1 /*
2 * ARM generic helpers.
3 *
4 * This code is licensed under the GNU GPL v2 or later.
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9 #include "qemu/osdep.h"
10 #include "cpu.h"
11 #include "internals.h"
12 #include "cpu-features.h"
13 #include "gdbstub/helpers.h"
14 #include "exec/helper-proto.h"
15 #include "qemu/main-loop.h"
16 #include "qemu/bitops.h"
17 #include "qemu/log.h"
18 #include "exec/page-protection.h"
19 #ifdef CONFIG_TCG
20 #include "accel/tcg/cpu-ldst.h"
21 #include "semihosting/common-semi.h"
22 #endif
23 #if !defined(CONFIG_USER_ONLY)
24 #include "hw/intc/armv7m_nvic.h"
25 #endif
26
v7m_msr_xpsr(CPUARMState * env,uint32_t mask,uint32_t reg,uint32_t val)27 static void v7m_msr_xpsr(CPUARMState *env, uint32_t mask,
28 uint32_t reg, uint32_t val)
29 {
30 /* Only APSR is actually writable */
31 if (!(reg & 4)) {
32 uint32_t apsrmask = 0;
33
34 if (mask & 8) {
35 apsrmask |= XPSR_NZCV | XPSR_Q;
36 }
37 if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
38 apsrmask |= XPSR_GE;
39 }
40 xpsr_write(env, val, apsrmask);
41 }
42 }
43
v7m_mrs_xpsr(CPUARMState * env,uint32_t reg,unsigned el)44 static uint32_t v7m_mrs_xpsr(CPUARMState *env, uint32_t reg, unsigned el)
45 {
46 uint32_t mask = 0;
47
48 if ((reg & 1) && el) {
49 mask |= XPSR_EXCP; /* IPSR (unpriv. reads as zero) */
50 }
51 if (!(reg & 4)) {
52 mask |= XPSR_NZCV | XPSR_Q; /* APSR */
53 if (arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
54 mask |= XPSR_GE;
55 }
56 }
57 /* EPSR reads as zero */
58 return xpsr_read(env) & mask;
59 }
60
arm_v7m_mrs_control(CPUARMState * env,uint32_t secure)61 uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure)
62 {
63 uint32_t value = env->v7m.control[secure];
64
65 if (!secure) {
66 /* SFPA is RAZ/WI from NS; FPCA is stored in the M_REG_S bank */
67 value |= env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK;
68 }
69 return value;
70 }
71
72 #ifdef CONFIG_USER_ONLY
73
HELPER(v7m_msr)74 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
75 {
76 uint32_t mask = extract32(maskreg, 8, 4);
77 uint32_t reg = extract32(maskreg, 0, 8);
78
79 switch (reg) {
80 case 0 ... 7: /* xPSR sub-fields */
81 v7m_msr_xpsr(env, mask, reg, val);
82 break;
83 case 20: /* CONTROL */
84 /* There are no sub-fields that are actually writable from EL0. */
85 break;
86 default:
87 /* Unprivileged writes to other registers are ignored */
88 break;
89 }
90 }
91
HELPER(v7m_mrs)92 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
93 {
94 switch (reg) {
95 case 0 ... 7: /* xPSR sub-fields */
96 return v7m_mrs_xpsr(env, reg, 0);
97 case 20: /* CONTROL */
98 return arm_v7m_mrs_control(env, 0);
99 default:
100 /* Unprivileged reads others as zero. */
101 return 0;
102 }
103 }
104
HELPER(v7m_bxns)105 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
106 {
107 /* translate.c should never generate calls here in user-only mode */
108 g_assert_not_reached();
109 }
110
HELPER(v7m_blxns)111 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
112 {
113 /* translate.c should never generate calls here in user-only mode */
114 g_assert_not_reached();
115 }
116
HELPER(v7m_preserve_fp_state)117 void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
118 {
119 /* translate.c should never generate calls here in user-only mode */
120 g_assert_not_reached();
121 }
122
HELPER(v7m_vlstm)123 void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
124 {
125 /* translate.c should never generate calls here in user-only mode */
126 g_assert_not_reached();
127 }
128
HELPER(v7m_vlldm)129 void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
130 {
131 /* translate.c should never generate calls here in user-only mode */
132 g_assert_not_reached();
133 }
134
HELPER(v7m_tt)135 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
136 {
137 /*
138 * The TT instructions can be used by unprivileged code, but in
139 * user-only emulation we don't have the MPU.
140 * Luckily since we know we are NonSecure unprivileged (and that in
141 * turn means that the A flag wasn't specified), all the bits in the
142 * register must be zero:
143 * IREGION: 0 because IRVALID is 0
144 * IRVALID: 0 because NS
145 * S: 0 because NS
146 * NSRW: 0 because NS
147 * NSR: 0 because NS
148 * RW: 0 because unpriv and A flag not set
149 * R: 0 because unpriv and A flag not set
150 * SRVALID: 0 because NS
151 * MRVALID: 0 because unpriv and A flag not set
152 * SREGION: 0 because SRVALID is 0
153 * MREGION: 0 because MRVALID is 0
154 */
155 return 0;
156 }
157
arm_v7m_mmu_idx_for_secstate(CPUARMState * env,bool secstate)158 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
159 {
160 return ARMMMUIdx_MUser;
161 }
162
163 #else /* !CONFIG_USER_ONLY */
164
arm_v7m_mmu_idx_all(CPUARMState * env,bool secstate,bool priv,bool negpri)165 static ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
166 bool secstate, bool priv, bool negpri)
167 {
168 ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
169
170 if (priv) {
171 mmu_idx |= ARM_MMU_IDX_M_PRIV;
172 }
173
174 if (negpri) {
175 mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
176 }
177
178 if (secstate) {
179 mmu_idx |= ARM_MMU_IDX_M_S;
180 }
181
182 return mmu_idx;
183 }
184
arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState * env,bool secstate,bool priv)185 static ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
186 bool secstate, bool priv)
187 {
188 bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate);
189
190 return arm_v7m_mmu_idx_all(env, secstate, priv, negpri);
191 }
192
193 /* Return the MMU index for a v7M CPU in the specified security state */
arm_v7m_mmu_idx_for_secstate(CPUARMState * env,bool secstate)194 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
195 {
196 bool priv = arm_v7m_is_handler_mode(env) ||
197 !(env->v7m.control[secstate] & 1);
198
199 return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
200 }
201
202 /*
203 * What kind of stack write are we doing? This affects how exceptions
204 * generated during the stacking are treated.
205 */
206 typedef enum StackingMode {
207 STACK_NORMAL,
208 STACK_IGNFAULTS,
209 STACK_LAZYFP,
210 } StackingMode;
211
v7m_stack_write(ARMCPU * cpu,uint32_t addr,uint32_t value,ARMMMUIdx mmu_idx,StackingMode mode)212 static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
213 ARMMMUIdx mmu_idx, StackingMode mode)
214 {
215 CPUState *cs = CPU(cpu);
216 CPUARMState *env = &cpu->env;
217 MemTxResult txres;
218 GetPhysAddrResult res = {};
219 ARMMMUFaultInfo fi = {};
220 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
221 int exc;
222 bool exc_secure;
223
224 if (get_phys_addr(env, addr, MMU_DATA_STORE, 0, mmu_idx, &res, &fi)) {
225 /* MPU/SAU lookup failed */
226 if (fi.type == ARMFault_QEMU_SFault) {
227 if (mode == STACK_LAZYFP) {
228 qemu_log_mask(CPU_LOG_INT,
229 "...SecureFault with SFSR.LSPERR "
230 "during lazy stacking\n");
231 env->v7m.sfsr |= R_V7M_SFSR_LSPERR_MASK;
232 } else {
233 qemu_log_mask(CPU_LOG_INT,
234 "...SecureFault with SFSR.AUVIOL "
235 "during stacking\n");
236 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
237 }
238 env->v7m.sfsr |= R_V7M_SFSR_SFARVALID_MASK;
239 env->v7m.sfar = addr;
240 exc = ARMV7M_EXCP_SECURE;
241 exc_secure = false;
242 } else {
243 if (mode == STACK_LAZYFP) {
244 qemu_log_mask(CPU_LOG_INT,
245 "...MemManageFault with CFSR.MLSPERR\n");
246 env->v7m.cfsr[secure] |= R_V7M_CFSR_MLSPERR_MASK;
247 } else {
248 qemu_log_mask(CPU_LOG_INT,
249 "...MemManageFault with CFSR.MSTKERR\n");
250 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK;
251 }
252 exc = ARMV7M_EXCP_MEM;
253 exc_secure = secure;
254 }
255 goto pend_fault;
256 }
257 address_space_stl_le(arm_addressspace(cs, res.f.attrs), res.f.phys_addr,
258 value, res.f.attrs, &txres);
259 if (txres != MEMTX_OK) {
260 /* BusFault trying to write the data */
261 if (mode == STACK_LAZYFP) {
262 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.LSPERR\n");
263 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_LSPERR_MASK;
264 } else {
265 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n");
266 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK;
267 }
268 exc = ARMV7M_EXCP_BUS;
269 exc_secure = false;
270 goto pend_fault;
271 }
272 return true;
273
274 pend_fault:
275 /*
276 * By pending the exception at this point we are making
277 * the IMPDEF choice "overridden exceptions pended" (see the
278 * MergeExcInfo() pseudocode). The other choice would be to not
279 * pend them now and then make a choice about which to throw away
280 * later if we have two derived exceptions.
281 * The only case when we must not pend the exception but instead
282 * throw it away is if we are doing the push of the callee registers
283 * and we've already generated a derived exception (this is indicated
284 * by the caller passing STACK_IGNFAULTS). Even in this case we will
285 * still update the fault status registers.
286 */
287 switch (mode) {
288 case STACK_NORMAL:
289 armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure);
290 break;
291 case STACK_LAZYFP:
292 armv7m_nvic_set_pending_lazyfp(env->nvic, exc, exc_secure);
293 break;
294 case STACK_IGNFAULTS:
295 break;
296 }
297 return false;
298 }
299
v7m_stack_read(ARMCPU * cpu,uint32_t * dest,uint32_t addr,ARMMMUIdx mmu_idx)300 static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
301 ARMMMUIdx mmu_idx)
302 {
303 CPUState *cs = CPU(cpu);
304 CPUARMState *env = &cpu->env;
305 MemTxResult txres;
306 GetPhysAddrResult res = {};
307 ARMMMUFaultInfo fi = {};
308 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
309 int exc;
310 bool exc_secure;
311 uint32_t value;
312
313 if (get_phys_addr(env, addr, MMU_DATA_LOAD, 0, mmu_idx, &res, &fi)) {
314 /* MPU/SAU lookup failed */
315 if (fi.type == ARMFault_QEMU_SFault) {
316 qemu_log_mask(CPU_LOG_INT,
317 "...SecureFault with SFSR.AUVIOL during unstack\n");
318 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
319 env->v7m.sfar = addr;
320 exc = ARMV7M_EXCP_SECURE;
321 exc_secure = false;
322 } else {
323 qemu_log_mask(CPU_LOG_INT,
324 "...MemManageFault with CFSR.MUNSTKERR\n");
325 env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK;
326 exc = ARMV7M_EXCP_MEM;
327 exc_secure = secure;
328 }
329 goto pend_fault;
330 }
331
332 value = address_space_ldl(arm_addressspace(cs, res.f.attrs),
333 res.f.phys_addr, res.f.attrs, &txres);
334 if (txres != MEMTX_OK) {
335 /* BusFault trying to read the data */
336 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n");
337 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK;
338 exc = ARMV7M_EXCP_BUS;
339 exc_secure = false;
340 goto pend_fault;
341 }
342
343 *dest = value;
344 return true;
345
346 pend_fault:
347 /*
348 * By pending the exception at this point we are making
349 * the IMPDEF choice "overridden exceptions pended" (see the
350 * MergeExcInfo() pseudocode). The other choice would be to not
351 * pend them now and then make a choice about which to throw away
352 * later if we have two derived exceptions.
353 */
354 armv7m_nvic_set_pending(env->nvic, exc, exc_secure);
355 return false;
356 }
357
HELPER(v7m_preserve_fp_state)358 void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
359 {
360 /*
361 * Preserve FP state (because LSPACT was set and we are about
362 * to execute an FP instruction). This corresponds to the
363 * PreserveFPState() pseudocode.
364 * We may throw an exception if the stacking fails.
365 */
366 ARMCPU *cpu = env_archcpu(env);
367 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
368 bool negpri = !(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_HFRDY_MASK);
369 bool is_priv = !(env->v7m.fpccr[is_secure] & R_V7M_FPCCR_USER_MASK);
370 bool splimviol = env->v7m.fpccr[is_secure] & R_V7M_FPCCR_SPLIMVIOL_MASK;
371 uint32_t fpcar = env->v7m.fpcar[is_secure];
372 bool stacked_ok = true;
373 bool ts = is_secure && (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
374 bool take_exception;
375
376 /* Take the BQL as we are going to touch the NVIC */
377 bql_lock();
378
379 /* Check the background context had access to the FPU */
380 if (!v7m_cpacr_pass(env, is_secure, is_priv)) {
381 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, is_secure);
382 env->v7m.cfsr[is_secure] |= R_V7M_CFSR_NOCP_MASK;
383 stacked_ok = false;
384 } else if (!is_secure && !extract32(env->v7m.nsacr, 10, 1)) {
385 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
386 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
387 stacked_ok = false;
388 }
389
390 if (!splimviol && stacked_ok) {
391 /* We only stack if the stack limit wasn't violated */
392 int i;
393 ARMMMUIdx mmu_idx;
394
395 mmu_idx = arm_v7m_mmu_idx_all(env, is_secure, is_priv, negpri);
396 for (i = 0; i < (ts ? 32 : 16); i += 2) {
397 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
398 uint32_t faddr = fpcar + 4 * i;
399 uint32_t slo = extract64(dn, 0, 32);
400 uint32_t shi = extract64(dn, 32, 32);
401
402 if (i >= 16) {
403 faddr += 8; /* skip the slot for the FPSCR/VPR */
404 }
405 stacked_ok = stacked_ok &&
406 v7m_stack_write(cpu, faddr, slo, mmu_idx, STACK_LAZYFP) &&
407 v7m_stack_write(cpu, faddr + 4, shi, mmu_idx, STACK_LAZYFP);
408 }
409
410 stacked_ok = stacked_ok &&
411 v7m_stack_write(cpu, fpcar + 0x40,
412 vfp_get_fpscr(env), mmu_idx, STACK_LAZYFP);
413 if (cpu_isar_feature(aa32_mve, cpu)) {
414 stacked_ok = stacked_ok &&
415 v7m_stack_write(cpu, fpcar + 0x44,
416 env->v7m.vpr, mmu_idx, STACK_LAZYFP);
417 }
418 }
419
420 /*
421 * We definitely pended an exception, but it's possible that it
422 * might not be able to be taken now. If its priority permits us
423 * to take it now, then we must not update the LSPACT or FP regs,
424 * but instead jump out to take the exception immediately.
425 * If it's just pending and won't be taken until the current
426 * handler exits, then we do update LSPACT and the FP regs.
427 */
428 take_exception = !stacked_ok &&
429 armv7m_nvic_can_take_pending_exception(env->nvic);
430
431 bql_unlock();
432
433 if (take_exception) {
434 raise_exception_ra(env, EXCP_LAZYFP, 0, 1, GETPC());
435 }
436
437 env->v7m.fpccr[is_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
438
439 if (ts) {
440 /* Clear s0 to s31 and the FPSCR and VPR */
441 int i;
442
443 for (i = 0; i < 32; i += 2) {
444 *aa32_vfp_dreg(env, i / 2) = 0;
445 }
446 vfp_set_fpscr(env, 0);
447 if (cpu_isar_feature(aa32_mve, cpu)) {
448 env->v7m.vpr = 0;
449 }
450 }
451 /*
452 * Otherwise s0 to s15, FPSCR and VPR are UNKNOWN; we choose to leave them
453 * unchanged.
454 */
455 }
456
457 /*
458 * Write to v7M CONTROL.SPSEL bit for the specified security bank.
459 * This may change the current stack pointer between Main and Process
460 * stack pointers if it is done for the CONTROL register for the current
461 * security state.
462 */
write_v7m_control_spsel_for_secstate(CPUARMState * env,bool new_spsel,bool secstate)463 static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
464 bool new_spsel,
465 bool secstate)
466 {
467 bool old_is_psp = v7m_using_psp(env);
468
469 env->v7m.control[secstate] =
470 deposit32(env->v7m.control[secstate],
471 R_V7M_CONTROL_SPSEL_SHIFT,
472 R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
473
474 if (secstate == env->v7m.secure) {
475 bool new_is_psp = v7m_using_psp(env);
476 uint32_t tmp;
477
478 if (old_is_psp != new_is_psp) {
479 tmp = env->v7m.other_sp;
480 env->v7m.other_sp = env->regs[13];
481 env->regs[13] = tmp;
482 }
483 }
484 }
485
486 /*
487 * Write to v7M CONTROL.SPSEL bit. This may change the current
488 * stack pointer between Main and Process stack pointers.
489 */
write_v7m_control_spsel(CPUARMState * env,bool new_spsel)490 static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
491 {
492 write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
493 }
494
write_v7m_exception(CPUARMState * env,uint32_t new_exc)495 void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
496 {
497 /*
498 * Write a new value to v7m.exception, thus transitioning into or out
499 * of Handler mode; this may result in a change of active stack pointer.
500 */
501 bool new_is_psp, old_is_psp = v7m_using_psp(env);
502 uint32_t tmp;
503
504 env->v7m.exception = new_exc;
505
506 new_is_psp = v7m_using_psp(env);
507
508 if (old_is_psp != new_is_psp) {
509 tmp = env->v7m.other_sp;
510 env->v7m.other_sp = env->regs[13];
511 env->regs[13] = tmp;
512 }
513 }
514
515 /* Switch M profile security state between NS and S */
switch_v7m_security_state(CPUARMState * env,bool new_secstate)516 static void switch_v7m_security_state(CPUARMState *env, bool new_secstate)
517 {
518 uint32_t new_ss_msp, new_ss_psp;
519
520 if (env->v7m.secure == new_secstate) {
521 return;
522 }
523
524 /*
525 * All the banked state is accessed by looking at env->v7m.secure
526 * except for the stack pointer; rearrange the SP appropriately.
527 */
528 new_ss_msp = env->v7m.other_ss_msp;
529 new_ss_psp = env->v7m.other_ss_psp;
530
531 if (v7m_using_psp(env)) {
532 env->v7m.other_ss_psp = env->regs[13];
533 env->v7m.other_ss_msp = env->v7m.other_sp;
534 } else {
535 env->v7m.other_ss_msp = env->regs[13];
536 env->v7m.other_ss_psp = env->v7m.other_sp;
537 }
538
539 env->v7m.secure = new_secstate;
540
541 if (v7m_using_psp(env)) {
542 env->regs[13] = new_ss_psp;
543 env->v7m.other_sp = new_ss_msp;
544 } else {
545 env->regs[13] = new_ss_msp;
546 env->v7m.other_sp = new_ss_psp;
547 }
548 }
549
HELPER(v7m_bxns)550 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
551 {
552 /*
553 * Handle v7M BXNS:
554 * - if the return value is a magic value, do exception return (like BX)
555 * - otherwise bit 0 of the return value is the target security state
556 */
557 uint32_t min_magic;
558
559 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
560 /* Covers FNC_RETURN and EXC_RETURN magic */
561 min_magic = FNC_RETURN_MIN_MAGIC;
562 } else {
563 /* EXC_RETURN magic only */
564 min_magic = EXC_RETURN_MIN_MAGIC;
565 }
566
567 if (dest >= min_magic) {
568 /*
569 * This is an exception return magic value; put it where
570 * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT.
571 * Note that if we ever add gen_ss_advance() singlestep support to
572 * M profile this should count as an "instruction execution complete"
573 * event (compare gen_bx_excret_final_code()).
574 */
575 env->regs[15] = dest & ~1;
576 env->thumb = dest & 1;
577 HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT);
578 /* notreached */
579 }
580
581 /* translate.c should have made BXNS UNDEF unless we're secure */
582 assert(env->v7m.secure);
583
584 if (!(dest & 1)) {
585 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
586 }
587 switch_v7m_security_state(env, dest & 1);
588 env->thumb = true;
589 env->regs[15] = dest & ~1;
590 arm_rebuild_hflags(env);
591 }
592
HELPER(v7m_blxns)593 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
594 {
595 /*
596 * Handle v7M BLXNS:
597 * - bit 0 of the destination address is the target security state
598 */
599
600 /* At this point regs[15] is the address just after the BLXNS */
601 uint32_t nextinst = env->regs[15] | 1;
602 uint32_t sp = env->regs[13] - 8;
603 uint32_t saved_psr;
604
605 /* translate.c will have made BLXNS UNDEF unless we're secure */
606 assert(env->v7m.secure);
607
608 if (dest & 1) {
609 /*
610 * Target is Secure, so this is just a normal BLX,
611 * except that the low bit doesn't indicate Thumb/not.
612 */
613 env->regs[14] = nextinst;
614 env->thumb = true;
615 env->regs[15] = dest & ~1;
616 return;
617 }
618
619 /* Target is non-secure: first push a stack frame */
620 if (!QEMU_IS_ALIGNED(sp, 8)) {
621 qemu_log_mask(LOG_GUEST_ERROR,
622 "BLXNS with misaligned SP is UNPREDICTABLE\n");
623 }
624
625 if (sp < v7m_sp_limit(env)) {
626 raise_exception(env, EXCP_STKOF, 0, 1);
627 }
628
629 saved_psr = env->v7m.exception;
630 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
631 saved_psr |= XPSR_SFPA;
632 }
633
634 /* Note that these stores can throw exceptions on MPU faults */
635 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
636 MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN,
637 arm_to_core_mmu_idx(mmu_idx));
638 cpu_stl_mmu(env, sp, nextinst, oi, GETPC());
639 cpu_stl_mmu(env, sp + 4, saved_psr, oi, GETPC());
640
641 env->regs[13] = sp;
642 env->regs[14] = 0xfeffffff;
643 if (arm_v7m_is_handler_mode(env)) {
644 /*
645 * Write a dummy value to IPSR, to avoid leaking the current secure
646 * exception number to non-secure code. This is guaranteed not
647 * to cause write_v7m_exception() to actually change stacks.
648 */
649 write_v7m_exception(env, 1);
650 }
651 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
652 switch_v7m_security_state(env, 0);
653 env->thumb = true;
654 env->regs[15] = dest;
655 arm_rebuild_hflags(env);
656 }
657
arm_v7m_load_vector(ARMCPU * cpu,int exc,bool targets_secure,uint32_t * pvec)658 static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
659 uint32_t *pvec)
660 {
661 CPUState *cs = CPU(cpu);
662 CPUARMState *env = &cpu->env;
663 MemTxResult result;
664 uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4;
665 uint32_t vector_entry;
666 MemTxAttrs attrs = {};
667 ARMMMUIdx mmu_idx;
668 bool exc_secure;
669
670 qemu_log_mask(CPU_LOG_INT,
671 "...loading from element %d of %s vector table at 0x%x\n",
672 exc, targets_secure ? "secure" : "non-secure", addr);
673
674 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
675
676 /*
677 * We don't do a get_phys_addr() here because the rules for vector
678 * loads are special: they always use the default memory map, and
679 * the default memory map permits reads from all addresses.
680 * Since there's no easy way to pass through to pmsav8_mpu_lookup()
681 * that we want this special case which would always say "yes",
682 * we just do the SAU lookup here followed by a direct physical load.
683 */
684 attrs.secure = targets_secure;
685 attrs.user = false;
686
687 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
688 V8M_SAttributes sattrs = {};
689
690 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx,
691 targets_secure, &sattrs);
692 if (sattrs.ns) {
693 attrs.secure = false;
694 } else if (!targets_secure) {
695 /*
696 * NS access to S memory: the underlying exception which we escalate
697 * to HardFault is SecureFault, which always targets Secure.
698 */
699 exc_secure = true;
700 goto load_fail;
701 }
702 }
703
704 vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
705 attrs, &result);
706 if (result != MEMTX_OK) {
707 /*
708 * Underlying exception is BusFault: its target security state
709 * depends on BFHFNMINS.
710 */
711 exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
712 goto load_fail;
713 }
714 *pvec = vector_entry;
715 qemu_log_mask(CPU_LOG_INT, "...loaded new PC 0x%x\n", *pvec);
716 return true;
717
718 load_fail:
719 /*
720 * All vector table fetch fails are reported as HardFault, with
721 * HFSR.VECTTBL and .FORCED set. (FORCED is set because
722 * technically the underlying exception is a SecureFault or BusFault
723 * that is escalated to HardFault.) This is a terminal exception,
724 * so we will either take the HardFault immediately or else enter
725 * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
726 * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
727 * secure); otherwise it targets the same security state as the
728 * underlying exception.
729 * In v8.1M HardFaults from vector table fetch fails don't set FORCED.
730 */
731 if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
732 exc_secure = true;
733 }
734 env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK;
735 if (!arm_feature(env, ARM_FEATURE_V8_1M)) {
736 env->v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
737 }
738 armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
739 return false;
740 }
741
v7m_integrity_sig(CPUARMState * env,uint32_t lr)742 static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr)
743 {
744 /*
745 * Return the integrity signature value for the callee-saves
746 * stack frame section. @lr is the exception return payload/LR value
747 * whose FType bit forms bit 0 of the signature if FP is present.
748 */
749 uint32_t sig = 0xfefa125a;
750
751 if (!cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))
752 || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
753 sig |= 1;
754 }
755 return sig;
756 }
757
v7m_push_callee_stack(ARMCPU * cpu,uint32_t lr,bool dotailchain,bool ignore_faults)758 static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
759 bool ignore_faults)
760 {
761 /*
762 * For v8M, push the callee-saves register part of the stack frame.
763 * Compare the v8M pseudocode PushCalleeStack().
764 * In the tailchaining case this may not be the current stack.
765 */
766 CPUARMState *env = &cpu->env;
767 uint32_t *frame_sp_p;
768 uint32_t frameptr;
769 ARMMMUIdx mmu_idx;
770 bool stacked_ok;
771 uint32_t limit;
772 bool want_psp;
773 uint32_t sig;
774 StackingMode smode = ignore_faults ? STACK_IGNFAULTS : STACK_NORMAL;
775
776 if (dotailchain) {
777 bool mode = lr & R_V7M_EXCRET_MODE_MASK;
778 bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) ||
779 !mode;
780
781 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
782 frame_sp_p = arm_v7m_get_sp_ptr(env, M_REG_S, mode,
783 lr & R_V7M_EXCRET_SPSEL_MASK);
784 want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
785 if (want_psp) {
786 limit = env->v7m.psplim[M_REG_S];
787 } else {
788 limit = env->v7m.msplim[M_REG_S];
789 }
790 } else {
791 mmu_idx = arm_mmu_idx(env);
792 frame_sp_p = &env->regs[13];
793 limit = v7m_sp_limit(env);
794 }
795
796 frameptr = *frame_sp_p - 0x28;
797 if (frameptr < limit) {
798 /*
799 * Stack limit failure: set SP to the limit value, and generate
800 * STKOF UsageFault. Stack pushes below the limit must not be
801 * performed. It is IMPDEF whether pushes above the limit are
802 * performed; we choose not to.
803 */
804 qemu_log_mask(CPU_LOG_INT,
805 "...STKOF during callee-saves register stacking\n");
806 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
807 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
808 env->v7m.secure);
809 *frame_sp_p = limit;
810 return true;
811 }
812
813 /*
814 * Write as much of the stack frame as we can. A write failure may
815 * cause us to pend a derived exception.
816 */
817 sig = v7m_integrity_sig(env, lr);
818 stacked_ok =
819 v7m_stack_write(cpu, frameptr, sig, mmu_idx, smode) &&
820 v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx, smode) &&
821 v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx, smode) &&
822 v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx, smode) &&
823 v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx, smode) &&
824 v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx, smode) &&
825 v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx, smode) &&
826 v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx, smode) &&
827 v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx, smode);
828
829 /* Update SP regardless of whether any of the stack accesses failed. */
830 *frame_sp_p = frameptr;
831
832 return !stacked_ok;
833 }
834
v7m_exception_taken(ARMCPU * cpu,uint32_t lr,bool dotailchain,bool ignore_stackfaults)835 static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
836 bool ignore_stackfaults)
837 {
838 /*
839 * Do the "take the exception" parts of exception entry,
840 * but not the pushing of state to the stack. This is
841 * similar to the pseudocode ExceptionTaken() function.
842 */
843 CPUARMState *env = &cpu->env;
844 uint32_t addr;
845 bool targets_secure;
846 int exc;
847 bool push_failed = false;
848
849 armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure);
850 qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n",
851 targets_secure ? "secure" : "nonsecure", exc);
852
853 if (dotailchain) {
854 /* Sanitize LR FType and PREFIX bits */
855 if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
856 lr |= R_V7M_EXCRET_FTYPE_MASK;
857 }
858 lr = deposit32(lr, 24, 8, 0xff);
859 }
860
861 if (arm_feature(env, ARM_FEATURE_V8)) {
862 if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
863 (lr & R_V7M_EXCRET_S_MASK)) {
864 /*
865 * The background code (the owner of the registers in the
866 * exception frame) is Secure. This means it may either already
867 * have or now needs to push callee-saves registers.
868 */
869 if (targets_secure) {
870 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
871 /*
872 * We took an exception from Secure to NonSecure
873 * (which means the callee-saved registers got stacked)
874 * and are now tailchaining to a Secure exception.
875 * Clear DCRS so eventual return from this Secure
876 * exception unstacks the callee-saved registers.
877 */
878 lr &= ~R_V7M_EXCRET_DCRS_MASK;
879 }
880 } else {
881 /*
882 * We're going to a non-secure exception; push the
883 * callee-saves registers to the stack now, if they're
884 * not already saved.
885 */
886 if (lr & R_V7M_EXCRET_DCRS_MASK &&
887 !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) {
888 push_failed = v7m_push_callee_stack(cpu, lr, dotailchain,
889 ignore_stackfaults);
890 }
891 lr |= R_V7M_EXCRET_DCRS_MASK;
892 }
893 }
894
895 lr &= ~R_V7M_EXCRET_ES_MASK;
896 if (targets_secure) {
897 lr |= R_V7M_EXCRET_ES_MASK;
898 }
899 lr &= ~R_V7M_EXCRET_SPSEL_MASK;
900 if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
901 lr |= R_V7M_EXCRET_SPSEL_MASK;
902 }
903
904 /*
905 * Clear registers if necessary to prevent non-secure exception
906 * code being able to see register values from secure code.
907 * Where register values become architecturally UNKNOWN we leave
908 * them with their previous values. v8.1M is tighter than v8.0M
909 * here and always zeroes the caller-saved registers regardless
910 * of the security state the exception is targeting.
911 */
912 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
913 if (!targets_secure || arm_feature(env, ARM_FEATURE_V8_1M)) {
914 /*
915 * Always clear the caller-saved registers (they have been
916 * pushed to the stack earlier in v7m_push_stack()).
917 * Clear callee-saved registers if the background code is
918 * Secure (in which case these regs were saved in
919 * v7m_push_callee_stack()).
920 */
921 int i;
922 /*
923 * r4..r11 are callee-saves, zero only if background
924 * state was Secure (EXCRET.S == 1) and exception
925 * targets Non-secure state
926 */
927 bool zero_callee_saves = !targets_secure &&
928 (lr & R_V7M_EXCRET_S_MASK);
929
930 for (i = 0; i < 13; i++) {
931 if (i < 4 || i > 11 || zero_callee_saves) {
932 env->regs[i] = 0;
933 }
934 }
935 /* Clear EAPSR */
936 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
937 }
938 }
939 }
940
941 if (push_failed && !ignore_stackfaults) {
942 /*
943 * Derived exception on callee-saves register stacking:
944 * we might now want to take a different exception which
945 * targets a different security state, so try again from the top.
946 */
947 qemu_log_mask(CPU_LOG_INT,
948 "...derived exception on callee-saves register stacking");
949 v7m_exception_taken(cpu, lr, true, true);
950 return;
951 }
952
953 if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) {
954 /* Vector load failed: derived exception */
955 qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load");
956 v7m_exception_taken(cpu, lr, true, true);
957 return;
958 }
959
960 /*
961 * Now we've done everything that might cause a derived exception
962 * we can go ahead and activate whichever exception we're going to
963 * take (which might now be the derived exception).
964 */
965 armv7m_nvic_acknowledge_irq(env->nvic);
966
967 /* Switch to target security state -- must do this before writing SPSEL */
968 switch_v7m_security_state(env, targets_secure);
969 write_v7m_control_spsel(env, 0);
970 arm_clear_exclusive(env);
971 /* Clear SFPA and FPCA (has no effect if no FPU) */
972 env->v7m.control[M_REG_S] &=
973 ~(R_V7M_CONTROL_FPCA_MASK | R_V7M_CONTROL_SFPA_MASK);
974 /* Clear IT bits */
975 env->condexec_bits = 0;
976 env->regs[14] = lr;
977 env->regs[15] = addr & 0xfffffffe;
978 env->thumb = addr & 1;
979 arm_rebuild_hflags(env);
980 }
981
v7m_update_fpccr(CPUARMState * env,uint32_t frameptr,bool apply_splim)982 static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr,
983 bool apply_splim)
984 {
985 /*
986 * Like the pseudocode UpdateFPCCR: save state in FPCAR and FPCCR
987 * that we will need later in order to do lazy FP reg stacking.
988 */
989 bool is_secure = env->v7m.secure;
990 NVICState *nvic = env->nvic;
991 /*
992 * Some bits are unbanked and live always in fpccr[M_REG_S]; some bits
993 * are banked and we want to update the bit in the bank for the
994 * current security state; and in one case we want to specifically
995 * update the NS banked version of a bit even if we are secure.
996 */
997 uint32_t *fpccr_s = &env->v7m.fpccr[M_REG_S];
998 uint32_t *fpccr_ns = &env->v7m.fpccr[M_REG_NS];
999 uint32_t *fpccr = &env->v7m.fpccr[is_secure];
1000 bool hfrdy, bfrdy, mmrdy, ns_ufrdy, s_ufrdy, sfrdy, monrdy;
1001
1002 env->v7m.fpcar[is_secure] = frameptr & ~0x7;
1003
1004 if (apply_splim && arm_feature(env, ARM_FEATURE_V8)) {
1005 bool splimviol;
1006 uint32_t splim = v7m_sp_limit(env);
1007 bool ign = armv7m_nvic_neg_prio_requested(nvic, is_secure) &&
1008 (env->v7m.ccr[is_secure] & R_V7M_CCR_STKOFHFNMIGN_MASK);
1009
1010 splimviol = !ign && frameptr < splim;
1011 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, SPLIMVIOL, splimviol);
1012 }
1013
1014 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, LSPACT, 1);
1015
1016 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, S, is_secure);
1017
1018 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, USER, arm_current_el(env) == 0);
1019
1020 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, THREAD,
1021 !arm_v7m_is_handler_mode(env));
1022
1023 hfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_HARD, false);
1024 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, HFRDY, hfrdy);
1025
1026 bfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_BUS, false);
1027 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, BFRDY, bfrdy);
1028
1029 mmrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_MEM, is_secure);
1030 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, MMRDY, mmrdy);
1031
1032 ns_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, false);
1033 *fpccr_ns = FIELD_DP32(*fpccr_ns, V7M_FPCCR, UFRDY, ns_ufrdy);
1034
1035 monrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_DEBUG, false);
1036 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, MONRDY, monrdy);
1037
1038 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1039 s_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, true);
1040 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, UFRDY, s_ufrdy);
1041
1042 sfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_SECURE, false);
1043 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, SFRDY, sfrdy);
1044 }
1045 }
1046
HELPER(v7m_vlstm)1047 void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
1048 {
1049 /* fptr is the value of Rn, the frame pointer we store the FP regs to */
1050 ARMCPU *cpu = env_archcpu(env);
1051 bool s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
1052 bool lspact = env->v7m.fpccr[s] & R_V7M_FPCCR_LSPACT_MASK;
1053 uintptr_t ra = GETPC();
1054 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1055 MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN,
1056 arm_to_core_mmu_idx(mmu_idx));
1057
1058 assert(env->v7m.secure);
1059
1060 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1061 return;
1062 }
1063
1064 /* Check access to the coprocessor is permitted */
1065 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
1066 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
1067 }
1068
1069 if (lspact) {
1070 /* LSPACT should not be active when there is active FP state */
1071 raise_exception_ra(env, EXCP_LSERR, 0, 1, GETPC());
1072 }
1073
1074 if (fptr & 7) {
1075 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
1076 }
1077
1078 /*
1079 * Note that we do not use v7m_stack_write() here, because the
1080 * accesses should not set the FSR bits for stacking errors if they
1081 * fail. (In pseudocode terms, they are AccType_NORMAL, not AccType_STACK
1082 * or AccType_LAZYFP). Faults in cpu_stl_mmu() will throw exceptions
1083 * and longjmp out.
1084 */
1085 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1086 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1087 int i;
1088
1089 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1090 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1091 uint32_t faddr = fptr + 4 * i;
1092 uint32_t slo = extract64(dn, 0, 32);
1093 uint32_t shi = extract64(dn, 32, 32);
1094
1095 if (i >= 16) {
1096 faddr += 8; /* skip the slot for the FPSCR */
1097 }
1098 cpu_stl_mmu(env, faddr, slo, oi, ra);
1099 cpu_stl_mmu(env, faddr + 4, shi, oi, ra);
1100 }
1101 cpu_stl_mmu(env, fptr + 0x40, vfp_get_fpscr(env), oi, ra);
1102 if (cpu_isar_feature(aa32_mve, cpu)) {
1103 cpu_stl_mmu(env, fptr + 0x44, env->v7m.vpr, oi, ra);
1104 }
1105
1106 /*
1107 * If TS is 0 then s0 to s15, FPSCR and VPR are UNKNOWN; we choose to
1108 * leave them unchanged, matching our choice in v7m_preserve_fp_state.
1109 */
1110 if (ts) {
1111 for (i = 0; i < 32; i += 2) {
1112 *aa32_vfp_dreg(env, i / 2) = 0;
1113 }
1114 vfp_set_fpscr(env, 0);
1115 if (cpu_isar_feature(aa32_mve, cpu)) {
1116 env->v7m.vpr = 0;
1117 }
1118 }
1119 } else {
1120 v7m_update_fpccr(env, fptr, false);
1121 }
1122
1123 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
1124 }
1125
HELPER(v7m_vlldm)1126 void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
1127 {
1128 ARMCPU *cpu = env_archcpu(env);
1129 uintptr_t ra = GETPC();
1130 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1131 MemOpIdx oi = make_memop_idx(MO_TEUL | MO_ALIGN,
1132 arm_to_core_mmu_idx(mmu_idx));
1133
1134 /* fptr is the value of Rn, the frame pointer we load the FP regs from */
1135 assert(env->v7m.secure);
1136
1137 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1138 return;
1139 }
1140
1141 /* Check access to the coprocessor is permitted */
1142 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
1143 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
1144 }
1145
1146 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1147 /* State in FP is still valid */
1148 env->v7m.fpccr[M_REG_S] &= ~R_V7M_FPCCR_LSPACT_MASK;
1149 } else {
1150 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1151 int i;
1152 uint32_t fpscr;
1153
1154 if (fptr & 7) {
1155 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
1156 }
1157
1158 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1159 uint32_t slo, shi;
1160 uint64_t dn;
1161 uint32_t faddr = fptr + 4 * i;
1162
1163 if (i >= 16) {
1164 faddr += 8; /* skip the slot for the FPSCR and VPR */
1165 }
1166
1167 slo = cpu_ldl_mmu(env, faddr, oi, ra);
1168 shi = cpu_ldl_mmu(env, faddr + 4, oi, ra);
1169
1170 dn = (uint64_t) shi << 32 | slo;
1171 *aa32_vfp_dreg(env, i / 2) = dn;
1172 }
1173 fpscr = cpu_ldl_mmu(env, fptr + 0x40, oi, ra);
1174 vfp_set_fpscr(env, fpscr);
1175 if (cpu_isar_feature(aa32_mve, cpu)) {
1176 env->v7m.vpr = cpu_ldl_mmu(env, fptr + 0x44, oi, ra);
1177 }
1178 }
1179
1180 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK;
1181 }
1182
v7m_push_stack(ARMCPU * cpu)1183 static bool v7m_push_stack(ARMCPU *cpu)
1184 {
1185 /*
1186 * Do the "set up stack frame" part of exception entry,
1187 * similar to pseudocode PushStack().
1188 * Return true if we generate a derived exception (and so
1189 * should ignore further stack faults trying to process
1190 * that derived exception.)
1191 */
1192 bool stacked_ok = true, limitviol = false;
1193 CPUARMState *env = &cpu->env;
1194 uint32_t xpsr = xpsr_read(env);
1195 uint32_t frameptr = env->regs[13];
1196 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1197 uint32_t framesize;
1198 bool nsacr_cp10 = extract32(env->v7m.nsacr, 10, 1);
1199
1200 if ((env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) &&
1201 (env->v7m.secure || nsacr_cp10)) {
1202 if (env->v7m.secure &&
1203 env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK) {
1204 framesize = 0xa8;
1205 } else {
1206 framesize = 0x68;
1207 }
1208 } else {
1209 framesize = 0x20;
1210 }
1211
1212 /* Align stack pointer if the guest wants that */
1213 if ((frameptr & 4) &&
1214 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) {
1215 frameptr -= 4;
1216 xpsr |= XPSR_SPREALIGN;
1217 }
1218
1219 xpsr &= ~XPSR_SFPA;
1220 if (env->v7m.secure &&
1221 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1222 xpsr |= XPSR_SFPA;
1223 }
1224
1225 frameptr -= framesize;
1226
1227 if (arm_feature(env, ARM_FEATURE_V8)) {
1228 uint32_t limit = v7m_sp_limit(env);
1229
1230 if (frameptr < limit) {
1231 /*
1232 * Stack limit failure: set SP to the limit value, and generate
1233 * STKOF UsageFault. Stack pushes below the limit must not be
1234 * performed. It is IMPDEF whether pushes above the limit are
1235 * performed; we choose not to.
1236 */
1237 qemu_log_mask(CPU_LOG_INT,
1238 "...STKOF during stacking\n");
1239 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
1240 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1241 env->v7m.secure);
1242 env->regs[13] = limit;
1243 /*
1244 * We won't try to perform any further memory accesses but
1245 * we must continue through the following code to check for
1246 * permission faults during FPU state preservation, and we
1247 * must update FPCCR if lazy stacking is enabled.
1248 */
1249 limitviol = true;
1250 stacked_ok = false;
1251 }
1252 }
1253
1254 /*
1255 * Write as much of the stack frame as we can. If we fail a stack
1256 * write this will result in a derived exception being pended
1257 * (which may be taken in preference to the one we started with
1258 * if it has higher priority).
1259 */
1260 stacked_ok = stacked_ok &&
1261 v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, STACK_NORMAL) &&
1262 v7m_stack_write(cpu, frameptr + 4, env->regs[1],
1263 mmu_idx, STACK_NORMAL) &&
1264 v7m_stack_write(cpu, frameptr + 8, env->regs[2],
1265 mmu_idx, STACK_NORMAL) &&
1266 v7m_stack_write(cpu, frameptr + 12, env->regs[3],
1267 mmu_idx, STACK_NORMAL) &&
1268 v7m_stack_write(cpu, frameptr + 16, env->regs[12],
1269 mmu_idx, STACK_NORMAL) &&
1270 v7m_stack_write(cpu, frameptr + 20, env->regs[14],
1271 mmu_idx, STACK_NORMAL) &&
1272 v7m_stack_write(cpu, frameptr + 24, env->regs[15],
1273 mmu_idx, STACK_NORMAL) &&
1274 v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, STACK_NORMAL);
1275
1276 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) {
1277 /* FPU is active, try to save its registers */
1278 bool fpccr_s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
1279 bool lspact = env->v7m.fpccr[fpccr_s] & R_V7M_FPCCR_LSPACT_MASK;
1280
1281 if (lspact && arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1282 qemu_log_mask(CPU_LOG_INT,
1283 "...SecureFault because LSPACT and FPCA both set\n");
1284 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1285 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1286 } else if (!env->v7m.secure && !nsacr_cp10) {
1287 qemu_log_mask(CPU_LOG_INT,
1288 "...Secure UsageFault with CFSR.NOCP because "
1289 "NSACR.CP10 prevents stacking FP regs\n");
1290 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
1291 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
1292 } else {
1293 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1294 /* Lazy stacking disabled, save registers now */
1295 int i;
1296 bool cpacr_pass = v7m_cpacr_pass(env, env->v7m.secure,
1297 arm_current_el(env) != 0);
1298
1299 if (stacked_ok && !cpacr_pass) {
1300 /*
1301 * Take UsageFault if CPACR forbids access. The pseudocode
1302 * here does a full CheckCPEnabled() but we know the NSACR
1303 * check can never fail as we have already handled that.
1304 */
1305 qemu_log_mask(CPU_LOG_INT,
1306 "...UsageFault with CFSR.NOCP because "
1307 "CPACR.CP10 prevents stacking FP regs\n");
1308 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1309 env->v7m.secure);
1310 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK;
1311 stacked_ok = false;
1312 }
1313
1314 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1315 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1316 uint32_t faddr = frameptr + 0x20 + 4 * i;
1317 uint32_t slo = extract64(dn, 0, 32);
1318 uint32_t shi = extract64(dn, 32, 32);
1319
1320 if (i >= 16) {
1321 faddr += 8; /* skip the slot for the FPSCR and VPR */
1322 }
1323 stacked_ok = stacked_ok &&
1324 v7m_stack_write(cpu, faddr, slo,
1325 mmu_idx, STACK_NORMAL) &&
1326 v7m_stack_write(cpu, faddr + 4, shi,
1327 mmu_idx, STACK_NORMAL);
1328 }
1329 stacked_ok = stacked_ok &&
1330 v7m_stack_write(cpu, frameptr + 0x60,
1331 vfp_get_fpscr(env), mmu_idx, STACK_NORMAL);
1332 if (cpu_isar_feature(aa32_mve, cpu)) {
1333 stacked_ok = stacked_ok &&
1334 v7m_stack_write(cpu, frameptr + 0x64,
1335 env->v7m.vpr, mmu_idx, STACK_NORMAL);
1336 }
1337 if (cpacr_pass) {
1338 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1339 *aa32_vfp_dreg(env, i / 2) = 0;
1340 }
1341 vfp_set_fpscr(env, 0);
1342 if (cpu_isar_feature(aa32_mve, cpu)) {
1343 env->v7m.vpr = 0;
1344 }
1345 }
1346 } else {
1347 /* Lazy stacking enabled, save necessary info to stack later */
1348 v7m_update_fpccr(env, frameptr + 0x20, true);
1349 }
1350 }
1351 }
1352
1353 /*
1354 * If we broke a stack limit then SP was already updated earlier;
1355 * otherwise we update SP regardless of whether any of the stack
1356 * accesses failed or we took some other kind of fault.
1357 */
1358 if (!limitviol) {
1359 env->regs[13] = frameptr;
1360 }
1361
1362 return !stacked_ok;
1363 }
1364
do_v7m_exception_exit(ARMCPU * cpu)1365 static void do_v7m_exception_exit(ARMCPU *cpu)
1366 {
1367 CPUARMState *env = &cpu->env;
1368 uint32_t excret;
1369 uint32_t xpsr, xpsr_mask;
1370 bool ufault = false;
1371 bool sfault = false;
1372 bool return_to_sp_process;
1373 bool return_to_handler;
1374 bool rettobase = false;
1375 bool exc_secure = false;
1376 bool return_to_secure;
1377 bool ftype;
1378 bool restore_s16_s31 = false;
1379
1380 /*
1381 * If we're not in Handler mode then jumps to magic exception-exit
1382 * addresses don't have magic behaviour. However for the v8M
1383 * security extensions the magic secure-function-return has to
1384 * work in thread mode too, so to avoid doing an extra check in
1385 * the generated code we allow exception-exit magic to also cause the
1386 * internal exception and bring us here in thread mode. Correct code
1387 * will never try to do this (the following insn fetch will always
1388 * fault) so we the overhead of having taken an unnecessary exception
1389 * doesn't matter.
1390 */
1391 if (!arm_v7m_is_handler_mode(env)) {
1392 return;
1393 }
1394
1395 /*
1396 * In the spec pseudocode ExceptionReturn() is called directly
1397 * from BXWritePC() and gets the full target PC value including
1398 * bit zero. In QEMU's implementation we treat it as a normal
1399 * jump-to-register (which is then caught later on), and so split
1400 * the target value up between env->regs[15] and env->thumb in
1401 * gen_bx(). Reconstitute it.
1402 */
1403 excret = env->regs[15];
1404 if (env->thumb) {
1405 excret |= 1;
1406 }
1407
1408 qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
1409 " previous exception %d\n",
1410 excret, env->v7m.exception);
1411
1412 if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
1413 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
1414 "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
1415 excret);
1416 }
1417
1418 ftype = excret & R_V7M_EXCRET_FTYPE_MASK;
1419
1420 if (!ftype && !cpu_isar_feature(aa32_vfp_simd, cpu)) {
1421 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception "
1422 "exit PC value 0x%" PRIx32 " is UNPREDICTABLE "
1423 "if FPU not present\n",
1424 excret);
1425 ftype = true;
1426 }
1427
1428 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1429 /*
1430 * EXC_RETURN.ES validation check (R_SMFL). We must do this before
1431 * we pick which FAULTMASK to clear.
1432 */
1433 if (!env->v7m.secure &&
1434 ((excret & R_V7M_EXCRET_ES_MASK) ||
1435 !(excret & R_V7M_EXCRET_DCRS_MASK))) {
1436 sfault = 1;
1437 /* For all other purposes, treat ES as 0 (R_HXSR) */
1438 excret &= ~R_V7M_EXCRET_ES_MASK;
1439 }
1440 exc_secure = excret & R_V7M_EXCRET_ES_MASK;
1441 }
1442
1443 if (env->v7m.exception != ARMV7M_EXCP_NMI) {
1444 /*
1445 * Auto-clear FAULTMASK on return from other than NMI.
1446 * If the security extension is implemented then this only
1447 * happens if the raw execution priority is >= 0; the
1448 * value of the ES bit in the exception return value indicates
1449 * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
1450 */
1451 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1452 if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
1453 env->v7m.faultmask[exc_secure] = 0;
1454 }
1455 } else {
1456 env->v7m.faultmask[M_REG_NS] = 0;
1457 }
1458 }
1459
1460 switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception,
1461 exc_secure)) {
1462 case -1:
1463 /* attempt to exit an exception that isn't active */
1464 ufault = true;
1465 break;
1466 case 0:
1467 /* still an irq active now */
1468 break;
1469 case 1:
1470 /*
1471 * We returned to base exception level, no nesting.
1472 * (In the pseudocode this is written using "NestedActivation != 1"
1473 * where we have 'rettobase == false'.)
1474 */
1475 rettobase = true;
1476 break;
1477 default:
1478 g_assert_not_reached();
1479 }
1480
1481 return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
1482 return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
1483 return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
1484 (excret & R_V7M_EXCRET_S_MASK);
1485
1486 if (arm_feature(env, ARM_FEATURE_V8)) {
1487 if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1488 /*
1489 * UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP);
1490 * we choose to take the UsageFault.
1491 */
1492 if ((excret & R_V7M_EXCRET_S_MASK) ||
1493 (excret & R_V7M_EXCRET_ES_MASK) ||
1494 !(excret & R_V7M_EXCRET_DCRS_MASK)) {
1495 ufault = true;
1496 }
1497 }
1498 if (excret & R_V7M_EXCRET_RES0_MASK) {
1499 ufault = true;
1500 }
1501 } else {
1502 /* For v7M we only recognize certain combinations of the low bits */
1503 switch (excret & 0xf) {
1504 case 1: /* Return to Handler */
1505 break;
1506 case 13: /* Return to Thread using Process stack */
1507 case 9: /* Return to Thread using Main stack */
1508 /*
1509 * We only need to check NONBASETHRDENA for v7M, because in
1510 * v8M this bit does not exist (it is RES1).
1511 */
1512 if (!rettobase &&
1513 !(env->v7m.ccr[env->v7m.secure] &
1514 R_V7M_CCR_NONBASETHRDENA_MASK)) {
1515 ufault = true;
1516 }
1517 break;
1518 default:
1519 ufault = true;
1520 }
1521 }
1522
1523 /*
1524 * Set CONTROL.SPSEL from excret.SPSEL. Since we're still in
1525 * Handler mode (and will be until we write the new XPSR.Interrupt
1526 * field) this does not switch around the current stack pointer.
1527 * We must do this before we do any kind of tailchaining, including
1528 * for the derived exceptions on integrity check failures, or we will
1529 * give the guest an incorrect EXCRET.SPSEL value on exception entry.
1530 */
1531 write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
1532
1533 /*
1534 * Clear scratch FP values left in caller saved registers; this
1535 * must happen before any kind of tail chaining.
1536 */
1537 if ((env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_CLRONRET_MASK) &&
1538 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
1539 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1540 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1541 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1542 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1543 "stackframe: error during lazy state deactivation\n");
1544 v7m_exception_taken(cpu, excret, true, false);
1545 return;
1546 } else {
1547 if (arm_feature(env, ARM_FEATURE_V8_1M)) {
1548 /* v8.1M adds this NOCP check */
1549 bool nsacr_pass = exc_secure ||
1550 extract32(env->v7m.nsacr, 10, 1);
1551 bool cpacr_pass = v7m_cpacr_pass(env, exc_secure, true);
1552 if (!nsacr_pass) {
1553 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
1554 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
1555 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1556 "stackframe: NSACR prevents clearing FPU registers\n");
1557 v7m_exception_taken(cpu, excret, true, false);
1558 return;
1559 } else if (!cpacr_pass) {
1560 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1561 exc_secure);
1562 env->v7m.cfsr[exc_secure] |= R_V7M_CFSR_NOCP_MASK;
1563 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1564 "stackframe: CPACR prevents clearing FPU registers\n");
1565 v7m_exception_taken(cpu, excret, true, false);
1566 return;
1567 }
1568 }
1569 /* Clear s0..s15, FPSCR and VPR */
1570 int i;
1571
1572 for (i = 0; i < 16; i += 2) {
1573 *aa32_vfp_dreg(env, i / 2) = 0;
1574 }
1575 vfp_set_fpscr(env, 0);
1576 if (cpu_isar_feature(aa32_mve, cpu)) {
1577 env->v7m.vpr = 0;
1578 }
1579 }
1580 }
1581
1582 if (sfault) {
1583 env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
1584 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1585 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1586 "stackframe: failed EXC_RETURN.ES validity check\n");
1587 v7m_exception_taken(cpu, excret, true, false);
1588 return;
1589 }
1590
1591 if (ufault) {
1592 /*
1593 * Bad exception return: instead of popping the exception
1594 * stack, directly take a usage fault on the current stack.
1595 */
1596 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1597 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
1598 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1599 "stackframe: failed exception return integrity check\n");
1600 v7m_exception_taken(cpu, excret, true, false);
1601 return;
1602 }
1603
1604 /*
1605 * Tailchaining: if there is currently a pending exception that
1606 * is high enough priority to preempt execution at the level we're
1607 * about to return to, then just directly take that exception now,
1608 * avoiding an unstack-and-then-stack. Note that now we have
1609 * deactivated the previous exception by calling armv7m_nvic_complete_irq()
1610 * our current execution priority is already the execution priority we are
1611 * returning to -- none of the state we would unstack or set based on
1612 * the EXCRET value affects it.
1613 */
1614 if (armv7m_nvic_can_take_pending_exception(env->nvic)) {
1615 qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n");
1616 v7m_exception_taken(cpu, excret, true, false);
1617 return;
1618 }
1619
1620 switch_v7m_security_state(env, return_to_secure);
1621
1622 {
1623 /*
1624 * The stack pointer we should be reading the exception frame from
1625 * depends on bits in the magic exception return type value (and
1626 * for v8M isn't necessarily the stack pointer we will eventually
1627 * end up resuming execution with). Get a pointer to the location
1628 * in the CPU state struct where the SP we need is currently being
1629 * stored; we will use and modify it in place.
1630 * We use this limited C variable scope so we don't accidentally
1631 * use 'frame_sp_p' after we do something that makes it invalid.
1632 */
1633 bool spsel = env->v7m.control[return_to_secure] & R_V7M_CONTROL_SPSEL_MASK;
1634 uint32_t *frame_sp_p = arm_v7m_get_sp_ptr(env, return_to_secure,
1635 !return_to_handler, spsel);
1636 uint32_t frameptr = *frame_sp_p;
1637 bool pop_ok = true;
1638 ARMMMUIdx mmu_idx;
1639 bool return_to_priv = return_to_handler ||
1640 !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK);
1641
1642 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure,
1643 return_to_priv);
1644
1645 if (!QEMU_IS_ALIGNED(frameptr, 8) &&
1646 arm_feature(env, ARM_FEATURE_V8)) {
1647 qemu_log_mask(LOG_GUEST_ERROR,
1648 "M profile exception return with non-8-aligned SP "
1649 "for destination state is UNPREDICTABLE\n");
1650 }
1651
1652 /* Do we need to pop callee-saved registers? */
1653 if (return_to_secure &&
1654 ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
1655 (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
1656 uint32_t actual_sig;
1657
1658 pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx);
1659
1660 if (pop_ok && v7m_integrity_sig(env, excret) != actual_sig) {
1661 /* Take a SecureFault on the current stack */
1662 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
1663 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1664 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1665 "stackframe: failed exception return integrity "
1666 "signature check\n");
1667 v7m_exception_taken(cpu, excret, true, false);
1668 return;
1669 }
1670
1671 pop_ok = pop_ok &&
1672 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
1673 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) &&
1674 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) &&
1675 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) &&
1676 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) &&
1677 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) &&
1678 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) &&
1679 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx);
1680
1681 frameptr += 0x28;
1682 }
1683
1684 /* Pop registers */
1685 pop_ok = pop_ok &&
1686 v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) &&
1687 v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) &&
1688 v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) &&
1689 v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) &&
1690 v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) &&
1691 v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) &&
1692 v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) &&
1693 v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx);
1694
1695 if (!pop_ok) {
1696 /*
1697 * v7m_stack_read() pended a fault, so take it (as a tail
1698 * chained exception on the same stack frame)
1699 */
1700 qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n");
1701 v7m_exception_taken(cpu, excret, true, false);
1702 return;
1703 }
1704
1705 /*
1706 * Returning from an exception with a PC with bit 0 set is defined
1707 * behaviour on v8M (bit 0 is ignored), but for v7M it was specified
1708 * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore
1709 * the lsbit, and there are several RTOSes out there which incorrectly
1710 * assume the r15 in the stack frame should be a Thumb-style "lsbit
1711 * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but
1712 * complain about the badly behaved guest.
1713 */
1714 if (env->regs[15] & 1) {
1715 env->regs[15] &= ~1U;
1716 if (!arm_feature(env, ARM_FEATURE_V8)) {
1717 qemu_log_mask(LOG_GUEST_ERROR,
1718 "M profile return from interrupt with misaligned "
1719 "PC is UNPREDICTABLE on v7M\n");
1720 }
1721 }
1722
1723 if (arm_feature(env, ARM_FEATURE_V8)) {
1724 /*
1725 * For v8M we have to check whether the xPSR exception field
1726 * matches the EXCRET value for return to handler/thread
1727 * before we commit to changing the SP and xPSR.
1728 */
1729 bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
1730 if (return_to_handler != will_be_handler) {
1731 /*
1732 * Take an INVPC UsageFault on the current stack.
1733 * By this point we will have switched to the security state
1734 * for the background state, so this UsageFault will target
1735 * that state.
1736 */
1737 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1738 env->v7m.secure);
1739 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1740 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1741 "stackframe: failed exception return integrity "
1742 "check\n");
1743 v7m_exception_taken(cpu, excret, true, false);
1744 return;
1745 }
1746 }
1747
1748 if (!ftype) {
1749 /* FP present and we need to handle it */
1750 if (!return_to_secure &&
1751 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK)) {
1752 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1753 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1754 qemu_log_mask(CPU_LOG_INT,
1755 "...taking SecureFault on existing stackframe: "
1756 "Secure LSPACT set but exception return is "
1757 "not to secure state\n");
1758 v7m_exception_taken(cpu, excret, true, false);
1759 return;
1760 }
1761
1762 restore_s16_s31 = return_to_secure &&
1763 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
1764
1765 if (env->v7m.fpccr[return_to_secure] & R_V7M_FPCCR_LSPACT_MASK) {
1766 /* State in FPU is still valid, just clear LSPACT */
1767 env->v7m.fpccr[return_to_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
1768 } else {
1769 int i;
1770 uint32_t fpscr;
1771 bool cpacr_pass, nsacr_pass;
1772
1773 cpacr_pass = v7m_cpacr_pass(env, return_to_secure,
1774 return_to_priv);
1775 nsacr_pass = return_to_secure ||
1776 extract32(env->v7m.nsacr, 10, 1);
1777
1778 if (!cpacr_pass) {
1779 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1780 return_to_secure);
1781 env->v7m.cfsr[return_to_secure] |= R_V7M_CFSR_NOCP_MASK;
1782 qemu_log_mask(CPU_LOG_INT,
1783 "...taking UsageFault on existing "
1784 "stackframe: CPACR.CP10 prevents unstacking "
1785 "FP regs\n");
1786 v7m_exception_taken(cpu, excret, true, false);
1787 return;
1788 } else if (!nsacr_pass) {
1789 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
1790 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_INVPC_MASK;
1791 qemu_log_mask(CPU_LOG_INT,
1792 "...taking Secure UsageFault on existing "
1793 "stackframe: NSACR.CP10 prevents unstacking "
1794 "FP regs\n");
1795 v7m_exception_taken(cpu, excret, true, false);
1796 return;
1797 }
1798
1799 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1800 uint32_t slo, shi;
1801 uint64_t dn;
1802 uint32_t faddr = frameptr + 0x20 + 4 * i;
1803
1804 if (i >= 16) {
1805 faddr += 8; /* Skip the slot for the FPSCR and VPR */
1806 }
1807
1808 pop_ok = pop_ok &&
1809 v7m_stack_read(cpu, &slo, faddr, mmu_idx) &&
1810 v7m_stack_read(cpu, &shi, faddr + 4, mmu_idx);
1811
1812 if (!pop_ok) {
1813 break;
1814 }
1815
1816 dn = (uint64_t)shi << 32 | slo;
1817 *aa32_vfp_dreg(env, i / 2) = dn;
1818 }
1819 pop_ok = pop_ok &&
1820 v7m_stack_read(cpu, &fpscr, frameptr + 0x60, mmu_idx);
1821 if (pop_ok) {
1822 vfp_set_fpscr(env, fpscr);
1823 }
1824 if (cpu_isar_feature(aa32_mve, cpu)) {
1825 pop_ok = pop_ok &&
1826 v7m_stack_read(cpu, &env->v7m.vpr,
1827 frameptr + 0x64, mmu_idx);
1828 }
1829 if (!pop_ok) {
1830 /*
1831 * These regs are 0 if security extension present;
1832 * otherwise merely UNKNOWN. We zero always.
1833 */
1834 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1835 *aa32_vfp_dreg(env, i / 2) = 0;
1836 }
1837 vfp_set_fpscr(env, 0);
1838 if (cpu_isar_feature(aa32_mve, cpu)) {
1839 env->v7m.vpr = 0;
1840 }
1841 }
1842 }
1843 }
1844 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1845 V7M_CONTROL, FPCA, !ftype);
1846
1847 /* Commit to consuming the stack frame */
1848 frameptr += 0x20;
1849 if (!ftype) {
1850 frameptr += 0x48;
1851 if (restore_s16_s31) {
1852 frameptr += 0x40;
1853 }
1854 }
1855 /*
1856 * Undo stack alignment (the SPREALIGN bit indicates that the original
1857 * pre-exception SP was not 8-aligned and we added a padding word to
1858 * align it, so we undo this by ORing in the bit that increases it
1859 * from the current 8-aligned value to the 8-unaligned value. (Adding 4
1860 * would work too but a logical OR is how the pseudocode specifies it.)
1861 */
1862 if (xpsr & XPSR_SPREALIGN) {
1863 frameptr |= 4;
1864 }
1865 *frame_sp_p = frameptr;
1866 }
1867
1868 xpsr_mask = ~(XPSR_SPREALIGN | XPSR_SFPA);
1869 if (!arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
1870 xpsr_mask &= ~XPSR_GE;
1871 }
1872 /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
1873 xpsr_write(env, xpsr, xpsr_mask);
1874
1875 if (env->v7m.secure) {
1876 bool sfpa = xpsr & XPSR_SFPA;
1877
1878 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1879 V7M_CONTROL, SFPA, sfpa);
1880 }
1881
1882 /*
1883 * The restored xPSR exception field will be zero if we're
1884 * resuming in Thread mode. If that doesn't match what the
1885 * exception return excret specified then this is a UsageFault.
1886 * v7M requires we make this check here; v8M did it earlier.
1887 */
1888 if (return_to_handler != arm_v7m_is_handler_mode(env)) {
1889 /*
1890 * Take an INVPC UsageFault by pushing the stack again;
1891 * we know we're v7M so this is never a Secure UsageFault.
1892 */
1893 bool ignore_stackfaults;
1894
1895 assert(!arm_feature(env, ARM_FEATURE_V8));
1896 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
1897 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1898 ignore_stackfaults = v7m_push_stack(cpu);
1899 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
1900 "failed exception return integrity check\n");
1901 v7m_exception_taken(cpu, excret, false, ignore_stackfaults);
1902 return;
1903 }
1904
1905 /* Otherwise, we have a successful exception exit. */
1906 arm_clear_exclusive(env);
1907 arm_rebuild_hflags(env);
1908 qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
1909 }
1910
do_v7m_function_return(ARMCPU * cpu)1911 static bool do_v7m_function_return(ARMCPU *cpu)
1912 {
1913 /*
1914 * v8M security extensions magic function return.
1915 * We may either:
1916 * (1) throw an exception (longjump)
1917 * (2) return true if we successfully handled the function return
1918 * (3) return false if we failed a consistency check and have
1919 * pended a UsageFault that needs to be taken now
1920 *
1921 * At this point the magic return value is split between env->regs[15]
1922 * and env->thumb. We don't bother to reconstitute it because we don't
1923 * need it (all values are handled the same way).
1924 */
1925 CPUARMState *env = &cpu->env;
1926 uint32_t newpc, newpsr, newpsr_exc;
1927
1928 qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n");
1929
1930 {
1931 bool threadmode, spsel;
1932 MemOpIdx oi;
1933 ARMMMUIdx mmu_idx;
1934 uint32_t *frame_sp_p;
1935 uint32_t frameptr;
1936
1937 /* Pull the return address and IPSR from the Secure stack */
1938 threadmode = !arm_v7m_is_handler_mode(env);
1939 spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
1940
1941 frame_sp_p = arm_v7m_get_sp_ptr(env, true, threadmode, spsel);
1942 frameptr = *frame_sp_p;
1943
1944 /*
1945 * These loads may throw an exception (for MPU faults). We want to
1946 * do them as secure, so work out what MMU index that is.
1947 */
1948 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
1949 oi = make_memop_idx(MO_LEUL | MO_ALIGN, arm_to_core_mmu_idx(mmu_idx));
1950 newpc = cpu_ldl_mmu(env, frameptr, oi, 0);
1951 newpsr = cpu_ldl_mmu(env, frameptr + 4, oi, 0);
1952
1953 /* Consistency checks on new IPSR */
1954 newpsr_exc = newpsr & XPSR_EXCP;
1955 if (!((env->v7m.exception == 0 && newpsr_exc == 0) ||
1956 (env->v7m.exception == 1 && newpsr_exc != 0))) {
1957 /* Pend the fault and tell our caller to take it */
1958 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1959 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1960 env->v7m.secure);
1961 qemu_log_mask(CPU_LOG_INT,
1962 "...taking INVPC UsageFault: "
1963 "IPSR consistency check failed\n");
1964 return false;
1965 }
1966
1967 *frame_sp_p = frameptr + 8;
1968 }
1969
1970 /* This invalidates frame_sp_p */
1971 switch_v7m_security_state(env, true);
1972 env->v7m.exception = newpsr_exc;
1973 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
1974 if (newpsr & XPSR_SFPA) {
1975 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK;
1976 }
1977 xpsr_write(env, 0, XPSR_IT);
1978 env->thumb = newpc & 1;
1979 env->regs[15] = newpc & ~1;
1980 arm_rebuild_hflags(env);
1981
1982 qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
1983 return true;
1984 }
1985
v7m_read_half_insn(ARMCPU * cpu,ARMMMUIdx mmu_idx,bool secure,uint32_t addr,uint16_t * insn)1986 static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx, bool secure,
1987 uint32_t addr, uint16_t *insn)
1988 {
1989 /*
1990 * Load a 16-bit portion of a v7M instruction, returning true on success,
1991 * or false on failure (in which case we will have pended the appropriate
1992 * exception).
1993 * We need to do the instruction fetch's MPU and SAU checks
1994 * like this because there is no MMU index that would allow
1995 * doing the load with a single function call. Instead we must
1996 * first check that the security attributes permit the load
1997 * and that they don't mismatch on the two halves of the instruction,
1998 * and then we do the load as a secure load (ie using the security
1999 * attributes of the address, not the CPU, as architecturally required).
2000 */
2001 CPUState *cs = CPU(cpu);
2002 CPUARMState *env = &cpu->env;
2003 V8M_SAttributes sattrs = {};
2004 GetPhysAddrResult res = {};
2005 ARMMMUFaultInfo fi = {};
2006 MemTxResult txres;
2007
2008 v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, secure, &sattrs);
2009 if (!sattrs.nsc || sattrs.ns) {
2010 /*
2011 * This must be the second half of the insn, and it straddles a
2012 * region boundary with the second half not being S&NSC.
2013 */
2014 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2015 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2016 qemu_log_mask(CPU_LOG_INT,
2017 "...really SecureFault with SFSR.INVEP\n");
2018 return false;
2019 }
2020 if (get_phys_addr(env, addr, MMU_INST_FETCH, 0, mmu_idx, &res, &fi)) {
2021 /* the MPU lookup failed */
2022 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
2023 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
2024 qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
2025 return false;
2026 }
2027 *insn = address_space_lduw_le(arm_addressspace(cs, res.f.attrs),
2028 res.f.phys_addr, res.f.attrs, &txres);
2029 if (txres != MEMTX_OK) {
2030 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
2031 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2032 qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");
2033 return false;
2034 }
2035 return true;
2036 }
2037
v7m_read_sg_stack_word(ARMCPU * cpu,ARMMMUIdx mmu_idx,uint32_t addr,uint32_t * spdata)2038 static bool v7m_read_sg_stack_word(ARMCPU *cpu, ARMMMUIdx mmu_idx,
2039 uint32_t addr, uint32_t *spdata)
2040 {
2041 /*
2042 * Read a word of data from the stack for the SG instruction,
2043 * writing the value into *spdata. If the load succeeds, return
2044 * true; otherwise pend an appropriate exception and return false.
2045 * (We can't use data load helpers here that throw an exception
2046 * because of the context we're called in, which is halfway through
2047 * arm_v7m_cpu_do_interrupt().)
2048 */
2049 CPUState *cs = CPU(cpu);
2050 CPUARMState *env = &cpu->env;
2051 MemTxResult txres;
2052 GetPhysAddrResult res = {};
2053 ARMMMUFaultInfo fi = {};
2054 uint32_t value;
2055
2056 if (get_phys_addr(env, addr, MMU_DATA_LOAD, 0, mmu_idx, &res, &fi)) {
2057 /* MPU/SAU lookup failed */
2058 if (fi.type == ARMFault_QEMU_SFault) {
2059 qemu_log_mask(CPU_LOG_INT,
2060 "...SecureFault during stack word read\n");
2061 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
2062 env->v7m.sfar = addr;
2063 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2064 } else {
2065 qemu_log_mask(CPU_LOG_INT,
2066 "...MemManageFault during stack word read\n");
2067 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_DACCVIOL_MASK |
2068 R_V7M_CFSR_MMARVALID_MASK;
2069 env->v7m.mmfar[M_REG_S] = addr;
2070 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, false);
2071 }
2072 return false;
2073 }
2074 value = address_space_ldl(arm_addressspace(cs, res.f.attrs),
2075 res.f.phys_addr, res.f.attrs, &txres);
2076 if (txres != MEMTX_OK) {
2077 /* BusFault trying to read the data */
2078 qemu_log_mask(CPU_LOG_INT,
2079 "...BusFault during stack word read\n");
2080 env->v7m.cfsr[M_REG_NS] |=
2081 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
2082 env->v7m.bfar = addr;
2083 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2084 return false;
2085 }
2086
2087 *spdata = value;
2088 return true;
2089 }
2090
v7m_handle_execute_nsc(ARMCPU * cpu)2091 static bool v7m_handle_execute_nsc(ARMCPU *cpu)
2092 {
2093 /*
2094 * Check whether this attempt to execute code in a Secure & NS-Callable
2095 * memory region is for an SG instruction; if so, then emulate the
2096 * effect of the SG instruction and return true. Otherwise pend
2097 * the correct kind of exception and return false.
2098 */
2099 CPUARMState *env = &cpu->env;
2100 ARMMMUIdx mmu_idx;
2101 uint16_t insn;
2102
2103 /*
2104 * We should never get here unless get_phys_addr_pmsav8() caused
2105 * an exception for NS executing in S&NSC memory.
2106 */
2107 assert(!env->v7m.secure);
2108 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
2109
2110 /* We want to do the MPU lookup as secure; work out what mmu_idx that is */
2111 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
2112
2113 if (!v7m_read_half_insn(cpu, mmu_idx, true, env->regs[15], &insn)) {
2114 return false;
2115 }
2116
2117 if (!env->thumb) {
2118 goto gen_invep;
2119 }
2120
2121 if (insn != 0xe97f) {
2122 /*
2123 * Not an SG instruction first half (we choose the IMPDEF
2124 * early-SG-check option).
2125 */
2126 goto gen_invep;
2127 }
2128
2129 if (!v7m_read_half_insn(cpu, mmu_idx, true, env->regs[15] + 2, &insn)) {
2130 return false;
2131 }
2132
2133 if (insn != 0xe97f) {
2134 /*
2135 * Not an SG instruction second half (yes, both halves of the SG
2136 * insn have the same hex value)
2137 */
2138 goto gen_invep;
2139 }
2140
2141 /*
2142 * OK, we have confirmed that we really have an SG instruction.
2143 * We know we're NS in S memory so don't need to repeat those checks.
2144 */
2145 qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
2146 ", executing it\n", env->regs[15]);
2147
2148 if (cpu_isar_feature(aa32_m_sec_state, cpu) &&
2149 !arm_v7m_is_handler_mode(env)) {
2150 /*
2151 * v8.1M exception stack frame integrity check. Note that we
2152 * must perform the memory access even if CCR_S.TRD is zero
2153 * and we aren't going to check what the data loaded is.
2154 */
2155 uint32_t spdata, sp;
2156
2157 /*
2158 * We know we are currently NS, so the S stack pointers must be
2159 * in other_ss_{psp,msp}, not in regs[13]/other_sp.
2160 */
2161 sp = v7m_using_psp(env) ? env->v7m.other_ss_psp : env->v7m.other_ss_msp;
2162 if (!v7m_read_sg_stack_word(cpu, mmu_idx, sp, &spdata)) {
2163 /* Stack access failed and an exception has been pended */
2164 return false;
2165 }
2166
2167 if (env->v7m.ccr[M_REG_S] & R_V7M_CCR_TRD_MASK) {
2168 if (((spdata & ~1) == 0xfefa125a) ||
2169 !(env->v7m.control[M_REG_S] & 1)) {
2170 goto gen_invep;
2171 }
2172 }
2173 }
2174
2175 env->regs[14] &= ~1;
2176 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
2177 switch_v7m_security_state(env, true);
2178 xpsr_write(env, 0, XPSR_IT);
2179 env->regs[15] += 4;
2180 arm_rebuild_hflags(env);
2181 return true;
2182
2183 gen_invep:
2184 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2185 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2186 qemu_log_mask(CPU_LOG_INT,
2187 "...really SecureFault with SFSR.INVEP\n");
2188 return false;
2189 }
2190
arm_v7m_cpu_do_interrupt(CPUState * cs)2191 void arm_v7m_cpu_do_interrupt(CPUState *cs)
2192 {
2193 ARMCPU *cpu = ARM_CPU(cs);
2194 CPUARMState *env = &cpu->env;
2195 uint32_t lr;
2196 bool ignore_stackfaults;
2197
2198 arm_log_exception(cs);
2199
2200 /*
2201 * For exceptions we just mark as pending on the NVIC, and let that
2202 * handle it.
2203 */
2204 switch (cs->exception_index) {
2205 case EXCP_UDEF:
2206 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2207 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK;
2208 break;
2209 case EXCP_NOCP:
2210 {
2211 /*
2212 * NOCP might be directed to something other than the current
2213 * security state if this fault is because of NSACR; we indicate
2214 * the target security state using exception.target_el.
2215 */
2216 int target_secstate;
2217
2218 if (env->exception.target_el == 3) {
2219 target_secstate = M_REG_S;
2220 } else {
2221 target_secstate = env->v7m.secure;
2222 }
2223 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, target_secstate);
2224 env->v7m.cfsr[target_secstate] |= R_V7M_CFSR_NOCP_MASK;
2225 break;
2226 }
2227 case EXCP_INVSTATE:
2228 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2229 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK;
2230 break;
2231 case EXCP_STKOF:
2232 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2233 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
2234 break;
2235 case EXCP_LSERR:
2236 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2237 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
2238 break;
2239 case EXCP_UNALIGNED:
2240 /* Unaligned faults reported by M-profile aware code */
2241 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2242 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
2243 break;
2244 case EXCP_DIVBYZERO:
2245 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2246 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_DIVBYZERO_MASK;
2247 break;
2248 case EXCP_SWI:
2249 /* The PC already points to the next instruction. */
2250 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure);
2251 break;
2252 case EXCP_PREFETCH_ABORT:
2253 case EXCP_DATA_ABORT:
2254 /*
2255 * Note that for M profile we don't have a guest facing FSR, but
2256 * the env->exception.fsr will be populated by the code that
2257 * raises the fault, in the A profile short-descriptor format.
2258 *
2259 * Log the exception.vaddress now regardless of subtype, because
2260 * logging below only logs it when it goes into a guest visible
2261 * register.
2262 */
2263 qemu_log_mask(CPU_LOG_INT, "...at fault address 0x%x\n",
2264 (uint32_t)env->exception.vaddress);
2265 switch (env->exception.fsr & 0xf) {
2266 case M_FAKE_FSR_NSC_EXEC:
2267 /*
2268 * Exception generated when we try to execute code at an address
2269 * which is marked as Secure & Non-Secure Callable and the CPU
2270 * is in the Non-Secure state. The only instruction which can
2271 * be executed like this is SG (and that only if both halves of
2272 * the SG instruction have the same security attributes.)
2273 * Everything else must generate an INVEP SecureFault, so we
2274 * emulate the SG instruction here.
2275 */
2276 if (v7m_handle_execute_nsc(cpu)) {
2277 return;
2278 }
2279 break;
2280 case M_FAKE_FSR_SFAULT:
2281 /*
2282 * Various flavours of SecureFault for attempts to execute or
2283 * access data in the wrong security state.
2284 */
2285 switch (cs->exception_index) {
2286 case EXCP_PREFETCH_ABORT:
2287 if (env->v7m.secure) {
2288 env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
2289 qemu_log_mask(CPU_LOG_INT,
2290 "...really SecureFault with SFSR.INVTRAN\n");
2291 } else {
2292 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2293 qemu_log_mask(CPU_LOG_INT,
2294 "...really SecureFault with SFSR.INVEP\n");
2295 }
2296 break;
2297 case EXCP_DATA_ABORT:
2298 /* This must be an NS access to S memory */
2299 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
2300 qemu_log_mask(CPU_LOG_INT,
2301 "...really SecureFault with SFSR.AUVIOL\n");
2302 break;
2303 }
2304 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2305 break;
2306 case 0x8: /* External Abort */
2307 switch (cs->exception_index) {
2308 case EXCP_PREFETCH_ABORT:
2309 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
2310 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
2311 break;
2312 case EXCP_DATA_ABORT:
2313 env->v7m.cfsr[M_REG_NS] |=
2314 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
2315 env->v7m.bfar = env->exception.vaddress;
2316 qemu_log_mask(CPU_LOG_INT,
2317 "...with CFSR.PRECISERR and BFAR 0x%x\n",
2318 env->v7m.bfar);
2319 break;
2320 }
2321 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2322 break;
2323 case 0x1: /* Alignment fault reported by generic code */
2324 qemu_log_mask(CPU_LOG_INT,
2325 "...really UsageFault with UFSR.UNALIGNED\n");
2326 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
2327 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
2328 env->v7m.secure);
2329 break;
2330 default:
2331 /*
2332 * All other FSR values are either MPU faults or "can't happen
2333 * for M profile" cases.
2334 */
2335 switch (cs->exception_index) {
2336 case EXCP_PREFETCH_ABORT:
2337 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
2338 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
2339 break;
2340 case EXCP_DATA_ABORT:
2341 env->v7m.cfsr[env->v7m.secure] |=
2342 (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
2343 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress;
2344 qemu_log_mask(CPU_LOG_INT,
2345 "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
2346 env->v7m.mmfar[env->v7m.secure]);
2347 break;
2348 }
2349 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM,
2350 env->v7m.secure);
2351 break;
2352 }
2353 break;
2354 case EXCP_SEMIHOST:
2355 qemu_log_mask(CPU_LOG_INT,
2356 "...handling as semihosting call 0x%x\n",
2357 env->regs[0]);
2358 #ifdef CONFIG_TCG
2359 do_common_semihosting(cs);
2360 #else
2361 g_assert_not_reached();
2362 #endif
2363 env->regs[15] += env->thumb ? 2 : 4;
2364 return;
2365 case EXCP_BKPT:
2366 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false);
2367 break;
2368 case EXCP_IRQ:
2369 break;
2370 case EXCP_EXCEPTION_EXIT:
2371 if (env->regs[15] < EXC_RETURN_MIN_MAGIC) {
2372 /* Must be v8M security extension function return */
2373 assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC);
2374 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
2375 if (do_v7m_function_return(cpu)) {
2376 return;
2377 }
2378 } else {
2379 do_v7m_exception_exit(cpu);
2380 return;
2381 }
2382 break;
2383 case EXCP_LAZYFP:
2384 /*
2385 * We already pended the specific exception in the NVIC in the
2386 * v7m_preserve_fp_state() helper function.
2387 */
2388 break;
2389 default:
2390 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
2391 return; /* Never happens. Keep compiler happy. */
2392 }
2393
2394 if (arm_feature(env, ARM_FEATURE_V8)) {
2395 lr = R_V7M_EXCRET_RES1_MASK |
2396 R_V7M_EXCRET_DCRS_MASK;
2397 /*
2398 * The S bit indicates whether we should return to Secure
2399 * or NonSecure (ie our current state).
2400 * The ES bit indicates whether we're taking this exception
2401 * to Secure or NonSecure (ie our target state). We set it
2402 * later, in v7m_exception_taken().
2403 * The SPSEL bit is also set in v7m_exception_taken() for v8M.
2404 * This corresponds to the ARM ARM pseudocode for v8M setting
2405 * some LR bits in PushStack() and some in ExceptionTaken();
2406 * the distinction matters for the tailchain cases where we
2407 * can take an exception without pushing the stack.
2408 */
2409 if (env->v7m.secure) {
2410 lr |= R_V7M_EXCRET_S_MASK;
2411 }
2412 } else {
2413 lr = R_V7M_EXCRET_RES1_MASK |
2414 R_V7M_EXCRET_S_MASK |
2415 R_V7M_EXCRET_DCRS_MASK |
2416 R_V7M_EXCRET_ES_MASK;
2417 if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
2418 lr |= R_V7M_EXCRET_SPSEL_MASK;
2419 }
2420 }
2421 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
2422 lr |= R_V7M_EXCRET_FTYPE_MASK;
2423 }
2424 if (!arm_v7m_is_handler_mode(env)) {
2425 lr |= R_V7M_EXCRET_MODE_MASK;
2426 }
2427
2428 ignore_stackfaults = v7m_push_stack(cpu);
2429 v7m_exception_taken(cpu, lr, false, ignore_stackfaults);
2430 }
2431
HELPER(v7m_mrs)2432 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
2433 {
2434 unsigned el = arm_current_el(env);
2435
2436 /* First handle registers which unprivileged can read */
2437 switch (reg) {
2438 case 0 ... 7: /* xPSR sub-fields */
2439 return v7m_mrs_xpsr(env, reg, el);
2440 case 20: /* CONTROL */
2441 return arm_v7m_mrs_control(env, env->v7m.secure);
2442 case 0x94: /* CONTROL_NS */
2443 /*
2444 * We have to handle this here because unprivileged Secure code
2445 * can read the NS CONTROL register.
2446 */
2447 if (!env->v7m.secure) {
2448 return 0;
2449 }
2450 return env->v7m.control[M_REG_NS] |
2451 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK);
2452 }
2453
2454 if (el == 0) {
2455 return 0; /* unprivileged reads others as zero */
2456 }
2457
2458 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2459 switch (reg) {
2460 case 0x88: /* MSP_NS */
2461 if (!env->v7m.secure) {
2462 return 0;
2463 }
2464 return env->v7m.other_ss_msp;
2465 case 0x89: /* PSP_NS */
2466 if (!env->v7m.secure) {
2467 return 0;
2468 }
2469 return env->v7m.other_ss_psp;
2470 case 0x8a: /* MSPLIM_NS */
2471 if (!env->v7m.secure) {
2472 return 0;
2473 }
2474 return env->v7m.msplim[M_REG_NS];
2475 case 0x8b: /* PSPLIM_NS */
2476 if (!env->v7m.secure) {
2477 return 0;
2478 }
2479 return env->v7m.psplim[M_REG_NS];
2480 case 0x90: /* PRIMASK_NS */
2481 if (!env->v7m.secure) {
2482 return 0;
2483 }
2484 return env->v7m.primask[M_REG_NS];
2485 case 0x91: /* BASEPRI_NS */
2486 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2487 goto bad_reg;
2488 }
2489 if (!env->v7m.secure) {
2490 return 0;
2491 }
2492 return env->v7m.basepri[M_REG_NS];
2493 case 0x93: /* FAULTMASK_NS */
2494 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2495 goto bad_reg;
2496 }
2497 if (!env->v7m.secure) {
2498 return 0;
2499 }
2500 return env->v7m.faultmask[M_REG_NS];
2501 case 0x98: /* SP_NS */
2502 {
2503 /*
2504 * This gives the non-secure SP selected based on whether we're
2505 * currently in handler mode or not, using the NS CONTROL.SPSEL.
2506 */
2507 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2508
2509 if (!env->v7m.secure) {
2510 return 0;
2511 }
2512 if (!arm_v7m_is_handler_mode(env) && spsel) {
2513 return env->v7m.other_ss_psp;
2514 } else {
2515 return env->v7m.other_ss_msp;
2516 }
2517 }
2518 default:
2519 break;
2520 }
2521 }
2522
2523 switch (reg) {
2524 case 8: /* MSP */
2525 return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];
2526 case 9: /* PSP */
2527 return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;
2528 case 10: /* MSPLIM */
2529 if (!arm_feature(env, ARM_FEATURE_V8)) {
2530 goto bad_reg;
2531 }
2532 return env->v7m.msplim[env->v7m.secure];
2533 case 11: /* PSPLIM */
2534 if (!arm_feature(env, ARM_FEATURE_V8)) {
2535 goto bad_reg;
2536 }
2537 return env->v7m.psplim[env->v7m.secure];
2538 case 16: /* PRIMASK */
2539 return env->v7m.primask[env->v7m.secure];
2540 case 17: /* BASEPRI */
2541 case 18: /* BASEPRI_MAX */
2542 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2543 goto bad_reg;
2544 }
2545 return env->v7m.basepri[env->v7m.secure];
2546 case 19: /* FAULTMASK */
2547 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2548 goto bad_reg;
2549 }
2550 return env->v7m.faultmask[env->v7m.secure];
2551 default:
2552 bad_reg:
2553 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"
2554 " register %d\n", reg);
2555 return 0;
2556 }
2557 }
2558
HELPER(v7m_msr)2559 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
2560 {
2561 /*
2562 * We're passed bits [11..0] of the instruction; extract
2563 * SYSm and the mask bits.
2564 * Invalid combinations of SYSm and mask are UNPREDICTABLE;
2565 * we choose to treat them as if the mask bits were valid.
2566 * NB that the pseudocode 'mask' variable is bits [11..10],
2567 * whereas ours is [11..8].
2568 */
2569 uint32_t mask = extract32(maskreg, 8, 4);
2570 uint32_t reg = extract32(maskreg, 0, 8);
2571 int cur_el = arm_current_el(env);
2572
2573 if (cur_el == 0 && reg > 7 && reg != 20) {
2574 /*
2575 * only xPSR sub-fields and CONTROL.SFPA may be written by
2576 * unprivileged code
2577 */
2578 return;
2579 }
2580
2581 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2582 switch (reg) {
2583 case 0x88: /* MSP_NS */
2584 if (!env->v7m.secure) {
2585 return;
2586 }
2587 env->v7m.other_ss_msp = val & ~3;
2588 return;
2589 case 0x89: /* PSP_NS */
2590 if (!env->v7m.secure) {
2591 return;
2592 }
2593 env->v7m.other_ss_psp = val & ~3;
2594 return;
2595 case 0x8a: /* MSPLIM_NS */
2596 if (!env->v7m.secure) {
2597 return;
2598 }
2599 env->v7m.msplim[M_REG_NS] = val & ~7;
2600 return;
2601 case 0x8b: /* PSPLIM_NS */
2602 if (!env->v7m.secure) {
2603 return;
2604 }
2605 env->v7m.psplim[M_REG_NS] = val & ~7;
2606 return;
2607 case 0x90: /* PRIMASK_NS */
2608 if (!env->v7m.secure) {
2609 return;
2610 }
2611 env->v7m.primask[M_REG_NS] = val & 1;
2612 return;
2613 case 0x91: /* BASEPRI_NS */
2614 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2615 goto bad_reg;
2616 }
2617 if (!env->v7m.secure) {
2618 return;
2619 }
2620 env->v7m.basepri[M_REG_NS] = val & 0xff;
2621 return;
2622 case 0x93: /* FAULTMASK_NS */
2623 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2624 goto bad_reg;
2625 }
2626 if (!env->v7m.secure) {
2627 return;
2628 }
2629 env->v7m.faultmask[M_REG_NS] = val & 1;
2630 return;
2631 case 0x94: /* CONTROL_NS */
2632 if (!env->v7m.secure) {
2633 return;
2634 }
2635 write_v7m_control_spsel_for_secstate(env,
2636 val & R_V7M_CONTROL_SPSEL_MASK,
2637 M_REG_NS);
2638 if (arm_feature(env, ARM_FEATURE_M_MAIN)) {
2639 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK;
2640 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK;
2641 }
2642 /*
2643 * SFPA is RAZ/WI from NS. FPCA is RO if NSACR.CP10 == 0,
2644 * RES0 if the FPU is not present, and is stored in the S bank
2645 */
2646 if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env)) &&
2647 extract32(env->v7m.nsacr, 10, 1)) {
2648 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2649 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2650 }
2651 return;
2652 case 0x98: /* SP_NS */
2653 {
2654 /*
2655 * This gives the non-secure SP selected based on whether we're
2656 * currently in handler mode or not, using the NS CONTROL.SPSEL.
2657 */
2658 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2659 bool is_psp = !arm_v7m_is_handler_mode(env) && spsel;
2660 uint32_t limit;
2661
2662 if (!env->v7m.secure) {
2663 return;
2664 }
2665
2666 limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
2667
2668 val &= ~0x3;
2669
2670 if (val < limit) {
2671 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
2672 }
2673
2674 if (is_psp) {
2675 env->v7m.other_ss_psp = val;
2676 } else {
2677 env->v7m.other_ss_msp = val;
2678 }
2679 return;
2680 }
2681 default:
2682 break;
2683 }
2684 }
2685
2686 switch (reg) {
2687 case 0 ... 7: /* xPSR sub-fields */
2688 v7m_msr_xpsr(env, mask, reg, val);
2689 break;
2690 case 8: /* MSP */
2691 if (v7m_using_psp(env)) {
2692 env->v7m.other_sp = val & ~3;
2693 } else {
2694 env->regs[13] = val & ~3;
2695 }
2696 break;
2697 case 9: /* PSP */
2698 if (v7m_using_psp(env)) {
2699 env->regs[13] = val & ~3;
2700 } else {
2701 env->v7m.other_sp = val & ~3;
2702 }
2703 break;
2704 case 10: /* MSPLIM */
2705 if (!arm_feature(env, ARM_FEATURE_V8)) {
2706 goto bad_reg;
2707 }
2708 env->v7m.msplim[env->v7m.secure] = val & ~7;
2709 break;
2710 case 11: /* PSPLIM */
2711 if (!arm_feature(env, ARM_FEATURE_V8)) {
2712 goto bad_reg;
2713 }
2714 env->v7m.psplim[env->v7m.secure] = val & ~7;
2715 break;
2716 case 16: /* PRIMASK */
2717 env->v7m.primask[env->v7m.secure] = val & 1;
2718 break;
2719 case 17: /* BASEPRI */
2720 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2721 goto bad_reg;
2722 }
2723 env->v7m.basepri[env->v7m.secure] = val & 0xff;
2724 break;
2725 case 18: /* BASEPRI_MAX */
2726 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2727 goto bad_reg;
2728 }
2729 val &= 0xff;
2730 if (val != 0 && (val < env->v7m.basepri[env->v7m.secure]
2731 || env->v7m.basepri[env->v7m.secure] == 0)) {
2732 env->v7m.basepri[env->v7m.secure] = val;
2733 }
2734 break;
2735 case 19: /* FAULTMASK */
2736 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2737 goto bad_reg;
2738 }
2739 env->v7m.faultmask[env->v7m.secure] = val & 1;
2740 break;
2741 case 20: /* CONTROL */
2742 /*
2743 * Writing to the SPSEL bit only has an effect if we are in
2744 * thread mode; other bits can be updated by any privileged code.
2745 * write_v7m_control_spsel() deals with updating the SPSEL bit in
2746 * env->v7m.control, so we only need update the others.
2747 * For v7M, we must just ignore explicit writes to SPSEL in handler
2748 * mode; for v8M the write is permitted but will have no effect.
2749 * All these bits are writes-ignored from non-privileged code,
2750 * except for SFPA.
2751 */
2752 if (cur_el > 0 && (arm_feature(env, ARM_FEATURE_V8) ||
2753 !arm_v7m_is_handler_mode(env))) {
2754 write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
2755 }
2756 if (cur_el > 0 && arm_feature(env, ARM_FEATURE_M_MAIN)) {
2757 env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
2758 env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
2759 }
2760 if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
2761 /*
2762 * SFPA is RAZ/WI from NS or if no FPU.
2763 * FPCA is RO if NSACR.CP10 == 0, RES0 if the FPU is not present.
2764 * Both are stored in the S bank.
2765 */
2766 if (env->v7m.secure) {
2767 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
2768 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_SFPA_MASK;
2769 }
2770 if (cur_el > 0 &&
2771 (env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_SECURITY) ||
2772 extract32(env->v7m.nsacr, 10, 1))) {
2773 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2774 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2775 }
2776 }
2777 break;
2778 default:
2779 bad_reg:
2780 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
2781 " register %d\n", reg);
2782 return;
2783 }
2784 }
2785
HELPER(v7m_tt)2786 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
2787 {
2788 /* Implement the TT instruction. op is bits [7:6] of the insn. */
2789 bool forceunpriv = op & 1;
2790 bool alt = op & 2;
2791 V8M_SAttributes sattrs = {};
2792 uint32_t tt_resp;
2793 bool r, rw, nsr, nsrw, mrvalid;
2794 ARMMMUIdx mmu_idx;
2795 uint32_t mregion;
2796 bool targetpriv;
2797 bool targetsec = env->v7m.secure;
2798
2799 /*
2800 * Work out what the security state and privilege level we're
2801 * interested in is...
2802 */
2803 if (alt) {
2804 targetsec = !targetsec;
2805 }
2806
2807 if (forceunpriv) {
2808 targetpriv = false;
2809 } else {
2810 targetpriv = arm_v7m_is_handler_mode(env) ||
2811 !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK);
2812 }
2813
2814 /* ...and then figure out which MMU index this is */
2815 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv);
2816
2817 /*
2818 * We know that the MPU and SAU don't care about the access type
2819 * for our purposes beyond that we don't want to claim to be
2820 * an insn fetch, so we arbitrarily call this a read.
2821 */
2822
2823 /*
2824 * MPU region info only available for privileged or if
2825 * inspecting the other MPU state.
2826 */
2827 if (arm_current_el(env) != 0 || alt) {
2828 GetPhysAddrResult res = {};
2829 ARMMMUFaultInfo fi = {};
2830
2831 /* We can ignore the return value as prot is always set */
2832 pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, targetsec,
2833 &res, &fi, &mregion);
2834 if (mregion == -1) {
2835 mrvalid = false;
2836 mregion = 0;
2837 } else {
2838 mrvalid = true;
2839 }
2840 r = res.f.prot & PAGE_READ;
2841 rw = res.f.prot & PAGE_WRITE;
2842 } else {
2843 r = false;
2844 rw = false;
2845 mrvalid = false;
2846 mregion = 0;
2847 }
2848
2849 if (env->v7m.secure) {
2850 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx,
2851 targetsec, &sattrs);
2852 nsr = sattrs.ns && r;
2853 nsrw = sattrs.ns && rw;
2854 } else {
2855 sattrs.ns = true;
2856 nsr = false;
2857 nsrw = false;
2858 }
2859
2860 tt_resp = (sattrs.iregion << 24) |
2861 (sattrs.irvalid << 23) |
2862 ((!sattrs.ns) << 22) |
2863 (nsrw << 21) |
2864 (nsr << 20) |
2865 (rw << 19) |
2866 (r << 18) |
2867 (sattrs.srvalid << 17) |
2868 (mrvalid << 16) |
2869 (sattrs.sregion << 8) |
2870 mregion;
2871
2872 return tt_resp;
2873 }
2874
2875 #endif /* !CONFIG_USER_ONLY */
2876
arm_v7m_get_sp_ptr(CPUARMState * env,bool secure,bool threadmode,bool spsel)2877 uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
2878 bool spsel)
2879 {
2880 /*
2881 * Return a pointer to the location where we currently store the
2882 * stack pointer for the requested security state and thread mode.
2883 * This pointer will become invalid if the CPU state is updated
2884 * such that the stack pointers are switched around (eg changing
2885 * the SPSEL control bit).
2886 * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
2887 * Unlike that pseudocode, we require the caller to pass us in the
2888 * SPSEL control bit value; this is because we also use this
2889 * function in handling of pushing of the callee-saves registers
2890 * part of the v8M stack frame (pseudocode PushCalleeStack()),
2891 * and in the tailchain codepath the SPSEL bit comes from the exception
2892 * return magic LR value from the previous exception. The pseudocode
2893 * opencodes the stack-selection in PushCalleeStack(), but we prefer
2894 * to make this utility function generic enough to do the job.
2895 */
2896 bool want_psp = threadmode && spsel;
2897
2898 if (secure == env->v7m.secure) {
2899 if (want_psp == v7m_using_psp(env)) {
2900 return &env->regs[13];
2901 } else {
2902 return &env->v7m.other_sp;
2903 }
2904 } else {
2905 if (want_psp) {
2906 return &env->v7m.other_ss_psp;
2907 } else {
2908 return &env->v7m.other_ss_msp;
2909 }
2910 }
2911 }
2912