1
2
3
4
5
6
7
8#include "qemu/osdep.h"
9#include "qemu/units.h"
10#include "target/arm/idau.h"
11#include "trace.h"
12#include "cpu.h"
13#include "internals.h"
14#include "exec/gdbstub.h"
15#include "exec/helper-proto.h"
16#include "qemu/host-utils.h"
17#include "sysemu/sysemu.h"
18#include "qemu/bitops.h"
19#include "qemu/crc32c.h"
20#include "qemu/qemu-print.h"
21#include "exec/exec-all.h"
22#include <zlib.h>
23#include "hw/semihosting/semihost.h"
24#include "sysemu/cpus.h"
25#include "sysemu/kvm.h"
26#include "qemu/range.h"
27#include "qapi/qapi-commands-machine-target.h"
28#include "qapi/error.h"
29#include "qemu/guest-random.h"
30#ifdef CONFIG_TCG
31#include "arm_ldst.h"
32#include "exec/cpu_ldst.h"
33#endif
34
35#ifdef CONFIG_USER_ONLY
36
37
38void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
39{
40 ARMCPU *cpu = env_archcpu(env);
41
42 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg);
43}
44
45uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
46{
47 ARMCPU *cpu = env_archcpu(env);
48
49 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg);
50 return 0;
51}
52
53void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
54{
55
56 g_assert_not_reached();
57}
58
59void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
60{
61
62 g_assert_not_reached();
63}
64
65void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
66{
67
68 g_assert_not_reached();
69}
70
71void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
72{
73
74 g_assert_not_reached();
75}
76
77void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
78{
79
80 g_assert_not_reached();
81}
82
83uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
84{
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103 return 0;
104}
105
106#else
107
108
109
110
111
112typedef enum StackingMode {
113 STACK_NORMAL,
114 STACK_IGNFAULTS,
115 STACK_LAZYFP,
116} StackingMode;
117
118static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
119 ARMMMUIdx mmu_idx, StackingMode mode)
120{
121 CPUState *cs = CPU(cpu);
122 CPUARMState *env = &cpu->env;
123 MemTxAttrs attrs = {};
124 MemTxResult txres;
125 target_ulong page_size;
126 hwaddr physaddr;
127 int prot;
128 ARMMMUFaultInfo fi = {};
129 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
130 int exc;
131 bool exc_secure;
132
133 if (get_phys_addr(env, addr, MMU_DATA_STORE, mmu_idx, &physaddr,
134 &attrs, &prot, &page_size, &fi, NULL)) {
135
136 if (fi.type == ARMFault_QEMU_SFault) {
137 if (mode == STACK_LAZYFP) {
138 qemu_log_mask(CPU_LOG_INT,
139 "...SecureFault with SFSR.LSPERR "
140 "during lazy stacking\n");
141 env->v7m.sfsr |= R_V7M_SFSR_LSPERR_MASK;
142 } else {
143 qemu_log_mask(CPU_LOG_INT,
144 "...SecureFault with SFSR.AUVIOL "
145 "during stacking\n");
146 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
147 }
148 env->v7m.sfsr |= R_V7M_SFSR_SFARVALID_MASK;
149 env->v7m.sfar = addr;
150 exc = ARMV7M_EXCP_SECURE;
151 exc_secure = false;
152 } else {
153 if (mode == STACK_LAZYFP) {
154 qemu_log_mask(CPU_LOG_INT,
155 "...MemManageFault with CFSR.MLSPERR\n");
156 env->v7m.cfsr[secure] |= R_V7M_CFSR_MLSPERR_MASK;
157 } else {
158 qemu_log_mask(CPU_LOG_INT,
159 "...MemManageFault with CFSR.MSTKERR\n");
160 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK;
161 }
162 exc = ARMV7M_EXCP_MEM;
163 exc_secure = secure;
164 }
165 goto pend_fault;
166 }
167 address_space_stl_le(arm_addressspace(cs, attrs), physaddr, value,
168 attrs, &txres);
169 if (txres != MEMTX_OK) {
170
171 if (mode == STACK_LAZYFP) {
172 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.LSPERR\n");
173 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_LSPERR_MASK;
174 } else {
175 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n");
176 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK;
177 }
178 exc = ARMV7M_EXCP_BUS;
179 exc_secure = false;
180 goto pend_fault;
181 }
182 return true;
183
184pend_fault:
185
186
187
188
189
190
191
192
193
194
195
196
197 switch (mode) {
198 case STACK_NORMAL:
199 armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure);
200 break;
201 case STACK_LAZYFP:
202 armv7m_nvic_set_pending_lazyfp(env->nvic, exc, exc_secure);
203 break;
204 case STACK_IGNFAULTS:
205 break;
206 }
207 return false;
208}
209
210static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
211 ARMMMUIdx mmu_idx)
212{
213 CPUState *cs = CPU(cpu);
214 CPUARMState *env = &cpu->env;
215 MemTxAttrs attrs = {};
216 MemTxResult txres;
217 target_ulong page_size;
218 hwaddr physaddr;
219 int prot;
220 ARMMMUFaultInfo fi = {};
221 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
222 int exc;
223 bool exc_secure;
224 uint32_t value;
225
226 if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr,
227 &attrs, &prot, &page_size, &fi, NULL)) {
228
229 if (fi.type == ARMFault_QEMU_SFault) {
230 qemu_log_mask(CPU_LOG_INT,
231 "...SecureFault with SFSR.AUVIOL during unstack\n");
232 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
233 env->v7m.sfar = addr;
234 exc = ARMV7M_EXCP_SECURE;
235 exc_secure = false;
236 } else {
237 qemu_log_mask(CPU_LOG_INT,
238 "...MemManageFault with CFSR.MUNSTKERR\n");
239 env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK;
240 exc = ARMV7M_EXCP_MEM;
241 exc_secure = secure;
242 }
243 goto pend_fault;
244 }
245
246 value = address_space_ldl(arm_addressspace(cs, attrs), physaddr,
247 attrs, &txres);
248 if (txres != MEMTX_OK) {
249
250 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n");
251 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK;
252 exc = ARMV7M_EXCP_BUS;
253 exc_secure = false;
254 goto pend_fault;
255 }
256
257 *dest = value;
258 return true;
259
260pend_fault:
261
262
263
264
265
266
267
268 armv7m_nvic_set_pending(env->nvic, exc, exc_secure);
269 return false;
270}
271
272void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
273{
274
275
276
277
278
279
280 ARMCPU *cpu = env_archcpu(env);
281 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
282 bool negpri = !(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_HFRDY_MASK);
283 bool is_priv = !(env->v7m.fpccr[is_secure] & R_V7M_FPCCR_USER_MASK);
284 bool splimviol = env->v7m.fpccr[is_secure] & R_V7M_FPCCR_SPLIMVIOL_MASK;
285 uint32_t fpcar = env->v7m.fpcar[is_secure];
286 bool stacked_ok = true;
287 bool ts = is_secure && (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
288 bool take_exception;
289
290
291 qemu_mutex_lock_iothread();
292
293
294 if (!v7m_cpacr_pass(env, is_secure, is_priv)) {
295 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, is_secure);
296 env->v7m.cfsr[is_secure] |= R_V7M_CFSR_NOCP_MASK;
297 stacked_ok = false;
298 } else if (!is_secure && !extract32(env->v7m.nsacr, 10, 1)) {
299 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
300 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
301 stacked_ok = false;
302 }
303
304 if (!splimviol && stacked_ok) {
305
306 int i;
307 ARMMMUIdx mmu_idx;
308
309 mmu_idx = arm_v7m_mmu_idx_all(env, is_secure, is_priv, negpri);
310 for (i = 0; i < (ts ? 32 : 16); i += 2) {
311 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
312 uint32_t faddr = fpcar + 4 * i;
313 uint32_t slo = extract64(dn, 0, 32);
314 uint32_t shi = extract64(dn, 32, 32);
315
316 if (i >= 16) {
317 faddr += 8;
318 }
319 stacked_ok = stacked_ok &&
320 v7m_stack_write(cpu, faddr, slo, mmu_idx, STACK_LAZYFP) &&
321 v7m_stack_write(cpu, faddr + 4, shi, mmu_idx, STACK_LAZYFP);
322 }
323
324 stacked_ok = stacked_ok &&
325 v7m_stack_write(cpu, fpcar + 0x40,
326 vfp_get_fpscr(env), mmu_idx, STACK_LAZYFP);
327 }
328
329
330
331
332
333
334
335
336
337 take_exception = !stacked_ok &&
338 armv7m_nvic_can_take_pending_exception(env->nvic);
339
340 qemu_mutex_unlock_iothread();
341
342 if (take_exception) {
343 raise_exception_ra(env, EXCP_LAZYFP, 0, 1, GETPC());
344 }
345
346 env->v7m.fpccr[is_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
347
348 if (ts) {
349
350 int i;
351
352 for (i = 0; i < 32; i += 2) {
353 *aa32_vfp_dreg(env, i / 2) = 0;
354 }
355 vfp_set_fpscr(env, 0);
356 }
357
358
359
360
361}
362
363
364
365
366
367
368
369static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
370 bool new_spsel,
371 bool secstate)
372{
373 bool old_is_psp = v7m_using_psp(env);
374
375 env->v7m.control[secstate] =
376 deposit32(env->v7m.control[secstate],
377 R_V7M_CONTROL_SPSEL_SHIFT,
378 R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
379
380 if (secstate == env->v7m.secure) {
381 bool new_is_psp = v7m_using_psp(env);
382 uint32_t tmp;
383
384 if (old_is_psp != new_is_psp) {
385 tmp = env->v7m.other_sp;
386 env->v7m.other_sp = env->regs[13];
387 env->regs[13] = tmp;
388 }
389 }
390}
391
392
393
394
395
396static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
397{
398 write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
399}
400
401void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
402{
403
404
405
406
407 bool new_is_psp, old_is_psp = v7m_using_psp(env);
408 uint32_t tmp;
409
410 env->v7m.exception = new_exc;
411
412 new_is_psp = v7m_using_psp(env);
413
414 if (old_is_psp != new_is_psp) {
415 tmp = env->v7m.other_sp;
416 env->v7m.other_sp = env->regs[13];
417 env->regs[13] = tmp;
418 }
419}
420
421
422static void switch_v7m_security_state(CPUARMState *env, bool new_secstate)
423{
424 uint32_t new_ss_msp, new_ss_psp;
425
426 if (env->v7m.secure == new_secstate) {
427 return;
428 }
429
430
431
432
433
434 new_ss_msp = env->v7m.other_ss_msp;
435 new_ss_psp = env->v7m.other_ss_psp;
436
437 if (v7m_using_psp(env)) {
438 env->v7m.other_ss_psp = env->regs[13];
439 env->v7m.other_ss_msp = env->v7m.other_sp;
440 } else {
441 env->v7m.other_ss_msp = env->regs[13];
442 env->v7m.other_ss_psp = env->v7m.other_sp;
443 }
444
445 env->v7m.secure = new_secstate;
446
447 if (v7m_using_psp(env)) {
448 env->regs[13] = new_ss_psp;
449 env->v7m.other_sp = new_ss_msp;
450 } else {
451 env->regs[13] = new_ss_msp;
452 env->v7m.other_sp = new_ss_psp;
453 }
454}
455
456void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
457{
458
459
460
461
462
463 uint32_t min_magic;
464
465 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
466
467 min_magic = FNC_RETURN_MIN_MAGIC;
468 } else {
469
470 min_magic = EXC_RETURN_MIN_MAGIC;
471 }
472
473 if (dest >= min_magic) {
474
475
476
477
478
479
480
481 env->regs[15] = dest & ~1;
482 env->thumb = dest & 1;
483 HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT);
484
485 }
486
487
488 assert(env->v7m.secure);
489
490 if (!(dest & 1)) {
491 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
492 }
493 switch_v7m_security_state(env, dest & 1);
494 env->thumb = 1;
495 env->regs[15] = dest & ~1;
496}
497
498void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
499{
500
501
502
503
504
505
506 uint32_t nextinst = env->regs[15] | 1;
507 uint32_t sp = env->regs[13] - 8;
508 uint32_t saved_psr;
509
510
511 assert(env->v7m.secure);
512
513 if (dest & 1) {
514
515
516
517
518 env->regs[14] = nextinst;
519 env->thumb = 1;
520 env->regs[15] = dest & ~1;
521 return;
522 }
523
524
525 if (!QEMU_IS_ALIGNED(sp, 8)) {
526 qemu_log_mask(LOG_GUEST_ERROR,
527 "BLXNS with misaligned SP is UNPREDICTABLE\n");
528 }
529
530 if (sp < v7m_sp_limit(env)) {
531 raise_exception(env, EXCP_STKOF, 0, 1);
532 }
533
534 saved_psr = env->v7m.exception;
535 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
536 saved_psr |= XPSR_SFPA;
537 }
538
539
540 cpu_stl_data_ra(env, sp, nextinst, GETPC());
541 cpu_stl_data_ra(env, sp + 4, saved_psr, GETPC());
542
543 env->regs[13] = sp;
544 env->regs[14] = 0xfeffffff;
545 if (arm_v7m_is_handler_mode(env)) {
546
547
548
549
550
551 write_v7m_exception(env, 1);
552 }
553 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
554 switch_v7m_security_state(env, 0);
555 env->thumb = 1;
556 env->regs[15] = dest;
557}
558
559static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
560 bool spsel)
561{
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578 bool want_psp = threadmode && spsel;
579
580 if (secure == env->v7m.secure) {
581 if (want_psp == v7m_using_psp(env)) {
582 return &env->regs[13];
583 } else {
584 return &env->v7m.other_sp;
585 }
586 } else {
587 if (want_psp) {
588 return &env->v7m.other_ss_psp;
589 } else {
590 return &env->v7m.other_ss_msp;
591 }
592 }
593}
594
595static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
596 uint32_t *pvec)
597{
598 CPUState *cs = CPU(cpu);
599 CPUARMState *env = &cpu->env;
600 MemTxResult result;
601 uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4;
602 uint32_t vector_entry;
603 MemTxAttrs attrs = {};
604 ARMMMUIdx mmu_idx;
605 bool exc_secure;
606
607 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
608
609
610
611
612
613
614
615
616
617 attrs.secure = targets_secure;
618 attrs.user = false;
619
620 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
621 V8M_SAttributes sattrs = {};
622
623 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs);
624 if (sattrs.ns) {
625 attrs.secure = false;
626 } else if (!targets_secure) {
627
628
629
630
631 exc_secure = true;
632 goto load_fail;
633 }
634 }
635
636 vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
637 attrs, &result);
638 if (result != MEMTX_OK) {
639
640
641
642
643 exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
644 goto load_fail;
645 }
646 *pvec = vector_entry;
647 return true;
648
649load_fail:
650
651
652
653
654
655
656
657
658
659
660
661 if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
662 exc_secure = true;
663 }
664 env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
665 armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
666 return false;
667}
668
669static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr)
670{
671
672
673
674
675
676 uint32_t sig = 0xfefa125a;
677
678 if (!arm_feature(env, ARM_FEATURE_VFP) || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
679 sig |= 1;
680 }
681 return sig;
682}
683
684static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
685 bool ignore_faults)
686{
687
688
689
690
691
692 CPUARMState *env = &cpu->env;
693 uint32_t *frame_sp_p;
694 uint32_t frameptr;
695 ARMMMUIdx mmu_idx;
696 bool stacked_ok;
697 uint32_t limit;
698 bool want_psp;
699 uint32_t sig;
700 StackingMode smode = ignore_faults ? STACK_IGNFAULTS : STACK_NORMAL;
701
702 if (dotailchain) {
703 bool mode = lr & R_V7M_EXCRET_MODE_MASK;
704 bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) ||
705 !mode;
706
707 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
708 frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,
709 lr & R_V7M_EXCRET_SPSEL_MASK);
710 want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
711 if (want_psp) {
712 limit = env->v7m.psplim[M_REG_S];
713 } else {
714 limit = env->v7m.msplim[M_REG_S];
715 }
716 } else {
717 mmu_idx = arm_mmu_idx(env);
718 frame_sp_p = &env->regs[13];
719 limit = v7m_sp_limit(env);
720 }
721
722 frameptr = *frame_sp_p - 0x28;
723 if (frameptr < limit) {
724
725
726
727
728
729
730 qemu_log_mask(CPU_LOG_INT,
731 "...STKOF during callee-saves register stacking\n");
732 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
733 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
734 env->v7m.secure);
735 *frame_sp_p = limit;
736 return true;
737 }
738
739
740
741
742
743 sig = v7m_integrity_sig(env, lr);
744 stacked_ok =
745 v7m_stack_write(cpu, frameptr, sig, mmu_idx, smode) &&
746 v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx, smode) &&
747 v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx, smode) &&
748 v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx, smode) &&
749 v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx, smode) &&
750 v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx, smode) &&
751 v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx, smode) &&
752 v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx, smode) &&
753 v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx, smode);
754
755
756 *frame_sp_p = frameptr;
757
758 return !stacked_ok;
759}
760
761static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
762 bool ignore_stackfaults)
763{
764
765
766
767
768
769 CPUARMState *env = &cpu->env;
770 uint32_t addr;
771 bool targets_secure;
772 int exc;
773 bool push_failed = false;
774
775 armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure);
776 qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n",
777 targets_secure ? "secure" : "nonsecure", exc);
778
779 if (dotailchain) {
780
781 if (!arm_feature(env, ARM_FEATURE_VFP)) {
782 lr |= R_V7M_EXCRET_FTYPE_MASK;
783 }
784 lr = deposit32(lr, 24, 8, 0xff);
785 }
786
787 if (arm_feature(env, ARM_FEATURE_V8)) {
788 if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
789 (lr & R_V7M_EXCRET_S_MASK)) {
790
791
792
793
794
795 if (targets_secure) {
796 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
797
798
799
800
801
802
803
804 lr &= ~R_V7M_EXCRET_DCRS_MASK;
805 }
806 } else {
807
808
809
810
811
812 if (lr & R_V7M_EXCRET_DCRS_MASK &&
813 !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) {
814 push_failed = v7m_push_callee_stack(cpu, lr, dotailchain,
815 ignore_stackfaults);
816 }
817 lr |= R_V7M_EXCRET_DCRS_MASK;
818 }
819 }
820
821 lr &= ~R_V7M_EXCRET_ES_MASK;
822 if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) {
823 lr |= R_V7M_EXCRET_ES_MASK;
824 }
825 lr &= ~R_V7M_EXCRET_SPSEL_MASK;
826 if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
827 lr |= R_V7M_EXCRET_SPSEL_MASK;
828 }
829
830
831
832
833
834
835
836 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
837 if (!targets_secure) {
838
839
840
841
842
843
844
845 int i;
846
847 for (i = 0; i < 13; i++) {
848
849 if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) {
850 env->regs[i] = 0;
851 }
852 }
853
854 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
855 }
856 }
857 }
858
859 if (push_failed && !ignore_stackfaults) {
860
861
862
863
864
865 qemu_log_mask(CPU_LOG_INT,
866 "...derived exception on callee-saves register stacking");
867 v7m_exception_taken(cpu, lr, true, true);
868 return;
869 }
870
871 if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) {
872
873 qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load");
874 v7m_exception_taken(cpu, lr, true, true);
875 return;
876 }
877
878
879
880
881
882
883 armv7m_nvic_acknowledge_irq(env->nvic);
884
885
886 switch_v7m_security_state(env, targets_secure);
887 write_v7m_control_spsel(env, 0);
888 arm_clear_exclusive(env);
889
890 env->v7m.control[M_REG_S] &=
891 ~(R_V7M_CONTROL_FPCA_MASK | R_V7M_CONTROL_SFPA_MASK);
892
893 env->condexec_bits = 0;
894 env->regs[14] = lr;
895 env->regs[15] = addr & 0xfffffffe;
896 env->thumb = addr & 1;
897}
898
899static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr,
900 bool apply_splim)
901{
902
903
904
905
906 bool is_secure = env->v7m.secure;
907 void *nvic = env->nvic;
908
909
910
911
912
913
914 uint32_t *fpccr_s = &env->v7m.fpccr[M_REG_S];
915 uint32_t *fpccr_ns = &env->v7m.fpccr[M_REG_NS];
916 uint32_t *fpccr = &env->v7m.fpccr[is_secure];
917 bool hfrdy, bfrdy, mmrdy, ns_ufrdy, s_ufrdy, sfrdy, monrdy;
918
919 env->v7m.fpcar[is_secure] = frameptr & ~0x7;
920
921 if (apply_splim && arm_feature(env, ARM_FEATURE_V8)) {
922 bool splimviol;
923 uint32_t splim = v7m_sp_limit(env);
924 bool ign = armv7m_nvic_neg_prio_requested(nvic, is_secure) &&
925 (env->v7m.ccr[is_secure] & R_V7M_CCR_STKOFHFNMIGN_MASK);
926
927 splimviol = !ign && frameptr < splim;
928 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, SPLIMVIOL, splimviol);
929 }
930
931 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, LSPACT, 1);
932
933 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, S, is_secure);
934
935 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, USER, arm_current_el(env) == 0);
936
937 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, THREAD,
938 !arm_v7m_is_handler_mode(env));
939
940 hfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_HARD, false);
941 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, HFRDY, hfrdy);
942
943 bfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_BUS, false);
944 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, BFRDY, bfrdy);
945
946 mmrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_MEM, is_secure);
947 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, MMRDY, mmrdy);
948
949 ns_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, false);
950 *fpccr_ns = FIELD_DP32(*fpccr_ns, V7M_FPCCR, UFRDY, ns_ufrdy);
951
952 monrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_DEBUG, false);
953 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, MONRDY, monrdy);
954
955 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
956 s_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, true);
957 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, UFRDY, s_ufrdy);
958
959 sfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_SECURE, false);
960 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, SFRDY, sfrdy);
961 }
962}
963
964void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
965{
966
967 bool s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
968 bool lspact = env->v7m.fpccr[s] & R_V7M_FPCCR_LSPACT_MASK;
969 uintptr_t ra = GETPC();
970
971 assert(env->v7m.secure);
972
973 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
974 return;
975 }
976
977
978 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
979 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
980 }
981
982 if (lspact) {
983
984 raise_exception_ra(env, EXCP_LSERR, 0, 1, GETPC());
985 }
986
987 if (fptr & 7) {
988 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
989 }
990
991
992
993
994
995
996
997
998 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
999 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1000 int i;
1001
1002 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1003 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1004 uint32_t faddr = fptr + 4 * i;
1005 uint32_t slo = extract64(dn, 0, 32);
1006 uint32_t shi = extract64(dn, 32, 32);
1007
1008 if (i >= 16) {
1009 faddr += 8;
1010 }
1011 cpu_stl_data_ra(env, faddr, slo, ra);
1012 cpu_stl_data_ra(env, faddr + 4, shi, ra);
1013 }
1014 cpu_stl_data_ra(env, fptr + 0x40, vfp_get_fpscr(env), ra);
1015
1016
1017
1018
1019
1020 if (ts) {
1021 for (i = 0; i < 32; i += 2) {
1022 *aa32_vfp_dreg(env, i / 2) = 0;
1023 }
1024 vfp_set_fpscr(env, 0);
1025 }
1026 } else {
1027 v7m_update_fpccr(env, fptr, false);
1028 }
1029
1030 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
1031}
1032
1033void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
1034{
1035 uintptr_t ra = GETPC();
1036
1037
1038 assert(env->v7m.secure);
1039
1040 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1041 return;
1042 }
1043
1044
1045 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
1046 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
1047 }
1048
1049 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1050
1051 env->v7m.fpccr[M_REG_S] &= ~R_V7M_FPCCR_LSPACT_MASK;
1052 } else {
1053 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1054 int i;
1055 uint32_t fpscr;
1056
1057 if (fptr & 7) {
1058 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
1059 }
1060
1061 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1062 uint32_t slo, shi;
1063 uint64_t dn;
1064 uint32_t faddr = fptr + 4 * i;
1065
1066 if (i >= 16) {
1067 faddr += 8;
1068 }
1069
1070 slo = cpu_ldl_data_ra(env, faddr, ra);
1071 shi = cpu_ldl_data_ra(env, faddr + 4, ra);
1072
1073 dn = (uint64_t) shi << 32 | slo;
1074 *aa32_vfp_dreg(env, i / 2) = dn;
1075 }
1076 fpscr = cpu_ldl_data_ra(env, fptr + 0x40, ra);
1077 vfp_set_fpscr(env, fpscr);
1078 }
1079
1080 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK;
1081}
1082
1083static bool v7m_push_stack(ARMCPU *cpu)
1084{
1085
1086
1087
1088
1089
1090
1091
1092 bool stacked_ok = true, limitviol = false;
1093 CPUARMState *env = &cpu->env;
1094 uint32_t xpsr = xpsr_read(env);
1095 uint32_t frameptr = env->regs[13];
1096 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1097 uint32_t framesize;
1098 bool nsacr_cp10 = extract32(env->v7m.nsacr, 10, 1);
1099
1100 if ((env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) &&
1101 (env->v7m.secure || nsacr_cp10)) {
1102 if (env->v7m.secure &&
1103 env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK) {
1104 framesize = 0xa8;
1105 } else {
1106 framesize = 0x68;
1107 }
1108 } else {
1109 framesize = 0x20;
1110 }
1111
1112
1113 if ((frameptr & 4) &&
1114 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) {
1115 frameptr -= 4;
1116 xpsr |= XPSR_SPREALIGN;
1117 }
1118
1119 xpsr &= ~XPSR_SFPA;
1120 if (env->v7m.secure &&
1121 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1122 xpsr |= XPSR_SFPA;
1123 }
1124
1125 frameptr -= framesize;
1126
1127 if (arm_feature(env, ARM_FEATURE_V8)) {
1128 uint32_t limit = v7m_sp_limit(env);
1129
1130 if (frameptr < limit) {
1131
1132
1133
1134
1135
1136
1137 qemu_log_mask(CPU_LOG_INT,
1138 "...STKOF during stacking\n");
1139 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
1140 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1141 env->v7m.secure);
1142 env->regs[13] = limit;
1143
1144
1145
1146
1147
1148
1149 limitviol = true;
1150 stacked_ok = false;
1151 }
1152 }
1153
1154
1155
1156
1157
1158
1159
1160 stacked_ok = stacked_ok &&
1161 v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, STACK_NORMAL) &&
1162 v7m_stack_write(cpu, frameptr + 4, env->regs[1],
1163 mmu_idx, STACK_NORMAL) &&
1164 v7m_stack_write(cpu, frameptr + 8, env->regs[2],
1165 mmu_idx, STACK_NORMAL) &&
1166 v7m_stack_write(cpu, frameptr + 12, env->regs[3],
1167 mmu_idx, STACK_NORMAL) &&
1168 v7m_stack_write(cpu, frameptr + 16, env->regs[12],
1169 mmu_idx, STACK_NORMAL) &&
1170 v7m_stack_write(cpu, frameptr + 20, env->regs[14],
1171 mmu_idx, STACK_NORMAL) &&
1172 v7m_stack_write(cpu, frameptr + 24, env->regs[15],
1173 mmu_idx, STACK_NORMAL) &&
1174 v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, STACK_NORMAL);
1175
1176 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) {
1177
1178 bool fpccr_s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
1179 bool lspact = env->v7m.fpccr[fpccr_s] & R_V7M_FPCCR_LSPACT_MASK;
1180
1181 if (lspact && arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1182 qemu_log_mask(CPU_LOG_INT,
1183 "...SecureFault because LSPACT and FPCA both set\n");
1184 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1185 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1186 } else if (!env->v7m.secure && !nsacr_cp10) {
1187 qemu_log_mask(CPU_LOG_INT,
1188 "...Secure UsageFault with CFSR.NOCP because "
1189 "NSACR.CP10 prevents stacking FP regs\n");
1190 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
1191 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
1192 } else {
1193 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1194
1195 int i;
1196 bool cpacr_pass = v7m_cpacr_pass(env, env->v7m.secure,
1197 arm_current_el(env) != 0);
1198
1199 if (stacked_ok && !cpacr_pass) {
1200
1201
1202
1203
1204
1205 qemu_log_mask(CPU_LOG_INT,
1206 "...UsageFault with CFSR.NOCP because "
1207 "CPACR.CP10 prevents stacking FP regs\n");
1208 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1209 env->v7m.secure);
1210 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK;
1211 stacked_ok = false;
1212 }
1213
1214 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1215 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1216 uint32_t faddr = frameptr + 0x20 + 4 * i;
1217 uint32_t slo = extract64(dn, 0, 32);
1218 uint32_t shi = extract64(dn, 32, 32);
1219
1220 if (i >= 16) {
1221 faddr += 8;
1222 }
1223 stacked_ok = stacked_ok &&
1224 v7m_stack_write(cpu, faddr, slo,
1225 mmu_idx, STACK_NORMAL) &&
1226 v7m_stack_write(cpu, faddr + 4, shi,
1227 mmu_idx, STACK_NORMAL);
1228 }
1229 stacked_ok = stacked_ok &&
1230 v7m_stack_write(cpu, frameptr + 0x60,
1231 vfp_get_fpscr(env), mmu_idx, STACK_NORMAL);
1232 if (cpacr_pass) {
1233 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1234 *aa32_vfp_dreg(env, i / 2) = 0;
1235 }
1236 vfp_set_fpscr(env, 0);
1237 }
1238 } else {
1239
1240 v7m_update_fpccr(env, frameptr + 0x20, true);
1241 }
1242 }
1243 }
1244
1245
1246
1247
1248
1249
1250 if (!limitviol) {
1251 env->regs[13] = frameptr;
1252 }
1253
1254 return !stacked_ok;
1255}
1256
1257static void do_v7m_exception_exit(ARMCPU *cpu)
1258{
1259 CPUARMState *env = &cpu->env;
1260 uint32_t excret;
1261 uint32_t xpsr, xpsr_mask;
1262 bool ufault = false;
1263 bool sfault = false;
1264 bool return_to_sp_process;
1265 bool return_to_handler;
1266 bool rettobase = false;
1267 bool exc_secure = false;
1268 bool return_to_secure;
1269 bool ftype;
1270 bool restore_s16_s31;
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283 if (!arm_v7m_is_handler_mode(env)) {
1284 return;
1285 }
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295 excret = env->regs[15];
1296 if (env->thumb) {
1297 excret |= 1;
1298 }
1299
1300 qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
1301 " previous exception %d\n",
1302 excret, env->v7m.exception);
1303
1304 if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
1305 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
1306 "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
1307 excret);
1308 }
1309
1310 ftype = excret & R_V7M_EXCRET_FTYPE_MASK;
1311
1312 if (!arm_feature(env, ARM_FEATURE_VFP) && !ftype) {
1313 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception "
1314 "exit PC value 0x%" PRIx32 " is UNPREDICTABLE "
1315 "if FPU not present\n",
1316 excret);
1317 ftype = true;
1318 }
1319
1320 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1321
1322
1323
1324
1325 if (!env->v7m.secure &&
1326 ((excret & R_V7M_EXCRET_ES_MASK) ||
1327 !(excret & R_V7M_EXCRET_DCRS_MASK))) {
1328 sfault = 1;
1329
1330 excret &= ~R_V7M_EXCRET_ES_MASK;
1331 }
1332 exc_secure = excret & R_V7M_EXCRET_ES_MASK;
1333 }
1334
1335 if (env->v7m.exception != ARMV7M_EXCP_NMI) {
1336
1337
1338
1339
1340
1341
1342
1343 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1344 if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
1345 env->v7m.faultmask[exc_secure] = 0;
1346 }
1347 } else {
1348 env->v7m.faultmask[M_REG_NS] = 0;
1349 }
1350 }
1351
1352 switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception,
1353 exc_secure)) {
1354 case -1:
1355
1356 ufault = true;
1357 break;
1358 case 0:
1359
1360 break;
1361 case 1:
1362
1363
1364
1365
1366
1367 rettobase = true;
1368 break;
1369 default:
1370 g_assert_not_reached();
1371 }
1372
1373 return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
1374 return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
1375 return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
1376 (excret & R_V7M_EXCRET_S_MASK);
1377
1378 if (arm_feature(env, ARM_FEATURE_V8)) {
1379 if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1380
1381
1382
1383
1384 if ((excret & R_V7M_EXCRET_S_MASK) ||
1385 (excret & R_V7M_EXCRET_ES_MASK) ||
1386 !(excret & R_V7M_EXCRET_DCRS_MASK)) {
1387 ufault = true;
1388 }
1389 }
1390 if (excret & R_V7M_EXCRET_RES0_MASK) {
1391 ufault = true;
1392 }
1393 } else {
1394
1395 switch (excret & 0xf) {
1396 case 1:
1397 break;
1398 case 13:
1399 case 9:
1400
1401
1402
1403
1404 if (!rettobase &&
1405 !(env->v7m.ccr[env->v7m.secure] &
1406 R_V7M_CCR_NONBASETHRDENA_MASK)) {
1407 ufault = true;
1408 }
1409 break;
1410 default:
1411 ufault = true;
1412 }
1413 }
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423 write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
1424
1425
1426
1427
1428
1429 if ((env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_CLRONRET_MASK) &&
1430 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
1431 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1432 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1433 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1434 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1435 "stackframe: error during lazy state deactivation\n");
1436 v7m_exception_taken(cpu, excret, true, false);
1437 return;
1438 } else {
1439
1440 int i;
1441
1442 for (i = 0; i < 16; i += 2) {
1443 *aa32_vfp_dreg(env, i / 2) = 0;
1444 }
1445 vfp_set_fpscr(env, 0);
1446 }
1447 }
1448
1449 if (sfault) {
1450 env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
1451 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1452 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1453 "stackframe: failed EXC_RETURN.ES validity check\n");
1454 v7m_exception_taken(cpu, excret, true, false);
1455 return;
1456 }
1457
1458 if (ufault) {
1459
1460
1461
1462
1463 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1464 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
1465 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1466 "stackframe: failed exception return integrity check\n");
1467 v7m_exception_taken(cpu, excret, true, false);
1468 return;
1469 }
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481 if (armv7m_nvic_can_take_pending_exception(env->nvic)) {
1482 qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n");
1483 v7m_exception_taken(cpu, excret, true, false);
1484 return;
1485 }
1486
1487 switch_v7m_security_state(env, return_to_secure);
1488
1489 {
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500 uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
1501 return_to_secure,
1502 !return_to_handler,
1503 return_to_sp_process);
1504 uint32_t frameptr = *frame_sp_p;
1505 bool pop_ok = true;
1506 ARMMMUIdx mmu_idx;
1507 bool return_to_priv = return_to_handler ||
1508 !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK);
1509
1510 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure,
1511 return_to_priv);
1512
1513 if (!QEMU_IS_ALIGNED(frameptr, 8) &&
1514 arm_feature(env, ARM_FEATURE_V8)) {
1515 qemu_log_mask(LOG_GUEST_ERROR,
1516 "M profile exception return with non-8-aligned SP "
1517 "for destination state is UNPREDICTABLE\n");
1518 }
1519
1520
1521 if (return_to_secure &&
1522 ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
1523 (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
1524 uint32_t actual_sig;
1525
1526 pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx);
1527
1528 if (pop_ok && v7m_integrity_sig(env, excret) != actual_sig) {
1529
1530 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
1531 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1532 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1533 "stackframe: failed exception return integrity "
1534 "signature check\n");
1535 v7m_exception_taken(cpu, excret, true, false);
1536 return;
1537 }
1538
1539 pop_ok = pop_ok &&
1540 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
1541 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) &&
1542 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) &&
1543 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) &&
1544 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) &&
1545 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) &&
1546 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) &&
1547 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx);
1548
1549 frameptr += 0x28;
1550 }
1551
1552
1553 pop_ok = pop_ok &&
1554 v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) &&
1555 v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) &&
1556 v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) &&
1557 v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) &&
1558 v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) &&
1559 v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) &&
1560 v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) &&
1561 v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx);
1562
1563 if (!pop_ok) {
1564
1565
1566
1567
1568 qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n");
1569 v7m_exception_taken(cpu, excret, true, false);
1570 return;
1571 }
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582 if (env->regs[15] & 1) {
1583 env->regs[15] &= ~1U;
1584 if (!arm_feature(env, ARM_FEATURE_V8)) {
1585 qemu_log_mask(LOG_GUEST_ERROR,
1586 "M profile return from interrupt with misaligned "
1587 "PC is UNPREDICTABLE on v7M\n");
1588 }
1589 }
1590
1591 if (arm_feature(env, ARM_FEATURE_V8)) {
1592
1593
1594
1595
1596
1597 bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
1598 if (return_to_handler != will_be_handler) {
1599
1600
1601
1602
1603
1604
1605 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1606 env->v7m.secure);
1607 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1608 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1609 "stackframe: failed exception return integrity "
1610 "check\n");
1611 v7m_exception_taken(cpu, excret, true, false);
1612 return;
1613 }
1614 }
1615
1616 if (!ftype) {
1617
1618 if (!return_to_secure &&
1619 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK)) {
1620 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1621 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1622 qemu_log_mask(CPU_LOG_INT,
1623 "...taking SecureFault on existing stackframe: "
1624 "Secure LSPACT set but exception return is "
1625 "not to secure state\n");
1626 v7m_exception_taken(cpu, excret, true, false);
1627 return;
1628 }
1629
1630 restore_s16_s31 = return_to_secure &&
1631 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
1632
1633 if (env->v7m.fpccr[return_to_secure] & R_V7M_FPCCR_LSPACT_MASK) {
1634
1635 env->v7m.fpccr[return_to_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
1636 } else {
1637 int i;
1638 uint32_t fpscr;
1639 bool cpacr_pass, nsacr_pass;
1640
1641 cpacr_pass = v7m_cpacr_pass(env, return_to_secure,
1642 return_to_priv);
1643 nsacr_pass = return_to_secure ||
1644 extract32(env->v7m.nsacr, 10, 1);
1645
1646 if (!cpacr_pass) {
1647 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1648 return_to_secure);
1649 env->v7m.cfsr[return_to_secure] |= R_V7M_CFSR_NOCP_MASK;
1650 qemu_log_mask(CPU_LOG_INT,
1651 "...taking UsageFault on existing "
1652 "stackframe: CPACR.CP10 prevents unstacking "
1653 "FP regs\n");
1654 v7m_exception_taken(cpu, excret, true, false);
1655 return;
1656 } else if (!nsacr_pass) {
1657 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
1658 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_INVPC_MASK;
1659 qemu_log_mask(CPU_LOG_INT,
1660 "...taking Secure UsageFault on existing "
1661 "stackframe: NSACR.CP10 prevents unstacking "
1662 "FP regs\n");
1663 v7m_exception_taken(cpu, excret, true, false);
1664 return;
1665 }
1666
1667 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1668 uint32_t slo, shi;
1669 uint64_t dn;
1670 uint32_t faddr = frameptr + 0x20 + 4 * i;
1671
1672 if (i >= 16) {
1673 faddr += 8;
1674 }
1675
1676 pop_ok = pop_ok &&
1677 v7m_stack_read(cpu, &slo, faddr, mmu_idx) &&
1678 v7m_stack_read(cpu, &shi, faddr + 4, mmu_idx);
1679
1680 if (!pop_ok) {
1681 break;
1682 }
1683
1684 dn = (uint64_t)shi << 32 | slo;
1685 *aa32_vfp_dreg(env, i / 2) = dn;
1686 }
1687 pop_ok = pop_ok &&
1688 v7m_stack_read(cpu, &fpscr, frameptr + 0x60, mmu_idx);
1689 if (pop_ok) {
1690 vfp_set_fpscr(env, fpscr);
1691 }
1692 if (!pop_ok) {
1693
1694
1695
1696
1697 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1698 *aa32_vfp_dreg(env, i / 2) = 0;
1699 }
1700 vfp_set_fpscr(env, 0);
1701 }
1702 }
1703 }
1704 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1705 V7M_CONTROL, FPCA, !ftype);
1706
1707
1708 frameptr += 0x20;
1709 if (!ftype) {
1710 frameptr += 0x48;
1711 if (restore_s16_s31) {
1712 frameptr += 0x40;
1713 }
1714 }
1715
1716
1717
1718
1719
1720
1721
1722 if (xpsr & XPSR_SPREALIGN) {
1723 frameptr |= 4;
1724 }
1725 *frame_sp_p = frameptr;
1726 }
1727
1728 xpsr_mask = ~(XPSR_SPREALIGN | XPSR_SFPA);
1729 if (!arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
1730 xpsr_mask &= ~XPSR_GE;
1731 }
1732
1733 xpsr_write(env, xpsr, xpsr_mask);
1734
1735 if (env->v7m.secure) {
1736 bool sfpa = xpsr & XPSR_SFPA;
1737
1738 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1739 V7M_CONTROL, SFPA, sfpa);
1740 }
1741
1742
1743
1744
1745
1746
1747
1748 if (return_to_handler != arm_v7m_is_handler_mode(env)) {
1749
1750
1751
1752
1753 bool ignore_stackfaults;
1754
1755 assert(!arm_feature(env, ARM_FEATURE_V8));
1756 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
1757 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1758 ignore_stackfaults = v7m_push_stack(cpu);
1759 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
1760 "failed exception return integrity check\n");
1761 v7m_exception_taken(cpu, excret, false, ignore_stackfaults);
1762 return;
1763 }
1764
1765
1766 arm_clear_exclusive(env);
1767 qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
1768}
1769
1770static bool do_v7m_function_return(ARMCPU *cpu)
1771{
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784 CPUARMState *env = &cpu->env;
1785 uint32_t newpc, newpsr, newpsr_exc;
1786
1787 qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n");
1788
1789 {
1790 bool threadmode, spsel;
1791 TCGMemOpIdx oi;
1792 ARMMMUIdx mmu_idx;
1793 uint32_t *frame_sp_p;
1794 uint32_t frameptr;
1795
1796
1797 threadmode = !arm_v7m_is_handler_mode(env);
1798 spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
1799
1800 frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
1801 frameptr = *frame_sp_p;
1802
1803
1804
1805
1806
1807 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
1808 oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx));
1809 newpc = helper_le_ldul_mmu(env, frameptr, oi, 0);
1810 newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0);
1811
1812
1813 newpsr_exc = newpsr & XPSR_EXCP;
1814 if (!((env->v7m.exception == 0 && newpsr_exc == 0) ||
1815 (env->v7m.exception == 1 && newpsr_exc != 0))) {
1816
1817 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1818 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1819 env->v7m.secure);
1820 qemu_log_mask(CPU_LOG_INT,
1821 "...taking INVPC UsageFault: "
1822 "IPSR consistency check failed\n");
1823 return false;
1824 }
1825
1826 *frame_sp_p = frameptr + 8;
1827 }
1828
1829
1830 switch_v7m_security_state(env, true);
1831 env->v7m.exception = newpsr_exc;
1832 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
1833 if (newpsr & XPSR_SFPA) {
1834 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK;
1835 }
1836 xpsr_write(env, 0, XPSR_IT);
1837 env->thumb = newpc & 1;
1838 env->regs[15] = newpc & ~1;
1839
1840 qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
1841 return true;
1842}
1843
1844static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
1845 uint32_t addr, uint16_t *insn)
1846{
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859 CPUState *cs = CPU(cpu);
1860 CPUARMState *env = &cpu->env;
1861 V8M_SAttributes sattrs = {};
1862 MemTxAttrs attrs = {};
1863 ARMMMUFaultInfo fi = {};
1864 MemTxResult txres;
1865 target_ulong page_size;
1866 hwaddr physaddr;
1867 int prot;
1868
1869 v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs);
1870 if (!sattrs.nsc || sattrs.ns) {
1871
1872
1873
1874
1875 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
1876 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1877 qemu_log_mask(CPU_LOG_INT,
1878 "...really SecureFault with SFSR.INVEP\n");
1879 return false;
1880 }
1881 if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
1882 &physaddr, &attrs, &prot, &page_size, &fi, NULL)) {
1883
1884 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
1885 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
1886 qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
1887 return false;
1888 }
1889 *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr,
1890 attrs, &txres);
1891 if (txres != MEMTX_OK) {
1892 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
1893 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
1894 qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");
1895 return false;
1896 }
1897 return true;
1898}
1899
1900static bool v7m_handle_execute_nsc(ARMCPU *cpu)
1901{
1902
1903
1904
1905
1906
1907
1908 CPUARMState *env = &cpu->env;
1909 ARMMMUIdx mmu_idx;
1910 uint16_t insn;
1911
1912
1913
1914
1915
1916 assert(!env->v7m.secure);
1917 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
1918
1919
1920 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
1921
1922 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) {
1923 return false;
1924 }
1925
1926 if (!env->thumb) {
1927 goto gen_invep;
1928 }
1929
1930 if (insn != 0xe97f) {
1931
1932
1933
1934
1935 goto gen_invep;
1936 }
1937
1938 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) {
1939 return false;
1940 }
1941
1942 if (insn != 0xe97f) {
1943
1944
1945
1946
1947 goto gen_invep;
1948 }
1949
1950
1951
1952
1953
1954 qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
1955 ", executing it\n", env->regs[15]);
1956 env->regs[14] &= ~1;
1957 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
1958 switch_v7m_security_state(env, true);
1959 xpsr_write(env, 0, XPSR_IT);
1960 env->regs[15] += 4;
1961 return true;
1962
1963gen_invep:
1964 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
1965 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1966 qemu_log_mask(CPU_LOG_INT,
1967 "...really SecureFault with SFSR.INVEP\n");
1968 return false;
1969}
1970
1971void arm_v7m_cpu_do_interrupt(CPUState *cs)
1972{
1973 ARMCPU *cpu = ARM_CPU(cs);
1974 CPUARMState *env = &cpu->env;
1975 uint32_t lr;
1976 bool ignore_stackfaults;
1977
1978 arm_log_exception(cs->exception_index);
1979
1980
1981
1982
1983
1984 switch (cs->exception_index) {
1985 case EXCP_UDEF:
1986 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
1987 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK;
1988 break;
1989 case EXCP_NOCP:
1990 {
1991
1992
1993
1994
1995
1996 int target_secstate;
1997
1998 if (env->exception.target_el == 3) {
1999 target_secstate = M_REG_S;
2000 } else {
2001 target_secstate = env->v7m.secure;
2002 }
2003 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, target_secstate);
2004 env->v7m.cfsr[target_secstate] |= R_V7M_CFSR_NOCP_MASK;
2005 break;
2006 }
2007 case EXCP_INVSTATE:
2008 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2009 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK;
2010 break;
2011 case EXCP_STKOF:
2012 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2013 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
2014 break;
2015 case EXCP_LSERR:
2016 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2017 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
2018 break;
2019 case EXCP_UNALIGNED:
2020 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2021 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
2022 break;
2023 case EXCP_SWI:
2024
2025 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure);
2026 break;
2027 case EXCP_PREFETCH_ABORT:
2028 case EXCP_DATA_ABORT:
2029
2030
2031
2032
2033
2034 switch (env->exception.fsr & 0xf) {
2035 case M_FAKE_FSR_NSC_EXEC:
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045 if (v7m_handle_execute_nsc(cpu)) {
2046 return;
2047 }
2048 break;
2049 case M_FAKE_FSR_SFAULT:
2050
2051
2052
2053
2054 switch (cs->exception_index) {
2055 case EXCP_PREFETCH_ABORT:
2056 if (env->v7m.secure) {
2057 env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
2058 qemu_log_mask(CPU_LOG_INT,
2059 "...really SecureFault with SFSR.INVTRAN\n");
2060 } else {
2061 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2062 qemu_log_mask(CPU_LOG_INT,
2063 "...really SecureFault with SFSR.INVEP\n");
2064 }
2065 break;
2066 case EXCP_DATA_ABORT:
2067
2068 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
2069 qemu_log_mask(CPU_LOG_INT,
2070 "...really SecureFault with SFSR.AUVIOL\n");
2071 break;
2072 }
2073 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2074 break;
2075 case 0x8:
2076 switch (cs->exception_index) {
2077 case EXCP_PREFETCH_ABORT:
2078 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
2079 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
2080 break;
2081 case EXCP_DATA_ABORT:
2082 env->v7m.cfsr[M_REG_NS] |=
2083 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
2084 env->v7m.bfar = env->exception.vaddress;
2085 qemu_log_mask(CPU_LOG_INT,
2086 "...with CFSR.PRECISERR and BFAR 0x%x\n",
2087 env->v7m.bfar);
2088 break;
2089 }
2090 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2091 break;
2092 default:
2093
2094
2095
2096
2097 switch (cs->exception_index) {
2098 case EXCP_PREFETCH_ABORT:
2099 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
2100 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
2101 break;
2102 case EXCP_DATA_ABORT:
2103 env->v7m.cfsr[env->v7m.secure] |=
2104 (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
2105 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress;
2106 qemu_log_mask(CPU_LOG_INT,
2107 "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
2108 env->v7m.mmfar[env->v7m.secure]);
2109 break;
2110 }
2111 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM,
2112 env->v7m.secure);
2113 break;
2114 }
2115 break;
2116 case EXCP_BKPT:
2117 if (semihosting_enabled()) {
2118 int nr;
2119 nr = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) & 0xff;
2120 if (nr == 0xab) {
2121 env->regs[15] += 2;
2122 qemu_log_mask(CPU_LOG_INT,
2123 "...handling as semihosting call 0x%x\n",
2124 env->regs[0]);
2125 env->regs[0] = do_arm_semihosting(env);
2126 return;
2127 }
2128 }
2129 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false);
2130 break;
2131 case EXCP_IRQ:
2132 break;
2133 case EXCP_EXCEPTION_EXIT:
2134 if (env->regs[15] < EXC_RETURN_MIN_MAGIC) {
2135
2136 assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC);
2137 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
2138 if (do_v7m_function_return(cpu)) {
2139 return;
2140 }
2141 } else {
2142 do_v7m_exception_exit(cpu);
2143 return;
2144 }
2145 break;
2146 case EXCP_LAZYFP:
2147
2148
2149
2150
2151 break;
2152 default:
2153 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
2154 return;
2155 }
2156
2157 if (arm_feature(env, ARM_FEATURE_V8)) {
2158 lr = R_V7M_EXCRET_RES1_MASK |
2159 R_V7M_EXCRET_DCRS_MASK;
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172 if (env->v7m.secure) {
2173 lr |= R_V7M_EXCRET_S_MASK;
2174 }
2175 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
2176 lr |= R_V7M_EXCRET_FTYPE_MASK;
2177 }
2178 } else {
2179 lr = R_V7M_EXCRET_RES1_MASK |
2180 R_V7M_EXCRET_S_MASK |
2181 R_V7M_EXCRET_DCRS_MASK |
2182 R_V7M_EXCRET_FTYPE_MASK |
2183 R_V7M_EXCRET_ES_MASK;
2184 if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
2185 lr |= R_V7M_EXCRET_SPSEL_MASK;
2186 }
2187 }
2188 if (!arm_v7m_is_handler_mode(env)) {
2189 lr |= R_V7M_EXCRET_MODE_MASK;
2190 }
2191
2192 ignore_stackfaults = v7m_push_stack(cpu);
2193 v7m_exception_taken(cpu, lr, false, ignore_stackfaults);
2194}
2195
2196uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
2197{
2198 uint32_t mask;
2199 unsigned el = arm_current_el(env);
2200
2201
2202
2203 switch (reg) {
2204 case 0 ... 7:
2205 mask = 0;
2206 if ((reg & 1) && el) {
2207 mask |= XPSR_EXCP;
2208 }
2209 if (!(reg & 4)) {
2210 mask |= XPSR_NZCV | XPSR_Q;
2211 if (arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
2212 mask |= XPSR_GE;
2213 }
2214 }
2215
2216 return xpsr_read(env) & mask;
2217 break;
2218 case 20:
2219 {
2220 uint32_t value = env->v7m.control[env->v7m.secure];
2221 if (!env->v7m.secure) {
2222
2223 value |= env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK;
2224 }
2225 return value;
2226 }
2227 case 0x94:
2228
2229
2230
2231
2232 if (!env->v7m.secure) {
2233 return 0;
2234 }
2235 return env->v7m.control[M_REG_NS] |
2236 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK);
2237 }
2238
2239 if (el == 0) {
2240 return 0;
2241 }
2242
2243 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2244 switch (reg) {
2245 case 0x88:
2246 if (!env->v7m.secure) {
2247 return 0;
2248 }
2249 return env->v7m.other_ss_msp;
2250 case 0x89:
2251 if (!env->v7m.secure) {
2252 return 0;
2253 }
2254 return env->v7m.other_ss_psp;
2255 case 0x8a:
2256 if (!env->v7m.secure) {
2257 return 0;
2258 }
2259 return env->v7m.msplim[M_REG_NS];
2260 case 0x8b:
2261 if (!env->v7m.secure) {
2262 return 0;
2263 }
2264 return env->v7m.psplim[M_REG_NS];
2265 case 0x90:
2266 if (!env->v7m.secure) {
2267 return 0;
2268 }
2269 return env->v7m.primask[M_REG_NS];
2270 case 0x91:
2271 if (!env->v7m.secure) {
2272 return 0;
2273 }
2274 return env->v7m.basepri[M_REG_NS];
2275 case 0x93:
2276 if (!env->v7m.secure) {
2277 return 0;
2278 }
2279 return env->v7m.faultmask[M_REG_NS];
2280 case 0x98:
2281 {
2282
2283
2284
2285
2286 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2287
2288 if (!env->v7m.secure) {
2289 return 0;
2290 }
2291 if (!arm_v7m_is_handler_mode(env) && spsel) {
2292 return env->v7m.other_ss_psp;
2293 } else {
2294 return env->v7m.other_ss_msp;
2295 }
2296 }
2297 default:
2298 break;
2299 }
2300 }
2301
2302 switch (reg) {
2303 case 8:
2304 return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];
2305 case 9:
2306 return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;
2307 case 10:
2308 if (!arm_feature(env, ARM_FEATURE_V8)) {
2309 goto bad_reg;
2310 }
2311 return env->v7m.msplim[env->v7m.secure];
2312 case 11:
2313 if (!arm_feature(env, ARM_FEATURE_V8)) {
2314 goto bad_reg;
2315 }
2316 return env->v7m.psplim[env->v7m.secure];
2317 case 16:
2318 return env->v7m.primask[env->v7m.secure];
2319 case 17:
2320 case 18:
2321 return env->v7m.basepri[env->v7m.secure];
2322 case 19:
2323 return env->v7m.faultmask[env->v7m.secure];
2324 default:
2325 bad_reg:
2326 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"
2327 " register %d\n", reg);
2328 return 0;
2329 }
2330}
2331
2332void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
2333{
2334
2335
2336
2337
2338
2339
2340
2341
2342 uint32_t mask = extract32(maskreg, 8, 4);
2343 uint32_t reg = extract32(maskreg, 0, 8);
2344 int cur_el = arm_current_el(env);
2345
2346 if (cur_el == 0 && reg > 7 && reg != 20) {
2347
2348
2349
2350
2351 return;
2352 }
2353
2354 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2355 switch (reg) {
2356 case 0x88:
2357 if (!env->v7m.secure) {
2358 return;
2359 }
2360 env->v7m.other_ss_msp = val;
2361 return;
2362 case 0x89:
2363 if (!env->v7m.secure) {
2364 return;
2365 }
2366 env->v7m.other_ss_psp = val;
2367 return;
2368 case 0x8a:
2369 if (!env->v7m.secure) {
2370 return;
2371 }
2372 env->v7m.msplim[M_REG_NS] = val & ~7;
2373 return;
2374 case 0x8b:
2375 if (!env->v7m.secure) {
2376 return;
2377 }
2378 env->v7m.psplim[M_REG_NS] = val & ~7;
2379 return;
2380 case 0x90:
2381 if (!env->v7m.secure) {
2382 return;
2383 }
2384 env->v7m.primask[M_REG_NS] = val & 1;
2385 return;
2386 case 0x91:
2387 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) {
2388 return;
2389 }
2390 env->v7m.basepri[M_REG_NS] = val & 0xff;
2391 return;
2392 case 0x93:
2393 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) {
2394 return;
2395 }
2396 env->v7m.faultmask[M_REG_NS] = val & 1;
2397 return;
2398 case 0x94:
2399 if (!env->v7m.secure) {
2400 return;
2401 }
2402 write_v7m_control_spsel_for_secstate(env,
2403 val & R_V7M_CONTROL_SPSEL_MASK,
2404 M_REG_NS);
2405 if (arm_feature(env, ARM_FEATURE_M_MAIN)) {
2406 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK;
2407 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK;
2408 }
2409
2410
2411
2412
2413 if (arm_feature(env, ARM_FEATURE_VFP) &&
2414 extract32(env->v7m.nsacr, 10, 1)) {
2415 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2416 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2417 }
2418 return;
2419 case 0x98:
2420 {
2421
2422
2423
2424
2425 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2426 bool is_psp = !arm_v7m_is_handler_mode(env) && spsel;
2427 uint32_t limit;
2428
2429 if (!env->v7m.secure) {
2430 return;
2431 }
2432
2433 limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
2434
2435 if (val < limit) {
2436 CPUState *cs = env_cpu(env);
2437
2438 cpu_restore_state(cs, GETPC(), true);
2439 raise_exception(env, EXCP_STKOF, 0, 1);
2440 }
2441
2442 if (is_psp) {
2443 env->v7m.other_ss_psp = val;
2444 } else {
2445 env->v7m.other_ss_msp = val;
2446 }
2447 return;
2448 }
2449 default:
2450 break;
2451 }
2452 }
2453
2454 switch (reg) {
2455 case 0 ... 7:
2456
2457 if (!(reg & 4)) {
2458 uint32_t apsrmask = 0;
2459
2460 if (mask & 8) {
2461 apsrmask |= XPSR_NZCV | XPSR_Q;
2462 }
2463 if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
2464 apsrmask |= XPSR_GE;
2465 }
2466 xpsr_write(env, val, apsrmask);
2467 }
2468 break;
2469 case 8:
2470 if (v7m_using_psp(env)) {
2471 env->v7m.other_sp = val;
2472 } else {
2473 env->regs[13] = val;
2474 }
2475 break;
2476 case 9:
2477 if (v7m_using_psp(env)) {
2478 env->regs[13] = val;
2479 } else {
2480 env->v7m.other_sp = val;
2481 }
2482 break;
2483 case 10:
2484 if (!arm_feature(env, ARM_FEATURE_V8)) {
2485 goto bad_reg;
2486 }
2487 env->v7m.msplim[env->v7m.secure] = val & ~7;
2488 break;
2489 case 11:
2490 if (!arm_feature(env, ARM_FEATURE_V8)) {
2491 goto bad_reg;
2492 }
2493 env->v7m.psplim[env->v7m.secure] = val & ~7;
2494 break;
2495 case 16:
2496 env->v7m.primask[env->v7m.secure] = val & 1;
2497 break;
2498 case 17:
2499 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2500 goto bad_reg;
2501 }
2502 env->v7m.basepri[env->v7m.secure] = val & 0xff;
2503 break;
2504 case 18:
2505 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2506 goto bad_reg;
2507 }
2508 val &= 0xff;
2509 if (val != 0 && (val < env->v7m.basepri[env->v7m.secure]
2510 || env->v7m.basepri[env->v7m.secure] == 0)) {
2511 env->v7m.basepri[env->v7m.secure] = val;
2512 }
2513 break;
2514 case 19:
2515 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2516 goto bad_reg;
2517 }
2518 env->v7m.faultmask[env->v7m.secure] = val & 1;
2519 break;
2520 case 20:
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531 if (cur_el > 0 && (arm_feature(env, ARM_FEATURE_V8) ||
2532 !arm_v7m_is_handler_mode(env))) {
2533 write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
2534 }
2535 if (cur_el > 0 && arm_feature(env, ARM_FEATURE_M_MAIN)) {
2536 env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
2537 env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
2538 }
2539 if (arm_feature(env, ARM_FEATURE_VFP)) {
2540
2541
2542
2543
2544
2545 if (env->v7m.secure) {
2546 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
2547 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_SFPA_MASK;
2548 }
2549 if (cur_el > 0 &&
2550 (env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_SECURITY) ||
2551 extract32(env->v7m.nsacr, 10, 1))) {
2552 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2553 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2554 }
2555 }
2556 break;
2557 default:
2558 bad_reg:
2559 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
2560 " register %d\n", reg);
2561 return;
2562 }
2563}
2564
2565uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
2566{
2567
2568 bool forceunpriv = op & 1;
2569 bool alt = op & 2;
2570 V8M_SAttributes sattrs = {};
2571 uint32_t tt_resp;
2572 bool r, rw, nsr, nsrw, mrvalid;
2573 int prot;
2574 ARMMMUFaultInfo fi = {};
2575 MemTxAttrs attrs = {};
2576 hwaddr phys_addr;
2577 ARMMMUIdx mmu_idx;
2578 uint32_t mregion;
2579 bool targetpriv;
2580 bool targetsec = env->v7m.secure;
2581 bool is_subpage;
2582
2583
2584
2585
2586
2587 if (alt) {
2588 targetsec = !targetsec;
2589 }
2590
2591 if (forceunpriv) {
2592 targetpriv = false;
2593 } else {
2594 targetpriv = arm_v7m_is_handler_mode(env) ||
2595 !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK);
2596 }
2597
2598
2599 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv);
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611 if (arm_current_el(env) != 0 || alt) {
2612
2613 pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx,
2614 &phys_addr, &attrs, &prot, &is_subpage,
2615 &fi, &mregion);
2616 if (mregion == -1) {
2617 mrvalid = false;
2618 mregion = 0;
2619 } else {
2620 mrvalid = true;
2621 }
2622 r = prot & PAGE_READ;
2623 rw = prot & PAGE_WRITE;
2624 } else {
2625 r = false;
2626 rw = false;
2627 mrvalid = false;
2628 mregion = 0;
2629 }
2630
2631 if (env->v7m.secure) {
2632 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs);
2633 nsr = sattrs.ns && r;
2634 nsrw = sattrs.ns && rw;
2635 } else {
2636 sattrs.ns = true;
2637 nsr = false;
2638 nsrw = false;
2639 }
2640
2641 tt_resp = (sattrs.iregion << 24) |
2642 (sattrs.irvalid << 23) |
2643 ((!sattrs.ns) << 22) |
2644 (nsrw << 21) |
2645 (nsr << 20) |
2646 (rw << 19) |
2647 (r << 18) |
2648 (sattrs.srvalid << 17) |
2649 (mrvalid << 16) |
2650 (sattrs.sregion << 8) |
2651 mregion;
2652
2653 return tt_resp;
2654}
2655
2656#endif
2657
2658ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
2659 bool secstate, bool priv, bool negpri)
2660{
2661 ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
2662
2663 if (priv) {
2664 mmu_idx |= ARM_MMU_IDX_M_PRIV;
2665 }
2666
2667 if (negpri) {
2668 mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
2669 }
2670
2671 if (secstate) {
2672 mmu_idx |= ARM_MMU_IDX_M_S;
2673 }
2674
2675 return mmu_idx;
2676}
2677
2678ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
2679 bool secstate, bool priv)
2680{
2681 bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate);
2682
2683 return arm_v7m_mmu_idx_all(env, secstate, priv, negpri);
2684}
2685
2686
2687ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
2688{
2689 bool priv = arm_current_el(env) != 0;
2690
2691 return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
2692}
2693