target-arm/op_helper.c

   1 /*
   2  *  ARM helper routines
   3  *
   4  *  Copyright (c) 2005-2007 CodeSourcery, LLC
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "cpu.h"
  20 #include "exec/helper-proto.h"
  21 #include "internals.h"
  22 #include "exec/cpu_ldst.h"
  23
  24 #define SIGNBIT (uint32_t)0x80000000
  25 #define SIGNBIT64 ((uint64_t)1 << 63)
  26
  27 static void raise_exception(CPUARMState *env, int tt)
  28 {
  29     ARMCPU *cpu = arm_env_get_cpu(env);
  30     CPUState *cs = CPU(cpu);
  31
  32     cs->exception_index = tt;
  33     cpu_loop_exit(cs);
  34 }
  35
  36 static int exception_target_el(CPUARMState *env)
  37 {
  38     int target_el = MAX(1, arm_current_el(env));
  39
  40     /* No such thing as secure EL1 if EL3 is aarch32, so update the target EL
  41      * to EL3 in this case.
  42      */
  43     if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
  44         target_el = 3;
  45     }
  46
  47     return target_el;
  48 }
  49
  50 uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
  51                           uint32_t rn, uint32_t maxindex)
  52 {
  53     uint32_t val;
  54     uint32_t tmp;
  55     int index;
  56     int shift;
  57     uint64_t *table;
  58     table = (uint64_t *)&env->vfp.regs[rn];
  59     val = 0;
  60     for (shift = 0; shift < 32; shift += 8) {
  61         index = (ireg >> shift) & 0xff;
  62         if (index < maxindex) {
  63             tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
  64             val |= tmp << shift;
  65         } else {
  66             val |= def & (0xff << shift);
  67         }
  68     }
  69     return val;
  70 }
  71
  72 #if !defined(CONFIG_USER_ONLY)
  73
  74 /* try to fill the TLB and return an exception if error. If retaddr is
  75  * NULL, it means that the function was called in C code (i.e. not
  76  * from generated code or from helper.c)
  77  */
  78 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
  79               uintptr_t retaddr)
  80 {
  81     int ret;
  82
  83     ret = arm_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
  84     if (unlikely(ret)) {
  85         ARMCPU *cpu = ARM_CPU(cs);
  86         CPUARMState *env = &cpu->env;
  87
  88         if (retaddr) {
  89             /* now we have a real cpu fault */
  90             cpu_restore_state(cs, retaddr);
  91         }
  92         raise_exception(env, cs->exception_index);
  93     }
  94 }
  95 #endif
  96
  97 uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
  98 {
  99     uint32_t res = a + b;
 100     if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
 101         env->QF = 1;
 102     return res;
 103 }
 104
 105 uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
 106 {
 107     uint32_t res = a + b;
 108     if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
 109         env->QF = 1;
 110         res = ~(((int32_t)a >> 31) ^ SIGNBIT);
 111     }
 112     return res;
 113 }
 114
 115 uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
 116 {
 117     uint32_t res = a - b;
 118     if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
 119         env->QF = 1;
 120         res = ~(((int32_t)a >> 31) ^ SIGNBIT);
 121     }
 122     return res;
 123 }
 124
 125 uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
 126 {
 127     uint32_t res;
 128     if (val >= 0x40000000) {
 129         res = ~SIGNBIT;
 130         env->QF = 1;
 131     } else if (val <= (int32_t)0xc0000000) {
 132         res = SIGNBIT;
 133         env->QF = 1;
 134     } else {
 135         res = val << 1;
 136     }
 137     return res;
 138 }
 139
 140 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
 141 {
 142     uint32_t res = a + b;
 143     if (res < a) {
 144         env->QF = 1;
 145         res = ~0;
 146     }
 147     return res;
 148 }
 149
 150 uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
 151 {
 152     uint32_t res = a - b;
 153     if (res > a) {
 154         env->QF = 1;
 155         res = 0;
 156     }
 157     return res;
 158 }
 159
 160 /* Signed saturation.  */
 161 static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
 162 {
 163     int32_t top;
 164     uint32_t mask;
 165
 166     top = val >> shift;
 167     mask = (1u << shift) - 1;
 168     if (top > 0) {
 169         env->QF = 1;
 170         return mask;
 171     } else if (top < -1) {
 172         env->QF = 1;
 173         return ~mask;
 174     }
 175     return val;
 176 }
 177
 178 /* Unsigned saturation.  */
 179 static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
 180 {
 181     uint32_t max;
 182
 183     max = (1u << shift) - 1;
 184     if (val < 0) {
 185         env->QF = 1;
 186         return 0;
 187     } else if (val > max) {
 188         env->QF = 1;
 189         return max;
 190     }
 191     return val;
 192 }
 193
 194 /* Signed saturate.  */
 195 uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
 196 {
 197     return do_ssat(env, x, shift);
 198 }
 199
 200 /* Dual halfword signed saturate.  */
 201 uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
 202 {
 203     uint32_t res;
 204
 205     res = (uint16_t)do_ssat(env, (int16_t)x, shift);
 206     res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
 207     return res;
 208 }
 209
 210 /* Unsigned saturate.  */
 211 uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
 212 {
 213     return do_usat(env, x, shift);
 214 }
 215
 216 /* Dual halfword unsigned saturate.  */
 217 uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
 218 {
 219     uint32_t res;
 220
 221     res = (uint16_t)do_usat(env, (int16_t)x, shift);
 222     res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
 223     return res;
 224 }
 225
 226 void HELPER(wfi)(CPUARMState *env)
 227 {
 228     CPUState *cs = CPU(arm_env_get_cpu(env));
 229
 230     cs->exception_index = EXCP_HLT;
 231     cs->halted = 1;
 232     cpu_loop_exit(cs);
 233 }
 234
 235 void HELPER(wfe)(CPUARMState *env)
 236 {
 237     CPUState *cs = CPU(arm_env_get_cpu(env));
 238
 239     /* Don't actually halt the CPU, just yield back to top
 240      * level loop
 241      */
 242     cs->exception_index = EXCP_YIELD;
 243     cpu_loop_exit(cs);
 244 }
 245
 246 /* Raise an internal-to-QEMU exception. This is limited to only
 247  * those EXCP values which are special cases for QEMU to interrupt
 248  * execution and not to be used for exceptions which are passed to
 249  * the guest (those must all have syndrome information and thus should
 250  * use exception_with_syndrome).
 251  */
 252 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
 253 {
 254     CPUState *cs = CPU(arm_env_get_cpu(env));
 255
 256     assert(excp_is_internal(excp));
 257     cs->exception_index = excp;
 258     cpu_loop_exit(cs);
 259 }
 260
 261 /* Raise an exception with the specified syndrome register value */
 262 void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
 263                                      uint32_t syndrome, uint32_t target_el)
 264 {
 265     CPUState *cs = CPU(arm_env_get_cpu(env));
 266
 267     assert(!excp_is_internal(excp));
 268     cs->exception_index = excp;
 269     env->exception.syndrome = syndrome;
 270     env->exception.target_el = target_el;
 271     cpu_loop_exit(cs);
 272 }
 273
 274 uint32_t HELPER(cpsr_read)(CPUARMState *env)
 275 {
 276     return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED);
 277 }
 278
 279 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
 280 {
 281     cpsr_write(env, val, mask);
 282 }
 283
 284 /* Access to user mode registers from privileged modes.  */
 285 uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
 286 {
 287     uint32_t val;
 288
 289     if (regno == 13) {
 290         val = env->banked_r13[0];
 291     } else if (regno == 14) {
 292         val = env->banked_r14[0];
 293     } else if (regno >= 8
 294                && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
 295         val = env->usr_regs[regno - 8];
 296     } else {
 297         val = env->regs[regno];
 298     }
 299     return val;
 300 }
 301
 302 void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
 303 {
 304     if (regno == 13) {
 305         env->banked_r13[0] = val;
 306     } else if (regno == 14) {
 307         env->banked_r14[0] = val;
 308     } else if (regno >= 8
 309                && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
 310         env->usr_regs[regno - 8] = val;
 311     } else {
 312         env->regs[regno] = val;
 313     }
 314 }
 315
 316 void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome)
 317 {
 318     const ARMCPRegInfo *ri = rip;
 319
 320     if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
 321         && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
 322         env->exception.syndrome = syndrome;
 323         env->exception.target_el = exception_target_el(env);
 324         raise_exception(env, EXCP_UDEF);
 325     }
 326
 327     if (!ri->accessfn) {
 328         return;
 329     }
 330
 331     switch (ri->accessfn(env, ri)) {
 332     case CP_ACCESS_OK:
 333         return;
 334     case CP_ACCESS_TRAP:
 335         env->exception.syndrome = syndrome;
 336         env->exception.target_el = exception_target_el(env);
 337         break;
 338     case CP_ACCESS_TRAP_UNCATEGORIZED:
 339         env->exception.syndrome = syn_uncategorized();
 340         env->exception.target_el = exception_target_el(env);
 341         break;
 342     default:
 343         g_assert_not_reached();
 344     }
 345     raise_exception(env, EXCP_UDEF);
 346 }
 347
 348 void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
 349 {
 350     const ARMCPRegInfo *ri = rip;
 351
 352     ri->writefn(env, ri, value);
 353 }
 354
 355 uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
 356 {
 357     const ARMCPRegInfo *ri = rip;
 358
 359     return ri->readfn(env, ri);
 360 }
 361
 362 void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
 363 {
 364     const ARMCPRegInfo *ri = rip;
 365
 366     ri->writefn(env, ri, value);
 367 }
 368
 369 uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
 370 {
 371     const ARMCPRegInfo *ri = rip;
 372
 373     return ri->readfn(env, ri);
 374 }
 375
 376 void HELPER(msr_i_pstate)(CPUARMState *env, uint32_t op, uint32_t imm)
 377 {
 378     /* MSR_i to update PSTATE. This is OK from EL0 only if UMA is set.
 379      * Note that SPSel is never OK from EL0; we rely on handle_msr_i()
 380      * to catch that case at translate time.
 381      */
 382     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
 383         env->exception.target_el = exception_target_el(env);
 384         env->exception.syndrome = syn_aa64_sysregtrap(0, extract32(op, 0, 3),
 385                                                       extract32(op, 3, 3), 4,
 386                                                       imm, 0x1f, 0);
 387         raise_exception(env, EXCP_UDEF);
 388     }
 389
 390     switch (op) {
 391     case 0x05: /* SPSel */
 392         update_spsel(env, imm);
 393         break;
 394     case 0x1e: /* DAIFSet */
 395         env->daif |= (imm << 6) & PSTATE_DAIF;
 396         break;
 397     case 0x1f: /* DAIFClear */
 398         env->daif &= ~((imm << 6) & PSTATE_DAIF);
 399         break;
 400     default:
 401         g_assert_not_reached();
 402     }
 403 }
 404
 405 void HELPER(clear_pstate_ss)(CPUARMState *env)
 406 {
 407     env->pstate &= ~PSTATE_SS;
 408 }
 409
 410 void HELPER(pre_hvc)(CPUARMState *env)
 411 {
 412     ARMCPU *cpu = arm_env_get_cpu(env);
 413     int cur_el = arm_current_el(env);
 414     /* FIXME: Use actual secure state.  */
 415     bool secure = false;
 416     bool undef;
 417
 418     if (arm_is_psci_call(cpu, EXCP_HVC)) {
 419         /* If PSCI is enabled and this looks like a valid PSCI call then
 420          * that overrides the architecturally mandated HVC behaviour.
 421          */
 422         return;
 423     }
 424
 425     if (!arm_feature(env, ARM_FEATURE_EL2)) {
 426         /* If EL2 doesn't exist, HVC always UNDEFs */
 427         undef = true;
 428     } else if (arm_feature(env, ARM_FEATURE_EL3)) {
 429         /* EL3.HCE has priority over EL2.HCD. */
 430         undef = !(env->cp15.scr_el3 & SCR_HCE);
 431     } else {
 432         undef = env->cp15.hcr_el2 & HCR_HCD;
 433     }
 434
 435     /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
 436      * For ARMv8/AArch64, HVC is allowed in EL3.
 437      * Note that we've already trapped HVC from EL0 at translation
 438      * time.
 439      */
 440     if (secure && (!is_a64(env) || cur_el == 1)) {
 441         undef = true;
 442     }
 443
 444     if (undef) {
 445         env->exception.syndrome = syn_uncategorized();
 446         env->exception.target_el = exception_target_el(env);
 447         raise_exception(env, EXCP_UDEF);
 448     }
 449 }
 450
 451 void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
 452 {
 453     ARMCPU *cpu = arm_env_get_cpu(env);
 454     int cur_el = arm_current_el(env);
 455     bool secure = arm_is_secure(env);
 456     bool smd = env->cp15.scr_el3 & SCR_SMD;
 457     /* On ARMv8 AArch32, SMD only applies to NS state.
 458      * On ARMv7 SMD only applies to NS state and only if EL2 is available.
 459      * For ARMv7 non EL2, we force SMD to zero so we don't need to re-check
 460      * the EL2 condition here.
 461      */
 462     bool undef = is_a64(env) ? smd : (!secure && smd);
 463
 464     if (arm_is_psci_call(cpu, EXCP_SMC)) {
 465         /* If PSCI is enabled and this looks like a valid PSCI call then
 466          * that overrides the architecturally mandated SMC behaviour.
 467          */
 468         return;
 469     }
 470
 471     if (!arm_feature(env, ARM_FEATURE_EL3)) {
 472         /* If we have no EL3 then SMC always UNDEFs */
 473         undef = true;
 474     } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
 475         /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
 476         env->exception.syndrome = syndrome;
 477         env->exception.target_el = 2;
 478         raise_exception(env, EXCP_HYP_TRAP);
 479     }
 480
 481     if (undef) {
 482         env->exception.syndrome = syn_uncategorized();
 483         env->exception.target_el = exception_target_el(env);
 484         raise_exception(env, EXCP_UDEF);
 485     }
 486 }
 487
 488 void HELPER(exception_return)(CPUARMState *env)
 489 {
 490     int cur_el = arm_current_el(env);
 491     unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
 492     uint32_t spsr = env->banked_spsr[spsr_idx];
 493     int new_el;
 494
 495     aarch64_save_sp(env, cur_el);
 496
 497     env->exclusive_addr = -1;
 498
 499     /* We must squash the PSTATE.SS bit to zero unless both of the
 500      * following hold:
 501      *  1. debug exceptions are currently disabled
 502      *  2. singlestep will be active in the EL we return to
 503      * We check 1 here and 2 after we've done the pstate/cpsr write() to
 504      * transition to the EL we're going to.
 505      */
 506     if (arm_generate_debug_exceptions(env)) {
 507         spsr &= ~PSTATE_SS;
 508     }
 509
 510     if (spsr & PSTATE_nRW) {
 511         /* TODO: We currently assume EL1/2/3 are running in AArch64.  */
 512         env->aarch64 = 0;
 513         new_el = 0;
 514         env->uncached_cpsr = 0x10;
 515         cpsr_write(env, spsr, ~0);
 516         if (!arm_singlestep_active(env)) {
 517             env->uncached_cpsr &= ~PSTATE_SS;
 518         }
 519         aarch64_sync_64_to_32(env);
 520
 521         env->regs[15] = env->elr_el[1] & ~0x1;
 522     } else {
 523         new_el = extract32(spsr, 2, 2);
 524         if (new_el > cur_el
 525             || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
 526             /* Disallow return to an EL which is unimplemented or higher
 527              * than the current one.
 528              */
 529             goto illegal_return;
 530         }
 531         if (extract32(spsr, 1, 1)) {
 532             /* Return with reserved M[1] bit set */
 533             goto illegal_return;
 534         }
 535         if (new_el == 0 && (spsr & PSTATE_SP)) {
 536             /* Return to EL0 with M[0] bit set */
 537             goto illegal_return;
 538         }
 539         env->aarch64 = 1;
 540         pstate_write(env, spsr);
 541         if (!arm_singlestep_active(env)) {
 542             env->pstate &= ~PSTATE_SS;
 543         }
 544         aarch64_restore_sp(env, new_el);
 545         env->pc = env->elr_el[cur_el];
 546     }
 547
 548     return;
 549
 550 illegal_return:
 551     /* Illegal return events of various kinds have architecturally
 552      * mandated behaviour:
 553      * restore NZCV and DAIF from SPSR_ELx
 554      * set PSTATE.IL
 555      * restore PC from ELR_ELx
 556      * no change to exception level, execution state or stack pointer
 557      */
 558     env->pstate |= PSTATE_IL;
 559     env->pc = env->elr_el[cur_el];
 560     spsr &= PSTATE_NZCV | PSTATE_DAIF;
 561     spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF);
 562     pstate_write(env, spsr);
 563     if (!arm_singlestep_active(env)) {
 564         env->pstate &= ~PSTATE_SS;
 565     }
 566 }
 567
 568 /* Return true if the linked breakpoint entry lbn passes its checks */
 569 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
 570 {
 571     CPUARMState *env = &cpu->env;
 572     uint64_t bcr = env->cp15.dbgbcr[lbn];
 573     int brps = extract32(cpu->dbgdidr, 24, 4);
 574     int ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
 575     int bt;
 576     uint32_t contextidr;
 577
 578     /* Links to unimplemented or non-context aware breakpoints are
 579      * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
 580      * as if linked to an UNKNOWN context-aware breakpoint (in which
 581      * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
 582      * We choose the former.
 583      */
 584     if (lbn > brps || lbn < (brps - ctx_cmps)) {
 585         return false;
 586     }
 587
 588     bcr = env->cp15.dbgbcr[lbn];
 589
 590     if (extract64(bcr, 0, 1) == 0) {
 591         /* Linked breakpoint disabled : generate no events */
 592         return false;
 593     }
 594
 595     bt = extract64(bcr, 20, 4);
 596
 597     /* We match the whole register even if this is AArch32 using the
 598      * short descriptor format (in which case it holds both PROCID and ASID),
 599      * since we don't implement the optional v7 context ID masking.
 600      */
 601     contextidr = extract64(env->cp15.contextidr_el[1], 0, 32);
 602
 603     switch (bt) {
 604     case 3: /* linked context ID match */
 605         if (arm_current_el(env) > 1) {
 606             /* Context matches never fire in EL2 or (AArch64) EL3 */
 607             return false;
 608         }
 609         return (contextidr == extract64(env->cp15.dbgbvr[lbn], 0, 32));
 610     case 5: /* linked address mismatch (reserved in AArch64) */
 611     case 9: /* linked VMID match (reserved if no EL2) */
 612     case 11: /* linked context ID and VMID match (reserved if no EL2) */
 613     default:
 614         /* Links to Unlinked context breakpoints must generate no
 615          * events; we choose to do the same for reserved values too.
 616          */
 617         return false;
 618     }
 619
 620     return false;
 621 }
 622
 623 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
 624 {
 625     CPUARMState *env = &cpu->env;
 626     uint64_t cr;
 627     int pac, hmc, ssc, wt, lbn;
 628     /* Note that for watchpoints the check is against the CPU security
 629      * state, not the S/NS attribute on the offending data access.
 630      */
 631     bool is_secure = arm_is_secure(env);
 632     int access_el = arm_current_el(env);
 633
 634     if (is_wp) {
 635         CPUWatchpoint *wp = env->cpu_watchpoint[n];
 636
 637         if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
 638             return false;
 639         }
 640         cr = env->cp15.dbgwcr[n];
 641         if (wp->hitattrs.user) {
 642             /* The LDRT/STRT/LDT/STT "unprivileged access" instructions should
 643              * match watchpoints as if they were accesses done at EL0, even if
 644              * the CPU is at EL1 or higher.
 645              */
 646             access_el = 0;
 647         }
 648     } else {
 649         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 650
 651         if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
 652             return false;
 653         }
 654         cr = env->cp15.dbgbcr[n];
 655     }
 656     /* The WATCHPOINT_HIT flag guarantees us that the watchpoint is
 657      * enabled and that the address and access type match; for breakpoints
 658      * we know the address matched; check the remaining fields, including
 659      * linked breakpoints. We rely on WCR and BCR having the same layout
 660      * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
 661      * Note that some combinations of {PAC, HMC, SSC} are reserved and
 662      * must act either like some valid combination or as if the watchpoint
 663      * were disabled. We choose the former, and use this together with
 664      * the fact that EL3 must always be Secure and EL2 must always be
 665      * Non-Secure to simplify the code slightly compared to the full
 666      * table in the ARM ARM.
 667      */
 668     pac = extract64(cr, 1, 2);
 669     hmc = extract64(cr, 13, 1);
 670     ssc = extract64(cr, 14, 2);
 671
 672     switch (ssc) {
 673     case 0:
 674         break;
 675     case 1:
 676     case 3:
 677         if (is_secure) {
 678             return false;
 679         }
 680         break;
 681     case 2:
 682         if (!is_secure) {
 683             return false;
 684         }
 685         break;
 686     }
 687
 688     switch (access_el) {
 689     case 3:
 690     case 2:
 691         if (!hmc) {
 692             return false;
 693         }
 694         break;
 695     case 1:
 696         if (extract32(pac, 0, 1) == 0) {
 697             return false;
 698         }
 699         break;
 700     case 0:
 701         if (extract32(pac, 1, 1) == 0) {
 702             return false;
 703         }
 704         break;
 705     default:
 706         g_assert_not_reached();
 707     }
 708
 709     wt = extract64(cr, 20, 1);
 710     lbn = extract64(cr, 16, 4);
 711
 712     if (wt && !linked_bp_matches(cpu, lbn)) {
 713         return false;
 714     }
 715
 716     return true;
 717 }
 718
 719 static bool check_watchpoints(ARMCPU *cpu)
 720 {
 721     CPUARMState *env = &cpu->env;
 722     int n;
 723
 724     /* If watchpoints are disabled globally or we can't take debug
 725      * exceptions here then watchpoint firings are ignored.
 726      */
 727     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 728         || !arm_generate_debug_exceptions(env)) {
 729         return false;
 730     }
 731
 732     for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
 733         if (bp_wp_matches(cpu, n, true)) {
 734             return true;
 735         }
 736     }
 737     return false;
 738 }
 739
 740 static bool check_breakpoints(ARMCPU *cpu)
 741 {
 742     CPUARMState *env = &cpu->env;
 743     int n;
 744
 745     /* If breakpoints are disabled globally or we can't take debug
 746      * exceptions here then breakpoint firings are ignored.
 747      */
 748     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 749         || !arm_generate_debug_exceptions(env)) {
 750         return false;
 751     }
 752
 753     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
 754         if (bp_wp_matches(cpu, n, false)) {
 755             return true;
 756         }
 757     }
 758     return false;
 759 }
 760
 761 void arm_debug_excp_handler(CPUState *cs)
 762 {
 763     /* Called by core code when a watchpoint or breakpoint fires;
 764      * need to check which one and raise the appropriate exception.
 765      */
 766     ARMCPU *cpu = ARM_CPU(cs);
 767     CPUARMState *env = &cpu->env;
 768     CPUWatchpoint *wp_hit = cs->watchpoint_hit;
 769
 770     if (wp_hit) {
 771         if (wp_hit->flags & BP_CPU) {
 772             cs->watchpoint_hit = NULL;
 773             if (check_watchpoints(cpu)) {
 774                 bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
 775                 bool same_el = arm_debug_target_el(env) == arm_current_el(env);
 776
 777                 env->exception.syndrome = syn_watchpoint(same_el, 0, wnr);
 778                 if (extended_addresses_enabled(env)) {
 779                     env->exception.fsr = (1 << 9) | 0x22;
 780                 } else {
 781                     env->exception.fsr = 0x2;
 782                 }
 783                 env->exception.vaddress = wp_hit->hitaddr;
 784                 raise_exception(env, EXCP_DATA_ABORT);
 785             } else {
 786                 cpu_resume_from_signal(cs, NULL);
 787             }
 788         }
 789     } else {
 790         if (check_breakpoints(cpu)) {
 791             bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
 792             env->exception.syndrome = syn_breakpoint(same_el);
 793             if (extended_addresses_enabled(env)) {
 794                 env->exception.fsr = (1 << 9) | 0x22;
 795             } else {
 796                 env->exception.fsr = 0x2;
 797             }
 798             /* FAR is UNKNOWN, so doesn't need setting */
 799             raise_exception(env, EXCP_PREFETCH_ABORT);
 800         }
 801     }
 802 }
 803
 804 /* ??? Flag setting arithmetic is awkward because we need to do comparisons.
 805    The only way to do that in TCG is a conditional branch, which clobbers
 806    all our temporaries.  For now implement these as helper functions.  */
 807
 808 /* Similarly for variable shift instructions.  */
 809
 810 uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 811 {
 812     int shift = i & 0xff;
 813     if (shift >= 32) {
 814         if (shift == 32)
 815             env->CF = x & 1;
 816         else
 817             env->CF = 0;
 818         return 0;
 819     } else if (shift != 0) {
 820         env->CF = (x >> (32 - shift)) & 1;
 821         return x << shift;
 822     }
 823     return x;
 824 }
 825
 826 uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 827 {
 828     int shift = i & 0xff;
 829     if (shift >= 32) {
 830         if (shift == 32)
 831             env->CF = (x >> 31) & 1;
 832         else
 833             env->CF = 0;
 834         return 0;
 835     } else if (shift != 0) {
 836         env->CF = (x >> (shift - 1)) & 1;
 837         return x >> shift;
 838     }
 839     return x;
 840 }
 841
 842 uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 843 {
 844     int shift = i & 0xff;
 845     if (shift >= 32) {
 846         env->CF = (x >> 31) & 1;
 847         return (int32_t)x >> 31;
 848     } else if (shift != 0) {
 849         env->CF = (x >> (shift - 1)) & 1;
 850         return (int32_t)x >> shift;
 851     }
 852     return x;
 853 }
 854
 855 uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 856 {
 857     int shift1, shift;
 858     shift1 = i & 0xff;
 859     shift = shift1 & 0x1f;
 860     if (shift == 0) {
 861         if (shift1 != 0)
 862             env->CF = (x >> 31) & 1;
 863         return x;
 864     } else {
 865         env->CF = (x >> (shift - 1)) & 1;
 866         return ((uint32_t)x >> shift) | (x << (32 - shift));
 867     }
 868 }