2 * ARM TLB (Translation lookaside buffer) helpers.
4 * This code is licensed under the GNU GPL v2 or later.
6 * SPDX-License-Identifier: GPL-2.0-or-later
8 #include "qemu/osdep.h"
10 #include "internals.h"
11 #include "exec/exec-all.h"
12 #include "exec/helper-proto.h"
16 * Returns true if the stage 1 translation regime is using LPAE format page
17 * tables. Used when raising alignment exceptions, whose FSR changes depending
18 * on whether the long or short descriptor format is in use.
20 bool arm_s1_regime_using_lpae_format(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
22 mmu_idx
= stage_1_mmu_idx(mmu_idx
);
23 return regime_using_lpae_format(env
, mmu_idx
);
26 static inline uint32_t merge_syn_data_abort(uint32_t template_syn
,
28 unsigned int target_el
,
29 bool same_el
, bool is_write
,
35 * ISV is only set for stage-2 data aborts routed to EL2 and
36 * never for stage-1 page table walks faulting on stage 2
37 * or for stage-1 faults.
39 * Furthermore, ISV is only set for certain kinds of load/stores.
40 * If the template syndrome does not have ISV set, we should leave
43 * See ARMv8 specs, D7-1974:
44 * ISS encoding for an exception from a Data Abort, the
47 * TODO: FEAT_LS64/FEAT_LS64_V/FEAT_SL64_ACCDATA: Translation,
48 * Access Flag, and Permission faults caused by LD64B, ST64B,
49 * ST64BV, or ST64BV0 insns report syndrome info even for stage-1
50 * faults and regardless of the target EL.
52 if (!(template_syn
& ARM_EL_ISV
) || target_el
!= 2
53 || fi
->s1ptw
|| !fi
->stage2
) {
54 syn
= syn_data_abort_no_iss(same_el
, 0,
55 fi
->ea
, 0, fi
->s1ptw
, is_write
, fsc
);
58 * Fields: IL, ISV, SAS, SSE, SRT, SF and AR come from the template
59 * syndrome created at translation time.
60 * Now we create the runtime syndrome with the remaining fields.
62 syn
= syn_data_abort_with_iss(same_el
,
64 fi
->ea
, 0, fi
->s1ptw
, is_write
, fsc
,
66 /* Merge the runtime syndrome with the template syndrome. */
72 static uint32_t compute_fsr_fsc(CPUARMState
*env
, ARMMMUFaultInfo
*fi
,
73 int target_el
, int mmu_idx
, uint32_t *ret_fsc
)
75 ARMMMUIdx arm_mmu_idx
= core_to_arm_mmu_idx(env
, mmu_idx
);
79 * For M-profile there is no guest-facing FSR. We compute a
80 * short-form value for env->exception.fsr which we will then
81 * examine in arm_v7m_cpu_do_interrupt(). In theory we could
82 * use the LPAE format instead as long as both bits of code agree
83 * (and arm_fi_to_lfsc() handled the M-profile specific
84 * ARMFault_QEMU_NSCExec and ARMFault_QEMU_SFault cases).
86 if (!arm_feature(env
, ARM_FEATURE_M
) &&
87 (target_el
== 2 || arm_el_is_aa64(env
, target_el
) ||
88 arm_s1_regime_using_lpae_format(env
, arm_mmu_idx
))) {
90 * LPAE format fault status register : bottom 6 bits are
91 * status code in the same form as needed for syndrome
93 fsr
= arm_fi_to_lfsc(fi
);
94 fsc
= extract32(fsr
, 0, 6);
96 fsr
= arm_fi_to_sfsc(fi
);
98 * Short format FSR : this fault will never actually be reported
99 * to an EL that uses a syndrome register. Use a (currently)
100 * reserved FSR code in case the constructed syndrome does leak
101 * into the guest somehow.
111 void arm_deliver_fault(ARMCPU
*cpu
, vaddr addr
,
112 MMUAccessType access_type
,
113 int mmu_idx
, ARMMMUFaultInfo
*fi
)
115 CPUARMState
*env
= &cpu
->env
;
118 uint32_t syn
, exc
, fsr
, fsc
;
120 target_el
= exception_target_el(env
);
123 env
->cp15
.hpfar_el2
= extract64(fi
->s2addr
, 12, 47) << 4;
124 if (arm_is_secure_below_el3(env
) && fi
->s1ns
) {
125 env
->cp15
.hpfar_el2
|= HPFAR_NS
;
128 same_el
= (arm_current_el(env
) == target_el
);
130 fsr
= compute_fsr_fsc(env
, fi
, target_el
, mmu_idx
, &fsc
);
132 if (access_type
== MMU_INST_FETCH
) {
133 syn
= syn_insn_abort(same_el
, fi
->ea
, fi
->s1ptw
, fsc
);
134 exc
= EXCP_PREFETCH_ABORT
;
136 syn
= merge_syn_data_abort(env
->exception
.syndrome
, fi
, target_el
,
137 same_el
, access_type
== MMU_DATA_STORE
,
139 if (access_type
== MMU_DATA_STORE
140 && arm_feature(env
, ARM_FEATURE_V6
)) {
143 exc
= EXCP_DATA_ABORT
;
146 env
->exception
.vaddress
= addr
;
147 env
->exception
.fsr
= fsr
;
148 raise_exception(env
, exc
, syn
, target_el
);
151 /* Raise a data fault alignment exception for the specified virtual address */
152 void arm_cpu_do_unaligned_access(CPUState
*cs
, vaddr vaddr
,
153 MMUAccessType access_type
,
154 int mmu_idx
, uintptr_t retaddr
)
156 ARMCPU
*cpu
= ARM_CPU(cs
);
157 ARMMMUFaultInfo fi
= {};
159 /* now we have a real cpu fault */
160 cpu_restore_state(cs
, retaddr
);
162 fi
.type
= ARMFault_Alignment
;
163 arm_deliver_fault(cpu
, vaddr
, access_type
, mmu_idx
, &fi
);
166 void helper_exception_pc_alignment(CPUARMState
*env
, target_ulong pc
)
168 ARMMMUFaultInfo fi
= { .type
= ARMFault_Alignment
};
169 int target_el
= exception_target_el(env
);
170 int mmu_idx
= cpu_mmu_index(env
, true);
173 env
->exception
.vaddress
= pc
;
176 * Note that the fsc is not applicable to this exception,
177 * since any syndrome is pcalignment not insn_abort.
179 env
->exception
.fsr
= compute_fsr_fsc(env
, &fi
, target_el
, mmu_idx
, &fsc
);
180 raise_exception(env
, EXCP_PREFETCH_ABORT
, syn_pcalignment(), target_el
);
183 #if !defined(CONFIG_USER_ONLY)
186 * arm_cpu_do_transaction_failed: handle a memory system error response
187 * (eg "no device/memory present at address") by raising an external abort
190 void arm_cpu_do_transaction_failed(CPUState
*cs
, hwaddr physaddr
,
191 vaddr addr
, unsigned size
,
192 MMUAccessType access_type
,
193 int mmu_idx
, MemTxAttrs attrs
,
194 MemTxResult response
, uintptr_t retaddr
)
196 ARMCPU
*cpu
= ARM_CPU(cs
);
197 ARMMMUFaultInfo fi
= {};
199 /* now we have a real cpu fault */
200 cpu_restore_state(cs
, retaddr
);
202 fi
.ea
= arm_extabort_type(response
);
203 fi
.type
= ARMFault_SyncExternal
;
204 arm_deliver_fault(cpu
, addr
, access_type
, mmu_idx
, &fi
);
207 bool arm_cpu_tlb_fill(CPUState
*cs
, vaddr address
, int size
,
208 MMUAccessType access_type
, int mmu_idx
,
209 bool probe
, uintptr_t retaddr
)
211 ARMCPU
*cpu
= ARM_CPU(cs
);
212 GetPhysAddrResult res
= {};
213 ARMMMUFaultInfo local_fi
, *fi
;
217 * Allow S1_ptw_translate to see any fault generated here.
218 * Since this may recurse, read and clear.
220 fi
= cpu
->env
.tlb_fi
;
222 cpu
->env
.tlb_fi
= NULL
;
224 fi
= memset(&local_fi
, 0, sizeof(local_fi
));
228 * Walk the page table and (if the mapping exists) add the page
229 * to the TLB. On success, return true. Otherwise, if probing,
230 * return false. Otherwise populate fsr with ARM DFSR/IFSR fault
231 * register format, and signal the fault.
233 ret
= get_phys_addr(&cpu
->env
, address
, access_type
,
234 core_to_arm_mmu_idx(&cpu
->env
, mmu_idx
),
238 * Map a single [sub]page. Regions smaller than our declared
239 * target page size are handled specially, so for those we
240 * pass in the exact addresses.
242 if (res
.f
.lg_page_size
>= TARGET_PAGE_BITS
) {
243 res
.f
.phys_addr
&= TARGET_PAGE_MASK
;
244 address
&= TARGET_PAGE_MASK
;
247 res
.f
.pte_attrs
= res
.cacheattrs
.attrs
;
248 res
.f
.shareability
= res
.cacheattrs
.shareability
;
250 tlb_set_page_full(cs
, mmu_idx
, address
, &res
.f
);
255 /* now we have a real cpu fault */
256 cpu_restore_state(cs
, retaddr
);
257 arm_deliver_fault(cpu
, address
, access_type
, mmu_idx
, fi
);
261 void arm_cpu_record_sigsegv(CPUState
*cs
, vaddr addr
,
262 MMUAccessType access_type
,
263 bool maperr
, uintptr_t ra
)
265 ARMMMUFaultInfo fi
= {
266 .type
= maperr
? ARMFault_Translation
: ARMFault_Permission
,
269 ARMCPU
*cpu
= ARM_CPU(cs
);
272 * We report both ESR and FAR to signal handlers.
273 * For now, it's easiest to deliver the fault normally.
275 cpu_restore_state(cs
, ra
);
276 arm_deliver_fault(cpu
, addr
, access_type
, MMU_USER_IDX
, &fi
);
279 void arm_cpu_record_sigbus(CPUState
*cs
, vaddr addr
,
280 MMUAccessType access_type
, uintptr_t ra
)
282 arm_cpu_do_unaligned_access(cs
, addr
, access_type
, MMU_USER_IDX
, ra
);
284 #endif /* !defined(CONFIG_USER_ONLY) */