4 * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
5 * Copyright (c) 2017-2018 SiFive, Inc.
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms and conditions of the GNU General Public License,
9 * version 2 or later, as published by the Free Software Foundation.
11 * This program is distributed in the hope it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
16 * You should have received a copy of the GNU General Public License along with
17 * this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "hw/core/cpu.h"
24 #include "hw/registerfields.h"
25 #include "exec/cpu-defs.h"
26 #include "qemu/cpu-float.h"
27 #include "qom/object.h"
28 #include "qemu/int128.h"
31 #define TCG_GUEST_DEFAULT_MO 0
34 * RISC-V-specific extra insn start words:
35 * 1: Original instruction opcode
37 #define TARGET_INSN_START_EXTRA_WORDS 1
39 #define TYPE_RISCV_CPU "riscv-cpu"
41 #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
42 #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
43 #define CPU_RESOLVING_TYPE TYPE_RISCV_CPU
45 #define TYPE_RISCV_CPU_ANY RISCV_CPU_TYPE_NAME("any")
46 #define TYPE_RISCV_CPU_BASE32 RISCV_CPU_TYPE_NAME("rv32")
47 #define TYPE_RISCV_CPU_BASE64 RISCV_CPU_TYPE_NAME("rv64")
48 #define TYPE_RISCV_CPU_BASE128 RISCV_CPU_TYPE_NAME("x-rv128")
49 #define TYPE_RISCV_CPU_IBEX RISCV_CPU_TYPE_NAME("lowrisc-ibex")
50 #define TYPE_RISCV_CPU_SHAKTI_C RISCV_CPU_TYPE_NAME("shakti-c")
51 #define TYPE_RISCV_CPU_SIFIVE_E31 RISCV_CPU_TYPE_NAME("sifive-e31")
52 #define TYPE_RISCV_CPU_SIFIVE_E34 RISCV_CPU_TYPE_NAME("sifive-e34")
53 #define TYPE_RISCV_CPU_SIFIVE_E51 RISCV_CPU_TYPE_NAME("sifive-e51")
54 #define TYPE_RISCV_CPU_SIFIVE_U34 RISCV_CPU_TYPE_NAME("sifive-u34")
55 #define TYPE_RISCV_CPU_SIFIVE_U54 RISCV_CPU_TYPE_NAME("sifive-u54")
56 #define TYPE_RISCV_CPU_HOST RISCV_CPU_TYPE_NAME("host")
58 #if defined(TARGET_RISCV32)
59 # define TYPE_RISCV_CPU_BASE TYPE_RISCV_CPU_BASE32
60 #elif defined(TARGET_RISCV64)
61 # define TYPE_RISCV_CPU_BASE TYPE_RISCV_CPU_BASE64
64 #define RV(x) ((target_ulong)1 << (x - 'A'))
67 #define RVE RV('E') /* E and I are mutually exclusive */
79 /* S extension denotes that Supervisor mode exists, however it is possible
80 to have a core that support S mode but does not have an MMU and there
81 is currently no bit in misa to indicate whether an MMU exists or not
82 so a cpu features bitfield is required, likewise for optional PMP support */
91 /* Privileged specification version */
93 PRIV_VERSION_1_10_0
= 0,
98 #define VEXT_VERSION_1_00_0 0x00010000
104 TRANSLATE_G_STAGE_FAIL
107 #define MMU_USER_IDX 3
109 #define MAX_RISCV_PMPS (16)
111 typedef struct CPUArchState CPURISCVState
;
113 #if !defined(CONFIG_USER_ONLY)
118 #define RV_VLEN_MAX 1024
119 #define RV_MAX_MHPMEVENTS 32
120 #define RV_MAX_MHPMCOUNTERS 32
122 FIELD(VTYPE
, VLMUL
, 0, 3)
123 FIELD(VTYPE
, VSEW
, 3, 3)
124 FIELD(VTYPE
, VTA
, 6, 1)
125 FIELD(VTYPE
, VMA
, 7, 1)
126 FIELD(VTYPE
, VEDIV
, 8, 2)
127 FIELD(VTYPE
, RESERVED
, 10, sizeof(target_ulong
) * 8 - 11)
129 typedef struct PMUCTRState
{
130 /* Current value of a counter */
131 target_ulong mhpmcounter_val
;
132 /* Current value of a counter in RV32*/
133 target_ulong mhpmcounterh_val
;
134 /* Snapshot values of counter */
135 target_ulong mhpmcounter_prev
;
136 /* Snapshort value of a counter in RV32 */
137 target_ulong mhpmcounterh_prev
;
139 /* Value beyond UINT32_MAX/UINT64_MAX before overflow interrupt trigger */
140 target_ulong irq_overflow_left
;
143 struct CPUArchState
{
144 target_ulong gpr
[32];
145 target_ulong gprh
[32]; /* 64 top bits of the 128-bit registers */
146 uint64_t fpr
[32]; /* assume both F and D extensions */
148 /* vector coprocessor state. */
149 uint64_t vreg
[32 * RV_VLEN_MAX
/ 64] QEMU_ALIGNED(16);
158 target_ulong load_res
;
159 target_ulong load_val
;
163 target_ulong badaddr
;
166 target_ulong guest_phys_fault_addr
;
168 target_ulong priv_ver
;
169 target_ulong bext_ver
;
170 target_ulong vext_ver
;
172 /* RISCVMXL, but uint32_t for vmstate migration */
173 uint32_t misa_mxl
; /* current mxl */
174 uint32_t misa_mxl_max
; /* max mxl for this cpu */
175 uint32_t misa_ext
; /* current extensions */
176 uint32_t misa_ext_mask
; /* max ext for this cpu */
177 uint32_t xl
; /* current xlen */
179 /* 128-bit helpers upper part return value */
184 #ifdef CONFIG_USER_ONLY
188 #ifndef CONFIG_USER_ONLY
190 /* This contains QEMU specific information about the virt state. */
195 target_ulong mhartid
;
197 * For RV32 this is 32-bit mstatus and 32-bit mstatush.
198 * For RV64 this is a 64-bit mstatus.
204 * MIP contains the software writable version of SEIP ORed with the
205 * external interrupt value. The MIP register is always up-to-date.
206 * To keep track of the current source, we also save booleans of the values
217 target_ulong satp
; /* since: priv-1.10.0 */
219 target_ulong medeleg
;
228 target_ulong mtval
; /* since: priv-1.10.0 */
230 /* Machine and Supervisor interrupt priorities */
235 target_ulong miselect
;
236 target_ulong siselect
;
238 /* Hypervisor CSRs */
239 target_ulong hstatus
;
240 target_ulong hedeleg
;
242 target_ulong hcounteren
;
250 /* Hypervisor controlled virtual interrupt priorities */
254 /* Upper 64-bits of 128-bit CSRs */
260 * For RV32 this is 32-bit vsstatus and 32-bit vsstatush.
261 * For RV64 this is a 64-bit vsstatus.
265 target_ulong vsscratch
;
267 target_ulong vscause
;
271 /* AIA VS-mode CSRs */
272 target_ulong vsiselect
;
278 target_ulong stvec_hs
;
279 target_ulong sscratch_hs
;
280 target_ulong sepc_hs
;
281 target_ulong scause_hs
;
282 target_ulong stval_hs
;
283 target_ulong satp_hs
;
286 /* Signals whether the current exception occurred with two-stage address
287 translation active. */
288 bool two_stage_lookup
;
290 * Signals whether the current exception occurred while doing two-stage
291 * address translation for the VS-stage page table walk.
293 bool two_stage_indirect_lookup
;
295 target_ulong scounteren
;
296 target_ulong mcounteren
;
298 target_ulong mcountinhibit
;
300 /* PMU counter state */
301 PMUCTRState pmu_ctrs
[RV_MAX_MHPMCOUNTERS
];
303 /* PMU event selector configured values. First three are unused*/
304 target_ulong mhpmevent_val
[RV_MAX_MHPMEVENTS
];
306 /* PMU event selector configured values for RV32*/
307 target_ulong mhpmeventh_val
[RV_MAX_MHPMEVENTS
];
309 target_ulong sscratch
;
310 target_ulong mscratch
;
312 /* temporary htif regs */
321 /* physical memory protection */
322 pmp_table_t pmp_state
;
323 target_ulong mseccfg
;
326 target_ulong trigger_cur
;
327 target_ulong tdata1
[RV_MAX_TRIGGERS
];
328 target_ulong tdata2
[RV_MAX_TRIGGERS
];
329 target_ulong tdata3
[RV_MAX_TRIGGERS
];
330 struct CPUBreakpoint
*cpu_breakpoint
[RV_MAX_TRIGGERS
];
331 struct CPUWatchpoint
*cpu_watchpoint
[RV_MAX_TRIGGERS
];
333 /* machine specific rdtime callback */
334 uint64_t (*rdtime_fn
)(void *);
337 /* machine specific AIA ireg read-modify-write callback */
338 #define AIA_MAKE_IREG(__isel, __priv, __virt, __vgein, __xlen) \
339 ((((__xlen) & 0xff) << 24) | \
340 (((__vgein) & 0x3f) << 20) | \
341 (((__virt) & 0x1) << 18) | \
342 (((__priv) & 0x3) << 16) | \
344 #define AIA_IREG_ISEL(__ireg) ((__ireg) & 0xffff)
345 #define AIA_IREG_PRIV(__ireg) (((__ireg) >> 16) & 0x3)
346 #define AIA_IREG_VIRT(__ireg) (((__ireg) >> 18) & 0x1)
347 #define AIA_IREG_VGEIN(__ireg) (((__ireg) >> 20) & 0x3f)
348 #define AIA_IREG_XLEN(__ireg) (((__ireg) >> 24) & 0xff)
349 int (*aia_ireg_rmw_fn
[4])(void *arg
, target_ulong reg
,
350 target_ulong
*val
, target_ulong new_val
, target_ulong write_mask
);
351 void *aia_ireg_rmw_fn_arg
[4];
353 /* True if in debugger mode. */
357 * CSRs for PointerMasking extension
360 target_ulong mpmmask
;
361 target_ulong mpmbase
;
362 target_ulong spmmask
;
363 target_ulong spmbase
;
364 target_ulong upmmask
;
365 target_ulong upmbase
;
367 /* CSRs for execution enviornment configuration */
369 target_ulong senvcfg
;
372 target_ulong cur_pmmask
;
373 target_ulong cur_pmbase
;
375 float_status fp_status
;
377 /* Fields from here on are preserved across CPU reset. */
378 QEMUTimer
*stimer
; /* Internal timer for S-mode interrupt */
379 QEMUTimer
*vstimer
; /* Internal timer for VS-mode interrupt */
386 bool kvm_timer_dirty
;
387 uint64_t kvm_timer_time
;
388 uint64_t kvm_timer_compare
;
389 uint64_t kvm_timer_state
;
390 uint64_t kvm_timer_frequency
;
393 OBJECT_DECLARE_CPU_TYPE(RISCVCPU
, RISCVCPUClass
, RISCV_CPU
)
397 * @parent_realize: The parent class' realize handler.
398 * @parent_phases: The parent class' reset phase handlers.
402 struct RISCVCPUClass
{
404 CPUClass parent_class
;
406 DeviceRealize parent_realize
;
407 ResettablePhases parent_phases
;
410 struct RISCVCPUConfig
{
443 bool ext_zihintpause
;
467 /* Vendor-specific custom extensions */
468 bool ext_XVentanaCondOps
;
482 bool short_isa_string
;
485 typedef struct RISCVCPUConfig RISCVCPUConfig
;
489 * @env: #CPURISCVState
497 CPUNegativeOffsetState neg
;
503 /* Configuration Settings */
506 QEMUTimer
*pmu_timer
;
507 /* A bitmask of Available programmable counters */
508 uint32_t pmu_avail_ctrs
;
509 /* Mapping of events to counters */
510 GHashTable
*pmu_event_ctr_map
;
513 static inline int riscv_has_ext(CPURISCVState
*env
, target_ulong ext
)
515 return (env
->misa_ext
& ext
) != 0;
518 static inline bool riscv_feature(CPURISCVState
*env
, int feature
)
520 return env
->features
& (1ULL << feature
);
523 static inline void riscv_set_feature(CPURISCVState
*env
, int feature
)
525 env
->features
|= (1ULL << feature
);
528 #include "cpu_user.h"
530 extern const char * const riscv_int_regnames
[];
531 extern const char * const riscv_int_regnamesh
[];
532 extern const char * const riscv_fpr_regnames
[];
534 const char *riscv_cpu_get_trap_name(target_ulong cause
, bool async
);
535 void riscv_cpu_do_interrupt(CPUState
*cpu
);
536 int riscv_cpu_write_elf64_note(WriteCoreDumpFunction f
, CPUState
*cs
,
537 int cpuid
, DumpState
*s
);
538 int riscv_cpu_write_elf32_note(WriteCoreDumpFunction f
, CPUState
*cs
,
539 int cpuid
, DumpState
*s
);
540 int riscv_cpu_gdb_read_register(CPUState
*cpu
, GByteArray
*buf
, int reg
);
541 int riscv_cpu_gdb_write_register(CPUState
*cpu
, uint8_t *buf
, int reg
);
542 int riscv_cpu_hviprio_index2irq(int index
, int *out_irq
, int *out_rdzero
);
543 uint8_t riscv_cpu_default_priority(int irq
);
544 uint64_t riscv_cpu_all_pending(CPURISCVState
*env
);
545 int riscv_cpu_mirq_pending(CPURISCVState
*env
);
546 int riscv_cpu_sirq_pending(CPURISCVState
*env
);
547 int riscv_cpu_vsirq_pending(CPURISCVState
*env
);
548 bool riscv_cpu_fp_enabled(CPURISCVState
*env
);
549 target_ulong
riscv_cpu_get_geilen(CPURISCVState
*env
);
550 void riscv_cpu_set_geilen(CPURISCVState
*env
, target_ulong geilen
);
551 bool riscv_cpu_vector_enabled(CPURISCVState
*env
);
552 bool riscv_cpu_virt_enabled(CPURISCVState
*env
);
553 void riscv_cpu_set_virt_enabled(CPURISCVState
*env
, bool enable
);
554 bool riscv_cpu_two_stage_lookup(int mmu_idx
);
555 int riscv_cpu_mmu_index(CPURISCVState
*env
, bool ifetch
);
556 hwaddr
riscv_cpu_get_phys_page_debug(CPUState
*cpu
, vaddr addr
);
557 G_NORETURN
void riscv_cpu_do_unaligned_access(CPUState
*cs
, vaddr addr
,
558 MMUAccessType access_type
, int mmu_idx
,
560 bool riscv_cpu_tlb_fill(CPUState
*cs
, vaddr address
, int size
,
561 MMUAccessType access_type
, int mmu_idx
,
562 bool probe
, uintptr_t retaddr
);
563 void riscv_cpu_do_transaction_failed(CPUState
*cs
, hwaddr physaddr
,
564 vaddr addr
, unsigned size
,
565 MMUAccessType access_type
,
566 int mmu_idx
, MemTxAttrs attrs
,
567 MemTxResult response
, uintptr_t retaddr
);
568 char *riscv_isa_string(RISCVCPU
*cpu
);
569 void riscv_cpu_list(void);
571 #define cpu_list riscv_cpu_list
572 #define cpu_mmu_index riscv_cpu_mmu_index
574 #ifndef CONFIG_USER_ONLY
575 bool riscv_cpu_exec_interrupt(CPUState
*cs
, int interrupt_request
);
576 void riscv_cpu_swap_hypervisor_regs(CPURISCVState
*env
);
577 int riscv_cpu_claim_interrupts(RISCVCPU
*cpu
, uint64_t interrupts
);
578 uint64_t riscv_cpu_update_mip(RISCVCPU
*cpu
, uint64_t mask
, uint64_t value
);
579 #define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
580 void riscv_cpu_set_rdtime_fn(CPURISCVState
*env
, uint64_t (*fn
)(void *),
582 void riscv_cpu_set_aia_ireg_rmw_fn(CPURISCVState
*env
, uint32_t priv
,
583 int (*rmw_fn
)(void *arg
,
586 target_ulong new_val
,
587 target_ulong write_mask
),
590 void riscv_cpu_set_mode(CPURISCVState
*env
, target_ulong newpriv
);
592 void riscv_translate_init(void);
593 G_NORETURN
void riscv_raise_exception(CPURISCVState
*env
,
594 uint32_t exception
, uintptr_t pc
);
596 target_ulong
riscv_cpu_get_fflags(CPURISCVState
*env
);
597 void riscv_cpu_set_fflags(CPURISCVState
*env
, target_ulong
);
599 #define TB_FLAGS_PRIV_MMU_MASK 3
600 #define TB_FLAGS_PRIV_HYP_ACCESS_MASK (1 << 2)
601 #define TB_FLAGS_MSTATUS_FS MSTATUS_FS
602 #define TB_FLAGS_MSTATUS_VS MSTATUS_VS
604 #include "exec/cpu-all.h"
606 FIELD(TB_FLAGS
, MEM_IDX
, 0, 3)
607 FIELD(TB_FLAGS
, LMUL
, 3, 3)
608 FIELD(TB_FLAGS
, SEW
, 6, 3)
609 /* Skip MSTATUS_VS (0x600) bits */
610 FIELD(TB_FLAGS
, VL_EQ_VLMAX
, 11, 1)
611 FIELD(TB_FLAGS
, VILL
, 12, 1)
612 /* Skip MSTATUS_FS (0x6000) bits */
613 /* Is a Hypervisor instruction load/store allowed? */
614 FIELD(TB_FLAGS
, HLSX
, 15, 1)
615 FIELD(TB_FLAGS
, MSTATUS_HS_FS
, 16, 2)
616 FIELD(TB_FLAGS
, MSTATUS_HS_VS
, 18, 2)
617 /* The combination of MXL/SXL/UXL that applies to the current cpu mode. */
618 FIELD(TB_FLAGS
, XL
, 20, 2)
619 /* If PointerMasking should be applied */
620 FIELD(TB_FLAGS
, PM_MASK_ENABLED
, 22, 1)
621 FIELD(TB_FLAGS
, PM_BASE_ENABLED
, 23, 1)
622 FIELD(TB_FLAGS
, VTA
, 24, 1)
623 FIELD(TB_FLAGS
, VMA
, 25, 1)
625 #ifdef TARGET_RISCV32
626 #define riscv_cpu_mxl(env) ((void)(env), MXL_RV32)
628 static inline RISCVMXL
riscv_cpu_mxl(CPURISCVState
*env
)
630 return env
->misa_mxl
;
633 #define riscv_cpu_mxl_bits(env) (1UL << (4 + riscv_cpu_mxl(env)))
635 #if defined(TARGET_RISCV32)
636 #define cpu_recompute_xl(env) ((void)(env), MXL_RV32)
638 static inline RISCVMXL
cpu_recompute_xl(CPURISCVState
*env
)
640 RISCVMXL xl
= env
->misa_mxl
;
641 #if !defined(CONFIG_USER_ONLY)
643 * When emulating a 32-bit-only cpu, use RV32.
644 * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
645 * MSTATUSH doesn't have UXL/SXL, therefore XLEN cannot be widened
646 * back to RV64 for lower privs.
648 if (xl
!= MXL_RV32
) {
653 xl
= get_field(env
->mstatus
, MSTATUS64_UXL
);
655 default: /* PRV_S | PRV_H */
656 xl
= get_field(env
->mstatus
, MSTATUS64_SXL
);
665 static inline int riscv_cpu_xlen(CPURISCVState
*env
)
667 return 16 << env
->xl
;
670 #ifdef TARGET_RISCV32
671 #define riscv_cpu_sxl(env) ((void)(env), MXL_RV32)
673 static inline RISCVMXL
riscv_cpu_sxl(CPURISCVState
*env
)
675 #ifdef CONFIG_USER_ONLY
676 return env
->misa_mxl
;
678 return get_field(env
->mstatus
, MSTATUS64_SXL
);
684 * Encode LMUL to lmul as follows:
695 * then, we can calculate VLMAX = vlen >> (vsew + 3 - lmul)
696 * e.g. vlen = 256 bits, SEW = 16, LMUL = 1/8
697 * => VLMAX = vlen >> (1 + 3 - (-3))
701 static inline uint32_t vext_get_vlmax(RISCVCPU
*cpu
, target_ulong vtype
)
703 uint8_t sew
= FIELD_EX64(vtype
, VTYPE
, VSEW
);
704 int8_t lmul
= sextract32(FIELD_EX64(vtype
, VTYPE
, VLMUL
), 0, 3);
705 return cpu
->cfg
.vlen
>> (sew
+ 3 - lmul
);
708 void cpu_get_tb_cpu_state(CPURISCVState
*env
, target_ulong
*pc
,
709 target_ulong
*cs_base
, uint32_t *pflags
);
711 void riscv_cpu_update_mask(CPURISCVState
*env
);
713 RISCVException
riscv_csrrw(CPURISCVState
*env
, int csrno
,
714 target_ulong
*ret_value
,
715 target_ulong new_value
, target_ulong write_mask
);
716 RISCVException
riscv_csrrw_debug(CPURISCVState
*env
, int csrno
,
717 target_ulong
*ret_value
,
718 target_ulong new_value
,
719 target_ulong write_mask
);
721 static inline void riscv_csr_write(CPURISCVState
*env
, int csrno
,
724 riscv_csrrw(env
, csrno
, NULL
, val
, MAKE_64BIT_MASK(0, TARGET_LONG_BITS
));
727 static inline target_ulong
riscv_csr_read(CPURISCVState
*env
, int csrno
)
729 target_ulong val
= 0;
730 riscv_csrrw(env
, csrno
, &val
, 0, 0);
734 typedef RISCVException (*riscv_csr_predicate_fn
)(CPURISCVState
*env
,
736 typedef RISCVException (*riscv_csr_read_fn
)(CPURISCVState
*env
, int csrno
,
737 target_ulong
*ret_value
);
738 typedef RISCVException (*riscv_csr_write_fn
)(CPURISCVState
*env
, int csrno
,
739 target_ulong new_value
);
740 typedef RISCVException (*riscv_csr_op_fn
)(CPURISCVState
*env
, int csrno
,
741 target_ulong
*ret_value
,
742 target_ulong new_value
,
743 target_ulong write_mask
);
745 RISCVException
riscv_csrrw_i128(CPURISCVState
*env
, int csrno
,
747 Int128 new_value
, Int128 write_mask
);
749 typedef RISCVException (*riscv_csr_read128_fn
)(CPURISCVState
*env
, int csrno
,
751 typedef RISCVException (*riscv_csr_write128_fn
)(CPURISCVState
*env
, int csrno
,
756 riscv_csr_predicate_fn predicate
;
757 riscv_csr_read_fn read
;
758 riscv_csr_write_fn write
;
760 riscv_csr_read128_fn read128
;
761 riscv_csr_write128_fn write128
;
762 /* The default priv spec version should be PRIV_VERSION_1_10_0 (i.e 0) */
763 uint32_t min_priv_ver
;
764 } riscv_csr_operations
;
766 /* CSR function table constants */
768 CSR_TABLE_SIZE
= 0x1000
772 * The event id are encoded based on the encoding specified in the
773 * SBI specification v0.3
776 enum riscv_pmu_event_idx
{
777 RISCV_PMU_EVENT_HW_CPU_CYCLES
= 0x01,
778 RISCV_PMU_EVENT_HW_INSTRUCTIONS
= 0x02,
779 RISCV_PMU_EVENT_CACHE_DTLB_READ_MISS
= 0x10019,
780 RISCV_PMU_EVENT_CACHE_DTLB_WRITE_MISS
= 0x1001B,
781 RISCV_PMU_EVENT_CACHE_ITLB_PREFETCH_MISS
= 0x10021,
784 /* CSR function table */
785 extern riscv_csr_operations csr_ops
[CSR_TABLE_SIZE
];
787 void riscv_get_csr_ops(int csrno
, riscv_csr_operations
*ops
);
788 void riscv_set_csr_ops(int csrno
, riscv_csr_operations
*ops
);
790 void riscv_cpu_register_gdb_regs_for_features(CPUState
*cs
);
792 #endif /* RISCV_CPU_H */