaddr addr, unsigned size,
631 MMUAccessType access_type,
632 int mmu_idx, MemTxAttrs attrs,
633 MemTxResult response, uintptr_t retaddr);
634
Aaron Lindsay08267482018-04-26 11:04:39 +0100635/* Call any registered EL change hooks */
Aaron Lindsayb5c53d12018-04-26 11:04:39 +0100636static inline void arm_call_pre_el_change_hook(ARMCPU *cpu)
637{
638 ARMELChangeHook *hook, *next;
639 QLIST_FOREACH_SAFE(hook, &cpu->pre_el_change_hooks, node, next) {
640 hook->hook(cpu, hook->opaque);
641 }
642}
Peter Maydellbd7d00f2016-06-17 15:23:46 +0100643static inline void arm_call_el_change_hook(ARMCPU *cpu)
644{
Aaron Lindsay08267482018-04-26 11:04:39 +0100645 ARMELChangeHook *hook, *next;
646 QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) {
647 hook->hook(cpu, hook->opaque);
Peter Maydellbd7d00f2016-06-17 15:23:46 +0100648 }
649}
650
Richard Henderson339370b2020-02-07 14:04:24 +0000651/* Return true if this address translation regime has two ranges. */
652static inline bool regime_has_2_ranges(ARMMMUIdx mmu_idx)
653{
654 switch (mmu_idx) {
655 case ARMMMUIdx_Stage1_E0:
656 case ARMMMUIdx_Stage1_E1:
Richard Henderson452ef8c2020-02-08 12:57:58 +0000657 case ARMMMUIdx_Stage1_E1_PAN:
RĂ©mi Denis-Courmontb1a10c82021-01-12 12:45:06 +0200658 case ARMMMUIdx_Stage1_SE0:
659 case ARMMMUIdx_Stage1_SE1:
660 case ARMMMUIdx_Stage1_SE1_PAN:
Richard Henderson339370b2020-02-07 14:04:24 +0000661 case ARMMMUIdx_E10_0:
662 case ARMMMUIdx_E10_1:
Richard Henderson452ef8c2020-02-08 12:57:58 +0000663 case ARMMMUIdx_E10_1_PAN:
Richard Henderson339370b2020-02-07 14:04:24 +0000664 case ARMMMUIdx_E20_0:
665 case ARMMMUIdx_E20_2:
Richard Henderson452ef8c2020-02-08 12:57:58 +0000666 case ARMMMUIdx_E20_2_PAN:
Richard Henderson339370b2020-02-07 14:04:24 +0000667 case ARMMMUIdx_SE10_0:
668 case ARMMMUIdx_SE10_1:
Richard Henderson452ef8c2020-02-08 12:57:58 +0000669 case ARMMMUIdx_SE10_1_PAN:
RĂ©mi Denis-Courmontb6ad6062021-01-12 12:45:00 +0200670 case ARMMMUIdx_SE20_0:
671 case ARMMMUIdx_SE20_2:
672 case ARMMMUIdx_SE20_2_PAN:
Richard Henderson339370b2020-02-07 14:04:24 +0000673 return true;
674 default:
675 return false;
676 }
677}
678
Peter Maydell61fcd692017-09-07 13:54:54 +0100679/* Return true if this address translation regime is secure */
680static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
681{
682 switch (mmu_idx) {
Richard Henderson01b98b62020-02-07 14:04:22 +0000683 case ARMMMUIdx_E10_0:
684 case ARMMMUIdx_E10_1:
Richard Henderson452ef8c2020-02-08 12:57:58 +0000685 case ARMMMUIdx_E10_1_PAN:
Richard Hendersonb9f60332020-02-07 14:04:24 +0000686 case ARMMMUIdx_E20_0:
687 case ARMMMUIdx_E20_2:
Richard Henderson452ef8c2020-02-08 12:57:58 +0000688 case ARMMMUIdx_E20_2_PAN:
Richard Henderson2859d7b2020-02-07 14:04:22 +0000689 case ARMMMUIdx_Stage1_E0:
690 case ARMMMUIdx_Stage1_E1:
Richard Henderson452ef8c2020-02-08 12:57:58 +0000691 case ARMMMUIdx_Stage1_E1_PAN:
Richard Hendersone013b742020-02-07 14:04:23 +0000692 case ARMMMUIdx_E2:
Richard Henderson97fa9352020-02-07 14:04:22 +0000693 case ARMMMUIdx_Stage2:
Peter Maydell62593712017-12-13 17:59:23 +0000694 case ARMMMUIdx_MPrivNegPri:
695 case ARMMMUIdx_MUserNegPri:
Peter Maydell61fcd692017-09-07 13:54:54 +0100696 case ARMMMUIdx_MPriv:
Peter Maydell61fcd692017-09-07 13:54:54 +0100697 case ARMMMUIdx_MUser:
698 return false;
Richard Henderson127b2b02020-02-07 14:04:23 +0000699 case ARMMMUIdx_SE3:
Richard Hendersonfba37ae2020-02-07 14:04:23 +0000700 case ARMMMUIdx_SE10_0:
701 case ARMMMUIdx_SE10_1:
Richard Henderson452ef8c2020-02-08 12:57:58 +0000702 case ARMMMUIdx_SE10_1_PAN:
RĂ©mi Denis-Courmontb6ad6062021-01-12 12:45:00 +0200703 case ARMMMUIdx_SE20_0:
704 case ARMMMUIdx_SE20_2:
705 case ARMMMUIdx_SE20_2_PAN:
RĂ©mi Denis-Courmontb1a10c82021-01-12 12:45:06 +0200706 case ARMMMUIdx_Stage1_SE0:
707 case ARMMMUIdx_Stage1_SE1:
708 case ARMMMUIdx_Stage1_SE1_PAN:
RĂ©mi Denis-Courmontb6ad6062021-01-12 12:45:00 +0200709 case ARMMMUIdx_SE2:
RĂ©mi Denis-Courmontb1a10c82021-01-12 12:45:06 +0200710 case ARMMMUIdx_Stage2_S:
Peter Maydell62593712017-12-13 17:59:23 +0000711 case ARMMMUIdx_MSPrivNegPri:
712 case ARMMMUIdx_MSUserNegPri:
Peter Maydell61fcd692017-09-07 13:54:54 +0100713 case ARMMMUIdx_MSPriv:
Peter Maydell61fcd692017-09-07 13:54:54 +0100714 case ARMMMUIdx_MSUser:
715 return true;
716 default:
717 g_assert_not_reached();
718 }
719}
720
Richard Henderson81636b72020-02-08 12:58:09 +0000721static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
722{
723 switch (mmu_idx) {
724 case ARMMMUIdx_Stage1_E1_PAN:
RĂ©mi Denis-Courmontb1a10c82021-01-12 12:45:06 +0200725 case ARMMMUIdx_Stage1_SE1_PAN:
Richard Henderson81636b72020-02-08 12:58:09 +0000726 case ARMMMUIdx_E10_1_PAN:
727 case ARMMMUIdx_E20_2_PAN:
728 case ARMMMUIdx_SE10_1_PAN:
RĂ©mi Denis-Courmontb6ad6062021-01-12 12:45:00 +0200729 case ARMMMUIdx_SE20_2_PAN:
Richard Henderson81636b72020-02-08 12:58:09 +0000730 return true;
731 default:
732 return false;
733 }
734}
735
Richard Henderson9c7ab8f2020-06-25 20:31:19 -0700736/* Return the exception level which controls this address translation regime */
737static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
738{
739 switch (mmu_idx) {
RĂ©mi Denis-Courmontb6ad6062021-01-12 12:45:00 +0200740 case ARMMMUIdx_SE20_0:
741 case ARMMMUIdx_SE20_2:
742 case ARMMMUIdx_SE20_2_PAN:
Richard Henderson9c7ab8f2020-06-25 20:31:19 -0700743 case ARMMMUIdx_E20_0:
744 case ARMMMUIdx_E20_2:
745 case ARMMMUIdx_E20_2_PAN:
746 case ARMMMUIdx_Stage2:
RĂ©mi Denis-Courmontb1a10c82021-01-12 12:45:06 +0200747 case ARMMMUIdx_Stage2_S:
RĂ©mi Denis-Courmontb6ad6062021-01-12 12:45:00 +0200748 case ARMMMUIdx_SE2:
Richard Henderson9c7ab8f2020-06-25 20:31:19 -0700749 case ARMMMUIdx_E2:
750 return 2;
751 case ARMMMUIdx_SE3:
752 return 3;
753 case ARMMMUIdx_SE10_0:
RĂ©mi Denis-Courmontb1a10c82021-01-12 12:45:06 +0200754 case ARMMMUIdx_Stage1_SE0:
Richard Henderson9c7ab8f2020-06-25 20:31:19 -0700755 return arm_el_is_aa64(env, 3) ? 1 : 3;
756 case ARMMMUIdx_SE10_1:
757 case ARMMMUIdx_SE10_1_PAN:
758 case ARMMMUIdx_Stage1_E0:
759 case ARMMMUIdx_Stage1_E1:
760 case ARMMMUIdx_Stage1_E1_PAN:
RĂ©mi Denis-Courmontb1a10c82021-01-12 12:45:06 +0200761 case ARMMMUIdx_Stage1_SE1:
762 case ARMMMUIdx_Stage1_SE1_PAN:
Richard Henderson9c7ab8f2020-06-25 20:31:19 -0700763 case ARMMMUIdx_E10_0:
764 case ARMMMUIdx_E10_1:
765 case ARMMMUIdx_E10_1_PAN:
766 case ARMMMUIdx_MPrivNegPri:
767 case ARMMMUIdx_MUserNegPri:
768 case ARMMMUIdx_MPriv:
769 case ARMMMUIdx_MUser:
770 case ARMMMUIdx_MSPrivNegPri:
771 case ARMMMUIdx_MSUserNegPri:
772 case ARMMMUIdx_MSPriv:
773 case ARMMMUIdx_MSUser:
774 return 1;
775 default:
776 g_assert_not_reached();
777 }
778}
779
Richard Henderson38659d32020-06-25 20:31:20 -0700780/* Return the TCR controlling this translation regime */
781static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
782{
783 if (mmu_idx == ARMMMUIdx_Stage2) {
784 return &env->cp15.vtcr_el2;
785 }
RĂ©mi Denis-Courmontb1a10c82021-01-12 12:45:06 +0200786 if (mmu_idx == ARMMMUIdx_Stage2_S) {
787 /*
788 * Note: Secure stage 2 nominally shares fields from VTCR_EL2, but
789 * those are not currently used by QEMU, so just return VSTCR_EL2.
790 */
791 return &env->cp15.vstcr_el2;
792 }
Richard Henderson38659d32020-06-25 20:31:20 -0700793 return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
794}
795
Peter Maydell81621d92018-03-23 18:26:46 +0000796/* Return the FSR value for a debug exception (watchpoint, hardware
797 * breakpoint or BKPT insn) targeting the specified exception level.
798 */
799static inline uint32_t arm_debug_exception_fsr(CPUARMState *env)
800{
801 ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
802 int target_el = arm_debug_target_el(env);
803 bool using_lpae = false;
804
805 if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
806 using_lpae = true;
807 } else {
808 if (arm_feature(env, ARM_FEATURE_LPAE) &&
809 (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
810 using_lpae = true;
811 }
812 }
813
814 if (using_lpae) {
815 return arm_fi_to_lfsc(&fi);
816 } else {
817 return arm_fi_to_sfsc(&fi);
818 }
819}
820
Peter Maydell88ce6c62020-02-14 17:51:05 +0000821/**
822 * arm_num_brps: Return number of implemented breakpoints.
823 * Note that the ID register BRPS field is "number of bps - 1",
824 * and we return the actual number of breakpoints.
825 */
826static inline int arm_num_brps(ARMCPU *cpu)
827{
828 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
829 return FIELD_EX64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, BRPS) + 1;
830 } else {
Peter Maydell4426d362020-02-14 17:51:06 +0000831 return FIELD_EX32(cpu->isar.dbgdidr, DBGDIDR, BRPS) + 1;
Peter Maydell88ce6c62020-02-14 17:51:05 +0000832 }
833}
834
835/**
836 * arm_num_wrps: Return number of implemented watchpoints.
837 * Note that the ID register WRPS field is "number of wps - 1",
838 * and we return the actual number of watchpoints.
839 */
840static inline int arm_num_wrps(ARMCPU *cpu)
841{
842 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
843 return FIELD_EX64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, WRPS) + 1;
844 } else {
Peter Maydell4426d362020-02-14 17:51:06 +0000845 return FIELD_EX32(cpu->isar.dbgdidr, DBGDIDR, WRPS) + 1;
Peter Maydell88ce6c62020-02-14 17:51:05 +0000846 }
847}
848
849/**
850 * arm_num_ctx_cmps: Return number of implemented context comparators.
851 * Note that the ID register CTX_CMPS field is "number of cmps - 1",
852 * and we return the actual number of comparators.
853 */
854static inline int arm_num_ctx_cmps(ARMCPU *cpu)
855{
856 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
857 return FIELD_EX64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, CTX_CMPS) + 1;
858 } else {
Peter Maydell4426d362020-02-14 17:51:06 +0000859 return FIELD_EX32(cpu->isar.dbgdidr, DBGDIDR, CTX_CMPS) + 1;
Peter Maydell88ce6c62020-02-14 17:51:05 +0000860 }
861}
862
Peter Maydell5529bf12018-10-08 14:55:04 +0100863/**
864 * v7m_using_psp: Return true if using process stack pointer
865 * Return true if the CPU is currently using the process stack
866 * pointer, or false if it is using the main stack pointer.
867 */
868static inline bool v7m_using_psp(CPUARMState *env)
869{
870 /* Handler mode always uses the main stack; for thread mode
871 * the CONTROL.SPSEL bit determines the answer.
872 * Note that in v7M it is not possible to be in Handler mode with
873 * CONTROL.SPSEL non-zero, but in v8M it is, so we must check both.
874 */
875 return !arm_v7m_is_handler_mode(env) &&
876 env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK;
877}
878
Peter Maydell55203182018-10-08 14:55:04 +0100879/**
880 * v7m_sp_limit: Return SP limit for current CPU state
881 * Return the SP limit value for the current CPU security state
882 * and stack pointer.
883 */
884static inline uint32_t v7m_sp_limit(CPUARMState *env)
885{
886 if (v7m_using_psp(env)) {
887 return env->v7m.psplim[env->v7m.secure];
888 } else {
889 return env->v7m.msplim[env->v7m.secure];
890 }
891}
892
Peter Maydell81e37282018-10-24 07:50:17 +0100893/**
Philippe Mathieu-Daudé787a7e72019-07-01 17:26:22 +0100894 * v7m_cpacr_pass:
895 * Return true if the v7M CPACR permits access to the FPU for the specified
896 * security state and privilege level.
897 */
898static inline bool v7m_cpacr_pass(CPUARMState *env,
899 bool is_secure, bool is_priv)
900{
901 switch (extract32(env->v7m.cpacr[is_secure], 20, 2)) {
902 case 0:
903 case 2: /* UNPREDICTABLE: we treat like 0 */
904 return false;
905 case 1:
906 return is_priv;
907 case 3:
908 return true;
909 default:
910 g_assert_not_reached();
911 }
912}
913
914/**
Peter Maydell81e37282018-10-24 07:50:17 +0100915 * aarch32_mode_name(): Return name of the AArch32 CPU mode
916 * @psr: Program Status Register indicating CPU mode
917 *
918 * Returns, for debug logging purposes, a printable representation
919 * of the AArch32 CPU mode ("svc", "usr", etc) as indicated by
920 * the low bits of the specified PSR.
921 */
922static inline const char *aarch32_mode_name(uint32_t psr)
923{
924 static const char cpu_mode_names[16][4] = {
925 "usr", "fiq", "irq", "svc", "???", "???", "mon", "abt",
926 "???", "???", "hyp", "und", "???", "???", "???", "sys"
927 };
928
929 return cpu_mode_names[psr & 0xf];
930}
931
Peter Maydell89430fc2018-11-13 10:47:59 +0000932/**
933 * arm_cpu_update_virq: Update CPU_INTERRUPT_VIRQ bit in cs->interrupt_request
934 *
935 * Update the CPU_INTERRUPT_VIRQ bit in cs->interrupt_request, following
936 * a change to either the input VIRQ line from the GIC or the HCR_EL2.VI bit.
937 * Must be called with the iothread lock held.
938 */
939void arm_cpu_update_virq(ARMCPU *cpu);
940
941/**
942 * arm_cpu_update_vfiq: Update CPU_INTERRUPT_VFIQ bit in cs->interrupt_request
943 *
944 * Update the CPU_INTERRUPT_VFIQ bit in cs->interrupt_request, following
945 * a change to either the input VFIQ line from the GIC or the HCR_EL2.VF bit.
946 * Must be called with the iothread lock held.
947 */
948void arm_cpu_update_vfiq(ARMCPU *cpu);
949
Richard Henderson50494a22019-01-21 10:23:12 +0000950/**
Richard Henderson3c296322022-05-06 13:02:33 -0500951 * arm_cpu_update_vserr: Update CPU_INTERRUPT_VSERR bit
952 *
953 * Update the CPU_INTERRUPT_VSERR bit in cs->interrupt_request,
954 * following a change to the HCR_EL2.VSE bit.
955 */
956void arm_cpu_update_vserr(ARMCPU *cpu);
957
958/**
Richard Henderson164690b2019-10-23 11:00:46 -0400959 * arm_mmu_idx_el:
960 * @env: The cpu environment
961 * @el: The EL to use.
962 *
963 * Return the full ARMMMUIdx for the translation regime for EL.
964 */
965ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el);
966
967/**
Richard Henderson50494a22019-01-21 10:23:12 +0000968 * arm_mmu_idx:
969 * @env: The cpu environment
970 *
971 * Return the full ARMMMUIdx for the current translation regime.
972 */
973ARMMMUIdx arm_mmu_idx(CPUARMState *env);
974
Richard Henderson64be86a2019-01-21 10:23:12 +0000975/**
976 * arm_stage1_mmu_idx:
977 * @env: The cpu environment
978 *
979 * Return the ARMMMUIdx for the stage1 traversal for the current regime.
980 */
981#ifdef CONFIG_USER_ONLY
982static inline ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
983{
Richard Henderson2859d7b2020-02-07 14:04:22 +0000984 return ARMMMUIdx_Stage1_E0;
Richard Henderson64be86a2019-01-21 10:23:12 +0000985}
986#else
987ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env);
988#endif
989
Richard Hendersonfee7aa42020-02-08 12:57:57 +0000990/**
991 * arm_mmu_idx_is_stage1_of_2:
992 * @mmu_idx: The ARMMMUIdx to test
993 *
994 * Return true if @mmu_idx is a NOTLB mmu_idx that is the
995 * first stage of a two stage regime.
996 */
997static inline bool arm_mmu_idx_is_stage1_of_2(ARMMMUIdx mmu_idx)
998{
999 switch (mmu_idx) {
1000 case ARMMMUIdx_Stage1_E0:
1001 case ARMMMUIdx_Stage1_E1:
Richard Henderson452ef8c2020-02-08 12:57:58 +00001002 case ARMMMUIdx_Stage1_E1_PAN:
RĂ©mi Denis-Courmontb1a10c82021-01-12 12:45:06 +02001003 case ARMMMUIdx_Stage1_SE0:
1004 case ARMMMUIdx_Stage1_SE1:
1005 case ARMMMUIdx_Stage1_SE1_PAN:
Richard Hendersonfee7aa42020-02-08 12:57:57 +00001006 return true;
1007 default:
1008 return false;
1009 }
1010}
1011
Richard Henderson4f9584e2020-02-08 12:58:01 +00001012static inline uint32_t aarch32_cpsr_valid_mask(uint64_t features,
1013 const ARMISARegisters *id)
1014{
Richard Hendersonf062d142020-02-08 12:58:02 +00001015 uint32_t valid = CPSR_M | CPSR_AIF | CPSR_IL | CPSR_NZCV;
Richard Henderson4f9584e2020-02-08 12:58:01 +00001016
1017 if ((features >> ARM_FEATURE_V4T) & 1) {
1018 valid |= CPSR_T;
1019 }
1020 if ((features >> ARM_FEATURE_V5) & 1) {
1021 valid |= CPSR_Q; /* V5TE in reality*/
1022 }
1023 if ((features >> ARM_FEATURE_V6) & 1) {
1024 valid |= CPSR_E | CPSR_GE;
1025 }
1026 if ((features >> ARM_FEATURE_THUMB2) & 1) {
1027 valid |= CPSR_IT;
1028 }
Peter Maydell873b73c2020-02-14 17:50:56 +00001029 if (isar_feature_aa32_jazelle(id)) {
Richard Hendersonf062d142020-02-08 12:58:02 +00001030 valid |= CPSR_J;
1031 }
Richard Henderson220f5082020-02-08 12:58:07 +00001032 if (isar_feature_aa32_pan(id)) {
1033 valid |= CPSR_PAN;
1034 }
Rebecca Crandc8b1852021-02-07 23:56:57 -07001035 if (isar_feature_aa32_dit(id)) {
1036 valid |= CPSR_DIT;
1037 }
Rebecca Cranf2f68a72021-02-16 15:45:41 -07001038 if (isar_feature_aa32_ssbs(id)) {
1039 valid |= CPSR_SSBS;
1040 }
Richard Henderson4f9584e2020-02-08 12:58:01 +00001041
1042 return valid;
1043}
1044
Richard Henderson14084512020-02-08 12:58:06 +00001045static inline uint32_t aarch64_pstate_valid_mask(const ARMISARegisters *id)
1046{
1047 uint32_t valid;
1048
1049 valid = PSTATE_M | PSTATE_DAIF | PSTATE_IL | PSTATE_SS | PSTATE_NZCV;
1050 if (isar_feature_aa64_bti(id)) {
1051 valid |= PSTATE_BTYPE;
1052 }
Richard Henderson220f5082020-02-08 12:58:07 +00001053 if (isar_feature_aa64_pan(id)) {
1054 valid |= PSTATE_PAN;
1055 }
Richard Henderson9eeb7a12020-02-08 12:58:14 +00001056 if (isar_feature_aa64_uao(id)) {
1057 valid |= PSTATE_UAO;
1058 }
Rebecca Crandc8b1852021-02-07 23:56:57 -07001059 if (isar_feature_aa64_dit(id)) {
1060 valid |= PSTATE_DIT;
1061 }
Rebecca Cranf2f68a72021-02-16 15:45:41 -07001062 if (isar_feature_aa64_ssbs(id)) {
1063 valid |= PSTATE_SSBS;
1064 }
Richard Henderson4b779ce2020-06-25 20:31:05 -07001065 if (isar_feature_aa64_mte(id)) {
1066 valid |= PSTATE_TCO;
1067 }
Richard Henderson14084512020-02-08 12:58:06 +00001068
1069 return valid;
1070}
1071
Richard Hendersonba97be92019-01-21 10:23:12 +00001072/*
1073 * Parameters of a given virtual address, as extracted from the
1074 * translation control register (TCR) for a given regime.
1075 */
1076typedef struct ARMVAParameters {
1077 unsigned tsz : 8;
Richard Hendersonf4ecc012022-03-01 11:59:47 -10001078 unsigned ps : 3;
Richard Hendersonef56c242022-03-01 11:59:56 -10001079 unsigned sh : 2;
Richard Hendersonba97be92019-01-21 10:23:12 +00001080 unsigned select : 1;
1081 bool tbi : 1;
1082 bool epd : 1;
1083 bool hpd : 1;
1084 bool using16k : 1;
1085 bool using64k : 1;
Richard Hendersonebf93ce2022-03-01 11:59:43 -10001086 bool tsz_oob : 1; /* tsz has been clamped to legal range */
Richard Hendersonef56c242022-03-01 11:59:56 -10001087 bool ds : 1;
Richard Hendersonba97be92019-01-21 10:23:12 +00001088} ARMVAParameters;
1089
Richard Hendersonbf0be432019-01-21 10:23:12 +00001090ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
1091 ARMMMUIdx mmu_idx, bool data);
Richard Hendersonbf0be432019-01-21 10:23:12 +00001092
Richard Hendersonff730e92019-03-01 12:04:55 -08001093static inline int exception_target_el(CPUARMState *env)
1094{
1095 int target_el = MAX(1, arm_current_el(env));
1096
1097 /*
1098 * No such thing as secure EL1 if EL3 is aarch32,
1099 * so update the target EL to EL3 in this case.
1100 */
1101 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
1102 target_el = 3;
1103 }
1104
1105 return target_el;
1106}
1107
Richard Henderson81ae05f2020-06-25 20:31:06 -07001108/* Determine if allocation tags are available. */
1109static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
1110 uint64_t sctlr)
1111{
1112 if (el < 3
1113 && arm_feature(env, ARM_FEATURE_EL3)
1114 && !(env->cp15.scr_el3 & SCR_ATA)) {
1115 return false;
1116 }
Idan Horowitz0da067f2022-04-01 15:35:48 +01001117 if (el < 2 && arm_is_el2_enabled(env)) {
Richard Henderson4301acd2020-10-08 11:21:55 -05001118 uint64_t hcr = arm_hcr_el2_eff(env);
1119 if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
1120 return false;
1121 }
Richard Henderson81ae05f2020-06-25 20:31:06 -07001122 }
1123 sctlr &= (el == 0 ? SCTLR_ATA0 : SCTLR_ATA);
1124 return sctlr != 0;
1125}
1126
Philippe Mathieu-Daudéebae8612019-07-01 17:26:20 +01001127#ifndef CONFIG_USER_ONLY
1128
Philippe Mathieu-Daudé787a7e72019-07-01 17:26:22 +01001129/* Security attributes for an address, as returned by v8m_security_lookup. */
1130typedef struct V8M_SAttributes {
1131 bool subpage; /* true if these attrs don't cover the whole TARGET_PAGE */
1132 bool ns;
1133 bool nsc;
1134 uint8_t sregion;
1135 bool srvalid;
1136 uint8_t iregion;
1137 bool irvalid;
1138} V8M_SAttributes;
1139
1140void v8m_security_lookup(CPUARMState *env, uint32_t address,
1141 MMUAccessType access_type, ARMMMUIdx mmu_idx,
1142 V8M_SAttributes *sattrs);
1143
1144bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
1145 MMUAccessType access_type, ARMMMUIdx mmu_idx,
1146 hwaddr *phys_ptr, MemTxAttrs *txattrs,
1147 int *prot, bool *is_subpage,
1148 ARMMMUFaultInfo *fi, uint32_t *mregion);
1149
Philippe Mathieu-Daudéebae8612019-07-01 17:26:20 +01001150/* Cacheability and shareability attributes for a memory access */
1151typedef struct ARMCacheAttrs {
Peter Maydell9f225e62022-05-05 19:39:47 +01001152 /*
1153 * If is_s2_format is true, attrs is the S2 descriptor bits [5:2]
1154 * Otherwise, attrs is the same as the MAIR_EL1 8-bit format
1155 */
1156 unsigned int attrs:8;
Philippe Mathieu-Daudéebae8612019-07-01 17:26:20 +01001157 unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */
Peter Maydell9f225e62022-05-05 19:39:47 +01001158 bool is_s2_format:1;
Philippe Mathieu-Daudéebae8612019-07-01 17:26:20 +01001159} ARMCacheAttrs;
1160
1161bool get_phys_addr(CPUARMState *env, target_ulong address,
1162 MMUAccessType access_type, ARMMMUIdx mmu_idx,
1163 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
1164 target_ulong *page_size,
Richard Henderson7e98e212020-06-25 20:31:39 -07001165 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
1166 __attribute__((nonnull));
Philippe Mathieu-Daudéebae8612019-07-01 17:26:20 +01001167
Peter Maydellfc6177a2022-01-22 18:24:31 +00001168void arm_log_exception(CPUState *cs);
Philippe Mathieu-Daudéb59f4792019-07-01 17:26:22 +01001169
Philippe Mathieu-Daudéebae8612019-07-01 17:26:20 +01001170#endif /* !CONFIG_USER_ONLY */
1171
Richard Henderson4b779ce2020-06-25 20:31:05 -07001172/*
1173 * The log2 of the words in the tag block, for GMID_EL1.BS.
1174 * The is the maximum, 256 bytes, which manipulates 64-bits of tags.
1175 */
1176#define GMID_EL1_BS 6
1177
Richard Hendersonefbc78a2020-06-25 20:31:09 -07001178/* We associate one allocation tag per 16 bytes, the minimum. */
1179#define LOG2_TAG_GRANULE 4
1180#define TAG_GRANULE (1 << LOG2_TAG_GRANULE)
1181
Richard Henderson206adac2020-06-25 20:31:31 -07001182/*
Richard Hendersonb64ee452021-01-12 20:26:47 -10001183 * SVE predicates are 1/8 the size of SVE vectors, and cannot use
1184 * the same simd_desc() encoding due to restrictions on size.
1185 * Use these instead.
1186 */
1187FIELD(PREDDESC, OPRSZ, 0, 6)
1188FIELD(PREDDESC, ESZ, 6, 2)
1189FIELD(PREDDESC, DATA, 8, 24)
1190
1191/*
Richard Henderson206adac2020-06-25 20:31:31 -07001192 * The SVE simd_data field, for memory ops, contains either
1193 * rd (5 bits) or a shift count (2 bits).
1194 */
1195#define SVE_MTEDESC_SHIFT 5
1196
Richard Henderson0a405be2020-06-25 20:31:21 -07001197/* Bits within a descriptor passed to the helper_mte_check* functions. */
1198FIELD(MTEDESC, MIDX, 0, 4)
1199FIELD(MTEDESC, TBI, 4, 2)
1200FIELD(MTEDESC, TCMA, 6, 2)
1201FIELD(MTEDESC, WRITE, 8, 1)
Richard Henderson28f32502021-04-16 11:31:02 -07001202FIELD(MTEDESC, SIZEM1, 9, SIMD_DATA_BITS - 9) /* size - 1 */
Richard Henderson0a405be2020-06-25 20:31:21 -07001203
Richard Hendersond304d282021-04-16 11:31:04 -07001204bool mte_probe(CPUARMState *env, uint32_t desc, uint64_t ptr);
Richard Hendersonbd47b612021-04-16 11:31:03 -07001205uint64_t mte_check(CPUARMState *env, uint32_t desc, uint64_t ptr, uintptr_t ra);
Richard Henderson2e34ff42020-06-25 20:31:23 -07001206
Richard Hendersonefbc78a2020-06-25 20:31:09 -07001207static inline int allocation_tag_from_addr(uint64_t ptr)
1208{
1209 return extract64(ptr, 56, 4);
1210}
1211
Richard Hendersonda549412020-06-25 20:31:07 -07001212static inline uint64_t address_with_allocation_tag(uint64_t ptr, int rtag)
1213{
1214 return deposit64(ptr, 56, 4, rtag);
1215}
1216
Richard Henderson2e34ff42020-06-25 20:31:23 -07001217/* Return true if tbi bits mean that the access is checked. */
1218static inline bool tbi_check(uint32_t desc, int bit55)
1219{
1220 return (desc >> (R_MTEDESC_TBI_SHIFT + bit55)) & 1;
1221}
1222
1223/* Return true if tcma bits mean that the access is unchecked. */
1224static inline bool tcma_check(uint32_t desc, int bit55, int ptr_tag)
1225{
1226 /*
1227 * We had extracted bit55 and ptr_tag for other reasons, so fold
1228 * (ptr<59:55> == 00000 || ptr<59:55> == 11111) into a single test.
1229 */
1230 bool match = ((ptr_tag + bit55) & 0xf) == 0;
1231 bool tcma = (desc >> (R_MTEDESC_TCMA_SHIFT + bit55)) & 1;
1232 return tcma && match;
1233}
1234
1235/*
1236 * For TBI, ideally, we would do nothing. Proper behaviour on fault is
1237 * for the tag to be present in the FAR_ELx register. But for user-only
1238 * mode, we do not have a TLB with which to implement this, so we must
1239 * remove the top byte.
1240 */
1241static inline uint64_t useronly_clean_ptr(uint64_t ptr)
1242{
Richard Henderson2e34ff42020-06-25 20:31:23 -07001243#ifdef CONFIG_USER_ONLY
Richard Henderson16c84972021-02-12 10:48:53 -08001244 /* TBI0 is known to be enabled, while TBI1 is disabled. */
1245 ptr &= sextract64(ptr, 0, 56);
Richard Henderson2e34ff42020-06-25 20:31:23 -07001246#endif
1247 return ptr;
1248}
1249
1250static inline uint64_t useronly_maybe_clean_ptr(uint32_t desc, uint64_t ptr)
1251{
1252#ifdef CONFIG_USER_ONLY
1253 int64_t clean_ptr = sextract64(ptr, 0, 56);
1254 if (tbi_check(desc, clean_ptr < 0)) {
1255 ptr = clean_ptr;
1256 }
1257#endif
1258 return ptr;
1259}
1260
Peter Maydell507b6a52021-06-17 13:15:45 +01001261/* Values for M-profile PSR.ECI for MVE insns */
1262enum MVEECIState {
1263 ECI_NONE = 0, /* No completed beats */
1264 ECI_A0 = 1, /* Completed: A0 */
1265 ECI_A0A1 = 2, /* Completed: A0, A1 */
1266 /* 3 is reserved */
1267 ECI_A0A1A2 = 4, /* Completed: A0, A1, A2 */
1268 ECI_A0A1A2B0 = 5, /* Completed: A0, A1, A2, B0 */
1269 /* All other values reserved */
1270};
1271
Alexander Graf01308952021-09-16 17:53:55 +02001272/* Definitions for the PMU registers */
1273#define PMCRN_MASK 0xf800
1274#define PMCRN_SHIFT 11
1275#define PMCRLC 0x40
1276#define PMCRDP 0x20
1277#define PMCRX 0x10
1278#define PMCRD 0x8
1279#define PMCRC 0x4
1280#define PMCRP 0x2
1281#define PMCRE 0x1
1282/*
1283 * Mask of PMCR bits writeable by guest (not including WO bits like C, P,
1284 * which can be written as 1 to trigger behaviour but which stay RAZ).
1285 */
1286#define PMCR_WRITEABLE_MASK (PMCRLC | PMCRDP | PMCRX | PMCRD | PMCRE)
1287
1288#define PMXEVTYPER_P 0x80000000
1289#define PMXEVTYPER_U 0x40000000
1290#define PMXEVTYPER_NSK 0x20000000
1291#define PMXEVTYPER_NSU 0x10000000
1292#define PMXEVTYPER_NSH 0x08000000
1293#define PMXEVTYPER_M 0x04000000
1294#define PMXEVTYPER_MT 0x02000000
1295#define PMXEVTYPER_EVTCOUNT 0x0000ffff
1296#define PMXEVTYPER_MASK (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \
1297 PMXEVTYPER_NSU | PMXEVTYPER_NSH | \
1298 PMXEVTYPER_M | PMXEVTYPER_MT | \
1299 PMXEVTYPER_EVTCOUNT)
1300
1301#define PMCCFILTR 0xf8000000
1302#define PMCCFILTR_M PMXEVTYPER_M
1303#define PMCCFILTR_EL0 (PMCCFILTR | PMCCFILTR_M)
1304
1305static inline uint32_t pmu_num_counters(CPUARMState *env)
1306{
Peter Maydell24526bb2022-05-13 13:28:52 +01001307 ARMCPU *cpu = env_archcpu(env);
1308
1309 return (cpu->isar.reset_pmcr_el0 & PMCRN_MASK) >> PMCRN_SHIFT;
Alexander Graf01308952021-09-16 17:53:55 +02001310}
1311
1312/* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
1313static inline uint64_t pmu_counter_mask(CPUARMState *env)
1314{
1315 return (1 << 31) | ((1 << pmu_num_counters(env)) - 1);
1316}
1317
Peter Maydell89f4f202021-09-21 17:28:59 +01001318#ifdef TARGET_AARCH64
1319int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg);
1320int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
1321int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
1322int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
1323#endif
1324
Richard Henderson7c1aaf92022-05-06 13:02:23 -05001325#ifdef CONFIG_USER_ONLY
1326static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
1327#else
1328void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu);
1329#endif
1330
Richard Hendersonb6f8b352022-05-06 13:02:26 -05001331void aa32_max_features(ARMCPU *cpu);
1332
Peter Maydellccd38082014-04-15 19:18:37 +01001333#endif