1
2
3
4
5
6
7
8
9#include "qemu/osdep.h"
10#include "qemu/units.h"
11#include "target/arm/idau.h"
12#include "trace.h"
13#include "cpu.h"
14#include "internals.h"
15#include "exec/gdbstub.h"
16#include "exec/helper-proto.h"
17#include "qemu/host-utils.h"
18#include "qemu/main-loop.h"
19#include "qemu/bitops.h"
20#include "qemu/crc32c.h"
21#include "qemu/qemu-print.h"
22#include "exec/exec-all.h"
23#include <zlib.h>
24#include "hw/semihosting/semihost.h"
25#include "sysemu/cpus.h"
26#include "sysemu/kvm.h"
27#include "qemu/range.h"
28#include "qapi/qapi-commands-machine-target.h"
29#include "qapi/error.h"
30#include "qemu/guest-random.h"
31#ifdef CONFIG_TCG
32#include "arm_ldst.h"
33#include "exec/cpu_ldst.h"
34#endif
35
36static void v7m_msr_xpsr(CPUARMState *env, uint32_t mask,
37 uint32_t reg, uint32_t val)
38{
39
40 if (!(reg & 4)) {
41 uint32_t apsrmask = 0;
42
43 if (mask & 8) {
44 apsrmask |= XPSR_NZCV | XPSR_Q;
45 }
46 if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
47 apsrmask |= XPSR_GE;
48 }
49 xpsr_write(env, val, apsrmask);
50 }
51}
52
53static uint32_t v7m_mrs_xpsr(CPUARMState *env, uint32_t reg, unsigned el)
54{
55 uint32_t mask = 0;
56
57 if ((reg & 1) && el) {
58 mask |= XPSR_EXCP;
59 }
60 if (!(reg & 4)) {
61 mask |= XPSR_NZCV | XPSR_Q;
62 if (arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
63 mask |= XPSR_GE;
64 }
65 }
66
67 return xpsr_read(env) & mask;
68}
69
70static uint32_t v7m_mrs_control(CPUARMState *env, uint32_t secure)
71{
72 uint32_t value = env->v7m.control[secure];
73
74 if (!secure) {
75
76 value |= env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK;
77 }
78 return value;
79}
80
81#ifdef CONFIG_USER_ONLY
82
83void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
84{
85 uint32_t mask = extract32(maskreg, 8, 4);
86 uint32_t reg = extract32(maskreg, 0, 8);
87
88 switch (reg) {
89 case 0 ... 7:
90 v7m_msr_xpsr(env, mask, reg, val);
91 break;
92 case 20:
93
94 break;
95 default:
96
97 break;
98 }
99}
100
101uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
102{
103 switch (reg) {
104 case 0 ... 7:
105 return v7m_mrs_xpsr(env, reg, 0);
106 case 20:
107 return v7m_mrs_control(env, 0);
108 default:
109
110 return 0;
111 }
112}
113
114void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
115{
116
117 g_assert_not_reached();
118}
119
120void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
121{
122
123 g_assert_not_reached();
124}
125
126void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
127{
128
129 g_assert_not_reached();
130}
131
132void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
133{
134
135 g_assert_not_reached();
136}
137
138void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
139{
140
141 g_assert_not_reached();
142}
143
144uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
145{
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164 return 0;
165}
166
167#else
168
169
170
171
172
173typedef enum StackingMode {
174 STACK_NORMAL,
175 STACK_IGNFAULTS,
176 STACK_LAZYFP,
177} StackingMode;
178
179static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
180 ARMMMUIdx mmu_idx, StackingMode mode)
181{
182 CPUState *cs = CPU(cpu);
183 CPUARMState *env = &cpu->env;
184 MemTxAttrs attrs = {};
185 MemTxResult txres;
186 target_ulong page_size;
187 hwaddr physaddr;
188 int prot;
189 ARMMMUFaultInfo fi = {};
190 ARMCacheAttrs cacheattrs = {};
191 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
192 int exc;
193 bool exc_secure;
194
195 if (get_phys_addr(env, addr, MMU_DATA_STORE, mmu_idx, &physaddr,
196 &attrs, &prot, &page_size, &fi, &cacheattrs)) {
197
198 if (fi.type == ARMFault_QEMU_SFault) {
199 if (mode == STACK_LAZYFP) {
200 qemu_log_mask(CPU_LOG_INT,
201 "...SecureFault with SFSR.LSPERR "
202 "during lazy stacking\n");
203 env->v7m.sfsr |= R_V7M_SFSR_LSPERR_MASK;
204 } else {
205 qemu_log_mask(CPU_LOG_INT,
206 "...SecureFault with SFSR.AUVIOL "
207 "during stacking\n");
208 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
209 }
210 env->v7m.sfsr |= R_V7M_SFSR_SFARVALID_MASK;
211 env->v7m.sfar = addr;
212 exc = ARMV7M_EXCP_SECURE;
213 exc_secure = false;
214 } else {
215 if (mode == STACK_LAZYFP) {
216 qemu_log_mask(CPU_LOG_INT,
217 "...MemManageFault with CFSR.MLSPERR\n");
218 env->v7m.cfsr[secure] |= R_V7M_CFSR_MLSPERR_MASK;
219 } else {
220 qemu_log_mask(CPU_LOG_INT,
221 "...MemManageFault with CFSR.MSTKERR\n");
222 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK;
223 }
224 exc = ARMV7M_EXCP_MEM;
225 exc_secure = secure;
226 }
227 goto pend_fault;
228 }
229 address_space_stl_le(arm_addressspace(cs, attrs), physaddr, value,
230 attrs, &txres);
231 if (txres != MEMTX_OK) {
232
233 if (mode == STACK_LAZYFP) {
234 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.LSPERR\n");
235 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_LSPERR_MASK;
236 } else {
237 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n");
238 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK;
239 }
240 exc = ARMV7M_EXCP_BUS;
241 exc_secure = false;
242 goto pend_fault;
243 }
244 return true;
245
246pend_fault:
247
248
249
250
251
252
253
254
255
256
257
258
259 switch (mode) {
260 case STACK_NORMAL:
261 armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure);
262 break;
263 case STACK_LAZYFP:
264 armv7m_nvic_set_pending_lazyfp(env->nvic, exc, exc_secure);
265 break;
266 case STACK_IGNFAULTS:
267 break;
268 }
269 return false;
270}
271
272static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
273 ARMMMUIdx mmu_idx)
274{
275 CPUState *cs = CPU(cpu);
276 CPUARMState *env = &cpu->env;
277 MemTxAttrs attrs = {};
278 MemTxResult txres;
279 target_ulong page_size;
280 hwaddr physaddr;
281 int prot;
282 ARMMMUFaultInfo fi = {};
283 ARMCacheAttrs cacheattrs = {};
284 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
285 int exc;
286 bool exc_secure;
287 uint32_t value;
288
289 if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr,
290 &attrs, &prot, &page_size, &fi, &cacheattrs)) {
291
292 if (fi.type == ARMFault_QEMU_SFault) {
293 qemu_log_mask(CPU_LOG_INT,
294 "...SecureFault with SFSR.AUVIOL during unstack\n");
295 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
296 env->v7m.sfar = addr;
297 exc = ARMV7M_EXCP_SECURE;
298 exc_secure = false;
299 } else {
300 qemu_log_mask(CPU_LOG_INT,
301 "...MemManageFault with CFSR.MUNSTKERR\n");
302 env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK;
303 exc = ARMV7M_EXCP_MEM;
304 exc_secure = secure;
305 }
306 goto pend_fault;
307 }
308
309 value = address_space_ldl(arm_addressspace(cs, attrs), physaddr,
310 attrs, &txres);
311 if (txres != MEMTX_OK) {
312
313 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n");
314 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK;
315 exc = ARMV7M_EXCP_BUS;
316 exc_secure = false;
317 goto pend_fault;
318 }
319
320 *dest = value;
321 return true;
322
323pend_fault:
324
325
326
327
328
329
330
331 armv7m_nvic_set_pending(env->nvic, exc, exc_secure);
332 return false;
333}
334
335void HELPER(v7m_preserve_fp_state)(CPUARMState *env)
336{
337
338
339
340
341
342
343 ARMCPU *cpu = env_archcpu(env);
344 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
345 bool negpri = !(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_HFRDY_MASK);
346 bool is_priv = !(env->v7m.fpccr[is_secure] & R_V7M_FPCCR_USER_MASK);
347 bool splimviol = env->v7m.fpccr[is_secure] & R_V7M_FPCCR_SPLIMVIOL_MASK;
348 uint32_t fpcar = env->v7m.fpcar[is_secure];
349 bool stacked_ok = true;
350 bool ts = is_secure && (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
351 bool take_exception;
352
353
354 qemu_mutex_lock_iothread();
355
356
357 if (!v7m_cpacr_pass(env, is_secure, is_priv)) {
358 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, is_secure);
359 env->v7m.cfsr[is_secure] |= R_V7M_CFSR_NOCP_MASK;
360 stacked_ok = false;
361 } else if (!is_secure && !extract32(env->v7m.nsacr, 10, 1)) {
362 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
363 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
364 stacked_ok = false;
365 }
366
367 if (!splimviol && stacked_ok) {
368
369 int i;
370 ARMMMUIdx mmu_idx;
371
372 mmu_idx = arm_v7m_mmu_idx_all(env, is_secure, is_priv, negpri);
373 for (i = 0; i < (ts ? 32 : 16); i += 2) {
374 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
375 uint32_t faddr = fpcar + 4 * i;
376 uint32_t slo = extract64(dn, 0, 32);
377 uint32_t shi = extract64(dn, 32, 32);
378
379 if (i >= 16) {
380 faddr += 8;
381 }
382 stacked_ok = stacked_ok &&
383 v7m_stack_write(cpu, faddr, slo, mmu_idx, STACK_LAZYFP) &&
384 v7m_stack_write(cpu, faddr + 4, shi, mmu_idx, STACK_LAZYFP);
385 }
386
387 stacked_ok = stacked_ok &&
388 v7m_stack_write(cpu, fpcar + 0x40,
389 vfp_get_fpscr(env), mmu_idx, STACK_LAZYFP);
390 }
391
392
393
394
395
396
397
398
399
400 take_exception = !stacked_ok &&
401 armv7m_nvic_can_take_pending_exception(env->nvic);
402
403 qemu_mutex_unlock_iothread();
404
405 if (take_exception) {
406 raise_exception_ra(env, EXCP_LAZYFP, 0, 1, GETPC());
407 }
408
409 env->v7m.fpccr[is_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
410
411 if (ts) {
412
413 int i;
414
415 for (i = 0; i < 32; i += 2) {
416 *aa32_vfp_dreg(env, i / 2) = 0;
417 }
418 vfp_set_fpscr(env, 0);
419 }
420
421
422
423
424}
425
426
427
428
429
430
431
432static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
433 bool new_spsel,
434 bool secstate)
435{
436 bool old_is_psp = v7m_using_psp(env);
437
438 env->v7m.control[secstate] =
439 deposit32(env->v7m.control[secstate],
440 R_V7M_CONTROL_SPSEL_SHIFT,
441 R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
442
443 if (secstate == env->v7m.secure) {
444 bool new_is_psp = v7m_using_psp(env);
445 uint32_t tmp;
446
447 if (old_is_psp != new_is_psp) {
448 tmp = env->v7m.other_sp;
449 env->v7m.other_sp = env->regs[13];
450 env->regs[13] = tmp;
451 }
452 }
453}
454
455
456
457
458
459static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
460{
461 write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
462}
463
464void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
465{
466
467
468
469
470 bool new_is_psp, old_is_psp = v7m_using_psp(env);
471 uint32_t tmp;
472
473 env->v7m.exception = new_exc;
474
475 new_is_psp = v7m_using_psp(env);
476
477 if (old_is_psp != new_is_psp) {
478 tmp = env->v7m.other_sp;
479 env->v7m.other_sp = env->regs[13];
480 env->regs[13] = tmp;
481 }
482}
483
484
485static void switch_v7m_security_state(CPUARMState *env, bool new_secstate)
486{
487 uint32_t new_ss_msp, new_ss_psp;
488
489 if (env->v7m.secure == new_secstate) {
490 return;
491 }
492
493
494
495
496
497 new_ss_msp = env->v7m.other_ss_msp;
498 new_ss_psp = env->v7m.other_ss_psp;
499
500 if (v7m_using_psp(env)) {
501 env->v7m.other_ss_psp = env->regs[13];
502 env->v7m.other_ss_msp = env->v7m.other_sp;
503 } else {
504 env->v7m.other_ss_msp = env->regs[13];
505 env->v7m.other_ss_psp = env->v7m.other_sp;
506 }
507
508 env->v7m.secure = new_secstate;
509
510 if (v7m_using_psp(env)) {
511 env->regs[13] = new_ss_psp;
512 env->v7m.other_sp = new_ss_msp;
513 } else {
514 env->regs[13] = new_ss_msp;
515 env->v7m.other_sp = new_ss_psp;
516 }
517}
518
519void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
520{
521
522
523
524
525
526 uint32_t min_magic;
527
528 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
529
530 min_magic = FNC_RETURN_MIN_MAGIC;
531 } else {
532
533 min_magic = EXC_RETURN_MIN_MAGIC;
534 }
535
536 if (dest >= min_magic) {
537
538
539
540
541
542
543
544 env->regs[15] = dest & ~1;
545 env->thumb = dest & 1;
546 HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT);
547
548 }
549
550
551 assert(env->v7m.secure);
552
553 if (!(dest & 1)) {
554 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
555 }
556 switch_v7m_security_state(env, dest & 1);
557 env->thumb = 1;
558 env->regs[15] = dest & ~1;
559 arm_rebuild_hflags(env);
560}
561
562void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
563{
564
565
566
567
568
569
570 uint32_t nextinst = env->regs[15] | 1;
571 uint32_t sp = env->regs[13] - 8;
572 uint32_t saved_psr;
573
574
575 assert(env->v7m.secure);
576
577 if (dest & 1) {
578
579
580
581
582 env->regs[14] = nextinst;
583 env->thumb = 1;
584 env->regs[15] = dest & ~1;
585 return;
586 }
587
588
589 if (!QEMU_IS_ALIGNED(sp, 8)) {
590 qemu_log_mask(LOG_GUEST_ERROR,
591 "BLXNS with misaligned SP is UNPREDICTABLE\n");
592 }
593
594 if (sp < v7m_sp_limit(env)) {
595 raise_exception(env, EXCP_STKOF, 0, 1);
596 }
597
598 saved_psr = env->v7m.exception;
599 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
600 saved_psr |= XPSR_SFPA;
601 }
602
603
604 cpu_stl_data_ra(env, sp, nextinst, GETPC());
605 cpu_stl_data_ra(env, sp + 4, saved_psr, GETPC());
606
607 env->regs[13] = sp;
608 env->regs[14] = 0xfeffffff;
609 if (arm_v7m_is_handler_mode(env)) {
610
611
612
613
614
615 write_v7m_exception(env, 1);
616 }
617 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
618 switch_v7m_security_state(env, 0);
619 env->thumb = 1;
620 env->regs[15] = dest;
621 arm_rebuild_hflags(env);
622}
623
624static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
625 bool spsel)
626{
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643 bool want_psp = threadmode && spsel;
644
645 if (secure == env->v7m.secure) {
646 if (want_psp == v7m_using_psp(env)) {
647 return &env->regs[13];
648 } else {
649 return &env->v7m.other_sp;
650 }
651 } else {
652 if (want_psp) {
653 return &env->v7m.other_ss_psp;
654 } else {
655 return &env->v7m.other_ss_msp;
656 }
657 }
658}
659
660static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
661 uint32_t *pvec)
662{
663 CPUState *cs = CPU(cpu);
664 CPUARMState *env = &cpu->env;
665 MemTxResult result;
666 uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4;
667 uint32_t vector_entry;
668 MemTxAttrs attrs = {};
669 ARMMMUIdx mmu_idx;
670 bool exc_secure;
671
672 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
673
674
675
676
677
678
679
680
681
682 attrs.secure = targets_secure;
683 attrs.user = false;
684
685 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
686 V8M_SAttributes sattrs = {};
687
688 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs);
689 if (sattrs.ns) {
690 attrs.secure = false;
691 } else if (!targets_secure) {
692
693
694
695
696 exc_secure = true;
697 goto load_fail;
698 }
699 }
700
701 vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
702 attrs, &result);
703 if (result != MEMTX_OK) {
704
705
706
707
708 exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
709 goto load_fail;
710 }
711 *pvec = vector_entry;
712 return true;
713
714load_fail:
715
716
717
718
719
720
721
722
723
724
725
726 if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
727 exc_secure = true;
728 }
729 env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
730 armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
731 return false;
732}
733
734static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr)
735{
736
737
738
739
740
741 uint32_t sig = 0xfefa125a;
742
743 if (!cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))
744 || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
745 sig |= 1;
746 }
747 return sig;
748}
749
750static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
751 bool ignore_faults)
752{
753
754
755
756
757
758 CPUARMState *env = &cpu->env;
759 uint32_t *frame_sp_p;
760 uint32_t frameptr;
761 ARMMMUIdx mmu_idx;
762 bool stacked_ok;
763 uint32_t limit;
764 bool want_psp;
765 uint32_t sig;
766 StackingMode smode = ignore_faults ? STACK_IGNFAULTS : STACK_NORMAL;
767
768 if (dotailchain) {
769 bool mode = lr & R_V7M_EXCRET_MODE_MASK;
770 bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) ||
771 !mode;
772
773 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
774 frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,
775 lr & R_V7M_EXCRET_SPSEL_MASK);
776 want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
777 if (want_psp) {
778 limit = env->v7m.psplim[M_REG_S];
779 } else {
780 limit = env->v7m.msplim[M_REG_S];
781 }
782 } else {
783 mmu_idx = arm_mmu_idx(env);
784 frame_sp_p = &env->regs[13];
785 limit = v7m_sp_limit(env);
786 }
787
788 frameptr = *frame_sp_p - 0x28;
789 if (frameptr < limit) {
790
791
792
793
794
795
796 qemu_log_mask(CPU_LOG_INT,
797 "...STKOF during callee-saves register stacking\n");
798 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
799 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
800 env->v7m.secure);
801 *frame_sp_p = limit;
802 return true;
803 }
804
805
806
807
808
809 sig = v7m_integrity_sig(env, lr);
810 stacked_ok =
811 v7m_stack_write(cpu, frameptr, sig, mmu_idx, smode) &&
812 v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx, smode) &&
813 v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx, smode) &&
814 v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx, smode) &&
815 v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx, smode) &&
816 v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx, smode) &&
817 v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx, smode) &&
818 v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx, smode) &&
819 v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx, smode);
820
821
822 *frame_sp_p = frameptr;
823
824 return !stacked_ok;
825}
826
827static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
828 bool ignore_stackfaults)
829{
830
831
832
833
834
835 CPUARMState *env = &cpu->env;
836 uint32_t addr;
837 bool targets_secure;
838 int exc;
839 bool push_failed = false;
840
841 armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure);
842 qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n",
843 targets_secure ? "secure" : "nonsecure", exc);
844
845 if (dotailchain) {
846
847 if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
848 lr |= R_V7M_EXCRET_FTYPE_MASK;
849 }
850 lr = deposit32(lr, 24, 8, 0xff);
851 }
852
853 if (arm_feature(env, ARM_FEATURE_V8)) {
854 if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
855 (lr & R_V7M_EXCRET_S_MASK)) {
856
857
858
859
860
861 if (targets_secure) {
862 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
863
864
865
866
867
868
869
870 lr &= ~R_V7M_EXCRET_DCRS_MASK;
871 }
872 } else {
873
874
875
876
877
878 if (lr & R_V7M_EXCRET_DCRS_MASK &&
879 !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) {
880 push_failed = v7m_push_callee_stack(cpu, lr, dotailchain,
881 ignore_stackfaults);
882 }
883 lr |= R_V7M_EXCRET_DCRS_MASK;
884 }
885 }
886
887 lr &= ~R_V7M_EXCRET_ES_MASK;
888 if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) {
889 lr |= R_V7M_EXCRET_ES_MASK;
890 }
891 lr &= ~R_V7M_EXCRET_SPSEL_MASK;
892 if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
893 lr |= R_V7M_EXCRET_SPSEL_MASK;
894 }
895
896
897
898
899
900
901
902 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
903 if (!targets_secure) {
904
905
906
907
908
909
910
911 int i;
912
913 for (i = 0; i < 13; i++) {
914
915 if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) {
916 env->regs[i] = 0;
917 }
918 }
919
920 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
921 }
922 }
923 }
924
925 if (push_failed && !ignore_stackfaults) {
926
927
928
929
930
931 qemu_log_mask(CPU_LOG_INT,
932 "...derived exception on callee-saves register stacking");
933 v7m_exception_taken(cpu, lr, true, true);
934 return;
935 }
936
937 if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) {
938
939 qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load");
940 v7m_exception_taken(cpu, lr, true, true);
941 return;
942 }
943
944
945
946
947
948
949 armv7m_nvic_acknowledge_irq(env->nvic);
950
951
952 switch_v7m_security_state(env, targets_secure);
953 write_v7m_control_spsel(env, 0);
954 arm_clear_exclusive(env);
955
956 env->v7m.control[M_REG_S] &=
957 ~(R_V7M_CONTROL_FPCA_MASK | R_V7M_CONTROL_SFPA_MASK);
958
959 env->condexec_bits = 0;
960 env->regs[14] = lr;
961 env->regs[15] = addr & 0xfffffffe;
962 env->thumb = addr & 1;
963 arm_rebuild_hflags(env);
964}
965
966static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr,
967 bool apply_splim)
968{
969
970
971
972
973 bool is_secure = env->v7m.secure;
974 void *nvic = env->nvic;
975
976
977
978
979
980
981 uint32_t *fpccr_s = &env->v7m.fpccr[M_REG_S];
982 uint32_t *fpccr_ns = &env->v7m.fpccr[M_REG_NS];
983 uint32_t *fpccr = &env->v7m.fpccr[is_secure];
984 bool hfrdy, bfrdy, mmrdy, ns_ufrdy, s_ufrdy, sfrdy, monrdy;
985
986 env->v7m.fpcar[is_secure] = frameptr & ~0x7;
987
988 if (apply_splim && arm_feature(env, ARM_FEATURE_V8)) {
989 bool splimviol;
990 uint32_t splim = v7m_sp_limit(env);
991 bool ign = armv7m_nvic_neg_prio_requested(nvic, is_secure) &&
992 (env->v7m.ccr[is_secure] & R_V7M_CCR_STKOFHFNMIGN_MASK);
993
994 splimviol = !ign && frameptr < splim;
995 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, SPLIMVIOL, splimviol);
996 }
997
998 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, LSPACT, 1);
999
1000 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, S, is_secure);
1001
1002 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, USER, arm_current_el(env) == 0);
1003
1004 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, THREAD,
1005 !arm_v7m_is_handler_mode(env));
1006
1007 hfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_HARD, false);
1008 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, HFRDY, hfrdy);
1009
1010 bfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_BUS, false);
1011 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, BFRDY, bfrdy);
1012
1013 mmrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_MEM, is_secure);
1014 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, MMRDY, mmrdy);
1015
1016 ns_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, false);
1017 *fpccr_ns = FIELD_DP32(*fpccr_ns, V7M_FPCCR, UFRDY, ns_ufrdy);
1018
1019 monrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_DEBUG, false);
1020 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, MONRDY, monrdy);
1021
1022 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1023 s_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, true);
1024 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, UFRDY, s_ufrdy);
1025
1026 sfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_SECURE, false);
1027 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, SFRDY, sfrdy);
1028 }
1029}
1030
1031void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr)
1032{
1033
1034 bool s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
1035 bool lspact = env->v7m.fpccr[s] & R_V7M_FPCCR_LSPACT_MASK;
1036 uintptr_t ra = GETPC();
1037
1038 assert(env->v7m.secure);
1039
1040 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1041 return;
1042 }
1043
1044
1045 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
1046 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
1047 }
1048
1049 if (lspact) {
1050
1051 raise_exception_ra(env, EXCP_LSERR, 0, 1, GETPC());
1052 }
1053
1054 if (fptr & 7) {
1055 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
1056 }
1057
1058
1059
1060
1061
1062
1063
1064
1065 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1066 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1067 int i;
1068
1069 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1070 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1071 uint32_t faddr = fptr + 4 * i;
1072 uint32_t slo = extract64(dn, 0, 32);
1073 uint32_t shi = extract64(dn, 32, 32);
1074
1075 if (i >= 16) {
1076 faddr += 8;
1077 }
1078 cpu_stl_data_ra(env, faddr, slo, ra);
1079 cpu_stl_data_ra(env, faddr + 4, shi, ra);
1080 }
1081 cpu_stl_data_ra(env, fptr + 0x40, vfp_get_fpscr(env), ra);
1082
1083
1084
1085
1086
1087 if (ts) {
1088 for (i = 0; i < 32; i += 2) {
1089 *aa32_vfp_dreg(env, i / 2) = 0;
1090 }
1091 vfp_set_fpscr(env, 0);
1092 }
1093 } else {
1094 v7m_update_fpccr(env, fptr, false);
1095 }
1096
1097 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
1098}
1099
1100void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr)
1101{
1102 uintptr_t ra = GETPC();
1103
1104
1105 assert(env->v7m.secure);
1106
1107 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1108 return;
1109 }
1110
1111
1112 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) {
1113 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC());
1114 }
1115
1116 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1117
1118 env->v7m.fpccr[M_REG_S] &= ~R_V7M_FPCCR_LSPACT_MASK;
1119 } else {
1120 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK;
1121 int i;
1122 uint32_t fpscr;
1123
1124 if (fptr & 7) {
1125 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC());
1126 }
1127
1128 for (i = 0; i < (ts ? 32 : 16); i += 2) {
1129 uint32_t slo, shi;
1130 uint64_t dn;
1131 uint32_t faddr = fptr + 4 * i;
1132
1133 if (i >= 16) {
1134 faddr += 8;
1135 }
1136
1137 slo = cpu_ldl_data_ra(env, faddr, ra);
1138 shi = cpu_ldl_data_ra(env, faddr + 4, ra);
1139
1140 dn = (uint64_t) shi << 32 | slo;
1141 *aa32_vfp_dreg(env, i / 2) = dn;
1142 }
1143 fpscr = cpu_ldl_data_ra(env, fptr + 0x40, ra);
1144 vfp_set_fpscr(env, fpscr);
1145 }
1146
1147 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK;
1148}
1149
1150static bool v7m_push_stack(ARMCPU *cpu)
1151{
1152
1153
1154
1155
1156
1157
1158
1159 bool stacked_ok = true, limitviol = false;
1160 CPUARMState *env = &cpu->env;
1161 uint32_t xpsr = xpsr_read(env);
1162 uint32_t frameptr = env->regs[13];
1163 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
1164 uint32_t framesize;
1165 bool nsacr_cp10 = extract32(env->v7m.nsacr, 10, 1);
1166
1167 if ((env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) &&
1168 (env->v7m.secure || nsacr_cp10)) {
1169 if (env->v7m.secure &&
1170 env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK) {
1171 framesize = 0xa8;
1172 } else {
1173 framesize = 0x68;
1174 }
1175 } else {
1176 framesize = 0x20;
1177 }
1178
1179
1180 if ((frameptr & 4) &&
1181 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) {
1182 frameptr -= 4;
1183 xpsr |= XPSR_SPREALIGN;
1184 }
1185
1186 xpsr &= ~XPSR_SFPA;
1187 if (env->v7m.secure &&
1188 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) {
1189 xpsr |= XPSR_SFPA;
1190 }
1191
1192 frameptr -= framesize;
1193
1194 if (arm_feature(env, ARM_FEATURE_V8)) {
1195 uint32_t limit = v7m_sp_limit(env);
1196
1197 if (frameptr < limit) {
1198
1199
1200
1201
1202
1203
1204 qemu_log_mask(CPU_LOG_INT,
1205 "...STKOF during stacking\n");
1206 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
1207 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1208 env->v7m.secure);
1209 env->regs[13] = limit;
1210
1211
1212
1213
1214
1215
1216 limitviol = true;
1217 stacked_ok = false;
1218 }
1219 }
1220
1221
1222
1223
1224
1225
1226
1227 stacked_ok = stacked_ok &&
1228 v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, STACK_NORMAL) &&
1229 v7m_stack_write(cpu, frameptr + 4, env->regs[1],
1230 mmu_idx, STACK_NORMAL) &&
1231 v7m_stack_write(cpu, frameptr + 8, env->regs[2],
1232 mmu_idx, STACK_NORMAL) &&
1233 v7m_stack_write(cpu, frameptr + 12, env->regs[3],
1234 mmu_idx, STACK_NORMAL) &&
1235 v7m_stack_write(cpu, frameptr + 16, env->regs[12],
1236 mmu_idx, STACK_NORMAL) &&
1237 v7m_stack_write(cpu, frameptr + 20, env->regs[14],
1238 mmu_idx, STACK_NORMAL) &&
1239 v7m_stack_write(cpu, frameptr + 24, env->regs[15],
1240 mmu_idx, STACK_NORMAL) &&
1241 v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, STACK_NORMAL);
1242
1243 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) {
1244
1245 bool fpccr_s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
1246 bool lspact = env->v7m.fpccr[fpccr_s] & R_V7M_FPCCR_LSPACT_MASK;
1247
1248 if (lspact && arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1249 qemu_log_mask(CPU_LOG_INT,
1250 "...SecureFault because LSPACT and FPCA both set\n");
1251 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1252 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1253 } else if (!env->v7m.secure && !nsacr_cp10) {
1254 qemu_log_mask(CPU_LOG_INT,
1255 "...Secure UsageFault with CFSR.NOCP because "
1256 "NSACR.CP10 prevents stacking FP regs\n");
1257 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S);
1258 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
1259 } else {
1260 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) {
1261
1262 int i;
1263 bool cpacr_pass = v7m_cpacr_pass(env, env->v7m.secure,
1264 arm_current_el(env) != 0);
1265
1266 if (stacked_ok && !cpacr_pass) {
1267
1268
1269
1270
1271
1272 qemu_log_mask(CPU_LOG_INT,
1273 "...UsageFault with CFSR.NOCP because "
1274 "CPACR.CP10 prevents stacking FP regs\n");
1275 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1276 env->v7m.secure);
1277 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK;
1278 stacked_ok = false;
1279 }
1280
1281 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1282 uint64_t dn = *aa32_vfp_dreg(env, i / 2);
1283 uint32_t faddr = frameptr + 0x20 + 4 * i;
1284 uint32_t slo = extract64(dn, 0, 32);
1285 uint32_t shi = extract64(dn, 32, 32);
1286
1287 if (i >= 16) {
1288 faddr += 8;
1289 }
1290 stacked_ok = stacked_ok &&
1291 v7m_stack_write(cpu, faddr, slo,
1292 mmu_idx, STACK_NORMAL) &&
1293 v7m_stack_write(cpu, faddr + 4, shi,
1294 mmu_idx, STACK_NORMAL);
1295 }
1296 stacked_ok = stacked_ok &&
1297 v7m_stack_write(cpu, frameptr + 0x60,
1298 vfp_get_fpscr(env), mmu_idx, STACK_NORMAL);
1299 if (cpacr_pass) {
1300 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) {
1301 *aa32_vfp_dreg(env, i / 2) = 0;
1302 }
1303 vfp_set_fpscr(env, 0);
1304 }
1305 } else {
1306
1307 v7m_update_fpccr(env, frameptr + 0x20, true);
1308 }
1309 }
1310 }
1311
1312
1313
1314
1315
1316
1317 if (!limitviol) {
1318 env->regs[13] = frameptr;
1319 }
1320
1321 return !stacked_ok;
1322}
1323
1324static void do_v7m_exception_exit(ARMCPU *cpu)
1325{
1326 CPUARMState *env = &cpu->env;
1327 uint32_t excret;
1328 uint32_t xpsr, xpsr_mask;
1329 bool ufault = false;
1330 bool sfault = false;
1331 bool return_to_sp_process;
1332 bool return_to_handler;
1333 bool rettobase = false;
1334 bool exc_secure = false;
1335 bool return_to_secure;
1336 bool ftype;
1337 bool restore_s16_s31;
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350 if (!arm_v7m_is_handler_mode(env)) {
1351 return;
1352 }
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362 excret = env->regs[15];
1363 if (env->thumb) {
1364 excret |= 1;
1365 }
1366
1367 qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
1368 " previous exception %d\n",
1369 excret, env->v7m.exception);
1370
1371 if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
1372 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
1373 "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
1374 excret);
1375 }
1376
1377 ftype = excret & R_V7M_EXCRET_FTYPE_MASK;
1378
1379 if (!ftype && !cpu_isar_feature(aa32_vfp_simd, cpu)) {
1380 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception "
1381 "exit PC value 0x%" PRIx32 " is UNPREDICTABLE "
1382 "if FPU not present\n",
1383 excret);
1384 ftype = true;
1385 }
1386
1387 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1388
1389
1390
1391
1392 if (!env->v7m.secure &&
1393 ((excret & R_V7M_EXCRET_ES_MASK) ||
1394 !(excret & R_V7M_EXCRET_DCRS_MASK))) {
1395 sfault = 1;
1396
1397 excret &= ~R_V7M_EXCRET_ES_MASK;
1398 }
1399 exc_secure = excret & R_V7M_EXCRET_ES_MASK;
1400 }
1401
1402 if (env->v7m.exception != ARMV7M_EXCP_NMI) {
1403
1404
1405
1406
1407
1408
1409
1410 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1411 if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
1412 env->v7m.faultmask[exc_secure] = 0;
1413 }
1414 } else {
1415 env->v7m.faultmask[M_REG_NS] = 0;
1416 }
1417 }
1418
1419 switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception,
1420 exc_secure)) {
1421 case -1:
1422
1423 ufault = true;
1424 break;
1425 case 0:
1426
1427 break;
1428 case 1:
1429
1430
1431
1432
1433
1434 rettobase = true;
1435 break;
1436 default:
1437 g_assert_not_reached();
1438 }
1439
1440 return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
1441 return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
1442 return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
1443 (excret & R_V7M_EXCRET_S_MASK);
1444
1445 if (arm_feature(env, ARM_FEATURE_V8)) {
1446 if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1447
1448
1449
1450
1451 if ((excret & R_V7M_EXCRET_S_MASK) ||
1452 (excret & R_V7M_EXCRET_ES_MASK) ||
1453 !(excret & R_V7M_EXCRET_DCRS_MASK)) {
1454 ufault = true;
1455 }
1456 }
1457 if (excret & R_V7M_EXCRET_RES0_MASK) {
1458 ufault = true;
1459 }
1460 } else {
1461
1462 switch (excret & 0xf) {
1463 case 1:
1464 break;
1465 case 13:
1466 case 9:
1467
1468
1469
1470
1471 if (!rettobase &&
1472 !(env->v7m.ccr[env->v7m.secure] &
1473 R_V7M_CCR_NONBASETHRDENA_MASK)) {
1474 ufault = true;
1475 }
1476 break;
1477 default:
1478 ufault = true;
1479 }
1480 }
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490 write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
1491
1492
1493
1494
1495
1496 if ((env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_CLRONRET_MASK) &&
1497 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
1498 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) {
1499 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1500 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1501 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1502 "stackframe: error during lazy state deactivation\n");
1503 v7m_exception_taken(cpu, excret, true, false);
1504 return;
1505 } else {
1506
1507 int i;
1508
1509 for (i = 0; i < 16; i += 2) {
1510 *aa32_vfp_dreg(env, i / 2) = 0;
1511 }
1512 vfp_set_fpscr(env, 0);
1513 }
1514 }
1515
1516 if (sfault) {
1517 env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
1518 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1519 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1520 "stackframe: failed EXC_RETURN.ES validity check\n");
1521 v7m_exception_taken(cpu, excret, true, false);
1522 return;
1523 }
1524
1525 if (ufault) {
1526
1527
1528
1529
1530 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1531 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
1532 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1533 "stackframe: failed exception return integrity check\n");
1534 v7m_exception_taken(cpu, excret, true, false);
1535 return;
1536 }
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548 if (armv7m_nvic_can_take_pending_exception(env->nvic)) {
1549 qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n");
1550 v7m_exception_taken(cpu, excret, true, false);
1551 return;
1552 }
1553
1554 switch_v7m_security_state(env, return_to_secure);
1555
1556 {
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567 uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
1568 return_to_secure,
1569 !return_to_handler,
1570 return_to_sp_process);
1571 uint32_t frameptr = *frame_sp_p;
1572 bool pop_ok = true;
1573 ARMMMUIdx mmu_idx;
1574 bool return_to_priv = return_to_handler ||
1575 !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK);
1576
1577 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure,
1578 return_to_priv);
1579
1580 if (!QEMU_IS_ALIGNED(frameptr, 8) &&
1581 arm_feature(env, ARM_FEATURE_V8)) {
1582 qemu_log_mask(LOG_GUEST_ERROR,
1583 "M profile exception return with non-8-aligned SP "
1584 "for destination state is UNPREDICTABLE\n");
1585 }
1586
1587
1588 if (return_to_secure &&
1589 ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
1590 (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
1591 uint32_t actual_sig;
1592
1593 pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx);
1594
1595 if (pop_ok && v7m_integrity_sig(env, excret) != actual_sig) {
1596
1597 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
1598 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1599 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
1600 "stackframe: failed exception return integrity "
1601 "signature check\n");
1602 v7m_exception_taken(cpu, excret, true, false);
1603 return;
1604 }
1605
1606 pop_ok = pop_ok &&
1607 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
1608 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) &&
1609 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) &&
1610 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) &&
1611 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) &&
1612 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) &&
1613 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) &&
1614 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx);
1615
1616 frameptr += 0x28;
1617 }
1618
1619
1620 pop_ok = pop_ok &&
1621 v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) &&
1622 v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) &&
1623 v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) &&
1624 v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) &&
1625 v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) &&
1626 v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) &&
1627 v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) &&
1628 v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx);
1629
1630 if (!pop_ok) {
1631
1632
1633
1634
1635 qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n");
1636 v7m_exception_taken(cpu, excret, true, false);
1637 return;
1638 }
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649 if (env->regs[15] & 1) {
1650 env->regs[15] &= ~1U;
1651 if (!arm_feature(env, ARM_FEATURE_V8)) {
1652 qemu_log_mask(LOG_GUEST_ERROR,
1653 "M profile return from interrupt with misaligned "
1654 "PC is UNPREDICTABLE on v7M\n");
1655 }
1656 }
1657
1658 if (arm_feature(env, ARM_FEATURE_V8)) {
1659
1660
1661
1662
1663
1664 bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
1665 if (return_to_handler != will_be_handler) {
1666
1667
1668
1669
1670
1671
1672 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1673 env->v7m.secure);
1674 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1675 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
1676 "stackframe: failed exception return integrity "
1677 "check\n");
1678 v7m_exception_taken(cpu, excret, true, false);
1679 return;
1680 }
1681 }
1682
1683 if (!ftype) {
1684
1685 if (!return_to_secure &&
1686 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK)) {
1687 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1688 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
1689 qemu_log_mask(CPU_LOG_INT,
1690 "...taking SecureFault on existing stackframe: "
1691 "Secure LSPACT set but exception return is "
1692 "not to secure state\n");
1693 v7m_exception_taken(cpu, excret, true, false);
1694 return;
1695 }
1696
1697 restore_s16_s31 = return_to_secure &&
1698 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK);
1699
1700 if (env->v7m.fpccr[return_to_secure] & R_V7M_FPCCR_LSPACT_MASK) {
1701
1702 env->v7m.fpccr[return_to_secure] &= ~R_V7M_FPCCR_LSPACT_MASK;
1703 } else {
1704 int i;
1705 uint32_t fpscr;
1706 bool cpacr_pass, nsacr_pass;
1707
1708 cpacr_pass = v7m_cpacr_pass(env, return_to_secure,
1709 return_to_priv);
1710 nsacr_pass = return_to_secure ||
1711 extract32(env->v7m.nsacr, 10, 1);
1712
1713 if (!cpacr_pass) {
1714 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1715 return_to_secure);
1716 env->v7m.cfsr[return_to_secure] |= R_V7M_CFSR_NOCP_MASK;
1717 qemu_log_mask(CPU_LOG_INT,
1718 "...taking UsageFault on existing "
1719 "stackframe: CPACR.CP10 prevents unstacking "
1720 "FP regs\n");
1721 v7m_exception_taken(cpu, excret, true, false);
1722 return;
1723 } else if (!nsacr_pass) {
1724 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
1725 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_INVPC_MASK;
1726 qemu_log_mask(CPU_LOG_INT,
1727 "...taking Secure UsageFault on existing "
1728 "stackframe: NSACR.CP10 prevents unstacking "
1729 "FP regs\n");
1730 v7m_exception_taken(cpu, excret, true, false);
1731 return;
1732 }
1733
1734 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1735 uint32_t slo, shi;
1736 uint64_t dn;
1737 uint32_t faddr = frameptr + 0x20 + 4 * i;
1738
1739 if (i >= 16) {
1740 faddr += 8;
1741 }
1742
1743 pop_ok = pop_ok &&
1744 v7m_stack_read(cpu, &slo, faddr, mmu_idx) &&
1745 v7m_stack_read(cpu, &shi, faddr + 4, mmu_idx);
1746
1747 if (!pop_ok) {
1748 break;
1749 }
1750
1751 dn = (uint64_t)shi << 32 | slo;
1752 *aa32_vfp_dreg(env, i / 2) = dn;
1753 }
1754 pop_ok = pop_ok &&
1755 v7m_stack_read(cpu, &fpscr, frameptr + 0x60, mmu_idx);
1756 if (pop_ok) {
1757 vfp_set_fpscr(env, fpscr);
1758 }
1759 if (!pop_ok) {
1760
1761
1762
1763
1764 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) {
1765 *aa32_vfp_dreg(env, i / 2) = 0;
1766 }
1767 vfp_set_fpscr(env, 0);
1768 }
1769 }
1770 }
1771 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1772 V7M_CONTROL, FPCA, !ftype);
1773
1774
1775 frameptr += 0x20;
1776 if (!ftype) {
1777 frameptr += 0x48;
1778 if (restore_s16_s31) {
1779 frameptr += 0x40;
1780 }
1781 }
1782
1783
1784
1785
1786
1787
1788
1789 if (xpsr & XPSR_SPREALIGN) {
1790 frameptr |= 4;
1791 }
1792 *frame_sp_p = frameptr;
1793 }
1794
1795 xpsr_mask = ~(XPSR_SPREALIGN | XPSR_SFPA);
1796 if (!arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
1797 xpsr_mask &= ~XPSR_GE;
1798 }
1799
1800 xpsr_write(env, xpsr, xpsr_mask);
1801
1802 if (env->v7m.secure) {
1803 bool sfpa = xpsr & XPSR_SFPA;
1804
1805 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S],
1806 V7M_CONTROL, SFPA, sfpa);
1807 }
1808
1809
1810
1811
1812
1813
1814
1815 if (return_to_handler != arm_v7m_is_handler_mode(env)) {
1816
1817
1818
1819
1820 bool ignore_stackfaults;
1821
1822 assert(!arm_feature(env, ARM_FEATURE_V8));
1823 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
1824 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1825 ignore_stackfaults = v7m_push_stack(cpu);
1826 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
1827 "failed exception return integrity check\n");
1828 v7m_exception_taken(cpu, excret, false, ignore_stackfaults);
1829 return;
1830 }
1831
1832
1833 arm_clear_exclusive(env);
1834 arm_rebuild_hflags(env);
1835 qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
1836}
1837
1838static bool do_v7m_function_return(ARMCPU *cpu)
1839{
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852 CPUARMState *env = &cpu->env;
1853 uint32_t newpc, newpsr, newpsr_exc;
1854
1855 qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n");
1856
1857 {
1858 bool threadmode, spsel;
1859 TCGMemOpIdx oi;
1860 ARMMMUIdx mmu_idx;
1861 uint32_t *frame_sp_p;
1862 uint32_t frameptr;
1863
1864
1865 threadmode = !arm_v7m_is_handler_mode(env);
1866 spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
1867
1868 frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
1869 frameptr = *frame_sp_p;
1870
1871
1872
1873
1874
1875 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
1876 oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx));
1877 newpc = helper_le_ldul_mmu(env, frameptr, oi, 0);
1878 newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0);
1879
1880
1881 newpsr_exc = newpsr & XPSR_EXCP;
1882 if (!((env->v7m.exception == 0 && newpsr_exc == 0) ||
1883 (env->v7m.exception == 1 && newpsr_exc != 0))) {
1884
1885 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
1886 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
1887 env->v7m.secure);
1888 qemu_log_mask(CPU_LOG_INT,
1889 "...taking INVPC UsageFault: "
1890 "IPSR consistency check failed\n");
1891 return false;
1892 }
1893
1894 *frame_sp_p = frameptr + 8;
1895 }
1896
1897
1898 switch_v7m_security_state(env, true);
1899 env->v7m.exception = newpsr_exc;
1900 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
1901 if (newpsr & XPSR_SFPA) {
1902 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK;
1903 }
1904 xpsr_write(env, 0, XPSR_IT);
1905 env->thumb = newpc & 1;
1906 env->regs[15] = newpc & ~1;
1907 arm_rebuild_hflags(env);
1908
1909 qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
1910 return true;
1911}
1912
1913static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
1914 uint32_t addr, uint16_t *insn)
1915{
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928 CPUState *cs = CPU(cpu);
1929 CPUARMState *env = &cpu->env;
1930 V8M_SAttributes sattrs = {};
1931 MemTxAttrs attrs = {};
1932 ARMMMUFaultInfo fi = {};
1933 ARMCacheAttrs cacheattrs = {};
1934 MemTxResult txres;
1935 target_ulong page_size;
1936 hwaddr physaddr;
1937 int prot;
1938
1939 v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs);
1940 if (!sattrs.nsc || sattrs.ns) {
1941
1942
1943
1944
1945 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
1946 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
1947 qemu_log_mask(CPU_LOG_INT,
1948 "...really SecureFault with SFSR.INVEP\n");
1949 return false;
1950 }
1951 if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx, &physaddr,
1952 &attrs, &prot, &page_size, &fi, &cacheattrs)) {
1953
1954 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
1955 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
1956 qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
1957 return false;
1958 }
1959 *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr,
1960 attrs, &txres);
1961 if (txres != MEMTX_OK) {
1962 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
1963 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
1964 qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");
1965 return false;
1966 }
1967 return true;
1968}
1969
1970static bool v7m_handle_execute_nsc(ARMCPU *cpu)
1971{
1972
1973
1974
1975
1976
1977
1978 CPUARMState *env = &cpu->env;
1979 ARMMMUIdx mmu_idx;
1980 uint16_t insn;
1981
1982
1983
1984
1985
1986 assert(!env->v7m.secure);
1987 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
1988
1989
1990 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
1991
1992 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) {
1993 return false;
1994 }
1995
1996 if (!env->thumb) {
1997 goto gen_invep;
1998 }
1999
2000 if (insn != 0xe97f) {
2001
2002
2003
2004
2005 goto gen_invep;
2006 }
2007
2008 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) {
2009 return false;
2010 }
2011
2012 if (insn != 0xe97f) {
2013
2014
2015
2016
2017 goto gen_invep;
2018 }
2019
2020
2021
2022
2023
2024 qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
2025 ", executing it\n", env->regs[15]);
2026 env->regs[14] &= ~1;
2027 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
2028 switch_v7m_security_state(env, true);
2029 xpsr_write(env, 0, XPSR_IT);
2030 env->regs[15] += 4;
2031 arm_rebuild_hflags(env);
2032 return true;
2033
2034gen_invep:
2035 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2036 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2037 qemu_log_mask(CPU_LOG_INT,
2038 "...really SecureFault with SFSR.INVEP\n");
2039 return false;
2040}
2041
2042void arm_v7m_cpu_do_interrupt(CPUState *cs)
2043{
2044 ARMCPU *cpu = ARM_CPU(cs);
2045 CPUARMState *env = &cpu->env;
2046 uint32_t lr;
2047 bool ignore_stackfaults;
2048
2049 arm_log_exception(cs->exception_index);
2050
2051
2052
2053
2054
2055 switch (cs->exception_index) {
2056 case EXCP_UDEF:
2057 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2058 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK;
2059 break;
2060 case EXCP_NOCP:
2061 {
2062
2063
2064
2065
2066
2067 int target_secstate;
2068
2069 if (env->exception.target_el == 3) {
2070 target_secstate = M_REG_S;
2071 } else {
2072 target_secstate = env->v7m.secure;
2073 }
2074 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, target_secstate);
2075 env->v7m.cfsr[target_secstate] |= R_V7M_CFSR_NOCP_MASK;
2076 break;
2077 }
2078 case EXCP_INVSTATE:
2079 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2080 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK;
2081 break;
2082 case EXCP_STKOF:
2083 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2084 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
2085 break;
2086 case EXCP_LSERR:
2087 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2088 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
2089 break;
2090 case EXCP_UNALIGNED:
2091 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
2092 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
2093 break;
2094 case EXCP_SWI:
2095
2096 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure);
2097 break;
2098 case EXCP_PREFETCH_ABORT:
2099 case EXCP_DATA_ABORT:
2100
2101
2102
2103
2104
2105 switch (env->exception.fsr & 0xf) {
2106 case M_FAKE_FSR_NSC_EXEC:
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116 if (v7m_handle_execute_nsc(cpu)) {
2117 return;
2118 }
2119 break;
2120 case M_FAKE_FSR_SFAULT:
2121
2122
2123
2124
2125 switch (cs->exception_index) {
2126 case EXCP_PREFETCH_ABORT:
2127 if (env->v7m.secure) {
2128 env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
2129 qemu_log_mask(CPU_LOG_INT,
2130 "...really SecureFault with SFSR.INVTRAN\n");
2131 } else {
2132 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
2133 qemu_log_mask(CPU_LOG_INT,
2134 "...really SecureFault with SFSR.INVEP\n");
2135 }
2136 break;
2137 case EXCP_DATA_ABORT:
2138
2139 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
2140 qemu_log_mask(CPU_LOG_INT,
2141 "...really SecureFault with SFSR.AUVIOL\n");
2142 break;
2143 }
2144 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
2145 break;
2146 case 0x8:
2147 switch (cs->exception_index) {
2148 case EXCP_PREFETCH_ABORT:
2149 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
2150 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
2151 break;
2152 case EXCP_DATA_ABORT:
2153 env->v7m.cfsr[M_REG_NS] |=
2154 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
2155 env->v7m.bfar = env->exception.vaddress;
2156 qemu_log_mask(CPU_LOG_INT,
2157 "...with CFSR.PRECISERR and BFAR 0x%x\n",
2158 env->v7m.bfar);
2159 break;
2160 }
2161 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
2162 break;
2163 default:
2164
2165
2166
2167
2168 switch (cs->exception_index) {
2169 case EXCP_PREFETCH_ABORT:
2170 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
2171 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
2172 break;
2173 case EXCP_DATA_ABORT:
2174 env->v7m.cfsr[env->v7m.secure] |=
2175 (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
2176 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress;
2177 qemu_log_mask(CPU_LOG_INT,
2178 "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
2179 env->v7m.mmfar[env->v7m.secure]);
2180 break;
2181 }
2182 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM,
2183 env->v7m.secure);
2184 break;
2185 }
2186 break;
2187 case EXCP_SEMIHOST:
2188 qemu_log_mask(CPU_LOG_INT,
2189 "...handling as semihosting call 0x%x\n",
2190 env->regs[0]);
2191 env->regs[0] = do_arm_semihosting(env);
2192 env->regs[15] += env->thumb ? 2 : 4;
2193 return;
2194 case EXCP_BKPT:
2195 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false);
2196 break;
2197 case EXCP_IRQ:
2198 break;
2199 case EXCP_EXCEPTION_EXIT:
2200 if (env->regs[15] < EXC_RETURN_MIN_MAGIC) {
2201
2202 assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC);
2203 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
2204 if (do_v7m_function_return(cpu)) {
2205 return;
2206 }
2207 } else {
2208 do_v7m_exception_exit(cpu);
2209 return;
2210 }
2211 break;
2212 case EXCP_LAZYFP:
2213
2214
2215
2216
2217 break;
2218 default:
2219 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
2220 return;
2221 }
2222
2223 if (arm_feature(env, ARM_FEATURE_V8)) {
2224 lr = R_V7M_EXCRET_RES1_MASK |
2225 R_V7M_EXCRET_DCRS_MASK;
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238 if (env->v7m.secure) {
2239 lr |= R_V7M_EXCRET_S_MASK;
2240 }
2241 } else {
2242 lr = R_V7M_EXCRET_RES1_MASK |
2243 R_V7M_EXCRET_S_MASK |
2244 R_V7M_EXCRET_DCRS_MASK |
2245 R_V7M_EXCRET_ES_MASK;
2246 if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
2247 lr |= R_V7M_EXCRET_SPSEL_MASK;
2248 }
2249 }
2250 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
2251 lr |= R_V7M_EXCRET_FTYPE_MASK;
2252 }
2253 if (!arm_v7m_is_handler_mode(env)) {
2254 lr |= R_V7M_EXCRET_MODE_MASK;
2255 }
2256
2257 ignore_stackfaults = v7m_push_stack(cpu);
2258 v7m_exception_taken(cpu, lr, false, ignore_stackfaults);
2259}
2260
2261uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
2262{
2263 unsigned el = arm_current_el(env);
2264
2265
2266 switch (reg) {
2267 case 0 ... 7:
2268 return v7m_mrs_xpsr(env, reg, el);
2269 case 20:
2270 return v7m_mrs_control(env, env->v7m.secure);
2271 case 0x94:
2272
2273
2274
2275
2276 if (!env->v7m.secure) {
2277 return 0;
2278 }
2279 return env->v7m.control[M_REG_NS] |
2280 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK);
2281 }
2282
2283 if (el == 0) {
2284 return 0;
2285 }
2286
2287 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2288 switch (reg) {
2289 case 0x88:
2290 if (!env->v7m.secure) {
2291 return 0;
2292 }
2293 return env->v7m.other_ss_msp;
2294 case 0x89:
2295 if (!env->v7m.secure) {
2296 return 0;
2297 }
2298 return env->v7m.other_ss_psp;
2299 case 0x8a:
2300 if (!env->v7m.secure) {
2301 return 0;
2302 }
2303 return env->v7m.msplim[M_REG_NS];
2304 case 0x8b:
2305 if (!env->v7m.secure) {
2306 return 0;
2307 }
2308 return env->v7m.psplim[M_REG_NS];
2309 case 0x90:
2310 if (!env->v7m.secure) {
2311 return 0;
2312 }
2313 return env->v7m.primask[M_REG_NS];
2314 case 0x91:
2315 if (!env->v7m.secure) {
2316 return 0;
2317 }
2318 return env->v7m.basepri[M_REG_NS];
2319 case 0x93:
2320 if (!env->v7m.secure) {
2321 return 0;
2322 }
2323 return env->v7m.faultmask[M_REG_NS];
2324 case 0x98:
2325 {
2326
2327
2328
2329
2330 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2331
2332 if (!env->v7m.secure) {
2333 return 0;
2334 }
2335 if (!arm_v7m_is_handler_mode(env) && spsel) {
2336 return env->v7m.other_ss_psp;
2337 } else {
2338 return env->v7m.other_ss_msp;
2339 }
2340 }
2341 default:
2342 break;
2343 }
2344 }
2345
2346 switch (reg) {
2347 case 8:
2348 return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];
2349 case 9:
2350 return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;
2351 case 10:
2352 if (!arm_feature(env, ARM_FEATURE_V8)) {
2353 goto bad_reg;
2354 }
2355 return env->v7m.msplim[env->v7m.secure];
2356 case 11:
2357 if (!arm_feature(env, ARM_FEATURE_V8)) {
2358 goto bad_reg;
2359 }
2360 return env->v7m.psplim[env->v7m.secure];
2361 case 16:
2362 return env->v7m.primask[env->v7m.secure];
2363 case 17:
2364 case 18:
2365 return env->v7m.basepri[env->v7m.secure];
2366 case 19:
2367 return env->v7m.faultmask[env->v7m.secure];
2368 default:
2369 bad_reg:
2370 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"
2371 " register %d\n", reg);
2372 return 0;
2373 }
2374}
2375
2376void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
2377{
2378
2379
2380
2381
2382
2383
2384
2385
2386 uint32_t mask = extract32(maskreg, 8, 4);
2387 uint32_t reg = extract32(maskreg, 0, 8);
2388 int cur_el = arm_current_el(env);
2389
2390 if (cur_el == 0 && reg > 7 && reg != 20) {
2391
2392
2393
2394
2395 return;
2396 }
2397
2398 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2399 switch (reg) {
2400 case 0x88:
2401 if (!env->v7m.secure) {
2402 return;
2403 }
2404 env->v7m.other_ss_msp = val;
2405 return;
2406 case 0x89:
2407 if (!env->v7m.secure) {
2408 return;
2409 }
2410 env->v7m.other_ss_psp = val;
2411 return;
2412 case 0x8a:
2413 if (!env->v7m.secure) {
2414 return;
2415 }
2416 env->v7m.msplim[M_REG_NS] = val & ~7;
2417 return;
2418 case 0x8b:
2419 if (!env->v7m.secure) {
2420 return;
2421 }
2422 env->v7m.psplim[M_REG_NS] = val & ~7;
2423 return;
2424 case 0x90:
2425 if (!env->v7m.secure) {
2426 return;
2427 }
2428 env->v7m.primask[M_REG_NS] = val & 1;
2429 return;
2430 case 0x91:
2431 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) {
2432 return;
2433 }
2434 env->v7m.basepri[M_REG_NS] = val & 0xff;
2435 return;
2436 case 0x93:
2437 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) {
2438 return;
2439 }
2440 env->v7m.faultmask[M_REG_NS] = val & 1;
2441 return;
2442 case 0x94:
2443 if (!env->v7m.secure) {
2444 return;
2445 }
2446 write_v7m_control_spsel_for_secstate(env,
2447 val & R_V7M_CONTROL_SPSEL_MASK,
2448 M_REG_NS);
2449 if (arm_feature(env, ARM_FEATURE_M_MAIN)) {
2450 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK;
2451 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK;
2452 }
2453
2454
2455
2456
2457 if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env)) &&
2458 extract32(env->v7m.nsacr, 10, 1)) {
2459 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2460 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2461 }
2462 return;
2463 case 0x98:
2464 {
2465
2466
2467
2468
2469 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
2470 bool is_psp = !arm_v7m_is_handler_mode(env) && spsel;
2471 uint32_t limit;
2472
2473 if (!env->v7m.secure) {
2474 return;
2475 }
2476
2477 limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
2478
2479 if (val < limit) {
2480 CPUState *cs = env_cpu(env);
2481
2482 cpu_restore_state(cs, GETPC(), true);
2483 raise_exception(env, EXCP_STKOF, 0, 1);
2484 }
2485
2486 if (is_psp) {
2487 env->v7m.other_ss_psp = val;
2488 } else {
2489 env->v7m.other_ss_msp = val;
2490 }
2491 return;
2492 }
2493 default:
2494 break;
2495 }
2496 }
2497
2498 switch (reg) {
2499 case 0 ... 7:
2500 v7m_msr_xpsr(env, mask, reg, val);
2501 break;
2502 case 8:
2503 if (v7m_using_psp(env)) {
2504 env->v7m.other_sp = val;
2505 } else {
2506 env->regs[13] = val;
2507 }
2508 break;
2509 case 9:
2510 if (v7m_using_psp(env)) {
2511 env->regs[13] = val;
2512 } else {
2513 env->v7m.other_sp = val;
2514 }
2515 break;
2516 case 10:
2517 if (!arm_feature(env, ARM_FEATURE_V8)) {
2518 goto bad_reg;
2519 }
2520 env->v7m.msplim[env->v7m.secure] = val & ~7;
2521 break;
2522 case 11:
2523 if (!arm_feature(env, ARM_FEATURE_V8)) {
2524 goto bad_reg;
2525 }
2526 env->v7m.psplim[env->v7m.secure] = val & ~7;
2527 break;
2528 case 16:
2529 env->v7m.primask[env->v7m.secure] = val & 1;
2530 break;
2531 case 17:
2532 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2533 goto bad_reg;
2534 }
2535 env->v7m.basepri[env->v7m.secure] = val & 0xff;
2536 break;
2537 case 18:
2538 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2539 goto bad_reg;
2540 }
2541 val &= 0xff;
2542 if (val != 0 && (val < env->v7m.basepri[env->v7m.secure]
2543 || env->v7m.basepri[env->v7m.secure] == 0)) {
2544 env->v7m.basepri[env->v7m.secure] = val;
2545 }
2546 break;
2547 case 19:
2548 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
2549 goto bad_reg;
2550 }
2551 env->v7m.faultmask[env->v7m.secure] = val & 1;
2552 break;
2553 case 20:
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564 if (cur_el > 0 && (arm_feature(env, ARM_FEATURE_V8) ||
2565 !arm_v7m_is_handler_mode(env))) {
2566 write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
2567 }
2568 if (cur_el > 0 && arm_feature(env, ARM_FEATURE_M_MAIN)) {
2569 env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
2570 env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
2571 }
2572 if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
2573
2574
2575
2576
2577
2578 if (env->v7m.secure) {
2579 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
2580 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_SFPA_MASK;
2581 }
2582 if (cur_el > 0 &&
2583 (env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_SECURITY) ||
2584 extract32(env->v7m.nsacr, 10, 1))) {
2585 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
2586 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
2587 }
2588 }
2589 break;
2590 default:
2591 bad_reg:
2592 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
2593 " register %d\n", reg);
2594 return;
2595 }
2596}
2597
2598uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
2599{
2600
2601 bool forceunpriv = op & 1;
2602 bool alt = op & 2;
2603 V8M_SAttributes sattrs = {};
2604 uint32_t tt_resp;
2605 bool r, rw, nsr, nsrw, mrvalid;
2606 int prot;
2607 ARMMMUFaultInfo fi = {};
2608 MemTxAttrs attrs = {};
2609 hwaddr phys_addr;
2610 ARMMMUIdx mmu_idx;
2611 uint32_t mregion;
2612 bool targetpriv;
2613 bool targetsec = env->v7m.secure;
2614 bool is_subpage;
2615
2616
2617
2618
2619
2620 if (alt) {
2621 targetsec = !targetsec;
2622 }
2623
2624 if (forceunpriv) {
2625 targetpriv = false;
2626 } else {
2627 targetpriv = arm_v7m_is_handler_mode(env) ||
2628 !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK);
2629 }
2630
2631
2632 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv);
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644 if (arm_current_el(env) != 0 || alt) {
2645
2646 pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx,
2647 &phys_addr, &attrs, &prot, &is_subpage,
2648 &fi, &mregion);
2649 if (mregion == -1) {
2650 mrvalid = false;
2651 mregion = 0;
2652 } else {
2653 mrvalid = true;
2654 }
2655 r = prot & PAGE_READ;
2656 rw = prot & PAGE_WRITE;
2657 } else {
2658 r = false;
2659 rw = false;
2660 mrvalid = false;
2661 mregion = 0;
2662 }
2663
2664 if (env->v7m.secure) {
2665 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs);
2666 nsr = sattrs.ns && r;
2667 nsrw = sattrs.ns && rw;
2668 } else {
2669 sattrs.ns = true;
2670 nsr = false;
2671 nsrw = false;
2672 }
2673
2674 tt_resp = (sattrs.iregion << 24) |
2675 (sattrs.irvalid << 23) |
2676 ((!sattrs.ns) << 22) |
2677 (nsrw << 21) |
2678 (nsr << 20) |
2679 (rw << 19) |
2680 (r << 18) |
2681 (sattrs.srvalid << 17) |
2682 (mrvalid << 16) |
2683 (sattrs.sregion << 8) |
2684 mregion;
2685
2686 return tt_resp;
2687}
2688
2689#endif
2690
2691ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
2692 bool secstate, bool priv, bool negpri)
2693{
2694 ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
2695
2696 if (priv) {
2697 mmu_idx |= ARM_MMU_IDX_M_PRIV;
2698 }
2699
2700 if (negpri) {
2701 mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
2702 }
2703
2704 if (secstate) {
2705 mmu_idx |= ARM_MMU_IDX_M_S;
2706 }
2707
2708 return mmu_idx;
2709}
2710
2711ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
2712 bool secstate, bool priv)
2713{
2714 bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate);
2715
2716 return arm_v7m_mmu_idx_all(env, secstate, priv, negpri);
2717}
2718
2719
2720ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
2721{
2722 bool priv = arm_v7m_is_handler_mode(env) ||
2723 !(env->v7m.control[secstate] & 1);
2724
2725 return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
2726}
2727