xref: /openbmc/qemu/target/arm/tcg/tlb_helper.c (revision 806f71ee)
1 /*
2  * ARM TLB (Translation lookaside buffer) helpers.
3  *
4  * This code is licensed under the GNU GPL v2 or later.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 #include "qemu/osdep.h"
9 #include "cpu.h"
10 #include "internals.h"
11 #include "cpu-features.h"
12 #include "exec/exec-all.h"
13 #include "exec/helper-proto.h"
14 
15 
16 /*
17  * Returns true if the stage 1 translation regime is using LPAE format page
18  * tables. Used when raising alignment exceptions, whose FSR changes depending
19  * on whether the long or short descriptor format is in use.
20  */
21 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
22 {
23     mmu_idx = stage_1_mmu_idx(mmu_idx);
24     return regime_using_lpae_format(env, mmu_idx);
25 }
26 
27 static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
28                                             ARMMMUFaultInfo *fi,
29                                             unsigned int target_el,
30                                             bool same_el, bool is_write,
31                                             int fsc)
32 {
33     uint32_t syn;
34 
35     /*
36      * ISV is only set for stage-2 data aborts routed to EL2 and
37      * never for stage-1 page table walks faulting on stage 2
38      * or for stage-1 faults.
39      *
40      * Furthermore, ISV is only set for certain kinds of load/stores.
41      * If the template syndrome does not have ISV set, we should leave
42      * it cleared.
43      *
44      * See ARMv8 specs, D7-1974:
45      * ISS encoding for an exception from a Data Abort, the
46      * ISV field.
47      *
48      * TODO: FEAT_LS64/FEAT_LS64_V/FEAT_SL64_ACCDATA: Translation,
49      * Access Flag, and Permission faults caused by LD64B, ST64B,
50      * ST64BV, or ST64BV0 insns report syndrome info even for stage-1
51      * faults and regardless of the target EL.
52      */
53     if (!(template_syn & ARM_EL_ISV) || target_el != 2
54         || fi->s1ptw || !fi->stage2) {
55         syn = syn_data_abort_no_iss(same_el, 0,
56                                     fi->ea, 0, fi->s1ptw, is_write, fsc);
57     } else {
58         /*
59          * Fields: IL, ISV, SAS, SSE, SRT, SF and AR come from the template
60          * syndrome created at translation time.
61          * Now we create the runtime syndrome with the remaining fields.
62          */
63         syn = syn_data_abort_with_iss(same_el,
64                                       0, 0, 0, 0, 0,
65                                       fi->ea, 0, fi->s1ptw, is_write, fsc,
66                                       true);
67         /* Merge the runtime syndrome with the template syndrome.  */
68         syn |= template_syn;
69     }
70     return syn;
71 }
72 
73 static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
74                                 int target_el, int mmu_idx, uint32_t *ret_fsc)
75 {
76     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
77     uint32_t fsr, fsc;
78 
79     /*
80      * For M-profile there is no guest-facing FSR. We compute a
81      * short-form value for env->exception.fsr which we will then
82      * examine in arm_v7m_cpu_do_interrupt(). In theory we could
83      * use the LPAE format instead as long as both bits of code agree
84      * (and arm_fi_to_lfsc() handled the M-profile specific
85      * ARMFault_QEMU_NSCExec and ARMFault_QEMU_SFault cases).
86      */
87     if (!arm_feature(env, ARM_FEATURE_M) &&
88         (target_el == 2 || arm_el_is_aa64(env, target_el) ||
89          arm_s1_regime_using_lpae_format(env, arm_mmu_idx))) {
90         /*
91          * LPAE format fault status register : bottom 6 bits are
92          * status code in the same form as needed for syndrome
93          */
94         fsr = arm_fi_to_lfsc(fi);
95         fsc = extract32(fsr, 0, 6);
96     } else {
97         fsr = arm_fi_to_sfsc(fi);
98         /*
99          * Short format FSR : this fault will never actually be reported
100          * to an EL that uses a syndrome register. Use a (currently)
101          * reserved FSR code in case the constructed syndrome does leak
102          * into the guest somehow.
103          */
104         fsc = 0x3f;
105     }
106 
107     *ret_fsc = fsc;
108     return fsr;
109 }
110 
111 static bool report_as_gpc_exception(ARMCPU *cpu, int current_el,
112                                     ARMMMUFaultInfo *fi)
113 {
114     bool ret;
115 
116     switch (fi->gpcf) {
117     case GPCF_None:
118         return false;
119     case GPCF_AddressSize:
120     case GPCF_Walk:
121     case GPCF_EABT:
122         /* R_PYTGX: GPT faults are reported as GPC. */
123         ret = true;
124         break;
125     case GPCF_Fail:
126         /*
127          * R_BLYPM: A GPF at EL3 is reported as insn or data abort.
128          * R_VBZMW, R_LXHQR: A GPF at EL[0-2] is reported as a GPC
129          * if SCR_EL3.GPF is set, otherwise an insn or data abort.
130          */
131         ret = (cpu->env.cp15.scr_el3 & SCR_GPF) && current_el != 3;
132         break;
133     default:
134         g_assert_not_reached();
135     }
136 
137     assert(cpu_isar_feature(aa64_rme, cpu));
138     assert(fi->type == ARMFault_GPCFOnWalk ||
139            fi->type == ARMFault_GPCFOnOutput);
140     if (fi->gpcf == GPCF_AddressSize) {
141         assert(fi->level == 0);
142     } else {
143         assert(fi->level >= 0 && fi->level <= 1);
144     }
145 
146     return ret;
147 }
148 
149 static unsigned encode_gpcsc(ARMMMUFaultInfo *fi)
150 {
151     static uint8_t const gpcsc[] = {
152         [GPCF_AddressSize] = 0b000000,
153         [GPCF_Walk]        = 0b000100,
154         [GPCF_Fail]        = 0b001100,
155         [GPCF_EABT]        = 0b010100,
156     };
157 
158     /* Note that we've validated fi->gpcf and fi->level above. */
159     return gpcsc[fi->gpcf] | fi->level;
160 }
161 
162 static G_NORETURN
163 void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
164                        MMUAccessType access_type,
165                        int mmu_idx, ARMMMUFaultInfo *fi)
166 {
167     CPUARMState *env = &cpu->env;
168     int target_el = exception_target_el(env);
169     int current_el = arm_current_el(env);
170     bool same_el;
171     uint32_t syn, exc, fsr, fsc;
172 
173     if (report_as_gpc_exception(cpu, current_el, fi)) {
174         target_el = 3;
175 
176         fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
177 
178         syn = syn_gpc(fi->stage2 && fi->type == ARMFault_GPCFOnWalk,
179                       access_type == MMU_INST_FETCH,
180                       encode_gpcsc(fi), 0, fi->s1ptw,
181                       access_type == MMU_DATA_STORE, fsc);
182 
183         env->cp15.mfar_el3 = fi->paddr;
184         switch (fi->paddr_space) {
185         case ARMSS_Secure:
186             break;
187         case ARMSS_NonSecure:
188             env->cp15.mfar_el3 |= R_MFAR_NS_MASK;
189             break;
190         case ARMSS_Root:
191             env->cp15.mfar_el3 |= R_MFAR_NSE_MASK;
192             break;
193         case ARMSS_Realm:
194             env->cp15.mfar_el3 |= R_MFAR_NSE_MASK | R_MFAR_NS_MASK;
195             break;
196         default:
197             g_assert_not_reached();
198         }
199 
200         exc = EXCP_GPC;
201         goto do_raise;
202     }
203 
204     /* If SCR_EL3.GPF is unset, GPF may still be routed to EL2. */
205     if (fi->gpcf == GPCF_Fail && target_el < 2) {
206         if (arm_hcr_el2_eff(env) & HCR_GPF) {
207             target_el = 2;
208         }
209     }
210 
211     if (fi->stage2) {
212         target_el = 2;
213         env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
214         if (arm_is_secure_below_el3(env) && fi->s1ns) {
215             env->cp15.hpfar_el2 |= HPFAR_NS;
216         }
217     }
218 
219     same_el = current_el == target_el;
220     fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
221 
222     if (access_type == MMU_INST_FETCH) {
223         syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
224         exc = EXCP_PREFETCH_ABORT;
225     } else {
226         syn = merge_syn_data_abort(env->exception.syndrome, fi, target_el,
227                                    same_el, access_type == MMU_DATA_STORE,
228                                    fsc);
229         if (access_type == MMU_DATA_STORE
230             && arm_feature(env, ARM_FEATURE_V6)) {
231             fsr |= (1 << 11);
232         }
233         exc = EXCP_DATA_ABORT;
234     }
235 
236  do_raise:
237     env->exception.vaddress = addr;
238     env->exception.fsr = fsr;
239     raise_exception(env, exc, syn, target_el);
240 }
241 
242 /* Raise a data fault alignment exception for the specified virtual address */
243 void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
244                                  MMUAccessType access_type,
245                                  int mmu_idx, uintptr_t retaddr)
246 {
247     ARMCPU *cpu = ARM_CPU(cs);
248     ARMMMUFaultInfo fi = {};
249 
250     /* now we have a real cpu fault */
251     cpu_restore_state(cs, retaddr);
252 
253     fi.type = ARMFault_Alignment;
254     arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi);
255 }
256 
257 void helper_exception_pc_alignment(CPUARMState *env, target_ulong pc)
258 {
259     ARMMMUFaultInfo fi = { .type = ARMFault_Alignment };
260     int target_el = exception_target_el(env);
261     int mmu_idx = cpu_mmu_index(env, true);
262     uint32_t fsc;
263 
264     env->exception.vaddress = pc;
265 
266     /*
267      * Note that the fsc is not applicable to this exception,
268      * since any syndrome is pcalignment not insn_abort.
269      */
270     env->exception.fsr = compute_fsr_fsc(env, &fi, target_el, mmu_idx, &fsc);
271     raise_exception(env, EXCP_PREFETCH_ABORT, syn_pcalignment(), target_el);
272 }
273 
274 #if !defined(CONFIG_USER_ONLY)
275 
276 /*
277  * arm_cpu_do_transaction_failed: handle a memory system error response
278  * (eg "no device/memory present at address") by raising an external abort
279  * exception
280  */
281 void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
282                                    vaddr addr, unsigned size,
283                                    MMUAccessType access_type,
284                                    int mmu_idx, MemTxAttrs attrs,
285                                    MemTxResult response, uintptr_t retaddr)
286 {
287     ARMCPU *cpu = ARM_CPU(cs);
288     ARMMMUFaultInfo fi = {};
289 
290     /* now we have a real cpu fault */
291     cpu_restore_state(cs, retaddr);
292 
293     fi.ea = arm_extabort_type(response);
294     fi.type = ARMFault_SyncExternal;
295     arm_deliver_fault(cpu, addr, access_type, mmu_idx, &fi);
296 }
297 
298 bool arm_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
299                       MMUAccessType access_type, int mmu_idx,
300                       bool probe, uintptr_t retaddr)
301 {
302     ARMCPU *cpu = ARM_CPU(cs);
303     GetPhysAddrResult res = {};
304     ARMMMUFaultInfo local_fi, *fi;
305     int ret;
306 
307     /*
308      * Allow S1_ptw_translate to see any fault generated here.
309      * Since this may recurse, read and clear.
310      */
311     fi = cpu->env.tlb_fi;
312     if (fi) {
313         cpu->env.tlb_fi = NULL;
314     } else {
315         fi = memset(&local_fi, 0, sizeof(local_fi));
316     }
317 
318     /*
319      * Walk the page table and (if the mapping exists) add the page
320      * to the TLB.  On success, return true.  Otherwise, if probing,
321      * return false.  Otherwise populate fsr with ARM DFSR/IFSR fault
322      * register format, and signal the fault.
323      */
324     ret = get_phys_addr(&cpu->env, address, access_type,
325                         core_to_arm_mmu_idx(&cpu->env, mmu_idx),
326                         &res, fi);
327     if (likely(!ret)) {
328         /*
329          * Map a single [sub]page. Regions smaller than our declared
330          * target page size are handled specially, so for those we
331          * pass in the exact addresses.
332          */
333         if (res.f.lg_page_size >= TARGET_PAGE_BITS) {
334             res.f.phys_addr &= TARGET_PAGE_MASK;
335             address &= TARGET_PAGE_MASK;
336         }
337 
338         res.f.extra.arm.pte_attrs = res.cacheattrs.attrs;
339         res.f.extra.arm.shareability = res.cacheattrs.shareability;
340 
341         tlb_set_page_full(cs, mmu_idx, address, &res.f);
342         return true;
343     } else if (probe) {
344         return false;
345     } else {
346         /* now we have a real cpu fault */
347         cpu_restore_state(cs, retaddr);
348         arm_deliver_fault(cpu, address, access_type, mmu_idx, fi);
349     }
350 }
351 #else
352 void arm_cpu_record_sigsegv(CPUState *cs, vaddr addr,
353                             MMUAccessType access_type,
354                             bool maperr, uintptr_t ra)
355 {
356     ARMMMUFaultInfo fi = {
357         .type = maperr ? ARMFault_Translation : ARMFault_Permission,
358         .level = 3,
359     };
360     ARMCPU *cpu = ARM_CPU(cs);
361 
362     /*
363      * We report both ESR and FAR to signal handlers.
364      * For now, it's easiest to deliver the fault normally.
365      */
366     cpu_restore_state(cs, ra);
367     arm_deliver_fault(cpu, addr, access_type, MMU_USER_IDX, &fi);
368 }
369 
370 void arm_cpu_record_sigbus(CPUState *cs, vaddr addr,
371                            MMUAccessType access_type, uintptr_t ra)
372 {
373     arm_cpu_do_unaligned_access(cs, addr, access_type, MMU_USER_IDX, ra);
374 }
375 #endif /* !defined(CONFIG_USER_ONLY) */
376