arm tcg cpus: Fix Lesser GPL version number
[qemu.git] / target / arm / op_helper.c
1 /*
2 * ARM helper routines
3 *
4 * Copyright (c) 2005-2007 CodeSourcery, LLC
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19 #include "qemu/osdep.h"
20 #include "qemu/log.h"
21 #include "qemu/main-loop.h"
22 #include "cpu.h"
23 #include "exec/helper-proto.h"
24 #include "internals.h"
25 #include "exec/exec-all.h"
26 #include "exec/cpu_ldst.h"
27
28 #define SIGNBIT (uint32_t)0x80000000
29 #define SIGNBIT64 ((uint64_t)1 << 63)
30
31 static CPUState *do_raise_exception(CPUARMState *env, uint32_t excp,
32 uint32_t syndrome, uint32_t target_el)
33 {
34 CPUState *cs = env_cpu(env);
35
36 if (target_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
37 /*
38 * Redirect NS EL1 exceptions to NS EL2. These are reported with
39 * their original syndrome register value, with the exception of
40 * SIMD/FP access traps, which are reported as uncategorized
41 * (see DDI0478C.a D1.10.4)
42 */
43 target_el = 2;
44 if (syn_get_ec(syndrome) == EC_ADVSIMDFPACCESSTRAP) {
45 syndrome = syn_uncategorized();
46 }
47 }
48
49 assert(!excp_is_internal(excp));
50 cs->exception_index = excp;
51 env->exception.syndrome = syndrome;
52 env->exception.target_el = target_el;
53
54 return cs;
55 }
56
57 void raise_exception(CPUARMState *env, uint32_t excp,
58 uint32_t syndrome, uint32_t target_el)
59 {
60 CPUState *cs = do_raise_exception(env, excp, syndrome, target_el);
61 cpu_loop_exit(cs);
62 }
63
64 void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
65 uint32_t target_el, uintptr_t ra)
66 {
67 CPUState *cs = do_raise_exception(env, excp, syndrome, target_el);
68 cpu_loop_exit_restore(cs, ra);
69 }
70
71 uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
72 uint64_t ireg, uint64_t def)
73 {
74 uint64_t tmp, val = 0;
75 uint32_t maxindex = ((desc & 3) + 1) * 8;
76 uint32_t base_reg = desc >> 2;
77 uint32_t shift, index, reg;
78
79 for (shift = 0; shift < 64; shift += 8) {
80 index = (ireg >> shift) & 0xff;
81 if (index < maxindex) {
82 reg = base_reg + (index >> 3);
83 tmp = *aa32_vfp_dreg(env, reg);
84 tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
85 } else {
86 tmp = def & (0xffull << shift);
87 }
88 val |= tmp;
89 }
90 return val;
91 }
92
93 void HELPER(v8m_stackcheck)(CPUARMState *env, uint32_t newvalue)
94 {
95 /*
96 * Perform the v8M stack limit check for SP updates from translated code,
97 * raising an exception if the limit is breached.
98 */
99 if (newvalue < v7m_sp_limit(env)) {
100 CPUState *cs = env_cpu(env);
101
102 /*
103 * Stack limit exceptions are a rare case, so rather than syncing
104 * PC/condbits before the call, we use cpu_restore_state() to
105 * get them right before raising the exception.
106 */
107 cpu_restore_state(cs, GETPC(), true);
108 raise_exception(env, EXCP_STKOF, 0, 1);
109 }
110 }
111
112 uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
113 {
114 uint32_t res = a + b;
115 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
116 env->QF = 1;
117 return res;
118 }
119
120 uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
121 {
122 uint32_t res = a + b;
123 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
124 env->QF = 1;
125 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
126 }
127 return res;
128 }
129
130 uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
131 {
132 uint32_t res = a - b;
133 if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
134 env->QF = 1;
135 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
136 }
137 return res;
138 }
139
140 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
141 {
142 uint32_t res = a + b;
143 if (res < a) {
144 env->QF = 1;
145 res = ~0;
146 }
147 return res;
148 }
149
150 uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
151 {
152 uint32_t res = a - b;
153 if (res > a) {
154 env->QF = 1;
155 res = 0;
156 }
157 return res;
158 }
159
160 /* Signed saturation. */
161 static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
162 {
163 int32_t top;
164 uint32_t mask;
165
166 top = val >> shift;
167 mask = (1u << shift) - 1;
168 if (top > 0) {
169 env->QF = 1;
170 return mask;
171 } else if (top < -1) {
172 env->QF = 1;
173 return ~mask;
174 }
175 return val;
176 }
177
178 /* Unsigned saturation. */
179 static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
180 {
181 uint32_t max;
182
183 max = (1u << shift) - 1;
184 if (val < 0) {
185 env->QF = 1;
186 return 0;
187 } else if (val > max) {
188 env->QF = 1;
189 return max;
190 }
191 return val;
192 }
193
194 /* Signed saturate. */
195 uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
196 {
197 return do_ssat(env, x, shift);
198 }
199
200 /* Dual halfword signed saturate. */
201 uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
202 {
203 uint32_t res;
204
205 res = (uint16_t)do_ssat(env, (int16_t)x, shift);
206 res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
207 return res;
208 }
209
210 /* Unsigned saturate. */
211 uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
212 {
213 return do_usat(env, x, shift);
214 }
215
216 /* Dual halfword unsigned saturate. */
217 uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
218 {
219 uint32_t res;
220
221 res = (uint16_t)do_usat(env, (int16_t)x, shift);
222 res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
223 return res;
224 }
225
226 void HELPER(setend)(CPUARMState *env)
227 {
228 env->uncached_cpsr ^= CPSR_E;
229 arm_rebuild_hflags(env);
230 }
231
232 /* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped.
233 * The function returns the target EL (1-3) if the instruction is to be trapped;
234 * otherwise it returns 0 indicating it is not trapped.
235 */
236 static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
237 {
238 int cur_el = arm_current_el(env);
239 uint64_t mask;
240
241 if (arm_feature(env, ARM_FEATURE_M)) {
242 /* M profile cores can never trap WFI/WFE. */
243 return 0;
244 }
245
246 /* If we are currently in EL0 then we need to check if SCTLR is set up for
247 * WFx instructions being trapped to EL1. These trap bits don't exist in v7.
248 */
249 if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) {
250 int target_el;
251
252 mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI;
253 if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) {
254 /* Secure EL0 and Secure PL1 is at EL3 */
255 target_el = 3;
256 } else {
257 target_el = 1;
258 }
259
260 if (!(env->cp15.sctlr_el[target_el] & mask)) {
261 return target_el;
262 }
263 }
264
265 /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it
266 * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the
267 * bits will be zero indicating no trap.
268 */
269 if (cur_el < 2) {
270 mask = is_wfe ? HCR_TWE : HCR_TWI;
271 if (arm_hcr_el2_eff(env) & mask) {
272 return 2;
273 }
274 }
275
276 /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */
277 if (cur_el < 3) {
278 mask = (is_wfe) ? SCR_TWE : SCR_TWI;
279 if (env->cp15.scr_el3 & mask) {
280 return 3;
281 }
282 }
283
284 return 0;
285 }
286
287 void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
288 {
289 CPUState *cs = env_cpu(env);
290 int target_el = check_wfx_trap(env, false);
291
292 if (cpu_has_work(cs)) {
293 /* Don't bother to go into our "low power state" if
294 * we would just wake up immediately.
295 */
296 return;
297 }
298
299 if (target_el) {
300 if (env->aarch64) {
301 env->pc -= insn_len;
302 } else {
303 env->regs[15] -= insn_len;
304 }
305
306 raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0, insn_len == 2),
307 target_el);
308 }
309
310 cs->exception_index = EXCP_HLT;
311 cs->halted = 1;
312 cpu_loop_exit(cs);
313 }
314
315 void HELPER(wfe)(CPUARMState *env)
316 {
317 /* This is a hint instruction that is semantically different
318 * from YIELD even though we currently implement it identically.
319 * Don't actually halt the CPU, just yield back to top
320 * level loop. This is not going into a "low power state"
321 * (ie halting until some event occurs), so we never take
322 * a configurable trap to a different exception level.
323 */
324 HELPER(yield)(env);
325 }
326
327 void HELPER(yield)(CPUARMState *env)
328 {
329 CPUState *cs = env_cpu(env);
330
331 /* This is a non-trappable hint instruction that generally indicates
332 * that the guest is currently busy-looping. Yield control back to the
333 * top level loop so that a more deserving VCPU has a chance to run.
334 */
335 cs->exception_index = EXCP_YIELD;
336 cpu_loop_exit(cs);
337 }
338
339 /* Raise an internal-to-QEMU exception. This is limited to only
340 * those EXCP values which are special cases for QEMU to interrupt
341 * execution and not to be used for exceptions which are passed to
342 * the guest (those must all have syndrome information and thus should
343 * use exception_with_syndrome).
344 */
345 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
346 {
347 CPUState *cs = env_cpu(env);
348
349 assert(excp_is_internal(excp));
350 cs->exception_index = excp;
351 cpu_loop_exit(cs);
352 }
353
354 /* Raise an exception with the specified syndrome register value */
355 void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
356 uint32_t syndrome, uint32_t target_el)
357 {
358 raise_exception(env, excp, syndrome, target_el);
359 }
360
361 /* Raise an EXCP_BKPT with the specified syndrome register value,
362 * targeting the correct exception level for debug exceptions.
363 */
364 void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
365 {
366 int debug_el = arm_debug_target_el(env);
367 int cur_el = arm_current_el(env);
368
369 /* FSR will only be used if the debug target EL is AArch32. */
370 env->exception.fsr = arm_debug_exception_fsr(env);
371 /* FAR is UNKNOWN: clear vaddress to avoid potentially exposing
372 * values to the guest that it shouldn't be able to see at its
373 * exception/security level.
374 */
375 env->exception.vaddress = 0;
376 /*
377 * Other kinds of architectural debug exception are ignored if
378 * they target an exception level below the current one (in QEMU
379 * this is checked by arm_generate_debug_exceptions()). Breakpoint
380 * instructions are special because they always generate an exception
381 * to somewhere: if they can't go to the configured debug exception
382 * level they are taken to the current exception level.
383 */
384 if (debug_el < cur_el) {
385 debug_el = cur_el;
386 }
387 raise_exception(env, EXCP_BKPT, syndrome, debug_el);
388 }
389
390 uint32_t HELPER(cpsr_read)(CPUARMState *env)
391 {
392 /*
393 * We store the ARMv8 PSTATE.SS bit in env->uncached_cpsr.
394 * This is convenient for populating SPSR_ELx, but must be
395 * hidden from aarch32 mode, where it is not visible.
396 *
397 * TODO: ARMv8.4-DIT -- need to move SS somewhere else.
398 */
399 return cpsr_read(env) & ~(CPSR_EXEC | PSTATE_SS);
400 }
401
402 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
403 {
404 cpsr_write(env, val, mask, CPSRWriteByInstr);
405 /* TODO: Not all cpsr bits are relevant to hflags. */
406 arm_rebuild_hflags(env);
407 }
408
409 /* Write the CPSR for a 32-bit exception return */
410 void HELPER(cpsr_write_eret)(CPUARMState *env, uint32_t val)
411 {
412 uint32_t mask;
413
414 qemu_mutex_lock_iothread();
415 arm_call_pre_el_change_hook(env_archcpu(env));
416 qemu_mutex_unlock_iothread();
417
418 mask = aarch32_cpsr_valid_mask(env->features, &env_archcpu(env)->isar);
419 cpsr_write(env, val, mask, CPSRWriteExceptionReturn);
420
421 /* Generated code has already stored the new PC value, but
422 * without masking out its low bits, because which bits need
423 * masking depends on whether we're returning to Thumb or ARM
424 * state. Do the masking now.
425 */
426 env->regs[15] &= (env->thumb ? ~1 : ~3);
427 arm_rebuild_hflags(env);
428
429 qemu_mutex_lock_iothread();
430 arm_call_el_change_hook(env_archcpu(env));
431 qemu_mutex_unlock_iothread();
432 }
433
434 /* Access to user mode registers from privileged modes. */
435 uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
436 {
437 uint32_t val;
438
439 if (regno == 13) {
440 val = env->banked_r13[BANK_USRSYS];
441 } else if (regno == 14) {
442 val = env->banked_r14[BANK_USRSYS];
443 } else if (regno >= 8
444 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
445 val = env->usr_regs[regno - 8];
446 } else {
447 val = env->regs[regno];
448 }
449 return val;
450 }
451
452 void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
453 {
454 if (regno == 13) {
455 env->banked_r13[BANK_USRSYS] = val;
456 } else if (regno == 14) {
457 env->banked_r14[BANK_USRSYS] = val;
458 } else if (regno >= 8
459 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
460 env->usr_regs[regno - 8] = val;
461 } else {
462 env->regs[regno] = val;
463 }
464 }
465
466 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
467 {
468 if ((env->uncached_cpsr & CPSR_M) == mode) {
469 env->regs[13] = val;
470 } else {
471 env->banked_r13[bank_number(mode)] = val;
472 }
473 }
474
475 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
476 {
477 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_SYS) {
478 /* SRS instruction is UNPREDICTABLE from System mode; we UNDEF.
479 * Other UNPREDICTABLE and UNDEF cases were caught at translate time.
480 */
481 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
482 exception_target_el(env));
483 }
484
485 if ((env->uncached_cpsr & CPSR_M) == mode) {
486 return env->regs[13];
487 } else {
488 return env->banked_r13[bank_number(mode)];
489 }
490 }
491
492 static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,
493 uint32_t regno)
494 {
495 /* Raise an exception if the requested access is one of the UNPREDICTABLE
496 * cases; otherwise return. This broadly corresponds to the pseudocode
497 * BankedRegisterAccessValid() and SPSRAccessValid(),
498 * except that we have already handled some cases at translate time.
499 */
500 int curmode = env->uncached_cpsr & CPSR_M;
501
502 if (regno == 17) {
503 /* ELR_Hyp: a special case because access from tgtmode is OK */
504 if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {
505 goto undef;
506 }
507 return;
508 }
509
510 if (curmode == tgtmode) {
511 goto undef;
512 }
513
514 if (tgtmode == ARM_CPU_MODE_USR) {
515 switch (regno) {
516 case 8 ... 12:
517 if (curmode != ARM_CPU_MODE_FIQ) {
518 goto undef;
519 }
520 break;
521 case 13:
522 if (curmode == ARM_CPU_MODE_SYS) {
523 goto undef;
524 }
525 break;
526 case 14:
527 if (curmode == ARM_CPU_MODE_HYP || curmode == ARM_CPU_MODE_SYS) {
528 goto undef;
529 }
530 break;
531 default:
532 break;
533 }
534 }
535
536 if (tgtmode == ARM_CPU_MODE_HYP) {
537 /* SPSR_Hyp, r13_hyp: accessible from Monitor mode only */
538 if (curmode != ARM_CPU_MODE_MON) {
539 goto undef;
540 }
541 }
542
543 return;
544
545 undef:
546 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
547 exception_target_el(env));
548 }
549
550 void HELPER(msr_banked)(CPUARMState *env, uint32_t value, uint32_t tgtmode,
551 uint32_t regno)
552 {
553 msr_mrs_banked_exc_checks(env, tgtmode, regno);
554
555 switch (regno) {
556 case 16: /* SPSRs */
557 env->banked_spsr[bank_number(tgtmode)] = value;
558 break;
559 case 17: /* ELR_Hyp */
560 env->elr_el[2] = value;
561 break;
562 case 13:
563 env->banked_r13[bank_number(tgtmode)] = value;
564 break;
565 case 14:
566 env->banked_r14[r14_bank_number(tgtmode)] = value;
567 break;
568 case 8 ... 12:
569 switch (tgtmode) {
570 case ARM_CPU_MODE_USR:
571 env->usr_regs[regno - 8] = value;
572 break;
573 case ARM_CPU_MODE_FIQ:
574 env->fiq_regs[regno - 8] = value;
575 break;
576 default:
577 g_assert_not_reached();
578 }
579 break;
580 default:
581 g_assert_not_reached();
582 }
583 }
584
585 uint32_t HELPER(mrs_banked)(CPUARMState *env, uint32_t tgtmode, uint32_t regno)
586 {
587 msr_mrs_banked_exc_checks(env, tgtmode, regno);
588
589 switch (regno) {
590 case 16: /* SPSRs */
591 return env->banked_spsr[bank_number(tgtmode)];
592 case 17: /* ELR_Hyp */
593 return env->elr_el[2];
594 case 13:
595 return env->banked_r13[bank_number(tgtmode)];
596 case 14:
597 return env->banked_r14[r14_bank_number(tgtmode)];
598 case 8 ... 12:
599 switch (tgtmode) {
600 case ARM_CPU_MODE_USR:
601 return env->usr_regs[regno - 8];
602 case ARM_CPU_MODE_FIQ:
603 return env->fiq_regs[regno - 8];
604 default:
605 g_assert_not_reached();
606 }
607 default:
608 g_assert_not_reached();
609 }
610 }
611
612 void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome,
613 uint32_t isread)
614 {
615 const ARMCPRegInfo *ri = rip;
616 int target_el;
617
618 if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
619 && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
620 raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
621 }
622
623 /*
624 * Check for an EL2 trap due to HSTR_EL2. We expect EL0 accesses
625 * to sysregs non accessible at EL0 to have UNDEF-ed already.
626 */
627 if (!is_a64(env) && arm_current_el(env) < 2 && ri->cp == 15 &&
628 (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
629 uint32_t mask = 1 << ri->crn;
630
631 if (ri->type & ARM_CP_64BIT) {
632 mask = 1 << ri->crm;
633 }
634
635 /* T4 and T14 are RES0 */
636 mask &= ~((1 << 4) | (1 << 14));
637
638 if (env->cp15.hstr_el2 & mask) {
639 target_el = 2;
640 goto exept;
641 }
642 }
643
644 if (!ri->accessfn) {
645 return;
646 }
647
648 switch (ri->accessfn(env, ri, isread)) {
649 case CP_ACCESS_OK:
650 return;
651 case CP_ACCESS_TRAP:
652 target_el = exception_target_el(env);
653 break;
654 case CP_ACCESS_TRAP_EL2:
655 /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
656 * a bug in the access function.
657 */
658 assert(!arm_is_secure(env) && arm_current_el(env) != 3);
659 target_el = 2;
660 break;
661 case CP_ACCESS_TRAP_EL3:
662 target_el = 3;
663 break;
664 case CP_ACCESS_TRAP_UNCATEGORIZED:
665 target_el = exception_target_el(env);
666 syndrome = syn_uncategorized();
667 break;
668 case CP_ACCESS_TRAP_UNCATEGORIZED_EL2:
669 target_el = 2;
670 syndrome = syn_uncategorized();
671 break;
672 case CP_ACCESS_TRAP_UNCATEGORIZED_EL3:
673 target_el = 3;
674 syndrome = syn_uncategorized();
675 break;
676 case CP_ACCESS_TRAP_FP_EL2:
677 target_el = 2;
678 /* Since we are an implementation that takes exceptions on a trapped
679 * conditional insn only if the insn has passed its condition code
680 * check, we take the IMPDEF choice to always report CV=1 COND=0xe
681 * (which is also the required value for AArch64 traps).
682 */
683 syndrome = syn_fp_access_trap(1, 0xe, false);
684 break;
685 case CP_ACCESS_TRAP_FP_EL3:
686 target_el = 3;
687 syndrome = syn_fp_access_trap(1, 0xe, false);
688 break;
689 default:
690 g_assert_not_reached();
691 }
692
693 exept:
694 raise_exception(env, EXCP_UDEF, syndrome, target_el);
695 }
696
697 void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
698 {
699 const ARMCPRegInfo *ri = rip;
700
701 if (ri->type & ARM_CP_IO) {
702 qemu_mutex_lock_iothread();
703 ri->writefn(env, ri, value);
704 qemu_mutex_unlock_iothread();
705 } else {
706 ri->writefn(env, ri, value);
707 }
708 }
709
710 uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
711 {
712 const ARMCPRegInfo *ri = rip;
713 uint32_t res;
714
715 if (ri->type & ARM_CP_IO) {
716 qemu_mutex_lock_iothread();
717 res = ri->readfn(env, ri);
718 qemu_mutex_unlock_iothread();
719 } else {
720 res = ri->readfn(env, ri);
721 }
722
723 return res;
724 }
725
726 void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
727 {
728 const ARMCPRegInfo *ri = rip;
729
730 if (ri->type & ARM_CP_IO) {
731 qemu_mutex_lock_iothread();
732 ri->writefn(env, ri, value);
733 qemu_mutex_unlock_iothread();
734 } else {
735 ri->writefn(env, ri, value);
736 }
737 }
738
739 uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
740 {
741 const ARMCPRegInfo *ri = rip;
742 uint64_t res;
743
744 if (ri->type & ARM_CP_IO) {
745 qemu_mutex_lock_iothread();
746 res = ri->readfn(env, ri);
747 qemu_mutex_unlock_iothread();
748 } else {
749 res = ri->readfn(env, ri);
750 }
751
752 return res;
753 }
754
755 void HELPER(pre_hvc)(CPUARMState *env)
756 {
757 ARMCPU *cpu = env_archcpu(env);
758 int cur_el = arm_current_el(env);
759 /* FIXME: Use actual secure state. */
760 bool secure = false;
761 bool undef;
762
763 if (arm_is_psci_call(cpu, EXCP_HVC)) {
764 /* If PSCI is enabled and this looks like a valid PSCI call then
765 * that overrides the architecturally mandated HVC behaviour.
766 */
767 return;
768 }
769
770 if (!arm_feature(env, ARM_FEATURE_EL2)) {
771 /* If EL2 doesn't exist, HVC always UNDEFs */
772 undef = true;
773 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
774 /* EL3.HCE has priority over EL2.HCD. */
775 undef = !(env->cp15.scr_el3 & SCR_HCE);
776 } else {
777 undef = env->cp15.hcr_el2 & HCR_HCD;
778 }
779
780 /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
781 * For ARMv8/AArch64, HVC is allowed in EL3.
782 * Note that we've already trapped HVC from EL0 at translation
783 * time.
784 */
785 if (secure && (!is_a64(env) || cur_el == 1)) {
786 undef = true;
787 }
788
789 if (undef) {
790 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
791 exception_target_el(env));
792 }
793 }
794
795 void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
796 {
797 ARMCPU *cpu = env_archcpu(env);
798 int cur_el = arm_current_el(env);
799 bool secure = arm_is_secure(env);
800 bool smd_flag = env->cp15.scr_el3 & SCR_SMD;
801
802 /*
803 * SMC behaviour is summarized in the following table.
804 * This helper handles the "Trap to EL2" and "Undef insn" cases.
805 * The "Trap to EL3" and "PSCI call" cases are handled in the exception
806 * helper.
807 *
808 * -> ARM_FEATURE_EL3 and !SMD
809 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
810 *
811 * Conduit SMC, valid call Trap to EL2 PSCI Call
812 * Conduit SMC, inval call Trap to EL2 Trap to EL3
813 * Conduit not SMC Trap to EL2 Trap to EL3
814 *
815 *
816 * -> ARM_FEATURE_EL3 and SMD
817 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
818 *
819 * Conduit SMC, valid call Trap to EL2 PSCI Call
820 * Conduit SMC, inval call Trap to EL2 Undef insn
821 * Conduit not SMC Trap to EL2 Undef insn
822 *
823 *
824 * -> !ARM_FEATURE_EL3
825 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
826 *
827 * Conduit SMC, valid call Trap to EL2 PSCI Call
828 * Conduit SMC, inval call Trap to EL2 Undef insn
829 * Conduit not SMC Undef insn Undef insn
830 */
831
832 /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state.
833 * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization
834 * extensions, SMD only applies to NS state.
835 * On ARMv7 without the Virtualization extensions, the SMD bit
836 * doesn't exist, but we forbid the guest to set it to 1 in scr_write(),
837 * so we need not special case this here.
838 */
839 bool smd = arm_feature(env, ARM_FEATURE_AARCH64) ? smd_flag
840 : smd_flag && !secure;
841
842 if (!arm_feature(env, ARM_FEATURE_EL3) &&
843 cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
844 /* If we have no EL3 then SMC always UNDEFs and can't be
845 * trapped to EL2. PSCI-via-SMC is a sort of ersatz EL3
846 * firmware within QEMU, and we want an EL2 guest to be able
847 * to forbid its EL1 from making PSCI calls into QEMU's
848 * "firmware" via HCR.TSC, so for these purposes treat
849 * PSCI-via-SMC as implying an EL3.
850 * This handles the very last line of the previous table.
851 */
852 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
853 exception_target_el(env));
854 }
855
856 if (cur_el == 1 && (arm_hcr_el2_eff(env) & HCR_TSC)) {
857 /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
858 * We also want an EL2 guest to be able to forbid its EL1 from
859 * making PSCI calls into QEMU's "firmware" via HCR.TSC.
860 * This handles all the "Trap to EL2" cases of the previous table.
861 */
862 raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
863 }
864
865 /* Catch the two remaining "Undef insn" cases of the previous table:
866 * - PSCI conduit is SMC but we don't have a valid PCSI call,
867 * - We don't have EL3 or SMD is set.
868 */
869 if (!arm_is_psci_call(cpu, EXCP_SMC) &&
870 (smd || !arm_feature(env, ARM_FEATURE_EL3))) {
871 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
872 exception_target_el(env));
873 }
874 }
875
876 /* ??? Flag setting arithmetic is awkward because we need to do comparisons.
877 The only way to do that in TCG is a conditional branch, which clobbers
878 all our temporaries. For now implement these as helper functions. */
879
880 /* Similarly for variable shift instructions. */
881
882 uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
883 {
884 int shift = i & 0xff;
885 if (shift >= 32) {
886 if (shift == 32)
887 env->CF = x & 1;
888 else
889 env->CF = 0;
890 return 0;
891 } else if (shift != 0) {
892 env->CF = (x >> (32 - shift)) & 1;
893 return x << shift;
894 }
895 return x;
896 }
897
898 uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
899 {
900 int shift = i & 0xff;
901 if (shift >= 32) {
902 if (shift == 32)
903 env->CF = (x >> 31) & 1;
904 else
905 env->CF = 0;
906 return 0;
907 } else if (shift != 0) {
908 env->CF = (x >> (shift - 1)) & 1;
909 return x >> shift;
910 }
911 return x;
912 }
913
914 uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
915 {
916 int shift = i & 0xff;
917 if (shift >= 32) {
918 env->CF = (x >> 31) & 1;
919 return (int32_t)x >> 31;
920 } else if (shift != 0) {
921 env->CF = (x >> (shift - 1)) & 1;
922 return (int32_t)x >> shift;
923 }
924 return x;
925 }
926
927 uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
928 {
929 int shift1, shift;
930 shift1 = i & 0xff;
931 shift = shift1 & 0x1f;
932 if (shift == 0) {
933 if (shift1 != 0)
934 env->CF = (x >> 31) & 1;
935 return x;
936 } else {
937 env->CF = (x >> (shift - 1)) & 1;
938 return ((uint32_t)x >> shift) | (x << (32 - shift));
939 }
940 }
941
942 void HELPER(probe_access)(CPUARMState *env, target_ulong ptr,
943 uint32_t access_type, uint32_t mmu_idx,
944 uint32_t size)
945 {
946 uint32_t in_page = -((uint32_t)ptr | TARGET_PAGE_SIZE);
947 uintptr_t ra = GETPC();
948
949 if (likely(size <= in_page)) {
950 probe_access(env, ptr, size, access_type, mmu_idx, ra);
951 } else {
952 probe_access(env, ptr, in_page, access_type, mmu_idx, ra);
953 probe_access(env, ptr + in_page, size - in_page,
954 access_type, mmu_idx, ra);
955 }
956 }