virtio-scsi: suppress virtqueue kick during processing
[qemu.git] / target / arm / op_helper.c
1 /*
2 * ARM helper routines
3 *
4 * Copyright (c) 2005-2007 CodeSourcery, LLC
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19 #include "qemu/osdep.h"
20 #include "qemu/log.h"
21 #include "cpu.h"
22 #include "exec/helper-proto.h"
23 #include "internals.h"
24 #include "exec/exec-all.h"
25 #include "exec/cpu_ldst.h"
26
27 #define SIGNBIT (uint32_t)0x80000000
28 #define SIGNBIT64 ((uint64_t)1 << 63)
29
30 static void raise_exception(CPUARMState *env, uint32_t excp,
31 uint32_t syndrome, uint32_t target_el)
32 {
33 CPUState *cs = CPU(arm_env_get_cpu(env));
34
35 assert(!excp_is_internal(excp));
36 cs->exception_index = excp;
37 env->exception.syndrome = syndrome;
38 env->exception.target_el = target_el;
39 cpu_loop_exit(cs);
40 }
41
42 static int exception_target_el(CPUARMState *env)
43 {
44 int target_el = MAX(1, arm_current_el(env));
45
46 /* No such thing as secure EL1 if EL3 is aarch32, so update the target EL
47 * to EL3 in this case.
48 */
49 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
50 target_el = 3;
51 }
52
53 return target_el;
54 }
55
56 uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
57 uint32_t rn, uint32_t maxindex)
58 {
59 uint32_t val;
60 uint32_t tmp;
61 int index;
62 int shift;
63 uint64_t *table;
64 table = (uint64_t *)&env->vfp.regs[rn];
65 val = 0;
66 for (shift = 0; shift < 32; shift += 8) {
67 index = (ireg >> shift) & 0xff;
68 if (index < maxindex) {
69 tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
70 val |= tmp << shift;
71 } else {
72 val |= def & (0xff << shift);
73 }
74 }
75 return val;
76 }
77
78 #if !defined(CONFIG_USER_ONLY)
79
80 static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
81 unsigned int target_el,
82 bool same_el,
83 bool s1ptw, bool is_write,
84 int fsc)
85 {
86 uint32_t syn;
87
88 /* ISV is only set for data aborts routed to EL2 and
89 * never for stage-1 page table walks faulting on stage 2.
90 *
91 * Furthermore, ISV is only set for certain kinds of load/stores.
92 * If the template syndrome does not have ISV set, we should leave
93 * it cleared.
94 *
95 * See ARMv8 specs, D7-1974:
96 * ISS encoding for an exception from a Data Abort, the
97 * ISV field.
98 */
99 if (!(template_syn & ARM_EL_ISV) || target_el != 2 || s1ptw) {
100 syn = syn_data_abort_no_iss(same_el,
101 0, 0, s1ptw, is_write, fsc);
102 } else {
103 /* Fields: IL, ISV, SAS, SSE, SRT, SF and AR come from the template
104 * syndrome created at translation time.
105 * Now we create the runtime syndrome with the remaining fields.
106 */
107 syn = syn_data_abort_with_iss(same_el,
108 0, 0, 0, 0, 0,
109 0, 0, s1ptw, is_write, fsc,
110 false);
111 /* Merge the runtime syndrome with the template syndrome. */
112 syn |= template_syn;
113 }
114 return syn;
115 }
116
117 /* try to fill the TLB and return an exception if error. If retaddr is
118 * NULL, it means that the function was called in C code (i.e. not
119 * from generated code or from helper.c)
120 */
121 void tlb_fill(CPUState *cs, target_ulong addr, MMUAccessType access_type,
122 int mmu_idx, uintptr_t retaddr)
123 {
124 bool ret;
125 uint32_t fsr = 0;
126 ARMMMUFaultInfo fi = {};
127
128 ret = arm_tlb_fill(cs, addr, access_type, mmu_idx, &fsr, &fi);
129 if (unlikely(ret)) {
130 ARMCPU *cpu = ARM_CPU(cs);
131 CPUARMState *env = &cpu->env;
132 uint32_t syn, exc;
133 unsigned int target_el;
134 bool same_el;
135
136 if (retaddr) {
137 /* now we have a real cpu fault */
138 cpu_restore_state(cs, retaddr);
139 }
140
141 target_el = exception_target_el(env);
142 if (fi.stage2) {
143 target_el = 2;
144 env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4;
145 }
146 same_el = arm_current_el(env) == target_el;
147 /* AArch64 syndrome does not have an LPAE bit */
148 syn = fsr & ~(1 << 9);
149
150 /* For insn and data aborts we assume there is no instruction syndrome
151 * information; this is always true for exceptions reported to EL1.
152 */
153 if (access_type == MMU_INST_FETCH) {
154 syn = syn_insn_abort(same_el, 0, fi.s1ptw, syn);
155 exc = EXCP_PREFETCH_ABORT;
156 } else {
157 syn = merge_syn_data_abort(env->exception.syndrome, target_el,
158 same_el, fi.s1ptw,
159 access_type == MMU_DATA_STORE, syn);
160 if (access_type == MMU_DATA_STORE
161 && arm_feature(env, ARM_FEATURE_V6)) {
162 fsr |= (1 << 11);
163 }
164 exc = EXCP_DATA_ABORT;
165 }
166
167 env->exception.vaddress = addr;
168 env->exception.fsr = fsr;
169 raise_exception(env, exc, syn, target_el);
170 }
171 }
172
173 /* Raise a data fault alignment exception for the specified virtual address */
174 void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
175 MMUAccessType access_type,
176 int mmu_idx, uintptr_t retaddr)
177 {
178 ARMCPU *cpu = ARM_CPU(cs);
179 CPUARMState *env = &cpu->env;
180 int target_el;
181 bool same_el;
182 uint32_t syn;
183
184 if (retaddr) {
185 /* now we have a real cpu fault */
186 cpu_restore_state(cs, retaddr);
187 }
188
189 target_el = exception_target_el(env);
190 same_el = (arm_current_el(env) == target_el);
191
192 env->exception.vaddress = vaddr;
193
194 /* the DFSR for an alignment fault depends on whether we're using
195 * the LPAE long descriptor format, or the short descriptor format
196 */
197 if (arm_s1_regime_using_lpae_format(env, cpu_mmu_index(env, false))) {
198 env->exception.fsr = (1 << 9) | 0x21;
199 } else {
200 env->exception.fsr = 0x1;
201 }
202
203 if (access_type == MMU_DATA_STORE && arm_feature(env, ARM_FEATURE_V6)) {
204 env->exception.fsr |= (1 << 11);
205 }
206
207 syn = merge_syn_data_abort(env->exception.syndrome, target_el,
208 same_el, 0, access_type == MMU_DATA_STORE,
209 0x21);
210 raise_exception(env, EXCP_DATA_ABORT, syn, target_el);
211 }
212
213 #endif /* !defined(CONFIG_USER_ONLY) */
214
215 uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
216 {
217 uint32_t res = a + b;
218 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
219 env->QF = 1;
220 return res;
221 }
222
223 uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
224 {
225 uint32_t res = a + b;
226 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
227 env->QF = 1;
228 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
229 }
230 return res;
231 }
232
233 uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
234 {
235 uint32_t res = a - b;
236 if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
237 env->QF = 1;
238 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
239 }
240 return res;
241 }
242
243 uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
244 {
245 uint32_t res;
246 if (val >= 0x40000000) {
247 res = ~SIGNBIT;
248 env->QF = 1;
249 } else if (val <= (int32_t)0xc0000000) {
250 res = SIGNBIT;
251 env->QF = 1;
252 } else {
253 res = val << 1;
254 }
255 return res;
256 }
257
258 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
259 {
260 uint32_t res = a + b;
261 if (res < a) {
262 env->QF = 1;
263 res = ~0;
264 }
265 return res;
266 }
267
268 uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
269 {
270 uint32_t res = a - b;
271 if (res > a) {
272 env->QF = 1;
273 res = 0;
274 }
275 return res;
276 }
277
278 /* Signed saturation. */
279 static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
280 {
281 int32_t top;
282 uint32_t mask;
283
284 top = val >> shift;
285 mask = (1u << shift) - 1;
286 if (top > 0) {
287 env->QF = 1;
288 return mask;
289 } else if (top < -1) {
290 env->QF = 1;
291 return ~mask;
292 }
293 return val;
294 }
295
296 /* Unsigned saturation. */
297 static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
298 {
299 uint32_t max;
300
301 max = (1u << shift) - 1;
302 if (val < 0) {
303 env->QF = 1;
304 return 0;
305 } else if (val > max) {
306 env->QF = 1;
307 return max;
308 }
309 return val;
310 }
311
312 /* Signed saturate. */
313 uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
314 {
315 return do_ssat(env, x, shift);
316 }
317
318 /* Dual halfword signed saturate. */
319 uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
320 {
321 uint32_t res;
322
323 res = (uint16_t)do_ssat(env, (int16_t)x, shift);
324 res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
325 return res;
326 }
327
328 /* Unsigned saturate. */
329 uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
330 {
331 return do_usat(env, x, shift);
332 }
333
334 /* Dual halfword unsigned saturate. */
335 uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
336 {
337 uint32_t res;
338
339 res = (uint16_t)do_usat(env, (int16_t)x, shift);
340 res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
341 return res;
342 }
343
344 void HELPER(setend)(CPUARMState *env)
345 {
346 env->uncached_cpsr ^= CPSR_E;
347 }
348
349 /* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped.
350 * The function returns the target EL (1-3) if the instruction is to be trapped;
351 * otherwise it returns 0 indicating it is not trapped.
352 */
353 static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
354 {
355 int cur_el = arm_current_el(env);
356 uint64_t mask;
357
358 /* If we are currently in EL0 then we need to check if SCTLR is set up for
359 * WFx instructions being trapped to EL1. These trap bits don't exist in v7.
360 */
361 if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) {
362 int target_el;
363
364 mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI;
365 if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) {
366 /* Secure EL0 and Secure PL1 is at EL3 */
367 target_el = 3;
368 } else {
369 target_el = 1;
370 }
371
372 if (!(env->cp15.sctlr_el[target_el] & mask)) {
373 return target_el;
374 }
375 }
376
377 /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it
378 * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the
379 * bits will be zero indicating no trap.
380 */
381 if (cur_el < 2 && !arm_is_secure(env)) {
382 mask = (is_wfe) ? HCR_TWE : HCR_TWI;
383 if (env->cp15.hcr_el2 & mask) {
384 return 2;
385 }
386 }
387
388 /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */
389 if (cur_el < 3) {
390 mask = (is_wfe) ? SCR_TWE : SCR_TWI;
391 if (env->cp15.scr_el3 & mask) {
392 return 3;
393 }
394 }
395
396 return 0;
397 }
398
399 void HELPER(wfi)(CPUARMState *env)
400 {
401 CPUState *cs = CPU(arm_env_get_cpu(env));
402 int target_el = check_wfx_trap(env, false);
403
404 if (cpu_has_work(cs)) {
405 /* Don't bother to go into our "low power state" if
406 * we would just wake up immediately.
407 */
408 return;
409 }
410
411 if (target_el) {
412 env->pc -= 4;
413 raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0), target_el);
414 }
415
416 cs->exception_index = EXCP_HLT;
417 cs->halted = 1;
418 cpu_loop_exit(cs);
419 }
420
421 void HELPER(wfe)(CPUARMState *env)
422 {
423 /* This is a hint instruction that is semantically different
424 * from YIELD even though we currently implement it identically.
425 * Don't actually halt the CPU, just yield back to top
426 * level loop. This is not going into a "low power state"
427 * (ie halting until some event occurs), so we never take
428 * a configurable trap to a different exception level.
429 */
430 HELPER(yield)(env);
431 }
432
433 void HELPER(yield)(CPUARMState *env)
434 {
435 ARMCPU *cpu = arm_env_get_cpu(env);
436 CPUState *cs = CPU(cpu);
437
438 /* This is a non-trappable hint instruction that generally indicates
439 * that the guest is currently busy-looping. Yield control back to the
440 * top level loop so that a more deserving VCPU has a chance to run.
441 */
442 cs->exception_index = EXCP_YIELD;
443 cpu_loop_exit(cs);
444 }
445
446 /* Raise an internal-to-QEMU exception. This is limited to only
447 * those EXCP values which are special cases for QEMU to interrupt
448 * execution and not to be used for exceptions which are passed to
449 * the guest (those must all have syndrome information and thus should
450 * use exception_with_syndrome).
451 */
452 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
453 {
454 CPUState *cs = CPU(arm_env_get_cpu(env));
455
456 assert(excp_is_internal(excp));
457 cs->exception_index = excp;
458 cpu_loop_exit(cs);
459 }
460
461 /* Raise an exception with the specified syndrome register value */
462 void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
463 uint32_t syndrome, uint32_t target_el)
464 {
465 raise_exception(env, excp, syndrome, target_el);
466 }
467
468 uint32_t HELPER(cpsr_read)(CPUARMState *env)
469 {
470 return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED);
471 }
472
473 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
474 {
475 cpsr_write(env, val, mask, CPSRWriteByInstr);
476 }
477
478 /* Write the CPSR for a 32-bit exception return */
479 void HELPER(cpsr_write_eret)(CPUARMState *env, uint32_t val)
480 {
481 cpsr_write(env, val, CPSR_ERET_MASK, CPSRWriteExceptionReturn);
482
483 /* Generated code has already stored the new PC value, but
484 * without masking out its low bits, because which bits need
485 * masking depends on whether we're returning to Thumb or ARM
486 * state. Do the masking now.
487 */
488 env->regs[15] &= (env->thumb ? ~1 : ~3);
489
490 arm_call_el_change_hook(arm_env_get_cpu(env));
491 }
492
493 /* Access to user mode registers from privileged modes. */
494 uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
495 {
496 uint32_t val;
497
498 if (regno == 13) {
499 val = env->banked_r13[BANK_USRSYS];
500 } else if (regno == 14) {
501 val = env->banked_r14[BANK_USRSYS];
502 } else if (regno >= 8
503 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
504 val = env->usr_regs[regno - 8];
505 } else {
506 val = env->regs[regno];
507 }
508 return val;
509 }
510
511 void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
512 {
513 if (regno == 13) {
514 env->banked_r13[BANK_USRSYS] = val;
515 } else if (regno == 14) {
516 env->banked_r14[BANK_USRSYS] = val;
517 } else if (regno >= 8
518 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
519 env->usr_regs[regno - 8] = val;
520 } else {
521 env->regs[regno] = val;
522 }
523 }
524
525 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
526 {
527 if ((env->uncached_cpsr & CPSR_M) == mode) {
528 env->regs[13] = val;
529 } else {
530 env->banked_r13[bank_number(mode)] = val;
531 }
532 }
533
534 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
535 {
536 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_SYS) {
537 /* SRS instruction is UNPREDICTABLE from System mode; we UNDEF.
538 * Other UNPREDICTABLE and UNDEF cases were caught at translate time.
539 */
540 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
541 exception_target_el(env));
542 }
543
544 if ((env->uncached_cpsr & CPSR_M) == mode) {
545 return env->regs[13];
546 } else {
547 return env->banked_r13[bank_number(mode)];
548 }
549 }
550
551 static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,
552 uint32_t regno)
553 {
554 /* Raise an exception if the requested access is one of the UNPREDICTABLE
555 * cases; otherwise return. This broadly corresponds to the pseudocode
556 * BankedRegisterAccessValid() and SPSRAccessValid(),
557 * except that we have already handled some cases at translate time.
558 */
559 int curmode = env->uncached_cpsr & CPSR_M;
560
561 if (curmode == tgtmode) {
562 goto undef;
563 }
564
565 if (tgtmode == ARM_CPU_MODE_USR) {
566 switch (regno) {
567 case 8 ... 12:
568 if (curmode != ARM_CPU_MODE_FIQ) {
569 goto undef;
570 }
571 break;
572 case 13:
573 if (curmode == ARM_CPU_MODE_SYS) {
574 goto undef;
575 }
576 break;
577 case 14:
578 if (curmode == ARM_CPU_MODE_HYP || curmode == ARM_CPU_MODE_SYS) {
579 goto undef;
580 }
581 break;
582 default:
583 break;
584 }
585 }
586
587 if (tgtmode == ARM_CPU_MODE_HYP) {
588 switch (regno) {
589 case 17: /* ELR_Hyp */
590 if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {
591 goto undef;
592 }
593 break;
594 default:
595 if (curmode != ARM_CPU_MODE_MON) {
596 goto undef;
597 }
598 break;
599 }
600 }
601
602 return;
603
604 undef:
605 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
606 exception_target_el(env));
607 }
608
609 void HELPER(msr_banked)(CPUARMState *env, uint32_t value, uint32_t tgtmode,
610 uint32_t regno)
611 {
612 msr_mrs_banked_exc_checks(env, tgtmode, regno);
613
614 switch (regno) {
615 case 16: /* SPSRs */
616 env->banked_spsr[bank_number(tgtmode)] = value;
617 break;
618 case 17: /* ELR_Hyp */
619 env->elr_el[2] = value;
620 break;
621 case 13:
622 env->banked_r13[bank_number(tgtmode)] = value;
623 break;
624 case 14:
625 env->banked_r14[bank_number(tgtmode)] = value;
626 break;
627 case 8 ... 12:
628 switch (tgtmode) {
629 case ARM_CPU_MODE_USR:
630 env->usr_regs[regno - 8] = value;
631 break;
632 case ARM_CPU_MODE_FIQ:
633 env->fiq_regs[regno - 8] = value;
634 break;
635 default:
636 g_assert_not_reached();
637 }
638 break;
639 default:
640 g_assert_not_reached();
641 }
642 }
643
644 uint32_t HELPER(mrs_banked)(CPUARMState *env, uint32_t tgtmode, uint32_t regno)
645 {
646 msr_mrs_banked_exc_checks(env, tgtmode, regno);
647
648 switch (regno) {
649 case 16: /* SPSRs */
650 return env->banked_spsr[bank_number(tgtmode)];
651 case 17: /* ELR_Hyp */
652 return env->elr_el[2];
653 case 13:
654 return env->banked_r13[bank_number(tgtmode)];
655 case 14:
656 return env->banked_r14[bank_number(tgtmode)];
657 case 8 ... 12:
658 switch (tgtmode) {
659 case ARM_CPU_MODE_USR:
660 return env->usr_regs[regno - 8];
661 case ARM_CPU_MODE_FIQ:
662 return env->fiq_regs[regno - 8];
663 default:
664 g_assert_not_reached();
665 }
666 default:
667 g_assert_not_reached();
668 }
669 }
670
671 void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome,
672 uint32_t isread)
673 {
674 const ARMCPRegInfo *ri = rip;
675 int target_el;
676
677 if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
678 && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
679 raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
680 }
681
682 if (!ri->accessfn) {
683 return;
684 }
685
686 switch (ri->accessfn(env, ri, isread)) {
687 case CP_ACCESS_OK:
688 return;
689 case CP_ACCESS_TRAP:
690 target_el = exception_target_el(env);
691 break;
692 case CP_ACCESS_TRAP_EL2:
693 /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
694 * a bug in the access function.
695 */
696 assert(!arm_is_secure(env) && arm_current_el(env) != 3);
697 target_el = 2;
698 break;
699 case CP_ACCESS_TRAP_EL3:
700 target_el = 3;
701 break;
702 case CP_ACCESS_TRAP_UNCATEGORIZED:
703 target_el = exception_target_el(env);
704 syndrome = syn_uncategorized();
705 break;
706 case CP_ACCESS_TRAP_UNCATEGORIZED_EL2:
707 target_el = 2;
708 syndrome = syn_uncategorized();
709 break;
710 case CP_ACCESS_TRAP_UNCATEGORIZED_EL3:
711 target_el = 3;
712 syndrome = syn_uncategorized();
713 break;
714 case CP_ACCESS_TRAP_FP_EL2:
715 target_el = 2;
716 /* Since we are an implementation that takes exceptions on a trapped
717 * conditional insn only if the insn has passed its condition code
718 * check, we take the IMPDEF choice to always report CV=1 COND=0xe
719 * (which is also the required value for AArch64 traps).
720 */
721 syndrome = syn_fp_access_trap(1, 0xe, false);
722 break;
723 case CP_ACCESS_TRAP_FP_EL3:
724 target_el = 3;
725 syndrome = syn_fp_access_trap(1, 0xe, false);
726 break;
727 default:
728 g_assert_not_reached();
729 }
730
731 raise_exception(env, EXCP_UDEF, syndrome, target_el);
732 }
733
734 void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
735 {
736 const ARMCPRegInfo *ri = rip;
737
738 ri->writefn(env, ri, value);
739 }
740
741 uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
742 {
743 const ARMCPRegInfo *ri = rip;
744
745 return ri->readfn(env, ri);
746 }
747
748 void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
749 {
750 const ARMCPRegInfo *ri = rip;
751
752 ri->writefn(env, ri, value);
753 }
754
755 uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
756 {
757 const ARMCPRegInfo *ri = rip;
758
759 return ri->readfn(env, ri);
760 }
761
762 void HELPER(msr_i_pstate)(CPUARMState *env, uint32_t op, uint32_t imm)
763 {
764 /* MSR_i to update PSTATE. This is OK from EL0 only if UMA is set.
765 * Note that SPSel is never OK from EL0; we rely on handle_msr_i()
766 * to catch that case at translate time.
767 */
768 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
769 uint32_t syndrome = syn_aa64_sysregtrap(0, extract32(op, 0, 3),
770 extract32(op, 3, 3), 4,
771 imm, 0x1f, 0);
772 raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
773 }
774
775 switch (op) {
776 case 0x05: /* SPSel */
777 update_spsel(env, imm);
778 break;
779 case 0x1e: /* DAIFSet */
780 env->daif |= (imm << 6) & PSTATE_DAIF;
781 break;
782 case 0x1f: /* DAIFClear */
783 env->daif &= ~((imm << 6) & PSTATE_DAIF);
784 break;
785 default:
786 g_assert_not_reached();
787 }
788 }
789
790 void HELPER(clear_pstate_ss)(CPUARMState *env)
791 {
792 env->pstate &= ~PSTATE_SS;
793 }
794
795 void HELPER(pre_hvc)(CPUARMState *env)
796 {
797 ARMCPU *cpu = arm_env_get_cpu(env);
798 int cur_el = arm_current_el(env);
799 /* FIXME: Use actual secure state. */
800 bool secure = false;
801 bool undef;
802
803 if (arm_is_psci_call(cpu, EXCP_HVC)) {
804 /* If PSCI is enabled and this looks like a valid PSCI call then
805 * that overrides the architecturally mandated HVC behaviour.
806 */
807 return;
808 }
809
810 if (!arm_feature(env, ARM_FEATURE_EL2)) {
811 /* If EL2 doesn't exist, HVC always UNDEFs */
812 undef = true;
813 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
814 /* EL3.HCE has priority over EL2.HCD. */
815 undef = !(env->cp15.scr_el3 & SCR_HCE);
816 } else {
817 undef = env->cp15.hcr_el2 & HCR_HCD;
818 }
819
820 /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
821 * For ARMv8/AArch64, HVC is allowed in EL3.
822 * Note that we've already trapped HVC from EL0 at translation
823 * time.
824 */
825 if (secure && (!is_a64(env) || cur_el == 1)) {
826 undef = true;
827 }
828
829 if (undef) {
830 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
831 exception_target_el(env));
832 }
833 }
834
835 void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
836 {
837 ARMCPU *cpu = arm_env_get_cpu(env);
838 int cur_el = arm_current_el(env);
839 bool secure = arm_is_secure(env);
840 bool smd = env->cp15.scr_el3 & SCR_SMD;
841 /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state.
842 * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization
843 * extensions, SMD only applies to NS state.
844 * On ARMv7 without the Virtualization extensions, the SMD bit
845 * doesn't exist, but we forbid the guest to set it to 1 in scr_write(),
846 * so we need not special case this here.
847 */
848 bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure;
849
850 if (arm_is_psci_call(cpu, EXCP_SMC)) {
851 /* If PSCI is enabled and this looks like a valid PSCI call then
852 * that overrides the architecturally mandated SMC behaviour.
853 */
854 return;
855 }
856
857 if (!arm_feature(env, ARM_FEATURE_EL3)) {
858 /* If we have no EL3 then SMC always UNDEFs */
859 undef = true;
860 } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
861 /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
862 raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
863 }
864
865 if (undef) {
866 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
867 exception_target_el(env));
868 }
869 }
870
871 static int el_from_spsr(uint32_t spsr)
872 {
873 /* Return the exception level that this SPSR is requesting a return to,
874 * or -1 if it is invalid (an illegal return)
875 */
876 if (spsr & PSTATE_nRW) {
877 switch (spsr & CPSR_M) {
878 case ARM_CPU_MODE_USR:
879 return 0;
880 case ARM_CPU_MODE_HYP:
881 return 2;
882 case ARM_CPU_MODE_FIQ:
883 case ARM_CPU_MODE_IRQ:
884 case ARM_CPU_MODE_SVC:
885 case ARM_CPU_MODE_ABT:
886 case ARM_CPU_MODE_UND:
887 case ARM_CPU_MODE_SYS:
888 return 1;
889 case ARM_CPU_MODE_MON:
890 /* Returning to Mon from AArch64 is never possible,
891 * so this is an illegal return.
892 */
893 default:
894 return -1;
895 }
896 } else {
897 if (extract32(spsr, 1, 1)) {
898 /* Return with reserved M[1] bit set */
899 return -1;
900 }
901 if (extract32(spsr, 0, 4) == 1) {
902 /* return to EL0 with M[0] bit set */
903 return -1;
904 }
905 return extract32(spsr, 2, 2);
906 }
907 }
908
909 void HELPER(exception_return)(CPUARMState *env)
910 {
911 int cur_el = arm_current_el(env);
912 unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
913 uint32_t spsr = env->banked_spsr[spsr_idx];
914 int new_el;
915 bool return_to_aa64 = (spsr & PSTATE_nRW) == 0;
916
917 aarch64_save_sp(env, cur_el);
918
919 env->exclusive_addr = -1;
920
921 /* We must squash the PSTATE.SS bit to zero unless both of the
922 * following hold:
923 * 1. debug exceptions are currently disabled
924 * 2. singlestep will be active in the EL we return to
925 * We check 1 here and 2 after we've done the pstate/cpsr write() to
926 * transition to the EL we're going to.
927 */
928 if (arm_generate_debug_exceptions(env)) {
929 spsr &= ~PSTATE_SS;
930 }
931
932 new_el = el_from_spsr(spsr);
933 if (new_el == -1) {
934 goto illegal_return;
935 }
936 if (new_el > cur_el
937 || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
938 /* Disallow return to an EL which is unimplemented or higher
939 * than the current one.
940 */
941 goto illegal_return;
942 }
943
944 if (new_el != 0 && arm_el_is_aa64(env, new_el) != return_to_aa64) {
945 /* Return to an EL which is configured for a different register width */
946 goto illegal_return;
947 }
948
949 if (new_el == 2 && arm_is_secure_below_el3(env)) {
950 /* Return to the non-existent secure-EL2 */
951 goto illegal_return;
952 }
953
954 if (new_el == 1 && (env->cp15.hcr_el2 & HCR_TGE)
955 && !arm_is_secure_below_el3(env)) {
956 goto illegal_return;
957 }
958
959 if (!return_to_aa64) {
960 env->aarch64 = 0;
961 /* We do a raw CPSR write because aarch64_sync_64_to_32()
962 * will sort the register banks out for us, and we've already
963 * caught all the bad-mode cases in el_from_spsr().
964 */
965 cpsr_write(env, spsr, ~0, CPSRWriteRaw);
966 if (!arm_singlestep_active(env)) {
967 env->uncached_cpsr &= ~PSTATE_SS;
968 }
969 aarch64_sync_64_to_32(env);
970
971 if (spsr & CPSR_T) {
972 env->regs[15] = env->elr_el[cur_el] & ~0x1;
973 } else {
974 env->regs[15] = env->elr_el[cur_el] & ~0x3;
975 }
976 qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to "
977 "AArch32 EL%d PC 0x%" PRIx32 "\n",
978 cur_el, new_el, env->regs[15]);
979 } else {
980 env->aarch64 = 1;
981 pstate_write(env, spsr);
982 if (!arm_singlestep_active(env)) {
983 env->pstate &= ~PSTATE_SS;
984 }
985 aarch64_restore_sp(env, new_el);
986 env->pc = env->elr_el[cur_el];
987 qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to "
988 "AArch64 EL%d PC 0x%" PRIx64 "\n",
989 cur_el, new_el, env->pc);
990 }
991
992 arm_call_el_change_hook(arm_env_get_cpu(env));
993
994 return;
995
996 illegal_return:
997 /* Illegal return events of various kinds have architecturally
998 * mandated behaviour:
999 * restore NZCV and DAIF from SPSR_ELx
1000 * set PSTATE.IL
1001 * restore PC from ELR_ELx
1002 * no change to exception level, execution state or stack pointer
1003 */
1004 env->pstate |= PSTATE_IL;
1005 env->pc = env->elr_el[cur_el];
1006 spsr &= PSTATE_NZCV | PSTATE_DAIF;
1007 spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF);
1008 pstate_write(env, spsr);
1009 if (!arm_singlestep_active(env)) {
1010 env->pstate &= ~PSTATE_SS;
1011 }
1012 qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: "
1013 "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc);
1014 }
1015
1016 /* Return true if the linked breakpoint entry lbn passes its checks */
1017 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
1018 {
1019 CPUARMState *env = &cpu->env;
1020 uint64_t bcr = env->cp15.dbgbcr[lbn];
1021 int brps = extract32(cpu->dbgdidr, 24, 4);
1022 int ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
1023 int bt;
1024 uint32_t contextidr;
1025
1026 /* Links to unimplemented or non-context aware breakpoints are
1027 * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
1028 * as if linked to an UNKNOWN context-aware breakpoint (in which
1029 * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
1030 * We choose the former.
1031 */
1032 if (lbn > brps || lbn < (brps - ctx_cmps)) {
1033 return false;
1034 }
1035
1036 bcr = env->cp15.dbgbcr[lbn];
1037
1038 if (extract64(bcr, 0, 1) == 0) {
1039 /* Linked breakpoint disabled : generate no events */
1040 return false;
1041 }
1042
1043 bt = extract64(bcr, 20, 4);
1044
1045 /* We match the whole register even if this is AArch32 using the
1046 * short descriptor format (in which case it holds both PROCID and ASID),
1047 * since we don't implement the optional v7 context ID masking.
1048 */
1049 contextidr = extract64(env->cp15.contextidr_el[1], 0, 32);
1050
1051 switch (bt) {
1052 case 3: /* linked context ID match */
1053 if (arm_current_el(env) > 1) {
1054 /* Context matches never fire in EL2 or (AArch64) EL3 */
1055 return false;
1056 }
1057 return (contextidr == extract64(env->cp15.dbgbvr[lbn], 0, 32));
1058 case 5: /* linked address mismatch (reserved in AArch64) */
1059 case 9: /* linked VMID match (reserved if no EL2) */
1060 case 11: /* linked context ID and VMID match (reserved if no EL2) */
1061 default:
1062 /* Links to Unlinked context breakpoints must generate no
1063 * events; we choose to do the same for reserved values too.
1064 */
1065 return false;
1066 }
1067
1068 return false;
1069 }
1070
1071 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
1072 {
1073 CPUARMState *env = &cpu->env;
1074 uint64_t cr;
1075 int pac, hmc, ssc, wt, lbn;
1076 /* Note that for watchpoints the check is against the CPU security
1077 * state, not the S/NS attribute on the offending data access.
1078 */
1079 bool is_secure = arm_is_secure(env);
1080 int access_el = arm_current_el(env);
1081
1082 if (is_wp) {
1083 CPUWatchpoint *wp = env->cpu_watchpoint[n];
1084
1085 if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
1086 return false;
1087 }
1088 cr = env->cp15.dbgwcr[n];
1089 if (wp->hitattrs.user) {
1090 /* The LDRT/STRT/LDT/STT "unprivileged access" instructions should
1091 * match watchpoints as if they were accesses done at EL0, even if
1092 * the CPU is at EL1 or higher.
1093 */
1094 access_el = 0;
1095 }
1096 } else {
1097 uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
1098
1099 if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
1100 return false;
1101 }
1102 cr = env->cp15.dbgbcr[n];
1103 }
1104 /* The WATCHPOINT_HIT flag guarantees us that the watchpoint is
1105 * enabled and that the address and access type match; for breakpoints
1106 * we know the address matched; check the remaining fields, including
1107 * linked breakpoints. We rely on WCR and BCR having the same layout
1108 * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
1109 * Note that some combinations of {PAC, HMC, SSC} are reserved and
1110 * must act either like some valid combination or as if the watchpoint
1111 * were disabled. We choose the former, and use this together with
1112 * the fact that EL3 must always be Secure and EL2 must always be
1113 * Non-Secure to simplify the code slightly compared to the full
1114 * table in the ARM ARM.
1115 */
1116 pac = extract64(cr, 1, 2);
1117 hmc = extract64(cr, 13, 1);
1118 ssc = extract64(cr, 14, 2);
1119
1120 switch (ssc) {
1121 case 0:
1122 break;
1123 case 1:
1124 case 3:
1125 if (is_secure) {
1126 return false;
1127 }
1128 break;
1129 case 2:
1130 if (!is_secure) {
1131 return false;
1132 }
1133 break;
1134 }
1135
1136 switch (access_el) {
1137 case 3:
1138 case 2:
1139 if (!hmc) {
1140 return false;
1141 }
1142 break;
1143 case 1:
1144 if (extract32(pac, 0, 1) == 0) {
1145 return false;
1146 }
1147 break;
1148 case 0:
1149 if (extract32(pac, 1, 1) == 0) {
1150 return false;
1151 }
1152 break;
1153 default:
1154 g_assert_not_reached();
1155 }
1156
1157 wt = extract64(cr, 20, 1);
1158 lbn = extract64(cr, 16, 4);
1159
1160 if (wt && !linked_bp_matches(cpu, lbn)) {
1161 return false;
1162 }
1163
1164 return true;
1165 }
1166
1167 static bool check_watchpoints(ARMCPU *cpu)
1168 {
1169 CPUARMState *env = &cpu->env;
1170 int n;
1171
1172 /* If watchpoints are disabled globally or we can't take debug
1173 * exceptions here then watchpoint firings are ignored.
1174 */
1175 if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
1176 || !arm_generate_debug_exceptions(env)) {
1177 return false;
1178 }
1179
1180 for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
1181 if (bp_wp_matches(cpu, n, true)) {
1182 return true;
1183 }
1184 }
1185 return false;
1186 }
1187
1188 static bool check_breakpoints(ARMCPU *cpu)
1189 {
1190 CPUARMState *env = &cpu->env;
1191 int n;
1192
1193 /* If breakpoints are disabled globally or we can't take debug
1194 * exceptions here then breakpoint firings are ignored.
1195 */
1196 if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
1197 || !arm_generate_debug_exceptions(env)) {
1198 return false;
1199 }
1200
1201 for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
1202 if (bp_wp_matches(cpu, n, false)) {
1203 return true;
1204 }
1205 }
1206 return false;
1207 }
1208
1209 void HELPER(check_breakpoints)(CPUARMState *env)
1210 {
1211 ARMCPU *cpu = arm_env_get_cpu(env);
1212
1213 if (check_breakpoints(cpu)) {
1214 HELPER(exception_internal(env, EXCP_DEBUG));
1215 }
1216 }
1217
1218 bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
1219 {
1220 /* Called by core code when a CPU watchpoint fires; need to check if this
1221 * is also an architectural watchpoint match.
1222 */
1223 ARMCPU *cpu = ARM_CPU(cs);
1224
1225 return check_watchpoints(cpu);
1226 }
1227
1228 void arm_debug_excp_handler(CPUState *cs)
1229 {
1230 /* Called by core code when a watchpoint or breakpoint fires;
1231 * need to check which one and raise the appropriate exception.
1232 */
1233 ARMCPU *cpu = ARM_CPU(cs);
1234 CPUARMState *env = &cpu->env;
1235 CPUWatchpoint *wp_hit = cs->watchpoint_hit;
1236
1237 if (wp_hit) {
1238 if (wp_hit->flags & BP_CPU) {
1239 bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
1240 bool same_el = arm_debug_target_el(env) == arm_current_el(env);
1241
1242 cs->watchpoint_hit = NULL;
1243
1244 if (extended_addresses_enabled(env)) {
1245 env->exception.fsr = (1 << 9) | 0x22;
1246 } else {
1247 env->exception.fsr = 0x2;
1248 }
1249 env->exception.vaddress = wp_hit->hitaddr;
1250 raise_exception(env, EXCP_DATA_ABORT,
1251 syn_watchpoint(same_el, 0, wnr),
1252 arm_debug_target_el(env));
1253 }
1254 } else {
1255 uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
1256 bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
1257
1258 /* (1) GDB breakpoints should be handled first.
1259 * (2) Do not raise a CPU exception if no CPU breakpoint has fired,
1260 * since singlestep is also done by generating a debug internal
1261 * exception.
1262 */
1263 if (cpu_breakpoint_test(cs, pc, BP_GDB)
1264 || !cpu_breakpoint_test(cs, pc, BP_CPU)) {
1265 return;
1266 }
1267
1268 if (extended_addresses_enabled(env)) {
1269 env->exception.fsr = (1 << 9) | 0x22;
1270 } else {
1271 env->exception.fsr = 0x2;
1272 }
1273 /* FAR is UNKNOWN, so doesn't need setting */
1274 raise_exception(env, EXCP_PREFETCH_ABORT,
1275 syn_breakpoint(same_el),
1276 arm_debug_target_el(env));
1277 }
1278 }
1279
1280 /* ??? Flag setting arithmetic is awkward because we need to do comparisons.
1281 The only way to do that in TCG is a conditional branch, which clobbers
1282 all our temporaries. For now implement these as helper functions. */
1283
1284 /* Similarly for variable shift instructions. */
1285
1286 uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
1287 {
1288 int shift = i & 0xff;
1289 if (shift >= 32) {
1290 if (shift == 32)
1291 env->CF = x & 1;
1292 else
1293 env->CF = 0;
1294 return 0;
1295 } else if (shift != 0) {
1296 env->CF = (x >> (32 - shift)) & 1;
1297 return x << shift;
1298 }
1299 return x;
1300 }
1301
1302 uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
1303 {
1304 int shift = i & 0xff;
1305 if (shift >= 32) {
1306 if (shift == 32)
1307 env->CF = (x >> 31) & 1;
1308 else
1309 env->CF = 0;
1310 return 0;
1311 } else if (shift != 0) {
1312 env->CF = (x >> (shift - 1)) & 1;
1313 return x >> shift;
1314 }
1315 return x;
1316 }
1317
1318 uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
1319 {
1320 int shift = i & 0xff;
1321 if (shift >= 32) {
1322 env->CF = (x >> 31) & 1;
1323 return (int32_t)x >> 31;
1324 } else if (shift != 0) {
1325 env->CF = (x >> (shift - 1)) & 1;
1326 return (int32_t)x >> shift;
1327 }
1328 return x;
1329 }
1330
1331 uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
1332 {
1333 int shift1, shift;
1334 shift1 = i & 0xff;
1335 shift = shift1 & 0x1f;
1336 if (shift == 0) {
1337 if (shift1 != 0)
1338 env->CF = (x >> 31) & 1;
1339 return x;
1340 } else {
1341 env->CF = (x >> (shift - 1)) & 1;
1342 return ((uint32_t)x >> shift) | (x << (32 - shift));
1343 }
1344 }