]>
Commit | Line | Data |
---|---|---|
b7bcbe95 FB |
1 | /* |
2 | * ARM helper routines | |
5fafdf24 | 3 | * |
9ee6e8bb | 4 | * Copyright (c) 2005-2007 CodeSourcery, LLC |
b7bcbe95 FB |
5 | * |
6 | * This library is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU Lesser General Public | |
8 | * License as published by the Free Software Foundation; either | |
9 | * version 2 of the License, or (at your option) any later version. | |
10 | * | |
11 | * This library is distributed in the hope that it will be useful, | |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
14 | * Lesser General Public License for more details. | |
15 | * | |
16 | * You should have received a copy of the GNU Lesser General Public | |
8167ee88 | 17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. |
b7bcbe95 | 18 | */ |
74c21bd0 | 19 | #include "qemu/osdep.h" |
6cdca173 | 20 | #include "qemu/units.h" |
c9b61d9a | 21 | #include "qemu/log.h" |
8d04fb55 | 22 | #include "qemu/main-loop.h" |
3e457172 | 23 | #include "cpu.h" |
2ef6175a | 24 | #include "exec/helper-proto.h" |
ccd38087 | 25 | #include "internals.h" |
63c91552 | 26 | #include "exec/exec-all.h" |
f08b6170 | 27 | #include "exec/cpu_ldst.h" |
b7bcbe95 | 28 | |
ad69471c PB |
29 | #define SIGNBIT (uint32_t)0x80000000 |
30 | #define SIGNBIT64 ((uint64_t)1 << 63) | |
31 | ||
7469f6c6 RH |
32 | static CPUState *do_raise_exception(CPUARMState *env, uint32_t excp, |
33 | uint32_t syndrome, uint32_t target_el) | |
b7bcbe95 | 34 | { |
2fc0cc0e | 35 | CPUState *cs = env_cpu(env); |
27103424 | 36 | |
7c208e0f | 37 | if (target_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) { |
7556edfb PM |
38 | /* |
39 | * Redirect NS EL1 exceptions to NS EL2. These are reported with | |
40 | * their original syndrome register value, with the exception of | |
41 | * SIMD/FP access traps, which are reported as uncategorized | |
42 | * (see DDI0478C.a D1.10.4) | |
43 | */ | |
44 | target_el = 2; | |
64b91e3f | 45 | if (syn_get_ec(syndrome) == EC_ADVSIMDFPACCESSTRAP) { |
7556edfb PM |
46 | syndrome = syn_uncategorized(); |
47 | } | |
48 | } | |
49 | ||
c6328599 PM |
50 | assert(!excp_is_internal(excp)); |
51 | cs->exception_index = excp; | |
52 | env->exception.syndrome = syndrome; | |
53 | env->exception.target_el = target_el; | |
7469f6c6 RH |
54 | |
55 | return cs; | |
56 | } | |
57 | ||
58 | void raise_exception(CPUARMState *env, uint32_t excp, | |
59 | uint32_t syndrome, uint32_t target_el) | |
60 | { | |
61 | CPUState *cs = do_raise_exception(env, excp, syndrome, target_el); | |
5638d180 | 62 | cpu_loop_exit(cs); |
b7bcbe95 FB |
63 | } |
64 | ||
7469f6c6 RH |
65 | void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome, |
66 | uint32_t target_el, uintptr_t ra) | |
67 | { | |
68 | CPUState *cs = do_raise_exception(env, excp, syndrome, target_el); | |
69 | cpu_loop_exit_restore(cs, ra); | |
70 | } | |
71 | ||
e7c06c4e RH |
72 | uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn, |
73 | uint32_t maxindex) | |
9ee6e8bb | 74 | { |
e7c06c4e RH |
75 | uint32_t val, shift; |
76 | uint64_t *table = vn; | |
77 | ||
9ee6e8bb | 78 | val = 0; |
9ee6e8bb | 79 | for (shift = 0; shift < 32; shift += 8) { |
e7c06c4e | 80 | uint32_t index = (ireg >> shift) & 0xff; |
8f8e3aa4 | 81 | if (index < maxindex) { |
e7c06c4e | 82 | uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff; |
9ee6e8bb PB |
83 | val |= tmp << shift; |
84 | } else { | |
8f8e3aa4 | 85 | val |= def & (0xff << shift); |
9ee6e8bb PB |
86 | } |
87 | } | |
8f8e3aa4 | 88 | return val; |
9ee6e8bb PB |
89 | } |
90 | ||
55203189 PM |
91 | void HELPER(v8m_stackcheck)(CPUARMState *env, uint32_t newvalue) |
92 | { | |
93 | /* | |
94 | * Perform the v8M stack limit check for SP updates from translated code, | |
95 | * raising an exception if the limit is breached. | |
96 | */ | |
97 | if (newvalue < v7m_sp_limit(env)) { | |
2fc0cc0e | 98 | CPUState *cs = env_cpu(env); |
55203189 PM |
99 | |
100 | /* | |
101 | * Stack limit exceptions are a rare case, so rather than syncing | |
102 | * PC/condbits before the call, we use cpu_restore_state() to | |
103 | * get them right before raising the exception. | |
104 | */ | |
105 | cpu_restore_state(cs, GETPC(), true); | |
106 | raise_exception(env, EXCP_STKOF, 0, 1); | |
107 | } | |
108 | } | |
109 | ||
9ef39277 | 110 | uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b) |
1497c961 PB |
111 | { |
112 | uint32_t res = a + b; | |
113 | if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) | |
114 | env->QF = 1; | |
115 | return res; | |
116 | } | |
117 | ||
9ef39277 | 118 | uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b) |
1497c961 PB |
119 | { |
120 | uint32_t res = a + b; | |
121 | if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) { | |
122 | env->QF = 1; | |
123 | res = ~(((int32_t)a >> 31) ^ SIGNBIT); | |
124 | } | |
125 | return res; | |
126 | } | |
127 | ||
9ef39277 | 128 | uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b) |
1497c961 PB |
129 | { |
130 | uint32_t res = a - b; | |
131 | if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) { | |
132 | env->QF = 1; | |
133 | res = ~(((int32_t)a >> 31) ^ SIGNBIT); | |
134 | } | |
135 | return res; | |
136 | } | |
137 | ||
9ef39277 | 138 | uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val) |
1497c961 PB |
139 | { |
140 | uint32_t res; | |
141 | if (val >= 0x40000000) { | |
142 | res = ~SIGNBIT; | |
143 | env->QF = 1; | |
144 | } else if (val <= (int32_t)0xc0000000) { | |
145 | res = SIGNBIT; | |
146 | env->QF = 1; | |
147 | } else { | |
148 | res = val << 1; | |
149 | } | |
150 | return res; | |
151 | } | |
152 | ||
9ef39277 | 153 | uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b) |
1497c961 PB |
154 | { |
155 | uint32_t res = a + b; | |
156 | if (res < a) { | |
157 | env->QF = 1; | |
158 | res = ~0; | |
159 | } | |
160 | return res; | |
161 | } | |
162 | ||
9ef39277 | 163 | uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b) |
1497c961 PB |
164 | { |
165 | uint32_t res = a - b; | |
166 | if (res > a) { | |
167 | env->QF = 1; | |
168 | res = 0; | |
169 | } | |
170 | return res; | |
171 | } | |
172 | ||
6ddbc6e4 | 173 | /* Signed saturation. */ |
9ef39277 | 174 | static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift) |
6ddbc6e4 PB |
175 | { |
176 | int32_t top; | |
177 | uint32_t mask; | |
178 | ||
6ddbc6e4 PB |
179 | top = val >> shift; |
180 | mask = (1u << shift) - 1; | |
181 | if (top > 0) { | |
182 | env->QF = 1; | |
183 | return mask; | |
184 | } else if (top < -1) { | |
185 | env->QF = 1; | |
186 | return ~mask; | |
187 | } | |
188 | return val; | |
189 | } | |
190 | ||
191 | /* Unsigned saturation. */ | |
9ef39277 | 192 | static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift) |
6ddbc6e4 PB |
193 | { |
194 | uint32_t max; | |
195 | ||
6ddbc6e4 PB |
196 | max = (1u << shift) - 1; |
197 | if (val < 0) { | |
198 | env->QF = 1; | |
199 | return 0; | |
200 | } else if (val > max) { | |
201 | env->QF = 1; | |
202 | return max; | |
203 | } | |
204 | return val; | |
205 | } | |
206 | ||
207 | /* Signed saturate. */ | |
9ef39277 | 208 | uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift) |
6ddbc6e4 | 209 | { |
9ef39277 | 210 | return do_ssat(env, x, shift); |
6ddbc6e4 PB |
211 | } |
212 | ||
213 | /* Dual halfword signed saturate. */ | |
9ef39277 | 214 | uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift) |
6ddbc6e4 PB |
215 | { |
216 | uint32_t res; | |
217 | ||
9ef39277 BS |
218 | res = (uint16_t)do_ssat(env, (int16_t)x, shift); |
219 | res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16; | |
6ddbc6e4 PB |
220 | return res; |
221 | } | |
222 | ||
223 | /* Unsigned saturate. */ | |
9ef39277 | 224 | uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift) |
6ddbc6e4 | 225 | { |
9ef39277 | 226 | return do_usat(env, x, shift); |
6ddbc6e4 PB |
227 | } |
228 | ||
229 | /* Dual halfword unsigned saturate. */ | |
9ef39277 | 230 | uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift) |
6ddbc6e4 PB |
231 | { |
232 | uint32_t res; | |
233 | ||
9ef39277 BS |
234 | res = (uint16_t)do_usat(env, (int16_t)x, shift); |
235 | res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16; | |
6ddbc6e4 PB |
236 | return res; |
237 | } | |
d9ba4830 | 238 | |
9886ecdf PB |
239 | void HELPER(setend)(CPUARMState *env) |
240 | { | |
241 | env->uncached_cpsr ^= CPSR_E; | |
242 | } | |
243 | ||
b1eced71 GB |
244 | /* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped. |
245 | * The function returns the target EL (1-3) if the instruction is to be trapped; | |
246 | * otherwise it returns 0 indicating it is not trapped. | |
247 | */ | |
248 | static inline int check_wfx_trap(CPUARMState *env, bool is_wfe) | |
249 | { | |
250 | int cur_el = arm_current_el(env); | |
251 | uint64_t mask; | |
252 | ||
0e284568 PM |
253 | if (arm_feature(env, ARM_FEATURE_M)) { |
254 | /* M profile cores can never trap WFI/WFE. */ | |
255 | return 0; | |
256 | } | |
257 | ||
b1eced71 GB |
258 | /* If we are currently in EL0 then we need to check if SCTLR is set up for |
259 | * WFx instructions being trapped to EL1. These trap bits don't exist in v7. | |
260 | */ | |
261 | if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) { | |
262 | int target_el; | |
263 | ||
264 | mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI; | |
265 | if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) { | |
266 | /* Secure EL0 and Secure PL1 is at EL3 */ | |
267 | target_el = 3; | |
268 | } else { | |
269 | target_el = 1; | |
270 | } | |
271 | ||
272 | if (!(env->cp15.sctlr_el[target_el] & mask)) { | |
273 | return target_el; | |
274 | } | |
275 | } | |
276 | ||
277 | /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it | |
278 | * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the | |
279 | * bits will be zero indicating no trap. | |
280 | */ | |
7c208e0f RH |
281 | if (cur_el < 2) { |
282 | mask = is_wfe ? HCR_TWE : HCR_TWI; | |
283 | if (arm_hcr_el2_eff(env) & mask) { | |
b1eced71 GB |
284 | return 2; |
285 | } | |
286 | } | |
287 | ||
288 | /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */ | |
289 | if (cur_el < 3) { | |
290 | mask = (is_wfe) ? SCR_TWE : SCR_TWI; | |
291 | if (env->cp15.scr_el3 & mask) { | |
292 | return 3; | |
293 | } | |
294 | } | |
295 | ||
296 | return 0; | |
297 | } | |
298 | ||
58803318 | 299 | void HELPER(wfi)(CPUARMState *env, uint32_t insn_len) |
d9ba4830 | 300 | { |
2fc0cc0e | 301 | CPUState *cs = env_cpu(env); |
b1eced71 | 302 | int target_el = check_wfx_trap(env, false); |
259186a7 | 303 | |
84549b6d PM |
304 | if (cpu_has_work(cs)) { |
305 | /* Don't bother to go into our "low power state" if | |
306 | * we would just wake up immediately. | |
307 | */ | |
308 | return; | |
309 | } | |
310 | ||
b1eced71 | 311 | if (target_el) { |
58803318 SS |
312 | env->pc -= insn_len; |
313 | raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0, insn_len == 2), | |
314 | target_el); | |
b1eced71 GB |
315 | } |
316 | ||
27103424 | 317 | cs->exception_index = EXCP_HLT; |
259186a7 | 318 | cs->halted = 1; |
5638d180 | 319 | cpu_loop_exit(cs); |
d9ba4830 PB |
320 | } |
321 | ||
72c1d3af PM |
322 | void HELPER(wfe)(CPUARMState *env) |
323 | { | |
049e24a1 PM |
324 | /* This is a hint instruction that is semantically different |
325 | * from YIELD even though we currently implement it identically. | |
326 | * Don't actually halt the CPU, just yield back to top | |
b1eced71 GB |
327 | * level loop. This is not going into a "low power state" |
328 | * (ie halting until some event occurs), so we never take | |
329 | * a configurable trap to a different exception level. | |
72c1d3af | 330 | */ |
049e24a1 PM |
331 | HELPER(yield)(env); |
332 | } | |
333 | ||
334 | void HELPER(yield)(CPUARMState *env) | |
335 | { | |
2fc0cc0e | 336 | CPUState *cs = env_cpu(env); |
049e24a1 PM |
337 | |
338 | /* This is a non-trappable hint instruction that generally indicates | |
339 | * that the guest is currently busy-looping. Yield control back to the | |
340 | * top level loop so that a more deserving VCPU has a chance to run. | |
341 | */ | |
27103424 | 342 | cs->exception_index = EXCP_YIELD; |
5638d180 | 343 | cpu_loop_exit(cs); |
72c1d3af PM |
344 | } |
345 | ||
d4a2dc67 PM |
346 | /* Raise an internal-to-QEMU exception. This is limited to only |
347 | * those EXCP values which are special cases for QEMU to interrupt | |
348 | * execution and not to be used for exceptions which are passed to | |
349 | * the guest (those must all have syndrome information and thus should | |
350 | * use exception_with_syndrome). | |
351 | */ | |
352 | void HELPER(exception_internal)(CPUARMState *env, uint32_t excp) | |
353 | { | |
2fc0cc0e | 354 | CPUState *cs = env_cpu(env); |
d4a2dc67 PM |
355 | |
356 | assert(excp_is_internal(excp)); | |
357 | cs->exception_index = excp; | |
358 | cpu_loop_exit(cs); | |
359 | } | |
360 | ||
361 | /* Raise an exception with the specified syndrome register value */ | |
362 | void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp, | |
73710361 | 363 | uint32_t syndrome, uint32_t target_el) |
d9ba4830 | 364 | { |
c6328599 | 365 | raise_exception(env, excp, syndrome, target_el); |
d9ba4830 PB |
366 | } |
367 | ||
c900a2e6 PM |
368 | /* Raise an EXCP_BKPT with the specified syndrome register value, |
369 | * targeting the correct exception level for debug exceptions. | |
370 | */ | |
371 | void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome) | |
372 | { | |
62b94f31 PM |
373 | /* FSR will only be used if the debug target EL is AArch32. */ |
374 | env->exception.fsr = arm_debug_exception_fsr(env); | |
548f514c PM |
375 | /* FAR is UNKNOWN: clear vaddress to avoid potentially exposing |
376 | * values to the guest that it shouldn't be able to see at its | |
377 | * exception/security level. | |
378 | */ | |
379 | env->exception.vaddress = 0; | |
c900a2e6 PM |
380 | raise_exception(env, EXCP_BKPT, syndrome, arm_debug_target_el(env)); |
381 | } | |
382 | ||
9ef39277 | 383 | uint32_t HELPER(cpsr_read)(CPUARMState *env) |
d9ba4830 | 384 | { |
4051e12c | 385 | return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED); |
d9ba4830 PB |
386 | } |
387 | ||
1ce94f81 | 388 | void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask) |
d9ba4830 | 389 | { |
50866ba5 | 390 | cpsr_write(env, val, mask, CPSRWriteByInstr); |
d9ba4830 | 391 | } |
b0109805 | 392 | |
235ea1f5 PM |
393 | /* Write the CPSR for a 32-bit exception return */ |
394 | void HELPER(cpsr_write_eret)(CPUARMState *env, uint32_t val) | |
395 | { | |
b5c53d1b | 396 | qemu_mutex_lock_iothread(); |
2fc0cc0e | 397 | arm_call_pre_el_change_hook(env_archcpu(env)); |
b5c53d1b AL |
398 | qemu_mutex_unlock_iothread(); |
399 | ||
50866ba5 | 400 | cpsr_write(env, val, CPSR_ERET_MASK, CPSRWriteExceptionReturn); |
bd7d00fc | 401 | |
fb0e8e79 PM |
402 | /* Generated code has already stored the new PC value, but |
403 | * without masking out its low bits, because which bits need | |
404 | * masking depends on whether we're returning to Thumb or ARM | |
405 | * state. Do the masking now. | |
406 | */ | |
407 | env->regs[15] &= (env->thumb ? ~1 : ~3); | |
408 | ||
8d04fb55 | 409 | qemu_mutex_lock_iothread(); |
2fc0cc0e | 410 | arm_call_el_change_hook(env_archcpu(env)); |
8d04fb55 | 411 | qemu_mutex_unlock_iothread(); |
235ea1f5 PM |
412 | } |
413 | ||
b0109805 | 414 | /* Access to user mode registers from privileged modes. */ |
9ef39277 | 415 | uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno) |
b0109805 PB |
416 | { |
417 | uint32_t val; | |
418 | ||
419 | if (regno == 13) { | |
99a99c1f | 420 | val = env->banked_r13[BANK_USRSYS]; |
b0109805 | 421 | } else if (regno == 14) { |
99a99c1f | 422 | val = env->banked_r14[BANK_USRSYS]; |
b0109805 PB |
423 | } else if (regno >= 8 |
424 | && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) { | |
425 | val = env->usr_regs[regno - 8]; | |
426 | } else { | |
427 | val = env->regs[regno]; | |
428 | } | |
429 | return val; | |
430 | } | |
431 | ||
1ce94f81 | 432 | void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val) |
b0109805 PB |
433 | { |
434 | if (regno == 13) { | |
99a99c1f | 435 | env->banked_r13[BANK_USRSYS] = val; |
b0109805 | 436 | } else if (regno == 14) { |
99a99c1f | 437 | env->banked_r14[BANK_USRSYS] = val; |
b0109805 PB |
438 | } else if (regno >= 8 |
439 | && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) { | |
440 | env->usr_regs[regno - 8] = val; | |
441 | } else { | |
442 | env->regs[regno] = val; | |
443 | } | |
444 | } | |
4b6a83fb | 445 | |
72309cee PM |
446 | void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val) |
447 | { | |
448 | if ((env->uncached_cpsr & CPSR_M) == mode) { | |
449 | env->regs[13] = val; | |
450 | } else { | |
451 | env->banked_r13[bank_number(mode)] = val; | |
452 | } | |
453 | } | |
454 | ||
455 | uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode) | |
456 | { | |
f01377f5 PM |
457 | if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_SYS) { |
458 | /* SRS instruction is UNPREDICTABLE from System mode; we UNDEF. | |
459 | * Other UNPREDICTABLE and UNDEF cases were caught at translate time. | |
460 | */ | |
461 | raise_exception(env, EXCP_UDEF, syn_uncategorized(), | |
462 | exception_target_el(env)); | |
463 | } | |
464 | ||
72309cee PM |
465 | if ((env->uncached_cpsr & CPSR_M) == mode) { |
466 | return env->regs[13]; | |
467 | } else { | |
468 | return env->banked_r13[bank_number(mode)]; | |
469 | } | |
470 | } | |
72309cee | 471 | |
8bfd0550 PM |
472 | static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode, |
473 | uint32_t regno) | |
474 | { | |
475 | /* Raise an exception if the requested access is one of the UNPREDICTABLE | |
476 | * cases; otherwise return. This broadly corresponds to the pseudocode | |
477 | * BankedRegisterAccessValid() and SPSRAccessValid(), | |
478 | * except that we have already handled some cases at translate time. | |
479 | */ | |
480 | int curmode = env->uncached_cpsr & CPSR_M; | |
481 | ||
aec4dd09 PM |
482 | if (regno == 17) { |
483 | /* ELR_Hyp: a special case because access from tgtmode is OK */ | |
484 | if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) { | |
485 | goto undef; | |
486 | } | |
487 | return; | |
488 | } | |
489 | ||
8bfd0550 PM |
490 | if (curmode == tgtmode) { |
491 | goto undef; | |
492 | } | |
493 | ||
494 | if (tgtmode == ARM_CPU_MODE_USR) { | |
495 | switch (regno) { | |
496 | case 8 ... 12: | |
497 | if (curmode != ARM_CPU_MODE_FIQ) { | |
498 | goto undef; | |
499 | } | |
500 | break; | |
501 | case 13: | |
502 | if (curmode == ARM_CPU_MODE_SYS) { | |
503 | goto undef; | |
504 | } | |
505 | break; | |
506 | case 14: | |
507 | if (curmode == ARM_CPU_MODE_HYP || curmode == ARM_CPU_MODE_SYS) { | |
508 | goto undef; | |
509 | } | |
510 | break; | |
511 | default: | |
512 | break; | |
513 | } | |
514 | } | |
515 | ||
516 | if (tgtmode == ARM_CPU_MODE_HYP) { | |
aec4dd09 PM |
517 | /* SPSR_Hyp, r13_hyp: accessible from Monitor mode only */ |
518 | if (curmode != ARM_CPU_MODE_MON) { | |
519 | goto undef; | |
8bfd0550 PM |
520 | } |
521 | } | |
522 | ||
523 | return; | |
524 | ||
525 | undef: | |
526 | raise_exception(env, EXCP_UDEF, syn_uncategorized(), | |
527 | exception_target_el(env)); | |
528 | } | |
529 | ||
530 | void HELPER(msr_banked)(CPUARMState *env, uint32_t value, uint32_t tgtmode, | |
531 | uint32_t regno) | |
532 | { | |
533 | msr_mrs_banked_exc_checks(env, tgtmode, regno); | |
534 | ||
535 | switch (regno) { | |
536 | case 16: /* SPSRs */ | |
537 | env->banked_spsr[bank_number(tgtmode)] = value; | |
538 | break; | |
539 | case 17: /* ELR_Hyp */ | |
540 | env->elr_el[2] = value; | |
541 | break; | |
542 | case 13: | |
543 | env->banked_r13[bank_number(tgtmode)] = value; | |
544 | break; | |
545 | case 14: | |
593cfa2b | 546 | env->banked_r14[r14_bank_number(tgtmode)] = value; |
8bfd0550 PM |
547 | break; |
548 | case 8 ... 12: | |
549 | switch (tgtmode) { | |
550 | case ARM_CPU_MODE_USR: | |
551 | env->usr_regs[regno - 8] = value; | |
552 | break; | |
553 | case ARM_CPU_MODE_FIQ: | |
554 | env->fiq_regs[regno - 8] = value; | |
555 | break; | |
556 | default: | |
557 | g_assert_not_reached(); | |
558 | } | |
559 | break; | |
560 | default: | |
561 | g_assert_not_reached(); | |
562 | } | |
563 | } | |
564 | ||
565 | uint32_t HELPER(mrs_banked)(CPUARMState *env, uint32_t tgtmode, uint32_t regno) | |
566 | { | |
567 | msr_mrs_banked_exc_checks(env, tgtmode, regno); | |
568 | ||
569 | switch (regno) { | |
570 | case 16: /* SPSRs */ | |
571 | return env->banked_spsr[bank_number(tgtmode)]; | |
572 | case 17: /* ELR_Hyp */ | |
573 | return env->elr_el[2]; | |
574 | case 13: | |
575 | return env->banked_r13[bank_number(tgtmode)]; | |
576 | case 14: | |
593cfa2b | 577 | return env->banked_r14[r14_bank_number(tgtmode)]; |
8bfd0550 PM |
578 | case 8 ... 12: |
579 | switch (tgtmode) { | |
580 | case ARM_CPU_MODE_USR: | |
581 | return env->usr_regs[regno - 8]; | |
582 | case ARM_CPU_MODE_FIQ: | |
583 | return env->fiq_regs[regno - 8]; | |
584 | default: | |
585 | g_assert_not_reached(); | |
586 | } | |
587 | default: | |
588 | g_assert_not_reached(); | |
589 | } | |
590 | } | |
591 | ||
3f208fd7 PM |
592 | void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome, |
593 | uint32_t isread) | |
f59df3f2 PM |
594 | { |
595 | const ARMCPRegInfo *ri = rip; | |
38836a2c | 596 | int target_el; |
c0f4af17 PM |
597 | |
598 | if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14 | |
599 | && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) { | |
c6328599 | 600 | raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env)); |
c0f4af17 PM |
601 | } |
602 | ||
603 | if (!ri->accessfn) { | |
604 | return; | |
605 | } | |
606 | ||
3f208fd7 | 607 | switch (ri->accessfn(env, ri, isread)) { |
f59df3f2 PM |
608 | case CP_ACCESS_OK: |
609 | return; | |
610 | case CP_ACCESS_TRAP: | |
38836a2c PM |
611 | target_el = exception_target_el(env); |
612 | break; | |
613 | case CP_ACCESS_TRAP_EL2: | |
614 | /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is | |
615 | * a bug in the access function. | |
616 | */ | |
3fc827d5 | 617 | assert(!arm_is_secure(env) && arm_current_el(env) != 3); |
38836a2c PM |
618 | target_el = 2; |
619 | break; | |
620 | case CP_ACCESS_TRAP_EL3: | |
621 | target_el = 3; | |
8bcbf37c | 622 | break; |
f59df3f2 | 623 | case CP_ACCESS_TRAP_UNCATEGORIZED: |
38836a2c | 624 | target_el = exception_target_el(env); |
c6328599 | 625 | syndrome = syn_uncategorized(); |
f59df3f2 | 626 | break; |
e7615726 PM |
627 | case CP_ACCESS_TRAP_UNCATEGORIZED_EL2: |
628 | target_el = 2; | |
629 | syndrome = syn_uncategorized(); | |
630 | break; | |
631 | case CP_ACCESS_TRAP_UNCATEGORIZED_EL3: | |
632 | target_el = 3; | |
633 | syndrome = syn_uncategorized(); | |
634 | break; | |
f2cae609 PM |
635 | case CP_ACCESS_TRAP_FP_EL2: |
636 | target_el = 2; | |
637 | /* Since we are an implementation that takes exceptions on a trapped | |
638 | * conditional insn only if the insn has passed its condition code | |
639 | * check, we take the IMPDEF choice to always report CV=1 COND=0xe | |
640 | * (which is also the required value for AArch64 traps). | |
641 | */ | |
642 | syndrome = syn_fp_access_trap(1, 0xe, false); | |
643 | break; | |
644 | case CP_ACCESS_TRAP_FP_EL3: | |
645 | target_el = 3; | |
646 | syndrome = syn_fp_access_trap(1, 0xe, false); | |
647 | break; | |
f59df3f2 PM |
648 | default: |
649 | g_assert_not_reached(); | |
650 | } | |
c6328599 | 651 | |
38836a2c | 652 | raise_exception(env, EXCP_UDEF, syndrome, target_el); |
f59df3f2 PM |
653 | } |
654 | ||
4b6a83fb PM |
655 | void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value) |
656 | { | |
657 | const ARMCPRegInfo *ri = rip; | |
c4241c7d | 658 | |
8d04fb55 JK |
659 | if (ri->type & ARM_CP_IO) { |
660 | qemu_mutex_lock_iothread(); | |
661 | ri->writefn(env, ri, value); | |
662 | qemu_mutex_unlock_iothread(); | |
663 | } else { | |
664 | ri->writefn(env, ri, value); | |
665 | } | |
4b6a83fb PM |
666 | } |
667 | ||
668 | uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip) | |
669 | { | |
670 | const ARMCPRegInfo *ri = rip; | |
8d04fb55 | 671 | uint32_t res; |
c4241c7d | 672 | |
8d04fb55 JK |
673 | if (ri->type & ARM_CP_IO) { |
674 | qemu_mutex_lock_iothread(); | |
675 | res = ri->readfn(env, ri); | |
676 | qemu_mutex_unlock_iothread(); | |
677 | } else { | |
678 | res = ri->readfn(env, ri); | |
679 | } | |
680 | ||
681 | return res; | |
4b6a83fb PM |
682 | } |
683 | ||
684 | void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value) | |
685 | { | |
686 | const ARMCPRegInfo *ri = rip; | |
c4241c7d | 687 | |
8d04fb55 JK |
688 | if (ri->type & ARM_CP_IO) { |
689 | qemu_mutex_lock_iothread(); | |
690 | ri->writefn(env, ri, value); | |
691 | qemu_mutex_unlock_iothread(); | |
692 | } else { | |
693 | ri->writefn(env, ri, value); | |
694 | } | |
4b6a83fb PM |
695 | } |
696 | ||
697 | uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip) | |
698 | { | |
699 | const ARMCPRegInfo *ri = rip; | |
8d04fb55 JK |
700 | uint64_t res; |
701 | ||
702 | if (ri->type & ARM_CP_IO) { | |
703 | qemu_mutex_lock_iothread(); | |
704 | res = ri->readfn(env, ri); | |
705 | qemu_mutex_unlock_iothread(); | |
706 | } else { | |
707 | res = ri->readfn(env, ri); | |
708 | } | |
c4241c7d | 709 | |
8d04fb55 | 710 | return res; |
4b6a83fb | 711 | } |
b0109805 | 712 | |
35979d71 EI |
713 | void HELPER(pre_hvc)(CPUARMState *env) |
714 | { | |
2fc0cc0e | 715 | ARMCPU *cpu = env_archcpu(env); |
dcbff19b | 716 | int cur_el = arm_current_el(env); |
35979d71 EI |
717 | /* FIXME: Use actual secure state. */ |
718 | bool secure = false; | |
719 | bool undef; | |
720 | ||
98128601 RH |
721 | if (arm_is_psci_call(cpu, EXCP_HVC)) { |
722 | /* If PSCI is enabled and this looks like a valid PSCI call then | |
723 | * that overrides the architecturally mandated HVC behaviour. | |
724 | */ | |
725 | return; | |
726 | } | |
727 | ||
39404338 PM |
728 | if (!arm_feature(env, ARM_FEATURE_EL2)) { |
729 | /* If EL2 doesn't exist, HVC always UNDEFs */ | |
730 | undef = true; | |
731 | } else if (arm_feature(env, ARM_FEATURE_EL3)) { | |
732 | /* EL3.HCE has priority over EL2.HCD. */ | |
35979d71 EI |
733 | undef = !(env->cp15.scr_el3 & SCR_HCE); |
734 | } else { | |
735 | undef = env->cp15.hcr_el2 & HCR_HCD; | |
736 | } | |
737 | ||
738 | /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state. | |
739 | * For ARMv8/AArch64, HVC is allowed in EL3. | |
740 | * Note that we've already trapped HVC from EL0 at translation | |
741 | * time. | |
742 | */ | |
743 | if (secure && (!is_a64(env) || cur_el == 1)) { | |
744 | undef = true; | |
745 | } | |
746 | ||
747 | if (undef) { | |
c6328599 PM |
748 | raise_exception(env, EXCP_UDEF, syn_uncategorized(), |
749 | exception_target_el(env)); | |
35979d71 EI |
750 | } |
751 | } | |
752 | ||
e0d6e6a5 EI |
753 | void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome) |
754 | { | |
2fc0cc0e | 755 | ARMCPU *cpu = env_archcpu(env); |
dcbff19b | 756 | int cur_el = arm_current_el(env); |
dbe9d163 | 757 | bool secure = arm_is_secure(env); |
7760da72 LM |
758 | bool smd_flag = env->cp15.scr_el3 & SCR_SMD; |
759 | ||
760 | /* | |
761 | * SMC behaviour is summarized in the following table. | |
762 | * This helper handles the "Trap to EL2" and "Undef insn" cases. | |
763 | * The "Trap to EL3" and "PSCI call" cases are handled in the exception | |
764 | * helper. | |
765 | * | |
766 | * -> ARM_FEATURE_EL3 and !SMD | |
767 | * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1 | |
768 | * | |
769 | * Conduit SMC, valid call Trap to EL2 PSCI Call | |
770 | * Conduit SMC, inval call Trap to EL2 Trap to EL3 | |
771 | * Conduit not SMC Trap to EL2 Trap to EL3 | |
772 | * | |
773 | * | |
774 | * -> ARM_FEATURE_EL3 and SMD | |
775 | * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1 | |
776 | * | |
777 | * Conduit SMC, valid call Trap to EL2 PSCI Call | |
778 | * Conduit SMC, inval call Trap to EL2 Undef insn | |
779 | * Conduit not SMC Trap to EL2 Undef insn | |
780 | * | |
781 | * | |
782 | * -> !ARM_FEATURE_EL3 | |
783 | * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1 | |
784 | * | |
785 | * Conduit SMC, valid call Trap to EL2 PSCI Call | |
786 | * Conduit SMC, inval call Trap to EL2 Undef insn | |
787 | * Conduit not SMC Undef insn Undef insn | |
788 | */ | |
789 | ||
f096e92b PM |
790 | /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state. |
791 | * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization | |
792 | * extensions, SMD only applies to NS state. | |
793 | * On ARMv7 without the Virtualization extensions, the SMD bit | |
794 | * doesn't exist, but we forbid the guest to set it to 1 in scr_write(), | |
795 | * so we need not special case this here. | |
e0d6e6a5 | 796 | */ |
7760da72 LM |
797 | bool smd = arm_feature(env, ARM_FEATURE_AARCH64) ? smd_flag |
798 | : smd_flag && !secure; | |
e0d6e6a5 | 799 | |
77077a83 JK |
800 | if (!arm_feature(env, ARM_FEATURE_EL3) && |
801 | cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { | |
802 | /* If we have no EL3 then SMC always UNDEFs and can't be | |
803 | * trapped to EL2. PSCI-via-SMC is a sort of ersatz EL3 | |
804 | * firmware within QEMU, and we want an EL2 guest to be able | |
805 | * to forbid its EL1 from making PSCI calls into QEMU's | |
806 | * "firmware" via HCR.TSC, so for these purposes treat | |
807 | * PSCI-via-SMC as implying an EL3. | |
7760da72 | 808 | * This handles the very last line of the previous table. |
98128601 | 809 | */ |
7760da72 LM |
810 | raise_exception(env, EXCP_UDEF, syn_uncategorized(), |
811 | exception_target_el(env)); | |
812 | } | |
813 | ||
7c208e0f | 814 | if (cur_el == 1 && (arm_hcr_el2_eff(env) & HCR_TSC)) { |
77077a83 JK |
815 | /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. |
816 | * We also want an EL2 guest to be able to forbid its EL1 from | |
817 | * making PSCI calls into QEMU's "firmware" via HCR.TSC. | |
7760da72 | 818 | * This handles all the "Trap to EL2" cases of the previous table. |
77077a83 | 819 | */ |
c6328599 | 820 | raise_exception(env, EXCP_HYP_TRAP, syndrome, 2); |
e0d6e6a5 EI |
821 | } |
822 | ||
7760da72 LM |
823 | /* Catch the two remaining "Undef insn" cases of the previous table: |
824 | * - PSCI conduit is SMC but we don't have a valid PCSI call, | |
825 | * - We don't have EL3 or SMD is set. | |
77077a83 | 826 | */ |
7760da72 LM |
827 | if (!arm_is_psci_call(cpu, EXCP_SMC) && |
828 | (smd || !arm_feature(env, ARM_FEATURE_EL3))) { | |
c6328599 PM |
829 | raise_exception(env, EXCP_UDEF, syn_uncategorized(), |
830 | exception_target_el(env)); | |
e0d6e6a5 EI |
831 | } |
832 | } | |
833 | ||
8984bd2e PB |
834 | /* ??? Flag setting arithmetic is awkward because we need to do comparisons. |
835 | The only way to do that in TCG is a conditional branch, which clobbers | |
836 | all our temporaries. For now implement these as helper functions. */ | |
837 | ||
8984bd2e PB |
838 | /* Similarly for variable shift instructions. */ |
839 | ||
9ef39277 | 840 | uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i) |
8984bd2e PB |
841 | { |
842 | int shift = i & 0xff; | |
843 | if (shift >= 32) { | |
844 | if (shift == 32) | |
845 | env->CF = x & 1; | |
846 | else | |
847 | env->CF = 0; | |
848 | return 0; | |
849 | } else if (shift != 0) { | |
850 | env->CF = (x >> (32 - shift)) & 1; | |
851 | return x << shift; | |
852 | } | |
853 | return x; | |
854 | } | |
855 | ||
9ef39277 | 856 | uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i) |
8984bd2e PB |
857 | { |
858 | int shift = i & 0xff; | |
859 | if (shift >= 32) { | |
860 | if (shift == 32) | |
861 | env->CF = (x >> 31) & 1; | |
862 | else | |
863 | env->CF = 0; | |
864 | return 0; | |
865 | } else if (shift != 0) { | |
866 | env->CF = (x >> (shift - 1)) & 1; | |
867 | return x >> shift; | |
868 | } | |
869 | return x; | |
870 | } | |
871 | ||
9ef39277 | 872 | uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i) |
8984bd2e PB |
873 | { |
874 | int shift = i & 0xff; | |
875 | if (shift >= 32) { | |
876 | env->CF = (x >> 31) & 1; | |
877 | return (int32_t)x >> 31; | |
878 | } else if (shift != 0) { | |
879 | env->CF = (x >> (shift - 1)) & 1; | |
880 | return (int32_t)x >> shift; | |
881 | } | |
882 | return x; | |
883 | } | |
884 | ||
9ef39277 | 885 | uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i) |
8984bd2e PB |
886 | { |
887 | int shift1, shift; | |
888 | shift1 = i & 0xff; | |
889 | shift = shift1 & 0x1f; | |
890 | if (shift == 0) { | |
891 | if (shift1 != 0) | |
892 | env->CF = (x >> 31) & 1; | |
893 | return x; | |
894 | } else { | |
895 | env->CF = (x >> (shift - 1)) & 1; | |
896 | return ((uint32_t)x >> shift) | (x << (32 - shift)); | |
897 | } | |
898 | } | |
6cdca173 SO |
899 | |
900 | void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in) | |
901 | { | |
902 | /* | |
903 | * Implement DC ZVA, which zeroes a fixed-length block of memory. | |
904 | * Note that we do not implement the (architecturally mandated) | |
905 | * alignment fault for attempts to use this on Device memory | |
906 | * (which matches the usual QEMU behaviour of not implementing either | |
907 | * alignment faults or any memory attribute handling). | |
908 | */ | |
909 | ||
910 | ARMCPU *cpu = env_archcpu(env); | |
911 | uint64_t blocklen = 4 << cpu->dcz_blocksize; | |
912 | uint64_t vaddr = vaddr_in & ~(blocklen - 1); | |
913 | ||
914 | #ifndef CONFIG_USER_ONLY | |
915 | { | |
916 | /* | |
917 | * Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than | |
918 | * the block size so we might have to do more than one TLB lookup. | |
919 | * We know that in fact for any v8 CPU the page size is at least 4K | |
920 | * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only | |
921 | * 1K as an artefact of legacy v5 subpage support being present in the | |
922 | * same QEMU executable. So in practice the hostaddr[] array has | |
923 | * two entries, given the current setting of TARGET_PAGE_BITS_MIN. | |
924 | */ | |
925 | int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE); | |
926 | void *hostaddr[DIV_ROUND_UP(2 * KiB, 1 << TARGET_PAGE_BITS_MIN)]; | |
927 | int try, i; | |
928 | unsigned mmu_idx = cpu_mmu_index(env, false); | |
929 | TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx); | |
930 | ||
931 | assert(maxidx <= ARRAY_SIZE(hostaddr)); | |
932 | ||
933 | for (try = 0; try < 2; try++) { | |
934 | ||
935 | for (i = 0; i < maxidx; i++) { | |
936 | hostaddr[i] = tlb_vaddr_to_host(env, | |
937 | vaddr + TARGET_PAGE_SIZE * i, | |
938 | 1, mmu_idx); | |
939 | if (!hostaddr[i]) { | |
940 | break; | |
941 | } | |
942 | } | |
943 | if (i == maxidx) { | |
944 | /* | |
945 | * If it's all in the TLB it's fair game for just writing to; | |
946 | * we know we don't need to update dirty status, etc. | |
947 | */ | |
948 | for (i = 0; i < maxidx - 1; i++) { | |
949 | memset(hostaddr[i], 0, TARGET_PAGE_SIZE); | |
950 | } | |
951 | memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE)); | |
952 | return; | |
953 | } | |
954 | /* | |
955 | * OK, try a store and see if we can populate the tlb. This | |
956 | * might cause an exception if the memory isn't writable, | |
957 | * in which case we will longjmp out of here. We must for | |
958 | * this purpose use the actual register value passed to us | |
959 | * so that we get the fault address right. | |
960 | */ | |
961 | helper_ret_stb_mmu(env, vaddr_in, 0, oi, GETPC()); | |
962 | /* Now we can populate the other TLB entries, if any */ | |
963 | for (i = 0; i < maxidx; i++) { | |
964 | uint64_t va = vaddr + TARGET_PAGE_SIZE * i; | |
965 | if (va != (vaddr_in & TARGET_PAGE_MASK)) { | |
966 | helper_ret_stb_mmu(env, va, 0, oi, GETPC()); | |
967 | } | |
968 | } | |
969 | } | |
970 | ||
971 | /* | |
972 | * Slow path (probably attempt to do this to an I/O device or | |
973 | * similar, or clearing of a block of code we have translations | |
974 | * cached for). Just do a series of byte writes as the architecture | |
975 | * demands. It's not worth trying to use a cpu_physical_memory_map(), | |
976 | * memset(), unmap() sequence here because: | |
977 | * + we'd need to account for the blocksize being larger than a page | |
978 | * + the direct-RAM access case is almost always going to be dealt | |
979 | * with in the fastpath code above, so there's no speed benefit | |
980 | * + we would have to deal with the map returning NULL because the | |
981 | * bounce buffer was in use | |
982 | */ | |
983 | for (i = 0; i < blocklen; i++) { | |
984 | helper_ret_stb_mmu(env, vaddr + i, 0, oi, GETPC()); | |
985 | } | |
986 | } | |
987 | #else | |
988 | memset(g2h(vaddr), 0, blocklen); | |
989 | #endif | |
990 | } |