1 /* 2 * ARM TLB (Translation lookaside buffer) helpers. 3 * 4 * This code is licensed under the GNU GPL v2 or later. 5 * 6 * SPDX-License-Identifier: GPL-2.0-or-later 7 */ 8 #include "qemu/osdep.h" 9 #include "cpu.h" 10 #include "internals.h" 11 #include "cpu-features.h" 12 #include "exec/exec-all.h" 13 #include "exec/helper-proto.h" 14 15 16 /* 17 * Returns true if the stage 1 translation regime is using LPAE format page 18 * tables. Used when raising alignment exceptions, whose FSR changes depending 19 * on whether the long or short descriptor format is in use. 20 */ 21 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx) 22 { 23 mmu_idx = stage_1_mmu_idx(mmu_idx); 24 return regime_using_lpae_format(env, mmu_idx); 25 } 26 27 static inline uint32_t merge_syn_data_abort(uint32_t template_syn, 28 ARMMMUFaultInfo *fi, 29 unsigned int target_el, 30 bool same_el, bool is_write, 31 int fsc) 32 { 33 uint32_t syn; 34 35 /* 36 * ISV is only set for stage-2 data aborts routed to EL2 and 37 * never for stage-1 page table walks faulting on stage 2 38 * or for stage-1 faults. 39 * 40 * Furthermore, ISV is only set for certain kinds of load/stores. 41 * If the template syndrome does not have ISV set, we should leave 42 * it cleared. 43 * 44 * See ARMv8 specs, D7-1974: 45 * ISS encoding for an exception from a Data Abort, the 46 * ISV field. 47 * 48 * TODO: FEAT_LS64/FEAT_LS64_V/FEAT_SL64_ACCDATA: Translation, 49 * Access Flag, and Permission faults caused by LD64B, ST64B, 50 * ST64BV, or ST64BV0 insns report syndrome info even for stage-1 51 * faults and regardless of the target EL. 52 */ 53 if (template_syn & ARM_EL_VNCR) { 54 /* 55 * FEAT_NV2 faults on accesses via VNCR_EL2 are a special case: 56 * they are always reported as "same EL", even though we are going 57 * from EL1 to EL2. 58 */ 59 assert(!fi->stage2); 60 syn = syn_data_abort_vncr(fi->ea, is_write, fsc); 61 } else if (!(template_syn & ARM_EL_ISV) || target_el != 2 62 || fi->s1ptw || !fi->stage2) { 63 syn = syn_data_abort_no_iss(same_el, 0, 64 fi->ea, 0, fi->s1ptw, is_write, fsc); 65 } else { 66 /* 67 * Fields: IL, ISV, SAS, SSE, SRT, SF and AR come from the template 68 * syndrome created at translation time. 69 * Now we create the runtime syndrome with the remaining fields. 70 */ 71 syn = syn_data_abort_with_iss(same_el, 72 0, 0, 0, 0, 0, 73 fi->ea, 0, fi->s1ptw, is_write, fsc, 74 true); 75 /* Merge the runtime syndrome with the template syndrome. */ 76 syn |= template_syn; 77 } 78 return syn; 79 } 80 81 static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi, 82 int target_el, int mmu_idx, uint32_t *ret_fsc) 83 { 84 ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx); 85 uint32_t fsr, fsc; 86 87 /* 88 * For M-profile there is no guest-facing FSR. We compute a 89 * short-form value for env->exception.fsr which we will then 90 * examine in arm_v7m_cpu_do_interrupt(). In theory we could 91 * use the LPAE format instead as long as both bits of code agree 92 * (and arm_fi_to_lfsc() handled the M-profile specific 93 * ARMFault_QEMU_NSCExec and ARMFault_QEMU_SFault cases). 94 */ 95 if (!arm_feature(env, ARM_FEATURE_M) && 96 (target_el == 2 || arm_el_is_aa64(env, target_el) || 97 arm_s1_regime_using_lpae_format(env, arm_mmu_idx))) { 98 /* 99 * LPAE format fault status register : bottom 6 bits are 100 * status code in the same form as needed for syndrome 101 */ 102 fsr = arm_fi_to_lfsc(fi); 103 fsc = extract32(fsr, 0, 6); 104 } else { 105 fsr = arm_fi_to_sfsc(fi); 106 /* 107 * Short format FSR : this fault will never actually be reported 108 * to an EL that uses a syndrome register. Use a (currently) 109 * reserved FSR code in case the constructed syndrome does leak 110 * into the guest somehow. 111 */ 112 fsc = 0x3f; 113 } 114 115 *ret_fsc = fsc; 116 return fsr; 117 } 118 119 static bool report_as_gpc_exception(ARMCPU *cpu, int current_el, 120 ARMMMUFaultInfo *fi) 121 { 122 bool ret; 123 124 switch (fi->gpcf) { 125 case GPCF_None: 126 return false; 127 case GPCF_AddressSize: 128 case GPCF_Walk: 129 case GPCF_EABT: 130 /* R_PYTGX: GPT faults are reported as GPC. */ 131 ret = true; 132 break; 133 case GPCF_Fail: 134 /* 135 * R_BLYPM: A GPF at EL3 is reported as insn or data abort. 136 * R_VBZMW, R_LXHQR: A GPF at EL[0-2] is reported as a GPC 137 * if SCR_EL3.GPF is set, otherwise an insn or data abort. 138 */ 139 ret = (cpu->env.cp15.scr_el3 & SCR_GPF) && current_el != 3; 140 break; 141 default: 142 g_assert_not_reached(); 143 } 144 145 assert(cpu_isar_feature(aa64_rme, cpu)); 146 assert(fi->type == ARMFault_GPCFOnWalk || 147 fi->type == ARMFault_GPCFOnOutput); 148 if (fi->gpcf == GPCF_AddressSize) { 149 assert(fi->level == 0); 150 } else { 151 assert(fi->level >= 0 && fi->level <= 1); 152 } 153 154 return ret; 155 } 156 157 static unsigned encode_gpcsc(ARMMMUFaultInfo *fi) 158 { 159 static uint8_t const gpcsc[] = { 160 [GPCF_AddressSize] = 0b000000, 161 [GPCF_Walk] = 0b000100, 162 [GPCF_Fail] = 0b001100, 163 [GPCF_EABT] = 0b010100, 164 }; 165 166 /* Note that we've validated fi->gpcf and fi->level above. */ 167 return gpcsc[fi->gpcf] | fi->level; 168 } 169 170 static G_NORETURN 171 void arm_deliver_fault(ARMCPU *cpu, vaddr addr, 172 MMUAccessType access_type, 173 int mmu_idx, ARMMMUFaultInfo *fi) 174 { 175 CPUARMState *env = &cpu->env; 176 int target_el = exception_target_el(env); 177 int current_el = arm_current_el(env); 178 bool same_el; 179 uint32_t syn, exc, fsr, fsc; 180 /* 181 * We know this must be a data or insn abort, and that 182 * env->exception.syndrome contains the template syndrome set 183 * up at translate time. So we can check only the VNCR bit 184 * (and indeed syndrome does not have the EC field in it, 185 * because we masked that out in disas_set_insn_syndrome()) 186 */ 187 bool is_vncr = (mmu_idx != MMU_INST_FETCH) && 188 (env->exception.syndrome & ARM_EL_VNCR); 189 190 if (is_vncr) { 191 /* FEAT_NV2 faults on accesses via VNCR_EL2 go to EL2 */ 192 target_el = 2; 193 } 194 195 if (report_as_gpc_exception(cpu, current_el, fi)) { 196 target_el = 3; 197 198 fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc); 199 200 syn = syn_gpc(fi->stage2 && fi->type == ARMFault_GPCFOnWalk, 201 access_type == MMU_INST_FETCH, 202 encode_gpcsc(fi), is_vncr, 203 0, fi->s1ptw, 204 access_type == MMU_DATA_STORE, fsc); 205 206 env->cp15.mfar_el3 = fi->paddr; 207 switch (fi->paddr_space) { 208 case ARMSS_Secure: 209 break; 210 case ARMSS_NonSecure: 211 env->cp15.mfar_el3 |= R_MFAR_NS_MASK; 212 break; 213 case ARMSS_Root: 214 env->cp15.mfar_el3 |= R_MFAR_NSE_MASK; 215 break; 216 case ARMSS_Realm: 217 env->cp15.mfar_el3 |= R_MFAR_NSE_MASK | R_MFAR_NS_MASK; 218 break; 219 default: 220 g_assert_not_reached(); 221 } 222 223 exc = EXCP_GPC; 224 goto do_raise; 225 } 226 227 /* If SCR_EL3.GPF is unset, GPF may still be routed to EL2. */ 228 if (fi->gpcf == GPCF_Fail && target_el < 2) { 229 if (arm_hcr_el2_eff(env) & HCR_GPF) { 230 target_el = 2; 231 } 232 } 233 234 if (fi->stage2) { 235 target_el = 2; 236 env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4; 237 if (arm_is_secure_below_el3(env) && fi->s1ns) { 238 env->cp15.hpfar_el2 |= HPFAR_NS; 239 } 240 } 241 242 same_el = current_el == target_el; 243 fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc); 244 245 if (access_type == MMU_INST_FETCH) { 246 syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc); 247 exc = EXCP_PREFETCH_ABORT; 248 } else { 249 syn = merge_syn_data_abort(env->exception.syndrome, fi, target_el, 250 same_el, access_type == MMU_DATA_STORE, 251 fsc); 252 if (access_type == MMU_DATA_STORE 253 && arm_feature(env, ARM_FEATURE_V6)) { 254 fsr |= (1 << 11); 255 } 256 exc = EXCP_DATA_ABORT; 257 } 258 259 do_raise: 260 env->exception.vaddress = addr; 261 env->exception.fsr = fsr; 262 raise_exception(env, exc, syn, target_el); 263 } 264 265 /* Raise a data fault alignment exception for the specified virtual address */ 266 void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr, 267 MMUAccessType access_type, 268 int mmu_idx, uintptr_t retaddr) 269 { 270 ARMCPU *cpu = ARM_CPU(cs); 271 ARMMMUFaultInfo fi = {}; 272 273 /* now we have a real cpu fault */ 274 cpu_restore_state(cs, retaddr); 275 276 fi.type = ARMFault_Alignment; 277 arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi); 278 } 279 280 void helper_exception_pc_alignment(CPUARMState *env, target_ulong pc) 281 { 282 ARMMMUFaultInfo fi = { .type = ARMFault_Alignment }; 283 int target_el = exception_target_el(env); 284 int mmu_idx = cpu_mmu_index(env, true); 285 uint32_t fsc; 286 287 env->exception.vaddress = pc; 288 289 /* 290 * Note that the fsc is not applicable to this exception, 291 * since any syndrome is pcalignment not insn_abort. 292 */ 293 env->exception.fsr = compute_fsr_fsc(env, &fi, target_el, mmu_idx, &fsc); 294 raise_exception(env, EXCP_PREFETCH_ABORT, syn_pcalignment(), target_el); 295 } 296 297 #if !defined(CONFIG_USER_ONLY) 298 299 /* 300 * arm_cpu_do_transaction_failed: handle a memory system error response 301 * (eg "no device/memory present at address") by raising an external abort 302 * exception 303 */ 304 void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr, 305 vaddr addr, unsigned size, 306 MMUAccessType access_type, 307 int mmu_idx, MemTxAttrs attrs, 308 MemTxResult response, uintptr_t retaddr) 309 { 310 ARMCPU *cpu = ARM_CPU(cs); 311 ARMMMUFaultInfo fi = {}; 312 313 /* now we have a real cpu fault */ 314 cpu_restore_state(cs, retaddr); 315 316 fi.ea = arm_extabort_type(response); 317 fi.type = ARMFault_SyncExternal; 318 arm_deliver_fault(cpu, addr, access_type, mmu_idx, &fi); 319 } 320 321 bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size, 322 MMUAccessType access_type, int mmu_idx, 323 bool probe, uintptr_t retaddr) 324 { 325 ARMCPU *cpu = ARM_CPU(cs); 326 GetPhysAddrResult res = {}; 327 ARMMMUFaultInfo local_fi, *fi; 328 int ret; 329 330 /* 331 * Allow S1_ptw_translate to see any fault generated here. 332 * Since this may recurse, read and clear. 333 */ 334 fi = cpu->env.tlb_fi; 335 if (fi) { 336 cpu->env.tlb_fi = NULL; 337 } else { 338 fi = memset(&local_fi, 0, sizeof(local_fi)); 339 } 340 341 /* 342 * Walk the page table and (if the mapping exists) add the page 343 * to the TLB. On success, return true. Otherwise, if probing, 344 * return false. Otherwise populate fsr with ARM DFSR/IFSR fault 345 * register format, and signal the fault. 346 */ 347 ret = get_phys_addr(&cpu->env, address, access_type, 348 core_to_arm_mmu_idx(&cpu->env, mmu_idx), 349 &res, fi); 350 if (likely(!ret)) { 351 /* 352 * Map a single [sub]page. Regions smaller than our declared 353 * target page size are handled specially, so for those we 354 * pass in the exact addresses. 355 */ 356 if (res.f.lg_page_size >= TARGET_PAGE_BITS) { 357 res.f.phys_addr &= TARGET_PAGE_MASK; 358 address &= TARGET_PAGE_MASK; 359 } 360 361 res.f.extra.arm.pte_attrs = res.cacheattrs.attrs; 362 res.f.extra.arm.shareability = res.cacheattrs.shareability; 363 364 tlb_set_page_full(cs, mmu_idx, address, &res.f); 365 return true; 366 } else if (probe) { 367 return false; 368 } else { 369 /* now we have a real cpu fault */ 370 cpu_restore_state(cs, retaddr); 371 arm_deliver_fault(cpu, address, access_type, mmu_idx, fi); 372 } 373 } 374 #else 375 void arm_cpu_record_sigsegv(CPUState *cs, vaddr addr, 376 MMUAccessType access_type, 377 bool maperr, uintptr_t ra) 378 { 379 ARMMMUFaultInfo fi = { 380 .type = maperr ? ARMFault_Translation : ARMFault_Permission, 381 .level = 3, 382 }; 383 ARMCPU *cpu = ARM_CPU(cs); 384 385 /* 386 * We report both ESR and FAR to signal handlers. 387 * For now, it's easiest to deliver the fault normally. 388 */ 389 cpu_restore_state(cs, ra); 390 arm_deliver_fault(cpu, addr, access_type, MMU_USER_IDX, &fi); 391 } 392 393 void arm_cpu_record_sigbus(CPUState *cs, vaddr addr, 394 MMUAccessType access_type, uintptr_t ra) 395 { 396 arm_cpu_do_unaligned_access(cs, addr, access_type, MMU_USER_IDX, ra); 397 } 398 #endif /* !defined(CONFIG_USER_ONLY) */ 399