Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2019-07-15' into staging
[qemu/ar7.git] / target / arm / m_helper.c
blob84609f446e666cbb7564f0c8c1581e70842379e7
1 /*
2 * ARM generic helpers.
4 * This code is licensed under the GNU GPL v2 or later.
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8 #include "qemu/osdep.h"
9 #include "qemu/units.h"
10 #include "target/arm/idau.h"
11 #include "trace.h"
12 #include "cpu.h"
13 #include "internals.h"
14 #include "exec/gdbstub.h"
15 #include "exec/helper-proto.h"
16 #include "qemu/host-utils.h"
17 #include "sysemu/sysemu.h"
18 #include "qemu/bitops.h"
19 #include "qemu/crc32c.h"
20 #include "qemu/qemu-print.h"
21 #include "exec/exec-all.h"
22 #include <zlib.h> /* For crc32 */
23 #include "hw/semihosting/semihost.h"
24 #include "sysemu/cpus.h"
25 #include "sysemu/kvm.h"
26 #include "qemu/range.h"
27 #include "qapi/qapi-commands-machine-target.h"
28 #include "qapi/error.h"
29 #include "qemu/guest-random.h"
30 #ifdef CONFIG_TCG
31 #include "arm_ldst.h"
32 #include "exec/cpu_ldst.h"
33 #endif
35 #ifdef CONFIG_USER_ONLY
37 /* These should probably raise undefined insn exceptions. */
38 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
40 ARMCPU *cpu = env_archcpu(env);
42 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg);
45 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
47 ARMCPU *cpu = env_archcpu(env);
49 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg);
50 return 0;
53 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
55 /* translate.c should never generate calls here in user-only mode */
56 g_assert_not_reached();
59 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
61 /* translate.c should never generate calls here in user-only mode */
62 g_assert_not_reached();
65 void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
67 /* translate.c should never generate calls here in user-only mode */
68 g_assert_not_reached();
71 void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
73 /* translate.c should never generate calls here in user-only mode */
74 g_assert_not_reached();
77 void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
79 /* translate.c should never generate calls here in user-only mode */
80 g_assert_not_reached();
83 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
86 * The TT instructions can be used by unprivileged code, but in
87 * user-only emulation we don't have the MPU.
88 * Luckily since we know we are NonSecure unprivileged (and that in
89 * turn means that the A flag wasn't specified), all the bits in the
90 * register must be zero:
91 * IREGION: 0 because IRVALID is 0
92 * IRVALID: 0 because NS
93 * S: 0 because NS
94 * NSRW: 0 because NS
95 * NSR: 0 because NS
96 * RW: 0 because unpriv and A flag not set
97 * R: 0 because unpriv and A flag not set
98 * SRVALID: 0 because NS
99 * MRVALID: 0 because unpriv and A flag not set
100 * SREGION: 0 becaus SRVALID is 0
101 * MREGION: 0 because MRVALID is 0
103 return 0;
106 #else
109 * What kind of stack write are we doing? This affects how exceptions
110 * generated during the stacking are treated.
112 typedef enum StackingMode {
113 STACK_NORMAL,
114 STACK_IGNFAULTS,
115 STACK_LAZYFP,
116 } StackingMode;
118 static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
119 ARMMMUIdx mmu_idx, StackingMode mode)
121 CPUState *cs = CPU(cpu);
122 CPUARMState *env = &cpu->env;
123 MemTxAttrs attrs = {};
124 MemTxResult txres;
125 target_ulong page_size;
126 hwaddr physaddr;
127 int prot;
128 ARMMMUFaultInfo fi = {};
129 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
130 int exc;
131 bool exc_secure;
133 if (get_phys_addr(env, addr, MMU_DATA_STORE, mmu_idx, &physaddr,
134 &attrs, &prot, &page_size, &fi, NULL)) {
135 /* MPU/SAU lookup failed */
136 if (fi.type == ARMFault_QEMU_SFault) {
137 if (mode == STACK_LAZYFP) {
138 qemu_log_mask(CPU_LOG_INT,
139 "...SecureFault with SFSR.LSPERR "
140 "during lazy stacking\n");
141 env->v7m.sfsr |= R_V7M_SFSR_LSPERR_MASK;
142 } else {
143 qemu_log_mask(CPU_LOG_INT,
144 "...SecureFault with SFSR.AUVIOL "
145 "during stacking\n");
146 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
148 env->v7m.sfsr |= R_V7M_SFSR_SFARVALID_MASK;
149 env->v7m.sfar = addr;
150 exc = ARMV7M_EXCP_SECURE;
151 exc_secure = false;
152 } else {
153 if (mode == STACK_LAZYFP) {
154 qemu_log_mask(CPU_LOG_INT,
155 "...MemManageFault with CFSR.MLSPERR\n");
156 env->v7m.cfsr[secure] |= R_V7M_CFSR_MLSPERR_MASK;
157 } else {
158 qemu_log_mask(CPU_LOG_INT,
159 "...MemManageFault with CFSR.MSTKERR\n");
160 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK;
162 exc = ARMV7M_EXCP_MEM;
163 exc_secure = secure;
165 goto pend_fault;
167 address_space_stl_le(arm_addressspace(cs, attrs), physaddr, value,
168 attrs, &txres);
169 if (txres != MEMTX_OK) {
170 /* BusFault trying to write the data */
171 if (mode == STACK_LAZYFP) {
172 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.LSPERR\n");
173 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_LSPERR_MASK;
174 } else {
175 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n");
176 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK;
178 exc = ARMV7M_EXCP_BUS;
179 exc_secure = false;
180 goto pend_fault;
182 return true;
184 pend_fault:
186 * By pending the exception at this point we are making
187 * the IMPDEF choice "overridden exceptions pended" (see the
188 * MergeExcInfo() pseudocode). The other choice would be to not
189 * pend them now and then make a choice about which to throw away
190 * later if we have two derived exceptions.
191 * The only case when we must not pend the exception but instead
192 * throw it away is if we are doing the push of the callee registers
193 * and we've already generated a derived exception (this is indicated
194 * by the caller passing STACK_IGNFAULTS). Even in this case we will
195 * still update the fault status registers.
197 switch (mode) {
198 case STACK_NORMAL:
199 armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure);
200 break;
201 case STACK_LAZYFP:
202 armv7m_nvic_set_pending_lazyfp(env->nvic, exc, exc_secure);
203 break;
204 case STACK_IGNFAULTS:
205 break;
207 return false;
210 static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
211 ARMMMUIdx mmu_idx)
213 CPUState *cs = CPU(cpu);
214 CPUARMState *env = &cpu->env;
215 MemTxAttrs attrs = {};
216 MemTxResult txres;
217 target_ulong page_size;
218 hwaddr physaddr;
219 int prot;
220 ARMMMUFaultInfo fi = {};
221 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
222 int exc;
223 bool exc_secure;
224 uint32_t value;
226 if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr,
227 &attrs, &prot, &page_size, &fi, NULL)) {
228 /* MPU/SAU lookup failed */
229 if (fi.type == ARMFault_QEMU_SFault) {
230 qemu_log_mask(CPU_LOG_INT,
231 "...SecureFault with SFSR.AUVIOL during unstack\n");
232 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
233 env->v7m.sfar = addr;
234 exc = ARMV7M_EXCP_SECURE;
235 exc_secure = false;
236 } else {
237 qemu_log_mask(CPU_LOG_INT,
238 "...MemManageFault with CFSR.MUNSTKERR\n");
239 env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK;
240 exc = ARMV7M_EXCP_MEM;
241 exc_secure = secure;
243 goto pend_fault;
246 value = address_space_ldl(arm_addressspace(cs, attrs), physaddr,
247 attrs, &txres);
248 if (txres != MEMTX_OK) {
249 /* BusFault trying to read the data */
250 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n");
251 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK;
252 exc = ARMV7M_EXCP_BUS;
253 exc_secure = false;
254 goto pend_fault;
257 *dest = value;
258 return true;
260 pend_fault:
262 * By pending the exception at this point we are making
263 * the IMPDEF choice "overridden exceptions pended" (see the
264 * MergeExcInfo() pseudocode). The other choice would be to not
265 * pend them now and then make a choice about which to throw away
266 * later if we have two derived exceptions.
268 armv7m_nvic_set_pending(env->nvic, exc, exc_secure);
269 return false;
272 void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
275 * Preserve FP state (because LSPACT was set and we are about
276 * to execute an FP instruction). This corresponds to the
277 * PreserveFPState() pseudocode.
278 * We may throw an exception if the stacking fails.
280 ARMCPU *cpu = env_archcpu(env);
281 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
282 bool negpri = !(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_HFRDY_MASK);
283 bool is_priv = !(env->v7m.fpccr[is_secure] & R_V7M_FPCCR_USER_MASK);
284 bool splimviol = env->v7m.fpccr[is_secure] & R_V7M_FPCCR_SPLIMVIOL_MASK;
285 uint32_t fpcar = env->v7m.fpcar[is_secure];
286 bool stacked_ok = true;
287 bool ts = is_secure && (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
288 bool take_exception;
290 /* Take the iothread lock as we are going to touch the NVIC */
291 qemu_mutex_lock_iothread();
293 /* Check the background context had access to the FPU */
294 if (!v7m_cpacr_pass(env, is_secure, is_priv)) {
295 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, is_secure);
296 env->v7m.cfsr[is_secure] |= R_V7M_CFSR_NOCP_MASK;
297 stacked_ok = false;
298 } else if (!is_secure && !extract32(env->v7m.nsacr, 10, 1)) {
299 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
300 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
301 stacked_ok = false;
304 if (!splimviol && stacked_ok) {
305 /* We only stack if the stack limit wasn't violated */
306 int i;
307 ARMMMUIdx mmu_idx;
309 mmu_idx = arm_v7m_mmu_idx_all(env, is_secure, is_priv, negpri);
310 for (i = 0; i < (ts ? 32 : 16); i += 2) {
311 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
312 uint32_t faddr = fpcar + 4 * i;
313 uint32_t slo = extract64(dn, 0, 32);
314 uint32_t shi = extract64(dn, 32, 32);
316 if (i >= 16) {
317 faddr += 8; /* skip the slot for the FPSCR */
319 stacked_ok = stacked_ok &&
320 v7m_stack_write(cpu, faddr, slo, mmu_idx, STACK_LAZYFP) &&
321 v7m_stack_write(cpu, faddr + 4, shi, mmu_idx, STACK_LAZYFP);
324 stacked_ok = stacked_ok &&
325 v7m_stack_write(cpu, fpcar + 0x40,
326 vfp_get_fpscr(env), mmu_idx, STACK_LAZYFP);
330 * We definitely pended an exception, but it's possible that it
331 * might not be able to be taken now. If its priority permits us
332 * to take it now, then we must not update the LSPACT or FP regs,
333 * but instead jump out to take the exception immediately.
334 * If it's just pending and won't be taken until the current
335 * handler exits, then we do update LSPACT and the FP regs.
337 take_exception = !stacked_ok &&
338 armv7m_nvic_can_take_pending_exception(env->nvic);
340 qemu_mutex_unlock_iothread();
342 if (take_exception) {
343 raise_exception_ra(env, EXCP_LAZYFP, 0, 1, GETPC());
346 env->v7m.fpccr[is_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
348 if (ts) {
349 /* Clear s0 to s31 and the FPSCR */
350 int i;
352 for (i = 0; i < 32; i += 2) {
353 *aa32_vfp_dreg(env, i / 2) = 0;
355 vfp_set_fpscr(env, 0);
358 * Otherwise s0 to s15 and FPSCR are UNKNOWN; we choose to leave them
359 * unchanged.
364 * Write to v7M CONTROL.SPSEL bit for the specified security bank.
365 * This may change the current stack pointer between Main and Process
366 * stack pointers if it is done for the CONTROL register for the current
367 * security state.
369 static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
370 bool new_spsel,
371 bool secstate)
373 bool old_is_psp = v7m_using_psp(env);
375 env->v7m.control[secstate] =
376 deposit32(env->v7m.control[secstate],
377 R_V7M_CONTROL_SPSEL_SHIFT,
378 R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
380 if (secstate == env->v7m.secure) {
381 bool new_is_psp = v7m_using_psp(env);
382 uint32_t tmp;
384 if (old_is_psp != new_is_psp) {
385 tmp = env->v7m.other_sp;
386 env->v7m.other_sp = env->regs[13];
387 env->regs[13] = tmp;
393 * Write to v7M CONTROL.SPSEL bit. This may change the current
394 * stack pointer between Main and Process stack pointers.
396 static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
398 write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
401 void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
404 * Write a new value to v7m.exception, thus transitioning into or out
405 * of Handler mode; this may result in a change of active stack pointer.
407 bool new_is_psp, old_is_psp = v7m_using_psp(env);
408 uint32_t tmp;
410 env->v7m.exception = new_exc;
412 new_is_psp = v7m_using_psp(env);
414 if (old_is_psp != new_is_psp) {
415 tmp = env->v7m.other_sp;
416 env->v7m.other_sp = env->regs[13];
417 env->regs[13] = tmp;
421 /* Switch M profile security state between NS and S */
422 static void switch_v7m_security_state(CPUARMState *env, bool new_secstate)
424 uint32_t new_ss_msp, new_ss_psp;
426 if (env->v7m.secure == new_secstate) {
427 return;
431 * All the banked state is accessed by looking at env->v7m.secure
432 * except for the stack pointer; rearrange the SP appropriately.
434 new_ss_msp = env->v7m.other_ss_msp;
435 new_ss_psp = env->v7m.other_ss_psp;
437 if (v7m_using_psp(env)) {
438 env->v7m.other_ss_psp = env->regs[13];
439 env->v7m.other_ss_msp = env->v7m.other_sp;
440 } else {
441 env->v7m.other_ss_msp = env->regs[13];
442 env->v7m.other_ss_psp = env->v7m.other_sp;
445 env->v7m.secure = new_secstate;
447 if (v7m_using_psp(env)) {
448 env->regs[13] = new_ss_psp;
449 env->v7m.other_sp = new_ss_msp;
450 } else {
451 env->regs[13] = new_ss_msp;
452 env->v7m.other_sp = new_ss_psp;
456 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
459 * Handle v7M BXNS:
460 * - if the return value is a magic value, do exception return (like BX)
461 * - otherwise bit 0 of the return value is the target security state
463 uint32_t min_magic;
465 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
466 /* Covers FNC_RETURN and EXC_RETURN magic */
467 min_magic = FNC_RETURN_MIN_MAGIC;
468 } else {
469 /* EXC_RETURN magic only */
470 min_magic = EXC_RETURN_MIN_MAGIC;
473 if (dest >= min_magic) {
475 * This is an exception return magic value; put it where
476 * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT.
477 * Note that if we ever add gen_ss_advance() singlestep support to
478 * M profile this should count as an "instruction execution complete"
479 * event (compare gen_bx_excret_final_code()).
481 env->regs[15] = dest & ~1;
482 env->thumb = dest & 1;
483 HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT);
484 /* notreached */
487 /* translate.c should have made BXNS UNDEF unless we're secure */
488 assert(env->v7m.secure);
490 if (!(dest & 1)) {
491 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
493 switch_v7m_security_state(env, dest & 1);
494 env->thumb = 1;
495 env->regs[15] = dest & ~1;
498 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
501 * Handle v7M BLXNS:
502 * - bit 0 of the destination address is the target security state
505 /* At this point regs[15] is the address just after the BLXNS */
506 uint32_t nextinst = env->regs[15] | 1;
507 uint32_t sp = env->regs[13] - 8;
508 uint32_t saved_psr;
510 /* translate.c will have made BLXNS UNDEF unless we're secure */
511 assert(env->v7m.secure);
513 if (dest & 1) {
515 * Target is Secure, so this is just a normal BLX,
516 * except that the low bit doesn't indicate Thumb/not.
518 env->regs[14] = nextinst;
519 env->thumb = 1;
520 env->regs[15] = dest & ~1;
521 return;
524 /* Target is non-secure: first push a stack frame */
525 if (!QEMU_IS_ALIGNED(sp, 8)) {
526 qemu_log_mask(LOG_GUEST_ERROR,
527 "BLXNS with misaligned SP is UNPREDICTABLE\n");
530 if (sp < v7m_sp_limit(env)) {
531 raise_exception(env, EXCP_STKOF, 0, 1);
534 saved_psr = env->v7m.exception;
535 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
536 saved_psr |= XPSR_SFPA;
539 /* Note that these stores can throw exceptions on MPU faults */
540 cpu_stl_data_ra(env, sp, nextinst, GETPC());
541 cpu_stl_data_ra(env, sp + 4, saved_psr, GETPC());
543 env->regs[13] = sp;
544 env->regs[14] = 0xfeffffff;
545 if (arm_v7m_is_handler_mode(env)) {
547 * Write a dummy value to IPSR, to avoid leaking the current secure
548 * exception number to non-secure code. This is guaranteed not
549 * to cause write_v7m_exception() to actually change stacks.
551 write_v7m_exception(env, 1);
553 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
554 switch_v7m_security_state(env, 0);
555 env->thumb = 1;
556 env->regs[15] = dest;
559 static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
560 bool spsel)
563 * Return a pointer to the location where we currently store the
564 * stack pointer for the requested security state and thread mode.
565 * This pointer will become invalid if the CPU state is updated
566 * such that the stack pointers are switched around (eg changing
567 * the SPSEL control bit).
568 * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
569 * Unlike that pseudocode, we require the caller to pass us in the
570 * SPSEL control bit value; this is because we also use this
571 * function in handling of pushing of the callee-saves registers
572 * part of the v8M stack frame (pseudocode PushCalleeStack()),
573 * and in the tailchain codepath the SPSEL bit comes from the exception
574 * return magic LR value from the previous exception. The pseudocode
575 * opencodes the stack-selection in PushCalleeStack(), but we prefer
576 * to make this utility function generic enough to do the job.
578 bool want_psp = threadmode && spsel;
580 if (secure == env->v7m.secure) {
581 if (want_psp == v7m_using_psp(env)) {
582 return &env->regs[13];
583 } else {
584 return &env->v7m.other_sp;
586 } else {
587 if (want_psp) {
588 return &env->v7m.other_ss_psp;
589 } else {
590 return &env->v7m.other_ss_msp;
595 static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
596 uint32_t *pvec)
598 CPUState *cs = CPU(cpu);
599 CPUARMState *env = &cpu->env;
600 MemTxResult result;
601 uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4;
602 uint32_t vector_entry;
603 MemTxAttrs attrs = {};
604 ARMMMUIdx mmu_idx;
605 bool exc_secure;
607 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
610 * We don't do a get_phys_addr() here because the rules for vector
611 * loads are special: they always use the default memory map, and
612 * the default memory map permits reads from all addresses.
613 * Since there's no easy way to pass through to pmsav8_mpu_lookup()
614 * that we want this special case which would always say "yes",
615 * we just do the SAU lookup here followed by a direct physical load.
617 attrs.secure = targets_secure;
618 attrs.user = false;
620 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
621 V8M_SAttributes sattrs = {};
623 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs);
624 if (sattrs.ns) {
625 attrs.secure = false;
626 } else if (!targets_secure) {
628 * NS access to S memory: the underlying exception which we escalate
629 * to HardFault is SecureFault, which always targets Secure.
631 exc_secure = true;
632 goto load_fail;
636 vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
637 attrs, &result);
638 if (result != MEMTX_OK) {
640 * Underlying exception is BusFault: its target security state
641 * depends on BFHFNMINS.
643 exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
644 goto load_fail;
646 *pvec = vector_entry;
647 return true;
649 load_fail:
651 * All vector table fetch fails are reported as HardFault, with
652 * HFSR.VECTTBL and .FORCED set. (FORCED is set because
653 * technically the underlying exception is a SecureFault or BusFault
654 * that is escalated to HardFault.) This is a terminal exception,
655 * so we will either take the HardFault immediately or else enter
656 * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
657 * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
658 * secure); otherwise it targets the same security state as the
659 * underlying exception.
661 if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
662 exc_secure = true;
664 env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
665 armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
666 return false;
669 static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr)
672 * Return the integrity signature value for the callee-saves
673 * stack frame section. @lr is the exception return payload/LR value
674 * whose FType bit forms bit 0 of the signature if FP is present.
676 uint32_t sig = 0xfefa125a;
678 if (!arm_feature(env, ARM_FEATURE_VFP) || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
679 sig |= 1;
681 return sig;
684 static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
685 bool ignore_faults)
688 * For v8M, push the callee-saves register part of the stack frame.
689 * Compare the v8M pseudocode PushCalleeStack().
690 * In the tailchaining case this may not be the current stack.
692 CPUARMState *env = &cpu->env;
693 uint32_t *frame_sp_p;
694 uint32_t frameptr;
695 ARMMMUIdx mmu_idx;
696 bool stacked_ok;
697 uint32_t limit;
698 bool want_psp;
699 uint32_t sig;
700 StackingMode smode = ignore_faults ? STACK_IGNFAULTS : STACK_NORMAL;
702 if (dotailchain) {
703 bool mode = lr & R_V7M_EXCRET_MODE_MASK;
704 bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) ||
705 !mode;
707 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
708 frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,
709 lr & R_V7M_EXCRET_SPSEL_MASK);
710 want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
711 if (want_psp) {
712 limit = env->v7m.psplim[M_REG_S];
713 } else {
714 limit = env->v7m.msplim[M_REG_S];
716 } else {
717 mmu_idx = arm_mmu_idx(env);
718 frame_sp_p = &env->regs[13];
719 limit = v7m_sp_limit(env);
722 frameptr = *frame_sp_p - 0x28;
723 if (frameptr < limit) {
725 * Stack limit failure: set SP to the limit value, and generate
726 * STKOF UsageFault. Stack pushes below the limit must not be
727 * performed. It is IMPDEF whether pushes above the limit are
728 * performed; we choose not to.
730 qemu_log_mask(CPU_LOG_INT,
731 "...STKOF during callee-saves register stacking\n");
732 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
733 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
734 env->v7m.secure);
735 *frame_sp_p = limit;
736 return true;
740 * Write as much of the stack frame as we can. A write failure may
741 * cause us to pend a derived exception.
743 sig = v7m_integrity_sig(env, lr);
744 stacked_ok =
745 v7m_stack_write(cpu, frameptr, sig, mmu_idx, smode) &&
746 v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx, smode) &&
747 v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx, smode) &&
748 v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx, smode) &&
749 v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx, smode) &&
750 v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx, smode) &&
751 v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx, smode) &&
752 v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx, smode) &&
753 v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx, smode);
755 /* Update SP regardless of whether any of the stack accesses failed. */
756 *frame_sp_p = frameptr;
758 return !stacked_ok;
761 static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
762 bool ignore_stackfaults)
765 * Do the "take the exception" parts of exception entry,
766 * but not the pushing of state to the stack. This is
767 * similar to the pseudocode ExceptionTaken() function.
769 CPUARMState *env = &cpu->env;
770 uint32_t addr;
771 bool targets_secure;
772 int exc;
773 bool push_failed = false;
775 armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure);
776 qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n",
777 targets_secure ? "secure" : "nonsecure", exc);
779 if (dotailchain) {
780 /* Sanitize LR FType and PREFIX bits */
781 if (!arm_feature(env, ARM_FEATURE_VFP)) {
782 lr |= R_V7M_EXCRET_FTYPE_MASK;
784 lr = deposit32(lr, 24, 8, 0xff);
787 if (arm_feature(env, ARM_FEATURE_V8)) {
788 if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
789 (lr & R_V7M_EXCRET_S_MASK)) {
791 * The background code (the owner of the registers in the
792 * exception frame) is Secure. This means it may either already
793 * have or now needs to push callee-saves registers.
795 if (targets_secure) {
796 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
798 * We took an exception from Secure to NonSecure
799 * (which means the callee-saved registers got stacked)
800 * and are now tailchaining to a Secure exception.
801 * Clear DCRS so eventual return from this Secure
802 * exception unstacks the callee-saved registers.
804 lr &= ~R_V7M_EXCRET_DCRS_MASK;
806 } else {
808 * We're going to a non-secure exception; push the
809 * callee-saves registers to the stack now, if they're
810 * not already saved.
812 if (lr & R_V7M_EXCRET_DCRS_MASK &&
813 !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) {
814 push_failed = v7m_push_callee_stack(cpu, lr, dotailchain,
815 ignore_stackfaults);
817 lr |= R_V7M_EXCRET_DCRS_MASK;
821 lr &= ~R_V7M_EXCRET_ES_MASK;
822 if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) {
823 lr |= R_V7M_EXCRET_ES_MASK;
825 lr &= ~R_V7M_EXCRET_SPSEL_MASK;
826 if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
827 lr |= R_V7M_EXCRET_SPSEL_MASK;
831 * Clear registers if necessary to prevent non-secure exception
832 * code being able to see register values from secure code.
833 * Where register values become architecturally UNKNOWN we leave
834 * them with their previous values.
836 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
837 if (!targets_secure) {
839 * Always clear the caller-saved registers (they have been
840 * pushed to the stack earlier in v7m_push_stack()).
841 * Clear callee-saved registers if the background code is
842 * Secure (in which case these regs were saved in
843 * v7m_push_callee_stack()).
845 int i;
847 for (i = 0; i < 13; i++) {
848 /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */
849 if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) {
850 env->regs[i] = 0;
853 /* Clear EAPSR */
854 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
859 if (push_failed && !ignore_stackfaults) {
861 * Derived exception on callee-saves register stacking:
862 * we might now want to take a different exception which
863 * targets a different security state, so try again from the top.
865 qemu_log_mask(CPU_LOG_INT,
866 "...derived exception on callee-saves register stacking");
867 v7m_exception_taken(cpu, lr, true, true);
868 return;
871 if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) {
872 /* Vector load failed: derived exception */
873 qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load");
874 v7m_exception_taken(cpu, lr, true, true);
875 return;
879 * Now we've done everything that might cause a derived exception
880 * we can go ahead and activate whichever exception we're going to
881 * take (which might now be the derived exception).
883 armv7m_nvic_acknowledge_irq(env->nvic);
885 /* Switch to target security state -- must do this before writing SPSEL */
886 switch_v7m_security_state(env, targets_secure);
887 write_v7m_control_spsel(env, 0);
888 arm_clear_exclusive(env);
889 /* Clear SFPA and FPCA (has no effect if no FPU) */
890 env->v7m.control[M_REG_S] &=
891 ~(R_V7M_CONTROL_FPCA_MASK | R_V7M_CONTROL_SFPA_MASK);
892 /* Clear IT bits */
893 env->condexec_bits = 0;
894 env->regs[14] = lr;
895 env->regs[15] = addr & 0xfffffffe;
896 env->thumb = addr & 1;
899 static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr,
900 bool apply_splim)
903 * Like the pseudocode UpdateFPCCR: save state in FPCAR and FPCCR
904 * that we will need later in order to do lazy FP reg stacking.
906 bool is_secure = env->v7m.secure;
907 void *nvic = env->nvic;
909 * Some bits are unbanked and live always in fpccr[M_REG_S]; some bits
910 * are banked and we want to update the bit in the bank for the
911 * current security state; and in one case we want to specifically
912 * update the NS banked version of a bit even if we are secure.
914 uint32_t *fpccr_s = &env->v7m.fpccr[M_REG_S];
915 uint32_t *fpccr_ns = &env->v7m.fpccr[M_REG_NS];
916 uint32_t *fpccr = &env->v7m.fpccr[is_secure];
917 bool hfrdy, bfrdy, mmrdy, ns_ufrdy, s_ufrdy, sfrdy, monrdy;
919 env->v7m.fpcar[is_secure] = frameptr & ~0x7;
921 if (apply_splim && arm_feature(env, ARM_FEATURE_V8)) {
922 bool splimviol;
923 uint32_t splim = v7m_sp_limit(env);
924 bool ign = armv7m_nvic_neg_prio_requested(nvic, is_secure) &&
925 (env->v7m.ccr[is_secure] & R_V7M_CCR_STKOFHFNMIGN_MASK);
927 splimviol = !ign && frameptr < splim;
928 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, SPLIMVIOL, splimviol);
931 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, LSPACT, 1);
933 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, S, is_secure);
935 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, USER, arm_current_el(env) == 0);
937 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, THREAD,
938 !arm_v7m_is_handler_mode(env));
940 hfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_HARD, false);
941 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, HFRDY, hfrdy);
943 bfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_BUS, false);
944 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, BFRDY, bfrdy);
946 mmrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_MEM, is_secure);
947 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, MMRDY, mmrdy);
949 ns_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, false);
950 *fpccr_ns = FIELD_DP32(*fpccr_ns, V7M_FPCCR, UFRDY, ns_ufrdy);
952 monrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_DEBUG, false);
953 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, MONRDY, monrdy);
955 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
956 s_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, true);
957 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, UFRDY, s_ufrdy);
959 sfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_SECURE, false);
960 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, SFRDY, sfrdy);
964 void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
966 /* fptr is the value of Rn, the frame pointer we store the FP regs to */
967 bool s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
968 bool lspact = env->v7m.fpccr[s] & R_V7M_FPCCR_LSPACT_MASK;
969 uintptr_t ra = GETPC();
971 assert(env->v7m.secure);
973 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
974 return;
977 /* Check access to the coprocessor is permitted */
978 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
979 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
982 if (lspact) {
983 /* LSPACT should not be active when there is active FP state */
984 raise_exception_ra(env, EXCP_LSERR, 0, 1, GETPC());
987 if (fptr & 7) {
988 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
992 * Note that we do not use v7m_stack_write() here, because the
993 * accesses should not set the FSR bits for stacking errors if they
994 * fail. (In pseudocode terms, they are AccType_NORMAL, not AccType_STACK
995 * or AccType_LAZYFP). Faults in cpu_stl_data_ra() will throw exceptions
996 * and longjmp out.
998 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
999 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1000 int i;
1002 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1003 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1004 uint32_t faddr = fptr + 4 * i;
1005 uint32_t slo = extract64(dn, 0, 32);
1006 uint32_t shi = extract64(dn, 32, 32);
1008 if (i >= 16) {
1009 faddr += 8; /* skip the slot for the FPSCR */
1011 cpu_stl_data_ra(env, faddr, slo, ra);
1012 cpu_stl_data_ra(env, faddr + 4, shi, ra);
1014 cpu_stl_data_ra(env, fptr + 0x40, vfp_get_fpscr(env), ra);
1017 * If TS is 0 then s0 to s15 and FPSCR are UNKNOWN; we choose to
1018 * leave them unchanged, matching our choice in v7m_preserve_fp_state.
1020 if (ts) {
1021 for (i = 0; i < 32; i += 2) {
1022 *aa32_vfp_dreg(env, i / 2) = 0;
1024 vfp_set_fpscr(env, 0);
1026 } else {
1027 v7m_update_fpccr(env, fptr, false);
1030 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
1033 void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
1035 uintptr_t ra = GETPC();
1037 /* fptr is the value of Rn, the frame pointer we load the FP regs from */
1038 assert(env->v7m.secure);
1040 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1041 return;
1044 /* Check access to the coprocessor is permitted */
1045 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
1046 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
1049 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1050 /* State in FP is still valid */
1051 env->v7m.fpccr[M_REG_S] &= ~R_V7M_FPCCR_LSPACT_MASK;
1052 } else {
1053 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1054 int i;
1055 uint32_t fpscr;
1057 if (fptr & 7) {
1058 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
1061 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1062 uint32_t slo, shi;
1063 uint64_t dn;
1064 uint32_t faddr = fptr + 4 * i;
1066 if (i >= 16) {
1067 faddr += 8; /* skip the slot for the FPSCR */
1070 slo = cpu_ldl_data_ra(env, faddr, ra);
1071 shi = cpu_ldl_data_ra(env, faddr + 4, ra);
1073 dn = (uint64_t) shi << 32 | slo;
1074 *aa32_vfp_dreg(env, i / 2) = dn;
1076 fpscr = cpu_ldl_data_ra(env, fptr + 0x40, ra);
1077 vfp_set_fpscr(env, fpscr);
1080 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK;
1083 static bool v7m_push_stack(ARMCPU *cpu)
1086 * Do the "set up stack frame" part of exception entry,
1087 * similar to pseudocode PushStack().
1088 * Return true if we generate a derived exception (and so
1089 * should ignore further stack faults trying to process
1090 * that derived exception.)
1092 bool stacked_ok = true, limitviol = false;
1093 CPUARMState *env = &cpu->env;
1094 uint32_t xpsr = xpsr_read(env);
1095 uint32_t frameptr = env->regs[13];
1096 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1097 uint32_t framesize;
1098 bool nsacr_cp10 = extract32(env->v7m.nsacr, 10, 1);
1100 if ((env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) &&
1101 (env->v7m.secure || nsacr_cp10)) {
1102 if (env->v7m.secure &&
1103 env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK) {
1104 framesize = 0xa8;
1105 } else {
1106 framesize = 0x68;
1108 } else {
1109 framesize = 0x20;
1112 /* Align stack pointer if the guest wants that */
1113 if ((frameptr & 4) &&
1114 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) {
1115 frameptr -= 4;
1116 xpsr |= XPSR_SPREALIGN;
1119 xpsr &= ~XPSR_SFPA;
1120 if (env->v7m.secure &&
1121 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1122 xpsr |= XPSR_SFPA;
1125 frameptr -= framesize;
1127 if (arm_feature(env, ARM_FEATURE_V8)) {
1128 uint32_t limit = v7m_sp_limit(env);
1130 if (frameptr < limit) {
1132 * Stack limit failure: set SP to the limit value, and generate
1133 * STKOF UsageFault. Stack pushes below the limit must not be
1134 * performed. It is IMPDEF whether pushes above the limit are
1135 * performed; we choose not to.
1137 qemu_log_mask(CPU_LOG_INT,
1138 "...STKOF during stacking\n");
1139 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
1140 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1141 env->v7m.secure);
1142 env->regs[13] = limit;
1144 * We won't try to perform any further memory accesses but
1145 * we must continue through the following code to check for
1146 * permission faults during FPU state preservation, and we
1147 * must update FPCCR if lazy stacking is enabled.
1149 limitviol = true;
1150 stacked_ok = false;
1155 * Write as much of the stack frame as we can. If we fail a stack
1156 * write this will result in a derived exception being pended
1157 * (which may be taken in preference to the one we started with
1158 * if it has higher priority).
1160 stacked_ok = stacked_ok &&
1161 v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, STACK_NORMAL) &&
1162 v7m_stack_write(cpu, frameptr + 4, env->regs[1],
1163 mmu_idx, STACK_NORMAL) &&
1164 v7m_stack_write(cpu, frameptr + 8, env->regs[2],
1165 mmu_idx, STACK_NORMAL) &&
1166 v7m_stack_write(cpu, frameptr + 12, env->regs[3],
1167 mmu_idx, STACK_NORMAL) &&
1168 v7m_stack_write(cpu, frameptr + 16, env->regs[12],
1169 mmu_idx, STACK_NORMAL) &&
1170 v7m_stack_write(cpu, frameptr + 20, env->regs[14],
1171 mmu_idx, STACK_NORMAL) &&
1172 v7m_stack_write(cpu, frameptr + 24, env->regs[15],
1173 mmu_idx, STACK_NORMAL) &&
1174 v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, STACK_NORMAL);
1176 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) {
1177 /* FPU is active, try to save its registers */
1178 bool fpccr_s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
1179 bool lspact = env->v7m.fpccr[fpccr_s] & R_V7M_FPCCR_LSPACT_MASK;
1181 if (lspact && arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1182 qemu_log_mask(CPU_LOG_INT,
1183 "...SecureFault because LSPACT and FPCA both set\n");
1184 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1185 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1186 } else if (!env->v7m.secure && !nsacr_cp10) {
1187 qemu_log_mask(CPU_LOG_INT,
1188 "...Secure UsageFault with CFSR.NOCP because "
1189 "NSACR.CP10 prevents stacking FP regs\n");
1190 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
1191 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
1192 } else {
1193 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1194 /* Lazy stacking disabled, save registers now */
1195 int i;
1196 bool cpacr_pass = v7m_cpacr_pass(env, env->v7m.secure,
1197 arm_current_el(env) != 0);
1199 if (stacked_ok && !cpacr_pass) {
1201 * Take UsageFault if CPACR forbids access. The pseudocode
1202 * here does a full CheckCPEnabled() but we know the NSACR
1203 * check can never fail as we have already handled that.
1205 qemu_log_mask(CPU_LOG_INT,
1206 "...UsageFault with CFSR.NOCP because "
1207 "CPACR.CP10 prevents stacking FP regs\n");
1208 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1209 env->v7m.secure);
1210 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK;
1211 stacked_ok = false;
1214 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1215 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1216 uint32_t faddr = frameptr + 0x20 + 4 * i;
1217 uint32_t slo = extract64(dn, 0, 32);
1218 uint32_t shi = extract64(dn, 32, 32);
1220 if (i >= 16) {
1221 faddr += 8; /* skip the slot for the FPSCR */
1223 stacked_ok = stacked_ok &&
1224 v7m_stack_write(cpu, faddr, slo,
1225 mmu_idx, STACK_NORMAL) &&
1226 v7m_stack_write(cpu, faddr + 4, shi,
1227 mmu_idx, STACK_NORMAL);
1229 stacked_ok = stacked_ok &&
1230 v7m_stack_write(cpu, frameptr + 0x60,
1231 vfp_get_fpscr(env), mmu_idx, STACK_NORMAL);
1232 if (cpacr_pass) {
1233 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1234 *aa32_vfp_dreg(env, i / 2) = 0;
1236 vfp_set_fpscr(env, 0);
1238 } else {
1239 /* Lazy stacking enabled, save necessary info to stack later */
1240 v7m_update_fpccr(env, frameptr + 0x20, true);
1246 * If we broke a stack limit then SP was already updated earlier;
1247 * otherwise we update SP regardless of whether any of the stack
1248 * accesses failed or we took some other kind of fault.
1250 if (!limitviol) {
1251 env->regs[13] = frameptr;
1254 return !stacked_ok;
1257 static void do_v7m_exception_exit(ARMCPU *cpu)
1259 CPUARMState *env = &cpu->env;
1260 uint32_t excret;
1261 uint32_t xpsr, xpsr_mask;
1262 bool ufault = false;
1263 bool sfault = false;
1264 bool return_to_sp_process;
1265 bool return_to_handler;
1266 bool rettobase = false;
1267 bool exc_secure = false;
1268 bool return_to_secure;
1269 bool ftype;
1270 bool restore_s16_s31;
1273 * If we're not in Handler mode then jumps to magic exception-exit
1274 * addresses don't have magic behaviour. However for the v8M
1275 * security extensions the magic secure-function-return has to
1276 * work in thread mode too, so to avoid doing an extra check in
1277 * the generated code we allow exception-exit magic to also cause the
1278 * internal exception and bring us here in thread mode. Correct code
1279 * will never try to do this (the following insn fetch will always
1280 * fault) so we the overhead of having taken an unnecessary exception
1281 * doesn't matter.
1283 if (!arm_v7m_is_handler_mode(env)) {
1284 return;
1288 * In the spec pseudocode ExceptionReturn() is called directly
1289 * from BXWritePC() and gets the full target PC value including
1290 * bit zero. In QEMU's implementation we treat it as a normal
1291 * jump-to-register (which is then caught later on), and so split
1292 * the target value up between env->regs[15] and env->thumb in
1293 * gen_bx(). Reconstitute it.
1295 excret = env->regs[15];
1296 if (env->thumb) {
1297 excret |= 1;
1300 qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
1301 " previous exception %d\n",
1302 excret, env->v7m.exception);
1304 if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
1305 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
1306 "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
1307 excret);
1310 ftype = excret & R_V7M_EXCRET_FTYPE_MASK;
1312 if (!arm_feature(env, ARM_FEATURE_VFP) && !ftype) {
1313 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception "
1314 "exit PC value 0x%" PRIx32 " is UNPREDICTABLE "
1315 "if FPU not present\n",
1316 excret);
1317 ftype = true;
1320 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1322 * EXC_RETURN.ES validation check (R_SMFL). We must do this before
1323 * we pick which FAULTMASK to clear.
1325 if (!env->v7m.secure &&
1326 ((excret & R_V7M_EXCRET_ES_MASK) ||
1327 !(excret & R_V7M_EXCRET_DCRS_MASK))) {
1328 sfault = 1;
1329 /* For all other purposes, treat ES as 0 (R_HXSR) */
1330 excret &= ~R_V7M_EXCRET_ES_MASK;
1332 exc_secure = excret & R_V7M_EXCRET_ES_MASK;
1335 if (env->v7m.exception != ARMV7M_EXCP_NMI) {
1337 * Auto-clear FAULTMASK on return from other than NMI.
1338 * If the security extension is implemented then this only
1339 * happens if the raw execution priority is >= 0; the
1340 * value of the ES bit in the exception return value indicates
1341 * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
1343 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1344 if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
1345 env->v7m.faultmask[exc_secure] = 0;
1347 } else {
1348 env->v7m.faultmask[M_REG_NS] = 0;
1352 switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception,
1353 exc_secure)) {
1354 case -1:
1355 /* attempt to exit an exception that isn't active */
1356 ufault = true;
1357 break;
1358 case 0:
1359 /* still an irq active now */
1360 break;
1361 case 1:
1363 * We returned to base exception level, no nesting.
1364 * (In the pseudocode this is written using "NestedActivation != 1"
1365 * where we have 'rettobase == false'.)
1367 rettobase = true;
1368 break;
1369 default:
1370 g_assert_not_reached();
1373 return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
1374 return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
1375 return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
1376 (excret & R_V7M_EXCRET_S_MASK);
1378 if (arm_feature(env, ARM_FEATURE_V8)) {
1379 if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1381 * UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP);
1382 * we choose to take the UsageFault.
1384 if ((excret & R_V7M_EXCRET_S_MASK) ||
1385 (excret & R_V7M_EXCRET_ES_MASK) ||
1386 !(excret & R_V7M_EXCRET_DCRS_MASK)) {
1387 ufault = true;
1390 if (excret & R_V7M_EXCRET_RES0_MASK) {
1391 ufault = true;
1393 } else {
1394 /* For v7M we only recognize certain combinations of the low bits */
1395 switch (excret & 0xf) {
1396 case 1: /* Return to Handler */
1397 break;
1398 case 13: /* Return to Thread using Process stack */
1399 case 9: /* Return to Thread using Main stack */
1401 * We only need to check NONBASETHRDENA for v7M, because in
1402 * v8M this bit does not exist (it is RES1).
1404 if (!rettobase &&
1405 !(env->v7m.ccr[env->v7m.secure] &
1406 R_V7M_CCR_NONBASETHRDENA_MASK)) {
1407 ufault = true;
1409 break;
1410 default:
1411 ufault = true;
1416 * Set CONTROL.SPSEL from excret.SPSEL. Since we're still in
1417 * Handler mode (and will be until we write the new XPSR.Interrupt
1418 * field) this does not switch around the current stack pointer.
1419 * We must do this before we do any kind of tailchaining, including
1420 * for the derived exceptions on integrity check failures, or we will
1421 * give the guest an incorrect EXCRET.SPSEL value on exception entry.
1423 write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
1426 * Clear scratch FP values left in caller saved registers; this
1427 * must happen before any kind of tail chaining.
1429 if ((env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_CLRONRET_MASK) &&
1430 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
1431 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1432 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1433 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1434 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1435 "stackframe: error during lazy state deactivation\n");
1436 v7m_exception_taken(cpu, excret, true, false);
1437 return;
1438 } else {
1439 /* Clear s0..s15 and FPSCR */
1440 int i;
1442 for (i = 0; i < 16; i += 2) {
1443 *aa32_vfp_dreg(env, i / 2) = 0;
1445 vfp_set_fpscr(env, 0);
1449 if (sfault) {
1450 env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
1451 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1452 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1453 "stackframe: failed EXC_RETURN.ES validity check\n");
1454 v7m_exception_taken(cpu, excret, true, false);
1455 return;
1458 if (ufault) {
1460 * Bad exception return: instead of popping the exception
1461 * stack, directly take a usage fault on the current stack.
1463 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1464 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
1465 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1466 "stackframe: failed exception return integrity check\n");
1467 v7m_exception_taken(cpu, excret, true, false);
1468 return;
1472 * Tailchaining: if there is currently a pending exception that
1473 * is high enough priority to preempt execution at the level we're
1474 * about to return to, then just directly take that exception now,
1475 * avoiding an unstack-and-then-stack. Note that now we have
1476 * deactivated the previous exception by calling armv7m_nvic_complete_irq()
1477 * our current execution priority is already the execution priority we are
1478 * returning to -- none of the state we would unstack or set based on
1479 * the EXCRET value affects it.
1481 if (armv7m_nvic_can_take_pending_exception(env->nvic)) {
1482 qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n");
1483 v7m_exception_taken(cpu, excret, true, false);
1484 return;
1487 switch_v7m_security_state(env, return_to_secure);
1491 * The stack pointer we should be reading the exception frame from
1492 * depends on bits in the magic exception return type value (and
1493 * for v8M isn't necessarily the stack pointer we will eventually
1494 * end up resuming execution with). Get a pointer to the location
1495 * in the CPU state struct where the SP we need is currently being
1496 * stored; we will use and modify it in place.
1497 * We use this limited C variable scope so we don't accidentally
1498 * use 'frame_sp_p' after we do something that makes it invalid.
1500 uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
1501 return_to_secure,
1502 !return_to_handler,
1503 return_to_sp_process);
1504 uint32_t frameptr = *frame_sp_p;
1505 bool pop_ok = true;
1506 ARMMMUIdx mmu_idx;
1507 bool return_to_priv = return_to_handler ||
1508 !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK);
1510 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure,
1511 return_to_priv);
1513 if (!QEMU_IS_ALIGNED(frameptr, 8) &&
1514 arm_feature(env, ARM_FEATURE_V8)) {
1515 qemu_log_mask(LOG_GUEST_ERROR,
1516 "M profile exception return with non-8-aligned SP "
1517 "for destination state is UNPREDICTABLE\n");
1520 /* Do we need to pop callee-saved registers? */
1521 if (return_to_secure &&
1522 ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
1523 (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
1524 uint32_t actual_sig;
1526 pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx);
1528 if (pop_ok && v7m_integrity_sig(env, excret) != actual_sig) {
1529 /* Take a SecureFault on the current stack */
1530 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
1531 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1532 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1533 "stackframe: failed exception return integrity "
1534 "signature check\n");
1535 v7m_exception_taken(cpu, excret, true, false);
1536 return;
1539 pop_ok = pop_ok &&
1540 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
1541 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) &&
1542 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) &&
1543 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) &&
1544 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) &&
1545 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) &&
1546 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) &&
1547 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx);
1549 frameptr += 0x28;
1552 /* Pop registers */
1553 pop_ok = pop_ok &&
1554 v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) &&
1555 v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) &&
1556 v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) &&
1557 v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) &&
1558 v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) &&
1559 v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) &&
1560 v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) &&
1561 v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx);
1563 if (!pop_ok) {
1565 * v7m_stack_read() pended a fault, so take it (as a tail
1566 * chained exception on the same stack frame)
1568 qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n");
1569 v7m_exception_taken(cpu, excret, true, false);
1570 return;
1574 * Returning from an exception with a PC with bit 0 set is defined
1575 * behaviour on v8M (bit 0 is ignored), but for v7M it was specified
1576 * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore
1577 * the lsbit, and there are several RTOSes out there which incorrectly
1578 * assume the r15 in the stack frame should be a Thumb-style "lsbit
1579 * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but
1580 * complain about the badly behaved guest.
1582 if (env->regs[15] & 1) {
1583 env->regs[15] &= ~1U;
1584 if (!arm_feature(env, ARM_FEATURE_V8)) {
1585 qemu_log_mask(LOG_GUEST_ERROR,
1586 "M profile return from interrupt with misaligned "
1587 "PC is UNPREDICTABLE on v7M\n");
1591 if (arm_feature(env, ARM_FEATURE_V8)) {
1593 * For v8M we have to check whether the xPSR exception field
1594 * matches the EXCRET value for return to handler/thread
1595 * before we commit to changing the SP and xPSR.
1597 bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
1598 if (return_to_handler != will_be_handler) {
1600 * Take an INVPC UsageFault on the current stack.
1601 * By this point we will have switched to the security state
1602 * for the background state, so this UsageFault will target
1603 * that state.
1605 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1606 env->v7m.secure);
1607 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1608 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1609 "stackframe: failed exception return integrity "
1610 "check\n");
1611 v7m_exception_taken(cpu, excret, true, false);
1612 return;
1616 if (!ftype) {
1617 /* FP present and we need to handle it */
1618 if (!return_to_secure &&
1619 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK)) {
1620 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1621 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1622 qemu_log_mask(CPU_LOG_INT,
1623 "...taking SecureFault on existing stackframe: "
1624 "Secure LSPACT set but exception return is "
1625 "not to secure state\n");
1626 v7m_exception_taken(cpu, excret, true, false);
1627 return;
1630 restore_s16_s31 = return_to_secure &&
1631 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
1633 if (env->v7m.fpccr[return_to_secure] & R_V7M_FPCCR_LSPACT_MASK) {
1634 /* State in FPU is still valid, just clear LSPACT */
1635 env->v7m.fpccr[return_to_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
1636 } else {
1637 int i;
1638 uint32_t fpscr;
1639 bool cpacr_pass, nsacr_pass;
1641 cpacr_pass = v7m_cpacr_pass(env, return_to_secure,
1642 return_to_priv);
1643 nsacr_pass = return_to_secure ||
1644 extract32(env->v7m.nsacr, 10, 1);
1646 if (!cpacr_pass) {
1647 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1648 return_to_secure);
1649 env->v7m.cfsr[return_to_secure] |= R_V7M_CFSR_NOCP_MASK;
1650 qemu_log_mask(CPU_LOG_INT,
1651 "...taking UsageFault on existing "
1652 "stackframe: CPACR.CP10 prevents unstacking "
1653 "FP regs\n");
1654 v7m_exception_taken(cpu, excret, true, false);
1655 return;
1656 } else if (!nsacr_pass) {
1657 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
1658 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_INVPC_MASK;
1659 qemu_log_mask(CPU_LOG_INT,
1660 "...taking Secure UsageFault on existing "
1661 "stackframe: NSACR.CP10 prevents unstacking "
1662 "FP regs\n");
1663 v7m_exception_taken(cpu, excret, true, false);
1664 return;
1667 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1668 uint32_t slo, shi;
1669 uint64_t dn;
1670 uint32_t faddr = frameptr + 0x20 + 4 * i;
1672 if (i >= 16) {
1673 faddr += 8; /* Skip the slot for the FPSCR */
1676 pop_ok = pop_ok &&
1677 v7m_stack_read(cpu, &slo, faddr, mmu_idx) &&
1678 v7m_stack_read(cpu, &shi, faddr + 4, mmu_idx);
1680 if (!pop_ok) {
1681 break;
1684 dn = (uint64_t)shi << 32 | slo;
1685 *aa32_vfp_dreg(env, i / 2) = dn;
1687 pop_ok = pop_ok &&
1688 v7m_stack_read(cpu, &fpscr, frameptr + 0x60, mmu_idx);
1689 if (pop_ok) {
1690 vfp_set_fpscr(env, fpscr);
1692 if (!pop_ok) {
1694 * These regs are 0 if security extension present;
1695 * otherwise merely UNKNOWN. We zero always.
1697 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1698 *aa32_vfp_dreg(env, i / 2) = 0;
1700 vfp_set_fpscr(env, 0);
1704 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1705 V7M_CONTROL, FPCA, !ftype);
1707 /* Commit to consuming the stack frame */
1708 frameptr += 0x20;
1709 if (!ftype) {
1710 frameptr += 0x48;
1711 if (restore_s16_s31) {
1712 frameptr += 0x40;
1716 * Undo stack alignment (the SPREALIGN bit indicates that the original
1717 * pre-exception SP was not 8-aligned and we added a padding word to
1718 * align it, so we undo this by ORing in the bit that increases it
1719 * from the current 8-aligned value to the 8-unaligned value. (Adding 4
1720 * would work too but a logical OR is how the pseudocode specifies it.)
1722 if (xpsr & XPSR_SPREALIGN) {
1723 frameptr |= 4;
1725 *frame_sp_p = frameptr;
1728 xpsr_mask = ~(XPSR_SPREALIGN | XPSR_SFPA);
1729 if (!arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
1730 xpsr_mask &= ~XPSR_GE;
1732 /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
1733 xpsr_write(env, xpsr, xpsr_mask);
1735 if (env->v7m.secure) {
1736 bool sfpa = xpsr & XPSR_SFPA;
1738 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1739 V7M_CONTROL, SFPA, sfpa);
1743 * The restored xPSR exception field will be zero if we're
1744 * resuming in Thread mode. If that doesn't match what the
1745 * exception return excret specified then this is a UsageFault.
1746 * v7M requires we make this check here; v8M did it earlier.
1748 if (return_to_handler != arm_v7m_is_handler_mode(env)) {
1750 * Take an INVPC UsageFault by pushing the stack again;
1751 * we know we're v7M so this is never a Secure UsageFault.
1753 bool ignore_stackfaults;
1755 assert(!arm_feature(env, ARM_FEATURE_V8));
1756 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
1757 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1758 ignore_stackfaults = v7m_push_stack(cpu);
1759 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
1760 "failed exception return integrity check\n");
1761 v7m_exception_taken(cpu, excret, false, ignore_stackfaults);
1762 return;
1765 /* Otherwise, we have a successful exception exit. */
1766 arm_clear_exclusive(env);
1767 qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
1770 static bool do_v7m_function_return(ARMCPU *cpu)
1773 * v8M security extensions magic function return.
1774 * We may either:
1775 * (1) throw an exception (longjump)
1776 * (2) return true if we successfully handled the function return
1777 * (3) return false if we failed a consistency check and have
1778 * pended a UsageFault that needs to be taken now
1780 * At this point the magic return value is split between env->regs[15]
1781 * and env->thumb. We don't bother to reconstitute it because we don't
1782 * need it (all values are handled the same way).
1784 CPUARMState *env = &cpu->env;
1785 uint32_t newpc, newpsr, newpsr_exc;
1787 qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n");
1790 bool threadmode, spsel;
1791 TCGMemOpIdx oi;
1792 ARMMMUIdx mmu_idx;
1793 uint32_t *frame_sp_p;
1794 uint32_t frameptr;
1796 /* Pull the return address and IPSR from the Secure stack */
1797 threadmode = !arm_v7m_is_handler_mode(env);
1798 spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
1800 frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
1801 frameptr = *frame_sp_p;
1804 * These loads may throw an exception (for MPU faults). We want to
1805 * do them as secure, so work out what MMU index that is.
1807 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
1808 oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx));
1809 newpc = helper_le_ldul_mmu(env, frameptr, oi, 0);
1810 newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0);
1812 /* Consistency checks on new IPSR */
1813 newpsr_exc = newpsr & XPSR_EXCP;
1814 if (!((env->v7m.exception == 0 && newpsr_exc == 0) ||
1815 (env->v7m.exception == 1 && newpsr_exc != 0))) {
1816 /* Pend the fault and tell our caller to take it */
1817 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1818 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1819 env->v7m.secure);
1820 qemu_log_mask(CPU_LOG_INT,
1821 "...taking INVPC UsageFault: "
1822 "IPSR consistency check failed\n");
1823 return false;
1826 *frame_sp_p = frameptr + 8;
1829 /* This invalidates frame_sp_p */
1830 switch_v7m_security_state(env, true);
1831 env->v7m.exception = newpsr_exc;
1832 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
1833 if (newpsr & XPSR_SFPA) {
1834 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK;
1836 xpsr_write(env, 0, XPSR_IT);
1837 env->thumb = newpc & 1;
1838 env->regs[15] = newpc & ~1;
1840 qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
1841 return true;
1844 static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
1845 uint32_t addr, uint16_t *insn)
1848 * Load a 16-bit portion of a v7M instruction, returning true on success,
1849 * or false on failure (in which case we will have pended the appropriate
1850 * exception).
1851 * We need to do the instruction fetch's MPU and SAU checks
1852 * like this because there is no MMU index that would allow
1853 * doing the load with a single function call. Instead we must
1854 * first check that the security attributes permit the load
1855 * and that they don't mismatch on the two halves of the instruction,
1856 * and then we do the load as a secure load (ie using the security
1857 * attributes of the address, not the CPU, as architecturally required).
1859 CPUState *cs = CPU(cpu);
1860 CPUARMState *env = &cpu->env;
1861 V8M_SAttributes sattrs = {};
1862 MemTxAttrs attrs = {};
1863 ARMMMUFaultInfo fi = {};
1864 MemTxResult txres;
1865 target_ulong page_size;
1866 hwaddr physaddr;
1867 int prot;
1869 v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs);
1870 if (!sattrs.nsc || sattrs.ns) {
1872 * This must be the second half of the insn, and it straddles a
1873 * region boundary with the second half not being S&NSC.
1875 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
1876 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1877 qemu_log_mask(CPU_LOG_INT,
1878 "...really SecureFault with SFSR.INVEP\n");
1879 return false;
1881 if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
1882 &physaddr, &attrs, &prot, &page_size, &fi, NULL)) {
1883 /* the MPU lookup failed */
1884 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
1885 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
1886 qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
1887 return false;
1889 *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr,
1890 attrs, &txres);
1891 if (txres != MEMTX_OK) {
1892 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
1893 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
1894 qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");
1895 return false;
1897 return true;
1900 static bool v7m_handle_execute_nsc(ARMCPU *cpu)
1903 * Check whether this attempt to execute code in a Secure & NS-Callable
1904 * memory region is for an SG instruction; if so, then emulate the
1905 * effect of the SG instruction and return true. Otherwise pend
1906 * the correct kind of exception and return false.
1908 CPUARMState *env = &cpu->env;
1909 ARMMMUIdx mmu_idx;
1910 uint16_t insn;
1913 * We should never get here unless get_phys_addr_pmsav8() caused
1914 * an exception for NS executing in S&NSC memory.
1916 assert(!env->v7m.secure);
1917 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
1919 /* We want to do the MPU lookup as secure; work out what mmu_idx that is */
1920 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
1922 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) {
1923 return false;
1926 if (!env->thumb) {
1927 goto gen_invep;
1930 if (insn != 0xe97f) {
1932 * Not an SG instruction first half (we choose the IMPDEF
1933 * early-SG-check option).
1935 goto gen_invep;
1938 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) {
1939 return false;
1942 if (insn != 0xe97f) {
1944 * Not an SG instruction second half (yes, both halves of the SG
1945 * insn have the same hex value)
1947 goto gen_invep;
1951 * OK, we have confirmed that we really have an SG instruction.
1952 * We know we're NS in S memory so don't need to repeat those checks.
1954 qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
1955 ", executing it\n", env->regs[15]);
1956 env->regs[14] &= ~1;
1957 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
1958 switch_v7m_security_state(env, true);
1959 xpsr_write(env, 0, XPSR_IT);
1960 env->regs[15] += 4;
1961 return true;
1963 gen_invep:
1964 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
1965 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1966 qemu_log_mask(CPU_LOG_INT,
1967 "...really SecureFault with SFSR.INVEP\n");
1968 return false;
1971 void arm_v7m_cpu_do_interrupt(CPUState *cs)
1973 ARMCPU *cpu = ARM_CPU(cs);
1974 CPUARMState *env = &cpu->env;
1975 uint32_t lr;
1976 bool ignore_stackfaults;
1978 arm_log_exception(cs->exception_index);
1981 * For exceptions we just mark as pending on the NVIC, and let that
1982 * handle it.
1984 switch (cs->exception_index) {
1985 case EXCP_UDEF:
1986 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
1987 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK;
1988 break;
1989 case EXCP_NOCP:
1992 * NOCP might be directed to something other than the current
1993 * security state if this fault is because of NSACR; we indicate
1994 * the target security state using exception.target_el.
1996 int target_secstate;
1998 if (env->exception.target_el == 3) {
1999 target_secstate = M_REG_S;
2000 } else {
2001 target_secstate = env->v7m.secure;
2003 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, target_secstate);
2004 env->v7m.cfsr[target_secstate] |= R_V7M_CFSR_NOCP_MASK;
2005 break;
2007 case EXCP_INVSTATE:
2008 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2009 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK;
2010 break;
2011 case EXCP_STKOF:
2012 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2013 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
2014 break;
2015 case EXCP_LSERR:
2016 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2017 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
2018 break;
2019 case EXCP_UNALIGNED:
2020 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2021 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
2022 break;
2023 case EXCP_SWI:
2024 /* The PC already points to the next instruction. */
2025 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure);
2026 break;
2027 case EXCP_PREFETCH_ABORT:
2028 case EXCP_DATA_ABORT:
2030 * Note that for M profile we don't have a guest facing FSR, but
2031 * the env->exception.fsr will be populated by the code that
2032 * raises the fault, in the A profile short-descriptor format.
2034 switch (env->exception.fsr & 0xf) {
2035 case M_FAKE_FSR_NSC_EXEC:
2037 * Exception generated when we try to execute code at an address
2038 * which is marked as Secure & Non-Secure Callable and the CPU
2039 * is in the Non-Secure state. The only instruction which can
2040 * be executed like this is SG (and that only if both halves of
2041 * the SG instruction have the same security attributes.)
2042 * Everything else must generate an INVEP SecureFault, so we
2043 * emulate the SG instruction here.
2045 if (v7m_handle_execute_nsc(cpu)) {
2046 return;
2048 break;
2049 case M_FAKE_FSR_SFAULT:
2051 * Various flavours of SecureFault for attempts to execute or
2052 * access data in the wrong security state.
2054 switch (cs->exception_index) {
2055 case EXCP_PREFETCH_ABORT:
2056 if (env->v7m.secure) {
2057 env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
2058 qemu_log_mask(CPU_LOG_INT,
2059 "...really SecureFault with SFSR.INVTRAN\n");
2060 } else {
2061 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2062 qemu_log_mask(CPU_LOG_INT,
2063 "...really SecureFault with SFSR.INVEP\n");
2065 break;
2066 case EXCP_DATA_ABORT:
2067 /* This must be an NS access to S memory */
2068 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
2069 qemu_log_mask(CPU_LOG_INT,
2070 "...really SecureFault with SFSR.AUVIOL\n");
2071 break;
2073 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2074 break;
2075 case 0x8: /* External Abort */
2076 switch (cs->exception_index) {
2077 case EXCP_PREFETCH_ABORT:
2078 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
2079 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
2080 break;
2081 case EXCP_DATA_ABORT:
2082 env->v7m.cfsr[M_REG_NS] |=
2083 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
2084 env->v7m.bfar = env->exception.vaddress;
2085 qemu_log_mask(CPU_LOG_INT,
2086 "...with CFSR.PRECISERR and BFAR 0x%x\n",
2087 env->v7m.bfar);
2088 break;
2090 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2091 break;
2092 default:
2094 * All other FSR values are either MPU faults or "can't happen
2095 * for M profile" cases.
2097 switch (cs->exception_index) {
2098 case EXCP_PREFETCH_ABORT:
2099 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
2100 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
2101 break;
2102 case EXCP_DATA_ABORT:
2103 env->v7m.cfsr[env->v7m.secure] |=
2104 (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
2105 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress;
2106 qemu_log_mask(CPU_LOG_INT,
2107 "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
2108 env->v7m.mmfar[env->v7m.secure]);
2109 break;
2111 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM,
2112 env->v7m.secure);
2113 break;
2115 break;
2116 case EXCP_BKPT:
2117 if (semihosting_enabled()) {
2118 int nr;
2119 nr = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) & 0xff;
2120 if (nr == 0xab) {
2121 env->regs[15] += 2;
2122 qemu_log_mask(CPU_LOG_INT,
2123 "...handling as semihosting call 0x%x\n",
2124 env->regs[0]);
2125 env->regs[0] = do_arm_semihosting(env);
2126 return;
2129 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false);
2130 break;
2131 case EXCP_IRQ:
2132 break;
2133 case EXCP_EXCEPTION_EXIT:
2134 if (env->regs[15] < EXC_RETURN_MIN_MAGIC) {
2135 /* Must be v8M security extension function return */
2136 assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC);
2137 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
2138 if (do_v7m_function_return(cpu)) {
2139 return;
2141 } else {
2142 do_v7m_exception_exit(cpu);
2143 return;
2145 break;
2146 case EXCP_LAZYFP:
2148 * We already pended the specific exception in the NVIC in the
2149 * v7m_preserve_fp_state() helper function.
2151 break;
2152 default:
2153 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
2154 return; /* Never happens. Keep compiler happy. */
2157 if (arm_feature(env, ARM_FEATURE_V8)) {
2158 lr = R_V7M_EXCRET_RES1_MASK |
2159 R_V7M_EXCRET_DCRS_MASK;
2161 * The S bit indicates whether we should return to Secure
2162 * or NonSecure (ie our current state).
2163 * The ES bit indicates whether we're taking this exception
2164 * to Secure or NonSecure (ie our target state). We set it
2165 * later, in v7m_exception_taken().
2166 * The SPSEL bit is also set in v7m_exception_taken() for v8M.
2167 * This corresponds to the ARM ARM pseudocode for v8M setting
2168 * some LR bits in PushStack() and some in ExceptionTaken();
2169 * the distinction matters for the tailchain cases where we
2170 * can take an exception without pushing the stack.
2172 if (env->v7m.secure) {
2173 lr |= R_V7M_EXCRET_S_MASK;
2175 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
2176 lr |= R_V7M_EXCRET_FTYPE_MASK;
2178 } else {
2179 lr = R_V7M_EXCRET_RES1_MASK |
2180 R_V7M_EXCRET_S_MASK |
2181 R_V7M_EXCRET_DCRS_MASK |
2182 R_V7M_EXCRET_FTYPE_MASK |
2183 R_V7M_EXCRET_ES_MASK;
2184 if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
2185 lr |= R_V7M_EXCRET_SPSEL_MASK;
2188 if (!arm_v7m_is_handler_mode(env)) {
2189 lr |= R_V7M_EXCRET_MODE_MASK;
2192 ignore_stackfaults = v7m_push_stack(cpu);
2193 v7m_exception_taken(cpu, lr, false, ignore_stackfaults);
2196 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
2198 uint32_t mask;
2199 unsigned el = arm_current_el(env);
2201 /* First handle registers which unprivileged can read */
2203 switch (reg) {
2204 case 0 ... 7: /* xPSR sub-fields */
2205 mask = 0;
2206 if ((reg & 1) && el) {
2207 mask |= XPSR_EXCP; /* IPSR (unpriv. reads as zero) */
2209 if (!(reg & 4)) {
2210 mask |= XPSR_NZCV | XPSR_Q; /* APSR */
2211 if (arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
2212 mask |= XPSR_GE;
2215 /* EPSR reads as zero */
2216 return xpsr_read(env) & mask;
2217 break;
2218 case 20: /* CONTROL */
2220 uint32_t value = env->v7m.control[env->v7m.secure];
2221 if (!env->v7m.secure) {
2222 /* SFPA is RAZ/WI from NS; FPCA is stored in the M_REG_S bank */
2223 value |= env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK;
2225 return value;
2227 case 0x94: /* CONTROL_NS */
2229 * We have to handle this here because unprivileged Secure code
2230 * can read the NS CONTROL register.
2232 if (!env->v7m.secure) {
2233 return 0;
2235 return env->v7m.control[M_REG_NS] |
2236 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK);
2239 if (el == 0) {
2240 return 0; /* unprivileged reads others as zero */
2243 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2244 switch (reg) {
2245 case 0x88: /* MSP_NS */
2246 if (!env->v7m.secure) {
2247 return 0;
2249 return env->v7m.other_ss_msp;
2250 case 0x89: /* PSP_NS */
2251 if (!env->v7m.secure) {
2252 return 0;
2254 return env->v7m.other_ss_psp;
2255 case 0x8a: /* MSPLIM_NS */
2256 if (!env->v7m.secure) {
2257 return 0;
2259 return env->v7m.msplim[M_REG_NS];
2260 case 0x8b: /* PSPLIM_NS */
2261 if (!env->v7m.secure) {
2262 return 0;
2264 return env->v7m.psplim[M_REG_NS];
2265 case 0x90: /* PRIMASK_NS */
2266 if (!env->v7m.secure) {
2267 return 0;
2269 return env->v7m.primask[M_REG_NS];
2270 case 0x91: /* BASEPRI_NS */
2271 if (!env->v7m.secure) {
2272 return 0;
2274 return env->v7m.basepri[M_REG_NS];
2275 case 0x93: /* FAULTMASK_NS */
2276 if (!env->v7m.secure) {
2277 return 0;
2279 return env->v7m.faultmask[M_REG_NS];
2280 case 0x98: /* SP_NS */
2283 * This gives the non-secure SP selected based on whether we're
2284 * currently in handler mode or not, using the NS CONTROL.SPSEL.
2286 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2288 if (!env->v7m.secure) {
2289 return 0;
2291 if (!arm_v7m_is_handler_mode(env) && spsel) {
2292 return env->v7m.other_ss_psp;
2293 } else {
2294 return env->v7m.other_ss_msp;
2297 default:
2298 break;
2302 switch (reg) {
2303 case 8: /* MSP */
2304 return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];
2305 case 9: /* PSP */
2306 return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;
2307 case 10: /* MSPLIM */
2308 if (!arm_feature(env, ARM_FEATURE_V8)) {
2309 goto bad_reg;
2311 return env->v7m.msplim[env->v7m.secure];
2312 case 11: /* PSPLIM */
2313 if (!arm_feature(env, ARM_FEATURE_V8)) {
2314 goto bad_reg;
2316 return env->v7m.psplim[env->v7m.secure];
2317 case 16: /* PRIMASK */
2318 return env->v7m.primask[env->v7m.secure];
2319 case 17: /* BASEPRI */
2320 case 18: /* BASEPRI_MAX */
2321 return env->v7m.basepri[env->v7m.secure];
2322 case 19: /* FAULTMASK */
2323 return env->v7m.faultmask[env->v7m.secure];
2324 default:
2325 bad_reg:
2326 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"
2327 " register %d\n", reg);
2328 return 0;
2332 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
2335 * We're passed bits [11..0] of the instruction; extract
2336 * SYSm and the mask bits.
2337 * Invalid combinations of SYSm and mask are UNPREDICTABLE;
2338 * we choose to treat them as if the mask bits were valid.
2339 * NB that the pseudocode 'mask' variable is bits [11..10],
2340 * whereas ours is [11..8].
2342 uint32_t mask = extract32(maskreg, 8, 4);
2343 uint32_t reg = extract32(maskreg, 0, 8);
2344 int cur_el = arm_current_el(env);
2346 if (cur_el == 0 && reg > 7 && reg != 20) {
2348 * only xPSR sub-fields and CONTROL.SFPA may be written by
2349 * unprivileged code
2351 return;
2354 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2355 switch (reg) {
2356 case 0x88: /* MSP_NS */
2357 if (!env->v7m.secure) {
2358 return;
2360 env->v7m.other_ss_msp = val;
2361 return;
2362 case 0x89: /* PSP_NS */
2363 if (!env->v7m.secure) {
2364 return;
2366 env->v7m.other_ss_psp = val;
2367 return;
2368 case 0x8a: /* MSPLIM_NS */
2369 if (!env->v7m.secure) {
2370 return;
2372 env->v7m.msplim[M_REG_NS] = val & ~7;
2373 return;
2374 case 0x8b: /* PSPLIM_NS */
2375 if (!env->v7m.secure) {
2376 return;
2378 env->v7m.psplim[M_REG_NS] = val & ~7;
2379 return;
2380 case 0x90: /* PRIMASK_NS */
2381 if (!env->v7m.secure) {
2382 return;
2384 env->v7m.primask[M_REG_NS] = val & 1;
2385 return;
2386 case 0x91: /* BASEPRI_NS */
2387 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) {
2388 return;
2390 env->v7m.basepri[M_REG_NS] = val & 0xff;
2391 return;
2392 case 0x93: /* FAULTMASK_NS */
2393 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) {
2394 return;
2396 env->v7m.faultmask[M_REG_NS] = val & 1;
2397 return;
2398 case 0x94: /* CONTROL_NS */
2399 if (!env->v7m.secure) {
2400 return;
2402 write_v7m_control_spsel_for_secstate(env,
2403 val & R_V7M_CONTROL_SPSEL_MASK,
2404 M_REG_NS);
2405 if (arm_feature(env, ARM_FEATURE_M_MAIN)) {
2406 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK;
2407 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK;
2410 * SFPA is RAZ/WI from NS. FPCA is RO if NSACR.CP10 == 0,
2411 * RES0 if the FPU is not present, and is stored in the S bank
2413 if (arm_feature(env, ARM_FEATURE_VFP) &&
2414 extract32(env->v7m.nsacr, 10, 1)) {
2415 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2416 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2418 return;
2419 case 0x98: /* SP_NS */
2422 * This gives the non-secure SP selected based on whether we're
2423 * currently in handler mode or not, using the NS CONTROL.SPSEL.
2425 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2426 bool is_psp = !arm_v7m_is_handler_mode(env) && spsel;
2427 uint32_t limit;
2429 if (!env->v7m.secure) {
2430 return;
2433 limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
2435 if (val < limit) {
2436 CPUState *cs = env_cpu(env);
2438 cpu_restore_state(cs, GETPC(), true);
2439 raise_exception(env, EXCP_STKOF, 0, 1);
2442 if (is_psp) {
2443 env->v7m.other_ss_psp = val;
2444 } else {
2445 env->v7m.other_ss_msp = val;
2447 return;
2449 default:
2450 break;
2454 switch (reg) {
2455 case 0 ... 7: /* xPSR sub-fields */
2456 /* only APSR is actually writable */
2457 if (!(reg & 4)) {
2458 uint32_t apsrmask = 0;
2460 if (mask & 8) {
2461 apsrmask |= XPSR_NZCV | XPSR_Q;
2463 if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
2464 apsrmask |= XPSR_GE;
2466 xpsr_write(env, val, apsrmask);
2468 break;
2469 case 8: /* MSP */
2470 if (v7m_using_psp(env)) {
2471 env->v7m.other_sp = val;
2472 } else {
2473 env->regs[13] = val;
2475 break;
2476 case 9: /* PSP */
2477 if (v7m_using_psp(env)) {
2478 env->regs[13] = val;
2479 } else {
2480 env->v7m.other_sp = val;
2482 break;
2483 case 10: /* MSPLIM */
2484 if (!arm_feature(env, ARM_FEATURE_V8)) {
2485 goto bad_reg;
2487 env->v7m.msplim[env->v7m.secure] = val & ~7;
2488 break;
2489 case 11: /* PSPLIM */
2490 if (!arm_feature(env, ARM_FEATURE_V8)) {
2491 goto bad_reg;
2493 env->v7m.psplim[env->v7m.secure] = val & ~7;
2494 break;
2495 case 16: /* PRIMASK */
2496 env->v7m.primask[env->v7m.secure] = val & 1;
2497 break;
2498 case 17: /* BASEPRI */
2499 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2500 goto bad_reg;
2502 env->v7m.basepri[env->v7m.secure] = val & 0xff;
2503 break;
2504 case 18: /* BASEPRI_MAX */
2505 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2506 goto bad_reg;
2508 val &= 0xff;
2509 if (val != 0 && (val < env->v7m.basepri[env->v7m.secure]
2510 || env->v7m.basepri[env->v7m.secure] == 0)) {
2511 env->v7m.basepri[env->v7m.secure] = val;
2513 break;
2514 case 19: /* FAULTMASK */
2515 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2516 goto bad_reg;
2518 env->v7m.faultmask[env->v7m.secure] = val & 1;
2519 break;
2520 case 20: /* CONTROL */
2522 * Writing to the SPSEL bit only has an effect if we are in
2523 * thread mode; other bits can be updated by any privileged code.
2524 * write_v7m_control_spsel() deals with updating the SPSEL bit in
2525 * env->v7m.control, so we only need update the others.
2526 * For v7M, we must just ignore explicit writes to SPSEL in handler
2527 * mode; for v8M the write is permitted but will have no effect.
2528 * All these bits are writes-ignored from non-privileged code,
2529 * except for SFPA.
2531 if (cur_el > 0 && (arm_feature(env, ARM_FEATURE_V8) ||
2532 !arm_v7m_is_handler_mode(env))) {
2533 write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
2535 if (cur_el > 0 && arm_feature(env, ARM_FEATURE_M_MAIN)) {
2536 env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
2537 env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
2539 if (arm_feature(env, ARM_FEATURE_VFP)) {
2541 * SFPA is RAZ/WI from NS or if no FPU.
2542 * FPCA is RO if NSACR.CP10 == 0, RES0 if the FPU is not present.
2543 * Both are stored in the S bank.
2545 if (env->v7m.secure) {
2546 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
2547 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_SFPA_MASK;
2549 if (cur_el > 0 &&
2550 (env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_SECURITY) ||
2551 extract32(env->v7m.nsacr, 10, 1))) {
2552 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2553 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2556 break;
2557 default:
2558 bad_reg:
2559 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
2560 " register %d\n", reg);
2561 return;
2565 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
2567 /* Implement the TT instruction. op is bits [7:6] of the insn. */
2568 bool forceunpriv = op & 1;
2569 bool alt = op & 2;
2570 V8M_SAttributes sattrs = {};
2571 uint32_t tt_resp;
2572 bool r, rw, nsr, nsrw, mrvalid;
2573 int prot;
2574 ARMMMUFaultInfo fi = {};
2575 MemTxAttrs attrs = {};
2576 hwaddr phys_addr;
2577 ARMMMUIdx mmu_idx;
2578 uint32_t mregion;
2579 bool targetpriv;
2580 bool targetsec = env->v7m.secure;
2581 bool is_subpage;
2584 * Work out what the security state and privilege level we're
2585 * interested in is...
2587 if (alt) {
2588 targetsec = !targetsec;
2591 if (forceunpriv) {
2592 targetpriv = false;
2593 } else {
2594 targetpriv = arm_v7m_is_handler_mode(env) ||
2595 !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK);
2598 /* ...and then figure out which MMU index this is */
2599 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv);
2602 * We know that the MPU and SAU don't care about the access type
2603 * for our purposes beyond that we don't want to claim to be
2604 * an insn fetch, so we arbitrarily call this a read.
2608 * MPU region info only available for privileged or if
2609 * inspecting the other MPU state.
2611 if (arm_current_el(env) != 0 || alt) {
2612 /* We can ignore the return value as prot is always set */
2613 pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx,
2614 &phys_addr, &attrs, &prot, &is_subpage,
2615 &fi, &mregion);
2616 if (mregion == -1) {
2617 mrvalid = false;
2618 mregion = 0;
2619 } else {
2620 mrvalid = true;
2622 r = prot & PAGE_READ;
2623 rw = prot & PAGE_WRITE;
2624 } else {
2625 r = false;
2626 rw = false;
2627 mrvalid = false;
2628 mregion = 0;
2631 if (env->v7m.secure) {
2632 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs);
2633 nsr = sattrs.ns && r;
2634 nsrw = sattrs.ns && rw;
2635 } else {
2636 sattrs.ns = true;
2637 nsr = false;
2638 nsrw = false;
2641 tt_resp = (sattrs.iregion << 24) |
2642 (sattrs.irvalid << 23) |
2643 ((!sattrs.ns) << 22) |
2644 (nsrw << 21) |
2645 (nsr << 20) |
2646 (rw << 19) |
2647 (r << 18) |
2648 (sattrs.srvalid << 17) |
2649 (mrvalid << 16) |
2650 (sattrs.sregion << 8) |
2651 mregion;
2653 return tt_resp;
2656 #endif /* !CONFIG_USER_ONLY */
2658 ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
2659 bool secstate, bool priv, bool negpri)
2661 ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
2663 if (priv) {
2664 mmu_idx |= ARM_MMU_IDX_M_PRIV;
2667 if (negpri) {
2668 mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
2671 if (secstate) {
2672 mmu_idx |= ARM_MMU_IDX_M_S;
2675 return mmu_idx;
2678 ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
2679 bool secstate, bool priv)
2681 bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate);
2683 return arm_v7m_mmu_idx_all(env, secstate, priv, negpri);
2686 /* Return the MMU index for a v7M CPU in the specified security state */
2687 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
2689 bool priv = arm_current_el(env) != 0;
2691 return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);