target/arm: Split helper_msr_i_pstate into 3

The EL0+UMA check is unique to DAIF. While SPSel had avoided the
check by nature of already checking EL >= 1, the other post v8.0
extensions to MSR (imm) allow EL0 and do not require UMA. Avoid
the unconditional write to pc and use raise_exception_ra to unwind.

Backports commit ff730e9666a716b669ac4a8ca7c521177d1d2b15 from qemu

qemu/aarch64.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_aarch64
 #define helper_msa_st_w helper_msa_st_w_aarch64
 #define helper_msr_banked helper_msr_banked_aarch64
-#define helper_msr_i_pstate helper_msr_i_pstate_aarch64
 #define helper_neon_abd_f32 helper_neon_abd_f32_aarch64
 #define helper_neon_abd_s16 helper_neon_abd_s16_aarch64
 #define helper_neon_abd_s32 helper_neon_abd_s32_aarch64
@@ -3411,6 +3410,9 @@
 #define helper_gvec_rsqrts_d helper_gvec_rsqrts_d_aarch64
 #define helper_gvec_rsqrts_h helper_gvec_rsqrts_h_aarch64
 #define helper_gvec_rsqrts_s helper_gvec_rsqrts_s_aarch64
+#define helper_msr_i_daifclear helper_msr_i_daifclear_aarch64
+#define helper_msr_i_daifset helper_msr_i_daifset_aarch64
+#define helper_msr_i_spsel helper_msr_i_spsel_aarch64
 #define helper_neon_addlp_s16 helper_neon_addlp_s16_aarch64
 #define helper_neon_addlp_s8 helper_neon_addlp_s8_aarch64
 #define helper_neon_addlp_u16 helper_neon_addlp_u16_aarch64

qemu/aarch64eb.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_aarch64eb
 #define helper_msa_st_w helper_msa_st_w_aarch64eb
 #define helper_msr_banked helper_msr_banked_aarch64eb
-#define helper_msr_i_pstate helper_msr_i_pstate_aarch64eb
 #define helper_neon_abd_f32 helper_neon_abd_f32_aarch64eb
 #define helper_neon_abd_s16 helper_neon_abd_s16_aarch64eb
 #define helper_neon_abd_s32 helper_neon_abd_s32_aarch64eb
@@ -3411,6 +3410,9 @@
 #define helper_gvec_rsqrts_d helper_gvec_rsqrts_d_aarch64eb
 #define helper_gvec_rsqrts_h helper_gvec_rsqrts_h_aarch64eb
 #define helper_gvec_rsqrts_s helper_gvec_rsqrts_s_aarch64eb
+#define helper_msr_i_daifclear helper_msr_i_daifclear_aarch64eb
+#define helper_msr_i_daifset helper_msr_i_daifset_aarch64eb
+#define helper_msr_i_spsel helper_msr_i_spsel_aarch64eb
 #define helper_neon_addlp_s16 helper_neon_addlp_s16_aarch64eb
 #define helper_neon_addlp_s8 helper_neon_addlp_s8_aarch64eb
 #define helper_neon_addlp_u16 helper_neon_addlp_u16_aarch64eb

qemu/arm.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_arm
 #define helper_msa_st_w helper_msa_st_w_arm
 #define helper_msr_banked helper_msr_banked_arm
-#define helper_msr_i_pstate helper_msr_i_pstate_arm
 #define helper_neon_abd_f32 helper_neon_abd_f32_arm
 #define helper_neon_abd_s16 helper_neon_abd_s16_arm
 #define helper_neon_abd_s32 helper_neon_abd_s32_arm

qemu/armeb.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_armeb
 #define helper_msa_st_w helper_msa_st_w_armeb
 #define helper_msr_banked helper_msr_banked_armeb
-#define helper_msr_i_pstate helper_msr_i_pstate_armeb
 #define helper_neon_abd_f32 helper_neon_abd_f32_armeb
 #define helper_neon_abd_s16 helper_neon_abd_s16_armeb
 #define helper_neon_abd_s32 helper_neon_abd_s32_armeb

qemu/header_gen.py

@@ -1438,7 +1438,6 @@ symbols = (
     'helper_msa_st_h',
     'helper_msa_st_w',
     'helper_msr_banked',
-    'helper_msr_i_pstate',
     'helper_neon_abd_f32',
     'helper_neon_abd_s16',
     'helper_neon_abd_s32',
@@ -3466,6 +3465,9 @@ aarch64_symbols = (
     'helper_gvec_rsqrts_d',
     'helper_gvec_rsqrts_h',
     'helper_gvec_rsqrts_s',
+    'helper_msr_i_daifclear',
+    'helper_msr_i_daifset',
+    'helper_msr_i_spsel',
     'helper_neon_addlp_s16',
     'helper_neon_addlp_s8',
     'helper_neon_addlp_u16',

qemu/m68k.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_m68k
 #define helper_msa_st_w helper_msa_st_w_m68k
 #define helper_msr_banked helper_msr_banked_m68k
-#define helper_msr_i_pstate helper_msr_i_pstate_m68k
 #define helper_neon_abd_f32 helper_neon_abd_f32_m68k
 #define helper_neon_abd_s16 helper_neon_abd_s16_m68k
 #define helper_neon_abd_s32 helper_neon_abd_s32_m68k

qemu/mips.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_mips
 #define helper_msa_st_w helper_msa_st_w_mips
 #define helper_msr_banked helper_msr_banked_mips
-#define helper_msr_i_pstate helper_msr_i_pstate_mips
 #define helper_neon_abd_f32 helper_neon_abd_f32_mips
 #define helper_neon_abd_s16 helper_neon_abd_s16_mips
 #define helper_neon_abd_s32 helper_neon_abd_s32_mips

qemu/mips64.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_mips64
 #define helper_msa_st_w helper_msa_st_w_mips64
 #define helper_msr_banked helper_msr_banked_mips64
-#define helper_msr_i_pstate helper_msr_i_pstate_mips64
 #define helper_neon_abd_f32 helper_neon_abd_f32_mips64
 #define helper_neon_abd_s16 helper_neon_abd_s16_mips64
 #define helper_neon_abd_s32 helper_neon_abd_s32_mips64

qemu/mips64el.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_mips64el
 #define helper_msa_st_w helper_msa_st_w_mips64el
 #define helper_msr_banked helper_msr_banked_mips64el
-#define helper_msr_i_pstate helper_msr_i_pstate_mips64el
 #define helper_neon_abd_f32 helper_neon_abd_f32_mips64el
 #define helper_neon_abd_s16 helper_neon_abd_s16_mips64el
 #define helper_neon_abd_s32 helper_neon_abd_s32_mips64el

qemu/mipsel.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_mipsel
 #define helper_msa_st_w helper_msa_st_w_mipsel
 #define helper_msr_banked helper_msr_banked_mipsel
-#define helper_msr_i_pstate helper_msr_i_pstate_mipsel
 #define helper_neon_abd_f32 helper_neon_abd_f32_mipsel
 #define helper_neon_abd_s16 helper_neon_abd_s16_mipsel
 #define helper_neon_abd_s32 helper_neon_abd_s32_mipsel

qemu/powerpc.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_powerpc
 #define helper_msa_st_w helper_msa_st_w_powerpc
 #define helper_msr_banked helper_msr_banked_powerpc
-#define helper_msr_i_pstate helper_msr_i_pstate_powerpc
 #define helper_neon_abd_f32 helper_neon_abd_f32_powerpc
 #define helper_neon_abd_s16 helper_neon_abd_s16_powerpc
 #define helper_neon_abd_s32 helper_neon_abd_s32_powerpc

qemu/sparc.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_sparc
 #define helper_msa_st_w helper_msa_st_w_sparc
 #define helper_msr_banked helper_msr_banked_sparc
-#define helper_msr_i_pstate helper_msr_i_pstate_sparc
 #define helper_neon_abd_f32 helper_neon_abd_f32_sparc
 #define helper_neon_abd_s16 helper_neon_abd_s16_sparc
 #define helper_neon_abd_s32 helper_neon_abd_s32_sparc

qemu/sparc64.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_sparc64
 #define helper_msa_st_w helper_msa_st_w_sparc64
 #define helper_msr_banked helper_msr_banked_sparc64
-#define helper_msr_i_pstate helper_msr_i_pstate_sparc64
 #define helper_neon_abd_f32 helper_neon_abd_f32_sparc64
 #define helper_neon_abd_s16 helper_neon_abd_s16_sparc64
 #define helper_neon_abd_s32 helper_neon_abd_s32_sparc64

qemu/target/arm/helper-a64.c

@@ -59,6 +59,36 @@ uint64_t HELPER(rbit64)(uint64_t x)
     return revbit64(x);
 }
 
+void HELPER(msr_i_spsel)(CPUARMState *env, uint32_t imm)
+{
+    update_spsel(env, imm);
+}
+
+static void daif_check(CPUARMState *env, uint32_t op,
+                       uint32_t imm, uintptr_t ra)
+{
+    /* DAIF update to PSTATE. This is OK from EL0 only if UMA is set.  */
+    if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
+        raise_exception_ra(env, EXCP_UDEF,
+                           syn_aa64_sysregtrap(0, extract32(op, 0, 3),
+                                               extract32(op, 3, 3), 4,
+                                               imm, 0x1f, 0),
+                           exception_target_el(env), ra);
+    }
+}
+
+void HELPER(msr_i_daifset)(CPUARMState *env, uint32_t imm)
+{
+    daif_check(env, 0x1e, imm, GETPC());
+    env->daif |= (imm << 6) & PSTATE_DAIF;
+}
+
+void HELPER(msr_i_daifclear)(CPUARMState *env, uint32_t imm)
+{
+    daif_check(env, 0x1f, imm, GETPC());
+    env->daif &= ~((imm << 6) & PSTATE_DAIF);
+}
+
 /* Convert a softfloat float_relation_ (as returned by
  * the float*_compare functions) to the correct ARM
  * NZCV flag state.

qemu/target/arm/helper-a64.h

@@ -19,6 +19,9 @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_2(msr_i_spsel, void, env, i32)
+DEF_HELPER_2(msr_i_daifset, void, env, i32)
+DEF_HELPER_2(msr_i_daifclear, void, env, i32)
 DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)

qemu/target/arm/helper.h

@@ -79,7 +79,6 @@ DEF_HELPER_2(get_cp_reg, i32, env, ptr)
 DEF_HELPER_3(set_cp_reg64, void, env, ptr, i64)
 DEF_HELPER_2(get_cp_reg64, i64, env, ptr)
 
-DEF_HELPER_3(msr_i_pstate, void, env, i32, i32)
 DEF_HELPER_1(clear_pstate_ss, void, env)
 
 DEF_HELPER_2(get_r13_banked, i32, env, i32)

qemu/target/arm/internals.h

@@ -970,4 +970,19 @@ ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va,
 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                    ARMMMUIdx mmu_idx, bool data);
 
+static inline int exception_target_el(CPUARMState *env)
+{
+    int target_el = MAX(1, arm_current_el(env));
+
+    /*
+     * No such thing as secure EL1 if EL3 is aarch32,
+     * so update the target EL to EL3 in this case.
+     */
+    if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
+        target_el = 3;
+    }
+
+    return target_el;
+}
+
 #endif

qemu/target/arm/op_helper.c

@@ -67,20 +67,6 @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-static int exception_target_el(CPUARMState *env)
-{
-    int target_el = MAX(1, arm_current_el(env));
-
-    /* No such thing as secure EL1 if EL3 is aarch32, so update the target EL
-     * to EL3 in this case.
-     */
-    if (arm_is_secure(env) && !arm_el_is_aa64(env, 3) && target_el == 1) {
-        target_el = 3;
-    }
-
-    return target_el;
-}
-
 uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
                           uint32_t maxindex)
 {
@@ -855,34 +841,6 @@ uint64_t HELPER(get_cp_reg64)(CPUARMState *env, void *rip)
     return ri->readfn(env, ri);
 }
 
-void HELPER(msr_i_pstate)(CPUARMState *env, uint32_t op, uint32_t imm)
-{
-    /* MSR_i to update PSTATE. This is OK from EL0 only if UMA is set.
-     * Note that SPSel is never OK from EL0; we rely on handle_msr_i()
-     * to catch that case at translate time.
-     */
-    if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
-        uint32_t syndrome = syn_aa64_sysregtrap(0, extract32(op, 0, 3),
-                                                extract32(op, 3, 3), 4,
-                                                imm, 0x1f, 0);
-        raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));
-    }
-
-    switch (op) {
-    case 0x05: /* SPSel */
-        update_spsel(env, imm);
-        break;
-    case 0x1e: /* DAIFSet */
-        env->daif |= (imm << 6) & PSTATE_DAIF;
-        break;
-    case 0x1f: /* DAIFClear */
-        env->daif &= ~((imm << 6) & PSTATE_DAIF);
-        break;
-    default:
-        g_assert_not_reached();
-    }
-}
-
 void HELPER(clear_pstate_ss)(CPUARMState *env)
 {
     env->pstate &= ~PSTATE_SS;

qemu/target/arm/translate-a64.c

@@ -1738,29 +1738,38 @@ static void handle_msr_i(DisasContext *s, uint32_t insn,
                          unsigned int op1, unsigned int op2, unsigned int crm)
 {
     TCGContext *tcg_ctx = s->uc->tcg_ctx;
+    TCGv_i32 t1;
     int op = op1 << 3 | op2;
+
+    /* End the TB by default, chaining is ok.  */
+    s->base.is_jmp = DISAS_TOO_MANY;
+
     switch (op) {
     case 0x05: /* SPSel */
         if (s->current_el == 0) {
-            unallocated_encoding(s);
+            goto do_unallocated;
-            return;
         }
-        /* fall through */
+        t1 = tcg_const_i32(tcg_ctx, crm & PSTATE_SP);
-    case 0x1e: /* DAIFSet */
+        gen_helper_msr_i_spsel(tcg_ctx, tcg_ctx->cpu_env, t1);
-    case 0x1f: /* DAIFClear */
+        tcg_temp_free_i32(tcg_ctx, t1);
-    {
-        TCGv_i32 tcg_imm = tcg_const_i32(tcg_ctx, crm);
-        TCGv_i32 tcg_op = tcg_const_i32(tcg_ctx, op);
-        gen_a64_set_pc_im(s, s->pc - 4);
-        gen_helper_msr_i_pstate(tcg_ctx, tcg_ctx->cpu_env, tcg_op, tcg_imm);
-        tcg_temp_free_i32(tcg_ctx, tcg_imm);
-        tcg_temp_free_i32(tcg_ctx, tcg_op);
-        /* For DAIFClear, exit the cpu loop to re-evaluate pending IRQs.  */
-        gen_a64_set_pc_im(s, s->pc);
-        s->base.is_jmp = (op == 0x1f ? DISAS_EXIT : DISAS_JUMP);
         break;
-    }
+
+    case 0x1e: /* DAIFSet */
+        t1 = tcg_const_i32(tcg_ctx, crm);
+        gen_helper_msr_i_daifset(tcg_ctx, tcg_ctx->cpu_env, t1);
+        tcg_temp_free_i32(tcg_ctx, t1);
+        break;
+
+    case 0x1f: /* DAIFClear */
+        t1 = tcg_const_i32(tcg_ctx, crm);
+        gen_helper_msr_i_daifclear(tcg_ctx, tcg_ctx->cpu_env, t1);
+        tcg_temp_free_i32(tcg_ctx, t1);
+        /* For DAIFClear, exit the cpu loop to re-evaluate pending IRQs.  */
+        s->base.is_jmp = DISAS_UPDATE;
+        break;
+
     default:
+    do_unallocated:
         unallocated_encoding(s);
         return;
     }

qemu/x86_64.h

@@ -1432,7 +1432,6 @@
 #define helper_msa_st_h helper_msa_st_h_x86_64
 #define helper_msa_st_w helper_msa_st_w_x86_64
 #define helper_msr_banked helper_msr_banked_x86_64
-#define helper_msr_i_pstate helper_msr_i_pstate_x86_64
 #define helper_neon_abd_f32 helper_neon_abd_f32_x86_64
 #define helper_neon_abd_s16 helper_neon_abd_s16_x86_64
 #define helper_neon_abd_s32 helper_neon_abd_s32_x86_64