Merge remote-tracking branch 'qemu/master'
[qemu/ar7.git] / target-arm / op_helper.c
blob9e5f7d63b563be808a66e85559b8e309a6637455
1 /*
2 * ARM helper routines
4 * Copyright (c) 2005-2007 CodeSourcery, LLC
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 #include "cpu.h"
21 #include "exec/helper-proto.h"
22 #include "internals.h"
23 #include "exec/cpu_ldst.h"
25 #define SIGNBIT (uint32_t)0x80000000
26 #define SIGNBIT64 ((uint64_t)1 << 63)
28 static void QEMU_NORETURN
29 raise_exception(CPUARMState *env, uint32_t excp,
30 uint32_t syndrome, uint32_t target_el)
32 CPUState *cs = CPU(arm_env_get_cpu(env));
34 assert(!excp_is_internal(excp));
35 cs->exception_index = excp;
36 env->exception.syndrome = syndrome;
37 env->exception.target_el = target_el;
38 cpu_loop_exit(cs);
41 static int exception_target_el(CPUARMState *env)
43 int target_el = MAX(1, arm_current_el(env));
45 /* No such thing as secure EL1 if EL3 is aarch32, so update the target EL
46 * to EL3 in this case.
48 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
49 target_el = 3;
52 return target_el;
55 uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
56 uint32_t rn, uint32_t maxindex)
58 uint32_t val;
59 uint32_t tmp;
60 int index;
61 int shift;
62 uint64_t *table;
63 table = (uint64_t *)&env->vfp.regs[rn];
64 val = 0;
65 for (shift = 0; shift < 32; shift += 8) {
66 index = (ireg >> shift) & 0xff;
67 if (index < maxindex) {
68 tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
69 val |= tmp << shift;
70 } else {
71 val |= def & (0xff << shift);
74 return val;
77 #if !defined(CONFIG_USER_ONLY)
79 /* try to fill the TLB and return an exception if error. If retaddr is
80 * NULL, it means that the function was called in C code (i.e. not
81 * from generated code or from helper.c)
83 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
84 uintptr_t retaddr)
86 bool ret;
87 uint32_t fsr = 0;
89 ret = arm_tlb_fill(cs, addr, is_write, mmu_idx, &fsr);
90 if (unlikely(ret)) {
91 ARMCPU *cpu = ARM_CPU(cs);
92 CPUARMState *env = &cpu->env;
93 uint32_t syn, exc;
94 bool same_el = (arm_current_el(env) != 0);
96 if (retaddr) {
97 /* now we have a real cpu fault */
98 cpu_restore_state(cs, retaddr);
101 /* AArch64 syndrome does not have an LPAE bit */
102 syn = fsr & ~(1 << 9);
104 /* For insn and data aborts we assume there is no instruction syndrome
105 * information; this is always true for exceptions reported to EL1.
107 if (is_write == 2) {
108 syn = syn_insn_abort(same_el, 0, 0, syn);
109 exc = EXCP_PREFETCH_ABORT;
110 } else {
111 syn = syn_data_abort(same_el, 0, 0, 0, is_write == 1, syn);
112 if (is_write == 1 && arm_feature(env, ARM_FEATURE_V6)) {
113 fsr |= (1 << 11);
115 exc = EXCP_DATA_ABORT;
118 env->exception.vaddress = addr;
119 env->exception.fsr = fsr;
120 raise_exception(env, exc, syn, exception_target_el(env));
123 #endif
125 uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
127 uint32_t res = a + b;
128 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
129 env->QF = 1;
130 return res;
133 uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
135 uint32_t res = a + b;
136 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
137 env->QF = 1;
138 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
140 return res;
143 uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
145 uint32_t res = a - b;
146 if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
147 env->QF = 1;
148 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
150 return res;
153 uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
155 uint32_t res;
156 if (val >= 0x40000000) {
157 res = ~SIGNBIT;
158 env->QF = 1;
159 } else if (val <= (int32_t)0xc0000000) {
160 res = SIGNBIT;
161 env->QF = 1;
162 } else {
163 res = val << 1;
165 return res;
168 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
170 uint32_t res = a + b;
171 if (res < a) {
172 env->QF = 1;
173 res = ~0;
175 return res;
178 uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
180 uint32_t res = a - b;
181 if (res > a) {
182 env->QF = 1;
183 res = 0;
185 return res;
188 /* Signed saturation. */
189 static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
191 int32_t top;
192 uint32_t mask;
194 top = val >> shift;
195 mask = (1u << shift) - 1;
196 if (top > 0) {
197 env->QF = 1;
198 return mask;
199 } else if (top < -1) {
200 env->QF = 1;
201 return ~mask;
203 return val;
206 /* Unsigned saturation. */
207 static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
209 uint32_t max;
211 max = (1u << shift) - 1;
212 if (val < 0) {
213 env->QF = 1;
214 return 0;
215 } else if (val > max) {
216 env->QF = 1;
217 return max;
219 return val;
222 /* Signed saturate. */
223 uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
225 return do_ssat(env, x, shift);
228 /* Dual halfword signed saturate. */
229 uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
231 uint32_t res;
233 res = (uint16_t)do_ssat(env, (int16_t)x, shift);
234 res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
235 return res;
238 /* Unsigned saturate. */
239 uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
241 return do_usat(env, x, shift);
244 /* Dual halfword unsigned saturate. */
245 uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
247 uint32_t res;
249 res = (uint16_t)do_usat(env, (int16_t)x, shift);
250 res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
251 return res;
254 /* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped.
255 * The function returns the target EL (1-3) if the instruction is to be trapped;
256 * otherwise it returns 0 indicating it is not trapped.
258 static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
260 int cur_el = arm_current_el(env);
261 uint64_t mask;
263 /* If we are currently in EL0 then we need to check if SCTLR is set up for
264 * WFx instructions being trapped to EL1. These trap bits don't exist in v7.
266 if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) {
267 int target_el;
269 mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI;
270 if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) {
271 /* Secure EL0 and Secure PL1 is at EL3 */
272 target_el = 3;
273 } else {
274 target_el = 1;
277 if (!(env->cp15.sctlr_el[target_el] & mask)) {
278 return target_el;
282 /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it
283 * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the
284 * bits will be zero indicating no trap.
286 if (cur_el < 2 && !arm_is_secure(env)) {
287 mask = (is_wfe) ? HCR_TWE : HCR_TWI;
288 if (env->cp15.hcr_el2 & mask) {
289 return 2;
293 /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */
294 if (cur_el < 3) {
295 mask = (is_wfe) ? SCR_TWE : SCR_TWI;
296 if (env->cp15.scr_el3 & mask) {
297 return 3;
301 return 0;
304 void HELPER(wfi)(CPUARMState *env)
306 CPUState *cs = CPU(arm_env_get_cpu(env));
307 int target_el = check_wfx_trap(env, false);
309 if (cpu_has_work(cs)) {
310 /* Don't bother to go into our "low power state" if
311 * we would just wake up immediately.
313 return;
316 if (target_el) {
317 env->pc -= 4;
318 raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0), target_el);
321 cs->exception_index = EXCP_HLT;
322 cs->halted = 1;
323 cpu_loop_exit(cs);
326 void QEMU_NORETURN HELPER(wfe)(CPUARMState *env)
328 /* This is a hint instruction that is semantically different
329 * from YIELD even though we currently implement it identically.
330 * Don't actually halt the CPU, just yield back to top
331 * level loop. This is not going into a "low power state"
332 * (ie halting until some event occurs), so we never take
333 * a configurable trap to a different exception level.
335 HELPER(yield)(env);
338 void QEMU_NORETURN HELPER(yield)(CPUARMState *env)
340 ARMCPU *cpu = arm_env_get_cpu(env);
341 CPUState *cs = CPU(cpu);
343 /* This is a non-trappable hint instruction that generally indicates
344 * that the guest is currently busy-looping. Yield control back to the
345 * top level loop so that a more deserving VCPU has a chance to run.
347 cs->exception_index = EXCP_YIELD;
348 cpu_loop_exit(cs);
351 /* Raise an internal-to-QEMU exception. This is limited to only
352 * those EXCP values which are special cases for QEMU to interrupt
353 * execution and not to be used for exceptions which are passed to
354 * the guest (those must all have syndrome information and thus should
355 * use exception_with_syndrome).
357 void QEMU_NORETURN HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
359 CPUState *cs = CPU(arm_env_get_cpu(env));
361 assert(excp_is_internal(excp));
362 cs->exception_index = excp;
363 cpu_loop_exit(cs);
366 /* Raise an exception with the specified syndrome register value */
367 void QEMU_NORETURN
368 HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
369 uint32_t syndrome, uint32_t target_el)
371 raise_exception(env, excp, syndrome, target_el);
374 uint32_t HELPER(cpsr_read)(CPUARMState *env)
376 return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED);
379 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
381 cpsr_write(env, val, mask);
384 /* Access to user mode registers from privileged modes. */
385 uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
387 uint32_t val;
389 if (regno == 13) {
390 val = env->banked_r13[0];
391 } else if (regno == 14) {
392 val = env->banked_r14[0];
393 } else if (regno >= 8
394 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
395 val = env->usr_regs[regno - 8];
396 } else {
397 val = env->regs[regno];
399 return val;
402 void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
404 if (regno == 13) {
405 env->banked_r13[0] = val;
406 } else if (regno == 14) {
407 env->banked_r14[0] = val;
408 } else if (regno >= 8
409 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
410 env->usr_regs[regno - 8] = val;
411 } else {
412 env->regs[regno] = val;
416 void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome)
418 const ARMCPRegInfo *ri = rip;
419 int target_el;
421 if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
422 && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
423 raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
426 if (!ri->accessfn) {
427 return;
430 switch (ri->accessfn(env, ri)) {
431 case CP_ACCESS_OK:
432 return;
433 case CP_ACCESS_TRAP:
434 target_el = exception_target_el(env);
435 break;
436 case CP_ACCESS_TRAP_EL2:
437 /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
438 * a bug in the access function.
440 assert(!arm_is_secure(env) && arm_current_el(env) != 3);
441 target_el = 2;
442 break;
443 case CP_ACCESS_TRAP_EL3:
444 target_el = 3;
445 break;
446 case CP_ACCESS_TRAP_UNCATEGORIZED:
447 target_el = exception_target_el(env);
448 syndrome = syn_uncategorized();
449 break;
450 case CP_ACCESS_TRAP_UNCATEGORIZED_EL2:
451 target_el = 2;
452 syndrome = syn_uncategorized();
453 break;
454 case CP_ACCESS_TRAP_UNCATEGORIZED_EL3:
455 target_el = 3;
456 syndrome = syn_uncategorized();
457 break;
458 default:
459 g_assert_not_reached();
462 raise_exception(env, EXCP_UDEF, syndrome, target_el);
465 void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
467 const ARMCPRegInfo *ri = rip;
469 ri->writefn(env, ri, value);
472 uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
474 const ARMCPRegInfo *ri = rip;
476 return ri->readfn(env, ri);
479 void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
481 const ARMCPRegInfo *ri = rip;
483 ri->writefn(env, ri, value);
486 uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
488 const ARMCPRegInfo *ri = rip;
490 return ri->readfn(env, ri);
493 void HELPER(msr_i_pstate)(CPUARMState *env, uint32_t op, uint32_t imm)
495 /* MSR_i to update PSTATE. This is OK from EL0 only if UMA is set.
496 * Note that SPSel is never OK from EL0; we rely on handle_msr_i()
497 * to catch that case at translate time.
499 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
500 uint32_t syndrome = syn_aa64_sysregtrap(0, extract32(op, 0, 3),
501 extract32(op, 3, 3), 4,
502 imm, 0x1f, 0);
503 raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
506 switch (op) {
507 case 0x05: /* SPSel */
508 update_spsel(env, imm);
509 break;
510 case 0x1e: /* DAIFSet */
511 env->daif |= (imm << 6) & PSTATE_DAIF;
512 break;
513 case 0x1f: /* DAIFClear */
514 env->daif &= ~((imm << 6) & PSTATE_DAIF);
515 break;
516 default:
517 g_assert_not_reached();
521 void HELPER(clear_pstate_ss)(CPUARMState *env)
523 env->pstate &= ~PSTATE_SS;
526 void HELPER(pre_hvc)(CPUARMState *env)
528 ARMCPU *cpu = arm_env_get_cpu(env);
529 int cur_el = arm_current_el(env);
530 /* FIXME: Use actual secure state. */
531 bool secure = false;
532 bool undef;
534 if (arm_is_psci_call(cpu, EXCP_HVC)) {
535 /* If PSCI is enabled and this looks like a valid PSCI call then
536 * that overrides the architecturally mandated HVC behaviour.
538 return;
541 if (!arm_feature(env, ARM_FEATURE_EL2)) {
542 /* If EL2 doesn't exist, HVC always UNDEFs */
543 undef = true;
544 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
545 /* EL3.HCE has priority over EL2.HCD. */
546 undef = !(env->cp15.scr_el3 & SCR_HCE);
547 } else {
548 undef = env->cp15.hcr_el2 & HCR_HCD;
551 /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
552 * For ARMv8/AArch64, HVC is allowed in EL3.
553 * Note that we've already trapped HVC from EL0 at translation
554 * time.
556 if (secure && (!is_a64(env) || cur_el == 1)) {
557 undef = true;
560 if (undef) {
561 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
562 exception_target_el(env));
566 void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
568 ARMCPU *cpu = arm_env_get_cpu(env);
569 int cur_el = arm_current_el(env);
570 bool secure = arm_is_secure(env);
571 bool smd = env->cp15.scr_el3 & SCR_SMD;
572 /* On ARMv8 AArch32, SMD only applies to NS state.
573 * On ARMv7 SMD only applies to NS state and only if EL2 is available.
574 * For ARMv7 non EL2, we force SMD to zero so we don't need to re-check
575 * the EL2 condition here.
577 bool undef = is_a64(env) ? smd : (!secure && smd);
579 if (arm_is_psci_call(cpu, EXCP_SMC)) {
580 /* If PSCI is enabled and this looks like a valid PSCI call then
581 * that overrides the architecturally mandated SMC behaviour.
583 return;
586 if (!arm_feature(env, ARM_FEATURE_EL3)) {
587 /* If we have no EL3 then SMC always UNDEFs */
588 undef = true;
589 } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
590 /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
591 raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
594 if (undef) {
595 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
596 exception_target_el(env));
600 void HELPER(exception_return)(CPUARMState *env)
602 int cur_el = arm_current_el(env);
603 unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
604 uint32_t spsr = env->banked_spsr[spsr_idx];
605 int new_el;
607 aarch64_save_sp(env, cur_el);
609 env->exclusive_addr = -1;
611 /* We must squash the PSTATE.SS bit to zero unless both of the
612 * following hold:
613 * 1. debug exceptions are currently disabled
614 * 2. singlestep will be active in the EL we return to
615 * We check 1 here and 2 after we've done the pstate/cpsr write() to
616 * transition to the EL we're going to.
618 if (arm_generate_debug_exceptions(env)) {
619 spsr &= ~PSTATE_SS;
622 if (spsr & PSTATE_nRW) {
623 /* TODO: We currently assume EL1/2/3 are running in AArch64. */
624 env->aarch64 = 0;
625 new_el = 0;
626 env->uncached_cpsr = 0x10;
627 cpsr_write(env, spsr, ~0);
628 if (!arm_singlestep_active(env)) {
629 env->uncached_cpsr &= ~PSTATE_SS;
631 aarch64_sync_64_to_32(env);
633 env->regs[15] = env->elr_el[1] & ~0x1;
634 } else {
635 new_el = extract32(spsr, 2, 2);
636 if (new_el > cur_el
637 || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
638 /* Disallow return to an EL which is unimplemented or higher
639 * than the current one.
641 goto illegal_return;
643 if (extract32(spsr, 1, 1)) {
644 /* Return with reserved M[1] bit set */
645 goto illegal_return;
647 if (new_el == 0 && (spsr & PSTATE_SP)) {
648 /* Return to EL0 with M[0] bit set */
649 goto illegal_return;
651 env->aarch64 = 1;
652 pstate_write(env, spsr);
653 if (!arm_singlestep_active(env)) {
654 env->pstate &= ~PSTATE_SS;
656 aarch64_restore_sp(env, new_el);
657 env->pc = env->elr_el[cur_el];
660 return;
662 illegal_return:
663 /* Illegal return events of various kinds have architecturally
664 * mandated behaviour:
665 * restore NZCV and DAIF from SPSR_ELx
666 * set PSTATE.IL
667 * restore PC from ELR_ELx
668 * no change to exception level, execution state or stack pointer
670 env->pstate |= PSTATE_IL;
671 env->pc = env->elr_el[cur_el];
672 spsr &= PSTATE_NZCV | PSTATE_DAIF;
673 spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF);
674 pstate_write(env, spsr);
675 if (!arm_singlestep_active(env)) {
676 env->pstate &= ~PSTATE_SS;
680 /* Return true if the linked breakpoint entry lbn passes its checks */
681 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
683 CPUARMState *env = &cpu->env;
684 uint64_t bcr = env->cp15.dbgbcr[lbn];
685 int brps = extract32(cpu->dbgdidr, 24, 4);
686 int ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
687 int bt;
688 uint32_t contextidr;
690 /* Links to unimplemented or non-context aware breakpoints are
691 * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
692 * as if linked to an UNKNOWN context-aware breakpoint (in which
693 * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
694 * We choose the former.
696 if (lbn > brps || lbn < (brps - ctx_cmps)) {
697 return false;
700 bcr = env->cp15.dbgbcr[lbn];
702 if (extract64(bcr, 0, 1) == 0) {
703 /* Linked breakpoint disabled : generate no events */
704 return false;
707 bt = extract64(bcr, 20, 4);
709 /* We match the whole register even if this is AArch32 using the
710 * short descriptor format (in which case it holds both PROCID and ASID),
711 * since we don't implement the optional v7 context ID masking.
713 contextidr = extract64(env->cp15.contextidr_el[1], 0, 32);
715 switch (bt) {
716 case 3: /* linked context ID match */
717 if (arm_current_el(env) > 1) {
718 /* Context matches never fire in EL2 or (AArch64) EL3 */
719 return false;
721 return (contextidr == extract64(env->cp15.dbgbvr[lbn], 0, 32));
722 case 5: /* linked address mismatch (reserved in AArch64) */
723 case 9: /* linked VMID match (reserved if no EL2) */
724 case 11: /* linked context ID and VMID match (reserved if no EL2) */
725 default:
726 /* Links to Unlinked context breakpoints must generate no
727 * events; we choose to do the same for reserved values too.
729 return false;
732 return false;
735 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
737 CPUARMState *env = &cpu->env;
738 uint64_t cr;
739 int pac, hmc, ssc, wt, lbn;
740 /* Note that for watchpoints the check is against the CPU security
741 * state, not the S/NS attribute on the offending data access.
743 bool is_secure = arm_is_secure(env);
744 int access_el = arm_current_el(env);
746 if (is_wp) {
747 CPUWatchpoint *wp = env->cpu_watchpoint[n];
749 if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
750 return false;
752 cr = env->cp15.dbgwcr[n];
753 if (wp->hitattrs.user) {
754 /* The LDRT/STRT/LDT/STT "unprivileged access" instructions should
755 * match watchpoints as if they were accesses done at EL0, even if
756 * the CPU is at EL1 or higher.
758 access_el = 0;
760 } else {
761 uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
763 if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
764 return false;
766 cr = env->cp15.dbgbcr[n];
768 /* The WATCHPOINT_HIT flag guarantees us that the watchpoint is
769 * enabled and that the address and access type match; for breakpoints
770 * we know the address matched; check the remaining fields, including
771 * linked breakpoints. We rely on WCR and BCR having the same layout
772 * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
773 * Note that some combinations of {PAC, HMC, SSC} are reserved and
774 * must act either like some valid combination or as if the watchpoint
775 * were disabled. We choose the former, and use this together with
776 * the fact that EL3 must always be Secure and EL2 must always be
777 * Non-Secure to simplify the code slightly compared to the full
778 * table in the ARM ARM.
780 pac = extract64(cr, 1, 2);
781 hmc = extract64(cr, 13, 1);
782 ssc = extract64(cr, 14, 2);
784 switch (ssc) {
785 case 0:
786 break;
787 case 1:
788 case 3:
789 if (is_secure) {
790 return false;
792 break;
793 case 2:
794 if (!is_secure) {
795 return false;
797 break;
800 switch (access_el) {
801 case 3:
802 case 2:
803 if (!hmc) {
804 return false;
806 break;
807 case 1:
808 if (extract32(pac, 0, 1) == 0) {
809 return false;
811 break;
812 case 0:
813 if (extract32(pac, 1, 1) == 0) {
814 return false;
816 break;
817 default:
818 g_assert_not_reached();
821 wt = extract64(cr, 20, 1);
822 lbn = extract64(cr, 16, 4);
824 if (wt && !linked_bp_matches(cpu, lbn)) {
825 return false;
828 return true;
831 static bool check_watchpoints(ARMCPU *cpu)
833 CPUARMState *env = &cpu->env;
834 int n;
836 /* If watchpoints are disabled globally or we can't take debug
837 * exceptions here then watchpoint firings are ignored.
839 if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
840 || !arm_generate_debug_exceptions(env)) {
841 return false;
844 for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
845 if (bp_wp_matches(cpu, n, true)) {
846 return true;
849 return false;
852 static bool check_breakpoints(ARMCPU *cpu)
854 CPUARMState *env = &cpu->env;
855 int n;
857 /* If breakpoints are disabled globally or we can't take debug
858 * exceptions here then breakpoint firings are ignored.
860 if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
861 || !arm_generate_debug_exceptions(env)) {
862 return false;
865 for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
866 if (bp_wp_matches(cpu, n, false)) {
867 return true;
870 return false;
873 void arm_debug_excp_handler(CPUState *cs)
875 /* Called by core code when a watchpoint or breakpoint fires;
876 * need to check which one and raise the appropriate exception.
878 ARMCPU *cpu = ARM_CPU(cs);
879 CPUARMState *env = &cpu->env;
880 CPUWatchpoint *wp_hit = cs->watchpoint_hit;
882 if (wp_hit) {
883 if (wp_hit->flags & BP_CPU) {
884 cs->watchpoint_hit = NULL;
885 if (check_watchpoints(cpu)) {
886 bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
887 bool same_el = arm_debug_target_el(env) == arm_current_el(env);
889 if (extended_addresses_enabled(env)) {
890 env->exception.fsr = (1 << 9) | 0x22;
891 } else {
892 env->exception.fsr = 0x2;
894 env->exception.vaddress = wp_hit->hitaddr;
895 raise_exception(env, EXCP_DATA_ABORT,
896 syn_watchpoint(same_el, 0, wnr),
897 arm_debug_target_el(env));
898 } else {
899 cpu_resume_from_signal(cs, NULL);
902 } else {
903 if (check_breakpoints(cpu)) {
904 bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
905 if (extended_addresses_enabled(env)) {
906 env->exception.fsr = (1 << 9) | 0x22;
907 } else {
908 env->exception.fsr = 0x2;
910 /* FAR is UNKNOWN, so doesn't need setting */
911 raise_exception(env, EXCP_PREFETCH_ABORT,
912 syn_breakpoint(same_el),
913 arm_debug_target_el(env));
918 /* ??? Flag setting arithmetic is awkward because we need to do comparisons.
919 The only way to do that in TCG is a conditional branch, which clobbers
920 all our temporaries. For now implement these as helper functions. */
922 /* Similarly for variable shift instructions. */
924 uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
926 int shift = i & 0xff;
927 if (shift >= 32) {
928 if (shift == 32)
929 env->CF = x & 1;
930 else
931 env->CF = 0;
932 return 0;
933 } else if (shift != 0) {
934 env->CF = (x >> (32 - shift)) & 1;
935 return x << shift;
937 return x;
940 uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
942 int shift = i & 0xff;
943 if (shift >= 32) {
944 if (shift == 32)
945 env->CF = (x >> 31) & 1;
946 else
947 env->CF = 0;
948 return 0;
949 } else if (shift != 0) {
950 env->CF = (x >> (shift - 1)) & 1;
951 return x >> shift;
953 return x;
956 uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
958 int shift = i & 0xff;
959 if (shift >= 32) {
960 env->CF = (x >> 31) & 1;
961 return (int32_t)x >> 31;
962 } else if (shift != 0) {
963 env->CF = (x >> (shift - 1)) & 1;
964 return (int32_t)x >> shift;
966 return x;
969 uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
971 int shift1, shift;
972 shift1 = i & 0xff;
973 shift = shift1 & 0x1f;
974 if (shift == 0) {
975 if (shift1 != 0)
976 env->CF = (x >> 31) & 1;
977 return x;
978 } else {
979 env->CF = (x >> (shift - 1)) & 1;
980 return ((uint32_t)x >> shift) | (x << (32 - shift));