yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2024-12-26 06:55:39 +00:00
Code Issues Packages Projects Releases Wiki Activity
unicorn/qemu/target/arm/internals.h

753 lines
23 KiB
C
Raw Normal View History

import
2015-08-21 07:04:50 +00:00
/*
* QEMU ARM CPU -- internal functions and types
*
* Copyright (c) 2014 Linaro Ltd
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, see
* <http://www.gnu.org/licenses/gpl-2.0.html>
*
* This header defines functions, types, etc which need to be shared
Move target-* CPU file into a target/ folder We've currently got 18 architectures in QEMU, and thus 18 target-xxx folders in the root folder of the QEMU source tree. More architectures (e.g. RISC-V, AVR) are likely to be included soon, too, so the main folder of the QEMU sources slowly gets quite overcrowded with the target-xxx folders. To disburden the main folder a little bit, let's move the target-xxx folders into a dedicated target/ folder, so that target-xxx/ simply becomes target/xxx/ instead. Backports commit fcf5ef2ab52c621a4617ebbef36bf43b4003f4c0 from qemu
2018-03-02 03:35:33 +00:00
* between different source files within target/arm/ but which are
import
2015-08-21 07:04:50 +00:00
* private to it and not required by the rest of QEMU.
*/
#ifndef TARGET_ARM_INTERNALS_H
#define TARGET_ARM_INTERNALS_H
armv7m: Fix reads of CONTROL register bit 1 The v7m CONTROL register bit 1 is SPSEL, which indicates the stack being used. We were storing this information not in v7m.control but in the separate v7m.other_sp structure field. Unfortunately, the code handling reads of the CONTROL register didn't take account of this, and so if SPSEL was updated by an exception entry or exit then a subsequent guest read of CONTROL would get the wrong value. Using a separate structure field doesn't really gain us anything in efficiency, so drop this unnecessary complexity in favour of simply storing all the bits in v7m.control. This is a migration compatibility break for M profile CPUs only. Backports commit abc24d86cc0364f402e438fae3acb14289b40734 from qemu
2018-03-02 18:25:58 +00:00
#include "hw/registerfields.h"
target-arm: Add and use symbolic names for register banks Add BANK_<cpumode> #defines to index banked registers. Backports commit 99a99c1fc8e9bfec1656ac5916c53977a93d3581 from qemu
2018-02-17 23:13:51 +00:00
/* register banks for CPU modes */
#define BANK_USRSYS 0
#define BANK_SVC 1
#define BANK_ABT 2
#define BANK_UND 3
#define BANK_IRQ 4
#define BANK_FIQ 5
#define BANK_HYP 6
#define BANK_MON 7
import
2015-08-21 07:04:50 +00:00
static inline bool excp_is_internal(int excp)
{
/* Return true if this exception number represents a QEMU-internal
* exception that will not be passed to the guest.
*/
return excp == EXCP_INTERRUPT
|| excp == EXCP_HLT
|| excp == EXCP_DEBUG
|| excp == EXCP_HALTED
|| excp == EXCP_EXCEPTION_EXIT
|| excp == EXCP_KERNEL_TRAP
target-arm: remove EXCP_STREX + cpu_exclusive_{test, info} The exception is not emitted anymore; remove it and the associated TCG variables. Backports commit 05188cc72f0399e99c92f608a8e7ca4c8e552c4b from qemu
2018-02-28 05:24:13 +00:00
|| excp == EXCP_SEMIHOST;
import
2015-08-21 07:04:50 +00:00
}
/* Scale factor for generic timers, ie number of ns per tick.
* This gives a 62.5MHz timer.
*/
#define GTIMER_SCALE 16
armv7m: Fix reads of CONTROL register bit 1 The v7m CONTROL register bit 1 is SPSEL, which indicates the stack being used. We were storing this information not in v7m.control but in the separate v7m.other_sp structure field. Unfortunately, the code handling reads of the CONTROL register didn't take account of this, and so if SPSEL was updated by an exception entry or exit then a subsequent guest read of CONTROL would get the wrong value. Using a separate structure field doesn't really gain us anything in efficiency, so drop this unnecessary complexity in favour of simply storing all the bits in v7m.control. This is a migration compatibility break for M profile CPUs only. Backports commit abc24d86cc0364f402e438fae3acb14289b40734 from qemu
2018-03-02 18:25:58 +00:00
/* Bit definitions for the v7M CONTROL register */
FIELD(V7M_CONTROL, NPRIV, 0, 1)
FIELD(V7M_CONTROL, SPSEL, 1, 1)
FIELD(V7M_CONTROL, FPCA, 2, 1)
target/arm: Implement BLXNS Implement the BLXNS instruction, which allows secure code to call non-secure code. Backports commit 3e3fa230e3b8ffe119f14ba57a6bc677a411be57 from qemu
2018-03-05 08:29:41 +00:00
FIELD(V7M_CONTROL, SFPA, 3, 1)
armv7m: Fix reads of CONTROL register bit 1 The v7m CONTROL register bit 1 is SPSEL, which indicates the stack being used. We were storing this information not in v7m.control but in the separate v7m.other_sp structure field. Unfortunately, the code handling reads of the CONTROL register didn't take account of this, and so if SPSEL was updated by an exception entry or exit then a subsequent guest read of CONTROL would get the wrong value. Using a separate structure field doesn't really gain us anything in efficiency, so drop this unnecessary complexity in favour of simply storing all the bits in v7m.control. This is a migration compatibility break for M profile CPUs only. Backports commit abc24d86cc0364f402e438fae3acb14289b40734 from qemu
2018-03-02 18:25:58 +00:00
target/arm: Add and use defines for EXCRET constants The exception-return magic values get some new bits in v8M, which makes some bit definitions for them worthwhile. We don't use the bit definitions for the switch on the low bits which checks the return type for v7M, because this is defined in the v7M ARM ARM as a set of valid values rather than via per-bit checks. Backports commit 4d1e7a4745c050f7ccac49a1c01437526b5130b5 from qemu
2018-03-05 04:12:35 +00:00
/* Bit definitions for v7M exception return payload */
FIELD(V7M_EXCRET, ES, 0, 1)
FIELD(V7M_EXCRET, RES0, 1, 1)
FIELD(V7M_EXCRET, SPSEL, 2, 1)
FIELD(V7M_EXCRET, MODE, 3, 1)
FIELD(V7M_EXCRET, FTYPE, 4, 1)
FIELD(V7M_EXCRET, DCRS, 5, 1)
FIELD(V7M_EXCRET, S, 6, 1)
FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
target/arm: Implement secure function return Secure function return happens when a non-secure function has been called using BLXNS and so has a particular magic LR value (either 0xfefffffe or 0xfeffffff). The function return via BX behaves specially when the new PC value is this magic value, in the same way that exception returns are handled. Adjust our BX excret guards so that they recognize the function return magic number as well, and perform the function-return unstacking in do_v7m_exception_exit(). Backports commit d02a8698d7ae2bfed3b11fe5b064cb0aa406863b from qemu
2018-03-05 08:33:39 +00:00
/* Minimum value which is a magic number for exception return */
#define EXC_RETURN_MIN_MAGIC 0xff000000
/* Minimum number which is a magic number for function or exception return
* when using v8M security extension
*/
#define FNC_RETURN_MIN_MAGIC 0xfefffffe
target/arm: Implement security attribute lookups for memory accesses Implement the security attribute lookups for memory accesses in the get_phys_addr() functions, causing these to generate various kinds of SecureFault for bad accesses. The major subtlety in this code relates to handling of the case when the security attributes the SAU assigns to the address don't match the current security state of the CPU. In the ARM ARM pseudocode for validating instruction accesses, the security attributes of the address determine whether the Secure or NonSecure MPU state is used. At face value, handling this would require us to encode the relevant bits of state into mmu_idx for both S and NS at once, which would result in our needing 16 mmu indexes. Fortunately we don't actually need to do this because a mismatch between address attributes and CPU state means either: * some kind of fault (usually a SecureFault, but in theory perhaps a UserFault for unaligned access to Device memory) * execution of the SG instruction in NS state from a Secure & NonSecure code region The purpose of SG is simply to flip the CPU into Secure state, so we can handle it by emulating execution of that instruction directly in arm_v7m_cpu_do_interrupt(), which means we can treat all the mismatch cases as "throw an exception" and we don't need to encode the state of the other MPU bank into our mmu_idx values. This commit doesn't include the actual emulation of SG; it also doesn't include implementation of the IDAU, which is a per-board way to specify hard-coded memory attributes for addresses, which override the CPU-internal SAU if they specify a more secure setting than the SAU is programmed to. Backports commit 35337cc391245f251bfb9134f181c33e6375d6c1 from qemu
2018-03-05 06:56:27 +00:00
/* We use a few fake FSR values for internal purposes in M profile.
* M profile cores don't have A/R format FSRs, but currently our
* get_phys_addr() code assumes A/R profile and reports failures via
* an A/R format FSR value. We then translate that into the proper
* M profile exception and FSR status bit in arm_v7m_cpu_do_interrupt().
* Mostly the FSR values we use for this are those defined for v7PMSA,
* since we share some of that codepath. A few kinds of fault are
* only for M profile and have no A/R equivalent, though, so we have
* to pick a value from the reserved range (which we never otherwise
* generate) to use for these.
* These values will never be visible to the guest.
*/
#define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */
#define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */
import
2015-08-21 07:04:50 +00:00
/*
* For AArch64, map a given EL to an index in the banked_spsr array.
target-arm: Store SPSR_EL1 state in banked_spsr[1] (SPSR_svc) The AArch64 SPSR_EL1 register is architecturally mandated to be mapped to the AArch32 SPSR_svc register. This means its state should live in QEMU's env->banked_spsr[1] field. Correct the various places in the code that incorrectly put it in banked_spsr[0]. Backports commit 7847f9ea9fce15a9ecfb62ab72c1e84ff516b0db from qemu
2018-02-12 21:36:13 +00:00
* Note that this mapping and the AArch32 mapping defined in bank_number()
* must agree such that the AArch64<->AArch32 SPSRs have the architecturally
* mandated mapping between each other.
import
2015-08-21 07:04:50 +00:00
*/
static inline unsigned int aarch64_banked_spsr_index(unsigned int el)
{
static const unsigned int map[4] = {
target-arm: Add and use symbolic names for register banks Add BANK_<cpumode> #defines to index banked registers. Backports commit 99a99c1fc8e9bfec1656ac5916c53977a93d3581 from qemu
2018-02-17 23:13:51 +00:00
BANK_USRSYS,
BANK_SVC, /* EL1. */
BANK_HYP, /* EL2. */
BANK_MON, /* EL3. */
import
2015-08-21 07:04:50 +00:00
};
assert(el >= 1 && el <= 3);
return map[el];
}
target-arm: Move get/set_r13_banked() to op_helper.c Move get/set_r13_banked() from helper.c to op_helper.c. This will let us add exception-raising code to them, and also puts them in the same file as get/set_user_reg(), which makes some conceptual sense. (The original reason for the helper.c/op_helper.c split was that only op_helper.c had access to the CPU env pointer; this distinction has not been true for a long time, though, and so the split is now rather arbitrary.) Backports commit 72309cee482868d6c4711931c3f7e02ab9dec229 from qemu target-arm: Move bank_number() into internals.h Move bank_number()'s implementation into internals.h, so it's available in the user-mode-only compile as well. Backports commit c766568d3604082c6fd45cbabe42c48e4861a13f from qemu
2018-02-20 20:04:52 +00:00
/* Map CPU modes onto saved register banks. */
static inline int bank_number(int mode)
{
switch (mode) {
default:
case ARM_CPU_MODE_USR:
case ARM_CPU_MODE_SYS:
return BANK_USRSYS;
case ARM_CPU_MODE_SVC:
return BANK_SVC;
case ARM_CPU_MODE_ABT:
return BANK_ABT;
case ARM_CPU_MODE_UND:
return BANK_UND;
case ARM_CPU_MODE_IRQ:
return BANK_IRQ;
case ARM_CPU_MODE_FIQ:
return BANK_FIQ;
case ARM_CPU_MODE_HYP:
return BANK_HYP;
case ARM_CPU_MODE_MON:
return BANK_MON;
}
g_assert_not_reached();
}
import
2015-08-21 07:04:50 +00:00
void switch_mode(CPUARMState *, int);
void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
void arm_translate_init(struct uc_struct *uc);
enum arm_fprounding {
FPROUNDING_TIEEVEN,
FPROUNDING_POSINF,
FPROUNDING_NEGINF,
FPROUNDING_ZERO,
FPROUNDING_TIEAWAY,
FPROUNDING_ODD
};
int arm_rmode_to_sf(int rmode);
static inline void aarch64_save_sp(CPUARMState *env, int el)
{
if (env->pstate & PSTATE_SP) {
env->sp_el[el] = env->xregs[31];
} else {
env->sp_el[0] = env->xregs[31];
}
}
static inline void aarch64_restore_sp(CPUARMState *env, int el)
{
if (env->pstate & PSTATE_SP) {
env->xregs[31] = env->sp_el[el];
} else {
env->xregs[31] = env->sp_el[0];
}
}
static inline void update_spsel(CPUARMState *env, uint32_t imm)
{
unsigned int cur_el = arm_current_el(env);
/* Update PSTATE SPSel bit; this requires us to update the
* working stack pointer in xregs[31].
*/
if (!((imm ^ env->pstate) & PSTATE_SP)) {
return;
}
aarch64_save_sp(env, cur_el);
env->pstate = deposit32(env->pstate, 0, 1, imm);
/* We rely on illegal updates to SPsel from EL0 to get trapped
* at translation time.
*/
assert(cur_el >= 1 && cur_el <= 3);
aarch64_restore_sp(env, cur_el);
}
target-arm: Add computation of starting level for S2 PTW The starting level for S2 pagetable walks is computed differently from the S1 starting level. Implement the S2 variant. Backports commit 1853d5a9dcac910322c6cc5b2fddec45fd052d25 from qemu
2018-02-17 18:23:53 +00:00
/*
* arm_pamax
* @cpu: ARMCPU
*
* Returns the implementation defined bit-width of physical addresses.
* The ARMv8 reference manuals refer to this as PAMax().
*/
static inline unsigned int arm_pamax(ARMCPU *cpu)
{
static const unsigned int pamax_map[] = {
32,
36,
40,
42,
44,
48,
};
unsigned int parange = extract32(cpu->id_aa64mmfr0, 0, 4);
/* id_aa64mmfr0 is a read-only register so values outside of the
* supported mappings can be considered an implementation error. */
assert(parange < ARRAY_SIZE(pamax_map));
return pamax_map[parange];
}
import
2015-08-21 07:04:50 +00:00
/* Return true if extended addresses are enabled.
* This is always the case if our translation regime is 64 bit,
* but depends on TTBCR.EAE for 32 bit.
*/
static inline bool extended_addresses_enabled(CPUARMState *env)
{
target-arm: make TTBCR banked Adds secure and non-secure bank register suport for TTBCR. Added new struct to compartmentalize the TCR data and masks. Removed old tcr/ttbcr data and added a 4 element array of the new structs in cp15. This allows for one entry per EL. Added a CP register definition for TCR_EL3. Backports commit 11f136ee25232a00f433cefe98ee33cd614ecccc from qemu
2018-02-12 00:57:59 +00:00
TCR *tcr = &env->cp15.tcr_el[arm_is_secure(env) ? 3 : 1];
return arm_el_is_aa64(env, 1) ||
(arm_feature(env, ARM_FEATURE_LPAE) && (tcr->raw_tcr & TTBCR_EAE));
import
2015-08-21 07:04:50 +00:00
}
/* Valid Syndrome Register EC field values */
enum arm_exception_class {
EC_UNCATEGORIZED = 0x00,
EC_WFX_TRAP = 0x01,
EC_CP15RTTRAP = 0x03,
EC_CP15RRTTRAP = 0x04,
EC_CP14RTTRAP = 0x05,
EC_CP14DTTRAP = 0x06,
EC_ADVSIMDFPACCESSTRAP = 0x07,
EC_FPIDTRAP = 0x08,
EC_CP14RRTTRAP = 0x0c,
EC_ILLEGALSTATE = 0x0e,
EC_AA32_SVC = 0x11,
EC_AA32_HVC = 0x12,
EC_AA32_SMC = 0x13,
EC_AA64_SVC = 0x15,
EC_AA64_HVC = 0x16,
EC_AA64_SMC = 0x17,
EC_SYSTEMREGISTERTRAP = 0x18,
EC_INSNABORT = 0x20,
EC_INSNABORT_SAME_EL = 0x21,
EC_PCALIGNMENT = 0x22,
EC_DATAABORT = 0x24,
EC_DATAABORT_SAME_EL = 0x25,
EC_SPALIGNMENT = 0x26,
EC_AA32_FPTRAP = 0x28,
EC_AA64_FPTRAP = 0x2c,
EC_SERROR = 0x2f,
EC_BREAKPOINT = 0x30,
EC_BREAKPOINT_SAME_EL = 0x31,
EC_SOFTWARESTEP = 0x32,
EC_SOFTWARESTEP_SAME_EL = 0x33,
EC_WATCHPOINT = 0x34,
EC_WATCHPOINT_SAME_EL = 0x35,
EC_AA32_BKPT = 0x38,
EC_VECTORCATCH = 0x3a,
EC_AA64_BKPT = 0x3c,
};
#define ARM_EL_EC_SHIFT 26
#define ARM_EL_IL_SHIFT 25
target-arm: Split data abort syndrome generator Split the data abort syndrome generator into two versions: One with a valid Instruction Specific Syndrome (ISS) and another without. The following new flags are supported by the syndrome generator with ISS: * isv - Instruction syndrome valid * sas - Syndrome access size * sse - Syndrome sign extend * srt - Syndrome register transfer * sf - Sixty-Four bit register width * ar - Acquire/Release These flags are not yet used, so this patch has no functional change except that we will now correctly set the IL bit in data abort syndromes without ISS information. Backports commit 094d028a7968236cd2b7f7b96394f7a3b8ad97c8 from qemu
2018-02-24 01:02:54 +00:00
#define ARM_EL_ISV_SHIFT 24
import
2015-08-21 07:04:50 +00:00
#define ARM_EL_IL (1 << ARM_EL_IL_SHIFT)
target-arm: Split data abort syndrome generator Split the data abort syndrome generator into two versions: One with a valid Instruction Specific Syndrome (ISS) and another without. The following new flags are supported by the syndrome generator with ISS: * isv - Instruction syndrome valid * sas - Syndrome access size * sse - Syndrome sign extend * srt - Syndrome register transfer * sf - Sixty-Four bit register width * ar - Acquire/Release These flags are not yet used, so this patch has no functional change except that we will now correctly set the IL bit in data abort syndromes without ISS information. Backports commit 094d028a7968236cd2b7f7b96394f7a3b8ad97c8 from qemu
2018-02-24 01:02:54 +00:00
#define ARM_EL_ISV (1 << ARM_EL_ISV_SHIFT)
import
2015-08-21 07:04:50 +00:00
/* Utility functions for constructing various kinds of syndrome value.
* Note that in general we follow the AArch64 syndrome values; in a
* few cases the value in HSR for exceptions taken to AArch32 Hyp
* mode differs slightly, so if we ever implemented Hyp mode then the
* syndrome value would need some massaging on exception entry.
* (One example of this is that AArch64 defaults to IL bit set for
* exceptions which don't specifically indicate information about the
* trapping instruction, whereas AArch32 defaults to IL bit clear.)
*/
static inline uint32_t syn_uncategorized(void)
{
return (EC_UNCATEGORIZED << ARM_EL_EC_SHIFT) | ARM_EL_IL;
}
static inline uint32_t syn_aa64_svc(uint32_t imm16)
{
return (EC_AA64_SVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
}
static inline uint32_t syn_aa64_hvc(uint32_t imm16)
{
return (EC_AA64_HVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
}
static inline uint32_t syn_aa64_smc(uint32_t imm16)
{
return (EC_AA64_SMC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
}
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
static inline uint32_t syn_aa32_svc(uint32_t imm16, bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_AA32_SVC << ARM_EL_EC_SHIFT) | (imm16 & 0xffff)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL);
import
2015-08-21 07:04:50 +00:00
}
static inline uint32_t syn_aa32_hvc(uint32_t imm16)
{
return (EC_AA32_HVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
}
static inline uint32_t syn_aa32_smc(void)
{
return (EC_AA32_SMC << ARM_EL_EC_SHIFT) | ARM_EL_IL;
}
static inline uint32_t syn_aa64_bkpt(uint32_t imm16)
{
return (EC_AA64_BKPT << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
}
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
static inline uint32_t syn_aa32_bkpt(uint32_t imm16, bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_AA32_BKPT << ARM_EL_EC_SHIFT) | (imm16 & 0xffff)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL);
import
2015-08-21 07:04:50 +00:00
}
static inline uint32_t syn_aa64_sysregtrap(int op0, int op1, int op2,
int crn, int crm, int rt,
int isread)
{
return (EC_SYSTEMREGISTERTRAP << ARM_EL_EC_SHIFT) | ARM_EL_IL
| (op0 << 20) | (op2 << 17) | (op1 << 14) | (crn << 10) | (rt << 5)
| (crm << 1) | isread;
}
static inline uint32_t syn_cp14_rt_trap(int cv, int cond, int opc1, int opc2,
int crn, int crm, int rt, int isread,
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_CP14RTTRAP << ARM_EL_EC_SHIFT)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL)
import
2015-08-21 07:04:50 +00:00
| (cv << 24) | (cond << 20) | (opc2 << 17) | (opc1 << 14)
| (crn << 10) | (rt << 5) | (crm << 1) | isread;
}
static inline uint32_t syn_cp15_rt_trap(int cv, int cond, int opc1, int opc2,
int crn, int crm, int rt, int isread,
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_CP15RTTRAP << ARM_EL_EC_SHIFT)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL)
import
2015-08-21 07:04:50 +00:00
| (cv << 24) | (cond << 20) | (opc2 << 17) | (opc1 << 14)
| (crn << 10) | (rt << 5) | (crm << 1) | isread;
}
static inline uint32_t syn_cp14_rrt_trap(int cv, int cond, int opc1, int crm,
int rt, int rt2, int isread,
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_CP14RRTTRAP << ARM_EL_EC_SHIFT)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL)
import
2015-08-21 07:04:50 +00:00
| (cv << 24) | (cond << 20) | (opc1 << 16)
| (rt2 << 10) | (rt << 5) | (crm << 1) | isread;
}
static inline uint32_t syn_cp15_rrt_trap(int cv, int cond, int opc1, int crm,
int rt, int rt2, int isread,
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_CP15RRTTRAP << ARM_EL_EC_SHIFT)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL)
import
2015-08-21 07:04:50 +00:00
| (cv << 24) | (cond << 20) | (opc1 << 16)
| (rt2 << 10) | (rt << 5) | (crm << 1) | isread;
}
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_ADVSIMDFPACCESSTRAP << ARM_EL_EC_SHIFT)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL)
import
2015-08-21 07:04:50 +00:00
| (cv << 24) | (cond << 20);
}
static inline uint32_t syn_insn_abort(int same_el, int ea, int s1ptw, int fsc)
{
return (EC_INSNABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
target-arm: Set IL bit in syndromes for insn abort, watchpoint, swstep For some exception syndrome types, the IL bit should always be set. This includes the instruction abort, watchpoint and software step syndrome types; add the missing ARM_EL_IL bit to the syndrome values returned by syn_insn_abort(), syn_swstep() and syn_watchpoint(). Backports commit 04ce861ea545477425ad9e045eec3f61c8a27df9 from qemu
2018-02-24 21:48:48 +00:00
| ARM_EL_IL | (ea << 9) | (s1ptw << 7) | fsc;
import
2015-08-21 07:04:50 +00:00
}
target-arm: Split data abort syndrome generator Split the data abort syndrome generator into two versions: One with a valid Instruction Specific Syndrome (ISS) and another without. The following new flags are supported by the syndrome generator with ISS: * isv - Instruction syndrome valid * sas - Syndrome access size * sse - Syndrome sign extend * srt - Syndrome register transfer * sf - Sixty-Four bit register width * ar - Acquire/Release These flags are not yet used, so this patch has no functional change except that we will now correctly set the IL bit in data abort syndromes without ISS information. Backports commit 094d028a7968236cd2b7f7b96394f7a3b8ad97c8 from qemu
2018-02-24 01:02:54 +00:00
static inline uint32_t syn_data_abort_no_iss(int same_el,
int ea, int cm, int s1ptw,
int wnr, int fsc)
import
2015-08-21 07:04:50 +00:00
{
return (EC_DATAABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
target-arm: Split data abort syndrome generator Split the data abort syndrome generator into two versions: One with a valid Instruction Specific Syndrome (ISS) and another without. The following new flags are supported by the syndrome generator with ISS: * isv - Instruction syndrome valid * sas - Syndrome access size * sse - Syndrome sign extend * srt - Syndrome register transfer * sf - Sixty-Four bit register width * ar - Acquire/Release These flags are not yet used, so this patch has no functional change except that we will now correctly set the IL bit in data abort syndromes without ISS information. Backports commit 094d028a7968236cd2b7f7b96394f7a3b8ad97c8 from qemu
2018-02-24 01:02:54 +00:00
| ARM_EL_IL
| (ea << 9) | (cm << 8) | (s1ptw << 7) | (wnr << 6) | fsc;
}
static inline uint32_t syn_data_abort_with_iss(int same_el,
int sas, int sse, int srt,
int sf, int ar,
int ea, int cm, int s1ptw,
int wnr, int fsc,
bool is_16bit)
{
return (EC_DATAABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
| (is_16bit ? 0 : ARM_EL_IL)
| ARM_EL_ISV | (sas << 22) | (sse << 21) | (srt << 16)
| (sf << 15) | (ar << 14)
| (ea << 9) | (cm << 8) | (s1ptw << 7) | (wnr << 6) | fsc;
import
2015-08-21 07:04:50 +00:00
}
static inline uint32_t syn_swstep(int same_el, int isv, int ex)
{
return (EC_SOFTWARESTEP << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
target-arm: Set IL bit in syndromes for insn abort, watchpoint, swstep For some exception syndrome types, the IL bit should always be set. This includes the instruction abort, watchpoint and software step syndrome types; add the missing ARM_EL_IL bit to the syndrome values returned by syn_insn_abort(), syn_swstep() and syn_watchpoint(). Backports commit 04ce861ea545477425ad9e045eec3f61c8a27df9 from qemu
2018-02-24 21:48:48 +00:00
| ARM_EL_IL | (isv << 24) | (ex << 6) | 0x22;
import
2015-08-21 07:04:50 +00:00
}
static inline uint32_t syn_watchpoint(int same_el, int cm, int wnr)
{
return (EC_WATCHPOINT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
target-arm: Set IL bit in syndromes for insn abort, watchpoint, swstep For some exception syndrome types, the IL bit should always be set. This includes the instruction abort, watchpoint and software step syndrome types; add the missing ARM_EL_IL bit to the syndrome values returned by syn_insn_abort(), syn_swstep() and syn_watchpoint(). Backports commit 04ce861ea545477425ad9e045eec3f61c8a27df9 from qemu
2018-02-24 21:48:48 +00:00
| ARM_EL_IL | (cm << 8) | (wnr << 6) | 0x22;
import
2015-08-21 07:04:50 +00:00
}
static inline uint32_t syn_breakpoint(int same_el)
{
return (EC_BREAKPOINT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
| ARM_EL_IL | 0x22;
}
fix WFI/WFE length in syndrome register WFI/E are often, but not always, 4 bytes long. When they are, we need to set ARM_EL_IL_SHIFT in the syndrome register. Pass the instruction length to HELPER(wfi), use it to decrement pc appropriately and to pass an is_16bit flag to syn_wfx, which sets ARM_EL_IL_SHIFT if needed. Set dc->insn in both arm_tr_translate_insn and thumb_tr_translate_insn. Backports commit 58803318e5a546b2eb0efd7a053ed36b6c29ae6f from qemu
2018-03-05 16:21:40 +00:00
static inline uint32_t syn_wfx(int cv, int cond, int ti, bool is_16bit)
target-arm: Add WFx syndrome function Adds a utility function for creating a WFx exception syndrome Backports commit 06fbb2fdf7a7ac468d62c66cfe4537d3c71f7bb9 from qemu
2018-02-13 02:33:00 +00:00
{
return (EC_WFX_TRAP << ARM_EL_EC_SHIFT) |
fix WFI/WFE length in syndrome register WFI/E are often, but not always, 4 bytes long. When they are, we need to set ARM_EL_IL_SHIFT in the syndrome register. Pass the instruction length to HELPER(wfi), use it to decrement pc appropriately and to pass an is_16bit flag to syn_wfx, which sets ARM_EL_IL_SHIFT if needed. Set dc->insn in both arm_tr_translate_insn and thumb_tr_translate_insn. Backports commit 58803318e5a546b2eb0efd7a053ed36b6c29ae6f from qemu
2018-03-05 16:21:40 +00:00
(is_16bit ? 0 : (1 << ARM_EL_IL_SHIFT)) |
target-arm: Add WFx syndrome function Adds a utility function for creating a WFx exception syndrome Backports commit 06fbb2fdf7a7ac468d62c66cfe4537d3c71f7bb9 from qemu
2018-02-13 02:33:00 +00:00
(cv << 24) | (cond << 20) | ti;
}
import
2015-08-21 07:04:50 +00:00
/* Update a QEMU watchpoint based on the information the guest has set in the
* DBGWCR<n>_EL1 and DBGWVR<n>_EL1 registers.
*/
void hw_watchpoint_update(ARMCPU *cpu, int n);
/* Update the QEMU watchpoints for every guest watchpoint. This does a
* complete delete-and-reinstate of the QEMU watchpoint list and so is
* suitable for use after migration or on reset.
*/
void hw_watchpoint_update_all(ARMCPU *cpu);
/* Update a QEMU breakpoint based on the information the guest has set in the
* DBGBCR<n>_EL1 and DBGBVR<n>_EL1 registers.
*/
void hw_breakpoint_update(ARMCPU *cpu, int n);
/* Update the QEMU breakpoints for every guest breakpoint. This does a
* complete delete-and-reinstate of the QEMU breakpoint list and so is
* suitable for use after migration or on reset.
*/
void hw_breakpoint_update_all(ARMCPU *cpu);
target-arm: Implement checking of fired watchpoint ARM stops before access to a location covered by watchpoint. Also, QEMU watchpoint fire is not necessarily an architectural watchpoint match. Unfortunately, that is hardly possible to ignore a fired watchpoint in debug exception handler. So move watchpoint check from debug exception handler to the dedicated watchpoint checking callback. Backports commit 3826121d9298cde1d29ead05910e1f40125ee9b0 from qemu
2018-02-20 16:50:26 +00:00
/* Callback function for checking if a watchpoint should trigger. */
bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
arm: Correctly handle watchpoints for BE32 CPUs In BE32 mode, sub-word size watchpoints can fail to trigger because the address of the access is adjusted in the opcode helpers before being compared with the watchpoint registers. This patch reverses the address adjustment before performing the comparison with the help of a new CPUClass hook. This version of the patch augments and tidies up comments a little. Backports commit 40612000599e52e792d23c998377a0fa429c4036 from qemu
2018-03-02 05:24:19 +00:00
/* Adjust addresses (in BE32 mode) before testing against watchpoint
* addresses.
*/
vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len);
import
2015-08-21 07:04:50 +00:00
/* Callback function for when a watchpoint or breakpoint triggers. */
void arm_debug_excp_handler(CPUState *cs);
#ifdef CONFIG_USER_ONLY
static inline bool arm_is_psci_call(ARMCPU *cpu, int excp_type)
{
return false;
}
#else
/* Return true if the r0/x0 value indicates that this SMC/HVC is a PSCI call. */
bool arm_is_psci_call(ARMCPU *cpu, int excp_type);
/* Actually handle a PSCI call */
void arm_handle_psci_call(ARMCPU *cpu);
#endif
target/arm: Clear exclusive monitor on v7M reset, exception entry/exit For M profile we must clear the exclusive monitor on reset, exception entry and exception exit. We weren't doing any of these things; fix this bug. Backports commit dc3c4c14f0f12854dbd967be3486f4db4e66d25b from qemu
2018-03-05 04:09:38 +00:00
/**
* arm_clear_exclusive: clear the exclusive monitor
* @env: CPU env
* Clear the CPU's exclusive monitor, like the guest CLREX instruction.
*/
static inline void arm_clear_exclusive(CPUARMState *env)
{
env->exclusive_addr = -1;
}
target/arm: Provide fault type enum and FSR conversion functions Currently get_phys_addr() and its various subfunctions return a hard-coded fault status register value for translation failures. This is awkward because FSR values these days may be either long-descriptor format or short-descriptor format. Worse, the right FSR type to use doesn't depend only on the translation table being walked -- some cases, like fault info reported to AArch32 EL2 for some kinds of ATS operation, must be in long-descriptor format even if the translation table being walked was short format. We can't get those cases right with our current approach. Provide fields in the ARMMMUFaultInfo struct which allow get_phys_addr() to provide sufficient information for a caller to construct an FSR value themselves, and utility functions which do this for both long and short format FSR values, as a first step in switching get_phys_addr() and its children to only returning the failure cause in the ARMMMUFaultInfo struct. Backports commit 1fa498fe0de979030bd1f481046e9f1c5574a584 from qemu
2018-03-05 18:30:26 +00:00
/**
* ARMFaultType: type of an ARM MMU fault
* This corresponds to the v8A pseudocode's Fault enumeration,
* with extensions for QEMU internal conditions.
*/
typedef enum ARMFaultType {
ARMFault_None,
ARMFault_AccessFlag,
ARMFault_Alignment,
ARMFault_Background,
ARMFault_Domain,
ARMFault_Permission,
ARMFault_Translation,
ARMFault_AddressSize,
ARMFault_SyncExternal,
ARMFault_SyncExternalOnWalk,
ARMFault_SyncParity,
ARMFault_SyncParityOnWalk,
ARMFault_AsyncParity,
ARMFault_AsyncExternal,
ARMFault_Debug,
ARMFault_TLBConflict,
ARMFault_Lockdown,
ARMFault_Exclusive,
ARMFault_ICacheMaint,
ARMFault_QEMU_NSCExec, /* v8M: NS executing in S&NSC memory */
ARMFault_QEMU_SFault, /* v8M: SecureFault INVTRAN, INVEP or AUVIOL */
} ARMFaultType;
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
/**
* ARMMMUFaultInfo: Information describing an ARM MMU Fault
target/arm: Provide fault type enum and FSR conversion functions Currently get_phys_addr() and its various subfunctions return a hard-coded fault status register value for translation failures. This is awkward because FSR values these days may be either long-descriptor format or short-descriptor format. Worse, the right FSR type to use doesn't depend only on the translation table being walked -- some cases, like fault info reported to AArch32 EL2 for some kinds of ATS operation, must be in long-descriptor format even if the translation table being walked was short format. We can't get those cases right with our current approach. Provide fields in the ARMMMUFaultInfo struct which allow get_phys_addr() to provide sufficient information for a caller to construct an FSR value themselves, and utility functions which do this for both long and short format FSR values, as a first step in switching get_phys_addr() and its children to only returning the failure cause in the ARMMMUFaultInfo struct. Backports commit 1fa498fe0de979030bd1f481046e9f1c5574a584 from qemu
2018-03-05 18:30:26 +00:00
* @type: Type of fault
* @level: Table walk level (for translation, access flag and permission faults)
* @domain: Domain of the fault address (for non-LPAE CPUs only)
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
* @s2addr: Address that caused a fault at stage 2
* @stage2: True if we faulted at stage 2
* @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk
target/arm: Allow deliver_fault() caller to specify EA bit For external aborts, we will want to be able to specify the EA (external abort type) bit in the syndrome field. Allow callers of deliver_fault() to do that by adding a field to ARMMMUFaultInfo which we use when constructing the syndrome values. Backports commit c528af7aa64f159eb30b46e567b650c5440fc117 from qemu
2018-03-04 18:20:21 +00:00
* @ea: True if we should set the EA (external abort type) bit in syndrome
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
*/
typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
struct ARMMMUFaultInfo {
target/arm: Provide fault type enum and FSR conversion functions Currently get_phys_addr() and its various subfunctions return a hard-coded fault status register value for translation failures. This is awkward because FSR values these days may be either long-descriptor format or short-descriptor format. Worse, the right FSR type to use doesn't depend only on the translation table being walked -- some cases, like fault info reported to AArch32 EL2 for some kinds of ATS operation, must be in long-descriptor format even if the translation table being walked was short format. We can't get those cases right with our current approach. Provide fields in the ARMMMUFaultInfo struct which allow get_phys_addr() to provide sufficient information for a caller to construct an FSR value themselves, and utility functions which do this for both long and short format FSR values, as a first step in switching get_phys_addr() and its children to only returning the failure cause in the ARMMMUFaultInfo struct. Backports commit 1fa498fe0de979030bd1f481046e9f1c5574a584 from qemu
2018-03-05 18:30:26 +00:00
ARMFaultType type;
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
target_ulong s2addr;
target/arm: Provide fault type enum and FSR conversion functions Currently get_phys_addr() and its various subfunctions return a hard-coded fault status register value for translation failures. This is awkward because FSR values these days may be either long-descriptor format or short-descriptor format. Worse, the right FSR type to use doesn't depend only on the translation table being walked -- some cases, like fault info reported to AArch32 EL2 for some kinds of ATS operation, must be in long-descriptor format even if the translation table being walked was short format. We can't get those cases right with our current approach. Provide fields in the ARMMMUFaultInfo struct which allow get_phys_addr() to provide sufficient information for a caller to construct an FSR value themselves, and utility functions which do this for both long and short format FSR values, as a first step in switching get_phys_addr() and its children to only returning the failure cause in the ARMMMUFaultInfo struct. Backports commit 1fa498fe0de979030bd1f481046e9f1c5574a584 from qemu
2018-03-05 18:30:26 +00:00
int level;
int domain;
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
bool stage2;
bool s1ptw;
target/arm: Allow deliver_fault() caller to specify EA bit For external aborts, we will want to be able to specify the EA (external abort type) bit in the syndrome field. Allow callers of deliver_fault() to do that by adding a field to ARMMMUFaultInfo which we use when constructing the syndrome values. Backports commit c528af7aa64f159eb30b46e567b650c5440fc117 from qemu
2018-03-04 18:20:21 +00:00
bool ea;
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
};
target/arm: Provide fault type enum and FSR conversion functions Currently get_phys_addr() and its various subfunctions return a hard-coded fault status register value for translation failures. This is awkward because FSR values these days may be either long-descriptor format or short-descriptor format. Worse, the right FSR type to use doesn't depend only on the translation table being walked -- some cases, like fault info reported to AArch32 EL2 for some kinds of ATS operation, must be in long-descriptor format even if the translation table being walked was short format. We can't get those cases right with our current approach. Provide fields in the ARMMMUFaultInfo struct which allow get_phys_addr() to provide sufficient information for a caller to construct an FSR value themselves, and utility functions which do this for both long and short format FSR values, as a first step in switching get_phys_addr() and its children to only returning the failure cause in the ARMMMUFaultInfo struct. Backports commit 1fa498fe0de979030bd1f481046e9f1c5574a584 from qemu
2018-03-05 18:30:26 +00:00
/**
* arm_fi_to_sfsc: Convert fault info struct to short-format FSC
* Compare pseudocode EncodeSDFSC(), though unlike that function
* we set up a whole FSR-format code including domain field and
* putting the high bit of the FSC into bit 10.
*/
static inline uint32_t arm_fi_to_sfsc(ARMMMUFaultInfo *fi)
{
uint32_t fsc;
switch (fi->type) {
case ARMFault_None:
return 0;
case ARMFault_AccessFlag:
fsc = fi->level == 1 ? 0x3 : 0x6;
break;
case ARMFault_Alignment:
fsc = 0x1;
break;
case ARMFault_Permission:
fsc = fi->level == 1 ? 0xd : 0xf;
break;
case ARMFault_Domain:
fsc = fi->level == 1 ? 0x9 : 0xb;
break;
case ARMFault_Translation:
fsc = fi->level == 1 ? 0x5 : 0x7;
break;
case ARMFault_SyncExternal:
fsc = 0x8 | (fi->ea << 12);
break;
case ARMFault_SyncExternalOnWalk:
fsc = fi->level == 1 ? 0xc : 0xe;
fsc |= (fi->ea << 12);
break;
case ARMFault_SyncParity:
fsc = 0x409;
break;
case ARMFault_SyncParityOnWalk:
fsc = fi->level == 1 ? 0x40c : 0x40e;
break;
case ARMFault_AsyncParity:
fsc = 0x408;
break;
case ARMFault_AsyncExternal:
fsc = 0x406 | (fi->ea << 12);
break;
case ARMFault_Debug:
fsc = 0x2;
break;
case ARMFault_TLBConflict:
fsc = 0x400;
break;
case ARMFault_Lockdown:
fsc = 0x404;
break;
case ARMFault_Exclusive:
fsc = 0x405;
break;
case ARMFault_ICacheMaint:
fsc = 0x4;
break;
case ARMFault_Background:
fsc = 0x0;
break;
case ARMFault_QEMU_NSCExec:
fsc = M_FAKE_FSR_NSC_EXEC;
break;
case ARMFault_QEMU_SFault:
fsc = M_FAKE_FSR_SFAULT;
break;
default:
/* Other faults can't occur in a context that requires a
* short-format status code.
*/
g_assert_not_reached();
}
fsc |= (fi->domain << 4);
return fsc;
}
/**
* arm_fi_to_lfsc: Convert fault info struct to long-format FSC
* Compare pseudocode EncodeLDFSC(), though unlike that function
* we fill in also the LPAE bit 9 of a DFSR format.
*/
static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
{
uint32_t fsc;
switch (fi->type) {
case ARMFault_None:
return 0;
case ARMFault_AddressSize:
fsc = fi->level & 3;
break;
case ARMFault_AccessFlag:
fsc = (fi->level & 3) | (0x2 << 2);
break;
case ARMFault_Permission:
fsc = (fi->level & 3) | (0x3 << 2);
break;
case ARMFault_Translation:
fsc = (fi->level & 3) | (0x1 << 2);
break;
case ARMFault_SyncExternal:
fsc = 0x10 | (fi->ea << 12);
break;
case ARMFault_SyncExternalOnWalk:
fsc = (fi->level & 3) | (0x5 << 2) | (fi->ea << 12);
break;
case ARMFault_SyncParity:
fsc = 0x18;
break;
case ARMFault_SyncParityOnWalk:
fsc = (fi->level & 3) | (0x7 << 2);
break;
case ARMFault_AsyncParity:
fsc = 0x19;
break;
case ARMFault_AsyncExternal:
fsc = 0x11 | (fi->ea << 12);
break;
case ARMFault_Alignment:
fsc = 0x21;
break;
case ARMFault_Debug:
fsc = 0x22;
break;
case ARMFault_TLBConflict:
fsc = 0x30;
break;
case ARMFault_Lockdown:
fsc = 0x34;
break;
case ARMFault_Exclusive:
fsc = 0x35;
break;
default:
/* Other faults can't occur in a context that requires a
* long-format status code.
*/
g_assert_not_reached();
}
fsc |= 1 << 9;
return fsc;
}
target-arm: Move setting of exception info into tlb_fill Move the code which sets exception information out of arm_cpu_handle_mmu_fault and into tlb_fill. tlb_fill is the only caller which wants to raise_exception() so it makes more sense for it to handle the whole of the exception setup. As part of this cleanup, move the user-mode-only implementation function for the handle_mmu_fault CPU method into cpu.c so we don't need to make it globally visible, and rename the softmmu-only utility function arm_cpu_handle_mmu_fault to arm_tlb_fill so it's clear that it's not the same thing. Backports commit 8c6084bf10fe721929ca94cf16acd6687e61d3ec from qemu
2018-02-13 03:26:33 +00:00
/* Do a page table walk and add page to TLB if possible */
target/arm: Use MMUAccessType enum rather than int In the ARM get_phys_addr() code, switch to using the MMUAccessType enum and its MMU_* values rather than int and literal 0/1/2. Backports commit 03ae85f858fc46495258a5dd4551fff2c34bd495 from qemu
2018-03-04 17:45:10 +00:00
bool arm_tlb_fill(CPUState *cpu, vaddr address,
MMUAccessType access_type, int mmu_idx,
target/arm: Extend PAR format determination Now that do_ats_write() is entirely in control of whether to generate a 32-bit PAR or a 64-bit PAR, we can make it use the correct (complicated) condition for doing so. Backports commit 1313e2d7e2cd8b21741e0cf542eb09dfc4188f79 from qemu
2018-03-05 19:08:43 +00:00
ARMMMUFaultInfo *fi);
target-arm: Move setting of exception info into tlb_fill Move the code which sets exception information out of arm_cpu_handle_mmu_fault and into tlb_fill. tlb_fill is the only caller which wants to raise_exception() so it makes more sense for it to handle the whole of the exception setup. As part of this cleanup, move the user-mode-only implementation function for the handle_mmu_fault CPU method into cpu.c so we don't need to make it globally visible, and rename the softmmu-only utility function arm_cpu_handle_mmu_fault to arm_tlb_fill so it's clear that it's not the same thing. Backports commit 8c6084bf10fe721929ca94cf16acd6687e61d3ec from qemu
2018-02-13 03:26:33 +00:00
target-arm: Use the right MMU index in arm_regime_using_lpae_format arm_regime_using_lpae_format checks whether the LPAE extension is used for stage 1 translation regimes. MMU indexes not exclusively of a stage 1 regime won't work with this method. In case of ARMMMUIdx_S12NSE0 or ARMMMUIdx_S12NSE1, offset these values by ARMMMUIdx_S1NSE0 to get the right index indicating a stage 1 translation regime. Rename also the function to arm_s1_regime_using_lpae_format and update the comments to reflect the change. Backports commit deb2db996cbb9470b39ae1e383791ef34c4eb3c2 from qemu
2018-02-18 01:54:16 +00:00
/* Return true if the stage 1 translation regime is using LPAE format page
* tables */
bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx);
target-arm: raise exception on misaligned LDREX operands Qemu does not generally perform alignment checks. However, the ARM ARM requires implementation of alignment exceptions for a number of cases including LDREX, and Windows-on-ARM relies on this. This change adds plumbing to enable alignment checks on loads using MO_ALIGN, a do_unaligned_access hook to raise the exception (data abort), and uses the new aligned loads in LDREX (for all but single-byte loads). Backports commit 30901475b91ef1f46304404ab4bfe89097f61b96 from qemu
2018-02-18 00:28:14 +00:00
/* Raise a data fault alignment exception for the specified virtual address */
Fix confusing argument names in some common functions There are functions tlb_fill(), cpu_unaligned_access() and do_unaligned_access() that are called with access type and mmu index arguments. But these arguments are named 'is_write' and 'is_user' in their declarations. The patches fix the arguments to avoid a confusion. Backports commit b35399bb4e9968296a12303b00f9f2066470e987 from qemu
2018-02-25 08:52:50 +00:00
void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
MMUAccessType access_type,
int mmu_idx, uintptr_t retaddr);
target-arm: raise exception on misaligned LDREX operands Qemu does not generally perform alignment checks. However, the ARM ARM requires implementation of alignment exceptions for a number of cases including LDREX, and Windows-on-ARM relies on this. This change adds plumbing to enable alignment checks on loads using MO_ALIGN, a do_unaligned_access hook to raise the exception (data abort), and uses the new aligned loads in LDREX (for all but single-byte loads). Backports commit 30901475b91ef1f46304404ab4bfe89097f61b96 from qemu
2018-02-18 00:28:14 +00:00
boards.h: Define new flag ignore_memory_transaction_failures Define a new MachineClass field ignore_memory_transaction_failures. If this is flag is true then the CPU will ignore memory transaction failures which should cause the CPU to take an exception due to an access to an unassigned physical address; the transaction will instead return zero (for a read) or be ignored (for a write). This should be set only by legacy board models which rely on the old RAZ/WI behaviour for handling devices that QEMU does not yet model. New board models should instead use "unimplemented-device" for all memory ranges where the guest will attempt to probe for a device that QEMU doesn't implement and a stub device is required. We need this for ARM boards, where we're about to implement support for generating external aborts on memory transaction failures. Too many of our legacy board models rely on the RAZ/WI behaviour and we would break currently working guests when their "probe for device" code provoked an external abort rather than a RAZ. Backports commit ed860129acd3fcd0b1e47884e810212aaca4d21b from qemu
2018-03-05 02:25:04 +00:00
/* arm_cpu_do_transaction_failed: handle a memory system error response
* (eg "no device/memory present at address") by raising an external abort
* exception
*/
void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
vaddr addr, unsigned size,
MMUAccessType access_type,
int mmu_idx, MemTxAttrs attrs,
MemTxResult response, uintptr_t retaddr);
target-arm: Provide hook to tell GICv3 about changes of security state The GICv3 CPU interface needs to know when the CPU it is attached to makes an exception level or mode transition that changes the security state, because whether it is asserting IRQ or FIQ can change depending on these things. Provide a mechanism for letting the GICv3 device register a hook to be called on such changes. Backports commit bd7d00fc50c9960876dd194ebf0c88889b53e765 from qemu
2018-02-25 00:07:35 +00:00
/* Call the EL change hook if one has been registered */
static inline void arm_call_el_change_hook(ARMCPU *cpu)
{
if (cpu->el_change_hook) {
cpu->el_change_hook(cpu, cpu->el_change_hook_opaque);
}
}
target/arm: Move regime_is_secure() to target/arm/internals.h Move the regime_is_secure() utility function to internals.h; we are going to want to call it from translate.c. Backports commit 61fcd69b0db268e7612b07fadc436b93def91768 from qemu
2018-03-05 02:14:04 +00:00
/* Return true if this address translation regime is secure */
static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
{
switch (mmu_idx) {
case ARMMMUIdx_S12NSE0:
case ARMMMUIdx_S12NSE1:
case ARMMMUIdx_S1NSE0:
case ARMMMUIdx_S1NSE1:
case ARMMMUIdx_S1E2:
case ARMMMUIdx_S2NS:
target/arm: Split M profile MNegPri mmu index into user and priv For M profile, we currently have an mmu index MNegPri for "requested execution priority negative". This fails to distinguish "requested execution priority negative, privileged" from "requested execution priority negative, usermode", but the two can return different results for MPU lookups. Fix this by splitting MNegPri into MNegPriPriv and MNegPriUser, and similarly for the Secure equivalent MSNegPri. This takes us from 6 M profile MMU modes to 8, which means we need to bump NB_MMU_MODES; this is OK since the point where we are forced to reduce TLB sizes is 9 MMU modes. (It would in theory be possible to stick with 6 MMU indexes: {mpu-disabled,user,privileged} x {secure,nonsecure} since in the MPU-disabled case the result of an MPU lookup is always the same for both user and privileged code. However we would then need to rework the TB flags handling to put user/priv into the TB flags separately from the mmuidx. Adding an extra couple of mmu indexes is simpler.) Backports commit 62593718d77c06ad2b5e942727cead40775d2395 from qemu
2018-03-05 18:13:42 +00:00
case ARMMMUIdx_MPrivNegPri:
case ARMMMUIdx_MUserNegPri:
target/arm: Move regime_is_secure() to target/arm/internals.h Move the regime_is_secure() utility function to internals.h; we are going to want to call it from translate.c. Backports commit 61fcd69b0db268e7612b07fadc436b93def91768 from qemu
2018-03-05 02:14:04 +00:00
case ARMMMUIdx_MPriv:
case ARMMMUIdx_MUser:
return false;
case ARMMMUIdx_S1E3:
case ARMMMUIdx_S1SE0:
case ARMMMUIdx_S1SE1:
target/arm: Split M profile MNegPri mmu index into user and priv For M profile, we currently have an mmu index MNegPri for "requested execution priority negative". This fails to distinguish "requested execution priority negative, privileged" from "requested execution priority negative, usermode", but the two can return different results for MPU lookups. Fix this by splitting MNegPri into MNegPriPriv and MNegPriUser, and similarly for the Secure equivalent MSNegPri. This takes us from 6 M profile MMU modes to 8, which means we need to bump NB_MMU_MODES; this is OK since the point where we are forced to reduce TLB sizes is 9 MMU modes. (It would in theory be possible to stick with 6 MMU indexes: {mpu-disabled,user,privileged} x {secure,nonsecure} since in the MPU-disabled case the result of an MPU lookup is always the same for both user and privileged code. However we would then need to rework the TB flags handling to put user/priv into the TB flags separately from the mmuidx. Adding an extra couple of mmu indexes is simpler.) Backports commit 62593718d77c06ad2b5e942727cead40775d2395 from qemu
2018-03-05 18:13:42 +00:00
case ARMMMUIdx_MSPrivNegPri:
case ARMMMUIdx_MSUserNegPri:
target/arm: Move regime_is_secure() to target/arm/internals.h Move the regime_is_secure() utility function to internals.h; we are going to want to call it from translate.c. Backports commit 61fcd69b0db268e7612b07fadc436b93def91768 from qemu
2018-03-05 02:14:04 +00:00
case ARMMMUIdx_MSPriv:
case ARMMMUIdx_MSUser:
return true;
default:
g_assert_not_reached();
}
}
import
2015-08-21 07:04:50 +00:00
#endif
Reference in a new issue Copy permalink