target/arm/tlb_helper.c

   1 /*
   2  * ARM TLB (Translation lookaside buffer) helpers.
   3  *
   4  * This code is licensed under the GNU GPL v2 or later.
   5  *
   6  * SPDX-License-Identifier: GPL-2.0-or-later
   7  */
   8 #include "qemu/osdep.h"
   9 #include "cpu.h"
  10 #include "internals.h"
  11 #include "exec/exec-all.h"
  12 #include "exec/helper-proto.h"
  13
  14 static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
  15                                             unsigned int target_el,
  16                                             bool same_el, bool ea,
  17                                             bool s1ptw, bool is_write,
  18                                             int fsc)
  19 {
  20     uint32_t syn;
  21
  22     /*
  23      * ISV is only set for data aborts routed to EL2 and
  24      * never for stage-1 page table walks faulting on stage 2.
  25      *
  26      * Furthermore, ISV is only set for certain kinds of load/stores.
  27      * If the template syndrome does not have ISV set, we should leave
  28      * it cleared.
  29      *
  30      * See ARMv8 specs, D7-1974:
  31      * ISS encoding for an exception from a Data Abort, the
  32      * ISV field.
  33      */
  34     if (!(template_syn & ARM_EL_ISV) || target_el != 2 || s1ptw) {
  35         syn = syn_data_abort_no_iss(same_el, 0,
  36                                     ea, 0, s1ptw, is_write, fsc);
  37     } else {
  38         /*
  39          * Fields: IL, ISV, SAS, SSE, SRT, SF and AR come from the template
  40          * syndrome created at translation time.
  41          * Now we create the runtime syndrome with the remaining fields.
  42          */
  43         syn = syn_data_abort_with_iss(same_el,
  44                                       0, 0, 0, 0, 0,
  45                                       ea, 0, s1ptw, is_write, fsc,
  46                                       true);
  47         /* Merge the runtime syndrome with the template syndrome.  */
  48         syn |= template_syn;
  49     }
  50     return syn;
  51 }
  52
  53 static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
  54                                 int target_el, int mmu_idx, uint32_t *ret_fsc)
  55 {
  56     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
  57     uint32_t fsr, fsc;
  58
  59     if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
  60         arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
  61         /*
  62          * LPAE format fault status register : bottom 6 bits are
  63          * status code in the same form as needed for syndrome
  64          */
  65         fsr = arm_fi_to_lfsc(fi);
  66         fsc = extract32(fsr, 0, 6);
  67     } else {
  68         fsr = arm_fi_to_sfsc(fi);
  69         /*
  70          * Short format FSR : this fault will never actually be reported
  71          * to an EL that uses a syndrome register. Use a (currently)
  72          * reserved FSR code in case the constructed syndrome does leak
  73          * into the guest somehow.
  74          */
  75         fsc = 0x3f;
  76     }
  77
  78     *ret_fsc = fsc;
  79     return fsr;
  80 }
  81
  82 static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,
  83                                             MMUAccessType access_type,
  84                                             int mmu_idx, ARMMMUFaultInfo *fi)
  85 {
  86     CPUARMState *env = &cpu->env;
  87     int target_el;
  88     bool same_el;
  89     uint32_t syn, exc, fsr, fsc;
  90
  91     target_el = exception_target_el(env);
  92     if (fi->stage2) {
  93         target_el = 2;
  94         env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
  95         if (arm_is_secure_below_el3(env) && fi->s1ns) {
  96             env->cp15.hpfar_el2 |= HPFAR_NS;
  97         }
  98     }
  99     same_el = (arm_current_el(env) == target_el);
 100
 101     fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
 102
 103     if (access_type == MMU_INST_FETCH) {
 104         syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
 105         exc = EXCP_PREFETCH_ABORT;
 106     } else {
 107         syn = merge_syn_data_abort(env->exception.syndrome, target_el,
 108                                    same_el, fi->ea, fi->s1ptw,
 109                                    access_type == MMU_DATA_STORE,
 110                                    fsc);
 111         if (access_type == MMU_DATA_STORE
 112             && arm_feature(env, ARM_FEATURE_V6)) {
 113             fsr |= (1 << 11);
 114         }
 115         exc = EXCP_DATA_ABORT;
 116     }
 117
 118     env->exception.vaddress = addr;
 119     env->exception.fsr = fsr;
 120     raise_exception(env, exc, syn, target_el);
 121 }
 122
 123 /* Raise a data fault alignment exception for the specified virtual address */
 124 void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
 125                                  MMUAccessType access_type,
 126                                  int mmu_idx, uintptr_t retaddr)
 127 {
 128     ARMCPU *cpu = ARM_CPU(cs);
 129     ARMMMUFaultInfo fi = {};
 130
 131     /* now we have a real cpu fault */
 132     cpu_restore_state(cs, retaddr, true);
 133
 134     fi.type = ARMFault_Alignment;
 135     arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi);
 136 }
 137
 138 void helper_exception_pc_alignment(CPUARMState *env, target_ulong pc)
 139 {
 140     ARMMMUFaultInfo fi = { .type = ARMFault_Alignment };
 141     int target_el = exception_target_el(env);
 142     int mmu_idx = cpu_mmu_index(env, true);
 143     uint32_t fsc;
 144
 145     env->exception.vaddress = pc;
 146
 147     /*
 148      * Note that the fsc is not applicable to this exception,
 149      * since any syndrome is pcalignment not insn_abort.
 150      */
 151     env->exception.fsr = compute_fsr_fsc(env, &fi, target_el, mmu_idx, &fsc);
 152     raise_exception(env, EXCP_PREFETCH_ABORT, syn_pcalignment(), target_el);
 153 }
 154
 155 #if !defined(CONFIG_USER_ONLY)
 156
 157 /*
 158  * arm_cpu_do_transaction_failed: handle a memory system error response
 159  * (eg "no device/memory present at address") by raising an external abort
 160  * exception
 161  */
 162 void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
 163                                    vaddr addr, unsigned size,
 164                                    MMUAccessType access_type,
 165                                    int mmu_idx, MemTxAttrs attrs,
 166                                    MemTxResult response, uintptr_t retaddr)
 167 {
 168     ARMCPU *cpu = ARM_CPU(cs);
 169     ARMMMUFaultInfo fi = {};
 170
 171     /* now we have a real cpu fault */
 172     cpu_restore_state(cs, retaddr, true);
 173
 174     fi.ea = arm_extabort_type(response);
 175     fi.type = ARMFault_SyncExternal;
 176     arm_deliver_fault(cpu, addr, access_type, mmu_idx, &fi);
 177 }
 178
 179 bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 180                       MMUAccessType access_type, int mmu_idx,
 181                       bool probe, uintptr_t retaddr)
 182 {
 183     ARMCPU *cpu = ARM_CPU(cs);
 184     ARMMMUFaultInfo fi = {};
 185     hwaddr phys_addr;
 186     target_ulong page_size;
 187     int prot, ret;
 188     MemTxAttrs attrs = {};
 189     ARMCacheAttrs cacheattrs = {};
 190
 191     /*
 192      * Walk the page table and (if the mapping exists) add the page
 193      * to the TLB.  On success, return true.  Otherwise, if probing,
 194      * return false.  Otherwise populate fsr with ARM DFSR/IFSR fault
 195      * register format, and signal the fault.
 196      */
 197     ret = get_phys_addr(&cpu->env, address, access_type,
 198                         core_to_arm_mmu_idx(&cpu->env, mmu_idx),
 199                         &phys_addr, &attrs, &prot, &page_size,
 200                         &fi, &cacheattrs);
 201     if (likely(!ret)) {
 202         /*
 203          * Map a single [sub]page. Regions smaller than our declared
 204          * target page size are handled specially, so for those we
 205          * pass in the exact addresses.
 206          */
 207         if (page_size >= TARGET_PAGE_SIZE) {
 208             phys_addr &= TARGET_PAGE_MASK;
 209             address &= TARGET_PAGE_MASK;
 210         }
 211         /* Notice and record tagged memory. */
 212         if (cpu_isar_feature(aa64_mte, cpu) && cacheattrs.attrs == 0xf0) {
 213             arm_tlb_mte_tagged(&attrs) = true;
 214         }
 215
 216         tlb_set_page_with_attrs(cs, address, phys_addr, attrs,
 217                                 prot, mmu_idx, page_size);
 218         return true;
 219     } else if (probe) {
 220         return false;
 221     } else {
 222         /* now we have a real cpu fault */
 223         cpu_restore_state(cs, retaddr, true);
 224         arm_deliver_fault(cpu, address, access_type, mmu_idx, &fi);
 225     }
 226 }
 227 #else
 228 void arm_cpu_record_sigsegv(CPUState *cs, vaddr addr,
 229                             MMUAccessType access_type,
 230                             bool maperr, uintptr_t ra)
 231 {
 232     ARMMMUFaultInfo fi = {
 233         .type = maperr ? ARMFault_Translation : ARMFault_Permission,
 234         .level = 3,
 235     };
 236     ARMCPU *cpu = ARM_CPU(cs);
 237
 238     /*
 239      * We report both ESR and FAR to signal handlers.
 240      * For now, it's easiest to deliver the fault normally.
 241      */
 242     cpu_restore_state(cs, ra, true);
 243     arm_deliver_fault(cpu, addr, access_type, MMU_USER_IDX, &fi);
 244 }
 245
 246 void arm_cpu_record_sigbus(CPUState *cs, vaddr addr,
 247                            MMUAccessType access_type, uintptr_t ra)
 248 {
 249     arm_cpu_do_unaligned_access(cs, addr, access_type, MMU_USER_IDX, ra);
 250 }
 251 #endif /* !defined(CONFIG_USER_ONLY) */