// AArch32_AT() // ============ // Perform address translation as per AT instructions. func AArch32_AT(vaddress : bits(32), stage_in : TranslationStage, el : bits(2), ataccess : ATAccess) begin var stage : TranslationStage = stage_in; var ss : SecurityState; var regime : Regime; var eae : boolean; // ATS1Hx instructions if el == EL2 then regime = Regime_EL2; eae = TRUE; ss = SS_NonSecure; // ATS1Cxx instructions elsif stage == TranslationStage_1 || (stage == TranslationStage_12 && !HaveEL(EL2)) then stage = TranslationStage_1; ss = SecurityStateAtEL(PSTATE.EL); regime = if ss == SS_Secure && ELUsingAArch32(EL3) then Regime_EL30 else Regime_EL10; eae = TTBCR().EAE == '1'; // ATS12NSOxx instructions else regime = Regime_EL10; eae = (if HaveEL(EL3) && ELUsingAArch32(EL3) then TTBCR_NS().EAE == '1' else TTBCR().EAE == '1'); ss = SS_NonSecure; end; var addrdesc : AddressDescriptor; var sdftype : SDFType; let aligned : boolean = TRUE; var supersection : bit = '0'; let accdesc : AccessDescriptor = CreateAccDescAT(ss, el, ataccess); // Prepare fault fields in case a fault is detected var fault : FaultRecord = NoFault(accdesc, ZeroExtend{64}(vaddress)); if eae then (fault, addrdesc) = AArch32_S1TranslateLD(fault, regime, vaddress, aligned, accdesc); else (fault, addrdesc, sdftype) = AArch32_S1TranslateSD(fault, regime, vaddress, aligned, accdesc); supersection = if sdftype == SDFType_Supersection then '1' else '0'; end; // ATS12NSOxx instructions if stage == TranslationStage_12 && fault.statuscode == Fault_None then (fault, addrdesc) = AArch32_S2Translate(fault, addrdesc, aligned, accdesc); end; if fault.statuscode != Fault_None then // Take exception on External abort or when a fault occurs on translation table walk if IsExternalAbort(fault) || (PSTATE.EL == EL1 && EL2Enabled() && fault.s2fs1walk) then PAR() = ARBITRARY : bits(64); AArch32_Abort(fault); end; end; addrdesc.fault = fault; if (eae || (stage == TranslationStage_12 && (HCR().VM == '1' || HCR().DC == '1')) || (stage == TranslationStage_1 && el != EL2 && PSTATE.EL == EL2)) then AArch32_EncodePARLD(addrdesc, ss); else AArch32_EncodePARSD(addrdesc, supersection, ss); end; return; end;

// AArch32_EncodePARLD() // ===================== // Returns 64-bit format PAR on address translation instruction. func AArch32_EncodePARLD(addrdesc : AddressDescriptor, ss : SecurityState) begin PAR()[63:0] = Zeros{64}; if !IsFault(addrdesc) then var ns : bit; if ss == SS_NonSecure then ns = ARBITRARY : bit; elsif addrdesc.paddress.paspace == PAS_Secure then ns = '0'; else ns = '1'; end; PAR().F = '0'; PAR().SH = ReportedPARShareability(PAREncodeShareability(addrdesc.memattrs)); PAR().NS = ns; PAR()[10] = ImpDefBit("Non-Faulting PAR"); // IMPDEF PAR().LPAE = '1'; PAR().PA = addrdesc.paddress.address[39:12]; PAR().ATTR = ReportedPARAttrs(EncodePARAttrs(addrdesc.memattrs)); else PAR().F = '1'; PAR().FST = AArch32_PARFaultStatusLD(addrdesc.fault); PAR().S2WLK = if addrdesc.fault.s2fs1walk then '1' else '0'; PAR().FSTAGE = if addrdesc.fault.secondstage then '1' else '0'; PAR().LPAE = '1'; PAR()[63:48] = ImpDefBits{16}("Faulting PAR"); // IMPDEF end; return; end;

// AArch32_EncodePARSD() // ===================== // Returns 32-bit format PAR on address translation instruction. func AArch32_EncodePARSD(addrdesc_in : AddressDescriptor, supersection : bit, ss : SecurityState) begin PAR()[31:0] = Zeros{32}; var addrdesc : AddressDescriptor = addrdesc_in; if !IsFault(addrdesc) then if (addrdesc.memattrs.memtype == MemType_Device || (addrdesc.memattrs.inner.attrs == MemAttr_NC && addrdesc.memattrs.outer.attrs == MemAttr_NC)) then addrdesc.memattrs.shareability = Shareability_OSH; end; var ns : bit; if ss == SS_NonSecure then ns = ARBITRARY : bit; elsif addrdesc.paddress.paspace == PAS_Secure then ns = '0'; else ns = '1'; end; let sh : bits(2) = (if addrdesc.memattrs.shareability != Shareability_NSH then '01' else '00'); PAR().F = '0'; PAR().SS = supersection; PAR().Outer = AArch32_ReportedOuterAttrs(AArch32_PAROuterAttrs(addrdesc.memattrs)); PAR().Inner = AArch32_ReportedInnerAttrs(AArch32_PARInnerAttrs(addrdesc.memattrs)); PAR().SH = ReportedPARShareability(sh); PAR()[8] = ImpDefBit("Non-Faulting PAR"); // IMPDEF PAR().NS = ns; PAR().NOS = if addrdesc.memattrs.shareability == Shareability_OSH then '0' else '1'; PAR().LPAE = '0'; PAR().PA = addrdesc.paddress.address[39:12]; else PAR().F = '1'; PAR().FST = AArch32_PARFaultStatusSD(addrdesc.fault); PAR().LPAE = '0'; PAR()[31:16] = ImpDefBits{16}("Faulting PAR"); // IMPDEF end; return; end;

// AArch32_PARFaultStatusLD() // ========================== // Fault status field decoding of 64-bit PAR func AArch32_PARFaultStatusLD(fault : FaultRecord) => bits(6) begin var syndrome : bits(6); if fault.statuscode == Fault_Domain then // Report Domain fault assert fault.level IN {1,2}; syndrome[1:0] = if fault.level == 1 then '01' else '10'; syndrome[5:2] = '1111'; else syndrome = EncodeLDFSC(fault.statuscode, fault.level); end; return syndrome; end;

// AArch32_PARFaultStatusSD() // ========================== // Fault status field decoding of 32-bit PAR. func AArch32_PARFaultStatusSD(fault : FaultRecord) => bits(6) begin var syndrome : bits(6); syndrome[5] = if IsExternalAbort(fault) then fault.extflag else '0'; syndrome[4:0] = EncodeSDFSC(fault.statuscode, fault.level); return syndrome; end;

// AArch32_PARInnerAttrs() // ======================= // Convert orthogonal attributes and hints to 32-bit PAR Inner field. func AArch32_PARInnerAttrs(memattrs : MemoryAttributes) => bits(3) begin var result : bits(3); if memattrs.memtype == MemType_Device then if memattrs.device == DeviceType_nGnRnE then result = '001'; // Non-cacheable elsif memattrs.device == DeviceType_nGnRE then result = '011'; // Non-cacheable end; else let inner : MemAttrHints = memattrs.inner; if inner.attrs == MemAttr_NC then result = '000'; // Non-cacheable elsif inner.attrs == MemAttr_WB && inner.hints[0] == '1' then result = '101'; // Write-Back, Write-Allocate elsif inner.attrs == MemAttr_WT then result = '110'; // Write-Through elsif inner.attrs == MemAttr_WB && inner.hints[0] == '0' then result = '111'; // Write-Back, no Write-Allocate end; end; return result; end;

// AArch32_PAROuterAttrs() // ======================= // Convert orthogonal attributes and hints to 32-bit PAR Outer field. func AArch32_PAROuterAttrs(memattrs : MemoryAttributes) => bits(2) begin var result : bits(2); if memattrs.memtype == MemType_Device then result = ARBITRARY : bits(2); else let outer : MemAttrHints = memattrs.outer; if outer.attrs == MemAttr_NC then result = '00'; // Non-cacheable elsif outer.attrs == MemAttr_WB && outer.hints[0] == '1' then result = '01'; // Write-Back, Write-Allocate elsif outer.attrs == MemAttr_WT && outer.hints[0] == '0' then result = '10'; // Write-Through, no Write-Allocate elsif outer.attrs == MemAttr_WB && outer.hints[0] == '0' then result = '11'; // Write-Back, no Write-Allocate end; end; return result; end;

// AArch32_ReportedInnerAttrs() // ============================ // The value returned in this field can be the resulting attribute, as determined by any permitted // implementation choices and any applicable configuration bits, instead of the value that appears // in the translation table descriptor. impdef func AArch32_ReportedInnerAttrs(attrs : bits(3)) => bits(3) begin return attrs; end;

// AArch32_ReportedOuterAttrs() // ============================ // The value returned in this field can be the resulting attribute, as determined by any permitted // implementation choices and any applicable configuration bits, instead of the value that appears // in the translation table descriptor. impdef func AArch32_ReportedOuterAttrs(attrs : bits(2)) => bits(2) begin return attrs; end;

// AArch32_CanTrapDC() // =================== // Determines whether the execution of the DC instruction can be trapped. func AArch32_CanTrapDC(cacheop : CacheOp, opscope : CacheOpScope) => boolean begin return (!AArch32_TreatDCAsNOP(cacheop, opscope) || ImpDefBool( "When DC is treated as NOP, data cache maintenance operations are trapped")); end;

// AArch32_DC() // ============ // Perform Data Cache Operation. func AArch32_DC(regval : bits(32), cacheop : CacheOp, opscope : CacheOpScope) begin var cache : CacheRecord; cache.acctype = AccessType_DC; cache.cacheop = cacheop; cache.opscope = opscope; cache.cachetype = CacheType_Data; cache.security = SecurityStateAtEL(PSTATE.EL); if opscope == CacheOpScope_SetWay then cache.shareability = Shareability_NSH; cache.(setnum, waynum, level) = DecodeSW(ZeroExtend{64}(regval), CacheType_Data); if (cacheop == CacheOp_Invalidate && PSTATE.EL == EL1 && EL2Enabled() && ((!ELUsingAArch32(EL2) && (HCR_EL2().SWIO == '1' || HCR_EL2().[DC,VM] != '00')) || (ELUsingAArch32(EL2) && (HCR().SWIO == '1' || HCR().[DC,VM] != '00')))) then cache.cacheop = CacheOp_CleanInvalidate; end; CACHE_OP(cache); return; end; if EL2Enabled() then if PSTATE.EL IN {EL0, EL1} then cache.is_vmid_valid = TRUE; cache.vmid = VMID(); else cache.is_vmid_valid = FALSE; end; else cache.is_vmid_valid = FALSE; end; if PSTATE.EL == EL0 then cache.is_asid_valid = TRUE; cache.asid = ASID(); else cache.is_asid_valid = FALSE; end; var vaddress : bits(32) = regval; var size : integer = 0; // by default no watchpoint address if cacheop == CacheOp_Invalidate then size = DataCacheWatchpointSize(); vaddress = AlignDownSize{32}(regval, size as AddressSize); end; cache.vaddress = ZeroExtend{64}(vaddress); let aligned : boolean = TRUE; let accdesc : AccessDescriptor = CreateAccDescDC(cache); var memaddrdesc : AddressDescriptor = AArch32_TranslateAddress(vaddress, accdesc, aligned, size); if IsFault(memaddrdesc) then memaddrdesc.fault.vaddress = ZeroExtend{64}(regval); AArch32_Abort(memaddrdesc.fault); end; cache.paddress = memaddrdesc.paddress; if opscope == CacheOpScope_PoC then cache.shareability = memaddrdesc.memattrs.shareability; else cache.shareability = Shareability_NSH; end; if (cacheop == CacheOp_Invalidate && PSTATE.EL == EL1 && EL2Enabled() && ((!ELUsingAArch32(EL2) && HCR_EL2().[DC,VM] != '00') || (ELUsingAArch32(EL2) && HCR().[DC,VM] != '00'))) then cache.cacheop = CacheOp_CleanInvalidate; end; CACHE_OP(cache); return; end;

// AArch32_TreatDCAsNOP() // ====================== // Determines whether the execution of the DC instruction is treated as a NOP. func AArch32_TreatDCAsNOP(cacheop : CacheOp, opscope : CacheOpScope) => boolean begin // DC to PoU: IMPLEMENTATION DEFINED - treated as NOP if LoUU and LoUIS are 0 if opscope == CacheOpScope_PoU && CLIDR().LoUU == '000' && CLIDR().LoUIS == '000' then return ImpDefBool("DC to PoU is treated as a NOP"); end; // DC to PoC: IMPLEMENTATION DEFINED - treated as NOP if LoC is 0 if opscope == CacheOpScope_PoC && CLIDR().LoC == '000' then return ImpDefBool("DC to PoC is treated as a NOP"); end; return FALSE; end;

// AArch32_VCRMatch() // ================== func AArch32_VCRMatch(vaddress : bits(32)) => boolean begin var match : boolean; if UsingAArch32() && ELUsingAArch32(EL1) && PSTATE.EL != EL2 then // Each bit position in this string corresponds to a bit in DBGVCR and an exception vector. var match_word : bits(32) = Zeros{}; let ss : SecurityState = CurrentSecurityState(); if vaddress[31:5] == ExcVectorBase()[31:5] then if HaveEL(EL3) && ss == SS_NonSecure then match_word[UInt(vaddress[4:2]) + 24] = '1'; // Non-secure vectors else match_word[UInt(vaddress[4:2]) + 0] = '1'; // Secure vectors (or no EL3) end; end; if (HaveEL(EL3) && ELUsingAArch32(EL3) && vaddress[31:5] == MVBAR()[31:5] && ss == SS_Secure) then match_word[UInt(vaddress[4:2]) + 8] = '1'; // Monitor vectors end; // Mask out bits not corresponding to vectors. var mask : bits(32); if !HaveEL(EL3) then mask = '00000000'::'00000000'::'00000000'::'11011110'; // DBGVCR[31:8] are RES0 elsif !ELUsingAArch32(EL3) then mask = '11011110'::'00000000'::'00000000'::'11011110'; // DBGVCR[15:8] are RES0 else mask = '11011110'::'00000000'::'11011100'::'11011110'; end; match_word = match_word AND DBGVCR() AND mask; match = !IsZero(match_word); // Check for UNPREDICTABLE case - match on Prefetch Abort and Data Abort vectors if !IsZero(match_word[28:27,12:11,4:3]) && DebugTarget() == PSTATE.EL then match = ConstrainUnpredictableBool(Unpredictable_VCMATCHDAPA); end; if !IsZero(vaddress[1:0]) && match then match = ConstrainUnpredictableBool(Unpredictable_VCMATCHHALF); end; else match = FALSE; end; return match; end;

// AArch32_SelfHostedSecurePrivilegedInvasiveDebugEnabled() // ======================================================== func AArch32_SelfHostedSecurePrivilegedInvasiveDebugEnabled() => boolean begin // The definition of this function is IMPLEMENTATION DEFINED. // In the recommended interface, AArch32_SelfHostedSecurePrivilegedInvasiveDebugEnabled returns // the state of the (DBGEN AND SPIDEN) signal. if !HaveEL(EL3) && NonSecureOnlyImplementation() then return FALSE; end; return DBGEN == HIGH && SPIDEN == HIGH; end;

// AArch32_BreakpointMatch() // ========================= // Breakpoint matching in an AArch32 translation regime. func AArch32_BreakpointMatch(n : integer, vaddress : bits(32), accdesc : AccessDescriptor, size : integer) => BreakpointInfo begin assert ELUsingAArch32(S1TranslationRegime()); assert n < NumBreakpointsImplemented(); var brkptinfo : BreakpointInfo; let enabled : boolean = DBGBCR(n).E == '1'; let isbreakpnt : boolean = TRUE; let linked : boolean = DBGBCR(n).BT == '0x01'; let linked_to : boolean = FALSE; let linked_n : integer{} = UInt(DBGBCR(n).LBN); let state_match : boolean = AArch32_StateMatch(DBGBCR(n).SSC, DBGBCR(n).HMC, DBGBCR(n).PMC, linked, linked_n, isbreakpnt, accdesc); var (value_match, value_mismatch) = AArch32_BreakpointValueMatch(n,vaddress, linked_to); if size == 4 then // Check second halfword // If the breakpoint address and BAS of an Address breakpoint match the address of the // second halfword of an instruction, but not the address of the first halfword, it is // CONSTRAINED UNPREDICTABLE whether this breakpoint generates a Breakpoint debug // event. let (match_i, mismatch_i) = AArch32_BreakpointValueMatch(n, vaddress + 2, linked_to); if !value_match && match_i then value_match = ConstrainUnpredictableBool(Unpredictable_BPMATCHHALF); end; if value_mismatch && !mismatch_i then value_mismatch = ConstrainUnpredictableBool(Unpredictable_BPMISMATCHHALF); end; end; if vaddress[1] == '1' && DBGBCR(n).BAS == '1111' then // The above notwithstanding, if DBGBCR(n).BAS == '1111', then it is CONSTRAINED // UNPREDICTABLE whether or not a Breakpoint debug event is generated for an instruction // at the address DBGBVR(n)+2. if value_match then value_match = ConstrainUnpredictableBool(Unpredictable_BPMATCHHALF); end; if !value_mismatch then value_mismatch = ConstrainUnpredictableBool(Unpredictable_BPMISMATCHHALF); end; end; brkptinfo.match = value_match && state_match && enabled; brkptinfo.mismatch = value_mismatch && state_match && enabled; return brkptinfo; end;

// AArch32_BreakpointValueMatch() // ============================== // The first result is whether an Address Match or Context breakpoint is programmed on the // instruction at "address". The second result is whether an Address Mismatch breakpoint is // programmed on the instruction, that is, whether the instruction should be stepped. func AArch32_BreakpointValueMatch(n_in : integer, vaddress : bits(32), linked_to : boolean) => (boolean, boolean) begin // "n" is the identity of the breakpoint unit to match against. // "vaddress" is the current instruction address, ignored if linked_to is TRUE and for Context // matching breakpoints. // "linked_to" is TRUE if this is a call from StateMatch for linking. var n : integer = n_in; var c : Constraint; // If a non-existent breakpoint then it is CONSTRAINED UNPREDICTABLE whether this gives // no match or the breakpoint is mapped to another UNKNOWN implemented breakpoint. if n >= NumBreakpointsImplemented() then (c, n) = ConstrainUnpredictableInteger(0, NumBreakpointsImplemented() - 1, Unpredictable_BPNOTIMPL); assert c IN {Constraint_DISABLED, Constraint_UNKNOWN}; if c == Constraint_DISABLED then return (FALSE, FALSE); end; end; // If this breakpoint is not enabled, it cannot generate a match. // (This could also happen on a call from StateMatch for linking). if DBGBCR(n).E == '0' then return (FALSE, FALSE); end; var dbgtype : bits(4) = DBGBCR(n).BT; (c, dbgtype) = AArch32_ReservedBreakpointType(n, dbgtype); if c == Constraint_DISABLED then return (FALSE, FALSE); end; // Otherwise the dbgtype value returned by AArch32_ReservedBreakpointType is valid. // Determine what to compare against. let match_addr : boolean = (dbgtype == '0x0x'); let mismatch : boolean = (dbgtype == '010x'); let match_vmid : boolean = (dbgtype == '10xx'); let match_cid1 : boolean = (dbgtype == 'xx1x'); let match_cid2 : boolean = (dbgtype == '11xx'); let linking_enabled : boolean = (dbgtype == 'xxx1'); // If called from StateMatch, is CONSTRAINED UNPREDICTABLE if the // breakpoint is not programmed with linking enabled. if linked_to && !linking_enabled then if !ConstrainUnpredictableBool(Unpredictable_BPLINKINGDISABLED) then return (FALSE, FALSE); end; end; // If called from BreakpointMatch return FALSE for Linked context ID and/or VMID matches. if !linked_to && linking_enabled && !match_addr then return (FALSE, FALSE); end; var bvr_match : boolean = FALSE; var bxvr_match : boolean = FALSE; // Do the comparison. if match_addr then let byte : integer = UInt(vaddress[1:0]); assert byte IN {0,2}; // "vaddress" is halfword aligned let byte_select_match : boolean = (DBGBCR(n).BAS[byte] == '1'); bvr_match = (vaddress[31:2] == DBGBVR(n)[31:2]) && byte_select_match; elsif match_cid1 then bvr_match = (PSTATE.EL != EL2 && CONTEXTIDR() == DBGBVR(n)[31:0]); end; if match_vmid then let vmid : bits(NUM_VMIDBITS) = VMID(); var bvr_vmid : bits(NUM_VMIDBITS); if ELUsingAArch32(EL2) then bvr_vmid = ZeroExtend{NUM_VMIDBITS}(DBGBXVR(n)[7:0]); elsif !IsFeatureImplemented(FEAT_VMID16) || VTCR_EL2().VS == '0' then bvr_vmid = ZeroExtend{NUM_VMIDBITS}(DBGBXVR(n)[7:0]); else bvr_vmid = DBGBXVR(n)[15:0]; end; bxvr_match = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && vmid == bvr_vmid); elsif match_cid2 then bxvr_match = (PSTATE.EL != EL3 && EL2Enabled() && !ELUsingAArch32(EL2) && DBGBXVR(n)[31:0] == CONTEXTIDR_EL2()[31:0]); end; let bvr_match_valid : boolean = (match_addr || match_cid1); let bxvr_match_valid : boolean = (match_vmid || match_cid2); let match : boolean = (!bxvr_match_valid || bxvr_match) && (!bvr_match_valid || bvr_match); return (match && !mismatch, !match && mismatch); end;

// AArch32_ReservedBreakpointType() // ================================ // Checks if the given DBGBCR(n).BT value is reserved and will generate Constrained Unpredictable // behavior, otherwise returns Constraint_NONE. func AArch32_ReservedBreakpointType(n : integer, bt_in : bits(4)) => (Constraint, bits(4)) begin var bt : bits(4) = bt_in; var reserved : boolean = FALSE; let context_aware : boolean = IsContextAwareBreakpoint(n); // Address mismatch if bt == '010x' && HaltOnBreakpointOrWatchpoint() then reserved = TRUE; end; // Context matching if bt != '0x0x' && !context_aware then reserved = TRUE; end; // EL2 extension if bt == '1xxx' && !HaveEL(EL2) then reserved = TRUE; end; // Context matching if (bt IN {'011x','11xx'} && !IsFeatureImplemented(FEAT_VHE) && !IsFeatureImplemented(FEAT_Debugv8p2)) then reserved = TRUE; end; if reserved then var c : Constraint; (c, bt) = ConstrainUnpredictableBits{4}(Unpredictable_RESBPTYPE); assert c IN {Constraint_DISABLED, Constraint_UNKNOWN}; if c == Constraint_DISABLED then return (c, ARBITRARY : bits(4)); // Otherwise the value returned by ConstrainUnpredictableBits must be a not-reserved value end; end; return (Constraint_NONE, bt); end;

// AArch32_StateMatch() // ==================== // Determine whether a breakpoint or watchpoint is enabled in the current mode and state. func AArch32_StateMatch(ssc_in : bits(2), hmc_in : bit, pxc_in : bits(2), linked_in : boolean, linked_n_in : integer, isbreakpnt : boolean, accdesc : AccessDescriptor) => boolean begin // "ssc_in","hmc_in","pxc_in" are the control fields from the DBGBCR(n) or DBGWCR(n) register. // "linked_in" is TRUE if this is a linked breakpoint/watchpoint type. // "linked_n_in" is the linked breakpoint number from the DBGBCR(n) or DBGWCR(n) register. // "isbreakpnt" is TRUE for breakpoints, FALSE for watchpoints. // "accdesc" describes the properties of the access being matched. var hmc : bit = hmc_in; var ssc : bits(2) = ssc_in; var pxc : bits(2) = pxc_in; var linked : boolean = linked_in; var linked_n : integer = linked_n_in; // If parameters are set to a reserved type, behaves as either disabled or a defined type var c : Constraint; // SSCE value discarded as there is no SSCE bit in AArch32_ (c, ssc, -, hmc, pxc) = CheckValidStateMatch(ssc, '0', hmc, pxc, isbreakpnt); if c == Constraint_DISABLED then return FALSE; end; // Otherwise the hmc,ssc,pxc values are either valid or the values returned by // CheckValidStateMatch are valid. let pl2_match : boolean = HaveEL(EL2) && ((hmc == '1' && (ssc::pxc != '1000')) || ssc == '11'); let pl1_match : boolean = pxc[0] == '1'; let pl0_match : boolean = pxc[1] == '1'; let ssu_match : boolean = isbreakpnt && hmc == '0' && pxc == '00' && ssc != '11'; var priv_match : boolean; if ssu_match then priv_match = PSTATE.M IN {M32_User,M32_Svc,M32_System}; else case accdesc.el of when EL3 => priv_match = pl1_match; // EL3 and EL1 are both PL1 when EL2 => priv_match = pl2_match; when EL1 => priv_match = pl1_match; when EL0 => priv_match = pl0_match; end; end; // Security state match var ss_match : boolean; case ssc of when '00' => ss_match = TRUE; // Both when '01' => ss_match = accdesc.ss == SS_NonSecure; // Non-secure only when '10' => ss_match = accdesc.ss == SS_Secure; // Secure only when '11' => ss_match = (hmc == '1' || accdesc.ss == SS_Secure); // HMC=1 -> Both, // HMC=0 -> Secure only end; var linked_match : boolean = FALSE; if linked then // "linked_n" must be an enabled context-aware breakpoint unit. // If it is not context-aware then it is CONSTRAINED UNPREDICTABLE whether // this gives no match, gives a match without linking, or linked_n is mapped to some // UNKNOWN breakpoint that is context-aware. if !IsContextAwareBreakpoint(linked_n) then let (first_ctx_cmp, last_ctx_cmp) : (integer, integer) = ContextAwareBreakpointRange(); (c, linked_n) = ConstrainUnpredictableInteger(first_ctx_cmp, last_ctx_cmp, Unpredictable_BPNOTCTXCMP); assert c IN {Constraint_DISABLED, Constraint_NONE, Constraint_UNKNOWN}; case c of when Constraint_DISABLED => return FALSE; // Disabled when Constraint_NONE => linked = FALSE; // No linking // Otherwise ConstrainUnpredictableInteger returned a context-aware breakpoint end; end; let vaddress : bits(32) = ARBITRARY : bits(32); let linked_to : boolean = TRUE; (linked_match,-) = AArch32_BreakpointValueMatch(linked_n, vaddress, linked_to); end; return priv_match && ss_match && (!linked || linked_match); end;

// AArch32_GenerateDebugExceptions() // ================================= func AArch32_GenerateDebugExceptions() => boolean begin let ss : SecurityState = CurrentSecurityState(); return AArch32_GenerateDebugExceptionsFrom(PSTATE.EL, ss); end;

// AArch32_GenerateDebugExceptionsFrom() // ===================================== func AArch32_GenerateDebugExceptionsFrom(from_el : bits(2), from_state : SecurityState) => boolean begin if !ELUsingAArch32(DebugTargetFrom(from_state)) then let mask : bit = '0'; // No PSTATE.D in AArch32 state return AArch64_GenerateDebugExceptionsFrom(from_el, from_state, mask); end; if DBGOSLSR().OSLK == '1' || DoubleLockStatus() || Halted() then return FALSE; end; var enabled : boolean; if HaveEL(EL3) && from_state == SS_Secure then assert from_el != EL2; // Secure EL2 always uses AArch64 if IsSecureEL2Enabled() then // Implies that EL3 and EL2 both using AArch64 enabled = MDCR_EL3().SDD == '0'; else let spd : bits(2) = if ELUsingAArch32(EL3) then SDCR().SPD else MDCR_EL3().SPD32; if spd[1] == '1' then enabled = spd[0] == '1'; else // SPD == 0b01 is reserved, but behaves the same as 0b00. enabled = AArch32_SelfHostedSecurePrivilegedInvasiveDebugEnabled(); end; end; if from_el == EL0 then enabled = enabled || SDER().SUIDEN == '1'; end; else enabled = from_el != EL2; end; return enabled; end;

// AArch32_IncrementCycleCounter() // =============================== // Increment the cycle counter and possibly set overflow bits. func AArch32_IncrementCycleCounter() begin if !CountPMUEvents(CYCLE_COUNTER_ID) then return; end; var d : bit = PMCR().D; // Check divide-by-64 var lc : bit = PMCR().LC; // Effective value of 'D' bit is 0 when Effective value of LC is '1' if lc == '1' then d = '0'; end; if d == '1' && !HasElapsed64Cycles() then return; end; let old_value : integer = UInt(PMCCNTR()); let new_value : integer = old_value + 1; PMCCNTR() = new_value[63:0]; let ovflw : integer{} = if lc == '1' then 64 else 32; if old_value[64:ovflw] != new_value[64:ovflw] then PMOVSSET().C = '1'; end; return; end;

// AArch32_IncrementEventCounter() // =============================== // Increment the specified event counter 'idx' by the specified amount 'increment'. // 'Vm' is the value event counter 'idx-1' is being incremented by if 'idx' is odd, // zero otherwise. // Returns the amount the counter was incremented by. func AArch32_IncrementEventCounter(idx : integer, increment_in : integer, Vm : integer) => integer begin if HaveAArch64() then // Force the counter to be incremented as a 64-bit counter. return AArch64_IncrementEventCounter(idx, increment_in, Vm); end; // In this model, event counters in an AArch32-only implementation are 32 bits and // the LP bits are RES0 in this model, even if FEAT_PMUv3p5 is implemented. var old_value : integer; var new_value : integer; old_value = UInt(PMEVCNTR(idx)); let increment : integer = PMUCountValue(idx, increment_in, Vm); new_value = old_value + increment; PMEVCNTR(idx) = new_value[31:0]; let ovflw : integer{} = 32; if old_value[64:ovflw] != new_value[64:ovflw] then PMOVSSET()[idx] = '1'; // Check for the CHAIN event from an even counter if (idx[0] == '0' && idx + 1 < NUM_PMU_COUNTERS && (GetPMUCounterRange(idx) == GetPMUCounterRange(idx+1) || ConstrainUnpredictableBool(Unpredictable_COUNT_CHAIN))) then // If PMU counters idx and idx+1 are not in same range, // it is CONSTRAINED UNPREDICTABLE if CHAIN event is counted PMUEvent(PMU_EVENT_CHAIN, 1, idx + 1); end; end; return increment; end;

// AArch32_PMUCycle() // ================== // Called at the end of each cycle to increment event counters and // check for PMU overflow. In pseudocode, a cycle ends after the // execution of the operational pseudocode. func AArch32_PMUCycle() begin if HaveAArch64() then AArch64_PMUCycle(); return; end; if !IsFeatureImplemented(FEAT_PMUv3) then return; end; PMUEvent(PMU_EVENT_CPU_CYCLES); let counters : integer = NUM_PMU_COUNTERS; var Vm : integer = 0; if counters != 0 then for idx = 0 to counters - 1 do if CountPMUEvents(idx) then let accumulated : integer = PMUEventAccumulator[[idx]]; if (idx MOD 2) == 0 then Vm = 0; end; Vm = AArch32_IncrementEventCounter(idx, accumulated, Vm); end; PMUEventAccumulator[[idx]] = 0; end; end; AArch32_IncrementCycleCounter(); CheckForPMUOverflow(); end;

// AArch32_EnterHypModeInDebugState() // ================================== // Take an exception in Debug state to Hyp mode. noreturn func AArch32_EnterHypModeInDebugState(except : ExceptionRecord) begin SynchronizeContext(); assert HaveEL(EL2) && CurrentSecurityState() == SS_NonSecure && ELUsingAArch32(EL2); AArch32_ReportHypEntry(except); AArch32_WriteMode(M32_Hyp); SPSR_curr() = ARBITRARY : bits(32); ELR_hyp() = ARBITRARY : bits(32); // In Debug state, the PE always execute T32 instructions when in AArch32 state, and // PSTATE.[SS,A,I,F] are not observable so behave as UNKNOWN. PSTATE.T = '1'; // PSTATE.J is RES0 PSTATE.[SS,A,I,F] = ARBITRARY : bits(4); DLR() = ARBITRARY : bits(32); DSPSR() = ARBITRARY : bits(32); if IsFeatureImplemented(FEAT_Debugv8p9) then DSPSR2() = ARBITRARY : bits(32); end; PSTATE.E = HSCTLR().EE; PSTATE.IL = '0'; PSTATE.IT = '00000000'; if IsFeatureImplemented(FEAT_SSBS) then PSTATE.SSBS = ARBITRARY : bit; end; EDSCR().ERR = '1'; UpdateEDSCRFields(); EndOfInstruction(EndOfInstructionReason_Exception); end;

// AArch32_EnterModeInDebugState() // =============================== // Take an exception in Debug state to a mode other than Monitor and Hyp mode. noreturn func AArch32_EnterModeInDebugState(target_mode : bits(5)) begin SynchronizeContext(); assert ELUsingAArch32(EL1) && PSTATE.EL != EL2; if PSTATE.M == M32_Monitor then SCR().NS = '0'; end; AArch32_WriteMode(target_mode); SPSR_curr() = ARBITRARY : bits(32); R(14) = ARBITRARY : bits(32); // In Debug state, the PE always execute T32 instructions when in AArch32 state, and // PSTATE.[SS,A,I,F] are not observable so behave as UNKNOWN. PSTATE.T = '1'; // PSTATE.J is RES0 PSTATE.[SS,A,I,F] = ARBITRARY : bits(4); DLR() = ARBITRARY : bits(32); DSPSR() = ARBITRARY : bits(32); if IsFeatureImplemented(FEAT_Debugv8p9) then DSPSR2() = ARBITRARY : bits(32); end; PSTATE.E = SCTLR().EE; PSTATE.IL = '0'; PSTATE.IT = '00000000'; if IsFeatureImplemented(FEAT_PAN) && SCTLR().SPAN == '0' then PSTATE.PAN = '1'; end; if IsFeatureImplemented(FEAT_SSBS) then PSTATE.SSBS = ARBITRARY : bit; end; EDSCR().ERR = '1'; UpdateEDSCRFields(); // Update EDSCR PE state flags. EndOfInstruction(EndOfInstructionReason_Exception); end;

// AArch32_EnterMonitorModeInDebugState() // ====================================== // Take an exception in Debug state to Monitor mode. func AArch32_EnterMonitorModeInDebugState() begin SynchronizeContext(); assert HaveEL(EL3) && ELUsingAArch32(EL3); let from_secure : boolean = CurrentSecurityState() == SS_Secure; if PSTATE.M == M32_Monitor then SCR().NS = '0'; end; AArch32_WriteMode(M32_Monitor); SPSR_curr() = ARBITRARY : bits(32); R(14) = ARBITRARY : bits(32); // In Debug state, the PE always execute T32 instructions when in AArch32 state, and // PSTATE.[SS,A,I,F] are not observable so behave as UNKNOWN. PSTATE.T = '1'; // PSTATE.J is RES0 PSTATE.[SS,A,I,F] = ARBITRARY : bits(4); PSTATE.E = SCTLR().EE; PSTATE.IL = '0'; PSTATE.IT = '00000000'; if IsFeatureImplemented(FEAT_PAN) then if !from_secure then PSTATE.PAN = '0'; elsif SCTLR().SPAN == '0' then PSTATE.PAN = '1'; end; end; if IsFeatureImplemented(FEAT_SSBS) then PSTATE.SSBS = ARBITRARY : bit; end; DLR() = ARBITRARY : bits(32); DSPSR() = ARBITRARY : bits(32); if IsFeatureImplemented(FEAT_Debugv8p9) then DSPSR2() = ARBITRARY : bits(32); end; EDSCR().ERR = '1'; UpdateEDSCRFields(); // Update EDSCR PE state flags. EndOfInstruction(EndOfInstructionReason_Exception); end;

// AArch32_WatchpointByteMatch() // ============================= func AArch32_WatchpointByteMatch(n : integer, vaddress : bits(32)) => boolean begin let dbgtop : integer{} = 31; let cmpbottom : integer{} = if DBGWVR(n)[2] == '1' then 2 else 3; // Word or doubleword var bottom = cmpbottom; let select : integer{} = UInt(vaddress[cmpbottom-1:0]); var byte_select_match : boolean = (DBGWCR(n).BAS[select] != '0'); var mask : integer{} = UInt(DBGWCR(n).MASK); // If DBGWCR(n).MASK is a nonzero value and DBGWCR(n).BAS is not set to '11111111', or // DBGWCR(n).BAS specifies a non-contiguous set of bytes behavior is CONSTRAINED // UNPREDICTABLE. if mask > 0 && !IsOnes(DBGWCR(n).BAS) then byte_select_match = ConstrainUnpredictableBool(Unpredictable_WPMASKANDBAS); else let LSB : bits(8) = (DBGWCR(n).BAS AND NOT(DBGWCR(n).BAS - 1)); let MSB : bits(8) = (DBGWCR(n).BAS + LSB); if !IsZero(MSB AND (MSB - 1)) then // Not contiguous byte_select_match = ConstrainUnpredictableBool(Unpredictable_WPBASCONTIGUOUS); bottom = 3; // For the whole doubleword end; end; // If the address mask is set to a reserved value, the behavior is CONSTRAINED UNPREDICTABLE. if mask > 0 && mask <= 2 then var c : Constraint; var unpred_mask : integer; (c, unpred_mask) = ConstrainUnpredictableInteger(3, 31, Unpredictable_RESWPMASK); assert c IN {Constraint_DISABLED, Constraint_NONE, Constraint_UNKNOWN}; case c of when Constraint_DISABLED => return FALSE; // Disabled when Constraint_NONE => mask = 0; // No masking // Otherwise the value returned by ConstrainUnpredictableInteger is a not-reserved value otherwise => mask = unpred_mask as integer{3..31}; end; end; let cmpmsb : integer{} = dbgtop; let cmplsb : integer{} = if mask > bottom then mask else bottom; let bottombit : integer{} = bottom; var WVR_match : boolean = (vaddress[cmpmsb:cmplsb] == DBGWVR(n)[cmpmsb:cmplsb]); if mask > bottom then // If masked bits of DBGWVR(n) are not zero, the behavior is CONSTRAINED UNPREDICTABLE. if WVR_match && !IsZero(DBGWVR(n)[cmplsb-1:bottombit]) then WVR_match = ConstrainUnpredictableBool(Unpredictable_WPMASKEDBITS); end; end; return (WVR_match && byte_select_match); end;

// AArch32_WatchpointMatch() // ========================= // Watchpoint matching in an AArch32 translation regime. func AArch32_WatchpointMatch(n : integer, vaddress : bits(32), size : integer, accdesc : AccessDescriptor) => WatchpointInfo begin assert ELUsingAArch32(S1TranslationRegime()); assert n < NumWatchpointsImplemented(); let enabled : boolean = DBGWCR(n).E == '1'; let linked : boolean = DBGWCR(n).WT == '1'; let isbreakpnt : boolean = FALSE; let linked_n : integer{} = UInt(DBGWCR_EL1(n).LBN); let state_match : boolean = AArch32_StateMatch(DBGWCR(n).SSC, DBGWCR(n).HMC, DBGWCR(n).PAC, linked, linked_n, isbreakpnt, accdesc); var watchptinfo : WatchpointInfo; var ls_match : boolean; case DBGWCR(n).LSC[1:0] of when '00' => ls_match = FALSE; when '01' => ls_match = accdesc.read; when '10' => ls_match = accdesc.write || accdesc.acctype == AccessType_DC; when '11' => ls_match = TRUE; end; var value_match : boolean = FALSE; watchptinfo.vaddress = ZeroExtend{64}(vaddress); for byte = 0 to size - 1 do if (!value_match && !AddressInNaturallyAlignedBlock(watchptinfo.vaddress, ZeroExtend{64}(vaddress + byte))) then // Watchpoint should report an address which is in // the naturally aligned block of the matched address. watchptinfo.vaddress = ZeroExtend{64}(vaddress + byte); end; value_match = value_match || AArch32_WatchpointByteMatch(n, vaddress + byte); end; watchptinfo.watchpt_num = n; watchptinfo.value_match = value_match && state_match && ls_match && enabled; return watchptinfo; end;

// AArch32_Abort() // =============== // Abort and Debug exception handling in an AArch32 translation regime. func AArch32_Abort(fault : FaultRecord) begin // Check if routed to AArch64 state var route_to_aarch64 : boolean = ((IsExternalAbort(fault) && !ELUsingAArch32(SyncExternalAbortTarget(fault))) || (PSTATE.EL == EL0 && !ELUsingAArch32(EL1))); if !route_to_aarch64 && EL2Enabled() && !ELUsingAArch32(EL2) then route_to_aarch64 = (HCR_EL2().TGE == '1' || IsSecondStage(fault) || (IsDebugException(fault) && MDCR_EL2().TDE == '1')); end; if route_to_aarch64 then AArch64_Abort(fault); end; if fault.accessdesc.acctype == AccessType_IFETCH then AArch32_TakePrefetchAbortException(fault); else AArch32_TakeDataAbortException(fault); end; end;

// AArch32_AbortSyndrome() // ======================= // Creates an exception syndrome record for Abort exceptions // taken to Hyp mode // from an AArch32 translation regime. func AArch32_AbortSyndrome(exceptype : Exception, fault : FaultRecord, target_el : bits(2)) => ExceptionRecord begin var except : ExceptionRecord = ExceptionSyndrome(exceptype); except.syndrome.iss = AArch32_FaultSyndrome(exceptype, fault); if exceptype == Exception_Watchpoint then except.vaddress = fault.watchptinfo.vaddress; else except.vaddress = ZeroExtend{64}(fault.vaddress); end; if IPAValid(fault) then except.ipavalid = TRUE; except.NS = if fault.ipaddress.paspace == PAS_NonSecure then '1' else '0'; except.ipaddress = ZeroExtend{NUM_PABITS}(fault.ipaddress.address); else except.ipavalid = FALSE; end; return except; end;

// AArch32_CheckPCAlignment() // ========================== func AArch32_CheckPCAlignment() begin let pc : bits(32) = ThisInstrAddr{}(); if (CurrentInstrSet() == InstrSet_A32 && pc[1] == '1') || pc[0] == '1' then if AArch32_GeneralExceptionsToAArch64() then AArch64_PCAlignmentFault(); end; let accdesc : AccessDescriptor = CreateAccDescIFetch(); var fault : FaultRecord = NoFault(accdesc, ZeroExtend{64}(pc)); // Generate an Alignment fault Prefetch Abort exception fault.statuscode = Fault_Alignment; AArch32_Abort(fault); end; end;

// AArch32_CommonFaultStatus() // =========================== // Return the common part of the fault status on reporting a Data // or Prefetch Abort. func AArch32_CommonFaultStatus(fault : FaultRecord, long_format : boolean) => bits(32) begin var target : bits(32) = Zeros{}; if IsFeatureImplemented(FEAT_RAS) && IsAsyncAbort(fault) then let errstate : ErrorState = PEErrorState(fault); target[15:14] = AArch32_EncodeAsyncErrorSyndrome(errstate); // AET end; if IsExternalAbort(fault) then target[12] = fault.extflag; end; // ExT target[9] = if long_format then '1' else '0'; // LPAE if long_format then // Long-descriptor format target[5:0] = EncodeLDFSC(fault.statuscode, fault.level); // STATUS else // Short-descriptor format target[10,3:0] = EncodeSDFSC(fault.statuscode, fault.level); // FS end; return target; end;

// AArch32_ReportDataAbort() // ========================= // Report syndrome information for aborts taken to modes other than Hyp mode. func AArch32_ReportDataAbort(route_to_monitor : boolean, fault : FaultRecord) begin var long_format : boolean; if route_to_monitor && CurrentSecurityState() != SS_Secure then long_format = ((TTBCR_S().EAE == '1') || (IsExternalSyncAbort(fault) && ((PSTATE.EL == EL2 || TTBCR().EAE == '1') || (fault.secondstage && ImpDefBool( "Report abort using Long-descriptor format"))))); else long_format = TTBCR().EAE == '1'; end; var syndrome : bits(32) = AArch32_CommonFaultStatus(fault, long_format); // bits of syndrome that are not common to I and D side if fault.accessdesc.acctype IN {AccessType_DC, AccessType_IC, AccessType_AT} then syndrome[13] = '1'; // CM syndrome[11] = '1'; // WnR else syndrome[11] = if fault.write then '1' else '0'; // WnR end; if !long_format then syndrome[7:4] = fault.domain; // Domain end; if fault.accessdesc.acctype == AccessType_IC then var i_syndrome : bits(32); if (!long_format && ImpDefBool("Report I-cache maintenance fault in IFSR")) then i_syndrome = syndrome; syndrome[10,3:0] = EncodeSDFSC(Fault_ICacheMaint, 1); else i_syndrome = ARBITRARY : bits(32); end; if route_to_monitor then IFSR_S() = i_syndrome; else IFSR() = i_syndrome; end; end; if route_to_monitor then DFSR_S() = syndrome; DFAR_S() = fault.vaddress[31:0]; else DFSR() = syndrome; DFAR() = fault.vaddress[31:0]; end; end;

// AArch32_ReportPrefetchAbort() // ============================= // Report syndrome information for aborts taken to modes other than Hyp mode. func AArch32_ReportPrefetchAbort(route_to_monitor : boolean, fault : FaultRecord) begin // The encoding used in the IFSR can be Long-descriptor format or Short-descriptor format. // Normally, the current translation table format determines the format. For an abort from // Non-secure state to Monitor mode, the IFSR uses the Long-descriptor format if any of the // following applies: // * The Secure TTBCR.EAE is set to 1. // * It is taken from Hyp mode. // * It is taken from EL1 or EL0, and the Non-secure TTBCR.EAE is set to 1. var long_format : boolean = FALSE; if route_to_monitor && CurrentSecurityState() != SS_Secure then long_format = TTBCR_S().EAE == '1' || PSTATE.EL == EL2 || TTBCR().EAE == '1'; else long_format = TTBCR().EAE == '1'; end; let fsr : bits(32) = AArch32_CommonFaultStatus(fault, long_format); if route_to_monitor then IFSR_S() = fsr; IFAR_S() = fault.vaddress[31:0]; else IFSR() = fsr; IFAR() = fault.vaddress[31:0]; end; return; end;

// AArch32_TakeDataAbortException() // ================================ func AArch32_TakeDataAbortException(fault : FaultRecord) begin var sea_target : bits(2); if IsExternalAbort(fault) then sea_target = SyncExternalAbortTarget(fault); else sea_target = ARBITRARY : bits(2); end; let route_to_monitor : boolean = IsExternalAbort(fault) && sea_target == EL3; let route_to_hyp : boolean = (EL2Enabled() && PSTATE.EL IN {EL0, EL1} && (HCR().TGE == '1' || (IsExternalAbort(fault) && sea_target == EL2) || (IsDebugException(fault) && HDCR().TDE == '1') || IsSecondStage(fault))); let preferred_exception_return : bits(32) = ThisInstrAddr{}(); let vect_offset : integer = 0x10; let lr_offset : integer = 8; if IsDebugException(fault) then DBGDSCRext().MOE = fault.debugmoe; end; if route_to_monitor then AArch32_ReportDataAbort(route_to_monitor, fault); AArch32_EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); elsif PSTATE.EL == EL2 || route_to_hyp then let except : ExceptionRecord = AArch32_AbortSyndrome(Exception_DataAbort, fault, EL2); if PSTATE.EL == EL2 then AArch32_EnterHypMode(except, preferred_exception_return, vect_offset); else AArch32_EnterHypMode(except, preferred_exception_return, 0x14); end; else AArch32_ReportDataAbort(route_to_monitor, fault); AArch32_EnterMode(M32_Abort, preferred_exception_return, lr_offset, vect_offset); end; end;

// AArch32_TakePrefetchAbortException() // ==================================== func AArch32_TakePrefetchAbortException(fault : FaultRecord) begin var sea_target : bits(2); if IsExternalAbort(fault) then sea_target = SyncExternalAbortTarget(fault); else sea_target = ARBITRARY : bits(2); end; let route_to_monitor : boolean = IsExternalAbort(fault) && sea_target == EL3; let route_to_hyp : boolean = (EL2Enabled() && PSTATE.EL IN {EL0, EL1} && (HCR().TGE == '1' || (IsExternalAbort(fault) && sea_target == EL2) || (IsDebugException(fault) && HDCR().TDE == '1') || IsSecondStage(fault))); var except : ExceptionRecord; let preferred_exception_return : bits(32) = ThisInstrAddr{}(); let vect_offset : integer = 0x0C; let lr_offset : integer = 4; if IsDebugException(fault) then DBGDSCRext().MOE = fault.debugmoe; end; if route_to_monitor then AArch32_ReportPrefetchAbort(route_to_monitor, fault); AArch32_EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); elsif PSTATE.EL == EL2 || route_to_hyp then if fault.statuscode == Fault_Alignment then // PC Alignment fault except = ExceptionSyndrome(Exception_PCAlignment); except.vaddress = ThisInstrAddr{64}(); else except = AArch32_AbortSyndrome(Exception_InstructionAbort, fault, EL2); end; if PSTATE.EL == EL2 then AArch32_EnterHypMode(except, preferred_exception_return, vect_offset); else AArch32_EnterHypMode(except, preferred_exception_return, 0x14); end; else AArch32_ReportPrefetchAbort(route_to_monitor, fault); AArch32_EnterMode(M32_Abort, preferred_exception_return, lr_offset, vect_offset); end; end;

// AArch32_TakePhysicalFIQException() // ================================== func AArch32_TakePhysicalFIQException() begin // Check if routed to AArch64 state var route_to_aarch64 : boolean = PSTATE.EL == EL0 && !ELUsingAArch32(EL1); if !route_to_aarch64 && EL2Enabled() && !ELUsingAArch32(EL2) then route_to_aarch64 = HCR_EL2().TGE == '1' || (HCR_EL2().FMO == '1' && !IsInHost()); end; if !route_to_aarch64 then route_to_aarch64 = EffectiveSCR_EL3_FIQ() == '1'; end; if route_to_aarch64 then AArch64_TakePhysicalFIQException(); end; let route_to_monitor : boolean = HaveEL(EL3) && SCR().FIQ == '1'; let route_to_hyp : boolean = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && (HCR().TGE == '1' || HCR().FMO == '1')); let preferred_exception_return : bits(32) = ThisInstrAddr{}(); let vect_offset : integer = 0x1C; let lr_offset : integer = 4; if route_to_monitor then AArch32_EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); elsif PSTATE.EL == EL2 || route_to_hyp then let except : ExceptionRecord = ExceptionSyndrome(Exception_FIQ); AArch32_EnterHypMode(except, preferred_exception_return, vect_offset); else AArch32_EnterMode(M32_FIQ, preferred_exception_return, lr_offset, vect_offset); end; end;

// AArch32_TakePhysicalIRQException() // ================================== // Take an enabled physical IRQ exception. func AArch32_TakePhysicalIRQException() begin // Check if routed to AArch64 state var route_to_aarch64 : boolean = PSTATE.EL == EL0 && !ELUsingAArch32(EL1); if !route_to_aarch64 && EL2Enabled() && !ELUsingAArch32(EL2) then route_to_aarch64 = HCR_EL2().TGE == '1' || (HCR_EL2().IMO == '1' && !IsInHost()); end; if !route_to_aarch64 then route_to_aarch64 = EffectiveSCR_EL3_IRQ() == '1'; end; if route_to_aarch64 then AArch64_TakePhysicalIRQException(); end; let route_to_monitor : boolean = HaveEL(EL3) && SCR().IRQ == '1'; let route_to_hyp : boolean = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && (HCR().TGE == '1' || HCR().IMO == '1')); let preferred_exception_return : bits(32) = ThisInstrAddr{}(); let vect_offset : integer = 0x18; let lr_offset : integer = 4; if route_to_monitor then AArch32_EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); elsif PSTATE.EL == EL2 || route_to_hyp then let except : ExceptionRecord = ExceptionSyndrome(Exception_IRQ); AArch32_EnterHypMode(except, preferred_exception_return, vect_offset); else AArch32_EnterMode(M32_IRQ, preferred_exception_return, lr_offset, vect_offset); end; end;

// AArch32_TakePhysicalSErrorException() // ===================================== func AArch32_TakePhysicalSErrorException(implicit_esb : boolean) begin var masked : boolean; var target_el : bits(2); (masked, target_el) = PhysicalSErrorTarget(); assert !masked; // Check if routed to AArch64 state if !ELUsingAArch32(target_el) then AArch64_TakePhysicalSErrorException(implicit_esb); end; let preferred_exception_return : bits(32) = ThisInstrAddr{}(); let vect_offset : integer = 0x10; let fault : FaultRecord = GetPendingPhysicalSError(); let lr_offset : integer = 8; let except : ExceptionRecord = AArch32_AbortSyndrome(Exception_DataAbort, fault, target_el); let route_to_monitor : boolean = (target_el == EL3); if IsSErrorEdgeTriggered() then ClearPendingPhysicalSError(); end; case target_el of when EL3 => AArch32_ReportDataAbort(route_to_monitor, fault); AArch32_EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); when EL2 => if PSTATE.EL == EL2 then AArch32_EnterHypMode(except, preferred_exception_return, vect_offset); else AArch32_EnterHypMode(except, preferred_exception_return, 0x14); end; when EL1 => AArch32_ReportDataAbort(route_to_monitor, fault); AArch32_EnterMode(M32_Abort, preferred_exception_return, lr_offset, vect_offset); otherwise => unreachable; end; end;

// AArch32_TakeVirtualFIQException() // ================================= func AArch32_TakeVirtualFIQException() begin assert PSTATE.EL IN {EL0, EL1} && EL2Enabled(); if ELUsingAArch32(EL2) then // Virtual IRQ enabled if TGE==0 and FMO==1 assert HCR().TGE == '0' && HCR().FMO == '1'; else assert HCR_EL2().TGE == '0' && HCR_EL2().FMO == '1'; end; // Check if routed to AArch64 state if PSTATE.EL == EL0 && !ELUsingAArch32(EL1) then AArch64_TakeVirtualFIQException(); end; let preferred_exception_return : bits(32)= ThisInstrAddr{}(); let vect_offset : integer = 0x1C; let lr_offset : integer = 4; AArch32_EnterMode(M32_FIQ, preferred_exception_return, lr_offset, vect_offset); end;

// AArch32_TakeVirtualIRQException() // ================================= func AArch32_TakeVirtualIRQException() begin assert PSTATE.EL IN {EL0, EL1} && EL2Enabled(); if ELUsingAArch32(EL2) then // Virtual IRQs enabled if TGE==0 and IMO==1 assert HCR().TGE == '0' && HCR().IMO == '1'; else assert HCR_EL2().TGE == '0' && HCR_EL2().IMO == '1'; end; // Check if routed to AArch64 state if PSTATE.EL == EL0 && !ELUsingAArch32(EL1) then AArch64_TakeVirtualIRQException(); end; let preferred_exception_return : bits(32) = ThisInstrAddr{}(); let vect_offset : integer = 0x18; let lr_offset : integer = 4; AArch32_EnterMode(M32_IRQ, preferred_exception_return, lr_offset, vect_offset); end;

// AArch32_TakeVirtualSErrorException() // ==================================== func AArch32_TakeVirtualSErrorException() begin assert PSTATE.EL IN {EL0, EL1} && EL2Enabled(); if ELUsingAArch32(EL2) then // Virtual SError enabled if TGE==0 and AMO==1 assert HCR().TGE == '0' && HCR().AMO == '1'; else assert HCR_EL2().TGE == '0' && HCR_EL2().AMO == '1'; end; // Check if routed to AArch64 state if PSTATE.EL == EL0 && !ELUsingAArch32(EL1) then AArch64_TakeVirtualSErrorException(); end; let route_to_monitor : boolean = FALSE; let preferred_exception_return : bits(32) = ThisInstrAddr{}(); let vect_offset : integer = 0x10; let lr_offset : integer = 8; let vaddress : bits(32) = ARBITRARY : bits(32); let parity : boolean = FALSE; let fault : Fault = Fault_AsyncExternal; let level : integer = ARBITRARY : integer; var fsr : bits(32) = Zeros{}; if IsFeatureImplemented(FEAT_RAS) then if ELUsingAArch32(EL2) then fsr[15:14] = VDFSR().AET; fsr[12] = VDFSR().ExT; else fsr[15:14] = VSESR_EL2().AET; fsr[12] = VSESR_EL2().ExT; end; else fsr[12] = ImpDefBit("Virtual External abort type"); end; if TTBCR().EAE == '1' then // Long-descriptor format fsr[9] = '1'; fsr[5:0] = EncodeLDFSC(fault, level); else // Short-descriptor format fsr[9] = '0'; fsr[10,3:0] = EncodeSDFSC(fault, level); end; DFSR() = fsr; DFAR() = ARBITRARY : bits(32); ClearPendingVirtualSError(); AArch32_EnterMode(M32_Abort, preferred_exception_return, lr_offset, vect_offset); end;

// AArch32_SoftwareBreakpoint() // ============================ func AArch32_SoftwareBreakpoint(immediate : bits(16)) begin if (EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2().TGE == '1' || MDCR_EL2().TDE == '1')) || !ELUsingAArch32(EL1) then AArch64_SoftwareBreakpoint(immediate); end; let accdesc : AccessDescriptor = CreateAccDescIFetch(); var fault : FaultRecord = NoFault(accdesc, ARBITRARY : bits(64)); fault.statuscode = Fault_Debug; fault.debugmoe = DebugException_BKPT; AArch32_Abort(fault); end;

// DebugException // ============== // Reason codes for debug exceptions, taken to AArch32 constant DebugException_Breakpoint : bits(4) = '0001'; constant DebugException_BKPT : bits(4) = '0011'; constant DebugException_VectorCatch : bits(4) = '0101'; constant DebugException_Watchpoint : bits(4) = '1010';

// AArch32_CheckAdvSIMDOrFPRegisterTraps() // ======================================= // Check if an instruction that accesses an Advanced SIMD and // floating-point System register is trapped by an appropriate HCR.TIDx // ID group trap control. func AArch32_CheckAdvSIMDOrFPRegisterTraps(reg : bits(4)) begin if PSTATE.EL == EL1 && EL2Enabled() then let tid0 : bit = if ELUsingAArch32(EL2) then HCR().TID0 else HCR_EL2().TID0; let tid3 : bit = if ELUsingAArch32(EL2) then HCR().TID3 else HCR_EL2().TID3; if ((tid0 == '1' && reg == '0000') || // FPSID (tid3 == '1' && reg IN {'0101', '0110', '0111'})) then // MVFRx if ELUsingAArch32(EL2) then AArch32_SystemAccessTrap(M32_Hyp, 0x8); else AArch64_AArch32SystemAccessTrap(EL2, 0x8); end; end; end; end;

// AArch32_ExceptionClass() // ======================== // Returns the Exception Class and Instruction Length fields to be reported in HSR func AArch32_ExceptionClass(exceptype : Exception) => (integer,bit) begin var il_is_valid : boolean = TRUE; var ec : integer; case exceptype of when Exception_Uncategorized => ec = 0x00; il_is_valid = FALSE; when Exception_WFxTrap => ec = 0x01; when Exception_CP15RTTrap => ec = 0x03; when Exception_CP15RRTTrap => ec = 0x04; when Exception_CP14RTTrap => ec = 0x05; when Exception_CP14DTTrap => ec = 0x06; when Exception_AdvSIMDFPAccessTrap => ec = 0x07; when Exception_FPIDTrap => ec = 0x08; when Exception_CP14RRTTrap => ec = 0x0C; when Exception_IllegalState => ec = 0x0E; il_is_valid = FALSE; when Exception_SupervisorCall => ec = 0x11; when Exception_HypervisorCall => ec = 0x12; when Exception_MonitorCall => ec = 0x13; when Exception_InstructionAbort => ec = if PSTATE.EL == EL2 then 0x21 else 0x20; il_is_valid = FALSE; when Exception_PCAlignment => ec = 0x22; il_is_valid = FALSE; when Exception_DataAbort => ec = if PSTATE.EL == EL2 then 0x25 else 0x24; when Exception_FPTrappedException => ec = 0x28; when Exception_Profiling => ec = 0x3D; otherwise => unreachable; end; var il : bit; if il_is_valid then il = if ThisInstrLength() == 32 then '1' else '0'; else il = '1'; end; return (ec,il); end;

// AArch32_GeneralExceptionsToAArch64() // ==================================== // Returns TRUE if exceptions normally routed to EL1 are being handled at an Exception // level using AArch64, because either EL1 is using AArch64 or TGE is in force and EL2 // is using AArch64. func AArch32_GeneralExceptionsToAArch64() => boolean begin return ((PSTATE.EL == EL0 && !ELUsingAArch32(EL1)) || (EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2().TGE == '1')); end;

// AArch32_ReportHypEntry() // ======================== // Report syndrome information to Hyp mode registers. func AArch32_ReportHypEntry(except : ExceptionRecord) begin let exceptype : Exception = except.exceptype; var (ec,il) : (integer, bit) = AArch32_ExceptionClass(exceptype); let iss : bits(25)= except.syndrome.iss; let iss2 : bits(24)= except.syndrome.iss2; // IL is not valid for Data Abort exceptions without valid instruction syndrome information if ec IN {0x24,0x25} && iss[24] == '0' then il = '1'; end; HSR() = ec[5:0]::il::iss; if exceptype IN {Exception_InstructionAbort, Exception_PCAlignment} then HIFAR() = except.vaddress[31:0]; HDFAR() = ARBITRARY : bits(32); elsif exceptype == Exception_DataAbort then HIFAR() = ARBITRARY : bits(32); HDFAR() = except.vaddress[31:0]; end; if except.ipavalid then HPFAR()[31:4] = except.ipaddress[39:12]; else HPFAR()[31:4] = ARBITRARY : bits(28); end; return; end;

// AArch32_TakeReset() // =================== // Reset into AArch32 state func AArch32_TakeReset(cold_reset : boolean) begin assert !HaveAArch64(); // Enter the highest implemented Exception level in AArch32 state if HaveEL(EL3) then AArch32_WriteMode(M32_Svc); SCR().NS = '0'; // Secure state elsif HaveEL(EL2) then AArch32_WriteMode(M32_Hyp); else AArch32_WriteMode(M32_Svc); end; // Reset System registers in the coproc=0b111x encoding space // and other system components AArch32_ResetControlRegisters(cold_reset); FPEXC().EN = '0'; // Reset all other PSTATE fields, including instruction set and endianness according to the // SCTLR values produced by the above call to ResetControlRegisters() PSTATE.[A,I,F] = '111'; // All asynchronous exceptions masked PSTATE.IT = '00000000'; // IT block state reset if HaveEL(EL2) && !HaveEL(EL3) then PSTATE.T = HSCTLR().TE; // Instruction set: TE=0:A32, TE=1:T32. PSTATE.J is RES0. PSTATE.E = HSCTLR().EE; // Endianness: EE=0: little-endian, EE=1: big-endian. else PSTATE.T = SCTLR().TE; // Instruction set: TE=0:A32, TE=1:T32. PSTATE.J is RES0. PSTATE.E = SCTLR().EE; // Endianness: EE=0: little-endian, EE=1: big-endian. end; PSTATE.IL = '0'; // Clear Illegal Execution state bit // All registers, bits and fields not reset by the above pseudocode or by the BranchTo() call // below are UNKNOWN bitstrings after reset. In particular, the return information registers // R14 or ELR_hyp and SPSR have UNKNOWN values, so that it // is impossible to return from a reset in an architecturally defined way. AArch32_ResetGeneralRegisters(); if IsFeatureImplemented(FEAT_SME) || IsFeatureImplemented(FEAT_SVE) then ResetSVERegisters(); else AArch32_ResetSIMDFPRegisters(); end; AArch32_ResetSpecialRegisters(); ResetExternalDebugRegisters(cold_reset); var rv : bits(32); // IMPLEMENTATION DEFINED reset vector if HaveEL(EL3) then if MVBAR()[0] == '1' then // Reset vector in MVBAR rv = MVBAR()[31:1]::'0'; else rv = ImpDefBits{32}("reset vector address"); end; else rv = RVBAR()[31:1]::'0'; end; // The reset vector must be correctly aligned assert rv[0] == '0' && (PSTATE.T == '1' || rv[1] == '0'); let branch_conditional : boolean = FALSE; EDPRSR().R = '0'; // Leaving Reset State. BranchTo{32}(rv, BranchType_RESET, branch_conditional); end;

// ExcVectorBase() // =============== func ExcVectorBase() => bits(32) begin if SCTLR().V == '1' then // Hivecs selected, base = 0xFFFF0000 return Ones{16}::Zeros{16}; else return VBAR()[31:5]::Zeros{5}; end; end;

// AArch32_FPTrappedException() // ============================ func AArch32_FPTrappedException(accumulated_exceptions : bits(8)) begin if AArch32_GeneralExceptionsToAArch64() then let is_ase : boolean = FALSE; let element : integer = 0; AArch64_FPTrappedException(is_ase, accumulated_exceptions); end; FPEXC().DEX = '1'; FPEXC().TFV = '1'; FPEXC()[7,4:0] = accumulated_exceptions[7,4:0]; // IDF,IXF,UFF,OFF,DZF,IOF FPEXC()[10:8] = '111'; // VECITR is RES1 AArch32_TakeUndefInstrException(); end;

// AArch32_CallHypervisor() // ======================== // Performs a HVC call func AArch32_CallHypervisor(immediate : bits(16)) begin assert HaveEL(EL2); if !ELUsingAArch32(EL2) then AArch64_CallHypervisor(immediate); else AArch32_TakeHVCException(immediate); end; end;

// AArch32_CallSupervisor() // ======================== // Calls the Supervisor func AArch32_CallSupervisor(immediate_in : bits(16)) begin var immediate : bits(16) = immediate_in; if CurrentCond() != '1110' then immediate = ARBITRARY : bits(16); end; if AArch32_GeneralExceptionsToAArch64() then AArch64_CallSupervisor(immediate); else AArch32_TakeSVCException(immediate); end; end;

// AArch32_TakeHVCException() // ========================== func AArch32_TakeHVCException(immediate : bits(16)) begin assert HaveEL(EL2) && ELUsingAArch32(EL2); AArch32_ITAdvance(); SSAdvance(); let preferred_exception_return : bits(32) = NextInstrAddr{}(); let vect_offset : integer{} = 0x08; var except : ExceptionRecord = ExceptionSyndrome(Exception_HypervisorCall); except.syndrome.iss[15:0] = immediate; if PSTATE.EL == EL2 then AArch32_EnterHypMode(except, preferred_exception_return, vect_offset); else AArch32_EnterHypMode(except, preferred_exception_return, 0x14); end; end;

// AArch32_TakeSMCException() // ========================== func AArch32_TakeSMCException() begin assert HaveEL(EL3) && ELUsingAArch32(EL3); AArch32_ITAdvance(); HSAdvance(); SSAdvance(); let preferred_exception_return : bits(32) = NextInstrAddr{}(); let vect_offset : integer = 0x08; let lr_offset : integer = 0; AArch32_EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); end;

// AArch32_TakeSVCException() // ========================== func AArch32_TakeSVCException(immediate : bits(16)) begin AArch32_ITAdvance(); SSAdvance(); let route_to_hyp : boolean = PSTATE.EL == EL0 && EL2Enabled() && HCR().TGE == '1'; let preferred_exception_return : bits(32) = NextInstrAddr{}(); let vect_offset : integer{} = 0x08; let lr_offset : integer{} = 0; if PSTATE.EL == EL2 || route_to_hyp then var except : ExceptionRecord = ExceptionSyndrome(Exception_SupervisorCall); except.syndrome.iss[15:0] = immediate; if PSTATE.EL == EL2 then AArch32_EnterHypMode(except, preferred_exception_return, vect_offset); else AArch32_EnterHypMode(except, preferred_exception_return, 0x14); end; else AArch32_EnterMode(M32_Svc, preferred_exception_return, lr_offset, vect_offset); end; end;

// AArch32_EnterHypMode() // ====================== // Take an exception to Hyp mode. noreturn func AArch32_EnterHypMode(except : ExceptionRecord, preferred_exception_return : bits(32), vect_offset : integer) begin SynchronizeContext(); assert HaveEL(EL2) && CurrentSecurityState() == SS_NonSecure && ELUsingAArch32(EL2); if Halted() then AArch32_EnterHypModeInDebugState(except); end; let spsr : bits(32) = GetPSRFromPSTATE{}(AArch32_NonDebugState); if ! except.exceptype IN {Exception_IRQ, Exception_FIQ} then AArch32_ReportHypEntry(except); end; AArch32_WriteMode(M32_Hyp); SPSR_curr() = spsr; ELR_hyp() = preferred_exception_return; PSTATE.T = HSCTLR().TE; // PSTATE.J is RES0 PSTATE.SS = '0'; if !HaveEL(EL3) then PSTATE.A = '1'; PSTATE.I = '1'; PSTATE.F = '1'; else if ELUsingAArch32(EL3) then if SCR().EA == '0' then PSTATE.A = '1'; end; if SCR().IRQ == '0' then PSTATE.I = '1'; end; if SCR().FIQ == '0' then PSTATE.F = '1'; end; else if SCR_EL3().EA == '0' then PSTATE.A = '1'; end; if EffectiveSCR_EL3_IRQ() == '0' then PSTATE.I = '1'; end; if EffectiveSCR_EL3_FIQ() == '0' then PSTATE.F = '1'; end; end; end; PSTATE.E = HSCTLR().EE; PSTATE.IL = '0'; PSTATE.IT = '00000000'; if IsFeatureImplemented(FEAT_SSBS) then PSTATE.SSBS = HSCTLR().DSSBS; end; let branch_conditional : boolean = FALSE; BranchTo{32}(HVBAR()[31:5]::vect_offset[4:0], BranchType_EXCEPTION, branch_conditional); CheckExceptionCatch(TRUE); // Check for debug event on exception entry EndOfInstruction(EndOfInstructionReason_Exception); end;

// AArch32_EnterMode() // =================== // Take an exception to a mode other than Monitor and Hyp mode. noreturn func AArch32_EnterMode(target_mode : bits(5), preferred_exception_return : bits(32), lr_offset : integer, vect_offset : integer) begin SynchronizeContext(); assert ELUsingAArch32(EL1) && PSTATE.EL != EL2; if Halted() then AArch32_EnterModeInDebugState(target_mode); end; let spsr : bits(32) = GetPSRFromPSTATE{}(AArch32_NonDebugState); if PSTATE.M == M32_Monitor then SCR().NS = '0'; end; AArch32_WriteMode(target_mode); SPSR_curr() = spsr; R(14) = preferred_exception_return + lr_offset; PSTATE.T = SCTLR().TE; // PSTATE.J is RES0 PSTATE.SS = '0'; if target_mode == M32_FIQ then PSTATE.[A,I,F] = '111'; elsif target_mode IN {M32_Abort, M32_IRQ} then PSTATE.[A,I] = '11'; else PSTATE.I = '1'; end; PSTATE.E = SCTLR().EE; PSTATE.IL = '0'; PSTATE.IT = '00000000'; if IsFeatureImplemented(FEAT_PAN) && SCTLR().SPAN == '0' then PSTATE.PAN = '1'; end; if IsFeatureImplemented(FEAT_SSBS) then PSTATE.SSBS = SCTLR().DSSBS; end; let branch_conditional : boolean = FALSE; BranchTo{32}(ExcVectorBase()[31:5]::vect_offset[4:0], BranchType_EXCEPTION, branch_conditional); CheckExceptionCatch(TRUE); // Check for debug event on exception entry EndOfInstruction(EndOfInstructionReason_Exception); end;

// AArch32_EnterMonitorMode() // ========================== // Take an exception to Monitor mode. func AArch32_EnterMonitorMode(preferred_exception_return : bits(32), lr_offset : integer, vect_offset : integer) begin SynchronizeContext(); assert HaveEL(EL3) && ELUsingAArch32(EL3); let from_secure : boolean = CurrentSecurityState() == SS_Secure; if Halted() then AArch32_EnterMonitorModeInDebugState(); end; let spsr : bits(32) = GetPSRFromPSTATE{}(AArch32_NonDebugState); if PSTATE.M == M32_Monitor then SCR().NS = '0'; end; AArch32_WriteMode(M32_Monitor); SPSR_curr() = spsr; R(14) = preferred_exception_return + lr_offset; PSTATE.T = SCTLR().TE; // PSTATE.J is RES0 PSTATE.SS = '0'; PSTATE.[A,I,F] = '111'; PSTATE.E = SCTLR().EE; PSTATE.IL = '0'; PSTATE.IT = '00000000'; if IsFeatureImplemented(FEAT_PAN) then if !from_secure then PSTATE.PAN = '0'; elsif SCTLR().SPAN == '0' then PSTATE.PAN = '1'; end; end; if IsFeatureImplemented(FEAT_SSBS) then PSTATE.SSBS = SCTLR().DSSBS; end; let branch_conditional : boolean = FALSE; BranchTo{32}(MVBAR()[31:5]::vect_offset[4:0], BranchType_EXCEPTION, branch_conditional); CheckExceptionCatch(TRUE); // Check for debug event on exception entry EndOfInstruction(EndOfInstructionReason_Exception); end;

// AArch32_CheckAdvSIMDOrFPEnabled() // ================================= // Check against CPACR, FPEXC, HCPTR, NSACR, and CPTR_EL3. func AArch32_CheckAdvSIMDOrFPEnabled(fpexc_check_in : boolean, advsimd : boolean) begin var fpexc_check : boolean = fpexc_check_in; if PSTATE.EL == EL0 && !ELUsingAArch32(EL1) then // When executing at EL0 using AArch32, if EL1 is using AArch64 then the Effective value of // FPEXC.EN is 1. This includes when EL2 is using AArch64 and enabled in the current // Security state, HCR_EL2.TGE is 1, and the Effective value of HCR_EL2.RW is 1. AArch64_CheckFPAdvSIMDEnabled(); else var cpacr_asedis = CPACR().ASEDIS; var cpacr_cp10 = CPACR().cp10; if HaveEL(EL3) && ELUsingAArch32(EL3) && CurrentSecurityState() == SS_NonSecure then // Check if access disabled in NSACR if NSACR().NSASEDIS == '1' then cpacr_asedis = '1'; end; if NSACR().cp10 == '0' then cpacr_cp10 = '00'; end; end; if PSTATE.EL != EL2 then // Check if Advanced SIMD disabled in CPACR if advsimd && cpacr_asedis == '1' then AArch32_Undefined(); end; // Check if access disabled in CPACR var disabled : boolean; case cpacr_cp10 of when '00' => disabled = TRUE; when '01' => disabled = PSTATE.EL == EL0; when '10' => disabled = ConstrainUnpredictableBool(Unpredictable_RESCPACR); when '11' => disabled = FALSE; end; if disabled then AArch32_Undefined(); end; end; // If required, check FPEXC enabled bit. if (fpexc_check && PSTATE.EL == EL0 && EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2().TGE == '1') then // When executing at EL0 using AArch32, if EL2 is using AArch64 and enabled in the // current Security state, HCR_EL2.TGE is 1, and the Effective value of HCR_EL2.RW is 0 // then it is IMPLEMENTATION DEFINED whether the Effective value of FPEXC.EN is 1 // or the value of FPEXC32_EL2.EN. fpexc_check = ImpDefBool("Use FPEXC32_EL2.EN value when {TGE,RW} == {1,0}"); end; if fpexc_check && FPEXC().EN == '0' then AArch32_Undefined(); end; AArch32_CheckFPAdvSIMDTrap(advsimd); // Also check against HCPTR and CPTR_EL3 end; end;

// AArch32_CheckFPAdvSIMDTrap() // ============================ // Check against CPTR_EL2 and CPTR_EL3. func AArch32_CheckFPAdvSIMDTrap(advsimd : boolean) begin if EL2Enabled() && !ELUsingAArch32(EL2) then AArch64_CheckFPAdvSIMDTrap(); else if (HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3().TFP == '1' && EL3SDDUndefPriority()) then Undefined(); end; let ss : SecurityState = CurrentSecurityState(); if HaveEL(EL2) && ss != SS_Secure then var hcptr_tase = HCPTR().TASE; var hcptr_cp10 = HCPTR().TCP10; if HaveEL(EL3) && ELUsingAArch32(EL3) then // Check if access disabled in NSACR if NSACR().NSASEDIS == '1' then hcptr_tase = '1'; end; if NSACR().cp10 == '0' then hcptr_cp10 = '1'; end; end; // Check if access disabled in HCPTR if (advsimd && hcptr_tase == '1') || hcptr_cp10 == '1' then var except : ExceptionRecord = ExceptionSyndrome(Exception_AdvSIMDFPAccessTrap); except.syndrome.iss[24:20] = ConditionSyndrome(); if advsimd then except.syndrome.iss[5] = '1'; else except.syndrome.iss[5] = '0'; except.syndrome.iss[3:0] = '1010'; // coproc field, always 0xA end; if PSTATE.EL == EL2 then AArch32_TakeUndefInstrException(except); else AArch32_TakeHypTrapException(except); end; end; end; if HaveEL(EL3) && !ELUsingAArch32(EL3) then // Check if access disabled in CPTR_EL3 if CPTR_EL3().TFP == '1' then if EL3SDDUndef() then Undefined(); else AArch64_AdvSIMDFPAccessTrap(EL3); end; end; end; end; end;

// AArch32_CheckForSMCUndefOrTrap() // ================================ // Check for UNDEFINED or trap on SMC instruction func AArch32_CheckForSMCUndefOrTrap() begin if !HaveEL(EL3) || PSTATE.EL == EL0 then Undefined(); end; if EL2Enabled() && !ELUsingAArch32(EL2) then AArch64_CheckForSMCUndefOrTrap(Zeros{16}); else let route_to_hyp : boolean = EL2Enabled() && PSTATE.EL == EL1 && HCR().TSC == '1'; if route_to_hyp then let except : ExceptionRecord = ExceptionSyndrome(Exception_MonitorCall); AArch32_TakeHypTrapException(except); end; end; end;

// AArch32_CheckForSVCTrap() // ========================= // Check for trap on SVC instruction func AArch32_CheckForSVCTrap(immediate : bits(16)) begin if IsFeatureImplemented(FEAT_FGT) then let route_to_el2 : boolean = (PSTATE.EL == EL0 && !ELUsingAArch32(EL1) && EL2Enabled() && HFGITR_EL2().SVC_EL0 == '1' && (!IsInHost() && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1'))); if route_to_el2 then var except : ExceptionRecord = ExceptionSyndrome(Exception_SupervisorCall); except.syndrome.iss[15:0] = immediate; except.trappedsyscallinst = TRUE; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); end; end; end;

// AArch32_CheckForWFxTrap() // ========================= // Check for trap on WFE or WFI instruction func AArch32_CheckForWFxTrap(target_el : bits(2), wfxtype : WFxType) begin assert HaveEL(target_el); // Check for routing to AArch64 if !ELUsingAArch32(target_el) then var trap : boolean; let is_wfe : boolean = wfxtype == WFxType_WFE; case target_el of when EL1 => trap = (if is_wfe then SCTLR_ELx().nTWE else SCTLR_ELx().nTWI) == '0'; when EL2 => trap = (if is_wfe then HCR_EL2().TWE else HCR_EL2().TWI) == '1'; when EL3 => trap = (if is_wfe then SCR_EL3().TWE else SCR_EL3().TWI) == '1'; end; if trap then if target_el == EL3 && EL3SDDUndef() then Undefined(); else AArch64_WFxTrap(wfxtype, target_el); end; end; return; end; let is_wfe : boolean = wfxtype == WFxType_WFE; var trap : boolean; case target_el of when EL1 => trap = (if is_wfe then SCTLR().nTWE else SCTLR().nTWI) == '0'; when EL2 => trap = (if is_wfe then HCR().TWE else HCR().TWI) == '1'; when EL3 => trap = (if is_wfe then SCR().TWE else SCR().TWI) == '1'; end; if trap then if target_el == EL1 && EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2().TGE == '1' then AArch64_WFxTrap(wfxtype, target_el); end; if target_el == EL3 && !EL3SDDUndef() then AArch32_TakeMonitorTrapException(); elsif target_el == EL2 then var except : ExceptionRecord = ExceptionSyndrome(Exception_WFxTrap); except.syndrome.iss[24:20] = ConditionSyndrome(); except.syndrome.iss[0] = if wfxtype == WFxType_WFI then '0' else '1'; AArch32_TakeHypTrapException(except); else AArch32_TakeUndefInstrException(); end; end; end;

// AArch32_CheckITEnabled() // ======================== // Check whether the T32 IT instruction is disabled. func AArch32_CheckITEnabled(mask : bits(4)) begin var it_disabled : bit; if PSTATE.EL == EL2 then it_disabled = HSCTLR().ITD; else it_disabled = (if ELUsingAArch32(EL1) then SCTLR().ITD else SCTLR_ELx().ITD); end; if it_disabled == '1' then if mask != '1000' then Undefined(); end; let accdesc : AccessDescriptor = CreateAccDescIFetch(); let aligned = TRUE; // Otherwise whether the IT block is allowed depends on hw1 of the next instruction. let next_instr = AArch32_MemSingle{16}(NextInstrAddr{32}(), accdesc, aligned); if next_instr IN {'11xxxxxxxxxxxxxx', '1011xxxxxxxxxxxx', '10100xxxxxxxxxxx', '01001xxxxxxxxxxx', '010001xxx1111xxx', '010001xx1xxxx111'} then // It is IMPLEMENTATION DEFINED whether the Undefined Instruction exception is // taken on the IT instruction or the next instruction. This is not reflected in // the pseudocode, which always takes the exception on the IT instruction. This // also does not take into account cases where the next instruction is UNPREDICTABLE. Undefined(); end; end; return; end;

// AArch32_CheckIllegalState() // =========================== // Check PSTATE.IL bit and generate Illegal Execution state exception if set. func AArch32_CheckIllegalState() begin if AArch32_GeneralExceptionsToAArch64() then AArch64_CheckIllegalState(); elsif PSTATE.IL == '1' then let route_to_hyp = PSTATE.EL == EL0 && EL2Enabled() && HCR().TGE == '1'; let preferred_exception_return : bits(32) = ThisInstrAddr{}(); let vect_offset : integer = 0x04; if PSTATE.EL == EL2 || route_to_hyp then let except : ExceptionRecord = ExceptionSyndrome(Exception_IllegalState); if PSTATE.EL == EL2 then AArch32_EnterHypMode(except, preferred_exception_return, vect_offset); else AArch32_EnterHypMode(except, preferred_exception_return, 0x14); end; else AArch32_TakeUndefInstrException(); end; end; end;

// AArch32_CheckSETENDEnabled() // ============================ // Check whether the AArch32 SETEND instruction is disabled. func AArch32_CheckSETENDEnabled() begin var setend_disabled : bit; if PSTATE.EL == EL2 then setend_disabled = HSCTLR().SED; else setend_disabled = (if ELUsingAArch32(EL1) then SCTLR().SED else SCTLR_ELx().SED); end; if setend_disabled == '1' then Undefined(); end; return; end;

// AArch32_SystemAccessTrap() // ========================== // Trapped AArch32 System register access. func AArch32_SystemAccessTrap(mode : bits(5), ec : integer) begin let (valid, target_el) = ELFromM32(mode); assert valid && HaveEL(target_el) && target_el != EL0 && UInt(target_el) >= UInt(PSTATE.EL); if target_el == EL2 then let except : ExceptionRecord = AArch32_SystemAccessTrapSyndrome(ThisInstr(), ec); AArch32_TakeHypTrapException(except); else AArch32_TakeUndefInstrException(); end; end;

// AArch32_SystemAccessTrapSyndrome() // ================================== // Returns the syndrome information for traps on AArch32 MCR, MCRR, MRC, MRRC, and VMRS, // VMSR instructions, other than traps that are due to HCPTR or CPACR. func AArch32_SystemAccessTrapSyndrome(instr : bits(32), ec : integer) => ExceptionRecord begin var except : ExceptionRecord; case ec of when 0x0 => except = ExceptionSyndrome(Exception_Uncategorized); when 0x3 => except = ExceptionSyndrome(Exception_CP15RTTrap); when 0x4 => except = ExceptionSyndrome(Exception_CP15RRTTrap); when 0x5 => except = ExceptionSyndrome(Exception_CP14RTTrap); when 0x6 => except = ExceptionSyndrome(Exception_CP14DTTrap); when 0x7 => except = ExceptionSyndrome(Exception_AdvSIMDFPAccessTrap); when 0x8 => except = ExceptionSyndrome(Exception_FPIDTrap); when 0xC => except = ExceptionSyndrome(Exception_CP14RRTTrap); otherwise => unreachable; end; var iss : bits(20) = Zeros{}; if except.exceptype == Exception_Uncategorized then return except; elsif except.exceptype IN {Exception_FPIDTrap, Exception_CP14RTTrap, Exception_CP15RTTrap} then // Trapped MRC/MCR, VMRS on FPSID iss[13:10] = instr[19:16]; // CRn, Reg in case of VMRS iss[8:5] = instr[15:12]; // Rt iss[9] = '0'; // RES0 if except.exceptype != Exception_FPIDTrap then // When trap is not for VMRS iss[19:17] = instr[7:5]; // opc2 iss[16:14] = instr[23:21]; // opc1 iss[4:1] = instr[3:0]; // CRm else //VMRS Access iss[19:17] = '000'; // opc2 - Hardcoded for VMRS iss[16:14] = '111'; // opc1 - Hardcoded for VMRS iss[4:1] = '0000'; // CRm - Hardcoded for VMRS end; elsif except.exceptype IN {Exception_CP14RRTTrap, Exception_AdvSIMDFPAccessTrap, Exception_CP15RRTTrap} then // Trapped MRRC/MCRR, VMRS/VMSR iss[19:16] = instr[7:4]; // opc1 iss[13:10] = instr[19:16]; // Rt2 iss[8:5] = instr[15:12]; // Rt iss[4:1] = instr[3:0]; // CRm elsif except.exceptype == Exception_CP14DTTrap then // Trapped LDC/STC iss[19:12] = instr[7:0]; // imm8 iss[4] = instr[23]; // U iss[2:1] = instr[24,21]; // P, W if instr[19:16] == '1111' then // Rn==15, LDC(Literal addressing)/STC iss[8:5] = ARBITRARY : bits(4); iss[3] = '1'; end; end; iss[0] = instr[20]; // Direction except.syndrome.iss[24:20] = ConditionSyndrome(); except.syndrome.iss[19:0] = iss; return except; end;

// AArch32_TakeHypTrapException() // ============================== // Exceptions routed to Hyp mode as a Hyp Trap exception. func AArch32_TakeHypTrapException(ec : integer) begin let except : ExceptionRecord = AArch32_SystemAccessTrapSyndrome(ThisInstr(), ec); AArch32_TakeHypTrapException(except); end; // AArch32_TakeHypTrapException() // ============================== // Exceptions routed to Hyp mode as a Hyp Trap exception. func AArch32_TakeHypTrapException(except : ExceptionRecord) begin assert HaveEL(EL2) && CurrentSecurityState() == SS_NonSecure && ELUsingAArch32(EL2); let preferred_exception_return : bits(32) = ThisInstrAddr{}(); let vect_offset : integer = 0x14; AArch32_EnterHypMode(except, preferred_exception_return, vect_offset); end;

// AArch32_TakeMonitorTrapException() // ================================== // Exceptions routed to Monitor mode as a Monitor Trap exception. func AArch32_TakeMonitorTrapException() begin assert HaveEL(EL3) && ELUsingAArch32(EL3); let preferred_exception_return : bits(32) = ThisInstrAddr{}(); let vect_offset : integer = 0x04; let lr_offset : integer = if CurrentInstrSet() == InstrSet_A32 then 4 else 2; AArch32_EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); end;

// AArch32_TakeUndefInstrException() // ================================= noreturn func AArch32_TakeUndefInstrException(except : ExceptionRecord) begin let route_to_hyp : boolean = PSTATE.EL == EL0 && EL2Enabled() && HCR().TGE == '1'; let preferred_exception_return : bits(32) = ThisInstrAddr{}(); let vect_offset : integer = 0x04; let lr_offset : integer = if CurrentInstrSet() == InstrSet_A32 then 4 else 2; if PSTATE.EL == EL2 then AArch32_EnterHypMode(except, preferred_exception_return, vect_offset); elsif route_to_hyp then AArch32_EnterHypMode(except, preferred_exception_return, 0x14); else AArch32_EnterMode(M32_Undef, preferred_exception_return, lr_offset, vect_offset); end; end; // AArch32_TakeUndefInstrException() // ================================= noreturn func AArch32_TakeUndefInstrException() begin let except : ExceptionRecord = ExceptionSyndrome(Exception_Uncategorized); AArch32_TakeUndefInstrException(except); end;

// AArch32_Undefined() // =================== noreturn func AArch32_Undefined() begin if AArch32_GeneralExceptionsToAArch64() then AArch64_Undefined(); end; AArch32_TakeUndefInstrException(); end;

// AArch32_DomainValid() // ===================== // Returns TRUE if the Domain is valid for a Short-descriptor translation scheme. func AArch32_DomainValid(statuscode : Fault, level : integer) => boolean begin assert statuscode != Fault_None; case statuscode of when Fault_Domain => return TRUE; when Fault_Translation,Fault_AccessFlag, Fault_SyncExternalOnWalk, Fault_SyncParityOnWalk => return level == 2; otherwise => return FALSE; end; end;

// AArch32_FaultSyndrome() // ======================= // Creates an exception syndrome value and updates the virtual address for Abort and Watchpoint // exceptions taken to AArch32 Hyp mode. func AArch32_FaultSyndrome(exceptype : Exception, fault : FaultRecord) => bits(25) begin assert fault.statuscode != Fault_None; var isstype : IssType; isstype.iss = Zeros{25}; let d_side : boolean = exceptype == Exception_DataAbort; if IsFeatureImplemented(FEAT_RAS) && IsAsyncAbort(fault) then let errstate : ErrorState = PEErrorState(fault); isstype.iss[11:10] = AArch32_EncodeAsyncErrorSyndrome(errstate); // AET end; if d_side then if AArch32_InstructionSyndromeValid(fault) then isstype.iss[24:14] = LSInstructionSyndrome(); end; if fault.accessdesc.acctype IN {AccessType_DC, AccessType_IC, AccessType_AT} then isstype.iss[8] = '1'; end; if fault.accessdesc.acctype IN {AccessType_DC, AccessType_IC, AccessType_AT} then isstype.iss[6] = '1'; elsif fault.statuscode == Fault_Exclusive then isstype.iss[6] = ARBITRARY : bit; else isstype.iss[6] = if fault.write then '1' else '0'; end; end; if IsExternalAbort(fault) then isstype.iss[9] = fault.extflag; end; isstype.iss[7] = if fault.s2fs1walk then '1' else '0'; isstype.iss[5:0] = EncodeLDFSC(fault.statuscode, fault.level); return isstype.iss; end;

// AArch32_InstructionSyndromeValid() // ================================== // Returns TRUE if ESR_ELx.ISV is '1' for the given Fault. func AArch32_InstructionSyndromeValid(fault : FaultRecord) => boolean begin if IsSecondStage(fault) && !fault.s2fs1walk then return (!IsExternalSyncAbort(fault) || (!IsFeatureImplemented(FEAT_RAS) && IsExternalAbortOnWalk(fault) && ImpDefBool("ISV on second stage translation table walk"))); end; return FALSE; end;

// EncodeSDFSC() // ============= // Function that gives the Short-descriptor FSR code for different types of Fault func EncodeSDFSC(statuscode : Fault, level : integer) => bits(5) begin var result : bits(5); case statuscode of when Fault_AccessFlag => assert level IN {1,2}; result = if level == 1 then '00011' else '00110'; when Fault_Alignment => result = '00001'; when Fault_Permission => assert level IN {1,2}; result = if level == 1 then '01101' else '01111'; when Fault_Domain => assert level IN {1,2}; result = if level == 1 then '01001' else '01011'; when Fault_Translation => assert level IN {1,2}; result = if level == 1 then '00101' else '00111'; when Fault_SyncExternal => result = '01000'; when Fault_SyncExternalOnWalk => assert level IN {1,2}; result = if level == 1 then '01100' else '01110'; when Fault_SyncParity => result = '11001'; when Fault_SyncParityOnWalk => assert level IN {1,2}; result = if level == 1 then '11100' else '11110'; when Fault_AsyncParity => result = '11000'; when Fault_AsyncExternal => result = '10110'; when Fault_Debug => result = '00010'; when Fault_TLBConflict => result = '10000'; when Fault_Lockdown => result = '10100'; // IMPLEMENTATION DEFINED when Fault_Exclusive => result = '10101'; // IMPLEMENTATION DEFINED when Fault_ICacheMaint => result = '00100'; otherwise => unreachable; end; return result; end;

// A32ExpandImm() // ============== func A32ExpandImm(imm12 : bits(12)) => bits(32) begin // PSTATE.C argument to following function call does not affect the imm32 result. let (imm32, -) = A32ExpandImm_C(imm12, PSTATE.C); return imm32; end;

// A32ExpandImm_C() // ================ func A32ExpandImm_C(imm12 : bits(12), carry_in : bit) => (bits(32), bit) begin let unrotated_value : bits(32) = ZeroExtend{}(imm12[7:0]); let (imm32, carry_out) : (bits(32), bit) = Shift_C{32}(unrotated_value, SRType_ROR, 2*UInt(imm12[11:8]), carry_in); return (imm32, carry_out); end;

// DecodeImmShift() // ================ func DecodeImmShift(srtype : bits(2), imm5 : bits(5)) => (SRType, integer{0..32}) begin var shift_t : SRType; var shift_n : integer{0..32}; case srtype of when '00' => shift_t = SRType_LSL; shift_n = UInt(imm5); when '01' => shift_t = SRType_LSR; shift_n = if imm5 == '00000' then 32 else UInt(imm5); when '10' => shift_t = SRType_ASR; shift_n = if imm5 == '00000' then 32 else UInt(imm5); when '11' => if imm5 == '00000' then shift_t = SRType_RRX; shift_n = 1; else shift_t = SRType_ROR; shift_n = UInt(imm5); end; end; return (shift_t, shift_n); end;

// DecodeRegShift() // ================ func DecodeRegShift(srtype : bits(2)) => SRType begin var shift_t : SRType; case srtype of when '00' => shift_t = SRType_LSL; when '01' => shift_t = SRType_LSR; when '10' => shift_t = SRType_ASR; when '11' => shift_t = SRType_ROR; end; return shift_t; end;

// RRX() // ===== func RRX{N}(x : bits(N), carry_in : bit) => bits(N) begin let (result, -) = RRX_C{N}(x, carry_in); return result; end;

// RRX_C() // ======= func RRX_C{N}(x : bits(N), carry_in : bit) => (bits(N), bit) begin let result : bits(N) = carry_in :: x[N-1:1]; let carry_out : bit = x[0]; return (result, carry_out); end;

// SRType // ====== type SRType of enumeration {SRType_LSL, SRType_LSR, SRType_ASR, SRType_ROR, SRType_RRX};

// Shift() // ======= func Shift{N}(value : bits(N), srtype : SRType, amount : integer, carry_in : bit) => bits(N) begin let (result, -) = Shift_C{N}(value, srtype, amount, carry_in); return result; end;

// Shift_C() // ========= func Shift_C{N}(value : bits(N), srtype : SRType, amount : integer, carry_in : bit) => (bits(N), bit) begin assert !(srtype == SRType_RRX && amount != 1); var result : bits(N); var carry_out : bit; if amount == 0 then (result, carry_out) = (value, carry_in); else case srtype of when SRType_LSL => (result, carry_out) = LSL_C(value, amount); when SRType_LSR => (result, carry_out) = LSR_C(value, amount); when SRType_ASR => (result, carry_out) = ASR_C(value, amount); when SRType_ROR => (result, carry_out) = ROR_C(value, amount); when SRType_RRX => (result, carry_out) = RRX_C{N}(value, carry_in); end; end; return (result, carry_out); end;

// T32ExpandImm() // ============== func T32ExpandImm(imm12 : bits(12)) => bits(32) begin // PSTATE.C argument to following function call does not affect the imm32 result. let (imm32, -) = T32ExpandImm_C(imm12, PSTATE.C); return imm32; end;

// T32ExpandImm_C() // ================ func T32ExpandImm_C(imm12 : bits(12), carry_in : bit) => (bits(32), bit) begin var imm32 : bits(32); var carry_out : bit; if imm12[11:10] == '00' then case imm12[9:8] of when '00' => imm32 = ZeroExtend{32}(imm12[7:0]); when '01' => imm32 = '00000000' :: imm12[7:0] :: '00000000' :: imm12[7:0]; when '10' => imm32 = imm12[7:0] :: '00000000' :: imm12[7:0] :: '00000000'; when '11' => imm32 = imm12[7:0] :: imm12[7:0] :: imm12[7:0] :: imm12[7:0]; end; carry_out = carry_in; else let unrotated_value : bits(32) = ZeroExtend{}('1'::imm12[6:0]); (imm32, carry_out) = ROR_C(unrotated_value, UInt(imm12[11:7])); end; return (imm32, carry_out); end;

// VBitOps // ======= type VBitOps of enumeration {VBitOps_VBIF, VBitOps_VBIT, VBitOps_VBSL};

// VCGEType // ======== type VCGEType of enumeration {VCGEType_signed, VCGEType_unsigned, VCGEType_fp};

// VCGTtype // ======== type VCGTtype of enumeration {VCGTtype_signed, VCGTtype_unsigned, VCGTtype_fp};

// VFPNegMul // ========= type VFPNegMul of enumeration {VFPNegMul_VNMLA, VFPNegMul_VNMLS, VFPNegMul_VNMUL};

// AArch32_CheckCP15InstrCoarseTraps() // =================================== // Check for coarse-grained traps to System registers in the // coproc=0b1111 encoding space by HSTR and HCR. func AArch32_CheckCP15InstrCoarseTraps(CRn : integer, nreg : integer, CRm : integer) begin if PSTATE.EL == EL0 && (!ELUsingAArch32(EL1) || (EL2Enabled() && !ELUsingAArch32(EL2))) then AArch64_CheckCP15InstrCoarseTraps(CRn, nreg, CRm); end; let trapped_encoding = ((CRn == 9 && CRm IN {0,1,2, 5,6,7,8 }) || (CRn == 10 && CRm IN {0,1, 4, 8 }) || (CRn == 11 && CRm IN {0,1,2,3,4,5,6,7,8,15})); // Check for coarse-grained Hyp traps if PSTATE.EL IN {EL0, EL1} && EL2Enabled() then let major : integer = if nreg == 1 then CRn else CRm; // Check for MCR, MRC, MCRR, and MRRC disabled by HSTR().CRn/HSTR().CRm // and MRC and MCR disabled by HCR.TIDCP. if ((! major IN {4,14} && HSTR()[major] == '1') || (HCR().TIDCP == '1' && nreg == 1 && trapped_encoding)) then if (PSTATE.EL == EL0 && ImpDefBool("UNDEF unallocated CP15 access at EL0")) then Undefined(); end; if ELUsingAArch32(EL2) then AArch32_SystemAccessTrap(M32_Hyp, 0x3); else AArch64_AArch32SystemAccessTrap(EL2, 0x3); end; end; end; end;

// AArch32_ExclusiveMonitorsPass() // =============================== // Return TRUE if the Exclusives monitors for the current PE include all of the addresses // associated with the virtual address region of size bytes starting at address. // The immediately following memory write must be to the same addresses. // It is IMPLEMENTATION DEFINED whether the detection of memory aborts happens // before or after the check on the local Exclusives monitor. As a result a failure // of the local monitor can occur on some implementations even if the memory // access would give a memory abort. func AArch32_ExclusiveMonitorsPass(address : bits(32), size : integer{1, 2, 4, 8, 16, 32}) => boolean begin let acqrel : boolean = FALSE; let privileged : boolean = PSTATE.EL != EL0; let tagchecked : boolean = FALSE; let accdesc : AccessDescriptor = CreateAccDescExLDST(MemOp_STORE, acqrel, tagchecked, privileged); let aligned : boolean = IsAlignedSize(address, size); if !aligned then let fault : FaultRecord = AlignmentFault(accdesc, ZeroExtend{64}(address)); AArch32_Abort(fault); end; if !AArch32_IsExclusiveVA(address, ProcessorID(), size) then return FALSE; end; let memaddrdesc : AddressDescriptor = AArch32_TranslateAddress(address, accdesc, aligned, size); // Check for aborts or debug exceptions if IsFault(memaddrdesc) then AArch32_Abort(memaddrdesc.fault); end; var passed : boolean = IsExclusiveLocal(memaddrdesc.paddress, ProcessorID(), size); ClearExclusiveLocal(ProcessorID()); if passed && memaddrdesc.memattrs.shareability != Shareability_NSH then passed = IsExclusiveGlobal(memaddrdesc.paddress, ProcessorID(), size); end; return passed; end;

// AArch32_IsExclusiveVA() // ======================= // An optional IMPLEMENTATION DEFINED test for an exclusive access to a virtual // address region of size bytes starting at address. // // It is permitted (but not required) for this function to return FALSE and // cause a store exclusive to fail if the virtual address region is not // totally included within the region recorded by MarkExclusiveVA(). // // It is always safe to return TRUE which will check the physical address only. impdef func AArch32_IsExclusiveVA(address : bits(32), processorid : integer, size : integer) => boolean begin return TRUE; end;

// AArch32_MarkExclusiveVA() // ========================= // Optionally record an exclusive access to the virtual address region of size bytes // starting at address for processorid. func AArch32_MarkExclusiveVA(address : bits(32), processorid : integer, size : integer) begin return; end;

// AArch32_SetExclusiveMonitors() // ============================== // Sets the Exclusives monitors for the current PE to record the addresses associated // with the virtual address region of size bytes starting at address. func AArch32_SetExclusiveMonitors(address : bits(32), size : integer{1, 2, 4, 8, 16, 32}) begin let acqrel : boolean = FALSE; let privileged : boolean = PSTATE.EL != EL0; let tagchecked : boolean = FALSE; let accdesc : AccessDescriptor = CreateAccDescExLDST(MemOp_LOAD, acqrel, tagchecked, privileged); let aligned : boolean = IsAlignedSize(address, size); if !aligned then let fault : FaultRecord = AlignmentFault(accdesc, ZeroExtend{64}(address)); AArch32_Abort(fault); end; let memaddrdesc : AddressDescriptor = AArch32_TranslateAddress(address, accdesc, aligned, size); // Check for aborts or debug exceptions if IsFault(memaddrdesc) then return; end; if memaddrdesc.memattrs.shareability != Shareability_NSH then MarkExclusiveGlobal(memaddrdesc.paddress, ProcessorID(), size); end; MarkExclusiveLocal(memaddrdesc.paddress, ProcessorID(), size); AArch32_MarkExclusiveVA(address, ProcessorID(), size); end;

// CheckAdvSIMDEnabled() // ===================== func CheckAdvSIMDEnabled() begin let fpexc_check : boolean = TRUE; let advsimd : boolean = TRUE; AArch32_CheckAdvSIMDOrFPEnabled(fpexc_check, advsimd); // Return from CheckAdvSIMDOrFPEnabled() occurs only if Advanced SIMD access is permitted // Make temporary copy of D registers // _Dclone[] is used as input data for instruction pseudocode for i = 0 to 31 do _Dclone[[i]] = D(i); end; return; end;

// CheckAdvSIMDOrVFPEnabled() // ========================== func CheckAdvSIMDOrVFPEnabled(include_fpexc_check : boolean, advsimd : boolean) begin AArch32_CheckAdvSIMDOrFPEnabled(include_fpexc_check, advsimd); // Return from CheckAdvSIMDOrFPEnabled() occurs only if VFP access is permitted return; end;

// CheckCryptoEnabled32() // ====================== func CheckCryptoEnabled32() begin CheckAdvSIMDEnabled(); // Return from CheckAdvSIMDEnabled() occurs only if access is permitted return; end;

// CheckVFPEnabled() // ================= func CheckVFPEnabled(include_fpexc_check : boolean) begin let advsimd : boolean = FALSE; AArch32_CheckAdvSIMDOrFPEnabled(include_fpexc_check, advsimd); // Return from CheckAdvSIMDOrFPEnabled() occurs only if VFP access is permitted return; end;

// FPHalvedSub() // ============= func FPHalvedSub{N}(op1 : bits(N), op2 : bits(N), fpcr : FPCR_Type) => bits(N) begin assert N IN {16,32,64}; let rounding : FPRounding = FPRoundingMode(fpcr); let (type1,sign1,value1) : (FPType, bit, real) = FPUnpack{N}(op1, fpcr); let (type2,sign2,value2) : (FPType, bit, real) = FPUnpack{N}(op2, fpcr); var (done,result) : (boolean, bits(N)) = FPProcessNaNs{N}(type1, type2, op1, op2, fpcr); if !done then let inf1 : boolean = (type1 == FPType_Infinity); let inf2 : boolean = (type2 == FPType_Infinity); let zero1 : boolean = (type1 == FPType_Zero); let zero2 : boolean = (type2 == FPType_Zero); if inf1 && inf2 && sign1 == sign2 then result = FPDefaultNaN{N}(fpcr); FPProcessException(FPExc_InvalidOp, fpcr); elsif (inf1 && sign1 == '0') || (inf2 && sign2 == '1') then result = FPInfinity{N}('0'); elsif (inf1 && sign1 == '1') || (inf2 && sign2 == '0') then result = FPInfinity{N}('1'); elsif zero1 && zero2 && sign1 != sign2 then result = FPZero{N}(sign1); else let result_value : real = (value1 - value2) / 2.0; if result_value == 0.0 then // Sign of exact zero result depends on rounding mode let result_sign : bit = if rounding == FPRounding_NEGINF then '1' else '0'; result = FPZero{N}(result_sign); else result = FPRound{N}(result_value, fpcr); end; end; end; return result; end;

// FPRSqrtStep() // ============= func FPRSqrtStep{N}(op1 : bits(N), op2 : bits(N)) => bits(N) begin assert N IN {16,32}; let fpcr : FPCR_Type = StandardFPCR(); let (type1,sign1,value1) : (FPType, bit, real) = FPUnpack{N}(op1, fpcr); let (type2,sign2,value2) : (FPType, bit, real) = FPUnpack{N}(op2, fpcr); var (done,result) : (boolean, bits(N)) = FPProcessNaNs{N}(type1, type2, op1, op2, fpcr); if !done then let inf1 : boolean = (type1 == FPType_Infinity); let inf2 : boolean = (type2 == FPType_Infinity); let zero1 : boolean = (type1 == FPType_Zero); let zero2 : boolean = (type2 == FPType_Zero); var product : bits(N); if (inf1 && zero2) || (zero1 && inf2) then product = FPZero{N}('0'); else product = FPMul{N}(op1, op2, fpcr); end; let three : bits(N) = FPThree{}('0'); result = FPHalvedSub{N}(three, product, fpcr); end; return result; end;

// FPRecipStep() // ============= func FPRecipStep{N}(op1 : bits(N), op2 : bits(N)) => bits(N) begin assert N IN {16,32}; let fpcr : FPCR_Type = StandardFPCR(); let (type1,sign1,value1) : (FPType, bit, real) = FPUnpack{N}(op1, fpcr); let (type2,sign2,value2) : (FPType, bit, real) = FPUnpack{N}(op2, fpcr); var (done,result) : (boolean, bits(N)) = FPProcessNaNs{N}(type1, type2, op1, op2, fpcr); if !done then let inf1 : boolean = (type1 == FPType_Infinity); let inf2 : boolean = (type2 == FPType_Infinity); let zero1 : boolean = (type1 == FPType_Zero); let zero2 : boolean = (type2 == FPType_Zero); var product : bits(N); if (inf1 && zero2) || (zero1 && inf2) then product = FPZero{N}('0'); else product = FPMul{N}(op1, op2, fpcr); end; let two : bits(N) = FPTwo{}('0'); result = FPSub{N}(two, product, fpcr); end; return result; end;

// StandardFPCR() // ============== func StandardFPCR() => FPCR_Type begin let value : bits(32) = ('00000' :: FPSCR().AHP :: '110000' :: FPSCR().FZ16 :: '0000000000000000000'); return ZeroExtend{64}(value); end;

// AArch32_MemSingle // ================= accessor AArch32_MemSingle{size : integer{8, 16, 32, 64}}(address : bits(32), accdesc : AccessDescriptor, aligned : boolean) <=> value : bits(size) begin // Perform an atomic, little-endian read of 'size' bits. getter let bytes : integer{} = size DIV 8; var value : bits(size); var memaddrdesc : AddressDescriptor; var memstatus : PhysMemRetStatus; (value, memaddrdesc, memstatus) = AArch32_MemSingleRead{size}(address, accdesc, aligned); // Check for a fault from translation or the output of translation. if IsFault(memaddrdesc) then AArch32_Abort(memaddrdesc.fault); end; // Check for external aborts. if IsFault(memstatus) then HandleExternalAbort(memstatus, accdesc.write, memaddrdesc, bytes, accdesc); end; return value; end; // Perform an atomic, little-endian write of 'size' bits. setter let bytes : integer{} = size DIV 8; var memaddrdesc : AddressDescriptor; var memstatus : PhysMemRetStatus; (memaddrdesc, memstatus) = AArch32_MemSingleWrite{size}(address, accdesc, aligned, value); // Check for a fault from translation or the output of translation. if IsFault(memaddrdesc) then AArch32_Abort(memaddrdesc.fault); end; // Check for external aborts. if IsFault(memstatus) then HandleExternalWriteAbort(memstatus, memaddrdesc, bytes, accdesc); end; return; end; end;

// AArch32_MemSingleRead() // ======================= // Perform an atomic, little-endian read of 'size' bits. func AArch32_MemSingleRead{size : integer{8, 16, 32, 64}}(address : bits(32), accdesc_in : AccessDescriptor, aligned : boolean ) => (bits(size), AddressDescriptor, PhysMemRetStatus) begin let bytes : integer{} = size DIV 8; var value : bits(size) = ARBITRARY : bits(size); var memstatus : PhysMemRetStatus = ARBITRARY : PhysMemRetStatus; var accdesc : AccessDescriptor = accdesc_in; assert IsAlignedSize(address, bytes); var memaddrdesc : AddressDescriptor; memaddrdesc = AArch32_TranslateAddress(address, accdesc, aligned, bytes); // Check for aborts or debug exceptions if IsFault(memaddrdesc) then return (value, memaddrdesc, memstatus); end; // Memory array access (memstatus, value) = PhysMemRead{size}(memaddrdesc, accdesc); if IsFault(memstatus) then return (value, memaddrdesc, memstatus); end; if accdesc.acctype == AccessType_IFETCH then if ELUsingAArch32(S1TranslationRegime()) then memaddrdesc.fault = AArch32_CheckDebug(address, accdesc, bytes); else memaddrdesc.fault = AArch64_CheckDebug(ZeroExtend{64}(address), accdesc, bytes); end; end; return (value, memaddrdesc, memstatus); end;

// AArch32_MemSingleWrite() // ======================== // Perform an atomic, little-endian write of 'size' bits. func AArch32_MemSingleWrite{size : integer{8, 16, 32, 64}}(address : bits(32), accdesc_in : AccessDescriptor, aligned : boolean, value : bits(size) ) => (AddressDescriptor, PhysMemRetStatus) begin let bytes : integer{} = size DIV 8; var accdesc : AccessDescriptor = accdesc_in; assert IsAlignedSize(address, bytes); var memaddrdesc : AddressDescriptor; var memstatus : PhysMemRetStatus = ARBITRARY : PhysMemRetStatus; memaddrdesc = AArch32_TranslateAddress(address, accdesc, aligned, bytes); // Check for aborts or debug exceptions if IsFault(memaddrdesc) then return (memaddrdesc, memstatus); end; // Effect on exclusives if memaddrdesc.memattrs.shareability != Shareability_NSH then ClearExclusiveByAddress(memaddrdesc.paddress, ProcessorID(), bytes); end; memstatus = PhysMemWrite{size}(memaddrdesc, accdesc, value); if IsFault(memstatus) then return (memaddrdesc, memstatus); end; return (memaddrdesc, memstatus); end;

// AArch32_UnalignedAccessFaults() // =============================== // Determine whether the unaligned access generates an Alignment fault func AArch32_UnalignedAccessFaults(accdesc : AccessDescriptor) => boolean begin return (AlignmentEnforced() || accdesc.a32lsmd || accdesc.exclusive || accdesc.acqsc || accdesc.relsc); end;

// MemA - accessor // =============== accessor MemA{size : integer{8, 16, 32, 64}}(address : bits(32)) <=> value : bits(size) begin getter let acqrel : boolean = FALSE; let privileged : boolean = PSTATE.EL != EL0; let tagchecked : boolean = FALSE; let accdesc : AccessDescriptor = CreateAccDescExLDST(MemOp_LOAD, acqrel, tagchecked, privileged); return Mem_with_type{size}(address, accdesc); end; setter let acqrel : boolean = FALSE; let privileged : boolean = PSTATE.EL != EL0; let tagchecked : boolean = FALSE; let accdesc : AccessDescriptor = CreateAccDescExLDST(MemOp_STORE, acqrel, tagchecked, privileged); Mem_with_type{size}(address, accdesc) = value; end; end;

// MemO // ==== accessor MemO{size : integer{8, 16, 32, 64} }(address : bits(32)) <=> value : bits(size) begin getter let acquire : boolean = TRUE; let tagchecked : boolean = FALSE; let accdesc : AccessDescriptor = CreateAccDescAcqRel(MemOp_LOAD, tagchecked, acquire); return Mem_with_type{size}(address, accdesc); end; setter let acquire : boolean = FALSE; let tagchecked : boolean = FALSE; let accdesc : AccessDescriptor = CreateAccDescAcqRel(MemOp_STORE, tagchecked, acquire); Mem_with_type{size}(address, accdesc) = value; end; end;

// MemS - accessor // =============== accessor MemS{size : integer{8, 16, 32, 64}}(address : bits(32)) <=> value : bits(size) begin // Memory accessor for streaming load multiple instructions getter let accdesc : AccessDescriptor = CreateAccDescA32LSMD(MemOp_LOAD); return Mem_with_type{size}(address, accdesc); end; // Memory accessor for streaming store multiple instructions setter let accdesc : AccessDescriptor = CreateAccDescA32LSMD(MemOp_STORE); Mem_with_type{size}(address, accdesc) = value; end; end;

// MemU - accessor // =============== accessor MemU{size : integer{8, 16, 32, 64} }(address : bits(32) ) <=> value: bits(size) begin getter let nontemporal : boolean = FALSE; let privileged : boolean = PSTATE.EL != EL0; let tagchecked : boolean = FALSE; let accdesc : AccessDescriptor = CreateAccDescGPR(MemOp_LOAD, nontemporal, privileged, tagchecked); return Mem_with_type{size}(address, accdesc); end; setter let nontemporal : boolean = FALSE; let privileged : boolean = PSTATE.EL != EL0; let tagchecked : boolean = FALSE; let accdesc : AccessDescriptor = CreateAccDescGPR(MemOp_STORE, nontemporal, privileged, tagchecked); Mem_with_type{size}(address, accdesc) = value; end; end;

// MemU_unpriv // =========== accessor MemU_unpriv{size : integer{8, 16, 32, 64}}(address : bits(32)) <=> value : bits(size) begin getter let nontemporal : boolean = FALSE; let privileged : boolean = FALSE; let tagchecked : boolean = FALSE; let accdesc : AccessDescriptor = CreateAccDescGPR(MemOp_LOAD, nontemporal, privileged, tagchecked); return Mem_with_type{size}(address, accdesc); end; setter let nontemporal : boolean = FALSE; let privileged : boolean = FALSE; let tagchecked : boolean = FALSE; let accdesc : AccessDescriptor = CreateAccDescGPR(MemOp_STORE, nontemporal, privileged, tagchecked); Mem_with_type{size}(address, accdesc) = value; end; end;

// Mem_with_type // ============= accessor Mem_with_type{size : integer{8, 16, 32, 64}}(address : bits(32), accdesc_in : AccessDescriptor ) <=> value_in : bits(size) begin // Perform a read of 'size' bits. The access byte order is reversed for a big-endian access. // Instruction fetches would call AArch32_MemSingle directly. getter let bytes : integer{} = size DIV 8; var accdesc : AccessDescriptor = accdesc_in; var value : bits(size); // Check alignment on size of element accessed, not overall access size var aligned : boolean; if accdesc.ispair then let half : integer{} = (size DIV 2) as integer{32}; aligned = IsAlignedSize(address, half DIV 8); else aligned = IsAlignedSize(address, bytes); end; if !aligned && AArch32_UnalignedAccessFaults(accdesc) then let fault : FaultRecord = AlignmentFault(accdesc, ZeroExtend{64}(address)); AArch32_Abort(fault); end; if aligned then value = AArch32_MemSingle{size}(address, accdesc, aligned); else assert bytes > 1; value[7:0] = AArch32_MemSingle{8}(address, accdesc, aligned); // For subsequent bytes, if they cross to a new translation page which assigns // Device memory type, it is CONSTRAINED UNPREDICTABLE whether an unaligned access // will generate an Alignment Fault. let c : Constraint = ConstrainUnpredictable(Unpredictable_DEVPAGE2); assert c IN {Constraint_FAULT, Constraint_NONE}; if c == Constraint_NONE then aligned = TRUE; end; for i = 1 to bytes-1 do value[i*:8] = AArch32_MemSingle{8}(address+i, accdesc, aligned); end; end; if BigEndian(accdesc.acctype) then value = BigEndianReverse{size}(value); end; return value; end; // Perform a write of 'size' bits. The byte order is reversed for a big-endian access. setter let bytes : integer{} = size DIV 8; var value : bits(size) = value_in; var accdesc : AccessDescriptor = accdesc_in; // Check alignment on size of element accessed, not overall access size var aligned : boolean; if accdesc.ispair then let half : integer{} = (size DIV 2) as integer{32}; aligned = IsAlignedSize(address, half DIV 8); else aligned = IsAlignedSize(address, bytes); end; if !aligned && AArch32_UnalignedAccessFaults(accdesc) then let fault : FaultRecord = AlignmentFault(accdesc, ZeroExtend{64}(address)); AArch32_Abort(fault); end; if BigEndian(accdesc.acctype) then value = BigEndianReverse{size}(value); end; if aligned then AArch32_MemSingle{size}(address, accdesc, aligned) = value; else assert bytes > 1; AArch32_MemSingle{8}(address, accdesc, aligned) = value[7:0]; // For subsequent bytes, if they cross to a new translation page which assigns // Device memory type, it is CONSTRAINED UNPREDICTABLE whether an unaligned access // will generate an Alignment Fault. let c : Constraint = ConstrainUnpredictable(Unpredictable_DEVPAGE2); assert c IN {Constraint_FAULT, Constraint_NONE}; if c == Constraint_NONE then aligned = TRUE; end; for i = 1 to bytes-1 do AArch32_MemSingle{8}(address+i, accdesc, aligned) = value[i*:8]; end; end; return; end; end;

// AArch32_ESBOperation() // ====================== // Perform the AArch32 ESB operation for ESB executed in AArch32 state. func AArch32_ESBOperation() begin var masked : boolean; var target_el : bits(2); (masked, target_el) = PhysicalSErrorTarget(); // Check if routed to AArch64 state if !masked && !ELUsingAArch32(target_el) then AArch64_ESBOperation(); return; end; // Check for a masked Physical SError pending that can be synchronized // by an Error synchronization event. if masked && IsSynchronizablePhysicalSErrorPending() then var syndrome : bits(32) = Zeros{}; syndrome[31] = '1'; // A syndrome[15:0] = AArch32_PhysicalSErrorSyndrome(); DISR() = syndrome; ClearPendingPhysicalSError(); end; return; end;

// AArch32_EncodeAsyncErrorSyndrome() // ================================== // Return the encoding for specified ErrorState for an SError exception taken // to AArch32 state. func AArch32_EncodeAsyncErrorSyndrome(errorstate : ErrorState) => bits(2) begin case errorstate of when ErrorState_UC => return '00'; when ErrorState_UEU => return '01'; when ErrorState_UEO => return '10'; when ErrorState_UER => return '11'; otherwise => unreachable; end; end;

// AArch32_PhysicalSErrorSyndrome() // ================================ // Generate SError syndrome. func AArch32_PhysicalSErrorSyndrome() => bits(16) begin var syndrome : bits(32) = Zeros{}; let fault : FaultRecord = GetPendingPhysicalSError(); if PSTATE.EL == EL2 then let errstate : ErrorState = PEErrorState(fault); syndrome[11:10] = AArch32_EncodeAsyncErrorSyndrome(errstate); // AET syndrome[9] = fault.extflag; // EA syndrome[5:0] = '010001'; // DFSC else let long_format : boolean = TTBCR().EAE == '1'; syndrome = AArch32_CommonFaultStatus(fault, long_format); end; return syndrome[15:0]; end;

// AArch32_vESBOperation() // ======================= // Perform the ESB operation for virtual SError interrupts executed in AArch32 state. // If FEAT_E3DSE is implemented and there is no unmasked virtual SError exception // pending, then AArch64_dESBOperation() is called to perform the AArch64 ESB operation // for a pending delegated SError exception. func AArch32_vESBOperation() begin assert PSTATE.EL IN {EL0, EL1} && EL2Enabled(); // Check for EL2 using AArch64 state if !ELUsingAArch32(EL2) then AArch64_vESBOperation(); return; end; // If physical SError interrupts are routed to Hyp mode, and TGE is not set, then a virtual // SError interrupt might be pending. let vsei_pending : boolean = IsVirtualSErrorPending() && HCR().TGE == '0' && HCR().AMO == '1'; let vsei_masked : boolean = (PSTATE.A == '1' || Halted() || ExternalDebugInterruptsDisabled(EL1)); // Check for a masked virtual SError pending if vsei_pending && vsei_masked then var syndrome : bits(32) = Zeros{}; syndrome[31] = '1'; // A syndrome[15:14] = VDFSR()[15:14]; // AET syndrome[12] = VDFSR()[12]; // ExT syndrome[9] = TTBCR().EAE; // LPAE if TTBCR().EAE == '1' then // Long-descriptor format syndrome[5:0] = '010001'; // STATUS else // Short-descriptor format syndrome[10,3:0] = '10110'; // FS end; VDISR() = syndrome; ClearPendingVirtualSError(); elsif IsFeatureImplemented(FEAT_E3DSE) && !ELUsingAArch32(EL3) then AArch64_dESBOperation(); end; return; end;

// AArch32_ResetGeneralRegisters() // =============================== func AArch32_ResetGeneralRegisters() begin for i = 0 to 7 do R(i) = ARBITRARY : bits(32); end; for i = 8 to 12 do Rmode(i, M32_User) = ARBITRARY : bits(32); Rmode(i, M32_FIQ) = ARBITRARY : bits(32); end; if HaveEL(EL2) then Rmode(13, M32_Hyp) = ARBITRARY : bits(32); end; // No R14_hyp for i = 13 to 14 do Rmode(i, M32_User) = ARBITRARY : bits(32); Rmode(i, M32_FIQ) = ARBITRARY : bits(32); Rmode(i, M32_IRQ) = ARBITRARY : bits(32); Rmode(i, M32_Svc) = ARBITRARY : bits(32); Rmode(i, M32_Abort) = ARBITRARY : bits(32); Rmode(i, M32_Undef) = ARBITRARY : bits(32); if HaveEL(EL3) then Rmode(i, M32_Monitor) = ARBITRARY : bits(32); end; end; return; end;

// AArch32_ResetSIMDFPRegisters() // ============================== func AArch32_ResetSIMDFPRegisters() begin for i = 0 to 15 do Q(i) = ARBITRARY : bits(128); end; return; end;

// AArch32_ResetSpecialRegisters() // =============================== func AArch32_ResetSpecialRegisters() begin // AArch32 special registers SPSR_fiq()[31:0] = ARBITRARY : bits(32); SPSR_irq()[31:0] = ARBITRARY : bits(32); SPSR_svc()[31:0] = ARBITRARY : bits(32); SPSR_abt()[31:0] = ARBITRARY : bits(32); SPSR_und()[31:0] = ARBITRARY : bits(32); if HaveEL(EL2) then SPSR_hyp() = ARBITRARY : bits(32); ELR_hyp() = ARBITRARY : bits(32); end; if HaveEL(EL3) then SPSR_mon() = ARBITRARY : bits(32); end; // External debug special registers DLR() = ARBITRARY : bits(32); DSPSR() = ARBITRARY : bits(32); return; end;

// ALUExceptionReturn() // ==================== func ALUExceptionReturn(address : bits(32)) begin if PSTATE.EL == EL2 then Undefined(); elsif PSTATE.M IN {M32_User,M32_System} then let c : Constraint = ConstrainUnpredictable(Unpredictable_ALUEXCEPTIONRETURN); assert c IN {Constraint_UNDEF, Constraint_NOP}; case c of when Constraint_UNDEF => Undefined(); when Constraint_NOP => ExecuteAsNOP(); end; else AArch32_ExceptionReturn(address, SPSR_curr()); end; end;

// ALUWritePC() // ============ func ALUWritePC(address : bits(32)) begin if CurrentInstrSet() == InstrSet_A32 then BXWritePC(address, BranchType_INDIR); else BranchWritePC(address, BranchType_INDIR); end; end;

// BXWritePC() // =========== func BXWritePC(address_in : bits(32), branch_type : BranchType) begin var address : bits(32) = address_in; if address[0] == '1' then SelectInstrSet(InstrSet_T32); address[0] = '0'; else SelectInstrSet(InstrSet_A32); // For branches to an unaligned PC counter in A32 state, the PE takes the branch // and does one of: // * Forces the address to be aligned // * Leaves the PC unaligned, meaning the target generates a PC Alignment fault. if address[1] == '1' && ConstrainUnpredictableBool(Unpredictable_A32FORCEALIGNPC) then address[1] = '0'; end; end; let branch_conditional : boolean = CurrentCond() != '111x'; BranchTo{32}(address, branch_type, branch_conditional); end;

// BranchWritePC() // =============== func BranchWritePC(address_in : bits(32), branch_type : BranchType) begin var address : bits(32) = address_in; if CurrentInstrSet() == InstrSet_A32 then address[1:0] = '00'; else address[0] = '0'; end; let branch_conditional : boolean = CurrentCond() != '111x'; BranchTo{32}(address, branch_type, branch_conditional); end;

// CBWritePC() // =========== // Takes a branch from a CBNZ/CBZ instruction. func CBWritePC(address_in : bits(32)) begin var address : bits(32) = address_in; assert CurrentInstrSet() == InstrSet_T32; address[0] = '0'; let branch_conditional : boolean = TRUE; BranchTo{32}(address, BranchType_DIR, branch_conditional); end;

// D - accessor // ============ accessor D(n : integer) <=> value : bits(64) begin getter assert n >= 0 && n <= 31; let vreg : bits(128) = V{}(n DIVRM 2); return vreg[(n MOD 2)*:64]; end; setter assert n >= 0 && n <= 31; var vreg : bits(128) = V{}(n DIVRM 2); vreg[(n MOD 2)*:64] = value; V{128}(n DIVRM 2) = vreg; end; end;

// Din // === // Return the initial value of D input func Din(n : integer) => bits(64) begin assert n >= 0 && n <= 31; return _Dclone[[n]]; end;

// H - accessor // ============ accessor H(n : integer) <=> value : bits(16) begin getter assert n >= 0 && n <= 31; return S(n)[15:0]; end; setter S(n) = ZeroExtend{32}(value); end; end;

// LR - accessor // ============= accessor LR() <=> value : bits(32) begin getter return R(14); end; setter R(14) = value; end; end;

// LoadWritePC() // ============= func LoadWritePC(address : bits(32)) begin BXWritePC(address, BranchType_INDIR); end;

// LookUpRIndex() // ============== func LookUpRIndex(n : integer, mode : bits(5)) => integer begin assert n >= 0 && n <= 14; var result : integer; case n of // Select index by mode: usr fiq irq svc abt und hyp when 8 => result = RBankSelect(mode, 8, 24, 8, 8, 8, 8, 8); when 9 => result = RBankSelect(mode, 9, 25, 9, 9, 9, 9, 9); when 10 => result = RBankSelect(mode, 10, 26, 10, 10, 10, 10, 10); when 11 => result = RBankSelect(mode, 11, 27, 11, 11, 11, 11, 11); when 12 => result = RBankSelect(mode, 12, 28, 12, 12, 12, 12, 12); when 13 => result = RBankSelect(mode, 13, 29, 17, 19, 21, 23, 15); when 14 => result = RBankSelect(mode, 14, 30, 16, 18, 20, 22, 14); otherwise => result = n; end; return result; end;

// Monitor mode registers // ====================== // The Monitor mode registers do not map to X registers, so must be defined separately var SP_mon : bits(32); var LR_mon : bits(32);

// PC32 // ==== // Read 32-bit program counter func PC32() => bits(32) begin return R(15); // This includes the offset from AArch32 state end;

// PCStoreValue() // ============== func PCStoreValue() => bits(32) begin // This function returns the PC value. On architecture versions before Armv7, it // is permitted to instead return PC+4, provided it does so consistently. It is // used only to describe A32 instructions, so it returns the address of the current // instruction plus 8 (normally) or 12 (when the alternative is permitted). return PC32(); end;

// Q - accessor // ============ accessor Q(n : integer) <=> value : bits(128) begin getter assert n >= 0 && n <= 15; return V{128}(n); end; setter assert n >= 0 && n <= 15; V{128}(n) = value; end; end;

// Qin // === // Return the initial value of Q input func Qin(n : integer) => bits(128) begin assert n >= 0 && n <= 15; return Din(2*n+1)::Din(2*n); end;

// R - accessor // ============ accessor R(n : integer) <=> value : bits(32) begin getter if n == 15 then let offset : integer{} = (if CurrentInstrSet() == InstrSet_A32 then 8 else 4); return _PC[31:0] + offset; else return Rmode(n, PSTATE.M); end; end; setter Rmode(n, PSTATE.M) = value; return; end; end; // R - accessor // ============ accessor R(lr : integer, hr : integer) <=> value : bits(64) begin getter return R(hr) :: R(lr); end; setter R(lr) = value[0+:32]; R(hr) = value[32+:32]; end; end;

// RBankSelect() // ============= func RBankSelect(mode : bits(5), usr : integer, fiq : integer, irq : integer, svc : integer, abt : integer, und : integer, hyp : integer) => integer begin var result : integer; case mode of when M32_User => result = usr; // User mode when M32_FIQ => result = fiq; // FIQ mode when M32_IRQ => result = irq; // IRQ mode when M32_Svc => result = svc; // Supervisor mode when M32_Abort => result = abt; // Abort mode when M32_Hyp => result = hyp; // Hyp mode when M32_Undef => result = und; // Undefined mode when M32_System => result = usr; // System mode uses User mode registers otherwise => unreachable; // Monitor mode end; return result; end;

// ReadAnyAllocatedRegister() // ========================== impdef func ReadAnyAllocatedRegister() => bits(32) begin return Zeros{32}; end;

// ReadAnyAllocatedSPSR() // ====================== impdef func ReadAnyAllocatedSPSR() => bits(32) begin return Zeros{32}; end;

// Rmode - accessor // ================ accessor Rmode(n : integer, mode : bits(5)) <=> value : bits(32) begin getter assert n >= 0 && n <= 14; // Check for attempted use of Monitor mode in Non-secure state. if CurrentSecurityState() != SS_Secure then assert mode != M32_Monitor; end; assert !BadMode(mode); if mode == M32_Monitor then if n == 13 then return SP_mon; elsif n == 14 then return LR_mon; else return _R[[n]][31:0]; end; else return _R[[LookUpRIndex(n, mode)]][31:0]; end; end; setter assert n >= 0 && n <= 14; // Check for attempted use of Monitor mode in Non-secure state. if CurrentSecurityState() != SS_Secure then assert mode != M32_Monitor; end; assert !BadMode(mode); if mode == M32_Monitor then if n == 13 then SP_mon = value; elsif n == 14 then LR_mon = value; else _R[[n]][31:0] = value; end; else // It is CONSTRAINED UNPREDICTABLE whether the upper 32 bits of the X // register are unchanged or set to zero. This is also tested for on // exception entry, as this applies to all AArch32 registers. if HaveAArch64() && ConstrainUnpredictableBool(Unpredictable_ZEROUPPER) then _R[[LookUpRIndex(n, mode)]] = ZeroExtend{64}(value); else _R[[LookUpRIndex(n, mode)]][31:0] = value; end; end; end; end;

// S - accessor // ============ accessor S(n : integer) <=> value : bits(32) begin getter assert n >= 0 && n <= 31; let vreg : bits(128) = V{}(n DIVRM 4); return vreg[(n MOD 4)*:32]; end; setter assert n >= 0 && n <= 31; var vreg : bits(128) = V{}(n DIVRM 4); vreg[(n MOD 4)*:32] = value; V{128}(n DIVRM 4) = vreg; end; end;

// _Dclone[] // ========= // Clone the 64-bit Advanced SIMD and VFP extension register bank for use as input to // instruction pseudocode, to avoid read-after-write for Advanced SIMD and VFP operations. var _Dclone : array [[32]] of bits(64);

// AArch32_ExceptionReturn() // ========================= func AArch32_ExceptionReturn(new_pc_in : bits(32), spsr : bits(32)) begin var new_pc : bits(32) = new_pc_in; SynchronizeContext(); // Attempts to change to an illegal mode or state will invoke the Illegal Execution state // mechanism SetPSTATEFromPSR{32}(spsr); ClearExclusiveLocal(ProcessorID()); SendEventLocal(); if PSTATE.IL == '1' then // If the exception return is illegal, PC[1:0] are UNKNOWN new_pc[1:0] = ARBITRARY : bits(2); else // LR[1:0] or LR[0] are treated as being 0, depending on the target instruction set state if PSTATE.T == '1' then new_pc[0] = '0'; // T32 else new_pc[1:0] = '00'; // A32 end; end; let branch_conditional : boolean = CurrentCond() != '111x'; BranchTo{32}(new_pc, BranchType_ERET, branch_conditional); CheckExceptionCatch(FALSE); // Check for debug event on exception return end;

// AArch32_ExecutingCP10or11Instr() // ================================ func AArch32_ExecutingCP10or11Instr() => boolean begin let instr : bits(32) = ThisInstr(); let instr_set : InstrSet = CurrentInstrSet(); assert instr_set IN {InstrSet_A32, InstrSet_T32}; if instr_set == InstrSet_A32 then return ((instr[27:24] == '1110' || instr[27:25] == '110') && instr[11:8] == '101x'); else // InstrSet_T32 return (instr[31:28] == '111x' && (instr[27:24] == '1110' || instr[27:25] == '110') && instr[11:8] == '101x'); end; end;

// AArch32_ITAdvance() // =================== func AArch32_ITAdvance() begin if PSTATE.IT[2:0] == '000' then PSTATE.IT = '00000000'; else PSTATE.IT[4:0] = LSL(PSTATE.IT[4:0], 1); end; return; end;

// AArch32_InterruptPending() // ========================== // Returns TRUE if there are any pending physical or virtual interrupts, and FALSE otherwise. func AArch32_InterruptPending() => boolean begin if !ELUsingAArch32(EL2) then return AArch64_InterruptPending(); end; let (irq_pending, -) = IRQPending(); let (fiq_pending, -) = FIQPending(); let pending_physical_interrupt : boolean = (irq_pending || fiq_pending || IsPhysicalSErrorPending()); var pending_virtual_interrupt : boolean = FALSE; if EL2Enabled() && PSTATE.EL IN {EL0, EL1} && HCR().TGE == '0' then let virq_pending : boolean = (HCR().IMO == '1' && (VirtualIRQPending() || HCR().VI == '1')); let vfiq_pending : boolean = (HCR().FMO == '1' && (VirtualFIQPending() || HCR().VF == '1')); let vsei_pending : boolean = (HCR().AMO == '1' && (IsVirtualSErrorPending() || HCR().VA == '1')); pending_virtual_interrupt = vsei_pending || virq_pending || vfiq_pending; end; return pending_physical_interrupt || pending_virtual_interrupt; end;

// AArch32_SysRegRead() // ==================== // Read from a 32-bit AArch32 System register and write the register's contents to R[t]. impdef func AArch32_SysRegRead(cp_num : integer, instr : bits(32), t : integer) begin let (-, el) = ELFromM32(PSTATE.M); let opc1 = instr[21+:3]; let CRn = instr[16+:4]; let CRm = instr[0+:4]; let opc2 = instr[5+:3]; end;

// AArch32_SysRegRead64() // ====================== // Read from a 64-bit AArch32 System register and write the register's contents to R[t] and R[t2]. impdef func AArch32_SysRegRead64(cp_num : integer, instr : bits(32), t : integer, t2 : integer) begin let (-, el) = ELFromM32(PSTATE.M); let opc1 = instr[4+:4]; let CRm = instr[0+:4]; end;

// AArch32_SysRegReadCanWriteAPSR() // ================================ // Determines whether the AArch32 System register read instruction can write to APSR flags. func AArch32_SysRegReadCanWriteAPSR(cp_num : integer, instr : bits(32)) => boolean begin assert UsingAArch32(); assert (cp_num IN {14,15}); assert cp_num == UInt(instr[11:8]); let opc1 : integer{} = UInt(instr[23:21]); let opc2 : integer{} = UInt(instr[7:5]); let CRn : integer{} = UInt(instr[19:16]); let CRm : integer{} = UInt(instr[3:0]); if cp_num == 14 && opc1 == 0 && CRn == 0 && CRm == 1 && opc2 == 0 then // DBGDSCRint return TRUE; end; return FALSE; end;

// AArch32_SysRegWrite() // ===================== // Read the contents of R[t] and write to a 32-bit AArch32 System register. impdef func AArch32_SysRegWrite(cp_num : integer, instr : bits(32), t : integer) begin let (-, el) = ELFromM32(PSTATE.M); let opc1 = instr[21+:3]; let CRn = instr[16+:4]; let CRm = instr[ 0+:4]; let opc2 = instr[ 5+:3]; end;

// AArch32_SysRegWrite64() // ======================= // Read the contents of R[t] and R[t2] and write to a 64-bit AArch32 System register. impdef func AArch32_SysRegWrite64(cp_num : integer, instr : bits(32), t : integer, t2 : integer) begin let (-, el) = ELFromM32(PSTATE.M); let opc1 = instr[4+:4]; let CRm = instr[0+:4]; end;

// AArch32_WriteMode() // =================== // Function for dealing with writes to PSTATE.M from AArch32 state only. // This ensures that PSTATE.EL and PSTATE.SP are always valid. func AArch32_WriteMode(mode : bits(5)) begin let (valid,el) : (boolean, bits(2)) = ELFromM32(mode); assert valid; PSTATE.M = mode; PSTATE.EL = el; PSTATE.nRW = '1'; PSTATE.SP = (if mode IN {M32_User,M32_System} then '0' else '1'); return; end;

// AArch32_WriteModeByInstr() // ========================== // Function for dealing with writes to PSTATE.M from an AArch32 instruction, and ensuring that // illegal state changes are correctly flagged in PSTATE.IL. func AArch32_WriteModeByInstr(mode : bits(5)) begin var (valid,el) : (boolean, bits(2)) = ELFromM32(mode); // 'valid' is set to FALSE if' mode' is invalid for this implementation or the current value // of SCR.NS/SCR_EL3.NS. Additionally, it is illegal for an instruction to write 'mode' to // PSTATE.EL if it would result in any of: // * A change to a mode that would cause entry to a higher Exception level. if UInt(el) > UInt(PSTATE.EL) then valid = FALSE; end; // * A change to or from Hyp mode. if (PSTATE.M == M32_Hyp || mode == M32_Hyp) && PSTATE.M != mode then valid = FALSE; end; // * When EL2 is implemented, the value of HCR.TGE is '1', a change to a Non-secure EL1 mode. if (PSTATE.M == M32_Monitor && HaveEL(EL2) && el == EL1 && SCR().NS == '1' && HCR().TGE == '1') then valid = FALSE; end; if !valid then PSTATE.IL = '1'; else AArch32_WriteMode(mode); end; end;

// BadMode() // ========= readonly func BadMode(mode : bits(5)) => boolean begin // Return TRUE if 'mode' encodes a mode that is not valid for this implementation var valid : boolean; case mode of when M32_Monitor => valid = HaveAArch32EL(EL3); when M32_Hyp => valid = HaveAArch32EL(EL2); when M32_FIQ, M32_IRQ, M32_Svc, M32_Abort, M32_Undef, M32_System => // If EL3 is implemented and using AArch32, then these modes are EL3 modes in Secure // state, and EL1 modes in Non-secure state. If EL3 is not implemented or is using // AArch64, then these modes are EL1 modes. // Therefore it is sufficient to test this implementation supports EL1 using AArch32 valid = HaveAArch32EL(EL1); when M32_User => valid = HaveAArch32EL(EL0); otherwise => valid = FALSE; // Passed an illegal mode value end; return !valid; end;

// BankedRegisterAccessValid() // =========================== // Checks for MRS (Banked register) or MSR (Banked register) accesses to registers // other than the SPSRs that are invalid. This includes ELR_hyp accesses. func BankedRegisterAccessValid(SYSm : bits(5), mode : bits(5)) => (boolean, Constraint) begin var valid : boolean = TRUE; var c : Constraint = Constraint_NONE; var banked_unpred : boolean = FALSE; case SYSm of when '000xx', '00100' => // R8_usr to R12_usr banked_unpred = mode != M32_FIQ; when '00101' => // SP_usr banked_unpred = mode == M32_System; when '00110' => // LR_usr banked_unpred = mode IN {M32_Hyp,M32_System}; when '010xx', '0110x', '01110' => // R8_fiq to R12_fiq, SP_fiq, LR_fiq banked_unpred = mode == M32_FIQ; when '1000x' => // LR_irq, SP_irq banked_unpred = mode == M32_IRQ; when '1001x' => // LR_svc, SP_svc banked_unpred = mode == M32_Svc; when '1010x' => // LR_abt, SP_abt banked_unpred = mode == M32_Abort; when '1011x' => // LR_und, SP_und banked_unpred = mode == M32_Undef; when '1110x' => // LR_mon, SP_mon banked_unpred = (!HaveEL(EL3) || CurrentSecurityState() != SS_Secure || mode == M32_Monitor); when '11110' => // ELR_hyp, only from Monitor or Hyp mode banked_unpred = !HaveEL(EL2) || ! mode IN {M32_Monitor,M32_Hyp}; when '11111' => // SP_hyp, only from Monitor mode banked_unpred = !HaveEL(EL2) || mode != M32_Monitor; otherwise => valid = FALSE; c = ConstrainUnpredictable(Unpredictable_UnimplementedRegister); assert c IN {Constraint_UNDEF, Constraint_NOP, Constraint_ANYREG}; end; if banked_unpred then valid = FALSE; c = ConstrainUnpredictable(Unpredictable_BankedRegister); assert c IN {Constraint_UNDEF, Constraint_NOP, Constraint_UNKNOWN}; end; return (valid, c); end;

// CPSRWriteByInstr() // ================== // Update PSTATE.[N,Z,C,V,Q,GR,E,A,I,F,M] from a CPSR value written by an MSR instruction. func CPSRWriteByInstr(value : bits(32), bytemask : bits(4)) begin let privileged : boolean = PSTATE.EL != EL0; // PSTATE.[A,I,F,M] are not writable at EL0 // Write PSTATE from 'value', ignoring bytes masked by 'bytemask' if bytemask[3] == '1' then PSTATE.[N,Z,C,V,Q] = value[31:27]; // Bits [26:24] are ignored end; if bytemask[2] == '1' then if IsFeatureImplemented(FEAT_SSBS) then PSTATE.SSBS = value[23]; end; if privileged then PSTATE.PAN = value[22]; end; if IsFeatureImplemented(FEAT_DIT) then PSTATE.DIT = value[21]; end; // Bit [20] is RES0 PSTATE.GE = value[19:16]; end; if bytemask[1] == '1' then // Bits [15:10] are RES0 PSTATE.E = value[9]; // PSTATE.E is writable at EL0 if privileged then PSTATE.A = value[8]; end; end; if bytemask[0] == '1' then if privileged then PSTATE.[I,F] = value[7:6]; // Bit [5] is RES0 // AArch32_WriteModeByInstr() sets PSTATE.IL to 1 if this is an illegal mode change. AArch32_WriteModeByInstr(value[4:0]); end; end; return; end;

// ConditionPassed() // ================= func ConditionPassed() => boolean begin return ConditionHolds(CurrentCond()); end;

// CurrentCond() // ============= // Returns the condition code that applies to the currently executing instruction impdef func CurrentCond() => bits(4) begin return Zeros{4}; end;

// InITBlock() // =========== func InITBlock() => boolean begin if CurrentInstrSet() == InstrSet_T32 then return PSTATE.IT[3:0] != '0000'; else return FALSE; end; end;

// LastInITBlock() // =============== func LastInITBlock() => boolean begin return (PSTATE.IT[3:0] == '1000'); end;

// SPSRWriteByInstr() // ================== func SPSRWriteByInstr(value : bits(32), bytemask : bits(4)) begin var new_spsr : bits(32) = SPSR_curr(); if bytemask[3] == '1' then new_spsr[31:24] = value[31:24]; // N, Z, C, V, Q flags, IT[1:0],J bits end; if bytemask[2] == '1' then new_spsr[23:16] = value[23:16]; // IL bit, GE[3:0] flags end; if bytemask[1] == '1' then new_spsr[15:8] = value[15:8]; // IT[7:2] bits, E bit, A interrupt mask end; if bytemask[0] == '1' then new_spsr[7:0] = value[7:0]; // I, F interrupt masks, T bit, Mode bits end; SPSR_curr() = new_spsr; // UNPREDICTABLE if User or System mode return; end;

// SPSRaccessValid() // ================= // Checks for MRS (Banked register) or MSR (Banked register) accesses to the SPSRs // that are UNPREDICTABLE func SPSRaccessValid(SYSm : bits(5), mode : bits(5)) => (boolean, Constraint) begin var valid : boolean = TRUE; var c : Constraint = Constraint_NONE; var banked_unpred : boolean = FALSE; case SYSm of when '01110' => // SPSR_fiq banked_unpred = mode == M32_FIQ; when '10000' => // SPSR_irq banked_unpred = mode == M32_IRQ; when '10010' => // SPSR_svc banked_unpred = mode == M32_Svc; when '10100' => // SPSR_abt banked_unpred = mode == M32_Abort; when '10110' => // SPSR_und banked_unpred = mode == M32_Undef; when '11100' => // SPSR_mon banked_unpred = (!HaveEL(EL3) || mode == M32_Monitor || CurrentSecurityState() != SS_Secure); when '11110' => // SPSR_hyp banked_unpred = !HaveEL(EL2) || mode != M32_Monitor; otherwise => valid = FALSE; c = ConstrainUnpredictable(Unpredictable_UnimplementedRegister); assert c IN {Constraint_UNDEF, Constraint_NOP, Constraint_ANYREG}; end; if banked_unpred then valid = FALSE; c = ConstrainUnpredictable(Unpredictable_BankedRegister); assert c IN {Constraint_UNDEF, Constraint_NOP, Constraint_UNKNOWN}; end; return (valid, c); end;

// SelectInstrSet() // ================ func SelectInstrSet(iset : InstrSet) begin assert CurrentInstrSet() IN {InstrSet_A32, InstrSet_T32}; assert iset IN {InstrSet_A32, InstrSet_T32}; PSTATE.T = if iset == InstrSet_A32 then '0' else '1'; return; end;

// AArch32_DTLBI_ALL() // =================== // Invalidate all data TLB entries for the indicated translation regime with the // the indicated security state for all TLBs within the indicated broadcast domain. // Invalidation applies to all applicable stage 1 and stage 2 entries. func AArch32_DTLBI_ALL(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast_in : Broadcast, attr_in : TLBIMemAttr) begin assert PSTATE.EL IN {EL3, EL2, EL1}; var attr : TLBIMemAttr = attr_in; let broadcast : Broadcast = AArch32_EffectiveBroadcast(broadcast_in); if ExcludeXS() then attr = TLBI_ExcludeXS; end; var r : TLBIRecord; r.op = TLBIOp_DALL; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.vmid = vmid; r.use_vmid = UseVMID(regime); r.level = TLBILevel_Any; r.attr = attr; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_DTLBI_ASID() // ==================== // Invalidate all data TLB stage 1 entries matching the indicated VMID (where regime supports) // and ASID in the parameter Rt in the indicated translation regime with the // indicated security state for all TLBs within the indicated broadcast domain. // Note: stage 1 and stage 2 combined entries are in the scope of this operation. func AArch32_DTLBI_ASID(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast_in : Broadcast, attr_in : TLBIMemAttr, Rt : bits(32)) begin assert PSTATE.EL IN {EL3, EL2, EL1}; var attr : TLBIMemAttr = attr_in; let broadcast : Broadcast = AArch32_EffectiveBroadcast(broadcast_in); if ExcludeXS() then attr = TLBI_ExcludeXS; end; var r : TLBIRecord; r.op = TLBIOp_DASID; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.vmid = vmid; r.use_vmid = UseVMID(regime); r.level = TLBILevel_Any; r.attr = attr; r.asid = Zeros{8} :: Rt[7:0]; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_DTLBI_VA() // ================== // Invalidate by VA all stage 1 data TLB entries in the indicated broadcast domain // matching the indicated VMID and ASID (where regime supports VMID, ASID) in the indicated regime // with the indicated security state. // ASID, VA and related parameters are derived from Rt. // Note: stage 1 and stage 2 combined entries are in the scope of this operation. func AArch32_DTLBI_VA(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast_in : Broadcast, level : TLBILevel, attr_in : TLBIMemAttr, Rt : bits(32)) begin assert PSTATE.EL IN {EL3, EL2, EL1}; var attr : TLBIMemAttr = attr_in; let broadcast : Broadcast = AArch32_EffectiveBroadcast(broadcast_in); if ExcludeXS() then attr = TLBI_ExcludeXS; end; var r : TLBIRecord; r.op = TLBIOp_DVA; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.vmid = vmid; r.use_vmid = UseVMID(regime); r.level = level; r.attr = attr; r.asid = Zeros{8} :: Rt[7:0]; r.address = Zeros{32} :: Rt[31:12] :: Zeros{12}; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_EffectiveBroadcast() // ============================ func AArch32_EffectiveBroadcast(broadcast_in : Broadcast) => Broadcast begin var broadcast : Broadcast = broadcast_in; if PSTATE.EL != EL1 then return broadcast; end; if (broadcast == Broadcast_NSH && ((ELUsingAArch32(EL2) && HCR().FB == '1') || (!ELUsingAArch32(EL2) && HCR_EL2().FB == '1'))) then broadcast = Broadcast_ForcedISH; end; return broadcast; end;

// AArch32_ITLBI_ALL() // =================== // Invalidate all instruction TLB entries for the indicated translation regime with the // the indicated security state for all TLBs within the indicated broadcast domain. // Invalidation applies to all applicable stage 1 and stage 2 entries. func AArch32_ITLBI_ALL(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast_in : Broadcast, attr_in : TLBIMemAttr) begin assert PSTATE.EL IN {EL3, EL2, EL1}; var attr : TLBIMemAttr = attr_in; let broadcast : Broadcast = AArch32_EffectiveBroadcast(broadcast_in); if ExcludeXS() then attr = TLBI_ExcludeXS; end; var r : TLBIRecord; r.op = TLBIOp_IALL; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.vmid = vmid; r.use_vmid = UseVMID(regime); r.level = TLBILevel_Any; r.attr = attr; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_ITLBI_ASID() // ==================== // Invalidate all instruction TLB stage 1 entries matching the indicated VMID // (where regime supports) and ASID in the parameter Rt in the indicated translation // regime with the indicated security state for all TLBs within the indicated broadcast domain. // Note: stage 1 and stage 2 combined entries are in the scope of this operation. func AArch32_ITLBI_ASID(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast_in : Broadcast, attr_in : TLBIMemAttr, Rt : bits(32)) begin assert PSTATE.EL IN {EL3, EL2, EL1}; var attr : TLBIMemAttr = attr_in; let broadcast : Broadcast = AArch32_EffectiveBroadcast(broadcast_in); if ExcludeXS() then attr = TLBI_ExcludeXS; end; var r : TLBIRecord; r.op = TLBIOp_IASID; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.vmid = vmid; r.use_vmid = UseVMID(regime); r.level = TLBILevel_Any; r.attr = attr; r.asid = Zeros{8} :: Rt[7:0]; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_ITLBI_VA() // ================== // Invalidate by VA all stage 1 instruction TLB entries in the indicated broadcast domain // matching the indicated VMID and ASID (where regime supports VMID, ASID) in the indicated regime // with the indicated security state. // ASID, VA and related parameters are derived from Rt. // Note: stage 1 and stage 2 combined entries are in the scope of this operation. func AArch32_ITLBI_VA(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast_in : Broadcast, level : TLBILevel, attr_in : TLBIMemAttr, Rt : bits(32)) begin assert PSTATE.EL IN {EL3, EL2, EL1}; var attr : TLBIMemAttr = attr_in; let broadcast : Broadcast = AArch32_EffectiveBroadcast(broadcast_in); if ExcludeXS() then attr = TLBI_ExcludeXS; end; var r : TLBIRecord; r.op = TLBIOp_IVA; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.vmid = vmid; r.use_vmid = UseVMID(regime); r.level = level; r.attr = attr; r.asid = Zeros{8} :: Rt[7:0]; r.address = Zeros{32} :: Rt[31:12] :: Zeros{12}; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_TLBI_ALL() // ================== // Invalidate all entries for the indicated translation regime with the // the indicated security state for all TLBs within the indicated broadcast domain. // Invalidation applies to all applicable stage 1 and stage 2 entries. func AArch32_TLBI_ALL(security : SecurityState, regime : Regime, broadcast : Broadcast, attr : TLBIMemAttr) begin assert PSTATE.EL IN {EL3, EL2}; var r : TLBIRecord; r.op = TLBIOp_ALL; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.level = TLBILevel_Any; r.attr = attr; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_TLBI_ASID() // =================== // Invalidate all stage 1 entries matching the indicated VMID (where regime supports) // and ASID in the parameter Rt in the indicated translation regime with the // indicated security state for all TLBs within the indicated broadcast domain. // Note: stage 1 and stage 2 combined entries are in the scope of this operation. func AArch32_TLBI_ASID(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast_in : Broadcast, attr_in : TLBIMemAttr, Rt : bits(32)) begin assert PSTATE.EL IN {EL3, EL2, EL1}; var attr : TLBIMemAttr = attr_in; let broadcast : Broadcast = AArch32_EffectiveBroadcast(broadcast_in); if ExcludeXS() then attr = TLBI_ExcludeXS; end; var r : TLBIRecord; r.op = TLBIOp_ASID; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.vmid = vmid; r.use_vmid = UseVMID(regime); r.level = TLBILevel_Any; r.attr = attr; r.asid = Zeros{8} :: Rt[7:0]; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_TLBI_IPAS2() // ==================== // Invalidate by IPA all stage 2 only TLB entries in the indicated broadcast // domain matching the indicated VMID in the indicated regime with the indicated security state. // Note: stage 1 and stage 2 combined entries are not in the scope of this operation. // IPA and related parameters of the are derived from Rt. func AArch32_TLBI_IPAS2(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast : Broadcast, level : TLBILevel, attr : TLBIMemAttr, Rt : bits(32)) begin assert PSTATE.EL IN {EL3, EL2}; assert security == SS_NonSecure; var r : TLBIRecord; r.op = TLBIOp_IPAS2; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.vmid = vmid; r.use_vmid = TRUE; r.level = level; r.attr = attr; r.address = Zeros{24} :: Rt[27:0] :: Zeros{12}; r.ipaspace = PAS_NonSecure; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_TLBI_VA() // ================= // Invalidate by VA all stage 1 TLB entries in the indicated broadcast domain // matching the indicated VMID and ASID (where regime supports VMID, ASID) in the indicated regime // with the indicated security state. // ASID, VA and related parameters are derived from Rt. // Note: stage 1 and stage 2 combined entries are in the scope of this operation. func AArch32_TLBI_VA(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast_in : Broadcast, level : TLBILevel, attr_in : TLBIMemAttr, Rt : bits(32)) begin assert PSTATE.EL IN {EL3, EL2, EL1}; var attr : TLBIMemAttr = attr_in; let broadcast : Broadcast = AArch32_EffectiveBroadcast(broadcast_in); if ExcludeXS() then attr = TLBI_ExcludeXS; end; var r : TLBIRecord; r.op = TLBIOp_VA; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.vmid = vmid; r.use_vmid = UseVMID(regime); r.level = level; r.attr = attr; r.asid = Zeros{8} :: Rt[7:0]; r.address = Zeros{32} :: Rt[31:12] :: Zeros{12}; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_TLBI_VAA() // ================== // Invalidate by VA all stage 1 TLB entries in the indicated broadcast domain // matching the indicated VMID (where regime supports VMID) and all ASID in the indicated regime // with the indicated security state. // VA and related parameters are derived from Rt. // Note: stage 1 and stage 2 combined entries are in the scope of this operation. func AArch32_TLBI_VAA(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast_in : Broadcast, level : TLBILevel, attr_in : TLBIMemAttr, Rt : bits(32)) begin assert PSTATE.EL IN {EL3, EL2, EL1}; var attr : TLBIMemAttr = attr_in; let broadcast : Broadcast = AArch32_EffectiveBroadcast(broadcast_in); if ExcludeXS() then attr = TLBI_ExcludeXS; end; var r : TLBIRecord; r.op = TLBIOp_VAA; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.vmid = vmid; r.use_vmid = UseVMID(regime); r.level = level; r.attr = attr; r.address = Zeros{32} :: Rt[31:12] :: Zeros{12}; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_TLBI_VMALL() // ==================== // Invalidate all stage 1 entries for the indicated translation regime with the // the indicated security state for all TLBs within the indicated broadcast // domain that match the indicated VMID (where applicable). // Note: stage 1 and stage 2 combined entries are in the scope of this operation. // Note: stage 2 only entries are not in the scope of this operation. func AArch32_TLBI_VMALL(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast_in : Broadcast, attr_in : TLBIMemAttr) begin assert PSTATE.EL IN {EL3, EL2, EL1}; var attr : TLBIMemAttr = attr_in; let broadcast : Broadcast = AArch32_EffectiveBroadcast(broadcast_in); if ExcludeXS() then attr = TLBI_ExcludeXS; end; var r : TLBIRecord; r.op = TLBIOp_VMALL; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.level = TLBILevel_Any; r.vmid = vmid; r.use_vmid = UseVMID(regime); r.attr = attr; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// AArch32_TLBI_VMALLS12() // ======================= // Invalidate all stage 1 and stage 2 entries for the indicated translation // regime with the indicated security state for all TLBs within the indicated // broadcast domain that match the indicated VMID. func AArch32_TLBI_VMALLS12(security : SecurityState, regime : Regime, vmid : bits(NUM_VMIDBITS), broadcast : Broadcast, attr : TLBIMemAttr) begin assert PSTATE.EL IN {EL3, EL2}; var r : TLBIRecord; r.op = TLBIOp_VMALLS12; r.from_aarch64 = FALSE; r.security = security; r.regime = regime; r.level = TLBILevel_Any; r.vmid = vmid; r.use_vmid = TRUE; r.attr = attr; TLBI(r); if broadcast != Broadcast_NSH then BroadcastTLBI(broadcast, r); end; return; end;

// Sat() // ===== func Sat{N}(i : integer, unsigned : boolean) => bits(N) begin let result : bits(N) = if unsigned then UnsignedSat{N}(i) else SignedSat{N}(i); return result; end;

// AArch32_CanTrapIC() // =================== // Determines whether the execution of the IC instruction can be trapped. func AArch32_CanTrapIC(cacheop : CacheOp, opscope : CacheOpScope) => boolean begin return (!AArch32_TreatICAsNOP(cacheop, opscope) || ImpDefBool( "When IC is treated as NOP, data cache maintenance operations are trapped")); end;

// AArch32_IC() // ============ // Perform Instruction Cache Operation. func AArch32_IC(opscope : CacheOpScope) begin let regval : bits(32) = ARBITRARY : bits(32); AArch32_IC(regval, opscope); end; // AArch32_IC() // ============ // Perform Instruction Cache Operation. func AArch32_IC(regval : bits(32), opscope : CacheOpScope) begin var cache : CacheRecord; cache.acctype = AccessType_IC; cache.cachetype = CacheType_Instruction; cache.cacheop = CacheOp_Invalidate; cache.opscope = opscope; cache.security = SecurityStateAtEL(PSTATE.EL); if opscope IN {CacheOpScope_ALLU, CacheOpScope_ALLUIS} then if (opscope == CacheOpScope_ALLUIS || AArch32_EffectiveBroadcast(Broadcast_NSH) == Broadcast_ForcedISH) then cache.shareability = Shareability_ISH; else cache.shareability = Shareability_NSH; end; cache.regval = ZeroExtend{64}(regval); CACHE_OP(cache); else assert opscope == CacheOpScope_PoU; if EL2Enabled() then if PSTATE.EL IN {EL0, EL1} then cache.is_vmid_valid = TRUE; cache.vmid = VMID(); else cache.is_vmid_valid = FALSE; end; else cache.is_vmid_valid = FALSE; end; if PSTATE.EL == EL0 then cache.is_asid_valid = TRUE; cache.asid = ASID(); else cache.is_asid_valid = FALSE; end; cache.shareability = Shareability_NSH; cache.vaddress = ZeroExtend{64}(regval); let size : integer = 0; let aligned : boolean = TRUE; let accdesc : AccessDescriptor = CreateAccDescIC(cache); let memaddrdesc : AddressDescriptor = AArch32_TranslateAddress(regval, accdesc, aligned, size); if IsFault(memaddrdesc) then AArch32_Abort(memaddrdesc.fault); end; cache.paddress = memaddrdesc.paddress; CACHE_OP(cache); end; return; end;

// AArch32_TreatICAsNOP() // ====================== // Determines whether the execution of the IC instruction is treated as a NOP. func AArch32_TreatICAsNOP(cacheop : CacheOp, opscope : CacheOpScope) => boolean begin if CTR().DIC == '1' then return ImpDefBool("IC is treated as NOP"); end; return FALSE; end;

// AArch32_RestrictPrediction() // ============================ // Clear all predictions in the context. func AArch32_RestrictPrediction(val : bits(32), restriction : RestrictType) begin var c : ExecutionCntxt; let target_el : bits(2) = val[25:24]; // If the target EL is not implemented or the instruction is executed at an // EL lower than the specified level, the instruction is treated as a NOP. if !HaveEL(target_el) || UInt(target_el) > UInt(PSTATE.EL) then ExecuteAsNOP(); end; let ns : bit = val[26]; let nse : bit = ARBITRARY : bit; let ss : SecurityState = TargetSecurityState(ns, nse); c.security = ss; c.target_el = target_el; if EL2Enabled() then if PSTATE.EL IN {EL0, EL1} then c.is_vmid_valid = TRUE; c.all_vmid = FALSE; c.vmid = VMID(); elsif target_el IN {EL0, EL1} then c.is_vmid_valid = TRUE; c.all_vmid = val[27] == '1'; c.vmid = ZeroExtend{NUM_VMIDBITS}(val[23:16]);// Only valid if val[27] == '0' else c.is_vmid_valid = FALSE; end; else c.is_vmid_valid = FALSE; end; if PSTATE.EL == EL0 then c.is_asid_valid = TRUE; c.all_asid = FALSE; c.asid = ASID(); elsif target_el == EL0 then c.is_asid_valid = TRUE; c.all_asid = val[8] == '1'; c.asid = ZeroExtend{NUM_ASIDBITS}(val[7:0]); // Only valid if val[8] == '0' else c.is_asid_valid = FALSE; end; c.restriction = restriction; RESTRICT_PREDICTIONS(c); end;

// AArch32_DefaultTEXDecode() // ========================== // Apply short-descriptor format memory region attributes, without TEX remap func AArch32_DefaultTEXDecode(TEX_in : bits(3), c_in : bit, b_in : bit, s : bit) => MemoryAttributes begin var memattrs : MemoryAttributes; var TEX : bits(3) = TEX_in; var c : bit = c_in; var b : bit = b_in; // Reserved values map to allocated values if (TEX == '001' && c::b == '01') || (TEX == '010' && c::b != '00') || TEX == '011' then var texcb : bits(5); (-, texcb) = ConstrainUnpredictableBits{5}(Unpredictable_RESTEXCB); TEX = texcb[4:2]; c = texcb[1]; b = texcb[0]; end; // Distinction between Inner Shareable and Outer Shareable is not supported in this format // A memory region is either Non-shareable or Outer Shareable case TEX::c::b of when '00000' => // Device-nGnRnE memattrs.memtype = MemType_Device; memattrs.device = DeviceType_nGnRnE; memattrs.shareability = Shareability_OSH; when '00001', '01000' => // Device-nGnRE memattrs.memtype = MemType_Device; memattrs.device = DeviceType_nGnRE; memattrs.shareability = Shareability_OSH; when '00010' => // Write-through Read allocate memattrs.memtype = MemType_Normal; memattrs.inner.attrs = MemAttr_WT; memattrs.inner.hints = MemHint_RA; memattrs.outer.attrs = MemAttr_WT; memattrs.outer.hints = MemHint_RA; memattrs.shareability = if s == '1' then Shareability_OSH else Shareability_NSH; when '00011' => // Write-back Read allocate memattrs.memtype = MemType_Normal; memattrs.inner.attrs = MemAttr_WB; memattrs.inner.hints = MemHint_RA; memattrs.outer.attrs = MemAttr_WB; memattrs.outer.hints = MemHint_RA; memattrs.shareability = if s == '1' then Shareability_OSH else Shareability_NSH; when '00100' => // Non-cacheable memattrs.memtype = MemType_Normal; memattrs.inner.attrs = MemAttr_NC; memattrs.outer.attrs = MemAttr_NC; memattrs.shareability = Shareability_OSH; when '00110' => memattrs = ImpDefMemoryAttributes("IMPLEMENTATION_DEFINED"); when '00111' => // Write-back Read and Write allocate memattrs.memtype = MemType_Normal; memattrs.inner.attrs = MemAttr_WB; memattrs.inner.hints = MemHint_RWA; memattrs.outer.attrs = MemAttr_WB; memattrs.outer.hints = MemHint_RWA; memattrs.shareability = if s == '1' then Shareability_OSH else Shareability_NSH; when '1xxxx' => // Cacheable, TEX[1:0] = Outer attrs, {c,b} = Inner attrs memattrs.memtype = MemType_Normal; memattrs.inner = DecodeSDFAttr(c::b); memattrs.outer = DecodeSDFAttr(TEX[1:0]); if memattrs.inner.attrs == MemAttr_NC && memattrs.outer.attrs == MemAttr_NC then memattrs.shareability = Shareability_OSH; else memattrs.shareability = if s == '1' then Shareability_OSH else Shareability_NSH; end; otherwise => // Reserved, handled above unreachable; end; // The Transient hint is not supported in this format memattrs.inner.transient = FALSE; memattrs.outer.transient = FALSE; memattrs.tags = MemTag_Untagged; if memattrs.inner.attrs == MemAttr_WB && memattrs.outer.attrs == MemAttr_WB then memattrs.xs = '0'; else memattrs.xs = '1'; end; return memattrs; end;

// AArch32_MAIRAttr() // ================== // Retrieve the memory attribute encoding indexed in the given MAIR func AArch32_MAIRAttr(index : integer, mair : bits(64)) => bits(8) begin assert (index < 8); return mair[index*:8]; end;

// AArch32_RemappedTEXDecode() // =========================== // Apply short-descriptor format memory region attributes, with TEX remap func AArch32_RemappedTEXDecode(regime : Regime, TEX : bits(3), c : bit, b : bit, s : bit) => MemoryAttributes begin var memattrs : MemoryAttributes; var prrr : PRRR_Type; var nmrr : NMRR_Type; let region : integer{} = UInt(TEX[0]::c::b); // TEX[2:1] are ignored in this mapping scheme if region == 6 then return ImpDefMemoryAttributes("IMPLEMENTATION_DEFINED"); end; if regime == Regime_EL30 then prrr = PRRR_S(); nmrr = NMRR_S(); elsif HaveEL(EL3) && ELUsingAArch32(EL3) then prrr = PRRR_NS(); nmrr = NMRR_NS(); else prrr = PRRR(); nmrr = NMRR(); end; let base : integer{} = 2 * region; var attrfield : bits(2) = prrr[region*:2]; if attrfield == '11' then // Reserved, maps to allocated value (-, attrfield) = ConstrainUnpredictableBits{2}(Unpredictable_RESPRRR); end; case attrfield of when '00' => // Device-nGnRnE memattrs.memtype = MemType_Device; memattrs.device = DeviceType_nGnRnE; memattrs.shareability = Shareability_OSH; when '01' => // Device-nGnRE memattrs.memtype = MemType_Device; memattrs.device = DeviceType_nGnRE; memattrs.shareability = Shareability_OSH; when '10' => let NSn : bit = if s == '0' then prrr.NS0 else prrr.NS1; let NOSm : bit = prrr[region+24] AND NSn; let IRn : bits(2) = nmrr[base+1:base]; let ORn : bits(2) = nmrr[base+17:base+16]; memattrs.memtype = MemType_Normal; memattrs.inner = DecodeSDFAttr(IRn); memattrs.outer = DecodeSDFAttr(ORn); if memattrs.inner.attrs == MemAttr_NC && memattrs.outer.attrs == MemAttr_NC then memattrs.shareability = Shareability_OSH; else let sh : bits(2) = NSn::NOSm; memattrs.shareability = DecodeShareability(sh); end; when '11' => unreachable; end; // The Transient hint is not supported in this format memattrs.inner.transient = FALSE; memattrs.outer.transient = FALSE; memattrs.tags = MemTag_Untagged; if memattrs.inner.attrs == MemAttr_WB && memattrs.outer.attrs == MemAttr_WB then memattrs.xs = '0'; else memattrs.xs = '1'; end; return memattrs; end;

// AArch32_CheckBreakpoint() // ========================= // Called before executing the instruction of length "size" bytes at "vaddress" in an AArch32 // translation regime, when either debug exceptions are enabled, or halting debug is enabled // and halting is allowed. func AArch32_CheckBreakpoint(fault_in : FaultRecord, vaddress : bits(32), accdesc : AccessDescriptor, size : integer) => FaultRecord begin assert ELUsingAArch32(S1TranslationRegime()); assert size IN {2,4}; var fault : FaultRecord = fault_in; var match : boolean = FALSE; var mismatch : boolean = FALSE; var brkptinfo : BreakpointInfo; for i = 0 to NumBreakpointsImplemented() - 1 do brkptinfo = AArch32_BreakpointMatch(i, vaddress, accdesc, size); match = match || brkptinfo.match; mismatch = mismatch || brkptinfo.mismatch; end; if match && HaltOnBreakpointOrWatchpoint() then let reason : bits(6) = DebugHalt_Breakpoint; Halt(reason); elsif (match || mismatch) then fault.statuscode = Fault_Debug; fault.debugmoe = DebugException_Breakpoint; fault.vaddress = ZeroExtend{64}(vaddress); end; return fault; end;

// AArch32_CheckDebug() // ==================== // Called on each access to check for a debug exception or entry to Debug state. func AArch32_CheckDebug(vaddress : bits(32), accdesc : AccessDescriptor, size : integer) => FaultRecord begin var fault : FaultRecord = NoFault(accdesc, ZeroExtend{64}(vaddress)); let d_side : boolean = IsWatchpointableAccess(accdesc); let i_side : boolean = (accdesc.acctype == AccessType_IFETCH); let generate_exception : boolean = (AArch32_GenerateDebugExceptions() && DBGDSCRext().MDBGen == '1'); let halt : boolean = HaltOnBreakpointOrWatchpoint(); // Relative priority of Vector Catch and Breakpoint exceptions not defined in the architecture let vector_catch_first : boolean = ConstrainUnpredictableBool(Unpredictable_BPVECTORCATCHPRI); if i_side && vector_catch_first && generate_exception then fault = AArch32_CheckVectorCatch(fault, vaddress, size); end; if fault.statuscode == Fault_None && (generate_exception || halt) then if d_side then fault = AArch32_CheckWatchpoint(fault, vaddress, accdesc, size); elsif i_side then fault = AArch32_CheckBreakpoint(fault, vaddress, accdesc, size); end; end; if fault.statuscode == Fault_None && i_side && !vector_catch_first && generate_exception then return AArch32_CheckVectorCatch(fault, vaddress, size); end; return fault; end;

// AArch32_CheckVectorCatch() // ========================== // Called before executing the instruction of length "size" bytes at "vaddress" in an AArch32 // translation regime, when debug exceptions are enabled. func AArch32_CheckVectorCatch(fault_in : FaultRecord, vaddress : bits(32), size : integer) => FaultRecord begin assert ELUsingAArch32(S1TranslationRegime()); var fault : FaultRecord = fault_in; var match : boolean = AArch32_VCRMatch(vaddress); if size == 4 && !match && AArch32_VCRMatch(vaddress + 2) then match = ConstrainUnpredictableBool(Unpredictable_VCMATCHHALF); end; if match then fault.statuscode = Fault_Debug; fault.debugmoe = DebugException_VectorCatch; end; return fault; end;

// AArch32_CheckWatchpoint() // ========================= // Called before accessing the memory location of "size" bytes at "address", // when either debug exceptions are enabled for the access, or halting debug // is enabled and halting is allowed. func AArch32_CheckWatchpoint(fault_in : FaultRecord, vaddress : bits(32), accdesc : AccessDescriptor, size : integer) => FaultRecord begin assert ELUsingAArch32(S1TranslationRegime()); var fault : FaultRecord = fault_in; var match : boolean = FALSE; if !IsWatchpointableAccess(accdesc) then return fault; end; for i = 0 to NumWatchpointsImplemented() - 1 do let watchptinfo : WatchpointInfo = AArch32_WatchpointMatch(i, vaddress, size, accdesc); match = match || watchptinfo.value_match; end; if match && HaltOnBreakpointOrWatchpoint() then let reason : bits(6) = DebugHalt_Watchpoint; EDWAR() = ZeroExtend{64}(vaddress); Halt(reason); elsif match then fault.statuscode = Fault_Debug; fault.debugmoe = DebugException_Watchpoint; fault.vaddress = ZeroExtend{64}(vaddress); end; return fault; end;

// AArch32_IPAIsOutOfRange() // ========================= // Check intermediate physical address bits not resolved by translation are ZERO func AArch32_IPAIsOutOfRange(walkparams : S2TTWParams, ipa : bits(40)) => boolean begin // Input Address size let iasize : integer{} = AArch32_S2IASize(walkparams.t0sz); return iasize < 40 && !IsZero(ipa[39:iasize]); end;

// AArch32_S1HasAlignmentFaultDueToMemType() // ========================================= // Returns whether stage 1 output fails alignment requirement on data accesses to memory type func AArch32_S1HasAlignmentFaultDueToMemType(accdesc : AccessDescriptor, aligned : boolean, ntlsmd : bit, memattrs : MemoryAttributes) => boolean begin if memattrs.memtype != MemType_Device then return FALSE; elsif accdesc.a32lsmd && ntlsmd == '0' then return memattrs.device != DeviceType_GRE; elsif accdesc.acctype == AccessType_DCZero then return TRUE; elsif !aligned then return !(ImpDefBool("Device location supports unaligned access")); else return FALSE; end; end;

// AArch32_S1LDHasPermissionsFault() // ================================= // Returns whether an access using stage 1 long-descriptor translation // violates permissions of target memory func AArch32_S1LDHasPermissionsFault(regime : Regime, walkparams : S1TTWParams, perms : Permissions, memtype : MemType, paspace : PASpace, accdesc : AccessDescriptor) => boolean begin var r, w, x : bit; var pr, pw : bit; var ur, uw : bit; var xn : bit; if HasUnprivileged(regime) then // Apply leaf permissions case perms.ap[2:1] of when '00' => (pr,pw,ur,uw) = ('1','1','0','0'); // R/W at PL1 only when '01' => (pr,pw,ur,uw) = ('1','1','1','1'); // R/W at any PL when '10' => (pr,pw,ur,uw) = ('1','0','0','0'); // RO at PL1 only when '11' => (pr,pw,ur,uw) = ('1','0','1','0'); // RO at any PL end; // Apply hierarchical permissions case perms.ap_table of when '00' => (pr,pw,ur,uw) = ( pr, pw, ur, uw); // No effect when '01' => (pr,pw,ur,uw) = ( pr, pw,'0','0'); // Privileged access when '10' => (pr,pw,ur,uw) = ( pr,'0', ur,'0'); // Read-only when '11' => (pr,pw,ur,uw) = ( pr,'0','0','0'); // Read-only, privileged access end; xn = perms.xn OR perms.xn_table; let pxn : bit = perms.pxn OR perms.pxn_table; let ux : bit = ur AND NOT(xn OR (uw AND walkparams.wxn)); let px : bit = pr AND NOT(xn OR pxn OR (pw AND walkparams.wxn) OR (uw AND walkparams.uwxn)); if IsFeatureImplemented(FEAT_PAN) && accdesc.pan then let pan : bit = PSTATE.PAN AND (ur OR uw); pr = pr AND NOT(pan); pw = pw AND NOT(pan); end; (r,w,x) = if accdesc.el == EL0 then (ur,uw,ux) else (pr,pw,px); // Prevent execution from Non-secure space by PE in Secure state if SIF is set if accdesc.ss == SS_Secure && paspace == PAS_NonSecure then x = x AND NOT(walkparams.sif); end; else // Apply leaf permissions case perms.ap[2] of when '0' => (r,w) = ('1','1'); // No effect when '1' => (r,w) = ('1','0'); // Read-only end; // Apply hierarchical permissions case perms.ap_table[1] of when '0' => (r,w) = ( r, w ); // No effect when '1' => (r,w) = ( r, '0'); // Read-only end; xn = perms.xn OR perms.xn_table; x = NOT(xn OR (w AND walkparams.wxn)); end; if accdesc.acctype == AccessType_IFETCH then let constraint : Constraint = ConstrainUnpredictable(Unpredictable_INSTRDEVICE); if constraint == Constraint_FAULT && memtype == MemType_Device then return TRUE; else return x == '0'; end; elsif accdesc.acctype IN {AccessType_IC, AccessType_DC} then return FALSE; elsif accdesc.write then return w == '0'; else return r == '0'; end; end;

// AArch32_S1SDHasPermissionsFault() // ================================= // Returns whether an access using stage 1 short-descriptor translation // violates permissions of target memory func AArch32_S1SDHasPermissionsFault(regime : Regime, perms_in : Permissions, memtype : MemType, paspace : PASpace, accdesc : AccessDescriptor) => boolean begin var perms : Permissions = perms_in; var pr, pw : bit; var ur, uw : bit; var sctlr : SCTLR_Type; if regime == Regime_EL30 then sctlr = SCTLR_S(); elsif HaveEL(EL3) && ELUsingAArch32(EL3) then sctlr = SCTLR_NS(); else sctlr = SCTLR(); end; if sctlr.AFE == '0' then // Map Reserved encoding '100' if perms.ap == '100' then perms.ap = ImpDefBits{3}("Reserved short descriptor AP encoding"); end; case perms.ap of when '000' => (pr,pw,ur,uw) = ('0','0','0','0'); // No access when '001' => (pr,pw,ur,uw) = ('1','1','0','0'); // R/W at PL1 only when '010' => (pr,pw,ur,uw) = ('1','1','1','0'); // R/W at PL1, RO at PL0 when '011' => (pr,pw,ur,uw) = ('1','1','1','1'); // R/W at any PL // '100' is reserved when '101' => (pr,pw,ur,uw) = ('1','0','0','0'); // RO at PL1 only when '110' => (pr,pw,ur,uw) = ('1','0','1','0'); // RO at any PL (deprecated) when '111' => (pr,pw,ur,uw) = ('1','0','1','0'); // RO at any PL end; else // Simplified access permissions model case perms.ap[2:1] of when '00' => (pr,pw,ur,uw) = ('1','1','0','0'); // R/W at PL1 only when '01' => (pr,pw,ur,uw) = ('1','1','1','1'); // R/W at any PL when '10' => (pr,pw,ur,uw) = ('1','0','0','0'); // RO at PL1 only when '11' => (pr,pw,ur,uw) = ('1','0','1','0'); // RO at any PL end; end; let ux : bit = ur AND NOT(perms.xn OR (uw AND sctlr.WXN)); let px : bit = pr AND NOT(perms.xn OR perms.pxn OR (pw AND sctlr.WXN) OR (uw AND sctlr.UWXN)); if IsFeatureImplemented(FEAT_PAN) && accdesc.pan then let pan : bit = PSTATE.PAN AND (ur OR uw); pr = pr AND NOT(pan); pw = pw AND NOT(pan); end; var (r,w,x) : (bit, bit, bit) = if accdesc.el == EL0 then (ur,uw,ux) else (pr,pw,px); // Prevent execution from Non-secure space by PE in Secure state if SIF is set if accdesc.ss == SS_Secure && paspace == PAS_NonSecure then x = x AND NOT(if ELUsingAArch32(EL3) then SCR().SIF else SCR_EL3().SIF); end; if accdesc.acctype == AccessType_IFETCH then if (memtype == MemType_Device && ConstrainUnpredictable(Unpredictable_INSTRDEVICE) == Constraint_FAULT) then return TRUE; else return x == '0'; end; elsif accdesc.acctype IN {AccessType_IC, AccessType_DC} then return FALSE; elsif accdesc.write then return w == '0'; else return r == '0'; end; end;

// AArch32_S2HasAlignmentFaultDueToMemType() // ========================================= // Returns whether stage 2 output fails alignment requirement on data accesses due to memory type func AArch32_S2HasAlignmentFaultDueToMemType(accdesc : AccessDescriptor, aligned : boolean, memattrs : MemoryAttributes) => boolean begin if memattrs.memtype != MemType_Device then return FALSE; elsif accdesc.acctype == AccessType_DCZero then return TRUE; elsif !aligned then return !(ImpDefBool("Device location supports unaligned access")); else return FALSE; end; end;

// AArch32_S2HasPermissionsFault() // =============================== // Returns whether stage 2 access violates permissions of target memory func AArch32_S2HasPermissionsFault(walkparams : S2TTWParams, perms : Permissions, memtype : MemType, accdesc : AccessDescriptor) => boolean begin let r : bit = perms.s2ap[0]; let w : bit = perms.s2ap[1]; var x : bit; var ux : bit; var px : bit; if IsFeatureImplemented(FEAT_XNX) then case perms.s2xn::perms.s2xnx of when '00' => (px, ux) = ( r, r ); when '01' => (px, ux) = ('0', r ); when '10' => (px, ux) = ('0', '0'); when '11' => (px, ux) = ( r, '0'); end; x = if accdesc.el == EL0 then ux else px; else x = r AND NOT(perms.s2xn); end; if accdesc.acctype == AccessType_TTW then return (walkparams.ptw == '1' && memtype == MemType_Device) || r == '0'; elsif accdesc.acctype == AccessType_IFETCH then let constraint : Constraint = ConstrainUnpredictable(Unpredictable_INSTRDEVICE); return (constraint == Constraint_FAULT && memtype == MemType_Device) || x == '0'; elsif accdesc.acctype IN {AccessType_IC, AccessType_DC} then return FALSE; elsif accdesc.write then return w == '0'; else return r == '0'; end; end;

// AArch32_S2InconsistentSL() // ========================== // Detect inconsistent configuration of stage 2 T0SZ and SL fields func AArch32_S2InconsistentSL(walkparams : S2TTWParams) => boolean begin let startlevel : integer = AArch32_S2StartLevel(walkparams.sl0); let levels : integer = FINAL_LEVEL - startlevel; let granulebits : AddressSize = TGxGranuleBits(walkparams.tgx); let stride : integer{} = granulebits - 3; // Input address size must at least be large enough to be resolved from the start level let sl_min_iasize : integer = ( levels * stride // Bits resolved by table walk, except initial level + granulebits // Bits directly mapped to output address + 1); // At least 1 more bit to be decoded by initial level // Can accommodate 1 more stride in the level + concatenation of up to 2^4 tables let sl_max_iasize : integer = sl_min_iasize + (stride-1) + 4; // Configured Input Address size let iasize : AddressSize = AArch32_S2IASize(walkparams.t0sz); return iasize < sl_min_iasize || iasize > sl_max_iasize; end;

// AArch32_VAIsOutOfRange() // ======================== // Check virtual address bits not resolved by translation are identical // and of accepted value func AArch32_VAIsOutOfRange(regime : Regime, walkparams : S1TTWParams, va : bits(32)) => boolean begin if regime == Regime_EL2 then // Input Address size let iasize : integer{} = AArch32_S1IASize(walkparams.t0sz); return walkparams.t0sz != '000' && !IsZero(va[31:iasize]); elsif walkparams.t1sz != '000' && walkparams.t0sz != '000' then // Lower range Input Address size let lo_iasize : integer{} = AArch32_S1IASize(walkparams.t0sz); // Upper range Input Address size let up_iasize : integer{} = AArch32_S1IASize(walkparams.t1sz); return !IsZero(va[31:lo_iasize]) && !IsOnes(va[31:up_iasize]); else return FALSE; end; end;

// AArch32_GetS1TLBContext() // ========================= // Gather translation context for accesses with VA to match against TLB entries func AArch32_GetS1TLBContext(regime : Regime, ss : SecurityState, va : bits(32)) => TLBContext begin var tlbcontext : TLBContext; case regime of when Regime_EL2 => tlbcontext = AArch32_TLBContextEL2(va); when Regime_EL10 => tlbcontext = AArch32_TLBContextEL10(ss, va); when Regime_EL30 => tlbcontext = AArch32_TLBContextEL30(va); end; tlbcontext.includes_s1 = TRUE; // The following may be amended for EL1&0 Regime if caching of stage 2 is successful tlbcontext.includes_s2 = FALSE; return tlbcontext; end;

// AArch32_GetS2TLBContext() // ========================= // Gather translation context for accesses with IPA to match against TLB entries func AArch32_GetS2TLBContext(ipa : FullAddress) => TLBContext begin assert ipa.paspace == PAS_NonSecure; var tlbcontext : TLBContext; tlbcontext.ss = SS_NonSecure; tlbcontext.regime = Regime_EL10; tlbcontext.ipaspace = ipa.paspace; tlbcontext.vmid = ZeroExtend{NUM_VMIDBITS}(VTTBR().VMID); tlbcontext.tg = TGx_4KB; tlbcontext.includes_s1 = FALSE; tlbcontext.includes_s2 = TRUE; tlbcontext.ia = ZeroExtend{64}(ipa.address); tlbcontext.cnp = if IsFeatureImplemented(FEAT_TTCNP) then VTTBR().CnP else '0'; return tlbcontext; end;

// AArch32_TLBContextEL10() // ======================== // Gather translation context for accesses under EL10 regime // (PL10 when EL3 is A64) to match against TLB entries func AArch32_TLBContextEL10(ss : SecurityState, va : bits(32)) => TLBContext begin var tlbcontext : TLBContext; var ttbcr : TTBCR_Type; var ttbr0 : TTBR0_Type; var ttbr1 : TTBR1_Type; var contextidr : CONTEXTIDR_Type; if HaveEL(EL3) && ELUsingAArch32(EL3) then ttbcr = TTBCR_NS(); ttbr0 = TTBR0_NS(); ttbr1 = TTBR1_NS(); contextidr = CONTEXTIDR_NS(); else ttbcr = TTBCR(); ttbr0 = TTBR0(); ttbr1 = TTBR1(); contextidr = CONTEXTIDR(); end; tlbcontext.ss = ss; tlbcontext.regime = Regime_EL10; if AArch32_EL2Enabled(ss) then tlbcontext.vmid = ZeroExtend{NUM_VMIDBITS}(VTTBR().VMID); end; if ttbcr.EAE == '1' then if ttbcr.A1 == '0' then tlbcontext.asid = ZeroExtend{NUM_ASIDBITS}(ttbr0.ASID); else tlbcontext.asid = ZeroExtend{NUM_ASIDBITS}(ttbr1.ASID); end; else tlbcontext.asid = ZeroExtend{NUM_ASIDBITS}(contextidr.ASID); end; tlbcontext.tg = TGx_4KB; tlbcontext.ia = ZeroExtend{64}(va); if IsFeatureImplemented(FEAT_TTCNP) && ttbcr.EAE == '1' then if AArch32_GetVARange(va, ttbcr.T0SZ, ttbcr.T1SZ) == VARange_LOWER then tlbcontext.cnp = ttbr0.CnP; else tlbcontext.cnp = ttbr1.CnP; end; else tlbcontext.cnp = '0'; end; return tlbcontext; end;

// AArch32_TLBContextEL2() // ======================= // Gather translation context for accesses under EL2 regime to match against TLB entries func AArch32_TLBContextEL2(va : bits(32)) => TLBContext begin var tlbcontext : TLBContext; tlbcontext.ss = SS_NonSecure; tlbcontext.regime = Regime_EL2; tlbcontext.ia = ZeroExtend{64}(va); tlbcontext.tg = TGx_4KB; tlbcontext.cnp = if IsFeatureImplemented(FEAT_TTCNP) then HTTBR().CnP else '0'; return tlbcontext; end;

// AArch32_TLBContextEL30() // ======================== // Gather translation context for accesses under EL30 regime // (PL10 in Secure state and EL3 is A32) to match against TLB entries func AArch32_TLBContextEL30(va : bits(32)) => TLBContext begin var tlbcontext : TLBContext; tlbcontext.ss = SS_Secure; tlbcontext.regime = Regime_EL30; if TTBCR_S().EAE == '1' then tlbcontext.asid = ZeroExtend{NUM_ASIDBITS}(if TTBCR_S().A1 == '0' then TTBR0_S().ASID else TTBR1_S().ASID); else tlbcontext.asid = ZeroExtend{NUM_ASIDBITS}(CONTEXTIDR_S().ASID); end; tlbcontext.tg = TGx_4KB; tlbcontext.ia = ZeroExtend{64}(va); if IsFeatureImplemented(FEAT_TTCNP) && TTBCR_S().EAE == '1' then if AArch32_GetVARange(va, TTBCR_S().T0SZ, TTBCR_S().T1SZ) == VARange_LOWER then tlbcontext.cnp = TTBR0_S().CnP; else tlbcontext.cnp = TTBR1_S().CnP; end; else tlbcontext.cnp = '0'; end; return tlbcontext; end;

// AArch32_EL2Enabled() // ==================== // Returns whether EL2 is enabled for the given Security State func AArch32_EL2Enabled(ss : SecurityState) => boolean begin if ss == SS_Secure then if !(HaveEL(EL2) && IsFeatureImplemented(FEAT_SEL2)) then return FALSE; elsif HaveEL(EL3) then return SCR_EL3().EEL2 == '1'; else return ImpDefBool("Secure-only implementation"); end; else return HaveEL(EL2); end; end;

// AArch32_FullTranslate() // ======================= // Perform address translation as specified by VMSA-A32 func AArch32_FullTranslate(va : bits(32), accdesc : AccessDescriptor, aligned : boolean) => AddressDescriptor begin // Prepare fault fields in case a fault is detected var fault : FaultRecord = NoFault(accdesc, ZeroExtend{64}(va)); let regime : Regime = TranslationRegime(accdesc.el); // First Stage Translation var ipa : AddressDescriptor; if regime == Regime_EL2 || TTBCR().EAE == '1' then (fault, ipa) = AArch32_S1TranslateLD(fault, regime, va, aligned, accdesc); else (fault, ipa, -) = AArch32_S1TranslateSD(fault, regime, va, aligned, accdesc); end; if fault.statuscode != Fault_None then return CreateFaultyAddressDescriptor(fault); end; if regime == Regime_EL10 && EL2Enabled() then ipa.vaddress = ZeroExtend{64}(va); var pa : AddressDescriptor; (fault, pa) = AArch32_S2Translate(fault, ipa, aligned, accdesc); if fault.statuscode != Fault_None then return CreateFaultyAddressDescriptor(fault); else return pa; end; else return ipa; end; end;

// AArch32_OutputDomain() // ====================== // Determine the domain the translated output address func AArch32_OutputDomain(regime : Regime, domain : bits(4)) => bits(2) begin var Dn : bits(2); if regime == Regime_EL30 then Dn = DACR_S()[UInt(domain)*:2]; elsif HaveEL(EL3) && ELUsingAArch32(EL3) then Dn = DACR_NS()[UInt(domain)*:2]; else Dn = DACR()[UInt(domain)*:2]; end; if Dn == '10' then // Reserved value maps to an allocated value (-, Dn) = ConstrainUnpredictableBits{2}(Unpredictable_RESDACR); end; return Dn; end;

// AArch32_S1DisabledOutput() // ========================== // Flat map the VA to IPA/PA, depending on the regime, assigning default memory attributes func AArch32_S1DisabledOutput(fault_in : FaultRecord, regime : Regime, va : bits(32), aligned : boolean, accdesc : AccessDescriptor) => (FaultRecord, AddressDescriptor) begin var fault : FaultRecord = fault_in; // No memory page is guarded when stage 1 address translation is disabled SetInGuardedPage(FALSE); var memattrs : MemoryAttributes; var default_cacheable : bit; if regime == Regime_EL10 && AArch32_EL2Enabled(accdesc.ss) then if ELStateUsingAArch32(EL2, accdesc.ss == SS_Secure) then default_cacheable = HCR().DC; else default_cacheable = HCR_EL2().DC; end; else default_cacheable = '0'; end; if default_cacheable == '1' then // Use default cacheable settings memattrs.memtype = MemType_Normal; memattrs.inner.attrs = MemAttr_WB; memattrs.inner.hints = MemHint_RWA; memattrs.outer.attrs = MemAttr_WB; memattrs.outer.hints = MemHint_RWA; memattrs.shareability = Shareability_NSH; if (EL2Enabled() && !ELStateUsingAArch32(EL2, accdesc.ss == SS_Secure) && IsFeatureImplemented(FEAT_MTE2) && HCR_EL2().DCT == '1') then memattrs.tags = MemTag_AllocationTagged; else memattrs.tags = MemTag_Untagged; end; memattrs.xs = '0'; elsif accdesc.acctype == AccessType_IFETCH then memattrs.memtype = MemType_Normal; memattrs.shareability = Shareability_OSH; memattrs.tags = MemTag_Untagged; if AArch32_S1ICacheEnabled(regime) then memattrs.inner.attrs = MemAttr_WT; memattrs.inner.hints = MemHint_RA; memattrs.outer.attrs = MemAttr_WT; memattrs.outer.hints = MemHint_RA; else memattrs.inner.attrs = MemAttr_NC; memattrs.outer.attrs = MemAttr_NC; end; memattrs.xs = '1'; else // Treat memory region as Device memattrs.memtype = MemType_Device; memattrs.device = DeviceType_nGnRnE; memattrs.shareability = Shareability_OSH; memattrs.tags = MemTag_Untagged; memattrs.xs = '1'; end; var ntlsmd : bit; if IsFeatureImplemented(FEAT_LSMAOC) then case regime of when Regime_EL30 => ntlsmd = SCTLR_S().nTLSMD; when Regime_EL2 => ntlsmd = HSCTLR().nTLSMD; when Regime_EL10 => if HaveEL(EL3) && ELUsingAArch32(EL3) then ntlsmd = SCTLR_NS().nTLSMD; else ntlsmd = SCTLR().nTLSMD; end; end; else ntlsmd = '1'; end; if AArch32_S1HasAlignmentFaultDueToMemType(accdesc, aligned, ntlsmd, memattrs) then fault.statuscode = Fault_Alignment; return (fault, ARBITRARY : AddressDescriptor); elsif (accdesc.exclusive && !(regime == Regime_EL10 && EL2Enabled() && ((!ELUsingAArch32(EL2) && HCR_EL2().DC == '1') || (ELUsingAArch32(EL2) && HCR().DC == '1'))) && ConstrainUnpredictableBool(Unpredictable_Atomic_MMU_IMPDEF_FAULT)) then fault.statuscode = Fault_Exclusive; end; var oa : FullAddress; oa.address = ZeroExtend{NUM_PABITS}(va); oa.paspace = if accdesc.ss == SS_Secure then PAS_Secure else PAS_NonSecure; let ipa : AddressDescriptor = CreateAddressDescriptor(ZeroExtend{64}(va), oa, memattrs, accdesc); return (fault, ipa); end;

// AArch32_S1Enabled() // =================== // Returns whether stage 1 translation is enabled for the active translation regime func AArch32_S1Enabled(regime : Regime, ss : SecurityState) => boolean begin if regime == Regime_EL2 then return HSCTLR().M == '1'; elsif regime == Regime_EL30 then return SCTLR_S().M == '1'; elsif !AArch32_EL2Enabled(ss) then return (if HaveEL(EL3) && ELUsingAArch32(EL3) then SCTLR_NS().M else SCTLR().M) == '1'; elsif ELStateUsingAArch32(EL2, ss == SS_Secure) then if HaveEL(EL3) && ELUsingAArch32(EL3) then return HCR().[TGE,DC] == '00' && SCTLR_NS().M == '1'; else return HCR().[TGE,DC] == '00' && SCTLR().M == '1'; end; else return EL2Enabled() && HCR_EL2().[TGE,DC] == '00' && SCTLR().M == '1'; end; end;

// AArch32_S1TranslateLD() // ======================= // Perform a stage 1 translation using long-descriptor format mapping VA to IPA/PA // depending on the regime func AArch32_S1TranslateLD(fault_in : FaultRecord, regime : Regime, va : bits(32), aligned : boolean, accdesc : AccessDescriptor) => (FaultRecord, AddressDescriptor) begin var fault : FaultRecord = fault_in; if !AArch32_S1Enabled(regime, accdesc.ss) then return AArch32_S1DisabledOutput(fault, regime, va, aligned, accdesc); end; let walkparams : S1TTWParams = AArch32_GetS1TTWParams(regime, va); if AArch32_VAIsOutOfRange(regime, walkparams, va) then fault.level = 1; fault.statuscode = Fault_Translation; return (fault, ARBITRARY : AddressDescriptor); end; var walkstate : TTWState; (fault, walkstate) = AArch32_S1WalkLD(fault, regime, walkparams, accdesc, va); if fault.statuscode != Fault_None then return (fault, ARBITRARY : AddressDescriptor); end; SetInGuardedPage(FALSE); // AArch32-VMSA does not guard any pages if AArch32_S1HasAlignmentFaultDueToMemType(accdesc, aligned, walkparams.ntlsmd, walkstate.memattrs) then fault.statuscode = Fault_Alignment; elsif AArch32_S1LDHasPermissionsFault(regime, walkparams, walkstate.permissions, walkstate.memattrs.memtype, walkstate.baseaddress.paspace, accdesc) then fault.statuscode = Fault_Permission; end; if fault.statuscode != Fault_None then return (fault, ARBITRARY : AddressDescriptor); end; var memattrs : MemoryAttributes; if ((accdesc.acctype == AccessType_IFETCH && (walkstate.memattrs.memtype == MemType_Device || !AArch32_S1ICacheEnabled(regime))) || (accdesc.acctype != AccessType_IFETCH && walkstate.memattrs.memtype == MemType_Normal && !AArch32_S1DCacheEnabled(regime))) then // Treat memory attributes as Normal Non-Cacheable memattrs = NormalNCMemAttr(); memattrs.xs = walkstate.memattrs.xs; else memattrs = walkstate.memattrs; end; // Shareability value of stage 1 translation subject to stage 2 is IMPLEMENTATION DEFINED // to be either effective value or descriptor value if (regime == Regime_EL10 && AArch32_EL2Enabled(accdesc.ss) && (if ELStateUsingAArch32(EL2, accdesc.ss==SS_Secure) then HCR().VM else HCR_EL2().VM) == '1' && !(ImpDefBool("Apply effective shareability at stage 1"))) then memattrs.shareability = walkstate.memattrs.shareability; else memattrs.shareability = EffectiveShareability(memattrs); end; // Output Address let oa : FullAddress = StageOA(ZeroExtend{64}(va), walkparams.d128, walkparams.tgx, walkstate); let ipa : AddressDescriptor = CreateAddressDescriptor(ZeroExtend{64}(va), oa, memattrs, accdesc); return (fault, ipa); end;

// AArch32_S1TranslateSD() // ======================= // Perform a stage 1 translation using short-descriptor format mapping VA to IPA/PA // depending on the regime func AArch32_S1TranslateSD(fault_in : FaultRecord, regime : Regime, va : bits(32), aligned : boolean, accdesc : AccessDescriptor) => (FaultRecord, AddressDescriptor, SDFType) begin var fault : FaultRecord = fault_in; if !AArch32_S1Enabled(regime, accdesc.ss) then var ipa : AddressDescriptor; (fault, ipa) = AArch32_S1DisabledOutput(fault, regime, va, aligned, accdesc); return (fault, ipa, ARBITRARY : SDFType); end; var walkstate : TTWState; (fault, walkstate) = AArch32_S1WalkSD(fault, regime, accdesc, va); if fault.statuscode != Fault_None then return (fault, ARBITRARY : AddressDescriptor, ARBITRARY : SDFType); end; let domain : bits(2) = AArch32_OutputDomain(regime, walkstate.domain); SetInGuardedPage(FALSE); // AArch32-VMSA does not guard any pages var ntlsmd : bit; if IsFeatureImplemented(FEAT_LSMAOC) then case regime of when Regime_EL30 => ntlsmd = SCTLR_S().nTLSMD; when Regime_EL10 => if HaveEL(EL3) && ELUsingAArch32(EL3) then ntlsmd = SCTLR_NS().nTLSMD; else ntlsmd = SCTLR().nTLSMD; end; end; else ntlsmd = '1'; end; if AArch32_S1HasAlignmentFaultDueToMemType(accdesc, aligned, ntlsmd, walkstate.memattrs) then fault.statuscode = Fault_Alignment; elsif (! accdesc.acctype IN {AccessType_IC, AccessType_DC} && domain == Domain_NoAccess) then fault.statuscode = Fault_Domain; elsif domain == Domain_Client then if AArch32_S1SDHasPermissionsFault(regime, walkstate.permissions, walkstate.memattrs.memtype, walkstate.baseaddress.paspace, accdesc) then fault.statuscode = Fault_Permission; end; end; if fault.statuscode != Fault_None then fault.domain = walkstate.domain; return (fault, ARBITRARY : AddressDescriptor, walkstate.sdftype); end; var memattrs : MemoryAttributes; if ((accdesc.acctype == AccessType_IFETCH && (walkstate.memattrs.memtype == MemType_Device || !AArch32_S1ICacheEnabled(regime))) || (accdesc.acctype != AccessType_IFETCH && walkstate.memattrs.memtype == MemType_Normal && !AArch32_S1DCacheEnabled(regime))) then // Treat memory attributes as Normal Non-Cacheable memattrs = NormalNCMemAttr(); memattrs.xs = walkstate.memattrs.xs; else memattrs = walkstate.memattrs; end; // Shareability value of stage 1 translation subject to stage 2 is IMPLEMENTATION DEFINED // to be either effective value or descriptor value if (regime == Regime_EL10 && AArch32_EL2Enabled(accdesc.ss) && (if ELStateUsingAArch32(EL2, accdesc.ss==SS_Secure) then HCR().VM else HCR_EL2().VM) == '1' && !(ImpDefBool("Apply effective shareability at stage 1"))) then memattrs.shareability = walkstate.memattrs.shareability; else memattrs.shareability = EffectiveShareability(memattrs); end; // Output Address let oa : FullAddress = AArch32_SDStageOA(walkstate.baseaddress, va, walkstate.sdftype); let ipa : AddressDescriptor = CreateAddressDescriptor(ZeroExtend{64}(va), oa, memattrs, accdesc); return (fault, ipa, walkstate.sdftype); end;

// AArch32_S2Translate() // ===================== // Perform a stage 2 translation mapping an IPA to a PA func AArch32_S2Translate(fault_in : FaultRecord, ipa : AddressDescriptor, aligned : boolean, accdesc : AccessDescriptor ) => (FaultRecord, AddressDescriptor) begin var fault : FaultRecord = fault_in; assert IsZero(ipa.paddress.address[NUM_PABITS-1:40]); if !ELStateUsingAArch32(EL2, accdesc.ss == SS_Secure) then let s1aarch64 : boolean = FALSE; return AArch64_S2Translate(fault, ipa, s1aarch64, aligned, accdesc); end; // Prepare fault fields in case a fault is detected fault.statuscode = Fault_None; fault.secondstage = TRUE; fault.s2fs1walk = accdesc.acctype == AccessType_TTW; fault.ipaddress = ipa.paddress; let walkparams : S2TTWParams = AArch32_GetS2TTWParams(); if walkparams.vm == '0' then // Stage 2 is disabled return (fault, ipa); end; if AArch32_IPAIsOutOfRange(walkparams, ipa.paddress.address[39:0]) then fault.statuscode = Fault_Translation; fault.level = 1; return (fault, ARBITRARY : AddressDescriptor); end; var walkstate : TTWState; (fault, walkstate) = AArch32_S2Walk(fault, walkparams, accdesc, ipa); if fault.statuscode != Fault_None then return (fault, ARBITRARY : AddressDescriptor); end; if AArch32_S2HasAlignmentFaultDueToMemType(accdesc, aligned, walkstate.memattrs) then fault.statuscode = Fault_Alignment; elsif AArch32_S2HasPermissionsFault(walkparams, walkstate.permissions, walkstate.memattrs.memtype, accdesc) then fault.statuscode = Fault_Permission; end; var s2_memattrs : MemoryAttributes; if ((accdesc.acctype == AccessType_TTW && walkstate.memattrs.memtype == MemType_Device) || (accdesc.acctype == AccessType_IFETCH && (walkstate.memattrs.memtype == MemType_Device || HCR2().ID == '1')) || (accdesc.acctype != AccessType_IFETCH && walkstate.memattrs.memtype == MemType_Normal && HCR2().CD == '1')) then // Treat memory attributes as Normal Non-Cacheable s2_memattrs = NormalNCMemAttr(); s2_memattrs.xs = walkstate.memattrs.xs; else s2_memattrs = walkstate.memattrs; end; let s2aarch64 : boolean = FALSE; let memattrs : MemoryAttributes = S2CombineS1MemAttrs(ipa.memattrs, s2_memattrs, s2aarch64); let ipa_64 : bits(64) = ZeroExtend{}(ipa.paddress.address[39:0]); // Output Address let oa : FullAddress = StageOA(ipa_64, walkparams.d128, walkparams.tgx, walkstate); let pa : AddressDescriptor = CreateAddressDescriptor(ipa.vaddress, oa, memattrs, accdesc); return (fault, pa); end;

// AArch32_SDStageOA() // =================== // Given the final walk state of a short-descriptor translation walk, // map the untranslated input address bits to the base output address func AArch32_SDStageOA(baseaddress : FullAddress, va : bits(32), sdftype : SDFType) => FullAddress begin let tsize : integer{} = SDFSize(sdftype); // Output Address var oa : FullAddress; oa.address = baseaddress.address[NUM_PABITS-1:tsize] :: va[tsize-1:0]; oa.paspace = baseaddress.paspace; return oa; end;

// AArch32_TranslateAddress() // ========================== // Main entry point for translating an address func AArch32_TranslateAddress(va : bits(32), accdesc : AccessDescriptor, aligned : boolean, size : integer) => AddressDescriptor begin let regime : Regime = TranslationRegime(PSTATE.EL); if !RegimeUsingAArch32(regime) then return AArch64_TranslateAddress(ZeroExtend{64}(va), accdesc, aligned, size); end; var result : AddressDescriptor = AArch32_FullTranslate(va, accdesc, aligned); if !IsFault(result) && accdesc.acctype != AccessType_IFETCH then // For an instruction fetch, CheckDebug will be called // after the instruction is read from memory result.fault = AArch32_CheckDebug(va, accdesc, size); end; // Update virtual address for abort functions result.vaddress = ZeroExtend{64}(va); return result; end;

// SDFSize() // ========= // Returns the short-descriptor format translation granule size func SDFSize(sdftype : SDFType) => AddressSize begin case sdftype of when SDFType_SmallPage => return 12; when SDFType_LargePage => return 16; when SDFType_Section => return 20; when SDFType_Supersection => return 24; otherwise => unreachable; end; end;

// AArch32_DecodeDescriptorTypeLD() // ================================ // Determine whether the long-descriptor is a page, block or table func AArch32_DecodeDescriptorTypeLD(descriptor : bits(64), level : integer) => DescriptorType begin if descriptor[1:0] == '11' && level == FINAL_LEVEL then return DescriptorType_Leaf; elsif descriptor[1:0] == '11' then return DescriptorType_Table; elsif descriptor[1:0] == '01' && level != FINAL_LEVEL then return DescriptorType_Leaf; else return DescriptorType_Invalid; end; end;

// AArch32_DecodeDescriptorTypeSD() // ================================ // Determine the type of the short-descriptor func AArch32_DecodeDescriptorTypeSD(descriptor : bits(32), level : integer) => SDFType begin if level == 1 && descriptor[1:0] == '01' then return SDFType_Table; elsif level == 1 && descriptor[18,1] == '01' then return SDFType_Section; elsif level == 1 && descriptor[18,1] == '11' then return SDFType_Supersection; elsif level == 2 && descriptor[1:0] == '01' then return SDFType_LargePage; elsif level == 2 && descriptor[1:0] == '1x' then return SDFType_SmallPage; else return SDFType_Invalid; end; end;

// AArch32_S1IASize() // ================== // Retrieve the number of bits containing the input address for stage 1 translation func AArch32_S1IASize(txsz : bits(3)) => AddressSize begin return 32 - UInt(txsz); end;

// AArch32_S1WalkLD() // ================== // Traverse stage 1 translation tables in long format to obtain the final descriptor func AArch32_S1WalkLD(fault_in : FaultRecord, regime : Regime, walkparams : S1TTWParams, accdesc : AccessDescriptor, va : bits(32)) => (FaultRecord, TTWState) begin var fault : FaultRecord = fault_in; var txsz : bits(3); var ttbr : bits(64); var epd : bit; var varange : VARange; if regime == Regime_EL2 then ttbr = HTTBR(); txsz = walkparams.t0sz; varange = VARange_LOWER; else varange = AArch32_GetVARange(va, walkparams.t0sz, walkparams.t1sz); var ttbr0 : bits(64); var ttbr1 : bits(64); var ttbcr : TTBCR_Type; if regime == Regime_EL30 then ttbcr = TTBCR_S(); ttbr0 = TTBR0_S(); ttbr1 = TTBR1_S(); elsif HaveEL(EL3) && ELUsingAArch32(EL3) then ttbcr = TTBCR_NS(); ttbr0 = TTBR0_NS(); ttbr1 = TTBR1_NS(); else ttbcr = TTBCR(); ttbr0 = TTBR0(); ttbr1 = TTBR1(); end; assert ttbcr.EAE == '1'; if varange == VARange_LOWER then txsz = walkparams.t0sz; ttbr = ttbr0; epd = ttbcr.EPD0; else txsz = walkparams.t1sz; ttbr = ttbr1; epd = ttbcr.EPD1; end; end; if regime != Regime_EL2 && epd == '1' then fault.level = 1; fault.statuscode = Fault_Translation; return (fault, ARBITRARY : TTWState); end; // Input Address size let iasize : AddressSize = AArch32_S1IASize(txsz); let granulebits : integer{} = TGxGranuleBits(walkparams.tgx) as integer{12, 14, 16}; let stride : integer{} = granulebits - 3; let startlevel : integer = FINAL_LEVEL - (((iasize-1) - granulebits) DIVRM stride); let levels : integer = FINAL_LEVEL - startlevel; if !IsZero(ttbr[47:40]) then fault.statuscode = Fault_AddressSize; fault.level = 0; return (fault, ARBITRARY : TTWState); end; var baseaddress : FullAddress; let baselsb = ((iasize - (levels*stride + granulebits)) + 3) as AddressSize; baseaddress.paspace = if accdesc.ss == SS_Secure then PAS_Secure else PAS_NonSecure; baseaddress.address = ZeroExtend{NUM_PABITS}(ttbr[39:baselsb]::Zeros{baselsb}); var walkstate : TTWState; walkstate.baseaddress = baseaddress; walkstate.level = startlevel; walkstate.istable = TRUE; // In regimes that support global and non-global translations, translation // table entries from lookup levels other than the final level of lookup // are treated as being non-global walkstate.nG = if HasUnprivileged(regime) then '1' else '0'; walkstate.memattrs = WalkMemAttrs(walkparams.sh, walkparams.irgn, walkparams.orgn); walkstate.permissions.ap_table = '00'; walkstate.permissions.xn_table = '0'; walkstate.permissions.pxn_table = '0'; var descriptor : bits(64); var walkaddress : AddressDescriptor; walkaddress.vaddress = ZeroExtend{64}(va); if !AArch32_S1DCacheEnabled(regime) then walkaddress.memattrs = NormalNCMemAttr(); walkaddress.memattrs.xs = walkstate.memattrs.xs; else walkaddress.memattrs = walkstate.memattrs; end; // Shareability value of stage 1 translation subject to stage 2 is IMPLEMENTATION DEFINED // to be either effective value or descriptor value if (regime == Regime_EL10 && AArch32_EL2Enabled(accdesc.ss) && (if ELStateUsingAArch32(EL2, accdesc.ss==SS_Secure) then HCR().VM else HCR_EL2().VM) == '1' && !(ImpDefBool("Apply effective shareability at stage 1"))) then walkaddress.memattrs.shareability = walkstate.memattrs.shareability; else walkaddress.memattrs.shareability = EffectiveShareability(walkaddress.memattrs); end; var desctype : DescriptorType; var msb_residual : integer = iasize - 1; repeat fault.level = walkstate.level; let indexlsb = ((FINAL_LEVEL - walkstate.level)*stride + granulebits) as AddressSize; let indexmsb = msb_residual as AddressSize; let index : bits(40) = ZeroExtend{}(va[indexmsb:indexlsb]::'000'); walkaddress.paddress.address = (walkstate.baseaddress.address OR ZeroExtend{NUM_PABITS}(index)); walkaddress.paddress.paspace = walkstate.baseaddress.paspace; let toplevel : boolean = walkstate.level == startlevel; let walkaccess : AccessDescriptor = CreateAccDescS1TTW(toplevel, varange, accdesc); // If there are two stages of translation, then the first stage table walk addresses // are themselves subject to translation if regime == Regime_EL10 && AArch32_EL2Enabled(accdesc.ss) then let s2aligned : boolean = TRUE; let (s2fault, s2walkaddress) = AArch32_S2Translate(fault, walkaddress, s2aligned, walkaccess); // Check for a fault on the stage 2 walk if s2fault.statuscode != Fault_None then return (s2fault, ARBITRARY : TTWState); end; (fault, descriptor) = FetchDescriptor{64}(walkparams.ee, s2walkaddress, walkaccess, fault); else (fault, descriptor) = FetchDescriptor{64}(walkparams.ee, walkaddress, walkaccess, fault); end; if fault.statuscode != Fault_None then return (fault, ARBITRARY : TTWState); end; desctype = AArch32_DecodeDescriptorTypeLD(descriptor, walkstate.level); case desctype of when DescriptorType_Table => if !IsZero(descriptor[47:40]) then fault.statuscode = Fault_AddressSize; return (fault, ARBITRARY : TTWState); end; walkstate.baseaddress.address = ZeroExtend{NUM_PABITS}(descriptor[39:12]:: Zeros{12}); if walkstate.baseaddress.paspace == PAS_Secure && descriptor[63] == '1' then walkstate.baseaddress.paspace = PAS_NonSecure; end; if walkparams.hpd == '0' then walkstate.permissions.xn_table = (walkstate.permissions.xn_table OR descriptor[60]); walkstate.permissions.ap_table = (walkstate.permissions.ap_table OR descriptor[62:61]); walkstate.permissions.pxn_table = (walkstate.permissions.pxn_table OR descriptor[59]); end; walkstate.level = walkstate.level + 1; msb_residual = indexlsb - 1; when DescriptorType_Invalid => fault.statuscode = Fault_Translation; return (fault, ARBITRARY : TTWState); when DescriptorType_Leaf => walkstate.istable = FALSE; end; until desctype == DescriptorType_Leaf looplimit 3; // Check the output address is inside the supported range if !IsZero(descriptor[47:40]) then fault.statuscode = Fault_AddressSize; return (fault, ARBITRARY : TTWState); end; // Check the access flag if descriptor[10] == '0' then fault.statuscode = Fault_AccessFlag; return (fault, ARBITRARY : TTWState); end; walkstate.permissions.xn = descriptor[54]; walkstate.permissions.pxn = descriptor[53]; walkstate.permissions.ap = descriptor[7:6]::'1'; walkstate.contiguous = descriptor[52]; if regime == Regime_EL2 then // All EL2 regime accesses are treated as Global walkstate.nG = '0'; elsif accdesc.ss == SS_Secure && walkstate.baseaddress.paspace == PAS_NonSecure then // When a PE is using the Long-descriptor translation table format, // and is in Secure state, a translation must be treated as non-global, // regardless of the value of the nG bit, // if NSTable is set to 1 at any level of the translation table walk. walkstate.nG = '1'; else walkstate.nG = descriptor[11]; end; let indexlsb = ((FINAL_LEVEL - walkstate.level)*stride + granulebits) as AddressSize; walkstate.baseaddress.address = ZeroExtend{NUM_PABITS}(descriptor[39:indexlsb]:: Zeros{indexlsb}); if walkstate.baseaddress.paspace == PAS_Secure && descriptor[5] == '1' then walkstate.baseaddress.paspace = PAS_NonSecure; end; let memattr : bits(3) = descriptor[4:2]; let sh : bits(2) = descriptor[9:8]; let attr : bits(8) = AArch32_MAIRAttr(UInt(memattr), walkparams.mair); let s1aarch64 : boolean = FALSE; walkstate.memattrs = S1DecodeMemAttrs(attr, sh, s1aarch64); return (fault, walkstate); end;

// AArch32_S1WalkSD() // ================== // Traverse stage 1 translation tables in short format to obtain the final descriptor func AArch32_S1WalkSD(fault_in : FaultRecord, regime : Regime, accdesc : AccessDescriptor, va : bits(32)) => (FaultRecord, TTWState) begin var fault : FaultRecord = fault_in; var sctlr : SCTLR_Type; var ttbcr : TTBCR_Type; var ttbr0 : TTBR0_Type; var ttbr1 : TTBR1_Type; // Determine correct translation control registers to use. if regime == Regime_EL30 then sctlr = SCTLR_S(); ttbcr = TTBCR_S(); ttbr0 = TTBR0_S(); ttbr1 = TTBR1_S(); elsif HaveEL(EL3) && ELUsingAArch32(EL3) then sctlr = SCTLR_NS(); ttbcr = TTBCR_NS(); ttbr0 = TTBR0_NS(); ttbr1 = TTBR1_NS(); else sctlr = SCTLR(); ttbcr = TTBCR(); ttbr0 = TTBR0(); ttbr1 = TTBR1(); end; assert ttbcr.EAE == '0'; let ee : bit = sctlr.EE; let afe : bit = sctlr.AFE; let tre : bit = sctlr.TRE; let ttbcr_n : integer{} = UInt(ttbcr.N); let varange : VARange = (if ttbcr_n == 0 || IsZero(va[31:(32-ttbcr_n)]) then VARange_LOWER else VARange_UPPER); let n : integer{} = if varange == VARange_LOWER then ttbcr_n else 0; var ttb : bits(32); var pd : bits(1); var irgn : bits(2); var rgn : bits(2); var s : bits(1); var nos : bits(1); if varange == VARange_LOWER then ttb = ttbr0.TTB0::Zeros{7}; pd = ttbcr.PD0; irgn = ttbr0.IRGN; rgn = ttbr0.RGN; s = ttbr0.S; nos = ttbr0.NOS; else ttb = ttbr1.TTB1::Zeros{7}; pd = ttbcr.PD1; irgn = ttbr1.IRGN; rgn = ttbr1.RGN; s = ttbr1.S; nos = ttbr1.NOS; end; // Check if Translation table walk disabled for translations with this Base register. if pd == '1' then fault.level = 1; fault.statuscode = Fault_Translation; return (fault, ARBITRARY : TTWState); end; var baseaddress : FullAddress; baseaddress.paspace = if accdesc.ss == SS_Secure then PAS_Secure else PAS_NonSecure; baseaddress.address = ZeroExtend{NUM_PABITS}(ttb[31:14-n]::Zeros{14-n}); let startlevel : integer = 1; var walkstate : TTWState; walkstate.baseaddress = baseaddress; // In regimes that support global and non-global translations, translation // table entries from lookup levels other than the final level of lookup // are treated as being non-global. Translations in Short-Descriptor Format // always support global & non-global translations. walkstate.nG = '1'; walkstate.memattrs = WalkMemAttrs(s::nos, irgn, rgn); walkstate.level = startlevel; walkstate.istable = TRUE; var domain : bits(4); var descriptor : bits(32); var walkaddress : AddressDescriptor; walkaddress.vaddress = ZeroExtend{64}(va); if !AArch32_S1DCacheEnabled(regime) then walkaddress.memattrs = NormalNCMemAttr(); walkaddress.memattrs.xs = walkstate.memattrs.xs; else walkaddress.memattrs = walkstate.memattrs; end; // Shareability value of stage 1 translation subject to stage 2 is IMPLEMENTATION DEFINED // to be either effective value or descriptor value if (regime == Regime_EL10 && AArch32_EL2Enabled(accdesc.ss) && (if ELStateUsingAArch32(EL2, accdesc.ss==SS_Secure) then HCR().VM else HCR_EL2().VM) == '1' && !(ImpDefBool("Apply effective shareability at stage 1"))) then walkaddress.memattrs.shareability = walkstate.memattrs.shareability; else walkaddress.memattrs.shareability = EffectiveShareability(walkaddress.memattrs); end; var nG : bit; var ns : bit; var pxn : bit; var ap : bits(3); var tex : bits(3); var c : bit; var b : bit; var xn : bit; repeat fault.level = walkstate.level; var index : bits(32); if walkstate.level == 1 then index = ZeroExtend{32}(va[31-n:20]::'00'); else index = ZeroExtend{32}(va[19:12]::'00'); end; walkaddress.paddress.address = (walkstate.baseaddress.address OR ZeroExtend{NUM_PABITS}(index)); walkaddress.paddress.paspace = walkstate.baseaddress.paspace; let toplevel : boolean = walkstate.level == startlevel; let walkaccess : AccessDescriptor = CreateAccDescS1TTW(toplevel, varange, accdesc); if regime == Regime_EL10 && AArch32_EL2Enabled(accdesc.ss) then let s2aligned : boolean = TRUE; let (s2fault, s2walkaddress) = AArch32_S2Translate(fault, walkaddress, s2aligned, walkaccess); if s2fault.statuscode != Fault_None then return (s2fault, ARBITRARY : TTWState); end; (fault, descriptor) = FetchDescriptor{32}(ee, s2walkaddress, walkaccess, fault); else (fault, descriptor) = FetchDescriptor{32}(ee, walkaddress, walkaccess, fault); end; if fault.statuscode != Fault_None then return (fault, ARBITRARY : TTWState); end; walkstate.sdftype = AArch32_DecodeDescriptorTypeSD(descriptor, walkstate.level); case walkstate.sdftype of when SDFType_Invalid => fault.domain = domain; fault.statuscode = Fault_Translation; return (fault, ARBITRARY : TTWState); when SDFType_Table => domain = descriptor[8:5]; ns = descriptor[3]; pxn = descriptor[2]; walkstate.baseaddress.address = ZeroExtend{NUM_PABITS}(descriptor[31:10]:: Zeros{10}); walkstate.level = 2; when SDFType_SmallPage => nG = descriptor[11]; s = descriptor[10]; ap = descriptor[9,5:4]; tex = descriptor[8:6]; c = descriptor[3]; b = descriptor[2]; xn = descriptor[0]; walkstate.baseaddress.address = ZeroExtend{NUM_PABITS}(descriptor[31:12]:: Zeros{12}); walkstate.istable = FALSE; when SDFType_LargePage => xn = descriptor[15]; tex = descriptor[14:12]; nG = descriptor[11]; s = descriptor[10]; ap = descriptor[9,5:4]; c = descriptor[3]; b = descriptor[2]; walkstate.baseaddress.address = ZeroExtend{NUM_PABITS}(descriptor[31:16]:: Zeros{16}); walkstate.istable = FALSE; when SDFType_Section => ns = descriptor[19]; nG = descriptor[17]; s = descriptor[16]; ap = descriptor[15,11:10]; tex = descriptor[14:12]; domain = descriptor[8:5]; xn = descriptor[4]; c = descriptor[3]; b = descriptor[2]; pxn = descriptor[0]; walkstate.baseaddress.address = ZeroExtend{NUM_PABITS}(descriptor[31:20]:: Zeros{20}); walkstate.istable = FALSE; when SDFType_Supersection => ns = descriptor[19]; nG = descriptor[17]; s = descriptor[16]; ap = descriptor[15,11:10]; tex = descriptor[14:12]; xn = descriptor[4]; c = descriptor[3]; b = descriptor[2]; pxn = descriptor[0]; domain = '0000'; walkstate.baseaddress.address = ZeroExtend{NUM_PABITS}(descriptor[8:5,23:20,31:24]:: Zeros{24}); walkstate.istable = FALSE; end; until walkstate.sdftype != SDFType_Table looplimit 2; if afe == '1' && ap[0] == '0' then fault.domain = domain; fault.statuscode = Fault_AccessFlag; return (fault, ARBITRARY : TTWState); end; // Decode the TEX, C, B and S bits to produce target memory attributes if tre == '1' then walkstate.memattrs = AArch32_RemappedTEXDecode(regime, tex, c, b, s); elsif RemapRegsHaveResetValues() then walkstate.memattrs = AArch32_DefaultTEXDecode(tex, c, b, s); else walkstate.memattrs = ImpDefMemoryAttributes("IMPLEMENTATION_DEFINED"); end; walkstate.permissions.ap = ap; walkstate.permissions.xn = xn; walkstate.permissions.pxn = pxn; walkstate.domain = domain; walkstate.nG = nG; if accdesc.ss == SS_Secure && ns == '0' then walkstate.baseaddress.paspace = PAS_Secure; else walkstate.baseaddress.paspace = PAS_NonSecure; end; return (fault, walkstate); end;

// AArch32_S2IASize() // ================== // Retrieve the number of bits containing the input address for stage 2 translation func AArch32_S2IASize(t0sz : bits(4)) => AddressSize begin return 32 - SInt(t0sz); end;

// AArch32_S2StartLevel() // ====================== // Determine the initial lookup level when performing a stage 2 translation // table walk func AArch32_S2StartLevel(sl0 : bits(2)) => integer begin return 2 - UInt(sl0); end;

// AArch32_S2Walk() // ================ // Traverse stage 2 translation tables in long format to obtain the final descriptor func AArch32_S2Walk(fault_in : FaultRecord, walkparams : S2TTWParams, accdesc : AccessDescriptor, ipa : AddressDescriptor) => (FaultRecord, TTWState) begin var fault : FaultRecord = fault_in; if walkparams.sl0 == '1x' || AArch32_S2InconsistentSL(walkparams) then fault.statuscode = Fault_Translation; fault.level = 1; return (fault, ARBITRARY : TTWState); end; // Input Address size let iasize : AddressSize = AArch32_S2IASize(walkparams.t0sz); let startlevel : integer = AArch32_S2StartLevel(walkparams.sl0); let levels : integer = FINAL_LEVEL - startlevel; let granulebits : AddressSize = TGxGranuleBits(walkparams.tgx); let stride : integer{} = granulebits - 3; if !IsZero(VTTBR()[47:40]) then fault.statuscode = Fault_AddressSize; fault.level = 0; return (fault, ARBITRARY : TTWState); end; var baseaddress : FullAddress; let baselsb = ((iasize - (levels*stride + granulebits)) + 3) as AddressSize; baseaddress.paspace = PAS_NonSecure; baseaddress.address = ZeroExtend{NUM_PABITS}(VTTBR()[39:baselsb]::Zeros{baselsb}); var walkstate : TTWState; walkstate.baseaddress = baseaddress; walkstate.level = startlevel; walkstate.istable = TRUE; walkstate.memattrs = WalkMemAttrs(walkparams.sh, walkparams.irgn, walkparams.orgn); var descriptor : bits(64); let walkaccess : AccessDescriptor = CreateAccDescS2TTW(accdesc); var walkaddress : AddressDescriptor; walkaddress.vaddress = ipa.vaddress; if HCR2().CD == '1' then walkaddress.memattrs = NormalNCMemAttr(); walkaddress.memattrs.xs = walkstate.memattrs.xs; else walkaddress.memattrs = walkstate.memattrs; end; walkaddress.memattrs.shareability = EffectiveShareability(walkaddress.memattrs); var msb_residual : integer = iasize - 1; var desctype : DescriptorType; repeat fault.level = walkstate.level; let indexlsb = ((FINAL_LEVEL - walkstate.level)*stride + granulebits) as AddressSize; let indexmsb = msb_residual as AddressSize; let index : bits(40) = ZeroExtend{}(ipa.paddress.address[indexmsb:indexlsb]::'000'); walkaddress.paddress.address = (walkstate.baseaddress.address OR ZeroExtend{NUM_PABITS}(index)); walkaddress.paddress.paspace = walkstate.baseaddress.paspace; (fault, descriptor) = FetchDescriptor{64}(walkparams.ee, walkaddress, walkaccess, fault); if fault.statuscode != Fault_None then return (fault, ARBITRARY : TTWState); end; desctype = AArch32_DecodeDescriptorTypeLD(descriptor, walkstate.level); case desctype of when DescriptorType_Table => if !IsZero(descriptor[47:40]) then fault.statuscode = Fault_AddressSize; return (fault, ARBITRARY : TTWState); end; walkstate.baseaddress.address = ZeroExtend{NUM_PABITS}(descriptor[39:12]:: Zeros{12}); walkstate.level = walkstate.level + 1; msb_residual = indexlsb - 1; when DescriptorType_Invalid => fault.statuscode = Fault_Translation; return (fault, ARBITRARY : TTWState); when DescriptorType_Leaf => walkstate.istable = FALSE; end; until desctype == DescriptorType_Leaf looplimit 3; // Check the output address is inside the supported range if !IsZero(descriptor[47:40]) then fault.statuscode = Fault_AddressSize; return (fault, ARBITRARY : TTWState); end; // Check the access flag if descriptor[10] == '0' then fault.statuscode = Fault_AccessFlag; return (fault, ARBITRARY : TTWState); end; // Unpack the descriptor into address and upper and lower block attributes let indexlsb = ((FINAL_LEVEL - walkstate.level)*stride + granulebits) as AddressSize; walkstate.baseaddress.address = ZeroExtend{NUM_PABITS}(descriptor[39:indexlsb]:: Zeros{indexlsb}); walkstate.permissions.s2ap = descriptor[7:6]; walkstate.permissions.s2xn = descriptor[54]; if IsFeatureImplemented(FEAT_XNX) then walkstate.permissions.s2xnx = descriptor[53]; else walkstate.permissions.s2xnx = '0'; end; let memattr : bits(4) = descriptor[5:2]; let sh : bits(2) = descriptor[9:8]; let s2aarch64 : boolean = FALSE; walkstate.memattrs = S2DecodeMemAttrs(memattr, sh, s2aarch64); walkstate.contiguous = descriptor[52]; return (fault, walkstate); end;

// RemapRegsHaveResetValues() // ========================== impdef func RemapRegsHaveResetValues() => boolean begin return TRUE; end;

// AArch32_GetS1TTWParams() // ======================== // Returns stage 1 translation table walk parameters from respective controlling // System registers. func AArch32_GetS1TTWParams(regime : Regime, va : bits(32)) => S1TTWParams begin var walkparams : S1TTWParams; case regime of when Regime_EL2 => walkparams = AArch32_S1TTWParamsEL2(); when Regime_EL10 => walkparams = AArch32_S1TTWParamsEL10(va); when Regime_EL30 => walkparams = AArch32_S1TTWParamsEL30(va); end; return walkparams; end;

// AArch32_GetS2TTWParams() // ======================== // Gather walk parameters for stage 2 translation func AArch32_GetS2TTWParams() => S2TTWParams begin var walkparams : S2TTWParams; walkparams.tgx = TGx_4KB; walkparams.s = VTCR().S; walkparams.t0sz = VTCR().T0SZ; walkparams.sl0 = VTCR().SL0; walkparams.irgn = VTCR().IRGN0; walkparams.orgn = VTCR().ORGN0; walkparams.sh = VTCR().SH0; walkparams.ee = HSCTLR().EE; walkparams.ptw = HCR().PTW; walkparams.vm = HCR().VM OR HCR().DC; // VTCR.S must match VTCR.T0SZ[3] if walkparams.s != walkparams.t0sz[3] then (-, walkparams.t0sz) = ConstrainUnpredictableBits{4}(Unpredictable_RESVTCRS); end; return walkparams; end;

// AArch32_GetVARange() // ==================== // Select the translation base address for stage 1 long-descriptor walks func AArch32_GetVARange(va : bits(32), t0sz : bits(3), t1sz : bits(3)) => VARange begin // Lower range Input Address size let lo_iasize : AddressSize = AArch32_S1IASize(t0sz); // Upper range Input Address size let up_iasize : AddressSize = AArch32_S1IASize(t1sz); if t1sz == '000' && t0sz == '000' then return VARange_LOWER; elsif t1sz == '000' then return if IsZero(va[31:lo_iasize]) then VARange_LOWER else VARange_UPPER; elsif t0sz == '000' then return if IsOnes(va[31:up_iasize]) then VARange_UPPER else VARange_LOWER; elsif IsZero(va[31:lo_iasize]) then return VARange_LOWER; elsif IsOnes(va[31:up_iasize]) then return VARange_UPPER; else // Will be reported as a Translation Fault return ARBITRARY : VARange; end; end;

// AArch32_S1DCacheEnabled() // ========================= // Determine cacheability of stage 1 data accesses func AArch32_S1DCacheEnabled(regime : Regime) => boolean begin case regime of when Regime_EL30 => return SCTLR_S().C == '1'; when Regime_EL2 => return HSCTLR().C == '1'; when Regime_EL10 => return (if HaveEL(EL3) && ELUsingAArch32(EL3) then SCTLR_NS().C else SCTLR().C) == '1'; end; end;

// AArch32_S1ICacheEnabled() // ========================= // Determine cacheability of stage 1 instruction fetches func AArch32_S1ICacheEnabled(regime : Regime) => boolean begin case regime of when Regime_EL30 => return SCTLR_S().I == '1'; when Regime_EL2 => return HSCTLR().I == '1'; when Regime_EL10 => return (if HaveEL(EL3) && ELUsingAArch32(EL3) then SCTLR_NS().I else SCTLR().I) == '1'; end; end;

// AArch32_S1TTWParamsEL10() // ========================= // Gather stage 1 translation table walk parameters for EL1&0 regime // (with EL2 enabled or disabled). func AArch32_S1TTWParamsEL10(va : bits(32)) => S1TTWParams begin var mair : bits(64); var sif : bit; var ttbcr : TTBCR_Type; var ttbcr2 : TTBCR2_Type; var sctlr : SCTLR_Type; if ELUsingAArch32(EL3) then ttbcr = TTBCR_NS(); ttbcr2 = TTBCR2_NS(); sctlr = SCTLR_NS(); mair = MAIR1_NS()::MAIR0_NS(); sif = SCR().SIF; else ttbcr = TTBCR(); ttbcr2 = TTBCR2(); sctlr = SCTLR(); mair = MAIR1()::MAIR0(); sif = if HaveEL(EL3) then SCR_EL3().SIF else '0'; end; assert ttbcr.EAE == '1'; var walkparams : S1TTWParams; walkparams.t0sz = ttbcr.T0SZ; walkparams.t1sz = ttbcr.T1SZ; walkparams.ee = sctlr.EE; walkparams.wxn = sctlr.WXN; walkparams.uwxn = sctlr.UWXN; walkparams.ntlsmd = if IsFeatureImplemented(FEAT_LSMAOC) then sctlr.nTLSMD else '1'; walkparams.mair = mair; walkparams.sif = sif; let varange : VARange = AArch32_GetVARange(va, walkparams.t0sz, walkparams.t1sz); if varange == VARange_LOWER then walkparams.sh = ttbcr.SH0; walkparams.irgn = ttbcr.IRGN0; walkparams.orgn = ttbcr.ORGN0; walkparams.hpd = (if IsFeatureImplemented(FEAT_AA32HPD) then ttbcr.T2E AND ttbcr2.HPD0 else '0'); else walkparams.sh = ttbcr.SH1; walkparams.irgn = ttbcr.IRGN1; walkparams.orgn = ttbcr.ORGN1; walkparams.hpd = (if IsFeatureImplemented(FEAT_AA32HPD) then ttbcr.T2E AND ttbcr2.HPD1 else '0'); end; return walkparams; end;

// AArch32_S1TTWParamsEL2() // ======================== // Gather stage 1 translation table walk parameters for EL2 regime func AArch32_S1TTWParamsEL2() => S1TTWParams begin var walkparams : S1TTWParams; walkparams.tgx = TGx_4KB; walkparams.t0sz = HTCR().T0SZ; walkparams.irgn = HTCR().IRGN0; walkparams.orgn = HTCR().ORGN0; walkparams.sh = HTCR().SH0; walkparams.hpd = if IsFeatureImplemented(FEAT_AA32HPD) then HTCR().HPD else '0'; walkparams.ee = HSCTLR().EE; walkparams.wxn = HSCTLR().WXN; if IsFeatureImplemented(FEAT_LSMAOC) then walkparams.ntlsmd = HSCTLR().nTLSMD; else walkparams.ntlsmd = '1'; end; walkparams.mair = HMAIR1()::HMAIR0(); return walkparams; end;

// AArch32_S1TTWParamsEL30() // ========================= // Gather stage 1 translation table walk parameters for EL3&0 regime func AArch32_S1TTWParamsEL30(va : bits(32)) => S1TTWParams begin assert TTBCR_S().EAE == '1'; var walkparams : S1TTWParams; walkparams.t0sz = TTBCR_S().T0SZ; walkparams.t1sz = TTBCR_S().T1SZ; walkparams.ee = SCTLR_S().EE; walkparams.wxn = SCTLR_S().WXN; walkparams.uwxn = SCTLR_S().UWXN; walkparams.ntlsmd = if IsFeatureImplemented(FEAT_LSMAOC) then SCTLR_S().nTLSMD else '1'; walkparams.mair = MAIR1_S()::MAIR0_S(); walkparams.sif = SCR().SIF; let varange : VARange = AArch32_GetVARange(va, walkparams.t0sz, walkparams.t1sz); if varange == VARange_LOWER then walkparams.sh = TTBCR_S().SH0; walkparams.irgn = TTBCR_S().IRGN0; walkparams.orgn = TTBCR_S().ORGN0; walkparams.hpd = (if IsFeatureImplemented(FEAT_AA32HPD) then TTBCR_S().T2E AND TTBCR2_S().HPD0 else '0'); else walkparams.sh = TTBCR_S().SH1; walkparams.irgn = TTBCR_S().IRGN1; walkparams.orgn = TTBCR_S().ORGN1; walkparams.hpd = (if IsFeatureImplemented(FEAT_AA32HPD) then TTBCR_S().T2E AND TTBCR2_S().HPD1 else '0'); end; return walkparams; end;

// Contents of the Branch Record Buffer //===================================== var Records_SRC : array [[64]] of BRBSRC_EL1_Type; var Records_TGT : array [[64]] of BRBTGT_EL1_Type; var Records_INF : array [[64]] of BRBINF_EL1_Type; // Getter functions for branch records //==================================== // Functions used by MRS instructions that access branch records func BRBSRC_EL1(n : integer) => BRBSRC_EL1_Type begin assert n IN {0..31}; let record_index : integer = UInt(BRBFCR_EL1().BANK::n[4:0]); if record_index < GetBRBENumRecords() then return Records_SRC[[record_index]]; else return Zeros{64}; end; end; func BRBTGT_EL1(n : integer) => BRBTGT_EL1_Type begin assert n IN {0..31}; let record_index : integer = UInt(BRBFCR_EL1().BANK::n[4:0]); if record_index < GetBRBENumRecords() then return Records_TGT[[record_index]]; else return Zeros{64}; end; end; func BRBINF_EL1(n : integer) => BRBINF_EL1_Type begin assert n IN {0..31}; let record_index : integer = UInt(BRBFCR_EL1().BANK::n[4:0]); if record_index < GetBRBENumRecords() then return Records_INF[[record_index]]; else return Zeros{64}; end; end;

// BRBCycleCountingEnabled() // ========================= // Returns TRUE if the recording of cycle counts is allowed, // FALSE otherwise. func BRBCycleCountingEnabled() => boolean begin if HaveEL(EL2) && BRBCR_EL2().CC == '0' then return FALSE; end; if BRBCR_EL1().CC == '0' then return FALSE; end; return TRUE; end;

// BRBEBranch() // ============ // Called to write branch record for the following branches when BRBE is active: // direct branches, // indirect branches, // direct branches with link, // indirect branches with link, // returns from subroutines. func BRBEBranch(br_type : BranchType, cond : boolean, target_address : bits(64)) begin if BranchRecordAllowed(PSTATE.EL) && FilterBranchRecord(br_type, cond) then var branch_type : bits(6); case br_type of when BranchType_DIR => branch_type = if cond then '001000' else '000000'; when BranchType_INDIR => branch_type = '000001'; when BranchType_DIRCALL => branch_type = '000010'; when BranchType_INDCALL => branch_type = '000011'; when BranchType_RET => branch_type = '000101'; otherwise => unreachable; end; var ccu : bit; var cc : bits(14); (ccu, cc) = BranchEncCycleCount(); let el : bits(2) = PSTATE.EL; let mispredict : bit = (if BRBEMispredictAllowed() && BranchMispredict() then '1' else '0'); UpdateBranchRecordBuffer(ccu, cc, branch_type, el, mispredict, '11', PC64(), target_address); PMUEvent(PMU_EVENT_BRB_FILTRATE); end; return; end;

// BRBEBranchOnISB() // ================= // Returns TRUE if ISBs generate Branch records, and FALSE otherwise. func BRBEBranchOnISB() => boolean begin return ImpDefBool("ISB generates Branch records"); end;

// BRBEDebugStateEntry() // ===================== // Called to write Debug state entry branch record when BRBE is active. func BRBEDebugStateEntry(source_address : bits(64)) begin if BranchRecordAllowed(PSTATE.EL) then let branch_type : bits(6) = '100001'; var ccu : bit; var cc : bits(14); (ccu, cc) = BranchEncCycleCount(); let el : bits(2) = '00'; let mispredict : bit = '0'; // Debug state is a prohibited region, therefore target_address=0 UpdateBranchRecordBuffer(ccu, cc, branch_type, el, mispredict, '10', source_address, Zeros{64}); PMUEvent(PMU_EVENT_BRB_FILTRATE); end; return; end;

// BRBEDebugStateExit() // ==================== // Called to write Debug state exit branch record when BRBE is active. func BRBEDebugStateExit(target_address : bits(64)) begin if BranchRecordAllowed(PSTATE.EL) then // Debug state is a prohibited region, therefore ccu=1, cc=0, source_address=0 let branch_type : bits(6) = '111001'; let ccu : bit = '1'; let cc : bits(14) = Zeros{14}; let el : bits(2) = PSTATE.EL; let mispredict : bit = '0'; UpdateBranchRecordBuffer(ccu, cc, branch_type, el, mispredict, '01', Zeros{64}, target_address); PMUEvent(PMU_EVENT_BRB_FILTRATE); end; return; end;

// BRBEException() // =============== // Called to write exception branch record when BRBE is active. func BRBEException(erec : ExceptionRecord, source_valid : boolean, source_address_in : bits(64), target_address_in : bits(64), target_el : bits(2), trappedsyscallinst : boolean) begin var target_address : bits(64) = target_address_in; let except : Exception = erec.exceptype; let iss : bits(25) = erec.syndrome.iss; case target_el of when EL3 => if !IsFeatureImplemented(FEAT_BRBEv1p1) || (MDCR_EL3().E3BREC == MDCR_EL3().E3BREW) then return; end; when EL2 => if BRBCR_EL2().EXCEPTION == '0' then return; end; when EL1 => if BRBCR_EL1().EXCEPTION == '0' then return; end; end; let target_valid : boolean = BranchRecordAllowed(target_el); if source_valid || target_valid then var branch_type : bits(6); case except of when Exception_Uncategorized => branch_type = '100011'; // Trap when Exception_WFxTrap => branch_type = '100011'; // Trap when Exception_CP15RTTrap => branch_type = '100011'; // Trap when Exception_CP15RRTTrap => branch_type = '100011'; // Trap when Exception_CP14RTTrap => branch_type = '100011'; // Trap when Exception_CP14DTTrap => branch_type = '100011'; // Trap when Exception_AdvSIMDFPAccessTrap => branch_type = '100011'; // Trap when Exception_FPIDTrap => branch_type = '100011'; // Trap when Exception_PACTrap => branch_type = '100011'; // Trap when Exception_CP14RRTTrap => branch_type = '100011'; // Trap when Exception_OtherTrap => branch_type = '100011'; // Trap when Exception_BranchTarget => branch_type = '101011'; // Inst Fault when Exception_IllegalState => branch_type = '100011'; // Trap when Exception_SupervisorCall => if !trappedsyscallinst then branch_type = '100010'; // Call else branch_type = '100011'; // Trap end; when Exception_HypervisorCall => branch_type = '100010'; // Call when Exception_MonitorCall => if !trappedsyscallinst then branch_type = '100010'; // Call else branch_type = '100011'; // Trap end; when Exception_SystemRegisterTrap => branch_type = '100011'; // Trap when Exception_SystemRegister128Trap => branch_type = '100011'; // Trap when Exception_SVEAccessTrap => branch_type = '100011'; // Trap when Exception_SMEAccessTrap => branch_type = '100011'; // Trap when Exception_ERetTrap => branch_type = '100011'; // Trap when Exception_PACFail => branch_type = '101100'; // Data Fault when Exception_InstructionAbort => branch_type = '101011'; // Inst Fault when Exception_PCAlignment => branch_type = '101010'; // Alignment when Exception_DataAbort => branch_type = '101100'; // Data Fault when Exception_NV2DataAbort => branch_type = '101100'; // Data Fault when Exception_SPAlignment => branch_type = '101010'; // Alignment when Exception_FPTrappedException => branch_type = '100011'; // Trap when Exception_SError => branch_type = '100100'; // System Error when Exception_Breakpoint => branch_type = '100110'; // Inst debug when Exception_SoftwareStep => branch_type = '100110'; // Inst debug when Exception_Watchpoint => branch_type = '100111'; // Data debug when Exception_NV2Watchpoint => branch_type = '100111'; // Data debug when Exception_SoftwareBreakpoint => branch_type = '100110'; // Inst debug when Exception_IRQ => branch_type = '101110'; // IRQ when Exception_FIQ => branch_type = '101111'; // FIQ when Exception_MemCpyMemSet => branch_type = '100011'; // Trap when Exception_GCSFail => if iss[23:20] == '0000' then branch_type = '101100'; // Data Fault elsif iss[23:20] == '0001' then branch_type = '101011'; // Inst Fault elsif iss[23:20] == '0010' then branch_type = '100011'; // Trap else unreachable; end; when Exception_Profiling => branch_type = '100110'; // Inst debug when Exception_GPC => if iss[20] == '1' then branch_type = '101011'; // Inst fault else branch_type = '101100'; // Data fault end; otherwise => unreachable; end; var ccu : bit; var cc : bits(14); (ccu, cc) = BranchEncCycleCount(); let el : bits(2) = if target_valid then target_el else '00'; let mispredict : bit = '0'; let sv : bit = if source_valid then '1' else '0'; let tv : bit = if target_valid then '1' else '0'; let source_address : bits(64) = if source_valid then source_address_in else Zeros{64}; if !target_valid then target_address = Zeros{64}; else target_address = AArch64_BranchAddr(target_address, target_el); end; UpdateBranchRecordBuffer(ccu, cc, branch_type, el, mispredict, sv::tv, source_address, target_address); PMUEvent(PMU_EVENT_BRB_FILTRATE); end; return; end;

// BRBEExceptionReturn() // ===================== // Called to write exception return branch record when BRBE is active. func BRBEExceptionReturn(target_address_in : bits(64), source_el : bits(2), source_valid : boolean, source_address_in : bits(64)) begin var target_address : bits(64) = target_address_in; case source_el of when EL3 => if !IsFeatureImplemented(FEAT_BRBEv1p1) || (MDCR_EL3().E3BREC == MDCR_EL3().E3BREW) then return; end; when EL2 => if BRBCR_EL2().ERTN == '0' then return; end; when EL1 => if BRBCR_EL1().ERTN == '0' then return; end; end; let target_valid : boolean = BranchRecordAllowed(PSTATE.EL); if source_valid || target_valid then let branch_type : bits(6) = '000111'; var ccu : bit; var cc : bits(14); (ccu, cc) = BranchEncCycleCount(); let el : bits(2) = if target_valid then PSTATE.EL else '00'; let mispredict : bit = (if source_valid && BRBEMispredictAllowed() && BranchMispredict() then '1' else '0'); let sv : bit = if source_valid then '1' else '0'; let tv : bit = if target_valid then '1' else '0'; let source_address : bits(64) = if source_valid then source_address_in else Zeros{64}; if !target_valid then target_address = Zeros{64}; end; UpdateBranchRecordBuffer(ccu, cc, branch_type, el, mispredict, sv::tv, source_address, target_address); PMUEvent(PMU_EVENT_BRB_FILTRATE); end; return; end;

// BRBEFreeze() // ============ // Generates BRBE freeze event. func BRBEFreeze() begin BRBFCR_EL1().PAUSED = '1'; BRBTS_EL1() = GetTimestamp(BRBETimeStamp()); end;

// BRBEISB() // ========= // Handles ISB instruction for BRBE. func BRBEISB() begin let branch_conditional : boolean = FALSE; BRBEBranch(BranchType_DIR, branch_conditional, PC64() + 4); end;

// BRBEMispredictAllowed() // ======================= // Returns TRUE if the recording of branch misprediction is allowed, // FALSE otherwise. func BRBEMispredictAllowed() => boolean begin if HaveEL(EL2) && BRBCR_EL2().MPRED == '0' then return FALSE; end; if BRBCR_EL1().MPRED == '0' then return FALSE; end; return TRUE; end;

// BRBETimeStamp() // =============== // Returns captured timestamp. func BRBETimeStamp() => TimeStamp begin if HaveEL(EL2) then var TS_el2 : bits(2) = BRBCR_EL2().TS; if !IsFeatureImplemented(FEAT_ECV) && TS_el2 == '10' then // Reserved value (-, TS_el2) = ConstrainUnpredictableBits{2}(Unpredictable_EL2TIMESTAMP); end; case TS_el2 of when '00' => // Falls out to check BRBCR_EL1.TS pass; when '01' => return TimeStamp_Virtual; when '10' => assert IsFeatureImplemented(FEAT_ECV); // Otherwise ConstrainUnpredictableBits // removes this case return TimeStamp_OffsetPhysical; when '11' => return TimeStamp_Physical; end; end; var TS_el1 : bits(2) = BRBCR_EL1().TS; if TS_el1 == '00' || (!IsFeatureImplemented(FEAT_ECV) && TS_el1 == '10') then // Reserved value (-, TS_el1) = ConstrainUnpredictableBits{2}(Unpredictable_EL1TIMESTAMP); end; case TS_el1 of when '01' => return TimeStamp_Virtual; when '10' => return TimeStamp_OffsetPhysical; when '11' => return TimeStamp_Physical; otherwise => unreachable; // ConstrainUnpredictableBits removes this case end; end;

// BRB_IALL() // ========== // Called to perform invalidation of branch records func BRB_IALL() begin let nbrberecords : integer = GetBRBENumRecords(); for i = 0 to nbrberecords - 1 do Records_SRC[[i]] = Zeros{64}; Records_TGT[[i]] = Zeros{64}; Records_INF[[i]] = Zeros{64}; end; end;

// BRB_INJ() // ========= // Called to perform manual injection of branch records. func BRB_INJ() begin UpdateBranchRecordBuffer(BRBINFINJ_EL1().CCU, BRBINFINJ_EL1().CC, BRBINFINJ_EL1().TYPE, BRBINFINJ_EL1().EL, BRBINFINJ_EL1().MPRED, BRBINFINJ_EL1().VALID, BRBSRCINJ_EL1().ADDRESS, BRBTGTINJ_EL1().ADDRESS); BRBINFINJ_EL1() = ARBITRARY : bits(64); BRBSRCINJ_EL1() = ARBITRARY : bits(64); BRBTGTINJ_EL1() = ARBITRARY : bits(64); if ConstrainUnpredictableBool(Unpredictable_BRBFILTRATE) then PMUEvent(PMU_EVENT_BRB_FILTRATE); end; end;

// BranchEncCycleCount() // ===================== // The first return result is '1' if either of the following is true, and '0' otherwise: // - This is the first Branch record after the PE exited a Prohibited Region. // - This is the first Branch record after cycle counting has been enabled. // If the first return is '0', the second return result is the encoded cycle count // since the last branch. // The format of this field uses a mantissa and exponent to express the cycle count value. // - bits[7:0] indicate the mantissa M. // - bits[13:8] indicate the exponent E. // The cycle count is expressed using the following function: // cycle_count = (if IsZero(E) then UInt(M) else UInt('1'::M::Zeros{UInt(E)-1})) // A value of all ones in both the mantissa and exponent indicates the cycle count value // exceeded the size of the cycle counter. // If the cycle count is not known, the second return result is zero. func BranchEncCycleCount() => (bit, bits(14)) begin var cc : integer = BranchRawCycleCount(); if !BRBCycleCountingEnabled() || FirstBranchAfterProhibited() then return ('1', Zeros{14}); end; // The format of this field uses a mantissa and exponent to express the cycle count value. // - bits[7:0] indicate the mantissa M. // - bits[13:8] indicate the exponent E. // The cycle count is expressed using the following function: // cycle_count = (if IsZero(E) then UInt(M) else UInt('1'::M::Zeros{UInt(E)-1})) // A value of all ones in both the mantissa and exponent indicates the cycle count value // exceeded the size of the cycle counter. var E : bits(6); var M : bits(8); if cc < 2^8 then E = Zeros{6}; M = cc[7:0]; elsif cc >= 2^20 then E = Ones{6}; M = Ones{8}; else E = 1[5:0]; while cc >= 2^9 looplimit 11 do E = E + 1; cc = cc DIVRM 2; end; M = cc[7:0]; end; return ('0', E::M); end;

// BranchMispredict() // ================== // Returns TRUE if the branch being executed was mispredicted, FALSE otherwise. impdef func BranchMispredict() => boolean begin return FALSE; end;

// BranchRawCycleCount() // ===================== // If the cycle count is known, the return result is the cycle count since the last branch. impdef func BranchRawCycleCount() => integer begin return 0; end;

// BranchRecordAllowed() // ===================== // Returns TRUE if branch recording is allowed, FALSE otherwise. func BranchRecordAllowed(el : bits(2)) => boolean begin if ELUsingAArch32(el) then return FALSE; end; if BRBFCR_EL1().PAUSED == '1' then return FALSE; end; if el == EL3 && IsFeatureImplemented(FEAT_BRBEv1p1) then return (MDCR_EL3().E3BREC != MDCR_EL3().E3BREW); end; if HaveEL(EL3) && (MDCR_EL3().SBRBE == '00' || (CurrentSecurityState() == SS_Secure && MDCR_EL3().SBRBE == '01')) then return FALSE; end; case el of when EL3 => return FALSE; // FEAT_BRBEv1p1 not implemented when EL2 => return BRBCR_EL2().E2BRE == '1'; when EL1 => return BRBCR_EL1().E1BRE == '1'; when EL0 => if EL2Enabled() && HCR_EL2().TGE == '1' then return BRBCR_EL2().E0HBRE == '1'; else return BRBCR_EL1().E0BRE == '1'; end; end; end;

// FilterBranchRecord() // ==================== // Returns TRUE if the branch record is not filtered out, FALSE otherwise. func FilterBranchRecord(br : BranchType, cond : boolean) => boolean begin case br of when BranchType_DIRCALL => return BRBFCR_EL1().DIRCALL != BRBFCR_EL1().EnI; when BranchType_INDCALL => return BRBFCR_EL1().INDCALL != BRBFCR_EL1().EnI; when BranchType_RET => return BRBFCR_EL1().RTN != BRBFCR_EL1().EnI; when BranchType_DIR => if cond then return BRBFCR_EL1().CONDDIR != BRBFCR_EL1().EnI; else return BRBFCR_EL1().DIRECT != BRBFCR_EL1().EnI; end; when BranchType_INDIR => return BRBFCR_EL1().INDIRECT != BRBFCR_EL1().EnI; otherwise => unreachable; end; return FALSE; end;

// FirstBranchAfterProhibited() // ============================ // Returns TRUE if branch recorded is the first branch after a prohibited region, // FALSE otherwise. impdef func FirstBranchAfterProhibited() => boolean begin return FALSE; end;

// GetBRBENumRecords() // =================== // Returns the number of branch records implemented. func GetBRBENumRecords() => integer begin assert UInt(BRBIDR0_EL1().NUMREC) IN {0x08, 0x10, 0x20, 0x40}; return ImpDefInt("Number of BRBE Branch records"); end;

// ShouldBRBEFreeze() // ================== // Returns TRUE if the BRBE freeze event conditions have been met, and FALSE otherwise. func ShouldBRBEFreeze() => boolean begin if !BranchRecordAllowed(PSTATE.EL) then return FALSE; end; var include_r1 : boolean; var include_r2 : boolean; let include_r3 : boolean = FALSE; if HaveEL(EL2) then include_r1 = (BRBCR_EL1().FZP == '1'); include_r2 = (BRBCR_EL2().FZP == '1'); else include_r1 = TRUE; include_r2 = TRUE; end; return CheckPMUOverflowCondition(PMUOverflowCondition_BRBEFreeze, include_r1, include_r2, include_r3); end;

// UpdateBranchRecordBuffer() // ========================== // Add a new Branch record to the buffer. func UpdateBranchRecordBuffer(ccu : bit, cc : bits(14), branch_type : bits(6), el : bits(2), mispredict : bit, valid : bits(2), source_address : bits(64), target_address : bits(64)) begin // Shift the Branch Records in the buffer let nbrberecords : integer = GetBRBENumRecords(); for i = nbrberecords - 1 downto 1 do Records_SRC[[i]] = Records_SRC[[i - 1]]; Records_TGT[[i]] = Records_TGT[[i - 1]]; Records_INF[[i]] = Records_INF[[i - 1]]; end; Records_INF[[0]].CCU = ccu; Records_INF[[0]].CC = cc; Records_INF[[0]].EL = el; Records_INF[[0]].VALID = valid; Records_INF[[0]].MPRED = mispredict; Records_INF[[0]].TYPE = branch_type; Records_SRC[[0]] = source_address; Records_TGT[[0]] = target_address; return; end;

// AArch64_BreakpointMatch() // ========================= // Breakpoint matching in an AArch64 translation regime. // Returns BreakpointInfo structure that contains breakpoint type, a boolean to indicate the // type of breakpoint, matched address and whether the breakpoint is active and matched // successfully. For Address Mismatch breakpoints, the returned boolean is the inverted result. func AArch64_BreakpointMatch(n : integer, vaddress : bits(64), accdesc : AccessDescriptor, size : integer) => BreakpointInfo begin assert !ELUsingAArch32(S1TranslationRegime()); assert n < NumBreakpointsImplemented(); var brkptinfo : BreakpointInfo; let linking_enabled : boolean = (DBGBCR_EL1(n).BT IN {'0x11', '1xx1'} || (IsFeatureImplemented(FEAT_ABLE) && DBGBCR_EL1(n).BT2 == '1')); // A breakpoint that has linking enabled does not generate debug events in isolation if linking_enabled then brkptinfo.bptype = BreakpointType_Inactive; brkptinfo.match = FALSE; return brkptinfo; end; let enabled : boolean = IsBreakpointEnabled(n); let linked : boolean = DBGBCR_EL1(n).BT == '0x01'; let isbreakpnt : boolean = TRUE; let linked_to : boolean = FALSE; let from_linking_enabled : boolean = FALSE; let lbnx : bits(2) = if IsFeatureImplemented(FEAT_Debugv8p9) then DBGBCR_EL1(n).LBNX else '00'; let linked_n : integer{} = UInt(lbnx :: DBGBCR_EL1(n).LBN); let ssce : bit = if IsFeatureImplemented(FEAT_RME) then DBGBCR_EL1(n).SSCE else '0'; let state_match = AArch64_StateMatch(DBGBCR_EL1(n).SSC, ssce, DBGBCR_EL1(n).HMC, DBGBCR_EL1(n).PMC, linked, linked_n, isbreakpnt, vaddress, accdesc); var (bp_type, value_match) = AArch64_BreakpointValueMatch(n, vaddress, linked_to, isbreakpnt, from_linking_enabled); if HaveAArch32() && size == 4 then // Check second halfword // If the breakpoint address and BAS of an Address breakpoint match the address of the // second halfword of an instruction, but not the address of the first halfword, it is // CONSTRAINED UNPREDICTABLE whether or not this breakpoint generates a Breakpoint debug // event. let (-, match_i) = AArch64_BreakpointValueMatch(n, vaddress + 2, linked_to, isbreakpnt, from_linking_enabled); if !value_match && match_i then value_match = ConstrainUnpredictableBool(Unpredictable_BPMATCHHALF); end; end; if vaddress[1] == '1' && DBGBCR_EL1(n).BAS == '1111' then // The above notwithstanding, if DBGBCR_EL1(n).BAS == '1111', then it is CONSTRAINED // UNPREDICTABLE whether or not a Breakpoint debug event is generated for an instruction // at the address DBGBVR_EL1(n)+2. if value_match then value_match = ConstrainUnpredictableBool(Unpredictable_BPMATCHHALF); end; end; if !(state_match && enabled) then brkptinfo.bptype = BreakpointType_Inactive; brkptinfo.match = FALSE; else brkptinfo.bptype = bp_type; brkptinfo.match = value_match; end; return brkptinfo; end;

// AArch64_BreakpointValueMatch() // ============================== // Returns breakpoint type to indicate the type of breakpoint and a boolean to indicate // whether the breakpoint matched successfully. For Address Mismatch breakpoints, the // returned boolean is the inverted result. If the breakpoint type return value is Inactive, // then the boolean result is FALSE. func AArch64_BreakpointValueMatch(n_in : integer, vaddress : bits(64), linked_to : boolean, isbreakpnt : boolean, from_linking_enabled : boolean ) => (BreakpointType, boolean) recurselimit 2 begin // "n_in" is the identity of the breakpoint unit to match against. // "vaddress" is the current instruction address, ignored if linked_to is TRUE and for Context // matching breakpoints. // "linked_to" is TRUE if this is a call from StateMatch for linking. // "isbreakpnt" TRUE is this is a call from BreakpointMatch or from StateMatch for a // linked breakpoint or from BreakpointValueMatch for a linked breakpoint with linking enabled. // "from_linking_enabled" is TRUE if this is a call from BreakpointValueMatch for a linked // breakpoint with linking enabled. var n : integer = n_in; var c : Constraint; var dbgtype : bits(5); // If a non-existent breakpoint then it is CONSTRAINED UNPREDICTABLE whether this gives // no match or the breakpoint is mapped to another UNKNOWN implemented breakpoint. if n >= NumBreakpointsImplemented() then (c, n) = ConstrainUnpredictableInteger(0, NumBreakpointsImplemented() - 1, Unpredictable_BPNOTIMPL); assert c IN {Constraint_DISABLED, Constraint_UNKNOWN}; if c == Constraint_DISABLED then return (BreakpointType_Inactive, FALSE); end; end; // If this breakpoint is not enabled, it cannot generate a match. // (This could also happen on a call from StateMatch for linking). if !IsBreakpointEnabled(n) then return (BreakpointType_Inactive, FALSE); end; // If BT is set to a reserved type, behaves either as disabled or as a not-reserved type. if IsFeatureImplemented(FEAT_ABLE) then dbgtype = DBGBCR_EL1(n).[BT2,BT]; else dbgtype = '0' :: DBGBCR_EL1(n).BT; end; (c, dbgtype) = AArch64_ReservedBreakpointType(n, dbgtype); if c == Constraint_DISABLED then return (BreakpointType_Inactive, FALSE); end; // Otherwise the value returned by ConstrainUnpredictableBits must be a not-reserved value // Determine what to compare against. let match_addr : boolean = (dbgtype == 'x0x0x'); let mismatch : boolean = (dbgtype == 'x010x'); let match_vmid : boolean = (dbgtype == 'x10xx'); let match_cid : boolean = (dbgtype == 'x001x'); let match_cid1 : boolean = (dbgtype IN {'x101x', 'xx11x'}); let match_cid2 : boolean = (dbgtype == 'x11xx'); let linking_enabled : boolean = (dbgtype IN {'xxx11', 'x1xx1', '1xxxx'}); // If this is a call from StateMatch, return FALSE if the breakpoint is not // programmed with linking enabled. if linked_to && !linking_enabled then return (BreakpointType_Inactive, FALSE); end; // If called from BreakpointMatch return FALSE for breakpoint with linking enabled. if !linked_to && linking_enabled then return (BreakpointType_Inactive, FALSE); end; let linked : boolean = (dbgtype == 'x0x01'); if from_linking_enabled then // A breakpoint with linking enabled has called this function. assert linked_to && isbreakpnt; if linked then // A breakpoint with linking enabled is linked to a linked breakpoint. This is // architecturally UNPREDICTABLE, but treated as disabled in the pseudo code to // avoid potential recursion in BreakpointValueMatch(). return (BreakpointType_Inactive, FALSE); end; end; // If a linked breakpoint is linked to an address matching breakpoint, // the behavior is CONSTRAINED UNPREDICTABLE. if linked_to && match_addr && isbreakpnt then if !ConstrainUnpredictableBool(Unpredictable_BPLINKEDADDRMATCH) then return (BreakpointType_Inactive, FALSE); end; end; // A breakpoint programmed for address mismatch does not match in AArch32 state. if mismatch && UsingAArch32() then return (BreakpointType_Inactive, FALSE); end; var bvr_match : boolean = FALSE; var bxvr_match : boolean = FALSE; var bp_type : BreakpointType; var mask : integer{0..31}; if IsFeatureImplemented(FEAT_BWE) then mask = UInt(DBGBCR_EL1(n).MASK); // If the mask is set to a reserved value, the behavior is CONSTRAINED UNPREDICTABLE. if mask IN {1, 2} then var unpred_mask : integer; (c, unpred_mask) = ConstrainUnpredictableInteger(3, 31, Unpredictable_RESBPMASK); assert c IN {Constraint_DISABLED, Constraint_NONE, Constraint_UNKNOWN}; case c of when Constraint_DISABLED => return (BreakpointType_Inactive, FALSE); // Disabled when Constraint_NONE => mask = 0; // No masking // Otherwise the value returned by ConstrainUnpredictableBits must // be a not-reserved value. otherwise => mask = unpred_mask as integer{3..31}; end; end; if mask != 0 then // When DBGBCR_EL1(n).MASK is a valid nonzero value, the behavior is // CONSTRAINED UNPREDICTABLE if any of the following are true: // - DBGBCR_EL1(n).[BT2,BT] is programmed for a Context matching breakpoint. // - DBGBCR_EL1(n).BAS is not '1111' and AArch32 is supported at EL0. if ((match_cid || match_cid1 || match_cid2) || (DBGBCR_EL1(n).BAS != '1111' && HaveAArch32())) then if !ConstrainUnpredictableBool(Unpredictable_BPMASK) then return (BreakpointType_Inactive, FALSE); end; end; else // A stand-alone mismatch of a single address is not supported. if mismatch then return (BreakpointType_Inactive, FALSE); end; end; else mask = 0; end; // Do the comparison. if match_addr then var byte_select_match : boolean; let byte : integer = UInt(vaddress[1:0]); if HaveAArch32() then // T32 instructions can be executed at EL0 in an AArch64 translation regime. assert byte IN {0,2}; // "vaddress" is halfword aligned byte_select_match = (DBGBCR_EL1(n).BAS[byte] == '1'); else assert byte == 0; // "vaddress" is word aligned byte_select_match = TRUE; // DBGBCR_EL1(n).BAS[byte] is RES1 end; // When FEAT_LVA3 is not implemented, if the DBGBVR_EL1(n).RESS field bits are not a // sign extension of the MSB of DBGBVR_EL1(n).VA, it is UNPREDICTABLE whether they // appear to be included in the match. // If 'vaddress' is outside of the current virtual address space, then the access // generates a Translation fault. let dbgtop : AddressSize = DebugAddrTop(); let unpredictable_ress : boolean = (dbgtop < 55 && !IsOnes(DBGBVR_EL1(n)[63:dbgtop]) && !IsZero(DBGBVR_EL1(n)[63:dbgtop]) && ConstrainUnpredictableBool(Unpredictable_DBGxVR_RESS)); let cmpmsb : integer{} = if unpredictable_ress then 63 else dbgtop; let cmplsb : integer{} = if mask > 2 then mask else 2; bvr_match = ((vaddress[cmpmsb:cmplsb] == DBGBVR_EL1(n)[cmpmsb:cmplsb]) && byte_select_match); if mask > 2 then // If masked bits of DBGBVR_EL1(n) are not zero, the behavior // is CONSTRAINED UNPREDICTABLE. let masktop : integer{} = mask - 1; if bvr_match && !IsZero(DBGBVR_EL1(n)[masktop:2]) then bvr_match = ConstrainUnpredictableBool(Unpredictable_BPMASKEDBITS); end; end; elsif match_cid then if IsInHost() then bvr_match = (CONTEXTIDR_EL2()[31:0] == DBGBVR_EL1(n)[31:0]); else bvr_match = (PSTATE.EL IN {EL0, EL1} && CONTEXTIDR_EL1()[31:0] == DBGBVR_EL1(n)[31:0]); end; elsif match_cid1 then bvr_match = (PSTATE.EL IN {EL0, EL1} && !IsInHost() && CONTEXTIDR_EL1()[31:0] == DBGBVR_EL1(n)[31:0]); end; if match_vmid then let vmid : bits(NUM_VMIDBITS) = VMID(); var bvr_vmid : bits(NUM_VMIDBITS); if !IsFeatureImplemented(FEAT_VMID16) || VTCR_EL2().VS == '0' then bvr_vmid = ZeroExtend{NUM_VMIDBITS}(DBGBVR_EL1(n)[39:32]); else bvr_vmid = DBGBVR_EL1(n)[47:32]; end; bxvr_match = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && !IsInHost() && vmid == bvr_vmid); elsif match_cid2 then bxvr_match = (PSTATE.EL != EL3 && EL2Enabled() && DBGBVR_EL1(n)[63:32] == CONTEXTIDR_EL2()[31:0]); end; let bvr_match_valid : boolean = (match_addr || match_cid || match_cid1); let bxvr_match_valid : boolean = (match_vmid || match_cid2); var value_match : boolean = ((!bxvr_match_valid || bxvr_match) && (!bvr_match_valid || bvr_match)); // A watchpoint might be linked to a linked address matching breakpoint with linking enabled, // which is in turn linked to a context matching breakpoint. if linked_to && linked then // If called from StateMatch and breakpoint is a linked breakpoint then it must be a // watchpoint that is linked to an address matching breakpoint which is linked to a // context matching breakpoint. assert !isbreakpnt && match_addr && IsFeatureImplemented(FEAT_ABLE); let lbnx : bits(2) = (if IsFeatureImplemented(FEAT_Debugv8p9) then DBGBCR_EL1(n).LBNX else '00'); let linked_linked_n : integer{} = UInt(lbnx :: DBGBCR_EL1(n).LBN); var linked_value_match : boolean; let linked_vaddress = ARBITRARY : bits(64); let linked_linked_to = TRUE; let linked_isbreakpnt = TRUE; let linked_from_linking_enabled = TRUE; (bp_type, linked_value_match) = AArch64_BreakpointValueMatch(linked_linked_n, linked_vaddress, linked_linked_to, linked_isbreakpnt, linked_from_linking_enabled); value_match = value_match && linked_value_match; end; if match_addr && !mismatch then bp_type = BreakpointType_AddrMatch; elsif match_addr && mismatch then bp_type = BreakpointType_AddrMismatch; elsif match_vmid || match_cid || match_cid1 || match_cid2 then bp_type = BreakpointType_CtxtMatch; else unreachable; end; return (bp_type, value_match); end;

// AArch64_ReservedBreakpointType() // ================================ // Checks if the given DBGBCR_EL1(n).[BT2,BT] values are reserved and will // generate Constrained Unpredictable behavior, otherwise returns Constraint_NONE. func AArch64_ReservedBreakpointType(n : integer, bt_in : bits(5)) => (Constraint, bits(5)) begin var bt : bits(5) = bt_in; var reserved : boolean = FALSE; let context_aware : boolean = IsContextAwareBreakpoint(n); if bt[4] == '0' then // Context matching if bt != '00x0x' && !context_aware then reserved = TRUE; end; // EL2 extension if bt == '01xxx' && !HaveEL(EL2) then reserved = TRUE; end; // Context matching if (bt IN {'0011x','011xx'} && !IsFeatureImplemented(FEAT_VHE) && !IsFeatureImplemented(FEAT_Debugv8p2)) then reserved = TRUE; end; // Reserved if bt == '0010x' && !IsFeatureImplemented(FEAT_BWE) && !HaveAArch32EL(EL1) then reserved = TRUE; end; else // Reserved if bt != '10x0x' then reserved = TRUE; end; end; if reserved then var c : Constraint; (c, bt) = ConstrainUnpredictableBits{5}(Unpredictable_RESBPTYPE); assert c IN {Constraint_DISABLED, Constraint_UNKNOWN}; if c == Constraint_DISABLED then return (c, ARBITRARY : bits(5)); // Otherwise the value returned by ConstrainUnpredictableBits must be a not-reserved value end; end; return (Constraint_NONE, bt); end;

// AArch64_StateMatch() // ==================== // Determine whether a breakpoint or watchpoint is enabled in the current mode and state. func AArch64_StateMatch(ssc_in : bits(2), ssce_in : bit, hmc_in : bit, pxc_in : bits(2), linked_in : boolean, linked_n_in : integer, isbreakpnt : boolean, vaddress : bits(64), accdesc : AccessDescriptor) => boolean begin if !IsFeatureImplemented(FEAT_RME) then assert ssce_in == '0'; end; // "ssc_in","ssce_in","hmc_in","pxc_in" are the control fields from // the DBGBCR_EL1(n) or DBGWCR_EL1(n) register. // "linked_in" is TRUE if this is a linked breakpoint/watchpoint type. // "linked_n_in" is the linked breakpoint number from the DBGBCR_EL1(n) or // DBGWCR_EL1(n) register. // "isbreakpnt" is TRUE for breakpoints, FALSE for watchpoints. // "vaddress" is the program counter for a linked watchpoint or the same value passed to // AArch64_CheckBreakpoint for a linked breakpoint. // "accdesc" describes the properties of the access being matched. var ssc : bits(2) = ssc_in; var ssce : bit = ssce_in; var hmc : bit = hmc_in; var pxc : bits(2) = pxc_in; let linked : boolean = linked_in; let linked_n : integer = linked_n_in; // If parameters are set to a reserved type, behaves as either disabled or a defined type var c : Constraint; (c, ssc, ssce, hmc, pxc) = CheckValidStateMatch(ssc, ssce, hmc, pxc, isbreakpnt); if c == Constraint_DISABLED then return FALSE; end; // Otherwise the hmc,ssc,ssce,pxc values are either valid or the values returned by // CheckValidStateMatch are valid. let EL3_match : boolean = HaveEL(EL3) && hmc == '1' && ssc[0] == '0'; let EL2_match : boolean = HaveEL(EL2) && ((hmc == '1' && (ssc::pxc != '1000')) || ssc == '11'); let EL1_match : boolean = pxc[0] == '1'; let EL0_match : boolean = pxc[1] == '1'; var priv_match : boolean; case accdesc.el of when EL3 => priv_match = EL3_match; when EL2 => priv_match = EL2_match; when EL1 => priv_match = EL1_match; when EL0 => priv_match = EL0_match; end; // Security state match var ss_match : boolean; case ssce::ssc of when '000' => ss_match = hmc == '1' || accdesc.ss != SS_Root; when '001' => ss_match = accdesc.ss == SS_NonSecure; when '010' => ss_match = (hmc == '1' && accdesc.ss == SS_Root) || accdesc.ss == SS_Secure; when '011' => ss_match = (hmc == '1' && accdesc.ss != SS_Root) || accdesc.ss == SS_Secure; when '101' => ss_match = accdesc.ss == SS_Realm; end; var linked_match : boolean = FALSE; if linked then // "linked_n" must be an enabled context-aware breakpoint unit. If it is not context-aware // then it is CONSTRAINED UNPREDICTABLE whether this gives no match, gives a match without // linking, or linked_n is mapped to some UNKNOWN breakpoint that is context-aware. if (!IsContextAwareBreakpoint(linked_n) && (isbreakpnt || !IsAddressLinkingBreakpoint(linked_n))) then return ConstrainUnpredictableBool(Unpredictable_BPNOTLINKING); end; end; if linked then let linked_to : boolean = TRUE; var bp_type : BreakpointType; let from_linking_enabled : boolean = FALSE; (bp_type, linked_match) = AArch64_BreakpointValueMatch(linked_n, vaddress, linked_to, isbreakpnt, from_linking_enabled); if bp_type == BreakpointType_AddrMismatch then linked_match = !linked_match; end; end; return priv_match && ss_match && (!linked || linked_match); end;

// DebugAddrTop() // ============== // Returns the value for the top bit used in Breakpoint and Watchpoint address comparisons. func DebugAddrTop() => AddressSize begin if IsFeatureImplemented(FEAT_LVA3) then return 55; elsif IsFeatureImplemented(FEAT_LVA) then return 52; else return 48; end; end;

// EffectiveMDSELR_EL1_BANK() // ========================== // Return the effective value of MDSELR_EL1.BANK. func EffectiveMDSELR_EL1_BANK() => bits(2) begin // If 16 or fewer breakpoints and 16 or fewer watchpoints are implemented, // then the field is RES0. let num_bp : integer = NumBreakpointsImplemented(); let num_wp : integer = NumWatchpointsImplemented(); if num_bp <= 16 && num_wp <= 16 then return '00'; end; // At EL3, the Effective value of this field is zero if MDCR_EL3.EBWE is 0. // At EL2, the Effective value is zero if the Effective value of MDCR_EL2.EBWE is 0. // That is, if either MDCR_EL3.EBWE is 0 or MDCR_EL2.EBWE is 0. // At EL1, the Effective value is zero if the Effective value of MDSCR_EL2.EMBWE is 0. // That is, if any of MDCR_EL3.EBWE, MDCR_EL2.EBWE, or MDSCR_EL1.EMBWE is 0. if ((HaveEL(EL3) && MDCR_EL3().EBWE == '0') || (PSTATE.EL != EL3 && EL2Enabled() && MDCR_EL2().EBWE == '0') || (PSTATE.EL == EL1 && MDSCR_EL1().EMBWE == '0')) then return '00'; end; var bank : bits(2) = MDSELR_EL1().BANK; // Values are reserved depending on the number of breakpoints or watchpoints // implemented. if ((bank == '11' && num_bp <= 48 && num_wp <= 48) || (bank == '10' && num_bp <= 32 && num_wp <= 32)) then // Reserved value (-, bank) = ConstrainUnpredictableBits{2}(Unpredictable_RESMDSELR); // The value returned by ConstrainUnpredictableBits must be a not-reserved value end; return bank; end;

// IsAddressLinkingBreakpoint() // ============================ // Returns TRUE if DBGBCR_EL1(n) supports being configured as an Address matching breakpoint with // linking enabled. func IsAddressLinkingBreakpoint(n : integer) => boolean begin return n < NumAddressLinkingBreakpointsImplemented(); end;

// IsBreakpointEnabled() // ===================== // Returns TRUE if the effective value of DBGBCR_EL1(n).E is '1', and FALSE otherwise. func IsBreakpointEnabled(n : integer) => boolean begin if (n > 15 && ((!HaltOnBreakpointOrWatchpoint() && !SelfHostedExtendedBPWPEnabled()) || (HaltOnBreakpointOrWatchpoint() && EDSCR2().EHBWE == '0'))) then return FALSE; end; return DBGBCR_EL1(n).E == '1'; end;

// NumAddressLinkingBreakpointsImplemented() // ========================================= // Returns the number of breakpoints that support being configured as Address matching breakpoint // with linking enabled, as described by ID_AA64DFR1_EL1().ABL_CMPs. func NumAddressLinkingBreakpointsImplemented() => integer begin if !IsFeatureImplemented(FEAT_ABLE) then return 0; else return ImpDefInt("Number of address-linking breakpoints"); end; end;

// SelfHostedExtendedBPWPEnabled() // =============================== // Returns TRUE if the extended breakpoints and watchpoints are enabled, and FALSE otherwise // from a self-hosted debug perspective. func SelfHostedExtendedBPWPEnabled() => boolean begin if NumBreakpointsImplemented() <= 16 && NumWatchpointsImplemented() <= 16 then return FALSE; end; if ((HaveEL(EL3) && MDCR_EL3().EBWE == '0') || (EL2Enabled() && MDCR_EL2().EBWE == '0')) then return FALSE; end; return MDSCR_EL1().EMBWE == '1'; end;

// CheckForPMUException() // ====================== // Take a PMU exception if enabled, permitted, and unmasked. func CheckForPMUException() begin var enabled : boolean; var target_el : bits(2); var pmu_exception : boolean; var synchronous : boolean; (enabled, target_el) = PMUExceptionEnabled(); if !enabled || PMUExceptionMasked(target_el, PSTATE.EL, PSTATE.PM) then pmu_exception = FALSE; else let include_r1 : boolean = TRUE; let include_r2 : boolean = TRUE; let include_r3 : boolean = TRUE; pmu_exception = CheckPMUOverflowCondition(PMUOverflowCondition_PMUException, include_r1, include_r2, include_r3); synchronous = FALSE; end; if pmu_exception then let fsc : bits(5) = '00000'; TakeProfilingException(target_el, fsc, synchronous); end; end;

// EffectivePMEE() // =============== // Return the Effective value of PMEE from MDCR_ELx or PMECR_EL1, handling reserved encodings: // '10' (MDCR_ELx), '10' and '01' (PMECR_EL1). func EffectivePMEE(el : bits(2), for_interrupt : boolean) => bits(2) begin var val : bits(2); case el of when EL1 => val = PMECR_EL1().PMEE; when EL2 => val = MDCR_EL2().PMEE; when EL3 => val = MDCR_EL3().PMEE; otherwise => unreachable; end; if (val == '10' || (el == EL1 && val == '01')) then var c : Constraint; (c, val) = ConstrainUnpredictableBits{2}(Unpredictable_RESPMEE); assert c IN {Constraint_DISABLED, Constraint_UNKNOWN}; if c == Constraint_DISABLED then val = if for_interrupt then '11' else '00'; // Otherwise the value returned by ConstrainUnpredictableBits must be // a non-reserved value end; end; return val; end;

// PMUExceptionEnabled() // ===================== // The first return value is TRUE if the PMU exception is enabled, and FALSE otherwise. // The second return value is the target Exception level for an enabled PMU exception. func PMUExceptionEnabled() => (boolean, bits(2)) begin if !IsFeatureImplemented(FEAT_EBEP) then return (FALSE, ARBITRARY : bits(2)); end; var enabled : boolean; var target : bits(2) = ARBITRARY : bits(2); let for_interrupt : boolean = FALSE; let pmee_el3 : bits(2) = EffectivePMEE(EL3, for_interrupt); let pmee_el2 : bits(2) = EffectivePMEE(EL2, for_interrupt); let pmee_el1 : bits(2) = EffectivePMEE(EL1, for_interrupt); if HaveEL(EL3) && pmee_el3 != '01' then enabled = pmee_el3 == '11'; if enabled then target = EL3; end; elsif EL2Enabled() && pmee_el2 != '01' then enabled = pmee_el2 == '11'; if enabled then target = EL2; end; else enabled = pmee_el1 == '11'; if enabled then target = if EL2Enabled() && HCR_EL2().TGE == '1' then EL2 else EL1; end; end; return (enabled, target); end;

// PMUExceptionMasked() // ==================== // Return TRUE if the PMU Exception is masked at the specified target Exception level // relative to the specified source Exception level, and by the value of PSTATE.PM, // and FALSE otherwise. func PMUExceptionMasked(target_el : bits(2), from_el : bits(2), pm : bit) => boolean begin assert IsFeatureImplemented(FEAT_EBEP); let for_interrupt : boolean = FALSE; if Halted() then return TRUE; elsif UInt(target_el) < UInt(from_el) then return TRUE; elsif (from_el == EL2 && target_el == EL2 && EffectivePMEE(EL2, for_interrupt) != '11') then return TRUE; elsif target_el == from_el && (PMECR_EL1().KPME == '0' || pm == '1') then return TRUE; end; return FALSE; end;

// PMUInterruptEnabled() // ===================== // Return TRUE if the PMU interrupt request (PMUIRQ) is enabled, FALSE otherwise. func PMUInterruptEnabled() => boolean begin if !IsFeatureImplemented(FEAT_EBEP) then return TRUE; end; var enabled : boolean; let for_interrupt : boolean = TRUE; let pmee_el3 : bits(2) = EffectivePMEE(EL3, for_interrupt); let pmee_el2 : bits(2) = EffectivePMEE(EL2, for_interrupt); let pmee_el1 : bits(2) = EffectivePMEE(EL1, for_interrupt); if HaveEL(EL3) && pmee_el3 != '01' then enabled = pmee_el3 == '00'; elsif EL2Enabled() && pmee_el2 != '01' then enabled = pmee_el2 == '00'; else enabled = pmee_el1 == '00'; end; return enabled; end;

// AArch64_GenerateDebugExceptions() // ================================= func AArch64_GenerateDebugExceptions() => boolean begin let ss : SecurityState = CurrentSecurityState(); return AArch64_GenerateDebugExceptionsFrom(PSTATE.EL, ss, PSTATE.D); end;

// AArch64_GenerateDebugExceptionsFrom() // ===================================== func AArch64_GenerateDebugExceptionsFrom(from_el : bits(2), from_state : SecurityState, mask : bit) => boolean begin if OSLSR_EL1().OSLK == '1' || DoubleLockStatus() || Halted() then return FALSE; end; let route_to_el2 : boolean = (HaveEL(EL2) && (from_state != SS_Secure || IsSecureEL2Enabled()) && (HCR_EL2().TGE == '1' || MDCR_EL2().TDE == '1')); let target : bits(2) = (if route_to_el2 then EL2 else EL1); var enabled : boolean; if HaveEL(EL3) && from_state == SS_Secure then enabled = MDCR_EL3().SDD == '0'; if from_el == EL0 && ELUsingAArch32(EL1) then enabled = enabled || SDER32_EL3().SUIDEN == '1'; end; else enabled = TRUE; end; if from_el == target then enabled = enabled && MDSCR_EL1().KDE == '1' && mask == '0'; else enabled = enabled && UInt(target) > UInt(from_el); end; return enabled; end;

// AArch64_TRCIT() // =============== // Determines whether an Instrumentation trace packet should // be generated and then generates an instrumentation trace packet // containing the value of the register passed as an argument func AArch64_TRCIT(Xt : bits(64)) begin let ss = CurrentSecurityState(); if TraceInstrumentationAllowed(ss, PSTATE.EL) then TraceInstrumentation(Xt); end; end;

// AArch64_IncrementCycleCounter() // =============================== // Increment the cycle counter and possibly set overflow bits. func AArch64_IncrementCycleCounter() begin if !CountPMUEvents(CYCLE_COUNTER_ID) then return; end; var d : bit = PMCR_EL0().D; // Check divide-by-64 var lc : bit = PMCR_EL0().LC; var lc_enabled : boolean; (lc_enabled, -) = PMUExceptionEnabled(); lc = if lc_enabled then '1' else lc; // Effective value of 'D' bit is 0 when Effective value of LC is '1' if lc == '1' then d = '0'; end; if d == '1' && !HasElapsed64Cycles() then return; end; let old_value : integer = UInt(PMCCNTR_EL0()); let new_value : integer = old_value + 1; PMCCNTR_EL0() = new_value[63:0]; let ovflw : integer{} = if HaveAArch32() && lc == '0' then 32 else 64; if old_value[64:ovflw] != new_value[64:ovflw] then PMOVSSET_EL0().C = '1'; end; return; end;

// AArch64_IncrementEventCounter() // =============================== // Increment the specified event counter 'idx' by the specified amount 'increment'. // 'Vm' is the value event counter 'idx-1' is being incremented by if 'idx' is odd, // zero otherwise. // Returns the amount the counter was incremented by. func AArch64_IncrementEventCounter(idx : integer, increment_in : integer, Vm : integer) => integer begin var old_value : integer; var new_value : integer; old_value = UInt(PMEVCNTR_EL0(idx)); let increment : integer = PMUCountValue(idx, increment_in, Vm); new_value = old_value + increment; var lp : bit; if IsFeatureImplemented(FEAT_PMUv3p5) then PMEVCNTR_EL0(idx) = new_value[63:0]; var pmuexception_enabled : boolean; (pmuexception_enabled, -) = PMUExceptionEnabled(); if pmuexception_enabled then lp = '1'; else case GetPMUCounterRange(idx) of when PMUCounterRange_R1 => lp = PMCR_EL0().LP; when PMUCounterRange_R2 => lp = MDCR_EL2().HLP; when PMUCounterRange_R3 => lp = '1'; otherwise => unreachable; end; end; else lp = '0'; PMEVCNTR_EL0(idx) = ZeroExtend{64}(new_value[31:0]); end; let ovflw : integer{} = if lp == '1' then 64 else 32; if old_value[64:ovflw] != new_value[64:ovflw] then PMOVSSET_EL0()[idx] = '1'; // Check for the CHAIN event from an even counter if (idx[0] == '0' && idx + 1 < NUM_PMU_COUNTERS && lp == '0' && (GetPMUCounterRange(idx) == GetPMUCounterRange(idx+1) || ConstrainUnpredictableBool(Unpredictable_COUNT_CHAIN))) then // If PMU counters idx and idx+1 are not in same range, // it is CONSTRAINED UNPREDICTABLE if CHAIN event is counted PMUEvent(PMU_EVENT_CHAIN, 1, idx + 1); end; end; return increment; end;

// AArch64_PMUCycle() // ================== // Called at the end of each cycle to increment event counters and // check for PMU overflow. In pseudocode, a cycle ends after the // execution of the operational pseudocode. func AArch64_PMUCycle() begin if !IsFeatureImplemented(FEAT_PMUv3) then return; end; PMUEvent(PMU_EVENT_CPU_CYCLES); let counters : integer = NUM_PMU_COUNTERS; var Vm : integer = 0; if counters != 0 then for idx = 0 to counters - 1 do if CountPMUEvents(idx) then let accumulated : integer = PMUEventAccumulator[[idx]]; if (idx MOD 2) == 0 then Vm = 0; end; Vm = AArch64_IncrementEventCounter(idx, accumulated, Vm); end; PMUEventAccumulator[[idx]] = 0; end; end; AArch64_IncrementCycleCounter(); CheckForPMUOverflow(); end;

// TakeProfilingException() // ======================== // Takes a Profiling exception. func TakeProfilingException(target_el : bits(2), fsc : bits(5), synchronous : boolean) begin var except : ExceptionRecord = ExceptionSyndrome(Exception_Profiling); except.syndrome.iss[5:1] = fsc; if synchronous then except.syndrome.iss[0] = '1'; end; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// CheckForSPEException() // ====================== // Take an SPE Profiling exception if pending, permitted, and unmasked. func CheckForSPEException() begin if !IsFeatureImplemented(FEAT_SPE_EXC) then return; end; if Halted() || Restarting() then return; end; var route_to_el3 : boolean = FALSE; var route_to_el2 : boolean = FALSE; var route_to_el1 : boolean = FALSE; if HaveEL(EL3) && MDCR_EL3().PMSEE == '1x' then let pending : boolean = PMBSR_EL3().S == '1'; let masked : boolean = PSTATE.EL == EL3; route_to_el3 = pending && !masked; end; var owning_ss : SecurityState; var owning_el : bits(2); (owning_ss, owning_el) = ProfilingBufferOwner(); let in_owning_ss : boolean = IsCurrentSecurityState(owning_ss); if EffectivePMSCR_EL2_EE() == '1x' then let pending : boolean = PMBSR_EL2().S == '1'; let masked : boolean = (!in_owning_ss || PSTATE.EL == EL3 || (PSTATE.EL == EL2 && (PMSCR_EL2().EE != '11' || PMSCR_EL2().KE == '0' || PSTATE.PM == '1')) ); route_to_el2 = pending && !masked; end; if EffectivePMSCR_EL1_EE() == '11' then let pending : boolean = PMBSR_EL1().S == '1'; let masked : boolean = (!in_owning_ss || PSTATE.EL IN {EL3, EL2} || (PSTATE.EL == EL1 && (PMSCR_EL1().KE == '0' || PSTATE.PM == '1')) ); if EffectiveTGE() == '1' then route_to_el2 = route_to_el2 || (pending && !masked); else route_to_el1 = pending && !masked; end; end; let fsc : bits(5) = '00001'; // SPE exception let synchronous : boolean = FALSE; // The relative priorities of the following checks is IMPLEMENTATION DEFINED if route_to_el3 then TakeProfilingException(EL3, fsc, synchronous); end; if route_to_el2 then TakeProfilingException(EL2, fsc, synchronous); end; if route_to_el1 then TakeProfilingException(EL1, fsc, synchronous); end; end;

// CheckMDCR_EL3_NSPBTrap() // ======================== // Check if the register access is trappable by MDCR_EL3.[NSPBE, NSPB] func CheckMDCR_EL3_NSPBTrap() => boolean begin var state_bits : bits(3); var reserved : boolean; (state_bits, reserved) = EffectiveMDCR_EL3_NSPB(); return ((reserved && ConstrainUnpredictableBool(Unpredictable_RESERVEDNSxB_Trap)) || state_bits[0] == '0' || state_bits[1] != EffectiveSCR_EL3_NS() || (IsFeatureImplemented(FEAT_RME) && state_bits[2] != EffectiveSCR_EL3_NSE())); end;

// CollectContextIDR1() // ==================== func CollectContextIDR1() => boolean begin if !StatisticalProfilingEnabled() then return FALSE; end; if PSTATE.EL == EL2 then return FALSE; end; if EL2Enabled() && HCR_EL2().TGE == '1' then return FALSE; end; return PMSCR_EL1().CX == '1'; end;

// CollectContextIDR2() // ==================== func CollectContextIDR2() => boolean begin if !StatisticalProfilingEnabled() then return FALSE; end; if !EL2Enabled() then return FALSE; end; return PMSCR_EL2().CX == '1'; end;

// CollectPhysicalAddress() // ======================== func CollectPhysicalAddress() => boolean begin if !StatisticalProfilingEnabled() then return FALSE; end; let (owning_ss, owning_el) : (SecurityState, bits(2)) = ProfilingBufferOwner(); if HaveEL(EL2) && (owning_ss != SS_Secure || IsSecureEL2Enabled()) then return PMSCR_EL2().PA == '1' && (owning_el == EL2 || PMSCR_EL1().PA == '1'); else return PMSCR_EL1().PA == '1'; end; end;

// CollectTimeStamp() // ================== func CollectTimeStamp() => TimeStamp begin if !StatisticalProfilingEnabled() then return TimeStamp_None; end; let (-, owning_el) = ProfilingBufferOwner(); if owning_el == EL2 then if PMSCR_EL2().TS == '0' then return TimeStamp_None; end; else if PMSCR_EL1().TS == '0' then return TimeStamp_None; end; end; var PCT_el1 : bits(2); if !IsFeatureImplemented(FEAT_ECV) then PCT_el1 = '0'::PMSCR_EL1().PCT[0]; // PCT[1] is RES0 else PCT_el1 = PMSCR_EL1().PCT; if PCT_el1 == '10' then // Reserved value (-, PCT_el1) = ConstrainUnpredictableBits{2}(Unpredictable_PMSCR_PCT); end; end; if EL2Enabled() then var PCT_el2 : bits(2); if !IsFeatureImplemented(FEAT_ECV) then PCT_el2 = '0'::PMSCR_EL2().PCT[0]; // PCT[1] is RES0 else PCT_el2 = PMSCR_EL2().PCT; if PCT_el2 == '10' then // Reserved value (-, PCT_el2) = ConstrainUnpredictableBits{2}(Unpredictable_PMSCR_PCT); end; end; case PCT_el2 of when '00' => return if IsInHost() then TimeStamp_Physical else TimeStamp_Virtual; when '01' => if owning_el == EL2 then return TimeStamp_Physical; end; when '11' => assert IsFeatureImplemented(FEAT_ECV); // FEAT_ECV must be implemented if owning_el == EL1 && PCT_el1 == '00' then return if IsInHost() then TimeStamp_Physical else TimeStamp_Virtual; else return TimeStamp_OffsetPhysical; end; otherwise => unreachable; end; end; case PCT_el1 of when '00' => return if IsInHost() then TimeStamp_Physical else TimeStamp_Virtual; when '01' => return TimeStamp_Physical; when '11' => assert IsFeatureImplemented(FEAT_ECV); // FEAT_ECV must be implemented return TimeStamp_OffsetPhysical; otherwise => unreachable; end; end;

// DefaultSPEEvent() // ================= // Return the target ELx for an indirect write to PMBSR_ELx for an Other buffer management // event or anything other than a buffer management event. func DefaultSPEEvent() => bits(2) begin return ReportSPEEvent(Zeros{6}, ARBITRARY : bits(6)); end;

// EffectiveMDCR_EL3_NSPB() // ======================== // Return the Effective value of MDCR_EL3.[NSPBE, NSPB] field and whether it is a reserved value. readonly func EffectiveMDCR_EL3_NSPB() => (bits(3), boolean) begin var state_bits : bits(3); var reserved : boolean = FALSE; if IsFeatureImplemented(FEAT_RME) then state_bits = MDCR_EL3().[NSPBE, NSPB]; if state_bits == '10x' || (!IsFeatureImplemented(FEAT_Secure) && state_bits == '00x') then // Reserved value reserved = TRUE; (-, state_bits) = ConstrainUnpredictableBits{3}(Unpredictable_RESERVEDNSxB); end; else state_bits = '0' :: MDCR_EL3().NSPB; end; return (state_bits, reserved); end;

// EffectivePMBLIMITR_EL1_nVM() // ============================ func EffectivePMBLIMITR_EL1_nVM() => bit begin if !IsFeatureImplemented(FEAT_SPE_nVM) then return '0'; end; if HaveEL(EL2) then let (owning_ss, owning_el) : (SecurityState, bits(2)) = ProfilingBufferOwner(); if ((owning_ss != SS_Secure || IsSecureEL2Enabled()) && owning_el == EL1 && PMSCR_EL2().EnVM == '0') then return '0'; end; end; return PMBLIMITR_EL1().nVM; end;

// EffectivePMSCR_EL1_EE() // ======================= // Return the Effective value of PMSCR_EL1.EE for the purpose of controlling the // SPE Profiling exception. func EffectivePMSCR_EL1_EE() => bits(2) begin if EffectivePMSCR_EL2_EE() == '00' then return '00'; end; var ee : bits(2) = PMSCR_EL1().EE; if ee IN {'01', '10'} then // Reserved value if IsFeatureImplemented(FEAT_NV) then ee[0] = ee[1]; else var c : Constraint; (c, ee) = ConstrainUnpredictableBits{2}(Unpredictable_RESPMSEE); assert c IN {Constraint_DISABLED, Constraint_UNKNOWN}; if c == Constraint_DISABLED then ee = '00'; end; // Otherwise the value returned by ConstrainUnpredictableBits must be // a non-reserved value end; end; return ee; end;

// EffectivePMSCR_EL2_EE() // ======================= // Return the Effective value of PMSCR_EL2.EE. readonly func EffectivePMSCR_EL2_EE() => bits(2) begin if !IsFeatureImplemented(FEAT_SPE_EXC) then return '00'; end; if HaveEL(EL3) && MDCR_EL3().PMSEE == '00' then return '00'; end; let check_el2 : boolean = (HaveEL(EL2) && (EffectiveSCR_EL3_NS() == '1' || IsSecureEL2Enabled())); return if check_el2 then PMSCR_EL2().EE else '01'; end;

// GetPMBSR_EL1_FSC() // ================== // Query the PMBSR_EL1.FSC field. func GetPMBSR_EL1_FSC() => bits(6) begin var FSC : bits(6); FSC = PMBSR_EL1()[5:0]; return FSC; end;

// GetPMBSR_EL2_FSC() // ================== // Query the PMBSR_EL2.FSC field. func GetPMBSR_EL2_FSC() => bits(6) begin var FSC : bits(6); FSC = PMBSR_EL2()[5:0]; return FSC; end;

// GetPMBSR_EL3_FSC() // ================== // Query the PMBSR_EL3.FSC field. func GetPMBSR_EL3_FSC() => bits(6) begin var FSC : bits(6); FSC = PMBSR_EL3()[5:0]; return FSC; end;

// OtherSPEManagementEvent() // ========================= // Report an Other buffer management event, with the status code 'bsc' func OtherSPEManagementEvent(bsc : bits(6)) begin let target_el : bits(2) = DefaultSPEEvent(); if PMBSR_EL(target_el).S == '0' then PMBSR_EL(target_el).S = '1'; // Assert interrupt or exception PMBSR_EL(target_el).EC = '000000'; // Other buffer management event PMBSR_EL(target_el).MSS = ZeroExtend{16}(bsc); PMBSR_EL(target_el).MSS2 = Zeros{24}; end; end;

// PMBSR_EL - accessor // =================== accessor PMBSR_EL(el : bits(2)) <=> value : PMBSRType begin getter var r : bits(64); case el of when EL1 => r = PMBSR_EL1(); when EL2 => r = PMBSR_EL2(); when EL3 => r = PMBSR_EL3(); otherwise => unreachable; end; return r; end; setter let r : bits(64) = value; case el of when EL1 => PMBSR_EL1() = r; when EL2 => PMBSR_EL2() = r; when EL3 => PMBSR_EL3() = r; otherwise => unreachable; end; return; end; end;

// ProfilingBufferEnabled() // ======================== readonly func ProfilingBufferEnabled() => boolean begin if !IsFeatureImplemented(FEAT_SPE) then return FALSE; end; let (-, owning_el) : (SecurityState, bits(2)) = ProfilingBufferOwner(); return !ELUsingAArch32(owning_el) && PMBLIMITR_EL1().E == '1'; end;

// ProfilingBufferOwner() // ====================== readonly func ProfilingBufferOwner() => (SecurityState, bits(2)) begin var owning_ss : SecurityState; var state_bits : bits(3); if HaveEL(EL3) then (state_bits, -) = EffectiveMDCR_EL3_NSPB(); else state_bits = if SecureOnlyImplementation() then '001' else '011'; end; case state_bits of when '00x' => owning_ss = SS_Secure; when '01x' => owning_ss = SS_NonSecure; when '11x' => owning_ss = SS_Realm; end; var owning_el : bits(2); if HaveEL(EL2) && (owning_ss != SS_Secure || IsSecureEL2Enabled()) then owning_el = if MDCR_EL2().E2PB == '00' then EL2 else EL1; else owning_el = EL1; end; return (owning_ss, owning_el); end;

// ReportSPEEvent() // ================ // Return the target ELx for an indirect write to PMBSR_ELx. // When the indirect write is due to a buffer management event: // 'ec_bits' is the Event Class for the management event. // 'fsc_bits' is the Fault Status Code when this is a fault, ignored otherwise. // Otherwise, 'ec_bits' should be Zeros(). func ReportSPEEvent(ec_bits : bits(6), fsc_bits : bits(6)) => bits(2) begin var target_el : bits(2); var route_to_el3 : boolean = FALSE; var route_to_el2 : boolean = FALSE; if IsFeatureImplemented(FEAT_SPE_EXC) then if ec_bits == '011111' then // implementation defined fault return ImpDefBits{2}("target_el for SPE ImpDef Fault"); end; let s1fault : boolean = (ec_bits == '100100'); // Stage 1 fault let s2fault : boolean = (ec_bits == '100101'); // Stage 2 fault var gpcfault, gpfault : boolean; if IsFeatureImplemented(FEAT_RME) then // Granule Protection Check fault, other than GPF. That is, a GPT address size fault, // GPT walk fault, or synchronous External abort on GPT fetch. gpcfault = (ec_bits == '011110'); // Other Granule Protection Fault, reported as Stage 1 or Stage 2 fault. gpfault = ((s1fault || s2fault) && fsc_bits IN {'10001x', '1001xx', '101000'}); else gpcfault = FALSE; gpfault = FALSE; end; let sync_ext_abort : boolean = ((s1fault || s2fault) && fsc_bits IN {'010000', '01001x', '0101xx', '011011'}); var owning_ss : SecurityState; var owning_el : bits(2); (owning_ss, owning_el) = ProfilingBufferOwner(); if HaveEL(EL3) && MDCR_EL3().PMSEE == '1x' then route_to_el3 = (MDCR_EL3().PMSEE == '11' || gpcfault || (gpfault && SCR_EL3().GPF == '1') || (sync_ext_abort && EffectiveEA() == '1')); end; if EffectivePMSCR_EL2_EE() == '1x' then route_to_el2 = (PMSCR_EL2().EE == '11' || (s1fault && owning_el == EL2) || s2fault || gpcfault || (gpfault && HCR_EL2().GPF == '1') || (sync_ext_abort && EffectiveHCR_TEA() == '1')); end; end; if route_to_el3 then target_el = EL3; elsif route_to_el2 then target_el = EL2; else target_el = EL1; end; return target_el; end;

// SPE Implementation Constants // ============================ constant SPEMaxAddrs : integer{} = 32; constant SPEMaxCounters : integer{} = 32; constant SPEMaxRecordSize : integer{} = 2048;

// SPEAddByteToRecord() // ==================== // Add one byte to a record and increase size property appropriately. func SPEAddByteToRecord(b : bits(8)) begin assert SPERecordSize < SPEMaxRecordSize; SPERecordData[[SPERecordSize]] = b; SPERecordSize = SPERecordSize + 1; end;

// SPEAddPacketToRecord() // ====================== // Add passed header and payload data to the record. // Payload must be a multiple of 8. func SPEAddPacketToRecord{N}(header_hi : bits(2), header_lo : bits(4), payload : bits(N)) begin assert N MOD 8 == 0; var sz : bits(2); case N of when 8 => sz = '00'; when 16 => sz = '01'; when 32 => sz = '10'; when 64 => sz = '11'; otherwise => unreachable; end; let header : bits(8) = header_hi::sz::header_lo; SPEAddByteToRecord(header); for i = 0 to (N DIV 8)-1 do SPEAddByteToRecord(payload[i*:8]); end; end;

// SPEBranch() // =========== // Called on every branch if SPE is present. Maintains previous branch target // and branch related SPE functionality. func SPEBranch{N}(target : bits(N), branch_type : BranchType, conditional : boolean, taken_flag : boolean) begin let is_isb : boolean = FALSE; SPEBranch{N}(target, branch_type, conditional, taken_flag, is_isb); end; func SPEBranch{N}(target : bits(N), branch_type : BranchType, conditional : boolean, taken_flag : boolean, is_isb : boolean) begin // If the PE implements branch prediction, data about (mis)prediction is collected // through the PMU events. var collect_prev_br : boolean; let collect_prev_br_eret : boolean = ImpDefBool("SPE prev br on eret"); let collect_prev_br_exception : boolean = (ImpDefBool( "SPE prev br on exception")); let collect_prev_br_isb : boolean = ImpDefBool("SPE prev br on isb"); case branch_type of when BranchType_EXCEPTION => collect_prev_br = collect_prev_br_exception; when BranchType_ERET => collect_prev_br = collect_prev_br_eret; otherwise => collect_prev_br = !is_isb || collect_prev_br_isb; end; // Implements previous branch target functionality if (taken_flag && IsFeatureImplemented(FEAT_SPE_PBT) && StatisticalProfilingEnabled() && collect_prev_br) then if SPESampleInFlight then let previous_target : bits(64) = SPESamplePreviousBranchAddress; SPESampleAddress[[SPEAddrPosPrevBranchTarget]][63:0] = previous_target[63:0]; let previous_branch_valid : boolean = SPESamplePreviousBranchAddressValid; SPESampleAddressValid[[SPEAddrPosPrevBranchTarget]] = previous_branch_valid; end; // Save the target address for it to be added to a future record. SPESamplePreviousBranchAddress[55:0] = target[55:0]; var ns : bit; var nse : bit; case CurrentSecurityState() of when SS_Secure => ns = '0'; nse = '0'; when SS_NonSecure => ns = '1'; nse = '0'; when SS_Realm => ns = '1'; nse = '1'; otherwise => unreachable; end; SPESamplePreviousBranchAddress[63] = ns; SPESamplePreviousBranchAddress[60] = nse; SPESamplePreviousBranchAddress[62:61] = PSTATE.EL; SPESamplePreviousBranchAddressValid = TRUE; end; if !StatisticalProfilingEnabled() then if taken_flag then // Invalidate previous branch address, if profiling is disabled // or prohibited. SPESamplePreviousBranchAddressValid = FALSE; end; return; end; if SPESampleInFlight then SPESampleOpAttr.branch_is_direct = branch_type IN {BranchType_DIR, BranchType_DIRCALL}; SPESampleOpAttr.branch_has_link = branch_type IN {BranchType_DIRCALL, BranchType_INDCALL}; SPESampleOpAttr.procedure_return = branch_type == BranchType_RET; SPESampleOpAttr.op_type = SPEOpType_Branch; SPESampleOpAttr.is_conditional = conditional; SPESampleOpAttr.cond_pass = taken_flag; // Save the target address. if taken_flag then var ns : bit; var nse : bit; case CurrentSecurityState() of when SS_Secure => ns = '0'; nse = '0'; when SS_NonSecure => ns = '1'; nse = '0'; when SS_Realm => ns = '1'; nse = '1'; otherwise => unreachable; end; let el : bits(2) = PSTATE.EL; SPESampleAddress[[SPEAddrPosBranchTarget]][55:0] = target[55:0]; SPESampleAddress[[SPEAddrPosBranchTarget]][63:56] = ns::el::nse::Zeros{4}; SPESampleAddressValid[[SPEAddrPosBranchTarget]] = TRUE; end; end; end;

// SPEBufferIsFull() // ================= // Return true if another full size sample record would not fit in the // profiling buffer. func SPEBufferIsFull() => boolean begin let write_pointer_limit : integer = UInt(PMBLIMITR_EL1().LIMIT::Zeros{12}); let current_write_pointer : integer = UInt(PMBPTR_EL1()); let record_max_size : integer = 1 << UInt(PMSIDR_EL1().MaxSize); return current_write_pointer > (write_pointer_limit - record_max_size); end;

// SPECollectRecord() // ================== // Returns TRUE if the sampled class of instructions or operations, as // determined by PMSFCR_EL1, are recorded and FALSE otherwise. func SPECollectRecord(events : bits(64), total_latency : integer, optype : SPEOpType) => boolean begin // Filtering by events var is_rejected_event : boolean; var is_rejected_nevent : boolean; (is_rejected_event, is_rejected_nevent) = SPEFilterByEvents(events); // Filtering by type let is_rejected_type : boolean = SPEFilterByType(SPESampleOpAttr); // Filtering by latency let is_rejected_latency : boolean = SPEFilterByLatency(total_latency); let is_rejected_data_source : boolean = SPEFilterByDataSource(optype); var return_value : boolean; return_value = !(is_rejected_nevent || is_rejected_event || is_rejected_type || is_rejected_latency || is_rejected_data_source); if return_value then PMUEvent(PMU_EVENT_SAMPLE_FILTRATE); end; return return_value; end;

// SPECompleteSample() // =================== // Called to complete the sampling process. func SPECompleteSample() begin assert SPESampleInFlight; PMUEvent(PMU_EVENT_SAMPLE_FEED); // Stop any pending counters for counter_index = 0 to (SPEMaxCounters - 1) do if SPESampleCounterPending[[counter_index]] then SPEStopCounter(counter_index); end; end; // Record any IMPLEMENTATION DEFINED events let impdef_events : bits(64) = ImpDefBits{}("SPE EVENTS"); SPESampleEvents[63:48] = impdef_events[63:48]; // The number of bits available for IMPLEMENTATION DEFINED events // is reduced by FEAT_SPEv1p4 if !IsFeatureImplemented(FEAT_SPEv1p4) then SPESampleEvents[31:24] = impdef_events[31:24]; end; SPESampleEvents[15:12] = impdef_events[15:12]; // Bit 24 encodes whether the sample was collected in Streaming SVE mode. if IsFeatureImplemented(FEAT_SPE_SME) then SPESampleEvents[24] = PSTATE.SM; end; SPESampleEvents[6] = if (SPESampleOpAttr.is_conditional && !SPESampleOpAttr.cond_pass) then '1' else '0'; var collect_record : boolean; collect_record = SPECollectRecord(SPESampleEvents, SPESampleCounter[[SPECounterPosTotalLatency]], SPESampleOpAttr.op_type); var discard : boolean = FALSE; if IsFeatureImplemented(FEAT_SPEv1p2) then discard = PMBLIMITR_EL1().FM == '10'; end; if collect_record && !discard then SPEConstructRecord(); if SPEBufferIsFull() then let bsc : bits(6) = '000001'; // Buffer full event OtherSPEManagementEvent(bsc); PMUEvent(PMU_EVENT_SAMPLE_BUFFER_FULL); end; end; SPESampleInFlight = FALSE; SPEResetSampleStorage(); end; // Order of addresses in sample storage and architectural index values constant SPEAddrPosPCVirtual : integer = 0; constant SPEAddrPosBranchTarget : integer = 1; constant SPEAddrPosDataVirtual : integer = 2; constant SPEAddrPosDataPhysical : integer = 3; constant SPEAddrPosPrevBranchTarget : integer = 4; // Order of counters in sample storage and architectural index values constant SPECounterPosTotalLatency : integer = 0; constant SPECounterPosIssueLatency : integer = 1; constant SPECounterPosTranslationLatency : integer = 2; constant SPECounterPosAltIssueLatency : integer = 4; // Sample in-flight flag var SPESampleInFlight : boolean = FALSE; // Globally declared variables which store data about the sample. // Context storage var SPESampleContextEL1 : bits(32); var SPESampleContextEL1Valid : boolean; var SPESampleContextEL2 : bits(32); var SPESampleContextEL2Valid : boolean; // Counter storage var SPESampleCounter : array [[SPEMaxCounters]] of integer; var SPESampleCounterValid : array [[SPEMaxCounters]] of boolean; var SPESampleCounterPending : array [[SPEMaxCounters]] of boolean; // Address storage var SPESampleAddress : array [[SPEMaxAddrs]] of bits(64); var SPESampleAddressValid : array [[SPEMaxAddrs]] of boolean; var SPESamplePreviousBranchAddress : bits(64); var SPESamplePreviousBranchAddressValid : boolean; // Data source storage var SPESampleDataSource : bits(16); var SPESampleDataSourceValid : boolean; // OpAttr storage var SPESampleOpAttr : SPEOpAttr; // Timestamp storage var SPESampleTimestamp : bits(64); var SPESampleTimestampValid : boolean; // Event storage var SPESampleEvents : bits(64);

// SPEConstructClass() // =================== // Constructs the encodings for the class and subclass fields. func SPEConstructClass() => (bits(2), bits(8)) begin var op_class : bits(2); var op_subclass : bits(8); let cond : bit = if SPESampleOpAttr.is_conditional then '1' else '0'; let fp : bit = if SPESampleOpAttr.is_floating_point then '1' else '0'; let ldst : bit = if SPESampleOpAttr.op_type == SPEOpType_Store then '1' else '0'; let ar : bit = if SPESampleOpAttr.is_acquire_release then '1' else '0'; let excl : bit = if SPESampleOpAttr.is_exclusive then '1' else '0'; let at : bit = if SPESampleOpAttr.at then '1' else '0'; let indirect : bit = if SPESampleOpAttr.branch_is_direct then '0' else '1'; let pred : bit = if SPESampleOpAttr.is_predicated then '1' else '0'; let sg : bit = if SPESampleOpAttr.is_gather_scatter then '1' else '0'; let evl : bits(3) = SPESampleOpAttr.evl; let simd : bit = if SPESampleOpAttr.is_simd then '1' else '0'; let ets : bits(4) = SPESampleOpAttr.ets; // Since this implementation of SPE samples instruction instead of micro-operations, a // Branch with link or Procedure return instruction will never be recorded as a "Load/store, // GCS" format Operation Type packet. Therefore the COMMON bit is hard-wired to '1'. let common : bit = '1'; if SPESampleOpAttr.op_type == SPEOpType_Other then op_class = '00'; op_subclass = Zeros{5}::simd::fp::cond; elsif SPESampleOpAttr.op_type == SPEOpType_OtherSVE then op_class = '00'; op_subclass = '0'::evl::'1'::pred::fp::'0'; elsif SPESampleOpAttr.op_type == SPEOpType_OtherSME then op_class = '00'; op_subclass = '1'::ets[3:1]::'1'::ets[0]::fp::'0'; elsif SPESampleOpAttr.op_type == SPEOpType_Branch then op_class = '10'; var cr : bits(2) = '00'; var gcs : bit = '0'; if IsFeatureImplemented(FEAT_SPE_CRR) then if SPESampleOpAttr.branch_has_link then cr = '01'; elsif SPESampleOpAttr.procedure_return then cr = '10'; else cr = '11'; end; end; if IsFeatureImplemented(FEAT_GCS) then if (SPESampleOpAttr.ldst_type == SPELDSTType_GCS && (SPESampleOpAttr.branch_has_link || SPESampleOpAttr.procedure_return)) then gcs = '1'; end; end; op_subclass = Zeros{3}::cr::gcs::indirect::cond; elsif SPESampleOpAttr.op_type IN {SPEOpType_Load, SPEOpType_Store, SPEOpType_LoadAtomic} then op_class = '01'; case SPESampleOpAttr.ldst_type of when SPELDSTType_NV2 => op_subclass = '0011000'::ldst; when SPELDSTType_Extended => op_subclass = '000'::ar::excl::at::'1'::ldst; when SPELDSTType_General => op_subclass = Zeros{7}::ldst; when SPELDSTType_SIMDFP => op_subclass = '0000010'::ldst; when SPELDSTType_SVESME => op_subclass = sg::evl::'1'::pred::'0'::ldst; when SPELDSTType_Unspecified => op_subclass = '0001000'::ldst; when SPELDSTType_Tags => op_subclass = '0001010'::ldst; when SPELDSTType_MemCopy => op_subclass = '0010000'::ldst; when SPELDSTType_MemSet => op_subclass = '00100101'; when SPELDSTType_GCS => op_subclass = '01000'::common::'0'::ldst; when SPELDSTType_GCSSS2 => unreachable; // GCSSS2 is converted to GCS, should not appear here otherwise => unreachable; end; else unreachable; end; return (op_class, op_subclass); end;

// SPEConstructRecord() // ==================== // Create new record and populate it with packets using sample storage data. // This is an example implementation, packets may appear in // any order as long as the record ends with an End or Timestamp packet. func SPEConstructRecord() begin // Empty the record. SPEEmptyRecord(); var op_class : bits(2); var op_subclass : bits(8); (op_class, op_subclass) = SPEConstructClass(); // Add operation details SPEAddPacketToRecord{8}('01', '10'::op_class, op_subclass); // Add contextEL1 if available if SPESampleContextEL1Valid then SPEAddPacketToRecord{32}('01', '0100', SPESampleContextEL1); end; // Add contextEL2 if available if SPESampleContextEL2Valid then SPEAddPacketToRecord{32}('01', '0101', SPESampleContextEL2); end; // Add valid counters for counter_index = 0 to (SPEMaxCounters - 1) do if SPESampleCounterValid[[counter_index]] then if counter_index >= 8 then // Need extended format SPEAddByteToRecord('001000'::counter_index[4:3]); end; // Check for overflow let large_counters : boolean = ImpDefBool("SPE 16bit counters"); if large_counters then if SPESampleCounter[[counter_index]] > 0xFFFF then SPESampleCounter[[counter_index]] = 0xFFFF; end; else if SPESampleCounter[[counter_index]] > 0xFFF then SPESampleCounter[[counter_index]] = 0xFFF; end; end; // Add byte0 for short format (byte1 for extended format) SPEAddPacketToRecord{16}('10', '1'::counter_index[2:0], SPESampleCounter[[counter_index]][15:0]); end; end; // Add valid addresses if IsFeatureImplemented(FEAT_SPE_PBT) then // Under the some conditions, it is IMPLEMENTATION_DEFINED whether // previous branch packet is present. let include_prev_br : boolean = (ImpDefBool( "SPE get prev br if not br")); if SPESampleOpAttr.op_type != SPEOpType_Branch && !include_prev_br then SPESampleAddressValid[[SPEAddrPosPrevBranchTarget]] = FALSE; end; end; // Data Virtual address should not be collected if this was an NV2 access and Statistical // Profiling is disabled at EL2. if !StatisticalProfilingEnabled(EL2) && SPESampleOpAttr.ldst_type == SPELDSTType_NV2 then SPESampleAddressValid[[SPEAddrPosDataVirtual]] = FALSE; end; for address_index = 0 to (SPEMaxAddrs - 1) do if SPESampleAddressValid[[address_index]] then if address_index >= 8 then // Need extended format SPEAddByteToRecord('001000'::address_index[4:3]); end; // Add byte0 for short format (byte1 for extended format) SPEAddPacketToRecord{64}('10', '0'::address_index[2:0], SPESampleAddress[[address_index]]); end; end; // Add Data Source if SPESampleDataSourceValid then let ds_payload_size : integer{} = SPEGetDataSourcePayloadSize(); SPEAddPacketToRecord{8 * ds_payload_size}('01', '0011', SPESampleDataSource[8*ds_payload_size-1:0]); end; // Add events // Get size of payload in bytes. let payload_size : integer{} = SPEGetEventsPayloadSize(); SPEAddPacketToRecord{8 * payload_size}('01', '0010', SPESampleEvents[8*payload_size-1:0]); // Add Timestamp to end the record if one is available. // Otherwise end with an End packet. if SPESampleTimestampValid then SPEAddPacketToRecord{64}('01', '0001', SPESampleTimestamp); else SPEAddByteToRecord('00000001'); end; // Add padding while SPERecordSize MOD (1<<UInt(PMBIDR_EL1().Align)) != 0 looplimit 2048 do SPEAddByteToRecord(Zeros{8}); end; SPEWriteToBuffer(); CTI_SignalEvent(CrossTriggerIn_SPESample); end;

// SPECycle() // ========== // Function called at the end of every cycle. Responsible for asserting interrupts // and advancing counters. func SPECycle() begin if !IsFeatureImplemented(FEAT_SPE) then return; end; // Increment pending counters if SPESampleInFlight then for i = 0 to (SPEMaxCounters - 1) do if SPESampleCounterPending[[i]] then SPESampleCounter[[i]] = SPESampleCounter[[i]] + 1; end; end; end; // Assert PMBIRQ if appropriate. if SPEInterruptEnabled() && PMBSR_EL1().S == '1' then SetInterruptRequestLevel(InterruptID_PMBIRQ, HIGH); else SetInterruptRequestLevel(InterruptID_PMBIRQ, LOW); end; end;

// SPEEmptyRecord() // ================ // Reset record data. func SPEEmptyRecord() begin SPERecordSize = 0; for i = 0 to (SPEMaxRecordSize - 1) do SPERecordData[[i]] = Zeros{8}; end; end;

// SPEEncodeETS() // ============== // Encodes an integer tile size length into the ets field for the SPE operation type packet. func SPEEncodeETS(size : integer) => bits(4) begin var ets : bits(4); if size <= 128 then ets = '0000'; elsif size <= 256 then ets = '0001'; elsif size <= 512 then ets = '0010'; elsif size <= 1024 then ets = '0011'; elsif size <= 2048 then ets = '0100'; elsif size <= 4096 then ets = '0101'; elsif size <= 8192 then ets = '0110'; elsif size <= 16384 then ets = '0111'; elsif size <= 32768 then ets = '1000'; elsif size <= 65536 then ets = '1001'; elsif size <= 131072 then ets = '1010'; elsif size <= 262144 then ets = '1011'; else ets = '1111'; end; return ets; end;

// SPEEncodeEVL() // ============== // Encodes an integer vector length into the evl field for the SPE operation type packet. func SPEEncodeEVL(vl : integer) => bits(3) begin var evl : bits(3); if vl <= 32 then evl = '000'; elsif vl <= 64 then evl = '001'; elsif vl <= 128 then evl = '010'; elsif vl <= 256 then evl = '011'; elsif vl <= 512 then evl = '100'; elsif vl <= 1024 then evl = '101'; elsif vl <= 2048 then evl = '110'; else if IsFeatureImplemented(FEAT_SPE_SME) then evl = '111'; else unreachable; end; end; return evl; end;

// SPEEvent() // ========== // Called when a PMU event is generated by the sampled structure. // Sets appropriate bit in SPESampleStorage.events. func SPEEvent(pmuevent : bits(16)) begin if !SPESampleInFlight then return; end; case pmuevent of when PMU_EVENT_DSNP_HIT_RD => if IsFeatureImplemented(FEAT_SPEv1p4) then SPESampleEvents[23] = '1'; // Snoop hit end; when {PMU_EVENT_L1D_LFB_HIT_RD, PMU_EVENT_L2D_LFB_HIT_RD, PMU_EVENT_L3D_LFB_HIT_RD, PMU_EVENT_LL_LFB_HIT_RD} => if IsFeatureImplemented(FEAT_SPEv1p4) then SPESampleEvents[22] = '1'; // Recent fetch end; when {PMU_EVENT_L1D_CACHE_HITM_RD, PMU_EVENT_L2D_CACHE_HITM_RD, PMU_EVENT_L3D_CACHE_HITM_RD, PMU_EVENT_LL_CACHE_HITM_RD} => if IsFeatureImplemented(FEAT_SPEv1p4) then SPESampleEvents[21] = '1'; // Modified end; when PMU_EVENT_L2D_CACHE_LMISS_RD => if IsFeatureImplemented(FEAT_SPEv1p4) then SPESampleEvents[20] = '1'; // L2 miss end; when PMU_EVENT_L2D_CACHE_RD => if IsFeatureImplemented(FEAT_SPEv1p4) then SPESampleEvents[19] = '1'; // L2 access end; when PMU_EVENT_SVE_PRED_EMPTY_SPEC => if IsFeatureImplemented(FEAT_SPEv1p1) then SPESampleEvents[18] = '1'; // Empty predicate end; when PMU_EVENT_SVE_PRED_NOT_FULL_SPEC => if IsFeatureImplemented(FEAT_SPEv1p1) then SPESampleEvents[17] = '1'; // Partial predicate end; when PMU_EVENT_LDST_ALIGN_LAT => if IsFeatureImplemented(FEAT_SPEv1p1) then SPESampleEvents[11] = '1'; // Misaligned end; when PMU_EVENT_REMOTE_ACCESS => SPESampleEvents[10] = '1'; // Remote access when PMU_EVENT_LL_CACHE_MISS => SPESampleEvents[9] = '1'; // LLC miss when PMU_EVENT_LL_CACHE => SPESampleEvents[8] = '1'; // LLC access when PMU_EVENT_BR_MIS_PRED => SPESampleEvents[7] = '1'; // Mispredicted when PMU_EVENT_BR_MIS_PRED_RETIRED => SPESampleEvents[7] = '1'; // Not taken when PMU_EVENT_DTLB_WALK => SPESampleEvents[5] = '1'; // TLB walk when PMU_EVENT_L1D_TLB => SPESampleEvents[4] = '1'; // TLB access when PMU_EVENT_L1D_CACHE_REFILL => if !IsFeatureImplemented(FEAT_SPEv1p4) then SPESampleEvents[3] = '1'; // L1 refill end; when PMU_EVENT_L1D_CACHE_LMISS_RD => if IsFeatureImplemented(FEAT_SPEv1p4) then SPESampleEvents[3] = '1'; // L1 miss end; when PMU_EVENT_L1D_CACHE => SPESampleEvents[2] = '1'; // L1 access when PMU_EVENT_INST_RETIRED => SPESampleEvents[1] = '1'; // Retire when PMU_EVENT_EXC_TAKEN => SPESampleEvents[0] = '1'; // Exception otherwise => return; end; return; end;

// SPEFilterByDataSource() // ======================= // Carry out filtering by data source. func SPEFilterByDataSource(optype : SPEOpType) => boolean begin // Filtering by Data Source var is_rejected_data_source : boolean = FALSE; if (IsFeatureImplemented(FEAT_SPE_FDS) && SPESampleDataSourceValid && (optype IN {SPEOpType_Load, SPEOpType_LoadAtomic})) then let data_source : bits(16) = SPESampleDataSource; let index : integer = UInt(data_source[5:0]); let is_ds : boolean = PMSDSFR_EL1()[index] == '1'; if is_ds then PMUEvent(PMU_EVENT_SAMPLE_FEED_DS); end; if PMSFCR_EL1().FDS == '1' then // Filtering by Data Source is enabled is_rejected_data_source = !is_ds; end; end; return is_rejected_data_source; end;

// SPEFilterByEvents() // =================== // Carries out filtering by the event bits. func SPEFilterByEvents(events : bits(64)) => (boolean, boolean) begin // "mask" defines which Events packet bits are checked by the filter var mask : bits(64) = Zeros{}; let impdef_mask : bits(64) = ImpDefBits{}("SPE mask"); mask[63:48] = impdef_mask[63:48]; if IsFeatureImplemented(FEAT_SPE_SME) && IsFeatureImplemented(FEAT_SPEv1p4) then mask[25:24] = '11'; // Streaming mode, SMCU end; if IsFeatureImplemented(FEAT_SPEv1p4) then mask[23:19] = '11111'; // Snoop hit, recent fetch, modified, // L2 miss, L2 access else mask[31:24] = impdef_mask[31:24]; end; if IsFeatureImplemented(FEAT_SPEv1p1) && IsFeatureImplemented(FEAT_SVE) then mask[18:17] = '11'; // Predicates end; mask[15:12] = impdef_mask[15:12]; if IsFeatureImplemented(FEAT_SPEv1p1) then mask[11] = '1'; // Data alignment end; if IsFeatureImplemented(FEAT_SPEv1p4) then mask[10:8] = '111'; // Remote access, LLC access, LLC miss else mask[10:8] = impdef_mask[10:8]; end; mask[7] = '1'; // Mispredicted if IsFeatureImplemented(FEAT_SPE_FnE) then mask[6] = '1'; // Not taken end; mask[5,3,1] = '111'; // TLB walk, L1 miss, retired if IsFeatureImplemented(FEAT_SPEv1p4) then mask[4,2] = '11'; // TLB access, L1 access else mask[4,2] = impdef_mask[4,2]; end; let e : bits(64) = events AND mask; // Filtering by event let evfr : bits(64) = PMSEVFR_EL1() AND mask; var is_rejected_event : boolean = FALSE; let is_evt : boolean = IsZero(NOT(e) AND evfr); if PMSFCR_EL1().FE == '1' then // Filtering by event is enabled if !IsZero(evfr) then // Not a CONSTRAINED UNPREDICTABLE case is_rejected_event = !is_evt; else is_rejected_event = ConstrainUnpredictableBool(Unpredictable_BADPMSFCR); end; end; // Filtering by inverse event var is_rejected_nevent : boolean = FALSE; var is_nevt : boolean; if IsFeatureImplemented(FEAT_SPE_FnE) then let nevfr : bits(64) = PMSNEVFR_EL1() AND mask; is_nevt = IsZero(e AND nevfr); if PMSFCR_EL1().FnE == '1' then // Inverse filtering by event is enabled if !IsZero(nevfr) then // Not a CONSTRAINED UNPREDICTABLE case is_rejected_nevent = !is_nevt; else is_rejected_nevent = ConstrainUnpredictableBool(Unpredictable_BADPMSFCR); end; end; else is_nevt = TRUE; // not implemented end; if is_evt && is_nevt then PMUEvent(PMU_EVENT_SAMPLE_FEED_EVENT); end; if (IsFeatureImplemented(FEAT_SPE_FnE) && PMSFCR_EL1().[FnE,FE]== '11' && !IsZero(PMSEVFR_EL1() AND PMSNEVFR_EL1() AND mask)) then // CONSTRAINED UNPREDICTABLE case due to combination of filter and inverse filter is_rejected_nevent = ConstrainUnpredictableBool(Unpredictable_BADPMSFCR); is_rejected_event = ConstrainUnpredictableBool(Unpredictable_BADPMSFCR); end; return (is_rejected_event, is_rejected_nevent); end;

// SPEFilterByLatency() // ==================== // Carries out filtering by latency. func SPEFilterByLatency(total_latency : integer) => boolean begin let is_lat : boolean = (total_latency >= UInt(PMSLATFR_EL1().MINLAT)); if is_lat then PMUEvent(PMU_EVENT_SAMPLE_FEED_LAT); end; var is_rejected_latency : boolean = FALSE; if PMSFCR_EL1().FL == '1' then // Filtering by latency is enabled if !IsZero(PMSLATFR_EL1().MINLAT) then // Not a CONSTRAINED UNPREDICTABLE case is_rejected_latency = is_rejected_latency || !is_lat; else is_rejected_latency = ConstrainUnpredictableBool(Unpredictable_BADPMSFCR); end; end; return is_rejected_latency; end;

// SPEFilterByType() // ================= // Returns TRUE if the operation is to be discarded because of its OpAttrs, and FALSE otherwise. func SPEFilterByType(opattr : SPEOpAttr) => boolean begin // Bit positions in the PMSFCR_EL1().[TYPE, TYPEm] fields let B : integer = 0; let LD : integer = 1; let ST : integer = 2; let FP : integer = 3; let SIMD : integer = 4; var flags : bits(5) = Zeros{}; var ctrl : bits(5) = Zeros{}; // With GCS, Branch Link and Procedure Return instructions write and read the GCS. // BL and RET instructions with GCS enabled call SPESampleLoadStore() before // branch/packet construction, setting ldst_type to indicate a GCS access. let is_gcs_ldst : boolean = (opattr.op_type == SPEOpType_Branch && opattr.ldst_type == SPELDSTType_GCS); let is_load : boolean = (opattr.op_type IN {SPEOpType_Load, SPEOpType_LoadAtomic} || (is_gcs_ldst && opattr.procedure_return)); let is_store : boolean = (opattr.op_type IN {SPEOpType_Store, SPEOpType_LoadAtomic} || (is_gcs_ldst && opattr.branch_has_link)); flags[B] = (if opattr.op_type == SPEOpType_Branch then '1' else '0'); flags[LD] = (if is_load then '1' else '0'); flags[ST] = (if is_store then '1' else '0'); flags[FP] = (if opattr.is_floating_point then '1' else '0'); flags[SIMD] = (if opattr.is_simd then '1' else '0'); ctrl[2:0] = PMSFCR_EL1().TYPE[2:0]; var mask : bits(5) = Zeros{}; if IsFeatureImplemented(FEAT_SPE_EFT) then ctrl[4:3] = PMSFCR_EL1().TYPE[4:3]; mask[4:0] = PMSFCR_EL1().TYPEm; end; let ctrl_or : bits(5) = (ctrl AND (NOT mask)); let ctrl_and : bits(5) = (ctrl AND mask); let is_op : boolean = ((IsZero(ctrl_or) || !IsZero(flags AND ctrl_or)) && ((flags AND mask) == ctrl_and)); if flags[B] == '1' then PMUEvent(PMU_EVENT_SAMPLE_FEED_BR); end; if flags[LD] == '1' then PMUEvent(PMU_EVENT_SAMPLE_FEED_LD); end; if flags[ST] == '1' then PMUEvent(PMU_EVENT_SAMPLE_FEED_ST); end; if flags[FP] == '1' then PMUEvent(PMU_EVENT_SAMPLE_FEED_FP); end; if flags[SIMD] == '1' then PMUEvent(PMU_EVENT_SAMPLE_FEED_SIMD); end; var is_rejected_type : boolean = FALSE; if PMSFCR_EL1().FT == '1' then // Filtering by type is enabled if IsFeatureImplemented(FEAT_SPE_EFT) || !IsZero(ctrl) then is_rejected_type = !is_op; else is_rejected_type = ConstrainUnpredictableBool(Unpredictable_BADPMSFCR); end; end; if is_op && (!IsZero(ctrl) || !IsZero(mask)) then PMUEvent(PMU_EVENT_SAMPLE_FEED_OP); end; return is_rejected_type; end;

// SPEFreezeOnEvent() // ================== // Returns TRUE if PMU event counter idx should be frozen due to an SPE event, and FALSE otherwise. func SPEFreezeOnEvent(idx : integer) => boolean begin let counters : integer = NUM_PMU_COUNTERS; assert (idx >= 0 && (idx < counters || idx == CYCLE_COUNTER_ID || (idx == INSTRUCTION_COUNTER_ID && IsFeatureImplemented(FEAT_PMUv3_ICNTR)))); if !IsFeatureImplemented(FEAT_SPEv1p2) || !IsFeatureImplemented(FEAT_PMUv3p7) then return FALSE; end; if idx == CYCLE_COUNTER_ID && !IsFeatureImplemented(FEAT_SPE_DPFZS) then // FZS does not affect the cycle counter when FEAT_SPE_DPFZS is not implemented return FALSE; end; let freeze_on_event : boolean = PMBLIMITR_EL1().[E,PMFZ] == '11'; let stopped : boolean = SPEProfilingStopped(); case GetPMUCounterRange(idx) of when PMUCounterRange_R1 => return freeze_on_event && stopped && PMCR_EL0().FZS == '1'; when PMUCounterRange_R2 => return freeze_on_event && stopped && MDCR_EL2().HPMFZS == '1'; otherwise => return FALSE; end; end;

// SPEGetDataSource() // ================== // Returns a tuple indicating the data source for an access passed to SPESampleLoadStore, and // whether the data source is valid. impdef func SPEGetDataSource(is_load : boolean, accdesc : AccessDescriptor, addrdesc : AddressDescriptor) => (boolean, bits(16)) begin return (TRUE, Zeros{16}); end;

// SPEGetDataSourcePayloadSize() // ============================= // Returns the size of the Data Source payload in bytes. func SPEGetDataSourcePayloadSize() => integer{1..2} begin return ImpDefInt("SPE Data Source packet payload size") as integer{1..2}; end;

// SPEGetEventsPayloadSize() // ========================= // Returns the size in bytes of the Events packet payload as an integer. func SPEGetEventsPayloadSize() => integer{1..4} begin return ImpDefInt("SPE Events packet payload size") as integer{1..4}; end;

// SPEGetRandomBoolean() // ===================== // Returns a random or pseudo-random boolean value. impdef func SPEGetRandomBoolean() => boolean begin return SPEGetRandomInterval()[0] == '1'; end;

// SPEGetRandomInterval() // ====================== // Returns a random or pseudo-random byte for resetting COUNT or ECOUNT. impdef func SPEGetRandomInterval() => bits(8) begin return _PC[0+:8]; end;

// SPEISB() // ======== // Called by ISB instruction, correctly calls SPEBranch to save previous branches. func SPEISB() begin let address : bits(64) = PC64() + 4; let branch_type : BranchType = BranchType_DIR; let branch_conditional : boolean = FALSE; let taken : boolean = FALSE; let is_isb : boolean = TRUE; SPEBranch{64}(address, branch_type, branch_conditional, taken, is_isb); end;

// SPEInterruptEnabled() // ===================== // Return TRUE if the SPE interrupt request (PMBIRQ) is enabled, FALSE otherwise. func SPEInterruptEnabled() => boolean begin return EffectivePMSCR_EL1_EE() == '00'; end;

// SPELDSTType // =========== // Type of a load or store operation. type SPELDSTType of enumeration { SPELDSTType_NV2, SPELDSTType_Extended, SPELDSTType_General, SPELDSTType_SIMDFP, SPELDSTType_SVESME, SPELDSTType_Tags, SPELDSTType_MemCopy, SPELDSTType_MemSet, SPELDSTType_GCS, SPELDSTType_GCSSS2, SPELDSTType_Unspecified };

// SPEMultiAccessSample() // ====================== // Called by instructions which make at least one store and one load access, where the configuration // of the operation type filter affects which access is sampled. func SPEMultiAccessSample() => boolean begin // If loads or stores are filtered out, the other should be recorded. // If neither or both are filtered out, pick one in an unbiased way. // Bit positions in the PMSFCR_EL1().[TYPE, TYPEm] fields. let LD : integer = 1; let ST : integer = 2; // Are loads allowed by filter? let loads_pass_filter : boolean = PMSFCR_EL1().FT == '1' && PMSFCR_EL1().TYPE[LD] == '1'; // Are stores allowed by filter? let stores_pass_filter : boolean = PMSFCR_EL1().FT == '1' && PMSFCR_EL1().TYPE[ST] == '1'; var record_load : boolean; if loads_pass_filter && !stores_pass_filter then // Only loads pass filter record_load = TRUE; elsif !loads_pass_filter && stores_pass_filter then // Only stores pass filter record_load = FALSE; else // Both loads and stores pass the filter or neither pass the filter. // Pick between the load or the store access (pseudo-)randomly. record_load = SPEGetRandomBoolean(); end; return record_load; end;

// SPEOpAttr // ========= // Attributes of sampled operation filtered by SPECollectRecord(). type SPEOpAttr of record { op_type : SPEOpType, ldst_type : SPELDSTType, branch_is_direct : boolean, branch_has_link : boolean, procedure_return : boolean, is_conditional : boolean, is_floating_point : boolean, is_simd : boolean, cond_pass : boolean, at : boolean, is_acquire_release : boolean, is_predicated : boolean, evl : bits(3), is_gather_scatter : boolean, is_exclusive : boolean, ets : bits(4), addr_valid : boolean };

// SPEOpType // ========= // Types of operation filtered by SPECollectRecord(). type SPEOpType of enumeration { SPEOpType_Load, // Any memory-read operation other than atomics, compare-and-swap, // and swap SPEOpType_Store, // Any memory-write operation, including atomics without return SPEOpType_LoadAtomic, // Atomics with return, compare-and-swap and swap SPEOpType_Branch, // Software write to the PC SPEOpType_OtherSVE, // Other SVE operation SPEOpType_OtherSME, // Other SME operation SPEOpType_Other, // Any other class of operation SPEOpType_Invalid };

// SPEProfilingStopped() // ===================== readonly func SPEProfilingStopped() => boolean begin var stopped : boolean = (PMBSR_EL1().S == '1'); if IsFeatureImplemented(FEAT_SPE_EXC) then if HaveEL(EL3) && MDCR_EL3().PMSEE == '1x' then stopped = stopped || (PMBSR_EL3().S == '1'); end; if EffectivePMSCR_EL2_EE() == '1x' then stopped = stopped || (PMBSR_EL2().S == '1'); end; end; return stopped; end;

// SPEResetSampleCounter() // ======================= // Reset PMSICR_EL1.Counter func SPEResetSampleCounter() begin PMSICR_EL1().COUNT[31:8] = PMSIRR_EL1().INTERVAL; if PMSIRR_EL1().RND == '1' && !IsFeatureImplemented(FEAT_SPE_ERnd) then PMSICR_EL1().COUNT[7:0] = SPEGetRandomInterval(); else PMSICR_EL1().COUNT[7:0] = Zeros{8}; end; end;

// SPEResetSampleStorage() // ======================= // Reset all variables inside sample storage. func SPEResetSampleStorage() begin // Context values SPESampleContextEL1 = Zeros{32}; SPESampleContextEL1Valid = FALSE; SPESampleContextEL2 = Zeros{32}; SPESampleContextEL2Valid = FALSE; // Counter values for i = 0 to (SPEMaxCounters - 1) do SPESampleCounter[[i]] = 0; SPESampleCounterValid[[i]] = FALSE; SPESampleCounterPending[[i]] = FALSE; end; // Address values for i = 0 to (SPEMaxAddrs - 1) do SPESampleAddressValid[[i]] = FALSE; SPESampleAddress[[i]] = Zeros{64}; end; // Data source values SPESampleDataSource = Zeros{16}; SPESampleDataSourceValid = FALSE; // Timestamp values SPESampleTimestamp = Zeros{64}; SPESampleTimestampValid = FALSE; // Event values SPESampleEvents = Zeros{64}; // Operation attributes SPESampleOpAttr.op_type = SPEOpType_Invalid; SPESampleOpAttr.ldst_type = SPELDSTType_Unspecified; SPESampleOpAttr.branch_is_direct = FALSE; SPESampleOpAttr.branch_has_link = FALSE; SPESampleOpAttr.procedure_return = FALSE; SPESampleOpAttr.is_conditional = FALSE; SPESampleOpAttr.is_floating_point = FALSE; SPESampleOpAttr.is_simd = FALSE; SPESampleOpAttr.cond_pass = FALSE; SPESampleOpAttr.at = FALSE; SPESampleOpAttr.is_acquire_release = FALSE; SPESampleOpAttr.is_exclusive = FALSE; SPESampleOpAttr.is_predicated = FALSE; SPESampleOpAttr.evl = '000'; SPESampleOpAttr.is_gather_scatter = FALSE; SPESampleOpAttr.addr_valid = FALSE; end; var SPERecordData : array [[SPEMaxRecordSize]] of bits(8); var SPERecordSize : integer;

// SPESampleAddAddressPCVirtual() // ============================== // Save the current PC address to sample storage. func SPESampleAddAddressPCVirtual() begin var ns : bit; var nse : bit; case CurrentSecurityState() of when SS_Secure => ns = '0'; nse = '0'; when SS_NonSecure => ns = '1'; nse = '0'; when SS_Realm => ns = '1'; nse = '1'; otherwise => unreachable; end; let el : bits(2) = PSTATE.EL; let pc : bits(64) = ThisInstrAddr{}(); SPESampleAddress[[SPEAddrPosPCVirtual]][55:0] = pc[55:0]; SPESampleAddress[[SPEAddrPosPCVirtual]][63:56] = ns::el::nse::Zeros{4}; SPESampleAddressValid[[SPEAddrPosPCVirtual]] = TRUE; end;

// SPESampleAddContext() // ===================== // Save contexts to sample storage if appropriate. func SPESampleAddContext() begin if CollectContextIDR1() then SPESampleContextEL1 = CONTEXTIDR_EL1()[31:0]; SPESampleContextEL1Valid = TRUE; end; if CollectContextIDR2() then SPESampleContextEL2 = CONTEXTIDR_EL2()[31:0]; SPESampleContextEL2Valid = TRUE; end; end;

// SPESampleAddTimeStamp() // ======================= // Save the appropriate type of timestamp to sample storage. func SPESampleAddTimeStamp() begin let timestamp : TimeStamp = CollectTimeStamp(); case timestamp of when TimeStamp_None => SPESampleTimestampValid = FALSE; otherwise => SPESampleTimestampValid = TRUE; SPESampleTimestamp = GetTimestamp(timestamp); end; end;

// SPESampleCollision() // ==================== // Called when there is an SPE sample collision. func SPESampleCollision() begin // Sample collision with the previous sample PMUEvent(PMU_EVENT_SAMPLE_COLLISION); let target_el : bits(2) = DefaultSPEEvent(); PMBSR_EL(target_el).COLL = '1'; end;

// SPESampleExtendedLoadStore() // ============================ // Sets the subclass of the operation type packet for // extended load/store operations. func SPESampleExtendedLoadStore(ar : boolean, excl : boolean, at : boolean, is_load : boolean) begin SPESampleOpAttr.is_acquire_release = ar; SPESampleOpAttr.is_exclusive = excl; SPESampleOpAttr.ldst_type = SPELDSTType_Extended; SPESampleOpAttr.at = at; if is_load then if at then SPESampleOpAttr.op_type = SPEOpType_LoadAtomic; else SPESampleOpAttr.op_type = SPEOpType_Load; end; else SPESampleOpAttr.op_type = SPEOpType_Store; end; end;

// SPESampleGCSSS2() // ================= // Sets the subclass of the operation type packet for GCSSS2 load/store operations. func SPESampleGCSSS2() begin // GCSSS2 does a read and a write. let record_load : boolean = SPEMultiAccessSample(); SPESampleOpAttr.op_type = if record_load then SPEOpType_Load else SPEOpType_Store; SPESampleOpAttr.ldst_type = SPELDSTType_GCSSS2; end;

// SPESampleGeneralPurposeLoadStore() // ================================== // Sets the subclass of the operation type packet for general // purpose load/store operations. func SPESampleGeneralPurposeLoadStore(is_load : boolean) begin SPESampleOpAttr.ldst_type = SPELDSTType_General; SPESampleOpAttr.op_type = if is_load then SPEOpType_Load else SPEOpType_Store; end;

// SPESampleLoadStore() // ==================== // Called if a sample is in flight when writing or reading memory, // indicating that the operation being sampled is in the Load, Store or atomic category. func SPESampleLoadStore(is_load : boolean, accdesc : AccessDescriptor, addrdesc : AddressDescriptor) begin // Check if this access type is suitable to be sampled. // This implementation of SPE always samples the first access made by a suitable instruction. // FEAT_MOPS instructions are an exception, where the first load or first store access may be // selected based on the configuration of the sample filters. if accdesc.acctype IN {AccessType_SPE, AccessType_IFETCH, AccessType_TRBE, AccessType_DC, AccessType_TTW, AccessType_AT} then return; end; var sample_access : boolean = FALSE; // For FEAT_MOPS and FEAT_GCS GCSSS2 instructions which perform both loads and stores, the // filter configuration will influence which part of the access is chosen to be sampled. if (SPESampleOpAttr.ldst_type IN {SPELDSTType_MemCopy, SPELDSTType_MemSet, SPELDSTType_GCSSS2}) then // SPEMultiAccessSample() will have been called before this function, // and chooses whether to sample a load or a store. var sample_load : boolean; sample_load = SPESampleOpAttr.op_type IN {SPEOpType_Load, SPEOpType_LoadAtomic}; // If no valid data has been collected, and this operation is acceptable for sampling. if !SPESampleOpAttr.addr_valid && (is_load == sample_load) then sample_access = TRUE; end; else if !SPESampleOpAttr.addr_valid then sample_access = TRUE; end; end; if sample_access then // Data access virtual address SPESetDataVirtualAddress(addrdesc.vaddress); // Data access physical address if CollectPhysicalAddress() then SPESetDataPhysicalAddress(addrdesc, accdesc); end; SPESampleOpAttr.addr_valid = TRUE; end; if SPESampleOpAttr.op_type == SPEOpType_Invalid then // Set as unspecified load/store by default, instructions will overwrite this if it does not // apply to them. SPESampleOpAttr.op_type = if is_load then SPEOpType_Load else SPEOpType_Store; if accdesc.acctype == AccessType_NV2 then // NV2 register load/store SPESampleOpAttr.ldst_type = SPELDSTType_NV2; end; end; // Set SPELDSTType to GCS for all GCS instruction, overwriting type GCSSS2. // After selection of which operation of a GCSSS2 instruction to sample, GCSSS2 is treated the // same as other GCS instructions. if accdesc.acctype == AccessType_GCS then SPESampleOpAttr.ldst_type = SPELDSTType_GCS; // If the GCS access is from a BL or RET, this will get overwritten to SPEOpType_Branch. SPESampleOpAttr.op_type = if is_load then SPEOpType_Load else SPEOpType_Store; end; (SPESampleDataSourceValid, SPESampleDataSource) = SPEGetDataSource(is_load, accdesc, addrdesc); end;

// SPESampleMemCopy() // ================== // Sets the subclass of the operation type packet for Memory Copy load/store // operations. func SPESampleMemCopy() begin // MemCopy does a read and a write. let record_load : boolean = SPEMultiAccessSample(); SPESampleOpAttr.op_type = if record_load then SPEOpType_Load else SPEOpType_Store; SPESampleOpAttr.ldst_type = SPELDSTType_MemCopy; end;

// SPESampleMemSet() // ================= // Callback used by memory set instructions to pass data back to the SPU. func SPESampleMemSet() begin SPESampleOpAttr.op_type = SPEOpType_Store; SPESampleOpAttr.ldst_type = SPELDSTType_MemSet; end;

// SPESampleOnSharedResource() // =========================== // Called when the sampled instruction is executed on an SMCU or other shared resource, sets bit 25 // of the events packet to 0b1. func SPESampleOnSharedResource() begin SPESampleEvents[25] = '1'; end;

// SPESampleOpOther() // ================== // Add other operation to sample storage. func SPESampleOpOther(conditional : boolean, cond_pass : boolean, is_fp : boolean, is_simd : boolean) begin SPESampleOpAttr.is_simd = is_simd; SPESampleOpOther(conditional, cond_pass, is_fp); end; func SPESampleOpOther(conditional : boolean, cond_pass : boolean, is_fp : boolean) begin SPESampleOpAttr.cond_pass = cond_pass; SPESampleOpAttr.is_floating_point = is_fp; SPESampleOpOther(conditional); end; func SPESampleOpOther(conditional : boolean) begin SPESampleOpAttr.is_conditional = conditional; SPESampleOpAttr.op_type = SPEOpType_Other; end;

// SPESampleOpSMEArrayOther() // ========================== // Sets the subclass of the operation type packet to Other, SME array. func SPESampleOpSMEArrayOther(floating_point : boolean, size : integer) begin // If the sampled effective vector or tile size is not a power of two, or is less than 128 bits, // the value is rounded up before it is encoded in the ets field. SPESampleOpAttr.is_floating_point = floating_point; SPESampleOpAttr.ets = SPEEncodeETS(size); SPESampleOpAttr.op_type = SPEOpType_OtherSME; SPESampleOpAttr.is_simd = TRUE; end;

// SPESampleOpSVEOther() // ===================== // Callback used by SVE, Other operations to pass data back to the SPU. func SPESampleOpSVEOther(vl : integer, predicated : boolean, floating_point : boolean) begin SPESampleOpAttr.is_predicated = predicated; SPESampleOpAttr.is_floating_point = floating_point; SPESampleOpAttr.evl = SPEEncodeEVL(vl); SPESampleOpAttr.op_type = SPEOpType_OtherSVE; end;

// SPESampleOpSVESMELoadStore() // ============================ // Callback used by SVE or SME loads and stores to pass data to SPE. func SPESampleOpSVESMELoadStore(is_gather_scatter : boolean, vl : integer, predicated : boolean, is_load : boolean) begin SPESampleOpAttr.is_gather_scatter = is_gather_scatter; SPESampleOpAttr.is_predicated = predicated; SPESampleOpAttr.evl = SPEEncodeEVL(vl); assert SPESampleOpAttr.evl != '111'; SPESampleOpAttr.op_type = if is_load then SPEOpType_Load else SPEOpType_Store; SPESampleOpAttr.ldst_type = SPELDSTType_SVESME; end;

// SPESampleSIMDFPLoadStore() // ========================== // Sets the subclass of the operation type packet for SIMD & FP // load store operations. func SPESampleSIMDFPLoadStore(is_load : boolean, scalar : boolean) begin SPESampleOpAttr.ldst_type = SPELDSTType_SIMDFP; SPESampleOpAttr.op_type = if is_load then SPEOpType_Load else SPEOpType_Store; SPESampleOpAttr.is_simd = !scalar; // Scalar operations in SIMD&FP are treated as floating point. SPESampleOpAttr.is_floating_point = scalar; end;

// SPESetDataPhysicalAddress() // =========================== // Called from SampleLoadStore() to save data physical packet. func SPESetDataPhysicalAddress(addrdesc : AddressDescriptor, accdesc : AccessDescriptor) begin var ns : bit; var nse : bit; var ch : bit; var lat : bits(4); case addrdesc.paddress.paspace of when PAS_Secure => ns = '0'; nse = '0'; when PAS_NonSecure => ns = '1'; nse = '0'; when PAS_Realm => ns = '1'; nse = '1'; otherwise => unreachable; end; if IsFeatureImplemented(FEAT_MTE2) then if accdesc.tagchecked then ch = '1'; lat = AArch64_LogicalAddressTag(addrdesc.vaddress); else ch = '0'; // If the access is Unchecked, this is an IMPLEMENTATION_DEFINED choice // between 0b0000 and the Logical Address Tag var zero_unchecked : boolean; zero_unchecked = ImpDefBool("SPE PAT for tag unchecked access zero"); if !zero_unchecked then lat = AArch64_LogicalAddressTag(addrdesc.vaddress); else lat = Zeros{4}; end; end; else ch = '0'; lat = '0000'; end; let paddr : bits(NUM_PABITS) = addrdesc.paddress.address; SPESampleAddress[[SPEAddrPosDataPhysical]][55:0] = ZeroExtend{56}(paddr); SPESampleAddress[[SPEAddrPosDataPhysical]][63:56] = ns::ch::'0'::nse::lat; SPESampleAddressValid[[SPEAddrPosDataPhysical]] = TRUE; end;

// SPESetDataVirtualAddress() // ========================== // Called from SampleLoadStore() to save data virtual packet. // Also used by exclusive load/stores to save virtual addresses if exclusive monitor is lost // before a read/write is completed. func SPESetDataVirtualAddress(vaddress : bits(64)) begin var tbi : bit; tbi = EffectiveTBI(vaddress, FALSE, PSTATE.EL); var non_tbi_is_zeros : boolean; non_tbi_is_zeros = ImpDefBool("SPE non-tbi tag is zero"); if tbi == '1' || !non_tbi_is_zeros then SPESampleAddress[[SPEAddrPosDataVirtual]][63:0] = vaddress[63:0]; else SPESampleAddress[[SPEAddrPosDataVirtual]][55:0] = vaddress[55:0]; SPESampleAddress[[SPEAddrPosDataVirtual]][63:56] = Zeros{8}; end; SPESampleAddressValid[[SPEAddrPosDataVirtual]] = TRUE; end;

// SPEStartCounter() // ================= // Enables incrementing of the counter at the passed index when SPECycle is called. func SPEStartCounter(counter_index : integer) begin assert counter_index < SPEMaxCounters; SPESampleCounterPending[[counter_index]] = TRUE; end;

// SPEStartSample() // ================ // Called to start the sampling process. Returns TRUE if a new sample is to be collected, and // FALSE otherwise. func SPEStartSample() => boolean begin if !StatisticalProfilingEnabled() then return FALSE; end; PMUEvent(PMU_EVENT_SAMPLE_POP); if !SPEToCollectSample() then return FALSE; end; if SPESampleInFlight then SPESampleCollision(); return FALSE; end; SPESampleInFlight = TRUE; SPEStartCounter(SPECounterPosTotalLatency); SPEStartCounter(SPECounterPosIssueLatency); SPESampleAddAddressPCVirtual(); // Many operations are type other and not conditional, can save footprint // and overhead by having this as the default and not calling SPESampleOpOther // if conditional == FALSE SPESampleOpOther(FALSE); SPESampleAddContext(); // Timestamp may be collected at any point in the sampling operation. // Collecting prior to execution is one possible choice. // This choice is IMPLEMENTATION DEFINED. SPESampleAddTimeStamp(); return TRUE; end;

// SPEStopCounter() // ================ // Disables incrementing of the counter at the passed index when SPECycle is called. func SPEStopCounter(counter_index : integer) begin SPESampleCounterValid[[counter_index]] = TRUE; SPESampleCounterPending[[counter_index]] = FALSE; end;

// SPEToCollectSample() // ==================== // Returns TRUE if the instruction which is about the executed should be sampled, and FALSE // otherwise. func SPEToCollectSample() => boolean begin if IsZero(PMSICR_EL1().COUNT) then SPEResetSampleCounter(); else PMSICR_EL1().COUNT = PMSICR_EL1().COUNT - 1; if IsZero(PMSICR_EL1().COUNT) then if PMSIRR_EL1().RND == '1' && IsFeatureImplemented(FEAT_SPE_ERnd) then PMSICR_EL1().ECOUNT = SPEGetRandomInterval(); return IsZero(PMSICR_EL1().ECOUNT); else return TRUE; end; end; end; if (PMSIRR_EL1().RND == '1' && IsFeatureImplemented(FEAT_SPE_ERnd) && !IsZero(PMSICR_EL1().ECOUNT)) then PMSICR_EL1().ECOUNT = PMSICR_EL1().ECOUNT - 1; if IsZero(PMSICR_EL1().ECOUNT) then return TRUE; end; end; return FALSE; end;

// SPEWriteToBuffer() // ================== // Write the active record to the Profiling Buffer. func SPEWriteToBuffer() begin assert ProfilingBufferEnabled() && !SPEProfilingStopped(); // Check alignment let align : integer{} = UInt(PMBIDR_EL1().Align); let aligned : boolean = IsAlignedP2(PMBPTR_EL1().PTR, align); let ttw_abort_as_fault : boolean = (ImpDefBool( "Report SPE ExtAbort on TTW as fault")); var owning_ss : SecurityState; var owning_el : bits(2); (owning_ss, owning_el) = ProfilingBufferOwner(); let accdesc : AccessDescriptor = CreateAccDescSPE(owning_ss, owning_el); let start_vaddr : bits(64) = PMBPTR_EL1(); for i = 0 to SPERecordSize - 1 do // If a previous write did not cause an issue if !SPEProfilingStopped() then let address : bits(64) = PMBPTR_EL1(); var memstatus : PhysMemRetStatus; var addrdesc : AddressDescriptor; (memstatus, addrdesc) = DebugMemWrite(address, accdesc, aligned, SPERecordData[[i]]); let fault : FaultRecord = addrdesc.fault; let ttw_abort : boolean = fault.statuscode IN {Fault_SyncExternalOnWalk, Fault_SyncParityOnWalk}; if IsFault(fault.statuscode) && (!ttw_abort || ttw_abort_as_fault) then DebugWriteFault(address, fault); elsif IsFault(memstatus) || (ttw_abort && !ttw_abort_as_fault) then DebugWriteExternalAbort(memstatus, addrdesc, start_vaddr); end; // Move pointer if no Buffer Management Event has been caused. if !SPEProfilingStopped() then PMBPTR_EL1() = PMBPTR_EL1() + 1; end; end; end; return; end;

// StatisticalProfilingEnabled() // ============================= // Return TRUE if Statistical Profiling is Enabled in the current EL, FALSE otherwise. func StatisticalProfilingEnabled() => boolean begin return StatisticalProfilingEnabled(PSTATE.EL); end; // StatisticalProfilingEnabled() // ============================= // Return TRUE if Statistical Profiling is Enabled in the specified EL, FALSE otherwise. func StatisticalProfilingEnabled(el : bits(2)) => boolean begin if (!IsFeatureImplemented(FEAT_SPE) || UsingAArch32() || !ProfilingBufferEnabled() || SPEProfilingStopped() || Halted()) then return FALSE; end; let tge_set : boolean = EL2Enabled() && HCR_EL2().TGE == '1'; let (owning_ss, owning_el) : (SecurityState, bits(2)) = ProfilingBufferOwner(); if (UInt(owning_el) < UInt(el) || (tge_set && owning_el == EL1) || owning_ss != SecurityStateAtEL(el)) then return FALSE; end; var spe_bit : bit; case el of when EL3 => unreachable; when EL2 => spe_bit = PMSCR_EL2().E2SPE; when EL1 => spe_bit = PMSCR_EL1().E1SPE; when EL0 => spe_bit = (if tge_set then PMSCR_EL2().E0HSPE else PMSCR_EL1().E0SPE); end; return spe_bit == '1'; end;

// TimeStamp // ========= type TimeStamp of enumeration { TimeStamp_None, // No timestamp TimeStamp_CoreSight, // CoreSight time (IMPLEMENTATION DEFINED) TimeStamp_Physical, // Physical counter value with no offset TimeStamp_OffsetPhysical, // Physical counter value minus CNTPOFF_EL2 TimeStamp_Virtual }; // Physical counter value minus CNTVOFF_EL2

// AArch64_TakeExceptionInDebugState() // =================================== // Take an exception in Debug state to an Exception level using AArch64. noreturn func AArch64_TakeExceptionInDebugState(target_el : bits(2), exception_in : ExceptionRecord) begin assert HaveEL(target_el) && !ELUsingAArch32(target_el) && UInt(target_el) >= UInt(PSTATE.EL); assert target_el != EL3 || EDSCR().SDD == '0'; var except : ExceptionRecord = exception_in; if !IsFeatureImplemented(FEAT_ExS) || SCTLR_EL(target_el).EIS == '1' then // Synchronize the context, including Instruction Fetch Barrier effect SynchronizeContext(); end; // If coming from AArch32 state, the top parts of the X() registers might be set to zero let from_32 : boolean = UsingAArch32(); if from_32 then AArch64_MaybeZeroRegisterUppers(); end; if from_32 && IsFeatureImplemented(FEAT_SME) && PSTATE.SM == '1' then ResetSVEState(); else MaybeZeroSVEUppers(target_el); end; AArch64_ReportException(except, target_el); if IsFeatureImplemented(FEAT_GCS) then PSTATE.EXLOCK = '0'; // Effective value of GCSCR_ELx.EXLOCKEN is 0 in Debug state end; PSTATE.EL = target_el; PSTATE.nRW = '0'; PSTATE.SP = '1'; SPSR_ELx() = ARBITRARY : bits(64); ELR_ELx() = ARBITRARY : bits(64); // PSTATE.[SS,D,A,I,F] are not observable and ignored in Debug state, so behave as if UNKNOWN. PSTATE.[SS,D,A,I,F] = ARBITRARY : bits(5); if IsFeatureImplemented(FEAT_SSBS) then PSTATE.SSBS = ARBITRARY : bit; end; if IsFeatureImplemented(FEAT_EBEP) then PSTATE.PM = ARBITRARY : bit; end; if IsFeatureImplemented(FEAT_MTE) then PSTATE.TCO = '1'; end; PSTATE.IL = '0'; if IsFeatureImplemented(FEAT_UAO) then PSTATE.UAO = '0'; end; if IsFeatureImplemented(FEAT_UINJ) then PSTATE.UINJ = '0'; end; if IsFeatureImplemented(FEAT_PAuth_LR) then PSTATE.PACM = '0'; end; if (IsFeatureImplemented(FEAT_PAN) && (PSTATE.EL == EL1 || (PSTATE.EL == EL2 && ELIsInHost(EL0))) && SCTLR_ELx().SPAN == '0') then PSTATE.PAN = '1'; end; if from_32 then // Coming from AArch32 PSTATE.IT = '00000000'; PSTATE.T = '0'; // PSTATE.J is RES0 end; if IsFeatureImplemented(FEAT_BTI) then PSTATE.BTYPE = '00'; end; DLR_EL0() = ARBITRARY : bits(64); DSPSR_EL0() = ARBITRARY : bits(64); EDSCR().ERR = '1'; UpdateEDSCRFields(); // Update EDSCR PE state flags. EndOfInstruction(EndOfInstructionReason_Exception); end;

// AArch64_WatchpointByteMatch() // ============================= func AArch64_WatchpointByteMatch(n : integer, vaddress : bits(64)) => boolean begin let dbgtop : AddressSize = DebugAddrTop(); let cmpbottom : integer{} = if DBGWVR_EL1(n)[2] == '1' then 2 else 3;// Word or doubleword var bottom : integer{} = cmpbottom; let select : integer{} = UInt(vaddress[cmpbottom-1:0]); var byte_select_match : boolean = (DBGWCR_EL1(n).BAS[select] != '0'); var mask : integer{} = UInt(DBGWCR_EL1(n).MASK); // If DBGWCR_EL1(n).MASK is a nonzero value and DBGWCR_EL1(n).BAS is not set to '11111111', or // DBGWCR_EL1(n).BAS specifies a non-contiguous set of bytes behavior is CONSTRAINED // UNPREDICTABLE. if mask > 0 && !IsOnes(DBGWCR_EL1(n).BAS) then byte_select_match = ConstrainUnpredictableBool(Unpredictable_WPMASKANDBAS); else let LSB : bits(8) = (DBGWCR_EL1(n).BAS AND NOT(DBGWCR_EL1(n).BAS - 1)); let MSB : bits(8) = (DBGWCR_EL1(n).BAS + LSB); if !IsZero(MSB AND (MSB - 1)) then // Not contiguous byte_select_match = ConstrainUnpredictableBool(Unpredictable_WPBASCONTIGUOUS); bottom = 3; // For the whole doubleword end; end; // If the address mask is set to a reserved value, the behavior is CONSTRAINED UNPREDICTABLE. if mask > 0 && mask <= 2 then var c : Constraint; var unpred_mask : integer; (c, unpred_mask) = ConstrainUnpredictableInteger(3, 31, Unpredictable_RESWPMASK); assert c IN {Constraint_DISABLED, Constraint_NONE, Constraint_UNKNOWN}; case c of when Constraint_DISABLED => return FALSE; // Disabled when Constraint_NONE => mask = 0; // No masking // Otherwise the value returned by ConstrainUnpredictableInteger is a not-reserved value otherwise => mask = unpred_mask as integer{3..31}; end; end; // When FEAT_LVA3 is not implemented, if the DBGWVR_EL1(n).RESS field bits are not a // sign extension of the MSB of DBGWVR_EL1(n).VA, it is UNPREDICTABLE whether they // appear to be included in the match. let unpredictable_ress : boolean = (dbgtop < 55 && !IsOnes(DBGWVR_EL1(n)[63:dbgtop]) && !IsZero(DBGWVR_EL1(n)[63:dbgtop]) && ConstrainUnpredictableBool(Unpredictable_DBGxVR_RESS)); let cmpmsb : integer{} = if unpredictable_ress then 63 else dbgtop; let cmplsb : integer{} = if mask > bottom then mask else bottom; let bottombit : integer{} = bottom; var WVR_match : boolean = (vaddress[cmpmsb:cmplsb] == DBGWVR_EL1(n)[cmpmsb:cmplsb]); if mask > bottom then // If masked bits of DBGWVR_EL1(n) are not zero, the behavior is CONSTRAINED UNPREDICTABLE. if WVR_match && !IsZero(DBGWVR_EL1(n)[cmplsb-1:bottombit]) then WVR_match = ConstrainUnpredictableBool(Unpredictable_WPMASKEDBITS); end; end; return (WVR_match && byte_select_match); end;

// AArch64_WatchpointMatch() // ========================= // Watchpoint matching in an AArch64 translation regime. func AArch64_WatchpointMatch(n : integer, vaddress : bits(64), size : integer, accdesc : AccessDescriptor) => WatchpointInfo begin assert !ELUsingAArch32(S1TranslationRegime()); assert n < NumWatchpointsImplemented(); let enabled : boolean = IsWatchpointEnabled(n); let linked : boolean = DBGWCR_EL1(n).WT == '1'; let isbreakpnt : boolean = FALSE; let lbnx : bits(2) = if IsFeatureImplemented(FEAT_Debugv8p9) then DBGWCR_EL1(n).LBNX else '00'; let linked_n : integer{} = UInt(lbnx :: DBGWCR_EL1(n).LBN); let ssce : bit = if IsFeatureImplemented(FEAT_RME) then DBGWCR_EL1(n).SSCE else '0'; let mismatch : boolean = IsFeatureImplemented(FEAT_BWE2) && DBGWCR_EL1(n).WT2 == '1'; let state_match : boolean = AArch64_StateMatch(DBGWCR_EL1(n).SSC, ssce, DBGWCR_EL1(n).HMC, DBGWCR_EL1(n).PAC, linked, linked_n, isbreakpnt, PC64(), accdesc); var watchptinfo : WatchpointInfo; var ls_match : boolean; case DBGWCR_EL1(n).LSC[1:0] of when '00' => ls_match = FALSE; when '01' => ls_match = accdesc.read; when '10' => ls_match = accdesc.write || accdesc.acctype == AccessType_DC; when '11' => ls_match = TRUE; end; var value_match : boolean = FALSE; watchptinfo.vaddress = vaddress; for byte = 0 to size - 1 do if (!value_match && !AddressInNaturallyAlignedBlock(watchptinfo.vaddress, vaddress + byte)) then // Watchpoint should report an address which is in // the naturally aligned block of the matched address. watchptinfo.vaddress = vaddress + byte; end; value_match = value_match || AArch64_WatchpointByteMatch(n, vaddress + byte); end; watchptinfo.watchpt_num = n; watchptinfo.value_match = value_match; if !(state_match && ls_match && enabled) then watchptinfo.wptype = WatchpointType_Inactive; watchptinfo.value_match = FALSE; elsif mismatch then watchptinfo.wptype = WatchpointType_AddrMismatch; else watchptinfo.wptype = WatchpointType_AddrMatch; end; return watchptinfo; end;

// IsWatchpointEnabled() // ===================== // Returns TRUE if the effective value of DBGWCR_EL1(n).E is '1', and FALSE otherwise. func IsWatchpointEnabled(n : integer) => boolean begin if (n > 15 && ((!HaltOnBreakpointOrWatchpoint() && !SelfHostedExtendedBPWPEnabled()) || (HaltOnBreakpointOrWatchpoint() && EDSCR2().EHBWE == '0'))) then return FALSE; end; return DBGWCR_EL1(n).E == '1'; end;

// AArch64_Abort() // =============== // Abort and Debug exception handling in an AArch64 translation regime. func AArch64_Abort(fault : FaultRecord) begin if IsDebugException(fault) then if fault.accessdesc.acctype == AccessType_IFETCH then if UsingAArch32() && fault.debugmoe == DebugException_VectorCatch then AArch64_VectorCatchException(fault); else AArch64_BreakpointException(fault); end; else AArch64_WatchpointException(fault); end; elsif fault.gpcf.gpf != GPCF_None && ReportAsGPCException(fault) then TakeGPCException(fault); elsif fault.statuscode == Fault_TagCheck then AArch64_RaiseTagCheckFault(fault); elsif IsExternalAbort(fault) && !IsExternalSyncAbort(fault) then PendSErrorInterrupt(fault); elsif fault.accessdesc.acctype == AccessType_IFETCH then AArch64_InstructionAbort(fault); else AArch64_DataAbort(fault); end; end;

// AArch64_AbortSyndrome() // ======================= // Creates an exception syndrome record for Abort and Watchpoint exceptions // from an AArch64 translation regime. func AArch64_AbortSyndrome(exceptype : Exception, fault : FaultRecord, target_el : bits(2)) => ExceptionRecord begin var except : ExceptionRecord = ExceptionSyndrome(exceptype); except.syndrome = AArch64_FaultSyndrome(exceptype, fault, target_el); if exceptype IN {Exception_NV2Watchpoint, Exception_Watchpoint} then except.vaddress = fault.watchptinfo.vaddress; elsif fault.statuscode == Fault_TagCheck then if IsFeatureImplemented(FEAT_MTE_TAGGED_FAR) then except.vaddress = ZeroExtend{64}(fault.vaddress); else except.vaddress = ARBITRARY : bits(4) :: fault.vaddress[59:0]; end; else except.vaddress = ZeroExtend{64}(fault.vaddress); end; if IPAValid(fault) then except.ipavalid = TRUE; except.NS = if fault.ipaddress.paspace == PAS_NonSecure then '1' else '0'; except.ipaddress = fault.ipaddress.address; else except.ipavalid = FALSE; end; if except.syndrome.iss[14] == '1' then except.pavalid = TRUE; except.paddress = fault.paddress; else except.pavalid = FALSE; except.paddress = ARBITRARY : FullAddress; end; return except; end;

// AArch64_CheckPCAlignment() // ========================== func AArch64_CheckPCAlignment() begin let pc : bits(64) = ThisInstrAddr{}(); if pc[1:0] != '00' then AArch64_PCAlignmentFault(); end; end;

// AArch64_DataAbort() // =================== func AArch64_DataAbort(fault : FaultRecord) begin var target_el : bits(2); if IsExternalAbort(fault) then target_el = SyncExternalAbortTarget(fault); else let route_to_el2 = (EL2Enabled() && PSTATE.EL IN {EL0, EL1} && (HCR_EL2().TGE == '1' || (IsFeatureImplemented(FEAT_RME) && fault.gpcf.gpf != GPCF_None && HCR_EL2().GPF == '1') || (IsFeatureImplemented(FEAT_NV2) && fault.accessdesc.acctype == AccessType_NV2) || IsSecondStage(fault))); if PSTATE.EL == EL3 then target_el = EL3; elsif PSTATE.EL == EL2 || route_to_el2 then target_el = EL2; else target_el = EL1; end; end; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let route_to_serr : boolean = (IsExternalAbort(fault) && AArch64_RouteToSErrorOffset(target_el)); let vect_offset : integer = if route_to_serr then 0x180 else 0x0; var except : ExceptionRecord; if IsFeatureImplemented(FEAT_NV2) && fault.accessdesc.acctype == AccessType_NV2 then except = AArch64_AbortSyndrome(Exception_NV2DataAbort, fault, target_el); else except = AArch64_AbortSyndrome(Exception_DataAbort, fault, target_el); end; AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_EffectiveTCF() // ====================== // Indicate if a Tag Check Fault should cause a synchronous exception, // be asynchronously accumulated, or have no effect on the PE. func AArch64_EffectiveTCF(el : bits(2), read : boolean) => TCFType begin var tcf : bits(2); let regime : Regime = TranslationRegime(el); case regime of when Regime_EL3 => tcf = SCTLR_EL3().TCF; when Regime_EL2 => tcf = SCTLR_EL2().TCF; when Regime_EL20 => tcf = if el == EL0 then SCTLR_EL2().TCF0 else SCTLR_EL2().TCF; when Regime_EL10 => tcf = if el == EL0 then SCTLR_EL1().TCF0 else SCTLR_EL1().TCF; otherwise => unreachable; end; if tcf == '11' then // Reserved value if !IsFeatureImplemented(FEAT_MTE_ASYM_FAULT) then (-,tcf) = ConstrainUnpredictableBits{2}(Unpredictable_RESTCF); end; end; case tcf of when '00' => // Tag Check Faults have no effect on the PE return TCFType_Ignore; when '01' => // Tag Check Faults cause a synchronous exception return TCFType_Sync; when '10' => if IsFeatureImplemented(FEAT_MTE_ASYNC) then // If asynchronous faults are implemented, // Tag Check Faults are asynchronously accumulated return TCFType_Async; else // Otherwise, Tag Check Faults have no effect on the PE return TCFType_Ignore; end; when '11' => if IsFeatureImplemented(FEAT_MTE_ASYM_FAULT) then // Tag Check Faults cause a synchronous exception on reads or on // a read/write access, and are asynchronously accumulated on writes if read then return TCFType_Sync; else return TCFType_Async; end; else // Otherwise, Tag Check Faults have no effect on the PE return TCFType_Ignore; end; otherwise => unreachable; end; end;

// AArch64_InstructionAbort() // ========================== func AArch64_InstructionAbort(fault : FaultRecord) begin // External aborts on instruction fetch must be taken synchronously if IsFeatureImplemented(FEAT_DoubleFault) then assert fault.statuscode != Fault_AsyncExternal; end; var target_el : bits(2); if IsExternalAbort(fault) then target_el = SyncExternalAbortTarget(fault); else let route_to_el2 : boolean = (EL2Enabled() && PSTATE.EL IN {EL0, EL1} && (HCR_EL2().TGE == '1' || (IsFeatureImplemented(FEAT_RME) && fault.gpcf.gpf != GPCF_None && HCR_EL2().GPF == '1') || IsSecondStage(fault))); if PSTATE.EL == EL3 then target_el = EL3; elsif PSTATE.EL == EL2 || route_to_el2 then target_el = EL2; else target_el = EL1; end; end; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); var vect_offset : integer; if IsExternalAbort(fault) && AArch64_RouteToSErrorOffset(target_el) then vect_offset = 0x180; else vect_offset = 0x0; end; let except : ExceptionRecord = AArch64_AbortSyndrome(Exception_InstructionAbort, fault, target_el); AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_PCAlignmentFault() // ========================== // Called on unaligned program counter in AArch64 state. func AArch64_PCAlignmentFault() begin let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; var except : ExceptionRecord = ExceptionSyndrome(Exception_PCAlignment); except.vaddress = ThisInstrAddr{64}(); var target_el : bits(2) = EL1; if UInt(PSTATE.EL) > UInt(EL1) then target_el = PSTATE.EL; elsif EL2Enabled() && HCR_EL2().TGE == '1' then target_el = EL2; end; AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_RaiseTagCheckFault() // ============================ // Raise a Tag Check Fault exception. func AArch64_RaiseTagCheckFault(fault : FaultRecord) begin let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; var target_el : bits(2) = EL1; if UInt(PSTATE.EL) > UInt(EL1) then target_el = PSTATE.EL; elsif PSTATE.EL == EL0 && EL2Enabled() && HCR_EL2().TGE == '1' then target_el = EL2; end; let except : ExceptionRecord = AArch64_AbortSyndrome(Exception_DataAbort, fault, target_el); AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_ReportTagCheckFault() // ============================= // Records a Tag Check Fault exception into the appropriate TFSR_ELx. func AArch64_ReportTagCheckFault(el : bits(2), ttbr : bit) begin case el of when EL3 => assert ttbr == '0'; TFSR_EL3().TF0 = '1'; when EL2 => if ttbr == '0' then TFSR_EL2().TF0 = '1'; else TFSR_EL2().TF1 = '1'; end; when EL1 => if ttbr == '0' then TFSR_EL1().TF0 = '1'; else TFSR_EL1().TF1 = '1'; end; when EL0 => if ttbr == '0' then TFSRE0_EL1().TF0 = '1'; else TFSRE0_EL1().TF1 = '1'; end; end; end;

// AArch64_RouteToSErrorOffset() // ============================= // Returns TRUE if synchronous External abort exceptions are taken to the // appropriate SError vector offset, and FALSE otherwise. func AArch64_RouteToSErrorOffset(target_el : bits(2)) => boolean begin if !IsFeatureImplemented(FEAT_DoubleFault) then return FALSE; end; var ease_bit : bit; case target_el of when EL3 => ease_bit = SCR_EL3().EASE; when EL2 => if IsFeatureImplemented(FEAT_DoubleFault2) && IsSCTLR2EL2Enabled() then ease_bit = SCTLR2_EL2().EASE; else ease_bit = '0'; end; when EL1 => if IsFeatureImplemented(FEAT_DoubleFault2) && IsSCTLR2EL1Enabled() then ease_bit = SCTLR2_EL1().EASE; else ease_bit = '0'; end; end; return (ease_bit == '1'); end;

// AArch64_SPAlignmentFault() // ========================== // Called on an unaligned stack pointer in AArch64 state. func AArch64_SPAlignmentFault() begin let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; let except : ExceptionRecord = ExceptionSyndrome(Exception_SPAlignment); var target_el : bits(2) = EL1; if UInt(PSTATE.EL) > UInt(EL1) then target_el = PSTATE.EL; elsif EL2Enabled() && HCR_EL2().TGE == '1' then target_el = EL2; end; AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// BranchTargetException() // ======================= // Raise branch target exception. func AArch64_BranchTargetException(vaddress : bits(52)) begin let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; var except : ExceptionRecord = ExceptionSyndrome(Exception_BranchTarget); except.syndrome.iss[1:0] = PSTATE.BTYPE; except.syndrome.iss[24:2] = Zeros{23}; // RES0 var target_el : bits(2) = EL1; if UInt(PSTATE.EL) > UInt(EL1) then target_el = PSTATE.EL; elsif PSTATE.EL == EL0 && EL2Enabled() && HCR_EL2().TGE == '1' then target_el = EL2; end; AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// TCFType // ======= type TCFType of enumeration { TCFType_Sync, TCFType_Async, TCFType_Ignore };

// TakeGPCException() // ================== // Report Granule Protection Exception faults func TakeGPCException(fault : FaultRecord) begin assert IsFeatureImplemented(FEAT_RME); assert IsFeatureImplemented(FEAT_LSE); assert IsFeatureImplemented(FEAT_HAFDBS); assert IsFeatureImplemented(FEAT_DoubleFault); var except : ExceptionRecord; except.exceptype = Exception_GPC; except.vaddress = ZeroExtend{64}(fault.vaddress); except.paddress = fault.paddress; except.pavalid = TRUE; if IPAValid(fault) then except.ipavalid = TRUE; except.NS = if fault.ipaddress.paspace == PAS_NonSecure then '1' else '0'; except.ipaddress = fault.ipaddress.address; else except.ipavalid = FALSE; end; except.syndrome.iss2[11] = if fault.hdbssf then '1' else '0'; // HDBSSF if fault.accessdesc.acctype == AccessType_GCS then except.syndrome.iss2[8] = '1'; //GCS end; // Populate the fields grouped in ISS except.syndrome.iss[24:22] = Zeros{3}; // RES0 except.syndrome.iss[21] = if fault.gpcfs2walk then '1' else '0'; // S2PTW if fault.accessdesc.acctype == AccessType_IFETCH then except.syndrome.iss[20] = '1'; // InD else except.syndrome.iss[20] = '0'; // InD end; except.syndrome.iss[19:14] = EncodeGPCSC(fault.gpcf); // GPCSC if IsFeatureImplemented(FEAT_NV2) && fault.accessdesc.acctype == AccessType_NV2 then except.syndrome.iss[13] = '1'; // VNCR else except.syndrome.iss[13] = '0'; // VNCR end; except.syndrome.iss[12:11] = '00'; // RES0 except.syndrome.iss[10:9] = '00'; // RES0 if fault.accessdesc.acctype IN {AccessType_DC, AccessType_IC, AccessType_AT} then except.syndrome.iss[8] = '1'; // CM else except.syndrome.iss[8] = '0'; // CM end; except.syndrome.iss[7] = if fault.s2fs1walk then '1' else '0'; // S1PTW if fault.accessdesc.acctype IN {AccessType_DC, AccessType_IC, AccessType_AT} then except.syndrome.iss[6] = '1'; // WnR elsif fault.statuscode IN {Fault_UnsupportedAtomicHWUpdate, Fault_Exclusive} then except.syndrome.iss[6] = ARBITRARY : bit; // WnR elsif fault.accessdesc.atomicop && IsExternalAbort(fault) then except.syndrome.iss[6] = ARBITRARY : bit; // WnR else except.syndrome.iss[6] = if fault.write then '1' else '0'; // WnR end; except.syndrome.iss[5:0] = EncodeLDFSC(fault.statuscode, fault.level); // xFSC let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let target_el : bits(2) = EL3; var vect_offset : integer; if IsExternalAbort(fault) && AArch64_RouteToSErrorOffset(target_el) then vect_offset = 0x180; else vect_offset = 0x0; end; AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_TakeDelegatedSErrorException() // ====================================== func AArch64_TakeDelegatedSErrorException() begin assert IsFeatureImplemented(FEAT_E3DSE) && PSTATE.EL != EL3 && SCR_EL3().[EnDSE,DSE] == '11'; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset = 0x180; var except : ExceptionRecord = ExceptionSyndrome(Exception_SError); var target_el : bits(2); var dsei_masked : boolean; (dsei_masked, target_el) = AArch64_DelegatedSErrorTarget(); assert !dsei_masked; except.syndrome.iss[24] = VSESR_EL3().IDS; except.syndrome.iss[23:0] = VSESR_EL3().ISS; ClearPendingDelegatedSError(); AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_TakePhysicalFIQException() // ================================== func AArch64_TakePhysicalFIQException() begin let route_to_el3 : boolean = EffectiveSCR_EL3_FIQ() == '1'; let route_to_el2 : boolean = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && (HCR_EL2().TGE == '1' || HCR_EL2().FMO == '1')); let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x100; let except : ExceptionRecord = ExceptionSyndrome(Exception_FIQ); if route_to_el3 then AArch64_TakeException(EL3, except, preferred_exception_return, vect_offset); elsif PSTATE.EL == EL2 || route_to_el2 then assert PSTATE.EL != EL3; AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); else assert PSTATE.EL IN {EL0, EL1}; AArch64_TakeException(EL1, except, preferred_exception_return, vect_offset); end; end;

// AArch64_TakePhysicalIRQException() // ================================== // Take an enabled physical IRQ exception. func AArch64_TakePhysicalIRQException() begin let route_to_el3 : boolean = EffectiveSCR_EL3_IRQ() == '1'; let route_to_el2 : boolean = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && (HCR_EL2().TGE == '1' || HCR_EL2().IMO == '1')); let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x80; let except : ExceptionRecord = ExceptionSyndrome(Exception_IRQ); if route_to_el3 then AArch64_TakeException(EL3, except, preferred_exception_return, vect_offset); elsif PSTATE.EL == EL2 || route_to_el2 then assert PSTATE.EL != EL3; AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); else assert PSTATE.EL IN {EL0, EL1}; AArch64_TakeException(EL1, except, preferred_exception_return, vect_offset); end; end;

// AArch64_TakePhysicalSErrorException() // ===================================== func AArch64_TakePhysicalSErrorException(implicit_esb : boolean) begin var masked : boolean; var target_el : bits(2); (masked, target_el) = PhysicalSErrorTarget(); assert !masked; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x180; let fault : FaultRecord = GetPendingPhysicalSError(); var except : ExceptionRecord = ExceptionSyndrome(Exception_SError); let is_esb : boolean = FALSE; let syndrome : bits(25) = AArch64_PhysicalSErrorSyndrome(is_esb, implicit_esb); if IsSErrorEdgeTriggered() then ClearPendingPhysicalSError(); end; if except.syndrome.iss[14] == '1' then except.pavalid = TRUE; except.paddress = fault.paddress; else except.pavalid = FALSE; except.paddress = ARBITRARY : FullAddress; end; except.syndrome.iss = syndrome; AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_TakeVirtualFIQException() // ================================= func AArch64_TakeVirtualFIQException() begin assert PSTATE.EL IN {EL0, EL1} && EL2Enabled(); // Virtual IRQ enabled if TGE==0 and FMO==1 assert HCR_EL2().TGE == '0' && HCR_EL2().FMO == '1'; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x100; let except : ExceptionRecord = ExceptionSyndrome(Exception_FIQ); AArch64_TakeException(EL1, except, preferred_exception_return, vect_offset); end;

// AArch64_TakeVirtualIRQException() // ================================= func AArch64_TakeVirtualIRQException() begin assert PSTATE.EL IN {EL0, EL1} && EL2Enabled(); // Virtual IRQ enabled if TGE==0 and IMO==1 assert HCR_EL2().TGE == '0' && HCR_EL2().IMO == '1'; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x80; let except : ExceptionRecord = ExceptionSyndrome(Exception_IRQ); AArch64_TakeException(EL1, except, preferred_exception_return, vect_offset); end;

// AArch64_TakeVirtualSErrorException() // ==================================== func AArch64_TakeVirtualSErrorException() begin assert PSTATE.EL IN {EL0, EL1} && EL2Enabled(); // Virtual SError enabled if TGE==0 and AMO==1 or TMEA==1 assert (HCR_EL2().TGE == '0' && (HCR_EL2().AMO == '1' || (IsHCRXEL2Enabled() && HCRX_EL2().TMEA == '1'))); let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x180; var except : ExceptionRecord = ExceptionSyndrome(Exception_SError); if IsFeatureImplemented(FEAT_RAS) then except.syndrome.iss[24] = VSESR_EL2().IDS; except.syndrome.iss[23:0] = VSESR_EL2().ISS; else let syndrome : bits(25) = ImpDefBits{}("Virtual SError syndrome"); let impdef_syndrome : boolean = syndrome[24] == '1'; if impdef_syndrome then except.syndrome.iss = syndrome; end; end; ClearPendingVirtualSError(); AArch64_TakeException(EL1, except, preferred_exception_return, vect_offset); end;

// AArch64_BreakpointException() // ============================= func AArch64_BreakpointException(fault : FaultRecord) begin assert PSTATE.EL != EL3; let route_to_el2 : boolean = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && (HCR_EL2().TGE == '1' || MDCR_EL2().TDE == '1')); let preferred_exception_return : bits(64) = ThisInstrAddr{}(); var target_el : bits(2); let vect_offset : integer = 0x0; target_el = if (PSTATE.EL == EL2 || route_to_el2) then EL2 else EL1; let vaddress : bits(64) = ARBITRARY : bits(64); let except : ExceptionRecord = AArch64_AbortSyndrome(Exception_Breakpoint, fault, target_el); AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_SoftwareBreakpoint() // ============================ func AArch64_SoftwareBreakpoint(immediate : bits(16)) begin let route_to_el2 : boolean = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && (HCR_EL2().TGE == '1' || MDCR_EL2().TDE == '1')); let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; var except : ExceptionRecord = ExceptionSyndrome(Exception_SoftwareBreakpoint); except.syndrome.iss[15:0] = immediate; if UInt(PSTATE.EL) > UInt(EL1) then AArch64_TakeException(PSTATE.EL, except, preferred_exception_return, vect_offset); elsif route_to_el2 then AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); else AArch64_TakeException(EL1, except, preferred_exception_return, vect_offset); end; end;

// AArch64_SoftwareStepException() // =============================== func AArch64_SoftwareStepException() begin assert PSTATE.EL != EL3; let route_to_el2 : boolean = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && (HCR_EL2().TGE == '1' || MDCR_EL2().TDE == '1')); let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; var except : ExceptionRecord = ExceptionSyndrome(Exception_SoftwareStep); if SoftwareStep_DidNotStep() then except.syndrome.iss[24] = '0'; else except.syndrome.iss[24] = '1'; except.syndrome.iss[6] = if SoftwareStep_SteppedEX() then '1' else '0'; end; except.syndrome.iss[5:0] = '100010'; // IFSC = Debug Exception if PSTATE.EL == EL2 || route_to_el2 then AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); else AArch64_TakeException(EL1, except, preferred_exception_return, vect_offset); end; end;

// AArch64_VectorCatchException() // ============================== // Vector Catch taken from EL0 or EL1 to EL2. This can only be called when debug exceptions are // being routed to EL2, as Vector Catch is a legacy debug event. func AArch64_VectorCatchException(fault : FaultRecord) begin assert PSTATE.EL != EL2; assert EL2Enabled() && (HCR_EL2().TGE == '1' || MDCR_EL2().TDE == '1'); let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; let vaddress : bits(64) = ARBITRARY : bits(64); let except : ExceptionRecord = AArch64_AbortSyndrome(Exception_VectorCatch, fault, EL2); AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); end;

// AArch64_WatchpointException() // ============================= func AArch64_WatchpointException(fault : FaultRecord) begin assert PSTATE.EL != EL3; let route_to_el2 : boolean = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && (HCR_EL2().TGE == '1' || MDCR_EL2().TDE == '1')); let preferred_exception_return : bits(64) = ThisInstrAddr{}(); var target_el : bits(2); let vect_offset : integer = 0x0; target_el = if (PSTATE.EL == EL2 || route_to_el2) then EL2 else EL1; var except : ExceptionRecord; if IsFeatureImplemented(FEAT_NV2) && fault.accessdesc.acctype == AccessType_NV2 then except = AArch64_AbortSyndrome(Exception_NV2Watchpoint, fault, target_el); else except = AArch64_AbortSyndrome(Exception_Watchpoint, fault, target_el); end; AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_ExceptionClass() // ======================== // Returns the Exception Class and Instruction Length fields to be reported in ESR func AArch64_ExceptionClass(exceptype : Exception, target_el : bits(2)) => (integer,bit) begin var il_is_valid : boolean = TRUE; let from_32 : boolean = UsingAArch32(); var ec : integer; case exceptype of when Exception_Uncategorized => ec = 0x00; il_is_valid = FALSE; when Exception_WFxTrap => ec = 0x01; when Exception_CP15RTTrap => ec = 0x03; assert from_32; when Exception_CP15RRTTrap => ec = 0x04; assert from_32; when Exception_CP14RTTrap => ec = 0x05; assert from_32; when Exception_CP14DTTrap => ec = 0x06; assert from_32; when Exception_AdvSIMDFPAccessTrap => ec = 0x07; when Exception_FPIDTrap => ec = 0x08; when Exception_PACTrap => ec = 0x09; when Exception_OtherTrap => ec = 0x0A; when Exception_GPC => ec = 0x1E; when Exception_CP14RRTTrap => ec = 0x0C; assert from_32; when Exception_BranchTarget => ec = 0x0D; when Exception_IllegalState => ec = 0x0E; il_is_valid = FALSE; when Exception_SupervisorCall => ec = if from_32 then 0x11 else 0x15; when Exception_HypervisorCall => ec = if from_32 then 0x12 else 0x16; when Exception_MonitorCall => ec = if from_32 then 0x13 else 0x17; when Exception_SystemRegisterTrap => ec = 0x18; assert !from_32; when Exception_SystemRegister128Trap => ec = 0x14; assert !from_32; when Exception_SVEAccessTrap => ec = 0x19; assert !from_32; when Exception_ERetTrap => ec = 0x1A; assert !from_32; when Exception_PACFail => ec = 0x1C; assert !from_32; when Exception_SMEAccessTrap => ec = 0x1D; assert !from_32; when Exception_InstructionAbort => ec = if target_el == PSTATE.EL then 0x21 else 0x20; il_is_valid = FALSE; when Exception_PCAlignment => ec = 0x22; il_is_valid = FALSE; when Exception_DataAbort => ec = if target_el == PSTATE.EL then 0x25 else 0x24; when Exception_NV2DataAbort => ec = 0x25; when Exception_SPAlignment => ec = 0x26; il_is_valid = FALSE; assert !from_32; when Exception_MemCpyMemSet => ec = 0x27; when Exception_GCSFail => ec = 0x2D; assert !from_32; when Exception_FPTrappedException => ec = if from_32 then 0x28 else 0x2C; when Exception_SError => ec = 0x2F; il_is_valid = FALSE; when Exception_Breakpoint => ec = if target_el == PSTATE.EL then 0x31 else 0x30; il_is_valid = FALSE; when Exception_SoftwareStep => ec = if target_el == PSTATE.EL then 0x33 else 0x32; il_is_valid = FALSE; when Exception_Watchpoint => ec = if target_el == PSTATE.EL then 0x35 else 0x34; il_is_valid = FALSE; when Exception_NV2Watchpoint => ec = 0x35; il_is_valid = FALSE; when Exception_SoftwareBreakpoint => ec = if from_32 then 0x38 else 0x3C; when Exception_VectorCatch => ec = 0x3A; il_is_valid = FALSE; assert from_32; when Exception_Profiling => ec = 0x3D; otherwise => unreachable; end; var il : bit; if il_is_valid then il = if ThisInstrLength() == 32 then '1' else '0'; else il = '1'; end; assert from_32 || il == '1'; // AArch64 instructions always 32-bit return (ec,il); end;

// AArch64_ReportException() // ========================= // Report syndrome information for exception taken to AArch64 state. func AArch64_ReportException(except : ExceptionRecord, target_el : bits(2)) begin let exceptype : Exception = except.exceptype; var (ec,il) = AArch64_ExceptionClass(exceptype, target_el); let iss : bits(25) = except.syndrome.iss; let iss2 : bits(24) = except.syndrome.iss2; // IL is not valid for Data Abort exceptions without valid instruction syndrome information if ec IN {0x24,0x25} && iss[24] == '0' then il = '1'; end; ESR_EL(target_el) = (Zeros{8} :: // [63:56] iss2 :: // [55:32] ec[5:0] :: // [31:26] il :: // [25] iss); // [24:0] if exceptype IN { Exception_InstructionAbort, Exception_PCAlignment, Exception_DataAbort, Exception_NV2DataAbort, Exception_NV2Watchpoint, Exception_GPC, Exception_Watchpoint } then FAR_EL(target_el) = except.vaddress; else FAR_EL(target_el) = ARBITRARY : bits(64); end; if except.ipavalid then HPFAR_EL2()[NUM_PABITS-9:4] = except.ipaddress[NUM_PABITS-1:12]; if IsSecureEL2Enabled() && CurrentSecurityState() == SS_Secure then HPFAR_EL2().NS = except.NS; else HPFAR_EL2().NS = '0'; end; elsif target_el == EL2 then HPFAR_EL2()[NUM_PABITS-9:4] = ARBITRARY : bits(NUM_PABITS-12); end; if except.pavalid then var faultaddr : bits(64) = ZeroExtend{}(except.paddress.address); if IsFeatureImplemented(FEAT_RME) then case except.paddress.paspace of when PAS_Secure => faultaddr[63:62] = '00'; when PAS_NonSecure => faultaddr[63:62] = '10'; when PAS_Root => faultaddr[63:62] = '01'; when PAS_Realm => faultaddr[63:62] = '11'; end; if exceptype == Exception_GPC then faultaddr[11:0] = Zeros{12}; end; else faultaddr[63] = if except.paddress.paspace == PAS_NonSecure then '1' else '0'; end; PFAR_EL(target_el) = faultaddr; elsif (IsFeatureImplemented(FEAT_PFAR) || (IsFeatureImplemented(FEAT_RME) && target_el == EL3)) then PFAR_EL(target_el) = ARBITRARY : bits(64); end; return; end;

// AArch64_TakeReset() // =================== // Reset into AArch64 state func AArch64_TakeReset(cold_reset : boolean) begin assert HaveAArch64(); // Enter the highest implemented Exception level in AArch64 state PSTATE.nRW = '0'; if HaveEL(EL3) then PSTATE.EL = EL3; elsif HaveEL(EL2) then PSTATE.EL = EL2; else PSTATE.EL = EL1; end; // Reset System registers and other system components AArch64_ResetControlRegisters(cold_reset); // Reset all other PSTATE fields PSTATE.SP = '1'; // Select stack pointer PSTATE.[D,A,I,F] = '1111'; // All asynchronous exceptions masked PSTATE.SS = '0'; // Clear software step bit PSTATE.DIT = '0'; // PSTATE.DIT is reset to 0 when resetting into AArch64 if IsFeatureImplemented(FEAT_PAuth_LR) then PSTATE.PACM = '0'; // PAC modifier end; if IsFeatureImplemented(FEAT_SME) then PSTATE.[SM,ZA] = '00'; // Disable Streaming SVE mode & ZA storage ResetSMEState('0'); end; if IsFeatureImplemented(FEAT_SSBS) then PSTATE.SSBS = ImpDefBit("PSTATE.SSBS bit at reset"); end; if IsFeatureImplemented(FEAT_GCS) then PSTATE.EXLOCK = '0'; // PSTATE.EXLOCK is reset to 0 when resetting into AArch64 end; if IsFeatureImplemented(FEAT_UINJ) then PSTATE.UINJ = '0'; // PSTATE.UINJ is reset to 0 when resetting into AArch64 end; PSTATE.IL = '0'; // Clear Illegal Execution state bit // All registers, bits and fields not reset by the above pseudocode or by the BranchTo() call // below are UNKNOWN bitstrings after reset. In particular, the return information registers // ELR_ELx and SPSR_ELx have UNKNOWN values, so that it // is impossible to return from a reset in an architecturally defined way. AArch64_ResetGeneralRegisters(); if IsFeatureImplemented(FEAT_SME) || IsFeatureImplemented(FEAT_SVE) then ResetSVERegisters(); else AArch64_ResetSIMDFPRegisters(); end; AArch64_ResetSpecialRegisters(); ResetExternalDebugRegisters(cold_reset); var rv : bits(64); // IMPLEMENTATION DEFINED reset vector if HaveEL(EL3) then rv = RVBAR_EL3(); elsif HaveEL(EL2) then rv = RVBAR_EL2(); else rv = RVBAR_EL1(); end; // The reset vector must be correctly aligned let pamax : AddressSize = AArch64_PAMax(); assert IsZero(rv[63:pamax]) && IsZero(rv[1:0]); let branch_conditional : boolean = FALSE; EDPRSR().R = '0'; // Leaving Reset State. BranchTo{64}(rv, BranchType_RESET, branch_conditional); end;

// GetESR_ELx_DFSC() // ================= // Query the ESR_ELx to get the DFSC field. func GetESR_ELx_DFSC(el : bits(2)) => bits(6) begin let ec : bits(6) = ESR_EL(el).EC; assert ec IN {'10010x', '101111', '11010x'}; return ESR_EL(el)[5:0]; end;

// GetESR_ELx_ExType() // =================== // Query the ESR_ELx to get the ExType field. func GetESR_ELx_ExType(el : bits(2)) => bits(4) begin let ec : bits(6) = ESR_EL(el).EC; assert ec == '101101'; return ESR_EL(el)[23:20]; end;

// GetESR_ELx_IFSC() // ================= // Query the ESR_ELx to get the IFSC field. func GetESR_ELx_IFSC(el : bits(2)) => bits(6) begin let ec : bits(6) = ESR_EL(el).EC; assert ec IN {'1100xx', '10000x'}; return ESR_EL(el)[5:0]; end;

// AArch64_FPTrappedException() // ============================ func AArch64_FPTrappedException(is_ase : boolean, accumulated_exceptions : bits(8)) begin var except : ExceptionRecord = ExceptionSyndrome(Exception_FPTrappedException); if is_ase then if ImpDefBool("vector instructions set TFV to 1") then except.syndrome.iss[23] = '1'; // TFV else except.syndrome.iss[23] = '0'; // TFV end; else except.syndrome.iss[23] = '1'; // TFV end; except.syndrome.iss[10:8] = ARBITRARY : bits(3); // VECITR if except.syndrome.iss[23] == '1' then except.syndrome.iss[7,4:0] = accumulated_exceptions[7,4:0]; // IDF, IXF, UFF, OFF, DZF, IOF else except.syndrome.iss[7,4:0] = ARBITRARY : bits(6); end; let route_to_el2 : boolean = PSTATE.EL == EL0 && EL2Enabled() && HCR_EL2().TGE == '1'; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; if UInt(PSTATE.EL) > UInt(EL1) then AArch64_TakeException(PSTATE.EL, except, preferred_exception_return, vect_offset); elsif route_to_el2 then AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); else AArch64_TakeException(EL1, except, preferred_exception_return, vect_offset); end; end;

// AArch64_CallHypervisor() // ======================== // Performs a HVC call func AArch64_CallHypervisor(immediate : bits(16)) begin assert HaveEL(EL2); if UsingAArch32() then AArch32_ITAdvance(); end; SSAdvance(); let preferred_exception_return : bits(64) = NextInstrAddr{}(); let vect_offset : integer{} = 0x0; var except : ExceptionRecord = ExceptionSyndrome(Exception_HypervisorCall); except.syndrome.iss[15:0] = immediate; if IsFeatureImplemented(FEAT_PAuth_LR) then PSTATE.PACM = '0'; end; if PSTATE.EL == EL3 then AArch64_TakeException(EL3, except, preferred_exception_return, vect_offset); else AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); end; end;

// AArch64_CallSecureMonitor() // =========================== func AArch64_CallSecureMonitor(immediate : bits(16)) begin assert HaveEL(EL3) && !ELUsingAArch32(EL3); if UsingAArch32() then AArch32_ITAdvance(); end; HSAdvance(); SSAdvance(); let preferred_exception_return : bits(64) = NextInstrAddr{}(); let vect_offset : integer{} = 0x0; var except : ExceptionRecord = ExceptionSyndrome(Exception_MonitorCall); except.syndrome.iss[15:0] = immediate; if IsFeatureImplemented(FEAT_PAuth_LR) then PSTATE.PACM = '0'; end; AArch64_TakeException(EL3, except, preferred_exception_return, vect_offset); end;

// AArch64_CallSupervisor() // ======================== // Calls the Supervisor func AArch64_CallSupervisor(immediate : bits(16)) begin if UsingAArch32() then AArch32_ITAdvance(); end; SSAdvance(); let route_to_el2 : boolean = PSTATE.EL == EL0 && EL2Enabled() && HCR_EL2().TGE == '1'; let preferred_exception_return : bits(64) = NextInstrAddr{}(); let vect_offset : integer{} = 0x0; var except : ExceptionRecord = ExceptionSyndrome(Exception_SupervisorCall); except.syndrome.iss[15:0] = immediate; if IsFeatureImplemented(FEAT_PAuth_LR) then PSTATE.PACM = '0'; end; if UInt(PSTATE.EL) > UInt(EL1) then AArch64_TakeException(PSTATE.EL, except, preferred_exception_return, vect_offset); elsif route_to_el2 then AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); else AArch64_TakeException(EL1, except, preferred_exception_return, vect_offset); end; end;

// AArch64_TakeException() // ======================= // Take an exception to an Exception level using AArch64. noreturn func AArch64_TakeException(target_el : bits(2), exception_in : ExceptionRecord, preferred_exception_return : bits(64), vect_offset_in : integer) begin assert HaveEL(target_el) && !ELUsingAArch32(target_el) && UInt(target_el) >= UInt(PSTATE.EL); if Halted() then AArch64_TakeExceptionInDebugState(target_el, exception_in); end; var except : ExceptionRecord = exception_in; var sync_errors : boolean; var iesb_req : boolean; if IsFeatureImplemented(FEAT_IESB) then sync_errors = SCTLR_EL(target_el).IESB == '1'; if IsFeatureImplemented(FEAT_DoubleFault) then sync_errors = sync_errors || (SCR_EL3().[EA,NMEA] == '11' && target_el == EL3); end; if sync_errors && InsertIESBBeforeException(target_el) then SynchronizeErrors(); if except.exceptype != Exception_SError then iesb_req = FALSE; sync_errors = FALSE; TakeUnmaskedPhysicalSErrorInterrupts(iesb_req); end; end; else sync_errors = FALSE; end; var brbe_source_allowed : boolean = FALSE; var brbe_source_address : bits(64) = Zeros{}; if IsFeatureImplemented(FEAT_BRBE) then brbe_source_allowed = BranchRecordAllowed(PSTATE.EL); brbe_source_address = preferred_exception_return; end; if !IsFeatureImplemented(FEAT_ExS) || SCTLR_EL(target_el).EIS == '1' then // Synchronize the context, including Instruction Fetch Barrier effect SynchronizeContext(); elsif !(except.exceptype == Exception_SoftwareBreakpoint || (except.exceptype IN {Exception_SupervisorCall, Exception_HypervisorCall, Exception_MonitorCall} && !except.trappedsyscallinst)) then InstructionFetchBarrier(); end; // If coming from AArch32 state, the top parts of the X() registers might be set to zero let from_32 : boolean = UsingAArch32(); if from_32 then AArch64_MaybeZeroRegisterUppers(); end; if from_32 && IsFeatureImplemented(FEAT_SME) && PSTATE.SM == '1' then ResetSVEState(); else MaybeZeroSVEUppers(target_el); end; var vect_offset : integer = vect_offset_in; if UInt(target_el) > UInt(PSTATE.EL) then var lower_32 : boolean; if target_el == EL3 then if EL2Enabled() then lower_32 = ELUsingAArch32(EL2); else lower_32 = ELUsingAArch32(EL1); end; elsif IsInHost() && PSTATE.EL == EL0 && target_el == EL2 then lower_32 = ELUsingAArch32(EL0); else lower_32 = ELUsingAArch32(target_el - 1); end; vect_offset = vect_offset + (if lower_32 then 0x600 else 0x400); elsif PSTATE.SP == '1' then vect_offset = vect_offset + 0x200; end; assert vect_offset < 2048; let vect_base : bits(64) = VBAR_EL(target_el)[63:11]::Zeros{11}; let target_vector : bits(64) = vect_base + vect_offset; var spsr : bits(64) = GetPSRFromPSTATE{}(AArch64_NonDebugState); if PSTATE.EL == EL1 && target_el == EL1 && EL2Enabled() then if EffectiveHCR_EL2_NVx() IN {'x01', '111'} then spsr[3:2] = '10'; end; end; if IsFeatureImplemented(FEAT_BTI) && !UsingAArch32() then var zero_btype : boolean; // SPSR_ELx[].BTYPE is only guaranteed valid for these exception types if except.exceptype IN {Exception_SError, Exception_IRQ, Exception_FIQ, Exception_SoftwareStep, Exception_PCAlignment, Exception_InstructionAbort, Exception_Breakpoint, Exception_VectorCatch, Exception_SoftwareBreakpoint, Exception_IllegalState, Exception_BranchTarget} then zero_btype = FALSE; else zero_btype = ConstrainUnpredictableBool(Unpredictable_ZEROBTYPE); end; if zero_btype then spsr[11:10] = '00'; end; end; if (IsFeatureImplemented(FEAT_NV2) && except.exceptype == Exception_NV2DataAbort && target_el == EL3) then // External aborts are configured to be taken to EL3 except.exceptype = Exception_DataAbort; end; if ! except.exceptype IN {Exception_IRQ, Exception_FIQ} then AArch64_ReportException(except, target_el); end; if IsFeatureImplemented(FEAT_BRBE) then BRBEException(except, brbe_source_allowed, brbe_source_address, target_vector, target_el, except.trappedsyscallinst); end; if IsFeatureImplemented(FEAT_GCS) then if PSTATE.EL == target_el then if GetCurrentEXLOCKEN() then PSTATE.EXLOCK = '1'; else PSTATE.EXLOCK = '0'; end; else PSTATE.EXLOCK = '0'; end; end; PSTATE.EL = target_el; PSTATE.nRW = '0'; PSTATE.SP = '1'; SPSR_ELx() = spsr; ELR_ELx() = preferred_exception_return; PSTATE.SS = '0'; if IsFeatureImplemented(FEAT_SSBS) then PSTATE.SSBS = SCTLR_ELx().DSSBS; end; if IsFeatureImplemented(FEAT_EBEP) then PSTATE.PM = '1'; end; if IsFeatureImplemented(FEAT_NMI) then PSTATE.ALLINT = NOT SCTLR_ELx().SPINTMASK; end; PSTATE.[D,A,I,F] = '1111'; if IsFeatureImplemented(FEAT_MTE) then PSTATE.TCO = '1'; end; PSTATE.IL = '0'; if IsFeatureImplemented(FEAT_UAO) then PSTATE.UAO = '0'; end; if IsFeatureImplemented(FEAT_UINJ) then PSTATE.UINJ = '0'; end; if IsFeatureImplemented(FEAT_PAuth_LR) then PSTATE.PACM = '0'; end; if IsFeatureImplemented(FEAT_PAN) && SCTLR_ELx().SPAN == '0' then if PSTATE.EL == EL1 then PSTATE.PAN = '1'; elsif PSTATE.EL == EL2 && ELIsInHost(EL0) then PSTATE.PAN = '1'; elsif (PSTATE.EL == EL2 && ELIsInHost(EL2) && ImpDefBool("Set PAN as 1 when E2H,TGE is '10'")) then PSTATE.PAN = '1'; end; end; if from_32 then // Coming from AArch32 PSTATE.IT = '00000000'; PSTATE.T = '0'; // PSTATE.J is RES0 end; if IsFeatureImplemented(FEAT_BTI) then PSTATE.BTYPE = '00'; end; let branch_conditional : boolean = FALSE; BranchTo{64}(target_vector, BranchType_EXCEPTION, branch_conditional); CheckExceptionCatch(TRUE); // Check for debug event on exception entry if sync_errors then SynchronizeErrors(); iesb_req = TRUE; TakeUnmaskedPhysicalSErrorInterrupts(iesb_req); end; EndOfInstruction(EndOfInstructionReason_Exception); end;

// AArch64_AArch32SystemAccessTrap() // ================================= // Trapped AArch32 System register access. func AArch64_AArch32SystemAccessTrap(target_el : bits(2), ec : integer) begin assert HaveEL(target_el) && target_el != EL0 && UInt(target_el) >= UInt(PSTATE.EL); let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; let except : ExceptionRecord = AArch64_AArch32SystemAccessTrapSyndrome(ThisInstr(), ec); AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_AArch32SystemAccessTrapSyndrome() // ========================================= // Returns the syndrome information for traps on AArch32 MCR, MCRR, MRC, MRRC, and VMRS, // VMSR instructions, other than traps that are due to HCPTR or CPACR. func AArch64_AArch32SystemAccessTrapSyndrome(instr : bits(32), ec : integer) => ExceptionRecord begin var except : ExceptionRecord; case ec of when 0x0 => except = ExceptionSyndrome(Exception_Uncategorized); when 0x3 => except = ExceptionSyndrome(Exception_CP15RTTrap); when 0x4 => except = ExceptionSyndrome(Exception_CP15RRTTrap); when 0x5 => except = ExceptionSyndrome(Exception_CP14RTTrap); when 0x6 => except = ExceptionSyndrome(Exception_CP14DTTrap); when 0x7 => except = ExceptionSyndrome(Exception_AdvSIMDFPAccessTrap); when 0x8 => except = ExceptionSyndrome(Exception_FPIDTrap); when 0xC => except = ExceptionSyndrome(Exception_CP14RRTTrap); otherwise => unreachable; end; var iss : bits(20) = Zeros{}; if except.exceptype == Exception_Uncategorized then return except; elsif except.exceptype IN {Exception_FPIDTrap, Exception_CP14RTTrap, Exception_CP15RTTrap} then // Trapped MRC/MCR, VMRS on FPSID if except.exceptype != Exception_FPIDTrap then // When trap is not for VMRS iss[19:17] = instr[7:5]; // opc2 iss[16:14] = instr[23:21]; // opc1 iss[13:10] = instr[19:16]; // CRn iss[4:1] = instr[3:0]; // CRm else iss[19:17] = '000'; iss[16:14] = '111'; iss[13:10] = instr[19:16]; // reg iss[4:1] = '0000'; end; if instr[20] == '1' && instr[15:12] == '1111' then // MRC, Rt==15 iss[9:5] = '11111'; elsif instr[20] == '0' && instr[15:12] == '1111' then // MCR, Rt==15 iss[9:5] = ARBITRARY : bits(5); else iss[9:5] = LookUpRIndex(UInt(instr[15:12]), PSTATE.M)[4:0]; end; elsif except.exceptype IN {Exception_CP14RRTTrap, Exception_AdvSIMDFPAccessTrap, Exception_CP15RRTTrap} then // Trapped MRRC/MCRR, VMRS/VMSR iss[19:16] = instr[7:4]; // opc1 if instr[19:16] == '1111' then // Rt2==15 iss[14:10] = ARBITRARY : bits(5); else iss[14:10] = LookUpRIndex(UInt(instr[19:16]), PSTATE.M)[4:0]; end; if instr[15:12] == '1111' then // Rt==15 iss[9:5] = ARBITRARY : bits(5); else iss[9:5] = LookUpRIndex(UInt(instr[15:12]), PSTATE.M)[4:0]; end; iss[4:1] = instr[3:0]; // CRm elsif except.exceptype == Exception_CP14DTTrap then // Trapped LDC/STC iss[19:12] = instr[7:0]; // imm8 iss[4] = instr[23]; // U iss[2:1] = instr[24,21]; // P,W if instr[19:16] == '1111' then // Rn==15, LDC(Literal addressing)/STC iss[9:5] = ARBITRARY : bits(5); iss[3] = '1'; end; end; iss[0] = instr[20]; // Direction except.syndrome.iss[24:20] = ConditionSyndrome(); except.syndrome.iss[19:0] = iss; return except; end;

// AArch64_AdvSIMDFPAccessTrap() // ============================= // Trapped access to Advanced SIMD or FP registers due to CPACR. func AArch64_AdvSIMDFPAccessTrap(target_el : bits(2)) begin let preferred_exception_return : bits(64) = ThisInstrAddr{}(); var except : ExceptionRecord; let vect_offset : integer = 0x0; let route_to_el2 : boolean = (target_el == EL1 && EL2Enabled() && HCR_EL2().TGE == '1'); if route_to_el2 then except = ExceptionSyndrome(Exception_Uncategorized); AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); else except = ExceptionSyndrome(Exception_AdvSIMDFPAccessTrap); except.syndrome.iss[24:20] = ConditionSyndrome(); AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end; return; end;

// AArch64_CheckCP15InstrCoarseTraps() // =================================== // Check for coarse-grained AArch32 traps to System registers in the // coproc=0b1111 encoding space by HSTR_EL2, HCR_EL2, and SCTLR_ELx. func AArch64_CheckCP15InstrCoarseTraps(CRn : integer, nreg : integer, CRm : integer) begin let trapped_encoding : boolean = ((CRn == 9 && CRm IN {0,1,2, 5,6,7,8 }) || (CRn == 10 && CRm IN {0,1, 4, 8 }) || (CRn == 11 && CRm IN {0,1,2,3,4,5,6,7,8,15})); // Check for MRC and MCR disabled by SCTLR_EL1.TIDCP. if (IsFeatureImplemented(FEAT_TIDCP1) && PSTATE.EL == EL0 && !IsInHost() && !ELUsingAArch32(EL1) && SCTLR_EL1().TIDCP == '1' && trapped_encoding) then if EL2Enabled() && HCR_EL2().TGE == '1' then AArch64_AArch32SystemAccessTrap(EL2, 0x3); else AArch64_AArch32SystemAccessTrap(EL1, 0x3); end; end; // Check for coarse-grained Hyp traps if PSTATE.EL IN {EL0, EL1} && EL2Enabled() then // Check for MRC and MCR disabled by SCTLR_EL2.TIDCP. if (IsFeatureImplemented(FEAT_TIDCP1) && PSTATE.EL == EL0 && IsInHost() && SCTLR_EL2().TIDCP == '1' && trapped_encoding) then AArch64_AArch32SystemAccessTrap(EL2, 0x3); end; let major : integer = if nreg == 1 then CRn else CRm; // Check for MCR, MRC, MCRR, and MRRC disabled by HSTR_EL2().CRn/HSTR().CRm // and MRC and MCR disabled by HCR_EL2.TIDCP. if ((!IsInHost() && ! major IN {4,14} && HSTR_EL2()[major] == '1') || (HCR_EL2().TIDCP == '1' && nreg == 1 && trapped_encoding)) then if (PSTATE.EL == EL0 && ImpDefBool("UNDEF unallocated CP15 access at EL0")) then Undefined(); end; AArch64_AArch32SystemAccessTrap(EL2, 0x3); end; end; end;

// AArch64_CheckFPAdvSIMDEnabled() // =============================== func AArch64_CheckFPAdvSIMDEnabled() begin AArch64_CheckFPEnabled(); // Check for illegal use of Advanced // SIMD in Streaming SVE Mode if IsFeatureImplemented(FEAT_SME) && PSTATE.SM == '1' && !IsFullA64Enabled() then SMEAccessTrap(SMEExceptionType_Streaming, PSTATE.EL); end; end;

// AArch64_CheckFPAdvSIMDTrap() // ============================ // Check against CPTR_EL2 and CPTR_EL3. func AArch64_CheckFPAdvSIMDTrap() begin if HaveEL(EL3) && CPTR_EL3().TFP == '1' && EL3SDDUndefPriority() then Undefined(); end; if PSTATE.EL IN {EL0, EL1, EL2} && EL2Enabled() then // Check if access disabled in CPTR_EL2 if ELIsInHost(EL2) then var disabled : boolean; case CPTR_EL2().FPEN of when 'x0' => disabled = TRUE; when '01' => disabled = PSTATE.EL == EL0 && HCR_EL2().TGE == '1'; when '11' => disabled = FALSE; end; if disabled then AArch64_AdvSIMDFPAccessTrap(EL2); end; else if CPTR_EL2().TFP == '1' then AArch64_AdvSIMDFPAccessTrap(EL2); end; end; end; if HaveEL(EL3) then // Check if access disabled in CPTR_EL3 if CPTR_EL3().TFP == '1' then if EL3SDDUndef() then Undefined(); else AArch64_AdvSIMDFPAccessTrap(EL3); end; end; end; end;

// AArch64_CheckFPEnabled() // ======================== // Check against CPACR func AArch64_CheckFPEnabled() begin if PSTATE.EL IN {EL0, EL1} && !IsInHost() then // Check if access disabled in CPACR_EL1 var disabled : boolean; case CPACR_EL1().FPEN of when 'x0' => disabled = TRUE; when '01' => disabled = PSTATE.EL == EL0; when '11' => disabled = FALSE; end; if disabled then AArch64_AdvSIMDFPAccessTrap(EL1); end; end; AArch64_CheckFPAdvSIMDTrap(); // Also check against CPTR_EL2 and CPTR_EL3 end;

// AArch64_CheckForERetTrap() // ========================== // Check for trap on ERET, ERETAA, ERETAB instruction func AArch64_CheckForERetTrap(eret_with_pac : boolean, pac_uses_key_a : boolean) begin if PSTATE.EL == EL1 && EL2Enabled() then var route_to_el2 : boolean = FALSE; // Check for a fine-grained trap by the hypervisor. if (IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HFGITR_EL2().ERET == '1') then route_to_el2 = TRUE; // Check for a trap by the Effective value of the HCR_EL2.NV bit elsif EffectiveHCR_EL2_NVx()[0] == '1' then route_to_el2 = TRUE; end; if route_to_el2 then let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; var except : ExceptionRecord = ExceptionSyndrome(Exception_ERetTrap); if !eret_with_pac then // ERET except.syndrome.iss[1] = '0'; except.syndrome.iss[0] = '0'; // RES0 else except.syndrome.iss[1] = '1'; except.syndrome.iss[0] = if pac_uses_key_a then '0' else '1'; end; AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); end; end; return; end;

// AArch64_CheckForSMCUndefOrTrap() // ================================ // Check for UNDEFINED or trap on SMC instruction func AArch64_CheckForSMCUndefOrTrap(imm : bits(16)) begin if PSTATE.EL == EL0 then Undefined(); end; if (!(PSTATE.EL == EL1 && EL2Enabled() && HCR_EL2().TSC == '1') && HaveEL(EL3) && SCR_EL3().SMD == '1') then Undefined(); end; var route_to_el2 : boolean = FALSE; if !HaveEL(EL3) then if (PSTATE.EL == EL1 && EL2Enabled() && HCR_EL2().TSC == '1' && (EffectiveHCR_EL2_NVx() == 'xx1' || (ImpDefBool("Trap SMC execution at EL1 to EL2")))) then route_to_el2 = TRUE; else Undefined(); end; else route_to_el2 = PSTATE.EL == EL1 && EL2Enabled() && HCR_EL2().TSC == '1'; end; if route_to_el2 then let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; var except : ExceptionRecord = ExceptionSyndrome(Exception_MonitorCall); except.syndrome.iss[15:0] = imm; except.trappedsyscallinst = TRUE; AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); end; end;

// AArch64_CheckForSVCTrap() // ========================= // Check for trap on SVC instruction func AArch64_CheckForSVCTrap(immediate : bits(16)) begin if IsFeatureImplemented(FEAT_FGT) then var route_to_el2 : boolean = FALSE; if PSTATE.EL == EL0 then route_to_el2 = (!UsingAArch32() && !ELUsingAArch32(EL1) && EL2Enabled() && HFGITR_EL2().SVC_EL0 == '1' && (!IsInHost() && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1'))); elsif PSTATE.EL == EL1 then route_to_el2 = (EL2Enabled() && HFGITR_EL2().SVC_EL1 == '1' && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1')); end; if route_to_el2 then var except : ExceptionRecord = ExceptionSyndrome(Exception_SupervisorCall); except.syndrome.iss[15:0] = immediate; except.trappedsyscallinst = TRUE; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); end; end; end;

// AArch64_CheckForWFxTrap() // ========================= // Checks for a trap on a WFE, WFET, WFI or WFIT instruction. func AArch64_CheckForWFxTrap(wfxtype : WFxType) => (boolean, bits(2)) begin let is_wfe : boolean = wfxtype IN {WFxType_WFE, WFxType_WFET}; var target_el : bits(2); var trap : boolean = FALSE; if HaveEL(EL3) && EL3SDDUndefPriority() && PSTATE.EL != EL3 then // Check for traps described by the Secure Monitor. // If the trap is enabled, the instruction will be UNDEFINED because EDSCR.SDD is 1. trap = (if is_wfe then SCR_EL3().TWE else SCR_EL3().TWI) == '1'; target_el = EL3; end; if !trap && PSTATE.EL == EL0 then // Check for traps described by the OS which may be EL1 or EL2. trap = (if is_wfe then SCTLR_ELx().nTWE else SCTLR_ELx().nTWI) == '0'; target_el = EL1; end; if !trap && PSTATE.EL IN {EL0, EL1} && EL2Enabled() && !IsInHost() then // Check for traps described by the Hypervisor. trap = (if is_wfe then HCR_EL2().TWE else HCR_EL2().TWI) == '1'; target_el = EL2; end; if !trap && HaveEL(EL3) && PSTATE.EL != EL3 then // Check for traps described by the Secure Monitor. trap = (if is_wfe then SCR_EL3().TWE else SCR_EL3().TWI) == '1'; target_el = EL3; end; return (trap, target_el); end;

// AArch64_CheckIllegalState() // =========================== // Check PSTATE.IL bit and generate Illegal Execution state exception if set. func AArch64_CheckIllegalState() begin if PSTATE.IL == '1' then let route_to_el2 : boolean = PSTATE.EL == EL0 && EL2Enabled() && HCR_EL2().TGE == '1'; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; let except : ExceptionRecord = ExceptionSyndrome(Exception_IllegalState); if UInt(PSTATE.EL) > UInt(EL1) then AArch64_TakeException(PSTATE.EL, except, preferred_exception_return, vect_offset); elsif route_to_el2 then AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); else AArch64_TakeException(EL1, except, preferred_exception_return, vect_offset); end; end; end;

// AArch64_MonitorModeTrap() // ========================= // Trapped use of Monitor mode features in a Secure EL1 AArch32 mode func AArch64_MonitorModeTrap() begin let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; let except : ExceptionRecord = ExceptionSyndrome(Exception_Uncategorized); if IsSecureEL2Enabled() then AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); end; AArch64_TakeException(EL3, except, preferred_exception_return, vect_offset); end;

// AArch64_OtherInstrTrap() // ======================== // Trapped access to the following instructions: // - LD64B // - ST64B // - ST64BV // - ST64BV0 // - PSB // - TSB func AArch64_OtherInstrTrap(target_el : bits(2), iss : bits(25)) begin let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; var except : ExceptionRecord = ExceptionSyndrome(Exception_OtherTrap); except.syndrome.iss = iss; AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_SystemAccessTrap() // ========================== // Trapped access to AArch64 System register or system instruction. func AArch64_SystemAccessTrap(target_el : bits(2), ec : integer) begin assert HaveEL(target_el) && target_el != EL0 && UInt(target_el) >= UInt(PSTATE.EL); let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; let except : ExceptionRecord = AArch64_SystemAccessTrapSyndrome(ThisInstr(), ec); AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end;

// AArch64_SystemAccessTrapSyndrome() // ================================== // Returns the syndrome information for traps on AArch64 MSR/MRS instructions. func AArch64_SystemAccessTrapSyndrome(instr_in : bits(32), ec : integer) => ExceptionRecord begin var except : ExceptionRecord; var instr : bits(32) = instr_in; case ec of when 0x0 => // Trapped access due to unknown reason. except = ExceptionSyndrome(Exception_Uncategorized); when 0x7 => // Trapped access to SVE, Advance SIMD&FP System register. except = ExceptionSyndrome(Exception_AdvSIMDFPAccessTrap); except.syndrome.iss[24:20] = ConditionSyndrome(); when 0x14 => // Trapped access to 128-bit System register or // 128-bit System instruction. except = ExceptionSyndrome(Exception_SystemRegister128Trap); instr = ThisInstr(); except.syndrome.iss[21:20] = instr[20:19]; // Op0 except.syndrome.iss[19:17] = instr[7:5]; // Op2 except.syndrome.iss[16:14] = instr[18:16]; // Op1 except.syndrome.iss[13:10] = instr[15:12]; // CRn except.syndrome.iss[9:6] = instr[4:1]; // Rt except.syndrome.iss[4:1] = instr[11:8]; // CRm except.syndrome.iss[0] = instr[21]; // Direction when 0x18 => // Trapped access to System register or system instruction. except = ExceptionSyndrome(Exception_SystemRegisterTrap); instr = ThisInstr(); except.syndrome.iss[21:20] = instr[20:19]; // Op0 except.syndrome.iss[19:17] = instr[7:5]; // Op2 except.syndrome.iss[16:14] = instr[18:16]; // Op1 except.syndrome.iss[13:10] = instr[15:12]; // CRn except.syndrome.iss[9:5] = instr[4:0]; // Rt except.syndrome.iss[4:1] = instr[11:8]; // CRm except.syndrome.iss[0] = instr[21]; // Direction when 0x19 => // Trapped access to SVE System register except = ExceptionSyndrome(Exception_SVEAccessTrap); when 0x1D => // Trapped access to SME System register except = ExceptionSyndrome(Exception_SMEAccessTrap); otherwise => unreachable; end; return except; end;

// AArch64_Undefined() // =================== noreturn func AArch64_Undefined() begin let route_to_el2 : boolean = PSTATE.EL == EL0 && EL2Enabled() && HCR_EL2().TGE == '1'; let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; let except : ExceptionRecord = ExceptionSyndrome(Exception_Uncategorized); if UInt(PSTATE.EL) > UInt(EL1) then AArch64_TakeException(PSTATE.EL, except, preferred_exception_return, vect_offset); elsif route_to_el2 then AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); else AArch64_TakeException(EL1, except, preferred_exception_return, vect_offset); end; end;

// AArch64_WFxTrap() // ================= // Generate an exception for a trapped WFE, WFI, WFET or WFIT instruction. func AArch64_WFxTrap(wfxtype : WFxType, target_el : bits(2)) begin assert UInt(target_el) > UInt(PSTATE.EL); let preferred_exception_return : bits(64) = ThisInstrAddr{}(); let vect_offset : integer = 0x0; var except : ExceptionRecord = ExceptionSyndrome(Exception_WFxTrap); except.syndrome.iss[24:20] = ConditionSyndrome(); case wfxtype of when WFxType_WFI => except.syndrome.iss[1:0] = '00'; when WFxType_WFE => except.syndrome.iss[1:0] = '01'; when WFxType_WFIT => except.syndrome.iss[1:0] = '10'; except.syndrome.iss[2] = '1'; // Register field is valid except.syndrome.iss[9:5] = ThisInstr()[4:0]; when WFxType_WFET => except.syndrome.iss[1:0] = '11'; except.syndrome.iss[2] = '1'; // Register field is valid except.syndrome.iss[9:5] = ThisInstr()[4:0]; end; if target_el == EL1 && EL2Enabled() && HCR_EL2().TGE == '1' then AArch64_TakeException(EL2, except, preferred_exception_return, vect_offset); else AArch64_TakeException(target_el, except, preferred_exception_return, vect_offset); end; end;

// CheckLDST64BEnabled() // ===================== // Checks for trap on ST64B and LD64B instructions func CheckLDST64BEnabled() begin var trap : boolean = FALSE; let iss : bits(25) = 0x2[24:0]; var target_el : bits(2); if PSTATE.EL == EL0 then if !IsInHost() then trap = SCTLR_EL1().EnALS == '0'; target_el = if EL2Enabled() && HCR_EL2().TGE == '1' then EL2 else EL1; else trap = SCTLR_EL2().EnALS == '0'; target_el = EL2; end; else target_el = EL1; end; if (!trap && EL2Enabled() && ((PSTATE.EL == EL0 && !IsInHost()) || PSTATE.EL == EL1)) then trap = !IsHCRXEL2Enabled() || HCRX_EL2().EnALS == '0'; target_el = EL2; end; if trap then AArch64_OtherInstrTrap(target_el, iss); end; end;

// CheckST64BV0Enabled() // ===================== // Checks for trap on ST64BV0 instruction func CheckST64BV0Enabled() begin var trap : boolean = FALSE; let iss : bits(25) = 0x1[24:0]; var target_el : bits(2); if (PSTATE.EL != EL3 && HaveEL(EL3) && SCR_EL3().EnAS0 == '0' && EL3SDDUndefPriority()) then Undefined(); end; if PSTATE.EL == EL0 then if !IsInHost() then trap = SCTLR_EL1().EnAS0 == '0'; target_el = if EL2Enabled() && HCR_EL2().TGE == '1' then EL2 else EL1; else trap = SCTLR_EL2().EnAS0 == '0'; target_el = EL2; end; end; if (!trap && EL2Enabled() && ((PSTATE.EL == EL0 && !IsInHost()) || PSTATE.EL == EL1)) then trap = !IsHCRXEL2Enabled() || HCRX_EL2().EnAS0 == '0'; target_el = EL2; end; if !trap && PSTATE.EL != EL3 then trap = HaveEL(EL3) && SCR_EL3().EnAS0 == '0'; target_el = EL3; end; if trap then if target_el == EL3 && EL3SDDUndef() then Undefined(); else AArch64_OtherInstrTrap(target_el, iss); end; end; end;

// CheckST64BVEnabled() // ==================== // Checks for trap on ST64BV instruction func CheckST64BVEnabled() begin var trap : boolean = FALSE; let iss : bits(25) = 0x0[24:0]; var target_el : bits(2); if PSTATE.EL == EL0 then if !IsInHost() then trap = SCTLR_EL1().EnASR == '0'; target_el = if EL2Enabled() && HCR_EL2().TGE == '1' then EL2 else EL1; else trap = SCTLR_EL2().EnASR == '0'; target_el = EL2; end; end; if (!trap && EL2Enabled() && ((PSTATE.EL == EL0 && !IsInHost()) || PSTATE.EL == EL1)) then trap = !IsHCRXEL2Enabled() || HCRX_EL2().EnASR == '0'; target_el = EL2; end; if trap then AArch64_OtherInstrTrap(target_el, iss); end; end;

// WFETrapDelay() // ============== // Returns TRUE when delay in trap to WFE is enabled with value to amount of delay, // FALSE otherwise. func WFETrapDelay(target_el : bits(2)) => (boolean, integer) begin var delay_enabled : boolean; var delay : integer; case target_el of when EL1 => if !IsInHost() then delay_enabled = SCTLR_EL1().TWEDEn == '1'; delay = 1 << (UInt(SCTLR_EL1().TWEDEL) + 8); else delay_enabled = SCTLR_EL2().TWEDEn == '1'; delay = 1 << (UInt(SCTLR_EL2().TWEDEL) + 8); end; when EL2 => assert EL2Enabled(); delay_enabled = HCR_EL2().TWEDEn == '1'; delay = 1 << (UInt(HCR_EL2().TWEDEL) + 8); when EL3 => delay_enabled = SCR_EL3().TWEDEn == '1'; delay = 1 << (UInt(SCR_EL3().TWEDEL) + 8); end; return (delay_enabled, delay); end;

// WaitForEventUntilDelay() // ======================== // Returns TRUE if WaitForEvent() returns before WFE trap delay expires, including potentially // some IMPLEMENTATION SPECIFIC additional delay, FALSE otherwise. impdef func WaitForEventUntilDelay(delay_enabled : boolean, delay : integer) => boolean begin return FALSE; end;

// AArch64_FaultSyndrome() // ======================= // Creates an exception syndrome value and updates the virtual address for Abort and Watchpoint // exceptions taken to an Exception level using AArch64. func AArch64_FaultSyndrome(exceptype : Exception, fault : FaultRecord, target_el : bits(2)) => IssType begin assert fault.statuscode != Fault_None; var isstype : IssType; isstype.iss = Zeros{25}; isstype.iss2 = Zeros{24}; let d_side : boolean = exceptype IN {Exception_DataAbort, Exception_NV2DataAbort, Exception_Watchpoint, Exception_NV2Watchpoint}; if IsFeatureImplemented(FEAT_RAS) && fault.statuscode == Fault_SyncExternal then let errstate : ErrorState = PEErrorState(fault); isstype.iss[12:11] = AArch64_EncodeSyncErrorSyndrome(errstate); // SET end; if d_side then if fault.accessdesc.acctype == AccessType_GCS then isstype.iss2[8] = '1'; end; if exceptype IN {Exception_Watchpoint, Exception_NV2Watchpoint} then isstype.iss[23:0] = WatchpointRelatedSyndrome(fault); end; if AArch64_InstructionSyndromeValid(fault) then if fault.accessdesc.ls64 then (isstype.iss2, isstype.iss[24:14]) = LS64InstructionSyndrome(); else isstype.iss[24:14] = LSInstructionSyndrome(); end; end; if IsFeatureImplemented(FEAT_NV2) && fault.accessdesc.acctype == AccessType_NV2 then isstype.iss[13] = '1'; // Fault is generated by use of VNCR_EL2 end; if (IsFeatureImplemented(FEAT_LS64) && fault.statuscode IN {Fault_AccessFlag, Fault_Translation, Fault_Permission}) then isstype.iss[12:11] = GetLoadStoreType(); end; if fault.accessdesc.acctype IN {AccessType_DC, AccessType_IC, AccessType_AT} then isstype.iss[8] = '1'; end; if fault.accessdesc.acctype IN {AccessType_DC, AccessType_IC, AccessType_AT} then isstype.iss[6] = '1'; elsif fault.statuscode IN {Fault_UnsupportedAtomicHWUpdate, Fault_Exclusive} then isstype.iss[6] = ARBITRARY : bit; elsif fault.accessdesc.atomicop && IsExternalAbort(fault) then isstype.iss[6] = ARBITRARY : bit; else isstype.iss[6] = if fault.write then '1' else '0'; end; isstype.iss2[9] = if fault.tagaccess then '1' else '0'; if fault.statuscode == Fault_Permission then isstype.iss2[5] = if fault.dirtybit then '1' else '0'; isstype.iss2[6] = if fault.overlay then '1' else '0'; if isstype.iss[24] == '0' then isstype.iss[21] = if fault.toplevel then '1' else '0'; end; isstype.iss2[7] = if fault.assuredonly then '1' else '0'; isstype.iss2[10] = if fault.s1tagnotdata then '1' else '0'; end; else if (fault.accessdesc.acctype == AccessType_IFETCH && fault.statuscode == Fault_Permission) then isstype.iss2[5] = if fault.dirtybit then '1' else '0'; isstype.iss[21] = if fault.toplevel then '1' else '0'; isstype.iss2[7] = if fault.assuredonly then '1' else '0'; isstype.iss2[6] = if fault.overlay then '1' else '0'; end; end; if fault.hdbssf then isstype.iss2[11] = '1'; end; if (IsFeatureImplemented(FEAT_PFAR) && IsExternalSyncAbort(fault) && !(EL2Enabled() && (HCR_EL2().VM == '1' || HCR_EL2().DC == '1') && target_el == EL1)) then isstype.iss[14] = if IsPFARValid(fault) then '1' else '0'; end; if IsExternalAbort(fault) then isstype.iss[9] = fault.extflag; end; isstype.iss[7] = if fault.s2fs1walk then '1' else '0'; isstype.iss[5:0] = EncodeLDFSC(fault.statuscode, fault.level); return isstype; end;

// AArch64_InstructionSyndromeValid() // ================================== // Returns TRUE if ESR_ELx.ISV is '1' for the given Fault. func AArch64_InstructionSyndromeValid(fault : FaultRecord) => boolean begin if !fault.accessdesc.lowestaddress then return FALSE; end; if fault.accessdesc.ls64 then return fault.statuscode IN {Fault_AccessFlag, Fault_Translation, Fault_Permission}; end; if fault.accessdesc.acctype == AccessType_GCS then return FALSE; end; if IsSecondStage(fault) && !fault.s2fs1walk then return (!IsExternalSyncAbort(fault) || (!IsFeatureImplemented(FEAT_RAS) && IsExternalAbortOnWalk(fault) && ImpDefBool("ISV on second stage translation table walk"))); end; return FALSE; end;

// EncodeGPCSC() // ============= // Function that gives the GPCSC code for types of GPT Fault func EncodeGPCSC(gpcf : GPCFRecord) => bits(6) begin assert gpcf.level IN {0,1}; case gpcf.gpf of when GPCF_AddressSize => return '00000'::gpcf.level[0]; when GPCF_Walk => return '00010'::gpcf.level[0]; when GPCF_Fail => return '00110'::gpcf.level[0]; when GPCF_EABT => return '01010'::gpcf.level[0]; end; end;

// LS64InstructionSyndrome() // ========================= // Returns the syndrome information and LST for a Data Abort by a // ST64B, ST64BV, ST64BV0, or LD64B instruction. The syndrome information // includes the ISS2, extended syndrome field. impdef func LS64InstructionSyndrome() => (bits(24), bits(11)) begin return (Zeros{24}, LSInstructionSyndrome()); end;

// WatchpointFARNotPrecise() // ========================= // Returns TRUE If the lowest watchpointed address that is higher than or equal to the address // recorded in EDWAR might not have been accessed by the instruction, other than the CONSTRAINED // UNPREDICTABLE condition of watchpoint matching a range of addresses with lowest address 16 bytes // rounded down and upper address rounded up to nearest 16 byte multiple, // FALSE otherwise. impdef func WatchpointFARNotPrecise(fault : FaultRecord) => boolean begin if IsFeatureImplemented(FEAT_SVE) || IsFeatureImplemented(FEAT_SME) then return fault.watchptinfo.maybe_false_match; end; return FALSE; end;

// AArch64_APAS() // ============== // Decode Xt and perform an APAS operation for the decoded record. func AArch64_APAS(Xt : bits(64)) begin var apas : APASRecord; let nse2 : bit = '0'; apas.paspace = DecodePASpace(nse2, Xt[62], Xt[63]); apas.pa = Xt[NUM_PABITS-1:6] :: '000000'; apas.target_attributes = Xt[2:0]; if AArch64_LocationSupportsAPAS(apas) then APAS_OP(apas); end; end;

// AArch64_LocationSupportsAPAS() // ============================== // Returns TRUE if the given memory location supports the APAS instruction. impdef func AArch64_LocationSupportsAPAS(apas : APASRecord) => boolean begin return TRUE; end;

// APASRecord // ========== // Details related to an APAS operation. type APASRecord of record { pa : bits(NUM_PABITS), paspace : PASpace, target_attributes : bits(3) };

// APAS_OP() // ========= // Sets the PA Space of the address in the APASRecord to the target PA space. If the location // does not support the APAS instruction or cannot be associated with the indicated PASpace, // then the instruction has no effect on the location and does not generate an External abort. impdef func APAS_OP(apas : APASRecord) begin return; end;

// AArch64_AT() // ============ // Perform address translation as per AT instructions. func AArch64_AT(address : bits(64), stage : TranslationStage, el_in : bits(2), ataccess : ATAccess) begin var el : bits(2) = el_in; // For stage 1 translation, when HCR_EL2().[E2H, TGE] is {1,1} and requested EL is EL1, // the EL2&0 translation regime is used. if ELIsInHost(EL0) && el == EL1 && stage == TranslationStage_1 then el = EL2; end; let ss : SecurityState = SecurityStateAtEL(el); let accdesc : AccessDescriptor = CreateAccDescAT(ss, el, ataccess); let aligned : boolean = TRUE; var fault : FaultRecord = NoFault(accdesc, address); let regime : Regime = TranslationRegime(el); var addrdesc : AddressDescriptor; if (el == EL0 && ELUsingAArch32(EL1)) || (el != EL0 && ELUsingAArch32(el)) then if regime == Regime_EL2 || TTBCR().EAE == '1' then (fault, addrdesc) = AArch32_S1TranslateLD(fault, regime, address[31:0], aligned, accdesc); else (fault, addrdesc, -) = AArch32_S1TranslateSD(fault, regime, address[31:0], aligned, accdesc); end; else let size : integer = 1; (fault, addrdesc) = AArch64_S1Translate(fault, regime, address, size, aligned, accdesc); end; if stage == TranslationStage_12 && fault.statuscode == Fault_None then let s1aarch64 : boolean = TRUE; if ELUsingAArch32(EL1) && regime == Regime_EL10 && EL2Enabled() then addrdesc.vaddress = ZeroExtend{64}(address); (fault, addrdesc) = AArch32_S2Translate(fault, addrdesc, aligned, accdesc); elsif regime == Regime_EL10 && EL2Enabled() then (fault, addrdesc) = AArch64_S2Translate(fault, addrdesc, s1aarch64, aligned, accdesc); end; end; let is_ATS1Ex : boolean = stage != TranslationStage_12; if fault.statuscode != Fault_None then addrdesc = CreateFaultyAddressDescriptor(fault); // Take an exception on: // * A Synchronous External abort occurs on translation table walk // * A stage 2 fault occurs on a stage 1 walk // * A GPC Exception (FEAT_RME) // * A GPF from ATS1E{1,0}* when executed from EL1 and HCR_EL2.GPF == '1' (FEAT_RME) if (IsExternalAbort(fault) || (PSTATE.EL == EL1 && fault.s2fs1walk) || (IsFeatureImplemented(FEAT_RME) && fault.gpcf.gpf != GPCF_None && ( ReportAsGPCException(fault) || (EL2Enabled() && HCR_EL2().GPF == '1' && PSTATE.EL == EL1 && el IN {EL1, EL0} && is_ATS1Ex) ))) then if IsFeatureImplemented(FEAT_D128) then PAR_EL1() = ARBITRARY : bits(128); else PAR_EL1()[63:0] = ARBITRARY : bits(64); end; AArch64_Abort(addrdesc.fault); end; end; AArch64_EncodePAR(regime, el, is_ATS1Ex, addrdesc); return; end;

// AArch64_EncodePAR() // =================== // Encode PAR register with result of translation. func AArch64_EncodePAR(regime : Regime, el : bits(2), is_ATS1Ex : boolean, addrdesc : AddressDescriptor) begin let paspace : PASpace = addrdesc.paddress.paspace; if IsFeatureImplemented(FEAT_D128) then PAR_EL1() = Zeros{128}; if AArch64_isPARFormatD128(regime, is_ATS1Ex) then PAR_EL1().D128 = '1'; else PAR_EL1().D128 = '0'; end; else PAR_EL1()[63:0] = Zeros{64}; end; if !IsFault(addrdesc) then PAR_EL1().F = '0'; if IsFeatureImplemented(FEAT_RME) then if regime == Regime_EL3 then case paspace of when PAS_Secure => PAR_EL1().[NSE,NS] = '00'; when PAS_NonSecure => PAR_EL1().[NSE,NS] = '01'; when PAS_Root => PAR_EL1().[NSE,NS] = '10'; when PAS_Realm => PAR_EL1().[NSE,NS] = '11'; end; elsif SecurityStateForRegime(regime) == SS_Secure then PAR_EL1().NSE = ARBITRARY : bit; PAR_EL1().NS = if paspace == PAS_Secure then '0' else '1'; elsif SecurityStateForRegime(regime) == SS_Realm then if regime == Regime_EL10 && is_ATS1Ex then PAR_EL1().NSE = ARBITRARY : bit; PAR_EL1().NS = ARBITRARY : bit; else PAR_EL1().NSE = ARBITRARY : bit; PAR_EL1().NS = if paspace == PAS_Realm then '0' else '1'; end; else PAR_EL1().NSE = ARBITRARY : bit; PAR_EL1().NS = ARBITRARY : bit; end; else PAR_EL1()[11] = '1'; // RES1 if SecurityStateForRegime(regime) == SS_Secure then PAR_EL1().NS = if paspace == PAS_Secure then '0' else '1'; else PAR_EL1().NS = ARBITRARY : bit; end; end; PAR_EL1().SH = ReportedPARShareability(PAREncodeShareability(addrdesc.memattrs)); if IsFeatureImplemented(FEAT_D128) && PAR_EL1().D128 == '1' then PAR_EL1()[119:76] = addrdesc.paddress.address[55:12]; else PAR_EL1()[55:12] = addrdesc.paddress.address[55:12]; end; PAR_EL1().ATTR = ReportedPARAttrs(EncodePARAttrs(addrdesc.memattrs)); PAR_EL1()[10] = ImpDefBit("Non-Faulting PAR"); else PAR_EL1().F = '1'; PAR_EL1().DirtyBit = if addrdesc.fault.dirtybit then '1' else '0'; PAR_EL1().Overlay = if addrdesc.fault.overlay then '1' else '0'; PAR_EL1().TopLevel = if addrdesc.fault.toplevel then '1' else '0'; PAR_EL1().AssuredOnly = if addrdesc.fault.assuredonly then '1' else '0'; PAR_EL1().FST = AArch64_PARFaultStatus(addrdesc.fault); PAR_EL1().PTW = if addrdesc.fault.s2fs1walk then '1' else '0'; PAR_EL1().S = if addrdesc.fault.secondstage then '1' else '0'; PAR_EL1()[11] = '1'; // RES1 PAR_EL1()[63:48] = ImpDefBits{16}("Faulting PAR"); end; return; end;

// AArch64_PARFaultStatus() // ======================== // Fault status field decoding of 64-bit PAR. func AArch64_PARFaultStatus(fault : FaultRecord) => bits(6) begin var fst : bits(6); if fault.statuscode == Fault_Domain then // Report Domain fault assert fault.level IN {1,2}; fst[1:0] = if fault.level == 1 then '01' else '10'; fst[5:2] = '1111'; else fst = EncodeLDFSC(fault.statuscode, fault.level); end; return fst; end;

// AArch64_isPARFormatD128() // ========================= // Check if last stage of translation uses VMSAv9-128. // Last stage of translation is stage 2 if enabled, else it is stage 1. func AArch64_isPARFormatD128(regime : Regime, is_ATS1Ex : boolean) => boolean begin var isPARFormatD128 : boolean; // Regime_EL2 does not support VMSAv9-128 if regime == Regime_EL2 || !IsFeatureImplemented(FEAT_D128) then isPARFormatD128 = FALSE; else isPARFormatD128 = FALSE; case regime of when Regime_EL3 => isPARFormatD128 = TCR_EL3().D128 == '1'; when Regime_EL20 => isPARFormatD128 = IsTCR2EL2Enabled() && TCR2_EL2().D128 == '1'; when Regime_EL10 => if is_ATS1Ex || !EL2Enabled() || HCR_EL2().[VM,DC] == '00' then isPARFormatD128 = IsTCR2EL1Enabled() && TCR2_EL1().D128 == '1'; else isPARFormatD128 = VTCR_EL2().D128 == '1'; end; end; end; return isPARFormatD128; end;

// GetPAR_EL1_D128() // ================= // Query the PAR_EL1.D128 field func GetPAR_EL1_D128() => bit begin return if IsFeatureImplemented(FEAT_D128) then PAR_EL1().D128 else '0'; end;

// GetPAR_EL1_F() // ============== // Query the PAR_EL1.F field. func GetPAR_EL1_F() => bit begin var F : bit; F = PAR_EL1().F; return F; end;

// MemBarrierOp // ============ // Memory barrier instruction types. type MemBarrierOp of enumeration { MemBarrierOp_DSB, // Data Synchronization Barrier MemBarrierOp_DMB, // Data Memory Barrier MemBarrierOp_ISB, // Instruction Synchronization Barrier MemBarrierOp_SSBB, // Speculative Synchronization Barrier to VA MemBarrierOp_PSSBB, // Speculative Synchronization Barrier to PA MemBarrierOp_SB // Speculation Barrier };

// BFXPreferred() // ============== // // Return TRUE if UBFX or SBFX is the preferred disassembly of a // UBFM or SBFM bitfield instruction. Must exclude more specific // aliases UBFIZ, SBFIZ, UXT[BH], SXT[BHW], LSL, LSR and ASR. func BFXPreferred(sf : bit, uns : bit, imms : bits(6), immr : bits(6)) => boolean begin // must not match UBFIZ/SBFIX alias if UInt(imms) < UInt(immr) then return FALSE; end; // must not match LSR/ASR/LSL alias (imms == 31 or 63) if imms == sf::'11111' then return FALSE; end; // must not match UXTx/SXTx alias if immr == '000000' then // must not match 32-bit UXT[BH] or SXT[BH] if sf == '0' && imms IN {'000111', '001111'} then return FALSE; end; // must not match 64-bit SXT[BHW] if sf::uns == '10' && imms IN {'000111', '001111', '011111'} then return FALSE; end; end; // must be UBFX/SBFX alias return TRUE; end;

// AltDecodeBitMasks() // =================== // Alternative but logically equivalent implementation of DecodeBitMasks() that // uses simpler primitives to compute tmask and wmask. func AltDecodeBitMasks{M}(immN : bit, imms : bits(6), immr : bits(6), immediate : boolean) => (bits(M), bits(M)) begin var tmask, wmask : bits(64); var tmask_and, wmask_and : bits(6); var tmask_or, wmask_or : bits(6); var levels : bits(6); // Compute log2 of element size // 2^len must be in range [2, M] if immN::NOT(imms) == '000000x' then Undefined(); end; let len : integer{} = HighestSetBitNZ(immN::NOT(imms)); assert 2 <= (2^len) && (2^len) <= M; // Determine s, r and s - r parameters levels = ZeroExtend{6}(Ones{len}); // For logical immediates an all-ones value of s is reserved // since it would generate a useless all-ones result (many times) if immediate && (imms AND levels) == levels then Undefined(); end; let s : integer{} = UInt(imms AND levels); let r : integer{} = UInt(immr AND levels); let diff : integer{} = s - r; // 6-bit subtract with borrow // Compute "top mask" tmask_and = diff[5:0] OR NOT(levels); tmask_or = diff[5:0] AND levels; tmask = Ones{64}; tmask = ((tmask AND Replicate{64, 2}(Replicate{1}(tmask_and[0]) :: Ones{1})) OR Replicate{64, 2}(Zeros{1} :: Replicate{1}(tmask_or[0]))); // optimization of first step: // tmask = Replicate{64}(tmask_and[0] :: '1'); tmask = ((tmask AND Replicate{64, 4}(Replicate{2}(tmask_and[1]) :: Ones{2})) OR Replicate{64, 4}(Zeros{2} :: Replicate{2}(tmask_or[1]))); tmask = ((tmask AND Replicate{64, 8}(Replicate{4}(tmask_and[2]) :: Ones{4})) OR Replicate{64, 8}(Zeros{4} :: Replicate{4}(tmask_or[2]))); tmask = ((tmask AND Replicate{64, 16}(Replicate{8}(tmask_and[3]) :: Ones{8})) OR Replicate{64, 16}(Zeros{8} :: Replicate{8}(tmask_or[3]))); tmask = ((tmask AND Replicate{64, 32}(Replicate{16}(tmask_and[4]) :: Ones{16})) OR Replicate{64, 32}(Zeros{16} :: Replicate{16}(tmask_or[4]))); tmask = ((tmask AND Replicate{64, 64}(Replicate{32}(tmask_and[5]) :: Ones{32})) OR Replicate{64, 64}(Zeros{32} :: Replicate{32}(tmask_or[5]))); // Compute "wraparound mask" wmask_and = immr OR NOT(levels); wmask_or = immr AND levels; wmask = Zeros{64}; wmask = ((wmask AND Replicate{64, 2}(Ones{1} :: Replicate{1}(wmask_and[0]))) OR Replicate{64, 2}(Replicate{1}(wmask_or[0]) :: Zeros{1})); // wmask = Replicate{64}(wmask_or[0] :: '0'); wmask = ((wmask AND Replicate{64, 4}(Ones{2} :: Replicate{2}(wmask_and[1]))) OR Replicate{64, 4}(Replicate{2}(wmask_or[1]) :: Zeros{2})); wmask = ((wmask AND Replicate{64, 8}(Ones{4} :: Replicate{4}(wmask_and[2]))) OR Replicate{64, 8}(Replicate{4}(wmask_or[2]) :: Zeros{4})); wmask = ((wmask AND Replicate{64, 16}(Ones{8} :: Replicate{8}(wmask_and[3]))) OR Replicate{64, 16}(Replicate{8}(wmask_or[3]) :: Zeros{8})); wmask = ((wmask AND Replicate{64, 32}(Ones{16} :: Replicate{16}(wmask_and[4]))) OR Replicate{64, 32}(Replicate{16}(wmask_or[4]) :: Zeros{16})); wmask = ((wmask AND Replicate{64, 64}(Ones{32} :: Replicate{32}(wmask_and[5]))) OR Replicate{64, 64}(Replicate{32}(wmask_or[5]) :: Zeros{32})); if diff[6] != '0' then // borrow from s - r wmask = wmask AND tmask; else wmask = wmask OR tmask; end; return (wmask[M-1:0], tmask[M-1:0]); end;

// DecodeBitMasks() // ================ // Decode AArch64 bitfield and logical immediate masks which use a similar encoding structure func DecodeBitMasks{M}(immN : bit, imms : bits(6), immr : bits(6), immediate : boolean) => (bits(M), bits(M)) begin var levels : bits(6); // Compute log2 of element size // 2^len must be in range [2, M] if immN::NOT(imms) == '000000x' then Undefined(); end; let len : integer{} = HighestSetBitNZ(immN::NOT(imms)); assert 2 <= (2^len) && (2^len) <= M; // Determine s, r and s - r parameters levels = ZeroExtend{6}(Ones{len}); // For logical immediates an all-ones value of s is reserved // since it would generate a useless all-ones result (many times) if immediate && (imms AND levels) == levels then Undefined(); end; let s : integer{} = UInt(imms AND levels); let r : integer{} = UInt(immr AND levels); let diff : integer{} = s - r; // 6-bit subtract with borrow let esize : integer{} = 1 << len; let d : integer{} = UInt(diff[len-1:0]); let welem : bits(esize) = ZeroExtend{}(Ones{s + 1}); let telem : bits(esize) = ZeroExtend{}(Ones{d + 1}); let wmask : bits(M) = Replicate{}(ROR(welem, r)); let tmask : bits(M) = Replicate{}(telem); return (wmask, tmask); end;

// AArch64_DataMemZero() // ===================== // Write Zero to data memory. func AArch64_DataMemZero(regval : bits(64), vaddress : bits(64), accdesc_in : AccessDescriptor, size : integer) begin var accdesc : AccessDescriptor = accdesc_in; // If the instruction targets tags as a payload, confer with system register configuration // which may override this. if accdesc.tagaccess then accdesc.tagaccess = IsMTEEnabled(accdesc.el); end; // If the instruction encoding permits tag checking, confer with system register configuration // which may override this. if accdesc.tagchecked then accdesc.tagchecked = AArch64_AccessIsTagChecked(vaddress, accdesc); end; let aligned : boolean = TRUE; var memaddrdesc : AddressDescriptor = AArch64_TranslateAddress(vaddress, accdesc, aligned, size); if IsFault(memaddrdesc) then if !IsDebugException(memaddrdesc.fault) then memaddrdesc.fault.vaddress = regval; end; AArch64_Abort(memaddrdesc.fault); end; for i = 0 to size-1 do if accdesc.tagchecked then let ltag : bits(4) = AArch64_LogicalAddressTag(vaddress); let bytes : integer = 1; let readcheck : boolean = FALSE; var fault : FaultRecord = AArch64_CheckTag(memaddrdesc, accdesc, readcheck, bytes, ltag); if fault.statuscode != Fault_None then if ImpDefBool( "DC_ZVA tag fault reported with lowest faulting address") then AArch64_Abort(fault); else fault.vaddress = regval; AArch64_Abort(fault); end; end; end; let memstatus : PhysMemRetStatus = PhysMemWrite{8}(memaddrdesc, accdesc, Zeros{8}); if IsFault(memstatus) then HandleExternalWriteAbort(memstatus, memaddrdesc, 1, accdesc); end; memaddrdesc.paddress.address = memaddrdesc.paddress.address + 1; end; return; end;

// AArch64_WriteTagMem() // ===================== // Write to tag memory. func AArch64_WriteTagMem(regval : bits(64), cachetype : CacheType, accdesc_in : AccessDescriptor, size : integer) begin assert accdesc_in.tagaccess && !accdesc_in.tagchecked; var accdesc : AccessDescriptor = accdesc_in; let vaddress : bits(64) = AlignDownSize{64}(regval, size as integer{16..2048}); let count : integer = size >> LOG2_TAG_GRANULE; let tag : bits(4) = AArch64_AllocationTagFromAddress(vaddress); let aligned : boolean = IsAlignedSize{64}(vaddress, TAG_GRANULE); assert aligned; accdesc.tagaccess = IsMTEEnabled(accdesc.el); var (memtagtype, memaddrdesc) = AArch64_TranslateTagAddress(vaddress, accdesc, aligned, size); // Check for aborts or debug exceptions if IsFault(memaddrdesc) then if IsDebugException(memaddrdesc.fault) then AArch64_Abort(memaddrdesc.fault); else memaddrdesc.fault.vaddress = regval; AArch64_Abort(memaddrdesc.fault); end; end; if !accdesc.tagaccess || memtagtype != MemTag_AllocationTagged then return; end; var memstatus : PhysMemRetStatus; for i = 0 to count-1 do memstatus = PhysMemTagWrite(memaddrdesc, accdesc, tag); if IsFault(memstatus) then HandleExternalWriteAbort(memstatus, memaddrdesc, 1, accdesc); end; memaddrdesc.paddress.address = memaddrdesc.paddress.address + TAG_GRANULE; memaddrdesc.vaddress = memaddrdesc.vaddress + TAG_GRANULE; end; return; end;

// CompareOp // ========= // Vector compare instruction types. type CompareOp of enumeration {CompareOp_GT, CompareOp_GE, CompareOp_EQ, CompareOp_LE, CompareOp_LT};

// CountOp // ======= // Bit counting instruction types. type CountOp of enumeration {CountOp_CLZ, CountOp_CLS, CountOp_CNT};

// EffectiveCPTA() // =============== // Returns the CPTA bit applied to Checked Pointer Arithmetic for Addition in the given EL. func EffectiveCPTA(el : bits(2)) => bit begin if !IsFeatureImplemented(FEAT_CPA2) then return '0'; end; if Halted() then return '0'; end; var cpta : bits(1); let regime : Regime = TranslationRegime(el); case regime of when Regime_EL3 => cpta = SCTLR2_EL3().CPTA; when Regime_EL2 => if IsSCTLR2EL2Enabled() then cpta = SCTLR2_EL2().CPTA; else cpta = '0'; end; when Regime_EL20 => if IsSCTLR2EL2Enabled() then cpta = if el == EL0 then SCTLR2_EL2().CPTA0 else SCTLR2_EL2().CPTA; else cpta = '0'; end; when Regime_EL10 => if IsSCTLR2EL1Enabled() then cpta = if el == EL0 then SCTLR2_EL1().CPTA0 else SCTLR2_EL1().CPTA; else cpta = '0'; end; otherwise => unreachable; end; return cpta; end;

// EffectiveCPTM() // =============== // Returns the CPTM bit applied to Checked Pointer Arithmetic for Multiplication in the given EL. func EffectiveCPTM(el : bits(2)) => bit begin if !IsFeatureImplemented(FEAT_CPA2) then return '0'; end; if EffectiveCPTA(el) == '0' then return '0'; end; if Halted() then return '0'; end; var cptm : bits(1); let regime : Regime = TranslationRegime(el); case regime of when Regime_EL3 => cptm = SCTLR2_EL3().CPTM; when Regime_EL2 => if IsSCTLR2EL2Enabled() then cptm = SCTLR2_EL2().CPTM; else cptm = '0'; end; when Regime_EL20 => if IsSCTLR2EL2Enabled() then cptm = if el == EL0 then SCTLR2_EL2().CPTM0 else SCTLR2_EL2().CPTM; else cptm = '0'; end; when Regime_EL10 => if IsSCTLR2EL1Enabled() then cptm = if el == EL0 then SCTLR2_EL1().CPTM0 else SCTLR2_EL1().CPTM; else cptm = '0'; end; otherwise => unreachable; end; return cptm; end;

// PointerAddCheck() // ================= // Apply Checked Pointer Arithmetic for addition. func PointerAddCheck(result : bits(64), base : bits(64)) => bits(64) begin return PointerCheckAtEL(PSTATE.EL, result, base, FALSE); end;