target-arm/op_helper.c

   1 /*
   2  *  ARM helper routines
   3  *
   4  *  Copyright (c) 2005-2007 CodeSourcery, LLC
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "cpu.h"
  20 #include "exec/helper-proto.h"
  21 #include "internals.h"
  22 #include "exec/cpu_ldst.h"
  23
  24 #define SIGNBIT (uint32_t)0x80000000
  25 #define SIGNBIT64 ((uint64_t)1 << 63)
  26
  27 static void raise_exception(CPUARMState *env, uint32_t excp,
  28                             uint32_t syndrome, uint32_t target_el)
  29 {
  30     CPUState *cs = CPU(arm_env_get_cpu(env));
  31
  32     assert(!excp_is_internal(excp));
  33     cs->exception_index = excp;
  34     env->exception.syndrome = syndrome;
  35     env->exception.target_el = target_el;
  36     cpu_loop_exit(cs);
  37 }
  38
  39 static int exception_target_el(CPUARMState *env)
  40 {
  41     int target_el = MAX(1, arm_current_el(env));
  42
  43     /* No such thing as secure EL1 if EL3 is aarch32, so update the target EL
  44      * to EL3 in this case.
  45      */
  46     if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
  47         target_el = 3;
  48     }
  49
  50     return target_el;
  51 }
  52
  53 uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
  54                           uint32_t rn, uint32_t maxindex)
  55 {
  56     uint32_t val;
  57     uint32_t tmp;
  58     int index;
  59     int shift;
  60     uint64_t *table;
  61     table = (uint64_t *)&env->vfp.regs[rn];
  62     val = 0;
  63     for (shift = 0; shift < 32; shift += 8) {
  64         index = (ireg >> shift) & 0xff;
  65         if (index < maxindex) {
  66             tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
  67             val |= tmp << shift;
  68         } else {
  69             val |= def & (0xff << shift);
  70         }
  71     }
  72     return val;
  73 }
  74
  75 #if !defined(CONFIG_USER_ONLY)
  76
  77 /* try to fill the TLB and return an exception if error. If retaddr is
  78  * NULL, it means that the function was called in C code (i.e. not
  79  * from generated code or from helper.c)
  80  */
  81 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
  82               uintptr_t retaddr)
  83 {
  84     bool ret;
  85     uint32_t fsr = 0;
  86
  87     ret = arm_tlb_fill(cs, addr, is_write, mmu_idx, &fsr);
  88     if (unlikely(ret)) {
  89         ARMCPU *cpu = ARM_CPU(cs);
  90         CPUARMState *env = &cpu->env;
  91         uint32_t syn, exc;
  92         bool same_el = (arm_current_el(env) != 0);
  93
  94         if (retaddr) {
  95             /* now we have a real cpu fault */
  96             cpu_restore_state(cs, retaddr);
  97         }
  98
  99         /* AArch64 syndrome does not have an LPAE bit */
 100         syn = fsr & ~(1 << 9);
 101
 102         /* For insn and data aborts we assume there is no instruction syndrome
 103          * information; this is always true for exceptions reported to EL1.
 104          */
 105         if (is_write == 2) {
 106             syn = syn_insn_abort(same_el, 0, 0, syn);
 107             exc = EXCP_PREFETCH_ABORT;
 108         } else {
 109             syn = syn_data_abort(same_el, 0, 0, 0, is_write == 1, syn);
 110             if (is_write == 1 && arm_feature(env, ARM_FEATURE_V6)) {
 111                 fsr |= (1 << 11);
 112             }
 113             exc = EXCP_DATA_ABORT;
 114         }
 115
 116         env->exception.vaddress = addr;
 117         env->exception.fsr = fsr;
 118         raise_exception(env, exc, syn, exception_target_el(env));
 119     }
 120 }
 121 #endif
 122
 123 uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b)
 124 {
 125     uint32_t res = a + b;
 126     if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT))
 127         env->QF = 1;
 128     return res;
 129 }
 130
 131 uint32_t HELPER(add_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
 132 {
 133     uint32_t res = a + b;
 134     if (((res ^ a) & SIGNBIT) && !((a ^ b) & SIGNBIT)) {
 135         env->QF = 1;
 136         res = ~(((int32_t)a >> 31) ^ SIGNBIT);
 137     }
 138     return res;
 139 }
 140
 141 uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
 142 {
 143     uint32_t res = a - b;
 144     if (((res ^ a) & SIGNBIT) && ((a ^ b) & SIGNBIT)) {
 145         env->QF = 1;
 146         res = ~(((int32_t)a >> 31) ^ SIGNBIT);
 147     }
 148     return res;
 149 }
 150
 151 uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
 152 {
 153     uint32_t res;
 154     if (val >= 0x40000000) {
 155         res = ~SIGNBIT;
 156         env->QF = 1;
 157     } else if (val <= (int32_t)0xc0000000) {
 158         res = SIGNBIT;
 159         env->QF = 1;
 160     } else {
 161         res = val << 1;
 162     }
 163     return res;
 164 }
 165
 166 uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
 167 {
 168     uint32_t res = a + b;
 169     if (res < a) {
 170         env->QF = 1;
 171         res = ~0;
 172     }
 173     return res;
 174 }
 175
 176 uint32_t HELPER(sub_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
 177 {
 178     uint32_t res = a - b;
 179     if (res > a) {
 180         env->QF = 1;
 181         res = 0;
 182     }
 183     return res;
 184 }
 185
 186 /* Signed saturation.  */
 187 static inline uint32_t do_ssat(CPUARMState *env, int32_t val, int shift)
 188 {
 189     int32_t top;
 190     uint32_t mask;
 191
 192     top = val >> shift;
 193     mask = (1u << shift) - 1;
 194     if (top > 0) {
 195         env->QF = 1;
 196         return mask;
 197     } else if (top < -1) {
 198         env->QF = 1;
 199         return ~mask;
 200     }
 201     return val;
 202 }
 203
 204 /* Unsigned saturation.  */
 205 static inline uint32_t do_usat(CPUARMState *env, int32_t val, int shift)
 206 {
 207     uint32_t max;
 208
 209     max = (1u << shift) - 1;
 210     if (val < 0) {
 211         env->QF = 1;
 212         return 0;
 213     } else if (val > max) {
 214         env->QF = 1;
 215         return max;
 216     }
 217     return val;
 218 }
 219
 220 /* Signed saturate.  */
 221 uint32_t HELPER(ssat)(CPUARMState *env, uint32_t x, uint32_t shift)
 222 {
 223     return do_ssat(env, x, shift);
 224 }
 225
 226 /* Dual halfword signed saturate.  */
 227 uint32_t HELPER(ssat16)(CPUARMState *env, uint32_t x, uint32_t shift)
 228 {
 229     uint32_t res;
 230
 231     res = (uint16_t)do_ssat(env, (int16_t)x, shift);
 232     res |= do_ssat(env, ((int32_t)x) >> 16, shift) << 16;
 233     return res;
 234 }
 235
 236 /* Unsigned saturate.  */
 237 uint32_t HELPER(usat)(CPUARMState *env, uint32_t x, uint32_t shift)
 238 {
 239     return do_usat(env, x, shift);
 240 }
 241
 242 /* Dual halfword unsigned saturate.  */
 243 uint32_t HELPER(usat16)(CPUARMState *env, uint32_t x, uint32_t shift)
 244 {
 245     uint32_t res;
 246
 247     res = (uint16_t)do_usat(env, (int16_t)x, shift);
 248     res |= do_usat(env, ((int32_t)x) >> 16, shift) << 16;
 249     return res;
 250 }
 251
 252 /* Function checks whether WFx (WFI/WFE) instructions are set up to be trapped.
 253  * The function returns the target EL (1-3) if the instruction is to be trapped;
 254  * otherwise it returns 0 indicating it is not trapped.
 255  */
 256 static inline int check_wfx_trap(CPUARMState *env, bool is_wfe)
 257 {
 258     int cur_el = arm_current_el(env);
 259     uint64_t mask;
 260
 261     /* If we are currently in EL0 then we need to check if SCTLR is set up for
 262      * WFx instructions being trapped to EL1. These trap bits don't exist in v7.
 263      */
 264     if (cur_el < 1 && arm_feature(env, ARM_FEATURE_V8)) {
 265         int target_el;
 266
 267         mask = is_wfe ? SCTLR_nTWE : SCTLR_nTWI;
 268         if (arm_is_secure_below_el3(env) && !arm_el_is_aa64(env, 3)) {
 269             /* Secure EL0 and Secure PL1 is at EL3 */
 270             target_el = 3;
 271         } else {
 272             target_el = 1;
 273         }
 274
 275         if (!(env->cp15.sctlr_el[target_el] & mask)) {
 276             return target_el;
 277         }
 278     }
 279
 280     /* We are not trapping to EL1; trap to EL2 if HCR_EL2 requires it
 281      * No need for ARM_FEATURE check as if HCR_EL2 doesn't exist the
 282      * bits will be zero indicating no trap.
 283      */
 284     if (cur_el < 2 && !arm_is_secure(env)) {
 285         mask = (is_wfe) ? HCR_TWE : HCR_TWI;
 286         if (env->cp15.hcr_el2 & mask) {
 287             return 2;
 288         }
 289     }
 290
 291     /* We are not trapping to EL1 or EL2; trap to EL3 if SCR_EL3 requires it */
 292     if (cur_el < 3) {
 293         mask = (is_wfe) ? SCR_TWE : SCR_TWI;
 294         if (env->cp15.scr_el3 & mask) {
 295             return 3;
 296         }
 297     }
 298
 299     return 0;
 300 }
 301
 302 void HELPER(wfi)(CPUARMState *env)
 303 {
 304     CPUState *cs = CPU(arm_env_get_cpu(env));
 305     int target_el = check_wfx_trap(env, false);
 306
 307     if (cpu_has_work(cs)) {
 308         /* Don't bother to go into our "low power state" if
 309          * we would just wake up immediately.
 310          */
 311         return;
 312     }
 313
 314     if (target_el) {
 315         env->pc -= 4;
 316         raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0), target_el);
 317     }
 318
 319     cs->exception_index = EXCP_HLT;
 320     cs->halted = 1;
 321     cpu_loop_exit(cs);
 322 }
 323
 324 void HELPER(wfe)(CPUARMState *env)
 325 {
 326     CPUState *cs = CPU(arm_env_get_cpu(env));
 327
 328     /* Don't actually halt the CPU, just yield back to top
 329      * level loop. This is not going into a "low power state"
 330      * (ie halting until some event occurs), so we never take
 331      * a configurable trap to a different exception level.
 332      */
 333     cs->exception_index = EXCP_YIELD;
 334     cpu_loop_exit(cs);
 335 }
 336
 337 /* Raise an internal-to-QEMU exception. This is limited to only
 338  * those EXCP values which are special cases for QEMU to interrupt
 339  * execution and not to be used for exceptions which are passed to
 340  * the guest (those must all have syndrome information and thus should
 341  * use exception_with_syndrome).
 342  */
 343 void HELPER(exception_internal)(CPUARMState *env, uint32_t excp)
 344 {
 345     CPUState *cs = CPU(arm_env_get_cpu(env));
 346
 347     assert(excp_is_internal(excp));
 348     cs->exception_index = excp;
 349     cpu_loop_exit(cs);
 350 }
 351
 352 /* Raise an exception with the specified syndrome register value */
 353 void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
 354                                      uint32_t syndrome, uint32_t target_el)
 355 {
 356     raise_exception(env, excp, syndrome, target_el);
 357 }
 358
 359 uint32_t HELPER(cpsr_read)(CPUARMState *env)
 360 {
 361     return cpsr_read(env) & ~(CPSR_EXEC | CPSR_RESERVED);
 362 }
 363
 364 void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
 365 {
 366     cpsr_write(env, val, mask);
 367 }
 368
 369 /* Access to user mode registers from privileged modes.  */
 370 uint32_t HELPER(get_user_reg)(CPUARMState *env, uint32_t regno)
 371 {
 372     uint32_t val;
 373
 374     if (regno == 13) {
 375         val = env->banked_r13[0];
 376     } else if (regno == 14) {
 377         val = env->banked_r14[0];
 378     } else if (regno >= 8
 379                && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
 380         val = env->usr_regs[regno - 8];
 381     } else {
 382         val = env->regs[regno];
 383     }
 384     return val;
 385 }
 386
 387 void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val)
 388 {
 389     if (regno == 13) {
 390         env->banked_r13[0] = val;
 391     } else if (regno == 14) {
 392         env->banked_r14[0] = val;
 393     } else if (regno >= 8
 394                && (env->uncached_cpsr & 0x1f) == ARM_CPU_MODE_FIQ) {
 395         env->usr_regs[regno - 8] = val;
 396     } else {
 397         env->regs[regno] = val;
 398     }
 399 }
 400
 401 void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome)
 402 {
 403     const ARMCPRegInfo *ri = rip;
 404     int target_el;
 405
 406     if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
 407         && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
 408         raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
 409     }
 410
 411     if (!ri->accessfn) {
 412         return;
 413     }
 414
 415     switch (ri->accessfn(env, ri)) {
 416     case CP_ACCESS_OK:
 417         return;
 418     case CP_ACCESS_TRAP:
 419         target_el = exception_target_el(env);
 420         break;
 421     case CP_ACCESS_TRAP_EL2:
 422         /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
 423          * a bug in the access function.
 424          */
 425         assert(!arm_is_secure(env) && arm_current_el(env) != 3);
 426         target_el = 2;
 427         break;
 428     case CP_ACCESS_TRAP_EL3:
 429         target_el = 3;
 430         break;
 431     case CP_ACCESS_TRAP_UNCATEGORIZED:
 432         target_el = exception_target_el(env);
 433         syndrome = syn_uncategorized();
 434         break;
 435     default:
 436         g_assert_not_reached();
 437     }
 438
 439     raise_exception(env, EXCP_UDEF, syndrome, target_el);
 440 }
 441
 442 void HELPER(set_cp_reg)(CPUARMState *env, void *rip, uint32_t value)
 443 {
 444     const ARMCPRegInfo *ri = rip;
 445
 446     ri->writefn(env, ri, value);
 447 }
 448
 449 uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip)
 450 {
 451     const ARMCPRegInfo *ri = rip;
 452
 453     return ri->readfn(env, ri);
 454 }
 455
 456 void HELPER(set_cp_reg64)(CPUARMState *env, void *rip, uint64_t value)
 457 {
 458     const ARMCPRegInfo *ri = rip;
 459
 460     ri->writefn(env, ri, value);
 461 }
 462
 463 uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
 464 {
 465     const ARMCPRegInfo *ri = rip;
 466
 467     return ri->readfn(env, ri);
 468 }
 469
 470 void HELPER(msr_i_pstate)(CPUARMState *env, uint32_t op, uint32_t imm)
 471 {
 472     /* MSR_i to update PSTATE. This is OK from EL0 only if UMA is set.
 473      * Note that SPSel is never OK from EL0; we rely on handle_msr_i()
 474      * to catch that case at translate time.
 475      */
 476     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
 477         uint32_t syndrome = syn_aa64_sysregtrap(0, extract32(op, 0, 3),
 478                                                 extract32(op, 3, 3), 4,
 479                                                 imm, 0x1f, 0);
 480         raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
 481     }
 482
 483     switch (op) {
 484     case 0x05: /* SPSel */
 485         update_spsel(env, imm);
 486         break;
 487     case 0x1e: /* DAIFSet */
 488         env->daif |= (imm << 6) & PSTATE_DAIF;
 489         break;
 490     case 0x1f: /* DAIFClear */
 491         env->daif &= ~((imm << 6) & PSTATE_DAIF);
 492         break;
 493     default:
 494         g_assert_not_reached();
 495     }
 496 }
 497
 498 void HELPER(clear_pstate_ss)(CPUARMState *env)
 499 {
 500     env->pstate &= ~PSTATE_SS;
 501 }
 502
 503 void HELPER(pre_hvc)(CPUARMState *env)
 504 {
 505     ARMCPU *cpu = arm_env_get_cpu(env);
 506     int cur_el = arm_current_el(env);
 507     /* FIXME: Use actual secure state.  */
 508     bool secure = false;
 509     bool undef;
 510
 511     if (arm_is_psci_call(cpu, EXCP_HVC)) {
 512         /* If PSCI is enabled and this looks like a valid PSCI call then
 513          * that overrides the architecturally mandated HVC behaviour.
 514          */
 515         return;
 516     }
 517
 518     if (!arm_feature(env, ARM_FEATURE_EL2)) {
 519         /* If EL2 doesn't exist, HVC always UNDEFs */
 520         undef = true;
 521     } else if (arm_feature(env, ARM_FEATURE_EL3)) {
 522         /* EL3.HCE has priority over EL2.HCD. */
 523         undef = !(env->cp15.scr_el3 & SCR_HCE);
 524     } else {
 525         undef = env->cp15.hcr_el2 & HCR_HCD;
 526     }
 527
 528     /* In ARMv7 and ARMv8/AArch32, HVC is undef in secure state.
 529      * For ARMv8/AArch64, HVC is allowed in EL3.
 530      * Note that we've already trapped HVC from EL0 at translation
 531      * time.
 532      */
 533     if (secure && (!is_a64(env) || cur_el == 1)) {
 534         undef = true;
 535     }
 536
 537     if (undef) {
 538         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
 539                         exception_target_el(env));
 540     }
 541 }
 542
 543 void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
 544 {
 545     ARMCPU *cpu = arm_env_get_cpu(env);
 546     int cur_el = arm_current_el(env);
 547     bool secure = arm_is_secure(env);
 548     bool smd = env->cp15.scr_el3 & SCR_SMD;
 549     /* On ARMv8 AArch32, SMD only applies to NS state.
 550      * On ARMv7 SMD only applies to NS state and only if EL2 is available.
 551      * For ARMv7 non EL2, we force SMD to zero so we don't need to re-check
 552      * the EL2 condition here.
 553      */
 554     bool undef = is_a64(env) ? smd : (!secure && smd);
 555
 556     if (arm_is_psci_call(cpu, EXCP_SMC)) {
 557         /* If PSCI is enabled and this looks like a valid PSCI call then
 558          * that overrides the architecturally mandated SMC behaviour.
 559          */
 560         return;
 561     }
 562
 563     if (!arm_feature(env, ARM_FEATURE_EL3)) {
 564         /* If we have no EL3 then SMC always UNDEFs */
 565         undef = true;
 566     } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
 567         /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
 568         raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
 569     }
 570
 571     if (undef) {
 572         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
 573                         exception_target_el(env));
 574     }
 575 }
 576
 577 void HELPER(exception_return)(CPUARMState *env)
 578 {
 579     int cur_el = arm_current_el(env);
 580     unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
 581     uint32_t spsr = env->banked_spsr[spsr_idx];
 582     int new_el;
 583
 584     aarch64_save_sp(env, cur_el);
 585
 586     env->exclusive_addr = -1;
 587
 588     /* We must squash the PSTATE.SS bit to zero unless both of the
 589      * following hold:
 590      *  1. debug exceptions are currently disabled
 591      *  2. singlestep will be active in the EL we return to
 592      * We check 1 here and 2 after we've done the pstate/cpsr write() to
 593      * transition to the EL we're going to.
 594      */
 595     if (arm_generate_debug_exceptions(env)) {
 596         spsr &= ~PSTATE_SS;
 597     }
 598
 599     if (spsr & PSTATE_nRW) {
 600         /* TODO: We currently assume EL1/2/3 are running in AArch64.  */
 601         env->aarch64 = 0;
 602         new_el = 0;
 603         env->uncached_cpsr = 0x10;
 604         cpsr_write(env, spsr, ~0);
 605         if (!arm_singlestep_active(env)) {
 606             env->uncached_cpsr &= ~PSTATE_SS;
 607         }
 608         aarch64_sync_64_to_32(env);
 609
 610         env->regs[15] = env->elr_el[1] & ~0x1;
 611     } else {
 612         new_el = extract32(spsr, 2, 2);
 613         if (new_el > cur_el
 614             || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
 615             /* Disallow return to an EL which is unimplemented or higher
 616              * than the current one.
 617              */
 618             goto illegal_return;
 619         }
 620         if (extract32(spsr, 1, 1)) {
 621             /* Return with reserved M[1] bit set */
 622             goto illegal_return;
 623         }
 624         if (new_el == 0 && (spsr & PSTATE_SP)) {
 625             /* Return to EL0 with M[0] bit set */
 626             goto illegal_return;
 627         }
 628         env->aarch64 = 1;
 629         pstate_write(env, spsr);
 630         if (!arm_singlestep_active(env)) {
 631             env->pstate &= ~PSTATE_SS;
 632         }
 633         aarch64_restore_sp(env, new_el);
 634         env->pc = env->elr_el[cur_el];
 635     }
 636
 637     return;
 638
 639 illegal_return:
 640     /* Illegal return events of various kinds have architecturally
 641      * mandated behaviour:
 642      * restore NZCV and DAIF from SPSR_ELx
 643      * set PSTATE.IL
 644      * restore PC from ELR_ELx
 645      * no change to exception level, execution state or stack pointer
 646      */
 647     env->pstate |= PSTATE_IL;
 648     env->pc = env->elr_el[cur_el];
 649     spsr &= PSTATE_NZCV | PSTATE_DAIF;
 650     spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF);
 651     pstate_write(env, spsr);
 652     if (!arm_singlestep_active(env)) {
 653         env->pstate &= ~PSTATE_SS;
 654     }
 655 }
 656
 657 /* Return true if the linked breakpoint entry lbn passes its checks */
 658 static bool linked_bp_matches(ARMCPU *cpu, int lbn)
 659 {
 660     CPUARMState *env = &cpu->env;
 661     uint64_t bcr = env->cp15.dbgbcr[lbn];
 662     int brps = extract32(cpu->dbgdidr, 24, 4);
 663     int ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
 664     int bt;
 665     uint32_t contextidr;
 666
 667     /* Links to unimplemented or non-context aware breakpoints are
 668      * CONSTRAINED UNPREDICTABLE: either behave as if disabled, or
 669      * as if linked to an UNKNOWN context-aware breakpoint (in which
 670      * case DBGWCR<n>_EL1.LBN must indicate that breakpoint).
 671      * We choose the former.
 672      */
 673     if (lbn > brps || lbn < (brps - ctx_cmps)) {
 674         return false;
 675     }
 676
 677     bcr = env->cp15.dbgbcr[lbn];
 678
 679     if (extract64(bcr, 0, 1) == 0) {
 680         /* Linked breakpoint disabled : generate no events */
 681         return false;
 682     }
 683
 684     bt = extract64(bcr, 20, 4);
 685
 686     /* We match the whole register even if this is AArch32 using the
 687      * short descriptor format (in which case it holds both PROCID and ASID),
 688      * since we don't implement the optional v7 context ID masking.
 689      */
 690     contextidr = extract64(env->cp15.contextidr_el[1], 0, 32);
 691
 692     switch (bt) {
 693     case 3: /* linked context ID match */
 694         if (arm_current_el(env) > 1) {
 695             /* Context matches never fire in EL2 or (AArch64) EL3 */
 696             return false;
 697         }
 698         return (contextidr == extract64(env->cp15.dbgbvr[lbn], 0, 32));
 699     case 5: /* linked address mismatch (reserved in AArch64) */
 700     case 9: /* linked VMID match (reserved if no EL2) */
 701     case 11: /* linked context ID and VMID match (reserved if no EL2) */
 702     default:
 703         /* Links to Unlinked context breakpoints must generate no
 704          * events; we choose to do the same for reserved values too.
 705          */
 706         return false;
 707     }
 708
 709     return false;
 710 }
 711
 712 static bool bp_wp_matches(ARMCPU *cpu, int n, bool is_wp)
 713 {
 714     CPUARMState *env = &cpu->env;
 715     uint64_t cr;
 716     int pac, hmc, ssc, wt, lbn;
 717     /* Note that for watchpoints the check is against the CPU security
 718      * state, not the S/NS attribute on the offending data access.
 719      */
 720     bool is_secure = arm_is_secure(env);
 721     int access_el = arm_current_el(env);
 722
 723     if (is_wp) {
 724         CPUWatchpoint *wp = env->cpu_watchpoint[n];
 725
 726         if (!wp || !(wp->flags & BP_WATCHPOINT_HIT)) {
 727             return false;
 728         }
 729         cr = env->cp15.dbgwcr[n];
 730         if (wp->hitattrs.user) {
 731             /* The LDRT/STRT/LDT/STT "unprivileged access" instructions should
 732              * match watchpoints as if they were accesses done at EL0, even if
 733              * the CPU is at EL1 or higher.
 734              */
 735             access_el = 0;
 736         }
 737     } else {
 738         uint64_t pc = is_a64(env) ? env->pc : env->regs[15];
 739
 740         if (!env->cpu_breakpoint[n] || env->cpu_breakpoint[n]->pc != pc) {
 741             return false;
 742         }
 743         cr = env->cp15.dbgbcr[n];
 744     }
 745     /* The WATCHPOINT_HIT flag guarantees us that the watchpoint is
 746      * enabled and that the address and access type match; for breakpoints
 747      * we know the address matched; check the remaining fields, including
 748      * linked breakpoints. We rely on WCR and BCR having the same layout
 749      * for the LBN, SSC, HMC, PAC/PMC and is-linked fields.
 750      * Note that some combinations of {PAC, HMC, SSC} are reserved and
 751      * must act either like some valid combination or as if the watchpoint
 752      * were disabled. We choose the former, and use this together with
 753      * the fact that EL3 must always be Secure and EL2 must always be
 754      * Non-Secure to simplify the code slightly compared to the full
 755      * table in the ARM ARM.
 756      */
 757     pac = extract64(cr, 1, 2);
 758     hmc = extract64(cr, 13, 1);
 759     ssc = extract64(cr, 14, 2);
 760
 761     switch (ssc) {
 762     case 0:
 763         break;
 764     case 1:
 765     case 3:
 766         if (is_secure) {
 767             return false;
 768         }
 769         break;
 770     case 2:
 771         if (!is_secure) {
 772             return false;
 773         }
 774         break;
 775     }
 776
 777     switch (access_el) {
 778     case 3:
 779     case 2:
 780         if (!hmc) {
 781             return false;
 782         }
 783         break;
 784     case 1:
 785         if (extract32(pac, 0, 1) == 0) {
 786             return false;
 787         }
 788         break;
 789     case 0:
 790         if (extract32(pac, 1, 1) == 0) {
 791             return false;
 792         }
 793         break;
 794     default:
 795         g_assert_not_reached();
 796     }
 797
 798     wt = extract64(cr, 20, 1);
 799     lbn = extract64(cr, 16, 4);
 800
 801     if (wt && !linked_bp_matches(cpu, lbn)) {
 802         return false;
 803     }
 804
 805     return true;
 806 }
 807
 808 static bool check_watchpoints(ARMCPU *cpu)
 809 {
 810     CPUARMState *env = &cpu->env;
 811     int n;
 812
 813     /* If watchpoints are disabled globally or we can't take debug
 814      * exceptions here then watchpoint firings are ignored.
 815      */
 816     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 817         || !arm_generate_debug_exceptions(env)) {
 818         return false;
 819     }
 820
 821     for (n = 0; n < ARRAY_SIZE(env->cpu_watchpoint); n++) {
 822         if (bp_wp_matches(cpu, n, true)) {
 823             return true;
 824         }
 825     }
 826     return false;
 827 }
 828
 829 static bool check_breakpoints(ARMCPU *cpu)
 830 {
 831     CPUARMState *env = &cpu->env;
 832     int n;
 833
 834     /* If breakpoints are disabled globally or we can't take debug
 835      * exceptions here then breakpoint firings are ignored.
 836      */
 837     if (extract32(env->cp15.mdscr_el1, 15, 1) == 0
 838         || !arm_generate_debug_exceptions(env)) {
 839         return false;
 840     }
 841
 842     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
 843         if (bp_wp_matches(cpu, n, false)) {
 844             return true;
 845         }
 846     }
 847     return false;
 848 }
 849
 850 void arm_debug_excp_handler(CPUState *cs)
 851 {
 852     /* Called by core code when a watchpoint or breakpoint fires;
 853      * need to check which one and raise the appropriate exception.
 854      */
 855     ARMCPU *cpu = ARM_CPU(cs);
 856     CPUARMState *env = &cpu->env;
 857     CPUWatchpoint *wp_hit = cs->watchpoint_hit;
 858
 859     if (wp_hit) {
 860         if (wp_hit->flags & BP_CPU) {
 861             cs->watchpoint_hit = NULL;
 862             if (check_watchpoints(cpu)) {
 863                 bool wnr = (wp_hit->flags & BP_WATCHPOINT_HIT_WRITE) != 0;
 864                 bool same_el = arm_debug_target_el(env) == arm_current_el(env);
 865
 866                 if (extended_addresses_enabled(env)) {
 867                     env->exception.fsr = (1 << 9) | 0x22;
 868                 } else {
 869                     env->exception.fsr = 0x2;
 870                 }
 871                 env->exception.vaddress = wp_hit->hitaddr;
 872                 raise_exception(env, EXCP_DATA_ABORT,
 873                                 syn_watchpoint(same_el, 0, wnr),
 874                                 arm_debug_target_el(env));
 875             } else {
 876                 cpu_resume_from_signal(cs, NULL);
 877             }
 878         }
 879     } else {
 880         if (check_breakpoints(cpu)) {
 881             bool same_el = (arm_debug_target_el(env) == arm_current_el(env));
 882             if (extended_addresses_enabled(env)) {
 883                 env->exception.fsr = (1 << 9) | 0x22;
 884             } else {
 885                 env->exception.fsr = 0x2;
 886             }
 887             /* FAR is UNKNOWN, so doesn't need setting */
 888             raise_exception(env, EXCP_PREFETCH_ABORT,
 889                             syn_breakpoint(same_el),
 890                             arm_debug_target_el(env));
 891         }
 892     }
 893 }
 894
 895 /* ??? Flag setting arithmetic is awkward because we need to do comparisons.
 896    The only way to do that in TCG is a conditional branch, which clobbers
 897    all our temporaries.  For now implement these as helper functions.  */
 898
 899 /* Similarly for variable shift instructions.  */
 900
 901 uint32_t HELPER(shl_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 902 {
 903     int shift = i & 0xff;
 904     if (shift >= 32) {
 905         if (shift == 32)
 906             env->CF = x & 1;
 907         else
 908             env->CF = 0;
 909         return 0;
 910     } else if (shift != 0) {
 911         env->CF = (x >> (32 - shift)) & 1;
 912         return x << shift;
 913     }
 914     return x;
 915 }
 916
 917 uint32_t HELPER(shr_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 918 {
 919     int shift = i & 0xff;
 920     if (shift >= 32) {
 921         if (shift == 32)
 922             env->CF = (x >> 31) & 1;
 923         else
 924             env->CF = 0;
 925         return 0;
 926     } else if (shift != 0) {
 927         env->CF = (x >> (shift - 1)) & 1;
 928         return x >> shift;
 929     }
 930     return x;
 931 }
 932
 933 uint32_t HELPER(sar_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 934 {
 935     int shift = i & 0xff;
 936     if (shift >= 32) {
 937         env->CF = (x >> 31) & 1;
 938         return (int32_t)x >> 31;
 939     } else if (shift != 0) {
 940         env->CF = (x >> (shift - 1)) & 1;
 941         return (int32_t)x >> shift;
 942     }
 943     return x;
 944 }
 945
 946 uint32_t HELPER(ror_cc)(CPUARMState *env, uint32_t x, uint32_t i)
 947 {
 948     int shift1, shift;
 949     shift1 = i & 0xff;
 950     shift = shift1 & 0x1f;
 951     if (shift == 0) {
 952         if (shift1 != 0)
 953             env->CF = (x >> 31) & 1;
 954         return x;
 955     } else {
 956         env->CF = (x >> (shift - 1)) & 1;
 957         return ((uint32_t)x >> shift) | (x << (32 - shift));
 958     }
 959 }