udb 0.1.9 → 0.1.13

data/.data/spec/custom/isa/qc_iu/inst/Xqccmi/qc.cm.ilut.yaml

@@ -0,0 +1,153 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../../schemas/inst_schema.json
+
+$schema: "inst_schema.json#"
+kind: instruction
+name: qc.cm.ilut
+long_name: Instruction Lookup Table Execute
+description: |
+  Fetch and execute the instruction(s) packed in the ILUT entry at index `ilut_index`.
+
+  The ILUT base address is held in `qc.itba.base` (shifted left by 6 to form a
+  64-byte-aligned byte address). The first `qc.itdec.dec` entries are 64-bit
+  double entries; all remaining entries are 32-bit single entries.
+
+  Entry address calculation:
+  - If `ilut_index` < `qc.itdec.dec`: `entry_addr = (qc.itba.BASE << 6) + ilut_index * 8`
+  - Otherwise: `entry_addr = (qc.itba.BASE << 6) + qc.itdec.DEC * 8 + (ilut_index - qc.itdec.DEC) * 4`
+
+  Each entry may contain one or two packed RISC-V instructions. The first
+  instruction begins at bit 0 of the entry. Its size is determined by the
+  standard RISC-V instruction-length encoding (16-bit, 32-bit, or 48-bit).
+  If bits remain after the first instruction and the next 16 bits are not
+  `c.nop` (16'h0001), a second instruction is present and is also executed.
+
+  PC-relative instructions (`auipc`, branches, and jumps) are not permitted
+  inside ILUT entries. Hardware detects such instructions during decode and
+  raises an IllegalInstruction exception.
+
+  On an exception caused by the second instruction, hardware sets bit 0 of
+  `mepc` to indicate that the fault originated from the second instruction
+  within the entry.
+
+  See the Xqccmi extension description for full details on entry layout,
+  dual-instruction packing, exception handling, and restrictions.
+definedBy:
+  extension:
+    name: Xqccmi
+assembly: ilut_index
+encoding:
+  match: 001-----------00
+  variables:
+    - name: ilut_index
+      location: 12-2
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+operation(): |
+  # Read the double-entry count (N = number of 64-bit double entries)
+  XReg N = {21'b0, CSR[qc.itdec].dec};
+
+  # Compute the byte address of the ILUT entry
+  XReg base_addr = CSR[qc.itba].base << 6;
+  XReg entry_addr;
+  Boolean is_double;
+
+  if (ilut_index < N) {
+    entry_addr = base_addr + (ilut_index * 8);
+    is_double = true;
+  } else {
+    entry_addr = base_addr + (N * 8) + ((ilut_index - N) * 4);
+    is_double = false;
+  }
+
+  # Translate the entry address (instruction fetch)
+  TranslationResult result;
+  if (CSR[misa].S == 1) {
+    result = translate(entry_addr, MemoryOperation::Fetch, mode(), $encoding);
+  } else {
+    result.paddr = entry_addr;
+  }
+
+  # Access check for instruction fetch
+  access_check(result.paddr, is_double ? 8 : 4, $pc, MemoryOperation::Fetch, ExceptionCode::InstructionAccessFault, mode());
+
+  # Read the entry from physical memory.
+  # For a 32-bit entry, read 32 bits. For a 64-bit double entry, read two
+  # consecutive 32-bit words (entry_lo = bits[31:0], entry_hi = bits[63:32]).
+  XReg entry_lo = read_physical_memory(32, result.paddr);
+  XReg entry_hi = 32'b0;
+  if (is_double) {
+    entry_hi = read_physical_memory(32, result.paddr + 4);
+  }
+
+  # Determine the size of the first instruction using RISC-V length encoding:
+  #   bits[1:0] != 2'b11 -> 16-bit instruction
+  #   bits[1:0] == 2'b11 and bits[4:2] != 3'b111 -> 32-bit instruction
+  #   bits[1:0] == 2'b11 and bits[4:2] == 3'b111 -> 48-bit instruction
+  Boolean has_second_inst = false; # true if this entry contains a second packed instruction
+
+  if (entry_lo[1:0] != 2'b11) {
+    # 16-bit first instruction; second instruction is in entry_lo[31:16]
+    Bits<16> second_lo = entry_lo[31:16];
+    if (second_lo != 16'h0001) {
+      has_second_inst = true;
+    }
+  } else if (entry_lo[4:2] != 3'b111) {
+    # 32-bit first instruction
+    if (is_double) {
+      # Second instruction starts at entry_hi[15:0]
+      Bits<16> second_lo = entry_hi[15:0];
+      if (second_lo != 16'h0001) {
+        has_second_inst = true;
+      }
+    }
+    # No room for a second instruction in a 32-bit entry after a 32-bit first
+  } else {
+    # 48-bit first instruction
+    if (!is_double) {
+      # 48-bit instruction does not fit in a 32-bit entry
+      executing_second_inst = false;
+      raise_ilut(ExceptionCode::IllegalInstruction, $encoding);
+    }
+    # No room for a second instruction after a 48-bit first in a 64-bit entry
+  }
+
+  # PC-relative instruction check:
+  # Hardware detects auipc, branches, and jump instructions during decode
+  # and raises an IllegalInstruction exception before any instruction executes.
+  # mepc bit 0 reflects which slot contained the forbidden instruction.
+  if (is_pc_relative_inst?(entry_lo)) {
+    executing_second_inst = false;
+    raise_ilut(ExceptionCode::IllegalInstruction, $encoding);
+  }
+  if (has_second_inst) {
+    Bits<32> second_inst;
+    if (entry_lo[1:0] != 2'b11) {
+      second_inst = {16'b0, entry_lo[31:16]};
+    } else {
+      second_inst = {16'b0, entry_hi[15:0]};
+    }
+    if (is_pc_relative_inst?(second_inst)) {
+      executing_second_inst = true;
+      raise_ilut(ExceptionCode::IllegalInstruction, $encoding);
+    }
+  }
+
+  # Execute the first instruction from the ILUT entry.
+  # IDL cannot express dynamic instruction dispatch; actual execution is implementation-defined.
+  # Any exception raised must call raise_ilut() with executing_second_inst = false (mepc bit 0 = 0).
+  executing_second_inst = false;
+  unpredictable("TO-DO: execute first ILUT instruction");
+
+  # Execute the second instruction from the ILUT entry, if present.
+  # Any exception raised must call raise_ilut() with executing_second_inst = true (mepc bit 0 = 1).
+  if (has_second_inst) {
+    executing_second_inst = true;
+    unpredictable("TO-DO: execute second ILUT instruction");
+    executing_second_inst = false;
+  }

data/.data/spec/custom/isa/qc_iu/inst/Xqccmt/qc.cm.jalt.yaml

@@ -0,0 +1,84 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../../schemas/inst_schema.json
+
+$schema: "inst_schema.json#"
+kind: instruction
+name: qc.cm.jalt
+long_name: Jump Via Table with Link to ra or t0
+description: |
+  Read an address from the Jump Vector Table and jump to it, linking to either
+  `ra` (x1) or `t0` (x5) depending on bit 0 of the table entry.
+
+  Bit 0 of the jump table entry is used as metadata:
+
+  * Bit 0 = 0: save return address in `ra` (x1)
+  * Bit 0 = 1: save return address in `t0` (x5)
+
+  The actual jump target always has bit 0 cleared:
+  `target = {entry[XLEN-1:1], 1'b0}`
+
+  Instruction encoded in the same encoding space as cm.jalt (Zcmt).
+  Xqccmt and Zcmt are mutually exclusive extensions.
+definedBy:
+  extension:
+    name: Xqccmt
+assembly: index_7_5, index_4_0
+encoding:
+  match: 101000--------10
+  variables:
+    - name: index_7_5
+      location: 9-7
+      not: 0
+    - name: index_4_0
+      location: 6-2
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+operation(): |
+  # Ensure JVT readable
+  check_zcmt_enabled($encoding);
+
+  if (CSR[jvt].MODE != 0) {
+    raise(ExceptionCode::IllegalInstruction, mode(), $encoding);
+  }
+
+  # Skip over _this_ 16-bit instruction
+  XReg return_addr = $pc + 2;
+
+  XReg jump_table_base = { CSR[jvt].BASE, 6'b000000 };
+  XReg index = { index_7_5, index_4_0 };
+  XReg virtual_address = jump_table_base + index `* (xlen() / 8);
+  XReg entry;
+  TranslationResult result;
+
+  # TODO: Correct this check when we figure out what MISA can do
+  if (CSR[misa].S == 1) {
+    result = translate(virtual_address, MemoryOperation::Fetch, mode(), $encoding);
+  } else {
+    result.paddr = virtual_address;
+  }
+
+  # may raise an exception
+  access_check(result.paddr, xlen(), $pc, MemoryOperation::Fetch, ExceptionCode::InstructionAccessFault, mode());
+
+  if (xlen() == 32) {
+    entry = read_physical_memory(32, result.paddr);
+  } else {
+    entry = read_physical_memory(64, result.paddr);
+  }
+
+  # Bit 0 of entry is metadata: 0 = link to ra (x1), 1 = link to t0 (x5)
+  if (entry[0] == 1'b1) {
+    X[5] = return_addr;  # t0
+  } else {
+    X[1] = return_addr;  # ra
+  }
+
+  # Jump target always has bit 0 cleared
+  XReg addr = entry & $signed(2'b10);
+
+  jump(addr);

data/.data/spec/custom/isa/qc_iu/inst/Xqccmt/qc.cm.jt.yaml

@@ -0,0 +1,60 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../../schemas/inst_schema.json
+
+$schema: "inst_schema.json#"
+kind: instruction
+name: qc.cm.jt
+long_name: Jump Via Table
+description: |
+  Read an address from the Jump Vector Table and jump to it.
+  Instruction encoded in the same encoding space as cm.jt (Zcmt).
+  Xqccmt and Zcmt are mutually exclusive extensions.
+definedBy:
+  extension:
+    name: Xqccmt
+assembly: index
+encoding:
+  match: 101000000-----10
+  variables:
+    - name: index
+      location: 6-2
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+operation(): |
+  # Ensure JVT readable
+  check_zcmt_enabled($encoding);
+
+  if (CSR[jvt].MODE != 0) {
+    raise(ExceptionCode::IllegalInstruction, mode(), $encoding);
+  }
+
+  XReg jump_table_base = { CSR[jvt].BASE, 6'b000000 };
+  XReg virtual_address = jump_table_base + index `* (xlen() / 8);
+  XReg addr;
+  TranslationResult result;
+
+  # TODO: Correct this check when we figure out what MISA can do
+  if (CSR[misa].S == 1) {
+    result = translate(virtual_address, MemoryOperation::Fetch, mode(), $encoding);
+  } else {
+    result.paddr = virtual_address;
+  }
+
+  # may raise an exception
+  access_check(result.paddr, xlen(), $pc, MemoryOperation::Fetch, ExceptionCode::InstructionAccessFault, mode());
+
+  if (xlen() == 32) {
+    addr = read_physical_memory(32, result.paddr);
+  } else {
+    addr = read_physical_memory(64, result.paddr);
+  }
+
+  # Ensure low-order bit is clear
+  addr = addr & $signed(2'b10);
+
+  jump(addr);

data/.data/spec/custom/isa/qc_iu/isa/globals.isa

@@ -58,6 +58,118 @@ builtin function sync_write_after_read_device {
   }
 }
 
+# Global flag: true while the second packed instruction in an ILUT entry is executing.
+# Set by qc.cm.ilut before executing the second slot; cleared after. Used by raise_ilut()
+# to encode the faulting slot into mepc bit 0.
+Boolean executing_second_inst = false;
+
+# Simplified precise-exception raise for qc_iu (M-mode only).
+# Identical to raise_precise except mepc.PC (or mnepc.PC for a double-trap)
+# captures bit 0 from executing_second_inst, allowing the trap handler to
+# distinguish first- vs second-instruction faults within an ILUT entry.
+# This function must be called for any exception raised by an ILUT-executed
+# instruction (first or second slot). The executing_second_inst flag must be set
+# before calling: false for the first instruction, true for the second.
+function raise_ilut {
+  arguments ExceptionCode exception_code, XReg tval
+  description {
+    Raise a precise exception for an ILUT-executed instruction.
+    Sets mepc.PC = $pc | (executing_second_inst ? 1 : 0) so that the trap handler
+    can determine whether the fault came from the first or second packed
+    instruction in the ILUT entry. For a double-trap, sets mnepc.PC instead.
+    Only the M-mode handling path is included because qc_iu is M-mode only.
+  }
+  body {
+    Bits<1> slot_bit = executing_second_inst ? 1'b1 : 1'b0;
+
+    # qc_iu is M-mode only; no S/H/VS/VU delegation logic needed.
+    if (implemented?(ExtensionName::Smrnmi) && CSR[mnstatus].NMIE == 1'b0) {
+      # Double-trap: use mnepc
+      CSR[mnepc].PC = $pc | slot_bit;
+    } else {
+      CSR[mepc].PC = $pc | slot_bit;
+    }
+
+    if (!mtval_readonly?()) {
+      CSR[mtval].VALUE = mtval_for(exception_code, tval);
+    }
+
+    $pc = {CSR[mtvec].BASE, 2'b00};
+    CSR[mcause].INT  = 1'b0;
+    CSR[mcause].CODE = $bits(exception_code);
+
+    set_mode(PrivilegeMode::M);
+    abort_current_instruction();
+  }
+}
+
+function is_pc_relative_inst? {
+  returns Boolean
+  arguments Bits<32> inst
+  description {
+    Returns true if +inst+ is a PC-relative instruction (auipc, branch, jump, or
+    compressed PC-relative jump (jal/c.j/c.jal), or compressed branch) that is
+    forbidden inside an ILUT entry. Register-indirect jumps (jalr, c.jr, c.jalr)
+    are NOT PC-relative and are permitted inside ILUT entries.
+    For 16-bit compressed instructions, only the lower 16 bits of +inst+ are examined.
+    For 48-bit Xqci instructions, only the lower 32 bits are passed here (the upper
+    16 bits are in a separate word and are not needed for this check).
+  }
+  body {
+    if (inst[1:0] != 2'b11) {
+      # 16-bit compressed instruction: examine only the lower 16 bits
+      Bits<16> cinst = inst[15:0];
+      # c.j:    funct3=101, op=01
+      if (cinst[15:13] == 3'b101 && cinst[1:0] == 2'b01) {
+        return true;
+      }
+      # c.jal:  funct3=001, op=01
+      if (cinst[15:13] == 3'b001 && cinst[1:0] == 2'b01) {
+        return true;
+      }
+      # c.beqz: funct3=110, op=01
+      if (cinst[15:13] == 3'b110 && cinst[1:0] == 2'b01) {
+        return true;
+      }
+      # c.bnez: funct3=111, op=01
+      if (cinst[15:13] == 3'b111 && cinst[1:0] == 2'b01) {
+        return true;
+      }
+      return false;
+    } else {
+      # 32-bit (or 48-bit) instruction: check opcode field bits[6:0]
+      Bits<7> opcode = inst[6:0];
+      # auipc
+      if (opcode == 7'b0010111) {
+        return true;
+      }
+      # jal
+      if (opcode == 7'b1101111) {
+        return true;
+      }
+      # branches
+      if (opcode == 7'b1100011) {
+        return true;
+      }
+      # 48-bit Xqci PC-relative instructions (inst[4:2]==3'b111 indicates 48-bit length)
+      if (inst[4:2] == 3'b111) {
+        # All Xqci 48-bit PC-relative instructions use opcode 7'b0011111
+        if (opcode == 7'b0011111) {
+          # qc.e.j / qc.e.jal: funct3=000, inst[24:20]==5'b00000
+          if (inst[14:12] == 3'b000 && inst[24:20] == 5'b00000) {
+            return true;
+          }
+          # qc.e.beqi/bnei/blti/bgei/bltui/bgeui: funct3=100, inst[24:23]==2'b11
+          if (inst[14:12] == 3'b100 && inst[24:23] == 2'b11) {
+            return true;
+          }
+        }
+      }
+      return false;
+    }
+  }
+}
+
 function get_and_validate_stack_pointer {
   returns XReg
   arguments XReg sp, Bits<INSTR_ENC_SIZE> encoding