1 /*
2 * ARM helper routines
3 *
4 * Copyright (c) 2005-2007 CodeSourcery, LLC
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19 #include "qemu/osdep.h"
20 #include "qemu/main-loop.h"
21 #include "cpu.h"
22 #include "exec/helper-proto.h"
23 #include "internals.h"
24 #include "cpu-features.h"
25 #include "exec/exec-all.h"
26 #include "exec/cpu_ldst.h"
27 #include "cpregs.h"
28
29 #define SIGNBIT (uint32_t)0x80000000
30 #define SIGNBIT64 ((uint64_t)1 << 63)
31
exception_target_el(CPUARMState * env)32 int exception_target_el(CPUARMState *env)
33 {
34 int target_el = MAX(1, arm_current_el(env));
35
36 /*
37 * No such thing as secure EL1 if EL3 is aarch32,
38 * so update the target EL to EL3 in this case.
39 */
40 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
41 target_el = 3;
42 }
43
44 return target_el;
45 }
46
raise_exception(CPUARMState * env,uint32_t excp,uint32_t syndrome,uint32_t target_el)47 void raise_exception(CPUARMState *env, uint32_t excp,
48 uint32_t syndrome, uint32_t target_el)
49 {
50 CPUState *cs = env_cpu(env);
51
52 if (target_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
53 /*
54 * Redirect NS EL1 exceptions to NS EL2. These are reported with
55 * their original syndrome register value, with the exception of
56 * SIMD/FP access traps, which are reported as uncategorized
57 * (see DDI0478C.a D1.10.4)
58 */
59 target_el = 2;
60 if (syn_get_ec(syndrome) == EC_ADVSIMDFPACCESSTRAP) {
61 syndrome = syn_uncategorized();
62 }
63 }
64
65 assert(!excp_is_internal(excp));
66 cs->exception_index = excp;
67 env->exception.syndrome = syndrome;
68 env->exception.target_el = target_el;
69 cpu_loop_exit(cs);
70 }
71
raise_exception_ra(CPUARMState * env,uint32_t excp,uint32_t syndrome,uint32_t target_el,uintptr_t ra)72 void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
73 uint32_t target_el, uintptr_t ra)
74 {
75 CPUState *cs = env_cpu(env);
76
77 /*
78 * restore_state_to_opc() will set env->exception.syndrome, so
79 * we must restore CPU state here before setting the syndrome
80 * the caller passed us, and cannot use cpu_loop_exit_restore().
81 */
82 cpu_restore_state(cs, ra);
83 raise_exception(env, excp, syndrome, target_el);
84 }
85
HELPER(neon_tbl)86 uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
87 uint64_t ireg, uint64_t def)
88 {
89 uint64_t tmp, val = 0;
90 uint32_t maxindex = ((desc & 3) + 1) * 8;
91 uint32_t base_reg = desc >> 2;
92 uint32_t shift, index, reg;
93
94 for (shift = 0; shift < 64; shift += 8) {
95 index = (ireg >> shift) & 0xff;
96 if (index < maxindex) {
97 reg = base_reg + (index >> 3);
98 tmp = *aa32_vfp_dreg(env, reg);
99 tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
100 } else {
101 tmp = def & (0xffull << shift);
102 }
103 val |= tmp;
104 }
105 return val;
106 }
107
HELPER(v8m_stackcheck)108 void HELPER(v8m_stackcheck)(CPUARMState *env, uint32_t newvalue)
109 {
110 /*
111 * Perform the v8M stack limit check for SP updates from translated code,
112 * raising an exception if the limit is breached.
113 */
114 if (newvalue < v7m_sp_limit(env)) {
115 /*
116 * Stack limit exceptions are a rare case, so rather than syncing
117 * PC/condbits before the call, we use raise_exception_ra() so
118 * that cpu_restore_state() will sort them out.
119 */
120 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
121 }
122 }
123
124 /* Sign/zero extend */
HELPER(sxtb16)125 uint32_t HELPER(sxtb16)(uint32_t x)
126 {
127 uint32_t res;
128 res = (uint16_t)(int8_t)x;
129 res |= (uint32_t)(int8_t)(x >> 16) << 16;
130 return res;
131 }
132
handle_possible_div0_trap(CPUARMState * env,uintptr_t ra)133 static void handle_possible_div0_trap(CPUARMState *env, uintptr_t ra)
134 {
135 /*
136 * Take a division-by-zero exception if necessary; otherwise return
137 * to get the usual non-trapping division behaviour (result of 0)
138 */
139 if (arm_feature(env, ARM_FEATURE_M)
140 && (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_DIV_0_TRP_MASK)) {
141 raise_exception_ra(env, EXCP_DIVBYZERO, 0, 1, ra);
142 }
143 }
144
HELPER(uxtb16)145 uint32_t HELPER(uxtb16)(uint32_t x)
146 {
147 uint32_t res;
148 res = (uint16_t)(uint8_t)x;
149 res |= (uint32_t)(uint8_t)(x >> 16) << 16;
150 return res;
151 }
152
HELPER(sdiv)153 int32_t HELPER(sdiv)(CPUARMState *env, int32_t num, int32_t den)
154 {
155 if (den == 0) {
156 handle_possible_div0_trap(env, GETPC());
157 return 0;
158 }
159 if (num == INT_MIN && den == -1) {
160 return INT_MIN;
161 }
162 return num / den;
163 }
164
HELPER(udiv)165 uint32_t HELPER(udiv)(CPUARMState *env, uint32_t num, uint32_t den)
166 {
167 if (den == 0) {
168 handle_possible_div0_trap(env, GETPC());
169 return 0;
170 }
171 return num / den;
172 }
173
HELPER(rbit)174 uint32_t HELPER(rbit)(uint32_t x)
175 {
176 return revbit32(x);
177 }
178
HELPER(add_setq)179 uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
180 {
181 uint32_t res = a + b;
182 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
183 env->QF = 1;
184 return res;
185 }
186
HELPER(add_saturate)187 uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
188 {
189 uint32_t res = a + b;
190 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
191 env->QF = 1;
192 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
193 }
194 return res;
195 }
196
HELPER(sub_saturate)197 uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
198 {
199 uint32_t res = a - b;
200 if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
201 env->QF = 1;
202 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
203 }
204 return res;
205 }
206
HELPER(add_usaturate)207 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
208 {
209 uint32_t res = a + b;
210 if (res < a) {
211 env->QF = 1;
212 res = ~0;
213 }
214 return res;
215 }
216
HELPER(sub_usaturate)217 uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
218 {
219 uint32_t res = a - b;
220 if (res > a) {
221 env->QF = 1;
222 res = 0;
223 }
224 return res;
225 }
226
227 /* Signed saturation. */
do_ssat(CPUARMState * env,int32_t val,int shift)228 static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
229 {
230 int32_t top;
231 uint32_t mask;
232
233 top = val >> shift;
234 mask = (1u << shift) - 1;
235 if (top > 0) {
236 env->QF = 1;
237 return mask;
238 } else if (top < -1) {
239 env->QF = 1;
240 return ~mask;
241 }
242 return val;
243 }
244
245 /* Unsigned saturation. */
do_usat(CPUARMState * env,int32_t val,int shift)246 static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
247 {
248 uint32_t max;
249
250 max = (1u << shift) - 1;
251 if (val < 0) {
252 env->QF = 1;
253 return 0;
254 } else if (val > max) {
255 env->QF = 1;
256 return max;
257 }
258 return val;
259 }
260
261 /* Signed saturate. */
HELPER(ssat)262 uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
263 {
264 return do_ssat(env, x, shift);
265 }
266
267 /* Dual halfword signed saturate. */
HELPER(ssat16)268 uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
269 {
270 uint32_t res;
271
272 res = (uint16_t)do_ssat(env, (int16_t)x, shift);
273 res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
274 return res;
275 }
276
277 /* Unsigned saturate. */
HELPER(usat)278 uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
279 {
280 return do_usat(env, x, shift);
281 }
282
283 /* Dual halfword unsigned saturate. */
HELPER(usat16)284 uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
285 {
286 uint32_t res;
287
288 res = (uint16_t)do_usat(env, (int16_t)x, shift);
289 res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
290 return res;
291 }
292
HELPER(setend)293 void HELPER(setend)(CPUARMState *env)
294 {
295 env->uncached_cpsr ^= CPSR_E;
296 arm_rebuild_hflags(env);
297 }
298
HELPER(check_bxj_trap)299 void HELPER(check_bxj_trap)(CPUARMState *env, uint32_t rm)
300 {
301 /*
302 * Only called if in NS EL0 or EL1 for a BXJ for a v7A CPU;
303 * check if HSTR.TJDBX means we need to trap to EL2.
304 */
305 if (env->cp15.hstr_el2 & HSTR_TJDBX) {
306 /*
307 * We know the condition code check passed, so take the IMPDEF
308 * choice to always report CV=1 COND 0xe
309 */
310 uint32_t syn = syn_bxjtrap(1, 0xe, rm);
311 raise_exception_ra(env, EXCP_HYP_TRAP, syn, 2, GETPC());
312 }
313 }
314
315 #ifndef CONFIG_USER_ONLY
316 /* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped.
317 * The function returns the target EL (1-3) if the instruction is to be trapped;
318 * otherwise it returns 0 indicating it is not trapped.
319 */
check_wfx_trap(CPUARMState * env,bool is_wfe)320 static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
321 {
322 int cur_el = arm_current_el(env);
323 uint64_t mask;
324
325 if (arm_feature(env, ARM_FEATURE_M)) {
326 /* M profile cores can never trap WFI/WFE. */
327 return 0;
328 }
329
330 /* If we are currently in EL0 then we need to check if SCTLR is set up for
331 * WFx instructions being trapped to EL1. These trap bits don't exist in v7.
332 */
333 if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) {
334 int target_el;
335
336 mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI;
337 if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) {
338 /* Secure EL0 and Secure PL1 is at EL3 */
339 target_el = 3;
340 } else {
341 target_el = 1;
342 }
343
344 if (!(env->cp15.sctlr_el[target_el] & mask)) {
345 return target_el;
346 }
347 }
348
349 /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it
350 * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the
351 * bits will be zero indicating no trap.
352 */
353 if (cur_el < 2) {
354 mask = is_wfe ? HCR_TWE : HCR_TWI;
355 if (arm_hcr_el2_eff(env) & mask) {
356 return 2;
357 }
358 }
359
360 /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */
361 if (cur_el < 3) {
362 mask = (is_wfe) ? SCR_TWE : SCR_TWI;
363 if (env->cp15.scr_el3 & mask) {
364 return 3;
365 }
366 }
367
368 return 0;
369 }
370 #endif
371
HELPER(wfi)372 void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
373 {
374 #ifdef CONFIG_USER_ONLY
375 /*
376 * WFI in the user-mode emulator is technically permitted but not
377 * something any real-world code would do. AArch64 Linux kernels
378 * trap it via SCTRL_EL1.nTWI and make it an (expensive) NOP;
379 * AArch32 kernels don't trap it so it will delay a bit.
380 * For QEMU, make it NOP here, because trying to raise EXCP_HLT
381 * would trigger an abort.
382 */
383 return;
384 #else
385 CPUState *cs = env_cpu(env);
386 int target_el = check_wfx_trap(env, false);
387
388 if (cpu_has_work(cs)) {
389 /* Don't bother to go into our "low power state" if
390 * we would just wake up immediately.
391 */
392 return;
393 }
394
395 if (target_el) {
396 if (env->aarch64) {
397 env->pc -= insn_len;
398 } else {
399 env->regs[15] -= insn_len;
400 }
401
402 raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0, insn_len == 2),
403 target_el);
404 }
405
406 cs->exception_index = EXCP_HLT;
407 cs->halted = 1;
408 cpu_loop_exit(cs);
409 #endif
410 }
411
HELPER(wfe)412 void HELPER(wfe)(CPUARMState *env)
413 {
414 /* This is a hint instruction that is semantically different
415 * from YIELD even though we currently implement it identically.
416 * Don't actually halt the CPU, just yield back to top
417 * level loop. This is not going into a "low power state"
418 * (ie halting until some event occurs), so we never take
419 * a configurable trap to a different exception level.
420 */
421 HELPER(yield)(env);
422 }
423
HELPER(yield)424 void HELPER(yield)(CPUARMState *env)
425 {
426 CPUState *cs = env_cpu(env);
427
428 /* This is a non-trappable hint instruction that generally indicates
429 * that the guest is currently busy-looping. Yield control back to the
430 * top level loop so that a more deserving VCPU has a chance to run.
431 */
432 cs->exception_index = EXCP_YIELD;
433 cpu_loop_exit(cs);
434 }
435
436 /* Raise an internal-to-QEMU exception. This is limited to only
437 * those EXCP values which are special cases for QEMU to interrupt
438 * execution and not to be used for exceptions which are passed to
439 * the guest (those must all have syndrome information and thus should
440 * use exception_with_syndrome*).
441 */
HELPER(exception_internal)442 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
443 {
444 CPUState *cs = env_cpu(env);
445
446 assert(excp_is_internal(excp));
447 cs->exception_index = excp;
448 cpu_loop_exit(cs);
449 }
450
451 /* Raise an exception with the specified syndrome register value */
HELPER(exception_with_syndrome_el)452 void HELPER(exception_with_syndrome_el)(CPUARMState *env, uint32_t excp,
453 uint32_t syndrome, uint32_t target_el)
454 {
455 raise_exception(env, excp, syndrome, target_el);
456 }
457
458 /*
459 * Raise an exception with the specified syndrome register value
460 * to the default target el.
461 */
HELPER(exception_with_syndrome)462 void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
463 uint32_t syndrome)
464 {
465 raise_exception(env, excp, syndrome, exception_target_el(env));
466 }
467
HELPER(cpsr_read)468 uint32_t HELPER(cpsr_read)(CPUARMState *env)
469 {
470 return cpsr_read(env) & ~CPSR_EXEC;
471 }
472
HELPER(cpsr_write)473 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
474 {
475 cpsr_write(env, val, mask, CPSRWriteByInstr);
476 /* TODO: Not all cpsr bits are relevant to hflags. */
477 arm_rebuild_hflags(env);
478 }
479
480 /* Write the CPSR for a 32-bit exception return */
HELPER(cpsr_write_eret)481 void HELPER(cpsr_write_eret)(CPUARMState *env, uint32_t val)
482 {
483 uint32_t mask;
484
485 bql_lock();
486 arm_call_pre_el_change_hook(env_archcpu(env));
487 bql_unlock();
488
489 mask = aarch32_cpsr_valid_mask(env->features, &env_archcpu(env)->isar);
490 cpsr_write(env, val, mask, CPSRWriteExceptionReturn);
491
492 /* Generated code has already stored the new PC value, but
493 * without masking out its low bits, because which bits need
494 * masking depends on whether we're returning to Thumb or ARM
495 * state. Do the masking now.
496 */
497 env->regs[15] &= (env->thumb ? ~1 : ~3);
498 arm_rebuild_hflags(env);
499
500 bql_lock();
501 arm_call_el_change_hook(env_archcpu(env));
502 bql_unlock();
503 }
504
505 /* Access to user mode registers from privileged modes. */
HELPER(get_user_reg)506 uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
507 {
508 uint32_t val;
509
510 if (regno == 13) {
511 val = env->banked_r13[BANK_USRSYS];
512 } else if (regno == 14) {
513 val = env->banked_r14[BANK_USRSYS];
514 } else if (regno >= 8
515 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
516 val = env->usr_regs[regno - 8];
517 } else {
518 val = env->regs[regno];
519 }
520 return val;
521 }
522
HELPER(set_user_reg)523 void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
524 {
525 if (regno == 13) {
526 env->banked_r13[BANK_USRSYS] = val;
527 } else if (regno == 14) {
528 env->banked_r14[BANK_USRSYS] = val;
529 } else if (regno >= 8
530 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
531 env->usr_regs[regno - 8] = val;
532 } else {
533 env->regs[regno] = val;
534 }
535 }
536
HELPER(set_r13_banked)537 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
538 {
539 if ((env->uncached_cpsr & CPSR_M) == mode) {
540 env->regs[13] = val;
541 } else {
542 env->banked_r13[bank_number(mode)] = val;
543 }
544 }
545
HELPER(get_r13_banked)546 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
547 {
548 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_SYS) {
549 /* SRS instruction is UNPREDICTABLE from System mode; we UNDEF.
550 * Other UNPREDICTABLE and UNDEF cases were caught at translate time.
551 */
552 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
553 exception_target_el(env));
554 }
555
556 if ((env->uncached_cpsr & CPSR_M) == mode) {
557 return env->regs[13];
558 } else {
559 return env->banked_r13[bank_number(mode)];
560 }
561 }
562
msr_mrs_banked_exc_checks(CPUARMState * env,uint32_t tgtmode,uint32_t regno)563 static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,
564 uint32_t regno)
565 {
566 /* Raise an exception if the requested access is one of the UNPREDICTABLE
567 * cases; otherwise return. This broadly corresponds to the pseudocode
568 * BankedRegisterAccessValid() and SPSRAccessValid(),
569 * except that we have already handled some cases at translate time.
570 */
571 int curmode = env->uncached_cpsr & CPSR_M;
572
573 if (tgtmode == ARM_CPU_MODE_HYP) {
574 /*
575 * Handle Hyp target regs first because some are special cases
576 * which don't want the usual "not accessible from tgtmode" check.
577 */
578 switch (regno) {
579 case 16 ... 17: /* ELR_Hyp, SPSR_Hyp */
580 if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {
581 goto undef;
582 }
583 break;
584 case 13:
585 if (curmode != ARM_CPU_MODE_MON) {
586 goto undef;
587 }
588 break;
589 default:
590 g_assert_not_reached();
591 }
592 return;
593 }
594
595 if (curmode == tgtmode) {
596 goto undef;
597 }
598
599 if (tgtmode == ARM_CPU_MODE_USR) {
600 switch (regno) {
601 case 8 ... 12:
602 if (curmode != ARM_CPU_MODE_FIQ) {
603 goto undef;
604 }
605 break;
606 case 13:
607 if (curmode == ARM_CPU_MODE_SYS) {
608 goto undef;
609 }
610 break;
611 case 14:
612 if (curmode == ARM_CPU_MODE_HYP || curmode == ARM_CPU_MODE_SYS) {
613 goto undef;
614 }
615 break;
616 default:
617 break;
618 }
619 }
620
621 return;
622
623 undef:
624 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
625 exception_target_el(env));
626 }
627
HELPER(msr_banked)628 void HELPER(msr_banked)(CPUARMState *env, uint32_t value, uint32_t tgtmode,
629 uint32_t regno)
630 {
631 msr_mrs_banked_exc_checks(env, tgtmode, regno);
632
633 switch (regno) {
634 case 16: /* SPSRs */
635 if (tgtmode == (env->uncached_cpsr & CPSR_M)) {
636 /* Only happens for SPSR_Hyp access in Hyp mode */
637 env->spsr = value;
638 } else {
639 env->banked_spsr[bank_number(tgtmode)] = value;
640 }
641 break;
642 case 17: /* ELR_Hyp */
643 env->elr_el[2] = value;
644 break;
645 case 13:
646 env->banked_r13[bank_number(tgtmode)] = value;
647 break;
648 case 14:
649 env->banked_r14[r14_bank_number(tgtmode)] = value;
650 break;
651 case 8 ... 12:
652 switch (tgtmode) {
653 case ARM_CPU_MODE_USR:
654 env->usr_regs[regno - 8] = value;
655 break;
656 case ARM_CPU_MODE_FIQ:
657 env->fiq_regs[regno - 8] = value;
658 break;
659 default:
660 g_assert_not_reached();
661 }
662 break;
663 default:
664 g_assert_not_reached();
665 }
666 }
667
HELPER(mrs_banked)668 uint32_t HELPER(mrs_banked)(CPUARMState *env, uint32_t tgtmode, uint32_t regno)
669 {
670 msr_mrs_banked_exc_checks(env, tgtmode, regno);
671
672 switch (regno) {
673 case 16: /* SPSRs */
674 if (tgtmode == (env->uncached_cpsr & CPSR_M)) {
675 /* Only happens for SPSR_Hyp access in Hyp mode */
676 return env->spsr;
677 } else {
678 return env->banked_spsr[bank_number(tgtmode)];
679 }
680 case 17: /* ELR_Hyp */
681 return env->elr_el[2];
682 case 13:
683 return env->banked_r13[bank_number(tgtmode)];
684 case 14:
685 return env->banked_r14[r14_bank_number(tgtmode)];
686 case 8 ... 12:
687 switch (tgtmode) {
688 case ARM_CPU_MODE_USR:
689 return env->usr_regs[regno - 8];
690 case ARM_CPU_MODE_FIQ:
691 return env->fiq_regs[regno - 8];
692 default:
693 g_assert_not_reached();
694 }
695 default:
696 g_assert_not_reached();
697 }
698 }
699
HELPER(access_check_cp_reg)700 const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key,
701 uint32_t syndrome, uint32_t isread)
702 {
703 ARMCPU *cpu = env_archcpu(env);
704 const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, key);
705 CPAccessResult res = CP_ACCESS_OK;
706 int target_el;
707
708 assert(ri != NULL);
709
710 if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
711 && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
712 res = CP_ACCESS_TRAP;
713 goto fail;
714 }
715
716 if (ri->accessfn) {
717 res = ri->accessfn(env, ri, isread);
718 }
719
720 /*
721 * If the access function indicates a trap from EL0 to EL1 then
722 * that always takes priority over the HSTR_EL2 trap. (If it indicates
723 * a trap to EL3, then the HSTR_EL2 trap takes priority; if it indicates
724 * a trap to EL2, then the syndrome is the same either way so we don't
725 * care whether technically the architecture says that HSTR_EL2 trap or
726 * the other trap takes priority. So we take the "check HSTR_EL2" path
727 * for all of those cases.)
728 */
729 if (res != CP_ACCESS_OK && ((res & CP_ACCESS_EL_MASK) == 0) &&
730 arm_current_el(env) == 0) {
731 goto fail;
732 }
733
734 /*
735 * HSTR_EL2 traps from EL1 are checked earlier, in generated code;
736 * we only need to check here for traps from EL0.
737 */
738 if (!is_a64(env) && arm_current_el(env) == 0 && ri->cp == 15 &&
739 arm_is_el2_enabled(env) &&
740 (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
741 uint32_t mask = 1 << ri->crn;
742
743 if (ri->type & ARM_CP_64BIT) {
744 mask = 1 << ri->crm;
745 }
746
747 /* T4 and T14 are RES0 */
748 mask &= ~((1 << 4) | (1 << 14));
749
750 if (env->cp15.hstr_el2 & mask) {
751 res = CP_ACCESS_TRAP_EL2;
752 goto fail;
753 }
754 }
755
756 /*
757 * Fine-grained traps also are lower priority than undef-to-EL1,
758 * higher priority than trap-to-EL3, and we don't care about priority
759 * order with other EL2 traps because the syndrome value is the same.
760 */
761 if (arm_fgt_active(env, arm_current_el(env))) {
762 uint64_t trapword = 0;
763 unsigned int idx = FIELD_EX32(ri->fgt, FGT, IDX);
764 unsigned int bitpos = FIELD_EX32(ri->fgt, FGT, BITPOS);
765 bool rev = FIELD_EX32(ri->fgt, FGT, REV);
766 bool trapbit;
767
768 if (ri->fgt & FGT_EXEC) {
769 assert(idx < ARRAY_SIZE(env->cp15.fgt_exec));
770 trapword = env->cp15.fgt_exec[idx];
771 } else if (isread && (ri->fgt & FGT_R)) {
772 assert(idx < ARRAY_SIZE(env->cp15.fgt_read));
773 trapword = env->cp15.fgt_read[idx];
774 } else if (!isread && (ri->fgt & FGT_W)) {
775 assert(idx < ARRAY_SIZE(env->cp15.fgt_write));
776 trapword = env->cp15.fgt_write[idx];
777 }
778
779 trapbit = extract64(trapword, bitpos, 1);
780 if (trapbit != rev) {
781 res = CP_ACCESS_TRAP_EL2;
782 goto fail;
783 }
784 }
785
786 if (likely(res == CP_ACCESS_OK)) {
787 return ri;
788 }
789
790 fail:
791 switch (res & ~CP_ACCESS_EL_MASK) {
792 case CP_ACCESS_TRAP:
793 break;
794 case CP_ACCESS_TRAP_UNCATEGORIZED:
795 /* Only CP_ACCESS_TRAP traps are direct to a specified EL */
796 assert((res & CP_ACCESS_EL_MASK) == 0);
797 if (cpu_isar_feature(aa64_ids, cpu) && isread &&
798 arm_cpreg_in_idspace(ri)) {
799 /*
800 * FEAT_IDST says this should be reported as EC_SYSTEMREGISTERTRAP,
801 * not EC_UNCATEGORIZED
802 */
803 break;
804 }
805 syndrome = syn_uncategorized();
806 break;
807 default:
808 g_assert_not_reached();
809 }
810
811 target_el = res & CP_ACCESS_EL_MASK;
812 switch (target_el) {
813 case 0:
814 target_el = exception_target_el(env);
815 break;
816 case 2:
817 assert(arm_current_el(env) != 3);
818 assert(arm_is_el2_enabled(env));
819 break;
820 case 3:
821 assert(arm_feature(env, ARM_FEATURE_EL3));
822 break;
823 default:
824 /* No "direct" traps to EL1 */
825 g_assert_not_reached();
826 }
827
828 raise_exception(env, EXCP_UDEF, syndrome, target_el);
829 }
830
HELPER(lookup_cp_reg)831 const void *HELPER(lookup_cp_reg)(CPUARMState *env, uint32_t key)
832 {
833 ARMCPU *cpu = env_archcpu(env);
834 const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, key);
835
836 assert(ri != NULL);
837 return ri;
838 }
839
840 /*
841 * Test for HCR_EL2.TIDCP at EL1.
842 * Since implementation defined registers are rare, and within QEMU
843 * most of them are no-op, do not waste HFLAGS space for this and
844 * always use a helper.
845 */
HELPER(tidcp_el1)846 void HELPER(tidcp_el1)(CPUARMState *env, uint32_t syndrome)
847 {
848 if (arm_hcr_el2_eff(env) & HCR_TIDCP) {
849 raise_exception_ra(env, EXCP_UDEF, syndrome, 2, GETPC());
850 }
851 }
852
853 /*
854 * Similarly, for FEAT_TIDCP1 at EL0.
855 * We have already checked for the presence of the feature.
856 */
HELPER(tidcp_el0)857 void HELPER(tidcp_el0)(CPUARMState *env, uint32_t syndrome)
858 {
859 /* See arm_sctlr(), but we also need the sctlr el. */
860 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0);
861 int target_el = mmu_idx == ARMMMUIdx_E20_0 ? 2 : 1;
862
863 /*
864 * The bit is not valid unless the target el is aa64, but since the
865 * bit test is simpler perform that first and check validity after.
866 */
867 if ((env->cp15.sctlr_el[target_el] & SCTLR_TIDCP)
868 && arm_el_is_aa64(env, target_el)) {
869 raise_exception_ra(env, EXCP_UDEF, syndrome, target_el, GETPC());
870 }
871 }
872
HELPER(set_cp_reg)873 void HELPER(set_cp_reg)(CPUARMState *env, const void *rip, uint32_t value)
874 {
875 const ARMCPRegInfo *ri = rip;
876
877 if (ri->type & ARM_CP_IO) {
878 bql_lock();
879 ri->writefn(env, ri, value);
880 bql_unlock();
881 } else {
882 ri->writefn(env, ri, value);
883 }
884 }
885
HELPER(get_cp_reg)886 uint32_t HELPER(get_cp_reg)(CPUARMState *env, const void *rip)
887 {
888 const ARMCPRegInfo *ri = rip;
889 uint32_t res;
890
891 if (ri->type & ARM_CP_IO) {
892 bql_lock();
893 res = ri->readfn(env, ri);
894 bql_unlock();
895 } else {
896 res = ri->readfn(env, ri);
897 }
898
899 return res;
900 }
901
HELPER(set_cp_reg64)902 void HELPER(set_cp_reg64)(CPUARMState *env, const void *rip, uint64_t value)
903 {
904 const ARMCPRegInfo *ri = rip;
905
906 if (ri->type & ARM_CP_IO) {
907 bql_lock();
908 ri->writefn(env, ri, value);
909 bql_unlock();
910 } else {
911 ri->writefn(env, ri, value);
912 }
913 }
914
HELPER(get_cp_reg64)915 uint64_t HELPER(get_cp_reg64)(CPUARMState *env, const void *rip)
916 {
917 const ARMCPRegInfo *ri = rip;
918 uint64_t res;
919
920 if (ri->type & ARM_CP_IO) {
921 bql_lock();
922 res = ri->readfn(env, ri);
923 bql_unlock();
924 } else {
925 res = ri->readfn(env, ri);
926 }
927
928 return res;
929 }
930
HELPER(pre_hvc)931 void HELPER(pre_hvc)(CPUARMState *env)
932 {
933 ARMCPU *cpu = env_archcpu(env);
934 int cur_el = arm_current_el(env);
935 /* FIXME: Use actual secure state. */
936 bool secure = false;
937 bool undef;
938
939 if (arm_is_psci_call(cpu, EXCP_HVC)) {
940 /* If PSCI is enabled and this looks like a valid PSCI call then
941 * that overrides the architecturally mandated HVC behaviour.
942 */
943 return;
944 }
945
946 if (!arm_feature(env, ARM_FEATURE_EL2)) {
947 /* If EL2 doesn't exist, HVC always UNDEFs */
948 undef = true;
949 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
950 /* EL3.HCE has priority over EL2.HCD. */
951 undef = !(env->cp15.scr_el3 & SCR_HCE);
952 } else {
953 undef = env->cp15.hcr_el2 & HCR_HCD;
954 }
955
956 /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
957 * For ARMv8/AArch64, HVC is allowed in EL3.
958 * Note that we've already trapped HVC from EL0 at translation
959 * time.
960 */
961 if (secure && (!is_a64(env) || cur_el == 1)) {
962 undef = true;
963 }
964
965 if (undef) {
966 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
967 exception_target_el(env));
968 }
969 }
970
HELPER(pre_smc)971 void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
972 {
973 ARMCPU *cpu = env_archcpu(env);
974 int cur_el = arm_current_el(env);
975 bool secure = arm_is_secure(env);
976 bool smd_flag = env->cp15.scr_el3 & SCR_SMD;
977
978 /*
979 * SMC behaviour is summarized in the following table.
980 * This helper handles the "Trap to EL2" and "Undef insn" cases.
981 * The "Trap to EL3" and "PSCI call" cases are handled in the exception
982 * helper.
983 *
984 * -> ARM_FEATURE_EL3 and !SMD
985 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
986 *
987 * Conduit SMC, valid call Trap to EL2 PSCI Call
988 * Conduit SMC, inval call Trap to EL2 Trap to EL3
989 * Conduit not SMC Trap to EL2 Trap to EL3
990 *
991 *
992 * -> ARM_FEATURE_EL3 and SMD
993 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
994 *
995 * Conduit SMC, valid call Trap to EL2 PSCI Call
996 * Conduit SMC, inval call Trap to EL2 Undef insn
997 * Conduit not SMC Trap to EL2 Undef insn
998 *
999 *
1000 * -> !ARM_FEATURE_EL3
1001 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
1002 *
1003 * Conduit SMC, valid call Trap to EL2 PSCI Call
1004 * Conduit SMC, inval call Trap to EL2 Undef insn
1005 * Conduit not SMC Undef or trap[1] Undef insn
1006 *
1007 * [1] In this case:
1008 * - if HCR_EL2.NV == 1 we must trap to EL2
1009 * - if HCR_EL2.NV == 0 then newer architecture revisions permit
1010 * AArch64 (but not AArch32) to trap to EL2 as an IMPDEF choice
1011 * - otherwise we must UNDEF
1012 * We take the IMPDEF choice to always UNDEF if HCR_EL2.NV == 0.
1013 */
1014
1015 /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state.
1016 * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization
1017 * extensions, SMD only applies to NS state.
1018 * On ARMv7 without the Virtualization extensions, the SMD bit
1019 * doesn't exist, but we forbid the guest to set it to 1 in scr_write(),
1020 * so we need not special case this here.
1021 */
1022 bool smd = arm_feature(env, ARM_FEATURE_AARCH64) ? smd_flag
1023 : smd_flag && !secure;
1024
1025 if (!arm_feature(env, ARM_FEATURE_EL3) &&
1026 !(arm_hcr_el2_eff(env) & HCR_NV) &&
1027 cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
1028 /*
1029 * If we have no EL3 then traditionally SMC always UNDEFs and can't be
1030 * trapped to EL2. For nested virtualization, SMC can be trapped to
1031 * the outer hypervisor. PSCI-via-SMC is a sort of ersatz EL3
1032 * firmware within QEMU, and we want an EL2 guest to be able
1033 * to forbid its EL1 from making PSCI calls into QEMU's
1034 * "firmware" via HCR.TSC, so for these purposes treat
1035 * PSCI-via-SMC as implying an EL3.
1036 * This handles the very last line of the previous table.
1037 */
1038 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
1039 exception_target_el(env));
1040 }
1041
1042 if (cur_el == 1 && (arm_hcr_el2_eff(env) & HCR_TSC)) {
1043 /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
1044 * We also want an EL2 guest to be able to forbid its EL1 from
1045 * making PSCI calls into QEMU's "firmware" via HCR.TSC.
1046 * This handles all the "Trap to EL2" cases of the previous table.
1047 */
1048 raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
1049 }
1050
1051 /* Catch the two remaining "Undef insn" cases of the previous table:
1052 * - PSCI conduit is SMC but we don't have a valid PCSI call,
1053 * - We don't have EL3 or SMD is set.
1054 */
1055 if (!arm_is_psci_call(cpu, EXCP_SMC) &&
1056 (smd || !arm_feature(env, ARM_FEATURE_EL3))) {
1057 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
1058 exception_target_el(env));
1059 }
1060 }
1061
1062 /* ??? Flag setting arithmetic is awkward because we need to do comparisons.
1063 The only way to do that in TCG is a conditional branch, which clobbers
1064 all our temporaries. For now implement these as helper functions. */
1065
1066 /* Similarly for variable shift instructions. */
1067
HELPER(shl_cc)1068 uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
1069 {
1070 int shift = i & 0xff;
1071 if (shift >= 32) {
1072 if (shift == 32)
1073 env->CF = x & 1;
1074 else
1075 env->CF = 0;
1076 return 0;
1077 } else if (shift != 0) {
1078 env->CF = (x >> (32 - shift)) & 1;
1079 return x << shift;
1080 }
1081 return x;
1082 }
1083
HELPER(shr_cc)1084 uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
1085 {
1086 int shift = i & 0xff;
1087 if (shift >= 32) {
1088 if (shift == 32)
1089 env->CF = (x >> 31) & 1;
1090 else
1091 env->CF = 0;
1092 return 0;
1093 } else if (shift != 0) {
1094 env->CF = (x >> (shift - 1)) & 1;
1095 return x >> shift;
1096 }
1097 return x;
1098 }
1099
HELPER(sar_cc)1100 uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
1101 {
1102 int shift = i & 0xff;
1103 if (shift >= 32) {
1104 env->CF = (x >> 31) & 1;
1105 return (int32_t)x >> 31;
1106 } else if (shift != 0) {
1107 env->CF = (x >> (shift - 1)) & 1;
1108 return (int32_t)x >> shift;
1109 }
1110 return x;
1111 }
1112
HELPER(ror_cc)1113 uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
1114 {
1115 int shift1, shift;
1116 shift1 = i & 0xff;
1117 shift = shift1 & 0x1f;
1118 if (shift == 0) {
1119 if (shift1 != 0)
1120 env->CF = (x >> 31) & 1;
1121 return x;
1122 } else {
1123 env->CF = (x >> (shift - 1)) & 1;
1124 return ((uint32_t)x >> shift) | (x << (32 - shift));
1125 }
1126 }
1127
HELPER(probe_access)1128 void HELPER(probe_access)(CPUARMState *env, target_ulong ptr,
1129 uint32_t access_type, uint32_t mmu_idx,
1130 uint32_t size)
1131 {
1132 uint32_t in_page = -((uint32_t)ptr | TARGET_PAGE_SIZE);
1133 uintptr_t ra = GETPC();
1134
1135 if (likely(size <= in_page)) {
1136 probe_access(env, ptr, size, access_type, mmu_idx, ra);
1137 } else {
1138 probe_access(env, ptr, in_page, access_type, mmu_idx, ra);
1139 probe_access(env, ptr + in_page, size - in_page,
1140 access_type, mmu_idx, ra);
1141 }
1142 }
1143
1144 /*
1145 * This function corresponds to AArch64.vESBOperation().
1146 * Note that the AArch32 version is not functionally different.
1147 */
HELPER(vesb)1148 void HELPER(vesb)(CPUARMState *env)
1149 {
1150 /*
1151 * The EL2Enabled() check is done inside arm_hcr_el2_eff,
1152 * and will return HCR_EL2.VSE == 0, so nothing happens.
1153 */
1154 uint64_t hcr = arm_hcr_el2_eff(env);
1155 bool enabled = !(hcr & HCR_TGE) && (hcr & HCR_AMO);
1156 bool pending = enabled && (hcr & HCR_VSE);
1157 bool masked = (env->daif & PSTATE_A);
1158
1159 /* If VSE pending and masked, defer the exception. */
1160 if (pending && masked) {
1161 uint32_t syndrome;
1162
1163 if (arm_el_is_aa64(env, 1)) {
1164 /* Copy across IDS and ISS from VSESR. */
1165 syndrome = env->cp15.vsesr_el2 & 0x1ffffff;
1166 } else {
1167 ARMMMUFaultInfo fi = { .type = ARMFault_AsyncExternal };
1168
1169 if (extended_addresses_enabled(env)) {
1170 syndrome = arm_fi_to_lfsc(&fi);
1171 } else {
1172 syndrome = arm_fi_to_sfsc(&fi);
1173 }
1174 /* Copy across AET and ExT from VSESR. */
1175 syndrome |= env->cp15.vsesr_el2 & 0xd000;
1176 }
1177
1178 /* Set VDISR_EL2.A along with the syndrome. */
1179 env->cp15.vdisr_el2 = syndrome | (1u << 31);
1180
1181 /* Clear pending virtual SError */
1182 env->cp15.hcr_el2 &= ~HCR_VSE;
1183 cpu_reset_interrupt(env_cpu(env), CPU_INTERRUPT_VSERR);
1184 }
1185 }
1186