2 * QEMU ARM CPU -- internal functions and types
4 * Copyright (c) 2014 Linaro Ltd
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version 2
9 * of the License, or (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see
18 * <http://www.gnu.org/licenses/gpl-2.0.html>
20 * This header defines functions, types, etc which need to be shared
21 * between different source files within target/arm/ but which are
22 * private to it and not required by the rest of QEMU.
25 #ifndef TARGET_ARM_INTERNALS_H
26 #define TARGET_ARM_INTERNALS_H
28 #include "hw/registerfields.h"
30 /* register banks for CPU modes */
40 static inline bool excp_is_internal(int excp
)
42 /* Return true if this exception number represents a QEMU-internal
43 * exception that will not be passed to the guest.
45 return excp
== EXCP_INTERRUPT
48 || excp
== EXCP_HALTED
49 || excp
== EXCP_EXCEPTION_EXIT
50 || excp
== EXCP_KERNEL_TRAP
51 || excp
== EXCP_SEMIHOST
;
54 /* Scale factor for generic timers, ie number of ns per tick.
55 * This gives a 62.5MHz timer.
57 #define GTIMER_SCALE 16
59 /* Bit definitions for the v7M CONTROL register */
60 FIELD(V7M_CONTROL
, NPRIV
, 0, 1)
61 FIELD(V7M_CONTROL
, SPSEL
, 1, 1)
62 FIELD(V7M_CONTROL
, FPCA
, 2, 1)
63 FIELD(V7M_CONTROL
, SFPA
, 3, 1)
65 /* Bit definitions for v7M exception return payload */
66 FIELD(V7M_EXCRET
, ES
, 0, 1)
67 FIELD(V7M_EXCRET
, RES0
, 1, 1)
68 FIELD(V7M_EXCRET
, SPSEL
, 2, 1)
69 FIELD(V7M_EXCRET
, MODE
, 3, 1)
70 FIELD(V7M_EXCRET
, FTYPE
, 4, 1)
71 FIELD(V7M_EXCRET
, DCRS
, 5, 1)
72 FIELD(V7M_EXCRET
, S
, 6, 1)
73 FIELD(V7M_EXCRET
, RES1
, 7, 25) /* including the must-be-1 prefix */
75 /* Minimum value which is a magic number for exception return */
76 #define EXC_RETURN_MIN_MAGIC 0xff000000
77 /* Minimum number which is a magic number for function or exception return
78 * when using v8M security extension
80 #define FNC_RETURN_MIN_MAGIC 0xfefffffe
82 /* We use a few fake FSR values for internal purposes in M profile.
83 * M profile cores don't have A/R format FSRs, but currently our
84 * get_phys_addr() code assumes A/R profile and reports failures via
85 * an A/R format FSR value. We then translate that into the proper
86 * M profile exception and FSR status bit in arm_v7m_cpu_do_interrupt().
87 * Mostly the FSR values we use for this are those defined for v7PMSA,
88 * since we share some of that codepath. A few kinds of fault are
89 * only for M profile and have no A/R equivalent, though, so we have
90 * to pick a value from the reserved range (which we never otherwise
91 * generate) to use for these.
92 * These values will never be visible to the guest.
94 #define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */
95 #define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */
98 * raise_exception: Raise the specified exception.
99 * Raise a guest exception with the specified value, syndrome register
100 * and target exception level. This should be called from helper functions,
101 * and never returns because we will longjump back up to the CPU main loop.
103 void QEMU_NORETURN
raise_exception(CPUARMState
*env
, uint32_t excp
,
104 uint32_t syndrome
, uint32_t target_el
);
107 * For AArch64, map a given EL to an index in the banked_spsr array.
108 * Note that this mapping and the AArch32 mapping defined in bank_number()
109 * must agree such that the AArch64<->AArch32 SPSRs have the architecturally
110 * mandated mapping between each other.
112 static inline unsigned int aarch64_banked_spsr_index(unsigned int el
)
114 static const unsigned int map
[4] = {
115 [1] = BANK_SVC
, /* EL1. */
116 [2] = BANK_HYP
, /* EL2. */
117 [3] = BANK_MON
, /* EL3. */
119 assert(el
>= 1 && el
<= 3);
123 /* Map CPU modes onto saved register banks. */
124 static inline int bank_number(int mode
)
127 case ARM_CPU_MODE_USR
:
128 case ARM_CPU_MODE_SYS
:
130 case ARM_CPU_MODE_SVC
:
132 case ARM_CPU_MODE_ABT
:
134 case ARM_CPU_MODE_UND
:
136 case ARM_CPU_MODE_IRQ
:
138 case ARM_CPU_MODE_FIQ
:
140 case ARM_CPU_MODE_HYP
:
142 case ARM_CPU_MODE_MON
:
145 g_assert_not_reached();
149 * r14_bank_number: Map CPU mode onto register bank for r14
151 * Given an AArch32 CPU mode, return the index into the saved register
152 * banks to use for the R14 (LR) in that mode. This is the same as
153 * bank_number(), except for the special case of Hyp mode, where
154 * R14 is shared with USR and SYS, unlike its R13 and SPSR.
155 * This should be used as the index into env->banked_r14[], and
156 * bank_number() used for the index into env->banked_r13[] and
157 * env->banked_spsr[].
159 static inline int r14_bank_number(int mode
)
161 return (mode
== ARM_CPU_MODE_HYP
) ? BANK_USRSYS
: bank_number(mode
);
164 void arm_cpu_register_gdb_regs_for_features(ARMCPU
*cpu
);
165 void arm_translate_init(void);
167 enum arm_fprounding
{
176 int arm_rmode_to_sf(int rmode
);
178 static inline void aarch64_save_sp(CPUARMState
*env
, int el
)
180 if (env
->pstate
& PSTATE_SP
) {
181 env
->sp_el
[el
] = env
->xregs
[31];
183 env
->sp_el
[0] = env
->xregs
[31];
187 static inline void aarch64_restore_sp(CPUARMState
*env
, int el
)
189 if (env
->pstate
& PSTATE_SP
) {
190 env
->xregs
[31] = env
->sp_el
[el
];
192 env
->xregs
[31] = env
->sp_el
[0];
196 static inline void update_spsel(CPUARMState
*env
, uint32_t imm
)
198 unsigned int cur_el
= arm_current_el(env
);
199 /* Update PSTATE SPSel bit; this requires us to update the
200 * working stack pointer in xregs[31].
202 if (!((imm
^ env
->pstate
) & PSTATE_SP
)) {
205 aarch64_save_sp(env
, cur_el
);
206 env
->pstate
= deposit32(env
->pstate
, 0, 1, imm
);
208 /* We rely on illegal updates to SPsel from EL0 to get trapped
209 * at translation time.
211 assert(cur_el
>= 1 && cur_el
<= 3);
212 aarch64_restore_sp(env
, cur_el
);
219 * Returns the implementation defined bit-width of physical addresses.
220 * The ARMv8 reference manuals refer to this as PAMax().
222 static inline unsigned int arm_pamax(ARMCPU
*cpu
)
224 static const unsigned int pamax_map
[] = {
232 unsigned int parange
= extract32(cpu
->id_aa64mmfr0
, 0, 4);
234 /* id_aa64mmfr0 is a read-only register so values outside of the
235 * supported mappings can be considered an implementation error. */
236 assert(parange
< ARRAY_SIZE(pamax_map
));
237 return pamax_map
[parange
];
240 /* Return true if extended addresses are enabled.
241 * This is always the case if our translation regime is 64 bit,
242 * but depends on TTBCR.EAE for 32 bit.
244 static inline bool extended_addresses_enabled(CPUARMState
*env
)
246 TCR
*tcr
= &env
->cp15
.tcr_el
[arm_is_secure(env
) ? 3 : 1];
247 return arm_el_is_aa64(env
, 1) ||
248 (arm_feature(env
, ARM_FEATURE_LPAE
) && (tcr
->raw_tcr
& TTBCR_EAE
));
251 /* Valid Syndrome Register EC field values */
252 enum arm_exception_class
{
253 EC_UNCATEGORIZED
= 0x00,
255 EC_CP15RTTRAP
= 0x03,
256 EC_CP15RRTTRAP
= 0x04,
257 EC_CP14RTTRAP
= 0x05,
258 EC_CP14DTTRAP
= 0x06,
259 EC_ADVSIMDFPACCESSTRAP
= 0x07,
261 EC_CP14RRTTRAP
= 0x0c,
262 EC_ILLEGALSTATE
= 0x0e,
269 EC_SYSTEMREGISTERTRAP
= 0x18,
270 EC_SVEACCESSTRAP
= 0x19,
272 EC_INSNABORT_SAME_EL
= 0x21,
273 EC_PCALIGNMENT
= 0x22,
275 EC_DATAABORT_SAME_EL
= 0x25,
276 EC_SPALIGNMENT
= 0x26,
277 EC_AA32_FPTRAP
= 0x28,
278 EC_AA64_FPTRAP
= 0x2c,
280 EC_BREAKPOINT
= 0x30,
281 EC_BREAKPOINT_SAME_EL
= 0x31,
282 EC_SOFTWARESTEP
= 0x32,
283 EC_SOFTWARESTEP_SAME_EL
= 0x33,
284 EC_WATCHPOINT
= 0x34,
285 EC_WATCHPOINT_SAME_EL
= 0x35,
287 EC_VECTORCATCH
= 0x3a,
291 #define ARM_EL_EC_SHIFT 26
292 #define ARM_EL_IL_SHIFT 25
293 #define ARM_EL_ISV_SHIFT 24
294 #define ARM_EL_IL (1 << ARM_EL_IL_SHIFT)
295 #define ARM_EL_ISV (1 << ARM_EL_ISV_SHIFT)
297 static inline uint32_t syn_get_ec(uint32_t syn
)
299 return syn
>> ARM_EL_EC_SHIFT
;
302 /* Utility functions for constructing various kinds of syndrome value.
303 * Note that in general we follow the AArch64 syndrome values; in a
304 * few cases the value in HSR for exceptions taken to AArch32 Hyp
305 * mode differs slightly, and we fix this up when populating HSR in
306 * arm_cpu_do_interrupt_aarch32_hyp().
307 * The exception is FP/SIMD access traps -- these report extra information
308 * when taking an exception to AArch32. For those we include the extra coproc
309 * and TA fields, and mask them out when taking the exception to AArch64.
311 static inline uint32_t syn_uncategorized(void)
313 return (EC_UNCATEGORIZED
<< ARM_EL_EC_SHIFT
) | ARM_EL_IL
;
316 static inline uint32_t syn_aa64_svc(uint32_t imm16
)
318 return (EC_AA64_SVC
<< ARM_EL_EC_SHIFT
) | ARM_EL_IL
| (imm16
& 0xffff);
321 static inline uint32_t syn_aa64_hvc(uint32_t imm16
)
323 return (EC_AA64_HVC
<< ARM_EL_EC_SHIFT
) | ARM_EL_IL
| (imm16
& 0xffff);
326 static inline uint32_t syn_aa64_smc(uint32_t imm16
)
328 return (EC_AA64_SMC
<< ARM_EL_EC_SHIFT
) | ARM_EL_IL
| (imm16
& 0xffff);
331 static inline uint32_t syn_aa32_svc(uint32_t imm16
, bool is_16bit
)
333 return (EC_AA32_SVC
<< ARM_EL_EC_SHIFT
) | (imm16
& 0xffff)
334 | (is_16bit
? 0 : ARM_EL_IL
);
337 static inline uint32_t syn_aa32_hvc(uint32_t imm16
)
339 return (EC_AA32_HVC
<< ARM_EL_EC_SHIFT
) | ARM_EL_IL
| (imm16
& 0xffff);
342 static inline uint32_t syn_aa32_smc(void)
344 return (EC_AA32_SMC
<< ARM_EL_EC_SHIFT
) | ARM_EL_IL
;
347 static inline uint32_t syn_aa64_bkpt(uint32_t imm16
)
349 return (EC_AA64_BKPT
<< ARM_EL_EC_SHIFT
) | ARM_EL_IL
| (imm16
& 0xffff);
352 static inline uint32_t syn_aa32_bkpt(uint32_t imm16
, bool is_16bit
)
354 return (EC_AA32_BKPT
<< ARM_EL_EC_SHIFT
) | (imm16
& 0xffff)
355 | (is_16bit
? 0 : ARM_EL_IL
);
358 static inline uint32_t syn_aa64_sysregtrap(int op0
, int op1
, int op2
,
359 int crn
, int crm
, int rt
,
362 return (EC_SYSTEMREGISTERTRAP
<< ARM_EL_EC_SHIFT
) | ARM_EL_IL
363 | (op0
<< 20) | (op2
<< 17) | (op1
<< 14) | (crn
<< 10) | (rt
<< 5)
364 | (crm
<< 1) | isread
;
367 static inline uint32_t syn_cp14_rt_trap(int cv
, int cond
, int opc1
, int opc2
,
368 int crn
, int crm
, int rt
, int isread
,
371 return (EC_CP14RTTRAP
<< ARM_EL_EC_SHIFT
)
372 | (is_16bit
? 0 : ARM_EL_IL
)
373 | (cv
<< 24) | (cond
<< 20) | (opc2
<< 17) | (opc1
<< 14)
374 | (crn
<< 10) | (rt
<< 5) | (crm
<< 1) | isread
;
377 static inline uint32_t syn_cp15_rt_trap(int cv
, int cond
, int opc1
, int opc2
,
378 int crn
, int crm
, int rt
, int isread
,
381 return (EC_CP15RTTRAP
<< ARM_EL_EC_SHIFT
)
382 | (is_16bit
? 0 : ARM_EL_IL
)
383 | (cv
<< 24) | (cond
<< 20) | (opc2
<< 17) | (opc1
<< 14)
384 | (crn
<< 10) | (rt
<< 5) | (crm
<< 1) | isread
;
387 static inline uint32_t syn_cp14_rrt_trap(int cv
, int cond
, int opc1
, int crm
,
388 int rt
, int rt2
, int isread
,
391 return (EC_CP14RRTTRAP
<< ARM_EL_EC_SHIFT
)
392 | (is_16bit
? 0 : ARM_EL_IL
)
393 | (cv
<< 24) | (cond
<< 20) | (opc1
<< 16)
394 | (rt2
<< 10) | (rt
<< 5) | (crm
<< 1) | isread
;
397 static inline uint32_t syn_cp15_rrt_trap(int cv
, int cond
, int opc1
, int crm
,
398 int rt
, int rt2
, int isread
,
401 return (EC_CP15RRTTRAP
<< ARM_EL_EC_SHIFT
)
402 | (is_16bit
? 0 : ARM_EL_IL
)
403 | (cv
<< 24) | (cond
<< 20) | (opc1
<< 16)
404 | (rt2
<< 10) | (rt
<< 5) | (crm
<< 1) | isread
;
407 static inline uint32_t syn_fp_access_trap(int cv
, int cond
, bool is_16bit
)
409 /* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 coproc == 0xa */
410 return (EC_ADVSIMDFPACCESSTRAP
<< ARM_EL_EC_SHIFT
)
411 | (is_16bit
? 0 : ARM_EL_IL
)
412 | (cv
<< 24) | (cond
<< 20) | 0xa;
415 static inline uint32_t syn_simd_access_trap(int cv
, int cond
, bool is_16bit
)
417 /* AArch32 SIMD trap: TA == 1 coproc == 0 */
418 return (EC_ADVSIMDFPACCESSTRAP
<< ARM_EL_EC_SHIFT
)
419 | (is_16bit
? 0 : ARM_EL_IL
)
420 | (cv
<< 24) | (cond
<< 20) | (1 << 5);
423 static inline uint32_t syn_sve_access_trap(void)
425 return EC_SVEACCESSTRAP
<< ARM_EL_EC_SHIFT
;
428 static inline uint32_t syn_insn_abort(int same_el
, int ea
, int s1ptw
, int fsc
)
430 return (EC_INSNABORT
<< ARM_EL_EC_SHIFT
) | (same_el
<< ARM_EL_EC_SHIFT
)
431 | ARM_EL_IL
| (ea
<< 9) | (s1ptw
<< 7) | fsc
;
434 static inline uint32_t syn_data_abort_no_iss(int same_el
,
435 int ea
, int cm
, int s1ptw
,
438 return (EC_DATAABORT
<< ARM_EL_EC_SHIFT
) | (same_el
<< ARM_EL_EC_SHIFT
)
440 | (ea
<< 9) | (cm
<< 8) | (s1ptw
<< 7) | (wnr
<< 6) | fsc
;
443 static inline uint32_t syn_data_abort_with_iss(int same_el
,
444 int sas
, int sse
, int srt
,
446 int ea
, int cm
, int s1ptw
,
450 return (EC_DATAABORT
<< ARM_EL_EC_SHIFT
) | (same_el
<< ARM_EL_EC_SHIFT
)
451 | (is_16bit
? 0 : ARM_EL_IL
)
452 | ARM_EL_ISV
| (sas
<< 22) | (sse
<< 21) | (srt
<< 16)
453 | (sf
<< 15) | (ar
<< 14)
454 | (ea
<< 9) | (cm
<< 8) | (s1ptw
<< 7) | (wnr
<< 6) | fsc
;
457 static inline uint32_t syn_swstep(int same_el
, int isv
, int ex
)
459 return (EC_SOFTWARESTEP
<< ARM_EL_EC_SHIFT
) | (same_el
<< ARM_EL_EC_SHIFT
)
460 | ARM_EL_IL
| (isv
<< 24) | (ex
<< 6) | 0x22;
463 static inline uint32_t syn_watchpoint(int same_el
, int cm
, int wnr
)
465 return (EC_WATCHPOINT
<< ARM_EL_EC_SHIFT
) | (same_el
<< ARM_EL_EC_SHIFT
)
466 | ARM_EL_IL
| (cm
<< 8) | (wnr
<< 6) | 0x22;
469 static inline uint32_t syn_breakpoint(int same_el
)
471 return (EC_BREAKPOINT
<< ARM_EL_EC_SHIFT
) | (same_el
<< ARM_EL_EC_SHIFT
)
475 static inline uint32_t syn_wfx(int cv
, int cond
, int ti
, bool is_16bit
)
477 return (EC_WFX_TRAP
<< ARM_EL_EC_SHIFT
) |
478 (is_16bit
? 0 : (1 << ARM_EL_IL_SHIFT
)) |
479 (cv
<< 24) | (cond
<< 20) | ti
;
482 /* Update a QEMU watchpoint based on the information the guest has set in the
483 * DBGWCR<n>_EL1 and DBGWVR<n>_EL1 registers.
485 void hw_watchpoint_update(ARMCPU
*cpu
, int n
);
486 /* Update the QEMU watchpoints for every guest watchpoint. This does a
487 * complete delete-and-reinstate of the QEMU watchpoint list and so is
488 * suitable for use after migration or on reset.
490 void hw_watchpoint_update_all(ARMCPU
*cpu
);
491 /* Update a QEMU breakpoint based on the information the guest has set in the
492 * DBGBCR<n>_EL1 and DBGBVR<n>_EL1 registers.
494 void hw_breakpoint_update(ARMCPU
*cpu
, int n
);
495 /* Update the QEMU breakpoints for every guest breakpoint. This does a
496 * complete delete-and-reinstate of the QEMU breakpoint list and so is
497 * suitable for use after migration or on reset.
499 void hw_breakpoint_update_all(ARMCPU
*cpu
);
501 /* Callback function for checking if a watchpoint should trigger. */
502 bool arm_debug_check_watchpoint(CPUState
*cs
, CPUWatchpoint
*wp
);
504 /* Adjust addresses (in BE32 mode) before testing against watchpoint
507 vaddr
arm_adjust_watchpoint_address(CPUState
*cs
, vaddr addr
, int len
);
509 /* Callback function for when a watchpoint or breakpoint triggers. */
510 void arm_debug_excp_handler(CPUState
*cs
);
512 #ifdef CONFIG_USER_ONLY
513 static inline bool arm_is_psci_call(ARMCPU
*cpu
, int excp_type
)
518 /* Return true if the r0/x0 value indicates that this SMC/HVC is a PSCI call. */
519 bool arm_is_psci_call(ARMCPU
*cpu
, int excp_type
);
520 /* Actually handle a PSCI call */
521 void arm_handle_psci_call(ARMCPU
*cpu
);
525 * arm_clear_exclusive: clear the exclusive monitor
527 * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
529 static inline void arm_clear_exclusive(CPUARMState
*env
)
531 env
->exclusive_addr
= -1;
535 * ARMFaultType: type of an ARM MMU fault
536 * This corresponds to the v8A pseudocode's Fault enumeration,
537 * with extensions for QEMU internal conditions.
539 typedef enum ARMFaultType
{
546 ARMFault_Translation
,
547 ARMFault_AddressSize
,
548 ARMFault_SyncExternal
,
549 ARMFault_SyncExternalOnWalk
,
551 ARMFault_SyncParityOnWalk
,
552 ARMFault_AsyncParity
,
553 ARMFault_AsyncExternal
,
555 ARMFault_TLBConflict
,
558 ARMFault_ICacheMaint
,
559 ARMFault_QEMU_NSCExec
, /* v8M: NS executing in S&NSC memory */
560 ARMFault_QEMU_SFault
, /* v8M: SecureFault INVTRAN, INVEP or AUVIOL */
564 * ARMMMUFaultInfo: Information describing an ARM MMU Fault
565 * @type: Type of fault
566 * @level: Table walk level (for translation, access flag and permission faults)
567 * @domain: Domain of the fault address (for non-LPAE CPUs only)
568 * @s2addr: Address that caused a fault at stage 2
569 * @stage2: True if we faulted at stage 2
570 * @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk
571 * @ea: True if we should set the EA (external abort type) bit in syndrome
573 typedef struct ARMMMUFaultInfo ARMMMUFaultInfo
;
574 struct ARMMMUFaultInfo
{
585 * arm_fi_to_sfsc: Convert fault info struct to short-format FSC
586 * Compare pseudocode EncodeSDFSC(), though unlike that function
587 * we set up a whole FSR-format code including domain field and
588 * putting the high bit of the FSC into bit 10.
590 static inline uint32_t arm_fi_to_sfsc(ARMMMUFaultInfo
*fi
)
597 case ARMFault_AccessFlag
:
598 fsc
= fi
->level
== 1 ? 0x3 : 0x6;
600 case ARMFault_Alignment
:
603 case ARMFault_Permission
:
604 fsc
= fi
->level
== 1 ? 0xd : 0xf;
606 case ARMFault_Domain
:
607 fsc
= fi
->level
== 1 ? 0x9 : 0xb;
609 case ARMFault_Translation
:
610 fsc
= fi
->level
== 1 ? 0x5 : 0x7;
612 case ARMFault_SyncExternal
:
613 fsc
= 0x8 | (fi
->ea
<< 12);
615 case ARMFault_SyncExternalOnWalk
:
616 fsc
= fi
->level
== 1 ? 0xc : 0xe;
617 fsc
|= (fi
->ea
<< 12);
619 case ARMFault_SyncParity
:
622 case ARMFault_SyncParityOnWalk
:
623 fsc
= fi
->level
== 1 ? 0x40c : 0x40e;
625 case ARMFault_AsyncParity
:
628 case ARMFault_AsyncExternal
:
629 fsc
= 0x406 | (fi
->ea
<< 12);
634 case ARMFault_TLBConflict
:
637 case ARMFault_Lockdown
:
640 case ARMFault_Exclusive
:
643 case ARMFault_ICacheMaint
:
646 case ARMFault_Background
:
649 case ARMFault_QEMU_NSCExec
:
650 fsc
= M_FAKE_FSR_NSC_EXEC
;
652 case ARMFault_QEMU_SFault
:
653 fsc
= M_FAKE_FSR_SFAULT
;
656 /* Other faults can't occur in a context that requires a
657 * short-format status code.
659 g_assert_not_reached();
662 fsc
|= (fi
->domain
<< 4);
667 * arm_fi_to_lfsc: Convert fault info struct to long-format FSC
668 * Compare pseudocode EncodeLDFSC(), though unlike that function
669 * we fill in also the LPAE bit 9 of a DFSR format.
671 static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo
*fi
)
678 case ARMFault_AddressSize
:
681 case ARMFault_AccessFlag
:
682 fsc
= (fi
->level
& 3) | (0x2 << 2);
684 case ARMFault_Permission
:
685 fsc
= (fi
->level
& 3) | (0x3 << 2);
687 case ARMFault_Translation
:
688 fsc
= (fi
->level
& 3) | (0x1 << 2);
690 case ARMFault_SyncExternal
:
691 fsc
= 0x10 | (fi
->ea
<< 12);
693 case ARMFault_SyncExternalOnWalk
:
694 fsc
= (fi
->level
& 3) | (0x5 << 2) | (fi
->ea
<< 12);
696 case ARMFault_SyncParity
:
699 case ARMFault_SyncParityOnWalk
:
700 fsc
= (fi
->level
& 3) | (0x7 << 2);
702 case ARMFault_AsyncParity
:
705 case ARMFault_AsyncExternal
:
706 fsc
= 0x11 | (fi
->ea
<< 12);
708 case ARMFault_Alignment
:
714 case ARMFault_TLBConflict
:
717 case ARMFault_Lockdown
:
720 case ARMFault_Exclusive
:
724 /* Other faults can't occur in a context that requires a
725 * long-format status code.
727 g_assert_not_reached();
734 static inline bool arm_extabort_type(MemTxResult result
)
736 /* The EA bit in syndromes and fault status registers is an
737 * IMPDEF classification of external aborts. ARM implementations
738 * usually use this to indicate AXI bus Decode error (0) or
739 * Slave error (1); in QEMU we follow that.
741 return result
!= MEMTX_DECODE_ERROR
;
744 /* Do a page table walk and add page to TLB if possible */
745 bool arm_tlb_fill(CPUState
*cpu
, vaddr address
,
746 MMUAccessType access_type
, int mmu_idx
,
747 ARMMMUFaultInfo
*fi
);
749 /* Return true if the stage 1 translation regime is using LPAE format page
751 bool arm_s1_regime_using_lpae_format(CPUARMState
*env
, ARMMMUIdx mmu_idx
);
753 /* Raise a data fault alignment exception for the specified virtual address */
754 void arm_cpu_do_unaligned_access(CPUState
*cs
, vaddr vaddr
,
755 MMUAccessType access_type
,
756 int mmu_idx
, uintptr_t retaddr
);
758 /* arm_cpu_do_transaction_failed: handle a memory system error response
759 * (eg "no device/memory present at address") by raising an external abort
762 void arm_cpu_do_transaction_failed(CPUState
*cs
, hwaddr physaddr
,
763 vaddr addr
, unsigned size
,
764 MMUAccessType access_type
,
765 int mmu_idx
, MemTxAttrs attrs
,
766 MemTxResult response
, uintptr_t retaddr
);
768 /* Call any registered EL change hooks */
769 static inline void arm_call_pre_el_change_hook(ARMCPU
*cpu
)
771 ARMELChangeHook
*hook
, *next
;
772 QLIST_FOREACH_SAFE(hook
, &cpu
->pre_el_change_hooks
, node
, next
) {
773 hook
->hook(cpu
, hook
->opaque
);
776 static inline void arm_call_el_change_hook(ARMCPU
*cpu
)
778 ARMELChangeHook
*hook
, *next
;
779 QLIST_FOREACH_SAFE(hook
, &cpu
->el_change_hooks
, node
, next
) {
780 hook
->hook(cpu
, hook
->opaque
);
784 /* Return true if this address translation regime is secure */
785 static inline bool regime_is_secure(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
788 case ARMMMUIdx_S12NSE0
:
789 case ARMMMUIdx_S12NSE1
:
790 case ARMMMUIdx_S1NSE0
:
791 case ARMMMUIdx_S1NSE1
:
794 case ARMMMUIdx_MPrivNegPri
:
795 case ARMMMUIdx_MUserNegPri
:
796 case ARMMMUIdx_MPriv
:
797 case ARMMMUIdx_MUser
:
800 case ARMMMUIdx_S1SE0
:
801 case ARMMMUIdx_S1SE1
:
802 case ARMMMUIdx_MSPrivNegPri
:
803 case ARMMMUIdx_MSUserNegPri
:
804 case ARMMMUIdx_MSPriv
:
805 case ARMMMUIdx_MSUser
:
808 g_assert_not_reached();
812 /* Return the FSR value for a debug exception (watchpoint, hardware
813 * breakpoint or BKPT insn) targeting the specified exception level.
815 static inline uint32_t arm_debug_exception_fsr(CPUARMState
*env
)
817 ARMMMUFaultInfo fi
= { .type
= ARMFault_Debug
};
818 int target_el
= arm_debug_target_el(env
);
819 bool using_lpae
= false;
821 if (target_el
== 2 || arm_el_is_aa64(env
, target_el
)) {
824 if (arm_feature(env
, ARM_FEATURE_LPAE
) &&
825 (env
->cp15
.tcr_el
[target_el
].raw_tcr
& TTBCR_EAE
)) {
831 return arm_fi_to_lfsc(&fi
);
833 return arm_fi_to_sfsc(&fi
);
837 /* Note make_memop_idx reserves 4 bits for mmu_idx, and MO_BSWAP is bit 3.
838 * Thus a TCGMemOpIdx, without any MO_ALIGN bits, fits in 8 bits.
840 #define MEMOPIDX_SHIFT 8
843 * v7m_using_psp: Return true if using process stack pointer
844 * Return true if the CPU is currently using the process stack
845 * pointer, or false if it is using the main stack pointer.
847 static inline bool v7m_using_psp(CPUARMState
*env
)
849 /* Handler mode always uses the main stack; for thread mode
850 * the CONTROL.SPSEL bit determines the answer.
851 * Note that in v7M it is not possible to be in Handler mode with
852 * CONTROL.SPSEL non-zero, but in v8M it is, so we must check both.
854 return !arm_v7m_is_handler_mode(env
) &&
855 env
->v7m
.control
[env
->v7m
.secure
] & R_V7M_CONTROL_SPSEL_MASK
;
859 * v7m_sp_limit: Return SP limit for current CPU state
860 * Return the SP limit value for the current CPU security state
863 static inline uint32_t v7m_sp_limit(CPUARMState
*env
)
865 if (v7m_using_psp(env
)) {
866 return env
->v7m
.psplim
[env
->v7m
.secure
];
868 return env
->v7m
.msplim
[env
->v7m
.secure
];
873 * aarch32_mode_name(): Return name of the AArch32 CPU mode
874 * @psr: Program Status Register indicating CPU mode
876 * Returns, for debug logging purposes, a printable representation
877 * of the AArch32 CPU mode ("svc", "usr", etc) as indicated by
878 * the low bits of the specified PSR.
880 static inline const char *aarch32_mode_name(uint32_t psr
)
882 static const char cpu_mode_names
[16][4] = {
883 "usr", "fiq", "irq", "svc", "???", "???", "mon", "abt",
884 "???", "???", "hyp", "und", "???", "???", "???", "sys"
887 return cpu_mode_names
[psr
& 0xf];
891 * arm_cpu_update_virq: Update CPU_INTERRUPT_VIRQ bit in cs->interrupt_request
893 * Update the CPU_INTERRUPT_VIRQ bit in cs->interrupt_request, following
894 * a change to either the input VIRQ line from the GIC or the HCR_EL2.VI bit.
895 * Must be called with the iothread lock held.
897 void arm_cpu_update_virq(ARMCPU
*cpu
);
900 * arm_cpu_update_vfiq: Update CPU_INTERRUPT_VFIQ bit in cs->interrupt_request
902 * Update the CPU_INTERRUPT_VFIQ bit in cs->interrupt_request, following
903 * a change to either the input VFIQ line from the GIC or the HCR_EL2.VF bit.
904 * Must be called with the iothread lock held.
906 void arm_cpu_update_vfiq(ARMCPU
*cpu
);