1/*
2 * ARM generic helpers.
3 *
4 * This code is licensed under the GNU GPL v2 or later.
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9#include "qemu/osdep.h"
10#include "qemu/units.h"
11#include "target/arm/idau.h"
12#include "trace.h"
13#include "cpu.h"
14#include "internals.h"
15#include "exec/gdbstub.h"
16#include "exec/helper-proto.h"
17#include "qemu/host-utils.h"
18#include "qemu/main-loop.h"
19#include "qemu/bitops.h"
20#include "qemu/crc32c.h"
21#include "qemu/qemu-print.h"
22#include "exec/exec-all.h"
23#include <zlib.h> /* For crc32 */
24#include "hw/semihosting/semihost.h"
25#include "sysemu/cpus.h"
26#include "sysemu/kvm.h"
27#include "qemu/range.h"
28#include "qapi/qapi-commands-machine-target.h"
29#include "qapi/error.h"
30#include "qemu/guest-random.h"
31#ifdef CONFIG_TCG
32#include "arm_ldst.h"
33#include "exec/cpu_ldst.h"
34#endif
35
36#ifdef CONFIG_USER_ONLY
37
38/* These should probably raise undefined insn exceptions. */
39void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
40{
41 ARMCPU *cpu = env_archcpu(env);
42
43 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg);
44}
45
46uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
47{
48 ARMCPU *cpu = env_archcpu(env);
49
50 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg);
51 return 0;
52}
53
54void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
55{
56 /* translate.c should never generate calls here in user-only mode */
57 g_assert_not_reached();
58}
59
60void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
61{
62 /* translate.c should never generate calls here in user-only mode */
63 g_assert_not_reached();
64}
65
66void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
67{
68 /* translate.c should never generate calls here in user-only mode */
69 g_assert_not_reached();
70}
71
72void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
73{
74 /* translate.c should never generate calls here in user-only mode */
75 g_assert_not_reached();
76}
77
78void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
79{
80 /* translate.c should never generate calls here in user-only mode */
81 g_assert_not_reached();
82}
83
84uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
85{
86 /*
87 * The TT instructions can be used by unprivileged code, but in
88 * user-only emulation we don't have the MPU.
89 * Luckily since we know we are NonSecure unprivileged (and that in
90 * turn means that the A flag wasn't specified), all the bits in the
91 * register must be zero:
92 * IREGION: 0 because IRVALID is 0
93 * IRVALID: 0 because NS
94 * S: 0 because NS
95 * NSRW: 0 because NS
96 * NSR: 0 because NS
97 * RW: 0 because unpriv and A flag not set
98 * R: 0 because unpriv and A flag not set
99 * SRVALID: 0 because NS
100 * MRVALID: 0 because unpriv and A flag not set
101 * SREGION: 0 becaus SRVALID is 0
102 * MREGION: 0 because MRVALID is 0
103 */
104 return 0;
105}
106
107#else
108
109/*
110 * What kind of stack write are we doing? This affects how exceptions
111 * generated during the stacking are treated.
112 */
113typedef enum StackingMode {
114 STACK_NORMAL,
115 STACK_IGNFAULTS,
116 STACK_LAZYFP,
117} StackingMode;
118
119static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
120 ARMMMUIdx mmu_idx, StackingMode mode)
121{
122 CPUState *cs = CPU(cpu);
123 CPUARMState *env = &cpu->env;
124 MemTxAttrs attrs = {};
125 MemTxResult txres;
126 target_ulong page_size;
127 hwaddr physaddr;
128 int prot;
129 ARMMMUFaultInfo fi = {};
130 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
131 int exc;
132 bool exc_secure;
133
134 if (get_phys_addr(env, addr, MMU_DATA_STORE, mmu_idx, &physaddr,
135 &attrs, &prot, &page_size, &fi, NULL)) {
136 /* MPU/SAU lookup failed */
137 if (fi.type == ARMFault_QEMU_SFault) {
138 if (mode == STACK_LAZYFP) {
139 qemu_log_mask(CPU_LOG_INT,
140 "...SecureFault with SFSR.LSPERR "
141 "during lazy stacking\n");
142 env->v7m.sfsr |= R_V7M_SFSR_LSPERR_MASK;
143 } else {
144 qemu_log_mask(CPU_LOG_INT,
145 "...SecureFault with SFSR.AUVIOL "
146 "during stacking\n");
147 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
148 }
149 env->v7m.sfsr |= R_V7M_SFSR_SFARVALID_MASK;
150 env->v7m.sfar = addr;
151 exc = ARMV7M_EXCP_SECURE;
152 exc_secure = false;
153 } else {
154 if (mode == STACK_LAZYFP) {
155 qemu_log_mask(CPU_LOG_INT,
156 "...MemManageFault with CFSR.MLSPERR\n");
157 env->v7m.cfsr[secure] |= R_V7M_CFSR_MLSPERR_MASK;
158 } else {
159 qemu_log_mask(CPU_LOG_INT,
160 "...MemManageFault with CFSR.MSTKERR\n");
161 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK;
162 }
163 exc = ARMV7M_EXCP_MEM;
164 exc_secure = secure;
165 }
166 goto pend_fault;
167 }
168 address_space_stl_le(arm_addressspace(cs, attrs), physaddr, value,
169 attrs, &txres);
170 if (txres != MEMTX_OK) {
171 /* BusFault trying to write the data */
172 if (mode == STACK_LAZYFP) {
173 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.LSPERR\n");
174 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_LSPERR_MASK;
175 } else {
176 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n");
177 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK;
178 }
179 exc = ARMV7M_EXCP_BUS;
180 exc_secure = false;
181 goto pend_fault;
182 }
183 return true;
184
185pend_fault:
186 /*
187 * By pending the exception at this point we are making
188 * the IMPDEF choice "overridden exceptions pended" (see the
189 * MergeExcInfo() pseudocode). The other choice would be to not
190 * pend them now and then make a choice about which to throw away
191 * later if we have two derived exceptions.
192 * The only case when we must not pend the exception but instead
193 * throw it away is if we are doing the push of the callee registers
194 * and we've already generated a derived exception (this is indicated
195 * by the caller passing STACK_IGNFAULTS). Even in this case we will
196 * still update the fault status registers.
197 */
198 switch (mode) {
199 case STACK_NORMAL:
200 armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure);
201 break;
202 case STACK_LAZYFP:
203 armv7m_nvic_set_pending_lazyfp(env->nvic, exc, exc_secure);
204 break;
205 case STACK_IGNFAULTS:
206 break;
207 }
208 return false;
209}
210
211static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
212 ARMMMUIdx mmu_idx)
213{
214 CPUState *cs = CPU(cpu);
215 CPUARMState *env = &cpu->env;
216 MemTxAttrs attrs = {};
217 MemTxResult txres;
218 target_ulong page_size;
219 hwaddr physaddr;
220 int prot;
221 ARMMMUFaultInfo fi = {};
222 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
223 int exc;
224 bool exc_secure;
225 uint32_t value;
226
227 if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr,
228 &attrs, &prot, &page_size, &fi, NULL)) {
229 /* MPU/SAU lookup failed */
230 if (fi.type == ARMFault_QEMU_SFault) {
231 qemu_log_mask(CPU_LOG_INT,
232 "...SecureFault with SFSR.AUVIOL during unstack\n");
233 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
234 env->v7m.sfar = addr;
235 exc = ARMV7M_EXCP_SECURE;
236 exc_secure = false;
237 } else {
238 qemu_log_mask(CPU_LOG_INT,
239 "...MemManageFault with CFSR.MUNSTKERR\n");
240 env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK;
241 exc = ARMV7M_EXCP_MEM;
242 exc_secure = secure;
243 }
244 goto pend_fault;
245 }
246
247 value = address_space_ldl(arm_addressspace(cs, attrs), physaddr,
248 attrs, &txres);
249 if (txres != MEMTX_OK) {
250 /* BusFault trying to read the data */
251 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n");
252 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK;
253 exc = ARMV7M_EXCP_BUS;
254 exc_secure = false;
255 goto pend_fault;
256 }
257
258 *dest = value;
259 return true;
260
261pend_fault:
262 /*
263 * By pending the exception at this point we are making
264 * the IMPDEF choice "overridden exceptions pended" (see the
265 * MergeExcInfo() pseudocode). The other choice would be to not
266 * pend them now and then make a choice about which to throw away
267 * later if we have two derived exceptions.
268 */
269 armv7m_nvic_set_pending(env->nvic, exc, exc_secure);
270 return false;
271}
272
273void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
274{
275 /*
276 * Preserve FP state (because LSPACT was set and we are about
277 * to execute an FP instruction). This corresponds to the
278 * PreserveFPState() pseudocode.
279 * We may throw an exception if the stacking fails.
280 */
281 ARMCPU *cpu = env_archcpu(env);
282 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
283 bool negpri = !(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_HFRDY_MASK);
284 bool is_priv = !(env->v7m.fpccr[is_secure] & R_V7M_FPCCR_USER_MASK);
285 bool splimviol = env->v7m.fpccr[is_secure] & R_V7M_FPCCR_SPLIMVIOL_MASK;
286 uint32_t fpcar = env->v7m.fpcar[is_secure];
287 bool stacked_ok = true;
288 bool ts = is_secure && (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
289 bool take_exception;
290
291 /* Take the iothread lock as we are going to touch the NVIC */
292 qemu_mutex_lock_iothread();
293
294 /* Check the background context had access to the FPU */
295 if (!v7m_cpacr_pass(env, is_secure, is_priv)) {
296 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, is_secure);
297 env->v7m.cfsr[is_secure] |= R_V7M_CFSR_NOCP_MASK;
298 stacked_ok = false;
299 } else if (!is_secure && !extract32(env->v7m.nsacr, 10, 1)) {
300 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
301 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
302 stacked_ok = false;
303 }
304
305 if (!splimviol && stacked_ok) {
306 /* We only stack if the stack limit wasn't violated */
307 int i;
308 ARMMMUIdx mmu_idx;
309
310 mmu_idx = arm_v7m_mmu_idx_all(env, is_secure, is_priv, negpri);
311 for (i = 0; i < (ts ? 32 : 16); i += 2) {
312 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
313 uint32_t faddr = fpcar + 4 * i;
314 uint32_t slo = extract64(dn, 0, 32);
315 uint32_t shi = extract64(dn, 32, 32);
316
317 if (i >= 16) {
318 faddr += 8; /* skip the slot for the FPSCR */
319 }
320 stacked_ok = stacked_ok &&
321 v7m_stack_write(cpu, faddr, slo, mmu_idx, STACK_LAZYFP) &&
322 v7m_stack_write(cpu, faddr + 4, shi, mmu_idx, STACK_LAZYFP);
323 }
324
325 stacked_ok = stacked_ok &&
326 v7m_stack_write(cpu, fpcar + 0x40,
327 vfp_get_fpscr(env), mmu_idx, STACK_LAZYFP);
328 }
329
330 /*
331 * We definitely pended an exception, but it's possible that it
332 * might not be able to be taken now. If its priority permits us
333 * to take it now, then we must not update the LSPACT or FP regs,
334 * but instead jump out to take the exception immediately.
335 * If it's just pending and won't be taken until the current
336 * handler exits, then we do update LSPACT and the FP regs.
337 */
338 take_exception = !stacked_ok &&
339 armv7m_nvic_can_take_pending_exception(env->nvic);
340
341 qemu_mutex_unlock_iothread();
342
343 if (take_exception) {
344 raise_exception_ra(env, EXCP_LAZYFP, 0, 1, GETPC());
345 }
346
347 env->v7m.fpccr[is_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
348
349 if (ts) {
350 /* Clear s0 to s31 and the FPSCR */
351 int i;
352
353 for (i = 0; i < 32; i += 2) {
354 *aa32_vfp_dreg(env, i / 2) = 0;
355 }
356 vfp_set_fpscr(env, 0);
357 }
358 /*
359 * Otherwise s0 to s15 and FPSCR are UNKNOWN; we choose to leave them
360 * unchanged.
361 */
362}
363
364/*
365 * Write to v7M CONTROL.SPSEL bit for the specified security bank.
366 * This may change the current stack pointer between Main and Process
367 * stack pointers if it is done for the CONTROL register for the current
368 * security state.
369 */
370static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
371 bool new_spsel,
372 bool secstate)
373{
374 bool old_is_psp = v7m_using_psp(env);
375
376 env->v7m.control[secstate] =
377 deposit32(env->v7m.control[secstate],
378 R_V7M_CONTROL_SPSEL_SHIFT,
379 R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
380
381 if (secstate == env->v7m.secure) {
382 bool new_is_psp = v7m_using_psp(env);
383 uint32_t tmp;
384
385 if (old_is_psp != new_is_psp) {
386 tmp = env->v7m.other_sp;
387 env->v7m.other_sp = env->regs[13];
388 env->regs[13] = tmp;
389 }
390 }
391}
392
393/*
394 * Write to v7M CONTROL.SPSEL bit. This may change the current
395 * stack pointer between Main and Process stack pointers.
396 */
397static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
398{
399 write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
400}
401
402void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
403{
404 /*
405 * Write a new value to v7m.exception, thus transitioning into or out
406 * of Handler mode; this may result in a change of active stack pointer.
407 */
408 bool new_is_psp, old_is_psp = v7m_using_psp(env);
409 uint32_t tmp;
410
411 env->v7m.exception = new_exc;
412
413 new_is_psp = v7m_using_psp(env);
414
415 if (old_is_psp != new_is_psp) {
416 tmp = env->v7m.other_sp;
417 env->v7m.other_sp = env->regs[13];
418 env->regs[13] = tmp;
419 }
420}
421
422/* Switch M profile security state between NS and S */
423static void switch_v7m_security_state(CPUARMState *env, bool new_secstate)
424{
425 uint32_t new_ss_msp, new_ss_psp;
426
427 if (env->v7m.secure == new_secstate) {
428 return;
429 }
430
431 /*
432 * All the banked state is accessed by looking at env->v7m.secure
433 * except for the stack pointer; rearrange the SP appropriately.
434 */
435 new_ss_msp = env->v7m.other_ss_msp;
436 new_ss_psp = env->v7m.other_ss_psp;
437
438 if (v7m_using_psp(env)) {
439 env->v7m.other_ss_psp = env->regs[13];
440 env->v7m.other_ss_msp = env->v7m.other_sp;
441 } else {
442 env->v7m.other_ss_msp = env->regs[13];
443 env->v7m.other_ss_psp = env->v7m.other_sp;
444 }
445
446 env->v7m.secure = new_secstate;
447
448 if (v7m_using_psp(env)) {
449 env->regs[13] = new_ss_psp;
450 env->v7m.other_sp = new_ss_msp;
451 } else {
452 env->regs[13] = new_ss_msp;
453 env->v7m.other_sp = new_ss_psp;
454 }
455}
456
457void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
458{
459 /*
460 * Handle v7M BXNS:
461 * - if the return value is a magic value, do exception return (like BX)
462 * - otherwise bit 0 of the return value is the target security state
463 */
464 uint32_t min_magic;
465
466 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
467 /* Covers FNC_RETURN and EXC_RETURN magic */
468 min_magic = FNC_RETURN_MIN_MAGIC;
469 } else {
470 /* EXC_RETURN magic only */
471 min_magic = EXC_RETURN_MIN_MAGIC;
472 }
473
474 if (dest >= min_magic) {
475 /*
476 * This is an exception return magic value; put it where
477 * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT.
478 * Note that if we ever add gen_ss_advance() singlestep support to
479 * M profile this should count as an "instruction execution complete"
480 * event (compare gen_bx_excret_final_code()).
481 */
482 env->regs[15] = dest & ~1;
483 env->thumb = dest & 1;
484 HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT);
485 /* notreached */
486 }
487
488 /* translate.c should have made BXNS UNDEF unless we're secure */
489 assert(env->v7m.secure);
490
491 if (!(dest & 1)) {
492 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
493 }
494 switch_v7m_security_state(env, dest & 1);
495 env->thumb = 1;
496 env->regs[15] = dest & ~1;
497}
498
499void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
500{
501 /*
502 * Handle v7M BLXNS:
503 * - bit 0 of the destination address is the target security state
504 */
505
506 /* At this point regs[15] is the address just after the BLXNS */
507 uint32_t nextinst = env->regs[15] | 1;
508 uint32_t sp = env->regs[13] - 8;
509 uint32_t saved_psr;
510
511 /* translate.c will have made BLXNS UNDEF unless we're secure */
512 assert(env->v7m.secure);
513
514 if (dest & 1) {
515 /*
516 * Target is Secure, so this is just a normal BLX,
517 * except that the low bit doesn't indicate Thumb/not.
518 */
519 env->regs[14] = nextinst;
520 env->thumb = 1;
521 env->regs[15] = dest & ~1;
522 return;
523 }
524
525 /* Target is non-secure: first push a stack frame */
526 if (!QEMU_IS_ALIGNED(sp, 8)) {
527 qemu_log_mask(LOG_GUEST_ERROR,
528 "BLXNS with misaligned SP is UNPREDICTABLE\n");
529 }
530
531 if (sp < v7m_sp_limit(env)) {
532 raise_exception(env, EXCP_STKOF, 0, 1);
533 }
534
535 saved_psr = env->v7m.exception;
536 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
537 saved_psr |= XPSR_SFPA;
538 }
539
540 /* Note that these stores can throw exceptions on MPU faults */
541 cpu_stl_data_ra(env, sp, nextinst, GETPC());
542 cpu_stl_data_ra(env, sp + 4, saved_psr, GETPC());
543
544 env->regs[13] = sp;
545 env->regs[14] = 0xfeffffff;
546 if (arm_v7m_is_handler_mode(env)) {
547 /*
548 * Write a dummy value to IPSR, to avoid leaking the current secure
549 * exception number to non-secure code. This is guaranteed not
550 * to cause write_v7m_exception() to actually change stacks.
551 */
552 write_v7m_exception(env, 1);
553 }
554 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
555 switch_v7m_security_state(env, 0);
556 env->thumb = 1;
557 env->regs[15] = dest;
558}
559
560static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
561 bool spsel)
562{
563 /*
564 * Return a pointer to the location where we currently store the
565 * stack pointer for the requested security state and thread mode.
566 * This pointer will become invalid if the CPU state is updated
567 * such that the stack pointers are switched around (eg changing
568 * the SPSEL control bit).
569 * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
570 * Unlike that pseudocode, we require the caller to pass us in the
571 * SPSEL control bit value; this is because we also use this
572 * function in handling of pushing of the callee-saves registers
573 * part of the v8M stack frame (pseudocode PushCalleeStack()),
574 * and in the tailchain codepath the SPSEL bit comes from the exception
575 * return magic LR value from the previous exception. The pseudocode
576 * opencodes the stack-selection in PushCalleeStack(), but we prefer
577 * to make this utility function generic enough to do the job.
578 */
579 bool want_psp = threadmode && spsel;
580
581 if (secure == env->v7m.secure) {
582 if (want_psp == v7m_using_psp(env)) {
583 return &env->regs[13];
584 } else {
585 return &env->v7m.other_sp;
586 }
587 } else {
588 if (want_psp) {
589 return &env->v7m.other_ss_psp;
590 } else {
591 return &env->v7m.other_ss_msp;
592 }
593 }
594}
595
596static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
597 uint32_t *pvec)
598{
599 CPUState *cs = CPU(cpu);
600 CPUARMState *env = &cpu->env;
601 MemTxResult result;
602 uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4;
603 uint32_t vector_entry;
604 MemTxAttrs attrs = {};
605 ARMMMUIdx mmu_idx;
606 bool exc_secure;
607
608 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
609
610 /*
611 * We don't do a get_phys_addr() here because the rules for vector
612 * loads are special: they always use the default memory map, and
613 * the default memory map permits reads from all addresses.
614 * Since there's no easy way to pass through to pmsav8_mpu_lookup()
615 * that we want this special case which would always say "yes",
616 * we just do the SAU lookup here followed by a direct physical load.
617 */
618 attrs.secure = targets_secure;
619 attrs.user = false;
620
621 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
622 V8M_SAttributes sattrs = {};
623
624 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs);
625 if (sattrs.ns) {
626 attrs.secure = false;
627 } else if (!targets_secure) {
628 /*
629 * NS access to S memory: the underlying exception which we escalate
630 * to HardFault is SecureFault, which always targets Secure.
631 */
632 exc_secure = true;
633 goto load_fail;
634 }
635 }
636
637 vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
638 attrs, &result);
639 if (result != MEMTX_OK) {
640 /*
641 * Underlying exception is BusFault: its target security state
642 * depends on BFHFNMINS.
643 */
644 exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
645 goto load_fail;
646 }
647 *pvec = vector_entry;
648 return true;
649
650load_fail:
651 /*
652 * All vector table fetch fails are reported as HardFault, with
653 * HFSR.VECTTBL and .FORCED set. (FORCED is set because
654 * technically the underlying exception is a SecureFault or BusFault
655 * that is escalated to HardFault.) This is a terminal exception,
656 * so we will either take the HardFault immediately or else enter
657 * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
658 * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
659 * secure); otherwise it targets the same security state as the
660 * underlying exception.
661 */
662 if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
663 exc_secure = true;
664 }
665 env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
666 armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
667 return false;
668}
669
670static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr)
671{
672 /*
673 * Return the integrity signature value for the callee-saves
674 * stack frame section. @lr is the exception return payload/LR value
675 * whose FType bit forms bit 0 of the signature if FP is present.
676 */
677 uint32_t sig = 0xfefa125a;
678
679 if (!arm_feature(env, ARM_FEATURE_VFP) || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
680 sig |= 1;
681 }
682 return sig;
683}
684
685static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
686 bool ignore_faults)
687{
688 /*
689 * For v8M, push the callee-saves register part of the stack frame.
690 * Compare the v8M pseudocode PushCalleeStack().
691 * In the tailchaining case this may not be the current stack.
692 */
693 CPUARMState *env = &cpu->env;
694 uint32_t *frame_sp_p;
695 uint32_t frameptr;
696 ARMMMUIdx mmu_idx;
697 bool stacked_ok;
698 uint32_t limit;
699 bool want_psp;
700 uint32_t sig;
701 StackingMode smode = ignore_faults ? STACK_IGNFAULTS : STACK_NORMAL;
702
703 if (dotailchain) {
704 bool mode = lr & R_V7M_EXCRET_MODE_MASK;
705 bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) ||
706 !mode;
707
708 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
709 frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,
710 lr & R_V7M_EXCRET_SPSEL_MASK);
711 want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
712 if (want_psp) {
713 limit = env->v7m.psplim[M_REG_S];
714 } else {
715 limit = env->v7m.msplim[M_REG_S];
716 }
717 } else {
718 mmu_idx = arm_mmu_idx(env);
719 frame_sp_p = &env->regs[13];
720 limit = v7m_sp_limit(env);
721 }
722
723 frameptr = *frame_sp_p - 0x28;
724 if (frameptr < limit) {
725 /*
726 * Stack limit failure: set SP to the limit value, and generate
727 * STKOF UsageFault. Stack pushes below the limit must not be
728 * performed. It is IMPDEF whether pushes above the limit are
729 * performed; we choose not to.
730 */
731 qemu_log_mask(CPU_LOG_INT,
732 "...STKOF during callee-saves register stacking\n");
733 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
734 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
735 env->v7m.secure);
736 *frame_sp_p = limit;
737 return true;
738 }
739
740 /*
741 * Write as much of the stack frame as we can. A write failure may
742 * cause us to pend a derived exception.
743 */
744 sig = v7m_integrity_sig(env, lr);
745 stacked_ok =
746 v7m_stack_write(cpu, frameptr, sig, mmu_idx, smode) &&
747 v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx, smode) &&
748 v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx, smode) &&
749 v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx, smode) &&
750 v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx, smode) &&
751 v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx, smode) &&
752 v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx, smode) &&
753 v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx, smode) &&
754 v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx, smode);
755
756 /* Update SP regardless of whether any of the stack accesses failed. */
757 *frame_sp_p = frameptr;
758
759 return !stacked_ok;
760}
761
762static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
763 bool ignore_stackfaults)
764{
765 /*
766 * Do the "take the exception" parts of exception entry,
767 * but not the pushing of state to the stack. This is
768 * similar to the pseudocode ExceptionTaken() function.
769 */
770 CPUARMState *env = &cpu->env;
771 uint32_t addr;
772 bool targets_secure;
773 int exc;
774 bool push_failed = false;
775
776 armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure);
777 qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n",
778 targets_secure ? "secure" : "nonsecure", exc);
779
780 if (dotailchain) {
781 /* Sanitize LR FType and PREFIX bits */
782 if (!arm_feature(env, ARM_FEATURE_VFP)) {
783 lr |= R_V7M_EXCRET_FTYPE_MASK;
784 }
785 lr = deposit32(lr, 24, 8, 0xff);
786 }
787
788 if (arm_feature(env, ARM_FEATURE_V8)) {
789 if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
790 (lr & R_V7M_EXCRET_S_MASK)) {
791 /*
792 * The background code (the owner of the registers in the
793 * exception frame) is Secure. This means it may either already
794 * have or now needs to push callee-saves registers.
795 */
796 if (targets_secure) {
797 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
798 /*
799 * We took an exception from Secure to NonSecure
800 * (which means the callee-saved registers got stacked)
801 * and are now tailchaining to a Secure exception.
802 * Clear DCRS so eventual return from this Secure
803 * exception unstacks the callee-saved registers.
804 */
805 lr &= ~R_V7M_EXCRET_DCRS_MASK;
806 }
807 } else {
808 /*
809 * We're going to a non-secure exception; push the
810 * callee-saves registers to the stack now, if they're
811 * not already saved.
812 */
813 if (lr & R_V7M_EXCRET_DCRS_MASK &&
814 !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) {
815 push_failed = v7m_push_callee_stack(cpu, lr, dotailchain,
816 ignore_stackfaults);
817 }
818 lr |= R_V7M_EXCRET_DCRS_MASK;
819 }
820 }
821
822 lr &= ~R_V7M_EXCRET_ES_MASK;
823 if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) {
824 lr |= R_V7M_EXCRET_ES_MASK;
825 }
826 lr &= ~R_V7M_EXCRET_SPSEL_MASK;
827 if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
828 lr |= R_V7M_EXCRET_SPSEL_MASK;
829 }
830
831 /*
832 * Clear registers if necessary to prevent non-secure exception
833 * code being able to see register values from secure code.
834 * Where register values become architecturally UNKNOWN we leave
835 * them with their previous values.
836 */
837 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
838 if (!targets_secure) {
839 /*
840 * Always clear the caller-saved registers (they have been
841 * pushed to the stack earlier in v7m_push_stack()).
842 * Clear callee-saved registers if the background code is
843 * Secure (in which case these regs were saved in
844 * v7m_push_callee_stack()).
845 */
846 int i;
847
848 for (i = 0; i < 13; i++) {
849 /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */
850 if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) {
851 env->regs[i] = 0;
852 }
853 }
854 /* Clear EAPSR */
855 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
856 }
857 }
858 }
859
860 if (push_failed && !ignore_stackfaults) {
861 /*
862 * Derived exception on callee-saves register stacking:
863 * we might now want to take a different exception which
864 * targets a different security state, so try again from the top.
865 */
866 qemu_log_mask(CPU_LOG_INT,
867 "...derived exception on callee-saves register stacking");
868 v7m_exception_taken(cpu, lr, true, true);
869 return;
870 }
871
872 if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) {
873 /* Vector load failed: derived exception */
874 qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load");
875 v7m_exception_taken(cpu, lr, true, true);
876 return;
877 }
878
879 /*
880 * Now we've done everything that might cause a derived exception
881 * we can go ahead and activate whichever exception we're going to
882 * take (which might now be the derived exception).
883 */
884 armv7m_nvic_acknowledge_irq(env->nvic);
885
886 /* Switch to target security state -- must do this before writing SPSEL */
887 switch_v7m_security_state(env, targets_secure);
888 write_v7m_control_spsel(env, 0);
889 arm_clear_exclusive(env);
890 /* Clear SFPA and FPCA (has no effect if no FPU) */
891 env->v7m.control[M_REG_S] &=
892 ~(R_V7M_CONTROL_FPCA_MASK | R_V7M_CONTROL_SFPA_MASK);
893 /* Clear IT bits */
894 env->condexec_bits = 0;
895 env->regs[14] = lr;
896 env->regs[15] = addr & 0xfffffffe;
897 env->thumb = addr & 1;
898}
899
900static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr,
901 bool apply_splim)
902{
903 /*
904 * Like the pseudocode UpdateFPCCR: save state in FPCAR and FPCCR
905 * that we will need later in order to do lazy FP reg stacking.
906 */
907 bool is_secure = env->v7m.secure;
908 void *nvic = env->nvic;
909 /*
910 * Some bits are unbanked and live always in fpccr[M_REG_S]; some bits
911 * are banked and we want to update the bit in the bank for the
912 * current security state; and in one case we want to specifically
913 * update the NS banked version of a bit even if we are secure.
914 */
915 uint32_t *fpccr_s = &env->v7m.fpccr[M_REG_S];
916 uint32_t *fpccr_ns = &env->v7m.fpccr[M_REG_NS];
917 uint32_t *fpccr = &env->v7m.fpccr[is_secure];
918 bool hfrdy, bfrdy, mmrdy, ns_ufrdy, s_ufrdy, sfrdy, monrdy;
919
920 env->v7m.fpcar[is_secure] = frameptr & ~0x7;
921
922 if (apply_splim && arm_feature(env, ARM_FEATURE_V8)) {
923 bool splimviol;
924 uint32_t splim = v7m_sp_limit(env);
925 bool ign = armv7m_nvic_neg_prio_requested(nvic, is_secure) &&
926 (env->v7m.ccr[is_secure] & R_V7M_CCR_STKOFHFNMIGN_MASK);
927
928 splimviol = !ign && frameptr < splim;
929 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, SPLIMVIOL, splimviol);
930 }
931
932 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, LSPACT, 1);
933
934 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, S, is_secure);
935
936 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, USER, arm_current_el(env) == 0);
937
938 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, THREAD,
939 !arm_v7m_is_handler_mode(env));
940
941 hfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_HARD, false);
942 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, HFRDY, hfrdy);
943
944 bfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_BUS, false);
945 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, BFRDY, bfrdy);
946
947 mmrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_MEM, is_secure);
948 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, MMRDY, mmrdy);
949
950 ns_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, false);
951 *fpccr_ns = FIELD_DP32(*fpccr_ns, V7M_FPCCR, UFRDY, ns_ufrdy);
952
953 monrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_DEBUG, false);
954 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, MONRDY, monrdy);
955
956 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
957 s_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, true);
958 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, UFRDY, s_ufrdy);
959
960 sfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_SECURE, false);
961 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, SFRDY, sfrdy);
962 }
963}
964
965void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
966{
967 /* fptr is the value of Rn, the frame pointer we store the FP regs to */
968 bool s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
969 bool lspact = env->v7m.fpccr[s] & R_V7M_FPCCR_LSPACT_MASK;
970 uintptr_t ra = GETPC();
971
972 assert(env->v7m.secure);
973
974 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
975 return;
976 }
977
978 /* Check access to the coprocessor is permitted */
979 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
980 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
981 }
982
983 if (lspact) {
984 /* LSPACT should not be active when there is active FP state */
985 raise_exception_ra(env, EXCP_LSERR, 0, 1, GETPC());
986 }
987
988 if (fptr & 7) {
989 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
990 }
991
992 /*
993 * Note that we do not use v7m_stack_write() here, because the
994 * accesses should not set the FSR bits for stacking errors if they
995 * fail. (In pseudocode terms, they are AccType_NORMAL, not AccType_STACK
996 * or AccType_LAZYFP). Faults in cpu_stl_data_ra() will throw exceptions
997 * and longjmp out.
998 */
999 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1000 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1001 int i;
1002
1003 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1004 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1005 uint32_t faddr = fptr + 4 * i;
1006 uint32_t slo = extract64(dn, 0, 32);
1007 uint32_t shi = extract64(dn, 32, 32);
1008
1009 if (i >= 16) {
1010 faddr += 8; /* skip the slot for the FPSCR */
1011 }
1012 cpu_stl_data_ra(env, faddr, slo, ra);
1013 cpu_stl_data_ra(env, faddr + 4, shi, ra);
1014 }
1015 cpu_stl_data_ra(env, fptr + 0x40, vfp_get_fpscr(env), ra);
1016
1017 /*
1018 * If TS is 0 then s0 to s15 and FPSCR are UNKNOWN; we choose to
1019 * leave them unchanged, matching our choice in v7m_preserve_fp_state.
1020 */
1021 if (ts) {
1022 for (i = 0; i < 32; i += 2) {
1023 *aa32_vfp_dreg(env, i / 2) = 0;
1024 }
1025 vfp_set_fpscr(env, 0);
1026 }
1027 } else {
1028 v7m_update_fpccr(env, fptr, false);
1029 }
1030
1031 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
1032}
1033
1034void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
1035{
1036 uintptr_t ra = GETPC();
1037
1038 /* fptr is the value of Rn, the frame pointer we load the FP regs from */
1039 assert(env->v7m.secure);
1040
1041 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1042 return;
1043 }
1044
1045 /* Check access to the coprocessor is permitted */
1046 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
1047 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
1048 }
1049
1050 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1051 /* State in FP is still valid */
1052 env->v7m.fpccr[M_REG_S] &= ~R_V7M_FPCCR_LSPACT_MASK;
1053 } else {
1054 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1055 int i;
1056 uint32_t fpscr;
1057
1058 if (fptr & 7) {
1059 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
1060 }
1061
1062 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1063 uint32_t slo, shi;
1064 uint64_t dn;
1065 uint32_t faddr = fptr + 4 * i;
1066
1067 if (i >= 16) {
1068 faddr += 8; /* skip the slot for the FPSCR */
1069 }
1070
1071 slo = cpu_ldl_data_ra(env, faddr, ra);
1072 shi = cpu_ldl_data_ra(env, faddr + 4, ra);
1073
1074 dn = (uint64_t) shi << 32 | slo;
1075 *aa32_vfp_dreg(env, i / 2) = dn;
1076 }
1077 fpscr = cpu_ldl_data_ra(env, fptr + 0x40, ra);
1078 vfp_set_fpscr(env, fpscr);
1079 }
1080
1081 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK;
1082}
1083
1084static bool v7m_push_stack(ARMCPU *cpu)
1085{
1086 /*
1087 * Do the "set up stack frame" part of exception entry,
1088 * similar to pseudocode PushStack().
1089 * Return true if we generate a derived exception (and so
1090 * should ignore further stack faults trying to process
1091 * that derived exception.)
1092 */
1093 bool stacked_ok = true, limitviol = false;
1094 CPUARMState *env = &cpu->env;
1095 uint32_t xpsr = xpsr_read(env);
1096 uint32_t frameptr = env->regs[13];
1097 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1098 uint32_t framesize;
1099 bool nsacr_cp10 = extract32(env->v7m.nsacr, 10, 1);
1100
1101 if ((env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) &&
1102 (env->v7m.secure || nsacr_cp10)) {
1103 if (env->v7m.secure &&
1104 env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK) {
1105 framesize = 0xa8;
1106 } else {
1107 framesize = 0x68;
1108 }
1109 } else {
1110 framesize = 0x20;
1111 }
1112
1113 /* Align stack pointer if the guest wants that */
1114 if ((frameptr & 4) &&
1115 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) {
1116 frameptr -= 4;
1117 xpsr |= XPSR_SPREALIGN;
1118 }
1119
1120 xpsr &= ~XPSR_SFPA;
1121 if (env->v7m.secure &&
1122 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1123 xpsr |= XPSR_SFPA;
1124 }
1125
1126 frameptr -= framesize;
1127
1128 if (arm_feature(env, ARM_FEATURE_V8)) {
1129 uint32_t limit = v7m_sp_limit(env);
1130
1131 if (frameptr < limit) {
1132 /*
1133 * Stack limit failure: set SP to the limit value, and generate
1134 * STKOF UsageFault. Stack pushes below the limit must not be
1135 * performed. It is IMPDEF whether pushes above the limit are
1136 * performed; we choose not to.
1137 */
1138 qemu_log_mask(CPU_LOG_INT,
1139 "...STKOF during stacking\n");
1140 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
1141 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1142 env->v7m.secure);
1143 env->regs[13] = limit;
1144 /*
1145 * We won't try to perform any further memory accesses but
1146 * we must continue through the following code to check for
1147 * permission faults during FPU state preservation, and we
1148 * must update FPCCR if lazy stacking is enabled.
1149 */
1150 limitviol = true;
1151 stacked_ok = false;
1152 }
1153 }
1154
1155 /*
1156 * Write as much of the stack frame as we can. If we fail a stack
1157 * write this will result in a derived exception being pended
1158 * (which may be taken in preference to the one we started with
1159 * if it has higher priority).
1160 */
1161 stacked_ok = stacked_ok &&
1162 v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, STACK_NORMAL) &&
1163 v7m_stack_write(cpu, frameptr + 4, env->regs[1],
1164 mmu_idx, STACK_NORMAL) &&
1165 v7m_stack_write(cpu, frameptr + 8, env->regs[2],
1166 mmu_idx, STACK_NORMAL) &&
1167 v7m_stack_write(cpu, frameptr + 12, env->regs[3],
1168 mmu_idx, STACK_NORMAL) &&
1169 v7m_stack_write(cpu, frameptr + 16, env->regs[12],
1170 mmu_idx, STACK_NORMAL) &&
1171 v7m_stack_write(cpu, frameptr + 20, env->regs[14],
1172 mmu_idx, STACK_NORMAL) &&
1173 v7m_stack_write(cpu, frameptr + 24, env->regs[15],
1174 mmu_idx, STACK_NORMAL) &&
1175 v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, STACK_NORMAL);
1176
1177 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) {
1178 /* FPU is active, try to save its registers */
1179 bool fpccr_s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
1180 bool lspact = env->v7m.fpccr[fpccr_s] & R_V7M_FPCCR_LSPACT_MASK;
1181
1182 if (lspact && arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1183 qemu_log_mask(CPU_LOG_INT,
1184 "...SecureFault because LSPACT and FPCA both set\n");
1185 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1186 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1187 } else if (!env->v7m.secure && !nsacr_cp10) {
1188 qemu_log_mask(CPU_LOG_INT,
1189 "...Secure UsageFault with CFSR.NOCP because "
1190 "NSACR.CP10 prevents stacking FP regs\n");
1191 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
1192 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
1193 } else {
1194 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1195 /* Lazy stacking disabled, save registers now */
1196 int i;
1197 bool cpacr_pass = v7m_cpacr_pass(env, env->v7m.secure,
1198 arm_current_el(env) != 0);
1199
1200 if (stacked_ok && !cpacr_pass) {
1201 /*
1202 * Take UsageFault if CPACR forbids access. The pseudocode
1203 * here does a full CheckCPEnabled() but we know the NSACR
1204 * check can never fail as we have already handled that.
1205 */
1206 qemu_log_mask(CPU_LOG_INT,
1207 "...UsageFault with CFSR.NOCP because "
1208 "CPACR.CP10 prevents stacking FP regs\n");
1209 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1210 env->v7m.secure);
1211 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK;
1212 stacked_ok = false;
1213 }
1214
1215 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1216 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1217 uint32_t faddr = frameptr + 0x20 + 4 * i;
1218 uint32_t slo = extract64(dn, 0, 32);
1219 uint32_t shi = extract64(dn, 32, 32);
1220
1221 if (i >= 16) {
1222 faddr += 8; /* skip the slot for the FPSCR */
1223 }
1224 stacked_ok = stacked_ok &&
1225 v7m_stack_write(cpu, faddr, slo,
1226 mmu_idx, STACK_NORMAL) &&
1227 v7m_stack_write(cpu, faddr + 4, shi,
1228 mmu_idx, STACK_NORMAL);
1229 }
1230 stacked_ok = stacked_ok &&
1231 v7m_stack_write(cpu, frameptr + 0x60,
1232 vfp_get_fpscr(env), mmu_idx, STACK_NORMAL);
1233 if (cpacr_pass) {
1234 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1235 *aa32_vfp_dreg(env, i / 2) = 0;
1236 }
1237 vfp_set_fpscr(env, 0);
1238 }
1239 } else {
1240 /* Lazy stacking enabled, save necessary info to stack later */
1241 v7m_update_fpccr(env, frameptr + 0x20, true);
1242 }
1243 }
1244 }
1245
1246 /*
1247 * If we broke a stack limit then SP was already updated earlier;
1248 * otherwise we update SP regardless of whether any of the stack
1249 * accesses failed or we took some other kind of fault.
1250 */
1251 if (!limitviol) {
1252 env->regs[13] = frameptr;
1253 }
1254
1255 return !stacked_ok;
1256}
1257
1258static void do_v7m_exception_exit(ARMCPU *cpu)
1259{
1260 CPUARMState *env = &cpu->env;
1261 uint32_t excret;
1262 uint32_t xpsr, xpsr_mask;
1263 bool ufault = false;
1264 bool sfault = false;
1265 bool return_to_sp_process;
1266 bool return_to_handler;
1267 bool rettobase = false;
1268 bool exc_secure = false;
1269 bool return_to_secure;
1270 bool ftype;
1271 bool restore_s16_s31;
1272
1273 /*
1274 * If we're not in Handler mode then jumps to magic exception-exit
1275 * addresses don't have magic behaviour. However for the v8M
1276 * security extensions the magic secure-function-return has to
1277 * work in thread mode too, so to avoid doing an extra check in
1278 * the generated code we allow exception-exit magic to also cause the
1279 * internal exception and bring us here in thread mode. Correct code
1280 * will never try to do this (the following insn fetch will always
1281 * fault) so we the overhead of having taken an unnecessary exception
1282 * doesn't matter.
1283 */
1284 if (!arm_v7m_is_handler_mode(env)) {
1285 return;
1286 }
1287
1288 /*
1289 * In the spec pseudocode ExceptionReturn() is called directly
1290 * from BXWritePC() and gets the full target PC value including
1291 * bit zero. In QEMU's implementation we treat it as a normal
1292 * jump-to-register (which is then caught later on), and so split
1293 * the target value up between env->regs[15] and env->thumb in
1294 * gen_bx(). Reconstitute it.
1295 */
1296 excret = env->regs[15];
1297 if (env->thumb) {
1298 excret |= 1;
1299 }
1300
1301 qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
1302 " previous exception %d\n",
1303 excret, env->v7m.exception);
1304
1305 if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
1306 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
1307 "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
1308 excret);
1309 }
1310
1311 ftype = excret & R_V7M_EXCRET_FTYPE_MASK;
1312
1313 if (!arm_feature(env, ARM_FEATURE_VFP) && !ftype) {
1314 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception "
1315 "exit PC value 0x%" PRIx32 " is UNPREDICTABLE "
1316 "if FPU not present\n",
1317 excret);
1318 ftype = true;
1319 }
1320
1321 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1322 /*
1323 * EXC_RETURN.ES validation check (R_SMFL). We must do this before
1324 * we pick which FAULTMASK to clear.
1325 */
1326 if (!env->v7m.secure &&
1327 ((excret & R_V7M_EXCRET_ES_MASK) ||
1328 !(excret & R_V7M_EXCRET_DCRS_MASK))) {
1329 sfault = 1;
1330 /* For all other purposes, treat ES as 0 (R_HXSR) */
1331 excret &= ~R_V7M_EXCRET_ES_MASK;
1332 }
1333 exc_secure = excret & R_V7M_EXCRET_ES_MASK;
1334 }
1335
1336 if (env->v7m.exception != ARMV7M_EXCP_NMI) {
1337 /*
1338 * Auto-clear FAULTMASK on return from other than NMI.
1339 * If the security extension is implemented then this only
1340 * happens if the raw execution priority is >= 0; the
1341 * value of the ES bit in the exception return value indicates
1342 * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
1343 */
1344 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1345 if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
1346 env->v7m.faultmask[exc_secure] = 0;
1347 }
1348 } else {
1349 env->v7m.faultmask[M_REG_NS] = 0;
1350 }
1351 }
1352
1353 switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception,
1354 exc_secure)) {
1355 case -1:
1356 /* attempt to exit an exception that isn't active */
1357 ufault = true;
1358 break;
1359 case 0:
1360 /* still an irq active now */
1361 break;
1362 case 1:
1363 /*
1364 * We returned to base exception level, no nesting.
1365 * (In the pseudocode this is written using "NestedActivation != 1"
1366 * where we have 'rettobase == false'.)
1367 */
1368 rettobase = true;
1369 break;
1370 default:
1371 g_assert_not_reached();
1372 }
1373
1374 return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
1375 return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
1376 return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
1377 (excret & R_V7M_EXCRET_S_MASK);
1378
1379 if (arm_feature(env, ARM_FEATURE_V8)) {
1380 if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1381 /*
1382 * UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP);
1383 * we choose to take the UsageFault.
1384 */
1385 if ((excret & R_V7M_EXCRET_S_MASK) ||
1386 (excret & R_V7M_EXCRET_ES_MASK) ||
1387 !(excret & R_V7M_EXCRET_DCRS_MASK)) {
1388 ufault = true;
1389 }
1390 }
1391 if (excret & R_V7M_EXCRET_RES0_MASK) {
1392 ufault = true;
1393 }
1394 } else {
1395 /* For v7M we only recognize certain combinations of the low bits */
1396 switch (excret & 0xf) {
1397 case 1: /* Return to Handler */
1398 break;
1399 case 13: /* Return to Thread using Process stack */
1400 case 9: /* Return to Thread using Main stack */
1401 /*
1402 * We only need to check NONBASETHRDENA for v7M, because in
1403 * v8M this bit does not exist (it is RES1).
1404 */
1405 if (!rettobase &&
1406 !(env->v7m.ccr[env->v7m.secure] &
1407 R_V7M_CCR_NONBASETHRDENA_MASK)) {
1408 ufault = true;
1409 }
1410 break;
1411 default:
1412 ufault = true;
1413 }
1414 }
1415
1416 /*
1417 * Set CONTROL.SPSEL from excret.SPSEL. Since we're still in
1418 * Handler mode (and will be until we write the new XPSR.Interrupt
1419 * field) this does not switch around the current stack pointer.
1420 * We must do this before we do any kind of tailchaining, including
1421 * for the derived exceptions on integrity check failures, or we will
1422 * give the guest an incorrect EXCRET.SPSEL value on exception entry.
1423 */
1424 write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
1425
1426 /*
1427 * Clear scratch FP values left in caller saved registers; this
1428 * must happen before any kind of tail chaining.
1429 */
1430 if ((env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_CLRONRET_MASK) &&
1431 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
1432 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1433 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1434 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1435 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1436 "stackframe: error during lazy state deactivation\n");
1437 v7m_exception_taken(cpu, excret, true, false);
1438 return;
1439 } else {
1440 /* Clear s0..s15 and FPSCR */
1441 int i;
1442
1443 for (i = 0; i < 16; i += 2) {
1444 *aa32_vfp_dreg(env, i / 2) = 0;
1445 }
1446 vfp_set_fpscr(env, 0);
1447 }
1448 }
1449
1450 if (sfault) {
1451 env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
1452 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1453 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1454 "stackframe: failed EXC_RETURN.ES validity check\n");
1455 v7m_exception_taken(cpu, excret, true, false);
1456 return;
1457 }
1458
1459 if (ufault) {
1460 /*
1461 * Bad exception return: instead of popping the exception
1462 * stack, directly take a usage fault on the current stack.
1463 */
1464 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1465 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
1466 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1467 "stackframe: failed exception return integrity check\n");
1468 v7m_exception_taken(cpu, excret, true, false);
1469 return;
1470 }
1471
1472 /*
1473 * Tailchaining: if there is currently a pending exception that
1474 * is high enough priority to preempt execution at the level we're
1475 * about to return to, then just directly take that exception now,
1476 * avoiding an unstack-and-then-stack. Note that now we have
1477 * deactivated the previous exception by calling armv7m_nvic_complete_irq()
1478 * our current execution priority is already the execution priority we are
1479 * returning to -- none of the state we would unstack or set based on
1480 * the EXCRET value affects it.
1481 */
1482 if (armv7m_nvic_can_take_pending_exception(env->nvic)) {
1483 qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n");
1484 v7m_exception_taken(cpu, excret, true, false);
1485 return;
1486 }
1487
1488 switch_v7m_security_state(env, return_to_secure);
1489
1490 {
1491 /*
1492 * The stack pointer we should be reading the exception frame from
1493 * depends on bits in the magic exception return type value (and
1494 * for v8M isn't necessarily the stack pointer we will eventually
1495 * end up resuming execution with). Get a pointer to the location
1496 * in the CPU state struct where the SP we need is currently being
1497 * stored; we will use and modify it in place.
1498 * We use this limited C variable scope so we don't accidentally
1499 * use 'frame_sp_p' after we do something that makes it invalid.
1500 */
1501 uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
1502 return_to_secure,
1503 !return_to_handler,
1504 return_to_sp_process);
1505 uint32_t frameptr = *frame_sp_p;
1506 bool pop_ok = true;
1507 ARMMMUIdx mmu_idx;
1508 bool return_to_priv = return_to_handler ||
1509 !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK);
1510
1511 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure,
1512 return_to_priv);
1513
1514 if (!QEMU_IS_ALIGNED(frameptr, 8) &&
1515 arm_feature(env, ARM_FEATURE_V8)) {
1516 qemu_log_mask(LOG_GUEST_ERROR,
1517 "M profile exception return with non-8-aligned SP "
1518 "for destination state is UNPREDICTABLE\n");
1519 }
1520
1521 /* Do we need to pop callee-saved registers? */
1522 if (return_to_secure &&
1523 ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
1524 (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
1525 uint32_t actual_sig;
1526
1527 pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx);
1528
1529 if (pop_ok && v7m_integrity_sig(env, excret) != actual_sig) {
1530 /* Take a SecureFault on the current stack */
1531 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
1532 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1533 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1534 "stackframe: failed exception return integrity "
1535 "signature check\n");
1536 v7m_exception_taken(cpu, excret, true, false);
1537 return;
1538 }
1539
1540 pop_ok = pop_ok &&
1541 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
1542 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) &&
1543 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) &&
1544 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) &&
1545 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) &&
1546 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) &&
1547 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) &&
1548 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx);
1549
1550 frameptr += 0x28;
1551 }
1552
1553 /* Pop registers */
1554 pop_ok = pop_ok &&
1555 v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) &&
1556 v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) &&
1557 v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) &&
1558 v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) &&
1559 v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) &&
1560 v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) &&
1561 v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) &&
1562 v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx);
1563
1564 if (!pop_ok) {
1565 /*
1566 * v7m_stack_read() pended a fault, so take it (as a tail
1567 * chained exception on the same stack frame)
1568 */
1569 qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n");
1570 v7m_exception_taken(cpu, excret, true, false);
1571 return;
1572 }
1573
1574 /*
1575 * Returning from an exception with a PC with bit 0 set is defined
1576 * behaviour on v8M (bit 0 is ignored), but for v7M it was specified
1577 * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore
1578 * the lsbit, and there are several RTOSes out there which incorrectly
1579 * assume the r15 in the stack frame should be a Thumb-style "lsbit
1580 * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but
1581 * complain about the badly behaved guest.
1582 */
1583 if (env->regs[15] & 1) {
1584 env->regs[15] &= ~1U;
1585 if (!arm_feature(env, ARM_FEATURE_V8)) {
1586 qemu_log_mask(LOG_GUEST_ERROR,
1587 "M profile return from interrupt with misaligned "
1588 "PC is UNPREDICTABLE on v7M\n");
1589 }
1590 }
1591
1592 if (arm_feature(env, ARM_FEATURE_V8)) {
1593 /*
1594 * For v8M we have to check whether the xPSR exception field
1595 * matches the EXCRET value for return to handler/thread
1596 * before we commit to changing the SP and xPSR.
1597 */
1598 bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
1599 if (return_to_handler != will_be_handler) {
1600 /*
1601 * Take an INVPC UsageFault on the current stack.
1602 * By this point we will have switched to the security state
1603 * for the background state, so this UsageFault will target
1604 * that state.
1605 */
1606 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1607 env->v7m.secure);
1608 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1609 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1610 "stackframe: failed exception return integrity "
1611 "check\n");
1612 v7m_exception_taken(cpu, excret, true, false);
1613 return;
1614 }
1615 }
1616
1617 if (!ftype) {
1618 /* FP present and we need to handle it */
1619 if (!return_to_secure &&
1620 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK)) {
1621 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1622 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1623 qemu_log_mask(CPU_LOG_INT,
1624 "...taking SecureFault on existing stackframe: "
1625 "Secure LSPACT set but exception return is "
1626 "not to secure state\n");
1627 v7m_exception_taken(cpu, excret, true, false);
1628 return;
1629 }
1630
1631 restore_s16_s31 = return_to_secure &&
1632 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
1633
1634 if (env->v7m.fpccr[return_to_secure] & R_V7M_FPCCR_LSPACT_MASK) {
1635 /* State in FPU is still valid, just clear LSPACT */
1636 env->v7m.fpccr[return_to_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
1637 } else {
1638 int i;
1639 uint32_t fpscr;
1640 bool cpacr_pass, nsacr_pass;
1641
1642 cpacr_pass = v7m_cpacr_pass(env, return_to_secure,
1643 return_to_priv);
1644 nsacr_pass = return_to_secure ||
1645 extract32(env->v7m.nsacr, 10, 1);
1646
1647 if (!cpacr_pass) {
1648 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1649 return_to_secure);
1650 env->v7m.cfsr[return_to_secure] |= R_V7M_CFSR_NOCP_MASK;
1651 qemu_log_mask(CPU_LOG_INT,
1652 "...taking UsageFault on existing "
1653 "stackframe: CPACR.CP10 prevents unstacking "
1654 "FP regs\n");
1655 v7m_exception_taken(cpu, excret, true, false);
1656 return;
1657 } else if (!nsacr_pass) {
1658 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
1659 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_INVPC_MASK;
1660 qemu_log_mask(CPU_LOG_INT,
1661 "...taking Secure UsageFault on existing "
1662 "stackframe: NSACR.CP10 prevents unstacking "
1663 "FP regs\n");
1664 v7m_exception_taken(cpu, excret, true, false);
1665 return;
1666 }
1667
1668 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1669 uint32_t slo, shi;
1670 uint64_t dn;
1671 uint32_t faddr = frameptr + 0x20 + 4 * i;
1672
1673 if (i >= 16) {
1674 faddr += 8; /* Skip the slot for the FPSCR */
1675 }
1676
1677 pop_ok = pop_ok &&
1678 v7m_stack_read(cpu, &slo, faddr, mmu_idx) &&
1679 v7m_stack_read(cpu, &shi, faddr + 4, mmu_idx);
1680
1681 if (!pop_ok) {
1682 break;
1683 }
1684
1685 dn = (uint64_t)shi << 32 | slo;
1686 *aa32_vfp_dreg(env, i / 2) = dn;
1687 }
1688 pop_ok = pop_ok &&
1689 v7m_stack_read(cpu, &fpscr, frameptr + 0x60, mmu_idx);
1690 if (pop_ok) {
1691 vfp_set_fpscr(env, fpscr);
1692 }
1693 if (!pop_ok) {
1694 /*
1695 * These regs are 0 if security extension present;
1696 * otherwise merely UNKNOWN. We zero always.
1697 */
1698 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1699 *aa32_vfp_dreg(env, i / 2) = 0;
1700 }
1701 vfp_set_fpscr(env, 0);
1702 }
1703 }
1704 }
1705 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1706 V7M_CONTROL, FPCA, !ftype);
1707
1708 /* Commit to consuming the stack frame */
1709 frameptr += 0x20;
1710 if (!ftype) {
1711 frameptr += 0x48;
1712 if (restore_s16_s31) {
1713 frameptr += 0x40;
1714 }
1715 }
1716 /*
1717 * Undo stack alignment (the SPREALIGN bit indicates that the original
1718 * pre-exception SP was not 8-aligned and we added a padding word to
1719 * align it, so we undo this by ORing in the bit that increases it
1720 * from the current 8-aligned value to the 8-unaligned value. (Adding 4
1721 * would work too but a logical OR is how the pseudocode specifies it.)
1722 */
1723 if (xpsr & XPSR_SPREALIGN) {
1724 frameptr |= 4;
1725 }
1726 *frame_sp_p = frameptr;
1727 }
1728
1729 xpsr_mask = ~(XPSR_SPREALIGN | XPSR_SFPA);
1730 if (!arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
1731 xpsr_mask &= ~XPSR_GE;
1732 }
1733 /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
1734 xpsr_write(env, xpsr, xpsr_mask);
1735
1736 if (env->v7m.secure) {
1737 bool sfpa = xpsr & XPSR_SFPA;
1738
1739 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1740 V7M_CONTROL, SFPA, sfpa);
1741 }
1742
1743 /*
1744 * The restored xPSR exception field will be zero if we're
1745 * resuming in Thread mode. If that doesn't match what the
1746 * exception return excret specified then this is a UsageFault.
1747 * v7M requires we make this check here; v8M did it earlier.
1748 */
1749 if (return_to_handler != arm_v7m_is_handler_mode(env)) {
1750 /*
1751 * Take an INVPC UsageFault by pushing the stack again;
1752 * we know we're v7M so this is never a Secure UsageFault.
1753 */
1754 bool ignore_stackfaults;
1755
1756 assert(!arm_feature(env, ARM_FEATURE_V8));
1757 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
1758 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1759 ignore_stackfaults = v7m_push_stack(cpu);
1760 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
1761 "failed exception return integrity check\n");
1762 v7m_exception_taken(cpu, excret, false, ignore_stackfaults);
1763 return;
1764 }
1765
1766 /* Otherwise, we have a successful exception exit. */
1767 arm_clear_exclusive(env);
1768 qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
1769}
1770
1771static bool do_v7m_function_return(ARMCPU *cpu)
1772{
1773 /*
1774 * v8M security extensions magic function return.
1775 * We may either:
1776 * (1) throw an exception (longjump)
1777 * (2) return true if we successfully handled the function return
1778 * (3) return false if we failed a consistency check and have
1779 * pended a UsageFault that needs to be taken now
1780 *
1781 * At this point the magic return value is split between env->regs[15]
1782 * and env->thumb. We don't bother to reconstitute it because we don't
1783 * need it (all values are handled the same way).
1784 */
1785 CPUARMState *env = &cpu->env;
1786 uint32_t newpc, newpsr, newpsr_exc;
1787
1788 qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n");
1789
1790 {
1791 bool threadmode, spsel;
1792 TCGMemOpIdx oi;
1793 ARMMMUIdx mmu_idx;
1794 uint32_t *frame_sp_p;
1795 uint32_t frameptr;
1796
1797 /* Pull the return address and IPSR from the Secure stack */
1798 threadmode = !arm_v7m_is_handler_mode(env);
1799 spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
1800
1801 frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
1802 frameptr = *frame_sp_p;
1803
1804 /*
1805 * These loads may throw an exception (for MPU faults). We want to
1806 * do them as secure, so work out what MMU index that is.
1807 */
1808 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
1809 oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx));
1810 newpc = helper_le_ldul_mmu(env, frameptr, oi, 0);
1811 newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0);
1812
1813 /* Consistency checks on new IPSR */
1814 newpsr_exc = newpsr & XPSR_EXCP;
1815 if (!((env->v7m.exception == 0 && newpsr_exc == 0) ||
1816 (env->v7m.exception == 1 && newpsr_exc != 0))) {
1817 /* Pend the fault and tell our caller to take it */
1818 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1819 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1820 env->v7m.secure);
1821 qemu_log_mask(CPU_LOG_INT,
1822 "...taking INVPC UsageFault: "
1823 "IPSR consistency check failed\n");
1824 return false;
1825 }
1826
1827 *frame_sp_p = frameptr + 8;
1828 }
1829
1830 /* This invalidates frame_sp_p */
1831 switch_v7m_security_state(env, true);
1832 env->v7m.exception = newpsr_exc;
1833 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
1834 if (newpsr & XPSR_SFPA) {
1835 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK;
1836 }
1837 xpsr_write(env, 0, XPSR_IT);
1838 env->thumb = newpc & 1;
1839 env->regs[15] = newpc & ~1;
1840
1841 qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
1842 return true;
1843}
1844
1845static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
1846 uint32_t addr, uint16_t *insn)
1847{
1848 /*
1849 * Load a 16-bit portion of a v7M instruction, returning true on success,
1850 * or false on failure (in which case we will have pended the appropriate
1851 * exception).
1852 * We need to do the instruction fetch's MPU and SAU checks
1853 * like this because there is no MMU index that would allow
1854 * doing the load with a single function call. Instead we must
1855 * first check that the security attributes permit the load
1856 * and that they don't mismatch on the two halves of the instruction,
1857 * and then we do the load as a secure load (ie using the security
1858 * attributes of the address, not the CPU, as architecturally required).
1859 */
1860 CPUState *cs = CPU(cpu);
1861 CPUARMState *env = &cpu->env;
1862 V8M_SAttributes sattrs = {};
1863 MemTxAttrs attrs = {};
1864 ARMMMUFaultInfo fi = {};
1865 MemTxResult txres;
1866 target_ulong page_size;
1867 hwaddr physaddr;
1868 int prot;
1869
1870 v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs);
1871 if (!sattrs.nsc || sattrs.ns) {
1872 /*
1873 * This must be the second half of the insn, and it straddles a
1874 * region boundary with the second half not being S&NSC.
1875 */
1876 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
1877 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1878 qemu_log_mask(CPU_LOG_INT,
1879 "...really SecureFault with SFSR.INVEP\n");
1880 return false;
1881 }
1882 if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
1883 &physaddr, &attrs, &prot, &page_size, &fi, NULL)) {
1884 /* the MPU lookup failed */
1885 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
1886 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
1887 qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
1888 return false;
1889 }
1890 *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr,
1891 attrs, &txres);
1892 if (txres != MEMTX_OK) {
1893 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
1894 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
1895 qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");
1896 return false;
1897 }
1898 return true;
1899}
1900
1901static bool v7m_handle_execute_nsc(ARMCPU *cpu)
1902{
1903 /*
1904 * Check whether this attempt to execute code in a Secure & NS-Callable
1905 * memory region is for an SG instruction; if so, then emulate the
1906 * effect of the SG instruction and return true. Otherwise pend
1907 * the correct kind of exception and return false.
1908 */
1909 CPUARMState *env = &cpu->env;
1910 ARMMMUIdx mmu_idx;
1911 uint16_t insn;
1912
1913 /*
1914 * We should never get here unless get_phys_addr_pmsav8() caused
1915 * an exception for NS executing in S&NSC memory.
1916 */
1917 assert(!env->v7m.secure);
1918 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
1919
1920 /* We want to do the MPU lookup as secure; work out what mmu_idx that is */
1921 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
1922
1923 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) {
1924 return false;
1925 }
1926
1927 if (!env->thumb) {
1928 goto gen_invep;
1929 }
1930
1931 if (insn != 0xe97f) {
1932 /*
1933 * Not an SG instruction first half (we choose the IMPDEF
1934 * early-SG-check option).
1935 */
1936 goto gen_invep;
1937 }
1938
1939 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) {
1940 return false;
1941 }
1942
1943 if (insn != 0xe97f) {
1944 /*
1945 * Not an SG instruction second half (yes, both halves of the SG
1946 * insn have the same hex value)
1947 */
1948 goto gen_invep;
1949 }
1950
1951 /*
1952 * OK, we have confirmed that we really have an SG instruction.
1953 * We know we're NS in S memory so don't need to repeat those checks.
1954 */
1955 qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
1956 ", executing it\n", env->regs[15]);
1957 env->regs[14] &= ~1;
1958 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
1959 switch_v7m_security_state(env, true);
1960 xpsr_write(env, 0, XPSR_IT);
1961 env->regs[15] += 4;
1962 return true;
1963
1964gen_invep:
1965 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
1966 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1967 qemu_log_mask(CPU_LOG_INT,
1968 "...really SecureFault with SFSR.INVEP\n");
1969 return false;
1970}
1971
1972void arm_v7m_cpu_do_interrupt(CPUState *cs)
1973{
1974 ARMCPU *cpu = ARM_CPU(cs);
1975 CPUARMState *env = &cpu->env;
1976 uint32_t lr;
1977 bool ignore_stackfaults;
1978
1979 arm_log_exception(cs->exception_index);
1980
1981 /*
1982 * For exceptions we just mark as pending on the NVIC, and let that
1983 * handle it.
1984 */
1985 switch (cs->exception_index) {
1986 case EXCP_UDEF:
1987 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
1988 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK;
1989 break;
1990 case EXCP_NOCP:
1991 {
1992 /*
1993 * NOCP might be directed to something other than the current
1994 * security state if this fault is because of NSACR; we indicate
1995 * the target security state using exception.target_el.
1996 */
1997 int target_secstate;
1998
1999 if (env->exception.target_el == 3) {
2000 target_secstate = M_REG_S;
2001 } else {
2002 target_secstate = env->v7m.secure;
2003 }
2004 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, target_secstate);
2005 env->v7m.cfsr[target_secstate] |= R_V7M_CFSR_NOCP_MASK;
2006 break;
2007 }
2008 case EXCP_INVSTATE:
2009 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2010 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK;
2011 break;
2012 case EXCP_STKOF:
2013 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2014 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
2015 break;
2016 case EXCP_LSERR:
2017 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2018 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
2019 break;
2020 case EXCP_UNALIGNED:
2021 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2022 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
2023 break;
2024 case EXCP_SWI:
2025 /* The PC already points to the next instruction. */
2026 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure);
2027 break;
2028 case EXCP_PREFETCH_ABORT:
2029 case EXCP_DATA_ABORT:
2030 /*
2031 * Note that for M profile we don't have a guest facing FSR, but
2032 * the env->exception.fsr will be populated by the code that
2033 * raises the fault, in the A profile short-descriptor format.
2034 */
2035 switch (env->exception.fsr & 0xf) {
2036 case M_FAKE_FSR_NSC_EXEC:
2037 /*
2038 * Exception generated when we try to execute code at an address
2039 * which is marked as Secure & Non-Secure Callable and the CPU
2040 * is in the Non-Secure state. The only instruction which can
2041 * be executed like this is SG (and that only if both halves of
2042 * the SG instruction have the same security attributes.)
2043 * Everything else must generate an INVEP SecureFault, so we
2044 * emulate the SG instruction here.
2045 */
2046 if (v7m_handle_execute_nsc(cpu)) {
2047 return;
2048 }
2049 break;
2050 case M_FAKE_FSR_SFAULT:
2051 /*
2052 * Various flavours of SecureFault for attempts to execute or
2053 * access data in the wrong security state.
2054 */
2055 switch (cs->exception_index) {
2056 case EXCP_PREFETCH_ABORT:
2057 if (env->v7m.secure) {
2058 env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
2059 qemu_log_mask(CPU_LOG_INT,
2060 "...really SecureFault with SFSR.INVTRAN\n");
2061 } else {
2062 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2063 qemu_log_mask(CPU_LOG_INT,
2064 "...really SecureFault with SFSR.INVEP\n");
2065 }
2066 break;
2067 case EXCP_DATA_ABORT:
2068 /* This must be an NS access to S memory */
2069 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
2070 qemu_log_mask(CPU_LOG_INT,
2071 "...really SecureFault with SFSR.AUVIOL\n");
2072 break;
2073 }
2074 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2075 break;
2076 case 0x8: /* External Abort */
2077 switch (cs->exception_index) {
2078 case EXCP_PREFETCH_ABORT:
2079 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
2080 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
2081 break;
2082 case EXCP_DATA_ABORT:
2083 env->v7m.cfsr[M_REG_NS] |=
2084 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
2085 env->v7m.bfar = env->exception.vaddress;
2086 qemu_log_mask(CPU_LOG_INT,
2087 "...with CFSR.PRECISERR and BFAR 0x%x\n",
2088 env->v7m.bfar);
2089 break;
2090 }
2091 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2092 break;
2093 default:
2094 /*
2095 * All other FSR values are either MPU faults or "can't happen
2096 * for M profile" cases.
2097 */
2098 switch (cs->exception_index) {
2099 case EXCP_PREFETCH_ABORT:
2100 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
2101 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
2102 break;
2103 case EXCP_DATA_ABORT:
2104 env->v7m.cfsr[env->v7m.secure] |=
2105 (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
2106 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress;
2107 qemu_log_mask(CPU_LOG_INT,
2108 "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
2109 env->v7m.mmfar[env->v7m.secure]);
2110 break;
2111 }
2112 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM,
2113 env->v7m.secure);
2114 break;
2115 }
2116 break;
2117 case EXCP_BKPT:
2118 if (semihosting_enabled()) {
2119 int nr;
2120 nr = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) & 0xff;
2121 if (nr == 0xab) {
2122 env->regs[15] += 2;
2123 qemu_log_mask(CPU_LOG_INT,
2124 "...handling as semihosting call 0x%x\n",
2125 env->regs[0]);
2126 env->regs[0] = do_arm_semihosting(env);
2127 return;
2128 }
2129 }
2130 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false);
2131 break;
2132 case EXCP_IRQ:
2133 break;
2134 case EXCP_EXCEPTION_EXIT:
2135 if (env->regs[15] < EXC_RETURN_MIN_MAGIC) {
2136 /* Must be v8M security extension function return */
2137 assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC);
2138 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
2139 if (do_v7m_function_return(cpu)) {
2140 return;
2141 }
2142 } else {
2143 do_v7m_exception_exit(cpu);
2144 return;
2145 }
2146 break;
2147 case EXCP_LAZYFP:
2148 /*
2149 * We already pended the specific exception in the NVIC in the
2150 * v7m_preserve_fp_state() helper function.
2151 */
2152 break;
2153 default:
2154 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
2155 return; /* Never happens. Keep compiler happy. */
2156 }
2157
2158 if (arm_feature(env, ARM_FEATURE_V8)) {
2159 lr = R_V7M_EXCRET_RES1_MASK |
2160 R_V7M_EXCRET_DCRS_MASK;
2161 /*
2162 * The S bit indicates whether we should return to Secure
2163 * or NonSecure (ie our current state).
2164 * The ES bit indicates whether we're taking this exception
2165 * to Secure or NonSecure (ie our target state). We set it
2166 * later, in v7m_exception_taken().
2167 * The SPSEL bit is also set in v7m_exception_taken() for v8M.
2168 * This corresponds to the ARM ARM pseudocode for v8M setting
2169 * some LR bits in PushStack() and some in ExceptionTaken();
2170 * the distinction matters for the tailchain cases where we
2171 * can take an exception without pushing the stack.
2172 */
2173 if (env->v7m.secure) {
2174 lr |= R_V7M_EXCRET_S_MASK;
2175 }
2176 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
2177 lr |= R_V7M_EXCRET_FTYPE_MASK;
2178 }
2179 } else {
2180 lr = R_V7M_EXCRET_RES1_MASK |
2181 R_V7M_EXCRET_S_MASK |
2182 R_V7M_EXCRET_DCRS_MASK |
2183 R_V7M_EXCRET_FTYPE_MASK |
2184 R_V7M_EXCRET_ES_MASK;
2185 if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
2186 lr |= R_V7M_EXCRET_SPSEL_MASK;
2187 }
2188 }
2189 if (!arm_v7m_is_handler_mode(env)) {
2190 lr |= R_V7M_EXCRET_MODE_MASK;
2191 }
2192
2193 ignore_stackfaults = v7m_push_stack(cpu);
2194 v7m_exception_taken(cpu, lr, false, ignore_stackfaults);
2195}
2196
2197uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
2198{
2199 uint32_t mask;
2200 unsigned el = arm_current_el(env);
2201
2202 /* First handle registers which unprivileged can read */
2203
2204 switch (reg) {
2205 case 0 ... 7: /* xPSR sub-fields */
2206 mask = 0;
2207 if ((reg & 1) && el) {
2208 mask |= XPSR_EXCP; /* IPSR (unpriv. reads as zero) */
2209 }
2210 if (!(reg & 4)) {
2211 mask |= XPSR_NZCV | XPSR_Q; /* APSR */
2212 if (arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
2213 mask |= XPSR_GE;
2214 }
2215 }
2216 /* EPSR reads as zero */
2217 return xpsr_read(env) & mask;
2218 break;
2219 case 20: /* CONTROL */
2220 {
2221 uint32_t value = env->v7m.control[env->v7m.secure];
2222 if (!env->v7m.secure) {
2223 /* SFPA is RAZ/WI from NS; FPCA is stored in the M_REG_S bank */
2224 value |= env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK;
2225 }
2226 return value;
2227 }
2228 case 0x94: /* CONTROL_NS */
2229 /*
2230 * We have to handle this here because unprivileged Secure code
2231 * can read the NS CONTROL register.
2232 */
2233 if (!env->v7m.secure) {
2234 return 0;
2235 }
2236 return env->v7m.control[M_REG_NS] |
2237 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK);
2238 }
2239
2240 if (el == 0) {
2241 return 0; /* unprivileged reads others as zero */
2242 }
2243
2244 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2245 switch (reg) {
2246 case 0x88: /* MSP_NS */
2247 if (!env->v7m.secure) {
2248 return 0;
2249 }
2250 return env->v7m.other_ss_msp;
2251 case 0x89: /* PSP_NS */
2252 if (!env->v7m.secure) {
2253 return 0;
2254 }
2255 return env->v7m.other_ss_psp;
2256 case 0x8a: /* MSPLIM_NS */
2257 if (!env->v7m.secure) {
2258 return 0;
2259 }
2260 return env->v7m.msplim[M_REG_NS];
2261 case 0x8b: /* PSPLIM_NS */
2262 if (!env->v7m.secure) {
2263 return 0;
2264 }
2265 return env->v7m.psplim[M_REG_NS];
2266 case 0x90: /* PRIMASK_NS */
2267 if (!env->v7m.secure) {
2268 return 0;
2269 }
2270 return env->v7m.primask[M_REG_NS];
2271 case 0x91: /* BASEPRI_NS */
2272 if (!env->v7m.secure) {
2273 return 0;
2274 }
2275 return env->v7m.basepri[M_REG_NS];
2276 case 0x93: /* FAULTMASK_NS */
2277 if (!env->v7m.secure) {
2278 return 0;
2279 }
2280 return env->v7m.faultmask[M_REG_NS];
2281 case 0x98: /* SP_NS */
2282 {
2283 /*
2284 * This gives the non-secure SP selected based on whether we're
2285 * currently in handler mode or not, using the NS CONTROL.SPSEL.
2286 */
2287 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2288
2289 if (!env->v7m.secure) {
2290 return 0;
2291 }
2292 if (!arm_v7m_is_handler_mode(env) && spsel) {
2293 return env->v7m.other_ss_psp;
2294 } else {
2295 return env->v7m.other_ss_msp;
2296 }
2297 }
2298 default:
2299 break;
2300 }
2301 }
2302
2303 switch (reg) {
2304 case 8: /* MSP */
2305 return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];
2306 case 9: /* PSP */
2307 return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;
2308 case 10: /* MSPLIM */
2309 if (!arm_feature(env, ARM_FEATURE_V8)) {
2310 goto bad_reg;
2311 }
2312 return env->v7m.msplim[env->v7m.secure];
2313 case 11: /* PSPLIM */
2314 if (!arm_feature(env, ARM_FEATURE_V8)) {
2315 goto bad_reg;
2316 }
2317 return env->v7m.psplim[env->v7m.secure];
2318 case 16: /* PRIMASK */
2319 return env->v7m.primask[env->v7m.secure];
2320 case 17: /* BASEPRI */
2321 case 18: /* BASEPRI_MAX */
2322 return env->v7m.basepri[env->v7m.secure];
2323 case 19: /* FAULTMASK */
2324 return env->v7m.faultmask[env->v7m.secure];
2325 default:
2326 bad_reg:
2327 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"
2328 " register %d\n", reg);
2329 return 0;
2330 }
2331}
2332
2333void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
2334{
2335 /*
2336 * We're passed bits [11..0] of the instruction; extract
2337 * SYSm and the mask bits.
2338 * Invalid combinations of SYSm and mask are UNPREDICTABLE;
2339 * we choose to treat them as if the mask bits were valid.
2340 * NB that the pseudocode 'mask' variable is bits [11..10],
2341 * whereas ours is [11..8].
2342 */
2343 uint32_t mask = extract32(maskreg, 8, 4);
2344 uint32_t reg = extract32(maskreg, 0, 8);
2345 int cur_el = arm_current_el(env);
2346
2347 if (cur_el == 0 && reg > 7 && reg != 20) {
2348 /*
2349 * only xPSR sub-fields and CONTROL.SFPA may be written by
2350 * unprivileged code
2351 */
2352 return;
2353 }
2354
2355 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2356 switch (reg) {
2357 case 0x88: /* MSP_NS */
2358 if (!env->v7m.secure) {
2359 return;
2360 }
2361 env->v7m.other_ss_msp = val;
2362 return;
2363 case 0x89: /* PSP_NS */
2364 if (!env->v7m.secure) {
2365 return;
2366 }
2367 env->v7m.other_ss_psp = val;
2368 return;
2369 case 0x8a: /* MSPLIM_NS */
2370 if (!env->v7m.secure) {
2371 return;
2372 }
2373 env->v7m.msplim[M_REG_NS] = val & ~7;
2374 return;
2375 case 0x8b: /* PSPLIM_NS */
2376 if (!env->v7m.secure) {
2377 return;
2378 }
2379 env->v7m.psplim[M_REG_NS] = val & ~7;
2380 return;
2381 case 0x90: /* PRIMASK_NS */
2382 if (!env->v7m.secure) {
2383 return;
2384 }
2385 env->v7m.primask[M_REG_NS] = val & 1;
2386 return;
2387 case 0x91: /* BASEPRI_NS */
2388 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) {
2389 return;
2390 }
2391 env->v7m.basepri[M_REG_NS] = val & 0xff;
2392 return;
2393 case 0x93: /* FAULTMASK_NS */
2394 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) {
2395 return;
2396 }
2397 env->v7m.faultmask[M_REG_NS] = val & 1;
2398 return;
2399 case 0x94: /* CONTROL_NS */
2400 if (!env->v7m.secure) {
2401 return;
2402 }
2403 write_v7m_control_spsel_for_secstate(env,
2404 val & R_V7M_CONTROL_SPSEL_MASK,
2405 M_REG_NS);
2406 if (arm_feature(env, ARM_FEATURE_M_MAIN)) {
2407 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK;
2408 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK;
2409 }
2410 /*
2411 * SFPA is RAZ/WI from NS. FPCA is RO if NSACR.CP10 == 0,
2412 * RES0 if the FPU is not present, and is stored in the S bank
2413 */
2414 if (arm_feature(env, ARM_FEATURE_VFP) &&
2415 extract32(env->v7m.nsacr, 10, 1)) {
2416 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2417 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2418 }
2419 return;
2420 case 0x98: /* SP_NS */
2421 {
2422 /*
2423 * This gives the non-secure SP selected based on whether we're
2424 * currently in handler mode or not, using the NS CONTROL.SPSEL.
2425 */
2426 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2427 bool is_psp = !arm_v7m_is_handler_mode(env) && spsel;
2428 uint32_t limit;
2429
2430 if (!env->v7m.secure) {
2431 return;
2432 }
2433
2434 limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
2435
2436 if (val < limit) {
2437 CPUState *cs = env_cpu(env);
2438
2439 cpu_restore_state(cs, GETPC(), true);
2440 raise_exception(env, EXCP_STKOF, 0, 1);
2441 }
2442
2443 if (is_psp) {
2444 env->v7m.other_ss_psp = val;
2445 } else {
2446 env->v7m.other_ss_msp = val;
2447 }
2448 return;
2449 }
2450 default:
2451 break;
2452 }
2453 }
2454
2455 switch (reg) {
2456 case 0 ... 7: /* xPSR sub-fields */
2457 /* only APSR is actually writable */
2458 if (!(reg & 4)) {
2459 uint32_t apsrmask = 0;
2460
2461 if (mask & 8) {
2462 apsrmask |= XPSR_NZCV | XPSR_Q;
2463 }
2464 if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
2465 apsrmask |= XPSR_GE;
2466 }
2467 xpsr_write(env, val, apsrmask);
2468 }
2469 break;
2470 case 8: /* MSP */
2471 if (v7m_using_psp(env)) {
2472 env->v7m.other_sp = val;
2473 } else {
2474 env->regs[13] = val;
2475 }
2476 break;
2477 case 9: /* PSP */
2478 if (v7m_using_psp(env)) {
2479 env->regs[13] = val;
2480 } else {
2481 env->v7m.other_sp = val;
2482 }
2483 break;
2484 case 10: /* MSPLIM */
2485 if (!arm_feature(env, ARM_FEATURE_V8)) {
2486 goto bad_reg;
2487 }
2488 env->v7m.msplim[env->v7m.secure] = val & ~7;
2489 break;
2490 case 11: /* PSPLIM */
2491 if (!arm_feature(env, ARM_FEATURE_V8)) {
2492 goto bad_reg;
2493 }
2494 env->v7m.psplim[env->v7m.secure] = val & ~7;
2495 break;
2496 case 16: /* PRIMASK */
2497 env->v7m.primask[env->v7m.secure] = val & 1;
2498 break;
2499 case 17: /* BASEPRI */
2500 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2501 goto bad_reg;
2502 }
2503 env->v7m.basepri[env->v7m.secure] = val & 0xff;
2504 break;
2505 case 18: /* BASEPRI_MAX */
2506 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2507 goto bad_reg;
2508 }
2509 val &= 0xff;
2510 if (val != 0 && (val < env->v7m.basepri[env->v7m.secure]
2511 || env->v7m.basepri[env->v7m.secure] == 0)) {
2512 env->v7m.basepri[env->v7m.secure] = val;
2513 }
2514 break;
2515 case 19: /* FAULTMASK */
2516 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2517 goto bad_reg;
2518 }
2519 env->v7m.faultmask[env->v7m.secure] = val & 1;
2520 break;
2521 case 20: /* CONTROL */
2522 /*
2523 * Writing to the SPSEL bit only has an effect if we are in
2524 * thread mode; other bits can be updated by any privileged code.
2525 * write_v7m_control_spsel() deals with updating the SPSEL bit in
2526 * env->v7m.control, so we only need update the others.
2527 * For v7M, we must just ignore explicit writes to SPSEL in handler
2528 * mode; for v8M the write is permitted but will have no effect.
2529 * All these bits are writes-ignored from non-privileged code,
2530 * except for SFPA.
2531 */
2532 if (cur_el > 0 && (arm_feature(env, ARM_FEATURE_V8) ||
2533 !arm_v7m_is_handler_mode(env))) {
2534 write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
2535 }
2536 if (cur_el > 0 && arm_feature(env, ARM_FEATURE_M_MAIN)) {
2537 env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
2538 env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
2539 }
2540 if (arm_feature(env, ARM_FEATURE_VFP)) {
2541 /*
2542 * SFPA is RAZ/WI from NS or if no FPU.
2543 * FPCA is RO if NSACR.CP10 == 0, RES0 if the FPU is not present.
2544 * Both are stored in the S bank.
2545 */
2546 if (env->v7m.secure) {
2547 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
2548 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_SFPA_MASK;
2549 }
2550 if (cur_el > 0 &&
2551 (env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_SECURITY) ||
2552 extract32(env->v7m.nsacr, 10, 1))) {
2553 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2554 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2555 }
2556 }
2557 break;
2558 default:
2559 bad_reg:
2560 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
2561 " register %d\n", reg);
2562 return;
2563 }
2564}
2565
2566uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
2567{
2568 /* Implement the TT instruction. op is bits [7:6] of the insn. */
2569 bool forceunpriv = op & 1;
2570 bool alt = op & 2;
2571 V8M_SAttributes sattrs = {};
2572 uint32_t tt_resp;
2573 bool r, rw, nsr, nsrw, mrvalid;
2574 int prot;
2575 ARMMMUFaultInfo fi = {};
2576 MemTxAttrs attrs = {};
2577 hwaddr phys_addr;
2578 ARMMMUIdx mmu_idx;
2579 uint32_t mregion;
2580 bool targetpriv;
2581 bool targetsec = env->v7m.secure;
2582 bool is_subpage;
2583
2584 /*
2585 * Work out what the security state and privilege level we're
2586 * interested in is...
2587 */
2588 if (alt) {
2589 targetsec = !targetsec;
2590 }
2591
2592 if (forceunpriv) {
2593 targetpriv = false;
2594 } else {
2595 targetpriv = arm_v7m_is_handler_mode(env) ||
2596 !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK);
2597 }
2598
2599 /* ...and then figure out which MMU index this is */
2600 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv);
2601
2602 /*
2603 * We know that the MPU and SAU don't care about the access type
2604 * for our purposes beyond that we don't want to claim to be
2605 * an insn fetch, so we arbitrarily call this a read.
2606 */
2607
2608 /*
2609 * MPU region info only available for privileged or if
2610 * inspecting the other MPU state.
2611 */
2612 if (arm_current_el(env) != 0 || alt) {
2613 /* We can ignore the return value as prot is always set */
2614 pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx,
2615 &phys_addr, &attrs, &prot, &is_subpage,
2616 &fi, &mregion);
2617 if (mregion == -1) {
2618 mrvalid = false;
2619 mregion = 0;
2620 } else {
2621 mrvalid = true;
2622 }
2623 r = prot & PAGE_READ;
2624 rw = prot & PAGE_WRITE;
2625 } else {
2626 r = false;
2627 rw = false;
2628 mrvalid = false;
2629 mregion = 0;
2630 }
2631
2632 if (env->v7m.secure) {
2633 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs);
2634 nsr = sattrs.ns && r;
2635 nsrw = sattrs.ns && rw;
2636 } else {
2637 sattrs.ns = true;
2638 nsr = false;
2639 nsrw = false;
2640 }
2641
2642 tt_resp = (sattrs.iregion << 24) |
2643 (sattrs.irvalid << 23) |
2644 ((!sattrs.ns) << 22) |
2645 (nsrw << 21) |
2646 (nsr << 20) |
2647 (rw << 19) |
2648 (r << 18) |
2649 (sattrs.srvalid << 17) |
2650 (mrvalid << 16) |
2651 (sattrs.sregion << 8) |
2652 mregion;
2653
2654 return tt_resp;
2655}
2656
2657#endif /* !CONFIG_USER_ONLY */
2658
2659ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
2660 bool secstate, bool priv, bool negpri)
2661{
2662 ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
2663
2664 if (priv) {
2665 mmu_idx |= ARM_MMU_IDX_M_PRIV;
2666 }
2667
2668 if (negpri) {
2669 mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
2670 }
2671
2672 if (secstate) {
2673 mmu_idx |= ARM_MMU_IDX_M_S;
2674 }
2675
2676 return mmu_idx;
2677}
2678
2679ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
2680 bool secstate, bool priv)
2681{
2682 bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate);
2683
2684 return arm_v7m_mmu_idx_all(env, secstate, priv, negpri);
2685}
2686
2687/* Return the MMU index for a v7M CPU in the specified security state */
2688ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
2689{
2690 bool priv = arm_current_el(env) != 0;
2691
2692 return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
2693}
2694