xref: /openbmc/qemu/target/arm/internals.h (revision 745a4f5e)
1 /*
2  * QEMU ARM CPU -- internal functions and types
3  *
4  * Copyright (c) 2014 Linaro Ltd
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version 2
9  * of the License, or (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, see
18  * <http://www.gnu.org/licenses/gpl-2.0.html>
19  *
20  * This header defines functions, types, etc which need to be shared
21  * between different source files within target/arm/ but which are
22  * private to it and not required by the rest of QEMU.
23  */
24 
25 #ifndef TARGET_ARM_INTERNALS_H
26 #define TARGET_ARM_INTERNALS_H
27 
28 #include "hw/registerfields.h"
29 
30 /* register banks for CPU modes */
31 #define BANK_USRSYS 0
32 #define BANK_SVC    1
33 #define BANK_ABT    2
34 #define BANK_UND    3
35 #define BANK_IRQ    4
36 #define BANK_FIQ    5
37 #define BANK_HYP    6
38 #define BANK_MON    7
39 
40 static inline bool excp_is_internal(int excp)
41 {
42     /* Return true if this exception number represents a QEMU-internal
43      * exception that will not be passed to the guest.
44      */
45     return excp == EXCP_INTERRUPT
46         || excp == EXCP_HLT
47         || excp == EXCP_DEBUG
48         || excp == EXCP_HALTED
49         || excp == EXCP_EXCEPTION_EXIT
50         || excp == EXCP_KERNEL_TRAP
51         || excp == EXCP_SEMIHOST;
52 }
53 
54 /* Scale factor for generic timers, ie number of ns per tick.
55  * This gives a 62.5MHz timer.
56  */
57 #define GTIMER_SCALE 16
58 
59 /* Bit definitions for the v7M CONTROL register */
60 FIELD(V7M_CONTROL, NPRIV, 0, 1)
61 FIELD(V7M_CONTROL, SPSEL, 1, 1)
62 FIELD(V7M_CONTROL, FPCA, 2, 1)
63 FIELD(V7M_CONTROL, SFPA, 3, 1)
64 
65 /* Bit definitions for v7M exception return payload */
66 FIELD(V7M_EXCRET, ES, 0, 1)
67 FIELD(V7M_EXCRET, RES0, 1, 1)
68 FIELD(V7M_EXCRET, SPSEL, 2, 1)
69 FIELD(V7M_EXCRET, MODE, 3, 1)
70 FIELD(V7M_EXCRET, FTYPE, 4, 1)
71 FIELD(V7M_EXCRET, DCRS, 5, 1)
72 FIELD(V7M_EXCRET, S, 6, 1)
73 FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
74 
75 /* Minimum value which is a magic number for exception return */
76 #define EXC_RETURN_MIN_MAGIC 0xff000000
77 /* Minimum number which is a magic number for function or exception return
78  * when using v8M security extension
79  */
80 #define FNC_RETURN_MIN_MAGIC 0xfefffffe
81 
82 /* We use a few fake FSR values for internal purposes in M profile.
83  * M profile cores don't have A/R format FSRs, but currently our
84  * get_phys_addr() code assumes A/R profile and reports failures via
85  * an A/R format FSR value. We then translate that into the proper
86  * M profile exception and FSR status bit in arm_v7m_cpu_do_interrupt().
87  * Mostly the FSR values we use for this are those defined for v7PMSA,
88  * since we share some of that codepath. A few kinds of fault are
89  * only for M profile and have no A/R equivalent, though, so we have
90  * to pick a value from the reserved range (which we never otherwise
91  * generate) to use for these.
92  * These values will never be visible to the guest.
93  */
94 #define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */
95 #define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */
96 
97 /**
98  * raise_exception: Raise the specified exception.
99  * Raise a guest exception with the specified value, syndrome register
100  * and target exception level. This should be called from helper functions,
101  * and never returns because we will longjump back up to the CPU main loop.
102  */
103 void QEMU_NORETURN raise_exception(CPUARMState *env, uint32_t excp,
104                                    uint32_t syndrome, uint32_t target_el);
105 
106 /*
107  * For AArch64, map a given EL to an index in the banked_spsr array.
108  * Note that this mapping and the AArch32 mapping defined in bank_number()
109  * must agree such that the AArch64<->AArch32 SPSRs have the architecturally
110  * mandated mapping between each other.
111  */
112 static inline unsigned int aarch64_banked_spsr_index(unsigned int el)
113 {
114     static const unsigned int map[4] = {
115         [1] = BANK_SVC, /* EL1.  */
116         [2] = BANK_HYP, /* EL2.  */
117         [3] = BANK_MON, /* EL3.  */
118     };
119     assert(el >= 1 && el <= 3);
120     return map[el];
121 }
122 
123 /* Map CPU modes onto saved register banks.  */
124 static inline int bank_number(int mode)
125 {
126     switch (mode) {
127     case ARM_CPU_MODE_USR:
128     case ARM_CPU_MODE_SYS:
129         return BANK_USRSYS;
130     case ARM_CPU_MODE_SVC:
131         return BANK_SVC;
132     case ARM_CPU_MODE_ABT:
133         return BANK_ABT;
134     case ARM_CPU_MODE_UND:
135         return BANK_UND;
136     case ARM_CPU_MODE_IRQ:
137         return BANK_IRQ;
138     case ARM_CPU_MODE_FIQ:
139         return BANK_FIQ;
140     case ARM_CPU_MODE_HYP:
141         return BANK_HYP;
142     case ARM_CPU_MODE_MON:
143         return BANK_MON;
144     }
145     g_assert_not_reached();
146 }
147 
148 /**
149  * r14_bank_number: Map CPU mode onto register bank for r14
150  *
151  * Given an AArch32 CPU mode, return the index into the saved register
152  * banks to use for the R14 (LR) in that mode. This is the same as
153  * bank_number(), except for the special case of Hyp mode, where
154  * R14 is shared with USR and SYS, unlike its R13 and SPSR.
155  * This should be used as the index into env->banked_r14[], and
156  * bank_number() used for the index into env->banked_r13[] and
157  * env->banked_spsr[].
158  */
159 static inline int r14_bank_number(int mode)
160 {
161     return (mode == ARM_CPU_MODE_HYP) ? BANK_USRSYS : bank_number(mode);
162 }
163 
164 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
165 void arm_translate_init(void);
166 
167 enum arm_fprounding {
168     FPROUNDING_TIEEVEN,
169     FPROUNDING_POSINF,
170     FPROUNDING_NEGINF,
171     FPROUNDING_ZERO,
172     FPROUNDING_TIEAWAY,
173     FPROUNDING_ODD
174 };
175 
176 int arm_rmode_to_sf(int rmode);
177 
178 static inline void aarch64_save_sp(CPUARMState *env, int el)
179 {
180     if (env->pstate & PSTATE_SP) {
181         env->sp_el[el] = env->xregs[31];
182     } else {
183         env->sp_el[0] = env->xregs[31];
184     }
185 }
186 
187 static inline void aarch64_restore_sp(CPUARMState *env, int el)
188 {
189     if (env->pstate & PSTATE_SP) {
190         env->xregs[31] = env->sp_el[el];
191     } else {
192         env->xregs[31] = env->sp_el[0];
193     }
194 }
195 
196 static inline void update_spsel(CPUARMState *env, uint32_t imm)
197 {
198     unsigned int cur_el = arm_current_el(env);
199     /* Update PSTATE SPSel bit; this requires us to update the
200      * working stack pointer in xregs[31].
201      */
202     if (!((imm ^ env->pstate) & PSTATE_SP)) {
203         return;
204     }
205     aarch64_save_sp(env, cur_el);
206     env->pstate = deposit32(env->pstate, 0, 1, imm);
207 
208     /* We rely on illegal updates to SPsel from EL0 to get trapped
209      * at translation time.
210      */
211     assert(cur_el >= 1 && cur_el <= 3);
212     aarch64_restore_sp(env, cur_el);
213 }
214 
215 /*
216  * arm_pamax
217  * @cpu: ARMCPU
218  *
219  * Returns the implementation defined bit-width of physical addresses.
220  * The ARMv8 reference manuals refer to this as PAMax().
221  */
222 static inline unsigned int arm_pamax(ARMCPU *cpu)
223 {
224     static const unsigned int pamax_map[] = {
225         [0] = 32,
226         [1] = 36,
227         [2] = 40,
228         [3] = 42,
229         [4] = 44,
230         [5] = 48,
231     };
232     unsigned int parange = extract32(cpu->id_aa64mmfr0, 0, 4);
233 
234     /* id_aa64mmfr0 is a read-only register so values outside of the
235      * supported mappings can be considered an implementation error.  */
236     assert(parange < ARRAY_SIZE(pamax_map));
237     return pamax_map[parange];
238 }
239 
240 /* Return true if extended addresses are enabled.
241  * This is always the case if our translation regime is 64 bit,
242  * but depends on TTBCR.EAE for 32 bit.
243  */
244 static inline bool extended_addresses_enabled(CPUARMState *env)
245 {
246     TCR *tcr = &env->cp15.tcr_el[arm_is_secure(env) ? 3 : 1];
247     return arm_el_is_aa64(env, 1) ||
248            (arm_feature(env, ARM_FEATURE_LPAE) && (tcr->raw_tcr & TTBCR_EAE));
249 }
250 
251 /* Valid Syndrome Register EC field values */
252 enum arm_exception_class {
253     EC_UNCATEGORIZED          = 0x00,
254     EC_WFX_TRAP               = 0x01,
255     EC_CP15RTTRAP             = 0x03,
256     EC_CP15RRTTRAP            = 0x04,
257     EC_CP14RTTRAP             = 0x05,
258     EC_CP14DTTRAP             = 0x06,
259     EC_ADVSIMDFPACCESSTRAP    = 0x07,
260     EC_FPIDTRAP               = 0x08,
261     EC_CP14RRTTRAP            = 0x0c,
262     EC_ILLEGALSTATE           = 0x0e,
263     EC_AA32_SVC               = 0x11,
264     EC_AA32_HVC               = 0x12,
265     EC_AA32_SMC               = 0x13,
266     EC_AA64_SVC               = 0x15,
267     EC_AA64_HVC               = 0x16,
268     EC_AA64_SMC               = 0x17,
269     EC_SYSTEMREGISTERTRAP     = 0x18,
270     EC_SVEACCESSTRAP          = 0x19,
271     EC_INSNABORT              = 0x20,
272     EC_INSNABORT_SAME_EL      = 0x21,
273     EC_PCALIGNMENT            = 0x22,
274     EC_DATAABORT              = 0x24,
275     EC_DATAABORT_SAME_EL      = 0x25,
276     EC_SPALIGNMENT            = 0x26,
277     EC_AA32_FPTRAP            = 0x28,
278     EC_AA64_FPTRAP            = 0x2c,
279     EC_SERROR                 = 0x2f,
280     EC_BREAKPOINT             = 0x30,
281     EC_BREAKPOINT_SAME_EL     = 0x31,
282     EC_SOFTWARESTEP           = 0x32,
283     EC_SOFTWARESTEP_SAME_EL   = 0x33,
284     EC_WATCHPOINT             = 0x34,
285     EC_WATCHPOINT_SAME_EL     = 0x35,
286     EC_AA32_BKPT              = 0x38,
287     EC_VECTORCATCH            = 0x3a,
288     EC_AA64_BKPT              = 0x3c,
289 };
290 
291 #define ARM_EL_EC_SHIFT 26
292 #define ARM_EL_IL_SHIFT 25
293 #define ARM_EL_ISV_SHIFT 24
294 #define ARM_EL_IL (1 << ARM_EL_IL_SHIFT)
295 #define ARM_EL_ISV (1 << ARM_EL_ISV_SHIFT)
296 
297 static inline uint32_t syn_get_ec(uint32_t syn)
298 {
299     return syn >> ARM_EL_EC_SHIFT;
300 }
301 
302 /* Utility functions for constructing various kinds of syndrome value.
303  * Note that in general we follow the AArch64 syndrome values; in a
304  * few cases the value in HSR for exceptions taken to AArch32 Hyp
305  * mode differs slightly, and we fix this up when populating HSR in
306  * arm_cpu_do_interrupt_aarch32_hyp().
307  * The exception is FP/SIMD access traps -- these report extra information
308  * when taking an exception to AArch32. For those we include the extra coproc
309  * and TA fields, and mask them out when taking the exception to AArch64.
310  */
311 static inline uint32_t syn_uncategorized(void)
312 {
313     return (EC_UNCATEGORIZED << ARM_EL_EC_SHIFT) | ARM_EL_IL;
314 }
315 
316 static inline uint32_t syn_aa64_svc(uint32_t imm16)
317 {
318     return (EC_AA64_SVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
319 }
320 
321 static inline uint32_t syn_aa64_hvc(uint32_t imm16)
322 {
323     return (EC_AA64_HVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
324 }
325 
326 static inline uint32_t syn_aa64_smc(uint32_t imm16)
327 {
328     return (EC_AA64_SMC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
329 }
330 
331 static inline uint32_t syn_aa32_svc(uint32_t imm16, bool is_16bit)
332 {
333     return (EC_AA32_SVC << ARM_EL_EC_SHIFT) | (imm16 & 0xffff)
334         | (is_16bit ? 0 : ARM_EL_IL);
335 }
336 
337 static inline uint32_t syn_aa32_hvc(uint32_t imm16)
338 {
339     return (EC_AA32_HVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
340 }
341 
342 static inline uint32_t syn_aa32_smc(void)
343 {
344     return (EC_AA32_SMC << ARM_EL_EC_SHIFT) | ARM_EL_IL;
345 }
346 
347 static inline uint32_t syn_aa64_bkpt(uint32_t imm16)
348 {
349     return (EC_AA64_BKPT << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
350 }
351 
352 static inline uint32_t syn_aa32_bkpt(uint32_t imm16, bool is_16bit)
353 {
354     return (EC_AA32_BKPT << ARM_EL_EC_SHIFT) | (imm16 & 0xffff)
355         | (is_16bit ? 0 : ARM_EL_IL);
356 }
357 
358 static inline uint32_t syn_aa64_sysregtrap(int op0, int op1, int op2,
359                                            int crn, int crm, int rt,
360                                            int isread)
361 {
362     return (EC_SYSTEMREGISTERTRAP << ARM_EL_EC_SHIFT) | ARM_EL_IL
363         | (op0 << 20) | (op2 << 17) | (op1 << 14) | (crn << 10) | (rt << 5)
364         | (crm << 1) | isread;
365 }
366 
367 static inline uint32_t syn_cp14_rt_trap(int cv, int cond, int opc1, int opc2,
368                                         int crn, int crm, int rt, int isread,
369                                         bool is_16bit)
370 {
371     return (EC_CP14RTTRAP << ARM_EL_EC_SHIFT)
372         | (is_16bit ? 0 : ARM_EL_IL)
373         | (cv << 24) | (cond << 20) | (opc2 << 17) | (opc1 << 14)
374         | (crn << 10) | (rt << 5) | (crm << 1) | isread;
375 }
376 
377 static inline uint32_t syn_cp15_rt_trap(int cv, int cond, int opc1, int opc2,
378                                         int crn, int crm, int rt, int isread,
379                                         bool is_16bit)
380 {
381     return (EC_CP15RTTRAP << ARM_EL_EC_SHIFT)
382         | (is_16bit ? 0 : ARM_EL_IL)
383         | (cv << 24) | (cond << 20) | (opc2 << 17) | (opc1 << 14)
384         | (crn << 10) | (rt << 5) | (crm << 1) | isread;
385 }
386 
387 static inline uint32_t syn_cp14_rrt_trap(int cv, int cond, int opc1, int crm,
388                                          int rt, int rt2, int isread,
389                                          bool is_16bit)
390 {
391     return (EC_CP14RRTTRAP << ARM_EL_EC_SHIFT)
392         | (is_16bit ? 0 : ARM_EL_IL)
393         | (cv << 24) | (cond << 20) | (opc1 << 16)
394         | (rt2 << 10) | (rt << 5) | (crm << 1) | isread;
395 }
396 
397 static inline uint32_t syn_cp15_rrt_trap(int cv, int cond, int opc1, int crm,
398                                          int rt, int rt2, int isread,
399                                          bool is_16bit)
400 {
401     return (EC_CP15RRTTRAP << ARM_EL_EC_SHIFT)
402         | (is_16bit ? 0 : ARM_EL_IL)
403         | (cv << 24) | (cond << 20) | (opc1 << 16)
404         | (rt2 << 10) | (rt << 5) | (crm << 1) | isread;
405 }
406 
407 static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit)
408 {
409     /* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 coproc == 0xa */
410     return (EC_ADVSIMDFPACCESSTRAP << ARM_EL_EC_SHIFT)
411         | (is_16bit ? 0 : ARM_EL_IL)
412         | (cv << 24) | (cond << 20) | 0xa;
413 }
414 
415 static inline uint32_t syn_simd_access_trap(int cv, int cond, bool is_16bit)
416 {
417     /* AArch32 SIMD trap: TA == 1 coproc == 0 */
418     return (EC_ADVSIMDFPACCESSTRAP << ARM_EL_EC_SHIFT)
419         | (is_16bit ? 0 : ARM_EL_IL)
420         | (cv << 24) | (cond << 20) | (1 << 5);
421 }
422 
423 static inline uint32_t syn_sve_access_trap(void)
424 {
425     return EC_SVEACCESSTRAP << ARM_EL_EC_SHIFT;
426 }
427 
428 static inline uint32_t syn_insn_abort(int same_el, int ea, int s1ptw, int fsc)
429 {
430     return (EC_INSNABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
431         | ARM_EL_IL | (ea << 9) | (s1ptw << 7) | fsc;
432 }
433 
434 static inline uint32_t syn_data_abort_no_iss(int same_el,
435                                              int ea, int cm, int s1ptw,
436                                              int wnr, int fsc)
437 {
438     return (EC_DATAABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
439            | ARM_EL_IL
440            | (ea << 9) | (cm << 8) | (s1ptw << 7) | (wnr << 6) | fsc;
441 }
442 
443 static inline uint32_t syn_data_abort_with_iss(int same_el,
444                                                int sas, int sse, int srt,
445                                                int sf, int ar,
446                                                int ea, int cm, int s1ptw,
447                                                int wnr, int fsc,
448                                                bool is_16bit)
449 {
450     return (EC_DATAABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
451            | (is_16bit ? 0 : ARM_EL_IL)
452            | ARM_EL_ISV | (sas << 22) | (sse << 21) | (srt << 16)
453            | (sf << 15) | (ar << 14)
454            | (ea << 9) | (cm << 8) | (s1ptw << 7) | (wnr << 6) | fsc;
455 }
456 
457 static inline uint32_t syn_swstep(int same_el, int isv, int ex)
458 {
459     return (EC_SOFTWARESTEP << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
460         | ARM_EL_IL | (isv << 24) | (ex << 6) | 0x22;
461 }
462 
463 static inline uint32_t syn_watchpoint(int same_el, int cm, int wnr)
464 {
465     return (EC_WATCHPOINT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
466         | ARM_EL_IL | (cm << 8) | (wnr << 6) | 0x22;
467 }
468 
469 static inline uint32_t syn_breakpoint(int same_el)
470 {
471     return (EC_BREAKPOINT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
472         | ARM_EL_IL | 0x22;
473 }
474 
475 static inline uint32_t syn_wfx(int cv, int cond, int ti, bool is_16bit)
476 {
477     return (EC_WFX_TRAP << ARM_EL_EC_SHIFT) |
478            (is_16bit ? 0 : (1 << ARM_EL_IL_SHIFT)) |
479            (cv << 24) | (cond << 20) | ti;
480 }
481 
482 /* Update a QEMU watchpoint based on the information the guest has set in the
483  * DBGWCR<n>_EL1 and DBGWVR<n>_EL1 registers.
484  */
485 void hw_watchpoint_update(ARMCPU *cpu, int n);
486 /* Update the QEMU watchpoints for every guest watchpoint. This does a
487  * complete delete-and-reinstate of the QEMU watchpoint list and so is
488  * suitable for use after migration or on reset.
489  */
490 void hw_watchpoint_update_all(ARMCPU *cpu);
491 /* Update a QEMU breakpoint based on the information the guest has set in the
492  * DBGBCR<n>_EL1 and DBGBVR<n>_EL1 registers.
493  */
494 void hw_breakpoint_update(ARMCPU *cpu, int n);
495 /* Update the QEMU breakpoints for every guest breakpoint. This does a
496  * complete delete-and-reinstate of the QEMU breakpoint list and so is
497  * suitable for use after migration or on reset.
498  */
499 void hw_breakpoint_update_all(ARMCPU *cpu);
500 
501 /* Callback function for checking if a watchpoint should trigger. */
502 bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
503 
504 /* Adjust addresses (in BE32 mode) before testing against watchpoint
505  * addresses.
506  */
507 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len);
508 
509 /* Callback function for when a watchpoint or breakpoint triggers. */
510 void arm_debug_excp_handler(CPUState *cs);
511 
512 #ifdef CONFIG_USER_ONLY
513 static inline bool arm_is_psci_call(ARMCPU *cpu, int excp_type)
514 {
515     return false;
516 }
517 #else
518 /* Return true if the r0/x0 value indicates that this SMC/HVC is a PSCI call. */
519 bool arm_is_psci_call(ARMCPU *cpu, int excp_type);
520 /* Actually handle a PSCI call */
521 void arm_handle_psci_call(ARMCPU *cpu);
522 #endif
523 
524 /**
525  * arm_clear_exclusive: clear the exclusive monitor
526  * @env: CPU env
527  * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
528  */
529 static inline void arm_clear_exclusive(CPUARMState *env)
530 {
531     env->exclusive_addr = -1;
532 }
533 
534 /**
535  * ARMFaultType: type of an ARM MMU fault
536  * This corresponds to the v8A pseudocode's Fault enumeration,
537  * with extensions for QEMU internal conditions.
538  */
539 typedef enum ARMFaultType {
540     ARMFault_None,
541     ARMFault_AccessFlag,
542     ARMFault_Alignment,
543     ARMFault_Background,
544     ARMFault_Domain,
545     ARMFault_Permission,
546     ARMFault_Translation,
547     ARMFault_AddressSize,
548     ARMFault_SyncExternal,
549     ARMFault_SyncExternalOnWalk,
550     ARMFault_SyncParity,
551     ARMFault_SyncParityOnWalk,
552     ARMFault_AsyncParity,
553     ARMFault_AsyncExternal,
554     ARMFault_Debug,
555     ARMFault_TLBConflict,
556     ARMFault_Lockdown,
557     ARMFault_Exclusive,
558     ARMFault_ICacheMaint,
559     ARMFault_QEMU_NSCExec, /* v8M: NS executing in S&NSC memory */
560     ARMFault_QEMU_SFault, /* v8M: SecureFault INVTRAN, INVEP or AUVIOL */
561 } ARMFaultType;
562 
563 /**
564  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
565  * @type: Type of fault
566  * @level: Table walk level (for translation, access flag and permission faults)
567  * @domain: Domain of the fault address (for non-LPAE CPUs only)
568  * @s2addr: Address that caused a fault at stage 2
569  * @stage2: True if we faulted at stage 2
570  * @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk
571  * @ea: True if we should set the EA (external abort type) bit in syndrome
572  */
573 typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
574 struct ARMMMUFaultInfo {
575     ARMFaultType type;
576     target_ulong s2addr;
577     int level;
578     int domain;
579     bool stage2;
580     bool s1ptw;
581     bool ea;
582 };
583 
584 /**
585  * arm_fi_to_sfsc: Convert fault info struct to short-format FSC
586  * Compare pseudocode EncodeSDFSC(), though unlike that function
587  * we set up a whole FSR-format code including domain field and
588  * putting the high bit of the FSC into bit 10.
589  */
590 static inline uint32_t arm_fi_to_sfsc(ARMMMUFaultInfo *fi)
591 {
592     uint32_t fsc;
593 
594     switch (fi->type) {
595     case ARMFault_None:
596         return 0;
597     case ARMFault_AccessFlag:
598         fsc = fi->level == 1 ? 0x3 : 0x6;
599         break;
600     case ARMFault_Alignment:
601         fsc = 0x1;
602         break;
603     case ARMFault_Permission:
604         fsc = fi->level == 1 ? 0xd : 0xf;
605         break;
606     case ARMFault_Domain:
607         fsc = fi->level == 1 ? 0x9 : 0xb;
608         break;
609     case ARMFault_Translation:
610         fsc = fi->level == 1 ? 0x5 : 0x7;
611         break;
612     case ARMFault_SyncExternal:
613         fsc = 0x8 | (fi->ea << 12);
614         break;
615     case ARMFault_SyncExternalOnWalk:
616         fsc = fi->level == 1 ? 0xc : 0xe;
617         fsc |= (fi->ea << 12);
618         break;
619     case ARMFault_SyncParity:
620         fsc = 0x409;
621         break;
622     case ARMFault_SyncParityOnWalk:
623         fsc = fi->level == 1 ? 0x40c : 0x40e;
624         break;
625     case ARMFault_AsyncParity:
626         fsc = 0x408;
627         break;
628     case ARMFault_AsyncExternal:
629         fsc = 0x406 | (fi->ea << 12);
630         break;
631     case ARMFault_Debug:
632         fsc = 0x2;
633         break;
634     case ARMFault_TLBConflict:
635         fsc = 0x400;
636         break;
637     case ARMFault_Lockdown:
638         fsc = 0x404;
639         break;
640     case ARMFault_Exclusive:
641         fsc = 0x405;
642         break;
643     case ARMFault_ICacheMaint:
644         fsc = 0x4;
645         break;
646     case ARMFault_Background:
647         fsc = 0x0;
648         break;
649     case ARMFault_QEMU_NSCExec:
650         fsc = M_FAKE_FSR_NSC_EXEC;
651         break;
652     case ARMFault_QEMU_SFault:
653         fsc = M_FAKE_FSR_SFAULT;
654         break;
655     default:
656         /* Other faults can't occur in a context that requires a
657          * short-format status code.
658          */
659         g_assert_not_reached();
660     }
661 
662     fsc |= (fi->domain << 4);
663     return fsc;
664 }
665 
666 /**
667  * arm_fi_to_lfsc: Convert fault info struct to long-format FSC
668  * Compare pseudocode EncodeLDFSC(), though unlike that function
669  * we fill in also the LPAE bit 9 of a DFSR format.
670  */
671 static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
672 {
673     uint32_t fsc;
674 
675     switch (fi->type) {
676     case ARMFault_None:
677         return 0;
678     case ARMFault_AddressSize:
679         fsc = fi->level & 3;
680         break;
681     case ARMFault_AccessFlag:
682         fsc = (fi->level & 3) | (0x2 << 2);
683         break;
684     case ARMFault_Permission:
685         fsc = (fi->level & 3) | (0x3 << 2);
686         break;
687     case ARMFault_Translation:
688         fsc = (fi->level & 3) | (0x1 << 2);
689         break;
690     case ARMFault_SyncExternal:
691         fsc = 0x10 | (fi->ea << 12);
692         break;
693     case ARMFault_SyncExternalOnWalk:
694         fsc = (fi->level & 3) | (0x5 << 2) | (fi->ea << 12);
695         break;
696     case ARMFault_SyncParity:
697         fsc = 0x18;
698         break;
699     case ARMFault_SyncParityOnWalk:
700         fsc = (fi->level & 3) | (0x7 << 2);
701         break;
702     case ARMFault_AsyncParity:
703         fsc = 0x19;
704         break;
705     case ARMFault_AsyncExternal:
706         fsc = 0x11 | (fi->ea << 12);
707         break;
708     case ARMFault_Alignment:
709         fsc = 0x21;
710         break;
711     case ARMFault_Debug:
712         fsc = 0x22;
713         break;
714     case ARMFault_TLBConflict:
715         fsc = 0x30;
716         break;
717     case ARMFault_Lockdown:
718         fsc = 0x34;
719         break;
720     case ARMFault_Exclusive:
721         fsc = 0x35;
722         break;
723     default:
724         /* Other faults can't occur in a context that requires a
725          * long-format status code.
726          */
727         g_assert_not_reached();
728     }
729 
730     fsc |= 1 << 9;
731     return fsc;
732 }
733 
734 static inline bool arm_extabort_type(MemTxResult result)
735 {
736     /* The EA bit in syndromes and fault status registers is an
737      * IMPDEF classification of external aborts. ARM implementations
738      * usually use this to indicate AXI bus Decode error (0) or
739      * Slave error (1); in QEMU we follow that.
740      */
741     return result != MEMTX_DECODE_ERROR;
742 }
743 
744 /* Do a page table walk and add page to TLB if possible */
745 bool arm_tlb_fill(CPUState *cpu, vaddr address,
746                   MMUAccessType access_type, int mmu_idx,
747                   ARMMMUFaultInfo *fi);
748 
749 /* Return true if the stage 1 translation regime is using LPAE format page
750  * tables */
751 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx);
752 
753 /* Raise a data fault alignment exception for the specified virtual address */
754 void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
755                                  MMUAccessType access_type,
756                                  int mmu_idx, uintptr_t retaddr);
757 
758 /* arm_cpu_do_transaction_failed: handle a memory system error response
759  * (eg "no device/memory present at address") by raising an external abort
760  * exception
761  */
762 void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
763                                    vaddr addr, unsigned size,
764                                    MMUAccessType access_type,
765                                    int mmu_idx, MemTxAttrs attrs,
766                                    MemTxResult response, uintptr_t retaddr);
767 
768 /* Call any registered EL change hooks */
769 static inline void arm_call_pre_el_change_hook(ARMCPU *cpu)
770 {
771     ARMELChangeHook *hook, *next;
772     QLIST_FOREACH_SAFE(hook, &cpu->pre_el_change_hooks, node, next) {
773         hook->hook(cpu, hook->opaque);
774     }
775 }
776 static inline void arm_call_el_change_hook(ARMCPU *cpu)
777 {
778     ARMELChangeHook *hook, *next;
779     QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) {
780         hook->hook(cpu, hook->opaque);
781     }
782 }
783 
784 /* Return true if this address translation regime is secure */
785 static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
786 {
787     switch (mmu_idx) {
788     case ARMMMUIdx_S12NSE0:
789     case ARMMMUIdx_S12NSE1:
790     case ARMMMUIdx_S1NSE0:
791     case ARMMMUIdx_S1NSE1:
792     case ARMMMUIdx_S1E2:
793     case ARMMMUIdx_S2NS:
794     case ARMMMUIdx_MPrivNegPri:
795     case ARMMMUIdx_MUserNegPri:
796     case ARMMMUIdx_MPriv:
797     case ARMMMUIdx_MUser:
798         return false;
799     case ARMMMUIdx_S1E3:
800     case ARMMMUIdx_S1SE0:
801     case ARMMMUIdx_S1SE1:
802     case ARMMMUIdx_MSPrivNegPri:
803     case ARMMMUIdx_MSUserNegPri:
804     case ARMMMUIdx_MSPriv:
805     case ARMMMUIdx_MSUser:
806         return true;
807     default:
808         g_assert_not_reached();
809     }
810 }
811 
812 /* Return the FSR value for a debug exception (watchpoint, hardware
813  * breakpoint or BKPT insn) targeting the specified exception level.
814  */
815 static inline uint32_t arm_debug_exception_fsr(CPUARMState *env)
816 {
817     ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
818     int target_el = arm_debug_target_el(env);
819     bool using_lpae = false;
820 
821     if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
822         using_lpae = true;
823     } else {
824         if (arm_feature(env, ARM_FEATURE_LPAE) &&
825             (env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
826             using_lpae = true;
827         }
828     }
829 
830     if (using_lpae) {
831         return arm_fi_to_lfsc(&fi);
832     } else {
833         return arm_fi_to_sfsc(&fi);
834     }
835 }
836 
837 /* Note make_memop_idx reserves 4 bits for mmu_idx, and MO_BSWAP is bit 3.
838  * Thus a TCGMemOpIdx, without any MO_ALIGN bits, fits in 8 bits.
839  */
840 #define MEMOPIDX_SHIFT  8
841 
842 /**
843  * v7m_using_psp: Return true if using process stack pointer
844  * Return true if the CPU is currently using the process stack
845  * pointer, or false if it is using the main stack pointer.
846  */
847 static inline bool v7m_using_psp(CPUARMState *env)
848 {
849     /* Handler mode always uses the main stack; for thread mode
850      * the CONTROL.SPSEL bit determines the answer.
851      * Note that in v7M it is not possible to be in Handler mode with
852      * CONTROL.SPSEL non-zero, but in v8M it is, so we must check both.
853      */
854     return !arm_v7m_is_handler_mode(env) &&
855         env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK;
856 }
857 
858 /**
859  * v7m_sp_limit: Return SP limit for current CPU state
860  * Return the SP limit value for the current CPU security state
861  * and stack pointer.
862  */
863 static inline uint32_t v7m_sp_limit(CPUARMState *env)
864 {
865     if (v7m_using_psp(env)) {
866         return env->v7m.psplim[env->v7m.secure];
867     } else {
868         return env->v7m.msplim[env->v7m.secure];
869     }
870 }
871 
872 /**
873  * aarch32_mode_name(): Return name of the AArch32 CPU mode
874  * @psr: Program Status Register indicating CPU mode
875  *
876  * Returns, for debug logging purposes, a printable representation
877  * of the AArch32 CPU mode ("svc", "usr", etc) as indicated by
878  * the low bits of the specified PSR.
879  */
880 static inline const char *aarch32_mode_name(uint32_t psr)
881 {
882     static const char cpu_mode_names[16][4] = {
883         "usr", "fiq", "irq", "svc", "???", "???", "mon", "abt",
884         "???", "???", "hyp", "und", "???", "???", "???", "sys"
885     };
886 
887     return cpu_mode_names[psr & 0xf];
888 }
889 
890 /**
891  * arm_cpu_update_virq: Update CPU_INTERRUPT_VIRQ bit in cs->interrupt_request
892  *
893  * Update the CPU_INTERRUPT_VIRQ bit in cs->interrupt_request, following
894  * a change to either the input VIRQ line from the GIC or the HCR_EL2.VI bit.
895  * Must be called with the iothread lock held.
896  */
897 void arm_cpu_update_virq(ARMCPU *cpu);
898 
899 /**
900  * arm_cpu_update_vfiq: Update CPU_INTERRUPT_VFIQ bit in cs->interrupt_request
901  *
902  * Update the CPU_INTERRUPT_VFIQ bit in cs->interrupt_request, following
903  * a change to either the input VFIQ line from the GIC or the HCR_EL2.VF bit.
904  * Must be called with the iothread lock held.
905  */
906 void arm_cpu_update_vfiq(ARMCPU *cpu);
907 
908 #endif
909