@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
c 2,934 lines 106 KB
Raw
1 /*
2 * ARM generic helpers.
3 *
4 * This code is licensed under the GNU GPL v2 or later.
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9 #include "qemu/osdep.h"
10 #include "cpu.h"
11 #include "helper.h"
12 #include "internals.h"
13 #include "cpu-features.h"
14 #include "gdbstub/helpers.h"
15 #include "qemu/main-loop.h"
16 #include "qemu/bitops.h"
17 #include "qemu/log.h"
18 #include "exec/page-protection.h"
19 #ifdef CONFIG_TCG
20 #include "accel/tcg/cpu-ldst-common.h"
21 #include "semihosting/common-semi.h"
22 #endif
23 #if !defined(CONFIG_USER_ONLY)
24 #include "hw/intc/armv7m_nvic.h"
25 #endif
26 #include "qemu/plugin.h"
27
28 static void v7m_msr_xpsr(CPUARMState *env, uint32_t mask,
29 uint32_t reg, uint32_t val)
30 {
31 /* Only APSR is actually writable */
32 if (!(reg & 4)) {
33 uint32_t apsrmask = 0;
34
35 if (mask & 8) {
36 apsrmask |= XPSR_NZCV | XPSR_Q;
37 }
38 if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
39 apsrmask |= XPSR_GE;
40 }
41 xpsr_write(env, val, apsrmask);
42 }
43 }
44
45 static uint32_t v7m_mrs_xpsr(CPUARMState *env, uint32_t reg, unsigned el)
46 {
47 uint32_t mask = 0;
48
49 if ((reg & 1) && el) {
50 mask |= XPSR_EXCP; /* IPSR (unpriv. reads as zero) */
51 }
52 if (!(reg & 4)) {
53 mask |= XPSR_NZCV | XPSR_Q; /* APSR */
54 if (arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
55 mask |= XPSR_GE;
56 }
57 }
58 /* EPSR reads as zero */
59 return xpsr_read(env) & mask;
60 }
61
62 uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure)
63 {
64 uint32_t value = env->v7m.control[secure];
65
66 if (!secure) {
67 /* SFPA is RAZ/WI from NS; FPCA is stored in the M_REG_S bank */
68 value |= env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK;
69 }
70 return value;
71 }
72
73 #ifdef CONFIG_USER_ONLY
74
75 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
76 {
77 uint32_t mask = extract32(maskreg, 8, 4);
78 uint32_t reg = extract32(maskreg, 0, 8);
79
80 switch (reg) {
81 case 0 ... 7: /* xPSR sub-fields */
82 v7m_msr_xpsr(env, mask, reg, val);
83 break;
84 case 20: /* CONTROL */
85 /* There are no sub-fields that are actually writable from EL0. */
86 break;
87 default:
88 /* Unprivileged writes to other registers are ignored */
89 break;
90 }
91 }
92
93 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
94 {
95 switch (reg) {
96 case 0 ... 7: /* xPSR sub-fields */
97 return v7m_mrs_xpsr(env, reg, 0);
98 case 20: /* CONTROL */
99 return arm_v7m_mrs_control(env, 0);
100 default:
101 /* Unprivileged reads others as zero. */
102 return 0;
103 }
104 }
105
106 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
107 {
108 /* translate.c should never generate calls here in user-only mode */
109 g_assert_not_reached();
110 }
111
112 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
113 {
114 /* translate.c should never generate calls here in user-only mode */
115 g_assert_not_reached();
116 }
117
118 void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
119 {
120 /* translate.c should never generate calls here in user-only mode */
121 g_assert_not_reached();
122 }
123
124 void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
125 {
126 /* translate.c should never generate calls here in user-only mode */
127 g_assert_not_reached();
128 }
129
130 void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
131 {
132 /* translate.c should never generate calls here in user-only mode */
133 g_assert_not_reached();
134 }
135
136 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
137 {
138 /*
139 * The TT instructions can be used by unprivileged code, but in
140 * user-only emulation we don't have the MPU.
141 * Luckily since we know we are NonSecure unprivileged (and that in
142 * turn means that the A flag wasn't specified), all the bits in the
143 * register must be zero:
144 * IREGION: 0 because IRVALID is 0
145 * IRVALID: 0 because NS
146 * S: 0 because NS
147 * NSRW: 0 because NS
148 * NSR: 0 because NS
149 * RW: 0 because unpriv and A flag not set
150 * R: 0 because unpriv and A flag not set
151 * SRVALID: 0 because NS
152 * MRVALID: 0 because unpriv and A flag not set
153 * SREGION: 0 because SRVALID is 0
154 * MREGION: 0 because MRVALID is 0
155 */
156 return 0;
157 }
158
159 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
160 {
161 return ARMMMUIdx_MUser;
162 }
163
164 #else /* !CONFIG_USER_ONLY */
165
166 static ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
167 bool secstate, bool priv, bool negpri)
168 {
169 ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
170
171 if (priv) {
172 mmu_idx |= ARM_MMU_IDX_M_PRIV;
173 }
174
175 if (negpri) {
176 mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
177 }
178
179 if (secstate) {
180 mmu_idx |= ARM_MMU_IDX_M_S;
181 }
182
183 return mmu_idx;
184 }
185
186 static ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
187 bool secstate, bool priv)
188 {
189 bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate);
190
191 return arm_v7m_mmu_idx_all(env, secstate, priv, negpri);
192 }
193
194 /* Return the MMU index for a v7M CPU in the specified security state */
195 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
196 {
197 bool priv = arm_v7m_is_handler_mode(env) ||
198 !(env->v7m.control[secstate] & 1);
199
200 return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
201 }
202
203 /*
204 * What kind of stack write are we doing? This affects how exceptions
205 * generated during the stacking are treated.
206 */
207 typedef enum StackingMode {
208 STACK_NORMAL,
209 STACK_IGNFAULTS,
210 STACK_LAZYFP,
211 } StackingMode;
212
213 static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
214 ARMMMUIdx mmu_idx, StackingMode mode)
215 {
216 CPUState *cs = CPU(cpu);
217 CPUARMState *env = &cpu->env;
218 MemTxResult txres;
219 GetPhysAddrResult res = {};
220 ARMMMUFaultInfo fi = {};
221 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
222 int exc;
223 bool exc_secure;
224
225 if (!get_phys_addr(env, addr, MMU_DATA_STORE, 0, mmu_idx, &res, &fi)) {
226 /* MPU/SAU lookup failed */
227 if (fi.type == ARMFault_QEMU_SFault) {
228 if (mode == STACK_LAZYFP) {
229 qemu_log_mask(CPU_LOG_INT,
230 "...SecureFault with SFSR.LSPERR "
231 "during lazy stacking\n");
232 env->v7m.sfsr |= R_V7M_SFSR_LSPERR_MASK;
233 } else {
234 qemu_log_mask(CPU_LOG_INT,
235 "...SecureFault with SFSR.AUVIOL "
236 "during stacking\n");
237 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
238 }
239 env->v7m.sfsr |= R_V7M_SFSR_SFARVALID_MASK;
240 env->v7m.sfar = addr;
241 exc = ARMV7M_EXCP_SECURE;
242 exc_secure = false;
243 } else {
244 if (mode == STACK_LAZYFP) {
245 qemu_log_mask(CPU_LOG_INT,
246 "...MemManageFault with CFSR.MLSPERR\n");
247 env->v7m.cfsr[secure] |= R_V7M_CFSR_MLSPERR_MASK;
248 } else {
249 qemu_log_mask(CPU_LOG_INT,
250 "...MemManageFault with CFSR.MSTKERR\n");
251 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK;
252 }
253 exc = ARMV7M_EXCP_MEM;
254 exc_secure = secure;
255 }
256 goto pend_fault;
257 }
258 address_space_stl_le(arm_addressspace(cs, res.f.attrs), res.f.phys_addr,
259 value, res.f.attrs, &txres);
260 if (txres != MEMTX_OK) {
261 /* BusFault trying to write the data */
262 if (mode == STACK_LAZYFP) {
263 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.LSPERR\n");
264 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_LSPERR_MASK;
265 } else {
266 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n");
267 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK;
268 }
269 exc = ARMV7M_EXCP_BUS;
270 exc_secure = false;
271 goto pend_fault;
272 }
273 return true;
274
275 pend_fault:
276 /*
277 * By pending the exception at this point we are making
278 * the IMPDEF choice "overridden exceptions pended" (see the
279 * MergeExcInfo() pseudocode). The other choice would be to not
280 * pend them now and then make a choice about which to throw away
281 * later if we have two derived exceptions.
282 * The only case when we must not pend the exception but instead
283 * throw it away is if we are doing the push of the callee registers
284 * and we've already generated a derived exception (this is indicated
285 * by the caller passing STACK_IGNFAULTS). Even in this case we will
286 * still update the fault status registers.
287 */
288 switch (mode) {
289 case STACK_NORMAL:
290 armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure);
291 break;
292 case STACK_LAZYFP:
293 armv7m_nvic_set_pending_lazyfp(env->nvic, exc, exc_secure);
294 break;
295 case STACK_IGNFAULTS:
296 break;
297 }
298 return false;
299 }
300
301 static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
302 ARMMMUIdx mmu_idx)
303 {
304 CPUState *cs = CPU(cpu);
305 CPUARMState *env = &cpu->env;
306 MemTxResult txres;
307 GetPhysAddrResult res = {};
308 ARMMMUFaultInfo fi = {};
309 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
310 int exc;
311 bool exc_secure;
312 uint32_t value;
313
314 if (!get_phys_addr(env, addr, MMU_DATA_LOAD, 0, mmu_idx, &res, &fi)) {
315 /* MPU/SAU lookup failed */
316 if (fi.type == ARMFault_QEMU_SFault) {
317 qemu_log_mask(CPU_LOG_INT,
318 "...SecureFault with SFSR.AUVIOL during unstack\n");
319 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
320 env->v7m.sfar = addr;
321 exc = ARMV7M_EXCP_SECURE;
322 exc_secure = false;
323 } else {
324 qemu_log_mask(CPU_LOG_INT,
325 "...MemManageFault with CFSR.MUNSTKERR\n");
326 env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK;
327 exc = ARMV7M_EXCP_MEM;
328 exc_secure = secure;
329 }
330 goto pend_fault;
331 }
332
333 value = address_space_ldl(arm_addressspace(cs, res.f.attrs),
334 res.f.phys_addr, res.f.attrs, &txres);
335 if (txres != MEMTX_OK) {
336 /* BusFault trying to read the data */
337 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n");
338 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK;
339 exc = ARMV7M_EXCP_BUS;
340 exc_secure = false;
341 goto pend_fault;
342 }
343
344 *dest = value;
345 return true;
346
347 pend_fault:
348 /*
349 * By pending the exception at this point we are making
350 * the IMPDEF choice "overridden exceptions pended" (see the
351 * MergeExcInfo() pseudocode). The other choice would be to not
352 * pend them now and then make a choice about which to throw away
353 * later if we have two derived exceptions.
354 */
355 armv7m_nvic_set_pending(env->nvic, exc, exc_secure);
356 return false;
357 }
358
359 void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
360 {
361 /*
362 * Preserve FP state (because LSPACT was set and we are about
363 * to execute an FP instruction). This corresponds to the
364 * PreserveFPState() pseudocode.
365 * We may throw an exception if the stacking fails.
366 */
367 ARMCPU *cpu = env_archcpu(env);
368 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
369 bool negpri = !(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_HFRDY_MASK);
370 bool is_priv = !(env->v7m.fpccr[is_secure] & R_V7M_FPCCR_USER_MASK);
371 bool splimviol = env->v7m.fpccr[is_secure] & R_V7M_FPCCR_SPLIMVIOL_MASK;
372 uint32_t fpcar = env->v7m.fpcar[is_secure];
373 bool stacked_ok = true;
374 bool ts = is_secure && (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
375 bool take_exception;
376
377 /* Take the BQL as we are going to touch the NVIC */
378 bql_lock();
379
380 /* Check the background context had access to the FPU */
381 if (!v7m_cpacr_pass(env, is_secure, is_priv)) {
382 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, is_secure);
383 env->v7m.cfsr[is_secure] |= R_V7M_CFSR_NOCP_MASK;
384 stacked_ok = false;
385 } else if (!is_secure && !extract32(env->v7m.nsacr, 10, 1)) {
386 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
387 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
388 stacked_ok = false;
389 }
390
391 if (!splimviol && stacked_ok) {
392 /* We only stack if the stack limit wasn't violated */
393 int i;
394 ARMMMUIdx mmu_idx;
395
396 mmu_idx = arm_v7m_mmu_idx_all(env, is_secure, is_priv, negpri);
397 for (i = 0; i < (ts ? 32 : 16); i += 2) {
398 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
399 uint32_t faddr = fpcar + 4 * i;
400 uint32_t slo = extract64(dn, 0, 32);
401 uint32_t shi = extract64(dn, 32, 32);
402
403 if (i >= 16) {
404 faddr += 8; /* skip the slot for the FPSCR/VPR */
405 }
406 stacked_ok = stacked_ok &&
407 v7m_stack_write(cpu, faddr, slo, mmu_idx, STACK_LAZYFP) &&
408 v7m_stack_write(cpu, faddr + 4, shi, mmu_idx, STACK_LAZYFP);
409 }
410
411 stacked_ok = stacked_ok &&
412 v7m_stack_write(cpu, fpcar + 0x40,
413 vfp_get_fpscr(env), mmu_idx, STACK_LAZYFP);
414 if (cpu_isar_feature(aa32_mve, cpu)) {
415 stacked_ok = stacked_ok &&
416 v7m_stack_write(cpu, fpcar + 0x44,
417 env->v7m.vpr, mmu_idx, STACK_LAZYFP);
418 }
419 }
420
421 /*
422 * We definitely pended an exception, but it's possible that it
423 * might not be able to be taken now. If its priority permits us
424 * to take it now, then we must not update the LSPACT or FP regs,
425 * but instead jump out to take the exception immediately.
426 * If it's just pending and won't be taken until the current
427 * handler exits, then we do update LSPACT and the FP regs.
428 */
429 take_exception = !stacked_ok &&
430 armv7m_nvic_can_take_pending_exception(env->nvic);
431
432 bql_unlock();
433
434 if (take_exception) {
435 raise_exception_ra(env, EXCP_LAZYFP, 0, 1, GETPC());
436 }
437
438 env->v7m.fpccr[is_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
439
440 if (ts) {
441 /* Clear s0 to s31 and the FPSCR and VPR */
442 int i;
443
444 for (i = 0; i < 32; i += 2) {
445 *aa32_vfp_dreg(env, i / 2) = 0;
446 }
447 vfp_set_fpscr(env, 0);
448 if (cpu_isar_feature(aa32_mve, cpu)) {
449 env->v7m.vpr = 0;
450 }
451 }
452 /*
453 * Otherwise s0 to s15, FPSCR and VPR are UNKNOWN; we choose to leave them
454 * unchanged.
455 */
456 }
457
458 /*
459 * Write to v7M CONTROL.SPSEL bit for the specified security bank.
460 * This may change the current stack pointer between Main and Process
461 * stack pointers if it is done for the CONTROL register for the current
462 * security state.
463 */
464 static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
465 bool new_spsel,
466 bool secstate)
467 {
468 bool old_is_psp = v7m_using_psp(env);
469
470 env->v7m.control[secstate] =
471 deposit32(env->v7m.control[secstate],
472 R_V7M_CONTROL_SPSEL_SHIFT,
473 R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
474
475 if (secstate == env->v7m.secure) {
476 bool new_is_psp = v7m_using_psp(env);
477 uint32_t tmp;
478
479 if (old_is_psp != new_is_psp) {
480 tmp = env->v7m.other_sp;
481 env->v7m.other_sp = env->regs[13];
482 env->regs[13] = tmp;
483 }
484 }
485 }
486
487 /*
488 * Write to v7M CONTROL.SPSEL bit. This may change the current
489 * stack pointer between Main and Process stack pointers.
490 */
491 static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
492 {
493 write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
494 }
495
496 void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
497 {
498 /*
499 * Write a new value to v7m.exception, thus transitioning into or out
500 * of Handler mode; this may result in a change of active stack pointer.
501 */
502 bool new_is_psp, old_is_psp = v7m_using_psp(env);
503 uint32_t tmp;
504
505 env->v7m.exception = new_exc;
506
507 new_is_psp = v7m_using_psp(env);
508
509 if (old_is_psp != new_is_psp) {
510 tmp = env->v7m.other_sp;
511 env->v7m.other_sp = env->regs[13];
512 env->regs[13] = tmp;
513 }
514 }
515
516 /* Switch M profile security state between NS and S */
517 static void switch_v7m_security_state(CPUARMState *env, bool new_secstate)
518 {
519 uint32_t new_ss_msp, new_ss_psp;
520
521 if (env->v7m.secure == new_secstate) {
522 return;
523 }
524
525 /*
526 * All the banked state is accessed by looking at env->v7m.secure
527 * except for the stack pointer; rearrange the SP appropriately.
528 */
529 new_ss_msp = env->v7m.other_ss_msp;
530 new_ss_psp = env->v7m.other_ss_psp;
531
532 if (v7m_using_psp(env)) {
533 env->v7m.other_ss_psp = env->regs[13];
534 env->v7m.other_ss_msp = env->v7m.other_sp;
535 } else {
536 env->v7m.other_ss_msp = env->regs[13];
537 env->v7m.other_ss_psp = env->v7m.other_sp;
538 }
539
540 env->v7m.secure = new_secstate;
541
542 if (v7m_using_psp(env)) {
543 env->regs[13] = new_ss_psp;
544 env->v7m.other_sp = new_ss_msp;
545 } else {
546 env->regs[13] = new_ss_msp;
547 env->v7m.other_sp = new_ss_psp;
548 }
549 }
550
551 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
552 {
553 /*
554 * Handle v7M BXNS:
555 * - if the return value is a magic value, do exception return (like BX)
556 * - otherwise bit 0 of the return value is the target security state
557 */
558 uint32_t min_magic;
559
560 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
561 /* Covers FNC_RETURN and EXC_RETURN magic */
562 min_magic = FNC_RETURN_MIN_MAGIC;
563 } else {
564 /* EXC_RETURN magic only */
565 min_magic = EXC_RETURN_MIN_MAGIC;
566 }
567
568 if (dest >= min_magic) {
569 /*
570 * This is an exception return magic value; put it where
571 * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT.
572 * Note that if we ever add gen_ss_advance() singlestep support to
573 * M profile this should count as an "instruction execution complete"
574 * event (compare gen_bx_excret_final_code()).
575 */
576 env->regs[15] = dest & ~1;
577 env->thumb = dest & 1;
578 HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT);
579 /* notreached */
580 }
581
582 /* translate.c should have made BXNS UNDEF unless we're secure */
583 assert(env->v7m.secure);
584
585 if (!(dest & 1)) {
586 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
587 }
588 switch_v7m_security_state(env, dest & 1);
589 env->thumb = true;
590 env->regs[15] = dest & ~1;
591 arm_rebuild_hflags(env);
592 }
593
594 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
595 {
596 /*
597 * Handle v7M BLXNS:
598 * - bit 0 of the destination address is the target security state
599 */
600
601 /* At this point regs[15] is the address just after the BLXNS */
602 uint32_t nextinst = env->regs[15] | 1;
603 uint32_t sp = env->regs[13] - 8;
604 uint32_t saved_psr;
605
606 /* translate.c will have made BLXNS UNDEF unless we're secure */
607 assert(env->v7m.secure);
608
609 if (dest & 1) {
610 /*
611 * Target is Secure, so this is just a normal BLX,
612 * except that the low bit doesn't indicate Thumb/not.
613 */
614 env->regs[14] = nextinst;
615 env->thumb = true;
616 env->regs[15] = dest & ~1;
617 return;
618 }
619
620 /* Target is non-secure: first push a stack frame */
621 if (!QEMU_IS_ALIGNED(sp, 8)) {
622 qemu_log_mask(LOG_GUEST_ERROR,
623 "BLXNS with misaligned SP is UNPREDICTABLE\n");
624 }
625
626 if (sp < v7m_sp_limit(env)) {
627 raise_exception(env, EXCP_STKOF, 0, 1);
628 }
629
630 saved_psr = env->v7m.exception;
631 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
632 saved_psr |= XPSR_SFPA;
633 }
634
635 /* Note that these stores can throw exceptions on MPU faults */
636 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
637 MemOpIdx oi = make_memop_idx(mo_endian(env) | MO_UL | MO_ALIGN,
638 arm_to_core_mmu_idx(mmu_idx));
639 cpu_stl_mmu(env, sp, nextinst, oi, GETPC());
640 cpu_stl_mmu(env, sp + 4, saved_psr, oi, GETPC());
641
642 env->regs[13] = sp;
643 env->regs[14] = 0xfeffffff;
644 if (arm_v7m_is_handler_mode(env)) {
645 /*
646 * Write a dummy value to IPSR, to avoid leaking the current secure
647 * exception number to non-secure code. This is guaranteed not
648 * to cause write_v7m_exception() to actually change stacks.
649 */
650 write_v7m_exception(env, 1);
651 }
652 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
653 switch_v7m_security_state(env, 0);
654 env->thumb = true;
655 env->regs[15] = dest;
656 arm_rebuild_hflags(env);
657 }
658
659 static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
660 uint32_t *pvec)
661 {
662 CPUState *cs = CPU(cpu);
663 CPUARMState *env = &cpu->env;
664 MemTxResult result;
665 uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4;
666 uint32_t vector_entry;
667 MemTxAttrs attrs = {};
668 ARMMMUIdx mmu_idx;
669 bool exc_secure;
670
671 qemu_log_mask(CPU_LOG_INT,
672 "...loading from element %d of %s vector table at 0x%x\n",
673 exc, targets_secure ? "secure" : "non-secure", addr);
674
675 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
676
677 /*
678 * We don't do a get_phys_addr() here because the rules for vector
679 * loads are special: they always use the default memory map, and
680 * the default memory map permits reads from all addresses.
681 * Since there's no easy way to pass through to pmsav8_mpu_lookup()
682 * that we want this special case which would always say "yes",
683 * we just do the SAU lookup here followed by a direct physical load.
684 */
685 attrs.secure = targets_secure;
686 attrs.user = false;
687
688 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
689 V8M_SAttributes sattrs = {};
690
691 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx,
692 targets_secure, &sattrs);
693 if (sattrs.ns) {
694 attrs.secure = false;
695 } else if (!targets_secure) {
696 /*
697 * NS access to S memory: the underlying exception which we escalate
698 * to HardFault is SecureFault, which always targets Secure.
699 */
700 exc_secure = true;
701 goto load_fail;
702 }
703 }
704
705 vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
706 attrs, &result);
707 if (result != MEMTX_OK) {
708 /*
709 * Underlying exception is BusFault: its target security state
710 * depends on BFHFNMINS.
711 */
712 exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
713 goto load_fail;
714 }
715 *pvec = vector_entry;
716 qemu_log_mask(CPU_LOG_INT, "...loaded new PC 0x%x\n", *pvec);
717 return true;
718
719 load_fail:
720 /*
721 * All vector table fetch fails are reported as HardFault, with
722 * HFSR.VECTTBL and .FORCED set. (FORCED is set because
723 * technically the underlying exception is a SecureFault or BusFault
724 * that is escalated to HardFault.) This is a terminal exception,
725 * so we will either take the HardFault immediately or else enter
726 * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
727 * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
728 * secure); otherwise it targets the same security state as the
729 * underlying exception.
730 * In v8.1M HardFaults from vector table fetch fails don't set FORCED.
731 */
732 if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
733 exc_secure = true;
734 }
735 env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK;
736 if (!arm_feature(env, ARM_FEATURE_V8_1M)) {
737 env->v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
738 }
739 armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
740 return false;
741 }
742
743 static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr)
744 {
745 /*
746 * Return the integrity signature value for the callee-saves
747 * stack frame section. @lr is the exception return payload/LR value
748 * whose FType bit forms bit 0 of the signature if FP is present.
749 */
750 uint32_t sig = 0xfefa125a;
751
752 if (!cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))
753 || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
754 sig |= 1;
755 }
756 return sig;
757 }
758
759 static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
760 bool ignore_faults)
761 {
762 /*
763 * For v8M, push the callee-saves register part of the stack frame.
764 * Compare the v8M pseudocode PushCalleeStack().
765 * In the tailchaining case this may not be the current stack.
766 */
767 CPUARMState *env = &cpu->env;
768 uint32_t *frame_sp_p;
769 uint32_t frameptr;
770 ARMMMUIdx mmu_idx;
771 bool stacked_ok;
772 uint32_t limit;
773 bool want_psp;
774 uint32_t sig;
775 StackingMode smode = ignore_faults ? STACK_IGNFAULTS : STACK_NORMAL;
776
777 if (dotailchain) {
778 bool mode = lr & R_V7M_EXCRET_MODE_MASK;
779 bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) ||
780 !mode;
781
782 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
783 frame_sp_p = arm_v7m_get_sp_ptr(env, M_REG_S, mode,
784 lr & R_V7M_EXCRET_SPSEL_MASK);
785 want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
786 if (want_psp) {
787 limit = env->v7m.psplim[M_REG_S];
788 } else {
789 limit = env->v7m.msplim[M_REG_S];
790 }
791 } else {
792 mmu_idx = arm_mmu_idx(env);
793 frame_sp_p = &env->regs[13];
794 limit = v7m_sp_limit(env);
795 }
796
797 frameptr = *frame_sp_p - 0x28;
798 if (frameptr < limit) {
799 /*
800 * Stack limit failure: set SP to the limit value, and generate
801 * STKOF UsageFault. Stack pushes below the limit must not be
802 * performed. It is IMPDEF whether pushes above the limit are
803 * performed; we choose not to.
804 */
805 qemu_log_mask(CPU_LOG_INT,
806 "...STKOF during callee-saves register stacking\n");
807 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
808 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
809 env->v7m.secure);
810 *frame_sp_p = limit;
811 return true;
812 }
813
814 /*
815 * Write as much of the stack frame as we can. A write failure may
816 * cause us to pend a derived exception.
817 */
818 sig = v7m_integrity_sig(env, lr);
819 stacked_ok =
820 v7m_stack_write(cpu, frameptr, sig, mmu_idx, smode) &&
821 v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx, smode) &&
822 v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx, smode) &&
823 v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx, smode) &&
824 v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx, smode) &&
825 v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx, smode) &&
826 v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx, smode) &&
827 v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx, smode) &&
828 v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx, smode);
829
830 /* Update SP regardless of whether any of the stack accesses failed. */
831 *frame_sp_p = frameptr;
832
833 return !stacked_ok;
834 }
835
836 static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
837 bool ignore_stackfaults)
838 {
839 /*
840 * Do the "take the exception" parts of exception entry,
841 * but not the pushing of state to the stack. This is
842 * similar to the pseudocode ExceptionTaken() function.
843 */
844 CPUARMState *env = &cpu->env;
845 uint32_t addr;
846 bool targets_secure;
847 int exc;
848 bool push_failed = false;
849
850 armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure);
851 qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n",
852 targets_secure ? "secure" : "nonsecure", exc);
853
854 if (dotailchain) {
855 /* Sanitize LR FType and PREFIX bits */
856 if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
857 lr |= R_V7M_EXCRET_FTYPE_MASK;
858 }
859 lr = deposit32(lr, 24, 8, 0xff);
860 }
861
862 if (arm_feature(env, ARM_FEATURE_V8)) {
863 if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
864 (lr & R_V7M_EXCRET_S_MASK)) {
865 /*
866 * The background code (the owner of the registers in the
867 * exception frame) is Secure. This means it may either already
868 * have or now needs to push callee-saves registers.
869 */
870 if (targets_secure) {
871 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
872 /*
873 * We took an exception from Secure to NonSecure
874 * (which means the callee-saved registers got stacked)
875 * and are now tailchaining to a Secure exception.
876 * Clear DCRS so eventual return from this Secure
877 * exception unstacks the callee-saved registers.
878 */
879 lr &= ~R_V7M_EXCRET_DCRS_MASK;
880 }
881 } else {
882 /*
883 * We're going to a non-secure exception; push the
884 * callee-saves registers to the stack now, if they're
885 * not already saved.
886 */
887 if (lr & R_V7M_EXCRET_DCRS_MASK &&
888 !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) {
889 push_failed = v7m_push_callee_stack(cpu, lr, dotailchain,
890 ignore_stackfaults);
891 }
892 lr |= R_V7M_EXCRET_DCRS_MASK;
893 }
894 }
895
896 lr &= ~R_V7M_EXCRET_ES_MASK;
897 if (targets_secure) {
898 lr |= R_V7M_EXCRET_ES_MASK;
899 }
900 lr &= ~R_V7M_EXCRET_SPSEL_MASK;
901 if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
902 lr |= R_V7M_EXCRET_SPSEL_MASK;
903 }
904
905 /*
906 * Clear registers if necessary to prevent non-secure exception
907 * code being able to see register values from secure code.
908 * Where register values become architecturally UNKNOWN we leave
909 * them with their previous values. v8.1M is tighter than v8.0M
910 * here and always zeroes the caller-saved registers regardless
911 * of the security state the exception is targeting.
912 */
913 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
914 if (!targets_secure || arm_feature(env, ARM_FEATURE_V8_1M)) {
915 /*
916 * Always clear the caller-saved registers (they have been
917 * pushed to the stack earlier in v7m_push_stack()).
918 * Clear callee-saved registers if the background code is
919 * Secure (in which case these regs were saved in
920 * v7m_push_callee_stack()).
921 */
922 int i;
923 /*
924 * r4..r11 are callee-saves, zero only if background
925 * state was Secure (EXCRET.S == 1) and exception
926 * targets Non-secure state
927 */
928 bool zero_callee_saves = !targets_secure &&
929 (lr & R_V7M_EXCRET_S_MASK);
930
931 for (i = 0; i < 13; i++) {
932 if (i < 4 || i > 11 || zero_callee_saves) {
933 env->regs[i] = 0;
934 }
935 }
936 /* Clear EAPSR */
937 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
938 }
939 }
940 }
941
942 if (push_failed && !ignore_stackfaults) {
943 /*
944 * Derived exception on callee-saves register stacking:
945 * we might now want to take a different exception which
946 * targets a different security state, so try again from the top.
947 */
948 qemu_log_mask(CPU_LOG_INT,
949 "...derived exception on callee-saves register stacking");
950 v7m_exception_taken(cpu, lr, true, true);
951 return;
952 }
953
954 if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) {
955 /* Vector load failed: derived exception */
956 qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load");
957 v7m_exception_taken(cpu, lr, true, true);
958 return;
959 }
960
961 /*
962 * Now we've done everything that might cause a derived exception
963 * we can go ahead and activate whichever exception we're going to
964 * take (which might now be the derived exception).
965 * Exception entry sets the event register (ARM ARM R_BPBR)
966 */
967 env->event_register = true;
968 armv7m_nvic_acknowledge_irq(env->nvic);
969
970 /* Switch to target security state -- must do this before writing SPSEL */
971 switch_v7m_security_state(env, targets_secure);
972 write_v7m_control_spsel(env, 0);
973 arm_clear_exclusive(env);
974 /* Clear SFPA and FPCA (has no effect if no FPU) */
975 env->v7m.control[M_REG_S] &=
976 ~(R_V7M_CONTROL_FPCA_MASK | R_V7M_CONTROL_SFPA_MASK);
977 /* Clear IT bits */
978 env->condexec_bits = 0;
979 env->regs[14] = lr;
980 env->regs[15] = addr & 0xfffffffe;
981 env->thumb = addr & 1;
982 arm_rebuild_hflags(env);
983 }
984
985 static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr,
986 bool apply_splim)
987 {
988 /*
989 * Like the pseudocode UpdateFPCCR: save state in FPCAR and FPCCR
990 * that we will need later in order to do lazy FP reg stacking.
991 */
992 bool is_secure = env->v7m.secure;
993 NVICState *nvic = env->nvic;
994 /*
995 * Some bits are unbanked and live always in fpccr[M_REG_S]; some bits
996 * are banked and we want to update the bit in the bank for the
997 * current security state; and in one case we want to specifically
998 * update the NS banked version of a bit even if we are secure.
999 */
1000 uint32_t *fpccr_s = &env->v7m.fpccr[M_REG_S];
1001 uint32_t *fpccr_ns = &env->v7m.fpccr[M_REG_NS];
1002 uint32_t *fpccr = &env->v7m.fpccr[is_secure];
1003 bool hfrdy, bfrdy, mmrdy, ns_ufrdy, s_ufrdy, sfrdy, monrdy;
1004
1005 env->v7m.fpcar[is_secure] = frameptr & ~0x7;
1006
1007 if (apply_splim && arm_feature(env, ARM_FEATURE_V8)) {
1008 bool splimviol;
1009 uint32_t splim = v7m_sp_limit(env);
1010 bool ign = armv7m_nvic_neg_prio_requested(nvic, is_secure) &&
1011 (env->v7m.ccr[is_secure] & R_V7M_CCR_STKOFHFNMIGN_MASK);
1012
1013 splimviol = !ign && frameptr < splim;
1014 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, SPLIMVIOL, splimviol);
1015 }
1016
1017 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, LSPACT, 1);
1018
1019 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, S, is_secure);
1020
1021 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, USER, arm_current_el(env) == 0);
1022
1023 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, THREAD,
1024 !arm_v7m_is_handler_mode(env));
1025
1026 hfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_HARD, false);
1027 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, HFRDY, hfrdy);
1028
1029 bfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_BUS, false);
1030 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, BFRDY, bfrdy);
1031
1032 mmrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_MEM, is_secure);
1033 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, MMRDY, mmrdy);
1034
1035 ns_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, false);
1036 *fpccr_ns = FIELD_DP32(*fpccr_ns, V7M_FPCCR, UFRDY, ns_ufrdy);
1037
1038 monrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_DEBUG, false);
1039 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, MONRDY, monrdy);
1040
1041 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1042 s_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, true);
1043 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, UFRDY, s_ufrdy);
1044
1045 sfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_SECURE, false);
1046 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, SFRDY, sfrdy);
1047 }
1048 }
1049
1050 void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
1051 {
1052 /* fptr is the value of Rn, the frame pointer we store the FP regs to */
1053 ARMCPU *cpu = env_archcpu(env);
1054 bool s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
1055 bool lspact = env->v7m.fpccr[s] & R_V7M_FPCCR_LSPACT_MASK;
1056 uintptr_t ra = GETPC();
1057 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1058 MemOpIdx oi = make_memop_idx(mo_endian(env) | MO_UL | MO_ALIGN,
1059 arm_to_core_mmu_idx(mmu_idx));
1060
1061 assert(env->v7m.secure);
1062
1063 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1064 return;
1065 }
1066
1067 /* Check access to the coprocessor is permitted */
1068 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
1069 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
1070 }
1071
1072 if (lspact) {
1073 /* LSPACT should not be active when there is active FP state */
1074 raise_exception_ra(env, EXCP_LSERR, 0, 1, GETPC());
1075 }
1076
1077 if (fptr & 7) {
1078 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
1079 }
1080
1081 /*
1082 * Note that we do not use v7m_stack_write() here, because the
1083 * accesses should not set the FSR bits for stacking errors if they
1084 * fail. (In pseudocode terms, they are AccType_NORMAL, not AccType_STACK
1085 * or AccType_LAZYFP). Faults in cpu_stl_mmu() will throw exceptions
1086 * and longjmp out.
1087 */
1088 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1089 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1090 int i;
1091
1092 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1093 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1094 uint32_t faddr = fptr + 4 * i;
1095 uint32_t slo = extract64(dn, 0, 32);
1096 uint32_t shi = extract64(dn, 32, 32);
1097
1098 if (i >= 16) {
1099 faddr += 8; /* skip the slot for the FPSCR */
1100 }
1101 cpu_stl_mmu(env, faddr, slo, oi, ra);
1102 cpu_stl_mmu(env, faddr + 4, shi, oi, ra);
1103 }
1104 cpu_stl_mmu(env, fptr + 0x40, vfp_get_fpscr(env), oi, ra);
1105 if (cpu_isar_feature(aa32_mve, cpu)) {
1106 cpu_stl_mmu(env, fptr + 0x44, env->v7m.vpr, oi, ra);
1107 }
1108
1109 /*
1110 * If TS is 0 then s0 to s15, FPSCR and VPR are UNKNOWN; we choose to
1111 * leave them unchanged, matching our choice in v7m_preserve_fp_state.
1112 */
1113 if (ts) {
1114 for (i = 0; i < 32; i += 2) {
1115 *aa32_vfp_dreg(env, i / 2) = 0;
1116 }
1117 vfp_set_fpscr(env, 0);
1118 if (cpu_isar_feature(aa32_mve, cpu)) {
1119 env->v7m.vpr = 0;
1120 }
1121 }
1122 } else {
1123 v7m_update_fpccr(env, fptr, false);
1124 }
1125
1126 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
1127 }
1128
1129 void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
1130 {
1131 ARMCPU *cpu = env_archcpu(env);
1132 uintptr_t ra = GETPC();
1133 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1134 MemOpIdx oi = make_memop_idx(mo_endian(env) | MO_UL | MO_ALIGN,
1135 arm_to_core_mmu_idx(mmu_idx));
1136
1137 /* fptr is the value of Rn, the frame pointer we load the FP regs from */
1138 assert(env->v7m.secure);
1139
1140 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1141 return;
1142 }
1143
1144 /* Check access to the coprocessor is permitted */
1145 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
1146 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
1147 }
1148
1149 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1150 /* State in FP is still valid */
1151 env->v7m.fpccr[M_REG_S] &= ~R_V7M_FPCCR_LSPACT_MASK;
1152 } else {
1153 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1154 int i;
1155 uint32_t fpscr;
1156
1157 if (fptr & 7) {
1158 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
1159 }
1160
1161 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1162 uint32_t slo, shi;
1163 uint64_t dn;
1164 uint32_t faddr = fptr + 4 * i;
1165
1166 if (i >= 16) {
1167 faddr += 8; /* skip the slot for the FPSCR and VPR */
1168 }
1169
1170 slo = cpu_ldl_mmu(env, faddr, oi, ra);
1171 shi = cpu_ldl_mmu(env, faddr + 4, oi, ra);
1172
1173 dn = (uint64_t) shi << 32 | slo;
1174 *aa32_vfp_dreg(env, i / 2) = dn;
1175 }
1176 fpscr = cpu_ldl_mmu(env, fptr + 0x40, oi, ra);
1177 vfp_set_fpscr(env, fpscr);
1178 if (cpu_isar_feature(aa32_mve, cpu)) {
1179 env->v7m.vpr = cpu_ldl_mmu(env, fptr + 0x44, oi, ra);
1180 }
1181 }
1182
1183 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK;
1184 }
1185
1186 static bool v7m_push_stack(ARMCPU *cpu)
1187 {
1188 /*
1189 * Do the "set up stack frame" part of exception entry,
1190 * similar to pseudocode PushStack().
1191 * Return true if we generate a derived exception (and so
1192 * should ignore further stack faults trying to process
1193 * that derived exception.)
1194 */
1195 bool stacked_ok = true, limitviol = false;
1196 CPUARMState *env = &cpu->env;
1197 uint32_t xpsr = xpsr_read(env);
1198 uint32_t frameptr = env->regs[13];
1199 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1200 uint32_t framesize;
1201 bool nsacr_cp10 = extract32(env->v7m.nsacr, 10, 1);
1202
1203 if ((env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) &&
1204 (env->v7m.secure || nsacr_cp10)) {
1205 if (env->v7m.secure &&
1206 env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK) {
1207 framesize = 0xa8;
1208 } else {
1209 framesize = 0x68;
1210 }
1211 } else {
1212 framesize = 0x20;
1213 }
1214
1215 /* Align stack pointer if the guest wants that */
1216 if ((frameptr & 4) &&
1217 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) {
1218 frameptr -= 4;
1219 xpsr |= XPSR_SPREALIGN;
1220 }
1221
1222 xpsr &= ~XPSR_SFPA;
1223 if (env->v7m.secure &&
1224 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1225 xpsr |= XPSR_SFPA;
1226 }
1227
1228 frameptr -= framesize;
1229
1230 if (arm_feature(env, ARM_FEATURE_V8)) {
1231 uint32_t limit = v7m_sp_limit(env);
1232
1233 if (frameptr < limit) {
1234 /*
1235 * Stack limit failure: set SP to the limit value, and generate
1236 * STKOF UsageFault. Stack pushes below the limit must not be
1237 * performed. It is IMPDEF whether pushes above the limit are
1238 * performed; we choose not to.
1239 */
1240 qemu_log_mask(CPU_LOG_INT,
1241 "...STKOF during stacking\n");
1242 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
1243 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1244 env->v7m.secure);
1245 env->regs[13] = limit;
1246 /*
1247 * We won't try to perform any further memory accesses but
1248 * we must continue through the following code to check for
1249 * permission faults during FPU state preservation, and we
1250 * must update FPCCR if lazy stacking is enabled.
1251 */
1252 limitviol = true;
1253 stacked_ok = false;
1254 }
1255 }
1256
1257 /*
1258 * Write as much of the stack frame as we can. If we fail a stack
1259 * write this will result in a derived exception being pended
1260 * (which may be taken in preference to the one we started with
1261 * if it has higher priority).
1262 */
1263 stacked_ok = stacked_ok &&
1264 v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, STACK_NORMAL) &&
1265 v7m_stack_write(cpu, frameptr + 4, env->regs[1],
1266 mmu_idx, STACK_NORMAL) &&
1267 v7m_stack_write(cpu, frameptr + 8, env->regs[2],
1268 mmu_idx, STACK_NORMAL) &&
1269 v7m_stack_write(cpu, frameptr + 12, env->regs[3],
1270 mmu_idx, STACK_NORMAL) &&
1271 v7m_stack_write(cpu, frameptr + 16, env->regs[12],
1272 mmu_idx, STACK_NORMAL) &&
1273 v7m_stack_write(cpu, frameptr + 20, env->regs[14],
1274 mmu_idx, STACK_NORMAL) &&
1275 v7m_stack_write(cpu, frameptr + 24, env->regs[15],
1276 mmu_idx, STACK_NORMAL) &&
1277 v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, STACK_NORMAL);
1278
1279 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) {
1280 /* FPU is active, try to save its registers */
1281 bool fpccr_s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
1282 bool lspact = env->v7m.fpccr[fpccr_s] & R_V7M_FPCCR_LSPACT_MASK;
1283
1284 if (lspact && arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1285 qemu_log_mask(CPU_LOG_INT,
1286 "...SecureFault because LSPACT and FPCA both set\n");
1287 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1288 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1289 } else if (!env->v7m.secure && !nsacr_cp10) {
1290 qemu_log_mask(CPU_LOG_INT,
1291 "...Secure UsageFault with CFSR.NOCP because "
1292 "NSACR.CP10 prevents stacking FP regs\n");
1293 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
1294 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
1295 } else {
1296 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1297 /* Lazy stacking disabled, save registers now */
1298 int i;
1299 bool cpacr_pass = v7m_cpacr_pass(env, env->v7m.secure,
1300 arm_current_el(env) != 0);
1301
1302 if (stacked_ok && !cpacr_pass) {
1303 /*
1304 * Take UsageFault if CPACR forbids access. The pseudocode
1305 * here does a full CheckCPEnabled() but we know the NSACR
1306 * check can never fail as we have already handled that.
1307 */
1308 qemu_log_mask(CPU_LOG_INT,
1309 "...UsageFault with CFSR.NOCP because "
1310 "CPACR.CP10 prevents stacking FP regs\n");
1311 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1312 env->v7m.secure);
1313 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK;
1314 stacked_ok = false;
1315 }
1316
1317 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1318 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1319 uint32_t faddr = frameptr + 0x20 + 4 * i;
1320 uint32_t slo = extract64(dn, 0, 32);
1321 uint32_t shi = extract64(dn, 32, 32);
1322
1323 if (i >= 16) {
1324 faddr += 8; /* skip the slot for the FPSCR and VPR */
1325 }
1326 stacked_ok = stacked_ok &&
1327 v7m_stack_write(cpu, faddr, slo,
1328 mmu_idx, STACK_NORMAL) &&
1329 v7m_stack_write(cpu, faddr + 4, shi,
1330 mmu_idx, STACK_NORMAL);
1331 }
1332 stacked_ok = stacked_ok &&
1333 v7m_stack_write(cpu, frameptr + 0x60,
1334 vfp_get_fpscr(env), mmu_idx, STACK_NORMAL);
1335 if (cpu_isar_feature(aa32_mve, cpu)) {
1336 stacked_ok = stacked_ok &&
1337 v7m_stack_write(cpu, frameptr + 0x64,
1338 env->v7m.vpr, mmu_idx, STACK_NORMAL);
1339 }
1340 if (cpacr_pass) {
1341 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1342 *aa32_vfp_dreg(env, i / 2) = 0;
1343 }
1344 vfp_set_fpscr(env, 0);
1345 if (cpu_isar_feature(aa32_mve, cpu)) {
1346 env->v7m.vpr = 0;
1347 }
1348 }
1349 } else {
1350 /* Lazy stacking enabled, save necessary info to stack later */
1351 v7m_update_fpccr(env, frameptr + 0x20, true);
1352 }
1353 }
1354 }
1355
1356 /*
1357 * If we broke a stack limit then SP was already updated earlier;
1358 * otherwise we update SP regardless of whether any of the stack
1359 * accesses failed or we took some other kind of fault.
1360 */
1361 if (!limitviol) {
1362 env->regs[13] = frameptr;
1363 }
1364
1365 return !stacked_ok;
1366 }
1367
1368 static void do_v7m_exception_exit(ARMCPU *cpu)
1369 {
1370 CPUARMState *env = &cpu->env;
1371 uint32_t excret;
1372 uint32_t xpsr, xpsr_mask;
1373 bool ufault = false;
1374 bool sfault = false;
1375 bool return_to_sp_process;
1376 bool return_to_handler;
1377 bool rettobase = false;
1378 bool exc_secure = false;
1379 bool return_to_secure;
1380 bool ftype;
1381 bool restore_s16_s31 = false;
1382
1383 /*
1384 * If we're not in Handler mode then jumps to magic exception-exit
1385 * addresses don't have magic behaviour. However for the v8M
1386 * security extensions the magic secure-function-return has to
1387 * work in thread mode too, so to avoid doing an extra check in
1388 * the generated code we allow exception-exit magic to also cause the
1389 * internal exception and bring us here in thread mode. Correct code
1390 * will never try to do this (the following insn fetch will always
1391 * fault) so we the overhead of having taken an unnecessary exception
1392 * doesn't matter.
1393 */
1394 if (!arm_v7m_is_handler_mode(env)) {
1395 return;
1396 }
1397
1398 /*
1399 * In the spec pseudocode ExceptionReturn() is called directly
1400 * from BXWritePC() and gets the full target PC value including
1401 * bit zero. In QEMU's implementation we treat it as a normal
1402 * jump-to-register (which is then caught later on), and so split
1403 * the target value up between env->regs[15] and env->thumb in
1404 * gen_bx(). Reconstitute it.
1405 */
1406 excret = env->regs[15];
1407 if (env->thumb) {
1408 excret |= 1;
1409 }
1410
1411 qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
1412 " previous exception %d\n",
1413 excret, env->v7m.exception);
1414
1415 if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
1416 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
1417 "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
1418 excret);
1419 }
1420
1421 ftype = excret & R_V7M_EXCRET_FTYPE_MASK;
1422
1423 if (!ftype && !cpu_isar_feature(aa32_vfp_simd, cpu)) {
1424 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception "
1425 "exit PC value 0x%" PRIx32 " is UNPREDICTABLE "
1426 "if FPU not present\n",
1427 excret);
1428 ftype = true;
1429 }
1430
1431 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1432 /*
1433 * EXC_RETURN.ES validation check (R_SMFL). We must do this before
1434 * we pick which FAULTMASK to clear.
1435 */
1436 if (!env->v7m.secure &&
1437 ((excret & R_V7M_EXCRET_ES_MASK) ||
1438 !(excret & R_V7M_EXCRET_DCRS_MASK))) {
1439 sfault = 1;
1440 /* For all other purposes, treat ES as 0 (R_HXSR) */
1441 excret &= ~R_V7M_EXCRET_ES_MASK;
1442 }
1443 exc_secure = excret & R_V7M_EXCRET_ES_MASK;
1444 }
1445
1446 if (env->v7m.exception != ARMV7M_EXCP_NMI) {
1447 /*
1448 * Auto-clear FAULTMASK on return from other than NMI.
1449 * If the security extension is implemented then this only
1450 * happens if the raw execution priority is >= 0; the
1451 * value of the ES bit in the exception return value indicates
1452 * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
1453 */
1454 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1455 if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
1456 env->v7m.faultmask[exc_secure] = 0;
1457 }
1458 } else {
1459 env->v7m.faultmask[M_REG_NS] = 0;
1460 }
1461 }
1462
1463 switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception,
1464 exc_secure)) {
1465 case -1:
1466 /* attempt to exit an exception that isn't active */
1467 ufault = true;
1468 break;
1469 case 0:
1470 /* still an irq active now */
1471 break;
1472 case 1:
1473 /*
1474 * We returned to base exception level, no nesting.
1475 * (In the pseudocode this is written using "NestedActivation != 1"
1476 * where we have 'rettobase == false'.)
1477 */
1478 rettobase = true;
1479 break;
1480 default:
1481 g_assert_not_reached();
1482 }
1483
1484 return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
1485 return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
1486 return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
1487 (excret & R_V7M_EXCRET_S_MASK);
1488
1489 if (arm_feature(env, ARM_FEATURE_V8)) {
1490 if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1491 /*
1492 * UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP);
1493 * we choose to take the UsageFault.
1494 */
1495 if ((excret & R_V7M_EXCRET_S_MASK) ||
1496 (excret & R_V7M_EXCRET_ES_MASK) ||
1497 !(excret & R_V7M_EXCRET_DCRS_MASK)) {
1498 ufault = true;
1499 }
1500 }
1501 if (excret & R_V7M_EXCRET_RES0_MASK) {
1502 ufault = true;
1503 }
1504 } else {
1505 /* For v7M we only recognize certain combinations of the low bits */
1506 switch (excret & 0xf) {
1507 case 1: /* Return to Handler */
1508 break;
1509 case 13: /* Return to Thread using Process stack */
1510 case 9: /* Return to Thread using Main stack */
1511 /*
1512 * We only need to check NONBASETHRDENA for v7M, because in
1513 * v8M this bit does not exist (it is RES1).
1514 */
1515 if (!rettobase &&
1516 !(env->v7m.ccr[env->v7m.secure] &
1517 R_V7M_CCR_NONBASETHRDENA_MASK)) {
1518 ufault = true;
1519 }
1520 break;
1521 default:
1522 ufault = true;
1523 }
1524 }
1525
1526 /*
1527 * Set CONTROL.SPSEL from excret.SPSEL. Since we're still in
1528 * Handler mode (and will be until we write the new XPSR.Interrupt
1529 * field) this does not switch around the current stack pointer.
1530 * We must do this before we do any kind of tailchaining, including
1531 * for the derived exceptions on integrity check failures, or we will
1532 * give the guest an incorrect EXCRET.SPSEL value on exception entry.
1533 */
1534 write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
1535
1536 /*
1537 * Clear scratch FP values left in caller saved registers; this
1538 * must happen before any kind of tail chaining.
1539 */
1540 if ((env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_CLRONRET_MASK) &&
1541 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
1542 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1543 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1544 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1545 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1546 "stackframe: error during lazy state deactivation\n");
1547 v7m_exception_taken(cpu, excret, true, false);
1548 return;
1549 } else {
1550 if (arm_feature(env, ARM_FEATURE_V8_1M)) {
1551 /* v8.1M adds this NOCP check */
1552 bool nsacr_pass = exc_secure ||
1553 extract32(env->v7m.nsacr, 10, 1);
1554 bool cpacr_pass = v7m_cpacr_pass(env, exc_secure, true);
1555 if (!nsacr_pass) {
1556 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
1557 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
1558 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1559 "stackframe: NSACR prevents clearing FPU registers\n");
1560 v7m_exception_taken(cpu, excret, true, false);
1561 return;
1562 } else if (!cpacr_pass) {
1563 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1564 exc_secure);
1565 env->v7m.cfsr[exc_secure] |= R_V7M_CFSR_NOCP_MASK;
1566 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1567 "stackframe: CPACR prevents clearing FPU registers\n");
1568 v7m_exception_taken(cpu, excret, true, false);
1569 return;
1570 }
1571 }
1572 /* Clear s0..s15, FPSCR and VPR */
1573 int i;
1574
1575 for (i = 0; i < 16; i += 2) {
1576 *aa32_vfp_dreg(env, i / 2) = 0;
1577 }
1578 vfp_set_fpscr(env, 0);
1579 if (cpu_isar_feature(aa32_mve, cpu)) {
1580 env->v7m.vpr = 0;
1581 }
1582 }
1583 }
1584
1585 if (sfault) {
1586 env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
1587 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1588 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1589 "stackframe: failed EXC_RETURN.ES validity check\n");
1590 v7m_exception_taken(cpu, excret, true, false);
1591 return;
1592 }
1593
1594 if (ufault) {
1595 /*
1596 * Bad exception return: instead of popping the exception
1597 * stack, directly take a usage fault on the current stack.
1598 */
1599 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1600 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
1601 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1602 "stackframe: failed exception return integrity check\n");
1603 v7m_exception_taken(cpu, excret, true, false);
1604 return;
1605 }
1606
1607 /*
1608 * Tailchaining: if there is currently a pending exception that
1609 * is high enough priority to preempt execution at the level we're
1610 * about to return to, then just directly take that exception now,
1611 * avoiding an unstack-and-then-stack. Note that now we have
1612 * deactivated the previous exception by calling armv7m_nvic_complete_irq()
1613 * our current execution priority is already the execution priority we are
1614 * returning to -- none of the state we would unstack or set based on
1615 * the EXCRET value affects it.
1616 */
1617 if (armv7m_nvic_can_take_pending_exception(env->nvic)) {
1618 qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n");
1619 v7m_exception_taken(cpu, excret, true, false);
1620 return;
1621 }
1622
1623 switch_v7m_security_state(env, return_to_secure);
1624
1625 {
1626 /*
1627 * The stack pointer we should be reading the exception frame from
1628 * depends on bits in the magic exception return type value (and
1629 * for v8M isn't necessarily the stack pointer we will eventually
1630 * end up resuming execution with). Get a pointer to the location
1631 * in the CPU state struct where the SP we need is currently being
1632 * stored; we will use and modify it in place.
1633 * We use this limited C variable scope so we don't accidentally
1634 * use 'frame_sp_p' after we do something that makes it invalid.
1635 */
1636 bool spsel = env->v7m.control[return_to_secure] & R_V7M_CONTROL_SPSEL_MASK;
1637 uint32_t *frame_sp_p = arm_v7m_get_sp_ptr(env, return_to_secure,
1638 !return_to_handler, spsel);
1639 uint32_t frameptr = *frame_sp_p;
1640 bool pop_ok = true;
1641 ARMMMUIdx mmu_idx;
1642 bool return_to_priv = return_to_handler ||
1643 !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK);
1644
1645 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure,
1646 return_to_priv);
1647
1648 if (!QEMU_IS_ALIGNED(frameptr, 8) &&
1649 arm_feature(env, ARM_FEATURE_V8)) {
1650 qemu_log_mask(LOG_GUEST_ERROR,
1651 "M profile exception return with non-8-aligned SP "
1652 "for destination state is UNPREDICTABLE\n");
1653 }
1654
1655 /* Do we need to pop callee-saved registers? */
1656 if (return_to_secure &&
1657 ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
1658 (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
1659 uint32_t actual_sig;
1660
1661 pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx);
1662
1663 if (pop_ok && v7m_integrity_sig(env, excret) != actual_sig) {
1664 /* Take a SecureFault on the current stack */
1665 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
1666 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1667 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1668 "stackframe: failed exception return integrity "
1669 "signature check\n");
1670 v7m_exception_taken(cpu, excret, true, false);
1671 return;
1672 }
1673
1674 pop_ok = pop_ok &&
1675 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
1676 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) &&
1677 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) &&
1678 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) &&
1679 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) &&
1680 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) &&
1681 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) &&
1682 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx);
1683
1684 frameptr += 0x28;
1685 }
1686
1687 /* Pop registers */
1688 pop_ok = pop_ok &&
1689 v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) &&
1690 v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) &&
1691 v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) &&
1692 v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) &&
1693 v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) &&
1694 v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) &&
1695 v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) &&
1696 v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx);
1697
1698 if (!pop_ok) {
1699 /*
1700 * v7m_stack_read() pended a fault, so take it (as a tail
1701 * chained exception on the same stack frame)
1702 */
1703 qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n");
1704 v7m_exception_taken(cpu, excret, true, false);
1705 return;
1706 }
1707
1708 /*
1709 * Returning from an exception with a PC with bit 0 set is defined
1710 * behaviour on v8M (bit 0 is ignored), but for v7M it was specified
1711 * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore
1712 * the lsbit, and there are several RTOSes out there which incorrectly
1713 * assume the r15 in the stack frame should be a Thumb-style "lsbit
1714 * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but
1715 * complain about the badly behaved guest.
1716 */
1717 if (env->regs[15] & 1) {
1718 env->regs[15] &= ~1U;
1719 if (!arm_feature(env, ARM_FEATURE_V8)) {
1720 qemu_log_mask(LOG_GUEST_ERROR,
1721 "M profile return from interrupt with misaligned "
1722 "PC is UNPREDICTABLE on v7M\n");
1723 }
1724 }
1725
1726 if (arm_feature(env, ARM_FEATURE_V8)) {
1727 /*
1728 * For v8M we have to check whether the xPSR exception field
1729 * matches the EXCRET value for return to handler/thread
1730 * before we commit to changing the SP and xPSR.
1731 */
1732 bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
1733 if (return_to_handler != will_be_handler) {
1734 /*
1735 * Take an INVPC UsageFault on the current stack.
1736 * By this point we will have switched to the security state
1737 * for the background state, so this UsageFault will target
1738 * that state.
1739 */
1740 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1741 env->v7m.secure);
1742 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1743 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1744 "stackframe: failed exception return integrity "
1745 "check\n");
1746 v7m_exception_taken(cpu, excret, true, false);
1747 return;
1748 }
1749 }
1750
1751 if (!ftype) {
1752 /* FP present and we need to handle it */
1753 if (!return_to_secure &&
1754 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK)) {
1755 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1756 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1757 qemu_log_mask(CPU_LOG_INT,
1758 "...taking SecureFault on existing stackframe: "
1759 "Secure LSPACT set but exception return is "
1760 "not to secure state\n");
1761 v7m_exception_taken(cpu, excret, true, false);
1762 return;
1763 }
1764
1765 restore_s16_s31 = return_to_secure &&
1766 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
1767
1768 if (env->v7m.fpccr[return_to_secure] & R_V7M_FPCCR_LSPACT_MASK) {
1769 /* State in FPU is still valid, just clear LSPACT */
1770 env->v7m.fpccr[return_to_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
1771 } else {
1772 int i;
1773 uint32_t fpscr;
1774 bool cpacr_pass, nsacr_pass;
1775
1776 cpacr_pass = v7m_cpacr_pass(env, return_to_secure,
1777 return_to_priv);
1778 nsacr_pass = return_to_secure ||
1779 extract32(env->v7m.nsacr, 10, 1);
1780
1781 if (!cpacr_pass) {
1782 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1783 return_to_secure);
1784 env->v7m.cfsr[return_to_secure] |= R_V7M_CFSR_NOCP_MASK;
1785 qemu_log_mask(CPU_LOG_INT,
1786 "...taking UsageFault on existing "
1787 "stackframe: CPACR.CP10 prevents unstacking "
1788 "FP regs\n");
1789 v7m_exception_taken(cpu, excret, true, false);
1790 return;
1791 } else if (!nsacr_pass) {
1792 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
1793 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_INVPC_MASK;
1794 qemu_log_mask(CPU_LOG_INT,
1795 "...taking Secure UsageFault on existing "
1796 "stackframe: NSACR.CP10 prevents unstacking "
1797 "FP regs\n");
1798 v7m_exception_taken(cpu, excret, true, false);
1799 return;
1800 }
1801
1802 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1803 uint32_t slo, shi;
1804 uint64_t dn;
1805 uint32_t faddr = frameptr + 0x20 + 4 * i;
1806
1807 if (i >= 16) {
1808 faddr += 8; /* Skip the slot for the FPSCR and VPR */
1809 }
1810
1811 pop_ok = pop_ok &&
1812 v7m_stack_read(cpu, &slo, faddr, mmu_idx) &&
1813 v7m_stack_read(cpu, &shi, faddr + 4, mmu_idx);
1814
1815 if (!pop_ok) {
1816 break;
1817 }
1818
1819 dn = (uint64_t)shi << 32 | slo;
1820 *aa32_vfp_dreg(env, i / 2) = dn;
1821 }
1822 pop_ok = pop_ok &&
1823 v7m_stack_read(cpu, &fpscr, frameptr + 0x60, mmu_idx);
1824 if (pop_ok) {
1825 vfp_set_fpscr(env, fpscr);
1826 }
1827 if (cpu_isar_feature(aa32_mve, cpu)) {
1828 pop_ok = pop_ok &&
1829 v7m_stack_read(cpu, &env->v7m.vpr,
1830 frameptr + 0x64, mmu_idx);
1831 }
1832 if (!pop_ok) {
1833 /*
1834 * These regs are 0 if security extension present;
1835 * otherwise merely UNKNOWN. We zero always.
1836 */
1837 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1838 *aa32_vfp_dreg(env, i / 2) = 0;
1839 }
1840 vfp_set_fpscr(env, 0);
1841 if (cpu_isar_feature(aa32_mve, cpu)) {
1842 env->v7m.vpr = 0;
1843 }
1844 }
1845 }
1846 }
1847 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1848 V7M_CONTROL, FPCA, !ftype);
1849
1850 /* Commit to consuming the stack frame */
1851 frameptr += 0x20;
1852 if (!ftype) {
1853 frameptr += 0x48;
1854 if (restore_s16_s31) {
1855 frameptr += 0x40;
1856 }
1857 }
1858 /*
1859 * Undo stack alignment (the SPREALIGN bit indicates that the original
1860 * pre-exception SP was not 8-aligned and we added a padding word to
1861 * align it, so we undo this by ORing in the bit that increases it
1862 * from the current 8-aligned value to the 8-unaligned value. (Adding 4
1863 * would work too but a logical OR is how the pseudocode specifies it.)
1864 */
1865 if (xpsr & XPSR_SPREALIGN) {
1866 frameptr |= 4;
1867 }
1868 *frame_sp_p = frameptr;
1869 }
1870
1871 xpsr_mask = ~(XPSR_SPREALIGN | XPSR_SFPA);
1872 if (!arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
1873 xpsr_mask &= ~XPSR_GE;
1874 }
1875 /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
1876 xpsr_write(env, xpsr, xpsr_mask);
1877
1878 if (env->v7m.secure) {
1879 bool sfpa = xpsr & XPSR_SFPA;
1880
1881 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1882 V7M_CONTROL, SFPA, sfpa);
1883 }
1884
1885 /*
1886 * The restored xPSR exception field will be zero if we're
1887 * resuming in Thread mode. If that doesn't match what the
1888 * exception return excret specified then this is a UsageFault.
1889 * v7M requires we make this check here; v8M did it earlier.
1890 */
1891 if (return_to_handler != arm_v7m_is_handler_mode(env)) {
1892 /*
1893 * Take an INVPC UsageFault by pushing the stack again;
1894 * we know we're v7M so this is never a Secure UsageFault.
1895 */
1896 bool ignore_stackfaults;
1897
1898 assert(!arm_feature(env, ARM_FEATURE_V8));
1899 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
1900 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1901 ignore_stackfaults = v7m_push_stack(cpu);
1902 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
1903 "failed exception return integrity check\n");
1904 v7m_exception_taken(cpu, excret, false, ignore_stackfaults);
1905 return;
1906 }
1907
1908 /* Otherwise, we have a successful exception exit. */
1909 arm_clear_exclusive(env);
1910 arm_rebuild_hflags(env);
1911
1912 /* Exception return sets the event register (ARM ARM R_BPBR) */
1913 env->event_register = true;
1914 qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
1915 }
1916
1917 static bool do_v7m_function_return(ARMCPU *cpu)
1918 {
1919 /*
1920 * v8M security extensions magic function return.
1921 * We may either:
1922 * (1) throw an exception (longjump)
1923 * (2) return true if we successfully handled the function return
1924 * (3) return false if we failed a consistency check and have
1925 * pended a UsageFault that needs to be taken now
1926 *
1927 * At this point the magic return value is split between env->regs[15]
1928 * and env->thumb. We don't bother to reconstitute it because we don't
1929 * need it (all values are handled the same way).
1930 */
1931 CPUARMState *env = &cpu->env;
1932 uint32_t newpc, newpsr, newpsr_exc;
1933
1934 qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n");
1935
1936 {
1937 bool threadmode, spsel;
1938 MemOpIdx oi;
1939 ARMMMUIdx mmu_idx;
1940 uint32_t *frame_sp_p;
1941 uint32_t frameptr;
1942
1943 /* Pull the return address and IPSR from the Secure stack */
1944 threadmode = !arm_v7m_is_handler_mode(env);
1945 spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
1946
1947 frame_sp_p = arm_v7m_get_sp_ptr(env, true, threadmode, spsel);
1948 frameptr = *frame_sp_p;
1949
1950 /*
1951 * These loads may throw an exception (for MPU faults). We want to
1952 * do them as secure, so work out what MMU index that is.
1953 */
1954 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
1955 oi = make_memop_idx(MO_LEUL | MO_ALIGN, arm_to_core_mmu_idx(mmu_idx));
1956 newpc = cpu_ldl_mmu(env, frameptr, oi, 0);
1957 newpsr = cpu_ldl_mmu(env, frameptr + 4, oi, 0);
1958
1959 /* Consistency checks on new IPSR */
1960 newpsr_exc = newpsr & XPSR_EXCP;
1961 if (!((env->v7m.exception == 0 && newpsr_exc == 0) ||
1962 (env->v7m.exception == 1 && newpsr_exc != 0))) {
1963 /* Pend the fault and tell our caller to take it */
1964 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1965 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1966 env->v7m.secure);
1967 qemu_log_mask(CPU_LOG_INT,
1968 "...taking INVPC UsageFault: "
1969 "IPSR consistency check failed\n");
1970 return false;
1971 }
1972
1973 *frame_sp_p = frameptr + 8;
1974 }
1975
1976 /* This invalidates frame_sp_p */
1977 switch_v7m_security_state(env, true);
1978 env->v7m.exception = newpsr_exc;
1979 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
1980 if (newpsr & XPSR_SFPA) {
1981 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK;
1982 }
1983 xpsr_write(env, 0, XPSR_IT);
1984 env->thumb = newpc & 1;
1985 env->regs[15] = newpc & ~1;
1986 arm_rebuild_hflags(env);
1987
1988 qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
1989 return true;
1990 }
1991
1992 static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx, bool secure,
1993 uint32_t addr, uint16_t *insn)
1994 {
1995 /*
1996 * Load a 16-bit portion of a v7M instruction, returning true on success,
1997 * or false on failure (in which case we will have pended the appropriate
1998 * exception).
1999 * We need to do the instruction fetch's MPU and SAU checks
2000 * like this because there is no MMU index that would allow
2001 * doing the load with a single function call. Instead we must
2002 * first check that the security attributes permit the load
2003 * and that they don't mismatch on the two halves of the instruction,
2004 * and then we do the load as a secure load (ie using the security
2005 * attributes of the address, not the CPU, as architecturally required).
2006 */
2007 CPUState *cs = CPU(cpu);
2008 CPUARMState *env = &cpu->env;
2009 V8M_SAttributes sattrs = {};
2010 GetPhysAddrResult res = {};
2011 ARMMMUFaultInfo fi = {};
2012 MemTxResult txres;
2013
2014 v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, secure, &sattrs);
2015 if (!sattrs.nsc || sattrs.ns) {
2016 /*
2017 * This must be the second half of the insn, and it straddles a
2018 * region boundary with the second half not being S&NSC.
2019 */
2020 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2021 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2022 qemu_log_mask(CPU_LOG_INT,
2023 "...really SecureFault with SFSR.INVEP\n");
2024 return false;
2025 }
2026 if (!get_phys_addr(env, addr, MMU_INST_FETCH, 0, mmu_idx, &res, &fi)) {
2027 /* the MPU lookup failed */
2028 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
2029 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
2030 qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
2031 return false;
2032 }
2033 *insn = address_space_lduw_le(arm_addressspace(cs, res.f.attrs),
2034 res.f.phys_addr, res.f.attrs, &txres);
2035 if (txres != MEMTX_OK) {
2036 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
2037 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2038 qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");
2039 return false;
2040 }
2041 return true;
2042 }
2043
2044 static bool v7m_read_sg_stack_word(ARMCPU *cpu, ARMMMUIdx mmu_idx,
2045 uint32_t addr, uint32_t *spdata)
2046 {
2047 /*
2048 * Read a word of data from the stack for the SG instruction,
2049 * writing the value into *spdata. If the load succeeds, return
2050 * true; otherwise pend an appropriate exception and return false.
2051 * (We can't use data load helpers here that throw an exception
2052 * because of the context we're called in, which is halfway through
2053 * arm_v7m_cpu_do_interrupt().)
2054 */
2055 CPUState *cs = CPU(cpu);
2056 CPUARMState *env = &cpu->env;
2057 MemTxResult txres;
2058 GetPhysAddrResult res = {};
2059 ARMMMUFaultInfo fi = {};
2060 uint32_t value;
2061
2062 if (!get_phys_addr(env, addr, MMU_DATA_LOAD, 0, mmu_idx, &res, &fi)) {
2063 /* MPU/SAU lookup failed */
2064 if (fi.type == ARMFault_QEMU_SFault) {
2065 qemu_log_mask(CPU_LOG_INT,
2066 "...SecureFault during stack word read\n");
2067 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
2068 env->v7m.sfar = addr;
2069 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2070 } else {
2071 qemu_log_mask(CPU_LOG_INT,
2072 "...MemManageFault during stack word read\n");
2073 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_DACCVIOL_MASK |
2074 R_V7M_CFSR_MMARVALID_MASK;
2075 env->v7m.mmfar[M_REG_S] = addr;
2076 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, false);
2077 }
2078 return false;
2079 }
2080 value = address_space_ldl(arm_addressspace(cs, res.f.attrs),
2081 res.f.phys_addr, res.f.attrs, &txres);
2082 if (txres != MEMTX_OK) {
2083 /* BusFault trying to read the data */
2084 qemu_log_mask(CPU_LOG_INT,
2085 "...BusFault during stack word read\n");
2086 env->v7m.cfsr[M_REG_NS] |=
2087 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
2088 env->v7m.bfar = addr;
2089 /*
2090 * The SG instruction's stack-word load is an AccType_NORMAL data
2091 * access, so CCR.BFHFNMIGN applies: at negative execution priority
2092 * with BFHFNMIGN set, the BusFault is suppressed -- the access
2093 * completes returning UNKNOWN data (status recorded above), with no
2094 * BusFault exception pended.
2095 */
2096 if (!((env->v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK) &&
2097 armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure))) {
2098 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2099 return false;
2100 }
2101 /* BusFault suppressed; data value is UNKNOWN, we choose 0 */
2102 value = 0;
2103 }
2104
2105 *spdata = value;
2106 return true;
2107 }
2108
2109 static bool v7m_handle_execute_nsc(ARMCPU *cpu)
2110 {
2111 /*
2112 * Check whether this attempt to execute code in a Secure & NS-Callable
2113 * memory region is for an SG instruction; if so, then emulate the
2114 * effect of the SG instruction and return true. Otherwise pend
2115 * the correct kind of exception and return false.
2116 */
2117 CPUARMState *env = &cpu->env;
2118 ARMMMUIdx mmu_idx;
2119 uint16_t insn;
2120
2121 /*
2122 * We should never get here unless get_phys_addr_pmsav8() caused
2123 * an exception for NS executing in S&NSC memory.
2124 */
2125 assert(!env->v7m.secure);
2126 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
2127
2128 /* We want to do the MPU lookup as secure; work out what mmu_idx that is */
2129 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
2130
2131 if (!v7m_read_half_insn(cpu, mmu_idx, true, env->regs[15], &insn)) {
2132 return false;
2133 }
2134
2135 if (!env->thumb) {
2136 goto gen_invep;
2137 }
2138
2139 if (insn != 0xe97f) {
2140 /*
2141 * Not an SG instruction first half (we choose the IMPDEF
2142 * early-SG-check option).
2143 */
2144 goto gen_invep;
2145 }
2146
2147 if (!v7m_read_half_insn(cpu, mmu_idx, true, env->regs[15] + 2, &insn)) {
2148 return false;
2149 }
2150
2151 if (insn != 0xe97f) {
2152 /*
2153 * Not an SG instruction second half (yes, both halves of the SG
2154 * insn have the same hex value)
2155 */
2156 goto gen_invep;
2157 }
2158
2159 /*
2160 * OK, we have confirmed that we really have an SG instruction.
2161 * We know we're NS in S memory so don't need to repeat those checks.
2162 */
2163 qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
2164 ", executing it\n", env->regs[15]);
2165
2166 if (cpu_isar_feature(aa32_m_sec_state, cpu) &&
2167 !arm_v7m_is_handler_mode(env)) {
2168 /*
2169 * v8.1M exception stack frame integrity check. Note that we
2170 * must perform the memory access even if CCR_S.TRD is zero
2171 * and we aren't going to check what the data loaded is.
2172 */
2173 uint32_t spdata, sp;
2174
2175 /*
2176 * We know we are currently NS, so the S stack pointers must be
2177 * in other_ss_{psp,msp}, not in regs[13]/other_sp.
2178 */
2179 sp = v7m_using_psp(env) ? env->v7m.other_ss_psp : env->v7m.other_ss_msp;
2180 if (!v7m_read_sg_stack_word(cpu, mmu_idx, sp, &spdata)) {
2181 /* Stack access failed and an exception has been pended */
2182 return false;
2183 }
2184
2185 if (env->v7m.ccr[M_REG_S] & R_V7M_CCR_TRD_MASK) {
2186 if (((spdata & ~1) == 0xfefa125a) ||
2187 !(env->v7m.control[M_REG_S] & 1)) {
2188 goto gen_invep;
2189 }
2190 }
2191 }
2192
2193 env->regs[14] &= ~1;
2194 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
2195 switch_v7m_security_state(env, true);
2196 xpsr_write(env, 0, XPSR_IT);
2197 env->regs[15] += 4;
2198 arm_rebuild_hflags(env);
2199 return true;
2200
2201 gen_invep:
2202 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2203 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2204 qemu_log_mask(CPU_LOG_INT,
2205 "...really SecureFault with SFSR.INVEP\n");
2206 return false;
2207 }
2208
2209 void arm_v7m_cpu_do_interrupt(CPUState *cs)
2210 {
2211 ARMCPU *cpu = ARM_CPU(cs);
2212 CPUARMState *env = &cpu->env;
2213 uint32_t lr;
2214 bool ignore_stackfaults;
2215 uint64_t last_pc = env->regs[15];
2216
2217 arm_log_exception(cs);
2218
2219 /*
2220 * For exceptions we just mark as pending on the NVIC, and let that
2221 * handle it.
2222 */
2223 switch (cs->exception_index) {
2224 case EXCP_UDEF:
2225 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2226 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK;
2227 break;
2228 case EXCP_NOCP:
2229 {
2230 /*
2231 * NOCP might be directed to something other than the current
2232 * security state if this fault is because of NSACR; we indicate
2233 * the target security state using exception.target_el.
2234 */
2235 int target_secstate;
2236
2237 if (env->exception.target_el == 3) {
2238 target_secstate = M_REG_S;
2239 } else {
2240 target_secstate = env->v7m.secure;
2241 }
2242 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, target_secstate);
2243 env->v7m.cfsr[target_secstate] |= R_V7M_CFSR_NOCP_MASK;
2244 break;
2245 }
2246 case EXCP_INVSTATE:
2247 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2248 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK;
2249 break;
2250 case EXCP_STKOF:
2251 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2252 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
2253 break;
2254 case EXCP_LSERR:
2255 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2256 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
2257 break;
2258 case EXCP_UNALIGNED:
2259 /* Unaligned faults reported by M-profile aware code */
2260 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2261 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
2262 break;
2263 case EXCP_DIVBYZERO:
2264 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2265 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_DIVBYZERO_MASK;
2266 break;
2267 case EXCP_SWI:
2268 /* The PC already points to the next instruction. */
2269 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure);
2270 break;
2271 case EXCP_PREFETCH_ABORT:
2272 case EXCP_DATA_ABORT:
2273 /*
2274 * Note that for M profile we don't have a guest facing FSR, but
2275 * the env->exception.fsr will be populated by the code that
2276 * raises the fault, in the A profile short-descriptor format.
2277 *
2278 * Log the exception.vaddress now regardless of subtype, because
2279 * logging below only logs it when it goes into a guest visible
2280 * register.
2281 */
2282 qemu_log_mask(CPU_LOG_INT, "...at fault address 0x%x\n",
2283 (uint32_t)env->exception.vaddress);
2284 switch (env->exception.fsr & 0xf) {
2285 case M_FAKE_FSR_NSC_EXEC:
2286 /*
2287 * Exception generated when we try to execute code at an address
2288 * which is marked as Secure & Non-Secure Callable and the CPU
2289 * is in the Non-Secure state. The only instruction which can
2290 * be executed like this is SG (and that only if both halves of
2291 * the SG instruction have the same security attributes.)
2292 * Everything else must generate an INVEP SecureFault, so we
2293 * emulate the SG instruction here.
2294 */
2295 if (v7m_handle_execute_nsc(cpu)) {
2296 return;
2297 }
2298 break;
2299 case M_FAKE_FSR_SFAULT:
2300 /*
2301 * Various flavours of SecureFault for attempts to execute or
2302 * access data in the wrong security state.
2303 */
2304 switch (cs->exception_index) {
2305 case EXCP_PREFETCH_ABORT:
2306 if (env->v7m.secure) {
2307 env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
2308 qemu_log_mask(CPU_LOG_INT,
2309 "...really SecureFault with SFSR.INVTRAN\n");
2310 } else {
2311 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2312 qemu_log_mask(CPU_LOG_INT,
2313 "...really SecureFault with SFSR.INVEP\n");
2314 }
2315 break;
2316 case EXCP_DATA_ABORT:
2317 /* This must be an NS access to S memory */
2318 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
2319 qemu_log_mask(CPU_LOG_INT,
2320 "...really SecureFault with SFSR.AUVIOL\n");
2321 break;
2322 }
2323 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2324 break;
2325 case 0x8: /* External Abort */
2326 switch (cs->exception_index) {
2327 case EXCP_PREFETCH_ABORT:
2328 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
2329 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
2330 break;
2331 case EXCP_DATA_ABORT:
2332 env->v7m.cfsr[M_REG_NS] |=
2333 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
2334 env->v7m.bfar = env->exception.vaddress;
2335 qemu_log_mask(CPU_LOG_INT,
2336 "...with CFSR.PRECISERR and BFAR 0x%x\n",
2337 env->v7m.bfar);
2338 break;
2339 }
2340 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2341 break;
2342 case 0x1: /* Alignment fault reported by generic code */
2343 qemu_log_mask(CPU_LOG_INT,
2344 "...really UsageFault with UFSR.UNALIGNED\n");
2345 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
2346 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
2347 env->v7m.secure);
2348 break;
2349 default:
2350 /*
2351 * All other FSR values are either MPU faults or "can't happen
2352 * for M profile" cases.
2353 */
2354 switch (cs->exception_index) {
2355 case EXCP_PREFETCH_ABORT:
2356 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
2357 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
2358 break;
2359 case EXCP_DATA_ABORT:
2360 env->v7m.cfsr[env->v7m.secure] |=
2361 (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
2362 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress;
2363 qemu_log_mask(CPU_LOG_INT,
2364 "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
2365 env->v7m.mmfar[env->v7m.secure]);
2366 break;
2367 }
2368 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM,
2369 env->v7m.secure);
2370 break;
2371 }
2372 break;
2373 case EXCP_SEMIHOST:
2374 qemu_log_mask(CPU_LOG_INT,
2375 "...handling as semihosting call 0x%x\n",
2376 env->regs[0]);
2377 #ifdef CONFIG_TCG
2378 do_common_semihosting(cs);
2379 #else
2380 g_assert_not_reached();
2381 #endif
2382 env->regs[15] += env->thumb ? 2 : 4;
2383 qemu_plugin_vcpu_hostcall_cb(cs, last_pc);
2384 return;
2385 case EXCP_BKPT:
2386 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false);
2387 break;
2388 case EXCP_IRQ:
2389 break;
2390 case EXCP_EXCEPTION_EXIT:
2391 if (env->regs[15] < EXC_RETURN_MIN_MAGIC) {
2392 /* Must be v8M security extension function return */
2393 assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC);
2394 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
2395 if (do_v7m_function_return(cpu)) {
2396 return;
2397 }
2398 } else {
2399 do_v7m_exception_exit(cpu);
2400 return;
2401 }
2402 break;
2403 case EXCP_LAZYFP:
2404 /*
2405 * We already pended the specific exception in the NVIC in the
2406 * v7m_preserve_fp_state() helper function.
2407 */
2408 break;
2409 default:
2410 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
2411 return; /* Never happens. Keep compiler happy. */
2412 }
2413
2414 if (arm_feature(env, ARM_FEATURE_V8)) {
2415 lr = R_V7M_EXCRET_RES1_MASK |
2416 R_V7M_EXCRET_DCRS_MASK;
2417 /*
2418 * The S bit indicates whether we should return to Secure
2419 * or NonSecure (ie our current state).
2420 * The ES bit indicates whether we're taking this exception
2421 * to Secure or NonSecure (ie our target state). We set it
2422 * later, in v7m_exception_taken().
2423 * The SPSEL bit is also set in v7m_exception_taken() for v8M.
2424 * This corresponds to the ARM ARM pseudocode for v8M setting
2425 * some LR bits in PushStack() and some in ExceptionTaken();
2426 * the distinction matters for the tailchain cases where we
2427 * can take an exception without pushing the stack.
2428 */
2429 if (env->v7m.secure) {
2430 lr |= R_V7M_EXCRET_S_MASK;
2431 }
2432 } else {
2433 lr = R_V7M_EXCRET_RES1_MASK |
2434 R_V7M_EXCRET_S_MASK |
2435 R_V7M_EXCRET_DCRS_MASK |
2436 R_V7M_EXCRET_ES_MASK;
2437 if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
2438 lr |= R_V7M_EXCRET_SPSEL_MASK;
2439 }
2440 }
2441 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
2442 lr |= R_V7M_EXCRET_FTYPE_MASK;
2443 }
2444 if (!arm_v7m_is_handler_mode(env)) {
2445 lr |= R_V7M_EXCRET_MODE_MASK;
2446 }
2447
2448 ignore_stackfaults = v7m_push_stack(cpu);
2449 v7m_exception_taken(cpu, lr, false, ignore_stackfaults);
2450
2451 arm_do_plugin_vcpu_discon_cb(cs, last_pc);
2452 }
2453
2454 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
2455 {
2456 unsigned el = arm_current_el(env);
2457
2458 /* First handle registers which unprivileged can read */
2459 switch (reg) {
2460 case 0 ... 7: /* xPSR sub-fields */
2461 return v7m_mrs_xpsr(env, reg, el);
2462 case 20: /* CONTROL */
2463 return arm_v7m_mrs_control(env, env->v7m.secure);
2464 case 0x94: /* CONTROL_NS */
2465 /*
2466 * We have to handle this here because unprivileged Secure code
2467 * can read the NS CONTROL register.
2468 */
2469 if (!env->v7m.secure) {
2470 return 0;
2471 }
2472 return env->v7m.control[M_REG_NS] |
2473 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK);
2474 }
2475
2476 if (el == 0) {
2477 return 0; /* unprivileged reads others as zero */
2478 }
2479
2480 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2481 switch (reg) {
2482 case 0x88: /* MSP_NS */
2483 if (!env->v7m.secure) {
2484 return 0;
2485 }
2486 return env->v7m.other_ss_msp;
2487 case 0x89: /* PSP_NS */
2488 if (!env->v7m.secure) {
2489 return 0;
2490 }
2491 return env->v7m.other_ss_psp;
2492 case 0x8a: /* MSPLIM_NS */
2493 if (!env->v7m.secure) {
2494 return 0;
2495 }
2496 return env->v7m.msplim[M_REG_NS];
2497 case 0x8b: /* PSPLIM_NS */
2498 if (!env->v7m.secure) {
2499 return 0;
2500 }
2501 return env->v7m.psplim[M_REG_NS];
2502 case 0x90: /* PRIMASK_NS */
2503 if (!env->v7m.secure) {
2504 return 0;
2505 }
2506 return env->v7m.primask[M_REG_NS];
2507 case 0x91: /* BASEPRI_NS */
2508 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2509 goto bad_reg;
2510 }
2511 if (!env->v7m.secure) {
2512 return 0;
2513 }
2514 return env->v7m.basepri[M_REG_NS];
2515 case 0x93: /* FAULTMASK_NS */
2516 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2517 goto bad_reg;
2518 }
2519 if (!env->v7m.secure) {
2520 return 0;
2521 }
2522 return env->v7m.faultmask[M_REG_NS];
2523 case 0x98: /* SP_NS */
2524 {
2525 /*
2526 * This gives the non-secure SP selected based on whether we're
2527 * currently in handler mode or not, using the NS CONTROL.SPSEL.
2528 */
2529 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2530
2531 if (!env->v7m.secure) {
2532 return 0;
2533 }
2534 if (!arm_v7m_is_handler_mode(env) && spsel) {
2535 return env->v7m.other_ss_psp;
2536 } else {
2537 return env->v7m.other_ss_msp;
2538 }
2539 }
2540 default:
2541 break;
2542 }
2543 }
2544
2545 switch (reg) {
2546 case 8: /* MSP */
2547 return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];
2548 case 9: /* PSP */
2549 return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;
2550 case 10: /* MSPLIM */
2551 if (!arm_feature(env, ARM_FEATURE_V8)) {
2552 goto bad_reg;
2553 }
2554 return env->v7m.msplim[env->v7m.secure];
2555 case 11: /* PSPLIM */
2556 if (!arm_feature(env, ARM_FEATURE_V8)) {
2557 goto bad_reg;
2558 }
2559 return env->v7m.psplim[env->v7m.secure];
2560 case 16: /* PRIMASK */
2561 return env->v7m.primask[env->v7m.secure];
2562 case 17: /* BASEPRI */
2563 case 18: /* BASEPRI_MAX */
2564 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2565 goto bad_reg;
2566 }
2567 return env->v7m.basepri[env->v7m.secure];
2568 case 19: /* FAULTMASK */
2569 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2570 goto bad_reg;
2571 }
2572 return env->v7m.faultmask[env->v7m.secure];
2573 default:
2574 bad_reg:
2575 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"
2576 " register %d\n", reg);
2577 return 0;
2578 }
2579 }
2580
2581 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
2582 {
2583 /*
2584 * We're passed bits [11..0] of the instruction; extract
2585 * SYSm and the mask bits.
2586 * Invalid combinations of SYSm and mask are UNPREDICTABLE;
2587 * we choose to treat them as if the mask bits were valid.
2588 * NB that the pseudocode 'mask' variable is bits [11..10],
2589 * whereas ours is [11..8].
2590 */
2591 uint32_t mask = extract32(maskreg, 8, 4);
2592 uint32_t reg = extract32(maskreg, 0, 8);
2593 int cur_el = arm_current_el(env);
2594
2595 if (cur_el == 0 && reg > 7 && reg != 20) {
2596 /*
2597 * only xPSR sub-fields and CONTROL.SFPA may be written by
2598 * unprivileged code
2599 */
2600 return;
2601 }
2602
2603 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2604 switch (reg) {
2605 case 0x88: /* MSP_NS */
2606 if (!env->v7m.secure) {
2607 return;
2608 }
2609 env->v7m.other_ss_msp = val & ~3;
2610 return;
2611 case 0x89: /* PSP_NS */
2612 if (!env->v7m.secure) {
2613 return;
2614 }
2615 env->v7m.other_ss_psp = val & ~3;
2616 return;
2617 case 0x8a: /* MSPLIM_NS */
2618 if (!env->v7m.secure) {
2619 return;
2620 }
2621 env->v7m.msplim[M_REG_NS] = val & ~7;
2622 return;
2623 case 0x8b: /* PSPLIM_NS */
2624 if (!env->v7m.secure) {
2625 return;
2626 }
2627 env->v7m.psplim[M_REG_NS] = val & ~7;
2628 return;
2629 case 0x90: /* PRIMASK_NS */
2630 if (!env->v7m.secure) {
2631 return;
2632 }
2633 env->v7m.primask[M_REG_NS] = val & 1;
2634 return;
2635 case 0x91: /* BASEPRI_NS */
2636 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2637 goto bad_reg;
2638 }
2639 if (!env->v7m.secure) {
2640 return;
2641 }
2642 env->v7m.basepri[M_REG_NS] = val & 0xff;
2643 return;
2644 case 0x93: /* FAULTMASK_NS */
2645 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2646 goto bad_reg;
2647 }
2648 if (!env->v7m.secure) {
2649 return;
2650 }
2651 env->v7m.faultmask[M_REG_NS] = val & 1;
2652 return;
2653 case 0x94: /* CONTROL_NS */
2654 if (!env->v7m.secure) {
2655 return;
2656 }
2657 write_v7m_control_spsel_for_secstate(env,
2658 val & R_V7M_CONTROL_SPSEL_MASK,
2659 M_REG_NS);
2660 if (arm_feature(env, ARM_FEATURE_M_MAIN)) {
2661 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK;
2662 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK;
2663 }
2664 /*
2665 * SFPA is RAZ/WI from NS. FPCA is RO if NSACR.CP10 == 0,
2666 * RES0 if the FPU is not present, and is stored in the S bank
2667 */
2668 if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env)) &&
2669 extract32(env->v7m.nsacr, 10, 1)) {
2670 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2671 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2672 }
2673 return;
2674 case 0x98: /* SP_NS */
2675 {
2676 /*
2677 * This gives the non-secure SP selected based on whether we're
2678 * currently in handler mode or not, using the NS CONTROL.SPSEL.
2679 */
2680 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2681 bool is_psp = !arm_v7m_is_handler_mode(env) && spsel;
2682 uint32_t limit;
2683
2684 if (!env->v7m.secure) {
2685 return;
2686 }
2687
2688 limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
2689
2690 val &= ~0x3;
2691
2692 if (val < limit) {
2693 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
2694 }
2695
2696 if (is_psp) {
2697 env->v7m.other_ss_psp = val;
2698 } else {
2699 env->v7m.other_ss_msp = val;
2700 }
2701 return;
2702 }
2703 default:
2704 break;
2705 }
2706 }
2707
2708 switch (reg) {
2709 case 0 ... 7: /* xPSR sub-fields */
2710 v7m_msr_xpsr(env, mask, reg, val);
2711 break;
2712 case 8: /* MSP */
2713 if (v7m_using_psp(env)) {
2714 env->v7m.other_sp = val & ~3;
2715 } else {
2716 env->regs[13] = val & ~3;
2717 }
2718 break;
2719 case 9: /* PSP */
2720 if (v7m_using_psp(env)) {
2721 env->regs[13] = val & ~3;
2722 } else {
2723 env->v7m.other_sp = val & ~3;
2724 }
2725 break;
2726 case 10: /* MSPLIM */
2727 if (!arm_feature(env, ARM_FEATURE_V8)) {
2728 goto bad_reg;
2729 }
2730 env->v7m.msplim[env->v7m.secure] = val & ~7;
2731 break;
2732 case 11: /* PSPLIM */
2733 if (!arm_feature(env, ARM_FEATURE_V8)) {
2734 goto bad_reg;
2735 }
2736 env->v7m.psplim[env->v7m.secure] = val & ~7;
2737 break;
2738 case 16: /* PRIMASK */
2739 env->v7m.primask[env->v7m.secure] = val & 1;
2740 break;
2741 case 17: /* BASEPRI */
2742 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2743 goto bad_reg;
2744 }
2745 env->v7m.basepri[env->v7m.secure] = val & 0xff;
2746 break;
2747 case 18: /* BASEPRI_MAX */
2748 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2749 goto bad_reg;
2750 }
2751 val &= 0xff;
2752 if (val != 0 && (val < env->v7m.basepri[env->v7m.secure]
2753 || env->v7m.basepri[env->v7m.secure] == 0)) {
2754 env->v7m.basepri[env->v7m.secure] = val;
2755 }
2756 break;
2757 case 19: /* FAULTMASK */
2758 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2759 goto bad_reg;
2760 }
2761 env->v7m.faultmask[env->v7m.secure] = val & 1;
2762 break;
2763 case 20: /* CONTROL */
2764 /*
2765 * Writing to the SPSEL bit only has an effect if we are in
2766 * thread mode; other bits can be updated by any privileged code.
2767 * write_v7m_control_spsel() deals with updating the SPSEL bit in
2768 * env->v7m.control, so we only need update the others.
2769 * For v7M, we must just ignore explicit writes to SPSEL in handler
2770 * mode; for v8M the write is permitted but will have no effect.
2771 * All these bits are writes-ignored from non-privileged code,
2772 * except for SFPA.
2773 */
2774 if (cur_el > 0 && (arm_feature(env, ARM_FEATURE_V8) ||
2775 !arm_v7m_is_handler_mode(env))) {
2776 write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
2777 }
2778 if (cur_el > 0 && arm_feature(env, ARM_FEATURE_M_MAIN)) {
2779 env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
2780 env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
2781 }
2782 if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
2783 /*
2784 * SFPA is RAZ/WI from NS or if no FPU.
2785 * FPCA is RO if NSACR.CP10 == 0, RES0 if the FPU is not present.
2786 * Both are stored in the S bank.
2787 */
2788 if (env->v7m.secure) {
2789 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
2790 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_SFPA_MASK;
2791 }
2792 if (cur_el > 0 &&
2793 (env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_SECURITY) ||
2794 extract32(env->v7m.nsacr, 10, 1))) {
2795 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2796 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2797 }
2798 }
2799 break;
2800 default:
2801 bad_reg:
2802 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
2803 " register %d\n", reg);
2804 return;
2805 }
2806 }
2807
2808 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
2809 {
2810 /* Implement the TT instruction. op is bits [7:6] of the insn. */
2811 bool forceunpriv = op & 1;
2812 bool alt = op & 2;
2813 V8M_SAttributes sattrs = {};
2814 uint32_t tt_resp;
2815 bool r, rw, nsr, nsrw, mrvalid;
2816 ARMMMUIdx mmu_idx;
2817 uint32_t mregion;
2818 bool targetpriv;
2819 bool targetsec = env->v7m.secure;
2820
2821 /*
2822 * Work out what the security state and privilege level we're
2823 * interested in is...
2824 */
2825 if (alt) {
2826 targetsec = !targetsec;
2827 }
2828
2829 if (forceunpriv) {
2830 targetpriv = false;
2831 } else {
2832 targetpriv = arm_v7m_is_handler_mode(env) ||
2833 !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK);
2834 }
2835
2836 /* ...and then figure out which MMU index this is */
2837 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv);
2838
2839 /*
2840 * We know that the MPU and SAU don't care about the access type
2841 * for our purposes beyond that we don't want to claim to be
2842 * an insn fetch, so we arbitrarily call this a read.
2843 */
2844
2845 /*
2846 * MPU region info only available for privileged or if
2847 * inspecting the other MPU state.
2848 */
2849 if (arm_current_el(env) != 0 || alt) {
2850 GetPhysAddrResult res = {};
2851 ARMMMUFaultInfo fi = {};
2852
2853 /* We can ignore the return value as prot is always set */
2854 pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, PAGE_READ, mmu_idx,
2855 targetsec, &res, &fi, &mregion);
2856 if (mregion == -1) {
2857 mrvalid = false;
2858 mregion = 0;
2859 } else {
2860 mrvalid = true;
2861 }
2862 r = res.f.prot & PAGE_READ;
2863 rw = res.f.prot & PAGE_WRITE;
2864 } else {
2865 r = false;
2866 rw = false;
2867 mrvalid = false;
2868 mregion = 0;
2869 }
2870
2871 if (env->v7m.secure) {
2872 /* Note that security check is done as Secure even if alt is true */
2873 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx,
2874 env->v7m.secure, &sattrs);
2875 nsr = sattrs.ns && r;
2876 nsrw = sattrs.ns && rw;
2877 } else {
2878 sattrs.ns = true;
2879 nsr = false;
2880 nsrw = false;
2881 }
2882
2883 tt_resp = (sattrs.iregion << 24) |
2884 (sattrs.irvalid << 23) |
2885 ((!sattrs.ns) << 22) |
2886 (nsrw << 21) |
2887 (nsr << 20) |
2888 (rw << 19) |
2889 (r << 18) |
2890 (sattrs.srvalid << 17) |
2891 (mrvalid << 16) |
2892 (sattrs.sregion << 8) |
2893 mregion;
2894
2895 return tt_resp;
2896 }
2897
2898 #endif /* !CONFIG_USER_ONLY */
2899
2900 uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
2901 bool spsel)
2902 {
2903 /*
2904 * Return a pointer to the location where we currently store the
2905 * stack pointer for the requested security state and thread mode.
2906 * This pointer will become invalid if the CPU state is updated
2907 * such that the stack pointers are switched around (eg changing
2908 * the SPSEL control bit).
2909 * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
2910 * Unlike that pseudocode, we require the caller to pass us in the
2911 * SPSEL control bit value; this is because we also use this
2912 * function in handling of pushing of the callee-saves registers
2913 * part of the v8M stack frame (pseudocode PushCalleeStack()),
2914 * and in the tailchain codepath the SPSEL bit comes from the exception
2915 * return magic LR value from the previous exception. The pseudocode
2916 * opencodes the stack-selection in PushCalleeStack(), but we prefer
2917 * to make this utility function generic enough to do the job.
2918 */
2919 bool want_psp = threadmode && spsel;
2920
2921 if (secure == env->v7m.secure) {
2922 if (want_psp == v7m_using_psp(env)) {
2923 return &env->regs[13];
2924 } else {
2925 return &env->v7m.other_sp;
2926 }
2927 } else {
2928 if (want_psp) {
2929 return &env->v7m.other_ss_psp;
2930 } else {
2931 return &env->v7m.other_ss_msp;
2932 }
2933 }
2934 }