9 #include "qemu-common.h"
10 #include "host-utils.h"
11 #if !defined(CONFIG_USER_ONLY)
12 #include "hw/loader.h"
15 static uint32_t cortexa9_cp15_c0_c1
[8] =
16 { 0x1031, 0x11, 0x000, 0, 0x00100103, 0x20000000, 0x01230000, 0x00002111 };
18 static uint32_t cortexa9_cp15_c0_c2
[8] =
19 { 0x00101111, 0x13112111, 0x21232041, 0x11112131, 0x00111142, 0, 0, 0 };
21 static uint32_t cortexa8_cp15_c0_c1
[8] =
22 { 0x1031, 0x11, 0x400, 0, 0x31100003, 0x20000000, 0x01202000, 0x11 };
24 static uint32_t cortexa8_cp15_c0_c2
[8] =
25 { 0x00101111, 0x12112111, 0x21232031, 0x11112131, 0x00111142, 0, 0, 0 };
27 static uint32_t mpcore_cp15_c0_c1
[8] =
28 { 0x111, 0x1, 0, 0x2, 0x01100103, 0x10020302, 0x01222000, 0 };
30 static uint32_t mpcore_cp15_c0_c2
[8] =
31 { 0x00100011, 0x12002111, 0x11221011, 0x01102131, 0x141, 0, 0, 0 };
33 static uint32_t arm1136_cp15_c0_c1
[8] =
34 { 0x111, 0x1, 0x2, 0x3, 0x01130003, 0x10030302, 0x01222110, 0 };
36 static uint32_t arm1136_cp15_c0_c2
[8] =
37 { 0x00140011, 0x12002111, 0x11231111, 0x01102131, 0x141, 0, 0, 0 };
39 static uint32_t cpu_arm_find_by_name(const char *name
);
41 static inline void set_feature(CPUARMState
*env
, int feature
)
43 env
->features
|= 1u << feature
;
46 static void cpu_reset_model_id(CPUARMState
*env
, uint32_t id
)
48 env
->cp15
.c0_cpuid
= id
;
50 case ARM_CPUID_ARM926
:
51 set_feature(env
, ARM_FEATURE_V4T
);
52 set_feature(env
, ARM_FEATURE_V5
);
53 set_feature(env
, ARM_FEATURE_VFP
);
54 env
->vfp
.xregs
[ARM_VFP_FPSID
] = 0x41011090;
55 env
->cp15
.c0_cachetype
= 0x1dd20d2;
56 env
->cp15
.c1_sys
= 0x00090078;
58 case ARM_CPUID_ARM946
:
59 set_feature(env
, ARM_FEATURE_V4T
);
60 set_feature(env
, ARM_FEATURE_V5
);
61 set_feature(env
, ARM_FEATURE_MPU
);
62 env
->cp15
.c0_cachetype
= 0x0f004006;
63 env
->cp15
.c1_sys
= 0x00000078;
65 case ARM_CPUID_ARM1026
:
66 set_feature(env
, ARM_FEATURE_V4T
);
67 set_feature(env
, ARM_FEATURE_V5
);
68 set_feature(env
, ARM_FEATURE_VFP
);
69 set_feature(env
, ARM_FEATURE_AUXCR
);
70 env
->vfp
.xregs
[ARM_VFP_FPSID
] = 0x410110a0;
71 env
->cp15
.c0_cachetype
= 0x1dd20d2;
72 env
->cp15
.c1_sys
= 0x00090078;
74 case ARM_CPUID_ARM1136_R2
:
75 case ARM_CPUID_ARM1136
:
76 set_feature(env
, ARM_FEATURE_V4T
);
77 set_feature(env
, ARM_FEATURE_V5
);
78 set_feature(env
, ARM_FEATURE_V6
);
79 set_feature(env
, ARM_FEATURE_VFP
);
80 set_feature(env
, ARM_FEATURE_AUXCR
);
81 env
->vfp
.xregs
[ARM_VFP_FPSID
] = 0x410120b4;
82 env
->vfp
.xregs
[ARM_VFP_MVFR0
] = 0x11111111;
83 env
->vfp
.xregs
[ARM_VFP_MVFR1
] = 0x00000000;
84 memcpy(env
->cp15
.c0_c1
, arm1136_cp15_c0_c1
, 8 * sizeof(uint32_t));
85 memcpy(env
->cp15
.c0_c2
, arm1136_cp15_c0_c2
, 8 * sizeof(uint32_t));
86 env
->cp15
.c0_cachetype
= 0x1dd20d2;
87 env
->cp15
.c1_sys
= 0x00050078;
89 case ARM_CPUID_ARM11MPCORE
:
90 set_feature(env
, ARM_FEATURE_V4T
);
91 set_feature(env
, ARM_FEATURE_V5
);
92 set_feature(env
, ARM_FEATURE_V6
);
93 set_feature(env
, ARM_FEATURE_V6K
);
94 set_feature(env
, ARM_FEATURE_VFP
);
95 set_feature(env
, ARM_FEATURE_AUXCR
);
96 env
->vfp
.xregs
[ARM_VFP_FPSID
] = 0x410120b4;
97 env
->vfp
.xregs
[ARM_VFP_MVFR0
] = 0x11111111;
98 env
->vfp
.xregs
[ARM_VFP_MVFR1
] = 0x00000000;
99 memcpy(env
->cp15
.c0_c1
, mpcore_cp15_c0_c1
, 8 * sizeof(uint32_t));
100 memcpy(env
->cp15
.c0_c2
, mpcore_cp15_c0_c2
, 8 * sizeof(uint32_t));
101 env
->cp15
.c0_cachetype
= 0x1dd20d2;
103 case ARM_CPUID_CORTEXA8
:
104 set_feature(env
, ARM_FEATURE_V4T
);
105 set_feature(env
, ARM_FEATURE_V5
);
106 set_feature(env
, ARM_FEATURE_V6
);
107 set_feature(env
, ARM_FEATURE_V6K
);
108 set_feature(env
, ARM_FEATURE_V7
);
109 set_feature(env
, ARM_FEATURE_AUXCR
);
110 set_feature(env
, ARM_FEATURE_THUMB2
);
111 set_feature(env
, ARM_FEATURE_VFP
);
112 set_feature(env
, ARM_FEATURE_VFP3
);
113 set_feature(env
, ARM_FEATURE_NEON
);
114 set_feature(env
, ARM_FEATURE_THUMB2EE
);
115 env
->vfp
.xregs
[ARM_VFP_FPSID
] = 0x410330c0;
116 env
->vfp
.xregs
[ARM_VFP_MVFR0
] = 0x11110222;
117 env
->vfp
.xregs
[ARM_VFP_MVFR1
] = 0x00011100;
118 memcpy(env
->cp15
.c0_c1
, cortexa8_cp15_c0_c1
, 8 * sizeof(uint32_t));
119 memcpy(env
->cp15
.c0_c2
, cortexa8_cp15_c0_c2
, 8 * sizeof(uint32_t));
120 env
->cp15
.c0_cachetype
= 0x82048004;
121 env
->cp15
.c0_clid
= (1 << 27) | (2 << 24) | 3;
122 env
->cp15
.c0_ccsid
[0] = 0xe007e01a; /* 16k L1 dcache. */
123 env
->cp15
.c0_ccsid
[1] = 0x2007e01a; /* 16k L1 icache. */
124 env
->cp15
.c0_ccsid
[2] = 0xf0000000; /* No L2 icache. */
125 env
->cp15
.c1_sys
= 0x00c50078;
127 case ARM_CPUID_CORTEXA9
:
128 set_feature(env
, ARM_FEATURE_V4T
);
129 set_feature(env
, ARM_FEATURE_V5
);
130 set_feature(env
, ARM_FEATURE_V6
);
131 set_feature(env
, ARM_FEATURE_V6K
);
132 set_feature(env
, ARM_FEATURE_V7
);
133 set_feature(env
, ARM_FEATURE_AUXCR
);
134 set_feature(env
, ARM_FEATURE_THUMB2
);
135 set_feature(env
, ARM_FEATURE_VFP
);
136 set_feature(env
, ARM_FEATURE_VFP3
);
137 set_feature(env
, ARM_FEATURE_VFP_FP16
);
138 set_feature(env
, ARM_FEATURE_NEON
);
139 set_feature(env
, ARM_FEATURE_THUMB2EE
);
140 /* Note that A9 supports the MP extensions even for
141 * A9UP and single-core A9MP (which are both different
142 * and valid configurations; we don't model A9UP).
144 set_feature(env
, ARM_FEATURE_V7MP
);
145 env
->vfp
.xregs
[ARM_VFP_FPSID
] = 0x41034000; /* Guess */
146 env
->vfp
.xregs
[ARM_VFP_MVFR0
] = 0x11110222;
147 env
->vfp
.xregs
[ARM_VFP_MVFR1
] = 0x01111111;
148 memcpy(env
->cp15
.c0_c1
, cortexa9_cp15_c0_c1
, 8 * sizeof(uint32_t));
149 memcpy(env
->cp15
.c0_c2
, cortexa9_cp15_c0_c2
, 8 * sizeof(uint32_t));
150 env
->cp15
.c0_cachetype
= 0x80038003;
151 env
->cp15
.c0_clid
= (1 << 27) | (1 << 24) | 3;
152 env
->cp15
.c0_ccsid
[0] = 0xe00fe015; /* 16k L1 dcache. */
153 env
->cp15
.c0_ccsid
[1] = 0x200fe015; /* 16k L1 icache. */
154 env
->cp15
.c1_sys
= 0x00c50078;
156 case ARM_CPUID_CORTEXM3
:
157 set_feature(env
, ARM_FEATURE_V4T
);
158 set_feature(env
, ARM_FEATURE_V5
);
159 set_feature(env
, ARM_FEATURE_V6
);
160 set_feature(env
, ARM_FEATURE_THUMB2
);
161 set_feature(env
, ARM_FEATURE_V7
);
162 set_feature(env
, ARM_FEATURE_M
);
163 set_feature(env
, ARM_FEATURE_DIV
);
165 case ARM_CPUID_ANY
: /* For userspace emulation. */
166 set_feature(env
, ARM_FEATURE_V4T
);
167 set_feature(env
, ARM_FEATURE_V5
);
168 set_feature(env
, ARM_FEATURE_V6
);
169 set_feature(env
, ARM_FEATURE_V6K
);
170 set_feature(env
, ARM_FEATURE_V7
);
171 set_feature(env
, ARM_FEATURE_THUMB2
);
172 set_feature(env
, ARM_FEATURE_VFP
);
173 set_feature(env
, ARM_FEATURE_VFP3
);
174 set_feature(env
, ARM_FEATURE_VFP_FP16
);
175 set_feature(env
, ARM_FEATURE_NEON
);
176 set_feature(env
, ARM_FEATURE_THUMB2EE
);
177 set_feature(env
, ARM_FEATURE_DIV
);
178 set_feature(env
, ARM_FEATURE_V7MP
);
180 case ARM_CPUID_TI915T
:
181 case ARM_CPUID_TI925T
:
182 set_feature(env
, ARM_FEATURE_V4T
);
183 set_feature(env
, ARM_FEATURE_OMAPCP
);
184 env
->cp15
.c0_cpuid
= ARM_CPUID_TI925T
; /* Depends on wiring. */
185 env
->cp15
.c0_cachetype
= 0x5109149;
186 env
->cp15
.c1_sys
= 0x00000070;
187 env
->cp15
.c15_i_max
= 0x000;
188 env
->cp15
.c15_i_min
= 0xff0;
190 case ARM_CPUID_PXA250
:
191 case ARM_CPUID_PXA255
:
192 case ARM_CPUID_PXA260
:
193 case ARM_CPUID_PXA261
:
194 case ARM_CPUID_PXA262
:
195 set_feature(env
, ARM_FEATURE_V4T
);
196 set_feature(env
, ARM_FEATURE_V5
);
197 set_feature(env
, ARM_FEATURE_XSCALE
);
198 /* JTAG_ID is ((id << 28) | 0x09265013) */
199 env
->cp15
.c0_cachetype
= 0xd172172;
200 env
->cp15
.c1_sys
= 0x00000078;
202 case ARM_CPUID_PXA270_A0
:
203 case ARM_CPUID_PXA270_A1
:
204 case ARM_CPUID_PXA270_B0
:
205 case ARM_CPUID_PXA270_B1
:
206 case ARM_CPUID_PXA270_C0
:
207 case ARM_CPUID_PXA270_C5
:
208 set_feature(env
, ARM_FEATURE_V4T
);
209 set_feature(env
, ARM_FEATURE_V5
);
210 set_feature(env
, ARM_FEATURE_XSCALE
);
211 /* JTAG_ID is ((id << 28) | 0x09265013) */
212 set_feature(env
, ARM_FEATURE_IWMMXT
);
213 env
->iwmmxt
.cregs
[ARM_IWMMXT_wCID
] = 0x69051000 | 'Q';
214 env
->cp15
.c0_cachetype
= 0xd172172;
215 env
->cp15
.c1_sys
= 0x00000078;
217 case ARM_CPUID_SA1100
:
218 case ARM_CPUID_SA1110
:
219 set_feature(env
, ARM_FEATURE_STRONGARM
);
220 env
->cp15
.c1_sys
= 0x00000070;
223 cpu_abort(env
, "Bad CPU ID: %x\n", id
);
228 void cpu_reset(CPUARMState
*env
)
232 if (qemu_loglevel_mask(CPU_LOG_RESET
)) {
233 qemu_log("CPU Reset (CPU %d)\n", env
->cpu_index
);
234 log_cpu_state(env
, 0);
237 id
= env
->cp15
.c0_cpuid
;
238 memset(env
, 0, offsetof(CPUARMState
, breakpoints
));
240 cpu_reset_model_id(env
, id
);
241 #if defined (CONFIG_USER_ONLY)
242 env
->uncached_cpsr
= ARM_CPU_MODE_USR
;
243 /* For user mode we must enable access to coprocessors */
244 env
->vfp
.xregs
[ARM_VFP_FPEXC
] = 1 << 30;
245 if (arm_feature(env
, ARM_FEATURE_IWMMXT
)) {
246 env
->cp15
.c15_cpar
= 3;
247 } else if (arm_feature(env
, ARM_FEATURE_XSCALE
)) {
248 env
->cp15
.c15_cpar
= 1;
251 /* SVC mode with interrupts disabled. */
252 env
->uncached_cpsr
= ARM_CPU_MODE_SVC
| CPSR_A
| CPSR_F
| CPSR_I
;
253 /* On ARMv7-M the CPSR_I is the value of the PRIMASK register, and is
254 clear at reset. Initial SP and PC are loaded from ROM. */
258 env
->uncached_cpsr
&= ~CPSR_I
;
261 /* We should really use ldl_phys here, in case the guest
262 modified flash and reset itself. However images
263 loaded via -kenrel have not been copied yet, so load the
264 values directly from there. */
265 env
->regs
[13] = ldl_p(rom
);
268 env
->regs
[15] = pc
& ~1;
271 env
->vfp
.xregs
[ARM_VFP_FPEXC
] = 0;
272 env
->cp15
.c2_base_mask
= 0xffffc000u
;
273 /* v7 performance monitor control register: same implementor
274 * field as main ID register, and we implement no event counters.
276 env
->cp15
.c9_pmcr
= (id
& 0xff000000);
278 set_flush_to_zero(1, &env
->vfp
.standard_fp_status
);
279 set_flush_inputs_to_zero(1, &env
->vfp
.standard_fp_status
);
280 set_default_nan_mode(1, &env
->vfp
.standard_fp_status
);
281 set_float_detect_tininess(float_tininess_before_rounding
,
282 &env
->vfp
.fp_status
);
283 set_float_detect_tininess(float_tininess_before_rounding
,
284 &env
->vfp
.standard_fp_status
);
288 static int vfp_gdb_get_reg(CPUState
*env
, uint8_t *buf
, int reg
)
292 /* VFP data registers are always little-endian. */
293 nregs
= arm_feature(env
, ARM_FEATURE_VFP3
) ? 32 : 16;
295 stfq_le_p(buf
, env
->vfp
.regs
[reg
]);
298 if (arm_feature(env
, ARM_FEATURE_NEON
)) {
299 /* Aliases for Q regs. */
302 stfq_le_p(buf
, env
->vfp
.regs
[(reg
- 32) * 2]);
303 stfq_le_p(buf
+ 8, env
->vfp
.regs
[(reg
- 32) * 2 + 1]);
307 switch (reg
- nregs
) {
308 case 0: stl_p(buf
, env
->vfp
.xregs
[ARM_VFP_FPSID
]); return 4;
309 case 1: stl_p(buf
, env
->vfp
.xregs
[ARM_VFP_FPSCR
]); return 4;
310 case 2: stl_p(buf
, env
->vfp
.xregs
[ARM_VFP_FPEXC
]); return 4;
315 static int vfp_gdb_set_reg(CPUState
*env
, uint8_t *buf
, int reg
)
319 nregs
= arm_feature(env
, ARM_FEATURE_VFP3
) ? 32 : 16;
321 env
->vfp
.regs
[reg
] = ldfq_le_p(buf
);
324 if (arm_feature(env
, ARM_FEATURE_NEON
)) {
327 env
->vfp
.regs
[(reg
- 32) * 2] = ldfq_le_p(buf
);
328 env
->vfp
.regs
[(reg
- 32) * 2 + 1] = ldfq_le_p(buf
+ 8);
332 switch (reg
- nregs
) {
333 case 0: env
->vfp
.xregs
[ARM_VFP_FPSID
] = ldl_p(buf
); return 4;
334 case 1: env
->vfp
.xregs
[ARM_VFP_FPSCR
] = ldl_p(buf
); return 4;
335 case 2: env
->vfp
.xregs
[ARM_VFP_FPEXC
] = ldl_p(buf
) & (1 << 30); return 4;
340 CPUARMState
*cpu_arm_init(const char *cpu_model
)
344 static int inited
= 0;
346 id
= cpu_arm_find_by_name(cpu_model
);
349 env
= qemu_mallocz(sizeof(CPUARMState
));
353 arm_translate_init();
356 env
->cpu_model_str
= cpu_model
;
357 env
->cp15
.c0_cpuid
= id
;
359 if (arm_feature(env
, ARM_FEATURE_NEON
)) {
360 gdb_register_coprocessor(env
, vfp_gdb_get_reg
, vfp_gdb_set_reg
,
361 51, "arm-neon.xml", 0);
362 } else if (arm_feature(env
, ARM_FEATURE_VFP3
)) {
363 gdb_register_coprocessor(env
, vfp_gdb_get_reg
, vfp_gdb_set_reg
,
364 35, "arm-vfp3.xml", 0);
365 } else if (arm_feature(env
, ARM_FEATURE_VFP
)) {
366 gdb_register_coprocessor(env
, vfp_gdb_get_reg
, vfp_gdb_set_reg
,
367 19, "arm-vfp.xml", 0);
378 static const struct arm_cpu_t arm_cpu_names
[] = {
379 { ARM_CPUID_ARM926
, "arm926"},
380 { ARM_CPUID_ARM946
, "arm946"},
381 { ARM_CPUID_ARM1026
, "arm1026"},
382 { ARM_CPUID_ARM1136
, "arm1136"},
383 { ARM_CPUID_ARM1136_R2
, "arm1136-r2"},
384 { ARM_CPUID_ARM11MPCORE
, "arm11mpcore"},
385 { ARM_CPUID_CORTEXM3
, "cortex-m3"},
386 { ARM_CPUID_CORTEXA8
, "cortex-a8"},
387 { ARM_CPUID_CORTEXA9
, "cortex-a9"},
388 { ARM_CPUID_TI925T
, "ti925t" },
389 { ARM_CPUID_PXA250
, "pxa250" },
390 { ARM_CPUID_SA1100
, "sa1100" },
391 { ARM_CPUID_SA1110
, "sa1110" },
392 { ARM_CPUID_PXA255
, "pxa255" },
393 { ARM_CPUID_PXA260
, "pxa260" },
394 { ARM_CPUID_PXA261
, "pxa261" },
395 { ARM_CPUID_PXA262
, "pxa262" },
396 { ARM_CPUID_PXA270
, "pxa270" },
397 { ARM_CPUID_PXA270_A0
, "pxa270-a0" },
398 { ARM_CPUID_PXA270_A1
, "pxa270-a1" },
399 { ARM_CPUID_PXA270_B0
, "pxa270-b0" },
400 { ARM_CPUID_PXA270_B1
, "pxa270-b1" },
401 { ARM_CPUID_PXA270_C0
, "pxa270-c0" },
402 { ARM_CPUID_PXA270_C5
, "pxa270-c5" },
403 { ARM_CPUID_ANY
, "any"},
407 void arm_cpu_list(FILE *f
, fprintf_function cpu_fprintf
)
411 (*cpu_fprintf
)(f
, "Available CPUs:\n");
412 for (i
= 0; arm_cpu_names
[i
].name
; i
++) {
413 (*cpu_fprintf
)(f
, " %s\n", arm_cpu_names
[i
].name
);
417 /* return 0 if not found */
418 static uint32_t cpu_arm_find_by_name(const char *name
)
424 for (i
= 0; arm_cpu_names
[i
].name
; i
++) {
425 if (strcmp(name
, arm_cpu_names
[i
].name
) == 0) {
426 id
= arm_cpu_names
[i
].id
;
433 void cpu_arm_close(CPUARMState
*env
)
438 uint32_t cpsr_read(CPUARMState
*env
)
442 return env
->uncached_cpsr
| (env
->NF
& 0x80000000) | (ZF
<< 30) |
443 (env
->CF
<< 29) | ((env
->VF
& 0x80000000) >> 3) | (env
->QF
<< 27)
444 | (env
->thumb
<< 5) | ((env
->condexec_bits
& 3) << 25)
445 | ((env
->condexec_bits
& 0xfc) << 8)
449 void cpsr_write(CPUARMState
*env
, uint32_t val
, uint32_t mask
)
451 if (mask
& CPSR_NZCV
) {
452 env
->ZF
= (~val
) & CPSR_Z
;
454 env
->CF
= (val
>> 29) & 1;
455 env
->VF
= (val
<< 3) & 0x80000000;
458 env
->QF
= ((val
& CPSR_Q
) != 0);
460 env
->thumb
= ((val
& CPSR_T
) != 0);
461 if (mask
& CPSR_IT_0_1
) {
462 env
->condexec_bits
&= ~3;
463 env
->condexec_bits
|= (val
>> 25) & 3;
465 if (mask
& CPSR_IT_2_7
) {
466 env
->condexec_bits
&= 3;
467 env
->condexec_bits
|= (val
>> 8) & 0xfc;
469 if (mask
& CPSR_GE
) {
470 env
->GE
= (val
>> 16) & 0xf;
473 if ((env
->uncached_cpsr
^ val
) & mask
& CPSR_M
) {
474 switch_mode(env
, val
& CPSR_M
);
476 mask
&= ~CACHED_CPSR_BITS
;
477 env
->uncached_cpsr
= (env
->uncached_cpsr
& ~mask
) | (val
& mask
);
480 /* Sign/zero extend */
481 uint32_t HELPER(sxtb16
)(uint32_t x
)
484 res
= (uint16_t)(int8_t)x
;
485 res
|= (uint32_t)(int8_t)(x
>> 16) << 16;
489 uint32_t HELPER(uxtb16
)(uint32_t x
)
492 res
= (uint16_t)(uint8_t)x
;
493 res
|= (uint32_t)(uint8_t)(x
>> 16) << 16;
497 uint32_t HELPER(clz
)(uint32_t x
)
502 int32_t HELPER(sdiv
)(int32_t num
, int32_t den
)
506 if (num
== INT_MIN
&& den
== -1)
511 uint32_t HELPER(udiv
)(uint32_t num
, uint32_t den
)
518 uint32_t HELPER(rbit
)(uint32_t x
)
520 x
= ((x
& 0xff000000) >> 24)
521 | ((x
& 0x00ff0000) >> 8)
522 | ((x
& 0x0000ff00) << 8)
523 | ((x
& 0x000000ff) << 24);
524 x
= ((x
& 0xf0f0f0f0) >> 4)
525 | ((x
& 0x0f0f0f0f) << 4);
526 x
= ((x
& 0x88888888) >> 3)
527 | ((x
& 0x44444444) >> 1)
528 | ((x
& 0x22222222) << 1)
529 | ((x
& 0x11111111) << 3);
533 uint32_t HELPER(abs
)(uint32_t x
)
535 return ((int32_t)x
< 0) ? -x
: x
;
538 #if defined(CONFIG_USER_ONLY)
540 void do_interrupt (CPUState
*env
)
542 env
->exception_index
= -1;
545 int cpu_arm_handle_mmu_fault (CPUState
*env
, target_ulong address
, int rw
,
546 int mmu_idx
, int is_softmmu
)
549 env
->exception_index
= EXCP_PREFETCH_ABORT
;
550 env
->cp15
.c6_insn
= address
;
552 env
->exception_index
= EXCP_DATA_ABORT
;
553 env
->cp15
.c6_data
= address
;
558 /* These should probably raise undefined insn exceptions. */
559 void HELPER(set_cp
)(CPUState
*env
, uint32_t insn
, uint32_t val
)
561 int op1
= (insn
>> 8) & 0xf;
562 cpu_abort(env
, "cp%i insn %08x\n", op1
, insn
);
566 uint32_t HELPER(get_cp
)(CPUState
*env
, uint32_t insn
)
568 int op1
= (insn
>> 8) & 0xf;
569 cpu_abort(env
, "cp%i insn %08x\n", op1
, insn
);
573 void HELPER(set_cp15
)(CPUState
*env
, uint32_t insn
, uint32_t val
)
575 cpu_abort(env
, "cp15 insn %08x\n", insn
);
578 uint32_t HELPER(get_cp15
)(CPUState
*env
, uint32_t insn
)
580 cpu_abort(env
, "cp15 insn %08x\n", insn
);
583 /* These should probably raise undefined insn exceptions. */
584 void HELPER(v7m_msr
)(CPUState
*env
, uint32_t reg
, uint32_t val
)
586 cpu_abort(env
, "v7m_mrs %d\n", reg
);
589 uint32_t HELPER(v7m_mrs
)(CPUState
*env
, uint32_t reg
)
591 cpu_abort(env
, "v7m_mrs %d\n", reg
);
595 void switch_mode(CPUState
*env
, int mode
)
597 if (mode
!= ARM_CPU_MODE_USR
)
598 cpu_abort(env
, "Tried to switch out of user mode\n");
601 void HELPER(set_r13_banked
)(CPUState
*env
, uint32_t mode
, uint32_t val
)
603 cpu_abort(env
, "banked r13 write\n");
606 uint32_t HELPER(get_r13_banked
)(CPUState
*env
, uint32_t mode
)
608 cpu_abort(env
, "banked r13 read\n");
614 extern int semihosting_enabled
;
616 /* Map CPU modes onto saved register banks. */
617 static inline int bank_number (int mode
)
620 case ARM_CPU_MODE_USR
:
621 case ARM_CPU_MODE_SYS
:
623 case ARM_CPU_MODE_SVC
:
625 case ARM_CPU_MODE_ABT
:
627 case ARM_CPU_MODE_UND
:
629 case ARM_CPU_MODE_IRQ
:
631 case ARM_CPU_MODE_FIQ
:
634 cpu_abort(cpu_single_env
, "Bad mode %x\n", mode
);
638 void switch_mode(CPUState
*env
, int mode
)
643 old_mode
= env
->uncached_cpsr
& CPSR_M
;
644 if (mode
== old_mode
)
647 if (old_mode
== ARM_CPU_MODE_FIQ
) {
648 memcpy (env
->fiq_regs
, env
->regs
+ 8, 5 * sizeof(uint32_t));
649 memcpy (env
->regs
+ 8, env
->usr_regs
, 5 * sizeof(uint32_t));
650 } else if (mode
== ARM_CPU_MODE_FIQ
) {
651 memcpy (env
->usr_regs
, env
->regs
+ 8, 5 * sizeof(uint32_t));
652 memcpy (env
->regs
+ 8, env
->fiq_regs
, 5 * sizeof(uint32_t));
655 i
= bank_number(old_mode
);
656 env
->banked_r13
[i
] = env
->regs
[13];
657 env
->banked_r14
[i
] = env
->regs
[14];
658 env
->banked_spsr
[i
] = env
->spsr
;
660 i
= bank_number(mode
);
661 env
->regs
[13] = env
->banked_r13
[i
];
662 env
->regs
[14] = env
->banked_r14
[i
];
663 env
->spsr
= env
->banked_spsr
[i
];
666 static void v7m_push(CPUARMState
*env
, uint32_t val
)
669 stl_phys(env
->regs
[13], val
);
672 static uint32_t v7m_pop(CPUARMState
*env
)
675 val
= ldl_phys(env
->regs
[13]);
680 /* Switch to V7M main or process stack pointer. */
681 static void switch_v7m_sp(CPUARMState
*env
, int process
)
684 if (env
->v7m
.current_sp
!= process
) {
685 tmp
= env
->v7m
.other_sp
;
686 env
->v7m
.other_sp
= env
->regs
[13];
688 env
->v7m
.current_sp
= process
;
692 static void do_v7m_exception_exit(CPUARMState
*env
)
697 type
= env
->regs
[15];
698 if (env
->v7m
.exception
!= 0)
699 armv7m_nvic_complete_irq(env
->nvic
, env
->v7m
.exception
);
701 /* Switch to the target stack. */
702 switch_v7m_sp(env
, (type
& 4) != 0);
704 env
->regs
[0] = v7m_pop(env
);
705 env
->regs
[1] = v7m_pop(env
);
706 env
->regs
[2] = v7m_pop(env
);
707 env
->regs
[3] = v7m_pop(env
);
708 env
->regs
[12] = v7m_pop(env
);
709 env
->regs
[14] = v7m_pop(env
);
710 env
->regs
[15] = v7m_pop(env
);
712 xpsr_write(env
, xpsr
, 0xfffffdff);
713 /* Undo stack alignment. */
716 /* ??? The exception return type specifies Thread/Handler mode. However
717 this is also implied by the xPSR value. Not sure what to do
718 if there is a mismatch. */
719 /* ??? Likewise for mismatches between the CONTROL register and the stack
723 static void do_interrupt_v7m(CPUARMState
*env
)
725 uint32_t xpsr
= xpsr_read(env
);
730 if (env
->v7m
.current_sp
)
732 if (env
->v7m
.exception
== 0)
735 /* For exceptions we just mark as pending on the NVIC, and let that
737 /* TODO: Need to escalate if the current priority is higher than the
738 one we're raising. */
739 switch (env
->exception_index
) {
741 armv7m_nvic_set_pending(env
->nvic
, ARMV7M_EXCP_USAGE
);
745 armv7m_nvic_set_pending(env
->nvic
, ARMV7M_EXCP_SVC
);
747 case EXCP_PREFETCH_ABORT
:
748 case EXCP_DATA_ABORT
:
749 armv7m_nvic_set_pending(env
->nvic
, ARMV7M_EXCP_MEM
);
752 if (semihosting_enabled
) {
754 nr
= lduw_code(env
->regs
[15]) & 0xff;
757 env
->regs
[0] = do_arm_semihosting(env
);
761 armv7m_nvic_set_pending(env
->nvic
, ARMV7M_EXCP_DEBUG
);
764 env
->v7m
.exception
= armv7m_nvic_acknowledge_irq(env
->nvic
);
766 case EXCP_EXCEPTION_EXIT
:
767 do_v7m_exception_exit(env
);
770 cpu_abort(env
, "Unhandled exception 0x%x\n", env
->exception_index
);
771 return; /* Never happens. Keep compiler happy. */
774 /* Align stack pointer. */
775 /* ??? Should only do this if Configuration Control Register
776 STACKALIGN bit is set. */
777 if (env
->regs
[13] & 4) {
781 /* Switch to the handler mode. */
783 v7m_push(env
, env
->regs
[15]);
784 v7m_push(env
, env
->regs
[14]);
785 v7m_push(env
, env
->regs
[12]);
786 v7m_push(env
, env
->regs
[3]);
787 v7m_push(env
, env
->regs
[2]);
788 v7m_push(env
, env
->regs
[1]);
789 v7m_push(env
, env
->regs
[0]);
790 switch_v7m_sp(env
, 0);
791 env
->uncached_cpsr
&= ~CPSR_IT
;
793 addr
= ldl_phys(env
->v7m
.vecbase
+ env
->v7m
.exception
* 4);
794 env
->regs
[15] = addr
& 0xfffffffe;
795 env
->thumb
= addr
& 1;
798 /* Handle a CPU exception. */
799 void do_interrupt(CPUARMState
*env
)
807 do_interrupt_v7m(env
);
810 /* TODO: Vectored interrupt controller. */
811 switch (env
->exception_index
) {
813 new_mode
= ARM_CPU_MODE_UND
;
822 if (semihosting_enabled
) {
823 /* Check for semihosting interrupt. */
825 mask
= lduw_code(env
->regs
[15] - 2) & 0xff;
827 mask
= ldl_code(env
->regs
[15] - 4) & 0xffffff;
829 /* Only intercept calls from privileged modes, to provide some
830 semblance of security. */
831 if (((mask
== 0x123456 && !env
->thumb
)
832 || (mask
== 0xab && env
->thumb
))
833 && (env
->uncached_cpsr
& CPSR_M
) != ARM_CPU_MODE_USR
) {
834 env
->regs
[0] = do_arm_semihosting(env
);
838 new_mode
= ARM_CPU_MODE_SVC
;
841 /* The PC already points to the next instruction. */
845 /* See if this is a semihosting syscall. */
846 if (env
->thumb
&& semihosting_enabled
) {
847 mask
= lduw_code(env
->regs
[15]) & 0xff;
849 && (env
->uncached_cpsr
& CPSR_M
) != ARM_CPU_MODE_USR
) {
851 env
->regs
[0] = do_arm_semihosting(env
);
855 env
->cp15
.c5_insn
= 2;
856 /* Fall through to prefetch abort. */
857 case EXCP_PREFETCH_ABORT
:
858 new_mode
= ARM_CPU_MODE_ABT
;
860 mask
= CPSR_A
| CPSR_I
;
863 case EXCP_DATA_ABORT
:
864 new_mode
= ARM_CPU_MODE_ABT
;
866 mask
= CPSR_A
| CPSR_I
;
870 new_mode
= ARM_CPU_MODE_IRQ
;
872 /* Disable IRQ and imprecise data aborts. */
873 mask
= CPSR_A
| CPSR_I
;
877 new_mode
= ARM_CPU_MODE_FIQ
;
879 /* Disable FIQ, IRQ and imprecise data aborts. */
880 mask
= CPSR_A
| CPSR_I
| CPSR_F
;
884 cpu_abort(env
, "Unhandled exception 0x%x\n", env
->exception_index
);
885 return; /* Never happens. Keep compiler happy. */
888 if (env
->cp15
.c1_sys
& (1 << 13)) {
891 switch_mode (env
, new_mode
);
892 env
->spsr
= cpsr_read(env
);
894 env
->condexec_bits
= 0;
895 /* Switch to the new mode, and to the correct instruction set. */
896 env
->uncached_cpsr
= (env
->uncached_cpsr
& ~CPSR_M
) | new_mode
;
897 env
->uncached_cpsr
|= mask
;
898 /* this is a lie, as the was no c1_sys on V4T/V5, but who cares
899 * and we should just guard the thumb mode on V4 */
900 if (arm_feature(env
, ARM_FEATURE_V4T
)) {
901 env
->thumb
= (env
->cp15
.c1_sys
& (1 << 30)) != 0;
903 env
->regs
[14] = env
->regs
[15] + offset
;
904 env
->regs
[15] = addr
;
905 env
->interrupt_request
|= CPU_INTERRUPT_EXITTB
;
908 /* Check section/page access permissions.
909 Returns the page protection flags, or zero if the access is not
911 static inline int check_ap(CPUState
*env
, int ap
, int domain
, int access_type
,
917 return PAGE_READ
| PAGE_WRITE
;
919 if (access_type
== 1)
926 if (access_type
== 1)
928 switch ((env
->cp15
.c1_sys
>> 8) & 3) {
930 return is_user
? 0 : PAGE_READ
;
937 return is_user
? 0 : PAGE_READ
| PAGE_WRITE
;
942 return PAGE_READ
| PAGE_WRITE
;
944 return PAGE_READ
| PAGE_WRITE
;
945 case 4: /* Reserved. */
948 return is_user
? 0 : prot_ro
;
952 if (!arm_feature (env
, ARM_FEATURE_V7
))
960 static uint32_t get_level1_table_address(CPUState
*env
, uint32_t address
)
964 if (address
& env
->cp15
.c2_mask
)
965 table
= env
->cp15
.c2_base1
& 0xffffc000;
967 table
= env
->cp15
.c2_base0
& env
->cp15
.c2_base_mask
;
969 table
|= (address
>> 18) & 0x3ffc;
973 static int get_phys_addr_v5(CPUState
*env
, uint32_t address
, int access_type
,
974 int is_user
, uint32_t *phys_ptr
, int *prot
,
975 target_ulong
*page_size
)
985 /* Pagetable walk. */
986 /* Lookup l1 descriptor. */
987 table
= get_level1_table_address(env
, address
);
988 desc
= ldl_phys(table
);
990 domain
= (env
->cp15
.c3
>> ((desc
>> 4) & 0x1e)) & 3;
992 /* Section translation fault. */
996 if (domain
== 0 || domain
== 2) {
998 code
= 9; /* Section domain fault. */
1000 code
= 11; /* Page domain fault. */
1005 phys_addr
= (desc
& 0xfff00000) | (address
& 0x000fffff);
1006 ap
= (desc
>> 10) & 3;
1008 *page_size
= 1024 * 1024;
1010 /* Lookup l2 entry. */
1012 /* Coarse pagetable. */
1013 table
= (desc
& 0xfffffc00) | ((address
>> 10) & 0x3fc);
1015 /* Fine pagetable. */
1016 table
= (desc
& 0xfffff000) | ((address
>> 8) & 0xffc);
1018 desc
= ldl_phys(table
);
1020 case 0: /* Page translation fault. */
1023 case 1: /* 64k page. */
1024 phys_addr
= (desc
& 0xffff0000) | (address
& 0xffff);
1025 ap
= (desc
>> (4 + ((address
>> 13) & 6))) & 3;
1026 *page_size
= 0x10000;
1028 case 2: /* 4k page. */
1029 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
1030 ap
= (desc
>> (4 + ((address
>> 13) & 6))) & 3;
1031 *page_size
= 0x1000;
1033 case 3: /* 1k page. */
1035 if (arm_feature(env
, ARM_FEATURE_XSCALE
)) {
1036 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
1038 /* Page translation fault. */
1043 phys_addr
= (desc
& 0xfffffc00) | (address
& 0x3ff);
1045 ap
= (desc
>> 4) & 3;
1049 /* Never happens, but compiler isn't smart enough to tell. */
1054 *prot
= check_ap(env
, ap
, domain
, access_type
, is_user
);
1056 /* Access permission fault. */
1060 *phys_ptr
= phys_addr
;
1063 return code
| (domain
<< 4);
1066 static int get_phys_addr_v6(CPUState
*env
, uint32_t address
, int access_type
,
1067 int is_user
, uint32_t *phys_ptr
, int *prot
,
1068 target_ulong
*page_size
)
1079 /* Pagetable walk. */
1080 /* Lookup l1 descriptor. */
1081 table
= get_level1_table_address(env
, address
);
1082 desc
= ldl_phys(table
);
1085 /* Section translation fault. */
1089 } else if (type
== 2 && (desc
& (1 << 18))) {
1093 /* Section or page. */
1094 domain
= (desc
>> 4) & 0x1e;
1096 domain
= (env
->cp15
.c3
>> domain
) & 3;
1097 if (domain
== 0 || domain
== 2) {
1099 code
= 9; /* Section domain fault. */
1101 code
= 11; /* Page domain fault. */
1105 if (desc
& (1 << 18)) {
1107 phys_addr
= (desc
& 0xff000000) | (address
& 0x00ffffff);
1108 *page_size
= 0x1000000;
1111 phys_addr
= (desc
& 0xfff00000) | (address
& 0x000fffff);
1112 *page_size
= 0x100000;
1114 ap
= ((desc
>> 10) & 3) | ((desc
>> 13) & 4);
1115 xn
= desc
& (1 << 4);
1118 /* Lookup l2 entry. */
1119 table
= (desc
& 0xfffffc00) | ((address
>> 10) & 0x3fc);
1120 desc
= ldl_phys(table
);
1121 ap
= ((desc
>> 4) & 3) | ((desc
>> 7) & 4);
1123 case 0: /* Page translation fault. */
1126 case 1: /* 64k page. */
1127 phys_addr
= (desc
& 0xffff0000) | (address
& 0xffff);
1128 xn
= desc
& (1 << 15);
1129 *page_size
= 0x10000;
1131 case 2: case 3: /* 4k page. */
1132 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
1134 *page_size
= 0x1000;
1137 /* Never happens, but compiler isn't smart enough to tell. */
1143 *prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
1145 if (xn
&& access_type
== 2)
1148 /* The simplified model uses AP[0] as an access control bit. */
1149 if ((env
->cp15
.c1_sys
& (1 << 29)) && (ap
& 1) == 0) {
1150 /* Access flag fault. */
1151 code
= (code
== 15) ? 6 : 3;
1154 *prot
= check_ap(env
, ap
, domain
, access_type
, is_user
);
1156 /* Access permission fault. */
1163 *phys_ptr
= phys_addr
;
1166 return code
| (domain
<< 4);
1169 static int get_phys_addr_mpu(CPUState
*env
, uint32_t address
, int access_type
,
1170 int is_user
, uint32_t *phys_ptr
, int *prot
)
1176 *phys_ptr
= address
;
1177 for (n
= 7; n
>= 0; n
--) {
1178 base
= env
->cp15
.c6_region
[n
];
1179 if ((base
& 1) == 0)
1181 mask
= 1 << ((base
>> 1) & 0x1f);
1182 /* Keep this shift separate from the above to avoid an
1183 (undefined) << 32. */
1184 mask
= (mask
<< 1) - 1;
1185 if (((base
^ address
) & ~mask
) == 0)
1191 if (access_type
== 2) {
1192 mask
= env
->cp15
.c5_insn
;
1194 mask
= env
->cp15
.c5_data
;
1196 mask
= (mask
>> (n
* 4)) & 0xf;
1203 *prot
= PAGE_READ
| PAGE_WRITE
;
1208 *prot
|= PAGE_WRITE
;
1211 *prot
= PAGE_READ
| PAGE_WRITE
;
1222 /* Bad permission. */
1229 static inline int get_phys_addr(CPUState
*env
, uint32_t address
,
1230 int access_type
, int is_user
,
1231 uint32_t *phys_ptr
, int *prot
,
1232 target_ulong
*page_size
)
1234 /* Fast Context Switch Extension. */
1235 if (address
< 0x02000000)
1236 address
+= env
->cp15
.c13_fcse
;
1238 if ((env
->cp15
.c1_sys
& 1) == 0) {
1239 /* MMU/MPU disabled. */
1240 *phys_ptr
= address
;
1241 *prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
1242 *page_size
= TARGET_PAGE_SIZE
;
1244 } else if (arm_feature(env
, ARM_FEATURE_MPU
)) {
1245 *page_size
= TARGET_PAGE_SIZE
;
1246 return get_phys_addr_mpu(env
, address
, access_type
, is_user
, phys_ptr
,
1248 } else if (env
->cp15
.c1_sys
& (1 << 23)) {
1249 return get_phys_addr_v6(env
, address
, access_type
, is_user
, phys_ptr
,
1252 return get_phys_addr_v5(env
, address
, access_type
, is_user
, phys_ptr
,
1257 int cpu_arm_handle_mmu_fault (CPUState
*env
, target_ulong address
,
1258 int access_type
, int mmu_idx
, int is_softmmu
)
1261 target_ulong page_size
;
1265 is_user
= mmu_idx
== MMU_USER_IDX
;
1266 ret
= get_phys_addr(env
, address
, access_type
, is_user
, &phys_addr
, &prot
,
1269 /* Map a single [sub]page. */
1270 phys_addr
&= ~(uint32_t)0x3ff;
1271 address
&= ~(uint32_t)0x3ff;
1272 tlb_set_page (env
, address
, phys_addr
, prot
, mmu_idx
, page_size
);
1276 if (access_type
== 2) {
1277 env
->cp15
.c5_insn
= ret
;
1278 env
->cp15
.c6_insn
= address
;
1279 env
->exception_index
= EXCP_PREFETCH_ABORT
;
1281 env
->cp15
.c5_data
= ret
;
1282 if (access_type
== 1 && arm_feature(env
, ARM_FEATURE_V6
))
1283 env
->cp15
.c5_data
|= (1 << 11);
1284 env
->cp15
.c6_data
= address
;
1285 env
->exception_index
= EXCP_DATA_ABORT
;
1290 target_phys_addr_t
cpu_get_phys_page_debug(CPUState
*env
, target_ulong addr
)
1293 target_ulong page_size
;
1297 ret
= get_phys_addr(env
, addr
, 0, 0, &phys_addr
, &prot
, &page_size
);
1305 void HELPER(set_cp
)(CPUState
*env
, uint32_t insn
, uint32_t val
)
1307 int cp_num
= (insn
>> 8) & 0xf;
1308 int cp_info
= (insn
>> 5) & 7;
1309 int src
= (insn
>> 16) & 0xf;
1310 int operand
= insn
& 0xf;
1312 if (env
->cp
[cp_num
].cp_write
)
1313 env
->cp
[cp_num
].cp_write(env
->cp
[cp_num
].opaque
,
1314 cp_info
, src
, operand
, val
);
1317 uint32_t HELPER(get_cp
)(CPUState
*env
, uint32_t insn
)
1319 int cp_num
= (insn
>> 8) & 0xf;
1320 int cp_info
= (insn
>> 5) & 7;
1321 int dest
= (insn
>> 16) & 0xf;
1322 int operand
= insn
& 0xf;
1324 if (env
->cp
[cp_num
].cp_read
)
1325 return env
->cp
[cp_num
].cp_read(env
->cp
[cp_num
].opaque
,
1326 cp_info
, dest
, operand
);
1330 /* Return basic MPU access permission bits. */
1331 static uint32_t simple_mpu_ap_bits(uint32_t val
)
1338 for (i
= 0; i
< 16; i
+= 2) {
1339 ret
|= (val
>> i
) & mask
;
1345 /* Pad basic MPU access permission bits to extended format. */
1346 static uint32_t extended_mpu_ap_bits(uint32_t val
)
1353 for (i
= 0; i
< 16; i
+= 2) {
1354 ret
|= (val
& mask
) << i
;
1360 void HELPER(set_cp15
)(CPUState
*env
, uint32_t insn
, uint32_t val
)
1366 op1
= (insn
>> 21) & 7;
1367 op2
= (insn
>> 5) & 7;
1369 switch ((insn
>> 16) & 0xf) {
1372 if (arm_feature(env
, ARM_FEATURE_XSCALE
))
1374 if (arm_feature(env
, ARM_FEATURE_OMAPCP
))
1376 if (arm_feature(env
, ARM_FEATURE_V7
)
1377 && op1
== 2 && crm
== 0 && op2
== 0) {
1378 env
->cp15
.c0_cssel
= val
& 0xf;
1382 case 1: /* System configuration. */
1383 if (arm_feature(env
, ARM_FEATURE_OMAPCP
))
1387 if (!arm_feature(env
, ARM_FEATURE_XSCALE
) || crm
== 0)
1388 env
->cp15
.c1_sys
= val
;
1389 /* ??? Lots of these bits are not implemented. */
1390 /* This may enable/disable the MMU, so do a TLB flush. */
1393 case 1: /* Auxiliary control register. */
1394 if (arm_feature(env
, ARM_FEATURE_XSCALE
)) {
1395 env
->cp15
.c1_xscaleauxcr
= val
;
1398 /* Not implemented. */
1401 if (arm_feature(env
, ARM_FEATURE_XSCALE
))
1403 if (env
->cp15
.c1_coproc
!= val
) {
1404 env
->cp15
.c1_coproc
= val
;
1405 /* ??? Is this safe when called from within a TB? */
1413 case 2: /* MMU Page table control / MPU cache control. */
1414 if (arm_feature(env
, ARM_FEATURE_MPU
)) {
1417 env
->cp15
.c2_data
= val
;
1420 env
->cp15
.c2_insn
= val
;
1428 env
->cp15
.c2_base0
= val
;
1431 env
->cp15
.c2_base1
= val
;
1435 env
->cp15
.c2_control
= val
;
1436 env
->cp15
.c2_mask
= ~(((uint32_t)0xffffffffu
) >> val
);
1437 env
->cp15
.c2_base_mask
= ~((uint32_t)0x3fffu
>> val
);
1444 case 3: /* MMU Domain access control / MPU write buffer control. */
1446 tlb_flush(env
, 1); /* Flush TLB as domain not tracked in TLB */
1448 case 4: /* Reserved. */
1450 case 5: /* MMU Fault status / MPU access permission. */
1451 if (arm_feature(env
, ARM_FEATURE_OMAPCP
))
1455 if (arm_feature(env
, ARM_FEATURE_MPU
))
1456 val
= extended_mpu_ap_bits(val
);
1457 env
->cp15
.c5_data
= val
;
1460 if (arm_feature(env
, ARM_FEATURE_MPU
))
1461 val
= extended_mpu_ap_bits(val
);
1462 env
->cp15
.c5_insn
= val
;
1465 if (!arm_feature(env
, ARM_FEATURE_MPU
))
1467 env
->cp15
.c5_data
= val
;
1470 if (!arm_feature(env
, ARM_FEATURE_MPU
))
1472 env
->cp15
.c5_insn
= val
;
1478 case 6: /* MMU Fault address / MPU base/size. */
1479 if (arm_feature(env
, ARM_FEATURE_MPU
)) {
1482 env
->cp15
.c6_region
[crm
] = val
;
1484 if (arm_feature(env
, ARM_FEATURE_OMAPCP
))
1488 env
->cp15
.c6_data
= val
;
1490 case 1: /* ??? This is WFAR on armv6 */
1492 env
->cp15
.c6_insn
= val
;
1499 case 7: /* Cache control. */
1500 env
->cp15
.c15_i_max
= 0x000;
1501 env
->cp15
.c15_i_min
= 0xff0;
1505 /* No cache, so nothing to do except VA->PA translations. */
1506 if (arm_feature(env
, ARM_FEATURE_V6K
)) {
1509 if (arm_feature(env
, ARM_FEATURE_V7
)) {
1510 env
->cp15
.c7_par
= val
& 0xfffff6ff;
1512 env
->cp15
.c7_par
= val
& 0xfffff1ff;
1517 target_ulong page_size
;
1519 int ret
, is_user
= op2
& 2;
1520 int access_type
= op2
& 1;
1523 /* Other states are only available with TrustZone */
1526 ret
= get_phys_addr(env
, val
, access_type
, is_user
,
1527 &phys_addr
, &prot
, &page_size
);
1529 /* We do not set any attribute bits in the PAR */
1530 if (page_size
== (1 << 24)
1531 && arm_feature(env
, ARM_FEATURE_V7
)) {
1532 env
->cp15
.c7_par
= (phys_addr
& 0xff000000) | 1 << 1;
1534 env
->cp15
.c7_par
= phys_addr
& 0xfffff000;
1537 env
->cp15
.c7_par
= ((ret
& (10 << 1)) >> 5) |
1538 ((ret
& (12 << 1)) >> 6) |
1539 ((ret
& 0xf) << 1) | 1;
1546 case 8: /* MMU TLB control. */
1548 case 0: /* Invalidate all. */
1551 case 1: /* Invalidate single TLB entry. */
1552 tlb_flush_page(env
, val
& TARGET_PAGE_MASK
);
1554 case 2: /* Invalidate on ASID. */
1555 tlb_flush(env
, val
== 0);
1557 case 3: /* Invalidate single entry on MVA. */
1558 /* ??? This is like case 1, but ignores ASID. */
1566 if (arm_feature(env
, ARM_FEATURE_OMAPCP
))
1568 if (arm_feature(env
, ARM_FEATURE_STRONGARM
))
1569 break; /* Ignore ReadBuffer access */
1571 case 0: /* Cache lockdown. */
1573 case 0: /* L1 cache. */
1576 env
->cp15
.c9_data
= val
;
1579 env
->cp15
.c9_insn
= val
;
1585 case 1: /* L2 cache. */
1586 /* Ignore writes to L2 lockdown/auxiliary registers. */
1592 case 1: /* TCM memory region registers. */
1593 /* Not implemented. */
1595 case 12: /* Performance monitor control */
1596 /* Performance monitors are implementation defined in v7,
1597 * but with an ARM recommended set of registers, which we
1598 * follow (although we don't actually implement any counters)
1600 if (!arm_feature(env
, ARM_FEATURE_V7
)) {
1604 case 0: /* performance monitor control register */
1605 /* only the DP, X, D and E bits are writable */
1606 env
->cp15
.c9_pmcr
&= ~0x39;
1607 env
->cp15
.c9_pmcr
|= (val
& 0x39);
1609 case 1: /* Count enable set register */
1611 env
->cp15
.c9_pmcnten
|= val
;
1613 case 2: /* Count enable clear */
1615 env
->cp15
.c9_pmcnten
&= ~val
;
1617 case 3: /* Overflow flag status */
1618 env
->cp15
.c9_pmovsr
&= ~val
;
1620 case 4: /* Software increment */
1621 /* RAZ/WI since we don't implement the software-count event */
1623 case 5: /* Event counter selection register */
1624 /* Since we don't implement any events, writing to this register
1625 * is actually UNPREDICTABLE. So we choose to RAZ/WI.
1632 case 13: /* Performance counters */
1633 if (!arm_feature(env
, ARM_FEATURE_V7
)) {
1637 case 0: /* Cycle count register: not implemented, so RAZ/WI */
1639 case 1: /* Event type select */
1640 env
->cp15
.c9_pmxevtyper
= val
& 0xff;
1642 case 2: /* Event count register */
1643 /* Unimplemented (we have no events), RAZ/WI */
1649 case 14: /* Performance monitor control */
1650 if (!arm_feature(env
, ARM_FEATURE_V7
)) {
1654 case 0: /* user enable */
1655 env
->cp15
.c9_pmuserenr
= val
& 1;
1656 /* changes access rights for cp registers, so flush tbs */
1659 case 1: /* interrupt enable set */
1660 /* We have no event counters so only the C bit can be changed */
1662 env
->cp15
.c9_pminten
|= val
;
1664 case 2: /* interrupt enable clear */
1666 env
->cp15
.c9_pminten
&= ~val
;
1674 case 10: /* MMU TLB lockdown. */
1675 /* ??? TLB lockdown not implemented. */
1677 case 12: /* Reserved. */
1679 case 13: /* Process ID. */
1682 /* Unlike real hardware the qemu TLB uses virtual addresses,
1683 not modified virtual addresses, so this causes a TLB flush.
1685 if (env
->cp15
.c13_fcse
!= val
)
1687 env
->cp15
.c13_fcse
= val
;
1690 /* This changes the ASID, so do a TLB flush. */
1691 if (env
->cp15
.c13_context
!= val
1692 && !arm_feature(env
, ARM_FEATURE_MPU
))
1694 env
->cp15
.c13_context
= val
;
1700 case 14: /* Reserved. */
1702 case 15: /* Implementation specific. */
1703 if (arm_feature(env
, ARM_FEATURE_XSCALE
)) {
1704 if (op2
== 0 && crm
== 1) {
1705 if (env
->cp15
.c15_cpar
!= (val
& 0x3fff)) {
1706 /* Changes cp0 to cp13 behavior, so needs a TB flush. */
1708 env
->cp15
.c15_cpar
= val
& 0x3fff;
1714 if (arm_feature(env
, ARM_FEATURE_OMAPCP
)) {
1718 case 1: /* Set TI925T configuration. */
1719 env
->cp15
.c15_ticonfig
= val
& 0xe7;
1720 env
->cp15
.c0_cpuid
= (val
& (1 << 5)) ? /* OS_TYPE bit */
1721 ARM_CPUID_TI915T
: ARM_CPUID_TI925T
;
1723 case 2: /* Set I_max. */
1724 env
->cp15
.c15_i_max
= val
;
1726 case 3: /* Set I_min. */
1727 env
->cp15
.c15_i_min
= val
;
1729 case 4: /* Set thread-ID. */
1730 env
->cp15
.c15_threadid
= val
& 0xffff;
1732 case 8: /* Wait-for-interrupt (deprecated). */
1733 cpu_interrupt(env
, CPU_INTERRUPT_HALT
);
1743 /* ??? For debugging only. Should raise illegal instruction exception. */
1744 cpu_abort(env
, "Unimplemented cp15 register write (c%d, c%d, {%d, %d})\n",
1745 (insn
>> 16) & 0xf, crm
, op1
, op2
);
1748 uint32_t HELPER(get_cp15
)(CPUState
*env
, uint32_t insn
)
1754 op1
= (insn
>> 21) & 7;
1755 op2
= (insn
>> 5) & 7;
1757 switch ((insn
>> 16) & 0xf) {
1758 case 0: /* ID codes. */
1764 case 0: /* Device ID. */
1765 return env
->cp15
.c0_cpuid
;
1766 case 1: /* Cache Type. */
1767 return env
->cp15
.c0_cachetype
;
1768 case 2: /* TCM status. */
1770 case 3: /* TLB type register. */
1771 return 0; /* No lockable TLB entries. */
1773 /* The MPIDR was standardised in v7; prior to
1774 * this it was implemented only in the 11MPCore.
1775 * For all other pre-v7 cores it does not exist.
1777 if (arm_feature(env
, ARM_FEATURE_V7
) ||
1778 ARM_CPUID(env
) == ARM_CPUID_ARM11MPCORE
) {
1779 int mpidr
= env
->cpu_index
;
1780 /* We don't support setting cluster ID ([8..11])
1781 * so these bits always RAZ.
1783 if (arm_feature(env
, ARM_FEATURE_V7MP
)) {
1785 /* Cores which are uniprocessor (non-coherent)
1786 * but still implement the MP extensions set
1787 * bit 30. (For instance, A9UP.) However we do
1788 * not currently model any of those cores.
1793 /* otherwise fall through to the unimplemented-reg case */
1798 if (!arm_feature(env
, ARM_FEATURE_V6
))
1800 return env
->cp15
.c0_c1
[op2
];
1802 if (!arm_feature(env
, ARM_FEATURE_V6
))
1804 return env
->cp15
.c0_c2
[op2
];
1805 case 3: case 4: case 5: case 6: case 7:
1811 /* These registers aren't documented on arm11 cores. However
1812 Linux looks at them anyway. */
1813 if (!arm_feature(env
, ARM_FEATURE_V6
))
1817 if (!arm_feature(env
, ARM_FEATURE_V7
))
1822 return env
->cp15
.c0_ccsid
[env
->cp15
.c0_cssel
];
1824 return env
->cp15
.c0_clid
;
1830 if (op2
!= 0 || crm
!= 0)
1832 return env
->cp15
.c0_cssel
;
1836 case 1: /* System configuration. */
1837 if (arm_feature(env
, ARM_FEATURE_OMAPCP
))
1840 case 0: /* Control register. */
1841 return env
->cp15
.c1_sys
;
1842 case 1: /* Auxiliary control register. */
1843 if (arm_feature(env
, ARM_FEATURE_XSCALE
))
1844 return env
->cp15
.c1_xscaleauxcr
;
1845 if (!arm_feature(env
, ARM_FEATURE_AUXCR
))
1847 switch (ARM_CPUID(env
)) {
1848 case ARM_CPUID_ARM1026
:
1850 case ARM_CPUID_ARM1136
:
1851 case ARM_CPUID_ARM1136_R2
:
1853 case ARM_CPUID_ARM11MPCORE
:
1855 case ARM_CPUID_CORTEXA8
:
1857 case ARM_CPUID_CORTEXA9
:
1862 case 2: /* Coprocessor access register. */
1863 if (arm_feature(env
, ARM_FEATURE_XSCALE
))
1865 return env
->cp15
.c1_coproc
;
1869 case 2: /* MMU Page table control / MPU cache control. */
1870 if (arm_feature(env
, ARM_FEATURE_MPU
)) {
1873 return env
->cp15
.c2_data
;
1876 return env
->cp15
.c2_insn
;
1884 return env
->cp15
.c2_base0
;
1886 return env
->cp15
.c2_base1
;
1888 return env
->cp15
.c2_control
;
1893 case 3: /* MMU Domain access control / MPU write buffer control. */
1894 return env
->cp15
.c3
;
1895 case 4: /* Reserved. */
1897 case 5: /* MMU Fault status / MPU access permission. */
1898 if (arm_feature(env
, ARM_FEATURE_OMAPCP
))
1902 if (arm_feature(env
, ARM_FEATURE_MPU
))
1903 return simple_mpu_ap_bits(env
->cp15
.c5_data
);
1904 return env
->cp15
.c5_data
;
1906 if (arm_feature(env
, ARM_FEATURE_MPU
))
1907 return simple_mpu_ap_bits(env
->cp15
.c5_data
);
1908 return env
->cp15
.c5_insn
;
1910 if (!arm_feature(env
, ARM_FEATURE_MPU
))
1912 return env
->cp15
.c5_data
;
1914 if (!arm_feature(env
, ARM_FEATURE_MPU
))
1916 return env
->cp15
.c5_insn
;
1920 case 6: /* MMU Fault address. */
1921 if (arm_feature(env
, ARM_FEATURE_MPU
)) {
1924 return env
->cp15
.c6_region
[crm
];
1926 if (arm_feature(env
, ARM_FEATURE_OMAPCP
))
1930 return env
->cp15
.c6_data
;
1932 if (arm_feature(env
, ARM_FEATURE_V6
)) {
1933 /* Watchpoint Fault Adrress. */
1934 return 0; /* Not implemented. */
1936 /* Instruction Fault Adrress. */
1937 /* Arm9 doesn't have an IFAR, but implementing it anyway
1938 shouldn't do any harm. */
1939 return env
->cp15
.c6_insn
;
1942 if (arm_feature(env
, ARM_FEATURE_V6
)) {
1943 /* Instruction Fault Adrress. */
1944 return env
->cp15
.c6_insn
;
1952 case 7: /* Cache control. */
1953 if (crm
== 4 && op1
== 0 && op2
== 0) {
1954 return env
->cp15
.c7_par
;
1956 /* FIXME: Should only clear Z flag if destination is r15. */
1959 case 8: /* MMU TLB control. */
1963 case 0: /* Cache lockdown */
1965 case 0: /* L1 cache. */
1966 if (arm_feature(env
, ARM_FEATURE_OMAPCP
)) {
1971 return env
->cp15
.c9_data
;
1973 return env
->cp15
.c9_insn
;
1977 case 1: /* L2 cache */
1981 /* L2 Lockdown and Auxiliary control. */
1987 case 12: /* Performance monitor control */
1988 if (!arm_feature(env
, ARM_FEATURE_V7
)) {
1992 case 0: /* performance monitor control register */
1993 return env
->cp15
.c9_pmcr
;
1994 case 1: /* count enable set */
1995 case 2: /* count enable clear */
1996 return env
->cp15
.c9_pmcnten
;
1997 case 3: /* overflow flag status */
1998 return env
->cp15
.c9_pmovsr
;
1999 case 4: /* software increment */
2000 case 5: /* event counter selection register */
2001 return 0; /* Unimplemented, RAZ/WI */
2005 case 13: /* Performance counters */
2006 if (!arm_feature(env
, ARM_FEATURE_V7
)) {
2010 case 1: /* Event type select */
2011 return env
->cp15
.c9_pmxevtyper
;
2012 case 0: /* Cycle count register */
2013 case 2: /* Event count register */
2014 /* Unimplemented, so RAZ/WI */
2019 case 14: /* Performance monitor control */
2020 if (!arm_feature(env
, ARM_FEATURE_V7
)) {
2024 case 0: /* user enable */
2025 return env
->cp15
.c9_pmuserenr
;
2026 case 1: /* interrupt enable set */
2027 case 2: /* interrupt enable clear */
2028 return env
->cp15
.c9_pminten
;
2036 case 10: /* MMU TLB lockdown. */
2037 /* ??? TLB lockdown not implemented. */
2039 case 11: /* TCM DMA control. */
2040 case 12: /* Reserved. */
2042 case 13: /* Process ID. */
2045 return env
->cp15
.c13_fcse
;
2047 return env
->cp15
.c13_context
;
2051 case 14: /* Reserved. */
2053 case 15: /* Implementation specific. */
2054 if (arm_feature(env
, ARM_FEATURE_XSCALE
)) {
2055 if (op2
== 0 && crm
== 1)
2056 return env
->cp15
.c15_cpar
;
2060 if (arm_feature(env
, ARM_FEATURE_OMAPCP
)) {
2064 case 1: /* Read TI925T configuration. */
2065 return env
->cp15
.c15_ticonfig
;
2066 case 2: /* Read I_max. */
2067 return env
->cp15
.c15_i_max
;
2068 case 3: /* Read I_min. */
2069 return env
->cp15
.c15_i_min
;
2070 case 4: /* Read thread-ID. */
2071 return env
->cp15
.c15_threadid
;
2072 case 8: /* TI925T_status */
2075 /* TODO: Peripheral port remap register:
2076 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt
2077 * controller base address at $rn & ~0xfff and map size of
2078 * 0x200 << ($rn & 0xfff), when MMU is off. */
2084 /* ??? For debugging only. Should raise illegal instruction exception. */
2085 cpu_abort(env
, "Unimplemented cp15 register read (c%d, c%d, {%d, %d})\n",
2086 (insn
>> 16) & 0xf, crm
, op1
, op2
);
2090 void HELPER(set_r13_banked
)(CPUState
*env
, uint32_t mode
, uint32_t val
)
2092 if ((env
->uncached_cpsr
& CPSR_M
) == mode
) {
2093 env
->regs
[13] = val
;
2095 env
->banked_r13
[bank_number(mode
)] = val
;
2099 uint32_t HELPER(get_r13_banked
)(CPUState
*env
, uint32_t mode
)
2101 if ((env
->uncached_cpsr
& CPSR_M
) == mode
) {
2102 return env
->regs
[13];
2104 return env
->banked_r13
[bank_number(mode
)];
2108 uint32_t HELPER(v7m_mrs
)(CPUState
*env
, uint32_t reg
)
2112 return xpsr_read(env
) & 0xf8000000;
2114 return xpsr_read(env
) & 0xf80001ff;
2116 return xpsr_read(env
) & 0xff00fc00;
2118 return xpsr_read(env
) & 0xff00fdff;
2120 return xpsr_read(env
) & 0x000001ff;
2122 return xpsr_read(env
) & 0x0700fc00;
2124 return xpsr_read(env
) & 0x0700edff;
2126 return env
->v7m
.current_sp
? env
->v7m
.other_sp
: env
->regs
[13];
2128 return env
->v7m
.current_sp
? env
->regs
[13] : env
->v7m
.other_sp
;
2129 case 16: /* PRIMASK */
2130 return (env
->uncached_cpsr
& CPSR_I
) != 0;
2131 case 17: /* BASEPRI */
2132 case 18: /* BASEPRI_MAX */
2133 return env
->v7m
.basepri
;
2134 case 19: /* FAULTMASK */
2135 return (env
->uncached_cpsr
& CPSR_F
) != 0;
2136 case 20: /* CONTROL */
2137 return env
->v7m
.control
;
2139 /* ??? For debugging only. */
2140 cpu_abort(env
, "Unimplemented system register read (%d)\n", reg
);
2145 void HELPER(v7m_msr
)(CPUState
*env
, uint32_t reg
, uint32_t val
)
2149 xpsr_write(env
, val
, 0xf8000000);
2152 xpsr_write(env
, val
, 0xf8000000);
2155 xpsr_write(env
, val
, 0xfe00fc00);
2158 xpsr_write(env
, val
, 0xfe00fc00);
2161 /* IPSR bits are readonly. */
2164 xpsr_write(env
, val
, 0x0600fc00);
2167 xpsr_write(env
, val
, 0x0600fc00);
2170 if (env
->v7m
.current_sp
)
2171 env
->v7m
.other_sp
= val
;
2173 env
->regs
[13] = val
;
2176 if (env
->v7m
.current_sp
)
2177 env
->regs
[13] = val
;
2179 env
->v7m
.other_sp
= val
;
2181 case 16: /* PRIMASK */
2183 env
->uncached_cpsr
|= CPSR_I
;
2185 env
->uncached_cpsr
&= ~CPSR_I
;
2187 case 17: /* BASEPRI */
2188 env
->v7m
.basepri
= val
& 0xff;
2190 case 18: /* BASEPRI_MAX */
2192 if (val
!= 0 && (val
< env
->v7m
.basepri
|| env
->v7m
.basepri
== 0))
2193 env
->v7m
.basepri
= val
;
2195 case 19: /* FAULTMASK */
2197 env
->uncached_cpsr
|= CPSR_F
;
2199 env
->uncached_cpsr
&= ~CPSR_F
;
2201 case 20: /* CONTROL */
2202 env
->v7m
.control
= val
& 3;
2203 switch_v7m_sp(env
, (val
& 2) != 0);
2206 /* ??? For debugging only. */
2207 cpu_abort(env
, "Unimplemented system register write (%d)\n", reg
);
2212 void cpu_arm_set_cp_io(CPUARMState
*env
, int cpnum
,
2213 ARMReadCPFunc
*cp_read
, ARMWriteCPFunc
*cp_write
,
2216 if (cpnum
< 0 || cpnum
> 14) {
2217 cpu_abort(env
, "Bad coprocessor number: %i\n", cpnum
);
2221 env
->cp
[cpnum
].cp_read
= cp_read
;
2222 env
->cp
[cpnum
].cp_write
= cp_write
;
2223 env
->cp
[cpnum
].opaque
= opaque
;
2228 /* Note that signed overflow is undefined in C. The following routines are
2229 careful to use unsigned types where modulo arithmetic is required.
2230 Failure to do so _will_ break on newer gcc. */
2232 /* Signed saturating arithmetic. */
2234 /* Perform 16-bit signed saturating addition. */
2235 static inline uint16_t add16_sat(uint16_t a
, uint16_t b
)
2240 if (((res
^ a
) & 0x8000) && !((a
^ b
) & 0x8000)) {
2249 /* Perform 8-bit signed saturating addition. */
2250 static inline uint8_t add8_sat(uint8_t a
, uint8_t b
)
2255 if (((res
^ a
) & 0x80) && !((a
^ b
) & 0x80)) {
2264 /* Perform 16-bit signed saturating subtraction. */
2265 static inline uint16_t sub16_sat(uint16_t a
, uint16_t b
)
2270 if (((res
^ a
) & 0x8000) && ((a
^ b
) & 0x8000)) {
2279 /* Perform 8-bit signed saturating subtraction. */
2280 static inline uint8_t sub8_sat(uint8_t a
, uint8_t b
)
2285 if (((res
^ a
) & 0x80) && ((a
^ b
) & 0x80)) {
2294 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
2295 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
2296 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8);
2297 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8);
2300 #include "op_addsub.h"
2302 /* Unsigned saturating arithmetic. */
2303 static inline uint16_t add16_usat(uint16_t a
, uint16_t b
)
2312 static inline uint16_t sub16_usat(uint16_t a
, uint16_t b
)
2320 static inline uint8_t add8_usat(uint8_t a
, uint8_t b
)
2329 static inline uint8_t sub8_usat(uint8_t a
, uint8_t b
)
2337 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
2338 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
2339 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8);
2340 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8);
2343 #include "op_addsub.h"
2345 /* Signed modulo arithmetic. */
2346 #define SARITH16(a, b, n, op) do { \
2348 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
2349 RESULT(sum, n, 16); \
2351 ge |= 3 << (n * 2); \
2354 #define SARITH8(a, b, n, op) do { \
2356 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
2357 RESULT(sum, n, 8); \
2363 #define ADD16(a, b, n) SARITH16(a, b, n, +)
2364 #define SUB16(a, b, n) SARITH16(a, b, n, -)
2365 #define ADD8(a, b, n) SARITH8(a, b, n, +)
2366 #define SUB8(a, b, n) SARITH8(a, b, n, -)
2370 #include "op_addsub.h"
2372 /* Unsigned modulo arithmetic. */
2373 #define ADD16(a, b, n) do { \
2375 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
2376 RESULT(sum, n, 16); \
2377 if ((sum >> 16) == 1) \
2378 ge |= 3 << (n * 2); \
2381 #define ADD8(a, b, n) do { \
2383 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
2384 RESULT(sum, n, 8); \
2385 if ((sum >> 8) == 1) \
2389 #define SUB16(a, b, n) do { \
2391 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
2392 RESULT(sum, n, 16); \
2393 if ((sum >> 16) == 0) \
2394 ge |= 3 << (n * 2); \
2397 #define SUB8(a, b, n) do { \
2399 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
2400 RESULT(sum, n, 8); \
2401 if ((sum >> 8) == 0) \
2408 #include "op_addsub.h"
2410 /* Halved signed arithmetic. */
2411 #define ADD16(a, b, n) \
2412 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
2413 #define SUB16(a, b, n) \
2414 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
2415 #define ADD8(a, b, n) \
2416 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
2417 #define SUB8(a, b, n) \
2418 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
2421 #include "op_addsub.h"
2423 /* Halved unsigned arithmetic. */
2424 #define ADD16(a, b, n) \
2425 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
2426 #define SUB16(a, b, n) \
2427 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
2428 #define ADD8(a, b, n) \
2429 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
2430 #define SUB8(a, b, n) \
2431 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
2434 #include "op_addsub.h"
2436 static inline uint8_t do_usad(uint8_t a
, uint8_t b
)
2444 /* Unsigned sum of absolute byte differences. */
2445 uint32_t HELPER(usad8
)(uint32_t a
, uint32_t b
)
2448 sum
= do_usad(a
, b
);
2449 sum
+= do_usad(a
>> 8, b
>> 8);
2450 sum
+= do_usad(a
>> 16, b
>>16);
2451 sum
+= do_usad(a
>> 24, b
>> 24);
2455 /* For ARMv6 SEL instruction. */
2456 uint32_t HELPER(sel_flags
)(uint32_t flags
, uint32_t a
, uint32_t b
)
2469 return (a
& mask
) | (b
& ~mask
);
2472 uint32_t HELPER(logicq_cc
)(uint64_t val
)
2474 return (val
>> 32) | (val
!= 0);
2477 /* VFP support. We follow the convention used for VFP instrunctions:
2478 Single precition routines have a "s" suffix, double precision a
2481 /* Convert host exception flags to vfp form. */
2482 static inline int vfp_exceptbits_from_host(int host_bits
)
2484 int target_bits
= 0;
2486 if (host_bits
& float_flag_invalid
)
2488 if (host_bits
& float_flag_divbyzero
)
2490 if (host_bits
& float_flag_overflow
)
2492 if (host_bits
& (float_flag_underflow
| float_flag_output_denormal
))
2494 if (host_bits
& float_flag_inexact
)
2495 target_bits
|= 0x10;
2496 if (host_bits
& float_flag_input_denormal
)
2497 target_bits
|= 0x80;
2501 uint32_t HELPER(vfp_get_fpscr
)(CPUState
*env
)
2506 fpscr
= (env
->vfp
.xregs
[ARM_VFP_FPSCR
] & 0xffc8ffff)
2507 | (env
->vfp
.vec_len
<< 16)
2508 | (env
->vfp
.vec_stride
<< 20);
2509 i
= get_float_exception_flags(&env
->vfp
.fp_status
);
2510 i
|= get_float_exception_flags(&env
->vfp
.standard_fp_status
);
2511 fpscr
|= vfp_exceptbits_from_host(i
);
2515 uint32_t vfp_get_fpscr(CPUState
*env
)
2517 return HELPER(vfp_get_fpscr
)(env
);
2520 /* Convert vfp exception flags to target form. */
2521 static inline int vfp_exceptbits_to_host(int target_bits
)
2525 if (target_bits
& 1)
2526 host_bits
|= float_flag_invalid
;
2527 if (target_bits
& 2)
2528 host_bits
|= float_flag_divbyzero
;
2529 if (target_bits
& 4)
2530 host_bits
|= float_flag_overflow
;
2531 if (target_bits
& 8)
2532 host_bits
|= float_flag_underflow
;
2533 if (target_bits
& 0x10)
2534 host_bits
|= float_flag_inexact
;
2535 if (target_bits
& 0x80)
2536 host_bits
|= float_flag_input_denormal
;
2540 void HELPER(vfp_set_fpscr
)(CPUState
*env
, uint32_t val
)
2545 changed
= env
->vfp
.xregs
[ARM_VFP_FPSCR
];
2546 env
->vfp
.xregs
[ARM_VFP_FPSCR
] = (val
& 0xffc8ffff);
2547 env
->vfp
.vec_len
= (val
>> 16) & 7;
2548 env
->vfp
.vec_stride
= (val
>> 20) & 3;
2551 if (changed
& (3 << 22)) {
2552 i
= (val
>> 22) & 3;
2555 i
= float_round_nearest_even
;
2561 i
= float_round_down
;
2564 i
= float_round_to_zero
;
2567 set_float_rounding_mode(i
, &env
->vfp
.fp_status
);
2569 if (changed
& (1 << 24)) {
2570 set_flush_to_zero((val
& (1 << 24)) != 0, &env
->vfp
.fp_status
);
2571 set_flush_inputs_to_zero((val
& (1 << 24)) != 0, &env
->vfp
.fp_status
);
2573 if (changed
& (1 << 25))
2574 set_default_nan_mode((val
& (1 << 25)) != 0, &env
->vfp
.fp_status
);
2576 i
= vfp_exceptbits_to_host(val
);
2577 set_float_exception_flags(i
, &env
->vfp
.fp_status
);
2578 set_float_exception_flags(0, &env
->vfp
.standard_fp_status
);
2581 void vfp_set_fpscr(CPUState
*env
, uint32_t val
)
2583 HELPER(vfp_set_fpscr
)(env
, val
);
2586 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
2588 #define VFP_BINOP(name) \
2589 float32 VFP_HELPER(name, s)(float32 a, float32 b, void *fpstp) \
2591 float_status *fpst = fpstp; \
2592 return float32_ ## name(a, b, fpst); \
2594 float64 VFP_HELPER(name, d)(float64 a, float64 b, void *fpstp) \
2596 float_status *fpst = fpstp; \
2597 return float64_ ## name(a, b, fpst); \
2605 float32
VFP_HELPER(neg
, s
)(float32 a
)
2607 return float32_chs(a
);
2610 float64
VFP_HELPER(neg
, d
)(float64 a
)
2612 return float64_chs(a
);
2615 float32
VFP_HELPER(abs
, s
)(float32 a
)
2617 return float32_abs(a
);
2620 float64
VFP_HELPER(abs
, d
)(float64 a
)
2622 return float64_abs(a
);
2625 float32
VFP_HELPER(sqrt
, s
)(float32 a
, CPUState
*env
)
2627 return float32_sqrt(a
, &env
->vfp
.fp_status
);
2630 float64
VFP_HELPER(sqrt
, d
)(float64 a
, CPUState
*env
)
2632 return float64_sqrt(a
, &env
->vfp
.fp_status
);
2635 /* XXX: check quiet/signaling case */
2636 #define DO_VFP_cmp(p, type) \
2637 void VFP_HELPER(cmp, p)(type a, type b, CPUState *env) \
2640 switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
2641 case 0: flags = 0x6; break; \
2642 case -1: flags = 0x8; break; \
2643 case 1: flags = 0x2; break; \
2644 default: case 2: flags = 0x3; break; \
2646 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
2647 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
2649 void VFP_HELPER(cmpe, p)(type a, type b, CPUState *env) \
2652 switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
2653 case 0: flags = 0x6; break; \
2654 case -1: flags = 0x8; break; \
2655 case 1: flags = 0x2; break; \
2656 default: case 2: flags = 0x3; break; \
2658 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
2659 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
2661 DO_VFP_cmp(s
, float32
)
2662 DO_VFP_cmp(d
, float64
)
2665 /* Integer to float and float to integer conversions */
2667 #define CONV_ITOF(name, fsz, sign) \
2668 float##fsz HELPER(name)(uint32_t x, void *fpstp) \
2670 float_status *fpst = fpstp; \
2671 return sign##int32_to_##float##fsz(x, fpst); \
2674 #define CONV_FTOI(name, fsz, sign, round) \
2675 uint32_t HELPER(name)(float##fsz x, void *fpstp) \
2677 float_status *fpst = fpstp; \
2678 if (float##fsz##_is_any_nan(x)) { \
2679 float_raise(float_flag_invalid, fpst); \
2682 return float##fsz##_to_##sign##int32##round(x, fpst); \
2685 #define FLOAT_CONVS(name, p, fsz, sign) \
2686 CONV_ITOF(vfp_##name##to##p, fsz, sign) \
2687 CONV_FTOI(vfp_to##name##p, fsz, sign, ) \
2688 CONV_FTOI(vfp_to##name##z##p, fsz, sign, _round_to_zero)
2690 FLOAT_CONVS(si
, s
, 32, )
2691 FLOAT_CONVS(si
, d
, 64, )
2692 FLOAT_CONVS(ui
, s
, 32, u
)
2693 FLOAT_CONVS(ui
, d
, 64, u
)
2699 /* floating point conversion */
2700 float64
VFP_HELPER(fcvtd
, s
)(float32 x
, CPUState
*env
)
2702 float64 r
= float32_to_float64(x
, &env
->vfp
.fp_status
);
2703 /* ARM requires that S<->D conversion of any kind of NaN generates
2704 * a quiet NaN by forcing the most significant frac bit to 1.
2706 return float64_maybe_silence_nan(r
);
2709 float32
VFP_HELPER(fcvts
, d
)(float64 x
, CPUState
*env
)
2711 float32 r
= float64_to_float32(x
, &env
->vfp
.fp_status
);
2712 /* ARM requires that S<->D conversion of any kind of NaN generates
2713 * a quiet NaN by forcing the most significant frac bit to 1.
2715 return float32_maybe_silence_nan(r
);
2718 /* VFP3 fixed point conversion. */
2719 #define VFP_CONV_FIX(name, p, fsz, itype, sign) \
2720 float##fsz HELPER(vfp_##name##to##p)(uint##fsz##_t x, uint32_t shift, \
2723 float_status *fpst = fpstp; \
2725 tmp = sign##int32_to_##float##fsz((itype##_t)x, fpst); \
2726 return float##fsz##_scalbn(tmp, -(int)shift, fpst); \
2728 uint##fsz##_t HELPER(vfp_to##name##p)(float##fsz x, uint32_t shift, \
2731 float_status *fpst = fpstp; \
2733 if (float##fsz##_is_any_nan(x)) { \
2734 float_raise(float_flag_invalid, fpst); \
2737 tmp = float##fsz##_scalbn(x, shift, fpst); \
2738 return float##fsz##_to_##itype##_round_to_zero(tmp, fpst); \
2741 VFP_CONV_FIX(sh
, d
, 64, int16
, )
2742 VFP_CONV_FIX(sl
, d
, 64, int32
, )
2743 VFP_CONV_FIX(uh
, d
, 64, uint16
, u
)
2744 VFP_CONV_FIX(ul
, d
, 64, uint32
, u
)
2745 VFP_CONV_FIX(sh
, s
, 32, int16
, )
2746 VFP_CONV_FIX(sl
, s
, 32, int32
, )
2747 VFP_CONV_FIX(uh
, s
, 32, uint16
, u
)
2748 VFP_CONV_FIX(ul
, s
, 32, uint32
, u
)
2751 /* Half precision conversions. */
2752 static float32
do_fcvt_f16_to_f32(uint32_t a
, CPUState
*env
, float_status
*s
)
2754 int ieee
= (env
->vfp
.xregs
[ARM_VFP_FPSCR
] & (1 << 26)) == 0;
2755 float32 r
= float16_to_float32(make_float16(a
), ieee
, s
);
2757 return float32_maybe_silence_nan(r
);
2762 static uint32_t do_fcvt_f32_to_f16(float32 a
, CPUState
*env
, float_status
*s
)
2764 int ieee
= (env
->vfp
.xregs
[ARM_VFP_FPSCR
] & (1 << 26)) == 0;
2765 float16 r
= float32_to_float16(a
, ieee
, s
);
2767 r
= float16_maybe_silence_nan(r
);
2769 return float16_val(r
);
2772 float32
HELPER(neon_fcvt_f16_to_f32
)(uint32_t a
, CPUState
*env
)
2774 return do_fcvt_f16_to_f32(a
, env
, &env
->vfp
.standard_fp_status
);
2777 uint32_t HELPER(neon_fcvt_f32_to_f16
)(float32 a
, CPUState
*env
)
2779 return do_fcvt_f32_to_f16(a
, env
, &env
->vfp
.standard_fp_status
);
2782 float32
HELPER(vfp_fcvt_f16_to_f32
)(uint32_t a
, CPUState
*env
)
2784 return do_fcvt_f16_to_f32(a
, env
, &env
->vfp
.fp_status
);
2787 uint32_t HELPER(vfp_fcvt_f32_to_f16
)(float32 a
, CPUState
*env
)
2789 return do_fcvt_f32_to_f16(a
, env
, &env
->vfp
.fp_status
);
2792 #define float32_two make_float32(0x40000000)
2793 #define float32_three make_float32(0x40400000)
2794 #define float32_one_point_five make_float32(0x3fc00000)
2796 float32
HELPER(recps_f32
)(float32 a
, float32 b
, CPUState
*env
)
2798 float_status
*s
= &env
->vfp
.standard_fp_status
;
2799 if ((float32_is_infinity(a
) && float32_is_zero_or_denormal(b
)) ||
2800 (float32_is_infinity(b
) && float32_is_zero_or_denormal(a
))) {
2801 if (!(float32_is_zero(a
) || float32_is_zero(b
))) {
2802 float_raise(float_flag_input_denormal
, s
);
2806 return float32_sub(float32_two
, float32_mul(a
, b
, s
), s
);
2809 float32
HELPER(rsqrts_f32
)(float32 a
, float32 b
, CPUState
*env
)
2811 float_status
*s
= &env
->vfp
.standard_fp_status
;
2813 if ((float32_is_infinity(a
) && float32_is_zero_or_denormal(b
)) ||
2814 (float32_is_infinity(b
) && float32_is_zero_or_denormal(a
))) {
2815 if (!(float32_is_zero(a
) || float32_is_zero(b
))) {
2816 float_raise(float_flag_input_denormal
, s
);
2818 return float32_one_point_five
;
2820 product
= float32_mul(a
, b
, s
);
2821 return float32_div(float32_sub(float32_three
, product
, s
), float32_two
, s
);
2826 /* Constants 256 and 512 are used in some helpers; we avoid relying on
2827 * int->float conversions at run-time. */
2828 #define float64_256 make_float64(0x4070000000000000LL)
2829 #define float64_512 make_float64(0x4080000000000000LL)
2831 /* The algorithm that must be used to calculate the estimate
2832 * is specified by the ARM ARM.
2834 static float64
recip_estimate(float64 a
, CPUState
*env
)
2836 /* These calculations mustn't set any fp exception flags,
2837 * so we use a local copy of the fp_status.
2839 float_status dummy_status
= env
->vfp
.standard_fp_status
;
2840 float_status
*s
= &dummy_status
;
2841 /* q = (int)(a * 512.0) */
2842 float64 q
= float64_mul(float64_512
, a
, s
);
2843 int64_t q_int
= float64_to_int64_round_to_zero(q
, s
);
2845 /* r = 1.0 / (((double)q + 0.5) / 512.0) */
2846 q
= int64_to_float64(q_int
, s
);
2847 q
= float64_add(q
, float64_half
, s
);
2848 q
= float64_div(q
, float64_512
, s
);
2849 q
= float64_div(float64_one
, q
, s
);
2851 /* s = (int)(256.0 * r + 0.5) */
2852 q
= float64_mul(q
, float64_256
, s
);
2853 q
= float64_add(q
, float64_half
, s
);
2854 q_int
= float64_to_int64_round_to_zero(q
, s
);
2856 /* return (double)s / 256.0 */
2857 return float64_div(int64_to_float64(q_int
, s
), float64_256
, s
);
2860 float32
HELPER(recpe_f32
)(float32 a
, CPUState
*env
)
2862 float_status
*s
= &env
->vfp
.standard_fp_status
;
2864 uint32_t val32
= float32_val(a
);
2867 int a_exp
= (val32
& 0x7f800000) >> 23;
2868 int sign
= val32
& 0x80000000;
2870 if (float32_is_any_nan(a
)) {
2871 if (float32_is_signaling_nan(a
)) {
2872 float_raise(float_flag_invalid
, s
);
2874 return float32_default_nan
;
2875 } else if (float32_is_infinity(a
)) {
2876 return float32_set_sign(float32_zero
, float32_is_neg(a
));
2877 } else if (float32_is_zero_or_denormal(a
)) {
2878 if (!float32_is_zero(a
)) {
2879 float_raise(float_flag_input_denormal
, s
);
2881 float_raise(float_flag_divbyzero
, s
);
2882 return float32_set_sign(float32_infinity
, float32_is_neg(a
));
2883 } else if (a_exp
>= 253) {
2884 float_raise(float_flag_underflow
, s
);
2885 return float32_set_sign(float32_zero
, float32_is_neg(a
));
2888 f64
= make_float64((0x3feULL
<< 52)
2889 | ((int64_t)(val32
& 0x7fffff) << 29));
2891 result_exp
= 253 - a_exp
;
2893 f64
= recip_estimate(f64
, env
);
2896 | ((result_exp
& 0xff) << 23)
2897 | ((float64_val(f64
) >> 29) & 0x7fffff);
2898 return make_float32(val32
);
2901 /* The algorithm that must be used to calculate the estimate
2902 * is specified by the ARM ARM.
2904 static float64
recip_sqrt_estimate(float64 a
, CPUState
*env
)
2906 /* These calculations mustn't set any fp exception flags,
2907 * so we use a local copy of the fp_status.
2909 float_status dummy_status
= env
->vfp
.standard_fp_status
;
2910 float_status
*s
= &dummy_status
;
2914 if (float64_lt(a
, float64_half
, s
)) {
2915 /* range 0.25 <= a < 0.5 */
2917 /* a in units of 1/512 rounded down */
2918 /* q0 = (int)(a * 512.0); */
2919 q
= float64_mul(float64_512
, a
, s
);
2920 q_int
= float64_to_int64_round_to_zero(q
, s
);
2922 /* reciprocal root r */
2923 /* r = 1.0 / sqrt(((double)q0 + 0.5) / 512.0); */
2924 q
= int64_to_float64(q_int
, s
);
2925 q
= float64_add(q
, float64_half
, s
);
2926 q
= float64_div(q
, float64_512
, s
);
2927 q
= float64_sqrt(q
, s
);
2928 q
= float64_div(float64_one
, q
, s
);
2930 /* range 0.5 <= a < 1.0 */
2932 /* a in units of 1/256 rounded down */
2933 /* q1 = (int)(a * 256.0); */
2934 q
= float64_mul(float64_256
, a
, s
);
2935 int64_t q_int
= float64_to_int64_round_to_zero(q
, s
);
2937 /* reciprocal root r */
2938 /* r = 1.0 /sqrt(((double)q1 + 0.5) / 256); */
2939 q
= int64_to_float64(q_int
, s
);
2940 q
= float64_add(q
, float64_half
, s
);
2941 q
= float64_div(q
, float64_256
, s
);
2942 q
= float64_sqrt(q
, s
);
2943 q
= float64_div(float64_one
, q
, s
);
2945 /* r in units of 1/256 rounded to nearest */
2946 /* s = (int)(256.0 * r + 0.5); */
2948 q
= float64_mul(q
, float64_256
,s
);
2949 q
= float64_add(q
, float64_half
, s
);
2950 q_int
= float64_to_int64_round_to_zero(q
, s
);
2952 /* return (double)s / 256.0;*/
2953 return float64_div(int64_to_float64(q_int
, s
), float64_256
, s
);
2956 float32
HELPER(rsqrte_f32
)(float32 a
, CPUState
*env
)
2958 float_status
*s
= &env
->vfp
.standard_fp_status
;
2964 val
= float32_val(a
);
2966 if (float32_is_any_nan(a
)) {
2967 if (float32_is_signaling_nan(a
)) {
2968 float_raise(float_flag_invalid
, s
);
2970 return float32_default_nan
;
2971 } else if (float32_is_zero_or_denormal(a
)) {
2972 if (!float32_is_zero(a
)) {
2973 float_raise(float_flag_input_denormal
, s
);
2975 float_raise(float_flag_divbyzero
, s
);
2976 return float32_set_sign(float32_infinity
, float32_is_neg(a
));
2977 } else if (float32_is_neg(a
)) {
2978 float_raise(float_flag_invalid
, s
);
2979 return float32_default_nan
;
2980 } else if (float32_is_infinity(a
)) {
2981 return float32_zero
;
2984 /* Normalize to a double-precision value between 0.25 and 1.0,
2985 * preserving the parity of the exponent. */
2986 if ((val
& 0x800000) == 0) {
2987 f64
= make_float64(((uint64_t)(val
& 0x80000000) << 32)
2989 | ((uint64_t)(val
& 0x7fffff) << 29));
2991 f64
= make_float64(((uint64_t)(val
& 0x80000000) << 32)
2993 | ((uint64_t)(val
& 0x7fffff) << 29));
2996 result_exp
= (380 - ((val
& 0x7f800000) >> 23)) / 2;
2998 f64
= recip_sqrt_estimate(f64
, env
);
3000 val64
= float64_val(f64
);
3002 val
= ((val64
>> 63) & 0x80000000)
3003 | ((result_exp
& 0xff) << 23)
3004 | ((val64
>> 29) & 0x7fffff);
3005 return make_float32(val
);
3008 uint32_t HELPER(recpe_u32
)(uint32_t a
, CPUState
*env
)
3012 if ((a
& 0x80000000) == 0) {
3016 f64
= make_float64((0x3feULL
<< 52)
3017 | ((int64_t)(a
& 0x7fffffff) << 21));
3019 f64
= recip_estimate (f64
, env
);
3021 return 0x80000000 | ((float64_val(f64
) >> 21) & 0x7fffffff);
3024 uint32_t HELPER(rsqrte_u32
)(uint32_t a
, CPUState
*env
)
3028 if ((a
& 0xc0000000) == 0) {
3032 if (a
& 0x80000000) {
3033 f64
= make_float64((0x3feULL
<< 52)
3034 | ((uint64_t)(a
& 0x7fffffff) << 21));
3035 } else { /* bits 31-30 == '01' */
3036 f64
= make_float64((0x3fdULL
<< 52)
3037 | ((uint64_t)(a
& 0x3fffffff) << 22));
3040 f64
= recip_sqrt_estimate(f64
, env
);
3042 return 0x80000000 | ((float64_val(f64
) >> 21) & 0x7fffffff);
3045 void HELPER(set_teecr
)(CPUState
*env
, uint32_t val
)
3048 if (env
->teecr
!= val
) {