]> git.proxmox.com Git - mirror_qemu.git/blame - target/arm/op_helper.c
Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging
[mirror_qemu.git] / target / arm / op_helper.c
CommitLineData
b7bcbe95
FB
1/*
2 * ARM helper routines
5fafdf24 3 *
9ee6e8bb 4 * Copyright (c) 2005-2007 CodeSourcery, LLC
b7bcbe95
FB
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
8167ee88 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
b7bcbe95 18 */
74c21bd0 19#include "qemu/osdep.h"
6cdca173 20#include "qemu/units.h"
c9b61d9a 21#include "qemu/log.h"
8d04fb55 22#include "qemu/main-loop.h"
3e457172 23#include "cpu.h"
2ef6175a 24#include "exec/helper-proto.h"
ccd38087 25#include "internals.h"
63c91552 26#include "exec/exec-all.h"
f08b6170 27#include "exec/cpu_ldst.h"
b7bcbe95 28
ad69471c
PB
29#define SIGNBIT (uint32_t)0x80000000
30#define SIGNBIT64 ((uint64_t)1 << 63)
31
7469f6c6
RH
32static CPUState *do_raise_exception(CPUARMState *env, uint32_t excp,
33 uint32_t syndrome, uint32_t target_el)
b7bcbe95 34{
2fc0cc0e 35 CPUState *cs = env_cpu(env);
27103424 36
7c208e0f 37 if (target_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
7556edfb
PM
38 /*
39 * Redirect NS EL1 exceptions to NS EL2. These are reported with
40 * their original syndrome register value, with the exception of
41 * SIMD/FP access traps, which are reported as uncategorized
42 * (see DDI0478C.a D1.10.4)
43 */
44 target_el = 2;
64b91e3f 45 if (syn_get_ec(syndrome) == EC_ADVSIMDFPACCESSTRAP) {
7556edfb
PM
46 syndrome = syn_uncategorized();
47 }
48 }
49
c6328599
PM
50 assert(!excp_is_internal(excp));
51 cs->exception_index = excp;
52 env->exception.syndrome = syndrome;
53 env->exception.target_el = target_el;
7469f6c6
RH
54
55 return cs;
56}
57
58void raise_exception(CPUARMState *env, uint32_t excp,
59 uint32_t syndrome, uint32_t target_el)
60{
61 CPUState *cs = do_raise_exception(env, excp, syndrome, target_el);
5638d180 62 cpu_loop_exit(cs);
b7bcbe95
FB
63}
64
7469f6c6
RH
65void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
66 uint32_t target_el, uintptr_t ra)
67{
68 CPUState *cs = do_raise_exception(env, excp, syndrome, target_el);
69 cpu_loop_exit_restore(cs, ra);
70}
71
e7c06c4e
RH
72uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
73 uint32_t maxindex)
9ee6e8bb 74{
e7c06c4e
RH
75 uint32_t val, shift;
76 uint64_t *table = vn;
77
9ee6e8bb 78 val = 0;
9ee6e8bb 79 for (shift = 0; shift < 32; shift += 8) {
e7c06c4e 80 uint32_t index = (ireg >> shift) & 0xff;
8f8e3aa4 81 if (index < maxindex) {
e7c06c4e 82 uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
9ee6e8bb
PB
83 val |= tmp << shift;
84 } else {
8f8e3aa4 85 val |= def & (0xff << shift);
9ee6e8bb
PB
86 }
87 }
8f8e3aa4 88 return val;
9ee6e8bb
PB
89}
90
55203189
PM
91void HELPER(v8m_stackcheck)(CPUARMState *env, uint32_t newvalue)
92{
93 /*
94 * Perform the v8M stack limit check for SP updates from translated code,
95 * raising an exception if the limit is breached.
96 */
97 if (newvalue < v7m_sp_limit(env)) {
2fc0cc0e 98 CPUState *cs = env_cpu(env);
55203189
PM
99
100 /*
101 * Stack limit exceptions are a rare case, so rather than syncing
102 * PC/condbits before the call, we use cpu_restore_state() to
103 * get them right before raising the exception.
104 */
105 cpu_restore_state(cs, GETPC(), true);
106 raise_exception(env, EXCP_STKOF, 0, 1);
107 }
108}
109
9ef39277 110uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
1497c961
PB
111{
112 uint32_t res = a + b;
113 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
114 env->QF = 1;
115 return res;
116}
117
9ef39277 118uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
1497c961
PB
119{
120 uint32_t res = a + b;
121 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
122 env->QF = 1;
123 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
124 }
125 return res;
126}
127
9ef39277 128uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
1497c961
PB
129{
130 uint32_t res = a - b;
131 if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
132 env->QF = 1;
133 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
134 }
135 return res;
136}
137
9ef39277 138uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
1497c961
PB
139{
140 uint32_t res;
141 if (val >= 0x40000000) {
142 res = ~SIGNBIT;
143 env->QF = 1;
144 } else if (val <= (int32_t)0xc0000000) {
145 res = SIGNBIT;
146 env->QF = 1;
147 } else {
148 res = val << 1;
149 }
150 return res;
151}
152
9ef39277 153uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
1497c961
PB
154{
155 uint32_t res = a + b;
156 if (res < a) {
157 env->QF = 1;
158 res = ~0;
159 }
160 return res;
161}
162
9ef39277 163uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
1497c961
PB
164{
165 uint32_t res = a - b;
166 if (res > a) {
167 env->QF = 1;
168 res = 0;
169 }
170 return res;
171}
172
6ddbc6e4 173/* Signed saturation. */
9ef39277 174static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
6ddbc6e4
PB
175{
176 int32_t top;
177 uint32_t mask;
178
6ddbc6e4
PB
179 top = val >> shift;
180 mask = (1u << shift) - 1;
181 if (top > 0) {
182 env->QF = 1;
183 return mask;
184 } else if (top < -1) {
185 env->QF = 1;
186 return ~mask;
187 }
188 return val;
189}
190
191/* Unsigned saturation. */
9ef39277 192static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
6ddbc6e4
PB
193{
194 uint32_t max;
195
6ddbc6e4
PB
196 max = (1u << shift) - 1;
197 if (val < 0) {
198 env->QF = 1;
199 return 0;
200 } else if (val > max) {
201 env->QF = 1;
202 return max;
203 }
204 return val;
205}
206
207/* Signed saturate. */
9ef39277 208uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
6ddbc6e4 209{
9ef39277 210 return do_ssat(env, x, shift);
6ddbc6e4
PB
211}
212
213/* Dual halfword signed saturate. */
9ef39277 214uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
6ddbc6e4
PB
215{
216 uint32_t res;
217
9ef39277
BS
218 res = (uint16_t)do_ssat(env, (int16_t)x, shift);
219 res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
6ddbc6e4
PB
220 return res;
221}
222
223/* Unsigned saturate. */
9ef39277 224uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
6ddbc6e4 225{
9ef39277 226 return do_usat(env, x, shift);
6ddbc6e4
PB
227}
228
229/* Dual halfword unsigned saturate. */
9ef39277 230uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
6ddbc6e4
PB
231{
232 uint32_t res;
233
9ef39277
BS
234 res = (uint16_t)do_usat(env, (int16_t)x, shift);
235 res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
6ddbc6e4
PB
236 return res;
237}
d9ba4830 238
9886ecdf
PB
239void HELPER(setend)(CPUARMState *env)
240{
241 env->uncached_cpsr ^= CPSR_E;
242}
243
b1eced71
GB
244/* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped.
245 * The function returns the target EL (1-3) if the instruction is to be trapped;
246 * otherwise it returns 0 indicating it is not trapped.
247 */
248static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
249{
250 int cur_el = arm_current_el(env);
251 uint64_t mask;
252
0e284568
PM
253 if (arm_feature(env, ARM_FEATURE_M)) {
254 /* M profile cores can never trap WFI/WFE. */
255 return 0;
256 }
257
b1eced71
GB
258 /* If we are currently in EL0 then we need to check if SCTLR is set up for
259 * WFx instructions being trapped to EL1. These trap bits don't exist in v7.
260 */
261 if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) {
262 int target_el;
263
264 mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI;
265 if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) {
266 /* Secure EL0 and Secure PL1 is at EL3 */
267 target_el = 3;
268 } else {
269 target_el = 1;
270 }
271
272 if (!(env->cp15.sctlr_el[target_el] & mask)) {
273 return target_el;
274 }
275 }
276
277 /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it
278 * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the
279 * bits will be zero indicating no trap.
280 */
7c208e0f
RH
281 if (cur_el < 2) {
282 mask = is_wfe ? HCR_TWE : HCR_TWI;
283 if (arm_hcr_el2_eff(env) & mask) {
b1eced71
GB
284 return 2;
285 }
286 }
287
288 /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */
289 if (cur_el < 3) {
290 mask = (is_wfe) ? SCR_TWE : SCR_TWI;
291 if (env->cp15.scr_el3 & mask) {
292 return 3;
293 }
294 }
295
296 return 0;
297}
298
58803318 299void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
d9ba4830 300{
2fc0cc0e 301 CPUState *cs = env_cpu(env);
b1eced71 302 int target_el = check_wfx_trap(env, false);
259186a7 303
84549b6d
PM
304 if (cpu_has_work(cs)) {
305 /* Don't bother to go into our "low power state" if
306 * we would just wake up immediately.
307 */
308 return;
309 }
310
b1eced71 311 if (target_el) {
58803318
SS
312 env->pc -= insn_len;
313 raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0, insn_len == 2),
314 target_el);
b1eced71
GB
315 }
316
27103424 317 cs->exception_index = EXCP_HLT;
259186a7 318 cs->halted = 1;
5638d180 319 cpu_loop_exit(cs);
d9ba4830
PB
320}
321
72c1d3af
PM
322void HELPER(wfe)(CPUARMState *env)
323{
049e24a1
PM
324 /* This is a hint instruction that is semantically different
325 * from YIELD even though we currently implement it identically.
326 * Don't actually halt the CPU, just yield back to top
b1eced71
GB
327 * level loop. This is not going into a "low power state"
328 * (ie halting until some event occurs), so we never take
329 * a configurable trap to a different exception level.
72c1d3af 330 */
049e24a1
PM
331 HELPER(yield)(env);
332}
333
334void HELPER(yield)(CPUARMState *env)
335{
2fc0cc0e 336 CPUState *cs = env_cpu(env);
049e24a1
PM
337
338 /* This is a non-trappable hint instruction that generally indicates
339 * that the guest is currently busy-looping. Yield control back to the
340 * top level loop so that a more deserving VCPU has a chance to run.
341 */
27103424 342 cs->exception_index = EXCP_YIELD;
5638d180 343 cpu_loop_exit(cs);
72c1d3af
PM
344}
345
d4a2dc67
PM
346/* Raise an internal-to-QEMU exception. This is limited to only
347 * those EXCP values which are special cases for QEMU to interrupt
348 * execution and not to be used for exceptions which are passed to
349 * the guest (those must all have syndrome information and thus should
350 * use exception_with_syndrome).
351 */
352void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
353{
2fc0cc0e 354 CPUState *cs = env_cpu(env);
d4a2dc67
PM
355
356 assert(excp_is_internal(excp));
357 cs->exception_index = excp;
358 cpu_loop_exit(cs);
359}
360
361/* Raise an exception with the specified syndrome register value */
362void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
73710361 363 uint32_t syndrome, uint32_t target_el)
d9ba4830 364{
c6328599 365 raise_exception(env, excp, syndrome, target_el);
d9ba4830
PB
366}
367
c900a2e6
PM
368/* Raise an EXCP_BKPT with the specified syndrome register value,
369 * targeting the correct exception level for debug exceptions.
370 */
371void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
372{
62b94f31
PM
373 /* FSR will only be used if the debug target EL is AArch32. */
374 env->exception.fsr = arm_debug_exception_fsr(env);
548f514c
PM
375 /* FAR is UNKNOWN: clear vaddress to avoid potentially exposing
376 * values to the guest that it shouldn't be able to see at its
377 * exception/security level.
378 */
379 env->exception.vaddress = 0;
c900a2e6
PM
380 raise_exception(env, EXCP_BKPT, syndrome, arm_debug_target_el(env));
381}
382
9ef39277 383uint32_t HELPER(cpsr_read)(CPUARMState *env)
d9ba4830 384{
4051e12c 385 return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED);
d9ba4830
PB
386}
387
1ce94f81 388void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
d9ba4830 389{
50866ba5 390 cpsr_write(env, val, mask, CPSRWriteByInstr);
d9ba4830 391}
b0109805 392
235ea1f5
PM
393/* Write the CPSR for a 32-bit exception return */
394void HELPER(cpsr_write_eret)(CPUARMState *env, uint32_t val)
395{
b5c53d1b 396 qemu_mutex_lock_iothread();
2fc0cc0e 397 arm_call_pre_el_change_hook(env_archcpu(env));
b5c53d1b
AL
398 qemu_mutex_unlock_iothread();
399
50866ba5 400 cpsr_write(env, val, CPSR_ERET_MASK, CPSRWriteExceptionReturn);
bd7d00fc 401
fb0e8e79
PM
402 /* Generated code has already stored the new PC value, but
403 * without masking out its low bits, because which bits need
404 * masking depends on whether we're returning to Thumb or ARM
405 * state. Do the masking now.
406 */
407 env->regs[15] &= (env->thumb ? ~1 : ~3);
408
8d04fb55 409 qemu_mutex_lock_iothread();
2fc0cc0e 410 arm_call_el_change_hook(env_archcpu(env));
8d04fb55 411 qemu_mutex_unlock_iothread();
235ea1f5
PM
412}
413
b0109805 414/* Access to user mode registers from privileged modes. */
9ef39277 415uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
b0109805
PB
416{
417 uint32_t val;
418
419 if (regno == 13) {
99a99c1f 420 val = env->banked_r13[BANK_USRSYS];
b0109805 421 } else if (regno == 14) {
99a99c1f 422 val = env->banked_r14[BANK_USRSYS];
b0109805
PB
423 } else if (regno >= 8
424 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
425 val = env->usr_regs[regno - 8];
426 } else {
427 val = env->regs[regno];
428 }
429 return val;
430}
431
1ce94f81 432void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
b0109805
PB
433{
434 if (regno == 13) {
99a99c1f 435 env->banked_r13[BANK_USRSYS] = val;
b0109805 436 } else if (regno == 14) {
99a99c1f 437 env->banked_r14[BANK_USRSYS] = val;
b0109805
PB
438 } else if (regno >= 8
439 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
440 env->usr_regs[regno - 8] = val;
441 } else {
442 env->regs[regno] = val;
443 }
444}
4b6a83fb 445
72309cee
PM
446void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
447{
448 if ((env->uncached_cpsr & CPSR_M) == mode) {
449 env->regs[13] = val;
450 } else {
451 env->banked_r13[bank_number(mode)] = val;
452 }
453}
454
455uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
456{
f01377f5
PM
457 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_SYS) {
458 /* SRS instruction is UNPREDICTABLE from System mode; we UNDEF.
459 * Other UNPREDICTABLE and UNDEF cases were caught at translate time.
460 */
461 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
462 exception_target_el(env));
463 }
464
72309cee
PM
465 if ((env->uncached_cpsr & CPSR_M) == mode) {
466 return env->regs[13];
467 } else {
468 return env->banked_r13[bank_number(mode)];
469 }
470}
72309cee 471
8bfd0550
PM
472static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,
473 uint32_t regno)
474{
475 /* Raise an exception if the requested access is one of the UNPREDICTABLE
476 * cases; otherwise return. This broadly corresponds to the pseudocode
477 * BankedRegisterAccessValid() and SPSRAccessValid(),
478 * except that we have already handled some cases at translate time.
479 */
480 int curmode = env->uncached_cpsr & CPSR_M;
481
aec4dd09
PM
482 if (regno == 17) {
483 /* ELR_Hyp: a special case because access from tgtmode is OK */
484 if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {
485 goto undef;
486 }
487 return;
488 }
489
8bfd0550
PM
490 if (curmode == tgtmode) {
491 goto undef;
492 }
493
494 if (tgtmode == ARM_CPU_MODE_USR) {
495 switch (regno) {
496 case 8 ... 12:
497 if (curmode != ARM_CPU_MODE_FIQ) {
498 goto undef;
499 }
500 break;
501 case 13:
502 if (curmode == ARM_CPU_MODE_SYS) {
503 goto undef;
504 }
505 break;
506 case 14:
507 if (curmode == ARM_CPU_MODE_HYP || curmode == ARM_CPU_MODE_SYS) {
508 goto undef;
509 }
510 break;
511 default:
512 break;
513 }
514 }
515
516 if (tgtmode == ARM_CPU_MODE_HYP) {
aec4dd09
PM
517 /* SPSR_Hyp, r13_hyp: accessible from Monitor mode only */
518 if (curmode != ARM_CPU_MODE_MON) {
519 goto undef;
8bfd0550
PM
520 }
521 }
522
523 return;
524
525undef:
526 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
527 exception_target_el(env));
528}
529
530void HELPER(msr_banked)(CPUARMState *env, uint32_t value, uint32_t tgtmode,
531 uint32_t regno)
532{
533 msr_mrs_banked_exc_checks(env, tgtmode, regno);
534
535 switch (regno) {
536 case 16: /* SPSRs */
537 env->banked_spsr[bank_number(tgtmode)] = value;
538 break;
539 case 17: /* ELR_Hyp */
540 env->elr_el[2] = value;
541 break;
542 case 13:
543 env->banked_r13[bank_number(tgtmode)] = value;
544 break;
545 case 14:
593cfa2b 546 env->banked_r14[r14_bank_number(tgtmode)] = value;
8bfd0550
PM
547 break;
548 case 8 ... 12:
549 switch (tgtmode) {
550 case ARM_CPU_MODE_USR:
551 env->usr_regs[regno - 8] = value;
552 break;
553 case ARM_CPU_MODE_FIQ:
554 env->fiq_regs[regno - 8] = value;
555 break;
556 default:
557 g_assert_not_reached();
558 }
559 break;
560 default:
561 g_assert_not_reached();
562 }
563}
564
565uint32_t HELPER(mrs_banked)(CPUARMState *env, uint32_t tgtmode, uint32_t regno)
566{
567 msr_mrs_banked_exc_checks(env, tgtmode, regno);
568
569 switch (regno) {
570 case 16: /* SPSRs */
571 return env->banked_spsr[bank_number(tgtmode)];
572 case 17: /* ELR_Hyp */
573 return env->elr_el[2];
574 case 13:
575 return env->banked_r13[bank_number(tgtmode)];
576 case 14:
593cfa2b 577 return env->banked_r14[r14_bank_number(tgtmode)];
8bfd0550
PM
578 case 8 ... 12:
579 switch (tgtmode) {
580 case ARM_CPU_MODE_USR:
581 return env->usr_regs[regno - 8];
582 case ARM_CPU_MODE_FIQ:
583 return env->fiq_regs[regno - 8];
584 default:
585 g_assert_not_reached();
586 }
587 default:
588 g_assert_not_reached();
589 }
590}
591
3f208fd7
PM
592void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome,
593 uint32_t isread)
f59df3f2
PM
594{
595 const ARMCPRegInfo *ri = rip;
38836a2c 596 int target_el;
c0f4af17
PM
597
598 if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
599 && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
c6328599 600 raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
c0f4af17
PM
601 }
602
603 if (!ri->accessfn) {
604 return;
605 }
606
3f208fd7 607 switch (ri->accessfn(env, ri, isread)) {
f59df3f2
PM
608 case CP_ACCESS_OK:
609 return;
610 case CP_ACCESS_TRAP:
38836a2c
PM
611 target_el = exception_target_el(env);
612 break;
613 case CP_ACCESS_TRAP_EL2:
614 /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
615 * a bug in the access function.
616 */
3fc827d5 617 assert(!arm_is_secure(env) && arm_current_el(env) != 3);
38836a2c
PM
618 target_el = 2;
619 break;
620 case CP_ACCESS_TRAP_EL3:
621 target_el = 3;
8bcbf37c 622 break;
f59df3f2 623 case CP_ACCESS_TRAP_UNCATEGORIZED:
38836a2c 624 target_el = exception_target_el(env);
c6328599 625 syndrome = syn_uncategorized();
f59df3f2 626 break;
e7615726
PM
627 case CP_ACCESS_TRAP_UNCATEGORIZED_EL2:
628 target_el = 2;
629 syndrome = syn_uncategorized();
630 break;
631 case CP_ACCESS_TRAP_UNCATEGORIZED_EL3:
632 target_el = 3;
633 syndrome = syn_uncategorized();
634 break;
f2cae609
PM
635 case CP_ACCESS_TRAP_FP_EL2:
636 target_el = 2;
637 /* Since we are an implementation that takes exceptions on a trapped
638 * conditional insn only if the insn has passed its condition code
639 * check, we take the IMPDEF choice to always report CV=1 COND=0xe
640 * (which is also the required value for AArch64 traps).
641 */
642 syndrome = syn_fp_access_trap(1, 0xe, false);
643 break;
644 case CP_ACCESS_TRAP_FP_EL3:
645 target_el = 3;
646 syndrome = syn_fp_access_trap(1, 0xe, false);
647 break;
f59df3f2
PM
648 default:
649 g_assert_not_reached();
650 }
c6328599 651
38836a2c 652 raise_exception(env, EXCP_UDEF, syndrome, target_el);
f59df3f2
PM
653}
654
4b6a83fb
PM
655void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
656{
657 const ARMCPRegInfo *ri = rip;
c4241c7d 658
8d04fb55
JK
659 if (ri->type & ARM_CP_IO) {
660 qemu_mutex_lock_iothread();
661 ri->writefn(env, ri, value);
662 qemu_mutex_unlock_iothread();
663 } else {
664 ri->writefn(env, ri, value);
665 }
4b6a83fb
PM
666}
667
668uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
669{
670 const ARMCPRegInfo *ri = rip;
8d04fb55 671 uint32_t res;
c4241c7d 672
8d04fb55
JK
673 if (ri->type & ARM_CP_IO) {
674 qemu_mutex_lock_iothread();
675 res = ri->readfn(env, ri);
676 qemu_mutex_unlock_iothread();
677 } else {
678 res = ri->readfn(env, ri);
679 }
680
681 return res;
4b6a83fb
PM
682}
683
684void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
685{
686 const ARMCPRegInfo *ri = rip;
c4241c7d 687
8d04fb55
JK
688 if (ri->type & ARM_CP_IO) {
689 qemu_mutex_lock_iothread();
690 ri->writefn(env, ri, value);
691 qemu_mutex_unlock_iothread();
692 } else {
693 ri->writefn(env, ri, value);
694 }
4b6a83fb
PM
695}
696
697uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
698{
699 const ARMCPRegInfo *ri = rip;
8d04fb55
JK
700 uint64_t res;
701
702 if (ri->type & ARM_CP_IO) {
703 qemu_mutex_lock_iothread();
704 res = ri->readfn(env, ri);
705 qemu_mutex_unlock_iothread();
706 } else {
707 res = ri->readfn(env, ri);
708 }
c4241c7d 709
8d04fb55 710 return res;
4b6a83fb 711}
b0109805 712
35979d71
EI
713void HELPER(pre_hvc)(CPUARMState *env)
714{
2fc0cc0e 715 ARMCPU *cpu = env_archcpu(env);
dcbff19b 716 int cur_el = arm_current_el(env);
35979d71
EI
717 /* FIXME: Use actual secure state. */
718 bool secure = false;
719 bool undef;
720
98128601
RH
721 if (arm_is_psci_call(cpu, EXCP_HVC)) {
722 /* If PSCI is enabled and this looks like a valid PSCI call then
723 * that overrides the architecturally mandated HVC behaviour.
724 */
725 return;
726 }
727
39404338
PM
728 if (!arm_feature(env, ARM_FEATURE_EL2)) {
729 /* If EL2 doesn't exist, HVC always UNDEFs */
730 undef = true;
731 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
732 /* EL3.HCE has priority over EL2.HCD. */
35979d71
EI
733 undef = !(env->cp15.scr_el3 & SCR_HCE);
734 } else {
735 undef = env->cp15.hcr_el2 & HCR_HCD;
736 }
737
738 /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
739 * For ARMv8/AArch64, HVC is allowed in EL3.
740 * Note that we've already trapped HVC from EL0 at translation
741 * time.
742 */
743 if (secure && (!is_a64(env) || cur_el == 1)) {
744 undef = true;
745 }
746
747 if (undef) {
c6328599
PM
748 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
749 exception_target_el(env));
35979d71
EI
750 }
751}
752
e0d6e6a5
EI
753void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
754{
2fc0cc0e 755 ARMCPU *cpu = env_archcpu(env);
dcbff19b 756 int cur_el = arm_current_el(env);
dbe9d163 757 bool secure = arm_is_secure(env);
7760da72
LM
758 bool smd_flag = env->cp15.scr_el3 & SCR_SMD;
759
760 /*
761 * SMC behaviour is summarized in the following table.
762 * This helper handles the "Trap to EL2" and "Undef insn" cases.
763 * The "Trap to EL3" and "PSCI call" cases are handled in the exception
764 * helper.
765 *
766 * -> ARM_FEATURE_EL3 and !SMD
767 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
768 *
769 * Conduit SMC, valid call Trap to EL2 PSCI Call
770 * Conduit SMC, inval call Trap to EL2 Trap to EL3
771 * Conduit not SMC Trap to EL2 Trap to EL3
772 *
773 *
774 * -> ARM_FEATURE_EL3 and SMD
775 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
776 *
777 * Conduit SMC, valid call Trap to EL2 PSCI Call
778 * Conduit SMC, inval call Trap to EL2 Undef insn
779 * Conduit not SMC Trap to EL2 Undef insn
780 *
781 *
782 * -> !ARM_FEATURE_EL3
783 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
784 *
785 * Conduit SMC, valid call Trap to EL2 PSCI Call
786 * Conduit SMC, inval call Trap to EL2 Undef insn
787 * Conduit not SMC Undef insn Undef insn
788 */
789
f096e92b
PM
790 /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state.
791 * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization
792 * extensions, SMD only applies to NS state.
793 * On ARMv7 without the Virtualization extensions, the SMD bit
794 * doesn't exist, but we forbid the guest to set it to 1 in scr_write(),
795 * so we need not special case this here.
e0d6e6a5 796 */
7760da72
LM
797 bool smd = arm_feature(env, ARM_FEATURE_AARCH64) ? smd_flag
798 : smd_flag && !secure;
e0d6e6a5 799
77077a83
JK
800 if (!arm_feature(env, ARM_FEATURE_EL3) &&
801 cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
802 /* If we have no EL3 then SMC always UNDEFs and can't be
803 * trapped to EL2. PSCI-via-SMC is a sort of ersatz EL3
804 * firmware within QEMU, and we want an EL2 guest to be able
805 * to forbid its EL1 from making PSCI calls into QEMU's
806 * "firmware" via HCR.TSC, so for these purposes treat
807 * PSCI-via-SMC as implying an EL3.
7760da72 808 * This handles the very last line of the previous table.
98128601 809 */
7760da72
LM
810 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
811 exception_target_el(env));
812 }
813
7c208e0f 814 if (cur_el == 1 && (arm_hcr_el2_eff(env) & HCR_TSC)) {
77077a83
JK
815 /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
816 * We also want an EL2 guest to be able to forbid its EL1 from
817 * making PSCI calls into QEMU's "firmware" via HCR.TSC.
7760da72 818 * This handles all the "Trap to EL2" cases of the previous table.
77077a83 819 */
c6328599 820 raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
e0d6e6a5
EI
821 }
822
7760da72
LM
823 /* Catch the two remaining "Undef insn" cases of the previous table:
824 * - PSCI conduit is SMC but we don't have a valid PCSI call,
825 * - We don't have EL3 or SMD is set.
77077a83 826 */
7760da72
LM
827 if (!arm_is_psci_call(cpu, EXCP_SMC) &&
828 (smd || !arm_feature(env, ARM_FEATURE_EL3))) {
c6328599
PM
829 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
830 exception_target_el(env));
e0d6e6a5
EI
831 }
832}
833
8984bd2e
PB
834/* ??? Flag setting arithmetic is awkward because we need to do comparisons.
835 The only way to do that in TCG is a conditional branch, which clobbers
836 all our temporaries. For now implement these as helper functions. */
837
8984bd2e
PB
838/* Similarly for variable shift instructions. */
839
9ef39277 840uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
8984bd2e
PB
841{
842 int shift = i & 0xff;
843 if (shift >= 32) {
844 if (shift == 32)
845 env->CF = x & 1;
846 else
847 env->CF = 0;
848 return 0;
849 } else if (shift != 0) {
850 env->CF = (x >> (32 - shift)) & 1;
851 return x << shift;
852 }
853 return x;
854}
855
9ef39277 856uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
8984bd2e
PB
857{
858 int shift = i & 0xff;
859 if (shift >= 32) {
860 if (shift == 32)
861 env->CF = (x >> 31) & 1;
862 else
863 env->CF = 0;
864 return 0;
865 } else if (shift != 0) {
866 env->CF = (x >> (shift - 1)) & 1;
867 return x >> shift;
868 }
869 return x;
870}
871
9ef39277 872uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
8984bd2e
PB
873{
874 int shift = i & 0xff;
875 if (shift >= 32) {
876 env->CF = (x >> 31) & 1;
877 return (int32_t)x >> 31;
878 } else if (shift != 0) {
879 env->CF = (x >> (shift - 1)) & 1;
880 return (int32_t)x >> shift;
881 }
882 return x;
883}
884
9ef39277 885uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
8984bd2e
PB
886{
887 int shift1, shift;
888 shift1 = i & 0xff;
889 shift = shift1 & 0x1f;
890 if (shift == 0) {
891 if (shift1 != 0)
892 env->CF = (x >> 31) & 1;
893 return x;
894 } else {
895 env->CF = (x >> (shift - 1)) & 1;
896 return ((uint32_t)x >> shift) | (x << (32 - shift));
897 }
898}
6cdca173
SO
899
900void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
901{
902 /*
903 * Implement DC ZVA, which zeroes a fixed-length block of memory.
904 * Note that we do not implement the (architecturally mandated)
905 * alignment fault for attempts to use this on Device memory
906 * (which matches the usual QEMU behaviour of not implementing either
907 * alignment faults or any memory attribute handling).
908 */
909
910 ARMCPU *cpu = env_archcpu(env);
911 uint64_t blocklen = 4 << cpu->dcz_blocksize;
912 uint64_t vaddr = vaddr_in & ~(blocklen - 1);
913
914#ifndef CONFIG_USER_ONLY
915 {
916 /*
917 * Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than
918 * the block size so we might have to do more than one TLB lookup.
919 * We know that in fact for any v8 CPU the page size is at least 4K
920 * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
921 * 1K as an artefact of legacy v5 subpage support being present in the
922 * same QEMU executable. So in practice the hostaddr[] array has
923 * two entries, given the current setting of TARGET_PAGE_BITS_MIN.
924 */
925 int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
926 void *hostaddr[DIV_ROUND_UP(2 * KiB, 1 << TARGET_PAGE_BITS_MIN)];
927 int try, i;
928 unsigned mmu_idx = cpu_mmu_index(env, false);
929 TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
930
931 assert(maxidx <= ARRAY_SIZE(hostaddr));
932
933 for (try = 0; try < 2; try++) {
934
935 for (i = 0; i < maxidx; i++) {
936 hostaddr[i] = tlb_vaddr_to_host(env,
937 vaddr + TARGET_PAGE_SIZE * i,
938 1, mmu_idx);
939 if (!hostaddr[i]) {
940 break;
941 }
942 }
943 if (i == maxidx) {
944 /*
945 * If it's all in the TLB it's fair game for just writing to;
946 * we know we don't need to update dirty status, etc.
947 */
948 for (i = 0; i < maxidx - 1; i++) {
949 memset(hostaddr[i], 0, TARGET_PAGE_SIZE);
950 }
951 memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE));
952 return;
953 }
954 /*
955 * OK, try a store and see if we can populate the tlb. This
956 * might cause an exception if the memory isn't writable,
957 * in which case we will longjmp out of here. We must for
958 * this purpose use the actual register value passed to us
959 * so that we get the fault address right.
960 */
961 helper_ret_stb_mmu(env, vaddr_in, 0, oi, GETPC());
962 /* Now we can populate the other TLB entries, if any */
963 for (i = 0; i < maxidx; i++) {
964 uint64_t va = vaddr + TARGET_PAGE_SIZE * i;
965 if (va != (vaddr_in & TARGET_PAGE_MASK)) {
966 helper_ret_stb_mmu(env, va, 0, oi, GETPC());
967 }
968 }
969 }
970
971 /*
972 * Slow path (probably attempt to do this to an I/O device or
973 * similar, or clearing of a block of code we have translations
974 * cached for). Just do a series of byte writes as the architecture
975 * demands. It's not worth trying to use a cpu_physical_memory_map(),
976 * memset(), unmap() sequence here because:
977 * + we'd need to account for the blocksize being larger than a page
978 * + the direct-RAM access case is almost always going to be dealt
979 * with in the fastpath code above, so there's no speed benefit
980 * + we would have to deal with the map returning NULL because the
981 * bounce buffer was in use
982 */
983 for (i = 0; i < blocklen; i++) {
984 helper_ret_stb_mmu(env, vaddr + i, 0, oi, GETPC());
985 }
986 }
987#else
988 memset(g2h(vaddr), 0, blocklen);
989#endif
990}