1 /* 2 * RISC-V Emulation Helpers for QEMU. 3 * 4 * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu 5 * Copyright (c) 2017-2018 SiFive, Inc. 6 * Copyright (c) 2022 VRULL GmbH 7 * 8 * This program is free software; you can redistribute it and/or modify it 9 * under the terms and conditions of the GNU General Public License, 10 * version 2 or later, as published by the Free Software Foundation. 11 * 12 * This program is distributed in the hope it will be useful, but WITHOUT 13 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 14 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 15 * more details. 16 * 17 * You should have received a copy of the GNU General Public License along with 18 * this program. If not, see <http://www.gnu.org/licenses/>. 19 */ 20 21 #include "qemu/osdep.h" 22 #include "cpu.h" 23 #include "internals.h" 24 #include "exec/exec-all.h" 25 #include "exec/cpu_ldst.h" 26 #include "exec/helper-proto.h" 27 28 /* Exceptions processing helpers */ 29 G_NORETURN void riscv_raise_exception(CPURISCVState *env, 30 uint32_t exception, uintptr_t pc) 31 { 32 CPUState *cs = env_cpu(env); 33 cs->exception_index = exception; 34 cpu_loop_exit_restore(cs, pc); 35 } 36 37 void helper_raise_exception(CPURISCVState *env, uint32_t exception) 38 { 39 riscv_raise_exception(env, exception, 0); 40 } 41 42 target_ulong helper_csrr(CPURISCVState *env, int csr) 43 { 44 /* 45 * The seed CSR must be accessed with a read-write instruction. A 46 * read-only instruction such as CSRRS/CSRRC with rs1=x0 or CSRRSI/ 47 * CSRRCI with uimm=0 will raise an illegal instruction exception. 48 */ 49 if (csr == CSR_SEED) { 50 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 51 } 52 53 target_ulong val = 0; 54 RISCVException ret = riscv_csrrw(env, csr, &val, 0, 0); 55 56 if (ret != RISCV_EXCP_NONE) { 57 riscv_raise_exception(env, ret, GETPC()); 58 } 59 return val; 60 } 61 62 void helper_csrw(CPURISCVState *env, int csr, target_ulong src) 63 { 64 target_ulong mask = env->xl == MXL_RV32 ? UINT32_MAX : (target_ulong)-1; 65 RISCVException ret = riscv_csrrw(env, csr, NULL, src, mask); 66 67 if (ret != RISCV_EXCP_NONE) { 68 riscv_raise_exception(env, ret, GETPC()); 69 } 70 } 71 72 target_ulong helper_csrrw(CPURISCVState *env, int csr, 73 target_ulong src, target_ulong write_mask) 74 { 75 target_ulong val = 0; 76 RISCVException ret = riscv_csrrw(env, csr, &val, src, write_mask); 77 78 if (ret != RISCV_EXCP_NONE) { 79 riscv_raise_exception(env, ret, GETPC()); 80 } 81 return val; 82 } 83 84 target_ulong helper_csrr_i128(CPURISCVState *env, int csr) 85 { 86 Int128 rv = int128_zero(); 87 RISCVException ret = riscv_csrrw_i128(env, csr, &rv, 88 int128_zero(), 89 int128_zero()); 90 91 if (ret != RISCV_EXCP_NONE) { 92 riscv_raise_exception(env, ret, GETPC()); 93 } 94 95 env->retxh = int128_gethi(rv); 96 return int128_getlo(rv); 97 } 98 99 void helper_csrw_i128(CPURISCVState *env, int csr, 100 target_ulong srcl, target_ulong srch) 101 { 102 RISCVException ret = riscv_csrrw_i128(env, csr, NULL, 103 int128_make128(srcl, srch), 104 UINT128_MAX); 105 106 if (ret != RISCV_EXCP_NONE) { 107 riscv_raise_exception(env, ret, GETPC()); 108 } 109 } 110 111 target_ulong helper_csrrw_i128(CPURISCVState *env, int csr, 112 target_ulong srcl, target_ulong srch, 113 target_ulong maskl, target_ulong maskh) 114 { 115 Int128 rv = int128_zero(); 116 RISCVException ret = riscv_csrrw_i128(env, csr, &rv, 117 int128_make128(srcl, srch), 118 int128_make128(maskl, maskh)); 119 120 if (ret != RISCV_EXCP_NONE) { 121 riscv_raise_exception(env, ret, GETPC()); 122 } 123 124 env->retxh = int128_gethi(rv); 125 return int128_getlo(rv); 126 } 127 128 129 /* 130 * check_zicbo_envcfg 131 * 132 * Raise virtual exceptions and illegal instruction exceptions for 133 * Zicbo[mz] instructions based on the settings of [mhs]envcfg as 134 * specified in section 2.5.1 of the CMO specification. 135 */ 136 static void check_zicbo_envcfg(CPURISCVState *env, target_ulong envbits, 137 uintptr_t ra) 138 { 139 #ifndef CONFIG_USER_ONLY 140 if ((env->priv < PRV_M) && !get_field(env->menvcfg, envbits)) { 141 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra); 142 } 143 144 if (env->virt_enabled && 145 (((env->priv <= PRV_S) && !get_field(env->henvcfg, envbits)) || 146 ((env->priv < PRV_S) && !get_field(env->senvcfg, envbits)))) { 147 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, ra); 148 } 149 150 if ((env->priv < PRV_S) && !get_field(env->senvcfg, envbits)) { 151 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra); 152 } 153 #endif 154 } 155 156 void helper_cbo_zero(CPURISCVState *env, target_ulong address) 157 { 158 RISCVCPU *cpu = env_archcpu(env); 159 uint16_t cbozlen = cpu->cfg.cboz_blocksize; 160 int mmu_idx = riscv_env_mmu_index(env, false); 161 uintptr_t ra = GETPC(); 162 void *mem; 163 164 check_zicbo_envcfg(env, MENVCFG_CBZE, ra); 165 166 /* Mask off low-bits to align-down to the cache-block. */ 167 address &= ~(cbozlen - 1); 168 169 /* 170 * cbo.zero requires MMU_DATA_STORE access. Do a probe_write() 171 * to raise any exceptions, including PMP. 172 */ 173 mem = probe_write(env, address, cbozlen, mmu_idx, ra); 174 175 if (likely(mem)) { 176 memset(mem, 0, cbozlen); 177 } else { 178 /* 179 * This means that we're dealing with an I/O page. Section 4.2 180 * of cmobase v1.0.1 says: 181 * 182 * "Cache-block zero instructions store zeros independently 183 * of whether data from the underlying memory locations are 184 * cacheable." 185 * 186 * Write zeros in address + cbozlen regardless of not being 187 * a RAM page. 188 */ 189 for (int i = 0; i < cbozlen; i++) { 190 cpu_stb_mmuidx_ra(env, address + i, 0, mmu_idx, ra); 191 } 192 } 193 } 194 195 /* 196 * check_zicbom_access 197 * 198 * Check access permissions (LOAD, STORE or FETCH as specified in 199 * section 2.5.2 of the CMO specification) for Zicbom, raising 200 * either store page-fault (non-virtualized) or store guest-page 201 * fault (virtualized). 202 */ 203 static void check_zicbom_access(CPURISCVState *env, 204 target_ulong address, 205 uintptr_t ra) 206 { 207 RISCVCPU *cpu = env_archcpu(env); 208 int mmu_idx = riscv_env_mmu_index(env, false); 209 uint16_t cbomlen = cpu->cfg.cbom_blocksize; 210 void *phost; 211 int ret; 212 213 /* Mask off low-bits to align-down to the cache-block. */ 214 address &= ~(cbomlen - 1); 215 216 /* 217 * Section 2.5.2 of cmobase v1.0.1: 218 * 219 * "A cache-block management instruction is permitted to 220 * access the specified cache block whenever a load instruction 221 * or store instruction is permitted to access the corresponding 222 * physical addresses. If neither a load instruction nor store 223 * instruction is permitted to access the physical addresses, 224 * but an instruction fetch is permitted to access the physical 225 * addresses, whether a cache-block management instruction is 226 * permitted to access the cache block is UNSPECIFIED." 227 */ 228 ret = probe_access_flags(env, address, cbomlen, MMU_DATA_LOAD, 229 mmu_idx, true, &phost, ra); 230 if (ret != TLB_INVALID_MASK) { 231 /* Success: readable */ 232 return; 233 } 234 235 /* 236 * Since not readable, must be writable. On failure, store 237 * fault/store guest amo fault will be raised by 238 * riscv_cpu_tlb_fill(). PMP exceptions will be caught 239 * there as well. 240 */ 241 probe_write(env, address, cbomlen, mmu_idx, ra); 242 } 243 244 void helper_cbo_clean_flush(CPURISCVState *env, target_ulong address) 245 { 246 uintptr_t ra = GETPC(); 247 check_zicbo_envcfg(env, MENVCFG_CBCFE, ra); 248 check_zicbom_access(env, address, ra); 249 250 /* We don't emulate the cache-hierarchy, so we're done. */ 251 } 252 253 void helper_cbo_inval(CPURISCVState *env, target_ulong address) 254 { 255 uintptr_t ra = GETPC(); 256 check_zicbo_envcfg(env, MENVCFG_CBIE, ra); 257 check_zicbom_access(env, address, ra); 258 259 /* We don't emulate the cache-hierarchy, so we're done. */ 260 } 261 262 #ifndef CONFIG_USER_ONLY 263 264 target_ulong helper_sret(CPURISCVState *env) 265 { 266 uint64_t mstatus; 267 target_ulong prev_priv, prev_virt; 268 269 if (!(env->priv >= PRV_S)) { 270 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 271 } 272 273 target_ulong retpc = env->sepc; 274 if (!riscv_has_ext(env, RVC) && (retpc & 0x3)) { 275 riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, GETPC()); 276 } 277 278 if (get_field(env->mstatus, MSTATUS_TSR) && !(env->priv >= PRV_M)) { 279 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 280 } 281 282 if (env->virt_enabled && get_field(env->hstatus, HSTATUS_VTSR)) { 283 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC()); 284 } 285 286 mstatus = env->mstatus; 287 prev_priv = get_field(mstatus, MSTATUS_SPP); 288 mstatus = set_field(mstatus, MSTATUS_SIE, 289 get_field(mstatus, MSTATUS_SPIE)); 290 mstatus = set_field(mstatus, MSTATUS_SPIE, 1); 291 mstatus = set_field(mstatus, MSTATUS_SPP, PRV_U); 292 if (env->priv_ver >= PRIV_VERSION_1_12_0) { 293 mstatus = set_field(mstatus, MSTATUS_MPRV, 0); 294 } 295 env->mstatus = mstatus; 296 297 if (riscv_has_ext(env, RVH) && !env->virt_enabled) { 298 /* We support Hypervisor extensions and virtulisation is disabled */ 299 target_ulong hstatus = env->hstatus; 300 301 prev_virt = get_field(hstatus, HSTATUS_SPV); 302 303 hstatus = set_field(hstatus, HSTATUS_SPV, 0); 304 305 env->hstatus = hstatus; 306 307 if (prev_virt) { 308 riscv_cpu_swap_hypervisor_regs(env); 309 } 310 311 riscv_cpu_set_virt_enabled(env, prev_virt); 312 } 313 314 riscv_cpu_set_mode(env, prev_priv); 315 316 return retpc; 317 } 318 319 target_ulong helper_mret(CPURISCVState *env) 320 { 321 if (!(env->priv >= PRV_M)) { 322 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 323 } 324 325 target_ulong retpc = env->mepc; 326 if (!riscv_has_ext(env, RVC) && (retpc & 0x3)) { 327 riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, GETPC()); 328 } 329 330 uint64_t mstatus = env->mstatus; 331 target_ulong prev_priv = get_field(mstatus, MSTATUS_MPP); 332 333 if (riscv_cpu_cfg(env)->pmp && 334 !pmp_get_num_rules(env) && (prev_priv != PRV_M)) { 335 riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC()); 336 } 337 338 target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) && 339 (prev_priv != PRV_M); 340 mstatus = set_field(mstatus, MSTATUS_MIE, 341 get_field(mstatus, MSTATUS_MPIE)); 342 mstatus = set_field(mstatus, MSTATUS_MPIE, 1); 343 mstatus = set_field(mstatus, MSTATUS_MPP, 344 riscv_has_ext(env, RVU) ? PRV_U : PRV_M); 345 mstatus = set_field(mstatus, MSTATUS_MPV, 0); 346 if ((env->priv_ver >= PRIV_VERSION_1_12_0) && (prev_priv != PRV_M)) { 347 mstatus = set_field(mstatus, MSTATUS_MPRV, 0); 348 } 349 env->mstatus = mstatus; 350 riscv_cpu_set_mode(env, prev_priv); 351 352 if (riscv_has_ext(env, RVH)) { 353 if (prev_virt) { 354 riscv_cpu_swap_hypervisor_regs(env); 355 } 356 357 riscv_cpu_set_virt_enabled(env, prev_virt); 358 } 359 360 return retpc; 361 } 362 363 void helper_wfi(CPURISCVState *env) 364 { 365 CPUState *cs = env_cpu(env); 366 bool rvs = riscv_has_ext(env, RVS); 367 bool prv_u = env->priv == PRV_U; 368 bool prv_s = env->priv == PRV_S; 369 370 if (((prv_s || (!rvs && prv_u)) && get_field(env->mstatus, MSTATUS_TW)) || 371 (rvs && prv_u && !env->virt_enabled)) { 372 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 373 } else if (env->virt_enabled && 374 (prv_u || (prv_s && get_field(env->hstatus, HSTATUS_VTW)))) { 375 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC()); 376 } else { 377 cs->halted = 1; 378 cs->exception_index = EXCP_HLT; 379 cpu_loop_exit(cs); 380 } 381 } 382 383 void helper_wrs_nto(CPURISCVState *env) 384 { 385 if (env->virt_enabled && (env->priv == PRV_S || env->priv == PRV_U) && 386 get_field(env->hstatus, HSTATUS_VTW) && 387 !get_field(env->mstatus, MSTATUS_TW)) { 388 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC()); 389 } else if (env->priv != PRV_M && get_field(env->mstatus, MSTATUS_TW)) { 390 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 391 } 392 } 393 394 void helper_tlb_flush(CPURISCVState *env) 395 { 396 CPUState *cs = env_cpu(env); 397 if (!env->virt_enabled && 398 (env->priv == PRV_U || 399 (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)))) { 400 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 401 } else if (env->virt_enabled && 402 (env->priv == PRV_U || get_field(env->hstatus, HSTATUS_VTVM))) { 403 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC()); 404 } else { 405 tlb_flush(cs); 406 } 407 } 408 409 void helper_tlb_flush_all(CPURISCVState *env) 410 { 411 CPUState *cs = env_cpu(env); 412 tlb_flush_all_cpus_synced(cs); 413 } 414 415 void helper_hyp_tlb_flush(CPURISCVState *env) 416 { 417 CPUState *cs = env_cpu(env); 418 419 if (env->virt_enabled) { 420 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC()); 421 } 422 423 if (env->priv == PRV_M || 424 (env->priv == PRV_S && !env->virt_enabled)) { 425 tlb_flush(cs); 426 return; 427 } 428 429 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 430 } 431 432 void helper_hyp_gvma_tlb_flush(CPURISCVState *env) 433 { 434 if (env->priv == PRV_S && !env->virt_enabled && 435 get_field(env->mstatus, MSTATUS_TVM)) { 436 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 437 } 438 439 helper_hyp_tlb_flush(env); 440 } 441 442 static int check_access_hlsv(CPURISCVState *env, bool x, uintptr_t ra) 443 { 444 if (env->priv == PRV_M) { 445 /* always allowed */ 446 } else if (env->virt_enabled) { 447 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, ra); 448 } else if (env->priv == PRV_U && !get_field(env->hstatus, HSTATUS_HU)) { 449 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra); 450 } 451 452 int mode = get_field(env->hstatus, HSTATUS_SPVP); 453 if (!x && mode == PRV_S && get_field(env->vsstatus, MSTATUS_SUM)) { 454 mode = MMUIdx_S_SUM; 455 } 456 return mode | MMU_2STAGE_BIT; 457 } 458 459 target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr) 460 { 461 uintptr_t ra = GETPC(); 462 int mmu_idx = check_access_hlsv(env, false, ra); 463 MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx); 464 465 return cpu_ldb_mmu(env, addr, oi, ra); 466 } 467 468 target_ulong helper_hyp_hlv_hu(CPURISCVState *env, target_ulong addr) 469 { 470 uintptr_t ra = GETPC(); 471 int mmu_idx = check_access_hlsv(env, false, ra); 472 MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx); 473 474 return cpu_ldw_mmu(env, addr, oi, ra); 475 } 476 477 target_ulong helper_hyp_hlv_wu(CPURISCVState *env, target_ulong addr) 478 { 479 uintptr_t ra = GETPC(); 480 int mmu_idx = check_access_hlsv(env, false, ra); 481 MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx); 482 483 return cpu_ldl_mmu(env, addr, oi, ra); 484 } 485 486 target_ulong helper_hyp_hlv_d(CPURISCVState *env, target_ulong addr) 487 { 488 uintptr_t ra = GETPC(); 489 int mmu_idx = check_access_hlsv(env, false, ra); 490 MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx); 491 492 return cpu_ldq_mmu(env, addr, oi, ra); 493 } 494 495 void helper_hyp_hsv_b(CPURISCVState *env, target_ulong addr, target_ulong val) 496 { 497 uintptr_t ra = GETPC(); 498 int mmu_idx = check_access_hlsv(env, false, ra); 499 MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx); 500 501 cpu_stb_mmu(env, addr, val, oi, ra); 502 } 503 504 void helper_hyp_hsv_h(CPURISCVState *env, target_ulong addr, target_ulong val) 505 { 506 uintptr_t ra = GETPC(); 507 int mmu_idx = check_access_hlsv(env, false, ra); 508 MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx); 509 510 cpu_stw_mmu(env, addr, val, oi, ra); 511 } 512 513 void helper_hyp_hsv_w(CPURISCVState *env, target_ulong addr, target_ulong val) 514 { 515 uintptr_t ra = GETPC(); 516 int mmu_idx = check_access_hlsv(env, false, ra); 517 MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx); 518 519 cpu_stl_mmu(env, addr, val, oi, ra); 520 } 521 522 void helper_hyp_hsv_d(CPURISCVState *env, target_ulong addr, target_ulong val) 523 { 524 uintptr_t ra = GETPC(); 525 int mmu_idx = check_access_hlsv(env, false, ra); 526 MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx); 527 528 cpu_stq_mmu(env, addr, val, oi, ra); 529 } 530 531 /* 532 * TODO: These implementations are not quite correct. They perform the 533 * access using execute permission just fine, but the final PMP check 534 * is supposed to have read permission as well. Without replicating 535 * a fair fraction of cputlb.c, fixing this requires adding new mmu_idx 536 * which would imply that exact check in tlb_fill. 537 */ 538 target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong addr) 539 { 540 uintptr_t ra = GETPC(); 541 int mmu_idx = check_access_hlsv(env, true, ra); 542 MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx); 543 544 return cpu_ldw_code_mmu(env, addr, oi, GETPC()); 545 } 546 547 target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong addr) 548 { 549 uintptr_t ra = GETPC(); 550 int mmu_idx = check_access_hlsv(env, true, ra); 551 MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx); 552 553 return cpu_ldl_code_mmu(env, addr, oi, ra); 554 } 555 556 #endif /* !CONFIG_USER_ONLY */ 557