target/arm/tlb_helper.c

   1 /*
   2  * ARM TLB (Translation lookaside buffer) helpers.
   3  *
   4  * This code is licensed under the GNU GPL v2 or later.
   5  *
   6  * SPDX-License-Identifier: GPL-2.0-or-later
   7  */
   8 #include "qemu/osdep.h"
   9 #include "cpu.h"
  10 #include "internals.h"
  11 #include "exec/exec-all.h"
  12 #include "exec/helper-proto.h"
  13
  14 static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
  15                                             unsigned int target_el,
  16                                             bool same_el, bool ea,
  17                                             bool s1ptw, bool is_write,
  18                                             int fsc)
  19 {
  20     uint32_t syn;
  21
  22     /*
  23      * ISV is only set for data aborts routed to EL2 and
  24      * never for stage-1 page table walks faulting on stage 2.
  25      *
  26      * Furthermore, ISV is only set for certain kinds of load/stores.
  27      * If the template syndrome does not have ISV set, we should leave
  28      * it cleared.
  29      *
  30      * See ARMv8 specs, D7-1974:
  31      * ISS encoding for an exception from a Data Abort, the
  32      * ISV field.
  33      */
  34     if (!(template_syn & ARM_EL_ISV) || target_el != 2 || s1ptw) {
  35         syn = syn_data_abort_no_iss(same_el, 0,
  36                                     ea, 0, s1ptw, is_write, fsc);
  37     } else {
  38         /*
  39          * Fields: IL, ISV, SAS, SSE, SRT, SF and AR come from the template
  40          * syndrome created at translation time.
  41          * Now we create the runtime syndrome with the remaining fields.
  42          */
  43         syn = syn_data_abort_with_iss(same_el,
  44                                       0, 0, 0, 0, 0,
  45                                       ea, 0, s1ptw, is_write, fsc,
  46                                       true);
  47         /* Merge the runtime syndrome with the template syndrome.  */
  48         syn |= template_syn;
  49     }
  50     return syn;
  51 }
  52
  53 static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
  54                                 int target_el, int mmu_idx, uint32_t *ret_fsc)
  55 {
  56     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
  57     uint32_t fsr, fsc;
  58
  59     if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
  60         arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
  61         /*
  62          * LPAE format fault status register : bottom 6 bits are
  63          * status code in the same form as needed for syndrome
  64          */
  65         fsr = arm_fi_to_lfsc(fi);
  66         fsc = extract32(fsr, 0, 6);
  67     } else {
  68         fsr = arm_fi_to_sfsc(fi);
  69         /*
  70          * Short format FSR : this fault will never actually be reported
  71          * to an EL that uses a syndrome register. Use a (currently)
  72          * reserved FSR code in case the constructed syndrome does leak
  73          * into the guest somehow.
  74          */
  75         fsc = 0x3f;
  76     }
  77
  78     *ret_fsc = fsc;
  79     return fsr;
  80 }
  81
  82 static G_NORETURN
  83 void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
  84                        MMUAccessType access_type,
  85                        int mmu_idx, ARMMMUFaultInfo *fi)
  86 {
  87     CPUARMState *env = &cpu->env;
  88     int target_el;
  89     bool same_el;
  90     uint32_t syn, exc, fsr, fsc;
  91
  92     target_el = exception_target_el(env);
  93     if (fi->stage2) {
  94         target_el = 2;
  95         env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
  96         if (arm_is_secure_below_el3(env) && fi->s1ns) {
  97             env->cp15.hpfar_el2 |= HPFAR_NS;
  98         }
  99     }
 100     same_el = (arm_current_el(env) == target_el);
 101
 102     fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
 103
 104     if (access_type == MMU_INST_FETCH) {
 105         syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
 106         exc = EXCP_PREFETCH_ABORT;
 107     } else {
 108         syn = merge_syn_data_abort(env->exception.syndrome, target_el,
 109                                    same_el, fi->ea, fi->s1ptw,
 110                                    access_type == MMU_DATA_STORE,
 111                                    fsc);
 112         if (access_type == MMU_DATA_STORE
 113             && arm_feature(env, ARM_FEATURE_V6)) {
 114             fsr |= (1 << 11);
 115         }
 116         exc = EXCP_DATA_ABORT;
 117     }
 118
 119     env->exception.vaddress = addr;
 120     env->exception.fsr = fsr;
 121     raise_exception(env, exc, syn, target_el);
 122 }
 123
 124 /* Raise a data fault alignment exception for the specified virtual address */
 125 void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
 126                                  MMUAccessType access_type,
 127                                  int mmu_idx, uintptr_t retaddr)
 128 {
 129     ARMCPU *cpu = ARM_CPU(cs);
 130     ARMMMUFaultInfo fi = {};
 131
 132     /* now we have a real cpu fault */
 133     cpu_restore_state(cs, retaddr, true);
 134
 135     fi.type = ARMFault_Alignment;
 136     arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi);
 137 }
 138
 139 void helper_exception_pc_alignment(CPUARMState *env, target_ulong pc)
 140 {
 141     ARMMMUFaultInfo fi = { .type = ARMFault_Alignment };
 142     int target_el = exception_target_el(env);
 143     int mmu_idx = cpu_mmu_index(env, true);
 144     uint32_t fsc;
 145
 146     env->exception.vaddress = pc;
 147
 148     /*
 149      * Note that the fsc is not applicable to this exception,
 150      * since any syndrome is pcalignment not insn_abort.
 151      */
 152     env->exception.fsr = compute_fsr_fsc(env, &fi, target_el, mmu_idx, &fsc);
 153     raise_exception(env, EXCP_PREFETCH_ABORT, syn_pcalignment(), target_el);
 154 }
 155
 156 #if !defined(CONFIG_USER_ONLY)
 157
 158 /*
 159  * arm_cpu_do_transaction_failed: handle a memory system error response
 160  * (eg "no device/memory present at address") by raising an external abort
 161  * exception
 162  */
 163 void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
 164                                    vaddr addr, unsigned size,
 165                                    MMUAccessType access_type,
 166                                    int mmu_idx, MemTxAttrs attrs,
 167                                    MemTxResult response, uintptr_t retaddr)
 168 {
 169     ARMCPU *cpu = ARM_CPU(cs);
 170     ARMMMUFaultInfo fi = {};
 171
 172     /* now we have a real cpu fault */
 173     cpu_restore_state(cs, retaddr, true);
 174
 175     fi.ea = arm_extabort_type(response);
 176     fi.type = ARMFault_SyncExternal;
 177     arm_deliver_fault(cpu, addr, access_type, mmu_idx, &fi);
 178 }
 179
 180 bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 181                       MMUAccessType access_type, int mmu_idx,
 182                       bool probe, uintptr_t retaddr)
 183 {
 184     ARMCPU *cpu = ARM_CPU(cs);
 185     ARMMMUFaultInfo fi = {};
 186     hwaddr phys_addr;
 187     target_ulong page_size;
 188     int prot, ret;
 189     MemTxAttrs attrs = {};
 190     ARMCacheAttrs cacheattrs = {};
 191
 192     /*
 193      * Walk the page table and (if the mapping exists) add the page
 194      * to the TLB.  On success, return true.  Otherwise, if probing,
 195      * return false.  Otherwise populate fsr with ARM DFSR/IFSR fault
 196      * register format, and signal the fault.
 197      */
 198     ret = get_phys_addr(&cpu->env, address, access_type,
 199                         core_to_arm_mmu_idx(&cpu->env, mmu_idx),
 200                         &phys_addr, &attrs, &prot, &page_size,
 201                         &fi, &cacheattrs);
 202     if (likely(!ret)) {
 203         /*
 204          * Map a single [sub]page. Regions smaller than our declared
 205          * target page size are handled specially, so for those we
 206          * pass in the exact addresses.
 207          */
 208         if (page_size >= TARGET_PAGE_SIZE) {
 209             phys_addr &= TARGET_PAGE_MASK;
 210             address &= TARGET_PAGE_MASK;
 211         }
 212         /* Notice and record tagged memory. */
 213         if (cpu_isar_feature(aa64_mte, cpu) && cacheattrs.attrs == 0xf0) {
 214             arm_tlb_mte_tagged(&attrs) = true;
 215         }
 216
 217         tlb_set_page_with_attrs(cs, address, phys_addr, attrs,
 218                                 prot, mmu_idx, page_size);
 219         return true;
 220     } else if (probe) {
 221         return false;
 222     } else {
 223         /* now we have a real cpu fault */
 224         cpu_restore_state(cs, retaddr, true);
 225         arm_deliver_fault(cpu, address, access_type, mmu_idx, &fi);
 226     }
 227 }
 228 #else
 229 void arm_cpu_record_sigsegv(CPUState *cs, vaddr addr,
 230                             MMUAccessType access_type,
 231                             bool maperr, uintptr_t ra)
 232 {
 233     ARMMMUFaultInfo fi = {
 234         .type = maperr ? ARMFault_Translation : ARMFault_Permission,
 235         .level = 3,
 236     };
 237     ARMCPU *cpu = ARM_CPU(cs);
 238
 239     /*
 240      * We report both ESR and FAR to signal handlers.
 241      * For now, it's easiest to deliver the fault normally.
 242      */
 243     cpu_restore_state(cs, ra, true);
 244     arm_deliver_fault(cpu, addr, access_type, MMU_USER_IDX, &fi);
 245 }
 246
 247 void arm_cpu_record_sigbus(CPUState *cs, vaddr addr,
 248                            MMUAccessType access_type, uintptr_t ra)
 249 {
 250     arm_cpu_do_unaligned_access(cs, addr, access_type, MMU_USER_IDX, ra);
 251 }
 252 #endif /* !defined(CONFIG_USER_ONLY) */