953 lines
28 KiB
C
953 lines
28 KiB
C
/*
|
|
* ARM helper routines
|
|
*
|
|
* Copyright (c) 2005-2007 CodeSourcery, LLC
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
#include "qemu/osdep.h"
|
|
#include "qemu/log.h"
|
|
#include "qemu/main-loop.h"
|
|
#include "cpu.h"
|
|
#include "exec/helper-proto.h"
|
|
#include "internals.h"
|
|
#include "exec/exec-all.h"
|
|
#include "exec/cpu_ldst.h"
|
|
|
|
#define SIGNBIT (uint32_t)0x80000000
|
|
#define SIGNBIT64 ((uint64_t)1 << 63)
|
|
|
|
static CPUState *do_raise_exception(CPUARMState *env, uint32_t excp,
|
|
uint32_t syndrome, uint32_t target_el)
|
|
{
|
|
CPUState *cs = env_cpu(env);
|
|
|
|
if (target_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
|
|
/*
|
|
* Redirect NS EL1 exceptions to NS EL2. These are reported with
|
|
* their original syndrome register value, with the exception of
|
|
* SIMD/FP access traps, which are reported as uncategorized
|
|
* (see DDI0478C.a D1.10.4)
|
|
*/
|
|
target_el = 2;
|
|
if (syn_get_ec(syndrome) == EC_ADVSIMDFPACCESSTRAP) {
|
|
syndrome = syn_uncategorized();
|
|
}
|
|
}
|
|
|
|
assert(!excp_is_internal(excp));
|
|
cs->exception_index = excp;
|
|
env->exception.syndrome = syndrome;
|
|
env->exception.target_el = target_el;
|
|
|
|
return cs;
|
|
}
|
|
|
|
void raise_exception(CPUARMState *env, uint32_t excp,
|
|
uint32_t syndrome, uint32_t target_el)
|
|
{
|
|
CPUState *cs = do_raise_exception(env, excp, syndrome, target_el);
|
|
cpu_loop_exit(cs);
|
|
}
|
|
|
|
void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
|
|
uint32_t target_el, uintptr_t ra)
|
|
{
|
|
CPUState *cs = do_raise_exception(env, excp, syndrome, target_el);
|
|
cpu_loop_exit_restore(cs, ra);
|
|
}
|
|
|
|
uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
|
|
uint32_t maxindex)
|
|
{
|
|
uint32_t val, shift;
|
|
uint64_t *table = vn;
|
|
|
|
val = 0;
|
|
for (shift = 0; shift < 32; shift += 8) {
|
|
uint32_t index = (ireg >> shift) & 0xff;
|
|
if (index < maxindex) {
|
|
uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
|
|
val |= tmp << shift;
|
|
} else {
|
|
val |= def & (0xff << shift);
|
|
}
|
|
}
|
|
return val;
|
|
}
|
|
|
|
void HELPER(v8m_stackcheck)(CPUARMState *env, uint32_t newvalue)
|
|
{
|
|
/*
|
|
* Perform the v8M stack limit check for SP updates from translated code,
|
|
* raising an exception if the limit is breached.
|
|
*/
|
|
if (newvalue < v7m_sp_limit(env)) {
|
|
CPUState *cs = env_cpu(env);
|
|
|
|
/*
|
|
* Stack limit exceptions are a rare case, so rather than syncing
|
|
* PC/condbits before the call, we use cpu_restore_state() to
|
|
* get them right before raising the exception.
|
|
*/
|
|
cpu_restore_state(cs, GETPC(), true);
|
|
raise_exception(env, EXCP_STKOF, 0, 1);
|
|
}
|
|
}
|
|
|
|
uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
|
|
{
|
|
uint32_t res = a + b;
|
|
if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
|
|
env->QF = 1;
|
|
return res;
|
|
}
|
|
|
|
uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
|
|
{
|
|
uint32_t res = a + b;
|
|
if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
|
|
env->QF = 1;
|
|
res = ~(((int32_t)a >> 31) ^ SIGNBIT);
|
|
}
|
|
return res;
|
|
}
|
|
|
|
uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
|
|
{
|
|
uint32_t res = a - b;
|
|
if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
|
|
env->QF = 1;
|
|
res = ~(((int32_t)a >> 31) ^ SIGNBIT);
|
|
}
|
|
return res;
|
|
}
|
|
|
|
uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
|
|
{
|
|
uint32_t res = a + b;
|
|
if (res < a) {
|
|
env->QF = 1;
|
|
res = ~0;
|
|
}
|
|
return res;
|
|
}
|
|
|
|
uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
|
|
{
|
|
uint32_t res = a - b;
|
|
if (res > a) {
|
|
env->QF = 1;
|
|
res = 0;
|
|
}
|
|
return res;
|
|
}
|
|
|
|
/* Signed saturation. */
|
|
static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
|
|
{
|
|
int32_t top;
|
|
uint32_t mask;
|
|
|
|
top = val >> shift;
|
|
mask = (1u << shift) - 1;
|
|
if (top > 0) {
|
|
env->QF = 1;
|
|
return mask;
|
|
} else if (top < -1) {
|
|
env->QF = 1;
|
|
return ~mask;
|
|
}
|
|
return val;
|
|
}
|
|
|
|
/* Unsigned saturation. */
|
|
static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
|
|
{
|
|
uint32_t max;
|
|
|
|
max = (1u << shift) - 1;
|
|
if (val < 0) {
|
|
env->QF = 1;
|
|
return 0;
|
|
} else if (val > max) {
|
|
env->QF = 1;
|
|
return max;
|
|
}
|
|
return val;
|
|
}
|
|
|
|
/* Signed saturate. */
|
|
uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
|
|
{
|
|
return do_ssat(env, x, shift);
|
|
}
|
|
|
|
/* Dual halfword signed saturate. */
|
|
uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
|
|
{
|
|
uint32_t res;
|
|
|
|
res = (uint16_t)do_ssat(env, (int16_t)x, shift);
|
|
res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
|
|
return res;
|
|
}
|
|
|
|
/* Unsigned saturate. */
|
|
uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
|
|
{
|
|
return do_usat(env, x, shift);
|
|
}
|
|
|
|
/* Dual halfword unsigned saturate. */
|
|
uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
|
|
{
|
|
uint32_t res;
|
|
|
|
res = (uint16_t)do_usat(env, (int16_t)x, shift);
|
|
res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
|
|
return res;
|
|
}
|
|
|
|
void HELPER(setend)(CPUARMState *env)
|
|
{
|
|
env->uncached_cpsr ^= CPSR_E;
|
|
arm_rebuild_hflags(env);
|
|
}
|
|
|
|
/* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped.
|
|
* The function returns the target EL (1-3) if the instruction is to be trapped;
|
|
* otherwise it returns 0 indicating it is not trapped.
|
|
*/
|
|
static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
|
|
{
|
|
int cur_el = arm_current_el(env);
|
|
uint64_t mask;
|
|
|
|
if (arm_feature(env, ARM_FEATURE_M)) {
|
|
/* M profile cores can never trap WFI/WFE. */
|
|
return 0;
|
|
}
|
|
|
|
/* If we are currently in EL0 then we need to check if SCTLR is set up for
|
|
* WFx instructions being trapped to EL1. These trap bits don't exist in v7.
|
|
*/
|
|
if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) {
|
|
int target_el;
|
|
|
|
mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI;
|
|
if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) {
|
|
/* Secure EL0 and Secure PL1 is at EL3 */
|
|
target_el = 3;
|
|
} else {
|
|
target_el = 1;
|
|
}
|
|
|
|
if (!(env->cp15.sctlr_el[target_el] & mask)) {
|
|
return target_el;
|
|
}
|
|
}
|
|
|
|
/* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it
|
|
* No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the
|
|
* bits will be zero indicating no trap.
|
|
*/
|
|
if (cur_el < 2) {
|
|
mask = is_wfe ? HCR_TWE : HCR_TWI;
|
|
if (arm_hcr_el2_eff(env) & mask) {
|
|
return 2;
|
|
}
|
|
}
|
|
|
|
/* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */
|
|
if (cur_el < 3) {
|
|
mask = (is_wfe) ? SCR_TWE : SCR_TWI;
|
|
if (env->cp15.scr_el3 & mask) {
|
|
return 3;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
|
|
{
|
|
CPUState *cs = env_cpu(env);
|
|
int target_el = check_wfx_trap(env, false);
|
|
|
|
if (cpu_has_work(cs)) {
|
|
/* Don't bother to go into our "low power state" if
|
|
* we would just wake up immediately.
|
|
*/
|
|
return;
|
|
}
|
|
|
|
if (target_el) {
|
|
if (env->aarch64) {
|
|
env->pc -= insn_len;
|
|
} else {
|
|
env->regs[15] -= insn_len;
|
|
}
|
|
|
|
raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0, insn_len == 2),
|
|
target_el);
|
|
}
|
|
|
|
cs->exception_index = EXCP_HLT;
|
|
cs->halted = 1;
|
|
cpu_loop_exit(cs);
|
|
}
|
|
|
|
void HELPER(wfe)(CPUARMState *env)
|
|
{
|
|
/* This is a hint instruction that is semantically different
|
|
* from YIELD even though we currently implement it identically.
|
|
* Don't actually halt the CPU, just yield back to top
|
|
* level loop. This is not going into a "low power state"
|
|
* (ie halting until some event occurs), so we never take
|
|
* a configurable trap to a different exception level.
|
|
*/
|
|
HELPER(yield)(env);
|
|
}
|
|
|
|
void HELPER(yield)(CPUARMState *env)
|
|
{
|
|
CPUState *cs = env_cpu(env);
|
|
|
|
/* This is a non-trappable hint instruction that generally indicates
|
|
* that the guest is currently busy-looping. Yield control back to the
|
|
* top level loop so that a more deserving VCPU has a chance to run.
|
|
*/
|
|
cs->exception_index = EXCP_YIELD;
|
|
cpu_loop_exit(cs);
|
|
}
|
|
|
|
/* Raise an internal-to-QEMU exception. This is limited to only
|
|
* those EXCP values which are special cases for QEMU to interrupt
|
|
* execution and not to be used for exceptions which are passed to
|
|
* the guest (those must all have syndrome information and thus should
|
|
* use exception_with_syndrome).
|
|
*/
|
|
void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
|
|
{
|
|
CPUState *cs = env_cpu(env);
|
|
|
|
assert(excp_is_internal(excp));
|
|
cs->exception_index = excp;
|
|
cpu_loop_exit(cs);
|
|
}
|
|
|
|
/* Raise an exception with the specified syndrome register value */
|
|
void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
|
|
uint32_t syndrome, uint32_t target_el)
|
|
{
|
|
raise_exception(env, excp, syndrome, target_el);
|
|
}
|
|
|
|
/* Raise an EXCP_BKPT with the specified syndrome register value,
|
|
* targeting the correct exception level for debug exceptions.
|
|
*/
|
|
void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)
|
|
{
|
|
int debug_el = arm_debug_target_el(env);
|
|
int cur_el = arm_current_el(env);
|
|
|
|
/* FSR will only be used if the debug target EL is AArch32. */
|
|
env->exception.fsr = arm_debug_exception_fsr(env);
|
|
/* FAR is UNKNOWN: clear vaddress to avoid potentially exposing
|
|
* values to the guest that it shouldn't be able to see at its
|
|
* exception/security level.
|
|
*/
|
|
env->exception.vaddress = 0;
|
|
/*
|
|
* Other kinds of architectural debug exception are ignored if
|
|
* they target an exception level below the current one (in QEMU
|
|
* this is checked by arm_generate_debug_exceptions()). Breakpoint
|
|
* instructions are special because they always generate an exception
|
|
* to somewhere: if they can't go to the configured debug exception
|
|
* level they are taken to the current exception level.
|
|
*/
|
|
if (debug_el < cur_el) {
|
|
debug_el = cur_el;
|
|
}
|
|
raise_exception(env, EXCP_BKPT, syndrome, debug_el);
|
|
}
|
|
|
|
uint32_t HELPER(cpsr_read)(CPUARMState *env)
|
|
{
|
|
/*
|
|
* We store the ARMv8 PSTATE.SS bit in env->uncached_cpsr.
|
|
* This is convenient for populating SPSR_ELx, but must be
|
|
* hidden from aarch32 mode, where it is not visible.
|
|
*
|
|
* TODO: ARMv8.4-DIT -- need to move SS somewhere else.
|
|
*/
|
|
return cpsr_read(env) & ~(CPSR_EXEC | PSTATE_SS);
|
|
}
|
|
|
|
void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
|
|
{
|
|
cpsr_write(env, val, mask, CPSRWriteByInstr);
|
|
/* TODO: Not all cpsr bits are relevant to hflags. */
|
|
arm_rebuild_hflags(env);
|
|
}
|
|
|
|
/* Write the CPSR for a 32-bit exception return */
|
|
void HELPER(cpsr_write_eret)(CPUARMState *env, uint32_t val)
|
|
{
|
|
uint32_t mask;
|
|
|
|
qemu_mutex_lock_iothread();
|
|
arm_call_pre_el_change_hook(env_archcpu(env));
|
|
qemu_mutex_unlock_iothread();
|
|
|
|
mask = aarch32_cpsr_valid_mask(env->features, &env_archcpu(env)->isar);
|
|
cpsr_write(env, val, mask, CPSRWriteExceptionReturn);
|
|
|
|
/* Generated code has already stored the new PC value, but
|
|
* without masking out its low bits, because which bits need
|
|
* masking depends on whether we're returning to Thumb or ARM
|
|
* state. Do the masking now.
|
|
*/
|
|
env->regs[15] &= (env->thumb ? ~1 : ~3);
|
|
arm_rebuild_hflags(env);
|
|
|
|
qemu_mutex_lock_iothread();
|
|
arm_call_el_change_hook(env_archcpu(env));
|
|
qemu_mutex_unlock_iothread();
|
|
}
|
|
|
|
/* Access to user mode registers from privileged modes. */
|
|
uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
|
|
{
|
|
uint32_t val;
|
|
|
|
if (regno == 13) {
|
|
val = env->banked_r13[BANK_USRSYS];
|
|
} else if (regno == 14) {
|
|
val = env->banked_r14[BANK_USRSYS];
|
|
} else if (regno >= 8
|
|
&& (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
|
|
val = env->usr_regs[regno - 8];
|
|
} else {
|
|
val = env->regs[regno];
|
|
}
|
|
return val;
|
|
}
|
|
|
|
void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
|
|
{
|
|
if (regno == 13) {
|
|
env->banked_r13[BANK_USRSYS] = val;
|
|
} else if (regno == 14) {
|
|
env->banked_r14[BANK_USRSYS] = val;
|
|
} else if (regno >= 8
|
|
&& (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
|
|
env->usr_regs[regno - 8] = val;
|
|
} else {
|
|
env->regs[regno] = val;
|
|
}
|
|
}
|
|
|
|
void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
|
|
{
|
|
if ((env->uncached_cpsr & CPSR_M) == mode) {
|
|
env->regs[13] = val;
|
|
} else {
|
|
env->banked_r13[bank_number(mode)] = val;
|
|
}
|
|
}
|
|
|
|
uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
|
|
{
|
|
if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_SYS) {
|
|
/* SRS instruction is UNPREDICTABLE from System mode; we UNDEF.
|
|
* Other UNPREDICTABLE and UNDEF cases were caught at translate time.
|
|
*/
|
|
raise_exception(env, EXCP_UDEF, syn_uncategorized(),
|
|
exception_target_el(env));
|
|
}
|
|
|
|
if ((env->uncached_cpsr & CPSR_M) == mode) {
|
|
return env->regs[13];
|
|
} else {
|
|
return env->banked_r13[bank_number(mode)];
|
|
}
|
|
}
|
|
|
|
static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,
|
|
uint32_t regno)
|
|
{
|
|
/* Raise an exception if the requested access is one of the UNPREDICTABLE
|
|
* cases; otherwise return. This broadly corresponds to the pseudocode
|
|
* BankedRegisterAccessValid() and SPSRAccessValid(),
|
|
* except that we have already handled some cases at translate time.
|
|
*/
|
|
int curmode = env->uncached_cpsr & CPSR_M;
|
|
|
|
if (regno == 17) {
|
|
/* ELR_Hyp: a special case because access from tgtmode is OK */
|
|
if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {
|
|
goto undef;
|
|
}
|
|
return;
|
|
}
|
|
|
|
if (curmode == tgtmode) {
|
|
goto undef;
|
|
}
|
|
|
|
if (tgtmode == ARM_CPU_MODE_USR) {
|
|
switch (regno) {
|
|
case 8 ... 12:
|
|
if (curmode != ARM_CPU_MODE_FIQ) {
|
|
goto undef;
|
|
}
|
|
break;
|
|
case 13:
|
|
if (curmode == ARM_CPU_MODE_SYS) {
|
|
goto undef;
|
|
}
|
|
break;
|
|
case 14:
|
|
if (curmode == ARM_CPU_MODE_HYP || curmode == ARM_CPU_MODE_SYS) {
|
|
goto undef;
|
|
}
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (tgtmode == ARM_CPU_MODE_HYP) {
|
|
/* SPSR_Hyp, r13_hyp: accessible from Monitor mode only */
|
|
if (curmode != ARM_CPU_MODE_MON) {
|
|
goto undef;
|
|
}
|
|
}
|
|
|
|
return;
|
|
|
|
undef:
|
|
raise_exception(env, EXCP_UDEF, syn_uncategorized(),
|
|
exception_target_el(env));
|
|
}
|
|
|
|
void HELPER(msr_banked)(CPUARMState *env, uint32_t value, uint32_t tgtmode,
|
|
uint32_t regno)
|
|
{
|
|
msr_mrs_banked_exc_checks(env, tgtmode, regno);
|
|
|
|
switch (regno) {
|
|
case 16: /* SPSRs */
|
|
env->banked_spsr[bank_number(tgtmode)] = value;
|
|
break;
|
|
case 17: /* ELR_Hyp */
|
|
env->elr_el[2] = value;
|
|
break;
|
|
case 13:
|
|
env->banked_r13[bank_number(tgtmode)] = value;
|
|
break;
|
|
case 14:
|
|
env->banked_r14[r14_bank_number(tgtmode)] = value;
|
|
break;
|
|
case 8 ... 12:
|
|
switch (tgtmode) {
|
|
case ARM_CPU_MODE_USR:
|
|
env->usr_regs[regno - 8] = value;
|
|
break;
|
|
case ARM_CPU_MODE_FIQ:
|
|
env->fiq_regs[regno - 8] = value;
|
|
break;
|
|
default:
|
|
g_assert_not_reached();
|
|
}
|
|
break;
|
|
default:
|
|
g_assert_not_reached();
|
|
}
|
|
}
|
|
|
|
uint32_t HELPER(mrs_banked)(CPUARMState *env, uint32_t tgtmode, uint32_t regno)
|
|
{
|
|
msr_mrs_banked_exc_checks(env, tgtmode, regno);
|
|
|
|
switch (regno) {
|
|
case 16: /* SPSRs */
|
|
return env->banked_spsr[bank_number(tgtmode)];
|
|
case 17: /* ELR_Hyp */
|
|
return env->elr_el[2];
|
|
case 13:
|
|
return env->banked_r13[bank_number(tgtmode)];
|
|
case 14:
|
|
return env->banked_r14[r14_bank_number(tgtmode)];
|
|
case 8 ... 12:
|
|
switch (tgtmode) {
|
|
case ARM_CPU_MODE_USR:
|
|
return env->usr_regs[regno - 8];
|
|
case ARM_CPU_MODE_FIQ:
|
|
return env->fiq_regs[regno - 8];
|
|
default:
|
|
g_assert_not_reached();
|
|
}
|
|
default:
|
|
g_assert_not_reached();
|
|
}
|
|
}
|
|
|
|
void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome,
|
|
uint32_t isread)
|
|
{
|
|
const ARMCPRegInfo *ri = rip;
|
|
int target_el;
|
|
|
|
if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
|
|
&& extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
|
|
raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
|
|
}
|
|
|
|
/*
|
|
* Check for an EL2 trap due to HSTR_EL2. We expect EL0 accesses
|
|
* to sysregs non accessible at EL0 to have UNDEF-ed already.
|
|
*/
|
|
if (!is_a64(env) && arm_current_el(env) < 2 && ri->cp == 15 &&
|
|
(arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
|
|
uint32_t mask = 1 << ri->crn;
|
|
|
|
if (ri->type & ARM_CP_64BIT) {
|
|
mask = 1 << ri->crm;
|
|
}
|
|
|
|
/* T4 and T14 are RES0 */
|
|
mask &= ~((1 << 4) | (1 << 14));
|
|
|
|
if (env->cp15.hstr_el2 & mask) {
|
|
target_el = 2;
|
|
goto exept;
|
|
}
|
|
}
|
|
|
|
if (!ri->accessfn) {
|
|
return;
|
|
}
|
|
|
|
switch (ri->accessfn(env, ri, isread)) {
|
|
case CP_ACCESS_OK:
|
|
return;
|
|
case CP_ACCESS_TRAP:
|
|
target_el = exception_target_el(env);
|
|
break;
|
|
case CP_ACCESS_TRAP_EL2:
|
|
/* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
|
|
* a bug in the access function.
|
|
*/
|
|
assert(!arm_is_secure(env) && arm_current_el(env) != 3);
|
|
target_el = 2;
|
|
break;
|
|
case CP_ACCESS_TRAP_EL3:
|
|
target_el = 3;
|
|
break;
|
|
case CP_ACCESS_TRAP_UNCATEGORIZED:
|
|
target_el = exception_target_el(env);
|
|
syndrome = syn_uncategorized();
|
|
break;
|
|
case CP_ACCESS_TRAP_UNCATEGORIZED_EL2:
|
|
target_el = 2;
|
|
syndrome = syn_uncategorized();
|
|
break;
|
|
case CP_ACCESS_TRAP_UNCATEGORIZED_EL3:
|
|
target_el = 3;
|
|
syndrome = syn_uncategorized();
|
|
break;
|
|
case CP_ACCESS_TRAP_FP_EL2:
|
|
target_el = 2;
|
|
/* Since we are an implementation that takes exceptions on a trapped
|
|
* conditional insn only if the insn has passed its condition code
|
|
* check, we take the IMPDEF choice to always report CV=1 COND=0xe
|
|
* (which is also the required value for AArch64 traps).
|
|
*/
|
|
syndrome = syn_fp_access_trap(1, 0xe, false);
|
|
break;
|
|
case CP_ACCESS_TRAP_FP_EL3:
|
|
target_el = 3;
|
|
syndrome = syn_fp_access_trap(1, 0xe, false);
|
|
break;
|
|
default:
|
|
g_assert_not_reached();
|
|
}
|
|
|
|
exept:
|
|
raise_exception(env, EXCP_UDEF, syndrome, target_el);
|
|
}
|
|
|
|
void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
|
|
{
|
|
const ARMCPRegInfo *ri = rip;
|
|
|
|
if (ri->type & ARM_CP_IO) {
|
|
qemu_mutex_lock_iothread();
|
|
ri->writefn(env, ri, value);
|
|
qemu_mutex_unlock_iothread();
|
|
} else {
|
|
ri->writefn(env, ri, value);
|
|
}
|
|
}
|
|
|
|
uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
|
|
{
|
|
const ARMCPRegInfo *ri = rip;
|
|
uint32_t res;
|
|
|
|
if (ri->type & ARM_CP_IO) {
|
|
qemu_mutex_lock_iothread();
|
|
res = ri->readfn(env, ri);
|
|
qemu_mutex_unlock_iothread();
|
|
} else {
|
|
res = ri->readfn(env, ri);
|
|
}
|
|
|
|
return res;
|
|
}
|
|
|
|
void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
|
|
{
|
|
const ARMCPRegInfo *ri = rip;
|
|
|
|
if (ri->type & ARM_CP_IO) {
|
|
qemu_mutex_lock_iothread();
|
|
ri->writefn(env, ri, value);
|
|
qemu_mutex_unlock_iothread();
|
|
} else {
|
|
ri->writefn(env, ri, value);
|
|
}
|
|
}
|
|
|
|
uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
|
|
{
|
|
const ARMCPRegInfo *ri = rip;
|
|
uint64_t res;
|
|
|
|
if (ri->type & ARM_CP_IO) {
|
|
qemu_mutex_lock_iothread();
|
|
res = ri->readfn(env, ri);
|
|
qemu_mutex_unlock_iothread();
|
|
} else {
|
|
res = ri->readfn(env, ri);
|
|
}
|
|
|
|
return res;
|
|
}
|
|
|
|
void HELPER(pre_hvc)(CPUARMState *env)
|
|
{
|
|
ARMCPU *cpu = env_archcpu(env);
|
|
int cur_el = arm_current_el(env);
|
|
/* FIXME: Use actual secure state. */
|
|
bool secure = false;
|
|
bool undef;
|
|
|
|
if (arm_is_psci_call(cpu, EXCP_HVC)) {
|
|
/* If PSCI is enabled and this looks like a valid PSCI call then
|
|
* that overrides the architecturally mandated HVC behaviour.
|
|
*/
|
|
return;
|
|
}
|
|
|
|
if (!arm_feature(env, ARM_FEATURE_EL2)) {
|
|
/* If EL2 doesn't exist, HVC always UNDEFs */
|
|
undef = true;
|
|
} else if (arm_feature(env, ARM_FEATURE_EL3)) {
|
|
/* EL3.HCE has priority over EL2.HCD. */
|
|
undef = !(env->cp15.scr_el3 & SCR_HCE);
|
|
} else {
|
|
undef = env->cp15.hcr_el2 & HCR_HCD;
|
|
}
|
|
|
|
/* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
|
|
* For ARMv8/AArch64, HVC is allowed in EL3.
|
|
* Note that we've already trapped HVC from EL0 at translation
|
|
* time.
|
|
*/
|
|
if (secure && (!is_a64(env) || cur_el == 1)) {
|
|
undef = true;
|
|
}
|
|
|
|
if (undef) {
|
|
raise_exception(env, EXCP_UDEF, syn_uncategorized(),
|
|
exception_target_el(env));
|
|
}
|
|
}
|
|
|
|
void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
|
|
{
|
|
ARMCPU *cpu = env_archcpu(env);
|
|
int cur_el = arm_current_el(env);
|
|
bool secure = arm_is_secure(env);
|
|
bool smd_flag = env->cp15.scr_el3 & SCR_SMD;
|
|
|
|
/*
|
|
* SMC behaviour is summarized in the following table.
|
|
* This helper handles the "Trap to EL2" and "Undef insn" cases.
|
|
* The "Trap to EL3" and "PSCI call" cases are handled in the exception
|
|
* helper.
|
|
*
|
|
* -> ARM_FEATURE_EL3 and !SMD
|
|
* HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
|
|
*
|
|
* Conduit SMC, valid call Trap to EL2 PSCI Call
|
|
* Conduit SMC, inval call Trap to EL2 Trap to EL3
|
|
* Conduit not SMC Trap to EL2 Trap to EL3
|
|
*
|
|
*
|
|
* -> ARM_FEATURE_EL3 and SMD
|
|
* HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
|
|
*
|
|
* Conduit SMC, valid call Trap to EL2 PSCI Call
|
|
* Conduit SMC, inval call Trap to EL2 Undef insn
|
|
* Conduit not SMC Trap to EL2 Undef insn
|
|
*
|
|
*
|
|
* -> !ARM_FEATURE_EL3
|
|
* HCR_TSC && NS EL1 !HCR_TSC || !NS EL1
|
|
*
|
|
* Conduit SMC, valid call Trap to EL2 PSCI Call
|
|
* Conduit SMC, inval call Trap to EL2 Undef insn
|
|
* Conduit not SMC Undef insn Undef insn
|
|
*/
|
|
|
|
/* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state.
|
|
* On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization
|
|
* extensions, SMD only applies to NS state.
|
|
* On ARMv7 without the Virtualization extensions, the SMD bit
|
|
* doesn't exist, but we forbid the guest to set it to 1 in scr_write(),
|
|
* so we need not special case this here.
|
|
*/
|
|
bool smd = arm_feature(env, ARM_FEATURE_AARCH64) ? smd_flag
|
|
: smd_flag && !secure;
|
|
|
|
if (!arm_feature(env, ARM_FEATURE_EL3) &&
|
|
cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
|
|
/* If we have no EL3 then SMC always UNDEFs and can't be
|
|
* trapped to EL2. PSCI-via-SMC is a sort of ersatz EL3
|
|
* firmware within QEMU, and we want an EL2 guest to be able
|
|
* to forbid its EL1 from making PSCI calls into QEMU's
|
|
* "firmware" via HCR.TSC, so for these purposes treat
|
|
* PSCI-via-SMC as implying an EL3.
|
|
* This handles the very last line of the previous table.
|
|
*/
|
|
raise_exception(env, EXCP_UDEF, syn_uncategorized(),
|
|
exception_target_el(env));
|
|
}
|
|
|
|
if (cur_el == 1 && (arm_hcr_el2_eff(env) & HCR_TSC)) {
|
|
/* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
|
|
* We also want an EL2 guest to be able to forbid its EL1 from
|
|
* making PSCI calls into QEMU's "firmware" via HCR.TSC.
|
|
* This handles all the "Trap to EL2" cases of the previous table.
|
|
*/
|
|
raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
|
|
}
|
|
|
|
/* Catch the two remaining "Undef insn" cases of the previous table:
|
|
* - PSCI conduit is SMC but we don't have a valid PCSI call,
|
|
* - We don't have EL3 or SMD is set.
|
|
*/
|
|
if (!arm_is_psci_call(cpu, EXCP_SMC) &&
|
|
(smd || !arm_feature(env, ARM_FEATURE_EL3))) {
|
|
raise_exception(env, EXCP_UDEF, syn_uncategorized(),
|
|
exception_target_el(env));
|
|
}
|
|
}
|
|
|
|
/* ??? Flag setting arithmetic is awkward because we need to do comparisons.
|
|
The only way to do that in TCG is a conditional branch, which clobbers
|
|
all our temporaries. For now implement these as helper functions. */
|
|
|
|
/* Similarly for variable shift instructions. */
|
|
|
|
uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
|
|
{
|
|
int shift = i & 0xff;
|
|
if (shift >= 32) {
|
|
if (shift == 32)
|
|
env->CF = x & 1;
|
|
else
|
|
env->CF = 0;
|
|
return 0;
|
|
} else if (shift != 0) {
|
|
env->CF = (x >> (32 - shift)) & 1;
|
|
return x << shift;
|
|
}
|
|
return x;
|
|
}
|
|
|
|
uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
|
|
{
|
|
int shift = i & 0xff;
|
|
if (shift >= 32) {
|
|
if (shift == 32)
|
|
env->CF = (x >> 31) & 1;
|
|
else
|
|
env->CF = 0;
|
|
return 0;
|
|
} else if (shift != 0) {
|
|
env->CF = (x >> (shift - 1)) & 1;
|
|
return x >> shift;
|
|
}
|
|
return x;
|
|
}
|
|
|
|
uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
|
|
{
|
|
int shift = i & 0xff;
|
|
if (shift >= 32) {
|
|
env->CF = (x >> 31) & 1;
|
|
return (int32_t)x >> 31;
|
|
} else if (shift != 0) {
|
|
env->CF = (x >> (shift - 1)) & 1;
|
|
return (int32_t)x >> shift;
|
|
}
|
|
return x;
|
|
}
|
|
|
|
uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
|
|
{
|
|
int shift1, shift;
|
|
shift1 = i & 0xff;
|
|
shift = shift1 & 0x1f;
|
|
if (shift == 0) {
|
|
if (shift1 != 0)
|
|
env->CF = (x >> 31) & 1;
|
|
return x;
|
|
} else {
|
|
env->CF = (x >> (shift - 1)) & 1;
|
|
return ((uint32_t)x >> shift) | (x << (32 - shift));
|
|
}
|
|
}
|
|
|
|
void HELPER(probe_access)(CPUARMState *env, target_ulong ptr,
|
|
uint32_t access_type, uint32_t mmu_idx,
|
|
uint32_t size)
|
|
{
|
|
uint32_t in_page = -((uint32_t)ptr | TARGET_PAGE_SIZE);
|
|
uintptr_t ra = GETPC();
|
|
|
|
if (likely(size <= in_page)) {
|
|
probe_access(env, ptr, size, access_type, mmu_idx, ra);
|
|
} else {
|
|
probe_access(env, ptr, in_page, access_type, mmu_idx, ra);
|
|
probe_access(env, ptr + in_page, size - in_page,
|
|
access_type, mmu_idx, ra);
|
|
}
|
|
}
|