Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20220126...
[qemu.git] / target / arm / tlb_helper.c
1 /*
2 * ARM TLB (Translation lookaside buffer) helpers.
3 *
4 * This code is licensed under the GNU GPL v2 or later.
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8 #include "qemu/osdep.h"
9 #include "cpu.h"
10 #include "internals.h"
11 #include "exec/exec-all.h"
12 #include "exec/helper-proto.h"
13
14 static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
15 unsigned int target_el,
16 bool same_el, bool ea,
17 bool s1ptw, bool is_write,
18 int fsc)
19 {
20 uint32_t syn;
21
22 /*
23 * ISV is only set for data aborts routed to EL2 and
24 * never for stage-1 page table walks faulting on stage 2.
25 *
26 * Furthermore, ISV is only set for certain kinds of load/stores.
27 * If the template syndrome does not have ISV set, we should leave
28 * it cleared.
29 *
30 * See ARMv8 specs, D7-1974:
31 * ISS encoding for an exception from a Data Abort, the
32 * ISV field.
33 */
34 if (!(template_syn & ARM_EL_ISV) || target_el != 2 || s1ptw) {
35 syn = syn_data_abort_no_iss(same_el, 0,
36 ea, 0, s1ptw, is_write, fsc);
37 } else {
38 /*
39 * Fields: IL, ISV, SAS, SSE, SRT, SF and AR come from the template
40 * syndrome created at translation time.
41 * Now we create the runtime syndrome with the remaining fields.
42 */
43 syn = syn_data_abort_with_iss(same_el,
44 0, 0, 0, 0, 0,
45 ea, 0, s1ptw, is_write, fsc,
46 true);
47 /* Merge the runtime syndrome with the template syndrome. */
48 syn |= template_syn;
49 }
50 return syn;
51 }
52
53 static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
54 int target_el, int mmu_idx, uint32_t *ret_fsc)
55 {
56 ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
57 uint32_t fsr, fsc;
58
59 if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
60 arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
61 /*
62 * LPAE format fault status register : bottom 6 bits are
63 * status code in the same form as needed for syndrome
64 */
65 fsr = arm_fi_to_lfsc(fi);
66 fsc = extract32(fsr, 0, 6);
67 } else {
68 fsr = arm_fi_to_sfsc(fi);
69 /*
70 * Short format FSR : this fault will never actually be reported
71 * to an EL that uses a syndrome register. Use a (currently)
72 * reserved FSR code in case the constructed syndrome does leak
73 * into the guest somehow.
74 */
75 fsc = 0x3f;
76 }
77
78 *ret_fsc = fsc;
79 return fsr;
80 }
81
82 static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,
83 MMUAccessType access_type,
84 int mmu_idx, ARMMMUFaultInfo *fi)
85 {
86 CPUARMState *env = &cpu->env;
87 int target_el;
88 bool same_el;
89 uint32_t syn, exc, fsr, fsc;
90
91 target_el = exception_target_el(env);
92 if (fi->stage2) {
93 target_el = 2;
94 env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
95 if (arm_is_secure_below_el3(env) && fi->s1ns) {
96 env->cp15.hpfar_el2 |= HPFAR_NS;
97 }
98 }
99 same_el = (arm_current_el(env) == target_el);
100
101 fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
102
103 if (access_type == MMU_INST_FETCH) {
104 syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
105 exc = EXCP_PREFETCH_ABORT;
106 } else {
107 syn = merge_syn_data_abort(env->exception.syndrome, target_el,
108 same_el, fi->ea, fi->s1ptw,
109 access_type == MMU_DATA_STORE,
110 fsc);
111 if (access_type == MMU_DATA_STORE
112 && arm_feature(env, ARM_FEATURE_V6)) {
113 fsr |= (1 << 11);
114 }
115 exc = EXCP_DATA_ABORT;
116 }
117
118 env->exception.vaddress = addr;
119 env->exception.fsr = fsr;
120 raise_exception(env, exc, syn, target_el);
121 }
122
123 /* Raise a data fault alignment exception for the specified virtual address */
124 void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
125 MMUAccessType access_type,
126 int mmu_idx, uintptr_t retaddr)
127 {
128 ARMCPU *cpu = ARM_CPU(cs);
129 ARMMMUFaultInfo fi = {};
130
131 /* now we have a real cpu fault */
132 cpu_restore_state(cs, retaddr, true);
133
134 fi.type = ARMFault_Alignment;
135 arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi);
136 }
137
138 void helper_exception_pc_alignment(CPUARMState *env, target_ulong pc)
139 {
140 ARMMMUFaultInfo fi = { .type = ARMFault_Alignment };
141 int target_el = exception_target_el(env);
142 int mmu_idx = cpu_mmu_index(env, true);
143 uint32_t fsc;
144
145 env->exception.vaddress = pc;
146
147 /*
148 * Note that the fsc is not applicable to this exception,
149 * since any syndrome is pcalignment not insn_abort.
150 */
151 env->exception.fsr = compute_fsr_fsc(env, &fi, target_el, mmu_idx, &fsc);
152 raise_exception(env, EXCP_PREFETCH_ABORT, syn_pcalignment(), target_el);
153 }
154
155 #if !defined(CONFIG_USER_ONLY)
156
157 /*
158 * arm_cpu_do_transaction_failed: handle a memory system error response
159 * (eg "no device/memory present at address") by raising an external abort
160 * exception
161 */
162 void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
163 vaddr addr, unsigned size,
164 MMUAccessType access_type,
165 int mmu_idx, MemTxAttrs attrs,
166 MemTxResult response, uintptr_t retaddr)
167 {
168 ARMCPU *cpu = ARM_CPU(cs);
169 ARMMMUFaultInfo fi = {};
170
171 /* now we have a real cpu fault */
172 cpu_restore_state(cs, retaddr, true);
173
174 fi.ea = arm_extabort_type(response);
175 fi.type = ARMFault_SyncExternal;
176 arm_deliver_fault(cpu, addr, access_type, mmu_idx, &fi);
177 }
178
179 bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
180 MMUAccessType access_type, int mmu_idx,
181 bool probe, uintptr_t retaddr)
182 {
183 ARMCPU *cpu = ARM_CPU(cs);
184 ARMMMUFaultInfo fi = {};
185 hwaddr phys_addr;
186 target_ulong page_size;
187 int prot, ret;
188 MemTxAttrs attrs = {};
189 ARMCacheAttrs cacheattrs = {};
190
191 /*
192 * Walk the page table and (if the mapping exists) add the page
193 * to the TLB. On success, return true. Otherwise, if probing,
194 * return false. Otherwise populate fsr with ARM DFSR/IFSR fault
195 * register format, and signal the fault.
196 */
197 ret = get_phys_addr(&cpu->env, address, access_type,
198 core_to_arm_mmu_idx(&cpu->env, mmu_idx),
199 &phys_addr, &attrs, &prot, &page_size,
200 &fi, &cacheattrs);
201 if (likely(!ret)) {
202 /*
203 * Map a single [sub]page. Regions smaller than our declared
204 * target page size are handled specially, so for those we
205 * pass in the exact addresses.
206 */
207 if (page_size >= TARGET_PAGE_SIZE) {
208 phys_addr &= TARGET_PAGE_MASK;
209 address &= TARGET_PAGE_MASK;
210 }
211 /* Notice and record tagged memory. */
212 if (cpu_isar_feature(aa64_mte, cpu) && cacheattrs.attrs == 0xf0) {
213 arm_tlb_mte_tagged(&attrs) = true;
214 }
215
216 tlb_set_page_with_attrs(cs, address, phys_addr, attrs,
217 prot, mmu_idx, page_size);
218 return true;
219 } else if (probe) {
220 return false;
221 } else {
222 /* now we have a real cpu fault */
223 cpu_restore_state(cs, retaddr, true);
224 arm_deliver_fault(cpu, address, access_type, mmu_idx, &fi);
225 }
226 }
227 #else
228 void arm_cpu_record_sigsegv(CPUState *cs, vaddr addr,
229 MMUAccessType access_type,
230 bool maperr, uintptr_t ra)
231 {
232 ARMMMUFaultInfo fi = {
233 .type = maperr ? ARMFault_Translation : ARMFault_Permission,
234 .level = 3,
235 };
236 ARMCPU *cpu = ARM_CPU(cs);
237
238 /*
239 * We report both ESR and FAR to signal handlers.
240 * For now, it's easiest to deliver the fault normally.
241 */
242 cpu_restore_state(cs, ra, true);
243 arm_deliver_fault(cpu, addr, access_type, MMU_USER_IDX, &fi);
244 }
245
246 void arm_cpu_record_sigbus(CPUState *cs, vaddr addr,
247 MMUAccessType access_type, uintptr_t ra)
248 {
249 arm_cpu_do_unaligned_access(cs, addr, access_type, MMU_USER_IDX, ra);
250 }
251 #endif /* !defined(CONFIG_USER_ONLY) */