target-arm/op_helper.c

   1 /*
   2  *  ARM helper routines
   3  *
   4  *  Copyright (c) 2005-2007 CodeSourcery, LLC
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "cpu.h"
  20 #include "exec/helper-proto.h"
  21 #include "internals.h"
  22 #include "exec/cpu_ldst.h"
  23
  24 #define SIGNBIT (uint32_t)0x80000000
  25 #define SIGNBIT64 ((uint64_t)1 << 63)
  26
  27 static void raise_exception(CPUARMState *env, uint32_t excp,
  28                             uint32_t syndrome, uint32_t target_el)
  29 {
  30     CPUState *cs = CPU(arm_env_get_cpu(env));
  31
  32     assert(!excp_is_internal(excp));
  33     cs->exception_index = excp;
  34     env->exception.syndrome = syndrome;
  35     env->exception.target_el = target_el;
  36     cpu_loop_exit(cs);
  37 }
  38
  39 static int exception_target_el(CPUARMState *env)
  40 {
  41     int target_el = MAX(1, arm_current_el(env));
  42
  43     /* No such thing as secure EL1 if EL3 is aarch32, so update the target EL
  44      * to EL3 in this case.
  45      */
  46     if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
  47         target_el = 3;
  48     }
  49
  50     return target_el;
  51 }
  52
  53 uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
  54                           uint32_t rn, uint32_t maxindex)
  55 {
  56     uint32_t val;
  57     uint32_t tmp;
  58     int index;
  59     int shift;
  60     uint64_t *table;
  61     table = (uint64_t *)&env->vfp.regs[rn];
  62     val = 0;
  63     for (shift = 0; shift < 32; shift += 8) {
  64         index = (ireg >> shift) & 0xff;
  65         if (index < maxindex) {
  66             tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
  67             val |= tmp << shift;
  68         } else {
  69             val |= def & (0xff << shift);
  70         }
  71     }
  72     return val;
  73 }
  74
  75 #if !defined(CONFIG_USER_ONLY)
  76
  77 /* try to fill the TLB and return an exception if error. If retaddr is
  78  * NULL, it means that the function was called in C code (i.e. not
  79  * from generated code or from helper.c)
  80  */
  81 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
  82               uintptr_t retaddr)
  83 {
  84     int ret;
  85
  86     ret = arm_tlb_fill(cs, addr, is_write, mmu_idx);
  87     if (unlikely(ret)) {
  88         ARMCPU *cpu = ARM_CPU(cs);
  89         CPUARMState *env = &cpu->env;
  90         uint32_t syn, exc;
  91         bool same_el = (arm_current_el(env) != 0);
  92
  93         if (retaddr) {
  94             /* now we have a real cpu fault */
  95             cpu_restore_state(cs, retaddr);
  96         }
  97
  98         /* AArch64 syndrome does not have an LPAE bit */
  99         syn = ret & ~(1 << 9);
 100
 101         /* For insn and data aborts we assume there is no instruction syndrome
 102          * information; this is always true for exceptions reported to EL1.
 103          */
 104         if (is_write == 2) {
 105             syn = syn_insn_abort(same_el, 0, 0, syn);
 106             exc = EXCP_PREFETCH_ABORT;
 107         } else {
 108             syn = syn_data_abort(same_el, 0, 0, 0, is_write == 1, syn);
 109             if (is_write == 1 && arm_feature(env, ARM_FEATURE_V6)) {
 110                 ret |= (1 << 11);
 111             }
 112             exc = EXCP_DATA_ABORT;
 113         }
 114
 115         env->exception.vaddress = addr;
 116         env->exception.fsr = ret;
 117         raise_exception(env, exc, syn, exception_target_el(env));
 118     }
 119 }
 120 #endif
 121
 122 uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
 123 {
 124     uint32_t res = a + b;
 125     if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
 126         env->QF = 1;
 127     return res;
 128 }
 129
 130 uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
 131 {
 132     uint32_t res = a + b;
 133     if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
 134         env->QF = 1;
 135         res = ~(((int32_t)a >> 31) ^ SIGNBIT);
 136     }
 137     return res;
 138 }
 139
 140 uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
 141 {
 142     uint32_t res = a - b;
 143     if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
 144         env->QF = 1;
 145         res = ~(((int32_t)a >> 31) ^ SIGNBIT);
 146     }
 147     return res;
 148 }
 149
 150 uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
 151 {
 152     uint32_t res;
 153     if (val >= 0x40000000) {
 154         res = ~SIGNBIT;
 155         env->QF = 1;
 156     } else if (val <= (int32_t)0xc0000000) {
 157         res = SIGNBIT;
 158         env->QF = 1;
 159     } else {
 160         res = val << 1;
 161     }
 162     return res;
 163 }
 164
 165 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
 166 {
 167     uint32_t res = a + b;
 168     if (res < a) {
 169         env->QF = 1;
 170         res = ~0;
 171     }
 172     return res;
 173 }
 174
 175 uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
 176 {
 177     uint32_t res = a - b;
 178     if (res > a) {
 179         env->QF = 1;
 180         res = 0;
 181     }
 182     return res;
 183 }
 184
 185 /* Signed saturation.  */
 186 static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
 187 {
 188     int32_t top;
 189     uint32_t mask;
 190
 191     top = val >> shift;
 192     mask = (1u << shift) - 1;
 193     if (top > 0) {
 194         env->QF = 1;
 195         return mask;
 196     } else if (top < -1) {
 197         env->QF = 1;
 198         return ~mask;
 199     }
 200     return val;
 201 }
 202
 203 /* Unsigned saturation.  */
 204 static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
 205 {
 206     uint32_t max;
 207
 208     max = (1u << shift) - 1;
 209     if (val < 0) {
 210         env->QF = 1;
 211         return 0;
 212     } else if (val > max) {
 213         env->QF = 1;
 214         return max;
 215     }
 216     return val;
 217 }
 218
 219 /* Signed saturate.  */
 220 uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
 221 {
 222     return do_ssat(env, x, shift);
 223 }
 224
 225 /* Dual halfword signed saturate.  */
 226 uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
 227 {
 228     uint32_t res;
 229
 230     res = (uint16_t)do_ssat(env, (int16_t)x, shift);
 231     res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
 232     return res;
 233 }
 234
 235 /* Unsigned saturate.  */
 236 uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
 237 {
 238     return do_usat(env, x, shift);
 239 }
 240
 241 /* Dual halfword unsigned saturate.  */
 242 uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
 243 {
 244     uint32_t res;
 245
 246     res = (uint16_t)do_usat(env, (int16_t)x, shift);
 247     res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
 248     return res;
 249 }
 250
 251 /* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped.
 252  * The function returns the target EL (1-3) if the instruction is to be trapped;
 253  * otherwise it returns 0 indicating it is not trapped.
 254  */
 255 static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
 256 {
 257     int cur_el = arm_current_el(env);
 258     uint64_t mask;
 259
 260     /* If we are currently in EL0 then we need to check if SCTLR is set up for
 261      * WFx instructions being trapped to EL1. These trap bits don't exist in v7.
 262      */
 263     if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) {
 264         int target_el;
 265
 266         mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI;
 267         if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) {
 268             /* Secure EL0 and Secure PL1 is at EL3 */
 269             target_el = 3;
 270         } else {
 271             target_el = 1;
 272         }
 273
 274         if (!(env->cp15.sctlr_el[target_el] & mask)) {
 275             return target_el;
 276         }
 277     }
 278
 279     /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it
 280      * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the
 281      * bits will be zero indicating no trap.
 282      */
 283     if (cur_el < 2 && !arm_is_secure(env)) {
 284         mask = (is_wfe) ? HCR_TWE : HCR_TWI;
 285         if (env->cp15.hcr_el2 & mask) {
 286             return 2;
 287         }
 288     }
 289
 290     /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */
 291     if (cur_el < 3) {
 292         mask = (is_wfe) ? SCR_TWE : SCR_TWI;
 293         if (env->cp15.scr_el3 & mask) {
 294             return 3;
 295         }
 296     }
 297
 298     return 0;
 299 }
 300
 301 void HELPER(wfi)(CPUARMState *env)
 302 {
 303     CPUState *cs = CPU(arm_env_get_cpu(env));
 304     int target_el = check_wfx_trap(env, false);
 305
 306     if (cpu_has_work(cs)) {
 307         /* Don't bother to go into our "low power state" if
 308          * we would just wake up immediately.
 309          */
 310         return;
 311     }
 312
 313     if (target_el) {
 314         env->pc -= 4;
 315         raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0), target_el);
 316     }
 317
 318     cs->exception_index = EXCP_HLT;
 319     cs->halted = 1;
 320     cpu_loop_exit(cs);
 321 }
 322
 323 void HELPER(wfe)(CPUARMState *env)
 324 {
 325     CPUState *cs = CPU(arm_env_get_cpu(env));
 326
 327     /* Don't actually halt the CPU, just yield back to top
 328      * level loop. This is not going into a "low power state"
 329      * (ie halting until some event occurs), so we never take
 330      * a configurable trap to a different exception level.
 331      */
 332     cs->exception_index = EXCP_YIELD;
 333     cpu_loop_exit(cs);
 334 }
 335
 336 /* Raise an internal-to-QEMU exception. This is limited to only
 337  * those EXCP values which are special cases for QEMU to interrupt
 338  * execution and not to be used for exceptions which are passed to
 339  * the guest (those must all have syndrome information and thus should
 340  * use exception_with_syndrome).
 341  */
 342 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
 343 {
 344     CPUState *cs = CPU(arm_env_get_cpu(env));
 345
 346     assert(excp_is_internal(excp));
 347     cs->exception_index = excp;
 348     cpu_loop_exit(cs);
 349 }
 350
 351 /* Raise an exception with the specified syndrome register value */
 352 void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
 353                                      uint32_t syndrome, uint32_t target_el)
 354 {
 355     raise_exception(env, excp, syndrome, target_el);
 356 }
 357
 358 uint32_t HELPER(cpsr_read)(CPUARMState *env)
 359 {
 360     return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED);
 361 }
 362
 363 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
 364 {
 365     cpsr_write(env, val, mask);
 366 }
 367
 368 /* Access to user mode registers from privileged modes.  */
 369 uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
 370 {
 371     uint32_t val;
 372
 373     if (regno == 13) {
 374         val = env->banked_r13[0];
 375     } else if (regno == 14) {
 376         val = env->banked_r14[0];
 377     } else if (regno >= 8
 378                && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
 379         val = env->usr_regs[regno - 8];
 380     } else {
 381         val = env->regs[regno];
 382     }
 383     return val;
 384 }
 385
 386 void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
 387 {
 388     if (regno == 13) {
 389         env->banked_r13[0] = val;
 390     } else if (regno == 14) {
 391         env->banked_r14[0] = val;
 392     } else if (regno >= 8
 393                && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
 394         env->usr_regs[regno - 8] = val;
 395     } else {
 396         env->regs[regno] = val;
 397     }
 398 }
 399
 400 void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome)
 401 {
 402     const ARMCPRegInfo *ri = rip;
 403     int target_el;
 404
 405     if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
 406         && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
 407         raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
 408     }
 409
 410     if (!ri->accessfn) {
 411         return;
 412     }
 413
 414     switch (ri->accessfn(env, ri)) {
 415     case CP_ACCESS_OK:
 416         return;
 417     case CP_ACCESS_TRAP:
 418         target_el = exception_target_el(env);
 419         break;
 420     case CP_ACCESS_TRAP_EL2:
 421         /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
 422          * a bug in the access function.
 423          */
 424         assert(!arm_is_secure(env) && arm_current_el(env) != 3);
 425         target_el = 2;
 426         break;
 427     case CP_ACCESS_TRAP_EL3:
 428         target_el = 3;
 429         break;
 430     case CP_ACCESS_TRAP_UNCATEGORIZED:
 431         target_el = exception_target_el(env);
 432         syndrome = syn_uncategorized();
 433         break;
 434     default:
 435         g_assert_not_reached();
 436     }
 437
 438     raise_exception(env, EXCP_UDEF, syndrome, target_el);
 439 }
 440
 441 void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
 442 {
 443     const ARMCPRegInfo *ri = rip;
 444
 445     ri->writefn(env, ri, value);
 446 }
 447
 448 uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
 449 {
 450     const ARMCPRegInfo *ri = rip;
 451
 452     return ri->readfn(env, ri);
 453 }
 454
 455 void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
 456 {
 457     const ARMCPRegInfo *ri = rip;
 458
 459     ri->writefn(env, ri, value);
 460 }
 461
 462 uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
 463 {
 464     const ARMCPRegInfo *ri = rip;
 465
 466     return ri->readfn(env, ri);
 467 }
 468
 469 void HELPER(msr_i_pstate)(CPUARMState *env, uint32_t op, uint32_t imm)
 470 {
 471     /* MSR_i to update PSTATE. This is OK from EL0 only if UMA is set.
 472      * Note that SPSel is never OK from EL0; we rely on handle_msr_i()
 473      * to catch that case at translate time.
 474      */
 475     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
 476         uint32_t syndrome = syn_aa64_sysregtrap(0, extract32(op, 0, 3),
 477                                                 extract32(op, 3, 3), 4,
 478                                                 imm, 0x1f, 0);
 479         raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
 480     }
 481
 482     switch (op) {
 483     case 0x05: /* SPSel */
 484         update_spsel(env, imm);
 485         break;
 486     case 0x1e: /* DAIFSet */
 487         env->daif |= (imm << 6) & PSTATE_DAIF;
 488         break;
 489     case 0x1f: /* DAIFClear */
 490         env->daif &= ~((imm << 6) & PSTATE_DAIF);
 491         break;
 492     default:
 493         g_assert_not_reached();
 494     }
 495 }
 496
 497 void HELPER(clear_pstate_ss)(CPUARMState *env)
 498 {
 499     env->pstate &= ~PSTATE_SS;
 500 }
 501
 502 void HELPER(pre_hvc)(CPUARMState *env)
 503 {
 504     ARMCPU *cpu = arm_env_get_cpu(env);
 505     int cur_el = arm_current_el(env);
 506     /* FIXME: Use actual secure state.  */
 507     bool secure = false;
 508     bool undef;
 509
 510     if (arm_is_psci_call(cpu, EXCP_HVC)) {
 511         /* If PSCI is enabled and this looks like a valid PSCI call then
 512          * that overrides the architecturally mandated HVC behaviour.
 513          */
 514         return;
 515     }
 516
 517     if (!arm_feature(env, ARM_FEATURE_EL2)) {
 518         /* If EL2 doesn't exist, HVC always UNDEFs */
 519         undef = true;
 520     } else if (arm_feature(env, ARM_FEATURE_EL3)) {
 521         /* EL3.HCE has priority over EL2.HCD. */
 522         undef = !(env->cp15.scr_el3 & SCR_HCE);
 523     } else {
 524         undef = env->cp15.hcr_el2 & HCR_HCD;
 525     }
 526
 527     /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
 528      * For ARMv8/AArch64, HVC is allowed in EL3.
 529      * Note that we've already trapped HVC from EL0 at translation
 530      * time.
 531      */
 532     if (secure && (!is_a64(env) || cur_el == 1)) {
 533         undef = true;
 534     }
 535
 536     if (undef) {
 537         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
 538                         exception_target_el(env));
 539     }
 540 }
 541
 542 void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
 543 {
 544     ARMCPU *cpu = arm_env_get_cpu(env);
 545     int cur_el = arm_current_el(env);
 546     bool secure = arm_is_secure(env);
 547     bool smd = env->cp15.scr_el3 & SCR_SMD;
 548     /* On ARMv8 AArch32, SMD only applies to NS state.
 549      * On ARMv7 SMD only applies to NS state and only if EL2 is available.
 550      * For ARMv7 non EL2, we force SMD to zero so we don't need to re-check
 551      * the EL2 condition here.
 552      */
 553     bool undef = is_a64(env) ? smd : (!secure && smd);
 554
 555     if (arm_is_psci_call(cpu, EXCP_SMC)) {
 556         /* If PSCI is enabled and this looks like a valid PSCI call then
 557          * that overrides the architecturally mandated SMC behaviour.
 558          */
 559         return;
 560     }
 561
 562     if (!arm_feature(env, ARM_FEATURE_EL3)) {
 563         /* If we have no EL3 then SMC always UNDEFs */
 564         undef = true;
 565     } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
 566         /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
 567         raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
 568     }
 569
 570     if (undef) {
 571         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
 572                         exception_target_el(env));
 573     }
 574 }
 575
 576 void HELPER(exception_return)(CPUARMState *env)
 577 {
 578     int cur_el = arm_current_el(env);
 579     unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
 580     uint32_t spsr = env->banked_spsr[spsr_idx];
 581     int new_el;
 582
 583     aarch64_save_sp(env, cur_el);
 584
 585     env->exclusive_addr = -1;
 586
 587     /* We must squash the PSTATE.SS bit to zero unless both of the
 588      * following hold:
 589      *  1. debug exceptions are currently disabled
 590      *  2. singlestep will be active in the EL we return to
 591      * We check 1 here and 2 after we've done the pstate/cpsr write() to
 592      * transition to the EL we're going to.
 593      */
 594     if (arm_generate_debug_exceptions(env)) {
 595         spsr &= ~PSTATE_SS;
 596     }
 597
 598     if (spsr & PSTATE_nRW) {
 599         /* TODO: We currently assume EL1/2/3 are running in AArch64.  */
 600         env->aarch64 = 0;
 601         new_el = 0;
 602         env->uncached_cpsr = 0x10;
 603         cpsr_write(env, spsr, ~0);
 604         if (!arm_singlestep_active(env)) {
 605             env->uncached_cpsr &= ~PSTATE_SS;
 606         }
 607         aarch64_sync_64_to_32(env);
 608
 609         env->regs[15] = env->elr_el[1] & ~0x1;
 610     } else {
 611         new_el = extract32(spsr, 2, 2);
 612         if (new_el > cur_el
 613             || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
 614             /* Disallow return to an EL which is unimplemented or higher
 615              * than the current one.
 616              */
 617             goto illegal_return;
 618         }
 619         if (extract32(spsr, 1, 1)) {
 620             /* Return with reserved M[1] bit set */
 621             goto illegal_return;
 622         }
 623         if (new_el == 0 && (spsr & PSTATE_SP)) {
 624             /* Return to EL0 with M[0] bit set */
 625             goto illegal_return;
 626         }
 627         env->aarch64 = 1;
 628         pstate_write(env, spsr);
 629         if (!arm_singlestep_active(env)) {
 630             env->pstate &= ~PSTATE_SS;
 631         }
 632         aarch64_restore_sp(env, new_el);
 633         env->pc = env->elr_el[cur_el];
 634     }
 635
 636     return;
 637
 638 illegal_return:
 639     /* Illegal return events of various kinds have architecturally
 640      * mandated behaviour:
 641      * restore NZCV and DAIF from SPSR_ELx
 642      * set PSTATE.IL
 643      * restore PC from ELR_ELx
 644      * no change to exception level, execution state or stack pointer
 645      */
 646     env->pstate |= PSTATE_IL;
 647     env->pc = env->elr_el[cur_el];
 648     spsr &= PSTATE_NZCV | PSTATE_DAIF;
 649     spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF);
 650     pstate_write(env, spsr);
 651     if (!arm_singlestep_active(env)) {
 652         env->pstate &= ~PSTATE_SS;
 653     }
 654 }
 655
 656 /* Return true if the linked breakpoint entry lbn passes its checks */
 657 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
 658 {
 659     CPUARMState *env = &cpu->env;
 660     uint64_t bcr = env->cp15.dbgbcr[lbn];
 661     int brps = extract32(cpu->dbgdidr, 24, 4);
 662     int ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
 663     int bt;
 664     uint32_t contextidr;
 665
 666     /* Links to unimplemented or non-context aware breakpoints are
 667      * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
 668      * as if linked to an UNKNOWN context-aware breakpoint (in which
 669      * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
 670      * We choose the former.
 671      */
 672     if (lbn > brps || lbn < (brps - ctx_cmps)) {
 673         return false;
 674     }
 675
 676     bcr = env->cp15.dbgbcr[lbn];
 677
 678     if (extract64(bcr, 0, 1) == 0) {
 679         /* Linked breakpoint disabled : generate no events */
 680         return false;
 681     }
 682
 683     bt = extract64(bcr, 20, 4);
 684
 685     /* We match the whole register even if this is AArch32 using the
 686      * short descriptor format (in which case it holds both PROCID and ASID),
 687      * since we don't implement the optional v7 context ID masking.
 688      */
 689     contextidr = extract64(env->cp15.contextidr_el[1], 0, 32);
 690
 691     switch (bt) {
 692     case 3: /* linked context ID match */
 693         if (arm_current_el(env) > 1) {
 694             /* Context matches never fire in EL2 or (AArch64) EL3 */
 695             return false;
 696         }
 697         return (contextidr == extract64(env->cp15.dbgbvr[lbn], 0, 32));
 698     case 5: /* linked address mismatch (reserved in AArch64) */
 699     case 9: /* linked VMID match (reserved if no EL2) */
 700     case 11: /* linked context ID and VMID match (reserved if no EL2) */
 701     default:
 702         /* Links to Unlinked context breakpoints must generate no
 703          * events; we choose to do the same for reserved values too.
 704          */
 705         return false;
 706     }
 707
 708     return false;
 709 }
 710
 711 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
 712 {
 713     CPUARMState *env = &cpu->env;
 714     uint64_t cr;
 715     int pac, hmc, ssc, wt, lbn;
 716     /* Note that for watchpoints the check is against the CPU security
 717      * state, not the S/NS attribute on the offending data access.
 718      */
 719     bool is_secure = arm_is_secure(env);
 720     int access_el = arm_current_el(env);
 721
 722     if (is_wp) {
 723         CPUWatchpoint *wp = env->cpu_watchpoint[n];
 724
 725         if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
 726             return false;
 727         }
 728         cr = env->cp15.dbgwcr[n];
 729         if (wp->hitattrs.user) {
 730             /* The LDRT/STRT/LDT/STT "unprivileged access" instructions should
 731              * match watchpoints as if they were accesses done at EL0, even if
 732              * the CPU is at EL1 or higher.
 733              */
 734             access_el = 0;
 735         }
 736     } else {
 737         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 738
 739         if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
 740             return false;
 741         }
 742         cr = env->cp15.dbgbcr[n];
 743     }
 744     /* The WATCHPOINT_HIT flag guarantees us that the watchpoint is
 745      * enabled and that the address and access type match; for breakpoints
 746      * we know the address matched; check the remaining fields, including
 747      * linked breakpoints. We rely on WCR and BCR having the same layout
 748      * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
 749      * Note that some combinations of {PAC, HMC, SSC} are reserved and
 750      * must act either like some valid combination or as if the watchpoint
 751      * were disabled. We choose the former, and use this together with
 752      * the fact that EL3 must always be Secure and EL2 must always be
 753      * Non-Secure to simplify the code slightly compared to the full
 754      * table in the ARM ARM.
 755      */
 756     pac = extract64(cr, 1, 2);
 757     hmc = extract64(cr, 13, 1);
 758     ssc = extract64(cr, 14, 2);
 759
 760     switch (ssc) {
 761     case 0:
 762         break;
 763     case 1:
 764     case 3:
 765         if (is_secure) {
 766             return false;
 767         }
 768         break;
 769     case 2:
 770         if (!is_secure) {
 771             return false;
 772         }
 773         break;
 774     }
 775
 776     switch (access_el) {
 777     case 3:
 778     case 2:
 779         if (!hmc) {
 780             return false;
 781         }
 782         break;
 783     case 1:
 784         if (extract32(pac, 0, 1) == 0) {
 785             return false;
 786         }
 787         break;
 788     case 0:
 789         if (extract32(pac, 1, 1) == 0) {
 790             return false;
 791         }
 792         break;
 793     default:
 794         g_assert_not_reached();
 795     }
 796
 797     wt = extract64(cr, 20, 1);
 798     lbn = extract64(cr, 16, 4);
 799
 800     if (wt && !linked_bp_matches(cpu, lbn)) {
 801         return false;
 802     }
 803
 804     return true;
 805 }
 806
 807 static bool check_watchpoints(ARMCPU *cpu)
 808 {
 809     CPUARMState *env = &cpu->env;
 810     int n;
 811
 812     /* If watchpoints are disabled globally or we can't take debug
 813      * exceptions here then watchpoint firings are ignored.
 814      */
 815     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 816         || !arm_generate_debug_exceptions(env)) {
 817         return false;
 818     }
 819
 820     for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
 821         if (bp_wp_matches(cpu, n, true)) {
 822             return true;
 823         }
 824     }
 825     return false;
 826 }
 827
 828 static bool check_breakpoints(ARMCPU *cpu)
 829 {
 830     CPUARMState *env = &cpu->env;
 831     int n;
 832
 833     /* If breakpoints are disabled globally or we can't take debug
 834      * exceptions here then breakpoint firings are ignored.
 835      */
 836     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 837         || !arm_generate_debug_exceptions(env)) {
 838         return false;
 839     }
 840
 841     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
 842         if (bp_wp_matches(cpu, n, false)) {
 843             return true;
 844         }
 845     }
 846     return false;
 847 }
 848
 849 void arm_debug_excp_handler(CPUState *cs)
 850 {
 851     /* Called by core code when a watchpoint or breakpoint fires;
 852      * need to check which one and raise the appropriate exception.
 853      */
 854     ARMCPU *cpu = ARM_CPU(cs);
 855     CPUARMState *env = &cpu->env;
 856     CPUWatchpoint *wp_hit = cs->watchpoint_hit;
 857
 858     if (wp_hit) {
 859         if (wp_hit->flags & BP_CPU) {
 860             cs->watchpoint_hit = NULL;
 861             if (check_watchpoints(cpu)) {
 862                 bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
 863                 bool same_el = arm_debug_target_el(env) == arm_current_el(env);
 864
 865                 if (extended_addresses_enabled(env)) {
 866                     env->exception.fsr = (1 << 9) | 0x22;
 867                 } else {
 868                     env->exception.fsr = 0x2;
 869                 }
 870                 env->exception.vaddress = wp_hit->hitaddr;
 871                 raise_exception(env, EXCP_DATA_ABORT,
 872                                 syn_watchpoint(same_el, 0, wnr),
 873                                 arm_debug_target_el(env));
 874             } else {
 875                 cpu_resume_from_signal(cs, NULL);
 876             }
 877         }
 878     } else {
 879         if (check_breakpoints(cpu)) {
 880             bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
 881             if (extended_addresses_enabled(env)) {
 882                 env->exception.fsr = (1 << 9) | 0x22;
 883             } else {
 884                 env->exception.fsr = 0x2;
 885             }
 886             /* FAR is UNKNOWN, so doesn't need setting */
 887             raise_exception(env, EXCP_PREFETCH_ABORT,
 888                             syn_breakpoint(same_el),
 889                             arm_debug_target_el(env));
 890         }
 891     }
 892 }
 893
 894 /* ??? Flag setting arithmetic is awkward because we need to do comparisons.
 895    The only way to do that in TCG is a conditional branch, which clobbers
 896    all our temporaries.  For now implement these as helper functions.  */
 897
 898 /* Similarly for variable shift instructions.  */
 899
 900 uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 901 {
 902     int shift = i & 0xff;
 903     if (shift >= 32) {
 904         if (shift == 32)
 905             env->CF = x & 1;
 906         else
 907             env->CF = 0;
 908         return 0;
 909     } else if (shift != 0) {
 910         env->CF = (x >> (32 - shift)) & 1;
 911         return x << shift;
 912     }
 913     return x;
 914 }
 915
 916 uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 917 {
 918     int shift = i & 0xff;
 919     if (shift >= 32) {
 920         if (shift == 32)
 921             env->CF = (x >> 31) & 1;
 922         else
 923             env->CF = 0;
 924         return 0;
 925     } else if (shift != 0) {
 926         env->CF = (x >> (shift - 1)) & 1;
 927         return x >> shift;
 928     }
 929     return x;
 930 }
 931
 932 uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 933 {
 934     int shift = i & 0xff;
 935     if (shift >= 32) {
 936         env->CF = (x >> 31) & 1;
 937         return (int32_t)x >> 31;
 938     } else if (shift != 0) {
 939         env->CF = (x >> (shift - 1)) & 1;
 940         return (int32_t)x >> shift;
 941     }
 942     return x;
 943 }
 944
 945 uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 946 {
 947     int shift1, shift;
 948     shift1 = i & 0xff;
 949     shift = shift1 & 0x1f;
 950     if (shift == 0) {
 951         if (shift1 != 0)
 952             env->CF = (x >> 31) & 1;
 953         return x;
 954     } else {
 955         env->CF = (x >> (shift - 1)) & 1;
 956         return ((uint32_t)x >> shift) | (x << (32 - shift));
 957     }
 958 }