2 * RISC-V CPU helpers for qemu.
4 * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
5 * Copyright (c) 2017-2018 SiFive, Inc.
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms and conditions of the GNU General Public License,
9 * version 2 or later, as published by the Free Software Foundation.
11 * This program is distributed in the hope it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
16 * You should have received a copy of the GNU General Public License along with
17 * this program. If not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
23 #include "exec/exec-all.h"
27 int riscv_cpu_mmu_index(CPURISCVState
*env
, bool ifetch
)
29 #ifdef CONFIG_USER_ONLY
36 #ifndef CONFIG_USER_ONLY
37 static int riscv_cpu_local_irq_pending(CPURISCVState
*env
)
39 target_ulong mstatus_mie
= get_field(env
->mstatus
, MSTATUS_MIE
);
40 target_ulong mstatus_sie
= get_field(env
->mstatus
, MSTATUS_SIE
);
41 target_ulong pending
= atomic_read(&env
->mip
) & env
->mie
;
42 target_ulong mie
= env
->priv
< PRV_M
|| (env
->priv
== PRV_M
&& mstatus_mie
);
43 target_ulong sie
= env
->priv
< PRV_S
|| (env
->priv
== PRV_S
&& mstatus_sie
);
44 target_ulong irqs
= (pending
& ~env
->mideleg
& -mie
) |
45 (pending
& env
->mideleg
& -sie
);
48 return ctz64(irqs
); /* since non-zero */
50 return EXCP_NONE
; /* indicates no pending interrupt */
55 bool riscv_cpu_exec_interrupt(CPUState
*cs
, int interrupt_request
)
57 #if !defined(CONFIG_USER_ONLY)
58 if (interrupt_request
& CPU_INTERRUPT_HARD
) {
59 RISCVCPU
*cpu
= RISCV_CPU(cs
);
60 CPURISCVState
*env
= &cpu
->env
;
61 int interruptno
= riscv_cpu_local_irq_pending(env
);
62 if (interruptno
>= 0) {
63 cs
->exception_index
= RISCV_EXCP_INT_FLAG
| interruptno
;
64 riscv_cpu_do_interrupt(cs
);
72 #if !defined(CONFIG_USER_ONLY)
74 int riscv_cpu_claim_interrupts(RISCVCPU
*cpu
, uint32_t interrupts
)
76 CPURISCVState
*env
= &cpu
->env
;
77 if (env
->miclaim
& interrupts
) {
80 env
->miclaim
|= interrupts
;
89 static void riscv_cpu_update_mip_irqs_async(CPUState
*target_cpu_state
,
92 struct CpuAsyncInfo
*info
= (struct CpuAsyncInfo
*) data
.host_ptr
;
95 cpu_interrupt(target_cpu_state
, CPU_INTERRUPT_HARD
);
97 cpu_reset_interrupt(target_cpu_state
, CPU_INTERRUPT_HARD
);
103 uint32_t riscv_cpu_update_mip(RISCVCPU
*cpu
, uint32_t mask
, uint32_t value
)
105 CPURISCVState
*env
= &cpu
->env
;
106 CPUState
*cs
= CPU(cpu
);
107 struct CpuAsyncInfo
*info
;
108 uint32_t old
, new, cmp
= atomic_read(&env
->mip
);
112 new = (old
& ~mask
) | (value
& mask
);
113 cmp
= atomic_cmpxchg(&env
->mip
, old
, new);
114 } while (old
!= cmp
);
116 info
= g_new(struct CpuAsyncInfo
, 1);
119 async_run_on_cpu(cs
, riscv_cpu_update_mip_irqs_async
,
120 RUN_ON_CPU_HOST_PTR(info
));
125 void riscv_cpu_set_mode(CPURISCVState
*env
, target_ulong newpriv
)
127 if (newpriv
> PRV_M
) {
128 g_assert_not_reached();
130 if (newpriv
== PRV_H
) {
133 /* tlb_flush is unnecessary as mode is contained in mmu_idx */
137 /* get_physical_address - get the physical address for this virtual address
139 * Do a page table walk to obtain the physical address corresponding to a
140 * virtual address. Returns 0 if the translation was successful
142 * Adapted from Spike's mmu_t::translate and mmu_t::walk
145 static int get_physical_address(CPURISCVState
*env
, hwaddr
*physical
,
146 int *prot
, target_ulong addr
,
147 int access_type
, int mmu_idx
)
149 /* NOTE: the env->pc value visible here will not be
150 * correct, but the value visible to the exception handler
151 * (riscv_cpu_do_interrupt) is correct */
155 if (mode
== PRV_M
&& access_type
!= MMU_INST_FETCH
) {
156 if (get_field(env
->mstatus
, MSTATUS_MPRV
)) {
157 mode
= get_field(env
->mstatus
, MSTATUS_MPP
);
161 if (mode
== PRV_M
|| !riscv_feature(env
, RISCV_FEATURE_MMU
)) {
163 *prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
164 return TRANSLATE_SUCCESS
;
170 int levels
, ptidxbits
, ptesize
, vm
, sum
;
171 int mxr
= get_field(env
->mstatus
, MSTATUS_MXR
);
173 if (env
->priv_ver
>= PRIV_VERSION_1_10_0
) {
174 base
= get_field(env
->satp
, SATP_PPN
) << PGSHIFT
;
175 sum
= get_field(env
->mstatus
, MSTATUS_SUM
);
176 vm
= get_field(env
->satp
, SATP_MODE
);
179 levels
= 2; ptidxbits
= 10; ptesize
= 4; break;
181 levels
= 3; ptidxbits
= 9; ptesize
= 8; break;
183 levels
= 4; ptidxbits
= 9; ptesize
= 8; break;
185 levels
= 5; ptidxbits
= 9; ptesize
= 8; break;
188 *prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
189 return TRANSLATE_SUCCESS
;
191 g_assert_not_reached();
194 base
= env
->sptbr
<< PGSHIFT
;
195 sum
= !get_field(env
->mstatus
, MSTATUS_PUM
);
196 vm
= get_field(env
->mstatus
, MSTATUS_VM
);
199 levels
= 2; ptidxbits
= 10; ptesize
= 4; break;
201 levels
= 3; ptidxbits
= 9; ptesize
= 8; break;
203 levels
= 4; ptidxbits
= 9; ptesize
= 8; break;
206 *prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
207 return TRANSLATE_SUCCESS
;
209 g_assert_not_reached();
213 CPUState
*cs
= env_cpu(env
);
214 int va_bits
= PGSHIFT
+ levels
* ptidxbits
;
215 target_ulong mask
= (1L << (TARGET_LONG_BITS
- (va_bits
- 1))) - 1;
216 target_ulong masked_msbs
= (addr
>> (va_bits
- 1)) & mask
;
217 if (masked_msbs
!= 0 && masked_msbs
!= mask
) {
218 return TRANSLATE_FAIL
;
221 int ptshift
= (levels
- 1) * ptidxbits
;
224 #if !TCG_OVERSIZED_GUEST
227 for (i
= 0; i
< levels
; i
++, ptshift
-= ptidxbits
) {
228 target_ulong idx
= (addr
>> (PGSHIFT
+ ptshift
)) &
229 ((1 << ptidxbits
) - 1);
231 /* check that physical address of PTE is legal */
232 target_ulong pte_addr
= base
+ idx
* ptesize
;
233 #if defined(TARGET_RISCV32)
234 target_ulong pte
= ldl_phys(cs
->as
, pte_addr
);
235 #elif defined(TARGET_RISCV64)
236 target_ulong pte
= ldq_phys(cs
->as
, pte_addr
);
238 target_ulong ppn
= pte
>> PTE_PPN_SHIFT
;
240 if (!(pte
& PTE_V
)) {
242 return TRANSLATE_FAIL
;
243 } else if (!(pte
& (PTE_R
| PTE_W
| PTE_X
))) {
244 /* Inner PTE, continue walking */
245 base
= ppn
<< PGSHIFT
;
246 } else if ((pte
& (PTE_R
| PTE_W
| PTE_X
)) == PTE_W
) {
247 /* Reserved leaf PTE flags: PTE_W */
248 return TRANSLATE_FAIL
;
249 } else if ((pte
& (PTE_R
| PTE_W
| PTE_X
)) == (PTE_W
| PTE_X
)) {
250 /* Reserved leaf PTE flags: PTE_W + PTE_X */
251 return TRANSLATE_FAIL
;
252 } else if ((pte
& PTE_U
) && ((mode
!= PRV_U
) &&
253 (!sum
|| access_type
== MMU_INST_FETCH
))) {
254 /* User PTE flags when not U mode and mstatus.SUM is not set,
255 or the access type is an instruction fetch */
256 return TRANSLATE_FAIL
;
257 } else if (!(pte
& PTE_U
) && (mode
!= PRV_S
)) {
258 /* Supervisor PTE flags when not S mode */
259 return TRANSLATE_FAIL
;
260 } else if (ppn
& ((1ULL << ptshift
) - 1)) {
262 return TRANSLATE_FAIL
;
263 } else if (access_type
== MMU_DATA_LOAD
&& !((pte
& PTE_R
) ||
264 ((pte
& PTE_X
) && mxr
))) {
265 /* Read access check failed */
266 return TRANSLATE_FAIL
;
267 } else if (access_type
== MMU_DATA_STORE
&& !(pte
& PTE_W
)) {
268 /* Write access check failed */
269 return TRANSLATE_FAIL
;
270 } else if (access_type
== MMU_INST_FETCH
&& !(pte
& PTE_X
)) {
271 /* Fetch access check failed */
272 return TRANSLATE_FAIL
;
274 /* if necessary, set accessed and dirty bits. */
275 target_ulong updated_pte
= pte
| PTE_A
|
276 (access_type
== MMU_DATA_STORE
? PTE_D
: 0);
278 /* Page table updates need to be atomic with MTTCG enabled */
279 if (updated_pte
!= pte
) {
281 * - if accessed or dirty bits need updating, and the PTE is
282 * in RAM, then we do so atomically with a compare and swap.
283 * - if the PTE is in IO space or ROM, then it can't be updated
284 * and we return TRANSLATE_FAIL.
285 * - if the PTE changed by the time we went to update it, then
286 * it is no longer valid and we must re-walk the page table.
289 hwaddr l
= sizeof(target_ulong
), addr1
;
290 mr
= address_space_translate(cs
->as
, pte_addr
,
291 &addr1
, &l
, false, MEMTXATTRS_UNSPECIFIED
);
292 if (memory_region_is_ram(mr
)) {
293 target_ulong
*pte_pa
=
294 qemu_map_ram_ptr(mr
->ram_block
, addr1
);
295 #if TCG_OVERSIZED_GUEST
296 /* MTTCG is not enabled on oversized TCG guests so
297 * page table updates do not need to be atomic */
298 *pte_pa
= pte
= updated_pte
;
300 target_ulong old_pte
=
301 atomic_cmpxchg(pte_pa
, pte
, updated_pte
);
302 if (old_pte
!= pte
) {
309 /* misconfigured PTE in ROM (AD bits are not preset) or
310 * PTE is in IO space and can't be updated atomically */
311 return TRANSLATE_FAIL
;
315 /* for superpage mappings, make a fake leaf PTE for the TLB's
317 target_ulong vpn
= addr
>> PGSHIFT
;
318 *physical
= (ppn
| (vpn
& ((1L << ptshift
) - 1))) << PGSHIFT
;
320 /* set permissions on the TLB entry */
321 if ((pte
& PTE_R
) || ((pte
& PTE_X
) && mxr
)) {
327 /* add write permission on stores or if the page is already dirty,
328 so that we TLB miss on later writes to update the dirty bit */
330 (access_type
== MMU_DATA_STORE
|| (pte
& PTE_D
))) {
333 return TRANSLATE_SUCCESS
;
336 return TRANSLATE_FAIL
;
339 static void raise_mmu_exception(CPURISCVState
*env
, target_ulong address
,
340 MMUAccessType access_type
)
342 CPUState
*cs
= env_cpu(env
);
343 int page_fault_exceptions
=
344 (env
->priv_ver
>= PRIV_VERSION_1_10_0
) &&
345 get_field(env
->satp
, SATP_MODE
) != VM_1_10_MBARE
;
346 switch (access_type
) {
348 cs
->exception_index
= page_fault_exceptions
?
349 RISCV_EXCP_INST_PAGE_FAULT
: RISCV_EXCP_INST_ACCESS_FAULT
;
352 cs
->exception_index
= page_fault_exceptions
?
353 RISCV_EXCP_LOAD_PAGE_FAULT
: RISCV_EXCP_LOAD_ACCESS_FAULT
;
356 cs
->exception_index
= page_fault_exceptions
?
357 RISCV_EXCP_STORE_PAGE_FAULT
: RISCV_EXCP_STORE_AMO_ACCESS_FAULT
;
360 g_assert_not_reached();
362 env
->badaddr
= address
;
365 hwaddr
riscv_cpu_get_phys_page_debug(CPUState
*cs
, vaddr addr
)
367 RISCVCPU
*cpu
= RISCV_CPU(cs
);
370 int mmu_idx
= cpu_mmu_index(&cpu
->env
, false);
372 if (get_physical_address(&cpu
->env
, &phys_addr
, &prot
, addr
, 0, mmu_idx
)) {
378 void riscv_cpu_do_unaligned_access(CPUState
*cs
, vaddr addr
,
379 MMUAccessType access_type
, int mmu_idx
,
382 RISCVCPU
*cpu
= RISCV_CPU(cs
);
383 CPURISCVState
*env
= &cpu
->env
;
384 switch (access_type
) {
386 cs
->exception_index
= RISCV_EXCP_INST_ADDR_MIS
;
389 cs
->exception_index
= RISCV_EXCP_LOAD_ADDR_MIS
;
392 cs
->exception_index
= RISCV_EXCP_STORE_AMO_ADDR_MIS
;
395 g_assert_not_reached();
398 riscv_raise_exception(env
, cs
->exception_index
, retaddr
);
402 bool riscv_cpu_tlb_fill(CPUState
*cs
, vaddr address
, int size
,
403 MMUAccessType access_type
, int mmu_idx
,
404 bool probe
, uintptr_t retaddr
)
406 #ifndef CONFIG_USER_ONLY
407 RISCVCPU
*cpu
= RISCV_CPU(cs
);
408 CPURISCVState
*env
= &cpu
->env
;
411 int ret
= TRANSLATE_FAIL
;
413 qemu_log_mask(CPU_LOG_MMU
, "%s ad %" VADDR_PRIx
" rw %d mmu_idx %d\n",
414 __func__
, address
, access_type
, mmu_idx
);
416 ret
= get_physical_address(env
, &pa
, &prot
, address
, access_type
, mmu_idx
);
418 qemu_log_mask(CPU_LOG_MMU
,
419 "%s address=%" VADDR_PRIx
" ret %d physical " TARGET_FMT_plx
420 " prot %d\n", __func__
, address
, ret
, pa
, prot
);
422 if (riscv_feature(env
, RISCV_FEATURE_PMP
) &&
423 !pmp_hart_has_privs(env
, pa
, TARGET_PAGE_SIZE
, 1 << access_type
)) {
424 ret
= TRANSLATE_FAIL
;
426 if (ret
== TRANSLATE_SUCCESS
) {
427 tlb_set_page(cs
, address
& TARGET_PAGE_MASK
, pa
& TARGET_PAGE_MASK
,
428 prot
, mmu_idx
, TARGET_PAGE_SIZE
);
433 raise_mmu_exception(env
, address
, access_type
);
434 riscv_raise_exception(env
, cs
->exception_index
, retaddr
);
437 switch (access_type
) {
439 cs
->exception_index
= RISCV_EXCP_INST_PAGE_FAULT
;
442 cs
->exception_index
= RISCV_EXCP_LOAD_PAGE_FAULT
;
445 cs
->exception_index
= RISCV_EXCP_STORE_PAGE_FAULT
;
448 cpu_loop_exit_restore(cs
, retaddr
);
455 * Adapted from Spike's processor_t::take_trap.
458 void riscv_cpu_do_interrupt(CPUState
*cs
)
460 #if !defined(CONFIG_USER_ONLY)
462 RISCVCPU
*cpu
= RISCV_CPU(cs
);
463 CPURISCVState
*env
= &cpu
->env
;
465 /* cs->exception is 32-bits wide unlike mcause which is XLEN-bits wide
466 * so we mask off the MSB and separate into trap type and cause.
468 bool async
= !!(cs
->exception_index
& RISCV_EXCP_INT_FLAG
);
469 target_ulong cause
= cs
->exception_index
& RISCV_EXCP_INT_MASK
;
470 target_ulong deleg
= async
? env
->mideleg
: env
->medeleg
;
471 target_ulong tval
= 0;
473 static const int ecall_cause_map
[] = {
474 [PRV_U
] = RISCV_EXCP_U_ECALL
,
475 [PRV_S
] = RISCV_EXCP_S_ECALL
,
476 [PRV_H
] = RISCV_EXCP_H_ECALL
,
477 [PRV_M
] = RISCV_EXCP_M_ECALL
481 /* set tval to badaddr for traps with address information */
483 case RISCV_EXCP_INST_ADDR_MIS
:
484 case RISCV_EXCP_INST_ACCESS_FAULT
:
485 case RISCV_EXCP_LOAD_ADDR_MIS
:
486 case RISCV_EXCP_STORE_AMO_ADDR_MIS
:
487 case RISCV_EXCP_LOAD_ACCESS_FAULT
:
488 case RISCV_EXCP_STORE_AMO_ACCESS_FAULT
:
489 case RISCV_EXCP_INST_PAGE_FAULT
:
490 case RISCV_EXCP_LOAD_PAGE_FAULT
:
491 case RISCV_EXCP_STORE_PAGE_FAULT
:
497 /* ecall is dispatched as one cause so translate based on mode */
498 if (cause
== RISCV_EXCP_U_ECALL
) {
499 assert(env
->priv
<= 3);
500 cause
= ecall_cause_map
[env
->priv
];
504 trace_riscv_trap(env
->mhartid
, async
, cause
, env
->pc
, tval
, cause
< 16 ?
505 (async
? riscv_intr_names
: riscv_excp_names
)[cause
] : "(unknown)");
507 if (env
->priv
<= PRV_S
&&
508 cause
< TARGET_LONG_BITS
&& ((deleg
>> cause
) & 1)) {
509 /* handle the trap in S-mode */
510 target_ulong s
= env
->mstatus
;
511 s
= set_field(s
, MSTATUS_SPIE
, env
->priv_ver
>= PRIV_VERSION_1_10_0
?
512 get_field(s
, MSTATUS_SIE
) : get_field(s
, MSTATUS_UIE
<< env
->priv
));
513 s
= set_field(s
, MSTATUS_SPP
, env
->priv
);
514 s
= set_field(s
, MSTATUS_SIE
, 0);
516 env
->scause
= cause
| ((target_ulong
)async
<< (TARGET_LONG_BITS
- 1));
518 env
->sbadaddr
= tval
;
519 env
->pc
= (env
->stvec
>> 2 << 2) +
520 ((async
&& (env
->stvec
& 3) == 1) ? cause
* 4 : 0);
521 riscv_cpu_set_mode(env
, PRV_S
);
523 /* handle the trap in M-mode */
524 target_ulong s
= env
->mstatus
;
525 s
= set_field(s
, MSTATUS_MPIE
, env
->priv_ver
>= PRIV_VERSION_1_10_0
?
526 get_field(s
, MSTATUS_MIE
) : get_field(s
, MSTATUS_UIE
<< env
->priv
));
527 s
= set_field(s
, MSTATUS_MPP
, env
->priv
);
528 s
= set_field(s
, MSTATUS_MIE
, 0);
530 env
->mcause
= cause
| ~(((target_ulong
)-1) >> async
);
532 env
->mbadaddr
= tval
;
533 env
->pc
= (env
->mtvec
>> 2 << 2) +
534 ((async
&& (env
->mtvec
& 3) == 1) ? cause
* 4 : 0);
535 riscv_cpu_set_mode(env
, PRV_M
);
538 /* NOTE: it is not necessary to yield load reservations here. It is only
539 * necessary for an SC from "another hart" to cause a load reservation
540 * to be yielded. Refer to the memory consistency model section of the
541 * RISC-V ISA Specification.
545 cs
->exception_index
= EXCP_NONE
; /* mark handled to qemu */