target-arm/op_helper.c

   1 /*
   2  *  ARM helper routines
   3  *
   4  *  Copyright (c) 2005-2007 CodeSourcery, LLC
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "cpu.h"
  20 #include "exec/helper-proto.h"
  21 #include "internals.h"
  22 #include "exec/cpu_ldst.h"
  23
  24 #define SIGNBIT (uint32_t)0x80000000
  25 #define SIGNBIT64 ((uint64_t)1 << 63)
  26
  27 static void raise_exception(CPUARMState *env, uint32_t excp,
  28                             uint32_t syndrome, uint32_t target_el)
  29 {
  30     CPUState *cs = CPU(arm_env_get_cpu(env));
  31
  32     assert(!excp_is_internal(excp));
  33     cs->exception_index = excp;
  34     env->exception.syndrome = syndrome;
  35     env->exception.target_el = target_el;
  36     cpu_loop_exit(cs);
  37 }
  38
  39 static int exception_target_el(CPUARMState *env)
  40 {
  41     int target_el = MAX(1, arm_current_el(env));
  42
  43     /* No such thing as secure EL1 if EL3 is aarch32, so update the target EL
  44      * to EL3 in this case.
  45      */
  46     if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
  47         target_el = 3;
  48     }
  49
  50     return target_el;
  51 }
  52
  53 uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
  54                           uint32_t rn, uint32_t maxindex)
  55 {
  56     uint32_t val;
  57     uint32_t tmp;
  58     int index;
  59     int shift;
  60     uint64_t *table;
  61     table = (uint64_t *)&env->vfp.regs[rn];
  62     val = 0;
  63     for (shift = 0; shift < 32; shift += 8) {
  64         index = (ireg >> shift) & 0xff;
  65         if (index < maxindex) {
  66             tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
  67             val |= tmp << shift;
  68         } else {
  69             val |= def & (0xff << shift);
  70         }
  71     }
  72     return val;
  73 }
  74
  75 #if !defined(CONFIG_USER_ONLY)
  76
  77 /* try to fill the TLB and return an exception if error. If retaddr is
  78  * NULL, it means that the function was called in C code (i.e. not
  79  * from generated code or from helper.c)
  80  */
  81 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
  82               uintptr_t retaddr)
  83 {
  84     bool ret;
  85     uint32_t fsr = 0;
  86     ARMMMUFaultInfo fi = {};
  87
  88     ret = arm_tlb_fill(cs, addr, is_write, mmu_idx, &fsr, &fi);
  89     if (unlikely(ret)) {
  90         ARMCPU *cpu = ARM_CPU(cs);
  91         CPUARMState *env = &cpu->env;
  92         uint32_t syn, exc;
  93         unsigned int target_el;
  94         bool same_el;
  95
  96         if (retaddr) {
  97             /* now we have a real cpu fault */
  98             cpu_restore_state(cs, retaddr);
  99         }
 100
 101         target_el = exception_target_el(env);
 102         if (fi.stage2) {
 103             target_el = 2;
 104             env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4;
 105         }
 106         same_el = arm_current_el(env) == target_el;
 107         /* AArch64 syndrome does not have an LPAE bit */
 108         syn = fsr & ~(1 << 9);
 109
 110         /* For insn and data aborts we assume there is no instruction syndrome
 111          * information; this is always true for exceptions reported to EL1.
 112          */
 113         if (is_write == 2) {
 114             syn = syn_insn_abort(same_el, 0, fi.s1ptw, syn);
 115             exc = EXCP_PREFETCH_ABORT;
 116         } else {
 117             syn = syn_data_abort(same_el, 0, 0, fi.s1ptw, is_write == 1, syn);
 118             if (is_write == 1 && arm_feature(env, ARM_FEATURE_V6)) {
 119                 fsr |= (1 << 11);
 120             }
 121             exc = EXCP_DATA_ABORT;
 122         }
 123
 124         env->exception.vaddress = addr;
 125         env->exception.fsr = fsr;
 126         raise_exception(env, exc, syn, target_el);
 127     }
 128 }
 129 #endif
 130
 131 uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
 132 {
 133     uint32_t res = a + b;
 134     if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
 135         env->QF = 1;
 136     return res;
 137 }
 138
 139 uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
 140 {
 141     uint32_t res = a + b;
 142     if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
 143         env->QF = 1;
 144         res = ~(((int32_t)a >> 31) ^ SIGNBIT);
 145     }
 146     return res;
 147 }
 148
 149 uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
 150 {
 151     uint32_t res = a - b;
 152     if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
 153         env->QF = 1;
 154         res = ~(((int32_t)a >> 31) ^ SIGNBIT);
 155     }
 156     return res;
 157 }
 158
 159 uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
 160 {
 161     uint32_t res;
 162     if (val >= 0x40000000) {
 163         res = ~SIGNBIT;
 164         env->QF = 1;
 165     } else if (val <= (int32_t)0xc0000000) {
 166         res = SIGNBIT;
 167         env->QF = 1;
 168     } else {
 169         res = val << 1;
 170     }
 171     return res;
 172 }
 173
 174 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
 175 {
 176     uint32_t res = a + b;
 177     if (res < a) {
 178         env->QF = 1;
 179         res = ~0;
 180     }
 181     return res;
 182 }
 183
 184 uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
 185 {
 186     uint32_t res = a - b;
 187     if (res > a) {
 188         env->QF = 1;
 189         res = 0;
 190     }
 191     return res;
 192 }
 193
 194 /* Signed saturation.  */
 195 static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
 196 {
 197     int32_t top;
 198     uint32_t mask;
 199
 200     top = val >> shift;
 201     mask = (1u << shift) - 1;
 202     if (top > 0) {
 203         env->QF = 1;
 204         return mask;
 205     } else if (top < -1) {
 206         env->QF = 1;
 207         return ~mask;
 208     }
 209     return val;
 210 }
 211
 212 /* Unsigned saturation.  */
 213 static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
 214 {
 215     uint32_t max;
 216
 217     max = (1u << shift) - 1;
 218     if (val < 0) {
 219         env->QF = 1;
 220         return 0;
 221     } else if (val > max) {
 222         env->QF = 1;
 223         return max;
 224     }
 225     return val;
 226 }
 227
 228 /* Signed saturate.  */
 229 uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
 230 {
 231     return do_ssat(env, x, shift);
 232 }
 233
 234 /* Dual halfword signed saturate.  */
 235 uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
 236 {
 237     uint32_t res;
 238
 239     res = (uint16_t)do_ssat(env, (int16_t)x, shift);
 240     res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
 241     return res;
 242 }
 243
 244 /* Unsigned saturate.  */
 245 uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
 246 {
 247     return do_usat(env, x, shift);
 248 }
 249
 250 /* Dual halfword unsigned saturate.  */
 251 uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
 252 {
 253     uint32_t res;
 254
 255     res = (uint16_t)do_usat(env, (int16_t)x, shift);
 256     res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
 257     return res;
 258 }
 259
 260 /* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped.
 261  * The function returns the target EL (1-3) if the instruction is to be trapped;
 262  * otherwise it returns 0 indicating it is not trapped.
 263  */
 264 static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
 265 {
 266     int cur_el = arm_current_el(env);
 267     uint64_t mask;
 268
 269     /* If we are currently in EL0 then we need to check if SCTLR is set up for
 270      * WFx instructions being trapped to EL1. These trap bits don't exist in v7.
 271      */
 272     if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) {
 273         int target_el;
 274
 275         mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI;
 276         if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) {
 277             /* Secure EL0 and Secure PL1 is at EL3 */
 278             target_el = 3;
 279         } else {
 280             target_el = 1;
 281         }
 282
 283         if (!(env->cp15.sctlr_el[target_el] & mask)) {
 284             return target_el;
 285         }
 286     }
 287
 288     /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it
 289      * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the
 290      * bits will be zero indicating no trap.
 291      */
 292     if (cur_el < 2 && !arm_is_secure(env)) {
 293         mask = (is_wfe) ? HCR_TWE : HCR_TWI;
 294         if (env->cp15.hcr_el2 & mask) {
 295             return 2;
 296         }
 297     }
 298
 299     /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */
 300     if (cur_el < 3) {
 301         mask = (is_wfe) ? SCR_TWE : SCR_TWI;
 302         if (env->cp15.scr_el3 & mask) {
 303             return 3;
 304         }
 305     }
 306
 307     return 0;
 308 }
 309
 310 void HELPER(wfi)(CPUARMState *env)
 311 {
 312     CPUState *cs = CPU(arm_env_get_cpu(env));
 313     int target_el = check_wfx_trap(env, false);
 314
 315     if (cpu_has_work(cs)) {
 316         /* Don't bother to go into our "low power state" if
 317          * we would just wake up immediately.
 318          */
 319         return;
 320     }
 321
 322     if (target_el) {
 323         env->pc -= 4;
 324         raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0), target_el);
 325     }
 326
 327     cs->exception_index = EXCP_HLT;
 328     cs->halted = 1;
 329     cpu_loop_exit(cs);
 330 }
 331
 332 void HELPER(wfe)(CPUARMState *env)
 333 {
 334     /* This is a hint instruction that is semantically different
 335      * from YIELD even though we currently implement it identically.
 336      * Don't actually halt the CPU, just yield back to top
 337      * level loop. This is not going into a "low power state"
 338      * (ie halting until some event occurs), so we never take
 339      * a configurable trap to a different exception level.
 340      */
 341     HELPER(yield)(env);
 342 }
 343
 344 void HELPER(yield)(CPUARMState *env)
 345 {
 346     ARMCPU *cpu = arm_env_get_cpu(env);
 347     CPUState *cs = CPU(cpu);
 348
 349     /* This is a non-trappable hint instruction that generally indicates
 350      * that the guest is currently busy-looping. Yield control back to the
 351      * top level loop so that a more deserving VCPU has a chance to run.
 352      */
 353     cs->exception_index = EXCP_YIELD;
 354     cpu_loop_exit(cs);
 355 }
 356
 357 /* Raise an internal-to-QEMU exception. This is limited to only
 358  * those EXCP values which are special cases for QEMU to interrupt
 359  * execution and not to be used for exceptions which are passed to
 360  * the guest (those must all have syndrome information and thus should
 361  * use exception_with_syndrome).
 362  */
 363 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
 364 {
 365     CPUState *cs = CPU(arm_env_get_cpu(env));
 366
 367     assert(excp_is_internal(excp));
 368     cs->exception_index = excp;
 369     cpu_loop_exit(cs);
 370 }
 371
 372 /* Raise an exception with the specified syndrome register value */
 373 void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
 374                                      uint32_t syndrome, uint32_t target_el)
 375 {
 376     raise_exception(env, excp, syndrome, target_el);
 377 }
 378
 379 uint32_t HELPER(cpsr_read)(CPUARMState *env)
 380 {
 381     return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED);
 382 }
 383
 384 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
 385 {
 386     cpsr_write(env, val, mask);
 387 }
 388
 389 /* Access to user mode registers from privileged modes.  */
 390 uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
 391 {
 392     uint32_t val;
 393
 394     if (regno == 13) {
 395         val = env->banked_r13[BANK_USRSYS];
 396     } else if (regno == 14) {
 397         val = env->banked_r14[BANK_USRSYS];
 398     } else if (regno >= 8
 399                && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
 400         val = env->usr_regs[regno - 8];
 401     } else {
 402         val = env->regs[regno];
 403     }
 404     return val;
 405 }
 406
 407 void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
 408 {
 409     if (regno == 13) {
 410         env->banked_r13[BANK_USRSYS] = val;
 411     } else if (regno == 14) {
 412         env->banked_r14[BANK_USRSYS] = val;
 413     } else if (regno >= 8
 414                && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
 415         env->usr_regs[regno - 8] = val;
 416     } else {
 417         env->regs[regno] = val;
 418     }
 419 }
 420
 421 void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome)
 422 {
 423     const ARMCPRegInfo *ri = rip;
 424     int target_el;
 425
 426     if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
 427         && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
 428         raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
 429     }
 430
 431     if (!ri->accessfn) {
 432         return;
 433     }
 434
 435     switch (ri->accessfn(env, ri)) {
 436     case CP_ACCESS_OK:
 437         return;
 438     case CP_ACCESS_TRAP:
 439         target_el = exception_target_el(env);
 440         break;
 441     case CP_ACCESS_TRAP_EL2:
 442         /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
 443          * a bug in the access function.
 444          */
 445         assert(!arm_is_secure(env) && arm_current_el(env) != 3);
 446         target_el = 2;
 447         break;
 448     case CP_ACCESS_TRAP_EL3:
 449         target_el = 3;
 450         break;
 451     case CP_ACCESS_TRAP_UNCATEGORIZED:
 452         target_el = exception_target_el(env);
 453         syndrome = syn_uncategorized();
 454         break;
 455     case CP_ACCESS_TRAP_UNCATEGORIZED_EL2:
 456         target_el = 2;
 457         syndrome = syn_uncategorized();
 458         break;
 459     case CP_ACCESS_TRAP_UNCATEGORIZED_EL3:
 460         target_el = 3;
 461         syndrome = syn_uncategorized();
 462         break;
 463     default:
 464         g_assert_not_reached();
 465     }
 466
 467     raise_exception(env, EXCP_UDEF, syndrome, target_el);
 468 }
 469
 470 void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
 471 {
 472     const ARMCPRegInfo *ri = rip;
 473
 474     ri->writefn(env, ri, value);
 475 }
 476
 477 uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
 478 {
 479     const ARMCPRegInfo *ri = rip;
 480
 481     return ri->readfn(env, ri);
 482 }
 483
 484 void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
 485 {
 486     const ARMCPRegInfo *ri = rip;
 487
 488     ri->writefn(env, ri, value);
 489 }
 490
 491 uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
 492 {
 493     const ARMCPRegInfo *ri = rip;
 494
 495     return ri->readfn(env, ri);
 496 }
 497
 498 void HELPER(msr_i_pstate)(CPUARMState *env, uint32_t op, uint32_t imm)
 499 {
 500     /* MSR_i to update PSTATE. This is OK from EL0 only if UMA is set.
 501      * Note that SPSel is never OK from EL0; we rely on handle_msr_i()
 502      * to catch that case at translate time.
 503      */
 504     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
 505         uint32_t syndrome = syn_aa64_sysregtrap(0, extract32(op, 0, 3),
 506                                                 extract32(op, 3, 3), 4,
 507                                                 imm, 0x1f, 0);
 508         raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
 509     }
 510
 511     switch (op) {
 512     case 0x05: /* SPSel */
 513         update_spsel(env, imm);
 514         break;
 515     case 0x1e: /* DAIFSet */
 516         env->daif |= (imm << 6) & PSTATE_DAIF;
 517         break;
 518     case 0x1f: /* DAIFClear */
 519         env->daif &= ~((imm << 6) & PSTATE_DAIF);
 520         break;
 521     default:
 522         g_assert_not_reached();
 523     }
 524 }
 525
 526 void HELPER(clear_pstate_ss)(CPUARMState *env)
 527 {
 528     env->pstate &= ~PSTATE_SS;
 529 }
 530
 531 void HELPER(pre_hvc)(CPUARMState *env)
 532 {
 533     ARMCPU *cpu = arm_env_get_cpu(env);
 534     int cur_el = arm_current_el(env);
 535     /* FIXME: Use actual secure state.  */
 536     bool secure = false;
 537     bool undef;
 538
 539     if (arm_is_psci_call(cpu, EXCP_HVC)) {
 540         /* If PSCI is enabled and this looks like a valid PSCI call then
 541          * that overrides the architecturally mandated HVC behaviour.
 542          */
 543         return;
 544     }
 545
 546     if (!arm_feature(env, ARM_FEATURE_EL2)) {
 547         /* If EL2 doesn't exist, HVC always UNDEFs */
 548         undef = true;
 549     } else if (arm_feature(env, ARM_FEATURE_EL3)) {
 550         /* EL3.HCE has priority over EL2.HCD. */
 551         undef = !(env->cp15.scr_el3 & SCR_HCE);
 552     } else {
 553         undef = env->cp15.hcr_el2 & HCR_HCD;
 554     }
 555
 556     /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
 557      * For ARMv8/AArch64, HVC is allowed in EL3.
 558      * Note that we've already trapped HVC from EL0 at translation
 559      * time.
 560      */
 561     if (secure && (!is_a64(env) || cur_el == 1)) {
 562         undef = true;
 563     }
 564
 565     if (undef) {
 566         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
 567                         exception_target_el(env));
 568     }
 569 }
 570
 571 void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
 572 {
 573     ARMCPU *cpu = arm_env_get_cpu(env);
 574     int cur_el = arm_current_el(env);
 575     bool secure = arm_is_secure(env);
 576     bool smd = env->cp15.scr_el3 & SCR_SMD;
 577     /* On ARMv8 AArch32, SMD only applies to NS state.
 578      * On ARMv7 SMD only applies to NS state and only if EL2 is available.
 579      * For ARMv7 non EL2, we force SMD to zero so we don't need to re-check
 580      * the EL2 condition here.
 581      */
 582     bool undef = is_a64(env) ? smd : (!secure && smd);
 583
 584     if (arm_is_psci_call(cpu, EXCP_SMC)) {
 585         /* If PSCI is enabled and this looks like a valid PSCI call then
 586          * that overrides the architecturally mandated SMC behaviour.
 587          */
 588         return;
 589     }
 590
 591     if (!arm_feature(env, ARM_FEATURE_EL3)) {
 592         /* If we have no EL3 then SMC always UNDEFs */
 593         undef = true;
 594     } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
 595         /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
 596         raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
 597     }
 598
 599     if (undef) {
 600         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
 601                         exception_target_el(env));
 602     }
 603 }
 604
 605 void HELPER(exception_return)(CPUARMState *env)
 606 {
 607     int cur_el = arm_current_el(env);
 608     unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
 609     uint32_t spsr = env->banked_spsr[spsr_idx];
 610     int new_el;
 611
 612     aarch64_save_sp(env, cur_el);
 613
 614     env->exclusive_addr = -1;
 615
 616     /* We must squash the PSTATE.SS bit to zero unless both of the
 617      * following hold:
 618      *  1. debug exceptions are currently disabled
 619      *  2. singlestep will be active in the EL we return to
 620      * We check 1 here and 2 after we've done the pstate/cpsr write() to
 621      * transition to the EL we're going to.
 622      */
 623     if (arm_generate_debug_exceptions(env)) {
 624         spsr &= ~PSTATE_SS;
 625     }
 626
 627     if (spsr & PSTATE_nRW) {
 628         /* TODO: We currently assume EL1/2/3 are running in AArch64.  */
 629         env->aarch64 = 0;
 630         new_el = 0;
 631         env->uncached_cpsr = 0x10;
 632         cpsr_write(env, spsr, ~0);
 633         if (!arm_singlestep_active(env)) {
 634             env->uncached_cpsr &= ~PSTATE_SS;
 635         }
 636         aarch64_sync_64_to_32(env);
 637
 638         env->regs[15] = env->elr_el[1] & ~0x1;
 639     } else {
 640         new_el = extract32(spsr, 2, 2);
 641         if (new_el > cur_el
 642             || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
 643             /* Disallow return to an EL which is unimplemented or higher
 644              * than the current one.
 645              */
 646             goto illegal_return;
 647         }
 648         if (extract32(spsr, 1, 1)) {
 649             /* Return with reserved M[1] bit set */
 650             goto illegal_return;
 651         }
 652         if (new_el == 0 && (spsr & PSTATE_SP)) {
 653             /* Return to EL0 with M[0] bit set */
 654             goto illegal_return;
 655         }
 656         env->aarch64 = 1;
 657         pstate_write(env, spsr);
 658         if (!arm_singlestep_active(env)) {
 659             env->pstate &= ~PSTATE_SS;
 660         }
 661         aarch64_restore_sp(env, new_el);
 662         env->pc = env->elr_el[cur_el];
 663     }
 664
 665     return;
 666
 667 illegal_return:
 668     /* Illegal return events of various kinds have architecturally
 669      * mandated behaviour:
 670      * restore NZCV and DAIF from SPSR_ELx
 671      * set PSTATE.IL
 672      * restore PC from ELR_ELx
 673      * no change to exception level, execution state or stack pointer
 674      */
 675     env->pstate |= PSTATE_IL;
 676     env->pc = env->elr_el[cur_el];
 677     spsr &= PSTATE_NZCV | PSTATE_DAIF;
 678     spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF);
 679     pstate_write(env, spsr);
 680     if (!arm_singlestep_active(env)) {
 681         env->pstate &= ~PSTATE_SS;
 682     }
 683 }
 684
 685 /* Return true if the linked breakpoint entry lbn passes its checks */
 686 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
 687 {
 688     CPUARMState *env = &cpu->env;
 689     uint64_t bcr = env->cp15.dbgbcr[lbn];
 690     int brps = extract32(cpu->dbgdidr, 24, 4);
 691     int ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
 692     int bt;
 693     uint32_t contextidr;
 694
 695     /* Links to unimplemented or non-context aware breakpoints are
 696      * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
 697      * as if linked to an UNKNOWN context-aware breakpoint (in which
 698      * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
 699      * We choose the former.
 700      */
 701     if (lbn > brps || lbn < (brps - ctx_cmps)) {
 702         return false;
 703     }
 704
 705     bcr = env->cp15.dbgbcr[lbn];
 706
 707     if (extract64(bcr, 0, 1) == 0) {
 708         /* Linked breakpoint disabled : generate no events */
 709         return false;
 710     }
 711
 712     bt = extract64(bcr, 20, 4);
 713
 714     /* We match the whole register even if this is AArch32 using the
 715      * short descriptor format (in which case it holds both PROCID and ASID),
 716      * since we don't implement the optional v7 context ID masking.
 717      */
 718     contextidr = extract64(env->cp15.contextidr_el[1], 0, 32);
 719
 720     switch (bt) {
 721     case 3: /* linked context ID match */
 722         if (arm_current_el(env) > 1) {
 723             /* Context matches never fire in EL2 or (AArch64) EL3 */
 724             return false;
 725         }
 726         return (contextidr == extract64(env->cp15.dbgbvr[lbn], 0, 32));
 727     case 5: /* linked address mismatch (reserved in AArch64) */
 728     case 9: /* linked VMID match (reserved if no EL2) */
 729     case 11: /* linked context ID and VMID match (reserved if no EL2) */
 730     default:
 731         /* Links to Unlinked context breakpoints must generate no
 732          * events; we choose to do the same for reserved values too.
 733          */
 734         return false;
 735     }
 736
 737     return false;
 738 }
 739
 740 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
 741 {
 742     CPUARMState *env = &cpu->env;
 743     uint64_t cr;
 744     int pac, hmc, ssc, wt, lbn;
 745     /* Note that for watchpoints the check is against the CPU security
 746      * state, not the S/NS attribute on the offending data access.
 747      */
 748     bool is_secure = arm_is_secure(env);
 749     int access_el = arm_current_el(env);
 750
 751     if (is_wp) {
 752         CPUWatchpoint *wp = env->cpu_watchpoint[n];
 753
 754         if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
 755             return false;
 756         }
 757         cr = env->cp15.dbgwcr[n];
 758         if (wp->hitattrs.user) {
 759             /* The LDRT/STRT/LDT/STT "unprivileged access" instructions should
 760              * match watchpoints as if they were accesses done at EL0, even if
 761              * the CPU is at EL1 or higher.
 762              */
 763             access_el = 0;
 764         }
 765     } else {
 766         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 767
 768         if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
 769             return false;
 770         }
 771         cr = env->cp15.dbgbcr[n];
 772     }
 773     /* The WATCHPOINT_HIT flag guarantees us that the watchpoint is
 774      * enabled and that the address and access type match; for breakpoints
 775      * we know the address matched; check the remaining fields, including
 776      * linked breakpoints. We rely on WCR and BCR having the same layout
 777      * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
 778      * Note that some combinations of {PAC, HMC, SSC} are reserved and
 779      * must act either like some valid combination or as if the watchpoint
 780      * were disabled. We choose the former, and use this together with
 781      * the fact that EL3 must always be Secure and EL2 must always be
 782      * Non-Secure to simplify the code slightly compared to the full
 783      * table in the ARM ARM.
 784      */
 785     pac = extract64(cr, 1, 2);
 786     hmc = extract64(cr, 13, 1);
 787     ssc = extract64(cr, 14, 2);
 788
 789     switch (ssc) {
 790     case 0:
 791         break;
 792     case 1:
 793     case 3:
 794         if (is_secure) {
 795             return false;
 796         }
 797         break;
 798     case 2:
 799         if (!is_secure) {
 800             return false;
 801         }
 802         break;
 803     }
 804
 805     switch (access_el) {
 806     case 3:
 807     case 2:
 808         if (!hmc) {
 809             return false;
 810         }
 811         break;
 812     case 1:
 813         if (extract32(pac, 0, 1) == 0) {
 814             return false;
 815         }
 816         break;
 817     case 0:
 818         if (extract32(pac, 1, 1) == 0) {
 819             return false;
 820         }
 821         break;
 822     default:
 823         g_assert_not_reached();
 824     }
 825
 826     wt = extract64(cr, 20, 1);
 827     lbn = extract64(cr, 16, 4);
 828
 829     if (wt && !linked_bp_matches(cpu, lbn)) {
 830         return false;
 831     }
 832
 833     return true;
 834 }
 835
 836 static bool check_watchpoints(ARMCPU *cpu)
 837 {
 838     CPUARMState *env = &cpu->env;
 839     int n;
 840
 841     /* If watchpoints are disabled globally or we can't take debug
 842      * exceptions here then watchpoint firings are ignored.
 843      */
 844     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 845         || !arm_generate_debug_exceptions(env)) {
 846         return false;
 847     }
 848
 849     for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
 850         if (bp_wp_matches(cpu, n, true)) {
 851             return true;
 852         }
 853     }
 854     return false;
 855 }
 856
 857 static bool check_breakpoints(ARMCPU *cpu)
 858 {
 859     CPUARMState *env = &cpu->env;
 860     int n;
 861
 862     /* If breakpoints are disabled globally or we can't take debug
 863      * exceptions here then breakpoint firings are ignored.
 864      */
 865     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 866         || !arm_generate_debug_exceptions(env)) {
 867         return false;
 868     }
 869
 870     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
 871         if (bp_wp_matches(cpu, n, false)) {
 872             return true;
 873         }
 874     }
 875     return false;
 876 }
 877
 878 void HELPER(check_breakpoints)(CPUARMState *env)
 879 {
 880     ARMCPU *cpu = arm_env_get_cpu(env);
 881
 882     if (check_breakpoints(cpu)) {
 883         HELPER(exception_internal(env, EXCP_DEBUG));
 884     }
 885 }
 886
 887 void arm_debug_excp_handler(CPUState *cs)
 888 {
 889     /* Called by core code when a watchpoint or breakpoint fires;
 890      * need to check which one and raise the appropriate exception.
 891      */
 892     ARMCPU *cpu = ARM_CPU(cs);
 893     CPUARMState *env = &cpu->env;
 894     CPUWatchpoint *wp_hit = cs->watchpoint_hit;
 895
 896     if (wp_hit) {
 897         if (wp_hit->flags & BP_CPU) {
 898             cs->watchpoint_hit = NULL;
 899             if (check_watchpoints(cpu)) {
 900                 bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
 901                 bool same_el = arm_debug_target_el(env) == arm_current_el(env);
 902
 903                 if (extended_addresses_enabled(env)) {
 904                     env->exception.fsr = (1 << 9) | 0x22;
 905                 } else {
 906                     env->exception.fsr = 0x2;
 907                 }
 908                 env->exception.vaddress = wp_hit->hitaddr;
 909                 raise_exception(env, EXCP_DATA_ABORT,
 910                                 syn_watchpoint(same_el, 0, wnr),
 911                                 arm_debug_target_el(env));
 912             } else {
 913                 cpu_resume_from_signal(cs, NULL);
 914             }
 915         }
 916     } else {
 917         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 918         bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
 919
 920         /* (1) GDB breakpoints should be handled first.
 921          * (2) Do not raise a CPU exception if no CPU breakpoint has fired,
 922          * since singlestep is also done by generating a debug internal
 923          * exception.
 924          */
 925         if (cpu_breakpoint_test(cs, pc, BP_GDB)
 926             || !cpu_breakpoint_test(cs, pc, BP_CPU)) {
 927             return;
 928         }
 929
 930         if (extended_addresses_enabled(env)) {
 931             env->exception.fsr = (1 << 9) | 0x22;
 932         } else {
 933             env->exception.fsr = 0x2;
 934         }
 935         /* FAR is UNKNOWN, so doesn't need setting */
 936         raise_exception(env, EXCP_PREFETCH_ABORT,
 937                         syn_breakpoint(same_el),
 938                         arm_debug_target_el(env));
 939     }
 940 }
 941
 942 /* ??? Flag setting arithmetic is awkward because we need to do comparisons.
 943    The only way to do that in TCG is a conditional branch, which clobbers
 944    all our temporaries.  For now implement these as helper functions.  */
 945
 946 /* Similarly for variable shift instructions.  */
 947
 948 uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 949 {
 950     int shift = i & 0xff;
 951     if (shift >= 32) {
 952         if (shift == 32)
 953             env->CF = x & 1;
 954         else
 955             env->CF = 0;
 956         return 0;
 957     } else if (shift != 0) {
 958         env->CF = (x >> (32 - shift)) & 1;
 959         return x << shift;
 960     }
 961     return x;
 962 }
 963
 964 uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 965 {
 966     int shift = i & 0xff;
 967     if (shift >= 32) {
 968         if (shift == 32)
 969             env->CF = (x >> 31) & 1;
 970         else
 971             env->CF = 0;
 972         return 0;
 973     } else if (shift != 0) {
 974         env->CF = (x >> (shift - 1)) & 1;
 975         return x >> shift;
 976     }
 977     return x;
 978 }
 979
 980 uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 981 {
 982     int shift = i & 0xff;
 983     if (shift >= 32) {
 984         env->CF = (x >> 31) & 1;
 985         return (int32_t)x >> 31;
 986     } else if (shift != 0) {
 987         env->CF = (x >> (shift - 1)) & 1;
 988         return (int32_t)x >> shift;
 989     }
 990     return x;
 991 }
 992
 993 uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 994 {
 995     int shift1, shift;
 996     shift1 = i & 0xff;
 997     shift = shift1 & 0x1f;
 998     if (shift == 0) {
 999         if (shift1 != 0)
1000             env->CF = (x >> 31) & 1;
1001         return x;
1002     } else {
1003         env->CF = (x >> (shift - 1)) & 1;
1004         return ((uint32_t)x >> shift) | (x << (32 - shift));
1005     }
1006 }