target-arm/op_helper.c

   1 /*
   2  *  ARM helper routines
   3  *
   4  *  Copyright (c) 2005-2007 CodeSourcery, LLC
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "cpu.h"
  20 #include "exec/helper-proto.h"
  21 #include "internals.h"
  22 #include "exec/cpu_ldst.h"
  23
  24 #define SIGNBIT (uint32_t)0x80000000
  25 #define SIGNBIT64 ((uint64_t)1 << 63)
  26
  27 static void raise_exception(CPUARMState *env, uint32_t excp,
  28                             uint32_t syndrome, uint32_t target_el)
  29 {
  30     CPUState *cs = CPU(arm_env_get_cpu(env));
  31
  32     assert(!excp_is_internal(excp));
  33     cs->exception_index = excp;
  34     env->exception.syndrome = syndrome;
  35     env->exception.target_el = target_el;
  36     cpu_loop_exit(cs);
  37 }
  38
  39 static int exception_target_el(CPUARMState *env)
  40 {
  41     int target_el = MAX(1, arm_current_el(env));
  42
  43     /* No such thing as secure EL1 if EL3 is aarch32, so update the target EL
  44      * to EL3 in this case.
  45      */
  46     if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
  47         target_el = 3;
  48     }
  49
  50     return target_el;
  51 }
  52
  53 uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
  54                           uint32_t rn, uint32_t maxindex)
  55 {
  56     uint32_t val;
  57     uint32_t tmp;
  58     int index;
  59     int shift;
  60     uint64_t *table;
  61     table = (uint64_t *)&env->vfp.regs[rn];
  62     val = 0;
  63     for (shift = 0; shift < 32; shift += 8) {
  64         index = (ireg >> shift) & 0xff;
  65         if (index < maxindex) {
  66             tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
  67             val |= tmp << shift;
  68         } else {
  69             val |= def & (0xff << shift);
  70         }
  71     }
  72     return val;
  73 }
  74
  75 #if !defined(CONFIG_USER_ONLY)
  76
  77 /* try to fill the TLB and return an exception if error. If retaddr is
  78  * NULL, it means that the function was called in C code (i.e. not
  79  * from generated code or from helper.c)
  80  */
  81 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
  82               uintptr_t retaddr)
  83 {
  84     int ret;
  85
  86     ret = arm_tlb_fill(cs, addr, is_write, mmu_idx);
  87     if (unlikely(ret)) {
  88         ARMCPU *cpu = ARM_CPU(cs);
  89         CPUARMState *env = &cpu->env;
  90         uint32_t syn, exc;
  91         bool same_el = (arm_current_el(env) != 0);
  92
  93         if (retaddr) {
  94             /* now we have a real cpu fault */
  95             cpu_restore_state(cs, retaddr);
  96         }
  97
  98         /* AArch64 syndrome does not have an LPAE bit */
  99         syn = ret & ~(1 << 9);
 100
 101         /* For insn and data aborts we assume there is no instruction syndrome
 102          * information; this is always true for exceptions reported to EL1.
 103          */
 104         if (is_write == 2) {
 105             syn = syn_insn_abort(same_el, 0, 0, syn);
 106             exc = EXCP_PREFETCH_ABORT;
 107         } else {
 108             syn = syn_data_abort(same_el, 0, 0, 0, is_write == 1, syn);
 109             if (is_write == 1 && arm_feature(env, ARM_FEATURE_V6)) {
 110                 ret |= (1 << 11);
 111             }
 112             exc = EXCP_DATA_ABORT;
 113         }
 114
 115         env->exception.vaddress = addr;
 116         env->exception.fsr = ret;
 117         raise_exception(env, exc, syn, exception_target_el(env));
 118     }
 119 }
 120 #endif
 121
 122 uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
 123 {
 124     uint32_t res = a + b;
 125     if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
 126         env->QF = 1;
 127     return res;
 128 }
 129
 130 uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
 131 {
 132     uint32_t res = a + b;
 133     if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
 134         env->QF = 1;
 135         res = ~(((int32_t)a >> 31) ^ SIGNBIT);
 136     }
 137     return res;
 138 }
 139
 140 uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
 141 {
 142     uint32_t res = a - b;
 143     if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
 144         env->QF = 1;
 145         res = ~(((int32_t)a >> 31) ^ SIGNBIT);
 146     }
 147     return res;
 148 }
 149
 150 uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
 151 {
 152     uint32_t res;
 153     if (val >= 0x40000000) {
 154         res = ~SIGNBIT;
 155         env->QF = 1;
 156     } else if (val <= (int32_t)0xc0000000) {
 157         res = SIGNBIT;
 158         env->QF = 1;
 159     } else {
 160         res = val << 1;
 161     }
 162     return res;
 163 }
 164
 165 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
 166 {
 167     uint32_t res = a + b;
 168     if (res < a) {
 169         env->QF = 1;
 170         res = ~0;
 171     }
 172     return res;
 173 }
 174
 175 uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
 176 {
 177     uint32_t res = a - b;
 178     if (res > a) {
 179         env->QF = 1;
 180         res = 0;
 181     }
 182     return res;
 183 }
 184
 185 /* Signed saturation.  */
 186 static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
 187 {
 188     int32_t top;
 189     uint32_t mask;
 190
 191     top = val >> shift;
 192     mask = (1u << shift) - 1;
 193     if (top > 0) {
 194         env->QF = 1;
 195         return mask;
 196     } else if (top < -1) {
 197         env->QF = 1;
 198         return ~mask;
 199     }
 200     return val;
 201 }
 202
 203 /* Unsigned saturation.  */
 204 static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
 205 {
 206     uint32_t max;
 207
 208     max = (1u << shift) - 1;
 209     if (val < 0) {
 210         env->QF = 1;
 211         return 0;
 212     } else if (val > max) {
 213         env->QF = 1;
 214         return max;
 215     }
 216     return val;
 217 }
 218
 219 /* Signed saturate.  */
 220 uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
 221 {
 222     return do_ssat(env, x, shift);
 223 }
 224
 225 /* Dual halfword signed saturate.  */
 226 uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
 227 {
 228     uint32_t res;
 229
 230     res = (uint16_t)do_ssat(env, (int16_t)x, shift);
 231     res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
 232     return res;
 233 }
 234
 235 /* Unsigned saturate.  */
 236 uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
 237 {
 238     return do_usat(env, x, shift);
 239 }
 240
 241 /* Dual halfword unsigned saturate.  */
 242 uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
 243 {
 244     uint32_t res;
 245
 246     res = (uint16_t)do_usat(env, (int16_t)x, shift);
 247     res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
 248     return res;
 249 }
 250
 251 void HELPER(wfi)(CPUARMState *env)
 252 {
 253     CPUState *cs = CPU(arm_env_get_cpu(env));
 254
 255     cs->exception_index = EXCP_HLT;
 256     cs->halted = 1;
 257     cpu_loop_exit(cs);
 258 }
 259
 260 void HELPER(wfe)(CPUARMState *env)
 261 {
 262     CPUState *cs = CPU(arm_env_get_cpu(env));
 263
 264     /* Don't actually halt the CPU, just yield back to top
 265      * level loop
 266      */
 267     cs->exception_index = EXCP_YIELD;
 268     cpu_loop_exit(cs);
 269 }
 270
 271 /* Raise an internal-to-QEMU exception. This is limited to only
 272  * those EXCP values which are special cases for QEMU to interrupt
 273  * execution and not to be used for exceptions which are passed to
 274  * the guest (those must all have syndrome information and thus should
 275  * use exception_with_syndrome).
 276  */
 277 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
 278 {
 279     CPUState *cs = CPU(arm_env_get_cpu(env));
 280
 281     assert(excp_is_internal(excp));
 282     cs->exception_index = excp;
 283     cpu_loop_exit(cs);
 284 }
 285
 286 /* Raise an exception with the specified syndrome register value */
 287 void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
 288                                      uint32_t syndrome, uint32_t target_el)
 289 {
 290     raise_exception(env, excp, syndrome, target_el);
 291 }
 292
 293 uint32_t HELPER(cpsr_read)(CPUARMState *env)
 294 {
 295     return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED);
 296 }
 297
 298 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
 299 {
 300     cpsr_write(env, val, mask);
 301 }
 302
 303 /* Access to user mode registers from privileged modes.  */
 304 uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
 305 {
 306     uint32_t val;
 307
 308     if (regno == 13) {
 309         val = env->banked_r13[0];
 310     } else if (regno == 14) {
 311         val = env->banked_r14[0];
 312     } else if (regno >= 8
 313                && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
 314         val = env->usr_regs[regno - 8];
 315     } else {
 316         val = env->regs[regno];
 317     }
 318     return val;
 319 }
 320
 321 void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
 322 {
 323     if (regno == 13) {
 324         env->banked_r13[0] = val;
 325     } else if (regno == 14) {
 326         env->banked_r14[0] = val;
 327     } else if (regno >= 8
 328                && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
 329         env->usr_regs[regno - 8] = val;
 330     } else {
 331         env->regs[regno] = val;
 332     }
 333 }
 334
 335 void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome)
 336 {
 337     const ARMCPRegInfo *ri = rip;
 338     int target_el;
 339
 340     if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
 341         && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
 342         raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
 343     }
 344
 345     if (!ri->accessfn) {
 346         return;
 347     }
 348
 349     switch (ri->accessfn(env, ri)) {
 350     case CP_ACCESS_OK:
 351         return;
 352     case CP_ACCESS_TRAP:
 353         target_el = exception_target_el(env);
 354         break;
 355     case CP_ACCESS_TRAP_EL2:
 356         /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
 357          * a bug in the access function.
 358          */
 359         assert(!arm_is_secure(env) && !arm_current_el(env) == 3);
 360         target_el = 2;
 361         break;
 362     case CP_ACCESS_TRAP_EL3:
 363         target_el = 3;
 364         break;
 365     case CP_ACCESS_TRAP_UNCATEGORIZED:
 366         target_el = exception_target_el(env);
 367         syndrome = syn_uncategorized();
 368         break;
 369     default:
 370         g_assert_not_reached();
 371     }
 372
 373     raise_exception(env, EXCP_UDEF, syndrome, target_el);
 374 }
 375
 376 void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
 377 {
 378     const ARMCPRegInfo *ri = rip;
 379
 380     ri->writefn(env, ri, value);
 381 }
 382
 383 uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
 384 {
 385     const ARMCPRegInfo *ri = rip;
 386
 387     return ri->readfn(env, ri);
 388 }
 389
 390 void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
 391 {
 392     const ARMCPRegInfo *ri = rip;
 393
 394     ri->writefn(env, ri, value);
 395 }
 396
 397 uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
 398 {
 399     const ARMCPRegInfo *ri = rip;
 400
 401     return ri->readfn(env, ri);
 402 }
 403
 404 void HELPER(msr_i_pstate)(CPUARMState *env, uint32_t op, uint32_t imm)
 405 {
 406     /* MSR_i to update PSTATE. This is OK from EL0 only if UMA is set.
 407      * Note that SPSel is never OK from EL0; we rely on handle_msr_i()
 408      * to catch that case at translate time.
 409      */
 410     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
 411         uint32_t syndrome = syn_aa64_sysregtrap(0, extract32(op, 0, 3),
 412                                                 extract32(op, 3, 3), 4,
 413                                                 imm, 0x1f, 0);
 414         raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
 415     }
 416
 417     switch (op) {
 418     case 0x05: /* SPSel */
 419         update_spsel(env, imm);
 420         break;
 421     case 0x1e: /* DAIFSet */
 422         env->daif |= (imm << 6) & PSTATE_DAIF;
 423         break;
 424     case 0x1f: /* DAIFClear */
 425         env->daif &= ~((imm << 6) & PSTATE_DAIF);
 426         break;
 427     default:
 428         g_assert_not_reached();
 429     }
 430 }
 431
 432 void HELPER(clear_pstate_ss)(CPUARMState *env)
 433 {
 434     env->pstate &= ~PSTATE_SS;
 435 }
 436
 437 void HELPER(pre_hvc)(CPUARMState *env)
 438 {
 439     ARMCPU *cpu = arm_env_get_cpu(env);
 440     int cur_el = arm_current_el(env);
 441     /* FIXME: Use actual secure state.  */
 442     bool secure = false;
 443     bool undef;
 444
 445     if (arm_is_psci_call(cpu, EXCP_HVC)) {
 446         /* If PSCI is enabled and this looks like a valid PSCI call then
 447          * that overrides the architecturally mandated HVC behaviour.
 448          */
 449         return;
 450     }
 451
 452     if (!arm_feature(env, ARM_FEATURE_EL2)) {
 453         /* If EL2 doesn't exist, HVC always UNDEFs */
 454         undef = true;
 455     } else if (arm_feature(env, ARM_FEATURE_EL3)) {
 456         /* EL3.HCE has priority over EL2.HCD. */
 457         undef = !(env->cp15.scr_el3 & SCR_HCE);
 458     } else {
 459         undef = env->cp15.hcr_el2 & HCR_HCD;
 460     }
 461
 462     /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
 463      * For ARMv8/AArch64, HVC is allowed in EL3.
 464      * Note that we've already trapped HVC from EL0 at translation
 465      * time.
 466      */
 467     if (secure && (!is_a64(env) || cur_el == 1)) {
 468         undef = true;
 469     }
 470
 471     if (undef) {
 472         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
 473                         exception_target_el(env));
 474     }
 475 }
 476
 477 void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
 478 {
 479     ARMCPU *cpu = arm_env_get_cpu(env);
 480     int cur_el = arm_current_el(env);
 481     bool secure = arm_is_secure(env);
 482     bool smd = env->cp15.scr_el3 & SCR_SMD;
 483     /* On ARMv8 AArch32, SMD only applies to NS state.
 484      * On ARMv7 SMD only applies to NS state and only if EL2 is available.
 485      * For ARMv7 non EL2, we force SMD to zero so we don't need to re-check
 486      * the EL2 condition here.
 487      */
 488     bool undef = is_a64(env) ? smd : (!secure && smd);
 489
 490     if (arm_is_psci_call(cpu, EXCP_SMC)) {
 491         /* If PSCI is enabled and this looks like a valid PSCI call then
 492          * that overrides the architecturally mandated SMC behaviour.
 493          */
 494         return;
 495     }
 496
 497     if (!arm_feature(env, ARM_FEATURE_EL3)) {
 498         /* If we have no EL3 then SMC always UNDEFs */
 499         undef = true;
 500     } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
 501         /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
 502         raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
 503     }
 504
 505     if (undef) {
 506         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
 507                         exception_target_el(env));
 508     }
 509 }
 510
 511 void HELPER(exception_return)(CPUARMState *env)
 512 {
 513     int cur_el = arm_current_el(env);
 514     unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
 515     uint32_t spsr = env->banked_spsr[spsr_idx];
 516     int new_el;
 517
 518     aarch64_save_sp(env, cur_el);
 519
 520     env->exclusive_addr = -1;
 521
 522     /* We must squash the PSTATE.SS bit to zero unless both of the
 523      * following hold:
 524      *  1. debug exceptions are currently disabled
 525      *  2. singlestep will be active in the EL we return to
 526      * We check 1 here and 2 after we've done the pstate/cpsr write() to
 527      * transition to the EL we're going to.
 528      */
 529     if (arm_generate_debug_exceptions(env)) {
 530         spsr &= ~PSTATE_SS;
 531     }
 532
 533     if (spsr & PSTATE_nRW) {
 534         /* TODO: We currently assume EL1/2/3 are running in AArch64.  */
 535         env->aarch64 = 0;
 536         new_el = 0;
 537         env->uncached_cpsr = 0x10;
 538         cpsr_write(env, spsr, ~0);
 539         if (!arm_singlestep_active(env)) {
 540             env->uncached_cpsr &= ~PSTATE_SS;
 541         }
 542         aarch64_sync_64_to_32(env);
 543
 544         env->regs[15] = env->elr_el[1] & ~0x1;
 545     } else {
 546         new_el = extract32(spsr, 2, 2);
 547         if (new_el > cur_el
 548             || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
 549             /* Disallow return to an EL which is unimplemented or higher
 550              * than the current one.
 551              */
 552             goto illegal_return;
 553         }
 554         if (extract32(spsr, 1, 1)) {
 555             /* Return with reserved M[1] bit set */
 556             goto illegal_return;
 557         }
 558         if (new_el == 0 && (spsr & PSTATE_SP)) {
 559             /* Return to EL0 with M[0] bit set */
 560             goto illegal_return;
 561         }
 562         env->aarch64 = 1;
 563         pstate_write(env, spsr);
 564         if (!arm_singlestep_active(env)) {
 565             env->pstate &= ~PSTATE_SS;
 566         }
 567         aarch64_restore_sp(env, new_el);
 568         env->pc = env->elr_el[cur_el];
 569     }
 570
 571     return;
 572
 573 illegal_return:
 574     /* Illegal return events of various kinds have architecturally
 575      * mandated behaviour:
 576      * restore NZCV and DAIF from SPSR_ELx
 577      * set PSTATE.IL
 578      * restore PC from ELR_ELx
 579      * no change to exception level, execution state or stack pointer
 580      */
 581     env->pstate |= PSTATE_IL;
 582     env->pc = env->elr_el[cur_el];
 583     spsr &= PSTATE_NZCV | PSTATE_DAIF;
 584     spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF);
 585     pstate_write(env, spsr);
 586     if (!arm_singlestep_active(env)) {
 587         env->pstate &= ~PSTATE_SS;
 588     }
 589 }
 590
 591 /* Return true if the linked breakpoint entry lbn passes its checks */
 592 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
 593 {
 594     CPUARMState *env = &cpu->env;
 595     uint64_t bcr = env->cp15.dbgbcr[lbn];
 596     int brps = extract32(cpu->dbgdidr, 24, 4);
 597     int ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
 598     int bt;
 599     uint32_t contextidr;
 600
 601     /* Links to unimplemented or non-context aware breakpoints are
 602      * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
 603      * as if linked to an UNKNOWN context-aware breakpoint (in which
 604      * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
 605      * We choose the former.
 606      */
 607     if (lbn > brps || lbn < (brps - ctx_cmps)) {
 608         return false;
 609     }
 610
 611     bcr = env->cp15.dbgbcr[lbn];
 612
 613     if (extract64(bcr, 0, 1) == 0) {
 614         /* Linked breakpoint disabled : generate no events */
 615         return false;
 616     }
 617
 618     bt = extract64(bcr, 20, 4);
 619
 620     /* We match the whole register even if this is AArch32 using the
 621      * short descriptor format (in which case it holds both PROCID and ASID),
 622      * since we don't implement the optional v7 context ID masking.
 623      */
 624     contextidr = extract64(env->cp15.contextidr_el[1], 0, 32);
 625
 626     switch (bt) {
 627     case 3: /* linked context ID match */
 628         if (arm_current_el(env) > 1) {
 629             /* Context matches never fire in EL2 or (AArch64) EL3 */
 630             return false;
 631         }
 632         return (contextidr == extract64(env->cp15.dbgbvr[lbn], 0, 32));
 633     case 5: /* linked address mismatch (reserved in AArch64) */
 634     case 9: /* linked VMID match (reserved if no EL2) */
 635     case 11: /* linked context ID and VMID match (reserved if no EL2) */
 636     default:
 637         /* Links to Unlinked context breakpoints must generate no
 638          * events; we choose to do the same for reserved values too.
 639          */
 640         return false;
 641     }
 642
 643     return false;
 644 }
 645
 646 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
 647 {
 648     CPUARMState *env = &cpu->env;
 649     uint64_t cr;
 650     int pac, hmc, ssc, wt, lbn;
 651     /* Note that for watchpoints the check is against the CPU security
 652      * state, not the S/NS attribute on the offending data access.
 653      */
 654     bool is_secure = arm_is_secure(env);
 655     int access_el = arm_current_el(env);
 656
 657     if (is_wp) {
 658         CPUWatchpoint *wp = env->cpu_watchpoint[n];
 659
 660         if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
 661             return false;
 662         }
 663         cr = env->cp15.dbgwcr[n];
 664         if (wp->hitattrs.user) {
 665             /* The LDRT/STRT/LDT/STT "unprivileged access" instructions should
 666              * match watchpoints as if they were accesses done at EL0, even if
 667              * the CPU is at EL1 or higher.
 668              */
 669             access_el = 0;
 670         }
 671     } else {
 672         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 673
 674         if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
 675             return false;
 676         }
 677         cr = env->cp15.dbgbcr[n];
 678     }
 679     /* The WATCHPOINT_HIT flag guarantees us that the watchpoint is
 680      * enabled and that the address and access type match; for breakpoints
 681      * we know the address matched; check the remaining fields, including
 682      * linked breakpoints. We rely on WCR and BCR having the same layout
 683      * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
 684      * Note that some combinations of {PAC, HMC, SSC} are reserved and
 685      * must act either like some valid combination or as if the watchpoint
 686      * were disabled. We choose the former, and use this together with
 687      * the fact that EL3 must always be Secure and EL2 must always be
 688      * Non-Secure to simplify the code slightly compared to the full
 689      * table in the ARM ARM.
 690      */
 691     pac = extract64(cr, 1, 2);
 692     hmc = extract64(cr, 13, 1);
 693     ssc = extract64(cr, 14, 2);
 694
 695     switch (ssc) {
 696     case 0:
 697         break;
 698     case 1:
 699     case 3:
 700         if (is_secure) {
 701             return false;
 702         }
 703         break;
 704     case 2:
 705         if (!is_secure) {
 706             return false;
 707         }
 708         break;
 709     }
 710
 711     switch (access_el) {
 712     case 3:
 713     case 2:
 714         if (!hmc) {
 715             return false;
 716         }
 717         break;
 718     case 1:
 719         if (extract32(pac, 0, 1) == 0) {
 720             return false;
 721         }
 722         break;
 723     case 0:
 724         if (extract32(pac, 1, 1) == 0) {
 725             return false;
 726         }
 727         break;
 728     default:
 729         g_assert_not_reached();
 730     }
 731
 732     wt = extract64(cr, 20, 1);
 733     lbn = extract64(cr, 16, 4);
 734
 735     if (wt && !linked_bp_matches(cpu, lbn)) {
 736         return false;
 737     }
 738
 739     return true;
 740 }
 741
 742 static bool check_watchpoints(ARMCPU *cpu)
 743 {
 744     CPUARMState *env = &cpu->env;
 745     int n;
 746
 747     /* If watchpoints are disabled globally or we can't take debug
 748      * exceptions here then watchpoint firings are ignored.
 749      */
 750     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 751         || !arm_generate_debug_exceptions(env)) {
 752         return false;
 753     }
 754
 755     for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
 756         if (bp_wp_matches(cpu, n, true)) {
 757             return true;
 758         }
 759     }
 760     return false;
 761 }
 762
 763 static bool check_breakpoints(ARMCPU *cpu)
 764 {
 765     CPUARMState *env = &cpu->env;
 766     int n;
 767
 768     /* If breakpoints are disabled globally or we can't take debug
 769      * exceptions here then breakpoint firings are ignored.
 770      */
 771     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 772         || !arm_generate_debug_exceptions(env)) {
 773         return false;
 774     }
 775
 776     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
 777         if (bp_wp_matches(cpu, n, false)) {
 778             return true;
 779         }
 780     }
 781     return false;
 782 }
 783
 784 void arm_debug_excp_handler(CPUState *cs)
 785 {
 786     /* Called by core code when a watchpoint or breakpoint fires;
 787      * need to check which one and raise the appropriate exception.
 788      */
 789     ARMCPU *cpu = ARM_CPU(cs);
 790     CPUARMState *env = &cpu->env;
 791     CPUWatchpoint *wp_hit = cs->watchpoint_hit;
 792
 793     if (wp_hit) {
 794         if (wp_hit->flags & BP_CPU) {
 795             cs->watchpoint_hit = NULL;
 796             if (check_watchpoints(cpu)) {
 797                 bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
 798                 bool same_el = arm_debug_target_el(env) == arm_current_el(env);
 799
 800                 if (extended_addresses_enabled(env)) {
 801                     env->exception.fsr = (1 << 9) | 0x22;
 802                 } else {
 803                     env->exception.fsr = 0x2;
 804                 }
 805                 env->exception.vaddress = wp_hit->hitaddr;
 806                 raise_exception(env, EXCP_DATA_ABORT,
 807                                 syn_watchpoint(same_el, 0, wnr),
 808                                 arm_debug_target_el(env));
 809             } else {
 810                 cpu_resume_from_signal(cs, NULL);
 811             }
 812         }
 813     } else {
 814         if (check_breakpoints(cpu)) {
 815             bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
 816             if (extended_addresses_enabled(env)) {
 817                 env->exception.fsr = (1 << 9) | 0x22;
 818             } else {
 819                 env->exception.fsr = 0x2;
 820             }
 821             /* FAR is UNKNOWN, so doesn't need setting */
 822             raise_exception(env, EXCP_PREFETCH_ABORT,
 823                             syn_breakpoint(same_el),
 824                             arm_debug_target_el(env));
 825         }
 826     }
 827 }
 828
 829 /* ??? Flag setting arithmetic is awkward because we need to do comparisons.
 830    The only way to do that in TCG is a conditional branch, which clobbers
 831    all our temporaries.  For now implement these as helper functions.  */
 832
 833 /* Similarly for variable shift instructions.  */
 834
 835 uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 836 {
 837     int shift = i & 0xff;
 838     if (shift >= 32) {
 839         if (shift == 32)
 840             env->CF = x & 1;
 841         else
 842             env->CF = 0;
 843         return 0;
 844     } else if (shift != 0) {
 845         env->CF = (x >> (32 - shift)) & 1;
 846         return x << shift;
 847     }
 848     return x;
 849 }
 850
 851 uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 852 {
 853     int shift = i & 0xff;
 854     if (shift >= 32) {
 855         if (shift == 32)
 856             env->CF = (x >> 31) & 1;
 857         else
 858             env->CF = 0;
 859         return 0;
 860     } else if (shift != 0) {
 861         env->CF = (x >> (shift - 1)) & 1;
 862         return x >> shift;
 863     }
 864     return x;
 865 }
 866
 867 uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 868 {
 869     int shift = i & 0xff;
 870     if (shift >= 32) {
 871         env->CF = (x >> 31) & 1;
 872         return (int32_t)x >> 31;
 873     } else if (shift != 0) {
 874         env->CF = (x >> (shift - 1)) & 1;
 875         return (int32_t)x >> shift;
 876     }
 877     return x;
 878 }
 879
 880 uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 881 {
 882     int shift1, shift;
 883     shift1 = i & 0xff;
 884     shift = shift1 & 0x1f;
 885     if (shift == 0) {
 886         if (shift1 != 0)
 887             env->CF = (x >> 31) & 1;
 888         return x;
 889     } else {
 890         env->CF = (x >> (shift - 1)) & 1;
 891         return ((uint32_t)x >> shift) | (x << (32 - shift));
 892     }
 893 }