1 /* 2 * AArch64 specific helpers 3 * 4 * Copyright (c) 2013 Alexander Graf <agraf@suse.de> 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2.1 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 #include "qemu/osdep.h" 21 #include "qemu/units.h" 22 #include "cpu.h" 23 #include "gdbstub/helpers.h" 24 #include "exec/helper-proto.h" 25 #include "qemu/host-utils.h" 26 #include "qemu/log.h" 27 #include "qemu/main-loop.h" 28 #include "qemu/bitops.h" 29 #include "internals.h" 30 #include "qemu/crc32c.h" 31 #include "exec/cpu-common.h" 32 #include "accel/tcg/cpu-ldst.h" 33 #include "accel/tcg/helper-retaddr.h" 34 #include "accel/tcg/probe.h" 35 #include "exec/target_page.h" 36 #include "exec/tlb-flags.h" 37 #include "qemu/int128.h" 38 #include "qemu/atomic128.h" 39 #include "fpu/softfloat.h" 40 #include <zlib.h> /* for crc32 */ 41 #ifdef CONFIG_USER_ONLY 42 #include "user/page-protection.h" 43 #endif 44 #include "vec_internal.h" 45 46 /* C2.4.7 Multiply and divide */ 47 /* special cases for 0 and LLONG_MIN are mandated by the standard */ 48 uint64_t HELPER(udiv64)(uint64_t num, uint64_t den) 49 { 50 if (den == 0) { 51 return 0; 52 } 53 return num / den; 54 } 55 56 int64_t HELPER(sdiv64)(int64_t num, int64_t den) 57 { 58 if (den == 0) { 59 return 0; 60 } 61 if (num == LLONG_MIN && den == -1) { 62 return LLONG_MIN; 63 } 64 return num / den; 65 } 66 67 uint64_t HELPER(rbit64)(uint64_t x) 68 { 69 return revbit64(x); 70 } 71 72 void HELPER(msr_i_spsel)(CPUARMState *env, uint32_t imm) 73 { 74 update_spsel(env, imm); 75 } 76 77 void HELPER(msr_set_allint_el1)(CPUARMState *env) 78 { 79 /* ALLINT update to PSTATE. */ 80 if (arm_hcrx_el2_eff(env) & HCRX_TALLINT) { 81 raise_exception_ra(env, EXCP_UDEF, 82 syn_aa64_sysregtrap(0, 1, 0, 4, 1, 0x1f, 0), 2, 83 GETPC()); 84 } 85 86 env->pstate |= PSTATE_ALLINT; 87 } 88 89 static void daif_check(CPUARMState *env, uint32_t op, 90 uint32_t imm, uintptr_t ra) 91 { 92 /* DAIF update to PSTATE. This is OK from EL0 only if UMA is set. */ 93 if (arm_current_el(env) == 0 && !(arm_sctlr(env, 0) & SCTLR_UMA)) { 94 raise_exception_ra(env, EXCP_UDEF, 95 syn_aa64_sysregtrap(0, extract32(op, 0, 3), 96 extract32(op, 3, 3), 4, 97 imm, 0x1f, 0), 98 exception_target_el(env), ra); 99 } 100 } 101 102 void HELPER(msr_i_daifset)(CPUARMState *env, uint32_t imm) 103 { 104 daif_check(env, 0x1e, imm, GETPC()); 105 env->daif |= (imm << 6) & PSTATE_DAIF; 106 arm_rebuild_hflags(env); 107 } 108 109 void HELPER(msr_i_daifclear)(CPUARMState *env, uint32_t imm) 110 { 111 daif_check(env, 0x1f, imm, GETPC()); 112 env->daif &= ~((imm << 6) & PSTATE_DAIF); 113 arm_rebuild_hflags(env); 114 } 115 116 /* Convert a softfloat float_relation_ (as returned by 117 * the float*_compare functions) to the correct ARM 118 * NZCV flag state. 119 */ 120 static inline uint32_t float_rel_to_flags(int res) 121 { 122 uint64_t flags; 123 switch (res) { 124 case float_relation_equal: 125 flags = PSTATE_Z | PSTATE_C; 126 break; 127 case float_relation_less: 128 flags = PSTATE_N; 129 break; 130 case float_relation_greater: 131 flags = PSTATE_C; 132 break; 133 case float_relation_unordered: 134 default: 135 flags = PSTATE_C | PSTATE_V; 136 break; 137 } 138 return flags; 139 } 140 141 uint64_t HELPER(vfp_cmph_a64)(uint32_t x, uint32_t y, float_status *fp_status) 142 { 143 return float_rel_to_flags(float16_compare_quiet(x, y, fp_status)); 144 } 145 146 uint64_t HELPER(vfp_cmpeh_a64)(uint32_t x, uint32_t y, float_status *fp_status) 147 { 148 return float_rel_to_flags(float16_compare(x, y, fp_status)); 149 } 150 151 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, float_status *fp_status) 152 { 153 return float_rel_to_flags(float32_compare_quiet(x, y, fp_status)); 154 } 155 156 uint64_t HELPER(vfp_cmpes_a64)(float32 x, float32 y, float_status *fp_status) 157 { 158 return float_rel_to_flags(float32_compare(x, y, fp_status)); 159 } 160 161 uint64_t HELPER(vfp_cmpd_a64)(float64 x, float64 y, float_status *fp_status) 162 { 163 return float_rel_to_flags(float64_compare_quiet(x, y, fp_status)); 164 } 165 166 uint64_t HELPER(vfp_cmped_a64)(float64 x, float64 y, float_status *fp_status) 167 { 168 return float_rel_to_flags(float64_compare(x, y, fp_status)); 169 } 170 171 float32 HELPER(vfp_mulxs)(float32 a, float32 b, float_status *fpst) 172 { 173 a = float32_squash_input_denormal(a, fpst); 174 b = float32_squash_input_denormal(b, fpst); 175 176 if ((float32_is_zero(a) && float32_is_infinity(b)) || 177 (float32_is_infinity(a) && float32_is_zero(b))) { 178 /* 2.0 with the sign bit set to sign(A) XOR sign(B) */ 179 return make_float32((1U << 30) | 180 ((float32_val(a) ^ float32_val(b)) & (1U << 31))); 181 } 182 return float32_mul(a, b, fpst); 183 } 184 185 float64 HELPER(vfp_mulxd)(float64 a, float64 b, float_status *fpst) 186 { 187 a = float64_squash_input_denormal(a, fpst); 188 b = float64_squash_input_denormal(b, fpst); 189 190 if ((float64_is_zero(a) && float64_is_infinity(b)) || 191 (float64_is_infinity(a) && float64_is_zero(b))) { 192 /* 2.0 with the sign bit set to sign(A) XOR sign(B) */ 193 return make_float64((1ULL << 62) | 194 ((float64_val(a) ^ float64_val(b)) & (1ULL << 63))); 195 } 196 return float64_mul(a, b, fpst); 197 } 198 199 /* 64bit/double versions of the neon float compare functions */ 200 uint64_t HELPER(neon_ceq_f64)(float64 a, float64 b, float_status *fpst) 201 { 202 return -float64_eq_quiet(a, b, fpst); 203 } 204 205 uint64_t HELPER(neon_cge_f64)(float64 a, float64 b, float_status *fpst) 206 { 207 return -float64_le(b, a, fpst); 208 } 209 210 uint64_t HELPER(neon_cgt_f64)(float64 a, float64 b, float_status *fpst) 211 { 212 return -float64_lt(b, a, fpst); 213 } 214 215 /* 216 * Reciprocal step and sqrt step. Note that unlike the A32/T32 217 * versions, these do a fully fused multiply-add or 218 * multiply-add-and-halve. 219 * The FPCR.AH == 1 versions need to avoid flipping the sign of NaN. 220 */ 221 #define DO_RECPS(NAME, CTYPE, FLOATTYPE, CHSFN) \ 222 CTYPE HELPER(NAME)(CTYPE a, CTYPE b, float_status *fpst) \ 223 { \ 224 a = FLOATTYPE ## _squash_input_denormal(a, fpst); \ 225 b = FLOATTYPE ## _squash_input_denormal(b, fpst); \ 226 a = FLOATTYPE ## _ ## CHSFN(a); \ 227 if ((FLOATTYPE ## _is_infinity(a) && FLOATTYPE ## _is_zero(b)) || \ 228 (FLOATTYPE ## _is_infinity(b) && FLOATTYPE ## _is_zero(a))) { \ 229 return FLOATTYPE ## _two; \ 230 } \ 231 return FLOATTYPE ## _muladd(a, b, FLOATTYPE ## _two, 0, fpst); \ 232 } 233 234 DO_RECPS(recpsf_f16, uint32_t, float16, chs) 235 DO_RECPS(recpsf_f32, float32, float32, chs) 236 DO_RECPS(recpsf_f64, float64, float64, chs) 237 DO_RECPS(recpsf_ah_f16, uint32_t, float16, ah_chs) 238 DO_RECPS(recpsf_ah_f32, float32, float32, ah_chs) 239 DO_RECPS(recpsf_ah_f64, float64, float64, ah_chs) 240 241 #define DO_RSQRTSF(NAME, CTYPE, FLOATTYPE, CHSFN) \ 242 CTYPE HELPER(NAME)(CTYPE a, CTYPE b, float_status *fpst) \ 243 { \ 244 a = FLOATTYPE ## _squash_input_denormal(a, fpst); \ 245 b = FLOATTYPE ## _squash_input_denormal(b, fpst); \ 246 a = FLOATTYPE ## _ ## CHSFN(a); \ 247 if ((FLOATTYPE ## _is_infinity(a) && FLOATTYPE ## _is_zero(b)) || \ 248 (FLOATTYPE ## _is_infinity(b) && FLOATTYPE ## _is_zero(a))) { \ 249 return FLOATTYPE ## _one_point_five; \ 250 } \ 251 return FLOATTYPE ## _muladd_scalbn(a, b, FLOATTYPE ## _three, \ 252 -1, 0, fpst); \ 253 } \ 254 255 DO_RSQRTSF(rsqrtsf_f16, uint32_t, float16, chs) 256 DO_RSQRTSF(rsqrtsf_f32, float32, float32, chs) 257 DO_RSQRTSF(rsqrtsf_f64, float64, float64, chs) 258 DO_RSQRTSF(rsqrtsf_ah_f16, uint32_t, float16, ah_chs) 259 DO_RSQRTSF(rsqrtsf_ah_f32, float32, float32, ah_chs) 260 DO_RSQRTSF(rsqrtsf_ah_f64, float64, float64, ah_chs) 261 262 /* Floating-point reciprocal exponent - see FPRecpX in ARM ARM */ 263 uint32_t HELPER(frecpx_f16)(uint32_t a, float_status *fpst) 264 { 265 uint16_t val16, sbit; 266 int16_t exp; 267 268 if (float16_is_any_nan(a)) { 269 float16 nan = a; 270 if (float16_is_signaling_nan(a, fpst)) { 271 float_raise(float_flag_invalid, fpst); 272 if (!fpst->default_nan_mode) { 273 nan = float16_silence_nan(a, fpst); 274 } 275 } 276 if (fpst->default_nan_mode) { 277 nan = float16_default_nan(fpst); 278 } 279 return nan; 280 } 281 282 a = float16_squash_input_denormal(a, fpst); 283 284 val16 = float16_val(a); 285 sbit = 0x8000 & val16; 286 exp = extract32(val16, 10, 5); 287 288 if (exp == 0) { 289 return make_float16(deposit32(sbit, 10, 5, 0x1e)); 290 } else { 291 return make_float16(deposit32(sbit, 10, 5, ~exp)); 292 } 293 } 294 295 float32 HELPER(frecpx_f32)(float32 a, float_status *fpst) 296 { 297 uint32_t val32, sbit; 298 int32_t exp; 299 300 if (float32_is_any_nan(a)) { 301 float32 nan = a; 302 if (float32_is_signaling_nan(a, fpst)) { 303 float_raise(float_flag_invalid, fpst); 304 if (!fpst->default_nan_mode) { 305 nan = float32_silence_nan(a, fpst); 306 } 307 } 308 if (fpst->default_nan_mode) { 309 nan = float32_default_nan(fpst); 310 } 311 return nan; 312 } 313 314 a = float32_squash_input_denormal(a, fpst); 315 316 val32 = float32_val(a); 317 sbit = 0x80000000ULL & val32; 318 exp = extract32(val32, 23, 8); 319 320 if (exp == 0) { 321 return make_float32(sbit | (0xfe << 23)); 322 } else { 323 return make_float32(sbit | (~exp & 0xff) << 23); 324 } 325 } 326 327 float64 HELPER(frecpx_f64)(float64 a, float_status *fpst) 328 { 329 uint64_t val64, sbit; 330 int64_t exp; 331 332 if (float64_is_any_nan(a)) { 333 float64 nan = a; 334 if (float64_is_signaling_nan(a, fpst)) { 335 float_raise(float_flag_invalid, fpst); 336 if (!fpst->default_nan_mode) { 337 nan = float64_silence_nan(a, fpst); 338 } 339 } 340 if (fpst->default_nan_mode) { 341 nan = float64_default_nan(fpst); 342 } 343 return nan; 344 } 345 346 a = float64_squash_input_denormal(a, fpst); 347 348 val64 = float64_val(a); 349 sbit = 0x8000000000000000ULL & val64; 350 exp = extract64(float64_val(a), 52, 11); 351 352 if (exp == 0) { 353 return make_float64(sbit | (0x7feULL << 52)); 354 } else { 355 return make_float64(sbit | (~exp & 0x7ffULL) << 52); 356 } 357 } 358 359 float32 HELPER(fcvtx_f64_to_f32)(float64 a, float_status *fpst) 360 { 361 float32 r; 362 int old = get_float_rounding_mode(fpst); 363 364 set_float_rounding_mode(float_round_to_odd, fpst); 365 r = float64_to_float32(a, fpst); 366 set_float_rounding_mode(old, fpst); 367 return r; 368 } 369 370 /* 371 * AH=1 min/max have some odd special cases: 372 * comparing two zeroes (regardless of sign), (NaN, anything), 373 * or (anything, NaN) should return the second argument (possibly 374 * squashed to zero). 375 * Also, denormal outputs are not squashed to zero regardless of FZ or FZ16. 376 */ 377 #define AH_MINMAX_HELPER(NAME, CTYPE, FLOATTYPE, MINMAX) \ 378 CTYPE HELPER(NAME)(CTYPE a, CTYPE b, float_status *fpst) \ 379 { \ 380 bool save; \ 381 CTYPE r; \ 382 a = FLOATTYPE ## _squash_input_denormal(a, fpst); \ 383 b = FLOATTYPE ## _squash_input_denormal(b, fpst); \ 384 if (FLOATTYPE ## _is_zero(a) && FLOATTYPE ## _is_zero(b)) { \ 385 return b; \ 386 } \ 387 if (FLOATTYPE ## _is_any_nan(a) || \ 388 FLOATTYPE ## _is_any_nan(b)) { \ 389 float_raise(float_flag_invalid, fpst); \ 390 return b; \ 391 } \ 392 save = get_flush_to_zero(fpst); \ 393 set_flush_to_zero(false, fpst); \ 394 r = FLOATTYPE ## _ ## MINMAX(a, b, fpst); \ 395 set_flush_to_zero(save, fpst); \ 396 return r; \ 397 } 398 399 AH_MINMAX_HELPER(vfp_ah_minh, dh_ctype_f16, float16, min) 400 AH_MINMAX_HELPER(vfp_ah_mins, float32, float32, min) 401 AH_MINMAX_HELPER(vfp_ah_mind, float64, float64, min) 402 AH_MINMAX_HELPER(vfp_ah_maxh, dh_ctype_f16, float16, max) 403 AH_MINMAX_HELPER(vfp_ah_maxs, float32, float32, max) 404 AH_MINMAX_HELPER(vfp_ah_maxd, float64, float64, max) 405 AH_MINMAX_HELPER(sme2_ah_fmax_b16, bfloat16, bfloat16, max) 406 AH_MINMAX_HELPER(sme2_ah_fmin_b16, bfloat16, bfloat16, min) 407 408 /* 64-bit versions of the CRC helpers. Note that although the operation 409 * (and the prototypes of crc32c() and crc32() mean that only the bottom 410 * 32 bits of the accumulator and result are used, we pass and return 411 * uint64_t for convenience of the generated code. Unlike the 32-bit 412 * instruction set versions, val may genuinely have 64 bits of data in it. 413 * The upper bytes of val (above the number specified by 'bytes') must have 414 * been zeroed out by the caller. 415 */ 416 uint64_t HELPER(crc32_64)(uint64_t acc, uint64_t val, uint32_t bytes) 417 { 418 uint8_t buf[8]; 419 420 stq_le_p(buf, val); 421 422 /* zlib crc32 converts the accumulator and output to one's complement. */ 423 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff; 424 } 425 426 uint64_t HELPER(crc32c_64)(uint64_t acc, uint64_t val, uint32_t bytes) 427 { 428 uint8_t buf[8]; 429 430 stq_le_p(buf, val); 431 432 /* Linux crc32c converts the output to one's complement. */ 433 return crc32c(acc, buf, bytes) ^ 0xffffffff; 434 } 435 436 /* 437 * AdvSIMD half-precision 438 */ 439 440 #define ADVSIMD_HELPER(name, suffix) HELPER(glue(glue(advsimd_, name), suffix)) 441 442 #define ADVSIMD_HALFOP(name) \ 443 uint32_t ADVSIMD_HELPER(name, h)(uint32_t a, uint32_t b, float_status *fpst) \ 444 { \ 445 return float16_ ## name(a, b, fpst); \ 446 } 447 448 #define ADVSIMD_TWOHALFOP(name) \ 449 uint32_t ADVSIMD_HELPER(name, 2h)(uint32_t two_a, uint32_t two_b, \ 450 float_status *fpst) \ 451 { \ 452 float16 a1, a2, b1, b2; \ 453 uint32_t r1, r2; \ 454 a1 = extract32(two_a, 0, 16); \ 455 a2 = extract32(two_a, 16, 16); \ 456 b1 = extract32(two_b, 0, 16); \ 457 b2 = extract32(two_b, 16, 16); \ 458 r1 = float16_ ## name(a1, b1, fpst); \ 459 r2 = float16_ ## name(a2, b2, fpst); \ 460 return deposit32(r1, 16, 16, r2); \ 461 } 462 463 ADVSIMD_TWOHALFOP(add) 464 ADVSIMD_TWOHALFOP(sub) 465 ADVSIMD_TWOHALFOP(mul) 466 ADVSIMD_TWOHALFOP(div) 467 ADVSIMD_TWOHALFOP(min) 468 ADVSIMD_TWOHALFOP(max) 469 ADVSIMD_TWOHALFOP(minnum) 470 ADVSIMD_TWOHALFOP(maxnum) 471 472 /* Data processing - scalar floating-point and advanced SIMD */ 473 static float16 float16_mulx(float16 a, float16 b, float_status *fpst) 474 { 475 a = float16_squash_input_denormal(a, fpst); 476 b = float16_squash_input_denormal(b, fpst); 477 478 if ((float16_is_zero(a) && float16_is_infinity(b)) || 479 (float16_is_infinity(a) && float16_is_zero(b))) { 480 /* 2.0 with the sign bit set to sign(A) XOR sign(B) */ 481 return make_float16((1U << 14) | 482 ((float16_val(a) ^ float16_val(b)) & (1U << 15))); 483 } 484 return float16_mul(a, b, fpst); 485 } 486 487 ADVSIMD_HALFOP(mulx) 488 ADVSIMD_TWOHALFOP(mulx) 489 490 /* fused multiply-accumulate */ 491 uint32_t HELPER(advsimd_muladdh)(uint32_t a, uint32_t b, uint32_t c, 492 float_status *fpst) 493 { 494 return float16_muladd(a, b, c, 0, fpst); 495 } 496 497 uint32_t HELPER(advsimd_muladd2h)(uint32_t two_a, uint32_t two_b, 498 uint32_t two_c, float_status *fpst) 499 { 500 float16 a1, a2, b1, b2, c1, c2; 501 uint32_t r1, r2; 502 a1 = extract32(two_a, 0, 16); 503 a2 = extract32(two_a, 16, 16); 504 b1 = extract32(two_b, 0, 16); 505 b2 = extract32(two_b, 16, 16); 506 c1 = extract32(two_c, 0, 16); 507 c2 = extract32(two_c, 16, 16); 508 r1 = float16_muladd(a1, b1, c1, 0, fpst); 509 r2 = float16_muladd(a2, b2, c2, 0, fpst); 510 return deposit32(r1, 16, 16, r2); 511 } 512 513 /* 514 * Floating point comparisons produce an integer result. Softfloat 515 * routines return float_relation types which we convert to the 0/-1 516 * Neon requires. 517 */ 518 519 #define ADVSIMD_CMPRES(test) (test) ? 0xffff : 0 520 521 uint32_t HELPER(advsimd_ceq_f16)(uint32_t a, uint32_t b, float_status *fpst) 522 { 523 int compare = float16_compare_quiet(a, b, fpst); 524 return ADVSIMD_CMPRES(compare == float_relation_equal); 525 } 526 527 uint32_t HELPER(advsimd_cge_f16)(uint32_t a, uint32_t b, float_status *fpst) 528 { 529 int compare = float16_compare(a, b, fpst); 530 return ADVSIMD_CMPRES(compare == float_relation_greater || 531 compare == float_relation_equal); 532 } 533 534 uint32_t HELPER(advsimd_cgt_f16)(uint32_t a, uint32_t b, float_status *fpst) 535 { 536 int compare = float16_compare(a, b, fpst); 537 return ADVSIMD_CMPRES(compare == float_relation_greater); 538 } 539 540 uint32_t HELPER(advsimd_acge_f16)(uint32_t a, uint32_t b, float_status *fpst) 541 { 542 float16 f0 = float16_abs(a); 543 float16 f1 = float16_abs(b); 544 int compare = float16_compare(f0, f1, fpst); 545 return ADVSIMD_CMPRES(compare == float_relation_greater || 546 compare == float_relation_equal); 547 } 548 549 uint32_t HELPER(advsimd_acgt_f16)(uint32_t a, uint32_t b, float_status *fpst) 550 { 551 float16 f0 = float16_abs(a); 552 float16 f1 = float16_abs(b); 553 int compare = float16_compare(f0, f1, fpst); 554 return ADVSIMD_CMPRES(compare == float_relation_greater); 555 } 556 557 /* round to integral */ 558 uint32_t HELPER(advsimd_rinth_exact)(uint32_t x, float_status *fp_status) 559 { 560 return float16_round_to_int(x, fp_status); 561 } 562 563 uint32_t HELPER(advsimd_rinth)(uint32_t x, float_status *fp_status) 564 { 565 int old_flags = get_float_exception_flags(fp_status), new_flags; 566 float16 ret; 567 568 ret = float16_round_to_int(x, fp_status); 569 570 /* Suppress any inexact exceptions the conversion produced */ 571 if (!(old_flags & float_flag_inexact)) { 572 new_flags = get_float_exception_flags(fp_status); 573 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status); 574 } 575 576 return ret; 577 } 578 579 static int el_from_spsr(uint32_t spsr) 580 { 581 /* Return the exception level that this SPSR is requesting a return to, 582 * or -1 if it is invalid (an illegal return) 583 */ 584 if (spsr & PSTATE_nRW) { 585 switch (spsr & CPSR_M) { 586 case ARM_CPU_MODE_USR: 587 return 0; 588 case ARM_CPU_MODE_HYP: 589 return 2; 590 case ARM_CPU_MODE_FIQ: 591 case ARM_CPU_MODE_IRQ: 592 case ARM_CPU_MODE_SVC: 593 case ARM_CPU_MODE_ABT: 594 case ARM_CPU_MODE_UND: 595 case ARM_CPU_MODE_SYS: 596 return 1; 597 case ARM_CPU_MODE_MON: 598 /* Returning to Mon from AArch64 is never possible, 599 * so this is an illegal return. 600 */ 601 default: 602 return -1; 603 } 604 } else { 605 if (extract32(spsr, 1, 1)) { 606 /* Return with reserved M[1] bit set */ 607 return -1; 608 } 609 if (extract32(spsr, 0, 4) == 1) { 610 /* return to EL0 with M[0] bit set */ 611 return -1; 612 } 613 return extract32(spsr, 2, 2); 614 } 615 } 616 617 static void cpsr_write_from_spsr_elx(CPUARMState *env, 618 uint32_t val) 619 { 620 uint32_t mask; 621 622 /* Save SPSR_ELx.SS into PSTATE. */ 623 env->pstate = (env->pstate & ~PSTATE_SS) | (val & PSTATE_SS); 624 val &= ~PSTATE_SS; 625 626 /* Move DIT to the correct location for CPSR */ 627 if (val & PSTATE_DIT) { 628 val &= ~PSTATE_DIT; 629 val |= CPSR_DIT; 630 } 631 632 mask = aarch32_cpsr_valid_mask(env->features, \ 633 &env_archcpu(env)->isar); 634 cpsr_write(env, val, mask, CPSRWriteRaw); 635 } 636 637 void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc) 638 { 639 ARMCPU *cpu = env_archcpu(env); 640 int cur_el = arm_current_el(env); 641 unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el); 642 uint32_t spsr = env->banked_spsr[spsr_idx]; 643 int new_el; 644 bool return_to_aa64 = (spsr & PSTATE_nRW) == 0; 645 646 aarch64_save_sp(env, cur_el); 647 648 arm_clear_exclusive(env); 649 650 /* We must squash the PSTATE.SS bit to zero unless both of the 651 * following hold: 652 * 1. debug exceptions are currently disabled 653 * 2. singlestep will be active in the EL we return to 654 * We check 1 here and 2 after we've done the pstate/cpsr write() to 655 * transition to the EL we're going to. 656 */ 657 if (arm_generate_debug_exceptions(env)) { 658 spsr &= ~PSTATE_SS; 659 } 660 661 /* 662 * FEAT_RME forbids return from EL3 with an invalid security state. 663 * We don't need an explicit check for FEAT_RME here because we enforce 664 * in scr_write() that you can't set the NSE bit without it. 665 */ 666 if (cur_el == 3 && (env->cp15.scr_el3 & (SCR_NS | SCR_NSE)) == SCR_NSE) { 667 goto illegal_return; 668 } 669 670 new_el = el_from_spsr(spsr); 671 if (new_el == -1) { 672 goto illegal_return; 673 } 674 if (new_el > cur_el || (new_el == 2 && !arm_is_el2_enabled(env))) { 675 /* Disallow return to an EL which is unimplemented or higher 676 * than the current one. 677 */ 678 goto illegal_return; 679 } 680 681 if (new_el != 0 && arm_el_is_aa64(env, new_el) != return_to_aa64) { 682 /* Return to an EL which is configured for a different register width */ 683 goto illegal_return; 684 } 685 686 if (!return_to_aa64 && !cpu_isar_feature(aa64_aa32, cpu)) { 687 /* Return to AArch32 when CPU is AArch64-only */ 688 goto illegal_return; 689 } 690 691 if (new_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) { 692 goto illegal_return; 693 } 694 695 bql_lock(); 696 arm_call_pre_el_change_hook(cpu); 697 bql_unlock(); 698 699 if (!return_to_aa64) { 700 env->aarch64 = false; 701 /* We do a raw CPSR write because aarch64_sync_64_to_32() 702 * will sort the register banks out for us, and we've already 703 * caught all the bad-mode cases in el_from_spsr(). 704 */ 705 cpsr_write_from_spsr_elx(env, spsr); 706 if (!arm_singlestep_active(env)) { 707 env->pstate &= ~PSTATE_SS; 708 } 709 aarch64_sync_64_to_32(env); 710 711 if (spsr & CPSR_T) { 712 env->regs[15] = new_pc & ~0x1; 713 } else { 714 env->regs[15] = new_pc & ~0x3; 715 } 716 helper_rebuild_hflags_a32(env, new_el); 717 qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to " 718 "AArch32 EL%d PC 0x%" PRIx32 "\n", 719 cur_el, new_el, env->regs[15]); 720 } else { 721 int tbii; 722 723 env->aarch64 = true; 724 spsr &= aarch64_pstate_valid_mask(&cpu->isar); 725 pstate_write(env, spsr); 726 if (!arm_singlestep_active(env)) { 727 env->pstate &= ~PSTATE_SS; 728 } 729 aarch64_restore_sp(env, new_el); 730 helper_rebuild_hflags_a64(env, new_el); 731 732 /* 733 * Apply TBI to the exception return address. We had to delay this 734 * until after we selected the new EL, so that we could select the 735 * correct TBI+TBID bits. This is made easier by waiting until after 736 * the hflags rebuild, since we can pull the composite TBII field 737 * from there. 738 */ 739 tbii = EX_TBFLAG_A64(env->hflags, TBII); 740 if ((tbii >> extract64(new_pc, 55, 1)) & 1) { 741 /* TBI is enabled. */ 742 int core_mmu_idx = arm_env_mmu_index(env); 743 if (regime_has_2_ranges(core_to_aa64_mmu_idx(core_mmu_idx))) { 744 new_pc = sextract64(new_pc, 0, 56); 745 } else { 746 new_pc = extract64(new_pc, 0, 56); 747 } 748 } 749 env->pc = new_pc; 750 751 qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to " 752 "AArch64 EL%d PC 0x%" PRIx64 "\n", 753 cur_el, new_el, env->pc); 754 } 755 756 /* 757 * Note that cur_el can never be 0. If new_el is 0, then 758 * el0_a64 is return_to_aa64, else el0_a64 is ignored. 759 */ 760 aarch64_sve_change_el(env, cur_el, new_el, return_to_aa64); 761 762 bql_lock(); 763 arm_call_el_change_hook(cpu); 764 bql_unlock(); 765 766 return; 767 768 illegal_return: 769 /* Illegal return events of various kinds have architecturally 770 * mandated behaviour: 771 * restore NZCV and DAIF from SPSR_ELx 772 * set PSTATE.IL 773 * restore PC from ELR_ELx 774 * no change to exception level, execution state or stack pointer 775 */ 776 env->pstate |= PSTATE_IL; 777 env->pc = new_pc; 778 spsr &= PSTATE_NZCV | PSTATE_DAIF | PSTATE_ALLINT; 779 spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF | PSTATE_ALLINT); 780 pstate_write(env, spsr); 781 if (!arm_singlestep_active(env)) { 782 env->pstate &= ~PSTATE_SS; 783 } 784 helper_rebuild_hflags_a64(env, cur_el); 785 qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: " 786 "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc); 787 } 788 789 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in) 790 { 791 uintptr_t ra = GETPC(); 792 793 /* 794 * Implement DC ZVA, which zeroes a fixed-length block of memory. 795 * Note that we do not implement the (architecturally mandated) 796 * alignment fault for attempts to use this on Device memory 797 * (which matches the usual QEMU behaviour of not implementing either 798 * alignment faults or any memory attribute handling). 799 */ 800 int blocklen = 4 << env_archcpu(env)->dcz_blocksize; 801 uint64_t vaddr = vaddr_in & ~(blocklen - 1); 802 int mmu_idx = arm_env_mmu_index(env); 803 void *mem; 804 805 /* 806 * Trapless lookup. In addition to actual invalid page, may 807 * return NULL for I/O, watchpoints, clean pages, etc. 808 */ 809 mem = tlb_vaddr_to_host(env, vaddr, MMU_DATA_STORE, mmu_idx); 810 811 #ifndef CONFIG_USER_ONLY 812 if (unlikely(!mem)) { 813 /* 814 * Trap if accessing an invalid page. DC_ZVA requires that we supply 815 * the original pointer for an invalid page. But watchpoints require 816 * that we probe the actual space. So do both. 817 */ 818 (void) probe_write(env, vaddr_in, 1, mmu_idx, ra); 819 mem = probe_write(env, vaddr, blocklen, mmu_idx, ra); 820 821 if (unlikely(!mem)) { 822 /* 823 * The only remaining reason for mem == NULL is I/O. 824 * Just do a series of byte writes as the architecture demands. 825 */ 826 for (int i = 0; i < blocklen; i++) { 827 cpu_stb_mmuidx_ra(env, vaddr + i, 0, mmu_idx, ra); 828 } 829 return; 830 } 831 } 832 #endif 833 834 set_helper_retaddr(ra); 835 memset(mem, 0, blocklen); 836 clear_helper_retaddr(); 837 } 838 839 void HELPER(unaligned_access)(CPUARMState *env, uint64_t addr, 840 uint32_t access_type, uint32_t mmu_idx) 841 { 842 arm_cpu_do_unaligned_access(env_cpu(env), addr, access_type, 843 mmu_idx, GETPC()); 844 } 845 846 /* Memory operations (memset, memmove, memcpy) */ 847 848 /* 849 * Return true if the CPY* and SET* insns can execute; compare 850 * pseudocode CheckMOPSEnabled(), though we refactor it a little. 851 */ 852 static bool mops_enabled(CPUARMState *env) 853 { 854 int el = arm_current_el(env); 855 856 if (el < 2 && 857 (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE) && 858 !(arm_hcrx_el2_eff(env) & HCRX_MSCEN)) { 859 return false; 860 } 861 862 if (el == 0) { 863 if (!el_is_in_host(env, 0)) { 864 return env->cp15.sctlr_el[1] & SCTLR_MSCEN; 865 } else { 866 return env->cp15.sctlr_el[2] & SCTLR_MSCEN; 867 } 868 } 869 return true; 870 } 871 872 static void check_mops_enabled(CPUARMState *env, uintptr_t ra) 873 { 874 if (!mops_enabled(env)) { 875 raise_exception_ra(env, EXCP_UDEF, syn_uncategorized(), 876 exception_target_el(env), ra); 877 } 878 } 879 880 /* 881 * Return the target exception level for an exception due 882 * to mismatched arguments in a FEAT_MOPS copy or set. 883 * Compare pseudocode MismatchedCpySetTargetEL() 884 */ 885 static int mops_mismatch_exception_target_el(CPUARMState *env) 886 { 887 int el = arm_current_el(env); 888 889 if (el > 1) { 890 return el; 891 } 892 if (el == 0 && (arm_hcr_el2_eff(env) & HCR_TGE)) { 893 return 2; 894 } 895 if (el == 1 && (arm_hcrx_el2_eff(env) & HCRX_MCE2)) { 896 return 2; 897 } 898 return 1; 899 } 900 901 /* 902 * Check whether an M or E instruction was executed with a CF value 903 * indicating the wrong option for this implementation. 904 * Assumes we are always Option A. 905 */ 906 static void check_mops_wrong_option(CPUARMState *env, uint32_t syndrome, 907 uintptr_t ra) 908 { 909 if (env->CF != 0) { 910 syndrome |= 1 << 17; /* Set the wrong-option bit */ 911 raise_exception_ra(env, EXCP_UDEF, syndrome, 912 mops_mismatch_exception_target_el(env), ra); 913 } 914 } 915 916 /* 917 * Return the maximum number of bytes we can transfer starting at addr 918 * without crossing a page boundary. 919 */ 920 static uint64_t page_limit(uint64_t addr) 921 { 922 return TARGET_PAGE_ALIGN(addr + 1) - addr; 923 } 924 925 /* 926 * Return the number of bytes we can copy starting from addr and working 927 * backwards without crossing a page boundary. 928 */ 929 static uint64_t page_limit_rev(uint64_t addr) 930 { 931 return (addr & ~TARGET_PAGE_MASK) + 1; 932 } 933 934 /* 935 * Perform part of a memory set on an area of guest memory starting at 936 * toaddr (a dirty address) and extending for setsize bytes. 937 * 938 * Returns the number of bytes actually set, which might be less than 939 * setsize; the caller should loop until the whole set has been done. 940 * The caller should ensure that the guest registers are correct 941 * for the possibility that the first byte of the set encounters 942 * an exception or watchpoint. We guarantee not to take any faults 943 * for bytes other than the first. 944 */ 945 static uint64_t set_step(CPUARMState *env, uint64_t toaddr, 946 uint64_t setsize, uint32_t data, int memidx, 947 uint32_t *mtedesc, uintptr_t ra) 948 { 949 void *mem; 950 951 setsize = MIN(setsize, page_limit(toaddr)); 952 if (*mtedesc) { 953 uint64_t mtesize = mte_mops_probe(env, toaddr, setsize, *mtedesc); 954 if (mtesize == 0) { 955 /* Trap, or not. All CPU state is up to date */ 956 mte_check_fail(env, *mtedesc, toaddr, ra); 957 /* Continue, with no further MTE checks required */ 958 *mtedesc = 0; 959 } else { 960 /* Advance to the end, or to the tag mismatch */ 961 setsize = MIN(setsize, mtesize); 962 } 963 } 964 965 toaddr = useronly_clean_ptr(toaddr); 966 /* 967 * Trapless lookup: returns NULL for invalid page, I/O, 968 * watchpoints, clean pages, etc. 969 */ 970 mem = tlb_vaddr_to_host(env, toaddr, MMU_DATA_STORE, memidx); 971 972 #ifndef CONFIG_USER_ONLY 973 if (unlikely(!mem)) { 974 /* 975 * Slow-path: just do one byte write. This will handle the 976 * watchpoint, invalid page, etc handling correctly. 977 * For clean code pages, the next iteration will see 978 * the page dirty and will use the fast path. 979 */ 980 cpu_stb_mmuidx_ra(env, toaddr, data, memidx, ra); 981 return 1; 982 } 983 #endif 984 /* Easy case: just memset the host memory */ 985 set_helper_retaddr(ra); 986 memset(mem, data, setsize); 987 clear_helper_retaddr(); 988 return setsize; 989 } 990 991 /* 992 * Similar, but setting tags. The architecture requires us to do this 993 * in 16-byte chunks. SETP accesses are not tag checked; they set 994 * the tags. 995 */ 996 static uint64_t set_step_tags(CPUARMState *env, uint64_t toaddr, 997 uint64_t setsize, uint32_t data, int memidx, 998 uint32_t *mtedesc, uintptr_t ra) 999 { 1000 void *mem; 1001 uint64_t cleanaddr; 1002 1003 setsize = MIN(setsize, page_limit(toaddr)); 1004 1005 cleanaddr = useronly_clean_ptr(toaddr); 1006 /* 1007 * Trapless lookup: returns NULL for invalid page, I/O, 1008 * watchpoints, clean pages, etc. 1009 */ 1010 mem = tlb_vaddr_to_host(env, cleanaddr, MMU_DATA_STORE, memidx); 1011 1012 #ifndef CONFIG_USER_ONLY 1013 if (unlikely(!mem)) { 1014 /* 1015 * Slow-path: just do one write. This will handle the 1016 * watchpoint, invalid page, etc handling correctly. 1017 * The architecture requires that we do 16 bytes at a time, 1018 * and we know both ptr and size are 16 byte aligned. 1019 * For clean code pages, the next iteration will see 1020 * the page dirty and will use the fast path. 1021 */ 1022 uint64_t repldata = data * 0x0101010101010101ULL; 1023 MemOpIdx oi16 = make_memop_idx(MO_TE | MO_128, memidx); 1024 cpu_st16_mmu(env, toaddr, int128_make128(repldata, repldata), oi16, ra); 1025 mte_mops_set_tags(env, toaddr, 16, *mtedesc); 1026 return 16; 1027 } 1028 #endif 1029 /* Easy case: just memset the host memory */ 1030 set_helper_retaddr(ra); 1031 memset(mem, data, setsize); 1032 clear_helper_retaddr(); 1033 mte_mops_set_tags(env, toaddr, setsize, *mtedesc); 1034 return setsize; 1035 } 1036 1037 typedef uint64_t StepFn(CPUARMState *env, uint64_t toaddr, 1038 uint64_t setsize, uint32_t data, 1039 int memidx, uint32_t *mtedesc, uintptr_t ra); 1040 1041 /* Extract register numbers from a MOPS exception syndrome value */ 1042 static int mops_destreg(uint32_t syndrome) 1043 { 1044 return extract32(syndrome, 10, 5); 1045 } 1046 1047 static int mops_srcreg(uint32_t syndrome) 1048 { 1049 return extract32(syndrome, 5, 5); 1050 } 1051 1052 static int mops_sizereg(uint32_t syndrome) 1053 { 1054 return extract32(syndrome, 0, 5); 1055 } 1056 1057 /* 1058 * Return true if TCMA and TBI bits mean we need to do MTE checks. 1059 * We only need to do this once per MOPS insn, not for every page. 1060 */ 1061 static bool mte_checks_needed(uint64_t ptr, uint32_t desc) 1062 { 1063 int bit55 = extract64(ptr, 55, 1); 1064 1065 /* 1066 * Note that tbi_check() returns true for "access checked" but 1067 * tcma_check() returns true for "access unchecked". 1068 */ 1069 if (!tbi_check(desc, bit55)) { 1070 return false; 1071 } 1072 return !tcma_check(desc, bit55, allocation_tag_from_addr(ptr)); 1073 } 1074 1075 /* Take an exception if the SETG addr/size are not granule aligned */ 1076 static void check_setg_alignment(CPUARMState *env, uint64_t ptr, uint64_t size, 1077 uint32_t memidx, uintptr_t ra) 1078 { 1079 if ((size != 0 && !QEMU_IS_ALIGNED(ptr, TAG_GRANULE)) || 1080 !QEMU_IS_ALIGNED(size, TAG_GRANULE)) { 1081 arm_cpu_do_unaligned_access(env_cpu(env), ptr, MMU_DATA_STORE, 1082 memidx, ra); 1083 1084 } 1085 } 1086 1087 static uint64_t arm_reg_or_xzr(CPUARMState *env, int reg) 1088 { 1089 /* 1090 * Runtime equivalent of cpu_reg() -- return the CPU register value, 1091 * for contexts when index 31 means XZR (not SP). 1092 */ 1093 return reg == 31 ? 0 : env->xregs[reg]; 1094 } 1095 1096 /* 1097 * For the Memory Set operation, our implementation chooses 1098 * always to use "option A", where we update Xd to the final 1099 * address in the SETP insn, and set Xn to be -(bytes remaining). 1100 * On SETM and SETE insns we only need update Xn. 1101 * 1102 * @env: CPU 1103 * @syndrome: syndrome value for mismatch exceptions 1104 * (also contains the register numbers we need to use) 1105 * @mtedesc: MTE descriptor word 1106 * @stepfn: function which does a single part of the set operation 1107 * @is_setg: true if this is the tag-setting SETG variant 1108 */ 1109 static void do_setp(CPUARMState *env, uint32_t syndrome, uint32_t mtedesc, 1110 StepFn *stepfn, bool is_setg, uintptr_t ra) 1111 { 1112 /* Prologue: we choose to do up to the next page boundary */ 1113 int rd = mops_destreg(syndrome); 1114 int rs = mops_srcreg(syndrome); 1115 int rn = mops_sizereg(syndrome); 1116 uint8_t data = arm_reg_or_xzr(env, rs); 1117 uint32_t memidx = FIELD_EX32(mtedesc, MTEDESC, MIDX); 1118 uint64_t toaddr = env->xregs[rd]; 1119 uint64_t setsize = env->xregs[rn]; 1120 uint64_t stagesetsize, step; 1121 1122 check_mops_enabled(env, ra); 1123 1124 if (setsize > INT64_MAX) { 1125 setsize = INT64_MAX; 1126 if (is_setg) { 1127 setsize &= ~0xf; 1128 } 1129 } 1130 1131 if (unlikely(is_setg)) { 1132 check_setg_alignment(env, toaddr, setsize, memidx, ra); 1133 } else if (!mte_checks_needed(toaddr, mtedesc)) { 1134 mtedesc = 0; 1135 } 1136 1137 stagesetsize = MIN(setsize, page_limit(toaddr)); 1138 while (stagesetsize) { 1139 env->xregs[rd] = toaddr; 1140 env->xregs[rn] = setsize; 1141 step = stepfn(env, toaddr, stagesetsize, data, memidx, &mtedesc, ra); 1142 toaddr += step; 1143 setsize -= step; 1144 stagesetsize -= step; 1145 } 1146 /* Insn completed, so update registers to the Option A format */ 1147 env->xregs[rd] = toaddr + setsize; 1148 env->xregs[rn] = -setsize; 1149 1150 /* Set NZCV = 0000 to indicate we are an Option A implementation */ 1151 env->NF = 0; 1152 env->ZF = 1; /* our env->ZF encoding is inverted */ 1153 env->CF = 0; 1154 env->VF = 0; 1155 } 1156 1157 void HELPER(setp)(CPUARMState *env, uint32_t syndrome, uint32_t mtedesc) 1158 { 1159 do_setp(env, syndrome, mtedesc, set_step, false, GETPC()); 1160 } 1161 1162 void HELPER(setgp)(CPUARMState *env, uint32_t syndrome, uint32_t mtedesc) 1163 { 1164 do_setp(env, syndrome, mtedesc, set_step_tags, true, GETPC()); 1165 } 1166 1167 static void do_setm(CPUARMState *env, uint32_t syndrome, uint32_t mtedesc, 1168 StepFn *stepfn, bool is_setg, uintptr_t ra) 1169 { 1170 /* Main: we choose to do all the full-page chunks */ 1171 CPUState *cs = env_cpu(env); 1172 int rd = mops_destreg(syndrome); 1173 int rs = mops_srcreg(syndrome); 1174 int rn = mops_sizereg(syndrome); 1175 uint8_t data = arm_reg_or_xzr(env, rs); 1176 uint64_t toaddr = env->xregs[rd] + env->xregs[rn]; 1177 uint64_t setsize = -env->xregs[rn]; 1178 uint32_t memidx = FIELD_EX32(mtedesc, MTEDESC, MIDX); 1179 uint64_t step, stagesetsize; 1180 1181 check_mops_enabled(env, ra); 1182 1183 /* 1184 * We're allowed to NOP out "no data to copy" before the consistency 1185 * checks; we choose to do so. 1186 */ 1187 if (env->xregs[rn] == 0) { 1188 return; 1189 } 1190 1191 check_mops_wrong_option(env, syndrome, ra); 1192 1193 /* 1194 * Our implementation will work fine even if we have an unaligned 1195 * destination address, and because we update Xn every time around 1196 * the loop below and the return value from stepfn() may be less 1197 * than requested, we might find toaddr is unaligned. So we don't 1198 * have an IMPDEF check for alignment here. 1199 */ 1200 1201 if (unlikely(is_setg)) { 1202 check_setg_alignment(env, toaddr, setsize, memidx, ra); 1203 } else if (!mte_checks_needed(toaddr, mtedesc)) { 1204 mtedesc = 0; 1205 } 1206 1207 /* Do the actual memset: we leave the last partial page to SETE */ 1208 stagesetsize = setsize & TARGET_PAGE_MASK; 1209 while (stagesetsize > 0) { 1210 step = stepfn(env, toaddr, stagesetsize, data, memidx, &mtedesc, ra); 1211 toaddr += step; 1212 setsize -= step; 1213 stagesetsize -= step; 1214 env->xregs[rn] = -setsize; 1215 if (stagesetsize > 0 && unlikely(cpu_loop_exit_requested(cs))) { 1216 cpu_loop_exit_restore(cs, ra); 1217 } 1218 } 1219 } 1220 1221 void HELPER(setm)(CPUARMState *env, uint32_t syndrome, uint32_t mtedesc) 1222 { 1223 do_setm(env, syndrome, mtedesc, set_step, false, GETPC()); 1224 } 1225 1226 void HELPER(setgm)(CPUARMState *env, uint32_t syndrome, uint32_t mtedesc) 1227 { 1228 do_setm(env, syndrome, mtedesc, set_step_tags, true, GETPC()); 1229 } 1230 1231 static void do_sete(CPUARMState *env, uint32_t syndrome, uint32_t mtedesc, 1232 StepFn *stepfn, bool is_setg, uintptr_t ra) 1233 { 1234 /* Epilogue: do the last partial page */ 1235 int rd = mops_destreg(syndrome); 1236 int rs = mops_srcreg(syndrome); 1237 int rn = mops_sizereg(syndrome); 1238 uint8_t data = arm_reg_or_xzr(env, rs); 1239 uint64_t toaddr = env->xregs[rd] + env->xregs[rn]; 1240 uint64_t setsize = -env->xregs[rn]; 1241 uint32_t memidx = FIELD_EX32(mtedesc, MTEDESC, MIDX); 1242 uint64_t step; 1243 1244 check_mops_enabled(env, ra); 1245 1246 /* 1247 * We're allowed to NOP out "no data to copy" before the consistency 1248 * checks; we choose to do so. 1249 */ 1250 if (setsize == 0) { 1251 return; 1252 } 1253 1254 check_mops_wrong_option(env, syndrome, ra); 1255 1256 /* 1257 * Our implementation has no address alignment requirements, but 1258 * we do want to enforce the "less than a page" size requirement, 1259 * so we don't need to have the "check for interrupts" here. 1260 */ 1261 if (setsize >= TARGET_PAGE_SIZE) { 1262 raise_exception_ra(env, EXCP_UDEF, syndrome, 1263 mops_mismatch_exception_target_el(env), ra); 1264 } 1265 1266 if (unlikely(is_setg)) { 1267 check_setg_alignment(env, toaddr, setsize, memidx, ra); 1268 } else if (!mte_checks_needed(toaddr, mtedesc)) { 1269 mtedesc = 0; 1270 } 1271 1272 /* Do the actual memset */ 1273 while (setsize > 0) { 1274 step = stepfn(env, toaddr, setsize, data, memidx, &mtedesc, ra); 1275 toaddr += step; 1276 setsize -= step; 1277 env->xregs[rn] = -setsize; 1278 } 1279 } 1280 1281 void HELPER(sete)(CPUARMState *env, uint32_t syndrome, uint32_t mtedesc) 1282 { 1283 do_sete(env, syndrome, mtedesc, set_step, false, GETPC()); 1284 } 1285 1286 void HELPER(setge)(CPUARMState *env, uint32_t syndrome, uint32_t mtedesc) 1287 { 1288 do_sete(env, syndrome, mtedesc, set_step_tags, true, GETPC()); 1289 } 1290 1291 /* 1292 * Perform part of a memory copy from the guest memory at fromaddr 1293 * and extending for copysize bytes, to the guest memory at 1294 * toaddr. Both addresses are dirty. 1295 * 1296 * Returns the number of bytes actually set, which might be less than 1297 * copysize; the caller should loop until the whole copy has been done. 1298 * The caller should ensure that the guest registers are correct 1299 * for the possibility that the first byte of the copy encounters 1300 * an exception or watchpoint. We guarantee not to take any faults 1301 * for bytes other than the first. 1302 */ 1303 static uint64_t copy_step(CPUARMState *env, uint64_t toaddr, uint64_t fromaddr, 1304 uint64_t copysize, int wmemidx, int rmemidx, 1305 uint32_t *wdesc, uint32_t *rdesc, uintptr_t ra) 1306 { 1307 void *rmem; 1308 void *wmem; 1309 1310 /* Don't cross a page boundary on either source or destination */ 1311 copysize = MIN(copysize, page_limit(toaddr)); 1312 copysize = MIN(copysize, page_limit(fromaddr)); 1313 /* 1314 * Handle MTE tag checks: either handle the tag mismatch for byte 0, 1315 * or else copy up to but not including the byte with the mismatch. 1316 */ 1317 if (*rdesc) { 1318 uint64_t mtesize = mte_mops_probe(env, fromaddr, copysize, *rdesc); 1319 if (mtesize == 0) { 1320 mte_check_fail(env, *rdesc, fromaddr, ra); 1321 *rdesc = 0; 1322 } else { 1323 copysize = MIN(copysize, mtesize); 1324 } 1325 } 1326 if (*wdesc) { 1327 uint64_t mtesize = mte_mops_probe(env, toaddr, copysize, *wdesc); 1328 if (mtesize == 0) { 1329 mte_check_fail(env, *wdesc, toaddr, ra); 1330 *wdesc = 0; 1331 } else { 1332 copysize = MIN(copysize, mtesize); 1333 } 1334 } 1335 1336 toaddr = useronly_clean_ptr(toaddr); 1337 fromaddr = useronly_clean_ptr(fromaddr); 1338 /* Trapless lookup of whether we can get a host memory pointer */ 1339 wmem = tlb_vaddr_to_host(env, toaddr, MMU_DATA_STORE, wmemidx); 1340 rmem = tlb_vaddr_to_host(env, fromaddr, MMU_DATA_LOAD, rmemidx); 1341 1342 #ifndef CONFIG_USER_ONLY 1343 /* 1344 * If we don't have host memory for both source and dest then just 1345 * do a single byte copy. This will handle watchpoints, invalid pages, 1346 * etc correctly. For clean code pages, the next iteration will see 1347 * the page dirty and will use the fast path. 1348 */ 1349 if (unlikely(!rmem || !wmem)) { 1350 uint8_t byte; 1351 if (rmem) { 1352 byte = *(uint8_t *)rmem; 1353 } else { 1354 byte = cpu_ldub_mmuidx_ra(env, fromaddr, rmemidx, ra); 1355 } 1356 if (wmem) { 1357 *(uint8_t *)wmem = byte; 1358 } else { 1359 cpu_stb_mmuidx_ra(env, toaddr, byte, wmemidx, ra); 1360 } 1361 return 1; 1362 } 1363 #endif 1364 /* Easy case: just memmove the host memory */ 1365 set_helper_retaddr(ra); 1366 memmove(wmem, rmem, copysize); 1367 clear_helper_retaddr(); 1368 return copysize; 1369 } 1370 1371 /* 1372 * Do part of a backwards memory copy. Here toaddr and fromaddr point 1373 * to the *last* byte to be copied. 1374 */ 1375 static uint64_t copy_step_rev(CPUARMState *env, uint64_t toaddr, 1376 uint64_t fromaddr, 1377 uint64_t copysize, int wmemidx, int rmemidx, 1378 uint32_t *wdesc, uint32_t *rdesc, uintptr_t ra) 1379 { 1380 void *rmem; 1381 void *wmem; 1382 1383 /* Don't cross a page boundary on either source or destination */ 1384 copysize = MIN(copysize, page_limit_rev(toaddr)); 1385 copysize = MIN(copysize, page_limit_rev(fromaddr)); 1386 1387 /* 1388 * Handle MTE tag checks: either handle the tag mismatch for byte 0, 1389 * or else copy up to but not including the byte with the mismatch. 1390 */ 1391 if (*rdesc) { 1392 uint64_t mtesize = mte_mops_probe_rev(env, fromaddr, copysize, *rdesc); 1393 if (mtesize == 0) { 1394 mte_check_fail(env, *rdesc, fromaddr, ra); 1395 *rdesc = 0; 1396 } else { 1397 copysize = MIN(copysize, mtesize); 1398 } 1399 } 1400 if (*wdesc) { 1401 uint64_t mtesize = mte_mops_probe_rev(env, toaddr, copysize, *wdesc); 1402 if (mtesize == 0) { 1403 mte_check_fail(env, *wdesc, toaddr, ra); 1404 *wdesc = 0; 1405 } else { 1406 copysize = MIN(copysize, mtesize); 1407 } 1408 } 1409 1410 toaddr = useronly_clean_ptr(toaddr); 1411 fromaddr = useronly_clean_ptr(fromaddr); 1412 /* Trapless lookup of whether we can get a host memory pointer */ 1413 wmem = tlb_vaddr_to_host(env, toaddr, MMU_DATA_STORE, wmemidx); 1414 rmem = tlb_vaddr_to_host(env, fromaddr, MMU_DATA_LOAD, rmemidx); 1415 1416 #ifndef CONFIG_USER_ONLY 1417 /* 1418 * If we don't have host memory for both source and dest then just 1419 * do a single byte copy. This will handle watchpoints, invalid pages, 1420 * etc correctly. For clean code pages, the next iteration will see 1421 * the page dirty and will use the fast path. 1422 */ 1423 if (unlikely(!rmem || !wmem)) { 1424 uint8_t byte; 1425 if (rmem) { 1426 byte = *(uint8_t *)rmem; 1427 } else { 1428 byte = cpu_ldub_mmuidx_ra(env, fromaddr, rmemidx, ra); 1429 } 1430 if (wmem) { 1431 *(uint8_t *)wmem = byte; 1432 } else { 1433 cpu_stb_mmuidx_ra(env, toaddr, byte, wmemidx, ra); 1434 } 1435 return 1; 1436 } 1437 #endif 1438 /* 1439 * Easy case: just memmove the host memory. Note that wmem and 1440 * rmem here point to the *last* byte to copy. 1441 */ 1442 set_helper_retaddr(ra); 1443 memmove(wmem - (copysize - 1), rmem - (copysize - 1), copysize); 1444 clear_helper_retaddr(); 1445 return copysize; 1446 } 1447 1448 /* 1449 * for the Memory Copy operation, our implementation chooses always 1450 * to use "option A", where we update Xd and Xs to the final addresses 1451 * in the CPYP insn, and then in CPYM and CPYE only need to update Xn. 1452 * 1453 * @env: CPU 1454 * @syndrome: syndrome value for mismatch exceptions 1455 * (also contains the register numbers we need to use) 1456 * @wdesc: MTE descriptor for the writes (destination) 1457 * @rdesc: MTE descriptor for the reads (source) 1458 * @move: true if this is CPY (memmove), false for CPYF (memcpy forwards) 1459 */ 1460 static void do_cpyp(CPUARMState *env, uint32_t syndrome, uint32_t wdesc, 1461 uint32_t rdesc, uint32_t move, uintptr_t ra) 1462 { 1463 int rd = mops_destreg(syndrome); 1464 int rs = mops_srcreg(syndrome); 1465 int rn = mops_sizereg(syndrome); 1466 uint32_t rmemidx = FIELD_EX32(rdesc, MTEDESC, MIDX); 1467 uint32_t wmemidx = FIELD_EX32(wdesc, MTEDESC, MIDX); 1468 bool forwards = true; 1469 uint64_t toaddr = env->xregs[rd]; 1470 uint64_t fromaddr = env->xregs[rs]; 1471 uint64_t copysize = env->xregs[rn]; 1472 uint64_t stagecopysize, step; 1473 1474 check_mops_enabled(env, ra); 1475 1476 1477 if (move) { 1478 /* 1479 * Copy backwards if necessary. The direction for a non-overlapping 1480 * copy is IMPDEF; we choose forwards. 1481 */ 1482 if (copysize > 0x007FFFFFFFFFFFFFULL) { 1483 copysize = 0x007FFFFFFFFFFFFFULL; 1484 } 1485 uint64_t fs = extract64(fromaddr, 0, 56); 1486 uint64_t ts = extract64(toaddr, 0, 56); 1487 uint64_t fe = extract64(fromaddr + copysize, 0, 56); 1488 1489 if (fs < ts && fe > ts) { 1490 forwards = false; 1491 } 1492 } else { 1493 if (copysize > INT64_MAX) { 1494 copysize = INT64_MAX; 1495 } 1496 } 1497 1498 if (!mte_checks_needed(fromaddr, rdesc)) { 1499 rdesc = 0; 1500 } 1501 if (!mte_checks_needed(toaddr, wdesc)) { 1502 wdesc = 0; 1503 } 1504 1505 if (forwards) { 1506 stagecopysize = MIN(copysize, page_limit(toaddr)); 1507 stagecopysize = MIN(stagecopysize, page_limit(fromaddr)); 1508 while (stagecopysize) { 1509 env->xregs[rd] = toaddr; 1510 env->xregs[rs] = fromaddr; 1511 env->xregs[rn] = copysize; 1512 step = copy_step(env, toaddr, fromaddr, stagecopysize, 1513 wmemidx, rmemidx, &wdesc, &rdesc, ra); 1514 toaddr += step; 1515 fromaddr += step; 1516 copysize -= step; 1517 stagecopysize -= step; 1518 } 1519 /* Insn completed, so update registers to the Option A format */ 1520 env->xregs[rd] = toaddr + copysize; 1521 env->xregs[rs] = fromaddr + copysize; 1522 env->xregs[rn] = -copysize; 1523 } else { 1524 /* 1525 * In a reverse copy the to and from addrs in Xs and Xd are the start 1526 * of the range, but it's more convenient for us to work with pointers 1527 * to the last byte being copied. 1528 */ 1529 toaddr += copysize - 1; 1530 fromaddr += copysize - 1; 1531 stagecopysize = MIN(copysize, page_limit_rev(toaddr)); 1532 stagecopysize = MIN(stagecopysize, page_limit_rev(fromaddr)); 1533 while (stagecopysize) { 1534 env->xregs[rn] = copysize; 1535 step = copy_step_rev(env, toaddr, fromaddr, stagecopysize, 1536 wmemidx, rmemidx, &wdesc, &rdesc, ra); 1537 copysize -= step; 1538 stagecopysize -= step; 1539 toaddr -= step; 1540 fromaddr -= step; 1541 } 1542 /* 1543 * Insn completed, so update registers to the Option A format. 1544 * For a reverse copy this is no different to the CPYP input format. 1545 */ 1546 env->xregs[rn] = copysize; 1547 } 1548 1549 /* Set NZCV = 0000 to indicate we are an Option A implementation */ 1550 env->NF = 0; 1551 env->ZF = 1; /* our env->ZF encoding is inverted */ 1552 env->CF = 0; 1553 env->VF = 0; 1554 } 1555 1556 void HELPER(cpyp)(CPUARMState *env, uint32_t syndrome, uint32_t wdesc, 1557 uint32_t rdesc) 1558 { 1559 do_cpyp(env, syndrome, wdesc, rdesc, true, GETPC()); 1560 } 1561 1562 void HELPER(cpyfp)(CPUARMState *env, uint32_t syndrome, uint32_t wdesc, 1563 uint32_t rdesc) 1564 { 1565 do_cpyp(env, syndrome, wdesc, rdesc, false, GETPC()); 1566 } 1567 1568 static void do_cpym(CPUARMState *env, uint32_t syndrome, uint32_t wdesc, 1569 uint32_t rdesc, uint32_t move, uintptr_t ra) 1570 { 1571 /* Main: we choose to copy until less than a page remaining */ 1572 CPUState *cs = env_cpu(env); 1573 int rd = mops_destreg(syndrome); 1574 int rs = mops_srcreg(syndrome); 1575 int rn = mops_sizereg(syndrome); 1576 uint32_t rmemidx = FIELD_EX32(rdesc, MTEDESC, MIDX); 1577 uint32_t wmemidx = FIELD_EX32(wdesc, MTEDESC, MIDX); 1578 bool forwards = true; 1579 uint64_t toaddr, fromaddr, copysize, step; 1580 1581 check_mops_enabled(env, ra); 1582 1583 /* We choose to NOP out "no data to copy" before consistency checks */ 1584 if (env->xregs[rn] == 0) { 1585 return; 1586 } 1587 1588 check_mops_wrong_option(env, syndrome, ra); 1589 1590 if (move) { 1591 forwards = (int64_t)env->xregs[rn] < 0; 1592 } 1593 1594 if (forwards) { 1595 toaddr = env->xregs[rd] + env->xregs[rn]; 1596 fromaddr = env->xregs[rs] + env->xregs[rn]; 1597 copysize = -env->xregs[rn]; 1598 } else { 1599 copysize = env->xregs[rn]; 1600 /* This toaddr and fromaddr point to the *last* byte to copy */ 1601 toaddr = env->xregs[rd] + copysize - 1; 1602 fromaddr = env->xregs[rs] + copysize - 1; 1603 } 1604 1605 if (!mte_checks_needed(fromaddr, rdesc)) { 1606 rdesc = 0; 1607 } 1608 if (!mte_checks_needed(toaddr, wdesc)) { 1609 wdesc = 0; 1610 } 1611 1612 /* Our implementation has no particular parameter requirements for CPYM */ 1613 1614 /* Do the actual memmove */ 1615 if (forwards) { 1616 while (copysize >= TARGET_PAGE_SIZE) { 1617 step = copy_step(env, toaddr, fromaddr, copysize, 1618 wmemidx, rmemidx, &wdesc, &rdesc, ra); 1619 toaddr += step; 1620 fromaddr += step; 1621 copysize -= step; 1622 env->xregs[rn] = -copysize; 1623 if (copysize >= TARGET_PAGE_SIZE && 1624 unlikely(cpu_loop_exit_requested(cs))) { 1625 cpu_loop_exit_restore(cs, ra); 1626 } 1627 } 1628 } else { 1629 while (copysize >= TARGET_PAGE_SIZE) { 1630 step = copy_step_rev(env, toaddr, fromaddr, copysize, 1631 wmemidx, rmemidx, &wdesc, &rdesc, ra); 1632 toaddr -= step; 1633 fromaddr -= step; 1634 copysize -= step; 1635 env->xregs[rn] = copysize; 1636 if (copysize >= TARGET_PAGE_SIZE && 1637 unlikely(cpu_loop_exit_requested(cs))) { 1638 cpu_loop_exit_restore(cs, ra); 1639 } 1640 } 1641 } 1642 } 1643 1644 void HELPER(cpym)(CPUARMState *env, uint32_t syndrome, uint32_t wdesc, 1645 uint32_t rdesc) 1646 { 1647 do_cpym(env, syndrome, wdesc, rdesc, true, GETPC()); 1648 } 1649 1650 void HELPER(cpyfm)(CPUARMState *env, uint32_t syndrome, uint32_t wdesc, 1651 uint32_t rdesc) 1652 { 1653 do_cpym(env, syndrome, wdesc, rdesc, false, GETPC()); 1654 } 1655 1656 static void do_cpye(CPUARMState *env, uint32_t syndrome, uint32_t wdesc, 1657 uint32_t rdesc, uint32_t move, uintptr_t ra) 1658 { 1659 /* Epilogue: do the last partial page */ 1660 int rd = mops_destreg(syndrome); 1661 int rs = mops_srcreg(syndrome); 1662 int rn = mops_sizereg(syndrome); 1663 uint32_t rmemidx = FIELD_EX32(rdesc, MTEDESC, MIDX); 1664 uint32_t wmemidx = FIELD_EX32(wdesc, MTEDESC, MIDX); 1665 bool forwards = true; 1666 uint64_t toaddr, fromaddr, copysize, step; 1667 1668 check_mops_enabled(env, ra); 1669 1670 /* We choose to NOP out "no data to copy" before consistency checks */ 1671 if (env->xregs[rn] == 0) { 1672 return; 1673 } 1674 1675 check_mops_wrong_option(env, syndrome, ra); 1676 1677 if (move) { 1678 forwards = (int64_t)env->xregs[rn] < 0; 1679 } 1680 1681 if (forwards) { 1682 toaddr = env->xregs[rd] + env->xregs[rn]; 1683 fromaddr = env->xregs[rs] + env->xregs[rn]; 1684 copysize = -env->xregs[rn]; 1685 } else { 1686 copysize = env->xregs[rn]; 1687 /* This toaddr and fromaddr point to the *last* byte to copy */ 1688 toaddr = env->xregs[rd] + copysize - 1; 1689 fromaddr = env->xregs[rs] + copysize - 1; 1690 } 1691 1692 if (!mte_checks_needed(fromaddr, rdesc)) { 1693 rdesc = 0; 1694 } 1695 if (!mte_checks_needed(toaddr, wdesc)) { 1696 wdesc = 0; 1697 } 1698 1699 /* Check the size; we don't want to have do a check-for-interrupts */ 1700 if (copysize >= TARGET_PAGE_SIZE) { 1701 raise_exception_ra(env, EXCP_UDEF, syndrome, 1702 mops_mismatch_exception_target_el(env), ra); 1703 } 1704 1705 /* Do the actual memmove */ 1706 if (forwards) { 1707 while (copysize > 0) { 1708 step = copy_step(env, toaddr, fromaddr, copysize, 1709 wmemidx, rmemidx, &wdesc, &rdesc, ra); 1710 toaddr += step; 1711 fromaddr += step; 1712 copysize -= step; 1713 env->xregs[rn] = -copysize; 1714 } 1715 } else { 1716 while (copysize > 0) { 1717 step = copy_step_rev(env, toaddr, fromaddr, copysize, 1718 wmemidx, rmemidx, &wdesc, &rdesc, ra); 1719 toaddr -= step; 1720 fromaddr -= step; 1721 copysize -= step; 1722 env->xregs[rn] = copysize; 1723 } 1724 } 1725 } 1726 1727 void HELPER(cpye)(CPUARMState *env, uint32_t syndrome, uint32_t wdesc, 1728 uint32_t rdesc) 1729 { 1730 do_cpye(env, syndrome, wdesc, rdesc, true, GETPC()); 1731 } 1732 1733 void HELPER(cpyfe)(CPUARMState *env, uint32_t syndrome, uint32_t wdesc, 1734 uint32_t rdesc) 1735 { 1736 do_cpye(env, syndrome, wdesc, rdesc, false, GETPC()); 1737 } 1738 1739 static bool is_guarded_page(CPUARMState *env, target_ulong addr, uintptr_t ra) 1740 { 1741 #ifdef CONFIG_USER_ONLY 1742 return page_get_flags(addr) & PAGE_BTI; 1743 #else 1744 CPUTLBEntryFull *full; 1745 void *host; 1746 int mmu_idx = cpu_mmu_index(env_cpu(env), true); 1747 int flags = probe_access_full(env, addr, 0, MMU_INST_FETCH, mmu_idx, 1748 false, &host, &full, ra); 1749 1750 assert(!(flags & TLB_INVALID_MASK)); 1751 return full->extra.arm.guarded; 1752 #endif 1753 } 1754 1755 void HELPER(guarded_page_check)(CPUARMState *env) 1756 { 1757 /* 1758 * We have already verified that bti is enabled, and that the 1759 * instruction at PC is not ok for BTYPE. This is always at 1760 * the beginning of a block, so PC is always up-to-date and 1761 * no unwind is required. 1762 */ 1763 if (is_guarded_page(env, env->pc, 0)) { 1764 raise_exception(env, EXCP_UDEF, syn_btitrap(env->btype), 1765 exception_target_el(env)); 1766 } 1767 } 1768 1769 void HELPER(guarded_page_br)(CPUARMState *env, target_ulong pc) 1770 { 1771 /* 1772 * We have already checked for branch via x16 and x17. 1773 * What remains for choosing BTYPE is checking for a guarded page. 1774 */ 1775 env->btype = is_guarded_page(env, pc, GETPC()) ? 3 : 1; 1776 } 1777