1 /* 2 * RISC-V Emulation Helpers for QEMU. 3 * 4 * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu 5 * Copyright (c) 2017-2018 SiFive, Inc. 6 * Copyright (c) 2022 VRULL GmbH 7 * 8 * This program is free software; you can redistribute it and/or modify it 9 * under the terms and conditions of the GNU General Public License, 10 * version 2 or later, as published by the Free Software Foundation. 11 * 12 * This program is distributed in the hope it will be useful, but WITHOUT 13 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 14 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 15 * more details. 16 * 17 * You should have received a copy of the GNU General Public License along with 18 * this program. If not, see <http://www.gnu.org/licenses/>. 19 */ 20 21 #include "qemu/osdep.h" 22 #include "cpu.h" 23 #include "internals.h" 24 #include "exec/exec-all.h" 25 #include "exec/cpu_ldst.h" 26 #include "exec/helper-proto.h" 27 28 /* Exceptions processing helpers */ 29 G_NORETURN void riscv_raise_exception(CPURISCVState *env, 30 uint32_t exception, uintptr_t pc) 31 { 32 CPUState *cs = env_cpu(env); 33 cs->exception_index = exception; 34 cpu_loop_exit_restore(cs, pc); 35 } 36 37 void helper_raise_exception(CPURISCVState *env, uint32_t exception) 38 { 39 riscv_raise_exception(env, exception, 0); 40 } 41 42 target_ulong helper_csrr(CPURISCVState *env, int csr) 43 { 44 /* 45 * The seed CSR must be accessed with a read-write instruction. A 46 * read-only instruction such as CSRRS/CSRRC with rs1=x0 or CSRRSI/ 47 * CSRRCI with uimm=0 will raise an illegal instruction exception. 48 */ 49 if (csr == CSR_SEED) { 50 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 51 } 52 53 target_ulong val = 0; 54 RISCVException ret = riscv_csrr(env, csr, &val); 55 56 if (ret != RISCV_EXCP_NONE) { 57 riscv_raise_exception(env, ret, GETPC()); 58 } 59 return val; 60 } 61 62 void helper_csrw(CPURISCVState *env, int csr, target_ulong src) 63 { 64 target_ulong mask = env->xl == MXL_RV32 ? UINT32_MAX : (target_ulong)-1; 65 RISCVException ret = riscv_csrrw(env, csr, NULL, src, mask); 66 67 if (ret != RISCV_EXCP_NONE) { 68 riscv_raise_exception(env, ret, GETPC()); 69 } 70 } 71 72 target_ulong helper_csrrw(CPURISCVState *env, int csr, 73 target_ulong src, target_ulong write_mask) 74 { 75 target_ulong val = 0; 76 RISCVException ret = riscv_csrrw(env, csr, &val, src, write_mask); 77 78 if (ret != RISCV_EXCP_NONE) { 79 riscv_raise_exception(env, ret, GETPC()); 80 } 81 return val; 82 } 83 84 target_ulong helper_csrr_i128(CPURISCVState *env, int csr) 85 { 86 Int128 rv = int128_zero(); 87 RISCVException ret = riscv_csrr_i128(env, csr, &rv); 88 89 if (ret != RISCV_EXCP_NONE) { 90 riscv_raise_exception(env, ret, GETPC()); 91 } 92 93 env->retxh = int128_gethi(rv); 94 return int128_getlo(rv); 95 } 96 97 void helper_csrw_i128(CPURISCVState *env, int csr, 98 target_ulong srcl, target_ulong srch) 99 { 100 RISCVException ret = riscv_csrrw_i128(env, csr, NULL, 101 int128_make128(srcl, srch), 102 UINT128_MAX); 103 104 if (ret != RISCV_EXCP_NONE) { 105 riscv_raise_exception(env, ret, GETPC()); 106 } 107 } 108 109 target_ulong helper_csrrw_i128(CPURISCVState *env, int csr, 110 target_ulong srcl, target_ulong srch, 111 target_ulong maskl, target_ulong maskh) 112 { 113 Int128 rv = int128_zero(); 114 RISCVException ret = riscv_csrrw_i128(env, csr, &rv, 115 int128_make128(srcl, srch), 116 int128_make128(maskl, maskh)); 117 118 if (ret != RISCV_EXCP_NONE) { 119 riscv_raise_exception(env, ret, GETPC()); 120 } 121 122 env->retxh = int128_gethi(rv); 123 return int128_getlo(rv); 124 } 125 126 127 /* 128 * check_zicbo_envcfg 129 * 130 * Raise virtual exceptions and illegal instruction exceptions for 131 * Zicbo[mz] instructions based on the settings of [mhs]envcfg as 132 * specified in section 2.5.1 of the CMO specification. 133 */ 134 static void check_zicbo_envcfg(CPURISCVState *env, target_ulong envbits, 135 uintptr_t ra) 136 { 137 #ifndef CONFIG_USER_ONLY 138 if ((env->priv < PRV_M) && !get_field(env->menvcfg, envbits)) { 139 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra); 140 } 141 142 if (env->virt_enabled && 143 (((env->priv <= PRV_S) && !get_field(env->henvcfg, envbits)) || 144 ((env->priv < PRV_S) && !get_field(env->senvcfg, envbits)))) { 145 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, ra); 146 } 147 148 if ((env->priv < PRV_S) && !get_field(env->senvcfg, envbits)) { 149 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra); 150 } 151 #endif 152 } 153 154 void helper_cbo_zero(CPURISCVState *env, target_ulong address) 155 { 156 RISCVCPU *cpu = env_archcpu(env); 157 uint16_t cbozlen = cpu->cfg.cboz_blocksize; 158 int mmu_idx = riscv_env_mmu_index(env, false); 159 uintptr_t ra = GETPC(); 160 void *mem; 161 162 check_zicbo_envcfg(env, MENVCFG_CBZE, ra); 163 164 /* Mask off low-bits to align-down to the cache-block. */ 165 address &= ~(cbozlen - 1); 166 167 /* 168 * cbo.zero requires MMU_DATA_STORE access. Do a probe_write() 169 * to raise any exceptions, including PMP. 170 */ 171 mem = probe_write(env, address, cbozlen, mmu_idx, ra); 172 173 if (likely(mem)) { 174 memset(mem, 0, cbozlen); 175 } else { 176 /* 177 * This means that we're dealing with an I/O page. Section 4.2 178 * of cmobase v1.0.1 says: 179 * 180 * "Cache-block zero instructions store zeros independently 181 * of whether data from the underlying memory locations are 182 * cacheable." 183 * 184 * Write zeros in address + cbozlen regardless of not being 185 * a RAM page. 186 */ 187 for (int i = 0; i < cbozlen; i++) { 188 cpu_stb_mmuidx_ra(env, address + i, 0, mmu_idx, ra); 189 } 190 } 191 } 192 193 /* 194 * check_zicbom_access 195 * 196 * Check access permissions (LOAD, STORE or FETCH as specified in 197 * section 2.5.2 of the CMO specification) for Zicbom, raising 198 * either store page-fault (non-virtualized) or store guest-page 199 * fault (virtualized). 200 */ 201 static void check_zicbom_access(CPURISCVState *env, 202 target_ulong address, 203 uintptr_t ra) 204 { 205 RISCVCPU *cpu = env_archcpu(env); 206 int mmu_idx = riscv_env_mmu_index(env, false); 207 uint16_t cbomlen = cpu->cfg.cbom_blocksize; 208 void *phost; 209 int ret; 210 211 /* Mask off low-bits to align-down to the cache-block. */ 212 address &= ~(cbomlen - 1); 213 214 /* 215 * Section 2.5.2 of cmobase v1.0.1: 216 * 217 * "A cache-block management instruction is permitted to 218 * access the specified cache block whenever a load instruction 219 * or store instruction is permitted to access the corresponding 220 * physical addresses. If neither a load instruction nor store 221 * instruction is permitted to access the physical addresses, 222 * but an instruction fetch is permitted to access the physical 223 * addresses, whether a cache-block management instruction is 224 * permitted to access the cache block is UNSPECIFIED." 225 */ 226 ret = probe_access_flags(env, address, cbomlen, MMU_DATA_LOAD, 227 mmu_idx, true, &phost, ra); 228 if (ret != TLB_INVALID_MASK) { 229 /* Success: readable */ 230 return; 231 } 232 233 /* 234 * Since not readable, must be writable. On failure, store 235 * fault/store guest amo fault will be raised by 236 * riscv_cpu_tlb_fill(). PMP exceptions will be caught 237 * there as well. 238 */ 239 probe_write(env, address, cbomlen, mmu_idx, ra); 240 } 241 242 void helper_cbo_clean_flush(CPURISCVState *env, target_ulong address) 243 { 244 uintptr_t ra = GETPC(); 245 check_zicbo_envcfg(env, MENVCFG_CBCFE, ra); 246 check_zicbom_access(env, address, ra); 247 248 /* We don't emulate the cache-hierarchy, so we're done. */ 249 } 250 251 void helper_cbo_inval(CPURISCVState *env, target_ulong address) 252 { 253 uintptr_t ra = GETPC(); 254 check_zicbo_envcfg(env, MENVCFG_CBIE, ra); 255 check_zicbom_access(env, address, ra); 256 257 /* We don't emulate the cache-hierarchy, so we're done. */ 258 } 259 260 #ifndef CONFIG_USER_ONLY 261 262 target_ulong helper_sret(CPURISCVState *env) 263 { 264 uint64_t mstatus; 265 target_ulong prev_priv, prev_virt = env->virt_enabled; 266 267 if (!(env->priv >= PRV_S)) { 268 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 269 } 270 271 target_ulong retpc = env->sepc; 272 if (!riscv_has_ext(env, RVC) && (retpc & 0x3)) { 273 riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, GETPC()); 274 } 275 276 if (get_field(env->mstatus, MSTATUS_TSR) && !(env->priv >= PRV_M)) { 277 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 278 } 279 280 if (env->virt_enabled && get_field(env->hstatus, HSTATUS_VTSR)) { 281 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC()); 282 } 283 284 mstatus = env->mstatus; 285 prev_priv = get_field(mstatus, MSTATUS_SPP); 286 mstatus = set_field(mstatus, MSTATUS_SIE, 287 get_field(mstatus, MSTATUS_SPIE)); 288 mstatus = set_field(mstatus, MSTATUS_SPIE, 1); 289 mstatus = set_field(mstatus, MSTATUS_SPP, PRV_U); 290 if (env->priv_ver >= PRIV_VERSION_1_12_0) { 291 mstatus = set_field(mstatus, MSTATUS_MPRV, 0); 292 } 293 env->mstatus = mstatus; 294 295 if (riscv_has_ext(env, RVH) && !env->virt_enabled) { 296 /* We support Hypervisor extensions and virtulisation is disabled */ 297 target_ulong hstatus = env->hstatus; 298 299 prev_virt = get_field(hstatus, HSTATUS_SPV); 300 301 hstatus = set_field(hstatus, HSTATUS_SPV, 0); 302 303 env->hstatus = hstatus; 304 305 if (prev_virt) { 306 riscv_cpu_swap_hypervisor_regs(env); 307 } 308 } 309 310 riscv_cpu_set_mode(env, prev_priv, prev_virt); 311 312 return retpc; 313 } 314 315 target_ulong helper_mret(CPURISCVState *env) 316 { 317 if (!(env->priv >= PRV_M)) { 318 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 319 } 320 321 target_ulong retpc = env->mepc; 322 if (!riscv_has_ext(env, RVC) && (retpc & 0x3)) { 323 riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, GETPC()); 324 } 325 326 uint64_t mstatus = env->mstatus; 327 target_ulong prev_priv = get_field(mstatus, MSTATUS_MPP); 328 329 if (riscv_cpu_cfg(env)->pmp && 330 !pmp_get_num_rules(env) && (prev_priv != PRV_M)) { 331 riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC()); 332 } 333 334 target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) && 335 (prev_priv != PRV_M); 336 mstatus = set_field(mstatus, MSTATUS_MIE, 337 get_field(mstatus, MSTATUS_MPIE)); 338 mstatus = set_field(mstatus, MSTATUS_MPIE, 1); 339 mstatus = set_field(mstatus, MSTATUS_MPP, 340 riscv_has_ext(env, RVU) ? PRV_U : PRV_M); 341 mstatus = set_field(mstatus, MSTATUS_MPV, 0); 342 if ((env->priv_ver >= PRIV_VERSION_1_12_0) && (prev_priv != PRV_M)) { 343 mstatus = set_field(mstatus, MSTATUS_MPRV, 0); 344 } 345 env->mstatus = mstatus; 346 347 if (riscv_has_ext(env, RVH) && prev_virt) { 348 riscv_cpu_swap_hypervisor_regs(env); 349 } 350 351 riscv_cpu_set_mode(env, prev_priv, prev_virt); 352 353 return retpc; 354 } 355 356 void helper_wfi(CPURISCVState *env) 357 { 358 CPUState *cs = env_cpu(env); 359 bool rvs = riscv_has_ext(env, RVS); 360 bool prv_u = env->priv == PRV_U; 361 bool prv_s = env->priv == PRV_S; 362 363 if (((prv_s || (!rvs && prv_u)) && get_field(env->mstatus, MSTATUS_TW)) || 364 (rvs && prv_u && !env->virt_enabled)) { 365 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 366 } else if (env->virt_enabled && 367 (prv_u || (prv_s && get_field(env->hstatus, HSTATUS_VTW)))) { 368 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC()); 369 } else { 370 cs->halted = 1; 371 cs->exception_index = EXCP_HLT; 372 cpu_loop_exit(cs); 373 } 374 } 375 376 void helper_wrs_nto(CPURISCVState *env) 377 { 378 if (env->virt_enabled && (env->priv == PRV_S || env->priv == PRV_U) && 379 get_field(env->hstatus, HSTATUS_VTW) && 380 !get_field(env->mstatus, MSTATUS_TW)) { 381 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC()); 382 } else if (env->priv != PRV_M && get_field(env->mstatus, MSTATUS_TW)) { 383 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 384 } 385 } 386 387 void helper_tlb_flush(CPURISCVState *env) 388 { 389 CPUState *cs = env_cpu(env); 390 if (!env->virt_enabled && 391 (env->priv == PRV_U || 392 (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)))) { 393 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 394 } else if (env->virt_enabled && 395 (env->priv == PRV_U || get_field(env->hstatus, HSTATUS_VTVM))) { 396 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC()); 397 } else { 398 tlb_flush(cs); 399 } 400 } 401 402 void helper_tlb_flush_all(CPURISCVState *env) 403 { 404 CPUState *cs = env_cpu(env); 405 tlb_flush_all_cpus_synced(cs); 406 } 407 408 void helper_hyp_tlb_flush(CPURISCVState *env) 409 { 410 CPUState *cs = env_cpu(env); 411 412 if (env->virt_enabled) { 413 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC()); 414 } 415 416 if (env->priv == PRV_M || 417 (env->priv == PRV_S && !env->virt_enabled)) { 418 tlb_flush(cs); 419 return; 420 } 421 422 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 423 } 424 425 void helper_hyp_gvma_tlb_flush(CPURISCVState *env) 426 { 427 if (env->priv == PRV_S && !env->virt_enabled && 428 get_field(env->mstatus, MSTATUS_TVM)) { 429 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); 430 } 431 432 helper_hyp_tlb_flush(env); 433 } 434 435 static int check_access_hlsv(CPURISCVState *env, bool x, uintptr_t ra) 436 { 437 if (env->priv == PRV_M) { 438 /* always allowed */ 439 } else if (env->virt_enabled) { 440 riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, ra); 441 } else if (env->priv == PRV_U && !get_field(env->hstatus, HSTATUS_HU)) { 442 riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, ra); 443 } 444 445 int mode = get_field(env->hstatus, HSTATUS_SPVP); 446 if (!x && mode == PRV_S && get_field(env->vsstatus, MSTATUS_SUM)) { 447 mode = MMUIdx_S_SUM; 448 } 449 return mode | MMU_2STAGE_BIT; 450 } 451 452 target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr) 453 { 454 uintptr_t ra = GETPC(); 455 int mmu_idx = check_access_hlsv(env, false, ra); 456 MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx); 457 458 return cpu_ldb_mmu(env, addr, oi, ra); 459 } 460 461 target_ulong helper_hyp_hlv_hu(CPURISCVState *env, target_ulong addr) 462 { 463 uintptr_t ra = GETPC(); 464 int mmu_idx = check_access_hlsv(env, false, ra); 465 MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx); 466 467 return cpu_ldw_mmu(env, addr, oi, ra); 468 } 469 470 target_ulong helper_hyp_hlv_wu(CPURISCVState *env, target_ulong addr) 471 { 472 uintptr_t ra = GETPC(); 473 int mmu_idx = check_access_hlsv(env, false, ra); 474 MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx); 475 476 return cpu_ldl_mmu(env, addr, oi, ra); 477 } 478 479 target_ulong helper_hyp_hlv_d(CPURISCVState *env, target_ulong addr) 480 { 481 uintptr_t ra = GETPC(); 482 int mmu_idx = check_access_hlsv(env, false, ra); 483 MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx); 484 485 return cpu_ldq_mmu(env, addr, oi, ra); 486 } 487 488 void helper_hyp_hsv_b(CPURISCVState *env, target_ulong addr, target_ulong val) 489 { 490 uintptr_t ra = GETPC(); 491 int mmu_idx = check_access_hlsv(env, false, ra); 492 MemOpIdx oi = make_memop_idx(MO_UB, mmu_idx); 493 494 cpu_stb_mmu(env, addr, val, oi, ra); 495 } 496 497 void helper_hyp_hsv_h(CPURISCVState *env, target_ulong addr, target_ulong val) 498 { 499 uintptr_t ra = GETPC(); 500 int mmu_idx = check_access_hlsv(env, false, ra); 501 MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx); 502 503 cpu_stw_mmu(env, addr, val, oi, ra); 504 } 505 506 void helper_hyp_hsv_w(CPURISCVState *env, target_ulong addr, target_ulong val) 507 { 508 uintptr_t ra = GETPC(); 509 int mmu_idx = check_access_hlsv(env, false, ra); 510 MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx); 511 512 cpu_stl_mmu(env, addr, val, oi, ra); 513 } 514 515 void helper_hyp_hsv_d(CPURISCVState *env, target_ulong addr, target_ulong val) 516 { 517 uintptr_t ra = GETPC(); 518 int mmu_idx = check_access_hlsv(env, false, ra); 519 MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx); 520 521 cpu_stq_mmu(env, addr, val, oi, ra); 522 } 523 524 /* 525 * TODO: These implementations are not quite correct. They perform the 526 * access using execute permission just fine, but the final PMP check 527 * is supposed to have read permission as well. Without replicating 528 * a fair fraction of cputlb.c, fixing this requires adding new mmu_idx 529 * which would imply that exact check in tlb_fill. 530 */ 531 target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong addr) 532 { 533 uintptr_t ra = GETPC(); 534 int mmu_idx = check_access_hlsv(env, true, ra); 535 MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx); 536 537 return cpu_ldw_code_mmu(env, addr, oi, GETPC()); 538 } 539 540 target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong addr) 541 { 542 uintptr_t ra = GETPC(); 543 int mmu_idx = check_access_hlsv(env, true, ra); 544 MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx); 545 546 return cpu_ldl_code_mmu(env, addr, oi, ra); 547 } 548 549 #endif /* !CONFIG_USER_ONLY */ 550