mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-09-06 18:05:37 +00:00
![Richard Henderson](/assets/img/avatar_default.png)
These functions are used for both page table walking and for deciding what format in which to deliver exception results. Since ptw.c is only present for system mode, put the functions into tlb_helper.c. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220604040607.269301-18-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
279 lines
9.2 KiB
C
279 lines
9.2 KiB
C
/*
|
|
* ARM TLB (Translation lookaside buffer) helpers.
|
|
*
|
|
* This code is licensed under the GNU GPL v2 or later.
|
|
*
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
|
*/
|
|
#include "qemu/osdep.h"
|
|
#include "cpu.h"
|
|
#include "internals.h"
|
|
#include "exec/exec-all.h"
|
|
#include "exec/helper-proto.h"
|
|
|
|
|
|
/* Return true if the translation regime is using LPAE format page tables */
|
|
bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
|
|
{
|
|
int el = regime_el(env, mmu_idx);
|
|
if (el == 2 || arm_el_is_aa64(env, el)) {
|
|
return true;
|
|
}
|
|
if (arm_feature(env, ARM_FEATURE_LPAE)
|
|
&& (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* Returns true if the stage 1 translation regime is using LPAE format page
|
|
* tables. Used when raising alignment exceptions, whose FSR changes depending
|
|
* on whether the long or short descriptor format is in use.
|
|
*/
|
|
bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
|
|
{
|
|
mmu_idx = stage_1_mmu_idx(mmu_idx);
|
|
return regime_using_lpae_format(env, mmu_idx);
|
|
}
|
|
|
|
static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
|
|
unsigned int target_el,
|
|
bool same_el, bool ea,
|
|
bool s1ptw, bool is_write,
|
|
int fsc)
|
|
{
|
|
uint32_t syn;
|
|
|
|
/*
|
|
* ISV is only set for data aborts routed to EL2 and
|
|
* never for stage-1 page table walks faulting on stage 2.
|
|
*
|
|
* Furthermore, ISV is only set for certain kinds of load/stores.
|
|
* If the template syndrome does not have ISV set, we should leave
|
|
* it cleared.
|
|
*
|
|
* See ARMv8 specs, D7-1974:
|
|
* ISS encoding for an exception from a Data Abort, the
|
|
* ISV field.
|
|
*/
|
|
if (!(template_syn & ARM_EL_ISV) || target_el != 2 || s1ptw) {
|
|
syn = syn_data_abort_no_iss(same_el, 0,
|
|
ea, 0, s1ptw, is_write, fsc);
|
|
} else {
|
|
/*
|
|
* Fields: IL, ISV, SAS, SSE, SRT, SF and AR come from the template
|
|
* syndrome created at translation time.
|
|
* Now we create the runtime syndrome with the remaining fields.
|
|
*/
|
|
syn = syn_data_abort_with_iss(same_el,
|
|
0, 0, 0, 0, 0,
|
|
ea, 0, s1ptw, is_write, fsc,
|
|
true);
|
|
/* Merge the runtime syndrome with the template syndrome. */
|
|
syn |= template_syn;
|
|
}
|
|
return syn;
|
|
}
|
|
|
|
static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
|
|
int target_el, int mmu_idx, uint32_t *ret_fsc)
|
|
{
|
|
ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
|
|
uint32_t fsr, fsc;
|
|
|
|
if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
|
|
arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
|
|
/*
|
|
* LPAE format fault status register : bottom 6 bits are
|
|
* status code in the same form as needed for syndrome
|
|
*/
|
|
fsr = arm_fi_to_lfsc(fi);
|
|
fsc = extract32(fsr, 0, 6);
|
|
} else {
|
|
fsr = arm_fi_to_sfsc(fi);
|
|
/*
|
|
* Short format FSR : this fault will never actually be reported
|
|
* to an EL that uses a syndrome register. Use a (currently)
|
|
* reserved FSR code in case the constructed syndrome does leak
|
|
* into the guest somehow.
|
|
*/
|
|
fsc = 0x3f;
|
|
}
|
|
|
|
*ret_fsc = fsc;
|
|
return fsr;
|
|
}
|
|
|
|
static G_NORETURN
|
|
void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
|
|
MMUAccessType access_type,
|
|
int mmu_idx, ARMMMUFaultInfo *fi)
|
|
{
|
|
CPUARMState *env = &cpu->env;
|
|
int target_el;
|
|
bool same_el;
|
|
uint32_t syn, exc, fsr, fsc;
|
|
|
|
target_el = exception_target_el(env);
|
|
if (fi->stage2) {
|
|
target_el = 2;
|
|
env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
|
|
if (arm_is_secure_below_el3(env) && fi->s1ns) {
|
|
env->cp15.hpfar_el2 |= HPFAR_NS;
|
|
}
|
|
}
|
|
same_el = (arm_current_el(env) == target_el);
|
|
|
|
fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
|
|
|
|
if (access_type == MMU_INST_FETCH) {
|
|
syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
|
|
exc = EXCP_PREFETCH_ABORT;
|
|
} else {
|
|
syn = merge_syn_data_abort(env->exception.syndrome, target_el,
|
|
same_el, fi->ea, fi->s1ptw,
|
|
access_type == MMU_DATA_STORE,
|
|
fsc);
|
|
if (access_type == MMU_DATA_STORE
|
|
&& arm_feature(env, ARM_FEATURE_V6)) {
|
|
fsr |= (1 << 11);
|
|
}
|
|
exc = EXCP_DATA_ABORT;
|
|
}
|
|
|
|
env->exception.vaddress = addr;
|
|
env->exception.fsr = fsr;
|
|
raise_exception(env, exc, syn, target_el);
|
|
}
|
|
|
|
/* Raise a data fault alignment exception for the specified virtual address */
|
|
void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
|
|
MMUAccessType access_type,
|
|
int mmu_idx, uintptr_t retaddr)
|
|
{
|
|
ARMCPU *cpu = ARM_CPU(cs);
|
|
ARMMMUFaultInfo fi = {};
|
|
|
|
/* now we have a real cpu fault */
|
|
cpu_restore_state(cs, retaddr, true);
|
|
|
|
fi.type = ARMFault_Alignment;
|
|
arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi);
|
|
}
|
|
|
|
void helper_exception_pc_alignment(CPUARMState *env, target_ulong pc)
|
|
{
|
|
ARMMMUFaultInfo fi = { .type = ARMFault_Alignment };
|
|
int target_el = exception_target_el(env);
|
|
int mmu_idx = cpu_mmu_index(env, true);
|
|
uint32_t fsc;
|
|
|
|
env->exception.vaddress = pc;
|
|
|
|
/*
|
|
* Note that the fsc is not applicable to this exception,
|
|
* since any syndrome is pcalignment not insn_abort.
|
|
*/
|
|
env->exception.fsr = compute_fsr_fsc(env, &fi, target_el, mmu_idx, &fsc);
|
|
raise_exception(env, EXCP_PREFETCH_ABORT, syn_pcalignment(), target_el);
|
|
}
|
|
|
|
#if !defined(CONFIG_USER_ONLY)
|
|
|
|
/*
|
|
* arm_cpu_do_transaction_failed: handle a memory system error response
|
|
* (eg "no device/memory present at address") by raising an external abort
|
|
* exception
|
|
*/
|
|
void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
|
|
vaddr addr, unsigned size,
|
|
MMUAccessType access_type,
|
|
int mmu_idx, MemTxAttrs attrs,
|
|
MemTxResult response, uintptr_t retaddr)
|
|
{
|
|
ARMCPU *cpu = ARM_CPU(cs);
|
|
ARMMMUFaultInfo fi = {};
|
|
|
|
/* now we have a real cpu fault */
|
|
cpu_restore_state(cs, retaddr, true);
|
|
|
|
fi.ea = arm_extabort_type(response);
|
|
fi.type = ARMFault_SyncExternal;
|
|
arm_deliver_fault(cpu, addr, access_type, mmu_idx, &fi);
|
|
}
|
|
|
|
bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
|
|
MMUAccessType access_type, int mmu_idx,
|
|
bool probe, uintptr_t retaddr)
|
|
{
|
|
ARMCPU *cpu = ARM_CPU(cs);
|
|
ARMMMUFaultInfo fi = {};
|
|
hwaddr phys_addr;
|
|
target_ulong page_size;
|
|
int prot, ret;
|
|
MemTxAttrs attrs = {};
|
|
ARMCacheAttrs cacheattrs = {};
|
|
|
|
/*
|
|
* Walk the page table and (if the mapping exists) add the page
|
|
* to the TLB. On success, return true. Otherwise, if probing,
|
|
* return false. Otherwise populate fsr with ARM DFSR/IFSR fault
|
|
* register format, and signal the fault.
|
|
*/
|
|
ret = get_phys_addr(&cpu->env, address, access_type,
|
|
core_to_arm_mmu_idx(&cpu->env, mmu_idx),
|
|
&phys_addr, &attrs, &prot, &page_size,
|
|
&fi, &cacheattrs);
|
|
if (likely(!ret)) {
|
|
/*
|
|
* Map a single [sub]page. Regions smaller than our declared
|
|
* target page size are handled specially, so for those we
|
|
* pass in the exact addresses.
|
|
*/
|
|
if (page_size >= TARGET_PAGE_SIZE) {
|
|
phys_addr &= TARGET_PAGE_MASK;
|
|
address &= TARGET_PAGE_MASK;
|
|
}
|
|
/* Notice and record tagged memory. */
|
|
if (cpu_isar_feature(aa64_mte, cpu) && cacheattrs.attrs == 0xf0) {
|
|
arm_tlb_mte_tagged(&attrs) = true;
|
|
}
|
|
|
|
tlb_set_page_with_attrs(cs, address, phys_addr, attrs,
|
|
prot, mmu_idx, page_size);
|
|
return true;
|
|
} else if (probe) {
|
|
return false;
|
|
} else {
|
|
/* now we have a real cpu fault */
|
|
cpu_restore_state(cs, retaddr, true);
|
|
arm_deliver_fault(cpu, address, access_type, mmu_idx, &fi);
|
|
}
|
|
}
|
|
#else
|
|
void arm_cpu_record_sigsegv(CPUState *cs, vaddr addr,
|
|
MMUAccessType access_type,
|
|
bool maperr, uintptr_t ra)
|
|
{
|
|
ARMMMUFaultInfo fi = {
|
|
.type = maperr ? ARMFault_Translation : ARMFault_Permission,
|
|
.level = 3,
|
|
};
|
|
ARMCPU *cpu = ARM_CPU(cs);
|
|
|
|
/*
|
|
* We report both ESR and FAR to signal handlers.
|
|
* For now, it's easiest to deliver the fault normally.
|
|
*/
|
|
cpu_restore_state(cs, ra, true);
|
|
arm_deliver_fault(cpu, addr, access_type, MMU_USER_IDX, &fi);
|
|
}
|
|
|
|
void arm_cpu_record_sigbus(CPUState *cs, vaddr addr,
|
|
MMUAccessType access_type, uintptr_t ra)
|
|
{
|
|
arm_cpu_do_unaligned_access(cs, addr, access_type, MMU_USER_IDX, ra);
|
|
}
|
|
#endif /* !defined(CONFIG_USER_ONLY) */
|