]>
Commit | Line | Data |
---|---|---|
b7bcbe95 FB |
1 | /* |
2 | * ARM helper routines | |
5fafdf24 | 3 | * |
9ee6e8bb | 4 | * Copyright (c) 2005-2007 CodeSourcery, LLC |
b7bcbe95 FB |
5 | * |
6 | * This library is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU Lesser General Public | |
8 | * License as published by the Free Software Foundation; either | |
9 | * version 2 of the License, or (at your option) any later version. | |
10 | * | |
11 | * This library is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
14 | * Lesser General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU Lesser General Public | |
8167ee88 | 17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. |
b7bcbe95 | 18 | */ |
74c21bd0 | 19 | #include "qemu/osdep.h" |
c9b61d9a | 20 | #include "qemu/log.h" |
8d04fb55 | 21 | #include "qemu/main-loop.h" |
3e457172 | 22 | #include "cpu.h" |
2ef6175a | 23 | #include "exec/helper-proto.h" |
ccd38087 | 24 | #include "internals.h" |
63c91552 | 25 | #include "exec/exec-all.h" |
f08b6170 | 26 | #include "exec/cpu_ldst.h" |
b7bcbe95 | 27 | |
ad69471c PB |
28 | #define SIGNBIT (uint32_t)0x80000000 |
29 | #define SIGNBIT64 ((uint64_t)1 << 63) | |
30 | ||
c6328599 PM |
31 | static void raise_exception(CPUARMState *env, uint32_t excp, |
32 | uint32_t syndrome, uint32_t target_el) | |
b7bcbe95 | 33 | { |
c6328599 | 34 | CPUState *cs = CPU(arm_env_get_cpu(env)); |
27103424 | 35 | |
c6328599 PM |
36 | assert(!excp_is_internal(excp)); |
37 | cs->exception_index = excp; | |
38 | env->exception.syndrome = syndrome; | |
39 | env->exception.target_el = target_el; | |
5638d180 | 40 | cpu_loop_exit(cs); |
b7bcbe95 FB |
41 | } |
42 | ||
e3b1d480 GB |
43 | static int exception_target_el(CPUARMState *env) |
44 | { | |
45 | int target_el = MAX(1, arm_current_el(env)); | |
46 | ||
47 | /* No such thing as secure EL1 if EL3 is aarch32, so update the target EL | |
48 | * to EL3 in this case. | |
49 | */ | |
50 | if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) { | |
51 | target_el = 3; | |
52 | } | |
53 | ||
54 | return target_el; | |
55 | } | |
56 | ||
9ef39277 | 57 | uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def, |
8f8e3aa4 | 58 | uint32_t rn, uint32_t maxindex) |
9ee6e8bb PB |
59 | { |
60 | uint32_t val; | |
9ee6e8bb PB |
61 | uint32_t tmp; |
62 | int index; | |
63 | int shift; | |
64 | uint64_t *table; | |
65 | table = (uint64_t *)&env->vfp.regs[rn]; | |
66 | val = 0; | |
9ee6e8bb | 67 | for (shift = 0; shift < 32; shift += 8) { |
8f8e3aa4 PB |
68 | index = (ireg >> shift) & 0xff; |
69 | if (index < maxindex) { | |
3018f259 | 70 | tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff; |
9ee6e8bb PB |
71 | val |= tmp << shift; |
72 | } else { | |
8f8e3aa4 | 73 | val |= def & (0xff << shift); |
9ee6e8bb PB |
74 | } |
75 | } | |
8f8e3aa4 | 76 | return val; |
9ee6e8bb PB |
77 | } |
78 | ||
b5ff1b31 FB |
79 | #if !defined(CONFIG_USER_ONLY) |
80 | ||
aaa1f954 EI |
81 | static inline uint32_t merge_syn_data_abort(uint32_t template_syn, |
82 | unsigned int target_el, | |
83 | bool same_el, | |
b35399bb | 84 | bool s1ptw, bool is_write, |
aaa1f954 EI |
85 | int fsc) |
86 | { | |
87 | uint32_t syn; | |
88 | ||
89 | /* ISV is only set for data aborts routed to EL2 and | |
90 | * never for stage-1 page table walks faulting on stage 2. | |
91 | * | |
92 | * Furthermore, ISV is only set for certain kinds of load/stores. | |
93 | * If the template syndrome does not have ISV set, we should leave | |
94 | * it cleared. | |
95 | * | |
96 | * See ARMv8 specs, D7-1974: | |
97 | * ISS encoding for an exception from a Data Abort, the | |
98 | * ISV field. | |
99 | */ | |
100 | if (!(template_syn & ARM_EL_ISV) || target_el != 2 || s1ptw) { | |
101 | syn = syn_data_abort_no_iss(same_el, | |
b35399bb | 102 | 0, 0, s1ptw, is_write, fsc); |
aaa1f954 EI |
103 | } else { |
104 | /* Fields: IL, ISV, SAS, SSE, SRT, SF and AR come from the template | |
105 | * syndrome created at translation time. | |
106 | * Now we create the runtime syndrome with the remaining fields. | |
107 | */ | |
108 | syn = syn_data_abort_with_iss(same_el, | |
109 | 0, 0, 0, 0, 0, | |
b35399bb | 110 | 0, 0, s1ptw, is_write, fsc, |
aaa1f954 EI |
111 | false); |
112 | /* Merge the runtime syndrome with the template syndrome. */ | |
113 | syn |= template_syn; | |
114 | } | |
115 | return syn; | |
116 | } | |
117 | ||
b5ff1b31 | 118 | /* try to fill the TLB and return an exception if error. If retaddr is |
d5a11fef AF |
119 | * NULL, it means that the function was called in C code (i.e. not |
120 | * from generated code or from helper.c) | |
121 | */ | |
b35399bb SS |
122 | void tlb_fill(CPUState *cs, target_ulong addr, MMUAccessType access_type, |
123 | int mmu_idx, uintptr_t retaddr) | |
b5ff1b31 | 124 | { |
b7cc4e82 PC |
125 | bool ret; |
126 | uint32_t fsr = 0; | |
e14b5a23 | 127 | ARMMMUFaultInfo fi = {}; |
b5ff1b31 | 128 | |
b35399bb | 129 | ret = arm_tlb_fill(cs, addr, access_type, mmu_idx, &fsr, &fi); |
551bd27f | 130 | if (unlikely(ret)) { |
d5a11fef AF |
131 | ARMCPU *cpu = ARM_CPU(cs); |
132 | CPUARMState *env = &cpu->env; | |
8c6084bf | 133 | uint32_t syn, exc; |
d759a457 EI |
134 | unsigned int target_el; |
135 | bool same_el; | |
d5a11fef | 136 | |
b5ff1b31 FB |
137 | if (retaddr) { |
138 | /* now we have a real cpu fault */ | |
3f38f309 | 139 | cpu_restore_state(cs, retaddr); |
b5ff1b31 | 140 | } |
8c6084bf | 141 | |
d759a457 EI |
142 | target_el = exception_target_el(env); |
143 | if (fi.stage2) { | |
144 | target_el = 2; | |
9b539263 | 145 | env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4; |
d759a457 EI |
146 | } |
147 | same_el = arm_current_el(env) == target_el; | |
8c6084bf | 148 | /* AArch64 syndrome does not have an LPAE bit */ |
b7cc4e82 | 149 | syn = fsr & ~(1 << 9); |
8c6084bf PM |
150 | |
151 | /* For insn and data aborts we assume there is no instruction syndrome | |
152 | * information; this is always true for exceptions reported to EL1. | |
153 | */ | |
b35399bb | 154 | if (access_type == MMU_INST_FETCH) { |
37785977 | 155 | syn = syn_insn_abort(same_el, 0, fi.s1ptw, syn); |
8c6084bf PM |
156 | exc = EXCP_PREFETCH_ABORT; |
157 | } else { | |
aaa1f954 | 158 | syn = merge_syn_data_abort(env->exception.syndrome, target_el, |
b35399bb SS |
159 | same_el, fi.s1ptw, |
160 | access_type == MMU_DATA_STORE, syn); | |
161 | if (access_type == MMU_DATA_STORE | |
162 | && arm_feature(env, ARM_FEATURE_V6)) { | |
b7cc4e82 | 163 | fsr |= (1 << 11); |
8c6084bf PM |
164 | } |
165 | exc = EXCP_DATA_ABORT; | |
166 | } | |
167 | ||
8c6084bf | 168 | env->exception.vaddress = addr; |
b7cc4e82 | 169 | env->exception.fsr = fsr; |
d759a457 | 170 | raise_exception(env, exc, syn, target_el); |
b5ff1b31 | 171 | } |
b5ff1b31 | 172 | } |
30901475 AB |
173 | |
174 | /* Raise a data fault alignment exception for the specified virtual address */ | |
b35399bb SS |
175 | void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr, |
176 | MMUAccessType access_type, | |
177 | int mmu_idx, uintptr_t retaddr) | |
30901475 AB |
178 | { |
179 | ARMCPU *cpu = ARM_CPU(cs); | |
180 | CPUARMState *env = &cpu->env; | |
181 | int target_el; | |
182 | bool same_el; | |
aaa1f954 | 183 | uint32_t syn; |
30901475 AB |
184 | |
185 | if (retaddr) { | |
186 | /* now we have a real cpu fault */ | |
187 | cpu_restore_state(cs, retaddr); | |
188 | } | |
189 | ||
190 | target_el = exception_target_el(env); | |
191 | same_el = (arm_current_el(env) == target_el); | |
192 | ||
193 | env->exception.vaddress = vaddr; | |
194 | ||
195 | /* the DFSR for an alignment fault depends on whether we're using | |
196 | * the LPAE long descriptor format, or the short descriptor format | |
197 | */ | |
deb2db99 | 198 | if (arm_s1_regime_using_lpae_format(env, cpu_mmu_index(env, false))) { |
e0fe723c | 199 | env->exception.fsr = (1 << 9) | 0x21; |
30901475 AB |
200 | } else { |
201 | env->exception.fsr = 0x1; | |
202 | } | |
203 | ||
b35399bb | 204 | if (access_type == MMU_DATA_STORE && arm_feature(env, ARM_FEATURE_V6)) { |
30901475 AB |
205 | env->exception.fsr |= (1 << 11); |
206 | } | |
207 | ||
aaa1f954 | 208 | syn = merge_syn_data_abort(env->exception.syndrome, target_el, |
b35399bb SS |
209 | same_el, 0, access_type == MMU_DATA_STORE, |
210 | 0x21); | |
aaa1f954 | 211 | raise_exception(env, EXCP_DATA_ABORT, syn, target_el); |
30901475 AB |
212 | } |
213 | ||
214 | #endif /* !defined(CONFIG_USER_ONLY) */ | |
1497c961 | 215 | |
9ef39277 | 216 | uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b) |
1497c961 PB |
217 | { |
218 | uint32_t res = a + b; | |
219 | if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) | |
220 | env->QF = 1; | |
221 | return res; | |
222 | } | |
223 | ||
9ef39277 | 224 | uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b) |
1497c961 PB |
225 | { |
226 | uint32_t res = a + b; | |
227 | if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) { | |
228 | env->QF = 1; | |
229 | res = ~(((int32_t)a >> 31) ^ SIGNBIT); | |
230 | } | |
231 | return res; | |
232 | } | |
233 | ||
9ef39277 | 234 | uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b) |
1497c961 PB |
235 | { |
236 | uint32_t res = a - b; | |
237 | if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) { | |
238 | env->QF = 1; | |
239 | res = ~(((int32_t)a >> 31) ^ SIGNBIT); | |
240 | } | |
241 | return res; | |
242 | } | |
243 | ||
9ef39277 | 244 | uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val) |
1497c961 PB |
245 | { |
246 | uint32_t res; | |
247 | if (val >= 0x40000000) { | |
248 | res = ~SIGNBIT; | |
249 | env->QF = 1; | |
250 | } else if (val <= (int32_t)0xc0000000) { | |
251 | res = SIGNBIT; | |
252 | env->QF = 1; | |
253 | } else { | |
254 | res = val << 1; | |
255 | } | |
256 | return res; | |
257 | } | |
258 | ||
9ef39277 | 259 | uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b) |
1497c961 PB |
260 | { |
261 | uint32_t res = a + b; | |
262 | if (res < a) { | |
263 | env->QF = 1; | |
264 | res = ~0; | |
265 | } | |
266 | return res; | |
267 | } | |
268 | ||
9ef39277 | 269 | uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b) |
1497c961 PB |
270 | { |
271 | uint32_t res = a - b; | |
272 | if (res > a) { | |
273 | env->QF = 1; | |
274 | res = 0; | |
275 | } | |
276 | return res; | |
277 | } | |
278 | ||
6ddbc6e4 | 279 | /* Signed saturation. */ |
9ef39277 | 280 | static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift) |
6ddbc6e4 PB |
281 | { |
282 | int32_t top; | |
283 | uint32_t mask; | |
284 | ||
6ddbc6e4 PB |
285 | top = val >> shift; |
286 | mask = (1u << shift) - 1; | |
287 | if (top > 0) { | |
288 | env->QF = 1; | |
289 | return mask; | |
290 | } else if (top < -1) { | |
291 | env->QF = 1; | |
292 | return ~mask; | |
293 | } | |
294 | return val; | |
295 | } | |
296 | ||
297 | /* Unsigned saturation. */ | |
9ef39277 | 298 | static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift) |
6ddbc6e4 PB |
299 | { |
300 | uint32_t max; | |
301 | ||
6ddbc6e4 PB |
302 | max = (1u << shift) - 1; |
303 | if (val < 0) { | |
304 | env->QF = 1; | |
305 | return 0; | |
306 | } else if (val > max) { | |
307 | env->QF = 1; | |
308 | return max; | |
309 | } | |
310 | return val; | |
311 | } | |
312 | ||
313 | /* Signed saturate. */ | |
9ef39277 | 314 | uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift) |
6ddbc6e4 | 315 | { |
9ef39277 | 316 | return do_ssat(env, x, shift); |
6ddbc6e4 PB |
317 | } |
318 | ||
319 | /* Dual halfword signed saturate. */ | |
9ef39277 | 320 | uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift) |
6ddbc6e4 PB |
321 | { |
322 | uint32_t res; | |
323 | ||
9ef39277 BS |
324 | res = (uint16_t)do_ssat(env, (int16_t)x, shift); |
325 | res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16; | |
6ddbc6e4 PB |
326 | return res; |
327 | } | |
328 | ||
329 | /* Unsigned saturate. */ | |
9ef39277 | 330 | uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift) |
6ddbc6e4 | 331 | { |
9ef39277 | 332 | return do_usat(env, x, shift); |
6ddbc6e4 PB |
333 | } |
334 | ||
335 | /* Dual halfword unsigned saturate. */ | |
9ef39277 | 336 | uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift) |
6ddbc6e4 PB |
337 | { |
338 | uint32_t res; | |
339 | ||
9ef39277 BS |
340 | res = (uint16_t)do_usat(env, (int16_t)x, shift); |
341 | res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16; | |
6ddbc6e4 PB |
342 | return res; |
343 | } | |
d9ba4830 | 344 | |
9886ecdf PB |
345 | void HELPER(setend)(CPUARMState *env) |
346 | { | |
347 | env->uncached_cpsr ^= CPSR_E; | |
348 | } | |
349 | ||
b1eced71 GB |
350 | /* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped. |
351 | * The function returns the target EL (1-3) if the instruction is to be trapped; | |
352 | * otherwise it returns 0 indicating it is not trapped. | |
353 | */ | |
354 | static inline int check_wfx_trap(CPUARMState *env, bool is_wfe) | |
355 | { | |
356 | int cur_el = arm_current_el(env); | |
357 | uint64_t mask; | |
358 | ||
359 | /* If we are currently in EL0 then we need to check if SCTLR is set up for | |
360 | * WFx instructions being trapped to EL1. These trap bits don't exist in v7. | |
361 | */ | |
362 | if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) { | |
363 | int target_el; | |
364 | ||
365 | mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI; | |
366 | if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) { | |
367 | /* Secure EL0 and Secure PL1 is at EL3 */ | |
368 | target_el = 3; | |
369 | } else { | |
370 | target_el = 1; | |
371 | } | |
372 | ||
373 | if (!(env->cp15.sctlr_el[target_el] & mask)) { | |
374 | return target_el; | |
375 | } | |
376 | } | |
377 | ||
378 | /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it | |
379 | * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the | |
380 | * bits will be zero indicating no trap. | |
381 | */ | |
382 | if (cur_el < 2 && !arm_is_secure(env)) { | |
383 | mask = (is_wfe) ? HCR_TWE : HCR_TWI; | |
384 | if (env->cp15.hcr_el2 & mask) { | |
385 | return 2; | |
386 | } | |
387 | } | |
388 | ||
389 | /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */ | |
390 | if (cur_el < 3) { | |
391 | mask = (is_wfe) ? SCR_TWE : SCR_TWI; | |
392 | if (env->cp15.scr_el3 & mask) { | |
393 | return 3; | |
394 | } | |
395 | } | |
396 | ||
397 | return 0; | |
398 | } | |
399 | ||
1ce94f81 | 400 | void HELPER(wfi)(CPUARMState *env) |
d9ba4830 | 401 | { |
259186a7 | 402 | CPUState *cs = CPU(arm_env_get_cpu(env)); |
b1eced71 | 403 | int target_el = check_wfx_trap(env, false); |
259186a7 | 404 | |
84549b6d PM |
405 | if (cpu_has_work(cs)) { |
406 | /* Don't bother to go into our "low power state" if | |
407 | * we would just wake up immediately. | |
408 | */ | |
409 | return; | |
410 | } | |
411 | ||
b1eced71 GB |
412 | if (target_el) { |
413 | env->pc -= 4; | |
414 | raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0), target_el); | |
415 | } | |
416 | ||
27103424 | 417 | cs->exception_index = EXCP_HLT; |
259186a7 | 418 | cs->halted = 1; |
5638d180 | 419 | cpu_loop_exit(cs); |
d9ba4830 PB |
420 | } |
421 | ||
72c1d3af PM |
422 | void HELPER(wfe)(CPUARMState *env) |
423 | { | |
049e24a1 PM |
424 | /* This is a hint instruction that is semantically different |
425 | * from YIELD even though we currently implement it identically. | |
426 | * Don't actually halt the CPU, just yield back to top | |
b1eced71 GB |
427 | * level loop. This is not going into a "low power state" |
428 | * (ie halting until some event occurs), so we never take | |
429 | * a configurable trap to a different exception level. | |
72c1d3af | 430 | */ |
049e24a1 PM |
431 | HELPER(yield)(env); |
432 | } | |
433 | ||
434 | void HELPER(yield)(CPUARMState *env) | |
435 | { | |
436 | ARMCPU *cpu = arm_env_get_cpu(env); | |
437 | CPUState *cs = CPU(cpu); | |
438 | ||
c22edfeb AB |
439 | /* When running in MTTCG we don't generate jumps to the yield and |
440 | * WFE helpers as it won't affect the scheduling of other vCPUs. | |
441 | * If we wanted to more completely model WFE/SEV so we don't busy | |
442 | * spin unnecessarily we would need to do something more involved. | |
443 | */ | |
444 | g_assert(!parallel_cpus); | |
445 | ||
049e24a1 PM |
446 | /* This is a non-trappable hint instruction that generally indicates |
447 | * that the guest is currently busy-looping. Yield control back to the | |
448 | * top level loop so that a more deserving VCPU has a chance to run. | |
449 | */ | |
27103424 | 450 | cs->exception_index = EXCP_YIELD; |
5638d180 | 451 | cpu_loop_exit(cs); |
72c1d3af PM |
452 | } |
453 | ||
d4a2dc67 PM |
454 | /* Raise an internal-to-QEMU exception. This is limited to only |
455 | * those EXCP values which are special cases for QEMU to interrupt | |
456 | * execution and not to be used for exceptions which are passed to | |
457 | * the guest (those must all have syndrome information and thus should | |
458 | * use exception_with_syndrome). | |
459 | */ | |
460 | void HELPER(exception_internal)(CPUARMState *env, uint32_t excp) | |
461 | { | |
462 | CPUState *cs = CPU(arm_env_get_cpu(env)); | |
463 | ||
464 | assert(excp_is_internal(excp)); | |
465 | cs->exception_index = excp; | |
466 | cpu_loop_exit(cs); | |
467 | } | |
468 | ||
469 | /* Raise an exception with the specified syndrome register value */ | |
470 | void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp, | |
73710361 | 471 | uint32_t syndrome, uint32_t target_el) |
d9ba4830 | 472 | { |
c6328599 | 473 | raise_exception(env, excp, syndrome, target_el); |
d9ba4830 PB |
474 | } |
475 | ||
9ef39277 | 476 | uint32_t HELPER(cpsr_read)(CPUARMState *env) |
d9ba4830 | 477 | { |
4051e12c | 478 | return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED); |
d9ba4830 PB |
479 | } |
480 | ||
1ce94f81 | 481 | void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask) |
d9ba4830 | 482 | { |
50866ba5 | 483 | cpsr_write(env, val, mask, CPSRWriteByInstr); |
d9ba4830 | 484 | } |
b0109805 | 485 | |
235ea1f5 PM |
486 | /* Write the CPSR for a 32-bit exception return */ |
487 | void HELPER(cpsr_write_eret)(CPUARMState *env, uint32_t val) | |
488 | { | |
50866ba5 | 489 | cpsr_write(env, val, CPSR_ERET_MASK, CPSRWriteExceptionReturn); |
bd7d00fc | 490 | |
fb0e8e79 PM |
491 | /* Generated code has already stored the new PC value, but |
492 | * without masking out its low bits, because which bits need | |
493 | * masking depends on whether we're returning to Thumb or ARM | |
494 | * state. Do the masking now. | |
495 | */ | |
496 | env->regs[15] &= (env->thumb ? ~1 : ~3); | |
497 | ||
8d04fb55 | 498 | qemu_mutex_lock_iothread(); |
bd7d00fc | 499 | arm_call_el_change_hook(arm_env_get_cpu(env)); |
8d04fb55 | 500 | qemu_mutex_unlock_iothread(); |
235ea1f5 PM |
501 | } |
502 | ||
b0109805 | 503 | /* Access to user mode registers from privileged modes. */ |
9ef39277 | 504 | uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno) |
b0109805 PB |
505 | { |
506 | uint32_t val; | |
507 | ||
508 | if (regno == 13) { | |
99a99c1f | 509 | val = env->banked_r13[BANK_USRSYS]; |
b0109805 | 510 | } else if (regno == 14) { |
99a99c1f | 511 | val = env->banked_r14[BANK_USRSYS]; |
b0109805 PB |
512 | } else if (regno >= 8 |
513 | && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) { | |
514 | val = env->usr_regs[regno - 8]; | |
515 | } else { | |
516 | val = env->regs[regno]; | |
517 | } | |
518 | return val; | |
519 | } | |
520 | ||
1ce94f81 | 521 | void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val) |
b0109805 PB |
522 | { |
523 | if (regno == 13) { | |
99a99c1f | 524 | env->banked_r13[BANK_USRSYS] = val; |
b0109805 | 525 | } else if (regno == 14) { |
99a99c1f | 526 | env->banked_r14[BANK_USRSYS] = val; |
b0109805 PB |
527 | } else if (regno >= 8 |
528 | && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) { | |
529 | env->usr_regs[regno - 8] = val; | |
530 | } else { | |
531 | env->regs[regno] = val; | |
532 | } | |
533 | } | |
4b6a83fb | 534 | |
72309cee PM |
535 | void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val) |
536 | { | |
537 | if ((env->uncached_cpsr & CPSR_M) == mode) { | |
538 | env->regs[13] = val; | |
539 | } else { | |
540 | env->banked_r13[bank_number(mode)] = val; | |
541 | } | |
542 | } | |
543 | ||
544 | uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode) | |
545 | { | |
f01377f5 PM |
546 | if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_SYS) { |
547 | /* SRS instruction is UNPREDICTABLE from System mode; we UNDEF. | |
548 | * Other UNPREDICTABLE and UNDEF cases were caught at translate time. | |
549 | */ | |
550 | raise_exception(env, EXCP_UDEF, syn_uncategorized(), | |
551 | exception_target_el(env)); | |
552 | } | |
553 | ||
72309cee PM |
554 | if ((env->uncached_cpsr & CPSR_M) == mode) { |
555 | return env->regs[13]; | |
556 | } else { | |
557 | return env->banked_r13[bank_number(mode)]; | |
558 | } | |
559 | } | |
72309cee | 560 | |
8bfd0550 PM |
561 | static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode, |
562 | uint32_t regno) | |
563 | { | |
564 | /* Raise an exception if the requested access is one of the UNPREDICTABLE | |
565 | * cases; otherwise return. This broadly corresponds to the pseudocode | |
566 | * BankedRegisterAccessValid() and SPSRAccessValid(), | |
567 | * except that we have already handled some cases at translate time. | |
568 | */ | |
569 | int curmode = env->uncached_cpsr & CPSR_M; | |
570 | ||
571 | if (curmode == tgtmode) { | |
572 | goto undef; | |
573 | } | |
574 | ||
575 | if (tgtmode == ARM_CPU_MODE_USR) { | |
576 | switch (regno) { | |
577 | case 8 ... 12: | |
578 | if (curmode != ARM_CPU_MODE_FIQ) { | |
579 | goto undef; | |
580 | } | |
581 | break; | |
582 | case 13: | |
583 | if (curmode == ARM_CPU_MODE_SYS) { | |
584 | goto undef; | |
585 | } | |
586 | break; | |
587 | case 14: | |
588 | if (curmode == ARM_CPU_MODE_HYP || curmode == ARM_CPU_MODE_SYS) { | |
589 | goto undef; | |
590 | } | |
591 | break; | |
592 | default: | |
593 | break; | |
594 | } | |
595 | } | |
596 | ||
597 | if (tgtmode == ARM_CPU_MODE_HYP) { | |
598 | switch (regno) { | |
599 | case 17: /* ELR_Hyp */ | |
600 | if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) { | |
601 | goto undef; | |
602 | } | |
603 | break; | |
604 | default: | |
605 | if (curmode != ARM_CPU_MODE_MON) { | |
606 | goto undef; | |
607 | } | |
608 | break; | |
609 | } | |
610 | } | |
611 | ||
612 | return; | |
613 | ||
614 | undef: | |
615 | raise_exception(env, EXCP_UDEF, syn_uncategorized(), | |
616 | exception_target_el(env)); | |
617 | } | |
618 | ||
619 | void HELPER(msr_banked)(CPUARMState *env, uint32_t value, uint32_t tgtmode, | |
620 | uint32_t regno) | |
621 | { | |
622 | msr_mrs_banked_exc_checks(env, tgtmode, regno); | |
623 | ||
624 | switch (regno) { | |
625 | case 16: /* SPSRs */ | |
626 | env->banked_spsr[bank_number(tgtmode)] = value; | |
627 | break; | |
628 | case 17: /* ELR_Hyp */ | |
629 | env->elr_el[2] = value; | |
630 | break; | |
631 | case 13: | |
632 | env->banked_r13[bank_number(tgtmode)] = value; | |
633 | break; | |
634 | case 14: | |
635 | env->banked_r14[bank_number(tgtmode)] = value; | |
636 | break; | |
637 | case 8 ... 12: | |
638 | switch (tgtmode) { | |
639 | case ARM_CPU_MODE_USR: | |
640 | env->usr_regs[regno - 8] = value; | |
641 | break; | |
642 | case ARM_CPU_MODE_FIQ: | |
643 | env->fiq_regs[regno - 8] = value; | |
644 | break; | |
645 | default: | |
646 | g_assert_not_reached(); | |
647 | } | |
648 | break; | |
649 | default: | |
650 | g_assert_not_reached(); | |
651 | } | |
652 | } | |
653 | ||
654 | uint32_t HELPER(mrs_banked)(CPUARMState *env, uint32_t tgtmode, uint32_t regno) | |
655 | { | |
656 | msr_mrs_banked_exc_checks(env, tgtmode, regno); | |
657 | ||
658 | switch (regno) { | |
659 | case 16: /* SPSRs */ | |
660 | return env->banked_spsr[bank_number(tgtmode)]; | |
661 | case 17: /* ELR_Hyp */ | |
662 | return env->elr_el[2]; | |
663 | case 13: | |
664 | return env->banked_r13[bank_number(tgtmode)]; | |
665 | case 14: | |
666 | return env->banked_r14[bank_number(tgtmode)]; | |
667 | case 8 ... 12: | |
668 | switch (tgtmode) { | |
669 | case ARM_CPU_MODE_USR: | |
670 | return env->usr_regs[regno - 8]; | |
671 | case ARM_CPU_MODE_FIQ: | |
672 | return env->fiq_regs[regno - 8]; | |
673 | default: | |
674 | g_assert_not_reached(); | |
675 | } | |
676 | default: | |
677 | g_assert_not_reached(); | |
678 | } | |
679 | } | |
680 | ||
3f208fd7 PM |
681 | void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome, |
682 | uint32_t isread) | |
f59df3f2 PM |
683 | { |
684 | const ARMCPRegInfo *ri = rip; | |
38836a2c | 685 | int target_el; |
c0f4af17 PM |
686 | |
687 | if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14 | |
688 | && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) { | |
c6328599 | 689 | raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env)); |
c0f4af17 PM |
690 | } |
691 | ||
692 | if (!ri->accessfn) { | |
693 | return; | |
694 | } | |
695 | ||
3f208fd7 | 696 | switch (ri->accessfn(env, ri, isread)) { |
f59df3f2 PM |
697 | case CP_ACCESS_OK: |
698 | return; | |
699 | case CP_ACCESS_TRAP: | |
38836a2c PM |
700 | target_el = exception_target_el(env); |
701 | break; | |
702 | case CP_ACCESS_TRAP_EL2: | |
703 | /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is | |
704 | * a bug in the access function. | |
705 | */ | |
3fc827d5 | 706 | assert(!arm_is_secure(env) && arm_current_el(env) != 3); |
38836a2c PM |
707 | target_el = 2; |
708 | break; | |
709 | case CP_ACCESS_TRAP_EL3: | |
710 | target_el = 3; | |
8bcbf37c | 711 | break; |
f59df3f2 | 712 | case CP_ACCESS_TRAP_UNCATEGORIZED: |
38836a2c | 713 | target_el = exception_target_el(env); |
c6328599 | 714 | syndrome = syn_uncategorized(); |
f59df3f2 | 715 | break; |
e7615726 PM |
716 | case CP_ACCESS_TRAP_UNCATEGORIZED_EL2: |
717 | target_el = 2; | |
718 | syndrome = syn_uncategorized(); | |
719 | break; | |
720 | case CP_ACCESS_TRAP_UNCATEGORIZED_EL3: | |
721 | target_el = 3; | |
722 | syndrome = syn_uncategorized(); | |
723 | break; | |
f2cae609 PM |
724 | case CP_ACCESS_TRAP_FP_EL2: |
725 | target_el = 2; | |
726 | /* Since we are an implementation that takes exceptions on a trapped | |
727 | * conditional insn only if the insn has passed its condition code | |
728 | * check, we take the IMPDEF choice to always report CV=1 COND=0xe | |
729 | * (which is also the required value for AArch64 traps). | |
730 | */ | |
731 | syndrome = syn_fp_access_trap(1, 0xe, false); | |
732 | break; | |
733 | case CP_ACCESS_TRAP_FP_EL3: | |
734 | target_el = 3; | |
735 | syndrome = syn_fp_access_trap(1, 0xe, false); | |
736 | break; | |
f59df3f2 PM |
737 | default: |
738 | g_assert_not_reached(); | |
739 | } | |
c6328599 | 740 | |
38836a2c | 741 | raise_exception(env, EXCP_UDEF, syndrome, target_el); |
f59df3f2 PM |
742 | } |
743 | ||
4b6a83fb PM |
744 | void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value) |
745 | { | |
746 | const ARMCPRegInfo *ri = rip; | |
c4241c7d | 747 | |
8d04fb55 JK |
748 | if (ri->type & ARM_CP_IO) { |
749 | qemu_mutex_lock_iothread(); | |
750 | ri->writefn(env, ri, value); | |
751 | qemu_mutex_unlock_iothread(); | |
752 | } else { | |
753 | ri->writefn(env, ri, value); | |
754 | } | |
4b6a83fb PM |
755 | } |
756 | ||
757 | uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip) | |
758 | { | |
759 | const ARMCPRegInfo *ri = rip; | |
8d04fb55 | 760 | uint32_t res; |
c4241c7d | 761 | |
8d04fb55 JK |
762 | if (ri->type & ARM_CP_IO) { |
763 | qemu_mutex_lock_iothread(); | |
764 | res = ri->readfn(env, ri); | |
765 | qemu_mutex_unlock_iothread(); | |
766 | } else { | |
767 | res = ri->readfn(env, ri); | |
768 | } | |
769 | ||
770 | return res; | |
4b6a83fb PM |
771 | } |
772 | ||
773 | void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value) | |
774 | { | |
775 | const ARMCPRegInfo *ri = rip; | |
c4241c7d | 776 | |
8d04fb55 JK |
777 | if (ri->type & ARM_CP_IO) { |
778 | qemu_mutex_lock_iothread(); | |
779 | ri->writefn(env, ri, value); | |
780 | qemu_mutex_unlock_iothread(); | |
781 | } else { | |
782 | ri->writefn(env, ri, value); | |
783 | } | |
4b6a83fb PM |
784 | } |
785 | ||
786 | uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip) | |
787 | { | |
788 | const ARMCPRegInfo *ri = rip; | |
8d04fb55 JK |
789 | uint64_t res; |
790 | ||
791 | if (ri->type & ARM_CP_IO) { | |
792 | qemu_mutex_lock_iothread(); | |
793 | res = ri->readfn(env, ri); | |
794 | qemu_mutex_unlock_iothread(); | |
795 | } else { | |
796 | res = ri->readfn(env, ri); | |
797 | } | |
c4241c7d | 798 | |
8d04fb55 | 799 | return res; |
4b6a83fb | 800 | } |
b0109805 | 801 | |
9cfa0b4e PM |
802 | void HELPER(msr_i_pstate)(CPUARMState *env, uint32_t op, uint32_t imm) |
803 | { | |
804 | /* MSR_i to update PSTATE. This is OK from EL0 only if UMA is set. | |
805 | * Note that SPSel is never OK from EL0; we rely on handle_msr_i() | |
806 | * to catch that case at translate time. | |
807 | */ | |
137feaa9 | 808 | if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) { |
c6328599 PM |
809 | uint32_t syndrome = syn_aa64_sysregtrap(0, extract32(op, 0, 3), |
810 | extract32(op, 3, 3), 4, | |
811 | imm, 0x1f, 0); | |
812 | raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env)); | |
9cfa0b4e PM |
813 | } |
814 | ||
815 | switch (op) { | |
816 | case 0x05: /* SPSel */ | |
f502cfc2 | 817 | update_spsel(env, imm); |
9cfa0b4e PM |
818 | break; |
819 | case 0x1e: /* DAIFSet */ | |
820 | env->daif |= (imm << 6) & PSTATE_DAIF; | |
821 | break; | |
822 | case 0x1f: /* DAIFClear */ | |
823 | env->daif &= ~((imm << 6) & PSTATE_DAIF); | |
824 | break; | |
825 | default: | |
826 | g_assert_not_reached(); | |
827 | } | |
828 | } | |
829 | ||
7ea47fe7 PM |
830 | void HELPER(clear_pstate_ss)(CPUARMState *env) |
831 | { | |
832 | env->pstate &= ~PSTATE_SS; | |
833 | } | |
834 | ||
35979d71 EI |
835 | void HELPER(pre_hvc)(CPUARMState *env) |
836 | { | |
98128601 | 837 | ARMCPU *cpu = arm_env_get_cpu(env); |
dcbff19b | 838 | int cur_el = arm_current_el(env); |
35979d71 EI |
839 | /* FIXME: Use actual secure state. */ |
840 | bool secure = false; | |
841 | bool undef; | |
842 | ||
98128601 RH |
843 | if (arm_is_psci_call(cpu, EXCP_HVC)) { |
844 | /* If PSCI is enabled and this looks like a valid PSCI call then | |
845 | * that overrides the architecturally mandated HVC behaviour. | |
846 | */ | |
847 | return; | |
848 | } | |
849 | ||
39404338 PM |
850 | if (!arm_feature(env, ARM_FEATURE_EL2)) { |
851 | /* If EL2 doesn't exist, HVC always UNDEFs */ | |
852 | undef = true; | |
853 | } else if (arm_feature(env, ARM_FEATURE_EL3)) { | |
854 | /* EL3.HCE has priority over EL2.HCD. */ | |
35979d71 EI |
855 | undef = !(env->cp15.scr_el3 & SCR_HCE); |
856 | } else { | |
857 | undef = env->cp15.hcr_el2 & HCR_HCD; | |
858 | } | |
859 | ||
860 | /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state. | |
861 | * For ARMv8/AArch64, HVC is allowed in EL3. | |
862 | * Note that we've already trapped HVC from EL0 at translation | |
863 | * time. | |
864 | */ | |
865 | if (secure && (!is_a64(env) || cur_el == 1)) { | |
866 | undef = true; | |
867 | } | |
868 | ||
869 | if (undef) { | |
c6328599 PM |
870 | raise_exception(env, EXCP_UDEF, syn_uncategorized(), |
871 | exception_target_el(env)); | |
35979d71 EI |
872 | } |
873 | } | |
874 | ||
e0d6e6a5 EI |
875 | void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome) |
876 | { | |
98128601 | 877 | ARMCPU *cpu = arm_env_get_cpu(env); |
dcbff19b | 878 | int cur_el = arm_current_el(env); |
dbe9d163 | 879 | bool secure = arm_is_secure(env); |
e0d6e6a5 | 880 | bool smd = env->cp15.scr_el3 & SCR_SMD; |
f096e92b PM |
881 | /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state. |
882 | * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization | |
883 | * extensions, SMD only applies to NS state. | |
884 | * On ARMv7 without the Virtualization extensions, the SMD bit | |
885 | * doesn't exist, but we forbid the guest to set it to 1 in scr_write(), | |
886 | * so we need not special case this here. | |
e0d6e6a5 | 887 | */ |
f096e92b | 888 | bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure; |
e0d6e6a5 | 889 | |
98128601 RH |
890 | if (arm_is_psci_call(cpu, EXCP_SMC)) { |
891 | /* If PSCI is enabled and this looks like a valid PSCI call then | |
892 | * that overrides the architecturally mandated SMC behaviour. | |
893 | */ | |
894 | return; | |
895 | } | |
896 | ||
39404338 PM |
897 | if (!arm_feature(env, ARM_FEATURE_EL3)) { |
898 | /* If we have no EL3 then SMC always UNDEFs */ | |
899 | undef = true; | |
900 | } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) { | |
901 | /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */ | |
c6328599 | 902 | raise_exception(env, EXCP_HYP_TRAP, syndrome, 2); |
e0d6e6a5 EI |
903 | } |
904 | ||
e0d6e6a5 | 905 | if (undef) { |
c6328599 PM |
906 | raise_exception(env, EXCP_UDEF, syn_uncategorized(), |
907 | exception_target_el(env)); | |
e0d6e6a5 EI |
908 | } |
909 | } | |
910 | ||
3809951b PM |
911 | static int el_from_spsr(uint32_t spsr) |
912 | { | |
913 | /* Return the exception level that this SPSR is requesting a return to, | |
914 | * or -1 if it is invalid (an illegal return) | |
915 | */ | |
916 | if (spsr & PSTATE_nRW) { | |
917 | switch (spsr & CPSR_M) { | |
918 | case ARM_CPU_MODE_USR: | |
919 | return 0; | |
920 | case ARM_CPU_MODE_HYP: | |
921 | return 2; | |
922 | case ARM_CPU_MODE_FIQ: | |
923 | case ARM_CPU_MODE_IRQ: | |
924 | case ARM_CPU_MODE_SVC: | |
925 | case ARM_CPU_MODE_ABT: | |
926 | case ARM_CPU_MODE_UND: | |
927 | case ARM_CPU_MODE_SYS: | |
928 | return 1; | |
929 | case ARM_CPU_MODE_MON: | |
930 | /* Returning to Mon from AArch64 is never possible, | |
931 | * so this is an illegal return. | |
932 | */ | |
933 | default: | |
934 | return -1; | |
935 | } | |
936 | } else { | |
937 | if (extract32(spsr, 1, 1)) { | |
938 | /* Return with reserved M[1] bit set */ | |
939 | return -1; | |
940 | } | |
941 | if (extract32(spsr, 0, 4) == 1) { | |
942 | /* return to EL0 with M[0] bit set */ | |
943 | return -1; | |
944 | } | |
945 | return extract32(spsr, 2, 2); | |
946 | } | |
947 | } | |
948 | ||
52e60cdd RH |
949 | void HELPER(exception_return)(CPUARMState *env) |
950 | { | |
dcbff19b | 951 | int cur_el = arm_current_el(env); |
db6c3cd0 | 952 | unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el); |
2a923c4d | 953 | uint32_t spsr = env->banked_spsr[spsr_idx]; |
ce02049d | 954 | int new_el; |
3809951b | 955 | bool return_to_aa64 = (spsr & PSTATE_nRW) == 0; |
52e60cdd | 956 | |
9208b961 | 957 | aarch64_save_sp(env, cur_el); |
52e60cdd RH |
958 | |
959 | env->exclusive_addr = -1; | |
960 | ||
3a298203 PM |
961 | /* We must squash the PSTATE.SS bit to zero unless both of the |
962 | * following hold: | |
963 | * 1. debug exceptions are currently disabled | |
964 | * 2. singlestep will be active in the EL we return to | |
965 | * We check 1 here and 2 after we've done the pstate/cpsr write() to | |
966 | * transition to the EL we're going to. | |
967 | */ | |
968 | if (arm_generate_debug_exceptions(env)) { | |
969 | spsr &= ~PSTATE_SS; | |
970 | } | |
971 | ||
3809951b PM |
972 | new_el = el_from_spsr(spsr); |
973 | if (new_el == -1) { | |
974 | goto illegal_return; | |
975 | } | |
976 | if (new_el > cur_el | |
977 | || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) { | |
978 | /* Disallow return to an EL which is unimplemented or higher | |
979 | * than the current one. | |
980 | */ | |
981 | goto illegal_return; | |
982 | } | |
983 | ||
984 | if (new_el != 0 && arm_el_is_aa64(env, new_el) != return_to_aa64) { | |
985 | /* Return to an EL which is configured for a different register width */ | |
986 | goto illegal_return; | |
987 | } | |
988 | ||
e393f339 PM |
989 | if (new_el == 2 && arm_is_secure_below_el3(env)) { |
990 | /* Return to the non-existent secure-EL2 */ | |
991 | goto illegal_return; | |
992 | } | |
993 | ||
994 | if (new_el == 1 && (env->cp15.hcr_el2 & HCR_TGE) | |
995 | && !arm_is_secure_below_el3(env)) { | |
996 | goto illegal_return; | |
997 | } | |
998 | ||
3809951b | 999 | if (!return_to_aa64) { |
52e60cdd | 1000 | env->aarch64 = 0; |
f8c88bbc PM |
1001 | /* We do a raw CPSR write because aarch64_sync_64_to_32() |
1002 | * will sort the register banks out for us, and we've already | |
1003 | * caught all the bad-mode cases in el_from_spsr(). | |
1004 | */ | |
50866ba5 | 1005 | cpsr_write(env, spsr, ~0, CPSRWriteRaw); |
3a298203 PM |
1006 | if (!arm_singlestep_active(env)) { |
1007 | env->uncached_cpsr &= ~PSTATE_SS; | |
1008 | } | |
ce02049d | 1009 | aarch64_sync_64_to_32(env); |
52e60cdd | 1010 | |
c1e03714 PM |
1011 | if (spsr & CPSR_T) { |
1012 | env->regs[15] = env->elr_el[cur_el] & ~0x1; | |
1013 | } else { | |
1014 | env->regs[15] = env->elr_el[cur_el] & ~0x3; | |
1015 | } | |
c9b61d9a PM |
1016 | qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to " |
1017 | "AArch32 EL%d PC 0x%" PRIx32 "\n", | |
1018 | cur_el, new_el, env->regs[15]); | |
52e60cdd | 1019 | } else { |
52e60cdd RH |
1020 | env->aarch64 = 1; |
1021 | pstate_write(env, spsr); | |
3a298203 PM |
1022 | if (!arm_singlestep_active(env)) { |
1023 | env->pstate &= ~PSTATE_SS; | |
1024 | } | |
98ea5615 | 1025 | aarch64_restore_sp(env, new_el); |
db6c3cd0 | 1026 | env->pc = env->elr_el[cur_el]; |
c9b61d9a PM |
1027 | qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to " |
1028 | "AArch64 EL%d PC 0x%" PRIx64 "\n", | |
1029 | cur_el, new_el, env->pc); | |
52e60cdd RH |
1030 | } |
1031 | ||
8d04fb55 | 1032 | qemu_mutex_lock_iothread(); |
bd7d00fc | 1033 | arm_call_el_change_hook(arm_env_get_cpu(env)); |
8d04fb55 | 1034 | qemu_mutex_unlock_iothread(); |
bd7d00fc | 1035 | |
52e60cdd RH |
1036 | return; |
1037 | ||
1038 | illegal_return: | |
1039 | /* Illegal return events of various kinds have architecturally | |
1040 | * mandated behaviour: | |
1041 | * restore NZCV and DAIF from SPSR_ELx | |
1042 | * set PSTATE.IL | |
1043 | * restore PC from ELR_ELx | |
1044 | * no change to exception level, execution state or stack pointer | |
1045 | */ | |
1046 | env->pstate |= PSTATE_IL; | |
db6c3cd0 | 1047 | env->pc = env->elr_el[cur_el]; |
52e60cdd RH |
1048 | spsr &= PSTATE_NZCV | PSTATE_DAIF; |
1049 | spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF); | |
1050 | pstate_write(env, spsr); | |
3a298203 PM |
1051 | if (!arm_singlestep_active(env)) { |
1052 | env->pstate &= ~PSTATE_SS; | |
1053 | } | |
c9b61d9a PM |
1054 | qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: " |
1055 | "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc); | |
52e60cdd RH |
1056 | } |
1057 | ||
3ff6fc91 PM |
1058 | /* Return true if the linked breakpoint entry lbn passes its checks */ |
1059 | static bool linked_bp_matches(ARMCPU *cpu, int lbn) | |
1060 | { | |
1061 | CPUARMState *env = &cpu->env; | |
1062 | uint64_t bcr = env->cp15.dbgbcr[lbn]; | |
1063 | int brps = extract32(cpu->dbgdidr, 24, 4); | |
1064 | int ctx_cmps = extract32(cpu->dbgdidr, 20, 4); | |
1065 | int bt; | |
1066 | uint32_t contextidr; | |
1067 | ||
1068 | /* Links to unimplemented or non-context aware breakpoints are | |
1069 | * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or | |
1070 | * as if linked to an UNKNOWN context-aware breakpoint (in which | |
1071 | * case DBGWCR<n>_EL1.LBN must indicate that breakpoint). | |
1072 | * We choose the former. | |
1073 | */ | |
1074 | if (lbn > brps || lbn < (brps - ctx_cmps)) { | |
1075 | return false; | |
1076 | } | |
1077 | ||
1078 | bcr = env->cp15.dbgbcr[lbn]; | |
1079 | ||
1080 | if (extract64(bcr, 0, 1) == 0) { | |
1081 | /* Linked breakpoint disabled : generate no events */ | |
1082 | return false; | |
1083 | } | |
1084 | ||
1085 | bt = extract64(bcr, 20, 4); | |
1086 | ||
1087 | /* We match the whole register even if this is AArch32 using the | |
1088 | * short descriptor format (in which case it holds both PROCID and ASID), | |
1089 | * since we don't implement the optional v7 context ID masking. | |
1090 | */ | |
54bf36ed | 1091 | contextidr = extract64(env->cp15.contextidr_el[1], 0, 32); |
3ff6fc91 PM |
1092 | |
1093 | switch (bt) { | |
1094 | case 3: /* linked context ID match */ | |
dcbff19b | 1095 | if (arm_current_el(env) > 1) { |
3ff6fc91 PM |
1096 | /* Context matches never fire in EL2 or (AArch64) EL3 */ |
1097 | return false; | |
1098 | } | |
1099 | return (contextidr == extract64(env->cp15.dbgbvr[lbn], 0, 32)); | |
1100 | case 5: /* linked address mismatch (reserved in AArch64) */ | |
1101 | case 9: /* linked VMID match (reserved if no EL2) */ | |
1102 | case 11: /* linked context ID and VMID match (reserved if no EL2) */ | |
1103 | default: | |
1104 | /* Links to Unlinked context breakpoints must generate no | |
1105 | * events; we choose to do the same for reserved values too. | |
1106 | */ | |
1107 | return false; | |
1108 | } | |
1109 | ||
1110 | return false; | |
1111 | } | |
1112 | ||
0eacea70 | 1113 | static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp) |
3ff6fc91 PM |
1114 | { |
1115 | CPUARMState *env = &cpu->env; | |
0eacea70 | 1116 | uint64_t cr; |
3ff6fc91 | 1117 | int pac, hmc, ssc, wt, lbn; |
ef7bab8d PM |
1118 | /* Note that for watchpoints the check is against the CPU security |
1119 | * state, not the S/NS attribute on the offending data access. | |
1120 | */ | |
1121 | bool is_secure = arm_is_secure(env); | |
9e1fc5bd | 1122 | int access_el = arm_current_el(env); |
3ff6fc91 | 1123 | |
0eacea70 | 1124 | if (is_wp) { |
9e1fc5bd PM |
1125 | CPUWatchpoint *wp = env->cpu_watchpoint[n]; |
1126 | ||
1127 | if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) { | |
0eacea70 PM |
1128 | return false; |
1129 | } | |
1130 | cr = env->cp15.dbgwcr[n]; | |
9e1fc5bd PM |
1131 | if (wp->hitattrs.user) { |
1132 | /* The LDRT/STRT/LDT/STT "unprivileged access" instructions should | |
1133 | * match watchpoints as if they were accesses done at EL0, even if | |
1134 | * the CPU is at EL1 or higher. | |
1135 | */ | |
1136 | access_el = 0; | |
1137 | } | |
0eacea70 PM |
1138 | } else { |
1139 | uint64_t pc = is_a64(env) ? env->pc : env->regs[15]; | |
3ff6fc91 | 1140 | |
0eacea70 PM |
1141 | if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) { |
1142 | return false; | |
1143 | } | |
1144 | cr = env->cp15.dbgbcr[n]; | |
1145 | } | |
3ff6fc91 | 1146 | /* The WATCHPOINT_HIT flag guarantees us that the watchpoint is |
0eacea70 PM |
1147 | * enabled and that the address and access type match; for breakpoints |
1148 | * we know the address matched; check the remaining fields, including | |
1149 | * linked breakpoints. We rely on WCR and BCR having the same layout | |
1150 | * for the LBN, SSC, HMC, PAC/PMC and is-linked fields. | |
1151 | * Note that some combinations of {PAC, HMC, SSC} are reserved and | |
3ff6fc91 PM |
1152 | * must act either like some valid combination or as if the watchpoint |
1153 | * were disabled. We choose the former, and use this together with | |
1154 | * the fact that EL3 must always be Secure and EL2 must always be | |
1155 | * Non-Secure to simplify the code slightly compared to the full | |
1156 | * table in the ARM ARM. | |
1157 | */ | |
0eacea70 PM |
1158 | pac = extract64(cr, 1, 2); |
1159 | hmc = extract64(cr, 13, 1); | |
1160 | ssc = extract64(cr, 14, 2); | |
3ff6fc91 PM |
1161 | |
1162 | switch (ssc) { | |
1163 | case 0: | |
1164 | break; | |
1165 | case 1: | |
1166 | case 3: | |
1167 | if (is_secure) { | |
1168 | return false; | |
1169 | } | |
1170 | break; | |
1171 | case 2: | |
1172 | if (!is_secure) { | |
1173 | return false; | |
1174 | } | |
1175 | break; | |
1176 | } | |
1177 | ||
9e1fc5bd | 1178 | switch (access_el) { |
3ff6fc91 PM |
1179 | case 3: |
1180 | case 2: | |
1181 | if (!hmc) { | |
1182 | return false; | |
1183 | } | |
1184 | break; | |
1185 | case 1: | |
1186 | if (extract32(pac, 0, 1) == 0) { | |
1187 | return false; | |
1188 | } | |
1189 | break; | |
1190 | case 0: | |
1191 | if (extract32(pac, 1, 1) == 0) { | |
1192 | return false; | |
1193 | } | |
1194 | break; | |
1195 | default: | |
1196 | g_assert_not_reached(); | |
1197 | } | |
1198 | ||
0eacea70 PM |
1199 | wt = extract64(cr, 20, 1); |
1200 | lbn = extract64(cr, 16, 4); | |
3ff6fc91 PM |
1201 | |
1202 | if (wt && !linked_bp_matches(cpu, lbn)) { | |
1203 | return false; | |
1204 | } | |
1205 | ||
1206 | return true; | |
1207 | } | |
1208 | ||
1209 | static bool check_watchpoints(ARMCPU *cpu) | |
1210 | { | |
1211 | CPUARMState *env = &cpu->env; | |
1212 | int n; | |
1213 | ||
1214 | /* If watchpoints are disabled globally or we can't take debug | |
1215 | * exceptions here then watchpoint firings are ignored. | |
1216 | */ | |
1217 | if (extract32(env->cp15.mdscr_el1, 15, 1) == 0 | |
1218 | || !arm_generate_debug_exceptions(env)) { | |
1219 | return false; | |
1220 | } | |
1221 | ||
1222 | for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) { | |
0eacea70 PM |
1223 | if (bp_wp_matches(cpu, n, true)) { |
1224 | return true; | |
1225 | } | |
1226 | } | |
1227 | return false; | |
1228 | } | |
1229 | ||
1230 | static bool check_breakpoints(ARMCPU *cpu) | |
1231 | { | |
1232 | CPUARMState *env = &cpu->env; | |
1233 | int n; | |
1234 | ||
1235 | /* If breakpoints are disabled globally or we can't take debug | |
1236 | * exceptions here then breakpoint firings are ignored. | |
1237 | */ | |
1238 | if (extract32(env->cp15.mdscr_el1, 15, 1) == 0 | |
1239 | || !arm_generate_debug_exceptions(env)) { | |
1240 | return false; | |
1241 | } | |
1242 | ||
1243 | for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) { | |
1244 | if (bp_wp_matches(cpu, n, false)) { | |
3ff6fc91 PM |
1245 | return true; |
1246 | } | |
1247 | } | |
1248 | return false; | |
1249 | } | |
1250 | ||
5d98bf8f SF |
1251 | void HELPER(check_breakpoints)(CPUARMState *env) |
1252 | { | |
1253 | ARMCPU *cpu = arm_env_get_cpu(env); | |
1254 | ||
1255 | if (check_breakpoints(cpu)) { | |
1256 | HELPER(exception_internal(env, EXCP_DEBUG)); | |
1257 | } | |
1258 | } | |
1259 | ||
3826121d SF |
1260 | bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp) |
1261 | { | |
1262 | /* Called by core code when a CPU watchpoint fires; need to check if this | |
1263 | * is also an architectural watchpoint match. | |
1264 | */ | |
1265 | ARMCPU *cpu = ARM_CPU(cs); | |
1266 | ||
1267 | return check_watchpoints(cpu); | |
1268 | } | |
1269 | ||
40612000 JB |
1270 | vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len) |
1271 | { | |
1272 | ARMCPU *cpu = ARM_CPU(cs); | |
1273 | CPUARMState *env = &cpu->env; | |
1274 | ||
1275 | /* In BE32 system mode, target memory is stored byteswapped (on a | |
1276 | * little-endian host system), and by the time we reach here (via an | |
1277 | * opcode helper) the addresses of subword accesses have been adjusted | |
1278 | * to account for that, which means that watchpoints will not match. | |
1279 | * Undo the adjustment here. | |
1280 | */ | |
1281 | if (arm_sctlr_b(env)) { | |
1282 | if (len == 1) { | |
1283 | addr ^= 3; | |
1284 | } else if (len == 2) { | |
1285 | addr ^= 2; | |
1286 | } | |
1287 | } | |
1288 | ||
1289 | return addr; | |
1290 | } | |
1291 | ||
3ff6fc91 PM |
1292 | void arm_debug_excp_handler(CPUState *cs) |
1293 | { | |
1294 | /* Called by core code when a watchpoint or breakpoint fires; | |
1295 | * need to check which one and raise the appropriate exception. | |
1296 | */ | |
1297 | ARMCPU *cpu = ARM_CPU(cs); | |
1298 | CPUARMState *env = &cpu->env; | |
1299 | CPUWatchpoint *wp_hit = cs->watchpoint_hit; | |
1300 | ||
1301 | if (wp_hit) { | |
1302 | if (wp_hit->flags & BP_CPU) { | |
3826121d SF |
1303 | bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0; |
1304 | bool same_el = arm_debug_target_el(env) == arm_current_el(env); | |
1305 | ||
3ff6fc91 | 1306 | cs->watchpoint_hit = NULL; |
3826121d SF |
1307 | |
1308 | if (extended_addresses_enabled(env)) { | |
1309 | env->exception.fsr = (1 << 9) | 0x22; | |
3ff6fc91 | 1310 | } else { |
3826121d | 1311 | env->exception.fsr = 0x2; |
3ff6fc91 | 1312 | } |
3826121d SF |
1313 | env->exception.vaddress = wp_hit->hitaddr; |
1314 | raise_exception(env, EXCP_DATA_ABORT, | |
1315 | syn_watchpoint(same_el, 0, wnr), | |
1316 | arm_debug_target_el(env)); | |
3ff6fc91 | 1317 | } |
0eacea70 | 1318 | } else { |
e63a2d4d | 1319 | uint64_t pc = is_a64(env) ? env->pc : env->regs[15]; |
5d98bf8f | 1320 | bool same_el = (arm_debug_target_el(env) == arm_current_el(env)); |
e63a2d4d | 1321 | |
5c629f4f SF |
1322 | /* (1) GDB breakpoints should be handled first. |
1323 | * (2) Do not raise a CPU exception if no CPU breakpoint has fired, | |
1324 | * since singlestep is also done by generating a debug internal | |
1325 | * exception. | |
1326 | */ | |
1327 | if (cpu_breakpoint_test(cs, pc, BP_GDB) | |
1328 | || !cpu_breakpoint_test(cs, pc, BP_CPU)) { | |
e63a2d4d SF |
1329 | return; |
1330 | } | |
1331 | ||
5d98bf8f SF |
1332 | if (extended_addresses_enabled(env)) { |
1333 | env->exception.fsr = (1 << 9) | 0x22; | |
1334 | } else { | |
1335 | env->exception.fsr = 0x2; | |
0eacea70 | 1336 | } |
5d98bf8f SF |
1337 | /* FAR is UNKNOWN, so doesn't need setting */ |
1338 | raise_exception(env, EXCP_PREFETCH_ABORT, | |
1339 | syn_breakpoint(same_el), | |
1340 | arm_debug_target_el(env)); | |
3ff6fc91 PM |
1341 | } |
1342 | } | |
1343 | ||
8984bd2e PB |
1344 | /* ??? Flag setting arithmetic is awkward because we need to do comparisons. |
1345 | The only way to do that in TCG is a conditional branch, which clobbers | |
1346 | all our temporaries. For now implement these as helper functions. */ | |
1347 | ||
8984bd2e PB |
1348 | /* Similarly for variable shift instructions. */ |
1349 | ||
9ef39277 | 1350 | uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i) |
8984bd2e PB |
1351 | { |
1352 | int shift = i & 0xff; | |
1353 | if (shift >= 32) { | |
1354 | if (shift == 32) | |
1355 | env->CF = x & 1; | |
1356 | else | |
1357 | env->CF = 0; | |
1358 | return 0; | |
1359 | } else if (shift != 0) { | |
1360 | env->CF = (x >> (32 - shift)) & 1; | |
1361 | return x << shift; | |
1362 | } | |
1363 | return x; | |
1364 | } | |
1365 | ||
9ef39277 | 1366 | uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i) |
8984bd2e PB |
1367 | { |
1368 | int shift = i & 0xff; | |
1369 | if (shift >= 32) { | |
1370 | if (shift == 32) | |
1371 | env->CF = (x >> 31) & 1; | |
1372 | else | |
1373 | env->CF = 0; | |
1374 | return 0; | |
1375 | } else if (shift != 0) { | |
1376 | env->CF = (x >> (shift - 1)) & 1; | |
1377 | return x >> shift; | |
1378 | } | |
1379 | return x; | |
1380 | } | |
1381 | ||
9ef39277 | 1382 | uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i) |
8984bd2e PB |
1383 | { |
1384 | int shift = i & 0xff; | |
1385 | if (shift >= 32) { | |
1386 | env->CF = (x >> 31) & 1; | |
1387 | return (int32_t)x >> 31; | |
1388 | } else if (shift != 0) { | |
1389 | env->CF = (x >> (shift - 1)) & 1; | |
1390 | return (int32_t)x >> shift; | |
1391 | } | |
1392 | return x; | |
1393 | } | |
1394 | ||
9ef39277 | 1395 | uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i) |
8984bd2e PB |
1396 | { |
1397 | int shift1, shift; | |
1398 | shift1 = i & 0xff; | |
1399 | shift = shift1 & 0x1f; | |
1400 | if (shift == 0) { | |
1401 | if (shift1 != 0) | |
1402 | env->CF = (x >> 31) & 1; | |
1403 | return x; | |
1404 | } else { | |
1405 | env->CF = (x >> (shift - 1)) & 1; | |
1406 | return ((uint32_t)x >> shift) | (x << (32 - shift)); | |
1407 | } | |
1408 | } |