5 * Copyright (c) 2017-2018 SiFive, Inc.
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms and conditions of the GNU General Public License,
9 * version 2 or later, as published by the Free Software Foundation.
11 * This program is distributed in the hope it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
16 * You should have received a copy of the GNU General Public License along with
17 * this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "hw/core/cpu.h"
24 #include "hw/registerfields.h"
25 #include "exec/cpu-defs.h"
26 #include "qemu/cpu-float.h"
27 #include "qom/object.h"
28 #include "qemu/int128.h"
31 #define TCG_GUEST_DEFAULT_MO 0
34 * RISC-V-specific extra insn start words:
35 * 1: Original instruction opcode
37 #define TARGET_INSN_START_EXTRA_WORDS 1
39 #define TYPE_RISCV_CPU "riscv-cpu"
41 #define RISCV_CPU_TYPE_SUFFIX "-" TYPE_RISCV_CPU
42 #define RISCV_CPU_TYPE_NAME(name) (name RISCV_CPU_TYPE_SUFFIX)
43 #define CPU_RESOLVING_TYPE TYPE_RISCV_CPU
45 #define TYPE_RISCV_CPU_ANY RISCV_CPU_TYPE_NAME("any")
46 #define TYPE_RISCV_CPU_BASE32 RISCV_CPU_TYPE_NAME("rv32")
47 #define TYPE_RISCV_CPU_BASE64 RISCV_CPU_TYPE_NAME("rv64")
48 #define TYPE_RISCV_CPU_BASE128 RISCV_CPU_TYPE_NAME("x-rv128")
49 #define TYPE_RISCV_CPU_IBEX RISCV_CPU_TYPE_NAME("lowrisc-ibex")
50 #define TYPE_RISCV_CPU_SHAKTI_C RISCV_CPU_TYPE_NAME("shakti-c")
51 #define TYPE_RISCV_CPU_SIFIVE_E31 RISCV_CPU_TYPE_NAME("sifive-e31")
52 #define TYPE_RISCV_CPU_SIFIVE_E34 RISCV_CPU_TYPE_NAME("sifive-e34")
53 #define TYPE_RISCV_CPU_SIFIVE_E51 RISCV_CPU_TYPE_NAME("sifive-e51")
54 #define TYPE_RISCV_CPU_SIFIVE_U34 RISCV_CPU_TYPE_NAME("sifive-u34")
55 #define TYPE_RISCV_CPU_SIFIVE_U54 RISCV_CPU_TYPE_NAME("sifive-u54")
56 #define TYPE_RISCV_CPU_HOST RISCV_CPU_TYPE_NAME("host")
58 #if defined(TARGET_RISCV32)
59 # define TYPE_RISCV_CPU_BASE TYPE_RISCV_CPU_BASE32
60 #elif defined(TARGET_RISCV64)
61 # define TYPE_RISCV_CPU_BASE TYPE_RISCV_CPU_BASE64
64 #define RV(x) ((target_ulong)1 << (x - 'A'))
67 #define RVE RV('E') /* E and I are mutually exclusive */
79 /* S extension denotes that Supervisor mode exists, however it is possible
80 to have a core that support S mode but does not have an MMU and there
81 is currently no bit in misa to indicate whether an MMU exists or not
82 so a cpu features bitfield is required, likewise for optional PMP support */
91 /* Privileged specification version */
93 PRIV_VERSION_1_10_0 = 0,
98 #define VEXT_VERSION_1_00_0 0x00010000
104 TRANSLATE_G_STAGE_FAIL
107 #define MMU_USER_IDX 3
109 #define MAX_RISCV_PMPS (16)
111 typedef struct CPUArchState CPURISCVState;
113 #if !defined(CONFIG_USER_ONLY)
118 #define RV_VLEN_MAX 1024
119 #define RV_MAX_MHPMEVENTS 32
120 #define RV_MAX_MHPMCOUNTERS 32
122 FIELD(VTYPE, VLMUL, 0, 3)
123 FIELD(VTYPE, VSEW, 3, 3)
124 FIELD(VTYPE, VTA, 6, 1)
125 FIELD(VTYPE, VMA, 7, 1)
126 FIELD(VTYPE, VEDIV, 8, 2)
127 FIELD(VTYPE, RESERVED, 10, sizeof(target_ulong) * 8 - 11)
129 typedef struct PMUCTRState {
130 /* Current value of a counter */
131 target_ulong mhpmcounter_val;
132 /* Current value of a counter in RV32*/
133 target_ulong mhpmcounterh_val;
134 /* Snapshot values of counter */
135 target_ulong mhpmcounter_prev;
136 /* Snapshort value of a counter in RV32 */
137 target_ulong mhpmcounterh_prev;
139 /* Value beyond UINT32_MAX/UINT64_MAX before overflow interrupt trigger */
140 target_ulong irq_overflow_left;
143 struct CPUArchState {
144 target_ulong gpr[32];
145 target_ulong gprh[32]; /* 64 top bits of the 128-bit registers */
146 uint64_t fpr[32]; /* assume both F and D extensions */
148 /* vector coprocessor state. */
149 uint64_t vreg[32 * RV_VLEN_MAX / 64] QEMU_ALIGNED(16);
158 target_ulong load_res;
159 target_ulong load_val;
163 target_ulong badaddr;
166 target_ulong guest_phys_fault_addr;
168 target_ulong priv_ver;
169 target_ulong bext_ver;
170 target_ulong vext_ver;
172 /* RISCVMXL, but uint32_t for vmstate migration */
173 uint32_t misa_mxl; /* current mxl */
174 uint32_t misa_mxl_max; /* max mxl for this cpu */
175 uint32_t misa_ext; /* current extensions */
176 uint32_t misa_ext_mask; /* max ext for this cpu */
177 uint32_t xl; /* current xlen */
179 /* 128-bit helpers upper part return value */
184 #ifdef CONFIG_USER_ONLY
188 #ifndef CONFIG_USER_ONLY
190 /* This contains QEMU specific information about the virt state. */
195 target_ulong mhartid;
197 * For RV32 this is 32-bit mstatus and 32-bit mstatush.
198 * For RV64 this is a 64-bit mstatus.
204 * MIP contains the software writable version of SEIP ORed with the
205 * external interrupt value. The MIP register is always up-to-date.
206 * To keep track of the current source, we also save booleans of the values
217 target_ulong satp; /* since: priv-1.10.0 */
219 target_ulong medeleg;
228 target_ulong mtval; /* since: priv-1.10.0 */
230 /* Machine and Supervisor interrupt priorities */
235 target_ulong miselect;
236 target_ulong siselect;
238 /* Hypervisor CSRs */
239 target_ulong hstatus;
240 target_ulong hedeleg;
242 target_ulong hcounteren;
250 /* Hypervisor controlled virtual interrupt priorities */
254 /* Upper 64-bits of 128-bit CSRs */
260 * For RV32 this is 32-bit vsstatus and 32-bit vsstatush.
261 * For RV64 this is a 64-bit vsstatus.
265 target_ulong vsscratch;
267 target_ulong vscause;
271 /* AIA VS-mode CSRs */
272 target_ulong vsiselect;
278 target_ulong stvec_hs;
279 target_ulong sscratch_hs;
280 target_ulong sepc_hs;
281 target_ulong scause_hs;
282 target_ulong stval_hs;
283 target_ulong satp_hs;
286 /* Signals whether the current exception occurred with two-stage address
287 translation active. */
288 bool two_stage_lookup;
290 * Signals whether the current exception occurred while doing two-stage
291 * address translation for the VS-stage page table walk.
293 bool two_stage_indirect_lookup;
295 target_ulong scounteren;
296 target_ulong mcounteren;
298 target_ulong mcountinhibit;
300 /* PMU counter state */
301 PMUCTRState pmu_ctrs[RV_MAX_MHPMCOUNTERS];
303 /* PMU event selector configured values. First three are unused*/
304 target_ulong mhpmevent_val[RV_MAX_MHPMEVENTS];
306 /* PMU event selector configured values for RV32*/
307 target_ulong mhpmeventh_val[RV_MAX_MHPMEVENTS];
309 target_ulong sscratch;
310 target_ulong mscratch;
312 /* temporary htif regs */
321 /* physical memory protection */
322 pmp_table_t pmp_state;
323 target_ulong mseccfg;
326 target_ulong trigger_cur;
327 target_ulong tdata1[RV_MAX_TRIGGERS];
328 target_ulong tdata2[RV_MAX_TRIGGERS];
329 target_ulong tdata3[RV_MAX_TRIGGERS];
330 struct CPUBreakpoint *cpu_breakpoint[RV_MAX_TRIGGERS];
331 struct CPUWatchpoint *cpu_watchpoint[RV_MAX_TRIGGERS];
332 QEMUTimer *itrigger_timer[RV_MAX_TRIGGERS];
334 bool itrigger_enabled;
336 /* machine specific rdtime callback */
337 uint64_t (*rdtime_fn)(void *);
340 /* machine specific AIA ireg read-modify-write callback */
341 #define AIA_MAKE_IREG(__isel, __priv, __virt, __vgein, __xlen) \
342 ((((__xlen) & 0xff) << 24) | \
343 (((__vgein) & 0x3f) << 20) | \
344 (((__virt) & 0x1) << 18) | \
345 (((__priv) & 0x3) << 16) | \
347 #define AIA_IREG_ISEL(__ireg) ((__ireg) & 0xffff)
348 #define AIA_IREG_PRIV(__ireg) (((__ireg) >> 16) & 0x3)
349 #define AIA_IREG_VIRT(__ireg) (((__ireg) >> 18) & 0x1)
350 #define AIA_IREG_VGEIN(__ireg) (((__ireg) >> 20) & 0x3f)
351 #define AIA_IREG_XLEN(__ireg) (((__ireg) >> 24) & 0xff)
352 int (*aia_ireg_rmw_fn[4])(void *arg, target_ulong reg,
353 target_ulong *val, target_ulong new_val, target_ulong write_mask);
354 void *aia_ireg_rmw_fn_arg[4];
356 /* True if in debugger mode. */
360 * CSRs for PointerMasking extension
363 target_ulong mpmmask;
364 target_ulong mpmbase;
365 target_ulong spmmask;
366 target_ulong spmbase;
367 target_ulong upmmask;
368 target_ulong upmbase;
370 /* CSRs for execution enviornment configuration */
372 uint64_t mstateen[SMSTATEEN_MAX_COUNT];
373 uint64_t hstateen[SMSTATEEN_MAX_COUNT];
374 uint64_t sstateen[SMSTATEEN_MAX_COUNT];
375 target_ulong senvcfg;
378 target_ulong cur_pmmask;
379 target_ulong cur_pmbase;
381 float_status fp_status;
383 /* Fields from here on are preserved across CPU reset. */
384 QEMUTimer *stimer; /* Internal timer for S-mode interrupt */
385 QEMUTimer *vstimer; /* Internal timer for VS-mode interrupt */
392 bool kvm_timer_dirty;
393 uint64_t kvm_timer_time;
394 uint64_t kvm_timer_compare;
395 uint64_t kvm_timer_state;
396 uint64_t kvm_timer_frequency;
399 OBJECT_DECLARE_CPU_TYPE(RISCVCPU, RISCVCPUClass, RISCV_CPU)
403 * @parent_realize: The parent class' realize handler.
404 * @parent_phases: The parent class' reset phase handlers.
408 struct RISCVCPUClass {
410 CPUClass parent_class;
412 DeviceRealize parent_realize;
413 ResettablePhases parent_phases;
416 struct RISCVCPUConfig {
449 bool ext_zihintpause;
475 /* Vendor-specific custom extensions */
476 bool ext_XVentanaCondOps;
490 bool short_isa_string;
493 typedef struct RISCVCPUConfig RISCVCPUConfig;
497 * @env: #CPURISCVState
505 CPUNegativeOffsetState neg;
511 /* Configuration Settings */
514 QEMUTimer *pmu_timer;
515 /* A bitmask of Available programmable counters */
516 uint32_t pmu_avail_ctrs;
517 /* Mapping of events to counters */
518 GHashTable *pmu_event_ctr_map;
521 static inline int riscv_has_ext(CPURISCVState *env, target_ulong ext)
523 return (env->misa_ext & ext) != 0;
526 static inline bool riscv_feature(CPURISCVState *env, int feature)
528 return env->features & (1ULL << feature);
531 static inline void riscv_set_feature(CPURISCVState *env, int feature)
533 env->features |= (1ULL << feature);
536 #include "cpu_user.h"
538 extern const char * const riscv_int_regnames[];
539 extern const char * const riscv_int_regnamesh[];
540 extern const char * const riscv_fpr_regnames[];
542 const char *riscv_cpu_get_trap_name(target_ulong cause, bool async);
543 void riscv_cpu_do_interrupt(CPUState *cpu);
544 int riscv_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
545 int cpuid, DumpState *s);
546 int riscv_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,
547 int cpuid, DumpState *s);
548 int riscv_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
549 int riscv_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
550 int riscv_cpu_hviprio_index2irq(int index, int *out_irq, int *out_rdzero);
551 uint8_t riscv_cpu_default_priority(int irq);
552 uint64_t riscv_cpu_all_pending(CPURISCVState *env);
553 int riscv_cpu_mirq_pending(CPURISCVState *env);
554 int riscv_cpu_sirq_pending(CPURISCVState *env);
555 int riscv_cpu_vsirq_pending(CPURISCVState *env);
556 bool riscv_cpu_fp_enabled(CPURISCVState *env);
557 target_ulong riscv_cpu_get_geilen(CPURISCVState *env);
558 void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen);
559 bool riscv_cpu_vector_enabled(CPURISCVState *env);
560 bool riscv_cpu_virt_enabled(CPURISCVState *env);
561 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
562 bool riscv_cpu_two_stage_lookup(int mmu_idx);
563 int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch);
564 hwaddr riscv_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
565 G_NORETURN void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
566 MMUAccessType access_type, int mmu_idx,
568 bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
569 MMUAccessType access_type, int mmu_idx,
570 bool probe, uintptr_t retaddr);
571 void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
572 vaddr addr, unsigned size,
573 MMUAccessType access_type,
574 int mmu_idx, MemTxAttrs attrs,
575 MemTxResult response, uintptr_t retaddr);
576 char *riscv_isa_string(RISCVCPU *cpu);
577 void riscv_cpu_list(void);
579 #define cpu_list riscv_cpu_list
580 #define cpu_mmu_index riscv_cpu_mmu_index
582 #ifndef CONFIG_USER_ONLY
583 bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request);
584 void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env);
585 int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint64_t interrupts);
586 uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value);
587 #define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
588 void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(void *),
590 void riscv_cpu_set_aia_ireg_rmw_fn(CPURISCVState *env, uint32_t priv,
591 int (*rmw_fn)(void *arg,
594 target_ulong new_val,
595 target_ulong write_mask),
598 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv);
600 void riscv_translate_init(void);
601 G_NORETURN void riscv_raise_exception(CPURISCVState *env,
602 uint32_t exception, uintptr_t pc);
604 target_ulong riscv_cpu_get_fflags(CPURISCVState *env);
605 void riscv_cpu_set_fflags(CPURISCVState *env, target_ulong);
607 #define TB_FLAGS_PRIV_MMU_MASK 3
608 #define TB_FLAGS_PRIV_HYP_ACCESS_MASK (1 << 2)
609 #define TB_FLAGS_MSTATUS_FS MSTATUS_FS
610 #define TB_FLAGS_MSTATUS_VS MSTATUS_VS
612 #include "exec/cpu-all.h"
614 FIELD(TB_FLAGS, MEM_IDX, 0, 3)
615 FIELD(TB_FLAGS, LMUL, 3, 3)
616 FIELD(TB_FLAGS, SEW, 6, 3)
617 /* Skip MSTATUS_VS (0x600) bits */
618 FIELD(TB_FLAGS, VL_EQ_VLMAX, 11, 1)
619 FIELD(TB_FLAGS, VILL, 12, 1)
620 /* Skip MSTATUS_FS (0x6000) bits */
621 /* Is a Hypervisor instruction load/store allowed? */
622 FIELD(TB_FLAGS, HLSX, 15, 1)
623 FIELD(TB_FLAGS, MSTATUS_HS_FS, 16, 2)
624 FIELD(TB_FLAGS, MSTATUS_HS_VS, 18, 2)
625 /* The combination of MXL/SXL/UXL that applies to the current cpu mode. */
626 FIELD(TB_FLAGS, XL, 20, 2)
627 /* If PointerMasking should be applied */
628 FIELD(TB_FLAGS, PM_MASK_ENABLED, 22, 1)
629 FIELD(TB_FLAGS, PM_BASE_ENABLED, 23, 1)
630 FIELD(TB_FLAGS, VTA, 24, 1)
631 FIELD(TB_FLAGS, VMA, 25, 1)
632 /* Native debug itrigger */
633 FIELD(TB_FLAGS, ITRIGGER, 26, 1)
635 #ifdef TARGET_RISCV32
636 #define riscv_cpu_mxl(env) ((void)(env), MXL_RV32)
638 static inline RISCVMXL riscv_cpu_mxl(CPURISCVState *env)
640 return env->misa_mxl;
643 #define riscv_cpu_mxl_bits(env) (1UL << (4 + riscv_cpu_mxl(env)))
645 #if defined(TARGET_RISCV32)
646 #define cpu_recompute_xl(env) ((void)(env), MXL_RV32)
648 static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
650 RISCVMXL xl = env->misa_mxl;
651 #if !defined(CONFIG_USER_ONLY)
653 * When emulating a 32-bit-only cpu, use RV32.
654 * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
655 * MSTATUSH doesn't have UXL/SXL, therefore XLEN cannot be widened
656 * back to RV64 for lower privs.
658 if (xl != MXL_RV32) {
663 xl = get_field(env->mstatus, MSTATUS64_UXL);
665 default: /* PRV_S | PRV_H */
666 xl = get_field(env->mstatus, MSTATUS64_SXL);
675 static inline int riscv_cpu_xlen(CPURISCVState *env)
677 return 16 << env->xl;
680 #ifdef TARGET_RISCV32
681 #define riscv_cpu_sxl(env) ((void)(env), MXL_RV32)
683 static inline RISCVMXL riscv_cpu_sxl(CPURISCVState *env)
685 #ifdef CONFIG_USER_ONLY
686 return env->misa_mxl;
688 return get_field(env->mstatus, MSTATUS64_SXL);
694 * Encode LMUL to lmul as follows:
705 * then, we can calculate VLMAX = vlen >> (vsew + 3 - lmul)
706 * e.g. vlen = 256 bits, SEW = 16, LMUL = 1/8
707 * => VLMAX = vlen >> (1 + 3 - (-3))
711 static inline uint32_t vext_get_vlmax(RISCVCPU *cpu, target_ulong vtype)
713 uint8_t sew = FIELD_EX64(vtype, VTYPE, VSEW);
714 int8_t lmul = sextract32(FIELD_EX64(vtype, VTYPE, VLMUL), 0, 3);
715 return cpu->cfg.vlen >> (sew + 3 - lmul);
718 void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
719 target_ulong *cs_base, uint32_t *pflags);
721 void riscv_cpu_update_mask(CPURISCVState *env);
723 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
724 target_ulong *ret_value,
725 target_ulong new_value, target_ulong write_mask);
726 RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
727 target_ulong *ret_value,
728 target_ulong new_value,
729 target_ulong write_mask);
731 static inline void riscv_csr_write(CPURISCVState *env, int csrno,
734 riscv_csrrw(env, csrno, NULL, val, MAKE_64BIT_MASK(0, TARGET_LONG_BITS));
737 static inline target_ulong riscv_csr_read(CPURISCVState *env, int csrno)
739 target_ulong val = 0;
740 riscv_csrrw(env, csrno, &val, 0, 0);
744 typedef RISCVException (*riscv_csr_predicate_fn)(CPURISCVState *env,
746 typedef RISCVException (*riscv_csr_read_fn)(CPURISCVState *env, int csrno,
747 target_ulong *ret_value);
748 typedef RISCVException (*riscv_csr_write_fn)(CPURISCVState *env, int csrno,
749 target_ulong new_value);
750 typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
751 target_ulong *ret_value,
752 target_ulong new_value,
753 target_ulong write_mask);
755 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
757 Int128 new_value, Int128 write_mask);
759 typedef RISCVException (*riscv_csr_read128_fn)(CPURISCVState *env, int csrno,
761 typedef RISCVException (*riscv_csr_write128_fn)(CPURISCVState *env, int csrno,
766 riscv_csr_predicate_fn predicate;
767 riscv_csr_read_fn read;
768 riscv_csr_write_fn write;
770 riscv_csr_read128_fn read128;
771 riscv_csr_write128_fn write128;
772 /* The default priv spec version should be PRIV_VERSION_1_10_0 (i.e 0) */
773 uint32_t min_priv_ver;
774 } riscv_csr_operations;
776 /* CSR function table constants */
778 CSR_TABLE_SIZE = 0x1000
782 * The event id are encoded based on the encoding specified in the
783 * SBI specification v0.3
786 enum riscv_pmu_event_idx {
787 RISCV_PMU_EVENT_HW_CPU_CYCLES = 0x01,
788 RISCV_PMU_EVENT_HW_INSTRUCTIONS = 0x02,
789 RISCV_PMU_EVENT_CACHE_DTLB_READ_MISS = 0x10019,
790 RISCV_PMU_EVENT_CACHE_DTLB_WRITE_MISS = 0x1001B,
791 RISCV_PMU_EVENT_CACHE_ITLB_PREFETCH_MISS = 0x10021,
794 /* CSR function table */
795 extern riscv_csr_operations csr_ops[CSR_TABLE_SIZE];
797 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops);
798 void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops);
800 void riscv_cpu_register_gdb_regs_for_features(CPUState *cs);
802 #endif /* RISCV_CPU_H */