error: Clean up errors with embedded newlines (again)
[qemu/ar7.git] / target-arm / op_helper.c
blobe42d287d9ca178072456607b1b15e4506b6c3f15
1 /*
2 * ARM helper routines
4 * Copyright (c) 2005-2007 CodeSourcery, LLC
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19 #include "cpu.h"
20 #include "exec/helper-proto.h"
21 #include "internals.h"
22 #include "exec/cpu_ldst.h"
24 #define SIGNBIT (uint32_t)0x80000000
25 #define SIGNBIT64 ((uint64_t)1 << 63)
27 static void raise_exception(CPUARMState *env, uint32_t excp,
28 uint32_t syndrome, uint32_t target_el)
30 CPUState *cs = CPU(arm_env_get_cpu(env));
32 assert(!excp_is_internal(excp));
33 cs->exception_index = excp;
34 env->exception.syndrome = syndrome;
35 env->exception.target_el = target_el;
36 cpu_loop_exit(cs);
39 static int exception_target_el(CPUARMState *env)
41 int target_el = MAX(1, arm_current_el(env));
43 /* No such thing as secure EL1 if EL3 is aarch32, so update the target EL
44 * to EL3 in this case.
46 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
47 target_el = 3;
50 return target_el;
53 uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
54 uint32_t rn, uint32_t maxindex)
56 uint32_t val;
57 uint32_t tmp;
58 int index;
59 int shift;
60 uint64_t *table;
61 table = (uint64_t *)&env->vfp.regs[rn];
62 val = 0;
63 for (shift = 0; shift < 32; shift += 8) {
64 index = (ireg >> shift) & 0xff;
65 if (index < maxindex) {
66 tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
67 val |= tmp << shift;
68 } else {
69 val |= def & (0xff << shift);
72 return val;
75 #if !defined(CONFIG_USER_ONLY)
77 /* try to fill the TLB and return an exception if error. If retaddr is
78 * NULL, it means that the function was called in C code (i.e. not
79 * from generated code or from helper.c)
81 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
82 uintptr_t retaddr)
84 bool ret;
85 uint32_t fsr = 0;
86 ARMMMUFaultInfo fi = {};
88 ret = arm_tlb_fill(cs, addr, is_write, mmu_idx, &fsr, &fi);
89 if (unlikely(ret)) {
90 ARMCPU *cpu = ARM_CPU(cs);
91 CPUARMState *env = &cpu->env;
92 uint32_t syn, exc;
93 unsigned int target_el;
94 bool same_el;
96 if (retaddr) {
97 /* now we have a real cpu fault */
98 cpu_restore_state(cs, retaddr);
101 target_el = exception_target_el(env);
102 if (fi.stage2) {
103 target_el = 2;
104 env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4;
106 same_el = arm_current_el(env) == target_el;
107 /* AArch64 syndrome does not have an LPAE bit */
108 syn = fsr & ~(1 << 9);
110 /* For insn and data aborts we assume there is no instruction syndrome
111 * information; this is always true for exceptions reported to EL1.
113 if (is_write == 2) {
114 syn = syn_insn_abort(same_el, 0, fi.s1ptw, syn);
115 exc = EXCP_PREFETCH_ABORT;
116 } else {
117 syn = syn_data_abort(same_el, 0, 0, fi.s1ptw, is_write == 1, syn);
118 if (is_write == 1 && arm_feature(env, ARM_FEATURE_V6)) {
119 fsr |= (1 << 11);
121 exc = EXCP_DATA_ABORT;
124 env->exception.vaddress = addr;
125 env->exception.fsr = fsr;
126 raise_exception(env, exc, syn, target_el);
130 /* Raise a data fault alignment exception for the specified virtual address */
131 void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr, int is_write,
132 int is_user, uintptr_t retaddr)
134 ARMCPU *cpu = ARM_CPU(cs);
135 CPUARMState *env = &cpu->env;
136 int target_el;
137 bool same_el;
139 if (retaddr) {
140 /* now we have a real cpu fault */
141 cpu_restore_state(cs, retaddr);
144 target_el = exception_target_el(env);
145 same_el = (arm_current_el(env) == target_el);
147 env->exception.vaddress = vaddr;
149 /* the DFSR for an alignment fault depends on whether we're using
150 * the LPAE long descriptor format, or the short descriptor format
152 if (arm_regime_using_lpae_format(env, cpu_mmu_index(env, false))) {
153 env->exception.fsr = 0x21;
154 } else {
155 env->exception.fsr = 0x1;
158 if (is_write == 1 && arm_feature(env, ARM_FEATURE_V6)) {
159 env->exception.fsr |= (1 << 11);
162 raise_exception(env, EXCP_DATA_ABORT,
163 syn_data_abort(same_el, 0, 0, 0, is_write == 1, 0x21),
164 target_el);
167 #endif /* !defined(CONFIG_USER_ONLY) */
169 uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
171 uint32_t res = a + b;
172 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
173 env->QF = 1;
174 return res;
177 uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
179 uint32_t res = a + b;
180 if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
181 env->QF = 1;
182 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
184 return res;
187 uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
189 uint32_t res = a - b;
190 if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
191 env->QF = 1;
192 res = ~(((int32_t)a >> 31) ^ SIGNBIT);
194 return res;
197 uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
199 uint32_t res;
200 if (val >= 0x40000000) {
201 res = ~SIGNBIT;
202 env->QF = 1;
203 } else if (val <= (int32_t)0xc0000000) {
204 res = SIGNBIT;
205 env->QF = 1;
206 } else {
207 res = val << 1;
209 return res;
212 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
214 uint32_t res = a + b;
215 if (res < a) {
216 env->QF = 1;
217 res = ~0;
219 return res;
222 uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
224 uint32_t res = a - b;
225 if (res > a) {
226 env->QF = 1;
227 res = 0;
229 return res;
232 /* Signed saturation. */
233 static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
235 int32_t top;
236 uint32_t mask;
238 top = val >> shift;
239 mask = (1u << shift) - 1;
240 if (top > 0) {
241 env->QF = 1;
242 return mask;
243 } else if (top < -1) {
244 env->QF = 1;
245 return ~mask;
247 return val;
250 /* Unsigned saturation. */
251 static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
253 uint32_t max;
255 max = (1u << shift) - 1;
256 if (val < 0) {
257 env->QF = 1;
258 return 0;
259 } else if (val > max) {
260 env->QF = 1;
261 return max;
263 return val;
266 /* Signed saturate. */
267 uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
269 return do_ssat(env, x, shift);
272 /* Dual halfword signed saturate. */
273 uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
275 uint32_t res;
277 res = (uint16_t)do_ssat(env, (int16_t)x, shift);
278 res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
279 return res;
282 /* Unsigned saturate. */
283 uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
285 return do_usat(env, x, shift);
288 /* Dual halfword unsigned saturate. */
289 uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
291 uint32_t res;
293 res = (uint16_t)do_usat(env, (int16_t)x, shift);
294 res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
295 return res;
298 /* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped.
299 * The function returns the target EL (1-3) if the instruction is to be trapped;
300 * otherwise it returns 0 indicating it is not trapped.
302 static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
304 int cur_el = arm_current_el(env);
305 uint64_t mask;
307 /* If we are currently in EL0 then we need to check if SCTLR is set up for
308 * WFx instructions being trapped to EL1. These trap bits don't exist in v7.
310 if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) {
311 int target_el;
313 mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI;
314 if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) {
315 /* Secure EL0 and Secure PL1 is at EL3 */
316 target_el = 3;
317 } else {
318 target_el = 1;
321 if (!(env->cp15.sctlr_el[target_el] & mask)) {
322 return target_el;
326 /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it
327 * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the
328 * bits will be zero indicating no trap.
330 if (cur_el < 2 && !arm_is_secure(env)) {
331 mask = (is_wfe) ? HCR_TWE : HCR_TWI;
332 if (env->cp15.hcr_el2 & mask) {
333 return 2;
337 /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */
338 if (cur_el < 3) {
339 mask = (is_wfe) ? SCR_TWE : SCR_TWI;
340 if (env->cp15.scr_el3 & mask) {
341 return 3;
345 return 0;
348 void HELPER(wfi)(CPUARMState *env)
350 CPUState *cs = CPU(arm_env_get_cpu(env));
351 int target_el = check_wfx_trap(env, false);
353 if (cpu_has_work(cs)) {
354 /* Don't bother to go into our "low power state" if
355 * we would just wake up immediately.
357 return;
360 if (target_el) {
361 env->pc -= 4;
362 raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0), target_el);
365 cs->exception_index = EXCP_HLT;
366 cs->halted = 1;
367 cpu_loop_exit(cs);
370 void HELPER(wfe)(CPUARMState *env)
372 /* This is a hint instruction that is semantically different
373 * from YIELD even though we currently implement it identically.
374 * Don't actually halt the CPU, just yield back to top
375 * level loop. This is not going into a "low power state"
376 * (ie halting until some event occurs), so we never take
377 * a configurable trap to a different exception level.
379 HELPER(yield)(env);
382 void HELPER(yield)(CPUARMState *env)
384 ARMCPU *cpu = arm_env_get_cpu(env);
385 CPUState *cs = CPU(cpu);
387 /* This is a non-trappable hint instruction that generally indicates
388 * that the guest is currently busy-looping. Yield control back to the
389 * top level loop so that a more deserving VCPU has a chance to run.
391 cs->exception_index = EXCP_YIELD;
392 cpu_loop_exit(cs);
395 /* Raise an internal-to-QEMU exception. This is limited to only
396 * those EXCP values which are special cases for QEMU to interrupt
397 * execution and not to be used for exceptions which are passed to
398 * the guest (those must all have syndrome information and thus should
399 * use exception_with_syndrome).
401 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
403 CPUState *cs = CPU(arm_env_get_cpu(env));
405 assert(excp_is_internal(excp));
406 cs->exception_index = excp;
407 cpu_loop_exit(cs);
410 /* Raise an exception with the specified syndrome register value */
411 void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
412 uint32_t syndrome, uint32_t target_el)
414 raise_exception(env, excp, syndrome, target_el);
417 uint32_t HELPER(cpsr_read)(CPUARMState *env)
419 return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED);
422 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
424 cpsr_write(env, val, mask);
427 /* Access to user mode registers from privileged modes. */
428 uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
430 uint32_t val;
432 if (regno == 13) {
433 val = env->banked_r13[BANK_USRSYS];
434 } else if (regno == 14) {
435 val = env->banked_r14[BANK_USRSYS];
436 } else if (regno >= 8
437 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
438 val = env->usr_regs[regno - 8];
439 } else {
440 val = env->regs[regno];
442 return val;
445 void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
447 if (regno == 13) {
448 env->banked_r13[BANK_USRSYS] = val;
449 } else if (regno == 14) {
450 env->banked_r14[BANK_USRSYS] = val;
451 } else if (regno >= 8
452 && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
453 env->usr_regs[regno - 8] = val;
454 } else {
455 env->regs[regno] = val;
459 void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome)
461 const ARMCPRegInfo *ri = rip;
462 int target_el;
464 if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
465 && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
466 raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
469 if (!ri->accessfn) {
470 return;
473 switch (ri->accessfn(env, ri)) {
474 case CP_ACCESS_OK:
475 return;
476 case CP_ACCESS_TRAP:
477 target_el = exception_target_el(env);
478 break;
479 case CP_ACCESS_TRAP_EL2:
480 /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
481 * a bug in the access function.
483 assert(!arm_is_secure(env) && arm_current_el(env) != 3);
484 target_el = 2;
485 break;
486 case CP_ACCESS_TRAP_EL3:
487 target_el = 3;
488 break;
489 case CP_ACCESS_TRAP_UNCATEGORIZED:
490 target_el = exception_target_el(env);
491 syndrome = syn_uncategorized();
492 break;
493 case CP_ACCESS_TRAP_UNCATEGORIZED_EL2:
494 target_el = 2;
495 syndrome = syn_uncategorized();
496 break;
497 case CP_ACCESS_TRAP_UNCATEGORIZED_EL3:
498 target_el = 3;
499 syndrome = syn_uncategorized();
500 break;
501 default:
502 g_assert_not_reached();
505 raise_exception(env, EXCP_UDEF, syndrome, target_el);
508 void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
510 const ARMCPRegInfo *ri = rip;
512 ri->writefn(env, ri, value);
515 uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
517 const ARMCPRegInfo *ri = rip;
519 return ri->readfn(env, ri);
522 void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
524 const ARMCPRegInfo *ri = rip;
526 ri->writefn(env, ri, value);
529 uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
531 const ARMCPRegInfo *ri = rip;
533 return ri->readfn(env, ri);
536 void HELPER(msr_i_pstate)(CPUARMState *env, uint32_t op, uint32_t imm)
538 /* MSR_i to update PSTATE. This is OK from EL0 only if UMA is set.
539 * Note that SPSel is never OK from EL0; we rely on handle_msr_i()
540 * to catch that case at translate time.
542 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
543 uint32_t syndrome = syn_aa64_sysregtrap(0, extract32(op, 0, 3),
544 extract32(op, 3, 3), 4,
545 imm, 0x1f, 0);
546 raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
549 switch (op) {
550 case 0x05: /* SPSel */
551 update_spsel(env, imm);
552 break;
553 case 0x1e: /* DAIFSet */
554 env->daif |= (imm << 6) & PSTATE_DAIF;
555 break;
556 case 0x1f: /* DAIFClear */
557 env->daif &= ~((imm << 6) & PSTATE_DAIF);
558 break;
559 default:
560 g_assert_not_reached();
564 void HELPER(clear_pstate_ss)(CPUARMState *env)
566 env->pstate &= ~PSTATE_SS;
569 void HELPER(pre_hvc)(CPUARMState *env)
571 ARMCPU *cpu = arm_env_get_cpu(env);
572 int cur_el = arm_current_el(env);
573 /* FIXME: Use actual secure state. */
574 bool secure = false;
575 bool undef;
577 if (arm_is_psci_call(cpu, EXCP_HVC)) {
578 /* If PSCI is enabled and this looks like a valid PSCI call then
579 * that overrides the architecturally mandated HVC behaviour.
581 return;
584 if (!arm_feature(env, ARM_FEATURE_EL2)) {
585 /* If EL2 doesn't exist, HVC always UNDEFs */
586 undef = true;
587 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
588 /* EL3.HCE has priority over EL2.HCD. */
589 undef = !(env->cp15.scr_el3 & SCR_HCE);
590 } else {
591 undef = env->cp15.hcr_el2 & HCR_HCD;
594 /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
595 * For ARMv8/AArch64, HVC is allowed in EL3.
596 * Note that we've already trapped HVC from EL0 at translation
597 * time.
599 if (secure && (!is_a64(env) || cur_el == 1)) {
600 undef = true;
603 if (undef) {
604 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
605 exception_target_el(env));
609 void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
611 ARMCPU *cpu = arm_env_get_cpu(env);
612 int cur_el = arm_current_el(env);
613 bool secure = arm_is_secure(env);
614 bool smd = env->cp15.scr_el3 & SCR_SMD;
615 /* On ARMv8 AArch32, SMD only applies to NS state.
616 * On ARMv7 SMD only applies to NS state and only if EL2 is available.
617 * For ARMv7 non EL2, we force SMD to zero so we don't need to re-check
618 * the EL2 condition here.
620 bool undef = is_a64(env) ? smd : (!secure && smd);
622 if (arm_is_psci_call(cpu, EXCP_SMC)) {
623 /* If PSCI is enabled and this looks like a valid PSCI call then
624 * that overrides the architecturally mandated SMC behaviour.
626 return;
629 if (!arm_feature(env, ARM_FEATURE_EL3)) {
630 /* If we have no EL3 then SMC always UNDEFs */
631 undef = true;
632 } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
633 /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
634 raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
637 if (undef) {
638 raise_exception(env, EXCP_UDEF, syn_uncategorized(),
639 exception_target_el(env));
643 void HELPER(exception_return)(CPUARMState *env)
645 int cur_el = arm_current_el(env);
646 unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
647 uint32_t spsr = env->banked_spsr[spsr_idx];
648 int new_el;
650 aarch64_save_sp(env, cur_el);
652 env->exclusive_addr = -1;
654 /* We must squash the PSTATE.SS bit to zero unless both of the
655 * following hold:
656 * 1. debug exceptions are currently disabled
657 * 2. singlestep will be active in the EL we return to
658 * We check 1 here and 2 after we've done the pstate/cpsr write() to
659 * transition to the EL we're going to.
661 if (arm_generate_debug_exceptions(env)) {
662 spsr &= ~PSTATE_SS;
665 if (spsr & PSTATE_nRW) {
666 /* TODO: We currently assume EL1/2/3 are running in AArch64. */
667 env->aarch64 = 0;
668 new_el = 0;
669 env->uncached_cpsr = 0x10;
670 cpsr_write(env, spsr, ~0);
671 if (!arm_singlestep_active(env)) {
672 env->uncached_cpsr &= ~PSTATE_SS;
674 aarch64_sync_64_to_32(env);
676 env->regs[15] = env->elr_el[1] & ~0x1;
677 } else {
678 new_el = extract32(spsr, 2, 2);
679 if (new_el > cur_el
680 || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
681 /* Disallow return to an EL which is unimplemented or higher
682 * than the current one.
684 goto illegal_return;
686 if (extract32(spsr, 1, 1)) {
687 /* Return with reserved M[1] bit set */
688 goto illegal_return;
690 if (new_el == 0 && (spsr & PSTATE_SP)) {
691 /* Return to EL0 with M[0] bit set */
692 goto illegal_return;
694 env->aarch64 = 1;
695 pstate_write(env, spsr);
696 if (!arm_singlestep_active(env)) {
697 env->pstate &= ~PSTATE_SS;
699 aarch64_restore_sp(env, new_el);
700 env->pc = env->elr_el[cur_el];
703 return;
705 illegal_return:
706 /* Illegal return events of various kinds have architecturally
707 * mandated behaviour:
708 * restore NZCV and DAIF from SPSR_ELx
709 * set PSTATE.IL
710 * restore PC from ELR_ELx
711 * no change to exception level, execution state or stack pointer
713 env->pstate |= PSTATE_IL;
714 env->pc = env->elr_el[cur_el];
715 spsr &= PSTATE_NZCV | PSTATE_DAIF;
716 spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF);
717 pstate_write(env, spsr);
718 if (!arm_singlestep_active(env)) {
719 env->pstate &= ~PSTATE_SS;
723 /* Return true if the linked breakpoint entry lbn passes its checks */
724 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
726 CPUARMState *env = &cpu->env;
727 uint64_t bcr = env->cp15.dbgbcr[lbn];
728 int brps = extract32(cpu->dbgdidr, 24, 4);
729 int ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
730 int bt;
731 uint32_t contextidr;
733 /* Links to unimplemented or non-context aware breakpoints are
734 * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
735 * as if linked to an UNKNOWN context-aware breakpoint (in which
736 * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
737 * We choose the former.
739 if (lbn > brps || lbn < (brps - ctx_cmps)) {
740 return false;
743 bcr = env->cp15.dbgbcr[lbn];
745 if (extract64(bcr, 0, 1) == 0) {
746 /* Linked breakpoint disabled : generate no events */
747 return false;
750 bt = extract64(bcr, 20, 4);
752 /* We match the whole register even if this is AArch32 using the
753 * short descriptor format (in which case it holds both PROCID and ASID),
754 * since we don't implement the optional v7 context ID masking.
756 contextidr = extract64(env->cp15.contextidr_el[1], 0, 32);
758 switch (bt) {
759 case 3: /* linked context ID match */
760 if (arm_current_el(env) > 1) {
761 /* Context matches never fire in EL2 or (AArch64) EL3 */
762 return false;
764 return (contextidr == extract64(env->cp15.dbgbvr[lbn], 0, 32));
765 case 5: /* linked address mismatch (reserved in AArch64) */
766 case 9: /* linked VMID match (reserved if no EL2) */
767 case 11: /* linked context ID and VMID match (reserved if no EL2) */
768 default:
769 /* Links to Unlinked context breakpoints must generate no
770 * events; we choose to do the same for reserved values too.
772 return false;
775 return false;
778 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
780 CPUARMState *env = &cpu->env;
781 uint64_t cr;
782 int pac, hmc, ssc, wt, lbn;
783 /* Note that for watchpoints the check is against the CPU security
784 * state, not the S/NS attribute on the offending data access.
786 bool is_secure = arm_is_secure(env);
787 int access_el = arm_current_el(env);
789 if (is_wp) {
790 CPUWatchpoint *wp = env->cpu_watchpoint[n];
792 if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
793 return false;
795 cr = env->cp15.dbgwcr[n];
796 if (wp->hitattrs.user) {
797 /* The LDRT/STRT/LDT/STT "unprivileged access" instructions should
798 * match watchpoints as if they were accesses done at EL0, even if
799 * the CPU is at EL1 or higher.
801 access_el = 0;
803 } else {
804 uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
806 if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
807 return false;
809 cr = env->cp15.dbgbcr[n];
811 /* The WATCHPOINT_HIT flag guarantees us that the watchpoint is
812 * enabled and that the address and access type match; for breakpoints
813 * we know the address matched; check the remaining fields, including
814 * linked breakpoints. We rely on WCR and BCR having the same layout
815 * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
816 * Note that some combinations of {PAC, HMC, SSC} are reserved and
817 * must act either like some valid combination or as if the watchpoint
818 * were disabled. We choose the former, and use this together with
819 * the fact that EL3 must always be Secure and EL2 must always be
820 * Non-Secure to simplify the code slightly compared to the full
821 * table in the ARM ARM.
823 pac = extract64(cr, 1, 2);
824 hmc = extract64(cr, 13, 1);
825 ssc = extract64(cr, 14, 2);
827 switch (ssc) {
828 case 0:
829 break;
830 case 1:
831 case 3:
832 if (is_secure) {
833 return false;
835 break;
836 case 2:
837 if (!is_secure) {
838 return false;
840 break;
843 switch (access_el) {
844 case 3:
845 case 2:
846 if (!hmc) {
847 return false;
849 break;
850 case 1:
851 if (extract32(pac, 0, 1) == 0) {
852 return false;
854 break;
855 case 0:
856 if (extract32(pac, 1, 1) == 0) {
857 return false;
859 break;
860 default:
861 g_assert_not_reached();
864 wt = extract64(cr, 20, 1);
865 lbn = extract64(cr, 16, 4);
867 if (wt && !linked_bp_matches(cpu, lbn)) {
868 return false;
871 return true;
874 static bool check_watchpoints(ARMCPU *cpu)
876 CPUARMState *env = &cpu->env;
877 int n;
879 /* If watchpoints are disabled globally or we can't take debug
880 * exceptions here then watchpoint firings are ignored.
882 if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
883 || !arm_generate_debug_exceptions(env)) {
884 return false;
887 for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
888 if (bp_wp_matches(cpu, n, true)) {
889 return true;
892 return false;
895 static bool check_breakpoints(ARMCPU *cpu)
897 CPUARMState *env = &cpu->env;
898 int n;
900 /* If breakpoints are disabled globally or we can't take debug
901 * exceptions here then breakpoint firings are ignored.
903 if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
904 || !arm_generate_debug_exceptions(env)) {
905 return false;
908 for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
909 if (bp_wp_matches(cpu, n, false)) {
910 return true;
913 return false;
916 void HELPER(check_breakpoints)(CPUARMState *env)
918 ARMCPU *cpu = arm_env_get_cpu(env);
920 if (check_breakpoints(cpu)) {
921 HELPER(exception_internal(env, EXCP_DEBUG));
925 void arm_debug_excp_handler(CPUState *cs)
927 /* Called by core code when a watchpoint or breakpoint fires;
928 * need to check which one and raise the appropriate exception.
930 ARMCPU *cpu = ARM_CPU(cs);
931 CPUARMState *env = &cpu->env;
932 CPUWatchpoint *wp_hit = cs->watchpoint_hit;
934 if (wp_hit) {
935 if (wp_hit->flags & BP_CPU) {
936 cs->watchpoint_hit = NULL;
937 if (check_watchpoints(cpu)) {
938 bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
939 bool same_el = arm_debug_target_el(env) == arm_current_el(env);
941 if (extended_addresses_enabled(env)) {
942 env->exception.fsr = (1 << 9) | 0x22;
943 } else {
944 env->exception.fsr = 0x2;
946 env->exception.vaddress = wp_hit->hitaddr;
947 raise_exception(env, EXCP_DATA_ABORT,
948 syn_watchpoint(same_el, 0, wnr),
949 arm_debug_target_el(env));
950 } else {
951 cpu_resume_from_signal(cs, NULL);
954 } else {
955 uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
956 bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
958 /* (1) GDB breakpoints should be handled first.
959 * (2) Do not raise a CPU exception if no CPU breakpoint has fired,
960 * since singlestep is also done by generating a debug internal
961 * exception.
963 if (cpu_breakpoint_test(cs, pc, BP_GDB)
964 || !cpu_breakpoint_test(cs, pc, BP_CPU)) {
965 return;
968 if (extended_addresses_enabled(env)) {
969 env->exception.fsr = (1 << 9) | 0x22;
970 } else {
971 env->exception.fsr = 0x2;
973 /* FAR is UNKNOWN, so doesn't need setting */
974 raise_exception(env, EXCP_PREFETCH_ABORT,
975 syn_breakpoint(same_el),
976 arm_debug_target_el(env));
980 /* ??? Flag setting arithmetic is awkward because we need to do comparisons.
981 The only way to do that in TCG is a conditional branch, which clobbers
982 all our temporaries. For now implement these as helper functions. */
984 /* Similarly for variable shift instructions. */
986 uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
988 int shift = i & 0xff;
989 if (shift >= 32) {
990 if (shift == 32)
991 env->CF = x & 1;
992 else
993 env->CF = 0;
994 return 0;
995 } else if (shift != 0) {
996 env->CF = (x >> (32 - shift)) & 1;
997 return x << shift;
999 return x;
1002 uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
1004 int shift = i & 0xff;
1005 if (shift >= 32) {
1006 if (shift == 32)
1007 env->CF = (x >> 31) & 1;
1008 else
1009 env->CF = 0;
1010 return 0;
1011 } else if (shift != 0) {
1012 env->CF = (x >> (shift - 1)) & 1;
1013 return x >> shift;
1015 return x;
1018 uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
1020 int shift = i & 0xff;
1021 if (shift >= 32) {
1022 env->CF = (x >> 31) & 1;
1023 return (int32_t)x >> 31;
1024 } else if (shift != 0) {
1025 env->CF = (x >> (shift - 1)) & 1;
1026 return (int32_t)x >> shift;
1028 return x;
1031 uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
1033 int shift1, shift;
1034 shift1 = i & 0xff;
1035 shift = shift1 & 0x1f;
1036 if (shift == 0) {
1037 if (shift1 != 0)
1038 env->CF = (x >> 31) & 1;
1039 return x;
1040 } else {
1041 env->CF = (x >> (shift - 1)) & 1;
1042 return ((uint32_t)x >> shift) | (x << (32 - shift));