/
translate.c
9926 lines (8901 loc) · 290 KB
/
translate.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* ARM translation
*
* Copyright (c) 2003 Fabrice Bellard
* Copyright (c) 2005-2007 CodeSourcery
* Copyright (c) 2007 OpenedHand, Ltd.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
*/
#include "qemu/osdep.h"
#include "cpu.h"
#include "internals.h"
#include "disas/disas.h"
#include "exec/exec-all.h"
#include "tcg/tcg-op.h"
#include "tcg/tcg-op-gvec.h"
#include "qemu/log.h"
#include "qemu/bitops.h"
#include "arm_ldst.h"
#include "semihosting/semihost.h"
#include "exec/helper-proto.h"
#include "exec/helper-gen.h"
#include "exec/log.h"
#include "cpregs.h"
#define ENABLE_ARCH_4T arm_dc_feature(s, ARM_FEATURE_V4T)
#define ENABLE_ARCH_5 arm_dc_feature(s, ARM_FEATURE_V5)
/* currently all emulated v5 cores are also v5TE, so don't bother */
#define ENABLE_ARCH_5TE arm_dc_feature(s, ARM_FEATURE_V5)
#define ENABLE_ARCH_5J dc_isar_feature(aa32_jazelle, s)
#define ENABLE_ARCH_6 arm_dc_feature(s, ARM_FEATURE_V6)
#define ENABLE_ARCH_6K arm_dc_feature(s, ARM_FEATURE_V6K)
#define ENABLE_ARCH_6T2 arm_dc_feature(s, ARM_FEATURE_THUMB2)
#define ENABLE_ARCH_7 arm_dc_feature(s, ARM_FEATURE_V7)
#define ENABLE_ARCH_8 arm_dc_feature(s, ARM_FEATURE_V8)
#include "translate.h"
#include "translate-a32.h"
/* These are TCG temporaries used only by the legacy iwMMXt decoder */
static TCGv_i64 cpu_V0, cpu_V1, cpu_M0;
/* These are TCG globals which alias CPUARMState fields */
static TCGv_i32 cpu_R[16];
TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
TCGv_i64 cpu_exclusive_addr;
TCGv_i64 cpu_exclusive_val;
#include "exec/gen-icount.h"
static const char * const regnames[] =
{ "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
"r8", "r9", "r10", "r11", "r12", "r13", "r14", "pc" };
/* initialize TCG globals. */
void arm_translate_init(void)
{
int i;
for (i = 0; i < 16; i++) {
cpu_R[i] = tcg_global_mem_new_i32(cpu_env,
offsetof(CPUARMState, regs[i]),
regnames[i]);
}
cpu_CF = tcg_global_mem_new_i32(cpu_env, offsetof(CPUARMState, CF), "CF");
cpu_NF = tcg_global_mem_new_i32(cpu_env, offsetof(CPUARMState, NF), "NF");
cpu_VF = tcg_global_mem_new_i32(cpu_env, offsetof(CPUARMState, VF), "VF");
cpu_ZF = tcg_global_mem_new_i32(cpu_env, offsetof(CPUARMState, ZF), "ZF");
cpu_exclusive_addr = tcg_global_mem_new_i64(cpu_env,
offsetof(CPUARMState, exclusive_addr), "exclusive_addr");
cpu_exclusive_val = tcg_global_mem_new_i64(cpu_env,
offsetof(CPUARMState, exclusive_val), "exclusive_val");
a64_translate_init();
}
uint64_t asimd_imm_const(uint32_t imm, int cmode, int op)
{
/* Expand the encoded constant as per AdvSIMDExpandImm pseudocode */
switch (cmode) {
case 0: case 1:
/* no-op */
break;
case 2: case 3:
imm <<= 8;
break;
case 4: case 5:
imm <<= 16;
break;
case 6: case 7:
imm <<= 24;
break;
case 8: case 9:
imm |= imm << 16;
break;
case 10: case 11:
imm = (imm << 8) | (imm << 24);
break;
case 12:
imm = (imm << 8) | 0xff;
break;
case 13:
imm = (imm << 16) | 0xffff;
break;
case 14:
if (op) {
/*
* This and cmode == 15 op == 1 are the only cases where
* the top and bottom 32 bits of the encoded constant differ.
*/
uint64_t imm64 = 0;
int n;
for (n = 0; n < 8; n++) {
if (imm & (1 << n)) {
imm64 |= (0xffULL << (n * 8));
}
}
return imm64;
}
imm |= (imm << 8) | (imm << 16) | (imm << 24);
break;
case 15:
if (op) {
/* Reserved encoding for AArch32; valid for AArch64 */
uint64_t imm64 = (uint64_t)(imm & 0x3f) << 48;
if (imm & 0x80) {
imm64 |= 0x8000000000000000ULL;
}
if (imm & 0x40) {
imm64 |= 0x3fc0000000000000ULL;
} else {
imm64 |= 0x4000000000000000ULL;
}
return imm64;
}
imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
| ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
break;
}
if (op) {
imm = ~imm;
}
return dup_const(MO_32, imm);
}
/* Generate a label used for skipping this instruction */
void arm_gen_condlabel(DisasContext *s)
{
if (!s->condjmp) {
s->condlabel = gen_new_label();
s->condjmp = 1;
}
}
/* Flags for the disas_set_da_iss info argument:
* lower bits hold the Rt register number, higher bits are flags.
*/
typedef enum ISSInfo {
ISSNone = 0,
ISSRegMask = 0x1f,
ISSInvalid = (1 << 5),
ISSIsAcqRel = (1 << 6),
ISSIsWrite = (1 << 7),
ISSIs16Bit = (1 << 8),
} ISSInfo;
/*
* Store var into env + offset to a member with size bytes.
* Free var after use.
*/
void store_cpu_offset(TCGv_i32 var, int offset, int size)
{
switch (size) {
case 1:
tcg_gen_st8_i32(var, cpu_env, offset);
break;
case 4:
tcg_gen_st_i32(var, cpu_env, offset);
break;
default:
g_assert_not_reached();
}
tcg_temp_free_i32(var);
}
/* Save the syndrome information for a Data Abort */
static void disas_set_da_iss(DisasContext *s, MemOp memop, ISSInfo issinfo)
{
uint32_t syn;
int sas = memop & MO_SIZE;
bool sse = memop & MO_SIGN;
bool is_acqrel = issinfo & ISSIsAcqRel;
bool is_write = issinfo & ISSIsWrite;
bool is_16bit = issinfo & ISSIs16Bit;
int srt = issinfo & ISSRegMask;
if (issinfo & ISSInvalid) {
/* Some callsites want to conditionally provide ISS info,
* eg "only if this was not a writeback"
*/
return;
}
if (srt == 15) {
/* For AArch32, insns where the src/dest is R15 never generate
* ISS information. Catching that here saves checking at all
* the call sites.
*/
return;
}
syn = syn_data_abort_with_iss(0, sas, sse, srt, 0, is_acqrel,
0, 0, 0, is_write, 0, is_16bit);
disas_set_insn_syndrome(s, syn);
}
static inline int get_a32_user_mem_index(DisasContext *s)
{
/* Return the core mmu_idx to use for A32/T32 "unprivileged load/store"
* insns:
* if PL2, UNPREDICTABLE (we choose to implement as if PL0)
* otherwise, access as if at PL0.
*/
switch (s->mmu_idx) {
case ARMMMUIdx_E2: /* this one is UNPREDICTABLE */
case ARMMMUIdx_E10_0:
case ARMMMUIdx_E10_1:
case ARMMMUIdx_E10_1_PAN:
return arm_to_core_mmu_idx(ARMMMUIdx_E10_0);
case ARMMMUIdx_SE3:
case ARMMMUIdx_SE10_0:
case ARMMMUIdx_SE10_1:
case ARMMMUIdx_SE10_1_PAN:
return arm_to_core_mmu_idx(ARMMMUIdx_SE10_0);
case ARMMMUIdx_MUser:
case ARMMMUIdx_MPriv:
return arm_to_core_mmu_idx(ARMMMUIdx_MUser);
case ARMMMUIdx_MUserNegPri:
case ARMMMUIdx_MPrivNegPri:
return arm_to_core_mmu_idx(ARMMMUIdx_MUserNegPri);
case ARMMMUIdx_MSUser:
case ARMMMUIdx_MSPriv:
return arm_to_core_mmu_idx(ARMMMUIdx_MSUser);
case ARMMMUIdx_MSUserNegPri:
case ARMMMUIdx_MSPrivNegPri:
return arm_to_core_mmu_idx(ARMMMUIdx_MSUserNegPri);
default:
g_assert_not_reached();
}
}
/* The architectural value of PC. */
static uint32_t read_pc(DisasContext *s)
{
return s->pc_curr + (s->thumb ? 4 : 8);
}
/* Set a variable to the value of a CPU register. */
void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
{
if (reg == 15) {
tcg_gen_movi_i32(var, read_pc(s));
} else {
tcg_gen_mov_i32(var, cpu_R[reg]);
}
}
/*
* Create a new temp, REG + OFS, except PC is ALIGN(PC, 4).
* This is used for load/store for which use of PC implies (literal),
* or ADD that implies ADR.
*/
TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
{
TCGv_i32 tmp = tcg_temp_new_i32();
if (reg == 15) {
tcg_gen_movi_i32(tmp, (read_pc(s) & ~3) + ofs);
} else {
tcg_gen_addi_i32(tmp, cpu_R[reg], ofs);
}
return tmp;
}
/* Set a CPU register. The source must be a temporary and will be
marked as dead. */
void store_reg(DisasContext *s, int reg, TCGv_i32 var)
{
if (reg == 15) {
/* In Thumb mode, we must ignore bit 0.
* In ARM mode, for ARMv4 and ARMv5, it is UNPREDICTABLE if bits [1:0]
* are not 0b00, but for ARMv6 and above, we must ignore bits [1:0].
* We choose to ignore [1:0] in ARM mode for all architecture versions.
*/
tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
s->base.is_jmp = DISAS_JUMP;
} else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
/* For M-profile SP bits [1:0] are always zero */
tcg_gen_andi_i32(var, var, ~3);
}
tcg_gen_mov_i32(cpu_R[reg], var);
tcg_temp_free_i32(var);
}
/*
* Variant of store_reg which applies v8M stack-limit checks before updating
* SP. If the check fails this will result in an exception being taken.
* We disable the stack checks for CONFIG_USER_ONLY because we have
* no idea what the stack limits should be in that case.
* If stack checking is not being done this just acts like store_reg().
*/
static void store_sp_checked(DisasContext *s, TCGv_i32 var)
{
#ifndef CONFIG_USER_ONLY
if (s->v8m_stackcheck) {
gen_helper_v8m_stackcheck(cpu_env, var);
}
#endif
store_reg(s, 13, var);
}
/* Value extensions. */
#define gen_uxtb(var) tcg_gen_ext8u_i32(var, var)
#define gen_uxth(var) tcg_gen_ext16u_i32(var, var)
#define gen_sxtb(var) tcg_gen_ext8s_i32(var, var)
#define gen_sxth(var) tcg_gen_ext16s_i32(var, var)
#define gen_sxtb16(var) gen_helper_sxtb16(var, var)
#define gen_uxtb16(var) gen_helper_uxtb16(var, var)
void gen_set_cpsr(TCGv_i32 var, uint32_t mask)
{
gen_helper_cpsr_write(cpu_env, var, tcg_constant_i32(mask));
}
static void gen_rebuild_hflags(DisasContext *s, bool new_el)
{
bool m_profile = arm_dc_feature(s, ARM_FEATURE_M);
if (new_el) {
if (m_profile) {
gen_helper_rebuild_hflags_m32_newel(cpu_env);
} else {
gen_helper_rebuild_hflags_a32_newel(cpu_env);
}
} else {
TCGv_i32 tcg_el = tcg_constant_i32(s->current_el);
if (m_profile) {
gen_helper_rebuild_hflags_m32(cpu_env, tcg_el);
} else {
gen_helper_rebuild_hflags_a32(cpu_env, tcg_el);
}
}
}
static void gen_exception_internal(int excp)
{
assert(excp_is_internal(excp));
gen_helper_exception_internal(cpu_env, tcg_constant_i32(excp));
}
static void gen_singlestep_exception(DisasContext *s)
{
/* We just completed step of an insn. Move from Active-not-pending
* to Active-pending, and then also take the swstep exception.
* This corresponds to making the (IMPDEF) choice to prioritize
* swstep exceptions over asynchronous exceptions taken to an exception
* level where debug is disabled. This choice has the advantage that
* we do not need to maintain internal state corresponding to the
* ISV/EX syndrome bits between completion of the step and generation
* of the exception, and our syndrome information is always correct.
*/
gen_ss_advance(s);
gen_swstep_exception(s, 1, s->is_ldex);
s->base.is_jmp = DISAS_NORETURN;
}
void clear_eci_state(DisasContext *s)
{
/*
* Clear any ECI/ICI state: used when a load multiple/store
* multiple insn executes.
*/
if (s->eci) {
store_cpu_field_constant(0, condexec_bits);
s->eci = 0;
}
}
static void gen_smul_dual(TCGv_i32 a, TCGv_i32 b)
{
TCGv_i32 tmp1 = tcg_temp_new_i32();
TCGv_i32 tmp2 = tcg_temp_new_i32();
tcg_gen_ext16s_i32(tmp1, a);
tcg_gen_ext16s_i32(tmp2, b);
tcg_gen_mul_i32(tmp1, tmp1, tmp2);
tcg_temp_free_i32(tmp2);
tcg_gen_sari_i32(a, a, 16);
tcg_gen_sari_i32(b, b, 16);
tcg_gen_mul_i32(b, b, a);
tcg_gen_mov_i32(a, tmp1);
tcg_temp_free_i32(tmp1);
}
/* Byteswap each halfword. */
void gen_rev16(TCGv_i32 dest, TCGv_i32 var)
{
TCGv_i32 tmp = tcg_temp_new_i32();
TCGv_i32 mask = tcg_constant_i32(0x00ff00ff);
tcg_gen_shri_i32(tmp, var, 8);
tcg_gen_and_i32(tmp, tmp, mask);
tcg_gen_and_i32(var, var, mask);
tcg_gen_shli_i32(var, var, 8);
tcg_gen_or_i32(dest, var, tmp);
tcg_temp_free_i32(tmp);
}
/* Byteswap low halfword and sign extend. */
static void gen_revsh(TCGv_i32 dest, TCGv_i32 var)
{
tcg_gen_bswap16_i32(var, var, TCG_BSWAP_OS);
}
/* Dual 16-bit add. Result placed in t0 and t1 is marked as dead.
tmp = (t0 ^ t1) & 0x8000;
t0 &= ~0x8000;
t1 &= ~0x8000;
t0 = (t0 + t1) ^ tmp;
*/
static void gen_add16(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
{
TCGv_i32 tmp = tcg_temp_new_i32();
tcg_gen_xor_i32(tmp, t0, t1);
tcg_gen_andi_i32(tmp, tmp, 0x8000);
tcg_gen_andi_i32(t0, t0, ~0x8000);
tcg_gen_andi_i32(t1, t1, ~0x8000);
tcg_gen_add_i32(t0, t0, t1);
tcg_gen_xor_i32(dest, t0, tmp);
tcg_temp_free_i32(tmp);
}
/* Set N and Z flags from var. */
static inline void gen_logic_CC(TCGv_i32 var)
{
tcg_gen_mov_i32(cpu_NF, var);
tcg_gen_mov_i32(cpu_ZF, var);
}
/* dest = T0 + T1 + CF. */
static void gen_add_carry(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
{
tcg_gen_add_i32(dest, t0, t1);
tcg_gen_add_i32(dest, dest, cpu_CF);
}
/* dest = T0 - T1 + CF - 1. */
static void gen_sub_carry(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
{
tcg_gen_sub_i32(dest, t0, t1);
tcg_gen_add_i32(dest, dest, cpu_CF);
tcg_gen_subi_i32(dest, dest, 1);
}
/* dest = T0 + T1. Compute C, N, V and Z flags */
static void gen_add_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
{
TCGv_i32 tmp = tcg_temp_new_i32();
tcg_gen_movi_i32(tmp, 0);
tcg_gen_add2_i32(cpu_NF, cpu_CF, t0, tmp, t1, tmp);
tcg_gen_mov_i32(cpu_ZF, cpu_NF);
tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
tcg_gen_xor_i32(tmp, t0, t1);
tcg_gen_andc_i32(cpu_VF, cpu_VF, tmp);
tcg_temp_free_i32(tmp);
tcg_gen_mov_i32(dest, cpu_NF);
}
/* dest = T0 + T1 + CF. Compute C, N, V and Z flags */
static void gen_adc_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
{
TCGv_i32 tmp = tcg_temp_new_i32();
if (TCG_TARGET_HAS_add2_i32) {
tcg_gen_movi_i32(tmp, 0);
tcg_gen_add2_i32(cpu_NF, cpu_CF, t0, tmp, cpu_CF, tmp);
tcg_gen_add2_i32(cpu_NF, cpu_CF, cpu_NF, cpu_CF, t1, tmp);
} else {
TCGv_i64 q0 = tcg_temp_new_i64();
TCGv_i64 q1 = tcg_temp_new_i64();
tcg_gen_extu_i32_i64(q0, t0);
tcg_gen_extu_i32_i64(q1, t1);
tcg_gen_add_i64(q0, q0, q1);
tcg_gen_extu_i32_i64(q1, cpu_CF);
tcg_gen_add_i64(q0, q0, q1);
tcg_gen_extr_i64_i32(cpu_NF, cpu_CF, q0);
tcg_temp_free_i64(q0);
tcg_temp_free_i64(q1);
}
tcg_gen_mov_i32(cpu_ZF, cpu_NF);
tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
tcg_gen_xor_i32(tmp, t0, t1);
tcg_gen_andc_i32(cpu_VF, cpu_VF, tmp);
tcg_temp_free_i32(tmp);
tcg_gen_mov_i32(dest, cpu_NF);
}
/* dest = T0 - T1. Compute C, N, V and Z flags */
static void gen_sub_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
{
TCGv_i32 tmp;
tcg_gen_sub_i32(cpu_NF, t0, t1);
tcg_gen_mov_i32(cpu_ZF, cpu_NF);
tcg_gen_setcond_i32(TCG_COND_GEU, cpu_CF, t0, t1);
tcg_gen_xor_i32(cpu_VF, cpu_NF, t0);
tmp = tcg_temp_new_i32();
tcg_gen_xor_i32(tmp, t0, t1);
tcg_gen_and_i32(cpu_VF, cpu_VF, tmp);
tcg_temp_free_i32(tmp);
tcg_gen_mov_i32(dest, cpu_NF);
}
/* dest = T0 + ~T1 + CF. Compute C, N, V and Z flags */
static void gen_sbc_CC(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
{
TCGv_i32 tmp = tcg_temp_new_i32();
tcg_gen_not_i32(tmp, t1);
gen_adc_CC(dest, t0, tmp);
tcg_temp_free_i32(tmp);
}
#define GEN_SHIFT(name) \
static void gen_##name(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1) \
{ \
TCGv_i32 tmpd = tcg_temp_new_i32(); \
TCGv_i32 tmp1 = tcg_temp_new_i32(); \
TCGv_i32 zero = tcg_constant_i32(0); \
tcg_gen_andi_i32(tmp1, t1, 0x1f); \
tcg_gen_##name##_i32(tmpd, t0, tmp1); \
tcg_gen_andi_i32(tmp1, t1, 0xe0); \
tcg_gen_movcond_i32(TCG_COND_NE, dest, tmp1, zero, zero, tmpd); \
tcg_temp_free_i32(tmpd); \
tcg_temp_free_i32(tmp1); \
}
GEN_SHIFT(shl)
GEN_SHIFT(shr)
#undef GEN_SHIFT
static void gen_sar(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
{
TCGv_i32 tmp1 = tcg_temp_new_i32();
tcg_gen_andi_i32(tmp1, t1, 0xff);
tcg_gen_umin_i32(tmp1, tmp1, tcg_constant_i32(31));
tcg_gen_sar_i32(dest, t0, tmp1);
tcg_temp_free_i32(tmp1);
}
static void shifter_out_im(TCGv_i32 var, int shift)
{
tcg_gen_extract_i32(cpu_CF, var, shift, 1);
}
/* Shift by immediate. Includes special handling for shift == 0. */
static inline void gen_arm_shift_im(TCGv_i32 var, int shiftop,
int shift, int flags)
{
switch (shiftop) {
case 0: /* LSL */
if (shift != 0) {
if (flags)
shifter_out_im(var, 32 - shift);
tcg_gen_shli_i32(var, var, shift);
}
break;
case 1: /* LSR */
if (shift == 0) {
if (flags) {
tcg_gen_shri_i32(cpu_CF, var, 31);
}
tcg_gen_movi_i32(var, 0);
} else {
if (flags)
shifter_out_im(var, shift - 1);
tcg_gen_shri_i32(var, var, shift);
}
break;
case 2: /* ASR */
if (shift == 0)
shift = 32;
if (flags)
shifter_out_im(var, shift - 1);
if (shift == 32)
shift = 31;
tcg_gen_sari_i32(var, var, shift);
break;
case 3: /* ROR/RRX */
if (shift != 0) {
if (flags)
shifter_out_im(var, shift - 1);
tcg_gen_rotri_i32(var, var, shift); break;
} else {
TCGv_i32 tmp = tcg_temp_new_i32();
tcg_gen_shli_i32(tmp, cpu_CF, 31);
if (flags)
shifter_out_im(var, 0);
tcg_gen_shri_i32(var, var, 1);
tcg_gen_or_i32(var, var, tmp);
tcg_temp_free_i32(tmp);
}
}
};
static inline void gen_arm_shift_reg(TCGv_i32 var, int shiftop,
TCGv_i32 shift, int flags)
{
if (flags) {
switch (shiftop) {
case 0: gen_helper_shl_cc(var, cpu_env, var, shift); break;
case 1: gen_helper_shr_cc(var, cpu_env, var, shift); break;
case 2: gen_helper_sar_cc(var, cpu_env, var, shift); break;
case 3: gen_helper_ror_cc(var, cpu_env, var, shift); break;
}
} else {
switch (shiftop) {
case 0:
gen_shl(var, var, shift);
break;
case 1:
gen_shr(var, var, shift);
break;
case 2:
gen_sar(var, var, shift);
break;
case 3: tcg_gen_andi_i32(shift, shift, 0x1f);
tcg_gen_rotr_i32(var, var, shift); break;
}
}
tcg_temp_free_i32(shift);
}
/*
* Generate a conditional based on ARM condition code cc.
* This is common between ARM and Aarch64 targets.
*/
void arm_test_cc(DisasCompare *cmp, int cc)
{
TCGv_i32 value;
TCGCond cond;
bool global = true;
switch (cc) {
case 0: /* eq: Z */
case 1: /* ne: !Z */
cond = TCG_COND_EQ;
value = cpu_ZF;
break;
case 2: /* cs: C */
case 3: /* cc: !C */
cond = TCG_COND_NE;
value = cpu_CF;
break;
case 4: /* mi: N */
case 5: /* pl: !N */
cond = TCG_COND_LT;
value = cpu_NF;
break;
case 6: /* vs: V */
case 7: /* vc: !V */
cond = TCG_COND_LT;
value = cpu_VF;
break;
case 8: /* hi: C && !Z */
case 9: /* ls: !C || Z -> !(C && !Z) */
cond = TCG_COND_NE;
value = tcg_temp_new_i32();
global = false;
/* CF is 1 for C, so -CF is an all-bits-set mask for C;
ZF is non-zero for !Z; so AND the two subexpressions. */
tcg_gen_neg_i32(value, cpu_CF);
tcg_gen_and_i32(value, value, cpu_ZF);
break;
case 10: /* ge: N == V -> N ^ V == 0 */
case 11: /* lt: N != V -> N ^ V != 0 */
/* Since we're only interested in the sign bit, == 0 is >= 0. */
cond = TCG_COND_GE;
value = tcg_temp_new_i32();
global = false;
tcg_gen_xor_i32(value, cpu_VF, cpu_NF);
break;
case 12: /* gt: !Z && N == V */
case 13: /* le: Z || N != V */
cond = TCG_COND_NE;
value = tcg_temp_new_i32();
global = false;
/* (N == V) is equal to the sign bit of ~(NF ^ VF). Propagate
* the sign bit then AND with ZF to yield the result. */
tcg_gen_xor_i32(value, cpu_VF, cpu_NF);
tcg_gen_sari_i32(value, value, 31);
tcg_gen_andc_i32(value, cpu_ZF, value);
break;
case 14: /* always */
case 15: /* always */
/* Use the ALWAYS condition, which will fold early.
* It doesn't matter what we use for the value. */
cond = TCG_COND_ALWAYS;
value = cpu_ZF;
goto no_invert;
default:
fprintf(stderr, "Bad condition code 0x%x\n", cc);
abort();
}
if (cc & 1) {
cond = tcg_invert_cond(cond);
}
no_invert:
cmp->cond = cond;
cmp->value = value;
cmp->value_global = global;
}
void arm_free_cc(DisasCompare *cmp)
{
if (!cmp->value_global) {
tcg_temp_free_i32(cmp->value);
}
}
void arm_jump_cc(DisasCompare *cmp, TCGLabel *label)
{
tcg_gen_brcondi_i32(cmp->cond, cmp->value, 0, label);
}
void arm_gen_test_cc(int cc, TCGLabel *label)
{
DisasCompare cmp;
arm_test_cc(&cmp, cc);
arm_jump_cc(&cmp, label);
arm_free_cc(&cmp);
}
void gen_set_condexec(DisasContext *s)
{
if (s->condexec_mask) {
uint32_t val = (s->condexec_cond << 4) | (s->condexec_mask >> 1);
store_cpu_field_constant(val, condexec_bits);
}
}
void gen_set_pc_im(DisasContext *s, target_ulong val)
{
tcg_gen_movi_i32(cpu_R[15], val);
}
/* Set PC and Thumb state from var. var is marked as dead. */
static inline void gen_bx(DisasContext *s, TCGv_i32 var)
{
s->base.is_jmp = DISAS_JUMP;
tcg_gen_andi_i32(cpu_R[15], var, ~1);
tcg_gen_andi_i32(var, var, 1);
store_cpu_field(var, thumb);
}
/*
* Set PC and Thumb state from var. var is marked as dead.
* For M-profile CPUs, include logic to detect exception-return
* branches and handle them. This is needed for Thumb POP/LDM to PC, LDR to PC,
* and BX reg, and no others, and happens only for code in Handler mode.
* The Security Extension also requires us to check for the FNC_RETURN
* which signals a function return from non-secure state; this can happen
* in both Handler and Thread mode.
* To avoid having to do multiple comparisons in inline generated code,
* we make the check we do here loose, so it will match for EXC_RETURN
* in Thread mode. For system emulation do_v7m_exception_exit() checks
* for these spurious cases and returns without doing anything (giving
* the same behaviour as for a branch to a non-magic address).
*
* In linux-user mode it is unclear what the right behaviour for an
* attempted FNC_RETURN should be, because in real hardware this will go
* directly to Secure code (ie not the Linux kernel) which will then treat
* the error in any way it chooses. For QEMU we opt to make the FNC_RETURN
* attempt behave the way it would on a CPU without the security extension,
* which is to say "like a normal branch". That means we can simply treat
* all branches as normal with no magic address behaviour.
*/
static inline void gen_bx_excret(DisasContext *s, TCGv_i32 var)
{
/* Generate the same code here as for a simple bx, but flag via
* s->base.is_jmp that we need to do the rest of the work later.
*/
gen_bx(s, var);
#ifndef CONFIG_USER_ONLY
if (arm_dc_feature(s, ARM_FEATURE_M_SECURITY) ||
(s->v7m_handler_mode && arm_dc_feature(s, ARM_FEATURE_M))) {
s->base.is_jmp = DISAS_BX_EXCRET;
}
#endif
}
static inline void gen_bx_excret_final_code(DisasContext *s)
{
/* Generate the code to finish possible exception return and end the TB */
TCGLabel *excret_label = gen_new_label();
uint32_t min_magic;
if (arm_dc_feature(s, ARM_FEATURE_M_SECURITY)) {
/* Covers FNC_RETURN and EXC_RETURN magic */
min_magic = FNC_RETURN_MIN_MAGIC;
} else {
/* EXC_RETURN magic only */
min_magic = EXC_RETURN_MIN_MAGIC;
}
/* Is the new PC value in the magic range indicating exception return? */
tcg_gen_brcondi_i32(TCG_COND_GEU, cpu_R[15], min_magic, excret_label);
/* No: end the TB as we would for a DISAS_JMP */
if (s->ss_active) {
gen_singlestep_exception(s);
} else {
tcg_gen_exit_tb(NULL, 0);
}
gen_set_label(excret_label);
/* Yes: this is an exception return.
* At this point in runtime env->regs[15] and env->thumb will hold
* the exception-return magic number, which do_v7m_exception_exit()
* will read. Nothing else will be able to see those values because
* the cpu-exec main loop guarantees that we will always go straight
* from raising the exception to the exception-handling code.
*
* gen_ss_advance(s) does nothing on M profile currently but
* calling it is conceptually the right thing as we have executed
* this instruction (compare SWI, HVC, SMC handling).
*/
gen_ss_advance(s);
gen_exception_internal(EXCP_EXCEPTION_EXIT);
}
static inline void gen_bxns(DisasContext *s, int rm)
{
TCGv_i32 var = load_reg(s, rm);
/* The bxns helper may raise an EXCEPTION_EXIT exception, so in theory
* we need to sync state before calling it, but:
* - we don't need to do gen_set_pc_im() because the bxns helper will
* always set the PC itself
* - we don't need to do gen_set_condexec() because BXNS is UNPREDICTABLE
* unless it's outside an IT block or the last insn in an IT block,
* so we know that condexec == 0 (already set at the top of the TB)
* is correct in the non-UNPREDICTABLE cases, and we can choose
* "zeroes the IT bits" as our UNPREDICTABLE behaviour otherwise.
*/
gen_helper_v7m_bxns(cpu_env, var);
tcg_temp_free_i32(var);
s->base.is_jmp = DISAS_EXIT;
}
static inline void gen_blxns(DisasContext *s, int rm)
{
TCGv_i32 var = load_reg(s, rm);
/* We don't need to sync condexec state, for the same reason as bxns.
* We do however need to set the PC, because the blxns helper reads it.
* The blxns helper may throw an exception.
*/
gen_set_pc_im(s, s->base.pc_next);
gen_helper_v7m_blxns(cpu_env, var);
tcg_temp_free_i32(var);
s->base.is_jmp = DISAS_EXIT;
}
/* Variant of store_reg which uses branch&exchange logic when storing
to r15 in ARM architecture v7 and above. The source must be a temporary
and will be marked as dead. */
static inline void store_reg_bx(DisasContext *s, int reg, TCGv_i32 var)
{
if (reg == 15 && ENABLE_ARCH_7) {
gen_bx(s, var);
} else {
store_reg(s, reg, var);
}
}
/* Variant of store_reg which uses branch&exchange logic when storing
* to r15 in ARM architecture v5T and above. This is used for storing
* the results of a LDR/LDM/POP into r15, and corresponds to the cases
* in the ARM ARM which use the LoadWritePC() pseudocode function. */
static inline void store_reg_from_load(DisasContext *s, int reg, TCGv_i32 var)
{
if (reg == 15 && ENABLE_ARCH_5) {
gen_bx_excret(s, var);
} else {
store_reg(s, reg, var);
}
}
#ifdef CONFIG_USER_ONLY
#define IS_USER_ONLY 1
#else
#define IS_USER_ONLY 0
#endif
MemOp pow2_align(unsigned i)
{
static const MemOp mop_align[] = {
0, MO_ALIGN_2, MO_ALIGN_4, MO_ALIGN_8, MO_ALIGN_16,
/*
* FIXME: TARGET_PAGE_BITS_MIN affects TLB_FLAGS_MASK such
* that 256-bit alignment (MO_ALIGN_32) cannot be supported:
* see get_alignment_bits(). Enforce only 128-bit alignment for now.
*/
MO_ALIGN_16
};
g_assert(i < ARRAY_SIZE(mop_align));
return mop_align[i];
}
/*
* Abstractions of "generate code to do a guest load/store for
* AArch32", where a vaddr is always 32 bits (and is zero
* extended if we're a 64 bit core) and data is also
* 32 bits unless specifically doing a 64 bit access.
* These functions work like tcg_gen_qemu_{ld,st}* except
* that the address argument is TCGv_i32 rather than TCGv.
*/
static TCGv gen_aa32_addr(DisasContext *s, TCGv_i32 a32, MemOp op)
{
TCGv addr = tcg_temp_new();
tcg_gen_extu_i32_tl(addr, a32);
/* Not needed for user-mode BE32, where we use MO_BE instead. */
if (!IS_USER_ONLY && s->sctlr_b && (op & MO_SIZE) < MO_32) {
tcg_gen_xori_tl(addr, addr, 4 - (1 << (op & MO_SIZE)));
}
return addr;
}
/*
* Internal routines are used for NEON cases where the endianness
* and/or alignment has already been taken into account and manipulated.
*/
void gen_aa32_ld_internal_i32(DisasContext *s, TCGv_i32 val,
TCGv_i32 a32, int index, MemOp opc)
{
TCGv addr = gen_aa32_addr(s, a32, opc);
tcg_gen_qemu_ld_i32(val, addr, index, opc);
tcg_temp_free(addr);
}
void gen_aa32_st_internal_i32(DisasContext *s, TCGv_i32 val,
TCGv_i32 a32, int index, MemOp opc)
{
TCGv addr = gen_aa32_addr(s, a32, opc);
tcg_gen_qemu_st_i32(val, addr, index, opc);
tcg_temp_free(addr);
}
void gen_aa32_ld_internal_i64(DisasContext *s, TCGv_i64 val,
TCGv_i32 a32, int index, MemOp opc)
{
TCGv addr = gen_aa32_addr(s, a32, opc);
tcg_gen_qemu_ld_i64(val, addr, index, opc);
/* Not needed for user-mode BE32, where we use MO_BE instead. */
if (!IS_USER_ONLY && s->sctlr_b && (opc & MO_SIZE) == MO_64) {
tcg_gen_rotri_i64(val, val, 32);
}
tcg_temp_free(addr);
}
void gen_aa32_st_internal_i64(DisasContext *s, TCGv_i64 val,
TCGv_i32 a32, int index, MemOp opc)
{
TCGv addr = gen_aa32_addr(s, a32, opc);