1 /* 2 * ARM helper routines 3 * 4 * Copyright (c) 2005-2007 CodeSourcery, LLC 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2.1 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 #include "qemu/osdep.h" 20 #include "qemu/main-loop.h" 21 #include "cpu.h" 22 #include "exec/helper-proto.h" 23 #include "internals.h" 24 #include "cpu-features.h" 25 #include "exec/exec-all.h" 26 #include "exec/cpu_ldst.h" 27 #include "cpregs.h" 28 29 #define SIGNBIT (uint32_t)0x80000000 30 #define SIGNBIT64 ((uint64_t)1 << 63) 31 32 int exception_target_el(CPUARMState *env) 33 { 34 int target_el = MAX(1, arm_current_el(env)); 35 36 /* 37 * No such thing as secure EL1 if EL3 is aarch32, 38 * so update the target EL to EL3 in this case. 39 */ 40 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) { 41 target_el = 3; 42 } 43 44 return target_el; 45 } 46 47 void raise_exception(CPUARMState *env, uint32_t excp, 48 uint32_t syndrome, uint32_t target_el) 49 { 50 CPUState *cs = env_cpu(env); 51 52 if (target_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) { 53 /* 54 * Redirect NS EL1 exceptions to NS EL2. These are reported with 55 * their original syndrome register value, with the exception of 56 * SIMD/FP access traps, which are reported as uncategorized 57 * (see DDI0478C.a D1.10.4) 58 */ 59 target_el = 2; 60 if (syn_get_ec(syndrome) == EC_ADVSIMDFPACCESSTRAP) { 61 syndrome = syn_uncategorized(); 62 } 63 } 64 65 assert(!excp_is_internal(excp)); 66 cs->exception_index = excp; 67 env->exception.syndrome = syndrome; 68 env->exception.target_el = target_el; 69 cpu_loop_exit(cs); 70 } 71 72 void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome, 73 uint32_t target_el, uintptr_t ra) 74 { 75 CPUState *cs = env_cpu(env); 76 77 /* 78 * restore_state_to_opc() will set env->exception.syndrome, so 79 * we must restore CPU state here before setting the syndrome 80 * the caller passed us, and cannot use cpu_loop_exit_restore(). 81 */ 82 cpu_restore_state(cs, ra); 83 raise_exception(env, excp, syndrome, target_el); 84 } 85 86 uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc, 87 uint64_t ireg, uint64_t def) 88 { 89 uint64_t tmp, val = 0; 90 uint32_t maxindex = ((desc & 3) + 1) * 8; 91 uint32_t base_reg = desc >> 2; 92 uint32_t shift, index, reg; 93 94 for (shift = 0; shift < 64; shift += 8) { 95 index = (ireg >> shift) & 0xff; 96 if (index < maxindex) { 97 reg = base_reg + (index >> 3); 98 tmp = *aa32_vfp_dreg(env, reg); 99 tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift; 100 } else { 101 tmp = def & (0xffull << shift); 102 } 103 val |= tmp; 104 } 105 return val; 106 } 107 108 void HELPER(v8m_stackcheck)(CPUARMState *env, uint32_t newvalue) 109 { 110 /* 111 * Perform the v8M stack limit check for SP updates from translated code, 112 * raising an exception if the limit is breached. 113 */ 114 if (newvalue < v7m_sp_limit(env)) { 115 /* 116 * Stack limit exceptions are a rare case, so rather than syncing 117 * PC/condbits before the call, we use raise_exception_ra() so 118 * that cpu_restore_state() will sort them out. 119 */ 120 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC()); 121 } 122 } 123 124 /* Sign/zero extend */ 125 uint32_t HELPER(sxtb16)(uint32_t x) 126 { 127 uint32_t res; 128 res = (uint16_t)(int8_t)x; 129 res |= (uint32_t)(int8_t)(x >> 16) << 16; 130 return res; 131 } 132 133 static void handle_possible_div0_trap(CPUARMState *env, uintptr_t ra) 134 { 135 /* 136 * Take a division-by-zero exception if necessary; otherwise return 137 * to get the usual non-trapping division behaviour (result of 0) 138 */ 139 if (arm_feature(env, ARM_FEATURE_M) 140 && (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_DIV_0_TRP_MASK)) { 141 raise_exception_ra(env, EXCP_DIVBYZERO, 0, 1, ra); 142 } 143 } 144 145 uint32_t HELPER(uxtb16)(uint32_t x) 146 { 147 uint32_t res; 148 res = (uint16_t)(uint8_t)x; 149 res |= (uint32_t)(uint8_t)(x >> 16) << 16; 150 return res; 151 } 152 153 int32_t HELPER(sdiv)(CPUARMState *env, int32_t num, int32_t den) 154 { 155 if (den == 0) { 156 handle_possible_div0_trap(env, GETPC()); 157 return 0; 158 } 159 if (num == INT_MIN && den == -1) { 160 return INT_MIN; 161 } 162 return num / den; 163 } 164 165 uint32_t HELPER(udiv)(CPUARMState *env, uint32_t num, uint32_t den) 166 { 167 if (den == 0) { 168 handle_possible_div0_trap(env, GETPC()); 169 return 0; 170 } 171 return num / den; 172 } 173 174 uint32_t HELPER(rbit)(uint32_t x) 175 { 176 return revbit32(x); 177 } 178 179 uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b) 180 { 181 uint32_t res = a + b; 182 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) 183 env->QF = 1; 184 return res; 185 } 186 187 uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b) 188 { 189 uint32_t res = a + b; 190 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) { 191 env->QF = 1; 192 res = ~(((int32_t)a >> 31) ^ SIGNBIT); 193 } 194 return res; 195 } 196 197 uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b) 198 { 199 uint32_t res = a - b; 200 if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) { 201 env->QF = 1; 202 res = ~(((int32_t)a >> 31) ^ SIGNBIT); 203 } 204 return res; 205 } 206 207 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b) 208 { 209 uint32_t res = a + b; 210 if (res < a) { 211 env->QF = 1; 212 res = ~0; 213 } 214 return res; 215 } 216 217 uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b) 218 { 219 uint32_t res = a - b; 220 if (res > a) { 221 env->QF = 1; 222 res = 0; 223 } 224 return res; 225 } 226 227 /* Signed saturation. */ 228 static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift) 229 { 230 int32_t top; 231 uint32_t mask; 232 233 top = val >> shift; 234 mask = (1u << shift) - 1; 235 if (top > 0) { 236 env->QF = 1; 237 return mask; 238 } else if (top < -1) { 239 env->QF = 1; 240 return ~mask; 241 } 242 return val; 243 } 244 245 /* Unsigned saturation. */ 246 static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift) 247 { 248 uint32_t max; 249 250 max = (1u << shift) - 1; 251 if (val < 0) { 252 env->QF = 1; 253 return 0; 254 } else if (val > max) { 255 env->QF = 1; 256 return max; 257 } 258 return val; 259 } 260 261 /* Signed saturate. */ 262 uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift) 263 { 264 return do_ssat(env, x, shift); 265 } 266 267 /* Dual halfword signed saturate. */ 268 uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift) 269 { 270 uint32_t res; 271 272 res = (uint16_t)do_ssat(env, (int16_t)x, shift); 273 res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16; 274 return res; 275 } 276 277 /* Unsigned saturate. */ 278 uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift) 279 { 280 return do_usat(env, x, shift); 281 } 282 283 /* Dual halfword unsigned saturate. */ 284 uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift) 285 { 286 uint32_t res; 287 288 res = (uint16_t)do_usat(env, (int16_t)x, shift); 289 res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16; 290 return res; 291 } 292 293 void HELPER(setend)(CPUARMState *env) 294 { 295 env->uncached_cpsr ^= CPSR_E; 296 arm_rebuild_hflags(env); 297 } 298 299 void HELPER(check_bxj_trap)(CPUARMState *env, uint32_t rm) 300 { 301 /* 302 * Only called if in NS EL0 or EL1 for a BXJ for a v7A CPU; 303 * check if HSTR.TJDBX means we need to trap to EL2. 304 */ 305 if (env->cp15.hstr_el2 & HSTR_TJDBX) { 306 /* 307 * We know the condition code check passed, so take the IMPDEF 308 * choice to always report CV=1 COND 0xe 309 */ 310 uint32_t syn = syn_bxjtrap(1, 0xe, rm); 311 raise_exception_ra(env, EXCP_HYP_TRAP, syn, 2, GETPC()); 312 } 313 } 314 315 #ifndef CONFIG_USER_ONLY 316 /* 317 * Function checks whether WFx (WFI/WFE) instructions are set up to be trapped. 318 * The function returns the target EL (1-3) if the instruction is to be trapped; 319 * otherwise it returns 0 indicating it is not trapped. 320 * For a trap, *excp is updated with the EXCP_* trap type to use. 321 */ 322 static inline int check_wfx_trap(CPUARMState *env, bool is_wfe, uint32_t *excp) 323 { 324 int cur_el = arm_current_el(env); 325 uint64_t mask; 326 327 *excp = EXCP_UDEF; 328 329 if (arm_feature(env, ARM_FEATURE_M)) { 330 /* M profile cores can never trap WFI/WFE. */ 331 return 0; 332 } 333 334 /* If we are currently in EL0 then we need to check if SCTLR is set up for 335 * WFx instructions being trapped to EL1. These trap bits don't exist in v7. 336 */ 337 if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) { 338 mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI; 339 if (!(arm_sctlr(env, cur_el) & mask)) { 340 return exception_target_el(env); 341 } 342 } 343 344 /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it 345 * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the 346 * bits will be zero indicating no trap. 347 */ 348 if (cur_el < 2) { 349 mask = is_wfe ? HCR_TWE : HCR_TWI; 350 if (arm_hcr_el2_eff(env) & mask) { 351 return 2; 352 } 353 } 354 355 /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */ 356 if (arm_feature(env, ARM_FEATURE_V8) && !arm_is_el3_or_mon(env)) { 357 mask = (is_wfe) ? SCR_TWE : SCR_TWI; 358 if (env->cp15.scr_el3 & mask) { 359 if (!arm_el_is_aa64(env, 3)) { 360 *excp = EXCP_MON_TRAP; 361 } 362 return 3; 363 } 364 } 365 366 return 0; 367 } 368 #endif 369 370 void HELPER(wfi)(CPUARMState *env, uint32_t insn_len) 371 { 372 #ifdef CONFIG_USER_ONLY 373 /* 374 * WFI in the user-mode emulator is technically permitted but not 375 * something any real-world code would do. AArch64 Linux kernels 376 * trap it via SCTRL_EL1.nTWI and make it an (expensive) NOP; 377 * AArch32 kernels don't trap it so it will delay a bit. 378 * For QEMU, make it NOP here, because trying to raise EXCP_HLT 379 * would trigger an abort. 380 */ 381 return; 382 #else 383 CPUState *cs = env_cpu(env); 384 uint32_t excp; 385 int target_el = check_wfx_trap(env, false, &excp); 386 387 if (cpu_has_work(cs)) { 388 /* Don't bother to go into our "low power state" if 389 * we would just wake up immediately. 390 */ 391 return; 392 } 393 394 if (target_el) { 395 if (env->aarch64) { 396 env->pc -= insn_len; 397 } else { 398 env->regs[15] -= insn_len; 399 } 400 401 raise_exception(env, excp, syn_wfx(1, 0xe, 0, insn_len == 2), 402 target_el); 403 } 404 405 cs->exception_index = EXCP_HLT; 406 cs->halted = 1; 407 cpu_loop_exit(cs); 408 #endif 409 } 410 411 void HELPER(wfit)(CPUARMState *env, uint64_t timeout) 412 { 413 #ifdef CONFIG_USER_ONLY 414 /* 415 * WFI in the user-mode emulator is technically permitted but not 416 * something any real-world code would do. AArch64 Linux kernels 417 * trap it via SCTRL_EL1.nTWI and make it an (expensive) NOP; 418 * AArch32 kernels don't trap it so it will delay a bit. 419 * For QEMU, make it NOP here, because trying to raise EXCP_HLT 420 * would trigger an abort. 421 */ 422 return; 423 #else 424 ARMCPU *cpu = env_archcpu(env); 425 CPUState *cs = env_cpu(env); 426 uint32_t excp; 427 int target_el = check_wfx_trap(env, false, &excp); 428 /* The WFIT should time out when CNTVCT_EL0 >= the specified value. */ 429 uint64_t cntval = gt_get_countervalue(env); 430 /* 431 * We want the value that we would get if we read CNTVCT_EL0 from 432 * the current exception level, so the direct_access offset, not 433 * the indirect_access one. Compare the pseudocode LocalTimeoutEvent(), 434 * which calls VirtualCounterTimer(). 435 */ 436 uint64_t offset = gt_direct_access_timer_offset(env, GTIMER_VIRT); 437 uint64_t cntvct = cntval - offset; 438 uint64_t nexttick; 439 440 if (cpu_has_work(cs) || cntvct >= timeout) { 441 /* 442 * Don't bother to go into our "low power state" if 443 * we would just wake up immediately. 444 */ 445 return; 446 } 447 448 if (target_el) { 449 env->pc -= 4; 450 raise_exception(env, excp, syn_wfx(1, 0xe, 0, false), target_el); 451 } 452 453 if (uadd64_overflow(timeout, offset, &nexttick)) { 454 nexttick = UINT64_MAX; 455 } 456 if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) { 457 /* 458 * If the timeout is too long for the signed 64-bit range 459 * of a QEMUTimer, let it expire early. 460 */ 461 timer_mod_ns(cpu->wfxt_timer, INT64_MAX); 462 } else { 463 timer_mod(cpu->wfxt_timer, nexttick); 464 } 465 cs->exception_index = EXCP_HLT; 466 cs->halted = 1; 467 cpu_loop_exit(cs); 468 #endif 469 } 470 471 void HELPER(wfe)(CPUARMState *env) 472 { 473 /* This is a hint instruction that is semantically different 474 * from YIELD even though we currently implement it identically. 475 * Don't actually halt the CPU, just yield back to top 476 * level loop. This is not going into a "low power state" 477 * (ie halting until some event occurs), so we never take 478 * a configurable trap to a different exception level. 479 */ 480 HELPER(yield)(env); 481 } 482 483 void HELPER(yield)(CPUARMState *env) 484 { 485 CPUState *cs = env_cpu(env); 486 487 /* This is a non-trappable hint instruction that generally indicates 488 * that the guest is currently busy-looping. Yield control back to the 489 * top level loop so that a more deserving VCPU has a chance to run. 490 */ 491 cs->exception_index = EXCP_YIELD; 492 cpu_loop_exit(cs); 493 } 494 495 /* Raise an internal-to-QEMU exception. This is limited to only 496 * those EXCP values which are special cases for QEMU to interrupt 497 * execution and not to be used for exceptions which are passed to 498 * the guest (those must all have syndrome information and thus should 499 * use exception_with_syndrome*). 500 */ 501 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp) 502 { 503 CPUState *cs = env_cpu(env); 504 505 assert(excp_is_internal(excp)); 506 cs->exception_index = excp; 507 cpu_loop_exit(cs); 508 } 509 510 /* Raise an exception with the specified syndrome register value */ 511 void HELPER(exception_with_syndrome_el)(CPUARMState *env, uint32_t excp, 512 uint32_t syndrome, uint32_t target_el) 513 { 514 raise_exception(env, excp, syndrome, target_el); 515 } 516 517 /* 518 * Raise an exception with the specified syndrome register value 519 * to the default target el. 520 */ 521 void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp, 522 uint32_t syndrome) 523 { 524 raise_exception(env, excp, syndrome, exception_target_el(env)); 525 } 526 527 uint32_t HELPER(cpsr_read)(CPUARMState *env) 528 { 529 return cpsr_read(env) & ~CPSR_EXEC; 530 } 531 532 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask) 533 { 534 cpsr_write(env, val, mask, CPSRWriteByInstr); 535 /* TODO: Not all cpsr bits are relevant to hflags. */ 536 arm_rebuild_hflags(env); 537 } 538 539 /* Write the CPSR for a 32-bit exception return */ 540 void HELPER(cpsr_write_eret)(CPUARMState *env, uint32_t val) 541 { 542 uint32_t mask; 543 544 bql_lock(); 545 arm_call_pre_el_change_hook(env_archcpu(env)); 546 bql_unlock(); 547 548 mask = aarch32_cpsr_valid_mask(env->features, &env_archcpu(env)->isar); 549 cpsr_write(env, val, mask, CPSRWriteExceptionReturn); 550 551 /* Generated code has already stored the new PC value, but 552 * without masking out its low bits, because which bits need 553 * masking depends on whether we're returning to Thumb or ARM 554 * state. Do the masking now. 555 */ 556 env->regs[15] &= (env->thumb ? ~1 : ~3); 557 arm_rebuild_hflags(env); 558 559 bql_lock(); 560 arm_call_el_change_hook(env_archcpu(env)); 561 bql_unlock(); 562 } 563 564 /* Access to user mode registers from privileged modes. */ 565 uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno) 566 { 567 uint32_t val; 568 569 if (regno == 13) { 570 val = env->banked_r13[BANK_USRSYS]; 571 } else if (regno == 14) { 572 val = env->banked_r14[BANK_USRSYS]; 573 } else if (regno >= 8 574 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) { 575 val = env->usr_regs[regno - 8]; 576 } else { 577 val = env->regs[regno]; 578 } 579 return val; 580 } 581 582 void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val) 583 { 584 if (regno == 13) { 585 env->banked_r13[BANK_USRSYS] = val; 586 } else if (regno == 14) { 587 env->banked_r14[BANK_USRSYS] = val; 588 } else if (regno >= 8 589 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) { 590 env->usr_regs[regno - 8] = val; 591 } else { 592 env->regs[regno] = val; 593 } 594 } 595 596 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val) 597 { 598 if ((env->uncached_cpsr & CPSR_M) == mode) { 599 env->regs[13] = val; 600 } else { 601 env->banked_r13[bank_number(mode)] = val; 602 } 603 } 604 605 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode) 606 { 607 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_SYS) { 608 /* SRS instruction is UNPREDICTABLE from System mode; we UNDEF. 609 * Other UNPREDICTABLE and UNDEF cases were caught at translate time. 610 */ 611 raise_exception(env, EXCP_UDEF, syn_uncategorized(), 612 exception_target_el(env)); 613 } 614 615 if ((env->uncached_cpsr & CPSR_M) == mode) { 616 return env->regs[13]; 617 } else { 618 return env->banked_r13[bank_number(mode)]; 619 } 620 } 621 622 static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode, 623 uint32_t regno) 624 { 625 /* Raise an exception if the requested access is one of the UNPREDICTABLE 626 * cases; otherwise return. This broadly corresponds to the pseudocode 627 * BankedRegisterAccessValid() and SPSRAccessValid(), 628 * except that we have already handled some cases at translate time. 629 */ 630 int curmode = env->uncached_cpsr & CPSR_M; 631 632 if (tgtmode == ARM_CPU_MODE_HYP) { 633 /* 634 * Handle Hyp target regs first because some are special cases 635 * which don't want the usual "not accessible from tgtmode" check. 636 */ 637 switch (regno) { 638 case 16 ... 17: /* ELR_Hyp, SPSR_Hyp */ 639 if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) { 640 goto undef; 641 } 642 break; 643 case 13: 644 if (curmode != ARM_CPU_MODE_MON) { 645 goto undef; 646 } 647 break; 648 default: 649 g_assert_not_reached(); 650 } 651 return; 652 } 653 654 if (curmode == tgtmode) { 655 goto undef; 656 } 657 658 if (tgtmode == ARM_CPU_MODE_USR) { 659 switch (regno) { 660 case 8 ... 12: 661 if (curmode != ARM_CPU_MODE_FIQ) { 662 goto undef; 663 } 664 break; 665 case 13: 666 if (curmode == ARM_CPU_MODE_SYS) { 667 goto undef; 668 } 669 break; 670 case 14: 671 if (curmode == ARM_CPU_MODE_HYP || curmode == ARM_CPU_MODE_SYS) { 672 goto undef; 673 } 674 break; 675 default: 676 break; 677 } 678 } 679 680 return; 681 682 undef: 683 raise_exception(env, EXCP_UDEF, syn_uncategorized(), 684 exception_target_el(env)); 685 } 686 687 void HELPER(msr_banked)(CPUARMState *env, uint32_t value, uint32_t tgtmode, 688 uint32_t regno) 689 { 690 msr_mrs_banked_exc_checks(env, tgtmode, regno); 691 692 switch (regno) { 693 case 16: /* SPSRs */ 694 if (tgtmode == (env->uncached_cpsr & CPSR_M)) { 695 /* Only happens for SPSR_Hyp access in Hyp mode */ 696 env->spsr = value; 697 } else { 698 env->banked_spsr[bank_number(tgtmode)] = value; 699 } 700 break; 701 case 17: /* ELR_Hyp */ 702 env->elr_el[2] = value; 703 break; 704 case 13: 705 env->banked_r13[bank_number(tgtmode)] = value; 706 break; 707 case 14: 708 env->banked_r14[r14_bank_number(tgtmode)] = value; 709 break; 710 case 8 ... 12: 711 switch (tgtmode) { 712 case ARM_CPU_MODE_USR: 713 env->usr_regs[regno - 8] = value; 714 break; 715 case ARM_CPU_MODE_FIQ: 716 env->fiq_regs[regno - 8] = value; 717 break; 718 default: 719 g_assert_not_reached(); 720 } 721 break; 722 default: 723 g_assert_not_reached(); 724 } 725 } 726 727 uint32_t HELPER(mrs_banked)(CPUARMState *env, uint32_t tgtmode, uint32_t regno) 728 { 729 msr_mrs_banked_exc_checks(env, tgtmode, regno); 730 731 switch (regno) { 732 case 16: /* SPSRs */ 733 if (tgtmode == (env->uncached_cpsr & CPSR_M)) { 734 /* Only happens for SPSR_Hyp access in Hyp mode */ 735 return env->spsr; 736 } else { 737 return env->banked_spsr[bank_number(tgtmode)]; 738 } 739 case 17: /* ELR_Hyp */ 740 return env->elr_el[2]; 741 case 13: 742 return env->banked_r13[bank_number(tgtmode)]; 743 case 14: 744 return env->banked_r14[r14_bank_number(tgtmode)]; 745 case 8 ... 12: 746 switch (tgtmode) { 747 case ARM_CPU_MODE_USR: 748 return env->usr_regs[regno - 8]; 749 case ARM_CPU_MODE_FIQ: 750 return env->fiq_regs[regno - 8]; 751 default: 752 g_assert_not_reached(); 753 } 754 default: 755 g_assert_not_reached(); 756 } 757 } 758 759 const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key, 760 uint32_t syndrome, uint32_t isread) 761 { 762 ARMCPU *cpu = env_archcpu(env); 763 const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, key); 764 CPAccessResult res = CP_ACCESS_OK; 765 int target_el; 766 uint32_t excp; 767 768 assert(ri != NULL); 769 770 if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14 771 && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) { 772 res = CP_ACCESS_UNDEFINED; 773 goto fail; 774 } 775 776 if (ri->accessfn) { 777 res = ri->accessfn(env, ri, isread); 778 } 779 780 /* 781 * If the access function indicates a trap from EL0 to EL1 then 782 * that always takes priority over the HSTR_EL2 trap. (If it indicates 783 * a trap to EL3, then the HSTR_EL2 trap takes priority; if it indicates 784 * a trap to EL2, then the syndrome is the same either way so we don't 785 * care whether technically the architecture says that HSTR_EL2 trap or 786 * the other trap takes priority. So we take the "check HSTR_EL2" path 787 * for all of those cases.) 788 */ 789 if (res != CP_ACCESS_OK && ((res & CP_ACCESS_EL_MASK) < 2) && 790 arm_current_el(env) == 0) { 791 goto fail; 792 } 793 794 /* 795 * HSTR_EL2 traps from EL1 are checked earlier, in generated code; 796 * we only need to check here for traps from EL0. 797 */ 798 if (!is_a64(env) && arm_current_el(env) == 0 && ri->cp == 15 && 799 arm_is_el2_enabled(env) && 800 (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 801 uint32_t mask = 1 << ri->crn; 802 803 if (ri->type & ARM_CP_64BIT) { 804 mask = 1 << ri->crm; 805 } 806 807 /* T4 and T14 are RES0 */ 808 mask &= ~((1 << 4) | (1 << 14)); 809 810 if (env->cp15.hstr_el2 & mask) { 811 res = CP_ACCESS_TRAP_EL2; 812 goto fail; 813 } 814 } 815 816 /* 817 * Fine-grained traps also are lower priority than undef-to-EL1, 818 * higher priority than trap-to-EL3, and we don't care about priority 819 * order with other EL2 traps because the syndrome value is the same. 820 */ 821 if (arm_fgt_active(env, arm_current_el(env))) { 822 uint64_t trapword = 0; 823 unsigned int idx = FIELD_EX32(ri->fgt, FGT, IDX); 824 unsigned int bitpos = FIELD_EX32(ri->fgt, FGT, BITPOS); 825 bool rev = FIELD_EX32(ri->fgt, FGT, REV); 826 bool nxs = FIELD_EX32(ri->fgt, FGT, NXS); 827 bool trapbit; 828 829 if (ri->fgt & FGT_EXEC) { 830 assert(idx < ARRAY_SIZE(env->cp15.fgt_exec)); 831 trapword = env->cp15.fgt_exec[idx]; 832 } else if (isread && (ri->fgt & FGT_R)) { 833 assert(idx < ARRAY_SIZE(env->cp15.fgt_read)); 834 trapword = env->cp15.fgt_read[idx]; 835 } else if (!isread && (ri->fgt & FGT_W)) { 836 assert(idx < ARRAY_SIZE(env->cp15.fgt_write)); 837 trapword = env->cp15.fgt_write[idx]; 838 } 839 840 if (nxs && (arm_hcrx_el2_eff(env) & HCRX_FGTNXS)) { 841 /* 842 * If HCRX_EL2.FGTnXS is 1 then the fine-grained trap for 843 * TLBI maintenance insns does *not* apply to the nXS variant. 844 */ 845 trapbit = 0; 846 } else { 847 trapbit = extract64(trapword, bitpos, 1); 848 } 849 if (trapbit != rev) { 850 res = CP_ACCESS_TRAP_EL2; 851 goto fail; 852 } 853 } 854 855 if (likely(res == CP_ACCESS_OK)) { 856 return ri; 857 } 858 859 fail: 860 excp = EXCP_UDEF; 861 switch (res) { 862 /* CP_ACCESS_TRAP* traps are always direct to a specified EL */ 863 case CP_ACCESS_TRAP_EL3: 864 /* 865 * If EL3 is AArch32 then there's no syndrome register; the cases 866 * where we would raise a SystemAccessTrap to AArch64 EL3 all become 867 * raising a Monitor trap exception. (Because there's no visible 868 * syndrome it doesn't matter what we pass to raise_exception().) 869 */ 870 if (!arm_el_is_aa64(env, 3)) { 871 excp = EXCP_MON_TRAP; 872 } 873 break; 874 case CP_ACCESS_TRAP_EL2: 875 case CP_ACCESS_TRAP_EL1: 876 break; 877 case CP_ACCESS_UNDEFINED: 878 /* CP_ACCESS_UNDEFINED is never direct to a specified EL */ 879 if (cpu_isar_feature(aa64_ids, cpu) && isread && 880 arm_cpreg_in_idspace(ri)) { 881 /* 882 * FEAT_IDST says this should be reported as EC_SYSTEMREGISTERTRAP, 883 * not EC_UNCATEGORIZED 884 */ 885 break; 886 } 887 syndrome = syn_uncategorized(); 888 break; 889 default: 890 g_assert_not_reached(); 891 } 892 893 target_el = res & CP_ACCESS_EL_MASK; 894 switch (target_el) { 895 case 0: 896 target_el = exception_target_el(env); 897 break; 898 case 1: 899 assert(arm_current_el(env) < 2); 900 break; 901 case 2: 902 assert(arm_current_el(env) != 3); 903 assert(arm_is_el2_enabled(env)); 904 break; 905 case 3: 906 assert(arm_feature(env, ARM_FEATURE_EL3)); 907 break; 908 default: 909 g_assert_not_reached(); 910 } 911 912 raise_exception(env, excp, syndrome, target_el); 913 } 914 915 const void *HELPER(lookup_cp_reg)(CPUARMState *env, uint32_t key) 916 { 917 ARMCPU *cpu = env_archcpu(env); 918 const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, key); 919 920 assert(ri != NULL); 921 return ri; 922 } 923 924 /* 925 * Test for HCR_EL2.TIDCP at EL1. 926 * Since implementation defined registers are rare, and within QEMU 927 * most of them are no-op, do not waste HFLAGS space for this and 928 * always use a helper. 929 */ 930 void HELPER(tidcp_el1)(CPUARMState *env, uint32_t syndrome) 931 { 932 if (arm_hcr_el2_eff(env) & HCR_TIDCP) { 933 raise_exception_ra(env, EXCP_UDEF, syndrome, 2, GETPC()); 934 } 935 } 936 937 /* 938 * Similarly, for FEAT_TIDCP1 at EL0. 939 * We have already checked for the presence of the feature. 940 */ 941 void HELPER(tidcp_el0)(CPUARMState *env, uint32_t syndrome) 942 { 943 /* See arm_sctlr(), but we also need the sctlr el. */ 944 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0); 945 int target_el; 946 947 switch (mmu_idx) { 948 case ARMMMUIdx_E20_0: 949 target_el = 2; 950 break; 951 case ARMMMUIdx_E30_0: 952 target_el = 3; 953 break; 954 default: 955 target_el = 1; 956 break; 957 } 958 959 /* 960 * The bit is not valid unless the target el is aa64, but since the 961 * bit test is simpler perform that first and check validity after. 962 */ 963 if ((env->cp15.sctlr_el[target_el] & SCTLR_TIDCP) 964 && arm_el_is_aa64(env, target_el)) { 965 raise_exception_ra(env, EXCP_UDEF, syndrome, target_el, GETPC()); 966 } 967 } 968 969 void HELPER(set_cp_reg)(CPUARMState *env, const void *rip, uint32_t value) 970 { 971 const ARMCPRegInfo *ri = rip; 972 973 if (ri->type & ARM_CP_IO) { 974 bql_lock(); 975 ri->writefn(env, ri, value); 976 bql_unlock(); 977 } else { 978 ri->writefn(env, ri, value); 979 } 980 } 981 982 uint32_t HELPER(get_cp_reg)(CPUARMState *env, const void *rip) 983 { 984 const ARMCPRegInfo *ri = rip; 985 uint32_t res; 986 987 if (ri->type & ARM_CP_IO) { 988 bql_lock(); 989 res = ri->readfn(env, ri); 990 bql_unlock(); 991 } else { 992 res = ri->readfn(env, ri); 993 } 994 995 return res; 996 } 997 998 void HELPER(set_cp_reg64)(CPUARMState *env, const void *rip, uint64_t value) 999 { 1000 const ARMCPRegInfo *ri = rip; 1001 1002 if (ri->type & ARM_CP_IO) { 1003 bql_lock(); 1004 ri->writefn(env, ri, value); 1005 bql_unlock(); 1006 } else { 1007 ri->writefn(env, ri, value); 1008 } 1009 } 1010 1011 uint64_t HELPER(get_cp_reg64)(CPUARMState *env, const void *rip) 1012 { 1013 const ARMCPRegInfo *ri = rip; 1014 uint64_t res; 1015 1016 if (ri->type & ARM_CP_IO) { 1017 bql_lock(); 1018 res = ri->readfn(env, ri); 1019 bql_unlock(); 1020 } else { 1021 res = ri->readfn(env, ri); 1022 } 1023 1024 return res; 1025 } 1026 1027 void HELPER(pre_hvc)(CPUARMState *env) 1028 { 1029 ARMCPU *cpu = env_archcpu(env); 1030 int cur_el = arm_current_el(env); 1031 /* FIXME: Use actual secure state. */ 1032 bool secure = false; 1033 bool undef; 1034 1035 if (arm_is_psci_call(cpu, EXCP_HVC)) { 1036 /* If PSCI is enabled and this looks like a valid PSCI call then 1037 * that overrides the architecturally mandated HVC behaviour. 1038 */ 1039 return; 1040 } 1041 1042 if (!arm_feature(env, ARM_FEATURE_EL2)) { 1043 /* If EL2 doesn't exist, HVC always UNDEFs */ 1044 undef = true; 1045 } else if (arm_feature(env, ARM_FEATURE_EL3)) { 1046 /* EL3.HCE has priority over EL2.HCD. */ 1047 undef = !(env->cp15.scr_el3 & SCR_HCE); 1048 } else { 1049 undef = env->cp15.hcr_el2 & HCR_HCD; 1050 } 1051 1052 /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state. 1053 * For ARMv8/AArch64, HVC is allowed in EL3. 1054 * Note that we've already trapped HVC from EL0 at translation 1055 * time. 1056 */ 1057 if (secure && (!is_a64(env) || cur_el == 1)) { 1058 undef = true; 1059 } 1060 1061 if (undef) { 1062 raise_exception(env, EXCP_UDEF, syn_uncategorized(), 1063 exception_target_el(env)); 1064 } 1065 } 1066 1067 void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome) 1068 { 1069 ARMCPU *cpu = env_archcpu(env); 1070 int cur_el = arm_current_el(env); 1071 bool secure = arm_is_secure(env); 1072 bool smd_flag = env->cp15.scr_el3 & SCR_SMD; 1073 1074 /* 1075 * SMC behaviour is summarized in the following table. 1076 * This helper handles the "Trap to EL2" and "Undef insn" cases. 1077 * The "Trap to EL3" and "PSCI call" cases are handled in the exception 1078 * helper. 1079 * 1080 * -> ARM_FEATURE_EL3 and !SMD 1081 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1 1082 * 1083 * Conduit SMC, valid call Trap to EL2 PSCI Call 1084 * Conduit SMC, inval call Trap to EL2 Trap to EL3 1085 * Conduit not SMC Trap to EL2 Trap to EL3 1086 * 1087 * 1088 * -> ARM_FEATURE_EL3 and SMD 1089 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1 1090 * 1091 * Conduit SMC, valid call Trap to EL2 PSCI Call 1092 * Conduit SMC, inval call Trap to EL2 Undef insn 1093 * Conduit not SMC Trap to EL2 Undef insn 1094 * 1095 * 1096 * -> !ARM_FEATURE_EL3 1097 * HCR_TSC && NS EL1 !HCR_TSC || !NS EL1 1098 * 1099 * Conduit SMC, valid call Trap to EL2 PSCI Call 1100 * Conduit SMC, inval call Trap to EL2 Undef insn 1101 * Conduit not SMC Undef or trap[1] Undef insn 1102 * 1103 * [1] In this case: 1104 * - if HCR_EL2.NV == 1 we must trap to EL2 1105 * - if HCR_EL2.NV == 0 then newer architecture revisions permit 1106 * AArch64 (but not AArch32) to trap to EL2 as an IMPDEF choice 1107 * - otherwise we must UNDEF 1108 * We take the IMPDEF choice to always UNDEF if HCR_EL2.NV == 0. 1109 */ 1110 1111 /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state. 1112 * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization 1113 * extensions, SMD only applies to NS state. 1114 * On ARMv7 without the Virtualization extensions, the SMD bit 1115 * doesn't exist, but we forbid the guest to set it to 1 in scr_write(), 1116 * so we need not special case this here. 1117 */ 1118 bool smd = arm_feature(env, ARM_FEATURE_AARCH64) ? smd_flag 1119 : smd_flag && !secure; 1120 1121 if (!arm_feature(env, ARM_FEATURE_EL3) && 1122 !(arm_hcr_el2_eff(env) & HCR_NV) && 1123 cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { 1124 /* 1125 * If we have no EL3 then traditionally SMC always UNDEFs and can't be 1126 * trapped to EL2. For nested virtualization, SMC can be trapped to 1127 * the outer hypervisor. PSCI-via-SMC is a sort of ersatz EL3 1128 * firmware within QEMU, and we want an EL2 guest to be able 1129 * to forbid its EL1 from making PSCI calls into QEMU's 1130 * "firmware" via HCR.TSC, so for these purposes treat 1131 * PSCI-via-SMC as implying an EL3. 1132 * This handles the very last line of the previous table. 1133 */ 1134 raise_exception(env, EXCP_UDEF, syn_uncategorized(), 1135 exception_target_el(env)); 1136 } 1137 1138 if (cur_el == 1 && (arm_hcr_el2_eff(env) & HCR_TSC)) { 1139 /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. 1140 * We also want an EL2 guest to be able to forbid its EL1 from 1141 * making PSCI calls into QEMU's "firmware" via HCR.TSC. 1142 * This handles all the "Trap to EL2" cases of the previous table. 1143 */ 1144 raise_exception(env, EXCP_HYP_TRAP, syndrome, 2); 1145 } 1146 1147 /* Catch the two remaining "Undef insn" cases of the previous table: 1148 * - PSCI conduit is SMC but we don't have a valid PCSI call, 1149 * - We don't have EL3 or SMD is set. 1150 */ 1151 if (!arm_is_psci_call(cpu, EXCP_SMC) && 1152 (smd || !arm_feature(env, ARM_FEATURE_EL3))) { 1153 raise_exception(env, EXCP_UDEF, syn_uncategorized(), 1154 exception_target_el(env)); 1155 } 1156 } 1157 1158 /* ??? Flag setting arithmetic is awkward because we need to do comparisons. 1159 The only way to do that in TCG is a conditional branch, which clobbers 1160 all our temporaries. For now implement these as helper functions. */ 1161 1162 /* Similarly for variable shift instructions. */ 1163 1164 uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i) 1165 { 1166 int shift = i & 0xff; 1167 if (shift >= 32) { 1168 if (shift == 32) 1169 env->CF = x & 1; 1170 else 1171 env->CF = 0; 1172 return 0; 1173 } else if (shift != 0) { 1174 env->CF = (x >> (32 - shift)) & 1; 1175 return x << shift; 1176 } 1177 return x; 1178 } 1179 1180 uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i) 1181 { 1182 int shift = i & 0xff; 1183 if (shift >= 32) { 1184 if (shift == 32) 1185 env->CF = (x >> 31) & 1; 1186 else 1187 env->CF = 0; 1188 return 0; 1189 } else if (shift != 0) { 1190 env->CF = (x >> (shift - 1)) & 1; 1191 return x >> shift; 1192 } 1193 return x; 1194 } 1195 1196 uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i) 1197 { 1198 int shift = i & 0xff; 1199 if (shift >= 32) { 1200 env->CF = (x >> 31) & 1; 1201 return (int32_t)x >> 31; 1202 } else if (shift != 0) { 1203 env->CF = (x >> (shift - 1)) & 1; 1204 return (int32_t)x >> shift; 1205 } 1206 return x; 1207 } 1208 1209 uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i) 1210 { 1211 int shift1, shift; 1212 shift1 = i & 0xff; 1213 shift = shift1 & 0x1f; 1214 if (shift == 0) { 1215 if (shift1 != 0) 1216 env->CF = (x >> 31) & 1; 1217 return x; 1218 } else { 1219 env->CF = (x >> (shift - 1)) & 1; 1220 return ((uint32_t)x >> shift) | (x << (32 - shift)); 1221 } 1222 } 1223 1224 void HELPER(probe_access)(CPUARMState *env, target_ulong ptr, 1225 uint32_t access_type, uint32_t mmu_idx, 1226 uint32_t size) 1227 { 1228 uint32_t in_page = -((uint32_t)ptr | TARGET_PAGE_SIZE); 1229 uintptr_t ra = GETPC(); 1230 1231 if (likely(size <= in_page)) { 1232 probe_access(env, ptr, size, access_type, mmu_idx, ra); 1233 } else { 1234 probe_access(env, ptr, in_page, access_type, mmu_idx, ra); 1235 probe_access(env, ptr + in_page, size - in_page, 1236 access_type, mmu_idx, ra); 1237 } 1238 } 1239 1240 /* 1241 * This function corresponds to AArch64.vESBOperation(). 1242 * Note that the AArch32 version is not functionally different. 1243 */ 1244 void HELPER(vesb)(CPUARMState *env) 1245 { 1246 /* 1247 * The EL2Enabled() check is done inside arm_hcr_el2_eff, 1248 * and will return HCR_EL2.VSE == 0, so nothing happens. 1249 */ 1250 uint64_t hcr = arm_hcr_el2_eff(env); 1251 bool enabled = !(hcr & HCR_TGE) && (hcr & HCR_AMO); 1252 bool pending = enabled && (hcr & HCR_VSE); 1253 bool masked = (env->daif & PSTATE_A); 1254 1255 /* If VSE pending and masked, defer the exception. */ 1256 if (pending && masked) { 1257 uint32_t syndrome; 1258 1259 if (arm_el_is_aa64(env, 1)) { 1260 /* Copy across IDS and ISS from VSESR. */ 1261 syndrome = env->cp15.vsesr_el2 & 0x1ffffff; 1262 } else { 1263 ARMMMUFaultInfo fi = { .type = ARMFault_AsyncExternal }; 1264 1265 if (extended_addresses_enabled(env)) { 1266 syndrome = arm_fi_to_lfsc(&fi); 1267 } else { 1268 syndrome = arm_fi_to_sfsc(&fi); 1269 } 1270 /* Copy across AET and ExT from VSESR. */ 1271 syndrome |= env->cp15.vsesr_el2 & 0xd000; 1272 } 1273 1274 /* Set VDISR_EL2.A along with the syndrome. */ 1275 env->cp15.vdisr_el2 = syndrome | (1u << 31); 1276 1277 /* Clear pending virtual SError */ 1278 env->cp15.hcr_el2 &= ~HCR_VSE; 1279 cpu_reset_interrupt(env_cpu(env), CPU_INTERRUPT_VSERR); 1280 } 1281 } 1282