?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
target/arm: Fix ATS1Hx instructions
[qemu.git] / target / arm / helper.c
blob96301930cc81b39fe6baf5aaf337f39812757ae9
1 #include "qemu/osdep.h"
2 #include "target/arm/idau.h"
3 #include "trace.h"
4 #include "cpu.h"
5 #include "internals.h"
6 #include "exec/gdbstub.h"
7 #include "exec/helper-proto.h"
8 #include "qemu/host-utils.h"
9 #include "sysemu/arch_init.h"
10 #include "sysemu/sysemu.h"
11 #include "qemu/bitops.h"
12 #include "qemu/crc32c.h"
13 #include "exec/exec-all.h"
14 #include "exec/cpu_ldst.h"
15 #include "arm_ldst.h"
16 #include <zlib.h> /* For crc32 */
17 #include "exec/semihost.h"
18 #include "sysemu/kvm.h"
19 #include "fpu/softfloat.h"
20 #include "qemu/range.h"
21
22 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
23
24 #ifndef CONFIG_USER_ONLY
25 /* Cacheability and shareability attributes for a memory access */
26 typedef struct ARMCacheAttrs {
27 unsigned int attrs:8; /* as in the MAIR register encoding */
28 unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */
29 } ARMCacheAttrs;
30
31 static bool get_phys_addr(CPUARMState *env, target_ulong address,
32 MMUAccessType access_type, ARMMMUIdx mmu_idx,
33 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
34 target_ulong *page_size,
35 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
36
37 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
38 MMUAccessType access_type, ARMMMUIdx mmu_idx,
39 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
40 target_ulong *page_size_ptr,
41 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
42
43 /* Security attributes for an address, as returned by v8m_security_lookup. */
44 typedef struct V8M_SAttributes {
45 bool subpage; /* true if these attrs don't cover the whole TARGET_PAGE */
46 bool ns;
47 bool nsc;
48 uint8_t sregion;
49 bool srvalid;
50 uint8_t iregion;
51 bool irvalid;
52 } V8M_SAttributes;
53
54 static void v8m_security_lookup(CPUARMState *env, uint32_t address,
55 MMUAccessType access_type, ARMMMUIdx mmu_idx,
56 V8M_SAttributes *sattrs);
57 #endif
58
59 static void switch_mode(CPUARMState *env, int mode);
60
61 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
62 {
63 int nregs;
64
65 /* VFP data registers are always little-endian. */
66 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
67 if (reg < nregs) {
68 stq_le_p(buf, *aa32_vfp_dreg(env, reg));
69 return 8;
70 }
71 if (arm_feature(env, ARM_FEATURE_NEON)) {
72 /* Aliases for Q regs. */
73 nregs += 16;
74 if (reg < nregs) {
75 uint64_t *q = aa32_vfp_qreg(env, reg - 32);
76 stq_le_p(buf, q[0]);
77 stq_le_p(buf + 8, q[1]);
78 return 16;
79 }
80 }
81 switch (reg - nregs) {
82 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
83 case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
84 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
85 }
86 return 0;
87 }
88
89 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
90 {
91 int nregs;
92
93 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
94 if (reg < nregs) {
95 *aa32_vfp_dreg(env, reg) = ldq_le_p(buf);
96 return 8;
97 }
98 if (arm_feature(env, ARM_FEATURE_NEON)) {
99 nregs += 16;
100 if (reg < nregs) {
101 uint64_t *q = aa32_vfp_qreg(env, reg - 32);
102 q[0] = ldq_le_p(buf);
103 q[1] = ldq_le_p(buf + 8);
104 return 16;
105 }
106 }
107 switch (reg - nregs) {
108 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
109 case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
110 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
111 }
112 return 0;
113 }
114
115 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
116 {
117 switch (reg) {
118 case 0 ... 31:
119 /* 128 bit FP register */
120 {
121 uint64_t *q = aa64_vfp_qreg(env, reg);
122 stq_le_p(buf, q[0]);
123 stq_le_p(buf + 8, q[1]);
124 return 16;
125 }
126 case 32:
127 /* FPSR */
128 stl_p(buf, vfp_get_fpsr(env));
129 return 4;
130 case 33:
131 /* FPCR */
132 stl_p(buf, vfp_get_fpcr(env));
133 return 4;
134 default:
135 return 0;
136 }
137 }
138
139 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
140 {
141 switch (reg) {
142 case 0 ... 31:
143 /* 128 bit FP register */
144 {
145 uint64_t *q = aa64_vfp_qreg(env, reg);
146 q[0] = ldq_le_p(buf);
147 q[1] = ldq_le_p(buf + 8);
148 return 16;
149 }
150 case 32:
151 /* FPSR */
152 vfp_set_fpsr(env, ldl_p(buf));
153 return 4;
154 case 33:
155 /* FPCR */
156 vfp_set_fpcr(env, ldl_p(buf));
157 return 4;
158 default:
159 return 0;
160 }
161 }
162
163 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
164 {
165 assert(ri->fieldoffset);
166 if (cpreg_field_is_64bit(ri)) {
167 return CPREG_FIELD64(env, ri);
168 } else {
169 return CPREG_FIELD32(env, ri);
170 }
171 }
172
173 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
174 uint64_t value)
175 {
176 assert(ri->fieldoffset);
177 if (cpreg_field_is_64bit(ri)) {
178 CPREG_FIELD64(env, ri) = value;
179 } else {
180 CPREG_FIELD32(env, ri) = value;
181 }
182 }
183
184 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri)
185 {
186 return (char *)env + ri->fieldoffset;
187 }
188
189 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
190 {
191 /* Raw read of a coprocessor register (as needed for migration, etc). */
192 if (ri->type & ARM_CP_CONST) {
193 return ri->resetvalue;
194 } else if (ri->raw_readfn) {
195 return ri->raw_readfn(env, ri);
196 } else if (ri->readfn) {
197 return ri->readfn(env, ri);
198 } else {
199 return raw_read(env, ri);
200 }
201 }
202
203 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
204 uint64_t v)
205 {
206 /* Raw write of a coprocessor register (as needed for migration, etc).
207 * Note that constant registers are treated as write-ignored; the
208 * caller should check for success by whether a readback gives the
209 * value written.
210 */
211 if (ri->type & ARM_CP_CONST) {
212 return;
213 } else if (ri->raw_writefn) {
214 ri->raw_writefn(env, ri, v);
215 } else if (ri->writefn) {
216 ri->writefn(env, ri, v);
217 } else {
218 raw_write(env, ri, v);
219 }
220 }
221
222 static int arm_gdb_get_sysreg(CPUARMState *env, uint8_t *buf, int reg)
223 {
224 ARMCPU *cpu = arm_env_get_cpu(env);
225 const ARMCPRegInfo *ri;
226 uint32_t key;
227
228 key = cpu->dyn_xml.cpregs_keys[reg];
229 ri = get_arm_cp_reginfo(cpu->cp_regs, key);
230 if (ri) {
231 if (cpreg_field_is_64bit(ri)) {
232 return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri));
233 } else {
234 return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri));
235 }
236 }
237 return 0;
238 }
239
240 static int arm_gdb_set_sysreg(CPUARMState *env, uint8_t *buf, int reg)
241 {
242 return 0;
243 }
244
245 static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
246 {
247 /* Return true if the regdef would cause an assertion if you called
248 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
249 * program bug for it not to have the NO_RAW flag).
250 * NB that returning false here doesn't necessarily mean that calling
251 * read/write_raw_cp_reg() is safe, because we can't distinguish "has
252 * read/write access functions which are safe for raw use" from "has
253 * read/write access functions which have side effects but has forgotten
254 * to provide raw access functions".
255 * The tests here line up with the conditions in read/write_raw_cp_reg()
256 * and assertions in raw_read()/raw_write().
257 */
258 if ((ri->type & ARM_CP_CONST) ||
259 ri->fieldoffset ||
260 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) {
261 return false;
262 }
263 return true;
264 }
265
266 bool write_cpustate_to_list(ARMCPU *cpu)
267 {
268 /* Write the coprocessor state from cpu->env to the (index,value) list. */
269 int i;
270 bool ok = true;
271
272 for (i = 0; i < cpu->cpreg_array_len; i++) {
273 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
274 const ARMCPRegInfo *ri;
275
276 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
277 if (!ri) {
278 ok = false;
279 continue;
280 }
281 if (ri->type & ARM_CP_NO_RAW) {
282 continue;
283 }
284 cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
285 }
286 return ok;
287 }
288
289 bool write_list_to_cpustate(ARMCPU *cpu)
290 {
291 int i;
292 bool ok = true;
293
294 for (i = 0; i < cpu->cpreg_array_len; i++) {
295 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
296 uint64_t v = cpu->cpreg_values[i];
297 const ARMCPRegInfo *ri;
298
299 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
300 if (!ri) {
301 ok = false;
302 continue;
303 }
304 if (ri->type & ARM_CP_NO_RAW) {
305 continue;
306 }
307 /* Write value and confirm it reads back as written
308 * (to catch read-only registers and partially read-only
309 * registers where the incoming migration value doesn't match)
310 */
311 write_raw_cp_reg(&cpu->env, ri, v);
312 if (read_raw_cp_reg(&cpu->env, ri) != v) {
313 ok = false;
314 }
315 }
316 return ok;
317 }
318
319 static void add_cpreg_to_list(gpointer key, gpointer opaque)
320 {
321 ARMCPU *cpu = opaque;
322 uint64_t regidx;
323 const ARMCPRegInfo *ri;
324
325 regidx = *(uint32_t *)key;
326 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
327
328 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
329 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
330 /* The value array need not be initialized at this point */
331 cpu->cpreg_array_len++;
332 }
333 }
334
335 static void count_cpreg(gpointer key, gpointer opaque)
336 {
337 ARMCPU *cpu = opaque;
338 uint64_t regidx;
339 const ARMCPRegInfo *ri;
340
341 regidx = *(uint32_t *)key;
342 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
343
344 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
345 cpu->cpreg_array_len++;
346 }
347 }
348
349 static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
350 {
351 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
352 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
353
354 if (aidx > bidx) {
355 return 1;
356 }
357 if (aidx < bidx) {
358 return -1;
359 }
360 return 0;
361 }
362
363 void init_cpreg_list(ARMCPU *cpu)
364 {
365 /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
366 * Note that we require cpreg_tuples[] to be sorted by key ID.
367 */
368 GList *keys;
369 int arraylen;
370
371 keys = g_hash_table_get_keys(cpu->cp_regs);
372 keys = g_list_sort(keys, cpreg_key_compare);
373
374 cpu->cpreg_array_len = 0;
375
376 g_list_foreach(keys, count_cpreg, cpu);
377
378 arraylen = cpu->cpreg_array_len;
379 cpu->cpreg_indexes = g_new(uint64_t, arraylen);
380 cpu->cpreg_values = g_new(uint64_t, arraylen);
381 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
382 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
383 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
384 cpu->cpreg_array_len = 0;
385
386 g_list_foreach(keys, add_cpreg_to_list, cpu);
387
388 assert(cpu->cpreg_array_len == arraylen);
389
390 g_list_free(keys);
391 }
392
393 /*
394 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but
395 * they are accessible when EL3 is using AArch64 regardless of EL3.NS.
396 *
397 * access_el3_aa32ns: Used to check AArch32 register views.
398 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views.
399 */
400 static CPAccessResult access_el3_aa32ns(CPUARMState *env,
401 const ARMCPRegInfo *ri,
402 bool isread)
403 {
404 bool secure = arm_is_secure_below_el3(env);
405
406 assert(!arm_el_is_aa64(env, 3));
407 if (secure) {
408 return CP_ACCESS_TRAP_UNCATEGORIZED;
409 }
410 return CP_ACCESS_OK;
411 }
412
413 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env,
414 const ARMCPRegInfo *ri,
415 bool isread)
416 {
417 if (!arm_el_is_aa64(env, 3)) {
418 return access_el3_aa32ns(env, ri, isread);
419 }
420 return CP_ACCESS_OK;
421 }
422
423 /* Some secure-only AArch32 registers trap to EL3 if used from
424 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts).
425 * Note that an access from Secure EL1 can only happen if EL3 is AArch64.
426 * We assume that the .access field is set to PL1_RW.
427 */
428 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
429 const ARMCPRegInfo *ri,
430 bool isread)
431 {
432 if (arm_current_el(env) == 3) {
433 return CP_ACCESS_OK;
434 }
435 if (arm_is_secure_below_el3(env)) {
436 return CP_ACCESS_TRAP_EL3;
437 }
438 /* This will be EL1 NS and EL2 NS, which just UNDEF */
439 return CP_ACCESS_TRAP_UNCATEGORIZED;
440 }
441
442 /* Check for traps to "powerdown debug" registers, which are controlled
443 * by MDCR.TDOSA
444 */
445 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
446 bool isread)
447 {
448 int el = arm_current_el(env);
449 bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) ||
450 (env->cp15.mdcr_el2 & MDCR_TDE) ||
451 (env->cp15.hcr_el2 & HCR_TGE);
452
453 if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) {
454 return CP_ACCESS_TRAP_EL2;
455 }
456 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
457 return CP_ACCESS_TRAP_EL3;
458 }
459 return CP_ACCESS_OK;
460 }
461
462 /* Check for traps to "debug ROM" registers, which are controlled
463 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
464 */
465 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
466 bool isread)
467 {
468 int el = arm_current_el(env);
469 bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) ||
470 (env->cp15.mdcr_el2 & MDCR_TDE) ||
471 (env->cp15.hcr_el2 & HCR_TGE);
472
473 if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) {
474 return CP_ACCESS_TRAP_EL2;
475 }
476 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
477 return CP_ACCESS_TRAP_EL3;
478 }
479 return CP_ACCESS_OK;
480 }
481
482 /* Check for traps to general debug registers, which are controlled
483 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
484 */
485 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
486 bool isread)
487 {
488 int el = arm_current_el(env);
489 bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) ||
490 (env->cp15.mdcr_el2 & MDCR_TDE) ||
491 (env->cp15.hcr_el2 & HCR_TGE);
492
493 if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) {
494 return CP_ACCESS_TRAP_EL2;
495 }
496 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
497 return CP_ACCESS_TRAP_EL3;
498 }
499 return CP_ACCESS_OK;
500 }
501
502 /* Check for traps to performance monitor registers, which are controlled
503 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
504 */
505 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri,
506 bool isread)
507 {
508 int el = arm_current_el(env);
509
510 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
511 && !arm_is_secure_below_el3(env)) {
512 return CP_ACCESS_TRAP_EL2;
513 }
514 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
515 return CP_ACCESS_TRAP_EL3;
516 }
517 return CP_ACCESS_OK;
518 }
519
520 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
521 {
522 ARMCPU *cpu = arm_env_get_cpu(env);
523
524 raw_write(env, ri, value);
525 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */
526 }
527
528 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
529 {
530 ARMCPU *cpu = arm_env_get_cpu(env);
531
532 if (raw_read(env, ri) != value) {
533 /* Unlike real hardware the qemu TLB uses virtual addresses,
534 * not modified virtual addresses, so this causes a TLB flush.
535 */
536 tlb_flush(CPU(cpu));
537 raw_write(env, ri, value);
538 }
539 }
540
541 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
542 uint64_t value)
543 {
544 ARMCPU *cpu = arm_env_get_cpu(env);
545
546 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA)
547 && !extended_addresses_enabled(env)) {
548 /* For VMSA (when not using the LPAE long descriptor page table
549 * format) this register includes the ASID, so do a TLB flush.
550 * For PMSA it is purely a process ID and no action is needed.
551 */
552 tlb_flush(CPU(cpu));
553 }
554 raw_write(env, ri, value);
555 }
556
557 /* IS variants of TLB operations must affect all cores */
558 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
559 uint64_t value)
560 {
561 CPUState *cs = ENV_GET_CPU(env);
562
563 tlb_flush_all_cpus_synced(cs);
564 }
565
566 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
567 uint64_t value)
568 {
569 CPUState *cs = ENV_GET_CPU(env);
570
571 tlb_flush_all_cpus_synced(cs);
572 }
573
574 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
575 uint64_t value)
576 {
577 CPUState *cs = ENV_GET_CPU(env);
578
579 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK);
580 }
581
582 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
583 uint64_t value)
584 {
585 CPUState *cs = ENV_GET_CPU(env);
586
587 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK);
588 }
589
590 /*
591 * Non-IS variants of TLB operations are upgraded to
592 * IS versions if we are at NS EL1 and HCR_EL2.FB is set to
593 * force broadcast of these operations.
594 */
595 static bool tlb_force_broadcast(CPUARMState *env)
596 {
597 return (env->cp15.hcr_el2 & HCR_FB) &&
598 arm_current_el(env) == 1 && arm_is_secure_below_el3(env);
599 }
600
601 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,
602 uint64_t value)
603 {
604 /* Invalidate all (TLBIALL) */
605 ARMCPU *cpu = arm_env_get_cpu(env);
606
607 if (tlb_force_broadcast(env)) {
608 tlbiall_is_write(env, NULL, value);
609 return;
610 }
611
612 tlb_flush(CPU(cpu));
613 }
614
615 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,
616 uint64_t value)
617 {
618 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
619 ARMCPU *cpu = arm_env_get_cpu(env);
620
621 if (tlb_force_broadcast(env)) {
622 tlbimva_is_write(env, NULL, value);
623 return;
624 }
625
626 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
627 }
628
629 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,
630 uint64_t value)
631 {
632 /* Invalidate by ASID (TLBIASID) */
633 ARMCPU *cpu = arm_env_get_cpu(env);
634
635 if (tlb_force_broadcast(env)) {
636 tlbiasid_is_write(env, NULL, value);
637 return;
638 }
639
640 tlb_flush(CPU(cpu));
641 }
642
643 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
644 uint64_t value)
645 {
646 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
647 ARMCPU *cpu = arm_env_get_cpu(env);
648
649 if (tlb_force_broadcast(env)) {
650 tlbimvaa_is_write(env, NULL, value);
651 return;
652 }
653
654 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
655 }
656
657 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,
658 uint64_t value)
659 {
660 CPUState *cs = ENV_GET_CPU(env);
661
662 tlb_flush_by_mmuidx(cs,
663 ARMMMUIdxBit_S12NSE1 |
664 ARMMMUIdxBit_S12NSE0 |
665 ARMMMUIdxBit_S2NS);
666 }
667
668 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
669 uint64_t value)
670 {
671 CPUState *cs = ENV_GET_CPU(env);
672
673 tlb_flush_by_mmuidx_all_cpus_synced(cs,
674 ARMMMUIdxBit_S12NSE1 |
675 ARMMMUIdxBit_S12NSE0 |
676 ARMMMUIdxBit_S2NS);
677 }
678
679 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
680 uint64_t value)
681 {
682 /* Invalidate by IPA. This has to invalidate any structures that
683 * contain only stage 2 translation information, but does not need
684 * to apply to structures that contain combined stage 1 and stage 2
685 * translation information.
686 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
687 */
688 CPUState *cs = ENV_GET_CPU(env);
689 uint64_t pageaddr;
690
691 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
692 return;
693 }
694
695 pageaddr = sextract64(value << 12, 0, 40);
696
697 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
698 }
699
700 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
701 uint64_t value)
702 {
703 CPUState *cs = ENV_GET_CPU(env);
704 uint64_t pageaddr;
705
706 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
707 return;
708 }
709
710 pageaddr = sextract64(value << 12, 0, 40);
711
712 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
713 ARMMMUIdxBit_S2NS);
714 }
715
716 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
717 uint64_t value)
718 {
719 CPUState *cs = ENV_GET_CPU(env);
720
721 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
722 }
723
724 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
725 uint64_t value)
726 {
727 CPUState *cs = ENV_GET_CPU(env);
728
729 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
730 }
731
732 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
733 uint64_t value)
734 {
735 CPUState *cs = ENV_GET_CPU(env);
736 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
737
738 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
739 }
740
741 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
742 uint64_t value)
743 {
744 CPUState *cs = ENV_GET_CPU(env);
745 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
746
747 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
748 ARMMMUIdxBit_S1E2);
749 }
750
751 static const ARMCPRegInfo cp_reginfo[] = {
752 /* Define the secure and non-secure FCSE identifier CP registers
753 * separately because there is no secure bank in V8 (no _EL3). This allows
754 * the secure register to be properly reset and migrated. There is also no
755 * v8 EL1 version of the register so the non-secure instance stands alone.
756 */
757 { .name = "FCSEIDR",
758 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
759 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
760 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns),
761 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
762 { .name = "FCSEIDR_S",
763 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
764 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
765 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s),
766 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
767 /* Define the secure and non-secure context identifier CP registers
768 * separately because there is no secure bank in V8 (no _EL3). This allows
769 * the secure register to be properly reset and migrated. In the
770 * non-secure case, the 32-bit register will have reset and migration
771 * disabled during registration as it is handled by the 64-bit instance.
772 */
773 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH,
774 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
775 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
776 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]),
777 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
778 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32,
779 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
780 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
781 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s),
782 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
783 REGINFO_SENTINEL
784 };
785
786 static const ARMCPRegInfo not_v8_cp_reginfo[] = {
787 /* NB: Some of these registers exist in v8 but with more precise
788 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
789 */
790 /* MMU Domain access control / MPU write buffer control */
791 { .name = "DACR",
792 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY,
793 .access = PL1_RW, .resetvalue = 0,
794 .writefn = dacr_write, .raw_writefn = raw_write,
795 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
796 offsetoflow32(CPUARMState, cp15.dacr_ns) } },
797 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs.
798 * For v6 and v5, these mappings are overly broad.
799 */
800 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0,
801 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
802 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1,
803 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
804 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4,
805 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
806 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8,
807 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
808 /* Cache maintenance ops; some of this space may be overridden later. */
809 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
810 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
811 .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
812 REGINFO_SENTINEL
813 };
814
815 static const ARMCPRegInfo not_v6_cp_reginfo[] = {
816 /* Not all pre-v6 cores implemented this WFI, so this is slightly
817 * over-broad.
818 */
819 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
820 .access = PL1_W, .type = ARM_CP_WFI },
821 REGINFO_SENTINEL
822 };
823
824 static const ARMCPRegInfo not_v7_cp_reginfo[] = {
825 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
826 * is UNPREDICTABLE; we choose to NOP as most implementations do).
827 */
828 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
829 .access = PL1_W, .type = ARM_CP_WFI },
830 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice
831 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
832 * OMAPCP will override this space.
833 */
834 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
835 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
836 .resetvalue = 0 },
837 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
838 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
839 .resetvalue = 0 },
840 /* v6 doesn't have the cache ID registers but Linux reads them anyway */
841 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
842 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
843 .resetvalue = 0 },
844 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
845 * implementing it as RAZ means the "debug architecture version" bits
846 * will read as a reserved value, which should cause Linux to not try
847 * to use the debug hardware.
848 */
849 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
850 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
851 /* MMU TLB control. Note that the wildcarding means we cover not just
852 * the unified TLB ops but also the dside/iside/inner-shareable variants.
853 */
854 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
855 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
856 .type = ARM_CP_NO_RAW },
857 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
858 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
859 .type = ARM_CP_NO_RAW },
860 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
861 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
862 .type = ARM_CP_NO_RAW },
863 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
864 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
865 .type = ARM_CP_NO_RAW },
866 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2,
867 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP },
868 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2,
869 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP },
870 REGINFO_SENTINEL
871 };
872
873 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
874 uint64_t value)
875 {
876 uint32_t mask = 0;
877
878 /* In ARMv8 most bits of CPACR_EL1 are RES0. */
879 if (!arm_feature(env, ARM_FEATURE_V8)) {
880 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
881 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
882 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
883 */
884 if (arm_feature(env, ARM_FEATURE_VFP)) {
885 /* VFP coprocessor: cp10 & cp11 [23:20] */
886 mask |= (1 << 31) | (1 << 30) | (0xf << 20);
887
888 if (!arm_feature(env, ARM_FEATURE_NEON)) {
889 /* ASEDIS [31] bit is RAO/WI */
890 value |= (1 << 31);
891 }
892
893 /* VFPv3 and upwards with NEON implement 32 double precision
894 * registers (D0-D31).
895 */
896 if (!arm_feature(env, ARM_FEATURE_NEON) ||
897 !arm_feature(env, ARM_FEATURE_VFP3)) {
898 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
899 value |= (1 << 30);
900 }
901 }
902 value &= mask;
903 }
904 env->cp15.cpacr_el1 = value;
905 }
906
907 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
908 {
909 /* Call cpacr_write() so that we reset with the correct RAO bits set
910 * for our CPU features.
911 */
912 cpacr_write(env, ri, 0);
913 }
914
915 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
916 bool isread)
917 {
918 if (arm_feature(env, ARM_FEATURE_V8)) {
919 /* Check if CPACR accesses are to be trapped to EL2 */
920 if (arm_current_el(env) == 1 &&
921 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) {
922 return CP_ACCESS_TRAP_EL2;
923 /* Check if CPACR accesses are to be trapped to EL3 */
924 } else if (arm_current_el(env) < 3 &&
925 (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
926 return CP_ACCESS_TRAP_EL3;
927 }
928 }
929
930 return CP_ACCESS_OK;
931 }
932
933 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri,
934 bool isread)
935 {
936 /* Check if CPTR accesses are set to trap to EL3 */
937 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
938 return CP_ACCESS_TRAP_EL3;
939 }
940
941 return CP_ACCESS_OK;
942 }
943
944 static const ARMCPRegInfo v6_cp_reginfo[] = {
945 /* prefetch by MVA in v6, NOP in v7 */
946 { .name = "MVA_prefetch",
947 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
948 .access = PL1_W, .type = ARM_CP_NOP },
949 /* We need to break the TB after ISB to execute self-modifying code
950 * correctly and also to take any pending interrupts immediately.
951 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag.
952 */
953 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
954 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore },
955 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
956 .access = PL0_W, .type = ARM_CP_NOP },
957 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
958 .access = PL0_W, .type = ARM_CP_NOP },
959 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
960 .access = PL1_RW,
961 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s),
962 offsetof(CPUARMState, cp15.ifar_ns) },
963 .resetvalue = 0, },
964 /* Watchpoint Fault Address Register : should actually only be present
965 * for 1136, 1176, 11MPCore.
966 */
967 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
968 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
969 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
970 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
971 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
972 .resetfn = cpacr_reset, .writefn = cpacr_write },
973 REGINFO_SENTINEL
974 };
975
976 /* Definitions for the PMU registers */
977 #define PMCRN_MASK 0xf800
978 #define PMCRN_SHIFT 11
979 #define PMCRD 0x8
980 #define PMCRC 0x4
981 #define PMCRE 0x1
982
983 static inline uint32_t pmu_num_counters(CPUARMState *env)
984 {
985 return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
986 }
987
988 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
989 static inline uint64_t pmu_counter_mask(CPUARMState *env)
990 {
991 return (1 << 31) | ((1 << pmu_num_counters(env)) - 1);
992 }
993
994 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
995 bool isread)
996 {
997 /* Performance monitor registers user accessibility is controlled
998 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable
999 * trapping to EL2 or EL3 for other accesses.
1000 */
1001 int el = arm_current_el(env);
1002
1003 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) {
1004 return CP_ACCESS_TRAP;
1005 }
1006 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
1007 && !arm_is_secure_below_el3(env)) {
1008 return CP_ACCESS_TRAP_EL2;
1009 }
1010 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
1011 return CP_ACCESS_TRAP_EL3;
1012 }
1013
1014 return CP_ACCESS_OK;
1015 }
1016
1017 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env,
1018 const ARMCPRegInfo *ri,
1019 bool isread)
1020 {
1021 /* ER: event counter read trap control */
1022 if (arm_feature(env, ARM_FEATURE_V8)
1023 && arm_current_el(env) == 0
1024 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0
1025 && isread) {
1026 return CP_ACCESS_OK;
1027 }
1028
1029 return pmreg_access(env, ri, isread);
1030 }
1031
1032 static CPAccessResult pmreg_access_swinc(CPUARMState *env,
1033 const ARMCPRegInfo *ri,
1034 bool isread)
1035 {
1036 /* SW: software increment write trap control */
1037 if (arm_feature(env, ARM_FEATURE_V8)
1038 && arm_current_el(env) == 0
1039 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0
1040 && !isread) {
1041 return CP_ACCESS_OK;
1042 }
1043
1044 return pmreg_access(env, ri, isread);
1045 }
1046
1047 #ifndef CONFIG_USER_ONLY
1048
1049 static CPAccessResult pmreg_access_selr(CPUARMState *env,
1050 const ARMCPRegInfo *ri,
1051 bool isread)
1052 {
1053 /* ER: event counter read trap control */
1054 if (arm_feature(env, ARM_FEATURE_V8)
1055 && arm_current_el(env) == 0
1056 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) {
1057 return CP_ACCESS_OK;
1058 }
1059
1060 return pmreg_access(env, ri, isread);
1061 }
1062
1063 static CPAccessResult pmreg_access_ccntr(CPUARMState *env,
1064 const ARMCPRegInfo *ri,
1065 bool isread)
1066 {
1067 /* CR: cycle counter read trap control */
1068 if (arm_feature(env, ARM_FEATURE_V8)
1069 && arm_current_el(env) == 0
1070 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0
1071 && isread) {
1072 return CP_ACCESS_OK;
1073 }
1074
1075 return pmreg_access(env, ri, isread);
1076 }
1077
1078 static inline bool arm_ccnt_enabled(CPUARMState *env)
1079 {
1080 /* This does not support checking PMCCFILTR_EL0 register */
1081
1082 if (!(env->cp15.c9_pmcr & PMCRE) || !(env->cp15.c9_pmcnten & (1 << 31))) {
1083 return false;
1084 }
1085
1086 return true;
1087 }
1088
1089 void pmccntr_sync(CPUARMState *env)
1090 {
1091 uint64_t temp_ticks;
1092
1093 temp_ticks = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
1094 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
1095
1096 if (env->cp15.c9_pmcr & PMCRD) {
1097 /* Increment once every 64 processor clock cycles */
1098 temp_ticks /= 64;
1099 }
1100
1101 if (arm_ccnt_enabled(env)) {
1102 env->cp15.c15_ccnt = temp_ticks - env->cp15.c15_ccnt;
1103 }
1104 }
1105
1106 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1107 uint64_t value)
1108 {
1109 pmccntr_sync(env);
1110
1111 if (value & PMCRC) {
1112 /* The counter has been reset */
1113 env->cp15.c15_ccnt = 0;
1114 }
1115
1116 /* only the DP, X, D and E bits are writable */
1117 env->cp15.c9_pmcr &= ~0x39;
1118 env->cp15.c9_pmcr |= (value & 0x39);
1119
1120 pmccntr_sync(env);
1121 }
1122
1123 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1124 {
1125 uint64_t total_ticks;
1126
1127 if (!arm_ccnt_enabled(env)) {
1128 /* Counter is disabled, do not change value */
1129 return env->cp15.c15_ccnt;
1130 }
1131
1132 total_ticks = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
1133 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
1134
1135 if (env->cp15.c9_pmcr & PMCRD) {
1136 /* Increment once every 64 processor clock cycles */
1137 total_ticks /= 64;
1138 }
1139 return total_ticks - env->cp15.c15_ccnt;
1140 }
1141
1142 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1143 uint64_t value)
1144 {
1145 /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and
1146 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the
1147 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are
1148 * accessed.
1149 */
1150 env->cp15.c9_pmselr = value & 0x1f;
1151 }
1152
1153 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1154 uint64_t value)
1155 {
1156 uint64_t total_ticks;
1157
1158 if (!arm_ccnt_enabled(env)) {
1159 /* Counter is disabled, set the absolute value */
1160 env->cp15.c15_ccnt = value;
1161 return;
1162 }
1163
1164 total_ticks = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
1165 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
1166
1167 if (env->cp15.c9_pmcr & PMCRD) {
1168 /* Increment once every 64 processor clock cycles */
1169 total_ticks /= 64;
1170 }
1171 env->cp15.c15_ccnt = total_ticks - value;
1172 }
1173
1174 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
1175 uint64_t value)
1176 {
1177 uint64_t cur_val = pmccntr_read(env, NULL);
1178
1179 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
1180 }
1181
1182 #else /* CONFIG_USER_ONLY */
1183
1184 void pmccntr_sync(CPUARMState *env)
1185 {
1186 }
1187
1188 #endif
1189
1190 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1191 uint64_t value)
1192 {
1193 pmccntr_sync(env);
1194 env->cp15.pmccfiltr_el0 = value & 0xfc000000;
1195 pmccntr_sync(env);
1196 }
1197
1198 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1199 uint64_t value)
1200 {
1201 value &= pmu_counter_mask(env);
1202 env->cp15.c9_pmcnten |= value;
1203 }
1204
1205 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1206 uint64_t value)
1207 {
1208 value &= pmu_counter_mask(env);
1209 env->cp15.c9_pmcnten &= ~value;
1210 }
1211
1212 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1213 uint64_t value)
1214 {
1215 value &= pmu_counter_mask(env);
1216 env->cp15.c9_pmovsr &= ~value;
1217 }
1218
1219 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
1220 uint64_t value)
1221 {
1222 /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
1223 * PMSELR value is equal to or greater than the number of implemented
1224 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI.
1225 */
1226 if (env->cp15.c9_pmselr == 0x1f) {
1227 pmccfiltr_write(env, ri, value);
1228 }
1229 }
1230
1231 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri)
1232 {
1233 /* We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER
1234 * are CONSTRAINED UNPREDICTABLE. See comments in pmxevtyper_write().
1235 */
1236 if (env->cp15.c9_pmselr == 0x1f) {
1237 return env->cp15.pmccfiltr_el0;
1238 } else {
1239 return 0;
1240 }
1241 }
1242
1243 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1244 uint64_t value)
1245 {
1246 if (arm_feature(env, ARM_FEATURE_V8)) {
1247 env->cp15.c9_pmuserenr = value & 0xf;
1248 } else {
1249 env->cp15.c9_pmuserenr = value & 1;
1250 }
1251 }
1252
1253 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1254 uint64_t value)
1255 {
1256 /* We have no event counters so only the C bit can be changed */
1257 value &= pmu_counter_mask(env);
1258 env->cp15.c9_pminten |= value;
1259 }
1260
1261 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1262 uint64_t value)
1263 {
1264 value &= pmu_counter_mask(env);
1265 env->cp15.c9_pminten &= ~value;
1266 }
1267
1268 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
1269 uint64_t value)
1270 {
1271 /* Note that even though the AArch64 view of this register has bits
1272 * [10:0] all RES0 we can only mask the bottom 5, to comply with the
1273 * architectural requirements for bits which are RES0 only in some
1274 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
1275 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
1276 */
1277 raw_write(env, ri, value & ~0x1FULL);
1278 }
1279
1280 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1281 {
1282 /* We only mask off bits that are RES0 both for AArch64 and AArch32.
1283 * For bits that vary between AArch32/64, code needs to check the
1284 * current execution mode before directly using the feature bit.
1285 */
1286 uint32_t valid_mask = SCR_AARCH64_MASK | SCR_AARCH32_MASK;
1287
1288 if (!arm_feature(env, ARM_FEATURE_EL2)) {
1289 valid_mask &= ~SCR_HCE;
1290
1291 /* On ARMv7, SMD (or SCD as it is called in v7) is only
1292 * supported if EL2 exists. The bit is UNK/SBZP when
1293 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero
1294 * when EL2 is unavailable.
1295 * On ARMv8, this bit is always available.
1296 */
1297 if (arm_feature(env, ARM_FEATURE_V7) &&
1298 !arm_feature(env, ARM_FEATURE_V8)) {
1299 valid_mask &= ~SCR_SMD;
1300 }
1301 }
1302
1303 /* Clear all-context RES0 bits. */
1304 value &= valid_mask;
1305 raw_write(env, ri, value);
1306 }
1307
1308 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1309 {
1310 ARMCPU *cpu = arm_env_get_cpu(env);
1311
1312 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR
1313 * bank
1314 */
1315 uint32_t index = A32_BANKED_REG_GET(env, csselr,
1316 ri->secure & ARM_CP_SECSTATE_S);
1317
1318 return cpu->ccsidr[index];
1319 }
1320
1321 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1322 uint64_t value)
1323 {
1324 raw_write(env, ri, value & 0xf);
1325 }
1326
1327 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1328 {
1329 CPUState *cs = ENV_GET_CPU(env);
1330 uint64_t ret = 0;
1331
1332 if (arm_hcr_el2_imo(env)) {
1333 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
1334 ret |= CPSR_I;
1335 }
1336 } else {
1337 if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
1338 ret |= CPSR_I;
1339 }
1340 }
1341
1342 if (arm_hcr_el2_fmo(env)) {
1343 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
1344 ret |= CPSR_F;
1345 }
1346 } else {
1347 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
1348 ret |= CPSR_F;
1349 }
1350 }
1351
1352 /* External aborts are not possible in QEMU so A bit is always clear */
1353 return ret;
1354 }
1355
1356 static const ARMCPRegInfo v7_cp_reginfo[] = {
1357 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
1358 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
1359 .access = PL1_W, .type = ARM_CP_NOP },
1360 /* Performance monitors are implementation defined in v7,
1361 * but with an ARM recommended set of registers, which we
1362 * follow (although we don't actually implement any counters)
1363 *
1364 * Performance registers fall into three categories:
1365 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
1366 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
1367 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
1368 * For the cases controlled by PMUSERENR we must set .access to PL0_RW
1369 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
1370 */
1371 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
1372 .access = PL0_RW, .type = ARM_CP_ALIAS,
1373 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
1374 .writefn = pmcntenset_write,
1375 .accessfn = pmreg_access,
1376 .raw_writefn = raw_write },
1377 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64,
1378 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
1379 .access = PL0_RW, .accessfn = pmreg_access,
1380 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
1381 .writefn = pmcntenset_write, .raw_writefn = raw_write },
1382 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
1383 .access = PL0_RW,
1384 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
1385 .accessfn = pmreg_access,
1386 .writefn = pmcntenclr_write,
1387 .type = ARM_CP_ALIAS },
1388 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
1389 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
1390 .access = PL0_RW, .accessfn = pmreg_access,
1391 .type = ARM_CP_ALIAS,
1392 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
1393 .writefn = pmcntenclr_write },
1394 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
1395 .access = PL0_RW,
1396 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
1397 .accessfn = pmreg_access,
1398 .writefn = pmovsr_write,
1399 .raw_writefn = raw_write },
1400 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64,
1401 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3,
1402 .access = PL0_RW, .accessfn = pmreg_access,
1403 .type = ARM_CP_ALIAS,
1404 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
1405 .writefn = pmovsr_write,
1406 .raw_writefn = raw_write },
1407 /* Unimplemented so WI. */
1408 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
1409 .access = PL0_W, .accessfn = pmreg_access_swinc, .type = ARM_CP_NOP },
1410 #ifndef CONFIG_USER_ONLY
1411 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
1412 .access = PL0_RW, .type = ARM_CP_ALIAS,
1413 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr),
1414 .accessfn = pmreg_access_selr, .writefn = pmselr_write,
1415 .raw_writefn = raw_write},
1416 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64,
1417 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5,
1418 .access = PL0_RW, .accessfn = pmreg_access_selr,
1419 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
1420 .writefn = pmselr_write, .raw_writefn = raw_write, },
1421 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
1422 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO,
1423 .readfn = pmccntr_read, .writefn = pmccntr_write32,
1424 .accessfn = pmreg_access_ccntr },
1425 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
1426 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
1427 .access = PL0_RW, .accessfn = pmreg_access_ccntr,
1428 .type = ARM_CP_IO,
1429 .readfn = pmccntr_read, .writefn = pmccntr_write, },
1430 #endif
1431 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
1432 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
1433 .writefn = pmccfiltr_write,
1434 .access = PL0_RW, .accessfn = pmreg_access,
1435 .type = ARM_CP_IO,
1436 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
1437 .resetvalue = 0, },
1438 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
1439 .access = PL0_RW, .type = ARM_CP_NO_RAW, .accessfn = pmreg_access,
1440 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
1441 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
1442 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
1443 .access = PL0_RW, .type = ARM_CP_NO_RAW, .accessfn = pmreg_access,
1444 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
1445 /* Unimplemented, RAZ/WI. */
1446 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
1447 .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
1448 .accessfn = pmreg_access_xevcntr },
1449 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
1450 .access = PL0_R | PL1_RW, .accessfn = access_tpm,
1451 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr),
1452 .resetvalue = 0,
1453 .writefn = pmuserenr_write, .raw_writefn = raw_write },
1454 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64,
1455 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0,
1456 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
1457 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
1458 .resetvalue = 0,
1459 .writefn = pmuserenr_write, .raw_writefn = raw_write },
1460 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
1461 .access = PL1_RW, .accessfn = access_tpm,
1462 .type = ARM_CP_ALIAS | ARM_CP_IO,
1463 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
1464 .resetvalue = 0,
1465 .writefn = pmintenset_write, .raw_writefn = raw_write },
1466 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
1467 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
1468 .access = PL1_RW, .accessfn = access_tpm,
1469 .type = ARM_CP_IO,
1470 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
1471 .writefn = pmintenset_write, .raw_writefn = raw_write,
1472 .resetvalue = 0x0 },
1473 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
1474 .access = PL1_RW, .accessfn = access_tpm,
1475 .type = ARM_CP_ALIAS | ARM_CP_IO,
1476 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
1477 .writefn = pmintenclr_write, },
1478 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
1479 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
1480 .access = PL1_RW, .accessfn = access_tpm,
1481 .type = ARM_CP_ALIAS | ARM_CP_IO,
1482 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
1483 .writefn = pmintenclr_write },
1484 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
1485 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
1486 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_RAW },
1487 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
1488 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
1489 .access = PL1_RW, .writefn = csselr_write, .resetvalue = 0,
1490 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s),
1491 offsetof(CPUARMState, cp15.csselr_ns) } },
1492 /* Auxiliary ID register: this actually has an IMPDEF value but for now
1493 * just RAZ for all cores:
1494 */
1495 { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
1496 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
1497 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
1498 /* Auxiliary fault status registers: these also are IMPDEF, and we
1499 * choose to RAZ/WI for all cores.
1500 */
1501 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
1502 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
1503 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
1504 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
1505 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
1506 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
1507 /* MAIR can just read-as-written because we don't implement caches
1508 * and so don't need to care about memory attributes.
1509 */
1510 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
1511 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
1512 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]),
1513 .resetvalue = 0 },
1514 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64,
1515 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0,
1516 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]),
1517 .resetvalue = 0 },
1518 /* For non-long-descriptor page tables these are PRRR and NMRR;
1519 * regardless they still act as reads-as-written for QEMU.
1520 */
1521 /* MAIR0/1 are defined separately from their 64-bit counterpart which
1522 * allows them to assign the correct fieldoffset based on the endianness
1523 * handled in the field definitions.
1524 */
1525 { .name = "MAIR0", .state = ARM_CP_STATE_AA32,
1526 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW,
1527 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s),
1528 offsetof(CPUARMState, cp15.mair0_ns) },
1529 .resetfn = arm_cp_reset_ignore },
1530 { .name = "MAIR1", .state = ARM_CP_STATE_AA32,
1531 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW,
1532 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s),
1533 offsetof(CPUARMState, cp15.mair1_ns) },
1534 .resetfn = arm_cp_reset_ignore },
1535 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
1536 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
1537 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read },
1538 /* 32 bit ITLB invalidates */
1539 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0,
1540 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1541 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
1542 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1543 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2,
1544 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1545 /* 32 bit DTLB invalidates */
1546 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0,
1547 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1548 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
1549 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1550 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2,
1551 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1552 /* 32 bit TLB invalidates */
1553 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
1554 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1555 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
1556 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1557 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
1558 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1559 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
1560 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
1561 REGINFO_SENTINEL
1562 };
1563
1564 static const ARMCPRegInfo v7mp_cp_reginfo[] = {
1565 /* 32 bit TLB invalidates, Inner Shareable */
1566 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
1567 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write },
1568 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
1569 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
1570 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
1571 .type = ARM_CP_NO_RAW, .access = PL1_W,
1572 .writefn = tlbiasid_is_write },
1573 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
1574 .type = ARM_CP_NO_RAW, .access = PL1_W,
1575 .writefn = tlbimvaa_is_write },
1576 REGINFO_SENTINEL
1577 };
1578
1579 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1580 uint64_t value)
1581 {
1582 value &= 1;
1583 env->teecr = value;
1584 }
1585
1586 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri,
1587 bool isread)
1588 {
1589 if (arm_current_el(env) == 0 && (env->teecr & 1)) {
1590 return CP_ACCESS_TRAP;
1591 }
1592 return CP_ACCESS_OK;
1593 }
1594
1595 static const ARMCPRegInfo t2ee_cp_reginfo[] = {
1596 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
1597 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
1598 .resetvalue = 0,
1599 .writefn = teecr_write },
1600 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
1601 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
1602 .accessfn = teehbr_access, .resetvalue = 0 },
1603 REGINFO_SENTINEL
1604 };
1605
1606 static const ARMCPRegInfo v6k_cp_reginfo[] = {
1607 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
1608 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
1609 .access = PL0_RW,
1610 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 },
1611 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
1612 .access = PL0_RW,
1613 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s),
1614 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) },
1615 .resetfn = arm_cp_reset_ignore },
1616 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
1617 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
1618 .access = PL0_R|PL1_W,
1619 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]),
1620 .resetvalue = 0},
1621 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
1622 .access = PL0_R|PL1_W,
1623 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s),
1624 offsetoflow32(CPUARMState, cp15.tpidruro_ns) },
1625 .resetfn = arm_cp_reset_ignore },
1626 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64,
1627 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
1628 .access = PL1_RW,
1629 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 },
1630 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4,
1631 .access = PL1_RW,
1632 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s),
1633 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) },
1634 .resetvalue = 0 },
1635 REGINFO_SENTINEL
1636 };
1637
1638 #ifndef CONFIG_USER_ONLY
1639
1640 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri,
1641 bool isread)
1642 {
1643 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero.
1644 * Writable only at the highest implemented exception level.
1645 */
1646 int el = arm_current_el(env);
1647
1648 switch (el) {
1649 case 0:
1650 if (!extract32(env->cp15.c14_cntkctl, 0, 2)) {
1651 return CP_ACCESS_TRAP;
1652 }
1653 break;
1654 case 1:
1655 if (!isread && ri->state == ARM_CP_STATE_AA32 &&
1656 arm_is_secure_below_el3(env)) {
1657 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */
1658 return CP_ACCESS_TRAP_UNCATEGORIZED;
1659 }
1660 break;
1661 case 2:
1662 case 3:
1663 break;
1664 }
1665
1666 if (!isread && el < arm_highest_el(env)) {
1667 return CP_ACCESS_TRAP_UNCATEGORIZED;
1668 }
1669
1670 return CP_ACCESS_OK;
1671 }
1672
1673 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
1674 bool isread)
1675 {
1676 unsigned int cur_el = arm_current_el(env);
1677 bool secure = arm_is_secure(env);
1678
1679 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */
1680 if (cur_el == 0 &&
1681 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
1682 return CP_ACCESS_TRAP;
1683 }
1684
1685 if (arm_feature(env, ARM_FEATURE_EL2) &&
1686 timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
1687 !extract32(env->cp15.cnthctl_el2, 0, 1)) {
1688 return CP_ACCESS_TRAP_EL2;
1689 }
1690 return CP_ACCESS_OK;
1691 }
1692
1693 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
1694 bool isread)
1695 {
1696 unsigned int cur_el = arm_current_el(env);
1697 bool secure = arm_is_secure(env);
1698
1699 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if
1700 * EL0[PV]TEN is zero.
1701 */
1702 if (cur_el == 0 &&
1703 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
1704 return CP_ACCESS_TRAP;
1705 }
1706
1707 if (arm_feature(env, ARM_FEATURE_EL2) &&
1708 timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
1709 !extract32(env->cp15.cnthctl_el2, 1, 1)) {
1710 return CP_ACCESS_TRAP_EL2;
1711 }
1712 return CP_ACCESS_OK;
1713 }
1714
1715 static CPAccessResult gt_pct_access(CPUARMState *env,
1716 const ARMCPRegInfo *ri,
1717 bool isread)
1718 {
1719 return gt_counter_access(env, GTIMER_PHYS, isread);
1720 }
1721
1722 static CPAccessResult gt_vct_access(CPUARMState *env,
1723 const ARMCPRegInfo *ri,
1724 bool isread)
1725 {
1726 return gt_counter_access(env, GTIMER_VIRT, isread);
1727 }
1728
1729 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri,
1730 bool isread)
1731 {
1732 return gt_timer_access(env, GTIMER_PHYS, isread);
1733 }
1734
1735 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri,
1736 bool isread)
1737 {
1738 return gt_timer_access(env, GTIMER_VIRT, isread);
1739 }
1740
1741 static CPAccessResult gt_stimer_access(CPUARMState *env,
1742 const ARMCPRegInfo *ri,
1743 bool isread)
1744 {
1745 /* The AArch64 register view of the secure physical timer is
1746 * always accessible from EL3, and configurably accessible from
1747 * Secure EL1.
1748 */
1749 switch (arm_current_el(env)) {
1750 case 1:
1751 if (!arm_is_secure(env)) {
1752 return CP_ACCESS_TRAP;
1753 }
1754 if (!(env->cp15.scr_el3 & SCR_ST)) {
1755 return CP_ACCESS_TRAP_EL3;
1756 }
1757 return CP_ACCESS_OK;
1758 case 0:
1759 case 2:
1760 return CP_ACCESS_TRAP;
1761 case 3:
1762 return CP_ACCESS_OK;
1763 default:
1764 g_assert_not_reached();
1765 }
1766 }
1767
1768 static uint64_t gt_get_countervalue(CPUARMState *env)
1769 {
1770 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
1771 }
1772
1773 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
1774 {
1775 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
1776
1777 if (gt->ctl & 1) {
1778 /* Timer enabled: calculate and set current ISTATUS, irq, and
1779 * reset timer to when ISTATUS next has to change
1780 */
1781 uint64_t offset = timeridx == GTIMER_VIRT ?
1782 cpu->env.cp15.cntvoff_el2 : 0;
1783 uint64_t count = gt_get_countervalue(&cpu->env);
1784 /* Note that this must be unsigned 64 bit arithmetic: */
1785 int istatus = count - offset >= gt->cval;
1786 uint64_t nexttick;
1787 int irqstate;
1788
1789 gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
1790
1791 irqstate = (istatus && !(gt->ctl & 2));
1792 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
1793
1794 if (istatus) {
1795 /* Next transition is when count rolls back over to zero */
1796 nexttick = UINT64_MAX;
1797 } else {
1798 /* Next transition is when we hit cval */
1799 nexttick = gt->cval + offset;
1800 }
1801 /* Note that the desired next expiry time might be beyond the
1802 * signed-64-bit range of a QEMUTimer -- in this case we just
1803 * set the timer for as far in the future as possible. When the
1804 * timer expires we will reset the timer for any remaining period.
1805 */
1806 if (nexttick > INT64_MAX / GTIMER_SCALE) {
1807 nexttick = INT64_MAX / GTIMER_SCALE;
1808 }
1809 timer_mod(cpu->gt_timer[timeridx], nexttick);
1810 trace_arm_gt_recalc(timeridx, irqstate, nexttick);
1811 } else {
1812 /* Timer disabled: ISTATUS and timer output always clear */
1813 gt->ctl &= ~4;
1814 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);
1815 timer_del(cpu->gt_timer[timeridx]);
1816 trace_arm_gt_recalc_disabled(timeridx);
1817 }
1818 }
1819
1820 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
1821 int timeridx)
1822 {
1823 ARMCPU *cpu = arm_env_get_cpu(env);
1824
1825 timer_del(cpu->gt_timer[timeridx]);
1826 }
1827
1828 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
1829 {
1830 return gt_get_countervalue(env);
1831 }
1832
1833 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
1834 {
1835 return gt_get_countervalue(env) - env->cp15.cntvoff_el2;
1836 }
1837
1838 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1839 int timeridx,
1840 uint64_t value)
1841 {
1842 trace_arm_gt_cval_write(timeridx, value);
1843 env->cp15.c14_timer[timeridx].cval = value;
1844 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1845 }
1846
1847 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
1848 int timeridx)
1849 {
1850 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
1851
1852 return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
1853 (gt_get_countervalue(env) - offset));
1854 }
1855
1856 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1857 int timeridx,
1858 uint64_t value)
1859 {
1860 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
1861
1862 trace_arm_gt_tval_write(timeridx, value);
1863 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset +
1864 sextract64(value, 0, 32);
1865 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1866 }
1867
1868 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1869 int timeridx,
1870 uint64_t value)
1871 {
1872 ARMCPU *cpu = arm_env_get_cpu(env);
1873 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
1874
1875 trace_arm_gt_ctl_write(timeridx, value);
1876 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
1877 if ((oldval ^ value) & 1) {
1878 /* Enable toggled */
1879 gt_recalc_timer(cpu, timeridx);
1880 } else if ((oldval ^ value) & 2) {
1881 /* IMASK toggled: don't need to recalculate,
1882 * just set the interrupt line based on ISTATUS
1883 */
1884 int irqstate = (oldval & 4) && !(value & 2);
1885
1886 trace_arm_gt_imask_toggle(timeridx, irqstate);
1887 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
1888 }
1889 }
1890
1891 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1892 {
1893 gt_timer_reset(env, ri, GTIMER_PHYS);
1894 }
1895
1896 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1897 uint64_t value)
1898 {
1899 gt_cval_write(env, ri, GTIMER_PHYS, value);
1900 }
1901
1902 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1903 {
1904 return gt_tval_read(env, ri, GTIMER_PHYS);
1905 }
1906
1907 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1908 uint64_t value)
1909 {
1910 gt_tval_write(env, ri, GTIMER_PHYS, value);
1911 }
1912
1913 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1914 uint64_t value)
1915 {
1916 gt_ctl_write(env, ri, GTIMER_PHYS, value);
1917 }
1918
1919 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1920 {
1921 gt_timer_reset(env, ri, GTIMER_VIRT);
1922 }
1923
1924 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1925 uint64_t value)
1926 {
1927 gt_cval_write(env, ri, GTIMER_VIRT, value);
1928 }
1929
1930 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1931 {
1932 return gt_tval_read(env, ri, GTIMER_VIRT);
1933 }
1934
1935 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1936 uint64_t value)
1937 {
1938 gt_tval_write(env, ri, GTIMER_VIRT, value);
1939 }
1940
1941 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1942 uint64_t value)
1943 {
1944 gt_ctl_write(env, ri, GTIMER_VIRT, value);
1945 }
1946
1947 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
1948 uint64_t value)
1949 {
1950 ARMCPU *cpu = arm_env_get_cpu(env);
1951
1952 trace_arm_gt_cntvoff_write(value);
1953 raw_write(env, ri, value);
1954 gt_recalc_timer(cpu, GTIMER_VIRT);
1955 }
1956
1957 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1958 {
1959 gt_timer_reset(env, ri, GTIMER_HYP);
1960 }
1961
1962 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1963 uint64_t value)
1964 {
1965 gt_cval_write(env, ri, GTIMER_HYP, value);
1966 }
1967
1968 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1969 {
1970 return gt_tval_read(env, ri, GTIMER_HYP);
1971 }
1972
1973 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1974 uint64_t value)
1975 {
1976 gt_tval_write(env, ri, GTIMER_HYP, value);
1977 }
1978
1979 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1980 uint64_t value)
1981 {
1982 gt_ctl_write(env, ri, GTIMER_HYP, value);
1983 }
1984
1985 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1986 {
1987 gt_timer_reset(env, ri, GTIMER_SEC);
1988 }
1989
1990 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1991 uint64_t value)
1992 {
1993 gt_cval_write(env, ri, GTIMER_SEC, value);
1994 }
1995
1996 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1997 {
1998 return gt_tval_read(env, ri, GTIMER_SEC);
1999 }
2000
2001 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2002 uint64_t value)
2003 {
2004 gt_tval_write(env, ri, GTIMER_SEC, value);
2005 }
2006
2007 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2008 uint64_t value)
2009 {
2010 gt_ctl_write(env, ri, GTIMER_SEC, value);
2011 }
2012
2013 void arm_gt_ptimer_cb(void *opaque)
2014 {
2015 ARMCPU *cpu = opaque;
2016
2017 gt_recalc_timer(cpu, GTIMER_PHYS);
2018 }
2019
2020 void arm_gt_vtimer_cb(void *opaque)
2021 {
2022 ARMCPU *cpu = opaque;
2023
2024 gt_recalc_timer(cpu, GTIMER_VIRT);
2025 }
2026
2027 void arm_gt_htimer_cb(void *opaque)
2028 {
2029 ARMCPU *cpu = opaque;
2030
2031 gt_recalc_timer(cpu, GTIMER_HYP);
2032 }
2033
2034 void arm_gt_stimer_cb(void *opaque)
2035 {
2036 ARMCPU *cpu = opaque;
2037
2038 gt_recalc_timer(cpu, GTIMER_SEC);
2039 }
2040
2041 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
2042 /* Note that CNTFRQ is purely reads-as-written for the benefit
2043 * of software; writing it doesn't actually change the timer frequency.
2044 * Our reset value matches the fixed frequency we implement the timer at.
2045 */
2046 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
2047 .type = ARM_CP_ALIAS,
2048 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
2049 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
2050 },
2051 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
2052 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
2053 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
2054 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
2055 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
2056 },
2057 /* overall control: mostly access permissions */
2058 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
2059 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
2060 .access = PL1_RW,
2061 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
2062 .resetvalue = 0,
2063 },
2064 /* per-timer control */
2065 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
2066 .secure = ARM_CP_SECSTATE_NS,
2067 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
2068 .accessfn = gt_ptimer_access,
2069 .fieldoffset = offsetoflow32(CPUARMState,
2070 cp15.c14_timer[GTIMER_PHYS].ctl),
2071 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
2072 },
2073 { .name = "CNTP_CTL_S",
2074 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
2075 .secure = ARM_CP_SECSTATE_S,
2076 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
2077 .accessfn = gt_ptimer_access,
2078 .fieldoffset = offsetoflow32(CPUARMState,
2079 cp15.c14_timer[GTIMER_SEC].ctl),
2080 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
2081 },
2082 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
2083 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
2084 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
2085 .accessfn = gt_ptimer_access,
2086 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
2087 .resetvalue = 0,
2088 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
2089 },
2090 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
2091 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
2092 .accessfn = gt_vtimer_access,
2093 .fieldoffset = offsetoflow32(CPUARMState,
2094 cp15.c14_timer[GTIMER_VIRT].ctl),
2095 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
2096 },
2097 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
2098 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
2099 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
2100 .accessfn = gt_vtimer_access,
2101 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
2102 .resetvalue = 0,
2103 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
2104 },
2105 /* TimerValue views: a 32 bit downcounting view of the underlying state */
2106 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
2107 .secure = ARM_CP_SECSTATE_NS,
2108 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
2109 .accessfn = gt_ptimer_access,
2110 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
2111 },
2112 { .name = "CNTP_TVAL_S",
2113 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
2114 .secure = ARM_CP_SECSTATE_S,
2115 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
2116 .accessfn = gt_ptimer_access,
2117 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
2118 },
2119 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
2120 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
2121 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
2122 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
2123 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
2124 },
2125 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
2126 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
2127 .accessfn = gt_vtimer_access,
2128 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
2129 },
2130 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
2131 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
2132 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
2133 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
2134 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
2135 },
2136 /* The counter itself */
2137 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
2138 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
2139 .accessfn = gt_pct_access,
2140 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
2141 },
2142 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
2143 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
2144 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2145 .accessfn = gt_pct_access, .readfn = gt_cnt_read,
2146 },
2147 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
2148 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
2149 .accessfn = gt_vct_access,
2150 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
2151 },
2152 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
2153 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
2154 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2155 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
2156 },
2157 /* Comparison value, indicating when the timer goes off */
2158 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
2159 .secure = ARM_CP_SECSTATE_NS,
2160 .access = PL1_RW | PL0_R,
2161 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2162 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
2163 .accessfn = gt_ptimer_access,
2164 .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
2165 },
2166 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
2167 .secure = ARM_CP_SECSTATE_S,
2168 .access = PL1_RW | PL0_R,
2169 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2170 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
2171 .accessfn = gt_ptimer_access,
2172 .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
2173 },
2174 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
2175 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
2176 .access = PL1_RW | PL0_R,
2177 .type = ARM_CP_IO,
2178 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
2179 .resetvalue = 0, .accessfn = gt_ptimer_access,
2180 .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
2181 },
2182 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
2183 .access = PL1_RW | PL0_R,
2184 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2185 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
2186 .accessfn = gt_vtimer_access,
2187 .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
2188 },
2189 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
2190 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
2191 .access = PL1_RW | PL0_R,
2192 .type = ARM_CP_IO,
2193 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
2194 .resetvalue = 0, .accessfn = gt_vtimer_access,
2195 .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
2196 },
2197 /* Secure timer -- this is actually restricted to only EL3
2198 * and configurably Secure-EL1 via the accessfn.
2199 */
2200 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64,
2201 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0,
2202 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW,
2203 .accessfn = gt_stimer_access,
2204 .readfn = gt_sec_tval_read,
2205 .writefn = gt_sec_tval_write,
2206 .resetfn = gt_sec_timer_reset,
2207 },
2208 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64,
2209 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1,
2210 .type = ARM_CP_IO, .access = PL1_RW,
2211 .accessfn = gt_stimer_access,
2212 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl),
2213 .resetvalue = 0,
2214 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
2215 },
2216 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64,
2217 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2,
2218 .type = ARM_CP_IO, .access = PL1_RW,
2219 .accessfn = gt_stimer_access,
2220 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
2221 .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
2222 },
2223 REGINFO_SENTINEL
2224 };
2225
2226 #else
2227
2228 /* In user-mode most of the generic timer registers are inaccessible
2229 * however modern kernels (4.12+) allow access to cntvct_el0
2230 */
2231
2232 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2233 {
2234 /* Currently we have no support for QEMUTimer in linux-user so we
2235 * can't call gt_get_countervalue(env), instead we directly
2236 * call the lower level functions.
2237 */
2238 return cpu_get_clock() / GTIMER_SCALE;
2239 }
2240
2241 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
2242 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
2243 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
2244 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */,
2245 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
2246 .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE,
2247 },
2248 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
2249 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
2250 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2251 .readfn = gt_virt_cnt_read,
2252 },
2253 REGINFO_SENTINEL
2254 };
2255
2256 #endif
2257
2258 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
2259 {
2260 if (arm_feature(env, ARM_FEATURE_LPAE)) {
2261 raw_write(env, ri, value);
2262 } else if (arm_feature(env, ARM_FEATURE_V7)) {
2263 raw_write(env, ri, value & 0xfffff6ff);
2264 } else {
2265 raw_write(env, ri, value & 0xfffff1ff);
2266 }
2267 }
2268
2269 #ifndef CONFIG_USER_ONLY
2270 /* get_phys_addr() isn't present for user-mode-only targets */
2271
2272 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
2273 bool isread)
2274 {
2275 if (ri->opc2 & 4) {
2276 /* The ATS12NSO* operations must trap to EL3 if executed in
2277 * Secure EL1 (which can only happen if EL3 is AArch64).
2278 * They are simply UNDEF if executed from NS EL1.
2279 * They function normally from EL2 or EL3.
2280 */
2281 if (arm_current_el(env) == 1) {
2282 if (arm_is_secure_below_el3(env)) {
2283 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3;
2284 }
2285 return CP_ACCESS_TRAP_UNCATEGORIZED;
2286 }
2287 }
2288 return CP_ACCESS_OK;
2289 }
2290
2291 static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
2292 MMUAccessType access_type, ARMMMUIdx mmu_idx)
2293 {
2294 hwaddr phys_addr;
2295 target_ulong page_size;
2296 int prot;
2297 bool ret;
2298 uint64_t par64;
2299 bool format64 = false;
2300 MemTxAttrs attrs = {};
2301 ARMMMUFaultInfo fi = {};
2302 ARMCacheAttrs cacheattrs = {};
2303
2304 ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs,
2305 &prot, &page_size, &fi, &cacheattrs);
2306
2307 if (is_a64(env)) {
2308 format64 = true;
2309 } else if (arm_feature(env, ARM_FEATURE_LPAE)) {
2310 /*
2311 * ATS1Cxx:
2312 * * TTBCR.EAE determines whether the result is returned using the
2313 * 32-bit or the 64-bit PAR format
2314 * * Instructions executed in Hyp mode always use the 64bit format
2315 *
2316 * ATS1S2NSOxx uses the 64bit format if any of the following is true:
2317 * * The Non-secure TTBCR.EAE bit is set to 1
2318 * * The implementation includes EL2, and the value of HCR.VM is 1
2319 *
2320 * (Note that HCR.DC makes HCR.VM behave as if it is 1.)
2321 *
2322 * ATS1Hx always uses the 64bit format.
2323 */
2324 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx);
2325
2326 if (arm_feature(env, ARM_FEATURE_EL2)) {
2327 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
2328 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC);
2329 } else {
2330 format64 |= arm_current_el(env) == 2;
2331 }
2332 }
2333 }
2334
2335 if (format64) {
2336 /* Create a 64-bit PAR */
2337 par64 = (1 << 11); /* LPAE bit always set */
2338 if (!ret) {
2339 par64 |= phys_addr & ~0xfffULL;
2340 if (!attrs.secure) {
2341 par64 |= (1 << 9); /* NS */
2342 }
2343 par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */
2344 par64 |= cacheattrs.shareability << 7; /* SH */
2345 } else {
2346 uint32_t fsr = arm_fi_to_lfsc(&fi);
2347
2348 par64 |= 1; /* F */
2349 par64 |= (fsr & 0x3f) << 1; /* FS */
2350 if (fi.stage2) {
2351 par64 |= (1 << 9); /* S */
2352 }
2353 if (fi.s1ptw) {
2354 par64 |= (1 << 8); /* PTW */
2355 }
2356 }
2357 } else {
2358 /* fsr is a DFSR/IFSR value for the short descriptor
2359 * translation table format (with WnR always clear).
2360 * Convert it to a 32-bit PAR.
2361 */
2362 if (!ret) {
2363 /* We do not set any attribute bits in the PAR */
2364 if (page_size == (1 << 24)
2365 && arm_feature(env, ARM_FEATURE_V7)) {
2366 par64 = (phys_addr & 0xff000000) | (1 << 1);
2367 } else {
2368 par64 = phys_addr & 0xfffff000;
2369 }
2370 if (!attrs.secure) {
2371 par64 |= (1 << 9); /* NS */
2372 }
2373 } else {
2374 uint32_t fsr = arm_fi_to_sfsc(&fi);
2375
2376 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) |
2377 ((fsr & 0xf) << 1) | 1;
2378 }
2379 }
2380 return par64;
2381 }
2382
2383 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
2384 {
2385 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
2386 uint64_t par64;
2387 ARMMMUIdx mmu_idx;
2388 int el = arm_current_el(env);
2389 bool secure = arm_is_secure_below_el3(env);
2390
2391 switch (ri->opc2 & 6) {
2392 case 0:
2393 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */
2394 switch (el) {
2395 case 3:
2396 mmu_idx = ARMMMUIdx_S1E3;
2397 break;
2398 case 2:
2399 mmu_idx = ARMMMUIdx_S1NSE1;
2400 break;
2401 case 1:
2402 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
2403 break;
2404 default:
2405 g_assert_not_reached();
2406 }
2407 break;
2408 case 2:
2409 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
2410 switch (el) {
2411 case 3:
2412 mmu_idx = ARMMMUIdx_S1SE0;
2413 break;
2414 case 2:
2415 mmu_idx = ARMMMUIdx_S1NSE0;
2416 break;
2417 case 1:
2418 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
2419 break;
2420 default:
2421 g_assert_not_reached();
2422 }
2423 break;
2424 case 4:
2425 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
2426 mmu_idx = ARMMMUIdx_S12NSE1;
2427 break;
2428 case 6:
2429 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
2430 mmu_idx = ARMMMUIdx_S12NSE0;
2431 break;
2432 default:
2433 g_assert_not_reached();
2434 }
2435
2436 par64 = do_ats_write(env, value, access_type, mmu_idx);
2437
2438 A32_BANKED_CURRENT_REG_SET(env, par, par64);
2439 }
2440
2441 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
2442 uint64_t value)
2443 {
2444 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
2445 uint64_t par64;
2446
2447 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S1E2);
2448
2449 A32_BANKED_CURRENT_REG_SET(env, par, par64);
2450 }
2451
2452 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
2453 bool isread)
2454 {
2455 if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) {
2456 return CP_ACCESS_TRAP;
2457 }
2458 return CP_ACCESS_OK;
2459 }
2460
2461 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
2462 uint64_t value)
2463 {
2464 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
2465 ARMMMUIdx mmu_idx;
2466 int secure = arm_is_secure_below_el3(env);
2467
2468 switch (ri->opc2 & 6) {
2469 case 0:
2470 switch (ri->opc1) {
2471 case 0: /* AT S1E1R, AT S1E1W */
2472 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
2473 break;
2474 case 4: /* AT S1E2R, AT S1E2W */
2475 mmu_idx = ARMMMUIdx_S1E2;
2476 break;
2477 case 6: /* AT S1E3R, AT S1E3W */
2478 mmu_idx = ARMMMUIdx_S1E3;
2479 break;
2480 default:
2481 g_assert_not_reached();
2482 }
2483 break;
2484 case 2: /* AT S1E0R, AT S1E0W */
2485 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
2486 break;
2487 case 4: /* AT S12E1R, AT S12E1W */
2488 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S12NSE1;
2489 break;
2490 case 6: /* AT S12E0R, AT S12E0W */
2491 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S12NSE0;
2492 break;
2493 default:
2494 g_assert_not_reached();
2495 }
2496
2497 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx);
2498 }
2499 #endif
2500
2501 static const ARMCPRegInfo vapa_cp_reginfo[] = {
2502 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
2503 .access = PL1_RW, .resetvalue = 0,
2504 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s),
2505 offsetoflow32(CPUARMState, cp15.par_ns) },
2506 .writefn = par_write },
2507 #ifndef CONFIG_USER_ONLY
2508 /* This underdecoding is safe because the reginfo is NO_RAW. */
2509 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
2510 .access = PL1_W, .accessfn = ats_access,
2511 .writefn = ats_write, .type = ARM_CP_NO_RAW },
2512 #endif
2513 REGINFO_SENTINEL
2514 };
2515
2516 /* Return basic MPU access permission bits. */
2517 static uint32_t simple_mpu_ap_bits(uint32_t val)
2518 {
2519 uint32_t ret;
2520 uint32_t mask;
2521 int i;
2522 ret = 0;
2523 mask = 3;
2524 for (i = 0; i < 16; i += 2) {
2525 ret |= (val >> i) & mask;
2526 mask <<= 2;
2527 }
2528 return ret;
2529 }
2530
2531 /* Pad basic MPU access permission bits to extended format. */
2532 static uint32_t extended_mpu_ap_bits(uint32_t val)
2533 {
2534 uint32_t ret;
2535 uint32_t mask;
2536 int i;
2537 ret = 0;
2538 mask = 3;
2539 for (i = 0; i < 16; i += 2) {
2540 ret |= (val & mask) << i;
2541 mask <<= 2;
2542 }
2543 return ret;
2544 }
2545
2546 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
2547 uint64_t value)
2548 {
2549 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
2550 }
2551
2552 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
2553 {
2554 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
2555 }
2556
2557 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
2558 uint64_t value)
2559 {
2560 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
2561 }
2562
2563 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
2564 {
2565 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
2566 }
2567
2568 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri)
2569 {
2570 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
2571
2572 if (!u32p) {
2573 return 0;
2574 }
2575
2576 u32p += env->pmsav7.rnr[M_REG_NS];
2577 return *u32p;
2578 }
2579
2580 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
2581 uint64_t value)
2582 {
2583 ARMCPU *cpu = arm_env_get_cpu(env);
2584 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
2585
2586 if (!u32p) {
2587 return;
2588 }
2589
2590 u32p += env->pmsav7.rnr[M_REG_NS];
2591 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
2592 *u32p = value;
2593 }
2594
2595 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2596 uint64_t value)
2597 {
2598 ARMCPU *cpu = arm_env_get_cpu(env);
2599 uint32_t nrgs = cpu->pmsav7_dregion;
2600
2601 if (value >= nrgs) {
2602 qemu_log_mask(LOG_GUEST_ERROR,
2603 "PMSAv7 RGNR write >= # supported regions, %" PRIu32
2604 " > %" PRIu32 "\n", (uint32_t)value, nrgs);
2605 return;
2606 }
2607
2608 raw_write(env, ri, value);
2609 }
2610
2611 static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
2612 /* Reset for all these registers is handled in arm_cpu_reset(),
2613 * because the PMSAv7 is also used by M-profile CPUs, which do
2614 * not register cpregs but still need the state to be reset.
2615 */
2616 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0,
2617 .access = PL1_RW, .type = ARM_CP_NO_RAW,
2618 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar),
2619 .readfn = pmsav7_read, .writefn = pmsav7_write,
2620 .resetfn = arm_cp_reset_ignore },
2621 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2,
2622 .access = PL1_RW, .type = ARM_CP_NO_RAW,
2623 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr),
2624 .readfn = pmsav7_read, .writefn = pmsav7_write,
2625 .resetfn = arm_cp_reset_ignore },
2626 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4,
2627 .access = PL1_RW, .type = ARM_CP_NO_RAW,
2628 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr),
2629 .readfn = pmsav7_read, .writefn = pmsav7_write,
2630 .resetfn = arm_cp_reset_ignore },
2631 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
2632 .access = PL1_RW,
2633 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]),
2634 .writefn = pmsav7_rgnr_write,
2635 .resetfn = arm_cp_reset_ignore },
2636 REGINFO_SENTINEL
2637 };
2638
2639 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
2640 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
2641 .access = PL1_RW, .type = ARM_CP_ALIAS,
2642 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
2643 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
2644 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
2645 .access = PL1_RW, .type = ARM_CP_ALIAS,
2646 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
2647 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
2648 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
2649 .access = PL1_RW,
2650 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
2651 .resetvalue = 0, },
2652 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
2653 .access = PL1_RW,
2654 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
2655 .resetvalue = 0, },
2656 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
2657 .access = PL1_RW,
2658 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
2659 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
2660 .access = PL1_RW,
2661 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
2662 /* Protection region base and size registers */
2663 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
2664 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2665 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
2666 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
2667 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2668 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
2669 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
2670 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2671 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
2672 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
2673 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2674 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
2675 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
2676 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2677 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
2678 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
2679 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2680 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
2681 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
2682 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2683 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
2684 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
2685 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2686 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
2687 REGINFO_SENTINEL
2688 };
2689
2690 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
2691 uint64_t value)
2692 {
2693 TCR *tcr = raw_ptr(env, ri);
2694 int maskshift = extract32(value, 0, 3);
2695
2696 if (!arm_feature(env, ARM_FEATURE_V8)) {
2697 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
2698 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
2699 * using Long-desciptor translation table format */
2700 value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
2701 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
2702 /* In an implementation that includes the Security Extensions
2703 * TTBCR has additional fields PD0 [4] and PD1 [5] for
2704 * Short-descriptor translation table format.
2705 */
2706 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N;
2707 } else {
2708 value &= TTBCR_N;
2709 }
2710 }
2711
2712 /* Update the masks corresponding to the TCR bank being written
2713 * Note that we always calculate mask and base_mask, but
2714 * they are only used for short-descriptor tables (ie if EAE is 0);
2715 * for long-descriptor tables the TCR fields are used differently
2716 * and the mask and base_mask values are meaningless.
2717 */
2718 tcr->raw_tcr = value;
2719 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift);
2720 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift);
2721 }
2722
2723 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2724 uint64_t value)
2725 {
2726 ARMCPU *cpu = arm_env_get_cpu(env);
2727
2728 if (arm_feature(env, ARM_FEATURE_LPAE)) {
2729 /* With LPAE the TTBCR could result in a change of ASID
2730 * via the TTBCR.A1 bit, so do a TLB flush.
2731 */
2732 tlb_flush(CPU(cpu));
2733 }
2734 vmsa_ttbcr_raw_write(env, ri, value);
2735 }
2736
2737 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2738 {
2739 TCR *tcr = raw_ptr(env, ri);
2740
2741 /* Reset both the TCR as well as the masks corresponding to the bank of
2742 * the TCR being reset.
2743 */
2744 tcr->raw_tcr = 0;
2745 tcr->mask = 0;
2746 tcr->base_mask = 0xffffc000u;
2747 }
2748
2749 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2750 uint64_t value)
2751 {
2752 ARMCPU *cpu = arm_env_get_cpu(env);
2753 TCR *tcr = raw_ptr(env, ri);
2754
2755 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
2756 tlb_flush(CPU(cpu));
2757 tcr->raw_tcr = value;
2758 }
2759
2760 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2761 uint64_t value)
2762 {
2763 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */
2764 if (cpreg_field_is_64bit(ri) &&
2765 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) {
2766 ARMCPU *cpu = arm_env_get_cpu(env);
2767 tlb_flush(CPU(cpu));
2768 }
2769 raw_write(env, ri, value);
2770 }
2771
2772 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2773 uint64_t value)
2774 {
2775 ARMCPU *cpu = arm_env_get_cpu(env);
2776 CPUState *cs = CPU(cpu);
2777
2778 /* Accesses to VTTBR may change the VMID so we must flush the TLB. */
2779 if (raw_read(env, ri) != value) {
2780 tlb_flush_by_mmuidx(cs,
2781 ARMMMUIdxBit_S12NSE1 |
2782 ARMMMUIdxBit_S12NSE0 |
2783 ARMMMUIdxBit_S2NS);
2784 raw_write(env, ri, value);
2785 }
2786 }
2787
2788 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
2789 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
2790 .access = PL1_RW, .type = ARM_CP_ALIAS,
2791 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s),
2792 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, },
2793 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
2794 .access = PL1_RW, .resetvalue = 0,
2795 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s),
2796 offsetoflow32(CPUARMState, cp15.ifsr_ns) } },
2797 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0,
2798 .access = PL1_RW, .resetvalue = 0,
2799 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s),
2800 offsetof(CPUARMState, cp15.dfar_ns) } },
2801 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64,
2802 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
2803 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
2804 .resetvalue = 0, },
2805 REGINFO_SENTINEL
2806 };
2807
2808 static const ARMCPRegInfo vmsa_cp_reginfo[] = {
2809 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
2810 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
2811 .access = PL1_RW,
2812 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
2813 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
2814 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
2815 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
2816 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
2817 offsetof(CPUARMState, cp15.ttbr0_ns) } },
2818 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
2819 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
2820 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
2821 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
2822 offsetof(CPUARMState, cp15.ttbr1_ns) } },
2823 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
2824 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
2825 .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
2826 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
2827 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) },
2828 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
2829 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write,
2830 .raw_writefn = vmsa_ttbcr_raw_write,
2831 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]),
2832 offsetoflow32(CPUARMState, cp15.tcr_el[1])} },
2833 REGINFO_SENTINEL
2834 };
2835
2836 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri,
2837 uint64_t value)
2838 {
2839 env->cp15.c15_ticonfig = value & 0xe7;
2840 /* The OS_TYPE bit in this register changes the reported CPUID! */
2841 env->cp15.c0_cpuid = (value & (1 << 5)) ?
2842 ARM_CPUID_TI915T : ARM_CPUID_TI925T;
2843 }
2844
2845 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
2846 uint64_t value)
2847 {
2848 env->cp15.c15_threadid = value & 0xffff;
2849 }
2850
2851 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
2852 uint64_t value)
2853 {
2854 /* Wait-for-interrupt (deprecated) */
2855 cpu_interrupt(CPU(arm_env_get_cpu(env)), CPU_INTERRUPT_HALT);
2856 }
2857
2858 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
2859 uint64_t value)
2860 {
2861 /* On OMAP there are registers indicating the max/min index of dcache lines
2862 * containing a dirty line; cache flush operations have to reset these.
2863 */
2864 env->cp15.c15_i_max = 0x000;
2865 env->cp15.c15_i_min = 0xff0;
2866 }
2867
2868 static const ARMCPRegInfo omap_cp_reginfo[] = {
2869 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY,
2870 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE,
2871 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
2872 .resetvalue = 0, },
2873 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,
2874 .access = PL1_RW, .type = ARM_CP_NOP },
2875 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0,
2876 .access = PL1_RW,
2877 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0,
2878 .writefn = omap_ticonfig_write },
2879 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0,
2880 .access = PL1_RW,
2881 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, },
2882 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0,
2883 .access = PL1_RW, .resetvalue = 0xff0,
2884 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) },
2885 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0,
2886 .access = PL1_RW,
2887 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0,
2888 .writefn = omap_threadid_write },
2889 { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
2890 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
2891 .type = ARM_CP_NO_RAW,
2892 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
2893 /* TODO: Peripheral port remap register:
2894 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
2895 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
2896 * when MMU is off.
2897 */
2898 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
2899 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
2900 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW,
2901 .writefn = omap_cachemaint_write },
2902 { .name = "C9", .cp = 15, .crn = 9,
2903 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
2904 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
2905 REGINFO_SENTINEL
2906 };
2907
2908 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
2909 uint64_t value)
2910 {
2911 env->cp15.c15_cpar = value & 0x3fff;
2912 }
2913
2914 static const ARMCPRegInfo xscale_cp_reginfo[] = {
2915 { .name = "XSCALE_CPAR",
2916 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
2917 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
2918 .writefn = xscale_cpar_write, },
2919 { .name = "XSCALE_AUXCR",
2920 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
2921 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
2922 .resetvalue = 0, },
2923 /* XScale specific cache-lockdown: since we have no cache we NOP these
2924 * and hope the guest does not really rely on cache behaviour.
2925 */
2926 { .name = "XSCALE_LOCK_ICACHE_LINE",
2927 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
2928 .access = PL1_W, .type = ARM_CP_NOP },
2929 { .name = "XSCALE_UNLOCK_ICACHE",
2930 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
2931 .access = PL1_W, .type = ARM_CP_NOP },
2932 { .name = "XSCALE_DCACHE_LOCK",
2933 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
2934 .access = PL1_RW, .type = ARM_CP_NOP },
2935 { .name = "XSCALE_UNLOCK_DCACHE",
2936 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
2937 .access = PL1_W, .type = ARM_CP_NOP },
2938 REGINFO_SENTINEL
2939 };
2940
2941 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
2942 /* RAZ/WI the whole crn=15 space, when we don't have a more specific
2943 * implementation of this implementation-defined space.
2944 * Ideally this should eventually disappear in favour of actually
2945 * implementing the correct behaviour for all cores.
2946 */
2947 { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
2948 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
2949 .access = PL1_RW,
2950 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE,
2951 .resetvalue = 0 },
2952 REGINFO_SENTINEL
2953 };
2954
2955 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
2956 /* Cache status: RAZ because we have no cache so it's always clean */
2957 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
2958 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2959 .resetvalue = 0 },
2960 REGINFO_SENTINEL
2961 };
2962
2963 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
2964 /* We never have a a block transfer operation in progress */
2965 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
2966 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2967 .resetvalue = 0 },
2968 /* The cache ops themselves: these all NOP for QEMU */
2969 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
2970 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2971 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
2972 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2973 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
2974 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2975 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
2976 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2977 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
2978 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2979 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
2980 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2981 REGINFO_SENTINEL
2982 };
2983
2984 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
2985 /* The cache test-and-clean instructions always return (1 << 30)
2986 * to indicate that there are no dirty cache lines.
2987 */
2988 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
2989 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2990 .resetvalue = (1 << 30) },
2991 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
2992 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2993 .resetvalue = (1 << 30) },
2994 REGINFO_SENTINEL
2995 };
2996
2997 static const ARMCPRegInfo strongarm_cp_reginfo[] = {
2998 /* Ignore ReadBuffer accesses */
2999 { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
3000 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
3001 .access = PL1_RW, .resetvalue = 0,
3002 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW },
3003 REGINFO_SENTINEL
3004 };
3005
3006 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3007 {
3008 ARMCPU *cpu = arm_env_get_cpu(env);
3009 unsigned int cur_el = arm_current_el(env);
3010 bool secure = arm_is_secure(env);
3011
3012 if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
3013 return env->cp15.vpidr_el2;
3014 }
3015 return raw_read(env, ri);
3016 }
3017
3018 static uint64_t mpidr_read_val(CPUARMState *env)
3019 {
3020 ARMCPU *cpu = ARM_CPU(arm_env_get_cpu(env));
3021 uint64_t mpidr = cpu->mp_affinity;
3022
3023 if (arm_feature(env, ARM_FEATURE_V7MP)) {
3024 mpidr |= (1U << 31);
3025 /* Cores which are uniprocessor (non-coherent)
3026 * but still implement the MP extensions set
3027 * bit 30. (For instance, Cortex-R5).
3028 */
3029 if (cpu->mp_is_up) {
3030 mpidr |= (1u << 30);
3031 }
3032 }
3033 return mpidr;
3034 }
3035
3036 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3037 {
3038 unsigned int cur_el = arm_current_el(env);
3039 bool secure = arm_is_secure(env);
3040
3041 if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
3042 return env->cp15.vmpidr_el2;
3043 }
3044 return mpidr_read_val(env);
3045 }
3046
3047 static const ARMCPRegInfo mpidr_cp_reginfo[] = {
3048 { .name = "MPIDR", .state = ARM_CP_STATE_BOTH,
3049 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
3050 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
3051 REGINFO_SENTINEL
3052 };
3053
3054 static const ARMCPRegInfo lpae_cp_reginfo[] = {
3055 /* NOP AMAIR0/1 */
3056 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
3057 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
3058 .access = PL1_RW, .type = ARM_CP_CONST,
3059 .resetvalue = 0 },
3060 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
3061 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
3062 .access = PL1_RW, .type = ARM_CP_CONST,
3063 .resetvalue = 0 },
3064 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
3065 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0,
3066 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s),
3067 offsetof(CPUARMState, cp15.par_ns)} },
3068 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
3069 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3070 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
3071 offsetof(CPUARMState, cp15.ttbr0_ns) },
3072 .writefn = vmsa_ttbr_write, },
3073 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
3074 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3075 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
3076 offsetof(CPUARMState, cp15.ttbr1_ns) },
3077 .writefn = vmsa_ttbr_write, },
3078 REGINFO_SENTINEL
3079 };
3080
3081 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3082 {
3083 return vfp_get_fpcr(env);
3084 }
3085
3086 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3087 uint64_t value)
3088 {
3089 vfp_set_fpcr(env, value);
3090 }
3091
3092 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3093 {
3094 return vfp_get_fpsr(env);
3095 }
3096
3097 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3098 uint64_t value)
3099 {
3100 vfp_set_fpsr(env, value);
3101 }
3102
3103 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri,
3104 bool isread)
3105 {
3106 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
3107 return CP_ACCESS_TRAP;
3108 }
3109 return CP_ACCESS_OK;
3110 }
3111
3112 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri,
3113 uint64_t value)
3114 {
3115 env->daif = value & PSTATE_DAIF;
3116 }
3117
3118 static CPAccessResult aa64_cacheop_access(CPUARMState *env,
3119 const ARMCPRegInfo *ri,
3120 bool isread)
3121 {
3122 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
3123 * SCTLR_EL1.UCI is set.
3124 */
3125 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) {
3126 return CP_ACCESS_TRAP;
3127 }
3128 return CP_ACCESS_OK;
3129 }
3130
3131 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions
3132 * Page D4-1736 (DDI0487A.b)
3133 */
3134
3135 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3136 uint64_t value)
3137 {
3138 CPUState *cs = ENV_GET_CPU(env);
3139 bool sec = arm_is_secure_below_el3(env);
3140
3141 if (sec) {
3142 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3143 ARMMMUIdxBit_S1SE1 |
3144 ARMMMUIdxBit_S1SE0);
3145 } else {
3146 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3147 ARMMMUIdxBit_S12NSE1 |
3148 ARMMMUIdxBit_S12NSE0);
3149 }
3150 }
3151
3152 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3153 uint64_t value)
3154 {
3155 CPUState *cs = ENV_GET_CPU(env);
3156
3157 if (tlb_force_broadcast(env)) {
3158 tlbi_aa64_vmalle1_write(env, NULL, value);
3159 return;
3160 }
3161
3162 if (arm_is_secure_below_el3(env)) {
3163 tlb_flush_by_mmuidx(cs,
3164 ARMMMUIdxBit_S1SE1 |
3165 ARMMMUIdxBit_S1SE0);
3166 } else {
3167 tlb_flush_by_mmuidx(cs,
3168 ARMMMUIdxBit_S12NSE1 |
3169 ARMMMUIdxBit_S12NSE0);
3170 }
3171 }
3172
3173 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3174 uint64_t value)
3175 {
3176 /* Note that the 'ALL' scope must invalidate both stage 1 and
3177 * stage 2 translations, whereas most other scopes only invalidate
3178 * stage 1 translations.
3179 */
3180 ARMCPU *cpu = arm_env_get_cpu(env);
3181 CPUState *cs = CPU(cpu);
3182
3183 if (arm_is_secure_below_el3(env)) {
3184 tlb_flush_by_mmuidx(cs,
3185 ARMMMUIdxBit_S1SE1 |
3186 ARMMMUIdxBit_S1SE0);
3187 } else {
3188 if (arm_feature(env, ARM_FEATURE_EL2)) {
3189 tlb_flush_by_mmuidx(cs,
3190 ARMMMUIdxBit_S12NSE1 |
3191 ARMMMUIdxBit_S12NSE0 |
3192 ARMMMUIdxBit_S2NS);
3193 } else {
3194 tlb_flush_by_mmuidx(cs,
3195 ARMMMUIdxBit_S12NSE1 |
3196 ARMMMUIdxBit_S12NSE0);
3197 }
3198 }
3199 }
3200
3201 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
3202 uint64_t value)
3203 {
3204 ARMCPU *cpu = arm_env_get_cpu(env);
3205 CPUState *cs = CPU(cpu);
3206
3207 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
3208 }
3209
3210 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
3211 uint64_t value)
3212 {
3213 ARMCPU *cpu = arm_env_get_cpu(env);
3214 CPUState *cs = CPU(cpu);
3215
3216 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3);
3217 }
3218
3219 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3220 uint64_t value)
3221 {
3222 /* Note that the 'ALL' scope must invalidate both stage 1 and
3223 * stage 2 translations, whereas most other scopes only invalidate
3224 * stage 1 translations.
3225 */
3226 CPUState *cs = ENV_GET_CPU(env);
3227 bool sec = arm_is_secure_below_el3(env);
3228 bool has_el2 = arm_feature(env, ARM_FEATURE_EL2);
3229
3230 if (sec) {
3231 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3232 ARMMMUIdxBit_S1SE1 |
3233 ARMMMUIdxBit_S1SE0);
3234 } else if (has_el2) {
3235 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3236 ARMMMUIdxBit_S12NSE1 |
3237 ARMMMUIdxBit_S12NSE0 |
3238 ARMMMUIdxBit_S2NS);
3239 } else {
3240 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3241 ARMMMUIdxBit_S12NSE1 |
3242 ARMMMUIdxBit_S12NSE0);
3243 }
3244 }
3245
3246 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3247 uint64_t value)
3248 {
3249 CPUState *cs = ENV_GET_CPU(env);
3250
3251 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
3252 }
3253
3254 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3255 uint64_t value)
3256 {
3257 CPUState *cs = ENV_GET_CPU(env);
3258
3259 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3);
3260 }
3261
3262 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
3263 uint64_t value)
3264 {
3265 /* Invalidate by VA, EL2
3266 * Currently handles both VAE2 and VALE2, since we don't support
3267 * flush-last-level-only.
3268 */
3269 ARMCPU *cpu = arm_env_get_cpu(env);
3270 CPUState *cs = CPU(cpu);
3271 uint64_t pageaddr = sextract64(value << 12, 0, 56);
3272
3273 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
3274 }
3275
3276 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
3277 uint64_t value)
3278 {
3279 /* Invalidate by VA, EL3
3280 * Currently handles both VAE3 and VALE3, since we don't support
3281 * flush-last-level-only.
3282 */
3283 ARMCPU *cpu = arm_env_get_cpu(env);
3284 CPUState *cs = CPU(cpu);
3285 uint64_t pageaddr = sextract64(value << 12, 0, 56);
3286
3287 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3);
3288 }
3289
3290 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3291 uint64_t value)
3292 {
3293 ARMCPU *cpu = arm_env_get_cpu(env);
3294 CPUState *cs = CPU(cpu);
3295 bool sec = arm_is_secure_below_el3(env);
3296 uint64_t pageaddr = sextract64(value << 12, 0, 56);
3297
3298 if (sec) {
3299 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
3300 ARMMMUIdxBit_S1SE1 |
3301 ARMMMUIdxBit_S1SE0);
3302 } else {
3303 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
3304 ARMMMUIdxBit_S12NSE1 |
3305 ARMMMUIdxBit_S12NSE0);
3306 }
3307 }
3308
3309 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3310 uint64_t value)
3311 {
3312 /* Invalidate by VA, EL1&0 (AArch64 version).
3313 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1,
3314 * since we don't support flush-for-specific-ASID-only or
3315 * flush-last-level-only.
3316 */
3317 ARMCPU *cpu = arm_env_get_cpu(env);
3318 CPUState *cs = CPU(cpu);
3319 uint64_t pageaddr = sextract64(value << 12, 0, 56);
3320
3321 if (tlb_force_broadcast(env)) {
3322 tlbi_aa64_vae1is_write(env, NULL, value);
3323 return;
3324 }
3325
3326 if (arm_is_secure_below_el3(env)) {
3327 tlb_flush_page_by_mmuidx(cs, pageaddr,
3328 ARMMMUIdxBit_S1SE1 |
3329 ARMMMUIdxBit_S1SE0);
3330 } else {
3331 tlb_flush_page_by_mmuidx(cs, pageaddr,
3332 ARMMMUIdxBit_S12NSE1 |
3333 ARMMMUIdxBit_S12NSE0);
3334 }
3335 }
3336
3337 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3338 uint64_t value)
3339 {
3340 CPUState *cs = ENV_GET_CPU(env);
3341 uint64_t pageaddr = sextract64(value << 12, 0, 56);
3342
3343 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
3344 ARMMMUIdxBit_S1E2);
3345 }
3346
3347 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3348 uint64_t value)
3349 {
3350 CPUState *cs = ENV_GET_CPU(env);
3351 uint64_t pageaddr = sextract64(value << 12, 0, 56);
3352
3353 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
3354 ARMMMUIdxBit_S1E3);
3355 }
3356
3357 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3358 uint64_t value)
3359 {
3360 /* Invalidate by IPA. This has to invalidate any structures that
3361 * contain only stage 2 translation information, but does not need
3362 * to apply to structures that contain combined stage 1 and stage 2
3363 * translation information.
3364 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
3365 */
3366 ARMCPU *cpu = arm_env_get_cpu(env);
3367 CPUState *cs = CPU(cpu);
3368 uint64_t pageaddr;
3369
3370 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
3371 return;
3372 }
3373
3374 pageaddr = sextract64(value << 12, 0, 48);
3375
3376 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
3377 }
3378
3379 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3380 uint64_t value)
3381 {
3382 CPUState *cs = ENV_GET_CPU(env);
3383 uint64_t pageaddr;
3384
3385 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
3386 return;
3387 }
3388
3389 pageaddr = sextract64(value << 12, 0, 48);
3390
3391 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
3392 ARMMMUIdxBit_S2NS);
3393 }
3394
3395 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,
3396 bool isread)
3397 {
3398 /* We don't implement EL2, so the only control on DC ZVA is the
3399 * bit in the SCTLR which can prohibit access for EL0.
3400 */
3401 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) {
3402 return CP_ACCESS_TRAP;
3403 }
3404 return CP_ACCESS_OK;
3405 }
3406
3407 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri)
3408 {
3409 ARMCPU *cpu = arm_env_get_cpu(env);
3410 int dzp_bit = 1 << 4;
3411
3412 /* DZP indicates whether DC ZVA access is allowed */
3413 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) {
3414 dzp_bit = 0;
3415 }
3416 return cpu->dcz_blocksize | dzp_bit;
3417 }
3418
3419 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
3420 bool isread)
3421 {
3422 if (!(env->pstate & PSTATE_SP)) {
3423 /* Access to SP_EL0 is undefined if it's being used as
3424 * the stack pointer.
3425 */
3426 return CP_ACCESS_TRAP_UNCATEGORIZED;
3427 }
3428 return CP_ACCESS_OK;
3429 }
3430
3431 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri)
3432 {
3433 return env->pstate & PSTATE_SP;
3434 }
3435
3436 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
3437 {
3438 update_spsel(env, val);
3439 }
3440
3441 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3442 uint64_t value)
3443 {
3444 ARMCPU *cpu = arm_env_get_cpu(env);
3445
3446 if (raw_read(env, ri) == value) {
3447 /* Skip the TLB flush if nothing actually changed; Linux likes
3448 * to do a lot of pointless SCTLR writes.
3449 */
3450 return;
3451 }
3452
3453 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {
3454 /* M bit is RAZ/WI for PMSA with no MPU implemented */
3455 value &= ~SCTLR_M;
3456 }
3457
3458 raw_write(env, ri, value);
3459 /* ??? Lots of these bits are not implemented. */
3460 /* This may enable/disable the MMU, so do a TLB flush. */
3461 tlb_flush(CPU(cpu));
3462 }
3463
3464 static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri,
3465 bool isread)
3466 {
3467 if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) {
3468 return CP_ACCESS_TRAP_FP_EL2;
3469 }
3470 if (env->cp15.cptr_el[3] & CPTR_TFP) {
3471 return CP_ACCESS_TRAP_FP_EL3;
3472 }
3473 return CP_ACCESS_OK;
3474 }
3475
3476 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3477 uint64_t value)
3478 {
3479 env->cp15.mdcr_el3 = value & SDCR_VALID_MASK;
3480 }
3481
3482 static const ARMCPRegInfo v8_cp_reginfo[] = {
3483 /* Minimal set of EL0-visible registers. This will need to be expanded
3484 * significantly for system emulation of AArch64 CPUs.
3485 */
3486 { .name = "NZCV", .state = ARM_CP_STATE_AA64,
3487 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
3488 .access = PL0_RW, .type = ARM_CP_NZCV },
3489 { .name = "DAIF", .state = ARM_CP_STATE_AA64,
3490 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
3491 .type = ARM_CP_NO_RAW,
3492 .access = PL0_RW, .accessfn = aa64_daif_access,
3493 .fieldoffset = offsetof(CPUARMState, daif),
3494 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
3495 { .name = "FPCR", .state = ARM_CP_STATE_AA64,
3496 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
3497 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
3498 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
3499 { .name = "FPSR", .state = ARM_CP_STATE_AA64,
3500 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
3501 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
3502 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
3503 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
3504 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
3505 .access = PL0_R, .type = ARM_CP_NO_RAW,
3506 .readfn = aa64_dczid_read },
3507 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
3508 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
3509 .access = PL0_W, .type = ARM_CP_DC_ZVA,
3510 #ifndef CONFIG_USER_ONLY
3511 /* Avoid overhead of an access check that always passes in user-mode */
3512 .accessfn = aa64_zva_access,
3513 #endif
3514 },
3515 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
3516 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
3517 .access = PL1_R, .type = ARM_CP_CURRENTEL },
3518 /* Cache ops: all NOPs since we don't emulate caches */
3519 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
3520 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
3521 .access = PL1_W, .type = ARM_CP_NOP },
3522 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
3523 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
3524 .access = PL1_W, .type = ARM_CP_NOP },
3525 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
3526 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
3527 .access = PL0_W, .type = ARM_CP_NOP,
3528 .accessfn = aa64_cacheop_access },
3529 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
3530 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
3531 .access = PL1_W, .type = ARM_CP_NOP },
3532 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
3533 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
3534 .access = PL1_W, .type = ARM_CP_NOP },
3535 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
3536 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
3537 .access = PL0_W, .type = ARM_CP_NOP,
3538 .accessfn = aa64_cacheop_access },
3539 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
3540 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
3541 .access = PL1_W, .type = ARM_CP_NOP },
3542 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
3543 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
3544 .access = PL0_W, .type = ARM_CP_NOP,
3545 .accessfn = aa64_cacheop_access },
3546 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
3547 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
3548 .access = PL0_W, .type = ARM_CP_NOP,
3549 .accessfn = aa64_cacheop_access },
3550 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
3551 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
3552 .access = PL1_W, .type = ARM_CP_NOP },
3553 /* TLBI operations */
3554 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
3555 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
3556 .access = PL1_W, .type = ARM_CP_NO_RAW,
3557 .writefn = tlbi_aa64_vmalle1is_write },
3558 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
3559 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
3560 .access = PL1_W, .type = ARM_CP_NO_RAW,
3561 .writefn = tlbi_aa64_vae1is_write },
3562 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
3563 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
3564 .access = PL1_W, .type = ARM_CP_NO_RAW,
3565 .writefn = tlbi_aa64_vmalle1is_write },
3566 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
3567 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
3568 .access = PL1_W, .type = ARM_CP_NO_RAW,
3569 .writefn = tlbi_aa64_vae1is_write },
3570 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
3571 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
3572 .access = PL1_W, .type = ARM_CP_NO_RAW,
3573 .writefn = tlbi_aa64_vae1is_write },
3574 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
3575 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
3576 .access = PL1_W, .type = ARM_CP_NO_RAW,
3577 .writefn = tlbi_aa64_vae1is_write },
3578 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
3579 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
3580 .access = PL1_W, .type = ARM_CP_NO_RAW,
3581 .writefn = tlbi_aa64_vmalle1_write },
3582 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
3583 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
3584 .access = PL1_W, .type = ARM_CP_NO_RAW,
3585 .writefn = tlbi_aa64_vae1_write },
3586 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
3587 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
3588 .access = PL1_W, .type = ARM_CP_NO_RAW,
3589 .writefn = tlbi_aa64_vmalle1_write },
3590 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
3591 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
3592 .access = PL1_W, .type = ARM_CP_NO_RAW,
3593 .writefn = tlbi_aa64_vae1_write },
3594 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
3595 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
3596 .access = PL1_W, .type = ARM_CP_NO_RAW,
3597 .writefn = tlbi_aa64_vae1_write },
3598 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
3599 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
3600 .access = PL1_W, .type = ARM_CP_NO_RAW,
3601 .writefn = tlbi_aa64_vae1_write },
3602 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64,
3603 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
3604 .access = PL2_W, .type = ARM_CP_NO_RAW,
3605 .writefn = tlbi_aa64_ipas2e1is_write },
3606 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64,
3607 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
3608 .access = PL2_W, .type = ARM_CP_NO_RAW,
3609 .writefn = tlbi_aa64_ipas2e1is_write },
3610 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,
3611 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
3612 .access = PL2_W, .type = ARM_CP_NO_RAW,
3613 .writefn = tlbi_aa64_alle1is_write },
3614 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64,
3615 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6,
3616 .access = PL2_W, .type = ARM_CP_NO_RAW,
3617 .writefn = tlbi_aa64_alle1is_write },
3618 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64,
3619 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
3620 .access = PL2_W, .type = ARM_CP_NO_RAW,
3621 .writefn = tlbi_aa64_ipas2e1_write },
3622 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64,
3623 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
3624 .access = PL2_W, .type = ARM_CP_NO_RAW,
3625 .writefn = tlbi_aa64_ipas2e1_write },
3626 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,
3627 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
3628 .access = PL2_W, .type = ARM_CP_NO_RAW,
3629 .writefn = tlbi_aa64_alle1_write },
3630 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64,
3631 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6,
3632 .access = PL2_W, .type = ARM_CP_NO_RAW,
3633 .writefn = tlbi_aa64_alle1is_write },
3634 #ifndef CONFIG_USER_ONLY
3635 /* 64 bit address translation operations */
3636 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
3637 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
3638 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3639 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
3640 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
3641 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3642 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
3643 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
3644 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3645 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
3646 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
3647 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3648 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64,
3649 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4,
3650 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3651 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64,
3652 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5,
3653 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3654 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64,
3655 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6,
3656 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3657 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64,
3658 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7,
3659 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3660 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */
3661 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64,
3662 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0,
3663 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3664 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64,
3665 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1,
3666 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3667 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64,
3668 .type = ARM_CP_ALIAS,
3669 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0,
3670 .access = PL1_RW, .resetvalue = 0,
3671 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]),
3672 .writefn = par_write },
3673 #endif
3674 /* TLB invalidate last level of translation table walk */
3675 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
3676 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
3677 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
3678 .type = ARM_CP_NO_RAW, .access = PL1_W,
3679 .writefn = tlbimvaa_is_write },
3680 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
3681 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
3682 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
3683 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
3684 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
3685 .type = ARM_CP_NO_RAW, .access = PL2_W,
3686 .writefn = tlbimva_hyp_write },
3687 { .name = "TLBIMVALHIS",
3688 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
3689 .type = ARM_CP_NO_RAW, .access = PL2_W,
3690 .writefn = tlbimva_hyp_is_write },
3691 { .name = "TLBIIPAS2",
3692 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
3693 .type = ARM_CP_NO_RAW, .access = PL2_W,
3694 .writefn = tlbiipas2_write },
3695 { .name = "TLBIIPAS2IS",
3696 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
3697 .type = ARM_CP_NO_RAW, .access = PL2_W,
3698 .writefn = tlbiipas2_is_write },
3699 { .name = "TLBIIPAS2L",
3700 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
3701 .type = ARM_CP_NO_RAW, .access = PL2_W,
3702 .writefn = tlbiipas2_write },
3703 { .name = "TLBIIPAS2LIS",
3704 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
3705 .type = ARM_CP_NO_RAW, .access = PL2_W,
3706 .writefn = tlbiipas2_is_write },
3707 /* 32 bit cache operations */
3708 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
3709 .type = ARM_CP_NOP, .access = PL1_W },
3710 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
3711 .type = ARM_CP_NOP, .access = PL1_W },
3712 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
3713 .type = ARM_CP_NOP, .access = PL1_W },
3714 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
3715 .type = ARM_CP_NOP, .access = PL1_W },
3716 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
3717 .type = ARM_CP_NOP, .access = PL1_W },
3718 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
3719 .type = ARM_CP_NOP, .access = PL1_W },
3720 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
3721 .type = ARM_CP_NOP, .access = PL1_W },
3722 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
3723 .type = ARM_CP_NOP, .access = PL1_W },
3724 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
3725 .type = ARM_CP_NOP, .access = PL1_W },
3726 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
3727 .type = ARM_CP_NOP, .access = PL1_W },
3728 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
3729 .type = ARM_CP_NOP, .access = PL1_W },
3730 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
3731 .type = ARM_CP_NOP, .access = PL1_W },
3732 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
3733 .type = ARM_CP_NOP, .access = PL1_W },
3734 /* MMU Domain access control / MPU write buffer control */
3735 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
3736 .access = PL1_RW, .resetvalue = 0,
3737 .writefn = dacr_write, .raw_writefn = raw_write,
3738 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
3739 offsetoflow32(CPUARMState, cp15.dacr_ns) } },
3740 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
3741 .type = ARM_CP_ALIAS,
3742 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
3743 .access = PL1_RW,
3744 .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
3745 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
3746 .type = ARM_CP_ALIAS,
3747 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
3748 .access = PL1_RW,
3749 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) },
3750 /* We rely on the access checks not allowing the guest to write to the
3751 * state field when SPSel indicates that it's being used as the stack
3752 * pointer.
3753 */
3754 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
3755 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
3756 .access = PL1_RW, .accessfn = sp_el0_access,
3757 .type = ARM_CP_ALIAS,
3758 .fieldoffset = offsetof(CPUARMState, sp_el[0]) },
3759 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64,
3760 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0,
3761 .access = PL2_RW, .type = ARM_CP_ALIAS,
3762 .fieldoffset = offsetof(CPUARMState, sp_el[1]) },
3763 { .name = "SPSel", .state = ARM_CP_STATE_AA64,
3764 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
3765 .type = ARM_CP_NO_RAW,
3766 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
3767 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64,
3768 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0,
3769 .type = ARM_CP_ALIAS,
3770 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]),
3771 .access = PL2_RW, .accessfn = fpexc32_access },
3772 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64,
3773 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0,
3774 .access = PL2_RW, .resetvalue = 0,
3775 .writefn = dacr_write, .raw_writefn = raw_write,
3776 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) },
3777 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64,
3778 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1,
3779 .access = PL2_RW, .resetvalue = 0,
3780 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) },
3781 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64,
3782 .type = ARM_CP_ALIAS,
3783 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0,
3784 .access = PL2_RW,
3785 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) },
3786 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64,
3787 .type = ARM_CP_ALIAS,
3788 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1,
3789 .access = PL2_RW,
3790 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) },
3791 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64,
3792 .type = ARM_CP_ALIAS,
3793 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2,
3794 .access = PL2_RW,
3795 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) },
3796 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64,
3797 .type = ARM_CP_ALIAS,
3798 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3,
3799 .access = PL2_RW,
3800 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) },
3801 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64,
3802 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1,
3803 .resetvalue = 0,
3804 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) },
3805 { .name = "SDCR", .type = ARM_CP_ALIAS,
3806 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1,
3807 .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
3808 .writefn = sdcr_write,
3809 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
3810 REGINFO_SENTINEL
3811 };
3812
3813 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */
3814 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
3815 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
3816 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
3817 .access = PL2_RW,
3818 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
3819 { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH,
3820 .type = ARM_CP_NO_RAW,
3821 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
3822 .access = PL2_RW,
3823 .type = ARM_CP_CONST, .resetvalue = 0 },
3824 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
3825 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
3826 .access = PL2_RW,
3827 .type = ARM_CP_CONST, .resetvalue = 0 },
3828 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
3829 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
3830 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3831 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
3832 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
3833 .access = PL2_RW, .type = ARM_CP_CONST,
3834 .resetvalue = 0 },
3835 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
3836 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
3837 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3838 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
3839 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
3840 .access = PL2_RW, .type = ARM_CP_CONST,
3841 .resetvalue = 0 },
3842 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
3843 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
3844 .access = PL2_RW, .type = ARM_CP_CONST,
3845 .resetvalue = 0 },
3846 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
3847 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
3848 .access = PL2_RW, .type = ARM_CP_CONST,
3849 .resetvalue = 0 },
3850 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
3851 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
3852 .access = PL2_RW, .type = ARM_CP_CONST,
3853 .resetvalue = 0 },
3854 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
3855 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
3856 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3857 { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH,
3858 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
3859 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
3860 .type = ARM_CP_CONST, .resetvalue = 0 },
3861 { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
3862 .cp = 15, .opc1 = 6, .crm = 2,
3863 .access = PL2_RW, .accessfn = access_el3_aa32ns,
3864 .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
3865 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
3866 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
3867 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3868 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
3869 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
3870 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3871 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
3872 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
3873 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3874 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
3875 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
3876 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3877 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
3878 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
3879 .resetvalue = 0 },
3880 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
3881 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
3882 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3883 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
3884 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
3885 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3886 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
3887 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
3888 .resetvalue = 0 },
3889 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
3890 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
3891 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3892 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
3893 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
3894 .resetvalue = 0 },
3895 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
3896 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
3897 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3898 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
3899 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
3900 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3901 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
3902 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
3903 .access = PL2_RW, .accessfn = access_tda,
3904 .type = ARM_CP_CONST, .resetvalue = 0 },
3905 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH,
3906 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
3907 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
3908 .type = ARM_CP_CONST, .resetvalue = 0 },
3909 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
3910 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
3911 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3912 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
3913 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
3914 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3915 { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
3916 .type = ARM_CP_CONST,
3917 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
3918 .access = PL2_RW, .resetvalue = 0 },
3919 REGINFO_SENTINEL
3920 };
3921
3922 /* Ditto, but for registers which exist in ARMv8 but not v7 */
3923 static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {
3924 { .name = "HCR2", .state = ARM_CP_STATE_AA32,
3925 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
3926 .access = PL2_RW,
3927 .type = ARM_CP_CONST, .resetvalue = 0 },
3928 REGINFO_SENTINEL
3929 };
3930
3931 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
3932 {
3933 ARMCPU *cpu = arm_env_get_cpu(env);
3934 CPUState *cs = ENV_GET_CPU(env);
3935 uint64_t valid_mask = HCR_MASK;
3936
3937 if (arm_feature(env, ARM_FEATURE_EL3)) {
3938 valid_mask &= ~HCR_HCD;
3939 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
3940 /* Architecturally HCR.TSC is RES0 if EL3 is not implemented.
3941 * However, if we're using the SMC PSCI conduit then QEMU is
3942 * effectively acting like EL3 firmware and so the guest at
3943 * EL2 should retain the ability to prevent EL1 from being
3944 * able to make SMC calls into the ersatz firmware, so in
3945 * that case HCR.TSC should be read/write.
3946 */
3947 valid_mask &= ~HCR_TSC;
3948 }
3949
3950 /* Clear RES0 bits. */
3951 value &= valid_mask;
3952
3953 /*
3954 * VI and VF are kept in cs->interrupt_request. Modifying that
3955 * requires that we have the iothread lock, which is done by
3956 * marking the reginfo structs as ARM_CP_IO.
3957 * Note that if a write to HCR pends a VIRQ or VFIQ it is never
3958 * possible for it to be taken immediately, because VIRQ and
3959 * VFIQ are masked unless running at EL0 or EL1, and HCR
3960 * can only be written at EL2.
3961 */
3962 g_assert(qemu_mutex_iothread_locked());
3963 if (value & HCR_VI) {
3964 cs->interrupt_request |= CPU_INTERRUPT_VIRQ;
3965 } else {
3966 cs->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
3967 }
3968 if (value & HCR_VF) {
3969 cs->interrupt_request |= CPU_INTERRUPT_VFIQ;
3970 } else {
3971 cs->interrupt_request &= ~CPU_INTERRUPT_VFIQ;
3972 }
3973 value &= ~(HCR_VI | HCR_VF);
3974
3975 /* These bits change the MMU setup:
3976 * HCR_VM enables stage 2 translation
3977 * HCR_PTW forbids certain page-table setups
3978 * HCR_DC Disables stage1 and enables stage2 translation
3979 */
3980 if ((env->cp15.hcr_el2 ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) {
3981 tlb_flush(CPU(cpu));
3982 }
3983 env->cp15.hcr_el2 = value;
3984 }
3985
3986 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri,
3987 uint64_t value)
3988 {
3989 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */
3990 value = deposit64(env->cp15.hcr_el2, 32, 32, value);
3991 hcr_write(env, NULL, value);
3992 }
3993
3994 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
3995 uint64_t value)
3996 {
3997 /* Handle HCR write, i.e. write to low half of HCR_EL2 */
3998 value = deposit64(env->cp15.hcr_el2, 0, 32, value);
3999 hcr_write(env, NULL, value);
4000 }
4001
4002 static uint64_t hcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
4003 {
4004 /* The VI and VF bits live in cs->interrupt_request */
4005 uint64_t ret = env->cp15.hcr_el2 & ~(HCR_VI | HCR_VF);
4006 CPUState *cs = ENV_GET_CPU(env);
4007
4008 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
4009 ret |= HCR_VI;
4010 }
4011 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
4012 ret |= HCR_VF;
4013 }
4014 return ret;
4015 }
4016
4017 static const ARMCPRegInfo el2_cp_reginfo[] = {
4018 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
4019 .type = ARM_CP_IO,
4020 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4021 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
4022 .writefn = hcr_write, .readfn = hcr_read },
4023 { .name = "HCR", .state = ARM_CP_STATE_AA32,
4024 .type = ARM_CP_ALIAS | ARM_CP_IO,
4025 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4026 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
4027 .writefn = hcr_writelow, .readfn = hcr_read },
4028 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
4029 .type = ARM_CP_ALIAS,
4030 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
4031 .access = PL2_RW,
4032 .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
4033 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
4034 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
4035 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
4036 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
4037 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
4038 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
4039 { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
4040 .type = ARM_CP_ALIAS,
4041 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
4042 .access = PL2_RW,
4043 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) },
4044 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
4045 .type = ARM_CP_ALIAS,
4046 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
4047 .access = PL2_RW,
4048 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) },
4049 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
4050 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
4051 .access = PL2_RW, .writefn = vbar_write,
4052 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
4053 .resetvalue = 0 },
4054 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64,
4055 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0,
4056 .access = PL3_RW, .type = ARM_CP_ALIAS,
4057 .fieldoffset = offsetof(CPUARMState, sp_el[2]) },
4058 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
4059 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
4060 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0,
4061 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]) },
4062 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
4063 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
4064 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),
4065 .resetvalue = 0 },
4066 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
4067 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
4068 .access = PL2_RW, .type = ARM_CP_ALIAS,
4069 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },
4070 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
4071 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
4072 .access = PL2_RW, .type = ARM_CP_CONST,
4073 .resetvalue = 0 },
4074 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
4075 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
4076 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
4077 .access = PL2_RW, .type = ARM_CP_CONST,
4078 .resetvalue = 0 },
4079 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
4080 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
4081 .access = PL2_RW, .type = ARM_CP_CONST,
4082 .resetvalue = 0 },
4083 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
4084 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
4085 .access = PL2_RW, .type = ARM_CP_CONST,
4086 .resetvalue = 0 },
4087 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
4088 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
4089 .access = PL2_RW,
4090 /* no .writefn needed as this can't cause an ASID change;
4091 * no .raw_writefn or .resetfn needed as we never use mask/base_mask
4092 */
4093 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
4094 { .name = "VTCR", .state = ARM_CP_STATE_AA32,
4095 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4096 .type = ARM_CP_ALIAS,
4097 .access = PL2_RW, .accessfn = access_el3_aa32ns,
4098 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
4099 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
4100 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4101 .access = PL2_RW,
4102 /* no .writefn needed as this can't cause an ASID change;
4103 * no .raw_writefn or .resetfn needed as we never use mask/base_mask
4104 */
4105 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
4106 { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
4107 .cp = 15, .opc1 = 6, .crm = 2,
4108 .type = ARM_CP_64BIT | ARM_CP_ALIAS,
4109 .access = PL2_RW, .accessfn = access_el3_aa32ns,
4110 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2),
4111 .writefn = vttbr_write },
4112 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
4113 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
4114 .access = PL2_RW, .writefn = vttbr_write,
4115 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) },
4116 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
4117 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
4118 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
4119 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) },
4120 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4121 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
4122 .access = PL2_RW, .resetvalue = 0,
4123 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
4124 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
4125 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
4126 .access = PL2_RW, .resetvalue = 0,
4127 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
4128 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
4129 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
4130 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
4131 { .name = "TLBIALLNSNH",
4132 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
4133 .type = ARM_CP_NO_RAW, .access = PL2_W,
4134 .writefn = tlbiall_nsnh_write },
4135 { .name = "TLBIALLNSNHIS",
4136 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
4137 .type = ARM_CP_NO_RAW, .access = PL2_W,
4138 .writefn = tlbiall_nsnh_is_write },
4139 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
4140 .type = ARM_CP_NO_RAW, .access = PL2_W,
4141 .writefn = tlbiall_hyp_write },
4142 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
4143 .type = ARM_CP_NO_RAW, .access = PL2_W,
4144 .writefn = tlbiall_hyp_is_write },
4145 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
4146 .type = ARM_CP_NO_RAW, .access = PL2_W,
4147 .writefn = tlbimva_hyp_write },
4148 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
4149 .type = ARM_CP_NO_RAW, .access = PL2_W,
4150 .writefn = tlbimva_hyp_is_write },
4151 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64,
4152 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
4153 .type = ARM_CP_NO_RAW, .access = PL2_W,
4154 .writefn = tlbi_aa64_alle2_write },
4155 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64,
4156 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
4157 .type = ARM_CP_NO_RAW, .access = PL2_W,
4158 .writefn = tlbi_aa64_vae2_write },
4159 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64,
4160 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
4161 .access = PL2_W, .type = ARM_CP_NO_RAW,
4162 .writefn = tlbi_aa64_vae2_write },
4163 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64,
4164 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
4165 .access = PL2_W, .type = ARM_CP_NO_RAW,
4166 .writefn = tlbi_aa64_alle2is_write },
4167 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64,
4168 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
4169 .type = ARM_CP_NO_RAW, .access = PL2_W,
4170 .writefn = tlbi_aa64_vae2is_write },
4171 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64,
4172 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
4173 .access = PL2_W, .type = ARM_CP_NO_RAW,
4174 .writefn = tlbi_aa64_vae2is_write },
4175 #ifndef CONFIG_USER_ONLY
4176 /* Unlike the other EL2-related AT operations, these must
4177 * UNDEF from EL3 if EL2 is not implemented, which is why we
4178 * define them here rather than with the rest of the AT ops.
4179 */
4180 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64,
4181 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
4182 .access = PL2_W, .accessfn = at_s1e2_access,
4183 .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4184 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64,
4185 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
4186 .access = PL2_W, .accessfn = at_s1e2_access,
4187 .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4188 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
4189 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
4190 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
4191 * to behave as if SCR.NS was 1.
4192 */
4193 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
4194 .access = PL2_W,
4195 .writefn = ats1h_write, .type = ARM_CP_NO_RAW },
4196 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
4197 .access = PL2_W,
4198 .writefn = ats1h_write, .type = ARM_CP_NO_RAW },
4199 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
4200 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
4201 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the
4202 * reset values as IMPDEF. We choose to reset to 3 to comply with
4203 * both ARMv7 and ARMv8.
4204 */
4205 .access = PL2_RW, .resetvalue = 3,
4206 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) },
4207 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
4208 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
4209 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
4210 .writefn = gt_cntvoff_write,
4211 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
4212 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
4213 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO,
4214 .writefn = gt_cntvoff_write,
4215 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
4216 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
4217 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
4218 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
4219 .type = ARM_CP_IO, .access = PL2_RW,
4220 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
4221 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
4222 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
4223 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO,
4224 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
4225 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
4226 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
4227 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW,
4228 .resetfn = gt_hyp_timer_reset,
4229 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write },
4230 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
4231 .type = ARM_CP_IO,
4232 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
4233 .access = PL2_RW,
4234 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl),
4235 .resetvalue = 0,
4236 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
4237 #endif
4238 /* The only field of MDCR_EL2 that has a defined architectural reset value
4239 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we
4240 * don't impelment any PMU event counters, so using zero as a reset
4241 * value for MDCR_EL2 is okay
4242 */
4243 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
4244 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
4245 .access = PL2_RW, .resetvalue = 0,
4246 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), },
4247 { .name = "HPFAR", .state = ARM_CP_STATE_AA32,
4248 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
4249 .access = PL2_RW, .accessfn = access_el3_aa32ns,
4250 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
4251 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64,
4252 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
4253 .access = PL2_RW,
4254 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
4255 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
4256 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
4257 .access = PL2_RW,
4258 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) },
4259 REGINFO_SENTINEL
4260 };
4261
4262 static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
4263 { .name = "HCR2", .state = ARM_CP_STATE_AA32,
4264 .type = ARM_CP_ALIAS | ARM_CP_IO,
4265 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
4266 .access = PL2_RW,
4267 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
4268 .writefn = hcr_writehigh },
4269 REGINFO_SENTINEL
4270 };
4271
4272 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
4273 bool isread)
4274 {
4275 /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2.
4276 * At Secure EL1 it traps to EL3.
4277 */
4278 if (arm_current_el(env) == 3) {
4279 return CP_ACCESS_OK;
4280 }
4281 if (arm_is_secure_below_el3(env)) {
4282 return CP_ACCESS_TRAP_EL3;
4283 }
4284 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */
4285 if (isread) {
4286 return CP_ACCESS_OK;
4287 }
4288 return CP_ACCESS_TRAP_UNCATEGORIZED;
4289 }
4290
4291 static const ARMCPRegInfo el3_cp_reginfo[] = {
4292 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
4293 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
4294 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
4295 .resetvalue = 0, .writefn = scr_write },
4296 { .name = "SCR", .type = ARM_CP_ALIAS,
4297 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
4298 .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
4299 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
4300 .writefn = scr_write },
4301 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
4302 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
4303 .access = PL3_RW, .resetvalue = 0,
4304 .fieldoffset = offsetof(CPUARMState, cp15.sder) },
4305 { .name = "SDER",
4306 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1,
4307 .access = PL3_RW, .resetvalue = 0,
4308 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) },
4309 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
4310 .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
4311 .writefn = vbar_write, .resetvalue = 0,
4312 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) },
4313 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64,
4314 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0,
4315 .access = PL3_RW, .resetvalue = 0,
4316 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) },
4317 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
4318 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2,
4319 .access = PL3_RW,
4320 /* no .writefn needed as this can't cause an ASID change;
4321 * we must provide a .raw_writefn and .resetfn because we handle
4322 * reset and migration for the AArch32 TTBCR(S), which might be
4323 * using mask and base_mask.
4324 */
4325 .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write,
4326 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) },
4327 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
4328 .type = ARM_CP_ALIAS,
4329 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
4330 .access = PL3_RW,
4331 .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
4332 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
4333 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
4334 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) },
4335 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64,
4336 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0,
4337 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) },
4338 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
4339 .type = ARM_CP_ALIAS,
4340 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
4341 .access = PL3_RW,
4342 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) },
4343 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
4344 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
4345 .access = PL3_RW, .writefn = vbar_write,
4346 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
4347 .resetvalue = 0 },
4348 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64,
4349 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2,
4350 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0,
4351 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) },
4352 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64,
4353 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2,
4354 .access = PL3_RW, .resetvalue = 0,
4355 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) },
4356 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64,
4357 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0,
4358 .access = PL3_RW, .type = ARM_CP_CONST,
4359 .resetvalue = 0 },
4360 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH,
4361 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0,
4362 .access = PL3_RW, .type = ARM_CP_CONST,
4363 .resetvalue = 0 },
4364 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH,
4365 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1,
4366 .access = PL3_RW, .type = ARM_CP_CONST,
4367 .resetvalue = 0 },
4368 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64,
4369 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0,
4370 .access = PL3_W, .type = ARM_CP_NO_RAW,
4371 .writefn = tlbi_aa64_alle3is_write },
4372 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64,
4373 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1,
4374 .access = PL3_W, .type = ARM_CP_NO_RAW,
4375 .writefn = tlbi_aa64_vae3is_write },
4376 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64,
4377 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5,
4378 .access = PL3_W, .type = ARM_CP_NO_RAW,
4379 .writefn = tlbi_aa64_vae3is_write },
4380 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64,
4381 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0,
4382 .access = PL3_W, .type = ARM_CP_NO_RAW,
4383 .writefn = tlbi_aa64_alle3_write },
4384 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64,
4385 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1,
4386 .access = PL3_W, .type = ARM_CP_NO_RAW,
4387 .writefn = tlbi_aa64_vae3_write },
4388 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64,
4389 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5,
4390 .access = PL3_W, .type = ARM_CP_NO_RAW,
4391 .writefn = tlbi_aa64_vae3_write },
4392 REGINFO_SENTINEL
4393 };
4394
4395 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
4396 bool isread)
4397 {
4398 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
4399 * but the AArch32 CTR has its own reginfo struct)
4400 */
4401 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) {
4402 return CP_ACCESS_TRAP;
4403 }
4404 return CP_ACCESS_OK;
4405 }
4406
4407 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
4408 uint64_t value)
4409 {
4410 /* Writes to OSLAR_EL1 may update the OS lock status, which can be
4411 * read via a bit in OSLSR_EL1.
4412 */
4413 int oslock;
4414
4415 if (ri->state == ARM_CP_STATE_AA32) {
4416 oslock = (value == 0xC5ACCE55);
4417 } else {
4418 oslock = value & 1;
4419 }
4420
4421 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
4422 }
4423
4424 static const ARMCPRegInfo debug_cp_reginfo[] = {
4425 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
4426 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
4427 * unlike DBGDRAR it is never accessible from EL0.
4428 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
4429 * accessor.
4430 */
4431 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
4432 .access = PL0_R, .accessfn = access_tdra,
4433 .type = ARM_CP_CONST, .resetvalue = 0 },
4434 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
4435 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
4436 .access = PL1_R, .accessfn = access_tdra,
4437 .type = ARM_CP_CONST, .resetvalue = 0 },
4438 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
4439 .access = PL0_R, .accessfn = access_tdra,
4440 .type = ARM_CP_CONST, .resetvalue = 0 },
4441 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
4442 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
4443 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
4444 .access = PL1_RW, .accessfn = access_tda,
4445 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
4446 .resetvalue = 0 },
4447 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1.
4448 * We don't implement the configurable EL0 access.
4449 */
4450 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH,
4451 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
4452 .type = ARM_CP_ALIAS,
4453 .access = PL1_R, .accessfn = access_tda,
4454 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
4455 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
4456 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
4457 .access = PL1_W, .type = ARM_CP_NO_RAW,
4458 .accessfn = access_tdosa,
4459 .writefn = oslar_write },
4460 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
4461 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
4462 .access = PL1_R, .resetvalue = 10,
4463 .accessfn = access_tdosa,
4464 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
4465 /* Dummy OSDLR_EL1: 32-bit Linux will read this */
4466 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
4467 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
4468 .access = PL1_RW, .accessfn = access_tdosa,
4469 .type = ARM_CP_NOP },
4470 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
4471 * implement vector catch debug events yet.
4472 */
4473 { .name = "DBGVCR",
4474 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
4475 .access = PL1_RW, .accessfn = access_tda,
4476 .type = ARM_CP_NOP },
4477 /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
4478 * to save and restore a 32-bit guest's DBGVCR)
4479 */
4480 { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
4481 .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
4482 .access = PL2_RW, .accessfn = access_tda,
4483 .type = ARM_CP_NOP },
4484 /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications
4485 * Channel but Linux may try to access this register. The 32-bit
4486 * alias is DBGDCCINT.
4487 */
4488 { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
4489 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
4490 .access = PL1_RW, .accessfn = access_tda,
4491 .type = ARM_CP_NOP },
4492 REGINFO_SENTINEL
4493 };
4494
4495 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
4496 /* 64 bit access versions of the (dummy) debug registers */
4497 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
4498 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
4499 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
4500 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
4501 REGINFO_SENTINEL
4502 };
4503
4504 /* Return the exception level to which exceptions should be taken
4505 * via SVEAccessTrap. If an exception should be routed through
4506 * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should
4507 * take care of raising that exception.
4508 * C.f. the ARM pseudocode function CheckSVEEnabled.
4509 */
4510 int sve_exception_el(CPUARMState *env, int el)
4511 {
4512 #ifndef CONFIG_USER_ONLY
4513 if (el <= 1) {
4514 bool disabled = false;
4515
4516 /* The CPACR.ZEN controls traps to EL1:
4517 * 0, 2 : trap EL0 and EL1 accesses
4518 * 1 : trap only EL0 accesses
4519 * 3 : trap no accesses
4520 */
4521 if (!extract32(env->cp15.cpacr_el1, 16, 1)) {
4522 disabled = true;
4523 } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) {
4524 disabled = el == 0;
4525 }
4526 if (disabled) {
4527 /* route_to_el2 */
4528 return (arm_feature(env, ARM_FEATURE_EL2)
4529 && !arm_is_secure(env)
4530 && (env->cp15.hcr_el2 & HCR_TGE) ? 2 : 1);
4531 }
4532
4533 /* Check CPACR.FPEN. */
4534 if (!extract32(env->cp15.cpacr_el1, 20, 1)) {
4535 disabled = true;
4536 } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) {
4537 disabled = el == 0;
4538 }
4539 if (disabled) {
4540 return 0;
4541 }
4542 }
4543
4544 /* CPTR_EL2. Since TZ and TFP are positive,
4545 * they will be zero when EL2 is not present.
4546 */
4547 if (el <= 2 && !arm_is_secure_below_el3(env)) {
4548 if (env->cp15.cptr_el[2] & CPTR_TZ) {
4549 return 2;
4550 }
4551 if (env->cp15.cptr_el[2] & CPTR_TFP) {
4552 return 0;
4553 }
4554 }
4555
4556 /* CPTR_EL3. Since EZ is negative we must check for EL3. */
4557 if (arm_feature(env, ARM_FEATURE_EL3)
4558 && !(env->cp15.cptr_el[3] & CPTR_EZ)) {
4559 return 3;
4560 }
4561 #endif
4562 return 0;
4563 }
4564
4565 /*
4566 * Given that SVE is enabled, return the vector length for EL.
4567 */
4568 uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
4569 {
4570 ARMCPU *cpu = arm_env_get_cpu(env);
4571 uint32_t zcr_len = cpu->sve_max_vq - 1;
4572
4573 if (el <= 1) {
4574 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
4575 }
4576 if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
4577 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
4578 }
4579 if (el < 3 && arm_feature(env, ARM_FEATURE_EL3)) {
4580 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
4581 }
4582 return zcr_len;
4583 }
4584
4585 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4586 uint64_t value)
4587 {
4588 int cur_el = arm_current_el(env);
4589 int old_len = sve_zcr_len_for_el(env, cur_el);
4590 int new_len;
4591
4592 /* Bits other than [3:0] are RAZ/WI. */
4593 raw_write(env, ri, value & 0xf);
4594
4595 /*
4596 * Because we arrived here, we know both FP and SVE are enabled;
4597 * otherwise we would have trapped access to the ZCR_ELn register.
4598 */
4599 new_len = sve_zcr_len_for_el(env, cur_el);
4600 if (new_len < old_len) {
4601 aarch64_sve_narrow_vq(env, new_len + 1);
4602 }
4603 }
4604
4605 static const ARMCPRegInfo zcr_el1_reginfo = {
4606 .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
4607 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
4608 .access = PL1_RW, .type = ARM_CP_SVE,
4609 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
4610 .writefn = zcr_write, .raw_writefn = raw_write
4611 };
4612
4613 static const ARMCPRegInfo zcr_el2_reginfo = {
4614 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
4615 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
4616 .access = PL2_RW, .type = ARM_CP_SVE,
4617 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
4618 .writefn = zcr_write, .raw_writefn = raw_write
4619 };
4620
4621 static const ARMCPRegInfo zcr_no_el2_reginfo = {
4622 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
4623 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
4624 .access = PL2_RW, .type = ARM_CP_SVE,
4625 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore
4626 };
4627
4628 static const ARMCPRegInfo zcr_el3_reginfo = {
4629 .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
4630 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
4631 .access = PL3_RW, .type = ARM_CP_SVE,
4632 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
4633 .writefn = zcr_write, .raw_writefn = raw_write
4634 };
4635
4636 void hw_watchpoint_update(ARMCPU *cpu, int n)
4637 {
4638 CPUARMState *env = &cpu->env;
4639 vaddr len = 0;
4640 vaddr wvr = env->cp15.dbgwvr[n];
4641 uint64_t wcr = env->cp15.dbgwcr[n];
4642 int mask;
4643 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
4644
4645 if (env->cpu_watchpoint[n]) {
4646 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
4647 env->cpu_watchpoint[n] = NULL;
4648 }
4649
4650 if (!extract64(wcr, 0, 1)) {
4651 /* E bit clear : watchpoint disabled */
4652 return;
4653 }
4654
4655 switch (extract64(wcr, 3, 2)) {
4656 case 0:
4657 /* LSC 00 is reserved and must behave as if the wp is disabled */
4658 return;
4659 case 1:
4660 flags |= BP_MEM_READ;
4661 break;
4662 case 2:
4663 flags |= BP_MEM_WRITE;
4664 break;
4665 case 3:
4666 flags |= BP_MEM_ACCESS;
4667 break;
4668 }
4669
4670 /* Attempts to use both MASK and BAS fields simultaneously are
4671 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
4672 * thus generating a watchpoint for every byte in the masked region.
4673 */
4674 mask = extract64(wcr, 24, 4);
4675 if (mask == 1 || mask == 2) {
4676 /* Reserved values of MASK; we must act as if the mask value was
4677 * some non-reserved value, or as if the watchpoint were disabled.
4678 * We choose the latter.
4679 */
4680 return;
4681 } else if (mask) {
4682 /* Watchpoint covers an aligned area up to 2GB in size */
4683 len = 1ULL << mask;
4684 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
4685 * whether the watchpoint fires when the unmasked bits match; we opt
4686 * to generate the exceptions.
4687 */
4688 wvr &= ~(len - 1);
4689 } else {
4690 /* Watchpoint covers bytes defined by the byte address select bits */
4691 int bas = extract64(wcr, 5, 8);
4692 int basstart;
4693
4694 if (bas == 0) {
4695 /* This must act as if the watchpoint is disabled */
4696 return;
4697 }
4698
4699 if (extract64(wvr, 2, 1)) {
4700 /* Deprecated case of an only 4-aligned address. BAS[7:4] are
4701 * ignored, and BAS[3:0] define which bytes to watch.
4702 */
4703 bas &= 0xf;
4704 }
4705 /* The BAS bits are supposed to be programmed to indicate a contiguous
4706 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
4707 * we fire for each byte in the word/doubleword addressed by the WVR.
4708 * We choose to ignore any non-zero bits after the first range of 1s.
4709 */
4710 basstart = ctz32(bas);
4711 len = cto32(bas >> basstart);
4712 wvr += basstart;
4713 }
4714
4715 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
4716 &env->cpu_watchpoint[n]);
4717 }
4718
4719 void hw_watchpoint_update_all(ARMCPU *cpu)
4720 {
4721 int i;
4722 CPUARMState *env = &cpu->env;
4723
4724 /* Completely clear out existing QEMU watchpoints and our array, to
4725 * avoid possible stale entries following migration load.
4726 */
4727 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
4728 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
4729
4730 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
4731 hw_watchpoint_update(cpu, i);
4732 }
4733 }
4734
4735 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4736 uint64_t value)
4737 {
4738 ARMCPU *cpu = arm_env_get_cpu(env);
4739 int i = ri->crm;
4740
4741 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
4742 * register reads and behaves as if values written are sign extended.
4743 * Bits [1:0] are RES0.
4744 */
4745 value = sextract64(value, 0, 49) & ~3ULL;
4746
4747 raw_write(env, ri, value);
4748 hw_watchpoint_update(cpu, i);
4749 }
4750
4751 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4752 uint64_t value)
4753 {
4754 ARMCPU *cpu = arm_env_get_cpu(env);
4755 int i = ri->crm;
4756
4757 raw_write(env, ri, value);
4758 hw_watchpoint_update(cpu, i);
4759 }
4760
4761 void hw_breakpoint_update(ARMCPU *cpu, int n)
4762 {
4763 CPUARMState *env = &cpu->env;
4764 uint64_t bvr = env->cp15.dbgbvr[n];
4765 uint64_t bcr = env->cp15.dbgbcr[n];
4766 vaddr addr;
4767 int bt;
4768 int flags = BP_CPU;
4769
4770 if (env->cpu_breakpoint[n]) {
4771 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
4772 env->cpu_breakpoint[n] = NULL;
4773 }
4774
4775 if (!extract64(bcr, 0, 1)) {
4776 /* E bit clear : watchpoint disabled */
4777 return;
4778 }
4779
4780 bt = extract64(bcr, 20, 4);
4781
4782 switch (bt) {
4783 case 4: /* unlinked address mismatch (reserved if AArch64) */
4784 case 5: /* linked address mismatch (reserved if AArch64) */
4785 qemu_log_mask(LOG_UNIMP,
4786 "arm: address mismatch breakpoint types not implemented\n");
4787 return;
4788 case 0: /* unlinked address match */
4789 case 1: /* linked address match */
4790 {
4791 /* Bits [63:49] are hardwired to the value of bit [48]; that is,
4792 * we behave as if the register was sign extended. Bits [1:0] are
4793 * RES0. The BAS field is used to allow setting breakpoints on 16
4794 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether
4795 * a bp will fire if the addresses covered by the bp and the addresses
4796 * covered by the insn overlap but the insn doesn't start at the
4797 * start of the bp address range. We choose to require the insn and
4798 * the bp to have the same address. The constraints on writing to
4799 * BAS enforced in dbgbcr_write mean we have only four cases:
4800 * 0b0000 => no breakpoint
4801 * 0b0011 => breakpoint on addr
4802 * 0b1100 => breakpoint on addr + 2
4803 * 0b1111 => breakpoint on addr
4804 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
4805 */
4806 int bas = extract64(bcr, 5, 4);
4807 addr = sextract64(bvr, 0, 49) & ~3ULL;
4808 if (bas == 0) {
4809 return;
4810 }
4811 if (bas == 0xc) {
4812 addr += 2;
4813 }
4814 break;
4815 }
4816 case 2: /* unlinked context ID match */
4817 case 8: /* unlinked VMID match (reserved if no EL2) */
4818 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
4819 qemu_log_mask(LOG_UNIMP,
4820 "arm: unlinked context breakpoint types not implemented\n");
4821 return;
4822 case 9: /* linked VMID match (reserved if no EL2) */
4823 case 11: /* linked context ID and VMID match (reserved if no EL2) */
4824 case 3: /* linked context ID match */
4825 default:
4826 /* We must generate no events for Linked context matches (unless
4827 * they are linked to by some other bp/wp, which is handled in
4828 * updates for the linking bp/wp). We choose to also generate no events
4829 * for reserved values.
4830 */
4831 return;
4832 }
4833
4834 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
4835 }
4836
4837 void hw_breakpoint_update_all(ARMCPU *cpu)
4838 {
4839 int i;
4840 CPUARMState *env = &cpu->env;
4841
4842 /* Completely clear out existing QEMU breakpoints and our array, to
4843 * avoid possible stale entries following migration load.
4844 */
4845 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
4846 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
4847
4848 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
4849 hw_breakpoint_update(cpu, i);
4850 }
4851 }
4852
4853 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4854 uint64_t value)
4855 {
4856 ARMCPU *cpu = arm_env_get_cpu(env);
4857 int i = ri->crm;
4858
4859 raw_write(env, ri, value);
4860 hw_breakpoint_update(cpu, i);
4861 }
4862
4863 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4864 uint64_t value)
4865 {
4866 ARMCPU *cpu = arm_env_get_cpu(env);
4867 int i = ri->crm;
4868
4869 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
4870 * copy of BAS[0].
4871 */
4872 value = deposit64(value, 6, 1, extract64(value, 5, 1));
4873 value = deposit64(value, 8, 1, extract64(value, 7, 1));
4874
4875 raw_write(env, ri, value);
4876 hw_breakpoint_update(cpu, i);
4877 }
4878
4879 static void define_debug_regs(ARMCPU *cpu)
4880 {
4881 /* Define v7 and v8 architectural debug registers.
4882 * These are just dummy implementations for now.
4883 */
4884 int i;
4885 int wrps, brps, ctx_cmps;
4886 ARMCPRegInfo dbgdidr = {
4887 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
4888 .access = PL0_R, .accessfn = access_tda,
4889 .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr,
4890 };
4891
4892 /* Note that all these register fields hold "number of Xs minus 1". */
4893 brps = extract32(cpu->dbgdidr, 24, 4);
4894 wrps = extract32(cpu->dbgdidr, 28, 4);
4895 ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
4896
4897 assert(ctx_cmps <= brps);
4898
4899 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties
4900 * of the debug registers such as number of breakpoints;
4901 * check that if they both exist then they agree.
4902 */
4903 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
4904 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps);
4905 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps);
4906 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps);
4907 }
4908
4909 define_one_arm_cp_reg(cpu, &dbgdidr);
4910 define_arm_cp_regs(cpu, debug_cp_reginfo);
4911
4912 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
4913 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
4914 }
4915
4916 for (i = 0; i < brps + 1; i++) {
4917 ARMCPRegInfo dbgregs[] = {
4918 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH,
4919 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
4920 .access = PL1_RW, .accessfn = access_tda,
4921 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
4922 .writefn = dbgbvr_write, .raw_writefn = raw_write
4923 },
4924 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH,
4925 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
4926 .access = PL1_RW, .accessfn = access_tda,
4927 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
4928 .writefn = dbgbcr_write, .raw_writefn = raw_write
4929 },
4930 REGINFO_SENTINEL
4931 };
4932 define_arm_cp_regs(cpu, dbgregs);
4933 }
4934
4935 for (i = 0; i < wrps + 1; i++) {
4936 ARMCPRegInfo dbgregs[] = {
4937 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH,
4938 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
4939 .access = PL1_RW, .accessfn = access_tda,
4940 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
4941 .writefn = dbgwvr_write, .raw_writefn = raw_write
4942 },
4943 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH,
4944 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
4945 .access = PL1_RW, .accessfn = access_tda,
4946 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
4947 .writefn = dbgwcr_write, .raw_writefn = raw_write
4948 },
4949 REGINFO_SENTINEL
4950 };
4951 define_arm_cp_regs(cpu, dbgregs);
4952 }
4953 }
4954
4955 /* We don't know until after realize whether there's a GICv3
4956 * attached, and that is what registers the gicv3 sysregs.
4957 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1
4958 * at runtime.
4959 */
4960 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
4961 {
4962 ARMCPU *cpu = arm_env_get_cpu(env);
4963 uint64_t pfr1 = cpu->id_pfr1;
4964
4965 if (env->gicv3state) {
4966 pfr1 |= 1 << 28;
4967 }
4968 return pfr1;
4969 }
4970
4971 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri)
4972 {
4973 ARMCPU *cpu = arm_env_get_cpu(env);
4974 uint64_t pfr0 = cpu->isar.id_aa64pfr0;
4975
4976 if (env->gicv3state) {
4977 pfr0 |= 1 << 24;
4978 }
4979 return pfr0;
4980 }
4981
4982 void register_cp_regs_for_features(ARMCPU *cpu)
4983 {
4984 /* Register all the coprocessor registers based on feature bits */
4985 CPUARMState *env = &cpu->env;
4986 if (arm_feature(env, ARM_FEATURE_M)) {
4987 /* M profile has no coprocessor registers */
4988 return;
4989 }
4990
4991 define_arm_cp_regs(cpu, cp_reginfo);
4992 if (!arm_feature(env, ARM_FEATURE_V8)) {
4993 /* Must go early as it is full of wildcards that may be
4994 * overridden by later definitions.
4995 */
4996 define_arm_cp_regs(cpu, not_v8_cp_reginfo);
4997 }
4998
4999 if (arm_feature(env, ARM_FEATURE_V6)) {
5000 /* The ID registers all have impdef reset values */
5001 ARMCPRegInfo v6_idregs[] = {
5002 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
5003 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
5004 .access = PL1_R, .type = ARM_CP_CONST,
5005 .resetvalue = cpu->id_pfr0 },
5006 /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
5007 * the value of the GIC field until after we define these regs.
5008 */
5009 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
5010 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
5011 .access = PL1_R, .type = ARM_CP_NO_RAW,
5012 .readfn = id_pfr1_read,
5013 .writefn = arm_cp_write_ignore },
5014 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
5015 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
5016 .access = PL1_R, .type = ARM_CP_CONST,
5017 .resetvalue = cpu->id_dfr0 },
5018 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
5019 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
5020 .access = PL1_R, .type = ARM_CP_CONST,
5021 .resetvalue = cpu->id_afr0 },
5022 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
5023 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
5024 .access = PL1_R, .type = ARM_CP_CONST,
5025 .resetvalue = cpu->id_mmfr0 },
5026 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
5027 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
5028 .access = PL1_R, .type = ARM_CP_CONST,
5029 .resetvalue = cpu->id_mmfr1 },
5030 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
5031 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
5032 .access = PL1_R, .type = ARM_CP_CONST,
5033 .resetvalue = cpu->id_mmfr2 },
5034 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
5035 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
5036 .access = PL1_R, .type = ARM_CP_CONST,
5037 .resetvalue = cpu->id_mmfr3 },
5038 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
5039 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
5040 .access = PL1_R, .type = ARM_CP_CONST,
5041 .resetvalue = cpu->isar.id_isar0 },
5042 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
5043 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
5044 .access = PL1_R, .type = ARM_CP_CONST,
5045 .resetvalue = cpu->isar.id_isar1 },
5046 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
5047 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
5048 .access = PL1_R, .type = ARM_CP_CONST,
5049 .resetvalue = cpu->isar.id_isar2 },
5050 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
5051 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
5052 .access = PL1_R, .type = ARM_CP_CONST,
5053 .resetvalue = cpu->isar.id_isar3 },
5054 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
5055 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
5056 .access = PL1_R, .type = ARM_CP_CONST,
5057 .resetvalue = cpu->isar.id_isar4 },
5058 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
5059 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
5060 .access = PL1_R, .type = ARM_CP_CONST,
5061 .resetvalue = cpu->isar.id_isar5 },
5062 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
5063 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
5064 .access = PL1_R, .type = ARM_CP_CONST,
5065 .resetvalue = cpu->id_mmfr4 },
5066 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
5067 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
5068 .access = PL1_R, .type = ARM_CP_CONST,
5069 .resetvalue = cpu->isar.id_isar6 },
5070 REGINFO_SENTINEL
5071 };
5072 define_arm_cp_regs(cpu, v6_idregs);
5073 define_arm_cp_regs(cpu, v6_cp_reginfo);
5074 } else {
5075 define_arm_cp_regs(cpu, not_v6_cp_reginfo);
5076 }
5077 if (arm_feature(env, ARM_FEATURE_V6K)) {
5078 define_arm_cp_regs(cpu, v6k_cp_reginfo);
5079 }
5080 if (arm_feature(env, ARM_FEATURE_V7MP) &&
5081 !arm_feature(env, ARM_FEATURE_PMSA)) {
5082 define_arm_cp_regs(cpu, v7mp_cp_reginfo);
5083 }
5084 if (arm_feature(env, ARM_FEATURE_V7)) {
5085 /* v7 performance monitor control register: same implementor
5086 * field as main ID register, and we implement only the cycle
5087 * count register.
5088 */
5089 #ifndef CONFIG_USER_ONLY
5090 ARMCPRegInfo pmcr = {
5091 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
5092 .access = PL0_RW,
5093 .type = ARM_CP_IO | ARM_CP_ALIAS,
5094 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
5095 .accessfn = pmreg_access, .writefn = pmcr_write,
5096 .raw_writefn = raw_write,
5097 };
5098 ARMCPRegInfo pmcr64 = {
5099 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
5100 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
5101 .access = PL0_RW, .accessfn = pmreg_access,
5102 .type = ARM_CP_IO,
5103 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
5104 .resetvalue = cpu->midr & 0xff000000,
5105 .writefn = pmcr_write, .raw_writefn = raw_write,
5106 };
5107 define_one_arm_cp_reg(cpu, &pmcr);
5108 define_one_arm_cp_reg(cpu, &pmcr64);
5109 #endif
5110 ARMCPRegInfo clidr = {
5111 .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
5112 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
5113 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr
5114 };
5115 define_one_arm_cp_reg(cpu, &clidr);
5116 define_arm_cp_regs(cpu, v7_cp_reginfo);
5117 define_debug_regs(cpu);
5118 } else {
5119 define_arm_cp_regs(cpu, not_v7_cp_reginfo);
5120 }
5121 if (arm_feature(env, ARM_FEATURE_V8)) {
5122 /* AArch64 ID registers, which all have impdef reset values.
5123 * Note that within the ID register ranges the unused slots
5124 * must all RAZ, not UNDEF; future architecture versions may
5125 * define new registers here.
5126 */
5127 ARMCPRegInfo v8_idregs[] = {
5128 /* ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST because we don't
5129 * know the right value for the GIC field until after we
5130 * define these regs.
5131 */
5132 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
5133 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
5134 .access = PL1_R, .type = ARM_CP_NO_RAW,
5135 .readfn = id_aa64pfr0_read,
5136 .writefn = arm_cp_write_ignore },
5137 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
5138 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
5139 .access = PL1_R, .type = ARM_CP_CONST,
5140 .resetvalue = cpu->isar.id_aa64pfr1},
5141 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5142 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
5143 .access = PL1_R, .type = ARM_CP_CONST,
5144 .resetvalue = 0 },
5145 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5146 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
5147 .access = PL1_R, .type = ARM_CP_CONST,
5148 .resetvalue = 0 },
5149 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
5150 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
5151 .access = PL1_R, .type = ARM_CP_CONST,
5152 /* At present, only SVEver == 0 is defined anyway. */
5153 .resetvalue = 0 },
5154 { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5155 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
5156 .access = PL1_R, .type = ARM_CP_CONST,
5157 .resetvalue = 0 },
5158 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5159 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
5160 .access = PL1_R, .type = ARM_CP_CONST,
5161 .resetvalue = 0 },
5162 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5163 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
5164 .access = PL1_R, .type = ARM_CP_CONST,
5165 .resetvalue = 0 },
5166 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
5167 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
5168 .access = PL1_R, .type = ARM_CP_CONST,
5169 .resetvalue = cpu->id_aa64dfr0 },
5170 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
5171 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
5172 .access = PL1_R, .type = ARM_CP_CONST,
5173 .resetvalue = cpu->id_aa64dfr1 },
5174 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5175 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
5176 .access = PL1_R, .type = ARM_CP_CONST,
5177 .resetvalue = 0 },
5178 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5179 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
5180 .access = PL1_R, .type = ARM_CP_CONST,
5181 .resetvalue = 0 },
5182 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
5183 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
5184 .access = PL1_R, .type = ARM_CP_CONST,
5185 .resetvalue = cpu->id_aa64afr0 },
5186 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
5187 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
5188 .access = PL1_R, .type = ARM_CP_CONST,
5189 .resetvalue = cpu->id_aa64afr1 },
5190 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5191 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
5192 .access = PL1_R, .type = ARM_CP_CONST,
5193 .resetvalue = 0 },
5194 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5195 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
5196 .access = PL1_R, .type = ARM_CP_CONST,
5197 .resetvalue = 0 },
5198 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
5199 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
5200 .access = PL1_R, .type = ARM_CP_CONST,
5201 .resetvalue = cpu->isar.id_aa64isar0 },
5202 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
5203 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
5204 .access = PL1_R, .type = ARM_CP_CONST,
5205 .resetvalue = cpu->isar.id_aa64isar1 },
5206 { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5207 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
5208 .access = PL1_R, .type = ARM_CP_CONST,
5209 .resetvalue = 0 },
5210 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5211 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
5212 .access = PL1_R, .type = ARM_CP_CONST,
5213 .resetvalue = 0 },
5214 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5215 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
5216 .access = PL1_R, .type = ARM_CP_CONST,
5217 .resetvalue = 0 },
5218 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5219 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
5220 .access = PL1_R, .type = ARM_CP_CONST,
5221 .resetvalue = 0 },
5222 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5223 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
5224 .access = PL1_R, .type = ARM_CP_CONST,
5225 .resetvalue = 0 },
5226 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5227 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
5228 .access = PL1_R, .type = ARM_CP_CONST,
5229 .resetvalue = 0 },
5230 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
5231 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
5232 .access = PL1_R, .type = ARM_CP_CONST,
5233 .resetvalue = cpu->id_aa64mmfr0 },
5234 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
5235 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
5236 .access = PL1_R, .type = ARM_CP_CONST,
5237 .resetvalue = cpu->id_aa64mmfr1 },
5238 { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5239 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
5240 .access = PL1_R, .type = ARM_CP_CONST,
5241 .resetvalue = 0 },
5242 { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5243 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
5244 .access = PL1_R, .type = ARM_CP_CONST,
5245 .resetvalue = 0 },
5246 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5247 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
5248 .access = PL1_R, .type = ARM_CP_CONST,
5249 .resetvalue = 0 },
5250 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5251 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
5252 .access = PL1_R, .type = ARM_CP_CONST,
5253 .resetvalue = 0 },
5254 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5255 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
5256 .access = PL1_R, .type = ARM_CP_CONST,
5257 .resetvalue = 0 },
5258 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5259 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
5260 .access = PL1_R, .type = ARM_CP_CONST,
5261 .resetvalue = 0 },
5262 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
5263 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
5264 .access = PL1_R, .type = ARM_CP_CONST,
5265 .resetvalue = cpu->isar.mvfr0 },
5266 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
5267 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
5268 .access = PL1_R, .type = ARM_CP_CONST,
5269 .resetvalue = cpu->isar.mvfr1 },
5270 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
5271 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
5272 .access = PL1_R, .type = ARM_CP_CONST,
5273 .resetvalue = cpu->isar.mvfr2 },
5274 { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5275 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
5276 .access = PL1_R, .type = ARM_CP_CONST,
5277 .resetvalue = 0 },
5278 { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5279 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
5280 .access = PL1_R, .type = ARM_CP_CONST,
5281 .resetvalue = 0 },
5282 { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5283 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
5284 .access = PL1_R, .type = ARM_CP_CONST,
5285 .resetvalue = 0 },
5286 { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5287 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
5288 .access = PL1_R, .type = ARM_CP_CONST,
5289 .resetvalue = 0 },
5290 { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
5291 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
5292 .access = PL1_R, .type = ARM_CP_CONST,
5293 .resetvalue = 0 },
5294 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
5295 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
5296 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
5297 .resetvalue = cpu->pmceid0 },
5298 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64,
5299 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6,
5300 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
5301 .resetvalue = cpu->pmceid0 },
5302 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32,
5303 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7,
5304 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
5305 .resetvalue = cpu->pmceid1 },
5306 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64,
5307 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7,
5308 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
5309 .resetvalue = cpu->pmceid1 },
5310 REGINFO_SENTINEL
5311 };
5312 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */
5313 if (!arm_feature(env, ARM_FEATURE_EL3) &&
5314 !arm_feature(env, ARM_FEATURE_EL2)) {
5315 ARMCPRegInfo rvbar = {
5316 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
5317 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
5318 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
5319 };
5320 define_one_arm_cp_reg(cpu, &rvbar);
5321 }
5322 define_arm_cp_regs(cpu, v8_idregs);
5323 define_arm_cp_regs(cpu, v8_cp_reginfo);
5324 }
5325 if (arm_feature(env, ARM_FEATURE_EL2)) {
5326 uint64_t vmpidr_def = mpidr_read_val(env);
5327 ARMCPRegInfo vpidr_regs[] = {
5328 { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
5329 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
5330 .access = PL2_RW, .accessfn = access_el3_aa32ns,
5331 .resetvalue = cpu->midr, .type = ARM_CP_ALIAS,
5332 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) },
5333 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64,
5334 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
5335 .access = PL2_RW, .resetvalue = cpu->midr,
5336 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
5337 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32,
5338 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
5339 .access = PL2_RW, .accessfn = access_el3_aa32ns,
5340 .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS,
5341 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) },
5342 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64,
5343 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
5344 .access = PL2_RW,
5345 .resetvalue = vmpidr_def,
5346 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
5347 REGINFO_SENTINEL
5348 };
5349 define_arm_cp_regs(cpu, vpidr_regs);
5350 define_arm_cp_regs(cpu, el2_cp_reginfo);
5351 if (arm_feature(env, ARM_FEATURE_V8)) {
5352 define_arm_cp_regs(cpu, el2_v8_cp_reginfo);
5353 }
5354 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */
5355 if (!arm_feature(env, ARM_FEATURE_EL3)) {
5356 ARMCPRegInfo rvbar = {
5357 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
5358 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
5359 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar
5360 };
5361 define_one_arm_cp_reg(cpu, &rvbar);
5362 }
5363 } else {
5364 /* If EL2 is missing but higher ELs are enabled, we need to
5365 * register the no_el2 reginfos.
5366 */
5367 if (arm_feature(env, ARM_FEATURE_EL3)) {
5368 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value
5369 * of MIDR_EL1 and MPIDR_EL1.
5370 */
5371 ARMCPRegInfo vpidr_regs[] = {
5372 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH,
5373 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
5374 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
5375 .type = ARM_CP_CONST, .resetvalue = cpu->midr,
5376 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
5377 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH,
5378 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
5379 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
5380 .type = ARM_CP_NO_RAW,
5381 .writefn = arm_cp_write_ignore, .readfn = mpidr_read },
5382 REGINFO_SENTINEL
5383 };
5384 define_arm_cp_regs(cpu, vpidr_regs);
5385 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo);
5386 if (arm_feature(env, ARM_FEATURE_V8)) {
5387 define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo);
5388 }
5389 }
5390 }
5391 if (arm_feature(env, ARM_FEATURE_EL3)) {
5392 define_arm_cp_regs(cpu, el3_cp_reginfo);
5393 ARMCPRegInfo el3_regs[] = {
5394 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
5395 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
5396 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar },
5397 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
5398 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
5399 .access = PL3_RW,
5400 .raw_writefn = raw_write, .writefn = sctlr_write,
5401 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]),
5402 .resetvalue = cpu->reset_sctlr },
5403 REGINFO_SENTINEL
5404 };
5405
5406 define_arm_cp_regs(cpu, el3_regs);
5407 }
5408 /* The behaviour of NSACR is sufficiently various that we don't
5409 * try to describe it in a single reginfo:
5410 * if EL3 is 64 bit, then trap to EL3 from S EL1,
5411 * reads as constant 0xc00 from NS EL1 and NS EL2
5412 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2
5413 * if v7 without EL3, register doesn't exist
5414 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2
5415 */
5416 if (arm_feature(env, ARM_FEATURE_EL3)) {
5417 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
5418 ARMCPRegInfo nsacr = {
5419 .name = "NSACR", .type = ARM_CP_CONST,
5420 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
5421 .access = PL1_RW, .accessfn = nsacr_access,
5422 .resetvalue = 0xc00
5423 };
5424 define_one_arm_cp_reg(cpu, &nsacr);
5425 } else {
5426 ARMCPRegInfo nsacr = {
5427 .name = "NSACR",
5428 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
5429 .access = PL3_RW | PL1_R,
5430 .resetvalue = 0,
5431 .fieldoffset = offsetof(CPUARMState, cp15.nsacr)
5432 };
5433 define_one_arm_cp_reg(cpu, &nsacr);
5434 }
5435 } else {
5436 if (arm_feature(env, ARM_FEATURE_V8)) {
5437 ARMCPRegInfo nsacr = {
5438 .name = "NSACR", .type = ARM_CP_CONST,
5439 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
5440 .access = PL1_R,
5441 .resetvalue = 0xc00
5442 };
5443 define_one_arm_cp_reg(cpu, &nsacr);
5444 }
5445 }
5446
5447 if (arm_feature(env, ARM_FEATURE_PMSA)) {
5448 if (arm_feature(env, ARM_FEATURE_V6)) {
5449 /* PMSAv6 not implemented */
5450 assert(arm_feature(env, ARM_FEATURE_V7));
5451 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
5452 define_arm_cp_regs(cpu, pmsav7_cp_reginfo);
5453 } else {
5454 define_arm_cp_regs(cpu, pmsav5_cp_reginfo);
5455 }
5456 } else {
5457 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
5458 define_arm_cp_regs(cpu, vmsa_cp_reginfo);
5459 }
5460 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
5461 define_arm_cp_regs(cpu, t2ee_cp_reginfo);
5462 }
5463 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
5464 define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
5465 }
5466 if (arm_feature(env, ARM_FEATURE_VAPA)) {
5467 define_arm_cp_regs(cpu, vapa_cp_reginfo);
5468 }
5469 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) {
5470 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo);
5471 }
5472 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) {
5473 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo);
5474 }
5475 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) {
5476 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo);
5477 }
5478 if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
5479 define_arm_cp_regs(cpu, omap_cp_reginfo);
5480 }
5481 if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
5482 define_arm_cp_regs(cpu, strongarm_cp_reginfo);
5483 }
5484 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
5485 define_arm_cp_regs(cpu, xscale_cp_reginfo);
5486 }
5487 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
5488 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
5489 }
5490 if (arm_feature(env, ARM_FEATURE_LPAE)) {
5491 define_arm_cp_regs(cpu, lpae_cp_reginfo);
5492 }
5493 /* Slightly awkwardly, the OMAP and StrongARM cores need all of
5494 * cp15 crn=0 to be writes-ignored, whereas for other cores they should
5495 * be read-only (ie write causes UNDEF exception).
5496 */
5497 {
5498 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = {
5499 /* Pre-v8 MIDR space.
5500 * Note that the MIDR isn't a simple constant register because
5501 * of the TI925 behaviour where writes to another register can
5502 * cause the MIDR value to change.
5503 *
5504 * Unimplemented registers in the c15 0 0 0 space default to
5505 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
5506 * and friends override accordingly.
5507 */
5508 { .name = "MIDR",
5509 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
5510 .access = PL1_R, .resetvalue = cpu->midr,
5511 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
5512 .readfn = midr_read,
5513 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
5514 .type = ARM_CP_OVERRIDE },
5515 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
5516 { .name = "DUMMY",
5517 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY,
5518 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
5519 { .name = "DUMMY",
5520 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY,
5521 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
5522 { .name = "DUMMY",
5523 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY,
5524 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
5525 { .name = "DUMMY",
5526 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY,
5527 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
5528 { .name = "DUMMY",
5529 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
5530 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
5531 REGINFO_SENTINEL
5532 };
5533 ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
5534 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
5535 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0,
5536 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr,
5537 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
5538 .readfn = midr_read },
5539 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */
5540 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
5541 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
5542 .access = PL1_R, .resetvalue = cpu->midr },
5543 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
5544 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7,
5545 .access = PL1_R, .resetvalue = cpu->midr },
5546 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
5547 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
5548 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->revidr },
5549 REGINFO_SENTINEL
5550 };
5551 ARMCPRegInfo id_cp_reginfo[] = {
5552 /* These are common to v8 and pre-v8 */
5553 { .name = "CTR",
5554 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
5555 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
5556 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64,
5557 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0,
5558 .access = PL0_R, .accessfn = ctr_el0_access,
5559 .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
5560 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
5561 { .name = "TCMTR",
5562 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
5563 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
5564 REGINFO_SENTINEL
5565 };
5566 /* TLBTR is specific to VMSA */
5567 ARMCPRegInfo id_tlbtr_reginfo = {
5568 .name = "TLBTR",
5569 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
5570 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0,
5571 };
5572 /* MPUIR is specific to PMSA V6+ */
5573 ARMCPRegInfo id_mpuir_reginfo = {
5574 .name = "MPUIR",
5575 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
5576 .access = PL1_R, .type = ARM_CP_CONST,
5577 .resetvalue = cpu->pmsav7_dregion << 8
5578 };
5579 ARMCPRegInfo crn0_wi_reginfo = {
5580 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
5581 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
5582 .type = ARM_CP_NOP | ARM_CP_OVERRIDE
5583 };
5584 if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
5585 arm_feature(env, ARM_FEATURE_STRONGARM)) {
5586 ARMCPRegInfo *r;
5587 /* Register the blanket "writes ignored" value first to cover the
5588 * whole space. Then update the specific ID registers to allow write
5589 * access, so that they ignore writes rather than causing them to
5590 * UNDEF.
5591 */
5592 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
5593 for (r = id_pre_v8_midr_cp_reginfo;
5594 r->type != ARM_CP_SENTINEL; r++) {
5595 r->access = PL1_RW;
5596 }
5597 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
5598 r->access = PL1_RW;
5599 }
5600 id_mpuir_reginfo.access = PL1_RW;
5601 id_tlbtr_reginfo.access = PL1_RW;
5602 }
5603 if (arm_feature(env, ARM_FEATURE_V8)) {
5604 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
5605 } else {
5606 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
5607 }
5608 define_arm_cp_regs(cpu, id_cp_reginfo);
5609 if (!arm_feature(env, ARM_FEATURE_PMSA)) {
5610 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
5611 } else if (arm_feature(env, ARM_FEATURE_V7)) {
5612 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
5613 }
5614 }
5615
5616 if (arm_feature(env, ARM_FEATURE_MPIDR)) {
5617 define_arm_cp_regs(cpu, mpidr_cp_reginfo);
5618 }
5619
5620 if (arm_feature(env, ARM_FEATURE_AUXCR)) {
5621 ARMCPRegInfo auxcr_reginfo[] = {
5622 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH,
5623 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1,
5624 .access = PL1_RW, .type = ARM_CP_CONST,
5625 .resetvalue = cpu->reset_auxcr },
5626 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH,
5627 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1,
5628 .access = PL2_RW, .type = ARM_CP_CONST,
5629 .resetvalue = 0 },
5630 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64,
5631 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1,
5632 .access = PL3_RW, .type = ARM_CP_CONST,
5633 .resetvalue = 0 },
5634 REGINFO_SENTINEL
5635 };
5636 define_arm_cp_regs(cpu, auxcr_reginfo);
5637 if (arm_feature(env, ARM_FEATURE_V8)) {
5638 /* HACTLR2 maps to ACTLR_EL2[63:32] and is not in ARMv7 */
5639 ARMCPRegInfo hactlr2_reginfo = {
5640 .name = "HACTLR2", .state = ARM_CP_STATE_AA32,
5641 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3,
5642 .access = PL2_RW, .type = ARM_CP_CONST,
5643 .resetvalue = 0
5644 };
5645 define_one_arm_cp_reg(cpu, &hactlr2_reginfo);
5646 }
5647 }
5648
5649 if (arm_feature(env, ARM_FEATURE_CBAR)) {
5650 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
5651 /* 32 bit view is [31:18] 0...0 [43:32]. */
5652 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
5653 | extract64(cpu->reset_cbar, 32, 12);
5654 ARMCPRegInfo cbar_reginfo[] = {
5655 { .name = "CBAR",
5656 .type = ARM_CP_CONST,
5657 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
5658 .access = PL1_R, .resetvalue = cpu->reset_cbar },
5659 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
5660 .type = ARM_CP_CONST,
5661 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
5662 .access = PL1_R, .resetvalue = cbar32 },
5663 REGINFO_SENTINEL
5664 };
5665 /* We don't implement a r/w 64 bit CBAR currently */
5666 assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
5667 define_arm_cp_regs(cpu, cbar_reginfo);
5668 } else {
5669 ARMCPRegInfo cbar = {
5670 .name = "CBAR",
5671 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
5672 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar,
5673 .fieldoffset = offsetof(CPUARMState,
5674 cp15.c15_config_base_address)
5675 };
5676 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
5677 cbar.access = PL1_R;
5678 cbar.fieldoffset = 0;
5679 cbar.type = ARM_CP_CONST;
5680 }
5681 define_one_arm_cp_reg(cpu, &cbar);
5682 }
5683 }
5684
5685 if (arm_feature(env, ARM_FEATURE_VBAR)) {
5686 ARMCPRegInfo vbar_cp_reginfo[] = {
5687 { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
5688 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
5689 .access = PL1_RW, .writefn = vbar_write,
5690 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s),
5691 offsetof(CPUARMState, cp15.vbar_ns) },
5692 .resetvalue = 0 },
5693 REGINFO_SENTINEL
5694 };
5695 define_arm_cp_regs(cpu, vbar_cp_reginfo);
5696 }
5697
5698 /* Generic registers whose values depend on the implementation */
5699 {
5700 ARMCPRegInfo sctlr = {
5701 .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
5702 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
5703 .access = PL1_RW,
5704 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s),
5705 offsetof(CPUARMState, cp15.sctlr_ns) },
5706 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
5707 .raw_writefn = raw_write,
5708 };
5709 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
5710 /* Normally we would always end the TB on an SCTLR write, but Linux
5711 * arch/arm/mach-pxa/sleep.S expects two instructions following
5712 * an MMU enable to execute from cache. Imitate this behaviour.
5713 */
5714 sctlr.type |= ARM_CP_SUPPRESS_TB_END;
5715 }
5716 define_one_arm_cp_reg(cpu, &sctlr);
5717 }
5718
5719 if (cpu_isar_feature(aa64_sve, cpu)) {
5720 define_one_arm_cp_reg(cpu, &zcr_el1_reginfo);
5721 if (arm_feature(env, ARM_FEATURE_EL2)) {
5722 define_one_arm_cp_reg(cpu, &zcr_el2_reginfo);
5723 } else {
5724 define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo);
5725 }
5726 if (arm_feature(env, ARM_FEATURE_EL3)) {
5727 define_one_arm_cp_reg(cpu, &zcr_el3_reginfo);
5728 }
5729 }
5730 }
5731
5732 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
5733 {
5734 CPUState *cs = CPU(cpu);
5735 CPUARMState *env = &cpu->env;
5736
5737 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
5738 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
5739 aarch64_fpu_gdb_set_reg,
5740 34, "aarch64-fpu.xml", 0);
5741 } else if (arm_feature(env, ARM_FEATURE_NEON)) {
5742 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
5743 51, "arm-neon.xml", 0);
5744 } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
5745 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
5746 35, "arm-vfp3.xml", 0);
5747 } else if (arm_feature(env, ARM_FEATURE_VFP)) {
5748 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
5749 19, "arm-vfp.xml", 0);
5750 }
5751 gdb_register_coprocessor(cs, arm_gdb_get_sysreg, arm_gdb_set_sysreg,
5752 arm_gen_dynamic_xml(cs),
5753 "system-registers.xml", 0);
5754 }
5755
5756 /* Sort alphabetically by type name, except for "any". */
5757 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b)
5758 {
5759 ObjectClass *class_a = (ObjectClass *)a;
5760 ObjectClass *class_b = (ObjectClass *)b;
5761 const char *name_a, *name_b;
5762
5763 name_a = object_class_get_name(class_a);
5764 name_b = object_class_get_name(class_b);
5765 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) {
5766 return 1;
5767 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) {
5768 return -1;
5769 } else {
5770 return strcmp(name_a, name_b);
5771 }
5772 }
5773
5774 static void arm_cpu_list_entry(gpointer data, gpointer user_data)
5775 {
5776 ObjectClass *oc = data;
5777 CPUListState *s = user_data;
5778 const char *typename;
5779 char *name;
5780
5781 typename = object_class_get_name(oc);
5782 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU));
5783 (*s->cpu_fprintf)(s->file, " %s\n",
5784 name);
5785 g_free(name);
5786 }
5787
5788 void arm_cpu_list(FILE *f, fprintf_function cpu_fprintf)
5789 {
5790 CPUListState s = {
5791 .file = f,
5792 .cpu_fprintf = cpu_fprintf,
5793 };
5794 GSList *list;
5795
5796 list = object_class_get_list(TYPE_ARM_CPU, false);
5797 list = g_slist_sort(list, arm_cpu_list_compare);
5798 (*cpu_fprintf)(f, "Available CPUs:\n");
5799 g_slist_foreach(list, arm_cpu_list_entry, &s);
5800 g_slist_free(list);
5801 }
5802
5803 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
5804 {
5805 ObjectClass *oc = data;
5806 CpuDefinitionInfoList **cpu_list = user_data;
5807 CpuDefinitionInfoList *entry;
5808 CpuDefinitionInfo *info;
5809 const char *typename;
5810
5811 typename = object_class_get_name(oc);
5812 info = g_malloc0(sizeof(*info));
5813 info->name = g_strndup(typename,
5814 strlen(typename) - strlen("-" TYPE_ARM_CPU));
5815 info->q_typename = g_strdup(typename);
5816
5817 entry = g_malloc0(sizeof(*entry));
5818 entry->value = info;
5819 entry->next = *cpu_list;
5820 *cpu_list = entry;
5821 }
5822
5823 CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp)
5824 {
5825 CpuDefinitionInfoList *cpu_list = NULL;
5826 GSList *list;
5827
5828 list = object_class_get_list(TYPE_ARM_CPU, false);
5829 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list);
5830 g_slist_free(list);
5831
5832 return cpu_list;
5833 }
5834
5835 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
5836 void *opaque, int state, int secstate,
5837 int crm, int opc1, int opc2,
5838 const char *name)
5839 {
5840 /* Private utility function for define_one_arm_cp_reg_with_opaque():
5841 * add a single reginfo struct to the hash table.
5842 */
5843 uint32_t *key = g_new(uint32_t, 1);
5844 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
5845 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
5846 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
5847
5848 r2->name = g_strdup(name);
5849 /* Reset the secure state to the specific incoming state. This is
5850 * necessary as the register may have been defined with both states.
5851 */
5852 r2->secure = secstate;
5853
5854 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
5855 /* Register is banked (using both entries in array).
5856 * Overwriting fieldoffset as the array is only used to define
5857 * banked registers but later only fieldoffset is used.
5858 */
5859 r2->fieldoffset = r->bank_fieldoffsets[ns];
5860 }
5861
5862 if (state == ARM_CP_STATE_AA32) {
5863 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
5864 /* If the register is banked then we don't need to migrate or
5865 * reset the 32-bit instance in certain cases:
5866 *
5867 * 1) If the register has both 32-bit and 64-bit instances then we
5868 * can count on the 64-bit instance taking care of the
5869 * non-secure bank.
5870 * 2) If ARMv8 is enabled then we can count on a 64-bit version
5871 * taking care of the secure bank. This requires that separate
5872 * 32 and 64-bit definitions are provided.
5873 */
5874 if ((r->state == ARM_CP_STATE_BOTH && ns) ||
5875 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) {
5876 r2->type |= ARM_CP_ALIAS;
5877 }
5878 } else if ((secstate != r->secure) && !ns) {
5879 /* The register is not banked so we only want to allow migration of
5880 * the non-secure instance.
5881 */
5882 r2->type |= ARM_CP_ALIAS;
5883 }
5884
5885 if (r->state == ARM_CP_STATE_BOTH) {
5886 /* We assume it is a cp15 register if the .cp field is left unset.
5887 */
5888 if (r2->cp == 0) {
5889 r2->cp = 15;
5890 }
5891
5892 #ifdef HOST_WORDS_BIGENDIAN
5893 if (r2->fieldoffset) {
5894 r2->fieldoffset += sizeof(uint32_t);
5895 }
5896 #endif
5897 }
5898 }
5899 if (state == ARM_CP_STATE_AA64) {
5900 /* To allow abbreviation of ARMCPRegInfo
5901 * definitions, we treat cp == 0 as equivalent to
5902 * the value for "standard guest-visible sysreg".
5903 * STATE_BOTH definitions are also always "standard
5904 * sysreg" in their AArch64 view (the .cp value may
5905 * be non-zero for the benefit of the AArch32 view).
5906 */
5907 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
5908 r2->cp = CP_REG_ARM64_SYSREG_CP;
5909 }
5910 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
5911 r2->opc0, opc1, opc2);
5912 } else {
5913 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
5914 }
5915 if (opaque) {
5916 r2->opaque = opaque;
5917 }
5918 /* reginfo passed to helpers is correct for the actual access,
5919 * and is never ARM_CP_STATE_BOTH:
5920 */
5921 r2->state = state;
5922 /* Make sure reginfo passed to helpers for wildcarded regs
5923 * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
5924 */
5925 r2->crm = crm;
5926 r2->opc1 = opc1;
5927 r2->opc2 = opc2;
5928 /* By convention, for wildcarded registers only the first
5929 * entry is used for migration; the others are marked as
5930 * ALIAS so we don't try to transfer the register
5931 * multiple times. Special registers (ie NOP/WFI) are
5932 * never migratable and not even raw-accessible.
5933 */
5934 if ((r->type & ARM_CP_SPECIAL)) {
5935 r2->type |= ARM_CP_NO_RAW;
5936 }
5937 if (((r->crm == CP_ANY) && crm != 0) ||
5938 ((r->opc1 == CP_ANY) && opc1 != 0) ||
5939 ((r->opc2 == CP_ANY) && opc2 != 0)) {
5940 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
5941 }
5942
5943 /* Check that raw accesses are either forbidden or handled. Note that
5944 * we can't assert this earlier because the setup of fieldoffset for
5945 * banked registers has to be done first.
5946 */
5947 if (!(r2->type & ARM_CP_NO_RAW)) {
5948 assert(!raw_accessors_invalid(r2));
5949 }
5950
5951 /* Overriding of an existing definition must be explicitly
5952 * requested.
5953 */
5954 if (!(r->type & ARM_CP_OVERRIDE)) {
5955 ARMCPRegInfo *oldreg;
5956 oldreg = g_hash_table_lookup(cpu->cp_regs, key);
5957 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
5958 fprintf(stderr, "Register redefined: cp=%d %d bit "
5959 "crn=%d crm=%d opc1=%d opc2=%d, "
5960 "was %s, now %s\n", r2->cp, 32 + 32 * is64,
5961 r2->crn, r2->crm, r2->opc1, r2->opc2,
5962 oldreg->name, r2->name);
5963 g_assert_not_reached();
5964 }
5965 }
5966 g_hash_table_insert(cpu->cp_regs, key, r2);
5967 }
5968
5969
5970 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
5971 const ARMCPRegInfo *r, void *opaque)
5972 {
5973 /* Define implementations of coprocessor registers.
5974 * We store these in a hashtable because typically
5975 * there are less than 150 registers in a space which
5976 * is 16*16*16*8*8 = 262144 in size.
5977 * Wildcarding is supported for the crm, opc1 and opc2 fields.
5978 * If a register is defined twice then the second definition is
5979 * used, so this can be used to define some generic registers and
5980 * then override them with implementation specific variations.
5981 * At least one of the original and the second definition should
5982 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard
5983 * against accidental use.
5984 *
5985 * The state field defines whether the register is to be
5986 * visible in the AArch32 or AArch64 execution state. If the
5987 * state is set to ARM_CP_STATE_BOTH then we synthesise a
5988 * reginfo structure for the AArch32 view, which sees the lower
5989 * 32 bits of the 64 bit register.
5990 *
5991 * Only registers visible in AArch64 may set r->opc0; opc0 cannot
5992 * be wildcarded. AArch64 registers are always considered to be 64
5993 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
5994 * the register, if any.
5995 */
5996 int crm, opc1, opc2, state;
5997 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
5998 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
5999 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
6000 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
6001 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
6002 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
6003 /* 64 bit registers have only CRm and Opc1 fields */
6004 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
6005 /* op0 only exists in the AArch64 encodings */
6006 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0));
6007 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
6008 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT));
6009 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1
6010 * encodes a minimum access level for the register. We roll this
6011 * runtime check into our general permission check code, so check
6012 * here that the reginfo's specified permissions are strict enough
6013 * to encompass the generic architectural permission check.
6014 */
6015 if (r->state != ARM_CP_STATE_AA32) {
6016 int mask = 0;
6017 switch (r->opc1) {
6018 case 0: case 1: case 2:
6019 /* min_EL EL1 */
6020 mask = PL1_RW;
6021 break;
6022 case 3:
6023 /* min_EL EL0 */
6024 mask = PL0_RW;
6025 break;
6026 case 4:
6027 /* min_EL EL2 */
6028 mask = PL2_RW;
6029 break;
6030 case 5:
6031 /* unallocated encoding, so not possible */
6032 assert(false);
6033 break;
6034 case 6:
6035 /* min_EL EL3 */
6036 mask = PL3_RW;
6037 break;
6038 case 7:
6039 /* min_EL EL1, secure mode only (we don't check the latter) */
6040 mask = PL1_RW;
6041 break;
6042 default:
6043 /* broken reginfo with out-of-range opc1 */
6044 assert(false);
6045 break;
6046 }
6047 /* assert our permissions are not too lax (stricter is fine) */
6048 assert((r->access & ~mask) == 0);
6049 }
6050
6051 /* Check that the register definition has enough info to handle
6052 * reads and writes if they are permitted.
6053 */
6054 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) {
6055 if (r->access & PL3_R) {
6056 assert((r->fieldoffset ||
6057 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
6058 r->readfn);
6059 }
6060 if (r->access & PL3_W) {
6061 assert((r->fieldoffset ||
6062 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
6063 r->writefn);
6064 }
6065 }
6066 /* Bad type field probably means missing sentinel at end of reg list */
6067 assert(cptype_valid(r->type));
6068 for (crm = crmmin; crm <= crmmax; crm++) {
6069 for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
6070 for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
6071 for (state = ARM_CP_STATE_AA32;
6072 state <= ARM_CP_STATE_AA64; state++) {
6073 if (r->state != state && r->state != ARM_CP_STATE_BOTH) {
6074 continue;
6075 }
6076 if (state == ARM_CP_STATE_AA32) {
6077 /* Under AArch32 CP registers can be common
6078 * (same for secure and non-secure world) or banked.
6079 */
6080 char *name;
6081
6082 switch (r->secure) {
6083 case ARM_CP_SECSTATE_S:
6084 case ARM_CP_SECSTATE_NS:
6085 add_cpreg_to_hashtable(cpu, r, opaque, state,
6086 r->secure, crm, opc1, opc2,
6087 r->name);
6088 break;
6089 default:
6090 name = g_strdup_printf("%s_S", r->name);
6091 add_cpreg_to_hashtable(cpu, r, opaque, state,
6092 ARM_CP_SECSTATE_S,
6093 crm, opc1, opc2, name);
6094 g_free(name);
6095 add_cpreg_to_hashtable(cpu, r, opaque, state,
6096 ARM_CP_SECSTATE_NS,
6097 crm, opc1, opc2, r->name);
6098 break;
6099 }
6100 } else {
6101 /* AArch64 registers get mapped to non-secure instance
6102 * of AArch32 */
6103 add_cpreg_to_hashtable(cpu, r, opaque, state,
6104 ARM_CP_SECSTATE_NS,
6105 crm, opc1, opc2, r->name);
6106 }
6107 }
6108 }
6109 }
6110 }
6111 }
6112
6113 void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
6114 const ARMCPRegInfo *regs, void *opaque)
6115 {
6116 /* Define a whole list of registers */
6117 const ARMCPRegInfo *r;
6118 for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
6119 define_one_arm_cp_reg_with_opaque(cpu, r, opaque);
6120 }
6121 }
6122
6123 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
6124 {
6125 return g_hash_table_lookup(cpregs, &encoded_cp);
6126 }
6127
6128 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
6129 uint64_t value)
6130 {
6131 /* Helper coprocessor write function for write-ignore registers */
6132 }
6133
6134 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri)
6135 {
6136 /* Helper coprocessor write function for read-as-zero registers */
6137 return 0;
6138 }
6139
6140 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque)
6141 {
6142 /* Helper coprocessor reset function for do-nothing-on-reset registers */
6143 }
6144
6145 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type)
6146 {
6147 /* Return true if it is not valid for us to switch to
6148 * this CPU mode (ie all the UNPREDICTABLE cases in
6149 * the ARM ARM CPSRWriteByInstr pseudocode).
6150 */
6151
6152 /* Changes to or from Hyp via MSR and CPS are illegal. */
6153 if (write_type == CPSRWriteByInstr &&
6154 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP ||
6155 mode == ARM_CPU_MODE_HYP)) {
6156 return 1;
6157 }
6158
6159 switch (mode) {
6160 case ARM_CPU_MODE_USR:
6161 return 0;
6162 case ARM_CPU_MODE_SYS:
6163 case ARM_CPU_MODE_SVC:
6164 case ARM_CPU_MODE_ABT:
6165 case ARM_CPU_MODE_UND:
6166 case ARM_CPU_MODE_IRQ:
6167 case ARM_CPU_MODE_FIQ:
6168 /* Note that we don't implement the IMPDEF NSACR.RFR which in v7
6169 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.)
6170 */
6171 /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR
6172 * and CPS are treated as illegal mode changes.
6173 */
6174 if (write_type == CPSRWriteByInstr &&
6175 (env->cp15.hcr_el2 & HCR_TGE) &&
6176 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON &&
6177 !arm_is_secure_below_el3(env)) {
6178 return 1;
6179 }
6180 return 0;
6181 case ARM_CPU_MODE_HYP:
6182 return !arm_feature(env, ARM_FEATURE_EL2)
6183 || arm_current_el(env) < 2 || arm_is_secure(env);
6184 case ARM_CPU_MODE_MON:
6185 return arm_current_el(env) < 3;
6186 default:
6187 return 1;
6188 }
6189 }
6190
6191 uint32_t cpsr_read(CPUARMState *env)
6192 {
6193 int ZF;
6194 ZF = (env->ZF == 0);
6195 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
6196 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
6197 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
6198 | ((env->condexec_bits & 0xfc) << 8)
6199 | (env->GE << 16) | (env->daif & CPSR_AIF);
6200 }
6201
6202 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask,
6203 CPSRWriteType write_type)
6204 {
6205 uint32_t changed_daif;
6206
6207 if (mask & CPSR_NZCV) {
6208 env->ZF = (~val) & CPSR_Z;
6209 env->NF = val;
6210 env->CF = (val >> 29) & 1;
6211 env->VF = (val << 3) & 0x80000000;
6212 }
6213 if (mask & CPSR_Q)
6214 env->QF = ((val & CPSR_Q) != 0);
6215 if (mask & CPSR_T)
6216 env->thumb = ((val & CPSR_T) != 0);
6217 if (mask & CPSR_IT_0_1) {
6218 env->condexec_bits &= ~3;
6219 env->condexec_bits |= (val >> 25) & 3;
6220 }
6221 if (mask & CPSR_IT_2_7) {
6222 env->condexec_bits &= 3;
6223 env->condexec_bits |= (val >> 8) & 0xfc;
6224 }
6225 if (mask & CPSR_GE) {
6226 env->GE = (val >> 16) & 0xf;
6227 }
6228
6229 /* In a V7 implementation that includes the security extensions but does
6230 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control
6231 * whether non-secure software is allowed to change the CPSR_F and CPSR_A
6232 * bits respectively.
6233 *
6234 * In a V8 implementation, it is permitted for privileged software to
6235 * change the CPSR A/F bits regardless of the SCR.AW/FW bits.
6236 */
6237 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) &&
6238 arm_feature(env, ARM_FEATURE_EL3) &&
6239 !arm_feature(env, ARM_FEATURE_EL2) &&
6240 !arm_is_secure(env)) {
6241
6242 changed_daif = (env->daif ^ val) & mask;
6243
6244 if (changed_daif & CPSR_A) {
6245 /* Check to see if we are allowed to change the masking of async
6246 * abort exceptions from a non-secure state.
6247 */
6248 if (!(env->cp15.scr_el3 & SCR_AW)) {
6249 qemu_log_mask(LOG_GUEST_ERROR,
6250 "Ignoring attempt to switch CPSR_A flag from "
6251 "non-secure world with SCR.AW bit clear\n");
6252 mask &= ~CPSR_A;
6253 }
6254 }
6255
6256 if (changed_daif & CPSR_F) {
6257 /* Check to see if we are allowed to change the masking of FIQ
6258 * exceptions from a non-secure state.
6259 */
6260 if (!(env->cp15.scr_el3 & SCR_FW)) {
6261 qemu_log_mask(LOG_GUEST_ERROR,
6262 "Ignoring attempt to switch CPSR_F flag from "
6263 "non-secure world with SCR.FW bit clear\n");
6264 mask &= ~CPSR_F;
6265 }
6266
6267 /* Check whether non-maskable FIQ (NMFI) support is enabled.
6268 * If this bit is set software is not allowed to mask
6269 * FIQs, but is allowed to set CPSR_F to 0.
6270 */
6271 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) &&
6272 (val & CPSR_F)) {
6273 qemu_log_mask(LOG_GUEST_ERROR,
6274 "Ignoring attempt to enable CPSR_F flag "
6275 "(non-maskable FIQ [NMFI] support enabled)\n");
6276 mask &= ~CPSR_F;
6277 }
6278 }
6279 }
6280
6281 env->daif &= ~(CPSR_AIF & mask);
6282 env->daif |= val & CPSR_AIF & mask;
6283
6284 if (write_type != CPSRWriteRaw &&
6285 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) {
6286 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) {
6287 /* Note that we can only get here in USR mode if this is a
6288 * gdb stub write; for this case we follow the architectural
6289 * behaviour for guest writes in USR mode of ignoring an attempt
6290 * to switch mode. (Those are caught by translate.c for writes
6291 * triggered by guest instructions.)
6292 */
6293 mask &= ~CPSR_M;
6294 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) {
6295 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in
6296 * v7, and has defined behaviour in v8:
6297 * + leave CPSR.M untouched
6298 * + allow changes to the other CPSR fields
6299 * + set PSTATE.IL
6300 * For user changes via the GDB stub, we don't set PSTATE.IL,
6301 * as this would be unnecessarily harsh for a user error.
6302 */
6303 mask &= ~CPSR_M;
6304 if (write_type != CPSRWriteByGDBStub &&
6305 arm_feature(env, ARM_FEATURE_V8)) {
6306 mask |= CPSR_IL;
6307 val |= CPSR_IL;
6308 }
6309 qemu_log_mask(LOG_GUEST_ERROR,
6310 "Illegal AArch32 mode switch attempt from %s to %s\n",
6311 aarch32_mode_name(env->uncached_cpsr),
6312 aarch32_mode_name(val));
6313 } else {
6314 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n",
6315 write_type == CPSRWriteExceptionReturn ?
6316 "Exception return from AArch32" :
6317 "AArch32 mode switch from",
6318 aarch32_mode_name(env->uncached_cpsr),
6319 aarch32_mode_name(val), env->regs[15]);
6320 switch_mode(env, val & CPSR_M);
6321 }
6322 }
6323 mask &= ~CACHED_CPSR_BITS;
6324 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
6325 }
6326
6327 /* Sign/zero extend */
6328 uint32_t HELPER(sxtb16)(uint32_t x)
6329 {
6330 uint32_t res;
6331 res = (uint16_t)(int8_t)x;
6332 res |= (uint32_t)(int8_t)(x >> 16) << 16;
6333 return res;
6334 }
6335
6336 uint32_t HELPER(uxtb16)(uint32_t x)
6337 {
6338 uint32_t res;
6339 res = (uint16_t)(uint8_t)x;
6340 res |= (uint32_t)(uint8_t)(x >> 16) << 16;
6341 return res;
6342 }
6343
6344 int32_t HELPER(sdiv)(int32_t num, int32_t den)
6345 {
6346 if (den == 0)
6347 return 0;
6348 if (num == INT_MIN && den == -1)
6349 return INT_MIN;
6350 return num / den;
6351 }
6352
6353 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
6354 {
6355 if (den == 0)
6356 return 0;
6357 return num / den;
6358 }
6359
6360 uint32_t HELPER(rbit)(uint32_t x)
6361 {
6362 return revbit32(x);
6363 }
6364
6365 #if defined(CONFIG_USER_ONLY)
6366
6367 /* These should probably raise undefined insn exceptions. */
6368 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
6369 {
6370 ARMCPU *cpu = arm_env_get_cpu(env);
6371
6372 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg);
6373 }
6374
6375 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
6376 {
6377 ARMCPU *cpu = arm_env_get_cpu(env);
6378
6379 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg);
6380 return 0;
6381 }
6382
6383 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
6384 {
6385 /* translate.c should never generate calls here in user-only mode */
6386 g_assert_not_reached();
6387 }
6388
6389 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
6390 {
6391 /* translate.c should never generate calls here in user-only mode */
6392 g_assert_not_reached();
6393 }
6394
6395 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
6396 {
6397 /* The TT instructions can be used by unprivileged code, but in
6398 * user-only emulation we don't have the MPU.
6399 * Luckily since we know we are NonSecure unprivileged (and that in
6400 * turn means that the A flag wasn't specified), all the bits in the
6401 * register must be zero:
6402 * IREGION: 0 because IRVALID is 0
6403 * IRVALID: 0 because NS
6404 * S: 0 because NS
6405 * NSRW: 0 because NS
6406 * NSR: 0 because NS
6407 * RW: 0 because unpriv and A flag not set
6408 * R: 0 because unpriv and A flag not set
6409 * SRVALID: 0 because NS
6410 * MRVALID: 0 because unpriv and A flag not set
6411 * SREGION: 0 becaus SRVALID is 0
6412 * MREGION: 0 because MRVALID is 0
6413 */
6414 return 0;
6415 }
6416
6417 static void switch_mode(CPUARMState *env, int mode)
6418 {
6419 ARMCPU *cpu = arm_env_get_cpu(env);
6420
6421 if (mode != ARM_CPU_MODE_USR) {
6422 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n");
6423 }
6424 }
6425
6426 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
6427 uint32_t cur_el, bool secure)
6428 {
6429 return 1;
6430 }
6431
6432 void aarch64_sync_64_to_32(CPUARMState *env)
6433 {
6434 g_assert_not_reached();
6435 }
6436
6437 #else
6438
6439 static void switch_mode(CPUARMState *env, int mode)
6440 {
6441 int old_mode;
6442 int i;
6443
6444 old_mode = env->uncached_cpsr & CPSR_M;
6445 if (mode == old_mode)
6446 return;
6447
6448 if (old_mode == ARM_CPU_MODE_FIQ) {
6449 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
6450 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
6451 } else if (mode == ARM_CPU_MODE_FIQ) {
6452 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
6453 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
6454 }
6455
6456 i = bank_number(old_mode);
6457 env->banked_r13[i] = env->regs[13];
6458 env->banked_r14[i] = env->regs[14];
6459 env->banked_spsr[i] = env->spsr;
6460
6461 i = bank_number(mode);
6462 env->regs[13] = env->banked_r13[i];
6463 env->regs[14] = env->banked_r14[i];
6464 env->spsr = env->banked_spsr[i];
6465 }
6466
6467 /* Physical Interrupt Target EL Lookup Table
6468 *
6469 * [ From ARM ARM section G1.13.4 (Table G1-15) ]
6470 *
6471 * The below multi-dimensional table is used for looking up the target
6472 * exception level given numerous condition criteria. Specifically, the
6473 * target EL is based on SCR and HCR routing controls as well as the
6474 * currently executing EL and secure state.
6475 *
6476 * Dimensions:
6477 * target_el_table[2][2][2][2][2][4]
6478 * | | | | | +--- Current EL
6479 * | | | | +------ Non-secure(0)/Secure(1)
6480 * | | | +--------- HCR mask override
6481 * | | +------------ SCR exec state control
6482 * | +--------------- SCR mask override
6483 * +------------------ 32-bit(0)/64-bit(1) EL3
6484 *
6485 * The table values are as such:
6486 * 0-3 = EL0-EL3
6487 * -1 = Cannot occur
6488 *
6489 * The ARM ARM target EL table includes entries indicating that an "exception
6490 * is not taken". The two cases where this is applicable are:
6491 * 1) An exception is taken from EL3 but the SCR does not have the exception
6492 * routed to EL3.
6493 * 2) An exception is taken from EL2 but the HCR does not have the exception
6494 * routed to EL2.
6495 * In these two cases, the below table contain a target of EL1. This value is
6496 * returned as it is expected that the consumer of the table data will check
6497 * for "target EL >= current EL" to ensure the exception is not taken.
6498 *
6499 * SCR HCR
6500 * 64 EA AMO From
6501 * BIT IRQ IMO Non-secure Secure
6502 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3
6503 */
6504 static const int8_t target_el_table[2][2][2][2][2][4] = {
6505 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
6506 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},
6507 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
6508 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},},
6509 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
6510 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},
6511 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
6512 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},},
6513 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },},
6514 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},
6515 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },},
6516 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},},
6517 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
6518 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},
6519 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
6520 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},},
6521 };
6522
6523 /*
6524 * Determine the target EL for physical exceptions
6525 */
6526 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
6527 uint32_t cur_el, bool secure)
6528 {
6529 CPUARMState *env = cs->env_ptr;
6530 int rw;
6531 int scr;
6532 int hcr;
6533 int target_el;
6534 /* Is the highest EL AArch64? */
6535 int is64 = arm_feature(env, ARM_FEATURE_AARCH64);
6536
6537 if (arm_feature(env, ARM_FEATURE_EL3)) {
6538 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
6539 } else {
6540 /* Either EL2 is the highest EL (and so the EL2 register width
6541 * is given by is64); or there is no EL2 or EL3, in which case
6542 * the value of 'rw' does not affect the table lookup anyway.
6543 */
6544 rw = is64;
6545 }
6546
6547 switch (excp_idx) {
6548 case EXCP_IRQ:
6549 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ);
6550 hcr = arm_hcr_el2_imo(env);
6551 break;
6552 case EXCP_FIQ:
6553 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ);
6554 hcr = arm_hcr_el2_fmo(env);
6555 break;
6556 default:
6557 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA);
6558 hcr = arm_hcr_el2_amo(env);
6559 break;
6560 };
6561
6562 /* If HCR.TGE is set then HCR is treated as being 1 */
6563 hcr |= ((env->cp15.hcr_el2 & HCR_TGE) == HCR_TGE);
6564
6565 /* Perform a table-lookup for the target EL given the current state */
6566 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el];
6567
6568 assert(target_el > 0);
6569
6570 return target_el;
6571 }
6572
6573 static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
6574 ARMMMUIdx mmu_idx, bool ignfault)
6575 {
6576 CPUState *cs = CPU(cpu);
6577 CPUARMState *env = &cpu->env;
6578 MemTxAttrs attrs = {};
6579 MemTxResult txres;
6580 target_ulong page_size;
6581 hwaddr physaddr;
6582 int prot;
6583 ARMMMUFaultInfo fi = {};
6584 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
6585 int exc;
6586 bool exc_secure;
6587
6588 if (get_phys_addr(env, addr, MMU_DATA_STORE, mmu_idx, &physaddr,
6589 &attrs, &prot, &page_size, &fi, NULL)) {
6590 /* MPU/SAU lookup failed */
6591 if (fi.type == ARMFault_QEMU_SFault) {
6592 qemu_log_mask(CPU_LOG_INT,
6593 "...SecureFault with SFSR.AUVIOL during stacking\n");
6594 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
6595 env->v7m.sfar = addr;
6596 exc = ARMV7M_EXCP_SECURE;
6597 exc_secure = false;
6598 } else {
6599 qemu_log_mask(CPU_LOG_INT, "...MemManageFault with CFSR.MSTKERR\n");
6600 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK;
6601 exc = ARMV7M_EXCP_MEM;
6602 exc_secure = secure;
6603 }
6604 goto pend_fault;
6605 }
6606 address_space_stl_le(arm_addressspace(cs, attrs), physaddr, value,
6607 attrs, &txres);
6608 if (txres != MEMTX_OK) {
6609 /* BusFault trying to write the data */
6610 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n");
6611 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK;
6612 exc = ARMV7M_EXCP_BUS;
6613 exc_secure = false;
6614 goto pend_fault;
6615 }
6616 return true;
6617
6618 pend_fault:
6619 /* By pending the exception at this point we are making
6620 * the IMPDEF choice "overridden exceptions pended" (see the
6621 * MergeExcInfo() pseudocode). The other choice would be to not
6622 * pend them now and then make a choice about which to throw away
6623 * later if we have two derived exceptions.
6624 * The only case when we must not pend the exception but instead
6625 * throw it away is if we are doing the push of the callee registers
6626 * and we've already generated a derived exception. Even in this
6627 * case we will still update the fault status registers.
6628 */
6629 if (!ignfault) {
6630 armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure);
6631 }
6632 return false;
6633 }
6634
6635 static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
6636 ARMMMUIdx mmu_idx)
6637 {
6638 CPUState *cs = CPU(cpu);
6639 CPUARMState *env = &cpu->env;
6640 MemTxAttrs attrs = {};
6641 MemTxResult txres;
6642 target_ulong page_size;
6643 hwaddr physaddr;
6644 int prot;
6645 ARMMMUFaultInfo fi = {};
6646 bool secure = mmu_idx & ARM_MMU_IDX_M_S;
6647 int exc;
6648 bool exc_secure;
6649 uint32_t value;
6650
6651 if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr,
6652 &attrs, &prot, &page_size, &fi, NULL)) {
6653 /* MPU/SAU lookup failed */
6654 if (fi.type == ARMFault_QEMU_SFault) {
6655 qemu_log_mask(CPU_LOG_INT,
6656 "...SecureFault with SFSR.AUVIOL during unstack\n");
6657 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
6658 env->v7m.sfar = addr;
6659 exc = ARMV7M_EXCP_SECURE;
6660 exc_secure = false;
6661 } else {
6662 qemu_log_mask(CPU_LOG_INT,
6663 "...MemManageFault with CFSR.MUNSTKERR\n");
6664 env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK;
6665 exc = ARMV7M_EXCP_MEM;
6666 exc_secure = secure;
6667 }
6668 goto pend_fault;
6669 }
6670
6671 value = address_space_ldl(arm_addressspace(cs, attrs), physaddr,
6672 attrs, &txres);
6673 if (txres != MEMTX_OK) {
6674 /* BusFault trying to read the data */
6675 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n");
6676 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK;
6677 exc = ARMV7M_EXCP_BUS;
6678 exc_secure = false;
6679 goto pend_fault;
6680 }
6681
6682 *dest = value;
6683 return true;
6684
6685 pend_fault:
6686 /* By pending the exception at this point we are making
6687 * the IMPDEF choice "overridden exceptions pended" (see the
6688 * MergeExcInfo() pseudocode). The other choice would be to not
6689 * pend them now and then make a choice about which to throw away
6690 * later if we have two derived exceptions.
6691 */
6692 armv7m_nvic_set_pending(env->nvic, exc, exc_secure);
6693 return false;
6694 }
6695
6696 /* Write to v7M CONTROL.SPSEL bit for the specified security bank.
6697 * This may change the current stack pointer between Main and Process
6698 * stack pointers if it is done for the CONTROL register for the current
6699 * security state.
6700 */
6701 static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
6702 bool new_spsel,
6703 bool secstate)
6704 {
6705 bool old_is_psp = v7m_using_psp(env);
6706
6707 env->v7m.control[secstate] =
6708 deposit32(env->v7m.control[secstate],
6709 R_V7M_CONTROL_SPSEL_SHIFT,
6710 R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
6711
6712 if (secstate == env->v7m.secure) {
6713 bool new_is_psp = v7m_using_psp(env);
6714 uint32_t tmp;
6715
6716 if (old_is_psp != new_is_psp) {
6717 tmp = env->v7m.other_sp;
6718 env->v7m.other_sp = env->regs[13];
6719 env->regs[13] = tmp;
6720 }
6721 }
6722 }
6723
6724 /* Write to v7M CONTROL.SPSEL bit. This may change the current
6725 * stack pointer between Main and Process stack pointers.
6726 */
6727 static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
6728 {
6729 write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
6730 }
6731
6732 void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
6733 {
6734 /* Write a new value to v7m.exception, thus transitioning into or out
6735 * of Handler mode; this may result in a change of active stack pointer.
6736 */
6737 bool new_is_psp, old_is_psp = v7m_using_psp(env);
6738 uint32_t tmp;
6739
6740 env->v7m.exception = new_exc;
6741
6742 new_is_psp = v7m_using_psp(env);
6743
6744 if (old_is_psp != new_is_psp) {
6745 tmp = env->v7m.other_sp;
6746 env->v7m.other_sp = env->regs[13];
6747 env->regs[13] = tmp;
6748 }
6749 }
6750
6751 /* Switch M profile security state between NS and S */
6752 static void switch_v7m_security_state(CPUARMState *env, bool new_secstate)
6753 {
6754 uint32_t new_ss_msp, new_ss_psp;
6755
6756 if (env->v7m.secure == new_secstate) {
6757 return;
6758 }
6759
6760 /* All the banked state is accessed by looking at env->v7m.secure
6761 * except for the stack pointer; rearrange the SP appropriately.
6762 */
6763 new_ss_msp = env->v7m.other_ss_msp;
6764 new_ss_psp = env->v7m.other_ss_psp;
6765
6766 if (v7m_using_psp(env)) {
6767 env->v7m.other_ss_psp = env->regs[13];
6768 env->v7m.other_ss_msp = env->v7m.other_sp;
6769 } else {
6770 env->v7m.other_ss_msp = env->regs[13];
6771 env->v7m.other_ss_psp = env->v7m.other_sp;
6772 }
6773
6774 env->v7m.secure = new_secstate;
6775
6776 if (v7m_using_psp(env)) {
6777 env->regs[13] = new_ss_psp;
6778 env->v7m.other_sp = new_ss_msp;
6779 } else {
6780 env->regs[13] = new_ss_msp;
6781 env->v7m.other_sp = new_ss_psp;
6782 }
6783 }
6784
6785 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
6786 {
6787 /* Handle v7M BXNS:
6788 * - if the return value is a magic value, do exception return (like BX)
6789 * - otherwise bit 0 of the return value is the target security state
6790 */
6791 uint32_t min_magic;
6792
6793 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
6794 /* Covers FNC_RETURN and EXC_RETURN magic */
6795 min_magic = FNC_RETURN_MIN_MAGIC;
6796 } else {
6797 /* EXC_RETURN magic only */
6798 min_magic = EXC_RETURN_MIN_MAGIC;
6799 }
6800
6801 if (dest >= min_magic) {
6802 /* This is an exception return magic value; put it where
6803 * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT.
6804 * Note that if we ever add gen_ss_advance() singlestep support to
6805 * M profile this should count as an "instruction execution complete"
6806 * event (compare gen_bx_excret_final_code()).
6807 */
6808 env->regs[15] = dest & ~1;
6809 env->thumb = dest & 1;
6810 HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT);
6811 /* notreached */
6812 }
6813
6814 /* translate.c should have made BXNS UNDEF unless we're secure */
6815 assert(env->v7m.secure);
6816
6817 switch_v7m_security_state(env, dest & 1);
6818 env->thumb = 1;
6819 env->regs[15] = dest & ~1;
6820 }
6821
6822 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
6823 {
6824 /* Handle v7M BLXNS:
6825 * - bit 0 of the destination address is the target security state
6826 */
6827
6828 /* At this point regs[15] is the address just after the BLXNS */
6829 uint32_t nextinst = env->regs[15] | 1;
6830 uint32_t sp = env->regs[13] - 8;
6831 uint32_t saved_psr;
6832
6833 /* translate.c will have made BLXNS UNDEF unless we're secure */
6834 assert(env->v7m.secure);
6835
6836 if (dest & 1) {
6837 /* target is Secure, so this is just a normal BLX,
6838 * except that the low bit doesn't indicate Thumb/not.
6839 */
6840 env->regs[14] = nextinst;
6841 env->thumb = 1;
6842 env->regs[15] = dest & ~1;
6843 return;
6844 }
6845
6846 /* Target is non-secure: first push a stack frame */
6847 if (!QEMU_IS_ALIGNED(sp, 8)) {
6848 qemu_log_mask(LOG_GUEST_ERROR,
6849 "BLXNS with misaligned SP is UNPREDICTABLE\n");
6850 }
6851
6852 if (sp < v7m_sp_limit(env)) {
6853 raise_exception(env, EXCP_STKOF, 0, 1);
6854 }
6855
6856 saved_psr = env->v7m.exception;
6857 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
6858 saved_psr |= XPSR_SFPA;
6859 }
6860
6861 /* Note that these stores can throw exceptions on MPU faults */
6862 cpu_stl_data(env, sp, nextinst);
6863 cpu_stl_data(env, sp + 4, saved_psr);
6864
6865 env->regs[13] = sp;
6866 env->regs[14] = 0xfeffffff;
6867 if (arm_v7m_is_handler_mode(env)) {
6868 /* Write a dummy value to IPSR, to avoid leaking the current secure
6869 * exception number to non-secure code. This is guaranteed not
6870 * to cause write_v7m_exception() to actually change stacks.
6871 */
6872 write_v7m_exception(env, 1);
6873 }
6874 switch_v7m_security_state(env, 0);
6875 env->thumb = 1;
6876 env->regs[15] = dest;
6877 }
6878
6879 static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
6880 bool spsel)
6881 {
6882 /* Return a pointer to the location where we currently store the
6883 * stack pointer for the requested security state and thread mode.
6884 * This pointer will become invalid if the CPU state is updated
6885 * such that the stack pointers are switched around (eg changing
6886 * the SPSEL control bit).
6887 * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
6888 * Unlike that pseudocode, we require the caller to pass us in the
6889 * SPSEL control bit value; this is because we also use this
6890 * function in handling of pushing of the callee-saves registers
6891 * part of the v8M stack frame (pseudocode PushCalleeStack()),
6892 * and in the tailchain codepath the SPSEL bit comes from the exception
6893 * return magic LR value from the previous exception. The pseudocode
6894 * opencodes the stack-selection in PushCalleeStack(), but we prefer
6895 * to make this utility function generic enough to do the job.
6896 */
6897 bool want_psp = threadmode && spsel;
6898
6899 if (secure == env->v7m.secure) {
6900 if (want_psp == v7m_using_psp(env)) {
6901 return &env->regs[13];
6902 } else {
6903 return &env->v7m.other_sp;
6904 }
6905 } else {
6906 if (want_psp) {
6907 return &env->v7m.other_ss_psp;
6908 } else {
6909 return &env->v7m.other_ss_msp;
6910 }
6911 }
6912 }
6913
6914 static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
6915 uint32_t *pvec)
6916 {
6917 CPUState *cs = CPU(cpu);
6918 CPUARMState *env = &cpu->env;
6919 MemTxResult result;
6920 uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4;
6921 uint32_t vector_entry;
6922 MemTxAttrs attrs = {};
6923 ARMMMUIdx mmu_idx;
6924 bool exc_secure;
6925
6926 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
6927
6928 /* We don't do a get_phys_addr() here because the rules for vector
6929 * loads are special: they always use the default memory map, and
6930 * the default memory map permits reads from all addresses.
6931 * Since there's no easy way to pass through to pmsav8_mpu_lookup()
6932 * that we want this special case which would always say "yes",
6933 * we just do the SAU lookup here followed by a direct physical load.
6934 */
6935 attrs.secure = targets_secure;
6936 attrs.user = false;
6937
6938 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
6939 V8M_SAttributes sattrs = {};
6940
6941 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs);
6942 if (sattrs.ns) {
6943 attrs.secure = false;
6944 } else if (!targets_secure) {
6945 /* NS access to S memory */
6946 goto load_fail;
6947 }
6948 }
6949
6950 vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
6951 attrs, &result);
6952 if (result != MEMTX_OK) {
6953 goto load_fail;
6954 }
6955 *pvec = vector_entry;
6956 return true;
6957
6958 load_fail:
6959 /* All vector table fetch fails are reported as HardFault, with
6960 * HFSR.VECTTBL and .FORCED set. (FORCED is set because
6961 * technically the underlying exception is a MemManage or BusFault
6962 * that is escalated to HardFault.) This is a terminal exception,
6963 * so we will either take the HardFault immediately or else enter
6964 * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
6965 */
6966 exc_secure = targets_secure ||
6967 !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
6968 env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
6969 armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
6970 return false;
6971 }
6972
6973 static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
6974 bool ignore_faults)
6975 {
6976 /* For v8M, push the callee-saves register part of the stack frame.
6977 * Compare the v8M pseudocode PushCalleeStack().
6978 * In the tailchaining case this may not be the current stack.
6979 */
6980 CPUARMState *env = &cpu->env;
6981 uint32_t *frame_sp_p;
6982 uint32_t frameptr;
6983 ARMMMUIdx mmu_idx;
6984 bool stacked_ok;
6985 uint32_t limit;
6986 bool want_psp;
6987
6988 if (dotailchain) {
6989 bool mode = lr & R_V7M_EXCRET_MODE_MASK;
6990 bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) ||
6991 !mode;
6992
6993 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
6994 frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,
6995 lr & R_V7M_EXCRET_SPSEL_MASK);
6996 want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
6997 if (want_psp) {
6998 limit = env->v7m.psplim[M_REG_S];
6999 } else {
7000 limit = env->v7m.msplim[M_REG_S];
7001 }
7002 } else {
7003 mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
7004 frame_sp_p = &env->regs[13];
7005 limit = v7m_sp_limit(env);
7006 }
7007
7008 frameptr = *frame_sp_p - 0x28;
7009 if (frameptr < limit) {
7010 /*
7011 * Stack limit failure: set SP to the limit value, and generate
7012 * STKOF UsageFault. Stack pushes below the limit must not be
7013 * performed. It is IMPDEF whether pushes above the limit are
7014 * performed; we choose not to.
7015 */
7016 qemu_log_mask(CPU_LOG_INT,
7017 "...STKOF during callee-saves register stacking\n");
7018 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
7019 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
7020 env->v7m.secure);
7021 *frame_sp_p = limit;
7022 return true;
7023 }
7024
7025 /* Write as much of the stack frame as we can. A write failure may
7026 * cause us to pend a derived exception.
7027 */
7028 stacked_ok =
7029 v7m_stack_write(cpu, frameptr, 0xfefa125b, mmu_idx, ignore_faults) &&
7030 v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx,
7031 ignore_faults) &&
7032 v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx,
7033 ignore_faults) &&
7034 v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx,
7035 ignore_faults) &&
7036 v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx,
7037 ignore_faults) &&
7038 v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx,
7039 ignore_faults) &&
7040 v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx,
7041 ignore_faults) &&
7042 v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx,
7043 ignore_faults) &&
7044 v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx,
7045 ignore_faults);
7046
7047 /* Update SP regardless of whether any of the stack accesses failed. */
7048 *frame_sp_p = frameptr;
7049
7050 return !stacked_ok;
7051 }
7052
7053 static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
7054 bool ignore_stackfaults)
7055 {
7056 /* Do the "take the exception" parts of exception entry,
7057 * but not the pushing of state to the stack. This is
7058 * similar to the pseudocode ExceptionTaken() function.
7059 */
7060 CPUARMState *env = &cpu->env;
7061 uint32_t addr;
7062 bool targets_secure;
7063 int exc;
7064 bool push_failed = false;
7065
7066 armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure);
7067 qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n",
7068 targets_secure ? "secure" : "nonsecure", exc);
7069
7070 if (arm_feature(env, ARM_FEATURE_V8)) {
7071 if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
7072 (lr & R_V7M_EXCRET_S_MASK)) {
7073 /* The background code (the owner of the registers in the
7074 * exception frame) is Secure. This means it may either already
7075 * have or now needs to push callee-saves registers.
7076 */
7077 if (targets_secure) {
7078 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
7079 /* We took an exception from Secure to NonSecure
7080 * (which means the callee-saved registers got stacked)
7081 * and are now tailchaining to a Secure exception.
7082 * Clear DCRS so eventual return from this Secure
7083 * exception unstacks the callee-saved registers.
7084 */
7085 lr &= ~R_V7M_EXCRET_DCRS_MASK;
7086 }
7087 } else {
7088 /* We're going to a non-secure exception; push the
7089 * callee-saves registers to the stack now, if they're
7090 * not already saved.
7091 */
7092 if (lr & R_V7M_EXCRET_DCRS_MASK &&
7093 !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) {
7094 push_failed = v7m_push_callee_stack(cpu, lr, dotailchain,
7095 ignore_stackfaults);
7096 }
7097 lr |= R_V7M_EXCRET_DCRS_MASK;
7098 }
7099 }
7100
7101 lr &= ~R_V7M_EXCRET_ES_MASK;
7102 if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) {
7103 lr |= R_V7M_EXCRET_ES_MASK;
7104 }
7105 lr &= ~R_V7M_EXCRET_SPSEL_MASK;
7106 if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
7107 lr |= R_V7M_EXCRET_SPSEL_MASK;
7108 }
7109
7110 /* Clear registers if necessary to prevent non-secure exception
7111 * code being able to see register values from secure code.
7112 * Where register values become architecturally UNKNOWN we leave
7113 * them with their previous values.
7114 */
7115 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
7116 if (!targets_secure) {
7117 /* Always clear the caller-saved registers (they have been
7118 * pushed to the stack earlier in v7m_push_stack()).
7119 * Clear callee-saved registers if the background code is
7120 * Secure (in which case these regs were saved in
7121 * v7m_push_callee_stack()).
7122 */
7123 int i;
7124
7125 for (i = 0; i < 13; i++) {
7126 /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */
7127 if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) {
7128 env->regs[i] = 0;
7129 }
7130 }
7131 /* Clear EAPSR */
7132 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
7133 }
7134 }
7135 }
7136
7137 if (push_failed && !ignore_stackfaults) {
7138 /* Derived exception on callee-saves register stacking:
7139 * we might now want to take a different exception which
7140 * targets a different security state, so try again from the top.
7141 */
7142 qemu_log_mask(CPU_LOG_INT,
7143 "...derived exception on callee-saves register stacking");
7144 v7m_exception_taken(cpu, lr, true, true);
7145 return;
7146 }
7147
7148 if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) {
7149 /* Vector load failed: derived exception */
7150 qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load");
7151 v7m_exception_taken(cpu, lr, true, true);
7152 return;
7153 }
7154
7155 /* Now we've done everything that might cause a derived exception
7156 * we can go ahead and activate whichever exception we're going to
7157 * take (which might now be the derived exception).
7158 */
7159 armv7m_nvic_acknowledge_irq(env->nvic);
7160
7161 /* Switch to target security state -- must do this before writing SPSEL */
7162 switch_v7m_security_state(env, targets_secure);
7163 write_v7m_control_spsel(env, 0);
7164 arm_clear_exclusive(env);
7165 /* Clear IT bits */
7166 env->condexec_bits = 0;
7167 env->regs[14] = lr;
7168 env->regs[15] = addr & 0xfffffffe;
7169 env->thumb = addr & 1;
7170 }
7171
7172 static bool v7m_push_stack(ARMCPU *cpu)
7173 {
7174 /* Do the "set up stack frame" part of exception entry,
7175 * similar to pseudocode PushStack().
7176 * Return true if we generate a derived exception (and so
7177 * should ignore further stack faults trying to process
7178 * that derived exception.)
7179 */
7180 bool stacked_ok;
7181 CPUARMState *env = &cpu->env;
7182 uint32_t xpsr = xpsr_read(env);
7183 uint32_t frameptr = env->regs[13];
7184 ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
7185
7186 /* Align stack pointer if the guest wants that */
7187 if ((frameptr & 4) &&
7188 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) {
7189 frameptr -= 4;
7190 xpsr |= XPSR_SPREALIGN;
7191 }
7192
7193 frameptr -= 0x20;
7194
7195 if (arm_feature(env, ARM_FEATURE_V8)) {
7196 uint32_t limit = v7m_sp_limit(env);
7197
7198 if (frameptr < limit) {
7199 /*
7200 * Stack limit failure: set SP to the limit value, and generate
7201 * STKOF UsageFault. Stack pushes below the limit must not be
7202 * performed. It is IMPDEF whether pushes above the limit are
7203 * performed; we choose not to.
7204 */
7205 qemu_log_mask(CPU_LOG_INT,
7206 "...STKOF during stacking\n");
7207 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
7208 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
7209 env->v7m.secure);
7210 env->regs[13] = limit;
7211 return true;
7212 }
7213 }
7214
7215 /* Write as much of the stack frame as we can. If we fail a stack
7216 * write this will result in a derived exception being pended
7217 * (which may be taken in preference to the one we started with
7218 * if it has higher priority).
7219 */
7220 stacked_ok =
7221 v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, false) &&
7222 v7m_stack_write(cpu, frameptr + 4, env->regs[1], mmu_idx, false) &&
7223 v7m_stack_write(cpu, frameptr + 8, env->regs[2], mmu_idx, false) &&
7224 v7m_stack_write(cpu, frameptr + 12, env->regs[3], mmu_idx, false) &&
7225 v7m_stack_write(cpu, frameptr + 16, env->regs[12], mmu_idx, false) &&
7226 v7m_stack_write(cpu, frameptr + 20, env->regs[14], mmu_idx, false) &&
7227 v7m_stack_write(cpu, frameptr + 24, env->regs[15], mmu_idx, false) &&
7228 v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, false);
7229
7230 /* Update SP regardless of whether any of the stack accesses failed. */
7231 env->regs[13] = frameptr;
7232
7233 return !stacked_ok;
7234 }
7235
7236 static void do_v7m_exception_exit(ARMCPU *cpu)
7237 {
7238 CPUARMState *env = &cpu->env;
7239 uint32_t excret;
7240 uint32_t xpsr;
7241 bool ufault = false;
7242 bool sfault = false;
7243 bool return_to_sp_process;
7244 bool return_to_handler;
7245 bool rettobase = false;
7246 bool exc_secure = false;
7247 bool return_to_secure;
7248
7249 /* If we're not in Handler mode then jumps to magic exception-exit
7250 * addresses don't have magic behaviour. However for the v8M
7251 * security extensions the magic secure-function-return has to
7252 * work in thread mode too, so to avoid doing an extra check in
7253 * the generated code we allow exception-exit magic to also cause the
7254 * internal exception and bring us here in thread mode. Correct code
7255 * will never try to do this (the following insn fetch will always
7256 * fault) so we the overhead of having taken an unnecessary exception
7257 * doesn't matter.
7258 */
7259 if (!arm_v7m_is_handler_mode(env)) {
7260 return;
7261 }
7262
7263 /* In the spec pseudocode ExceptionReturn() is called directly
7264 * from BXWritePC() and gets the full target PC value including
7265 * bit zero. In QEMU's implementation we treat it as a normal
7266 * jump-to-register (which is then caught later on), and so split
7267 * the target value up between env->regs[15] and env->thumb in
7268 * gen_bx(). Reconstitute it.
7269 */
7270 excret = env->regs[15];
7271 if (env->thumb) {
7272 excret |= 1;
7273 }
7274
7275 qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
7276 " previous exception %d\n",
7277 excret, env->v7m.exception);
7278
7279 if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
7280 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
7281 "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
7282 excret);
7283 }
7284
7285 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
7286 /* EXC_RETURN.ES validation check (R_SMFL). We must do this before
7287 * we pick which FAULTMASK to clear.
7288 */
7289 if (!env->v7m.secure &&
7290 ((excret & R_V7M_EXCRET_ES_MASK) ||
7291 !(excret & R_V7M_EXCRET_DCRS_MASK))) {
7292 sfault = 1;
7293 /* For all other purposes, treat ES as 0 (R_HXSR) */
7294 excret &= ~R_V7M_EXCRET_ES_MASK;
7295 }
7296 exc_secure = excret & R_V7M_EXCRET_ES_MASK;
7297 }
7298
7299 if (env->v7m.exception != ARMV7M_EXCP_NMI) {
7300 /* Auto-clear FAULTMASK on return from other than NMI.
7301 * If the security extension is implemented then this only
7302 * happens if the raw execution priority is >= 0; the
7303 * value of the ES bit in the exception return value indicates
7304 * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
7305 */
7306 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
7307 if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
7308 env->v7m.faultmask[exc_secure] = 0;
7309 }
7310 } else {
7311 env->v7m.faultmask[M_REG_NS] = 0;
7312 }
7313 }
7314
7315 switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception,
7316 exc_secure)) {
7317 case -1:
7318 /* attempt to exit an exception that isn't active */
7319 ufault = true;
7320 break;
7321 case 0:
7322 /* still an irq active now */
7323 break;
7324 case 1:
7325 /* we returned to base exception level, no nesting.
7326 * (In the pseudocode this is written using "NestedActivation != 1"
7327 * where we have 'rettobase == false'.)
7328 */
7329 rettobase = true;
7330 break;
7331 default:
7332 g_assert_not_reached();
7333 }
7334
7335 return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
7336 return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
7337 return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
7338 (excret & R_V7M_EXCRET_S_MASK);
7339
7340 if (arm_feature(env, ARM_FEATURE_V8)) {
7341 if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
7342 /* UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP);
7343 * we choose to take the UsageFault.
7344 */
7345 if ((excret & R_V7M_EXCRET_S_MASK) ||
7346 (excret & R_V7M_EXCRET_ES_MASK) ||
7347 !(excret & R_V7M_EXCRET_DCRS_MASK)) {
7348 ufault = true;
7349 }
7350 }
7351 if (excret & R_V7M_EXCRET_RES0_MASK) {
7352 ufault = true;
7353 }
7354 } else {
7355 /* For v7M we only recognize certain combinations of the low bits */
7356 switch (excret & 0xf) {
7357 case 1: /* Return to Handler */
7358 break;
7359 case 13: /* Return to Thread using Process stack */
7360 case 9: /* Return to Thread using Main stack */
7361 /* We only need to check NONBASETHRDENA for v7M, because in
7362 * v8M this bit does not exist (it is RES1).
7363 */
7364 if (!rettobase &&
7365 !(env->v7m.ccr[env->v7m.secure] &
7366 R_V7M_CCR_NONBASETHRDENA_MASK)) {
7367 ufault = true;
7368 }
7369 break;
7370 default:
7371 ufault = true;
7372 }
7373 }
7374
7375 /*
7376 * Set CONTROL.SPSEL from excret.SPSEL. Since we're still in
7377 * Handler mode (and will be until we write the new XPSR.Interrupt
7378 * field) this does not switch around the current stack pointer.
7379 * We must do this before we do any kind of tailchaining, including
7380 * for the derived exceptions on integrity check failures, or we will
7381 * give the guest an incorrect EXCRET.SPSEL value on exception entry.
7382 */
7383 write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
7384
7385 if (sfault) {
7386 env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
7387 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
7388 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
7389 "stackframe: failed EXC_RETURN.ES validity check\n");
7390 v7m_exception_taken(cpu, excret, true, false);
7391 return;
7392 }
7393
7394 if (ufault) {
7395 /* Bad exception return: instead of popping the exception
7396 * stack, directly take a usage fault on the current stack.
7397 */
7398 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
7399 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
7400 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
7401 "stackframe: failed exception return integrity check\n");
7402 v7m_exception_taken(cpu, excret, true, false);
7403 return;
7404 }
7405
7406 /*
7407 * Tailchaining: if there is currently a pending exception that
7408 * is high enough priority to preempt execution at the level we're
7409 * about to return to, then just directly take that exception now,
7410 * avoiding an unstack-and-then-stack. Note that now we have
7411 * deactivated the previous exception by calling armv7m_nvic_complete_irq()
7412 * our current execution priority is already the execution priority we are
7413 * returning to -- none of the state we would unstack or set based on
7414 * the EXCRET value affects it.
7415 */
7416 if (armv7m_nvic_can_take_pending_exception(env->nvic)) {
7417 qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n");
7418 v7m_exception_taken(cpu, excret, true, false);
7419 return;
7420 }
7421
7422 switch_v7m_security_state(env, return_to_secure);
7423
7424 {
7425 /* The stack pointer we should be reading the exception frame from
7426 * depends on bits in the magic exception return type value (and
7427 * for v8M isn't necessarily the stack pointer we will eventually
7428 * end up resuming execution with). Get a pointer to the location
7429 * in the CPU state struct where the SP we need is currently being
7430 * stored; we will use and modify it in place.
7431 * We use this limited C variable scope so we don't accidentally
7432 * use 'frame_sp_p' after we do something that makes it invalid.
7433 */
7434 uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
7435 return_to_secure,
7436 !return_to_handler,
7437 return_to_sp_process);
7438 uint32_t frameptr = *frame_sp_p;
7439 bool pop_ok = true;
7440 ARMMMUIdx mmu_idx;
7441 bool return_to_priv = return_to_handler ||
7442 !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK);
7443
7444 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure,
7445 return_to_priv);
7446
7447 if (!QEMU_IS_ALIGNED(frameptr, 8) &&
7448 arm_feature(env, ARM_FEATURE_V8)) {
7449 qemu_log_mask(LOG_GUEST_ERROR,
7450 "M profile exception return with non-8-aligned SP "
7451 "for destination state is UNPREDICTABLE\n");
7452 }
7453
7454 /* Do we need to pop callee-saved registers? */
7455 if (return_to_secure &&
7456 ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
7457 (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
7458 uint32_t expected_sig = 0xfefa125b;
7459 uint32_t actual_sig;
7460
7461 pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx);
7462
7463 if (pop_ok && expected_sig != actual_sig) {
7464 /* Take a SecureFault on the current stack */
7465 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
7466 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
7467 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
7468 "stackframe: failed exception return integrity "
7469 "signature check\n");
7470 v7m_exception_taken(cpu, excret, true, false);
7471 return;
7472 }
7473
7474 pop_ok = pop_ok &&
7475 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
7476 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) &&
7477 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) &&
7478 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) &&
7479 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) &&
7480 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) &&
7481 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) &&
7482 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx);
7483
7484 frameptr += 0x28;
7485 }
7486
7487 /* Pop registers */
7488 pop_ok = pop_ok &&
7489 v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) &&
7490 v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) &&
7491 v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) &&
7492 v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) &&
7493 v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) &&
7494 v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) &&
7495 v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) &&
7496 v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx);
7497
7498 if (!pop_ok) {
7499 /* v7m_stack_read() pended a fault, so take it (as a tail
7500 * chained exception on the same stack frame)
7501 */
7502 qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n");
7503 v7m_exception_taken(cpu, excret, true, false);
7504 return;
7505 }
7506
7507 /* Returning from an exception with a PC with bit 0 set is defined
7508 * behaviour on v8M (bit 0 is ignored), but for v7M it was specified
7509 * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore
7510 * the lsbit, and there are several RTOSes out there which incorrectly
7511 * assume the r15 in the stack frame should be a Thumb-style "lsbit
7512 * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but
7513 * complain about the badly behaved guest.
7514 */
7515 if (env->regs[15] & 1) {
7516 env->regs[15] &= ~1U;
7517 if (!arm_feature(env, ARM_FEATURE_V8)) {
7518 qemu_log_mask(LOG_GUEST_ERROR,
7519 "M profile return from interrupt with misaligned "
7520 "PC is UNPREDICTABLE on v7M\n");
7521 }
7522 }
7523
7524 if (arm_feature(env, ARM_FEATURE_V8)) {
7525 /* For v8M we have to check whether the xPSR exception field
7526 * matches the EXCRET value for return to handler/thread
7527 * before we commit to changing the SP and xPSR.
7528 */
7529 bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
7530 if (return_to_handler != will_be_handler) {
7531 /* Take an INVPC UsageFault on the current stack.
7532 * By this point we will have switched to the security state
7533 * for the background state, so this UsageFault will target
7534 * that state.
7535 */
7536 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
7537 env->v7m.secure);
7538 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
7539 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
7540 "stackframe: failed exception return integrity "
7541 "check\n");
7542 v7m_exception_taken(cpu, excret, true, false);
7543 return;
7544 }
7545 }
7546
7547 /* Commit to consuming the stack frame */
7548 frameptr += 0x20;
7549 /* Undo stack alignment (the SPREALIGN bit indicates that the original
7550 * pre-exception SP was not 8-aligned and we added a padding word to
7551 * align it, so we undo this by ORing in the bit that increases it
7552 * from the current 8-aligned value to the 8-unaligned value. (Adding 4
7553 * would work too but a logical OR is how the pseudocode specifies it.)
7554 */
7555 if (xpsr & XPSR_SPREALIGN) {
7556 frameptr |= 4;
7557 }
7558 *frame_sp_p = frameptr;
7559 }
7560 /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
7561 xpsr_write(env, xpsr, ~XPSR_SPREALIGN);
7562
7563 /* The restored xPSR exception field will be zero if we're
7564 * resuming in Thread mode. If that doesn't match what the
7565 * exception return excret specified then this is a UsageFault.
7566 * v7M requires we make this check here; v8M did it earlier.
7567 */
7568 if (return_to_handler != arm_v7m_is_handler_mode(env)) {
7569 /* Take an INVPC UsageFault by pushing the stack again;
7570 * we know we're v7M so this is never a Secure UsageFault.
7571 */
7572 bool ignore_stackfaults;
7573
7574 assert(!arm_feature(env, ARM_FEATURE_V8));
7575 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
7576 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
7577 ignore_stackfaults = v7m_push_stack(cpu);
7578 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
7579 "failed exception return integrity check\n");
7580 v7m_exception_taken(cpu, excret, false, ignore_stackfaults);
7581 return;
7582 }
7583
7584 /* Otherwise, we have a successful exception exit. */
7585 arm_clear_exclusive(env);
7586 qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
7587 }
7588
7589 static bool do_v7m_function_return(ARMCPU *cpu)
7590 {
7591 /* v8M security extensions magic function return.
7592 * We may either:
7593 * (1) throw an exception (longjump)
7594 * (2) return true if we successfully handled the function return
7595 * (3) return false if we failed a consistency check and have
7596 * pended a UsageFault that needs to be taken now
7597 *
7598 * At this point the magic return value is split between env->regs[15]
7599 * and env->thumb. We don't bother to reconstitute it because we don't
7600 * need it (all values are handled the same way).
7601 */
7602 CPUARMState *env = &cpu->env;
7603 uint32_t newpc, newpsr, newpsr_exc;
7604
7605 qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n");
7606
7607 {
7608 bool threadmode, spsel;
7609 TCGMemOpIdx oi;
7610 ARMMMUIdx mmu_idx;
7611 uint32_t *frame_sp_p;
7612 uint32_t frameptr;
7613
7614 /* Pull the return address and IPSR from the Secure stack */
7615 threadmode = !arm_v7m_is_handler_mode(env);
7616 spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
7617
7618 frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
7619 frameptr = *frame_sp_p;
7620
7621 /* These loads may throw an exception (for MPU faults). We want to
7622 * do them as secure, so work out what MMU index that is.
7623 */
7624 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
7625 oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx));
7626 newpc = helper_le_ldul_mmu(env, frameptr, oi, 0);
7627 newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0);
7628
7629 /* Consistency checks on new IPSR */
7630 newpsr_exc = newpsr & XPSR_EXCP;
7631 if (!((env->v7m.exception == 0 && newpsr_exc == 0) ||
7632 (env->v7m.exception == 1 && newpsr_exc != 0))) {
7633 /* Pend the fault and tell our caller to take it */
7634 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
7635 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
7636 env->v7m.secure);
7637 qemu_log_mask(CPU_LOG_INT,
7638 "...taking INVPC UsageFault: "
7639 "IPSR consistency check failed\n");
7640 return false;
7641 }
7642
7643 *frame_sp_p = frameptr + 8;
7644 }
7645
7646 /* This invalidates frame_sp_p */
7647 switch_v7m_security_state(env, true);
7648 env->v7m.exception = newpsr_exc;
7649 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
7650 if (newpsr & XPSR_SFPA) {
7651 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK;
7652 }
7653 xpsr_write(env, 0, XPSR_IT);
7654 env->thumb = newpc & 1;
7655 env->regs[15] = newpc & ~1;
7656
7657 qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
7658 return true;
7659 }
7660
7661 static void arm_log_exception(int idx)
7662 {
7663 if (qemu_loglevel_mask(CPU_LOG_INT)) {
7664 const char *exc = NULL;
7665 static const char * const excnames[] = {
7666 [EXCP_UDEF] = "Undefined Instruction",
7667 [EXCP_SWI] = "SVC",
7668 [EXCP_PREFETCH_ABORT] = "Prefetch Abort",
7669 [EXCP_DATA_ABORT] = "Data Abort",
7670 [EXCP_IRQ] = "IRQ",
7671 [EXCP_FIQ] = "FIQ",
7672 [EXCP_BKPT] = "Breakpoint",
7673 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit",
7674 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage",
7675 [EXCP_HVC] = "Hypervisor Call",
7676 [EXCP_HYP_TRAP] = "Hypervisor Trap",
7677 [EXCP_SMC] = "Secure Monitor Call",
7678 [EXCP_VIRQ] = "Virtual IRQ",
7679 [EXCP_VFIQ] = "Virtual FIQ",
7680 [EXCP_SEMIHOST] = "Semihosting call",
7681 [EXCP_NOCP] = "v7M NOCP UsageFault",
7682 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault",
7683 [EXCP_STKOF] = "v8M STKOF UsageFault",
7684 };
7685
7686 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
7687 exc = excnames[idx];
7688 }
7689 if (!exc) {
7690 exc = "unknown";
7691 }
7692 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc);
7693 }
7694 }
7695
7696 static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
7697 uint32_t addr, uint16_t *insn)
7698 {
7699 /* Load a 16-bit portion of a v7M instruction, returning true on success,
7700 * or false on failure (in which case we will have pended the appropriate
7701 * exception).
7702 * We need to do the instruction fetch's MPU and SAU checks
7703 * like this because there is no MMU index that would allow
7704 * doing the load with a single function call. Instead we must
7705 * first check that the security attributes permit the load
7706 * and that they don't mismatch on the two halves of the instruction,
7707 * and then we do the load as a secure load (ie using the security
7708 * attributes of the address, not the CPU, as architecturally required).
7709 */
7710 CPUState *cs = CPU(cpu);
7711 CPUARMState *env = &cpu->env;
7712 V8M_SAttributes sattrs = {};
7713 MemTxAttrs attrs = {};
7714 ARMMMUFaultInfo fi = {};
7715 MemTxResult txres;
7716 target_ulong page_size;
7717 hwaddr physaddr;
7718 int prot;
7719
7720 v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs);
7721 if (!sattrs.nsc || sattrs.ns) {
7722 /* This must be the second half of the insn, and it straddles a
7723 * region boundary with the second half not being S&NSC.
7724 */
7725 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
7726 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
7727 qemu_log_mask(CPU_LOG_INT,
7728 "...really SecureFault with SFSR.INVEP\n");
7729 return false;
7730 }
7731 if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
7732 &physaddr, &attrs, &prot, &page_size, &fi, NULL)) {
7733 /* the MPU lookup failed */
7734 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
7735 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
7736 qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
7737 return false;
7738 }
7739 *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr,
7740 attrs, &txres);
7741 if (txres != MEMTX_OK) {
7742 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
7743 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
7744 qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");
7745 return false;
7746 }
7747 return true;
7748 }
7749
7750 static bool v7m_handle_execute_nsc(ARMCPU *cpu)
7751 {
7752 /* Check whether this attempt to execute code in a Secure & NS-Callable
7753 * memory region is for an SG instruction; if so, then emulate the
7754 * effect of the SG instruction and return true. Otherwise pend
7755 * the correct kind of exception and return false.
7756 */
7757 CPUARMState *env = &cpu->env;
7758 ARMMMUIdx mmu_idx;
7759 uint16_t insn;
7760
7761 /* We should never get here unless get_phys_addr_pmsav8() caused
7762 * an exception for NS executing in S&NSC memory.
7763 */
7764 assert(!env->v7m.secure);
7765 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
7766
7767 /* We want to do the MPU lookup as secure; work out what mmu_idx that is */
7768 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
7769
7770 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) {
7771 return false;
7772 }
7773
7774 if (!env->thumb) {
7775 goto gen_invep;
7776 }
7777
7778 if (insn != 0xe97f) {
7779 /* Not an SG instruction first half (we choose the IMPDEF
7780 * early-SG-check option).
7781 */
7782 goto gen_invep;
7783 }
7784
7785 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) {
7786 return false;
7787 }
7788
7789 if (insn != 0xe97f) {
7790 /* Not an SG instruction second half (yes, both halves of the SG
7791 * insn have the same hex value)
7792 */
7793 goto gen_invep;
7794 }
7795
7796 /* OK, we have confirmed that we really have an SG instruction.
7797 * We know we're NS in S memory so don't need to repeat those checks.
7798 */
7799 qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
7800 ", executing it\n", env->regs[15]);
7801 env->regs[14] &= ~1;
7802 switch_v7m_security_state(env, true);
7803 xpsr_write(env, 0, XPSR_IT);
7804 env->regs[15] += 4;
7805 return true;
7806
7807 gen_invep:
7808 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
7809 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
7810 qemu_log_mask(CPU_LOG_INT,
7811 "...really SecureFault with SFSR.INVEP\n");
7812 return false;
7813 }
7814
7815 void arm_v7m_cpu_do_interrupt(CPUState *cs)
7816 {
7817 ARMCPU *cpu = ARM_CPU(cs);
7818 CPUARMState *env = &cpu->env;
7819 uint32_t lr;
7820 bool ignore_stackfaults;
7821
7822 arm_log_exception(cs->exception_index);
7823
7824 /* For exceptions we just mark as pending on the NVIC, and let that
7825 handle it. */
7826 switch (cs->exception_index) {
7827 case EXCP_UDEF:
7828 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
7829 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK;
7830 break;
7831 case EXCP_NOCP:
7832 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
7833 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK;
7834 break;
7835 case EXCP_INVSTATE:
7836 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
7837 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK;
7838 break;
7839 case EXCP_STKOF:
7840 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
7841 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
7842 break;
7843 case EXCP_SWI:
7844 /* The PC already points to the next instruction. */
7845 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure);
7846 break;
7847 case EXCP_PREFETCH_ABORT:
7848 case EXCP_DATA_ABORT:
7849 /* Note that for M profile we don't have a guest facing FSR, but
7850 * the env->exception.fsr will be populated by the code that
7851 * raises the fault, in the A profile short-descriptor format.
7852 */
7853 switch (env->exception.fsr & 0xf) {
7854 case M_FAKE_FSR_NSC_EXEC:
7855 /* Exception generated when we try to execute code at an address
7856 * which is marked as Secure & Non-Secure Callable and the CPU
7857 * is in the Non-Secure state. The only instruction which can
7858 * be executed like this is SG (and that only if both halves of
7859 * the SG instruction have the same security attributes.)
7860 * Everything else must generate an INVEP SecureFault, so we
7861 * emulate the SG instruction here.
7862 */
7863 if (v7m_handle_execute_nsc(cpu)) {
7864 return;
7865 }
7866 break;
7867 case M_FAKE_FSR_SFAULT:
7868 /* Various flavours of SecureFault for attempts to execute or
7869 * access data in the wrong security state.
7870 */
7871 switch (cs->exception_index) {
7872 case EXCP_PREFETCH_ABORT:
7873 if (env->v7m.secure) {
7874 env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
7875 qemu_log_mask(CPU_LOG_INT,
7876 "...really SecureFault with SFSR.INVTRAN\n");
7877 } else {
7878 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
7879 qemu_log_mask(CPU_LOG_INT,
7880 "...really SecureFault with SFSR.INVEP\n");
7881 }
7882 break;
7883 case EXCP_DATA_ABORT:
7884 /* This must be an NS access to S memory */
7885 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
7886 qemu_log_mask(CPU_LOG_INT,
7887 "...really SecureFault with SFSR.AUVIOL\n");
7888 break;
7889 }
7890 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
7891 break;
7892 case 0x8: /* External Abort */
7893 switch (cs->exception_index) {
7894 case EXCP_PREFETCH_ABORT:
7895 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
7896 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
7897 break;
7898 case EXCP_DATA_ABORT:
7899 env->v7m.cfsr[M_REG_NS] |=
7900 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
7901 env->v7m.bfar = env->exception.vaddress;
7902 qemu_log_mask(CPU_LOG_INT,
7903 "...with CFSR.PRECISERR and BFAR 0x%x\n",
7904 env->v7m.bfar);
7905 break;
7906 }
7907 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
7908 break;
7909 default:
7910 /* All other FSR values are either MPU faults or "can't happen
7911 * for M profile" cases.
7912 */
7913 switch (cs->exception_index) {
7914 case EXCP_PREFETCH_ABORT:
7915 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
7916 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
7917 break;
7918 case EXCP_DATA_ABORT:
7919 env->v7m.cfsr[env->v7m.secure] |=
7920 (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
7921 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress;
7922 qemu_log_mask(CPU_LOG_INT,
7923 "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
7924 env->v7m.mmfar[env->v7m.secure]);
7925 break;
7926 }
7927 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM,
7928 env->v7m.secure);
7929 break;
7930 }
7931 break;
7932 case EXCP_BKPT:
7933 if (semihosting_enabled()) {
7934 int nr;
7935 nr = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) & 0xff;
7936 if (nr == 0xab) {
7937 env->regs[15] += 2;
7938 qemu_log_mask(CPU_LOG_INT,
7939 "...handling as semihosting call 0x%x\n",
7940 env->regs[0]);
7941 env->regs[0] = do_arm_semihosting(env);
7942 return;
7943 }
7944 }
7945 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false);
7946 break;
7947 case EXCP_IRQ:
7948 break;
7949 case EXCP_EXCEPTION_EXIT:
7950 if (env->regs[15] < EXC_RETURN_MIN_MAGIC) {
7951 /* Must be v8M security extension function return */
7952 assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC);
7953 assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
7954 if (do_v7m_function_return(cpu)) {
7955 return;
7956 }
7957 } else {
7958 do_v7m_exception_exit(cpu);
7959 return;
7960 }
7961 break;
7962 default:
7963 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
7964 return; /* Never happens. Keep compiler happy. */
7965 }
7966
7967 if (arm_feature(env, ARM_FEATURE_V8)) {
7968 lr = R_V7M_EXCRET_RES1_MASK |
7969 R_V7M_EXCRET_DCRS_MASK |
7970 R_V7M_EXCRET_FTYPE_MASK;
7971 /* The S bit indicates whether we should return to Secure
7972 * or NonSecure (ie our current state).
7973 * The ES bit indicates whether we're taking this exception
7974 * to Secure or NonSecure (ie our target state). We set it
7975 * later, in v7m_exception_taken().
7976 * The SPSEL bit is also set in v7m_exception_taken() for v8M.
7977 * This corresponds to the ARM ARM pseudocode for v8M setting
7978 * some LR bits in PushStack() and some in ExceptionTaken();
7979 * the distinction matters for the tailchain cases where we
7980 * can take an exception without pushing the stack.
7981 */
7982 if (env->v7m.secure) {
7983 lr |= R_V7M_EXCRET_S_MASK;
7984 }
7985 } else {
7986 lr = R_V7M_EXCRET_RES1_MASK |
7987 R_V7M_EXCRET_S_MASK |
7988 R_V7M_EXCRET_DCRS_MASK |
7989 R_V7M_EXCRET_FTYPE_MASK |
7990 R_V7M_EXCRET_ES_MASK;
7991 if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
7992 lr |= R_V7M_EXCRET_SPSEL_MASK;
7993 }
7994 }
7995 if (!arm_v7m_is_handler_mode(env)) {
7996 lr |= R_V7M_EXCRET_MODE_MASK;
7997 }
7998
7999 ignore_stackfaults = v7m_push_stack(cpu);
8000 v7m_exception_taken(cpu, lr, false, ignore_stackfaults);
8001 }
8002
8003 /* Function used to synchronize QEMU's AArch64 register set with AArch32
8004 * register set. This is necessary when switching between AArch32 and AArch64
8005 * execution state.
8006 */
8007 void aarch64_sync_32_to_64(CPUARMState *env)
8008 {
8009 int i;
8010 uint32_t mode = env->uncached_cpsr & CPSR_M;
8011
8012 /* We can blanket copy R[0:7] to X[0:7] */
8013 for (i = 0; i < 8; i++) {
8014 env->xregs[i] = env->regs[i];
8015 }
8016
8017 /* Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12.
8018 * Otherwise, they come from the banked user regs.
8019 */
8020 if (mode == ARM_CPU_MODE_FIQ) {
8021 for (i = 8; i < 13; i++) {
8022 env->xregs[i] = env->usr_regs[i - 8];
8023 }
8024 } else {
8025 for (i = 8; i < 13; i++) {
8026 env->xregs[i] = env->regs[i];
8027 }
8028 }
8029
8030 /* Registers x13-x23 are the various mode SP and FP registers. Registers
8031 * r13 and r14 are only copied if we are in that mode, otherwise we copy
8032 * from the mode banked register.
8033 */
8034 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
8035 env->xregs[13] = env->regs[13];
8036 env->xregs[14] = env->regs[14];
8037 } else {
8038 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)];
8039 /* HYP is an exception in that it is copied from r14 */
8040 if (mode == ARM_CPU_MODE_HYP) {
8041 env->xregs[14] = env->regs[14];
8042 } else {
8043 env->xregs[14] = env->banked_r14[bank_number(ARM_CPU_MODE_USR)];
8044 }
8045 }
8046
8047 if (mode == ARM_CPU_MODE_HYP) {
8048 env->xregs[15] = env->regs[13];
8049 } else {
8050 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)];
8051 }
8052
8053 if (mode == ARM_CPU_MODE_IRQ) {
8054 env->xregs[16] = env->regs[14];
8055 env->xregs[17] = env->regs[13];
8056 } else {
8057 env->xregs[16] = env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)];
8058 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)];
8059 }
8060
8061 if (mode == ARM_CPU_MODE_SVC) {
8062 env->xregs[18] = env->regs[14];
8063 env->xregs[19] = env->regs[13];
8064 } else {
8065 env->xregs[18] = env->banked_r14[bank_number(ARM_CPU_MODE_SVC)];
8066 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)];
8067 }
8068
8069 if (mode == ARM_CPU_MODE_ABT) {
8070 env->xregs[20] = env->regs[14];
8071 env->xregs[21] = env->regs[13];
8072 } else {
8073 env->xregs[20] = env->banked_r14[bank_number(ARM_CPU_MODE_ABT)];
8074 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)];
8075 }
8076
8077 if (mode == ARM_CPU_MODE_UND) {
8078 env->xregs[22] = env->regs[14];
8079 env->xregs[23] = env->regs[13];
8080 } else {
8081 env->xregs[22] = env->banked_r14[bank_number(ARM_CPU_MODE_UND)];
8082 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)];
8083 }
8084
8085 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
8086 * mode, then we can copy from r8-r14. Otherwise, we copy from the
8087 * FIQ bank for r8-r14.
8088 */
8089 if (mode == ARM_CPU_MODE_FIQ) {
8090 for (i = 24; i < 31; i++) {
8091 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */
8092 }
8093 } else {
8094 for (i = 24; i < 29; i++) {
8095 env->xregs[i] = env->fiq_regs[i - 24];
8096 }
8097 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)];
8098 env->xregs[30] = env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)];
8099 }
8100
8101 env->pc = env->regs[15];
8102 }
8103
8104 /* Function used to synchronize QEMU's AArch32 register set with AArch64
8105 * register set. This is necessary when switching between AArch32 and AArch64
8106 * execution state.
8107 */
8108 void aarch64_sync_64_to_32(CPUARMState *env)
8109 {
8110 int i;
8111 uint32_t mode = env->uncached_cpsr & CPSR_M;
8112
8113 /* We can blanket copy X[0:7] to R[0:7] */
8114 for (i = 0; i < 8; i++) {
8115 env->regs[i] = env->xregs[i];
8116 }
8117
8118 /* Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12.
8119 * Otherwise, we copy x8-x12 into the banked user regs.
8120 */
8121 if (mode == ARM_CPU_MODE_FIQ) {
8122 for (i = 8; i < 13; i++) {
8123 env->usr_regs[i - 8] = env->xregs[i];
8124 }
8125 } else {
8126 for (i = 8; i < 13; i++) {
8127 env->regs[i] = env->xregs[i];
8128 }
8129 }
8130
8131 /* Registers r13 & r14 depend on the current mode.
8132 * If we are in a given mode, we copy the corresponding x registers to r13
8133 * and r14. Otherwise, we copy the x register to the banked r13 and r14
8134 * for the mode.
8135 */
8136 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
8137 env->regs[13] = env->xregs[13];
8138 env->regs[14] = env->xregs[14];
8139 } else {
8140 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13];
8141
8142 /* HYP is an exception in that it does not have its own banked r14 but
8143 * shares the USR r14
8144 */
8145 if (mode == ARM_CPU_MODE_HYP) {
8146 env->regs[14] = env->xregs[14];
8147 } else {
8148 env->banked_r14[bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
8149 }
8150 }
8151
8152 if (mode == ARM_CPU_MODE_HYP) {
8153 env->regs[13] = env->xregs[15];
8154 } else {
8155 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15];
8156 }
8157
8158 if (mode == ARM_CPU_MODE_IRQ) {
8159 env->regs[14] = env->xregs[16];
8160 env->regs[13] = env->xregs[17];
8161 } else {
8162 env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
8163 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17];
8164 }
8165
8166 if (mode == ARM_CPU_MODE_SVC) {
8167 env->regs[14] = env->xregs[18];
8168 env->regs[13] = env->xregs[19];
8169 } else {
8170 env->banked_r14[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
8171 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19];
8172 }
8173
8174 if (mode == ARM_CPU_MODE_ABT) {
8175 env->regs[14] = env->xregs[20];
8176 env->regs[13] = env->xregs[21];
8177 } else {
8178 env->banked_r14[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
8179 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21];
8180 }
8181
8182 if (mode == ARM_CPU_MODE_UND) {
8183 env->regs[14] = env->xregs[22];
8184 env->regs[13] = env->xregs[23];
8185 } else {
8186 env->banked_r14[bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
8187 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23];
8188 }
8189
8190 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
8191 * mode, then we can copy to r8-r14. Otherwise, we copy to the
8192 * FIQ bank for r8-r14.
8193 */
8194 if (mode == ARM_CPU_MODE_FIQ) {
8195 for (i = 24; i < 31; i++) {
8196 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */
8197 }
8198 } else {
8199 for (i = 24; i < 29; i++) {
8200 env->fiq_regs[i - 24] = env->xregs[i];
8201 }
8202 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29];
8203 env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
8204 }
8205
8206 env->regs[15] = env->pc;
8207 }
8208
8209 static void take_aarch32_exception(CPUARMState *env, int new_mode,
8210 uint32_t mask, uint32_t offset,
8211 uint32_t newpc)
8212 {
8213 /* Change the CPU state so as to actually take the exception. */
8214 switch_mode(env, new_mode);
8215 /*
8216 * For exceptions taken to AArch32 we must clear the SS bit in both
8217 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.
8218 */
8219 env->uncached_cpsr &= ~PSTATE_SS;
8220 env->spsr = cpsr_read(env);
8221 /* Clear IT bits. */
8222 env->condexec_bits = 0;
8223 /* Switch to the new mode, and to the correct instruction set. */
8224 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
8225 /* Set new mode endianness */
8226 env->uncached_cpsr &= ~CPSR_E;
8227 if (env->cp15.sctlr_el[arm_current_el(env)] & SCTLR_EE) {
8228 env->uncached_cpsr |= CPSR_E;
8229 }
8230 /* J and IL must always be cleared for exception entry */
8231 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J);
8232 env->daif |= mask;
8233
8234 if (new_mode == ARM_CPU_MODE_HYP) {
8235 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0;
8236 env->elr_el[2] = env->regs[15];
8237 } else {
8238 /*
8239 * this is a lie, as there was no c1_sys on V4T/V5, but who cares
8240 * and we should just guard the thumb mode on V4
8241 */
8242 if (arm_feature(env, ARM_FEATURE_V4T)) {
8243 env->thumb =
8244 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0;
8245 }
8246 env->regs[14] = env->regs[15] + offset;
8247 }
8248 env->regs[15] = newpc;
8249 }
8250
8251 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
8252 {
8253 /*
8254 * Handle exception entry to Hyp mode; this is sufficiently
8255 * different to entry to other AArch32 modes that we handle it
8256 * separately here.
8257 *
8258 * The vector table entry used is always the 0x14 Hyp mode entry point,
8259 * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp.
8260 * The offset applied to the preferred return address is always zero
8261 * (see DDI0487C.a section G1.12.3).
8262 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values.
8263 */
8264 uint32_t addr, mask;
8265 ARMCPU *cpu = ARM_CPU(cs);
8266 CPUARMState *env = &cpu->env;
8267
8268 switch (cs->exception_index) {
8269 case EXCP_UDEF:
8270 addr = 0x04;
8271 break;
8272 case EXCP_SWI:
8273 addr = 0x14;
8274 break;
8275 case EXCP_BKPT:
8276 /* Fall through to prefetch abort. */
8277 case EXCP_PREFETCH_ABORT:
8278 env->cp15.ifar_s = env->exception.vaddress;
8279 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n",
8280 (uint32_t)env->exception.vaddress);
8281 addr = 0x0c;
8282 break;
8283 case EXCP_DATA_ABORT:
8284 env->cp15.dfar_s = env->exception.vaddress;
8285 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n",
8286 (uint32_t)env->exception.vaddress);
8287 addr = 0x10;
8288 break;
8289 case EXCP_IRQ:
8290 addr = 0x18;
8291 break;
8292 case EXCP_FIQ:
8293 addr = 0x1c;
8294 break;
8295 case EXCP_HVC:
8296 addr = 0x08;
8297 break;
8298 case EXCP_HYP_TRAP:
8299 addr = 0x14;
8300 default:
8301 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
8302 }
8303
8304 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) {
8305 if (!arm_feature(env, ARM_FEATURE_V8)) {
8306 /*
8307 * QEMU syndrome values are v8-style. v7 has the IL bit
8308 * UNK/SBZP for "field not valid" cases, where v8 uses RES1.
8309 * If this is a v7 CPU, squash the IL bit in those cases.
8310 */
8311 if (cs->exception_index == EXCP_PREFETCH_ABORT ||
8312 (cs->exception_index == EXCP_DATA_ABORT &&
8313 !(env->exception.syndrome & ARM_EL_ISV)) ||
8314 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) {
8315 env->exception.syndrome &= ~ARM_EL_IL;
8316 }
8317 }
8318 env->cp15.esr_el[2] = env->exception.syndrome;
8319 }
8320
8321 if (arm_current_el(env) != 2 && addr < 0x14) {
8322 addr = 0x14;
8323 }
8324
8325 mask = 0;
8326 if (!(env->cp15.scr_el3 & SCR_EA)) {
8327 mask |= CPSR_A;
8328 }
8329 if (!(env->cp15.scr_el3 & SCR_IRQ)) {
8330 mask |= CPSR_I;
8331 }
8332 if (!(env->cp15.scr_el3 & SCR_FIQ)) {
8333 mask |= CPSR_F;
8334 }
8335
8336 addr += env->cp15.hvbar;
8337
8338 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr);
8339 }
8340
8341 static void arm_cpu_do_interrupt_aarch32(CPUState *cs)
8342 {
8343 ARMCPU *cpu = ARM_CPU(cs);
8344 CPUARMState *env = &cpu->env;
8345 uint32_t addr;
8346 uint32_t mask;
8347 int new_mode;
8348 uint32_t offset;
8349 uint32_t moe;
8350
8351 /* If this is a debug exception we must update the DBGDSCR.MOE bits */
8352 switch (syn_get_ec(env->exception.syndrome)) {
8353 case EC_BREAKPOINT:
8354 case EC_BREAKPOINT_SAME_EL:
8355 moe = 1;
8356 break;
8357 case EC_WATCHPOINT:
8358 case EC_WATCHPOINT_SAME_EL:
8359 moe = 10;
8360 break;
8361 case EC_AA32_BKPT:
8362 moe = 3;
8363 break;
8364 case EC_VECTORCATCH:
8365 moe = 5;
8366 break;
8367 default:
8368 moe = 0;
8369 break;
8370 }
8371
8372 if (moe) {
8373 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe);
8374 }
8375
8376 if (env->exception.target_el == 2) {
8377 arm_cpu_do_interrupt_aarch32_hyp(cs);
8378 return;
8379 }
8380
8381 /* TODO: Vectored interrupt controller. */
8382 switch (cs->exception_index) {
8383 case EXCP_UDEF:
8384 new_mode = ARM_CPU_MODE_UND;
8385 addr = 0x04;
8386 mask = CPSR_I;
8387 if (env->thumb)
8388 offset = 2;
8389 else
8390 offset = 4;
8391 break;
8392 case EXCP_SWI:
8393 new_mode = ARM_CPU_MODE_SVC;
8394 addr = 0x08;
8395 mask = CPSR_I;
8396 /* The PC already points to the next instruction. */
8397 offset = 0;
8398 break;
8399 case EXCP_BKPT:
8400 /* Fall through to prefetch abort. */
8401 case EXCP_PREFETCH_ABORT:
8402 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr);
8403 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress);
8404 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n",
8405 env->exception.fsr, (uint32_t)env->exception.vaddress);
8406 new_mode = ARM_CPU_MODE_ABT;
8407 addr = 0x0c;
8408 mask = CPSR_A | CPSR_I;
8409 offset = 4;
8410 break;
8411 case EXCP_DATA_ABORT:
8412 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr);
8413 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress);
8414 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n",
8415 env->exception.fsr,
8416 (uint32_t)env->exception.vaddress);
8417 new_mode = ARM_CPU_MODE_ABT;
8418 addr = 0x10;
8419 mask = CPSR_A | CPSR_I;
8420 offset = 8;
8421 break;
8422 case EXCP_IRQ:
8423 new_mode = ARM_CPU_MODE_IRQ;
8424 addr = 0x18;
8425 /* Disable IRQ and imprecise data aborts. */
8426 mask = CPSR_A | CPSR_I;
8427 offset = 4;
8428 if (env->cp15.scr_el3 & SCR_IRQ) {
8429 /* IRQ routed to monitor mode */
8430 new_mode = ARM_CPU_MODE_MON;
8431 mask |= CPSR_F;
8432 }
8433 break;
8434 case EXCP_FIQ:
8435 new_mode = ARM_CPU_MODE_FIQ;
8436 addr = 0x1c;
8437 /* Disable FIQ, IRQ and imprecise data aborts. */
8438 mask = CPSR_A | CPSR_I | CPSR_F;
8439 if (env->cp15.scr_el3 & SCR_FIQ) {
8440 /* FIQ routed to monitor mode */
8441 new_mode = ARM_CPU_MODE_MON;
8442 }
8443 offset = 4;
8444 break;
8445 case EXCP_VIRQ:
8446 new_mode = ARM_CPU_MODE_IRQ;
8447 addr = 0x18;
8448 /* Disable IRQ and imprecise data aborts. */
8449 mask = CPSR_A | CPSR_I;
8450 offset = 4;
8451 break;
8452 case EXCP_VFIQ:
8453 new_mode = ARM_CPU_MODE_FIQ;
8454 addr = 0x1c;
8455 /* Disable FIQ, IRQ and imprecise data aborts. */
8456 mask = CPSR_A | CPSR_I | CPSR_F;
8457 offset = 4;
8458 break;
8459 case EXCP_SMC:
8460 new_mode = ARM_CPU_MODE_MON;
8461 addr = 0x08;
8462 mask = CPSR_A | CPSR_I | CPSR_F;
8463 offset = 0;
8464 break;
8465 default:
8466 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
8467 return; /* Never happens. Keep compiler happy. */
8468 }
8469
8470 if (new_mode == ARM_CPU_MODE_MON) {
8471 addr += env->cp15.mvbar;
8472 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
8473 /* High vectors. When enabled, base address cannot be remapped. */
8474 addr += 0xffff0000;
8475 } else {
8476 /* ARM v7 architectures provide a vector base address register to remap
8477 * the interrupt vector table.
8478 * This register is only followed in non-monitor mode, and is banked.
8479 * Note: only bits 31:5 are valid.
8480 */
8481 addr += A32_BANKED_CURRENT_REG_GET(env, vbar);
8482 }
8483
8484 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
8485 env->cp15.scr_el3 &= ~SCR_NS;
8486 }
8487
8488 take_aarch32_exception(env, new_mode, mask, offset, addr);
8489 }
8490
8491 /* Handle exception entry to a target EL which is using AArch64 */
8492 static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
8493 {
8494 ARMCPU *cpu = ARM_CPU(cs);
8495 CPUARMState *env = &cpu->env;
8496 unsigned int new_el = env->exception.target_el;
8497 target_ulong addr = env->cp15.vbar_el[new_el];
8498 unsigned int new_mode = aarch64_pstate_mode(new_el, true);
8499 unsigned int cur_el = arm_current_el(env);
8500
8501 /*
8502 * Note that new_el can never be 0. If cur_el is 0, then
8503 * el0_a64 is is_a64(), else el0_a64 is ignored.
8504 */
8505 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
8506
8507 if (cur_el < new_el) {
8508 /* Entry vector offset depends on whether the implemented EL
8509 * immediately lower than the target level is using AArch32 or AArch64
8510 */
8511 bool is_aa64;
8512
8513 switch (new_el) {
8514 case 3:
8515 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0;
8516 break;
8517 case 2:
8518 is_aa64 = (env->cp15.hcr_el2 & HCR_RW) != 0;
8519 break;
8520 case 1:
8521 is_aa64 = is_a64(env);
8522 break;
8523 default:
8524 g_assert_not_reached();
8525 }
8526
8527 if (is_aa64) {
8528 addr += 0x400;
8529 } else {
8530 addr += 0x600;
8531 }
8532 } else if (pstate_read(env) & PSTATE_SP) {
8533 addr += 0x200;
8534 }
8535
8536 switch (cs->exception_index) {
8537 case EXCP_PREFETCH_ABORT:
8538 case EXCP_DATA_ABORT:
8539 env->cp15.far_el[new_el] = env->exception.vaddress;
8540 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n",
8541 env->cp15.far_el[new_el]);
8542 /* fall through */
8543 case EXCP_BKPT:
8544 case EXCP_UDEF:
8545 case EXCP_SWI:
8546 case EXCP_HVC:
8547 case EXCP_HYP_TRAP:
8548 case EXCP_SMC:
8549 if (syn_get_ec(env->exception.syndrome) == EC_ADVSIMDFPACCESSTRAP) {
8550 /*
8551 * QEMU internal FP/SIMD syndromes from AArch32 include the
8552 * TA and coproc fields which are only exposed if the exception
8553 * is taken to AArch32 Hyp mode. Mask them out to get a valid
8554 * AArch64 format syndrome.
8555 */
8556 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20);
8557 }
8558 env->cp15.esr_el[new_el] = env->exception.syndrome;
8559 break;
8560 case EXCP_IRQ:
8561 case EXCP_VIRQ:
8562 addr += 0x80;
8563 break;
8564 case EXCP_FIQ:
8565 case EXCP_VFIQ:
8566 addr += 0x100;
8567 break;
8568 case EXCP_SEMIHOST:
8569 qemu_log_mask(CPU_LOG_INT,
8570 "...handling as semihosting call 0x%" PRIx64 "\n",
8571 env->xregs[0]);
8572 env->xregs[0] = do_arm_semihosting(env);
8573 return;
8574 default:
8575 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
8576 }
8577
8578 if (is_a64(env)) {
8579 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = pstate_read(env);
8580 aarch64_save_sp(env, arm_current_el(env));
8581 env->elr_el[new_el] = env->pc;
8582 } else {
8583 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = cpsr_read(env);
8584 env->elr_el[new_el] = env->regs[15];
8585
8586 aarch64_sync_32_to_64(env);
8587
8588 env->condexec_bits = 0;
8589 }
8590 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n",
8591 env->elr_el[new_el]);
8592
8593 pstate_write(env, PSTATE_DAIF | new_mode);
8594 env->aarch64 = 1;
8595 aarch64_restore_sp(env, new_el);
8596
8597 env->pc = addr;
8598
8599 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n",
8600 new_el, env->pc, pstate_read(env));
8601 }
8602
8603 static inline bool check_for_semihosting(CPUState *cs)
8604 {
8605 /* Check whether this exception is a semihosting call; if so
8606 * then handle it and return true; otherwise return false.
8607 */
8608 ARMCPU *cpu = ARM_CPU(cs);
8609 CPUARMState *env = &cpu->env;
8610
8611 if (is_a64(env)) {
8612 if (cs->exception_index == EXCP_SEMIHOST) {
8613 /* This is always the 64-bit semihosting exception.
8614 * The "is this usermode" and "is semihosting enabled"
8615 * checks have been done at translate time.
8616 */
8617 qemu_log_mask(CPU_LOG_INT,
8618 "...handling as semihosting call 0x%" PRIx64 "\n",
8619 env->xregs[0]);
8620 env->xregs[0] = do_arm_semihosting(env);
8621 return true;
8622 }
8623 return false;
8624 } else {
8625 uint32_t imm;
8626
8627 /* Only intercept calls from privileged modes, to provide some
8628 * semblance of security.
8629 */
8630 if (cs->exception_index != EXCP_SEMIHOST &&
8631 (!semihosting_enabled() ||
8632 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR))) {
8633 return false;
8634 }
8635
8636 switch (cs->exception_index) {
8637 case EXCP_SEMIHOST:
8638 /* This is always a semihosting call; the "is this usermode"
8639 * and "is semihosting enabled" checks have been done at
8640 * translate time.
8641 */
8642 break;
8643 case EXCP_SWI:
8644 /* Check for semihosting interrupt. */
8645 if (env->thumb) {
8646 imm = arm_lduw_code(env, env->regs[15] - 2, arm_sctlr_b(env))
8647 & 0xff;
8648 if (imm == 0xab) {
8649 break;
8650 }
8651 } else {
8652 imm = arm_ldl_code(env, env->regs[15] - 4, arm_sctlr_b(env))
8653 & 0xffffff;
8654 if (imm == 0x123456) {
8655 break;
8656 }
8657 }
8658 return false;
8659 case EXCP_BKPT:
8660 /* See if this is a semihosting syscall. */
8661 if (env->thumb) {
8662 imm = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env))
8663 & 0xff;
8664 if (imm == 0xab) {
8665 env->regs[15] += 2;
8666 break;
8667 }
8668 }
8669 return false;
8670 default:
8671 return false;
8672 }
8673
8674 qemu_log_mask(CPU_LOG_INT,
8675 "...handling as semihosting call 0x%x\n",
8676 env->regs[0]);
8677 env->regs[0] = do_arm_semihosting(env);
8678 return true;
8679 }
8680 }
8681
8682 /* Handle a CPU exception for A and R profile CPUs.
8683 * Do any appropriate logging, handle PSCI calls, and then hand off
8684 * to the AArch64-entry or AArch32-entry function depending on the
8685 * target exception level's register width.
8686 */
8687 void arm_cpu_do_interrupt(CPUState *cs)
8688 {
8689 ARMCPU *cpu = ARM_CPU(cs);
8690 CPUARMState *env = &cpu->env;
8691 unsigned int new_el = env->exception.target_el;
8692
8693 assert(!arm_feature(env, ARM_FEATURE_M));
8694
8695 arm_log_exception(cs->exception_index);
8696 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env),
8697 new_el);
8698 if (qemu_loglevel_mask(CPU_LOG_INT)
8699 && !excp_is_internal(cs->exception_index)) {
8700 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n",
8701 syn_get_ec(env->exception.syndrome),
8702 env->exception.syndrome);
8703 }
8704
8705 if (arm_is_psci_call(cpu, cs->exception_index)) {
8706 arm_handle_psci_call(cpu);
8707 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
8708 return;
8709 }
8710
8711 /* Semihosting semantics depend on the register width of the
8712 * code that caused the exception, not the target exception level,
8713 * so must be handled here.
8714 */
8715 if (check_for_semihosting(cs)) {
8716 return;
8717 }
8718
8719 /* Hooks may change global state so BQL should be held, also the
8720 * BQL needs to be held for any modification of
8721 * cs->interrupt_request.
8722 */
8723 g_assert(qemu_mutex_iothread_locked());
8724
8725 arm_call_pre_el_change_hook(cpu);
8726
8727 assert(!excp_is_internal(cs->exception_index));
8728 if (arm_el_is_aa64(env, new_el)) {
8729 arm_cpu_do_interrupt_aarch64(cs);
8730 } else {
8731 arm_cpu_do_interrupt_aarch32(cs);
8732 }
8733
8734 arm_call_el_change_hook(cpu);
8735
8736 if (!kvm_enabled()) {
8737 cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
8738 }
8739 }
8740
8741 /* Return the exception level which controls this address translation regime */
8742 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
8743 {
8744 switch (mmu_idx) {
8745 case ARMMMUIdx_S2NS:
8746 case ARMMMUIdx_S1E2:
8747 return 2;
8748 case ARMMMUIdx_S1E3:
8749 return 3;
8750 case ARMMMUIdx_S1SE0:
8751 return arm_el_is_aa64(env, 3) ? 1 : 3;
8752 case ARMMMUIdx_S1SE1:
8753 case ARMMMUIdx_S1NSE0:
8754 case ARMMMUIdx_S1NSE1:
8755 case ARMMMUIdx_MPrivNegPri:
8756 case ARMMMUIdx_MUserNegPri:
8757 case ARMMMUIdx_MPriv:
8758 case ARMMMUIdx_MUser:
8759 case ARMMMUIdx_MSPrivNegPri:
8760 case ARMMMUIdx_MSUserNegPri:
8761 case ARMMMUIdx_MSPriv:
8762 case ARMMMUIdx_MSUser:
8763 return 1;
8764 default:
8765 g_assert_not_reached();
8766 }
8767 }
8768
8769 /* Return the SCTLR value which controls this address translation regime */
8770 static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
8771 {
8772 return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
8773 }
8774
8775 /* Return true if the specified stage of address translation is disabled */
8776 static inline bool regime_translation_disabled(CPUARMState *env,
8777 ARMMMUIdx mmu_idx)
8778 {
8779 if (arm_feature(env, ARM_FEATURE_M)) {
8780 switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] &
8781 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
8782 case R_V7M_MPU_CTRL_ENABLE_MASK:
8783 /* Enabled, but not for HardFault and NMI */
8784 return mmu_idx & ARM_MMU_IDX_M_NEGPRI;
8785 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK:
8786 /* Enabled for all cases */
8787 return false;
8788 case 0:
8789 default:
8790 /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
8791 * we warned about that in armv7m_nvic.c when the guest set it.
8792 */
8793 return true;
8794 }
8795 }
8796
8797 if (mmu_idx == ARMMMUIdx_S2NS) {
8798 /* HCR.DC means HCR.VM behaves as 1 */
8799 return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0;
8800 }
8801
8802 if (env->cp15.hcr_el2 & HCR_TGE) {
8803 /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
8804 if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) {
8805 return true;
8806 }
8807 }
8808
8809 if ((env->cp15.hcr_el2 & HCR_DC) &&
8810 (mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1)) {
8811 /* HCR.DC means SCTLR_EL1.M behaves as 0 */
8812 return true;
8813 }
8814
8815 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
8816 }
8817
8818 static inline bool regime_translation_big_endian(CPUARMState *env,
8819 ARMMMUIdx mmu_idx)
8820 {
8821 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
8822 }
8823
8824 /* Return the TCR controlling this translation regime */
8825 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
8826 {
8827 if (mmu_idx == ARMMMUIdx_S2NS) {
8828 return &env->cp15.vtcr_el2;
8829 }
8830 return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
8831 }
8832
8833 /* Convert a possible stage1+2 MMU index into the appropriate
8834 * stage 1 MMU index
8835 */
8836 static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
8837 {
8838 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
8839 mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0);
8840 }
8841 return mmu_idx;
8842 }
8843
8844 /* Returns TBI0 value for current regime el */
8845 uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
8846 {
8847 TCR *tcr;
8848 uint32_t el;
8849
8850 /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
8851 * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
8852 */
8853 mmu_idx = stage_1_mmu_idx(mmu_idx);
8854
8855 tcr = regime_tcr(env, mmu_idx);
8856 el = regime_el(env, mmu_idx);
8857
8858 if (el > 1) {
8859 return extract64(tcr->raw_tcr, 20, 1);
8860 } else {
8861 return extract64(tcr->raw_tcr, 37, 1);
8862 }
8863 }
8864
8865 /* Returns TBI1 value for current regime el */
8866 uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
8867 {
8868 TCR *tcr;
8869 uint32_t el;
8870
8871 /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
8872 * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
8873 */
8874 mmu_idx = stage_1_mmu_idx(mmu_idx);
8875
8876 tcr = regime_tcr(env, mmu_idx);
8877 el = regime_el(env, mmu_idx);
8878
8879 if (el > 1) {
8880 return 0;
8881 } else {
8882 return extract64(tcr->raw_tcr, 38, 1);
8883 }
8884 }
8885
8886 /* Return the TTBR associated with this translation regime */
8887 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
8888 int ttbrn)
8889 {
8890 if (mmu_idx == ARMMMUIdx_S2NS) {
8891 return env->cp15.vttbr_el2;
8892 }
8893 if (ttbrn == 0) {
8894 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
8895 } else {
8896 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
8897 }
8898 }
8899
8900 /* Return true if the translation regime is using LPAE format page tables */
8901 static inline bool regime_using_lpae_format(CPUARMState *env,
8902 ARMMMUIdx mmu_idx)
8903 {
8904 int el = regime_el(env, mmu_idx);
8905 if (el == 2 || arm_el_is_aa64(env, el)) {
8906 return true;
8907 }
8908 if (arm_feature(env, ARM_FEATURE_LPAE)
8909 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) {
8910 return true;
8911 }
8912 return false;
8913 }
8914
8915 /* Returns true if the stage 1 translation regime is using LPAE format page
8916 * tables. Used when raising alignment exceptions, whose FSR changes depending
8917 * on whether the long or short descriptor format is in use. */
8918 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
8919 {
8920 mmu_idx = stage_1_mmu_idx(mmu_idx);
8921
8922 return regime_using_lpae_format(env, mmu_idx);
8923 }
8924
8925 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
8926 {
8927 switch (mmu_idx) {
8928 case ARMMMUIdx_S1SE0:
8929 case ARMMMUIdx_S1NSE0:
8930 case ARMMMUIdx_MUser:
8931 case ARMMMUIdx_MSUser:
8932 case ARMMMUIdx_MUserNegPri:
8933 case ARMMMUIdx_MSUserNegPri:
8934 return true;
8935 default:
8936 return false;
8937 case ARMMMUIdx_S12NSE0:
8938 case ARMMMUIdx_S12NSE1:
8939 g_assert_not_reached();
8940 }
8941 }
8942
8943 /* Translate section/page access permissions to page
8944 * R/W protection flags
8945 *
8946 * @env: CPUARMState
8947 * @mmu_idx: MMU index indicating required translation regime
8948 * @ap: The 3-bit access permissions (AP[2:0])
8949 * @domain_prot: The 2-bit domain access permissions
8950 */
8951 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
8952 int ap, int domain_prot)
8953 {
8954 bool is_user = regime_is_user(env, mmu_idx);
8955
8956 if (domain_prot == 3) {
8957 return PAGE_READ | PAGE_WRITE;
8958 }
8959
8960 switch (ap) {
8961 case 0:
8962 if (arm_feature(env, ARM_FEATURE_V7)) {
8963 return 0;
8964 }
8965 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) {
8966 case SCTLR_S:
8967 return is_user ? 0 : PAGE_READ;
8968 case SCTLR_R:
8969 return PAGE_READ;
8970 default:
8971 return 0;
8972 }
8973 case 1:
8974 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
8975 case 2:
8976 if (is_user) {
8977 return PAGE_READ;
8978 } else {
8979 return PAGE_READ | PAGE_WRITE;
8980 }
8981 case 3:
8982 return PAGE_READ | PAGE_WRITE;
8983 case 4: /* Reserved. */
8984 return 0;
8985 case 5:
8986 return is_user ? 0 : PAGE_READ;
8987 case 6:
8988 return PAGE_READ;
8989 case 7:
8990 if (!arm_feature(env, ARM_FEATURE_V6K)) {
8991 return 0;
8992 }
8993 return PAGE_READ;
8994 default:
8995 g_assert_not_reached();
8996 }
8997 }
8998
8999 /* Translate section/page access permissions to page
9000 * R/W protection flags.
9001 *
9002 * @ap: The 2-bit simple AP (AP[2:1])
9003 * @is_user: TRUE if accessing from PL0
9004 */
9005 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
9006 {
9007 switch (ap) {
9008 case 0:
9009 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
9010 case 1:
9011 return PAGE_READ | PAGE_WRITE;
9012 case 2:
9013 return is_user ? 0 : PAGE_READ;
9014 case 3:
9015 return PAGE_READ;
9016 default:
9017 g_assert_not_reached();
9018 }
9019 }
9020
9021 static inline int
9022 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
9023 {
9024 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
9025 }
9026
9027 /* Translate S2 section/page access permissions to protection flags
9028 *
9029 * @env: CPUARMState
9030 * @s2ap: The 2-bit stage2 access permissions (S2AP)
9031 * @xn: XN (execute-never) bit
9032 */
9033 static int get_S2prot(CPUARMState *env, int s2ap, int xn)
9034 {
9035 int prot = 0;
9036
9037 if (s2ap & 1) {
9038 prot |= PAGE_READ;
9039 }
9040 if (s2ap & 2) {
9041 prot |= PAGE_WRITE;
9042 }
9043 if (!xn) {
9044 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
9045 prot |= PAGE_EXEC;
9046 }
9047 }
9048 return prot;
9049 }
9050
9051 /* Translate section/page access permissions to protection flags
9052 *
9053 * @env: CPUARMState
9054 * @mmu_idx: MMU index indicating required translation regime
9055 * @is_aa64: TRUE if AArch64
9056 * @ap: The 2-bit simple AP (AP[2:1])
9057 * @ns: NS (non-secure) bit
9058 * @xn: XN (execute-never) bit
9059 * @pxn: PXN (privileged execute-never) bit
9060 */
9061 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
9062 int ap, int ns, int xn, int pxn)
9063 {
9064 bool is_user = regime_is_user(env, mmu_idx);
9065 int prot_rw, user_rw;
9066 bool have_wxn;
9067 int wxn = 0;
9068
9069 assert(mmu_idx != ARMMMUIdx_S2NS);
9070
9071 user_rw = simple_ap_to_rw_prot_is_user(ap, true);
9072 if (is_user) {
9073 prot_rw = user_rw;
9074 } else {
9075 prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
9076 }
9077
9078 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
9079 return prot_rw;
9080 }
9081
9082 /* TODO have_wxn should be replaced with
9083 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
9084 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
9085 * compatible processors have EL2, which is required for [U]WXN.
9086 */
9087 have_wxn = arm_feature(env, ARM_FEATURE_LPAE);
9088
9089 if (have_wxn) {
9090 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
9091 }
9092
9093 if (is_aa64) {
9094 switch (regime_el(env, mmu_idx)) {
9095 case 1:
9096 if (!is_user) {
9097 xn = pxn || (user_rw & PAGE_WRITE);
9098 }
9099 break;
9100 case 2:
9101 case 3:
9102 break;
9103 }
9104 } else if (arm_feature(env, ARM_FEATURE_V7)) {
9105 switch (regime_el(env, mmu_idx)) {
9106 case 1:
9107 case 3:
9108 if (is_user) {
9109 xn = xn || !(user_rw & PAGE_READ);
9110 } else {
9111 int uwxn = 0;
9112 if (have_wxn) {
9113 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
9114 }
9115 xn = xn || !(prot_rw & PAGE_READ) || pxn ||
9116 (uwxn && (user_rw & PAGE_WRITE));
9117 }
9118 break;
9119 case 2:
9120 break;
9121 }
9122 } else {
9123 xn = wxn = 0;
9124 }
9125
9126 if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
9127 return prot_rw;
9128 }
9129 return prot_rw | PAGE_EXEC;
9130 }
9131
9132 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
9133 uint32_t *table, uint32_t address)
9134 {
9135 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
9136 TCR *tcr = regime_tcr(env, mmu_idx);
9137
9138 if (address & tcr->mask) {
9139 if (tcr->raw_tcr & TTBCR_PD1) {
9140 /* Translation table walk disabled for TTBR1 */
9141 return false;
9142 }
9143 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
9144 } else {
9145 if (tcr->raw_tcr & TTBCR_PD0) {
9146 /* Translation table walk disabled for TTBR0 */
9147 return false;
9148 }
9149 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask;
9150 }
9151 *table |= (address >> 18) & 0x3ffc;
9152 return true;
9153 }
9154
9155 /* Translate a S1 pagetable walk through S2 if needed. */
9156 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
9157 hwaddr addr, MemTxAttrs txattrs,
9158 ARMMMUFaultInfo *fi)
9159 {
9160 if ((mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1) &&
9161 !regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
9162 target_ulong s2size;
9163 hwaddr s2pa;
9164 int s2prot;
9165 int ret;
9166 ARMCacheAttrs cacheattrs = {};
9167 ARMCacheAttrs *pcacheattrs = NULL;
9168
9169 if (env->cp15.hcr_el2 & HCR_PTW) {
9170 /*
9171 * PTW means we must fault if this S1 walk touches S2 Device
9172 * memory; otherwise we don't care about the attributes and can
9173 * save the S2 translation the effort of computing them.
9174 */
9175 pcacheattrs = &cacheattrs;
9176 }
9177
9178 ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
9179 &txattrs, &s2prot, &s2size, fi, pcacheattrs);
9180 if (ret) {
9181 assert(fi->type != ARMFault_None);
9182 fi->s2addr = addr;
9183 fi->stage2 = true;
9184 fi->s1ptw = true;
9185 return ~0;
9186 }
9187 if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) {
9188 /* Access was to Device memory: generate Permission fault */
9189 fi->type = ARMFault_Permission;
9190 fi->s2addr = addr;
9191 fi->stage2 = true;
9192 fi->s1ptw = true;
9193 return ~0;
9194 }
9195 addr = s2pa;
9196 }
9197 return addr;
9198 }
9199
9200 /* All loads done in the course of a page table walk go through here. */
9201 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
9202 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi)
9203 {
9204 ARMCPU *cpu = ARM_CPU(cs);
9205 CPUARMState *env = &cpu->env;
9206 MemTxAttrs attrs = {};
9207 MemTxResult result = MEMTX_OK;
9208 AddressSpace *as;
9209 uint32_t data;
9210
9211 attrs.secure = is_secure;
9212 as = arm_addressspace(cs, attrs);
9213 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
9214 if (fi->s1ptw) {
9215 return 0;
9216 }
9217 if (regime_translation_big_endian(env, mmu_idx)) {
9218 data = address_space_ldl_be(as, addr, attrs, &result);
9219 } else {
9220 data = address_space_ldl_le(as, addr, attrs, &result);
9221 }
9222 if (result == MEMTX_OK) {
9223 return data;
9224 }
9225 fi->type = ARMFault_SyncExternalOnWalk;
9226 fi->ea = arm_extabort_type(result);
9227 return 0;
9228 }
9229
9230 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
9231 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi)
9232 {
9233 ARMCPU *cpu = ARM_CPU(cs);
9234 CPUARMState *env = &cpu->env;
9235 MemTxAttrs attrs = {};
9236 MemTxResult result = MEMTX_OK;
9237 AddressSpace *as;
9238 uint64_t data;
9239
9240 attrs.secure = is_secure;
9241 as = arm_addressspace(cs, attrs);
9242 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
9243 if (fi->s1ptw) {
9244 return 0;
9245 }
9246 if (regime_translation_big_endian(env, mmu_idx)) {
9247 data = address_space_ldq_be(as, addr, attrs, &result);
9248 } else {
9249 data = address_space_ldq_le(as, addr, attrs, &result);
9250 }
9251 if (result == MEMTX_OK) {
9252 return data;
9253 }
9254 fi->type = ARMFault_SyncExternalOnWalk;
9255 fi->ea = arm_extabort_type(result);
9256 return 0;
9257 }
9258
9259 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
9260 MMUAccessType access_type, ARMMMUIdx mmu_idx,
9261 hwaddr *phys_ptr, int *prot,
9262 target_ulong *page_size,
9263 ARMMMUFaultInfo *fi)
9264 {
9265 CPUState *cs = CPU(arm_env_get_cpu(env));
9266 int level = 1;
9267 uint32_t table;
9268 uint32_t desc;
9269 int type;
9270 int ap;
9271 int domain = 0;
9272 int domain_prot;
9273 hwaddr phys_addr;
9274 uint32_t dacr;
9275
9276 /* Pagetable walk. */
9277 /* Lookup l1 descriptor. */
9278 if (!get_level1_table_address(env, mmu_idx, &table, address)) {
9279 /* Section translation fault if page walk is disabled by PD0 or PD1 */
9280 fi->type = ARMFault_Translation;
9281 goto do_fault;
9282 }
9283 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9284 mmu_idx, fi);
9285 if (fi->type != ARMFault_None) {
9286 goto do_fault;
9287 }
9288 type = (desc & 3);
9289 domain = (desc >> 5) & 0x0f;
9290 if (regime_el(env, mmu_idx) == 1) {
9291 dacr = env->cp15.dacr_ns;
9292 } else {
9293 dacr = env->cp15.dacr_s;
9294 }
9295 domain_prot = (dacr >> (domain * 2)) & 3;
9296 if (type == 0) {
9297 /* Section translation fault. */
9298 fi->type = ARMFault_Translation;
9299 goto do_fault;
9300 }
9301 if (type != 2) {
9302 level = 2;
9303 }
9304 if (domain_prot == 0 || domain_prot == 2) {
9305 fi->type = ARMFault_Domain;
9306 goto do_fault;
9307 }
9308 if (type == 2) {
9309 /* 1Mb section. */
9310 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
9311 ap = (desc >> 10) & 3;
9312 *page_size = 1024 * 1024;
9313 } else {
9314 /* Lookup l2 entry. */
9315 if (type == 1) {
9316 /* Coarse pagetable. */
9317 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
9318 } else {
9319 /* Fine pagetable. */
9320 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
9321 }
9322 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9323 mmu_idx, fi);
9324 if (fi->type != ARMFault_None) {
9325 goto do_fault;
9326 }
9327 switch (desc & 3) {
9328 case 0: /* Page translation fault. */
9329 fi->type = ARMFault_Translation;
9330 goto do_fault;
9331 case 1: /* 64k page. */
9332 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
9333 ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
9334 *page_size = 0x10000;
9335 break;
9336 case 2: /* 4k page. */
9337 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
9338 ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
9339 *page_size = 0x1000;
9340 break;
9341 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
9342 if (type == 1) {
9343 /* ARMv6/XScale extended small page format */
9344 if (arm_feature(env, ARM_FEATURE_XSCALE)
9345 || arm_feature(env, ARM_FEATURE_V6)) {
9346 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
9347 *page_size = 0x1000;
9348 } else {
9349 /* UNPREDICTABLE in ARMv5; we choose to take a
9350 * page translation fault.
9351 */
9352 fi->type = ARMFault_Translation;
9353 goto do_fault;
9354 }
9355 } else {
9356 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
9357 *page_size = 0x400;
9358 }
9359 ap = (desc >> 4) & 3;
9360 break;
9361 default:
9362 /* Never happens, but compiler isn't smart enough to tell. */
9363 abort();
9364 }
9365 }
9366 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
9367 *prot |= *prot ? PAGE_EXEC : 0;
9368 if (!(*prot & (1 << access_type))) {
9369 /* Access permission fault. */
9370 fi->type = ARMFault_Permission;
9371 goto do_fault;
9372 }
9373 *phys_ptr = phys_addr;
9374 return false;
9375 do_fault:
9376 fi->domain = domain;
9377 fi->level = level;
9378 return true;
9379 }
9380
9381 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
9382 MMUAccessType access_type, ARMMMUIdx mmu_idx,
9383 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
9384 target_ulong *page_size, ARMMMUFaultInfo *fi)
9385 {
9386 CPUState *cs = CPU(arm_env_get_cpu(env));
9387 int level = 1;
9388 uint32_t table;
9389 uint32_t desc;
9390 uint32_t xn;
9391 uint32_t pxn = 0;
9392 int type;
9393 int ap;
9394 int domain = 0;
9395 int domain_prot;
9396 hwaddr phys_addr;
9397 uint32_t dacr;
9398 bool ns;
9399
9400 /* Pagetable walk. */
9401 /* Lookup l1 descriptor. */
9402 if (!get_level1_table_address(env, mmu_idx, &table, address)) {
9403 /* Section translation fault if page walk is disabled by PD0 or PD1 */
9404 fi->type = ARMFault_Translation;
9405 goto do_fault;
9406 }
9407 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9408 mmu_idx, fi);
9409 if (fi->type != ARMFault_None) {
9410 goto do_fault;
9411 }
9412 type = (desc & 3);
9413 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
9414 /* Section translation fault, or attempt to use the encoding
9415 * which is Reserved on implementations without PXN.
9416 */
9417 fi->type = ARMFault_Translation;
9418 goto do_fault;
9419 }
9420 if ((type == 1) || !(desc & (1 << 18))) {
9421 /* Page or Section. */
9422 domain = (desc >> 5) & 0x0f;
9423 }
9424 if (regime_el(env, mmu_idx) == 1) {
9425 dacr = env->cp15.dacr_ns;
9426 } else {
9427 dacr = env->cp15.dacr_s;
9428 }
9429 if (type == 1) {
9430 level = 2;
9431 }
9432 domain_prot = (dacr >> (domain * 2)) & 3;
9433 if (domain_prot == 0 || domain_prot == 2) {
9434 /* Section or Page domain fault */
9435 fi->type = ARMFault_Domain;
9436 goto do_fault;
9437 }
9438 if (type != 1) {
9439 if (desc & (1 << 18)) {
9440 /* Supersection. */
9441 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
9442 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
9443 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
9444 *page_size = 0x1000000;
9445 } else {
9446 /* Section. */
9447 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
9448 *page_size = 0x100000;
9449 }
9450 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
9451 xn = desc & (1 << 4);
9452 pxn = desc & 1;
9453 ns = extract32(desc, 19, 1);
9454 } else {
9455 if (arm_feature(env, ARM_FEATURE_PXN)) {
9456 pxn = (desc >> 2) & 1;
9457 }
9458 ns = extract32(desc, 3, 1);
9459 /* Lookup l2 entry. */
9460 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
9461 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9462 mmu_idx, fi);
9463 if (fi->type != ARMFault_None) {
9464 goto do_fault;
9465 }
9466 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
9467 switch (desc & 3) {
9468 case 0: /* Page translation fault. */
9469 fi->type = ARMFault_Translation;
9470 goto do_fault;
9471 case 1: /* 64k page. */
9472 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
9473 xn = desc & (1 << 15);
9474 *page_size = 0x10000;
9475 break;
9476 case 2: case 3: /* 4k page. */
9477 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
9478 xn = desc & 1;
9479 *page_size = 0x1000;
9480 break;
9481 default:
9482 /* Never happens, but compiler isn't smart enough to tell. */
9483 abort();
9484 }
9485 }
9486 if (domain_prot == 3) {
9487 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
9488 } else {
9489 if (pxn && !regime_is_user(env, mmu_idx)) {
9490 xn = 1;
9491 }
9492 if (xn && access_type == MMU_INST_FETCH) {
9493 fi->type = ARMFault_Permission;
9494 goto do_fault;
9495 }
9496
9497 if (arm_feature(env, ARM_FEATURE_V6K) &&
9498 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) {
9499 /* The simplified model uses AP[0] as an access control bit. */
9500 if ((ap & 1) == 0) {
9501 /* Access flag fault. */
9502 fi->type = ARMFault_AccessFlag;
9503 goto do_fault;
9504 }
9505 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
9506 } else {
9507 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
9508 }
9509 if (*prot && !xn) {
9510 *prot |= PAGE_EXEC;
9511 }
9512 if (!(*prot & (1 << access_type))) {
9513 /* Access permission fault. */
9514 fi->type = ARMFault_Permission;
9515 goto do_fault;
9516 }
9517 }
9518 if (ns) {
9519 /* The NS bit will (as required by the architecture) have no effect if
9520 * the CPU doesn't support TZ or this is a non-secure translation
9521 * regime, because the attribute will already be non-secure.
9522 */
9523 attrs->secure = false;
9524 }
9525 *phys_ptr = phys_addr;
9526 return false;
9527 do_fault:
9528 fi->domain = domain;
9529 fi->level = level;
9530 return true;
9531 }
9532
9533 /*
9534 * check_s2_mmu_setup
9535 * @cpu: ARMCPU
9536 * @is_aa64: True if the translation regime is in AArch64 state
9537 * @startlevel: Suggested starting level
9538 * @inputsize: Bitsize of IPAs
9539 * @stride: Page-table stride (See the ARM ARM)
9540 *
9541 * Returns true if the suggested S2 translation parameters are OK and
9542 * false otherwise.
9543 */
9544 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
9545 int inputsize, int stride)
9546 {
9547 const int grainsize = stride + 3;
9548 int startsizecheck;
9549
9550 /* Negative levels are never allowed. */
9551 if (level < 0) {
9552 return false;
9553 }
9554
9555 startsizecheck = inputsize - ((3 - level) * stride + grainsize);
9556 if (startsizecheck < 1 || startsizecheck > stride + 4) {
9557 return false;
9558 }
9559
9560 if (is_aa64) {
9561 CPUARMState *env = &cpu->env;
9562 unsigned int pamax = arm_pamax(cpu);
9563
9564 switch (stride) {
9565 case 13: /* 64KB Pages. */
9566 if (level == 0 || (level == 1 && pamax <= 42)) {
9567 return false;
9568 }
9569 break;
9570 case 11: /* 16KB Pages. */
9571 if (level == 0 || (level == 1 && pamax <= 40)) {
9572 return false;
9573 }
9574 break;
9575 case 9: /* 4KB Pages. */
9576 if (level == 0 && pamax <= 42) {
9577 return false;
9578 }
9579 break;
9580 default:
9581 g_assert_not_reached();
9582 }
9583
9584 /* Inputsize checks. */
9585 if (inputsize > pamax &&
9586 (arm_el_is_aa64(env, 1) || inputsize > 40)) {
9587 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */
9588 return false;
9589 }
9590 } else {
9591 /* AArch32 only supports 4KB pages. Assert on that. */
9592 assert(stride == 9);
9593
9594 if (level == 0) {
9595 return false;
9596 }
9597 }
9598 return true;
9599 }
9600
9601 /* Translate from the 4-bit stage 2 representation of
9602 * memory attributes (without cache-allocation hints) to
9603 * the 8-bit representation of the stage 1 MAIR registers
9604 * (which includes allocation hints).
9605 *
9606 * ref: shared/translation/attrs/S2AttrDecode()
9607 * .../S2ConvertAttrsHints()
9608 */
9609 static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
9610 {
9611 uint8_t hiattr = extract32(s2attrs, 2, 2);
9612 uint8_t loattr = extract32(s2attrs, 0, 2);
9613 uint8_t hihint = 0, lohint = 0;
9614
9615 if (hiattr != 0) { /* normal memory */
9616 if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
9617 hiattr = loattr = 1; /* non-cacheable */
9618 } else {
9619 if (hiattr != 1) { /* Write-through or write-back */
9620 hihint = 3; /* RW allocate */
9621 }
9622 if (loattr != 1) { /* Write-through or write-back */
9623 lohint = 3; /* RW allocate */
9624 }
9625 }
9626 }
9627
9628 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
9629 }
9630
9631 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
9632 MMUAccessType access_type, ARMMMUIdx mmu_idx,
9633 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
9634 target_ulong *page_size_ptr,
9635 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
9636 {
9637 ARMCPU *cpu = arm_env_get_cpu(env);
9638 CPUState *cs = CPU(cpu);
9639 /* Read an LPAE long-descriptor translation table. */
9640 ARMFaultType fault_type = ARMFault_Translation;
9641 uint32_t level;
9642 uint32_t epd = 0;
9643 int32_t t0sz, t1sz;
9644 uint32_t tg;
9645 uint64_t ttbr;
9646 int ttbr_select;
9647 hwaddr descaddr, indexmask, indexmask_grainsize;
9648 uint32_t tableattrs;
9649 target_ulong page_size;
9650 uint32_t attrs;
9651 int32_t stride = 9;
9652 int32_t addrsize;
9653 int inputsize;
9654 int32_t tbi = 0;
9655 TCR *tcr = regime_tcr(env, mmu_idx);
9656 int ap, ns, xn, pxn;
9657 uint32_t el = regime_el(env, mmu_idx);
9658 bool ttbr1_valid = true;
9659 uint64_t descaddrmask;
9660 bool aarch64 = arm_el_is_aa64(env, el);
9661
9662 /* TODO:
9663 * This code does not handle the different format TCR for VTCR_EL2.
9664 * This code also does not support shareability levels.
9665 * Attribute and permission bit handling should also be checked when adding
9666 * support for those page table walks.
9667 */
9668 if (aarch64) {
9669 level = 0;
9670 addrsize = 64;
9671 if (el > 1) {
9672 if (mmu_idx != ARMMMUIdx_S2NS) {
9673 tbi = extract64(tcr->raw_tcr, 20, 1);
9674 }
9675 } else {
9676 if (extract64(address, 55, 1)) {
9677 tbi = extract64(tcr->raw_tcr, 38, 1);
9678 } else {
9679 tbi = extract64(tcr->raw_tcr, 37, 1);
9680 }
9681 }
9682 tbi *= 8;
9683
9684 /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it
9685 * invalid.
9686 */
9687 if (el > 1) {
9688 ttbr1_valid = false;
9689 }
9690 } else {
9691 level = 1;
9692 addrsize = 32;
9693 /* There is no TTBR1 for EL2 */
9694 if (el == 2) {
9695 ttbr1_valid = false;
9696 }
9697 }
9698
9699 /* Determine whether this address is in the region controlled by
9700 * TTBR0 or TTBR1 (or if it is in neither region and should fault).
9701 * This is a Non-secure PL0/1 stage 1 translation, so controlled by
9702 * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
9703 */
9704 if (aarch64) {
9705 /* AArch64 translation. */
9706 t0sz = extract32(tcr->raw_tcr, 0, 6);
9707 t0sz = MIN(t0sz, 39);
9708 t0sz = MAX(t0sz, 16);
9709 } else if (mmu_idx != ARMMMUIdx_S2NS) {
9710 /* AArch32 stage 1 translation. */
9711 t0sz = extract32(tcr->raw_tcr, 0, 3);
9712 } else {
9713 /* AArch32 stage 2 translation. */
9714 bool sext = extract32(tcr->raw_tcr, 4, 1);
9715 bool sign = extract32(tcr->raw_tcr, 3, 1);
9716 /* Address size is 40-bit for a stage 2 translation,
9717 * and t0sz can be negative (from -8 to 7),
9718 * so we need to adjust it to use the TTBR selecting logic below.
9719 */
9720 addrsize = 40;
9721 t0sz = sextract32(tcr->raw_tcr, 0, 4) + 8;
9722
9723 /* If the sign-extend bit is not the same as t0sz[3], the result
9724 * is unpredictable. Flag this as a guest error. */
9725 if (sign != sext) {
9726 qemu_log_mask(LOG_GUEST_ERROR,
9727 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
9728 }
9729 }
9730 t1sz = extract32(tcr->raw_tcr, 16, 6);
9731 if (aarch64) {
9732 t1sz = MIN(t1sz, 39);
9733 t1sz = MAX(t1sz, 16);
9734 }
9735 if (t0sz && !extract64(address, addrsize - t0sz, t0sz - tbi)) {
9736 /* there is a ttbr0 region and we are in it (high bits all zero) */
9737 ttbr_select = 0;
9738 } else if (ttbr1_valid && t1sz &&
9739 !extract64(~address, addrsize - t1sz, t1sz - tbi)) {
9740 /* there is a ttbr1 region and we are in it (high bits all one) */
9741 ttbr_select = 1;
9742 } else if (!t0sz) {
9743 /* ttbr0 region is "everything not in the ttbr1 region" */
9744 ttbr_select = 0;
9745 } else if (!t1sz && ttbr1_valid) {
9746 /* ttbr1 region is "everything not in the ttbr0 region" */
9747 ttbr_select = 1;
9748 } else {
9749 /* in the gap between the two regions, this is a Translation fault */
9750 fault_type = ARMFault_Translation;
9751 goto do_fault;
9752 }
9753
9754 /* Note that QEMU ignores shareability and cacheability attributes,
9755 * so we don't need to do anything with the SH, ORGN, IRGN fields
9756 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
9757 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
9758 * implement any ASID-like capability so we can ignore it (instead
9759 * we will always flush the TLB any time the ASID is changed).
9760 */
9761 if (ttbr_select == 0) {
9762 ttbr = regime_ttbr(env, mmu_idx, 0);
9763 if (el < 2) {
9764 epd = extract32(tcr->raw_tcr, 7, 1);
9765 }
9766 inputsize = addrsize - t0sz;
9767
9768 tg = extract32(tcr->raw_tcr, 14, 2);
9769 if (tg == 1) { /* 64KB pages */
9770 stride = 13;
9771 }
9772 if (tg == 2) { /* 16KB pages */
9773 stride = 11;
9774 }
9775 } else {
9776 /* We should only be here if TTBR1 is valid */
9777 assert(ttbr1_valid);
9778
9779 ttbr = regime_ttbr(env, mmu_idx, 1);
9780 epd = extract32(tcr->raw_tcr, 23, 1);
9781 inputsize = addrsize - t1sz;
9782
9783 tg = extract32(tcr->raw_tcr, 30, 2);
9784 if (tg == 3) { /* 64KB pages */
9785 stride = 13;
9786 }
9787 if (tg == 1) { /* 16KB pages */
9788 stride = 11;
9789 }
9790 }
9791
9792 /* Here we should have set up all the parameters for the translation:
9793 * inputsize, ttbr, epd, stride, tbi
9794 */
9795
9796 if (epd) {
9797 /* Translation table walk disabled => Translation fault on TLB miss
9798 * Note: This is always 0 on 64-bit EL2 and EL3.
9799 */
9800 goto do_fault;
9801 }
9802
9803 if (mmu_idx != ARMMMUIdx_S2NS) {
9804 /* The starting level depends on the virtual address size (which can
9805 * be up to 48 bits) and the translation granule size. It indicates
9806 * the number of strides (stride bits at a time) needed to
9807 * consume the bits of the input address. In the pseudocode this is:
9808 * level = 4 - RoundUp((inputsize - grainsize) / stride)
9809 * where their 'inputsize' is our 'inputsize', 'grainsize' is
9810 * our 'stride + 3' and 'stride' is our 'stride'.
9811 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
9812 * = 4 - (inputsize - stride - 3 + stride - 1) / stride
9813 * = 4 - (inputsize - 4) / stride;
9814 */
9815 level = 4 - (inputsize - 4) / stride;
9816 } else {
9817 /* For stage 2 translations the starting level is specified by the
9818 * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
9819 */
9820 uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2);
9821 uint32_t startlevel;
9822 bool ok;
9823
9824 if (!aarch64 || stride == 9) {
9825 /* AArch32 or 4KB pages */
9826 startlevel = 2 - sl0;
9827 } else {
9828 /* 16KB or 64KB pages */
9829 startlevel = 3 - sl0;
9830 }
9831
9832 /* Check that the starting level is valid. */
9833 ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
9834 inputsize, stride);
9835 if (!ok) {
9836 fault_type = ARMFault_Translation;
9837 goto do_fault;
9838 }
9839 level = startlevel;
9840 }
9841
9842 indexmask_grainsize = (1ULL << (stride + 3)) - 1;
9843 indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
9844
9845 /* Now we can extract the actual base address from the TTBR */
9846 descaddr = extract64(ttbr, 0, 48);
9847 descaddr &= ~indexmask;
9848
9849 /* The address field in the descriptor goes up to bit 39 for ARMv7
9850 * but up to bit 47 for ARMv8, but we use the descaddrmask
9851 * up to bit 39 for AArch32, because we don't need other bits in that case
9852 * to construct next descriptor address (anyway they should be all zeroes).
9853 */
9854 descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) &
9855 ~indexmask_grainsize;
9856
9857 /* Secure accesses start with the page table in secure memory and
9858 * can be downgraded to non-secure at any step. Non-secure accesses
9859 * remain non-secure. We implement this by just ORing in the NSTable/NS
9860 * bits at each step.
9861 */
9862 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4);
9863 for (;;) {
9864 uint64_t descriptor;
9865 bool nstable;
9866
9867 descaddr |= (address >> (stride * (4 - level))) & indexmask;
9868 descaddr &= ~7ULL;
9869 nstable = extract32(tableattrs, 4, 1);
9870 descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi);
9871 if (fi->type != ARMFault_None) {
9872 goto do_fault;
9873 }
9874
9875 if (!(descriptor & 1) ||
9876 (!(descriptor & 2) && (level == 3))) {
9877 /* Invalid, or the Reserved level 3 encoding */
9878 goto do_fault;
9879 }
9880 descaddr = descriptor & descaddrmask;
9881
9882 if ((descriptor & 2) && (level < 3)) {
9883 /* Table entry. The top five bits are attributes which may
9884 * propagate down through lower levels of the table (and
9885 * which are all arranged so that 0 means "no effect", so
9886 * we can gather them up by ORing in the bits at each level).
9887 */
9888 tableattrs |= extract64(descriptor, 59, 5);
9889 level++;
9890 indexmask = indexmask_grainsize;
9891 continue;
9892 }
9893 /* Block entry at level 1 or 2, or page entry at level 3.
9894 * These are basically the same thing, although the number
9895 * of bits we pull in from the vaddr varies.
9896 */
9897 page_size = (1ULL << ((stride * (4 - level)) + 3));
9898 descaddr |= (address & (page_size - 1));
9899 /* Extract attributes from the descriptor */
9900 attrs = extract64(descriptor, 2, 10)
9901 | (extract64(descriptor, 52, 12) << 10);
9902
9903 if (mmu_idx == ARMMMUIdx_S2NS) {
9904 /* Stage 2 table descriptors do not include any attribute fields */
9905 break;
9906 }
9907 /* Merge in attributes from table descriptors */
9908 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */
9909 attrs |= extract32(tableattrs, 3, 1) << 5; /* APTable[1] => AP[2] */
9910 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
9911 * means "force PL1 access only", which means forcing AP[1] to 0.
9912 */
9913 if (extract32(tableattrs, 2, 1)) {
9914 attrs &= ~(1 << 4);
9915 }
9916 attrs |= nstable << 3; /* NS */
9917 break;
9918 }
9919 /* Here descaddr is the final physical address, and attributes
9920 * are all in attrs.
9921 */
9922 fault_type = ARMFault_AccessFlag;
9923 if ((attrs & (1 << 8)) == 0) {
9924 /* Access flag */
9925 goto do_fault;
9926 }
9927
9928 ap = extract32(attrs, 4, 2);
9929 xn = extract32(attrs, 12, 1);
9930
9931 if (mmu_idx == ARMMMUIdx_S2NS) {
9932 ns = true;
9933 *prot = get_S2prot(env, ap, xn);
9934 } else {
9935 ns = extract32(attrs, 3, 1);
9936 pxn = extract32(attrs, 11, 1);
9937 *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
9938 }
9939
9940 fault_type = ARMFault_Permission;
9941 if (!(*prot & (1 << access_type))) {
9942 goto do_fault;
9943 }
9944
9945 if (ns) {
9946 /* The NS bit will (as required by the architecture) have no effect if
9947 * the CPU doesn't support TZ or this is a non-secure translation
9948 * regime, because the attribute will already be non-secure.
9949 */
9950 txattrs->secure = false;
9951 }
9952
9953 if (cacheattrs != NULL) {
9954 if (mmu_idx == ARMMMUIdx_S2NS) {
9955 cacheattrs->attrs = convert_stage2_attrs(env,
9956 extract32(attrs, 0, 4));
9957 } else {
9958 /* Index into MAIR registers for cache attributes */
9959 uint8_t attrindx = extract32(attrs, 0, 3);
9960 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
9961 assert(attrindx <= 7);
9962 cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
9963 }
9964 cacheattrs->shareability = extract32(attrs, 6, 2);
9965 }
9966
9967 *phys_ptr = descaddr;
9968 *page_size_ptr = page_size;
9969 return false;
9970
9971 do_fault:
9972 fi->type = fault_type;
9973 fi->level = level;
9974 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */
9975 fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_S2NS);
9976 return true;
9977 }
9978
9979 static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
9980 ARMMMUIdx mmu_idx,
9981 int32_t address, int *prot)
9982 {
9983 if (!arm_feature(env, ARM_FEATURE_M)) {
9984 *prot = PAGE_READ | PAGE_WRITE;
9985 switch (address) {
9986 case 0xF0000000 ... 0xFFFFFFFF:
9987 if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
9988 /* hivecs execing is ok */
9989 *prot |= PAGE_EXEC;
9990 }
9991 break;
9992 case 0x00000000 ... 0x7FFFFFFF:
9993 *prot |= PAGE_EXEC;
9994 break;
9995 }
9996 } else {
9997 /* Default system address map for M profile cores.
9998 * The architecture specifies which regions are execute-never;
9999 * at the MPU level no other checks are defined.
10000 */
10001 switch (address) {
10002 case 0x00000000 ... 0x1fffffff: /* ROM */
10003 case 0x20000000 ... 0x3fffffff: /* SRAM */
10004 case 0x60000000 ... 0x7fffffff: /* RAM */
10005 case 0x80000000 ... 0x9fffffff: /* RAM */
10006 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
10007 break;
10008 case 0x40000000 ... 0x5fffffff: /* Peripheral */
10009 case 0xa0000000 ... 0xbfffffff: /* Device */
10010 case 0xc0000000 ... 0xdfffffff: /* Device */
10011 case 0xe0000000 ... 0xffffffff: /* System */
10012 *prot = PAGE_READ | PAGE_WRITE;
10013 break;
10014 default:
10015 g_assert_not_reached();
10016 }
10017 }
10018 }
10019
10020 static bool pmsav7_use_background_region(ARMCPU *cpu,
10021 ARMMMUIdx mmu_idx, bool is_user)
10022 {
10023 /* Return true if we should use the default memory map as a
10024 * "background" region if there are no hits against any MPU regions.
10025 */
10026 CPUARMState *env = &cpu->env;
10027
10028 if (is_user) {
10029 return false;
10030 }
10031
10032 if (arm_feature(env, ARM_FEATURE_M)) {
10033 return env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)]
10034 & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
10035 } else {
10036 return regime_sctlr(env, mmu_idx) & SCTLR_BR;
10037 }
10038 }
10039
10040 static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address)
10041 {
10042 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
10043 return arm_feature(env, ARM_FEATURE_M) &&
10044 extract32(address, 20, 12) == 0xe00;
10045 }
10046
10047 static inline bool m_is_system_region(CPUARMState *env, uint32_t address)
10048 {
10049 /* True if address is in the M profile system region
10050 * 0xe0000000 - 0xffffffff
10051 */
10052 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7;
10053 }
10054
10055 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
10056 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10057 hwaddr *phys_ptr, int *prot,
10058 target_ulong *page_size,
10059 ARMMMUFaultInfo *fi)
10060 {
10061 ARMCPU *cpu = arm_env_get_cpu(env);
10062 int n;
10063 bool is_user = regime_is_user(env, mmu_idx);
10064
10065 *phys_ptr = address;
10066 *page_size = TARGET_PAGE_SIZE;
10067 *prot = 0;
10068
10069 if (regime_translation_disabled(env, mmu_idx) ||
10070 m_is_ppb_region(env, address)) {
10071 /* MPU disabled or M profile PPB access: use default memory map.
10072 * The other case which uses the default memory map in the
10073 * v7M ARM ARM pseudocode is exception vector reads from the vector
10074 * table. In QEMU those accesses are done in arm_v7m_load_vector(),
10075 * which always does a direct read using address_space_ldl(), rather
10076 * than going via this function, so we don't need to check that here.
10077 */
10078 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
10079 } else { /* MPU enabled */
10080 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
10081 /* region search */
10082 uint32_t base = env->pmsav7.drbar[n];
10083 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5);
10084 uint32_t rmask;
10085 bool srdis = false;
10086
10087 if (!(env->pmsav7.drsr[n] & 0x1)) {
10088 continue;
10089 }
10090
10091 if (!rsize) {
10092 qemu_log_mask(LOG_GUEST_ERROR,
10093 "DRSR[%d]: Rsize field cannot be 0\n", n);
10094 continue;
10095 }
10096 rsize++;
10097 rmask = (1ull << rsize) - 1;
10098
10099 if (base & rmask) {
10100 qemu_log_mask(LOG_GUEST_ERROR,
10101 "DRBAR[%d]: 0x%" PRIx32 " misaligned "
10102 "to DRSR region size, mask = 0x%" PRIx32 "\n",
10103 n, base, rmask);
10104 continue;
10105 }
10106
10107 if (address < base || address > base + rmask) {
10108 /*
10109 * Address not in this region. We must check whether the
10110 * region covers addresses in the same page as our address.
10111 * In that case we must not report a size that covers the
10112 * whole page for a subsequent hit against a different MPU
10113 * region or the background region, because it would result in
10114 * incorrect TLB hits for subsequent accesses to addresses that
10115 * are in this MPU region.
10116 */
10117 if (ranges_overlap(base, rmask,
10118 address & TARGET_PAGE_MASK,
10119 TARGET_PAGE_SIZE)) {
10120 *page_size = 1;
10121 }
10122 continue;
10123 }
10124
10125 /* Region matched */
10126
10127 if (rsize >= 8) { /* no subregions for regions < 256 bytes */
10128 int i, snd;
10129 uint32_t srdis_mask;
10130
10131 rsize -= 3; /* sub region size (power of 2) */
10132 snd = ((address - base) >> rsize) & 0x7;
10133 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1);
10134
10135 srdis_mask = srdis ? 0x3 : 0x0;
10136 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) {
10137 /* This will check in groups of 2, 4 and then 8, whether
10138 * the subregion bits are consistent. rsize is incremented
10139 * back up to give the region size, considering consistent
10140 * adjacent subregions as one region. Stop testing if rsize
10141 * is already big enough for an entire QEMU page.
10142 */
10143 int snd_rounded = snd & ~(i - 1);
10144 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n],
10145 snd_rounded + 8, i);
10146 if (srdis_mask ^ srdis_multi) {
10147 break;
10148 }
10149 srdis_mask = (srdis_mask << i) | srdis_mask;
10150 rsize++;
10151 }
10152 }
10153 if (srdis) {
10154 continue;
10155 }
10156 if (rsize < TARGET_PAGE_BITS) {
10157 *page_size = 1 << rsize;
10158 }
10159 break;
10160 }
10161
10162 if (n == -1) { /* no hits */
10163 if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
10164 /* background fault */
10165 fi->type = ARMFault_Background;
10166 return true;
10167 }
10168 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
10169 } else { /* a MPU hit! */
10170 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
10171 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
10172
10173 if (m_is_system_region(env, address)) {
10174 /* System space is always execute never */
10175 xn = 1;
10176 }
10177
10178 if (is_user) { /* User mode AP bit decoding */
10179 switch (ap) {
10180 case 0:
10181 case 1:
10182 case 5:
10183 break; /* no access */
10184 case 3:
10185 *prot |= PAGE_WRITE;
10186 /* fall through */
10187 case 2:
10188 case 6:
10189 *prot |= PAGE_READ | PAGE_EXEC;
10190 break;
10191 case 7:
10192 /* for v7M, same as 6; for R profile a reserved value */
10193 if (arm_feature(env, ARM_FEATURE_M)) {
10194 *prot |= PAGE_READ | PAGE_EXEC;
10195 break;
10196 }
10197 /* fall through */
10198 default:
10199 qemu_log_mask(LOG_GUEST_ERROR,
10200 "DRACR[%d]: Bad value for AP bits: 0x%"
10201 PRIx32 "\n", n, ap);
10202 }
10203 } else { /* Priv. mode AP bits decoding */
10204 switch (ap) {
10205 case 0:
10206 break; /* no access */
10207 case 1:
10208 case 2:
10209 case 3:
10210 *prot |= PAGE_WRITE;
10211 /* fall through */
10212 case 5:
10213 case 6:
10214 *prot |= PAGE_READ | PAGE_EXEC;
10215 break;
10216 case 7:
10217 /* for v7M, same as 6; for R profile a reserved value */
10218 if (arm_feature(env, ARM_FEATURE_M)) {
10219 *prot |= PAGE_READ | PAGE_EXEC;
10220 break;
10221 }
10222 /* fall through */
10223 default:
10224 qemu_log_mask(LOG_GUEST_ERROR,
10225 "DRACR[%d]: Bad value for AP bits: 0x%"
10226 PRIx32 "\n", n, ap);
10227 }
10228 }
10229
10230 /* execute never */
10231 if (xn) {
10232 *prot &= ~PAGE_EXEC;
10233 }
10234 }
10235 }
10236
10237 fi->type = ARMFault_Permission;
10238 fi->level = 1;
10239 return !(*prot & (1 << access_type));
10240 }
10241
10242 static bool v8m_is_sau_exempt(CPUARMState *env,
10243 uint32_t address, MMUAccessType access_type)
10244 {
10245 /* The architecture specifies that certain address ranges are
10246 * exempt from v8M SAU/IDAU checks.
10247 */
10248 return
10249 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
10250 (address >= 0xe0000000 && address <= 0xe0002fff) ||
10251 (address >= 0xe000e000 && address <= 0xe000efff) ||
10252 (address >= 0xe002e000 && address <= 0xe002efff) ||
10253 (address >= 0xe0040000 && address <= 0xe0041fff) ||
10254 (address >= 0xe00ff000 && address <= 0xe00fffff);
10255 }
10256
10257 static void v8m_security_lookup(CPUARMState *env, uint32_t address,
10258 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10259 V8M_SAttributes *sattrs)
10260 {
10261 /* Look up the security attributes for this address. Compare the
10262 * pseudocode SecurityCheck() function.
10263 * We assume the caller has zero-initialized *sattrs.
10264 */
10265 ARMCPU *cpu = arm_env_get_cpu(env);
10266 int r;
10267 bool idau_exempt = false, idau_ns = true, idau_nsc = true;
10268 int idau_region = IREGION_NOTVALID;
10269 uint32_t addr_page_base = address & TARGET_PAGE_MASK;
10270 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
10271
10272 if (cpu->idau) {
10273 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau);
10274 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau);
10275
10276 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns,
10277 &idau_nsc);
10278 }
10279
10280 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
10281 /* 0xf0000000..0xffffffff is always S for insn fetches */
10282 return;
10283 }
10284
10285 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) {
10286 sattrs->ns = !regime_is_secure(env, mmu_idx);
10287 return;
10288 }
10289
10290 if (idau_region != IREGION_NOTVALID) {
10291 sattrs->irvalid = true;
10292 sattrs->iregion = idau_region;
10293 }
10294
10295 switch (env->sau.ctrl & 3) {
10296 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
10297 break;
10298 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
10299 sattrs->ns = true;
10300 break;
10301 default: /* SAU.ENABLE == 1 */
10302 for (r = 0; r < cpu->sau_sregion; r++) {
10303 if (env->sau.rlar[r] & 1) {
10304 uint32_t base = env->sau.rbar[r] & ~0x1f;
10305 uint32_t limit = env->sau.rlar[r] | 0x1f;
10306
10307 if (base <= address && limit >= address) {
10308 if (base > addr_page_base || limit < addr_page_limit) {
10309 sattrs->subpage = true;
10310 }
10311 if (sattrs->srvalid) {
10312 /* If we hit in more than one region then we must report
10313 * as Secure, not NS-Callable, with no valid region
10314 * number info.
10315 */
10316 sattrs->ns = false;
10317 sattrs->nsc = false;
10318 sattrs->sregion = 0;
10319 sattrs->srvalid = false;
10320 break;
10321 } else {
10322 if (env->sau.rlar[r] & 2) {
10323 sattrs->nsc = true;
10324 } else {
10325 sattrs->ns = true;
10326 }
10327 sattrs->srvalid = true;
10328 sattrs->sregion = r;
10329 }
10330 } else {
10331 /*
10332 * Address not in this region. We must check whether the
10333 * region covers addresses in the same page as our address.
10334 * In that case we must not report a size that covers the
10335 * whole page for a subsequent hit against a different MPU
10336 * region or the background region, because it would result
10337 * in incorrect TLB hits for subsequent accesses to
10338 * addresses that are in this MPU region.
10339 */
10340 if (limit >= base &&
10341 ranges_overlap(base, limit - base + 1,
10342 addr_page_base,
10343 TARGET_PAGE_SIZE)) {
10344 sattrs->subpage = true;
10345 }
10346 }
10347 }
10348 }
10349
10350 /* The IDAU will override the SAU lookup results if it specifies
10351 * higher security than the SAU does.
10352 */
10353 if (!idau_ns) {
10354 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) {
10355 sattrs->ns = false;
10356 sattrs->nsc = idau_nsc;
10357 }
10358 }
10359 break;
10360 }
10361 }
10362
10363 static bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
10364 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10365 hwaddr *phys_ptr, MemTxAttrs *txattrs,
10366 int *prot, bool *is_subpage,
10367 ARMMMUFaultInfo *fi, uint32_t *mregion)
10368 {
10369 /* Perform a PMSAv8 MPU lookup (without also doing the SAU check
10370 * that a full phys-to-virt translation does).
10371 * mregion is (if not NULL) set to the region number which matched,
10372 * or -1 if no region number is returned (MPU off, address did not
10373 * hit a region, address hit in multiple regions).
10374 * We set is_subpage to true if the region hit doesn't cover the
10375 * entire TARGET_PAGE the address is within.
10376 */
10377 ARMCPU *cpu = arm_env_get_cpu(env);
10378 bool is_user = regime_is_user(env, mmu_idx);
10379 uint32_t secure = regime_is_secure(env, mmu_idx);
10380 int n;
10381 int matchregion = -1;
10382 bool hit = false;
10383 uint32_t addr_page_base = address & TARGET_PAGE_MASK;
10384 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
10385
10386 *is_subpage = false;
10387 *phys_ptr = address;
10388 *prot = 0;
10389 if (mregion) {
10390 *mregion = -1;
10391 }
10392
10393 /* Unlike the ARM ARM pseudocode, we don't need to check whether this
10394 * was an exception vector read from the vector table (which is always
10395 * done using the default system address map), because those accesses
10396 * are done in arm_v7m_load_vector(), which always does a direct
10397 * read using address_space_ldl(), rather than going via this function.
10398 */
10399 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */
10400 hit = true;
10401 } else if (m_is_ppb_region(env, address)) {
10402 hit = true;
10403 } else if (pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
10404 hit = true;
10405 } else {
10406 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
10407 /* region search */
10408 /* Note that the base address is bits [31:5] from the register
10409 * with bits [4:0] all zeroes, but the limit address is bits
10410 * [31:5] from the register with bits [4:0] all ones.
10411 */
10412 uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f;
10413 uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f;
10414
10415 if (!(env->pmsav8.rlar[secure][n] & 0x1)) {
10416 /* Region disabled */
10417 continue;
10418 }
10419
10420 if (address < base || address > limit) {
10421 /*
10422 * Address not in this region. We must check whether the
10423 * region covers addresses in the same page as our address.
10424 * In that case we must not report a size that covers the
10425 * whole page for a subsequent hit against a different MPU
10426 * region or the background region, because it would result in
10427 * incorrect TLB hits for subsequent accesses to addresses that
10428 * are in this MPU region.
10429 */
10430 if (limit >= base &&
10431 ranges_overlap(base, limit - base + 1,
10432 addr_page_base,
10433 TARGET_PAGE_SIZE)) {
10434 *is_subpage = true;
10435 }
10436 continue;
10437 }
10438
10439 if (base > addr_page_base || limit < addr_page_limit) {
10440 *is_subpage = true;
10441 }
10442
10443 if (hit) {
10444 /* Multiple regions match -- always a failure (unlike
10445 * PMSAv7 where highest-numbered-region wins)
10446 */
10447 fi->type = ARMFault_Permission;
10448 fi->level = 1;
10449 return true;
10450 }
10451
10452 matchregion = n;
10453 hit = true;
10454 }
10455 }
10456
10457 if (!hit) {
10458 /* background fault */
10459 fi->type = ARMFault_Background;
10460 return true;
10461 }
10462
10463 if (matchregion == -1) {
10464 /* hit using the background region */
10465 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
10466 } else {
10467 uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2);
10468 uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1);
10469
10470 if (m_is_system_region(env, address)) {
10471 /* System space is always execute never */
10472 xn = 1;
10473 }
10474
10475 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
10476 if (*prot && !xn) {
10477 *prot |= PAGE_EXEC;
10478 }
10479 /* We don't need to look the attribute up in the MAIR0/MAIR1
10480 * registers because that only tells us about cacheability.
10481 */
10482 if (mregion) {
10483 *mregion = matchregion;
10484 }
10485 }
10486
10487 fi->type = ARMFault_Permission;
10488 fi->level = 1;
10489 return !(*prot & (1 << access_type));
10490 }
10491
10492
10493 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
10494 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10495 hwaddr *phys_ptr, MemTxAttrs *txattrs,
10496 int *prot, target_ulong *page_size,
10497 ARMMMUFaultInfo *fi)
10498 {
10499 uint32_t secure = regime_is_secure(env, mmu_idx);
10500 V8M_SAttributes sattrs = {};
10501 bool ret;
10502 bool mpu_is_subpage;
10503
10504 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
10505 v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs);
10506 if (access_type == MMU_INST_FETCH) {
10507 /* Instruction fetches always use the MMU bank and the
10508 * transaction attribute determined by the fetch address,
10509 * regardless of CPU state. This is painful for QEMU
10510 * to handle, because it would mean we need to encode
10511 * into the mmu_idx not just the (user, negpri) information
10512 * for the current security state but also that for the
10513 * other security state, which would balloon the number
10514 * of mmu_idx values needed alarmingly.
10515 * Fortunately we can avoid this because it's not actually
10516 * possible to arbitrarily execute code from memory with
10517 * the wrong security attribute: it will always generate
10518 * an exception of some kind or another, apart from the
10519 * special case of an NS CPU executing an SG instruction
10520 * in S&NSC memory. So we always just fail the translation
10521 * here and sort things out in the exception handler
10522 * (including possibly emulating an SG instruction).
10523 */
10524 if (sattrs.ns != !secure) {
10525 if (sattrs.nsc) {
10526 fi->type = ARMFault_QEMU_NSCExec;
10527 } else {
10528 fi->type = ARMFault_QEMU_SFault;
10529 }
10530 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
10531 *phys_ptr = address;
10532 *prot = 0;
10533 return true;
10534 }
10535 } else {
10536 /* For data accesses we always use the MMU bank indicated
10537 * by the current CPU state, but the security attributes
10538 * might downgrade a secure access to nonsecure.
10539 */
10540 if (sattrs.ns) {
10541 txattrs->secure = false;
10542 } else if (!secure) {
10543 /* NS access to S memory must fault.
10544 * Architecturally we should first check whether the
10545 * MPU information for this address indicates that we
10546 * are doing an unaligned access to Device memory, which
10547 * should generate a UsageFault instead. QEMU does not
10548 * currently check for that kind of unaligned access though.
10549 * If we added it we would need to do so as a special case
10550 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
10551 */
10552 fi->type = ARMFault_QEMU_SFault;
10553 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
10554 *phys_ptr = address;
10555 *prot = 0;
10556 return true;
10557 }
10558 }
10559 }
10560
10561 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr,
10562 txattrs, prot, &mpu_is_subpage, fi, NULL);
10563 /*
10564 * TODO: this is a temporary hack to ignore the fact that the SAU region
10565 * is smaller than a page if this is an executable region. We never
10566 * supported small MPU regions, but we did (accidentally) allow small
10567 * SAU regions, and if we now made small SAU regions not be executable
10568 * then this would break previously working guest code. We can't
10569 * remove this until/unless we implement support for execution from
10570 * small regions.
10571 */
10572 if (*prot & PAGE_EXEC) {
10573 sattrs.subpage = false;
10574 }
10575 *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE;
10576 return ret;
10577 }
10578
10579 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
10580 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10581 hwaddr *phys_ptr, int *prot,
10582 ARMMMUFaultInfo *fi)
10583 {
10584 int n;
10585 uint32_t mask;
10586 uint32_t base;
10587 bool is_user = regime_is_user(env, mmu_idx);
10588
10589 if (regime_translation_disabled(env, mmu_idx)) {
10590 /* MPU disabled. */
10591 *phys_ptr = address;
10592 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
10593 return false;
10594 }
10595
10596 *phys_ptr = address;
10597 for (n = 7; n >= 0; n--) {
10598 base = env->cp15.c6_region[n];
10599 if ((base & 1) == 0) {
10600 continue;
10601 }
10602 mask = 1 << ((base >> 1) & 0x1f);
10603 /* Keep this shift separate from the above to avoid an
10604 (undefined) << 32. */
10605 mask = (mask << 1) - 1;
10606 if (((base ^ address) & ~mask) == 0) {
10607 break;
10608 }
10609 }
10610 if (n < 0) {
10611 fi->type = ARMFault_Background;
10612 return true;
10613 }
10614
10615 if (access_type == MMU_INST_FETCH) {
10616 mask = env->cp15.pmsav5_insn_ap;
10617 } else {
10618 mask = env->cp15.pmsav5_data_ap;
10619 }
10620 mask = (mask >> (n * 4)) & 0xf;
10621 switch (mask) {
10622 case 0:
10623 fi->type = ARMFault_Permission;
10624 fi->level = 1;
10625 return true;
10626 case 1:
10627 if (is_user) {
10628 fi->type = ARMFault_Permission;
10629 fi->level = 1;
10630 return true;
10631 }
10632 *prot = PAGE_READ | PAGE_WRITE;
10633 break;
10634 case 2:
10635 *prot = PAGE_READ;
10636 if (!is_user) {
10637 *prot |= PAGE_WRITE;
10638 }
10639 break;
10640 case 3:
10641 *prot = PAGE_READ | PAGE_WRITE;
10642 break;
10643 case 5:
10644 if (is_user) {
10645 fi->type = ARMFault_Permission;
10646 fi->level = 1;
10647 return true;
10648 }
10649 *prot = PAGE_READ;
10650 break;
10651 case 6:
10652 *prot = PAGE_READ;
10653 break;
10654 default:
10655 /* Bad permission. */
10656 fi->type = ARMFault_Permission;
10657 fi->level = 1;
10658 return true;
10659 }
10660 *prot |= PAGE_EXEC;
10661 return false;
10662 }
10663
10664 /* Combine either inner or outer cacheability attributes for normal
10665 * memory, according to table D4-42 and pseudocode procedure
10666 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
10667 *
10668 * NB: only stage 1 includes allocation hints (RW bits), leading to
10669 * some asymmetry.
10670 */
10671 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
10672 {
10673 if (s1 == 4 || s2 == 4) {
10674 /* non-cacheable has precedence */
10675 return 4;
10676 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
10677 /* stage 1 write-through takes precedence */
10678 return s1;
10679 } else if (extract32(s2, 2, 2) == 2) {
10680 /* stage 2 write-through takes precedence, but the allocation hint
10681 * is still taken from stage 1
10682 */
10683 return (2 << 2) | extract32(s1, 0, 2);
10684 } else { /* write-back */
10685 return s1;
10686 }
10687 }
10688
10689 /* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
10690 * and CombineS1S2Desc()
10691 *
10692 * @s1: Attributes from stage 1 walk
10693 * @s2: Attributes from stage 2 walk
10694 */
10695 static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2)
10696 {
10697 uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4);
10698 uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4);
10699 ARMCacheAttrs ret;
10700
10701 /* Combine shareability attributes (table D4-43) */
10702 if (s1.shareability == 2 || s2.shareability == 2) {
10703 /* if either are outer-shareable, the result is outer-shareable */
10704 ret.shareability = 2;
10705 } else if (s1.shareability == 3 || s2.shareability == 3) {
10706 /* if either are inner-shareable, the result is inner-shareable */
10707 ret.shareability = 3;
10708 } else {
10709 /* both non-shareable */
10710 ret.shareability = 0;
10711 }
10712
10713 /* Combine memory type and cacheability attributes */
10714 if (s1hi == 0 || s2hi == 0) {
10715 /* Device has precedence over normal */
10716 if (s1lo == 0 || s2lo == 0) {
10717 /* nGnRnE has precedence over anything */
10718 ret.attrs = 0;
10719 } else if (s1lo == 4 || s2lo == 4) {
10720 /* non-Reordering has precedence over Reordering */
10721 ret.attrs = 4; /* nGnRE */
10722 } else if (s1lo == 8 || s2lo == 8) {
10723 /* non-Gathering has precedence over Gathering */
10724 ret.attrs = 8; /* nGRE */
10725 } else {
10726 ret.attrs = 0xc; /* GRE */
10727 }
10728
10729 /* Any location for which the resultant memory type is any
10730 * type of Device memory is always treated as Outer Shareable.
10731 */
10732 ret.shareability = 2;
10733 } else { /* Normal memory */
10734 /* Outer/inner cacheability combine independently */
10735 ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
10736 | combine_cacheattr_nibble(s1lo, s2lo);
10737
10738 if (ret.attrs == 0x44) {
10739 /* Any location for which the resultant memory type is Normal
10740 * Inner Non-cacheable, Outer Non-cacheable is always treated
10741 * as Outer Shareable.
10742 */
10743 ret.shareability = 2;
10744 }
10745 }
10746
10747 return ret;
10748 }
10749
10750
10751 /* get_phys_addr - get the physical address for this virtual address
10752 *
10753 * Find the physical address corresponding to the given virtual address,
10754 * by doing a translation table walk on MMU based systems or using the
10755 * MPU state on MPU based systems.
10756 *
10757 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
10758 * prot and page_size may not be filled in, and the populated fsr value provides
10759 * information on why the translation aborted, in the format of a
10760 * DFSR/IFSR fault register, with the following caveats:
10761 * * we honour the short vs long DFSR format differences.
10762 * * the WnR bit is never set (the caller must do this).
10763 * * for PSMAv5 based systems we don't bother to return a full FSR format
10764 * value.
10765 *
10766 * @env: CPUARMState
10767 * @address: virtual address to get physical address for
10768 * @access_type: 0 for read, 1 for write, 2 for execute
10769 * @mmu_idx: MMU index indicating required translation regime
10770 * @phys_ptr: set to the physical address corresponding to the virtual address
10771 * @attrs: set to the memory transaction attributes to use
10772 * @prot: set to the permissions for the page containing phys_ptr
10773 * @page_size: set to the size of the page containing phys_ptr
10774 * @fi: set to fault info if the translation fails
10775 * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
10776 */
10777 static bool get_phys_addr(CPUARMState *env, target_ulong address,
10778 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10779 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
10780 target_ulong *page_size,
10781 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
10782 {
10783 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
10784 /* Call ourselves recursively to do the stage 1 and then stage 2
10785 * translations.
10786 */
10787 if (arm_feature(env, ARM_FEATURE_EL2)) {
10788 hwaddr ipa;
10789 int s2_prot;
10790 int ret;
10791 ARMCacheAttrs cacheattrs2 = {};
10792
10793 ret = get_phys_addr(env, address, access_type,
10794 stage_1_mmu_idx(mmu_idx), &ipa, attrs,
10795 prot, page_size, fi, cacheattrs);
10796
10797 /* If S1 fails or S2 is disabled, return early. */
10798 if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
10799 *phys_ptr = ipa;
10800 return ret;
10801 }
10802
10803 /* S1 is done. Now do S2 translation. */
10804 ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS,
10805 phys_ptr, attrs, &s2_prot,
10806 page_size, fi,
10807 cacheattrs != NULL ? &cacheattrs2 : NULL);
10808 fi->s2addr = ipa;
10809 /* Combine the S1 and S2 perms. */
10810 *prot &= s2_prot;
10811
10812 /* Combine the S1 and S2 cache attributes, if needed */
10813 if (!ret && cacheattrs != NULL) {
10814 if (env->cp15.hcr_el2 & HCR_DC) {
10815 /*
10816 * HCR.DC forces the first stage attributes to
10817 * Normal Non-Shareable,
10818 * Inner Write-Back Read-Allocate Write-Allocate,
10819 * Outer Write-Back Read-Allocate Write-Allocate.
10820 */
10821 cacheattrs->attrs = 0xff;
10822 cacheattrs->shareability = 0;
10823 }
10824 *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
10825 }
10826
10827 return ret;
10828 } else {
10829 /*
10830 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
10831 */
10832 mmu_idx = stage_1_mmu_idx(mmu_idx);
10833 }
10834 }
10835
10836 /* The page table entries may downgrade secure to non-secure, but
10837 * cannot upgrade an non-secure translation regime's attributes
10838 * to secure.
10839 */
10840 attrs->secure = regime_is_secure(env, mmu_idx);
10841 attrs->user = regime_is_user(env, mmu_idx);
10842
10843 /* Fast Context Switch Extension. This doesn't exist at all in v8.
10844 * In v7 and earlier it affects all stage 1 translations.
10845 */
10846 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS
10847 && !arm_feature(env, ARM_FEATURE_V8)) {
10848 if (regime_el(env, mmu_idx) == 3) {
10849 address += env->cp15.fcseidr_s;
10850 } else {
10851 address += env->cp15.fcseidr_ns;
10852 }
10853 }
10854
10855 if (arm_feature(env, ARM_FEATURE_PMSA)) {
10856 bool ret;
10857 *page_size = TARGET_PAGE_SIZE;
10858
10859 if (arm_feature(env, ARM_FEATURE_V8)) {
10860 /* PMSAv8 */
10861 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx,
10862 phys_ptr, attrs, prot, page_size, fi);
10863 } else if (arm_feature(env, ARM_FEATURE_V7)) {
10864 /* PMSAv7 */
10865 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
10866 phys_ptr, prot, page_size, fi);
10867 } else {
10868 /* Pre-v7 MPU */
10869 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
10870 phys_ptr, prot, fi);
10871 }
10872 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32
10873 " mmu_idx %u -> %s (prot %c%c%c)\n",
10874 access_type == MMU_DATA_LOAD ? "reading" :
10875 (access_type == MMU_DATA_STORE ? "writing" : "execute"),
10876 (uint32_t)address, mmu_idx,
10877 ret ? "Miss" : "Hit",
10878 *prot & PAGE_READ ? 'r' : '-',
10879 *prot & PAGE_WRITE ? 'w' : '-',
10880 *prot & PAGE_EXEC ? 'x' : '-');
10881
10882 return ret;
10883 }
10884
10885 /* Definitely a real MMU, not an MPU */
10886
10887 if (regime_translation_disabled(env, mmu_idx)) {
10888 /* MMU disabled. */
10889 *phys_ptr = address;
10890 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
10891 *page_size = TARGET_PAGE_SIZE;
10892 return 0;
10893 }
10894
10895 if (regime_using_lpae_format(env, mmu_idx)) {
10896 return get_phys_addr_lpae(env, address, access_type, mmu_idx,
10897 phys_ptr, attrs, prot, page_size,
10898 fi, cacheattrs);
10899 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
10900 return get_phys_addr_v6(env, address, access_type, mmu_idx,
10901 phys_ptr, attrs, prot, page_size, fi);
10902 } else {
10903 return get_phys_addr_v5(env, address, access_type, mmu_idx,
10904 phys_ptr, prot, page_size, fi);
10905 }
10906 }
10907
10908 /* Walk the page table and (if the mapping exists) add the page
10909 * to the TLB. Return false on success, or true on failure. Populate
10910 * fsr with ARM DFSR/IFSR fault register format value on failure.
10911 */
10912 bool arm_tlb_fill(CPUState *cs, vaddr address,
10913 MMUAccessType access_type, int mmu_idx,
10914 ARMMMUFaultInfo *fi)
10915 {
10916 ARMCPU *cpu = ARM_CPU(cs);
10917 CPUARMState *env = &cpu->env;
10918 hwaddr phys_addr;
10919 target_ulong page_size;
10920 int prot;
10921 int ret;
10922 MemTxAttrs attrs = {};
10923
10924 ret = get_phys_addr(env, address, access_type,
10925 core_to_arm_mmu_idx(env, mmu_idx), &phys_addr,
10926 &attrs, &prot, &page_size, fi, NULL);
10927 if (!ret) {
10928 /*
10929 * Map a single [sub]page. Regions smaller than our declared
10930 * target page size are handled specially, so for those we
10931 * pass in the exact addresses.
10932 */
10933 if (page_size >= TARGET_PAGE_SIZE) {
10934 phys_addr &= TARGET_PAGE_MASK;
10935 address &= TARGET_PAGE_MASK;
10936 }
10937 tlb_set_page_with_attrs(cs, address, phys_addr, attrs,
10938 prot, mmu_idx, page_size);
10939 return 0;
10940 }
10941
10942 return ret;
10943 }
10944
10945 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
10946 MemTxAttrs *attrs)
10947 {
10948 ARMCPU *cpu = ARM_CPU(cs);
10949 CPUARMState *env = &cpu->env;
10950 hwaddr phys_addr;
10951 target_ulong page_size;
10952 int prot;
10953 bool ret;
10954 ARMMMUFaultInfo fi = {};
10955 ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
10956
10957 *attrs = (MemTxAttrs) {};
10958
10959 ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
10960 attrs, &prot, &page_size, &fi, NULL);
10961
10962 if (ret) {
10963 return -1;
10964 }
10965 return phys_addr;
10966 }
10967
10968 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
10969 {
10970 uint32_t mask;
10971 unsigned el = arm_current_el(env);
10972
10973 /* First handle registers which unprivileged can read */
10974
10975 switch (reg) {
10976 case 0 ... 7: /* xPSR sub-fields */
10977 mask = 0;
10978 if ((reg & 1) && el) {
10979 mask |= XPSR_EXCP; /* IPSR (unpriv. reads as zero) */
10980 }
10981 if (!(reg & 4)) {
10982 mask |= XPSR_NZCV | XPSR_Q; /* APSR */
10983 }
10984 /* EPSR reads as zero */
10985 return xpsr_read(env) & mask;
10986 break;
10987 case 20: /* CONTROL */
10988 return env->v7m.control[env->v7m.secure];
10989 case 0x94: /* CONTROL_NS */
10990 /* We have to handle this here because unprivileged Secure code
10991 * can read the NS CONTROL register.
10992 */
10993 if (!env->v7m.secure) {
10994 return 0;
10995 }
10996 return env->v7m.control[M_REG_NS];
10997 }
10998
10999 if (el == 0) {
11000 return 0; /* unprivileged reads others as zero */
11001 }
11002
11003 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
11004 switch (reg) {
11005 case 0x88: /* MSP_NS */
11006 if (!env->v7m.secure) {
11007 return 0;
11008 }
11009 return env->v7m.other_ss_msp;
11010 case 0x89: /* PSP_NS */
11011 if (!env->v7m.secure) {
11012 return 0;
11013 }
11014 return env->v7m.other_ss_psp;
11015 case 0x8a: /* MSPLIM_NS */
11016 if (!env->v7m.secure) {
11017 return 0;
11018 }
11019 return env->v7m.msplim[M_REG_NS];
11020 case 0x8b: /* PSPLIM_NS */
11021 if (!env->v7m.secure) {
11022 return 0;
11023 }
11024 return env->v7m.psplim[M_REG_NS];
11025 case 0x90: /* PRIMASK_NS */
11026 if (!env->v7m.secure) {
11027 return 0;
11028 }
11029 return env->v7m.primask[M_REG_NS];
11030 case 0x91: /* BASEPRI_NS */
11031 if (!env->v7m.secure) {
11032 return 0;
11033 }
11034 return env->v7m.basepri[M_REG_NS];
11035 case 0x93: /* FAULTMASK_NS */
11036 if (!env->v7m.secure) {
11037 return 0;
11038 }
11039 return env->v7m.faultmask[M_REG_NS];
11040 case 0x98: /* SP_NS */
11041 {
11042 /* This gives the non-secure SP selected based on whether we're
11043 * currently in handler mode or not, using the NS CONTROL.SPSEL.
11044 */
11045 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
11046
11047 if (!env->v7m.secure) {
11048 return 0;
11049 }
11050 if (!arm_v7m_is_handler_mode(env) && spsel) {
11051 return env->v7m.other_ss_psp;
11052 } else {
11053 return env->v7m.other_ss_msp;
11054 }
11055 }
11056 default:
11057 break;
11058 }
11059 }
11060
11061 switch (reg) {
11062 case 8: /* MSP */
11063 return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];
11064 case 9: /* PSP */
11065 return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;
11066 case 10: /* MSPLIM */
11067 if (!arm_feature(env, ARM_FEATURE_V8)) {
11068 goto bad_reg;
11069 }
11070 return env->v7m.msplim[env->v7m.secure];
11071 case 11: /* PSPLIM */
11072 if (!arm_feature(env, ARM_FEATURE_V8)) {
11073 goto bad_reg;
11074 }
11075 return env->v7m.psplim[env->v7m.secure];
11076 case 16: /* PRIMASK */
11077 return env->v7m.primask[env->v7m.secure];
11078 case 17: /* BASEPRI */
11079 case 18: /* BASEPRI_MAX */
11080 return env->v7m.basepri[env->v7m.secure];
11081 case 19: /* FAULTMASK */
11082 return env->v7m.faultmask[env->v7m.secure];
11083 default:
11084 bad_reg:
11085 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"
11086 " register %d\n", reg);
11087 return 0;
11088 }
11089 }
11090
11091 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
11092 {
11093 /* We're passed bits [11..0] of the instruction; extract
11094 * SYSm and the mask bits.
11095 * Invalid combinations of SYSm and mask are UNPREDICTABLE;
11096 * we choose to treat them as if the mask bits were valid.
11097 * NB that the pseudocode 'mask' variable is bits [11..10],
11098 * whereas ours is [11..8].
11099 */
11100 uint32_t mask = extract32(maskreg, 8, 4);
11101 uint32_t reg = extract32(maskreg, 0, 8);
11102
11103 if (arm_current_el(env) == 0 && reg > 7) {
11104 /* only xPSR sub-fields may be written by unprivileged */
11105 return;
11106 }
11107
11108 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
11109 switch (reg) {
11110 case 0x88: /* MSP_NS */
11111 if (!env->v7m.secure) {
11112 return;
11113 }
11114 env->v7m.other_ss_msp = val;
11115 return;
11116 case 0x89: /* PSP_NS */
11117 if (!env->v7m.secure) {
11118 return;
11119 }
11120 env->v7m.other_ss_psp = val;
11121 return;
11122 case 0x8a: /* MSPLIM_NS */
11123 if (!env->v7m.secure) {
11124 return;
11125 }
11126 env->v7m.msplim[M_REG_NS] = val & ~7;
11127 return;
11128 case 0x8b: /* PSPLIM_NS */
11129 if (!env->v7m.secure) {
11130 return;
11131 }
11132 env->v7m.psplim[M_REG_NS] = val & ~7;
11133 return;
11134 case 0x90: /* PRIMASK_NS */
11135 if (!env->v7m.secure) {
11136 return;
11137 }
11138 env->v7m.primask[M_REG_NS] = val & 1;
11139 return;
11140 case 0x91: /* BASEPRI_NS */
11141 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) {
11142 return;
11143 }
11144 env->v7m.basepri[M_REG_NS] = val & 0xff;
11145 return;
11146 case 0x93: /* FAULTMASK_NS */
11147 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) {
11148 return;
11149 }
11150 env->v7m.faultmask[M_REG_NS] = val & 1;
11151 return;
11152 case 0x94: /* CONTROL_NS */
11153 if (!env->v7m.secure) {
11154 return;
11155 }
11156 write_v7m_control_spsel_for_secstate(env,
11157 val & R_V7M_CONTROL_SPSEL_MASK,
11158 M_REG_NS);
11159 if (arm_feature(env, ARM_FEATURE_M_MAIN)) {
11160 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK;
11161 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK;
11162 }
11163 return;
11164 case 0x98: /* SP_NS */
11165 {
11166 /* This gives the non-secure SP selected based on whether we're
11167 * currently in handler mode or not, using the NS CONTROL.SPSEL.
11168 */
11169 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK;
11170 bool is_psp = !arm_v7m_is_handler_mode(env) && spsel;
11171 uint32_t limit;
11172
11173 if (!env->v7m.secure) {
11174 return;
11175 }
11176
11177 limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
11178
11179 if (val < limit) {
11180 CPUState *cs = CPU(arm_env_get_cpu(env));
11181
11182 cpu_restore_state(cs, GETPC(), true);
11183 raise_exception(env, EXCP_STKOF, 0, 1);
11184 }
11185
11186 if (is_psp) {
11187 env->v7m.other_ss_psp = val;
11188 } else {
11189 env->v7m.other_ss_msp = val;
11190 }
11191 return;
11192 }
11193 default:
11194 break;
11195 }
11196 }
11197
11198 switch (reg) {
11199 case 0 ... 7: /* xPSR sub-fields */
11200 /* only APSR is actually writable */
11201 if (!(reg & 4)) {
11202 uint32_t apsrmask = 0;
11203
11204 if (mask & 8) {
11205 apsrmask |= XPSR_NZCV | XPSR_Q;
11206 }
11207 if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
11208 apsrmask |= XPSR_GE;
11209 }
11210 xpsr_write(env, val, apsrmask);
11211 }
11212 break;
11213 case 8: /* MSP */
11214 if (v7m_using_psp(env)) {
11215 env->v7m.other_sp = val;
11216 } else {
11217 env->regs[13] = val;
11218 }
11219 break;
11220 case 9: /* PSP */
11221 if (v7m_using_psp(env)) {
11222 env->regs[13] = val;
11223 } else {
11224 env->v7m.other_sp = val;
11225 }
11226 break;
11227 case 10: /* MSPLIM */
11228 if (!arm_feature(env, ARM_FEATURE_V8)) {
11229 goto bad_reg;
11230 }
11231 env->v7m.msplim[env->v7m.secure] = val & ~7;
11232 break;
11233 case 11: /* PSPLIM */
11234 if (!arm_feature(env, ARM_FEATURE_V8)) {
11235 goto bad_reg;
11236 }
11237 env->v7m.psplim[env->v7m.secure] = val & ~7;
11238 break;
11239 case 16: /* PRIMASK */
11240 env->v7m.primask[env->v7m.secure] = val & 1;
11241 break;
11242 case 17: /* BASEPRI */
11243 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
11244 goto bad_reg;
11245 }
11246 env->v7m.basepri[env->v7m.secure] = val & 0xff;
11247 break;
11248 case 18: /* BASEPRI_MAX */
11249 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
11250 goto bad_reg;
11251 }
11252 val &= 0xff;
11253 if (val != 0 && (val < env->v7m.basepri[env->v7m.secure]
11254 || env->v7m.basepri[env->v7m.secure] == 0)) {
11255 env->v7m.basepri[env->v7m.secure] = val;
11256 }
11257 break;
11258 case 19: /* FAULTMASK */
11259 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
11260 goto bad_reg;
11261 }
11262 env->v7m.faultmask[env->v7m.secure] = val & 1;
11263 break;
11264 case 20: /* CONTROL */
11265 /* Writing to the SPSEL bit only has an effect if we are in
11266 * thread mode; other bits can be updated by any privileged code.
11267 * write_v7m_control_spsel() deals with updating the SPSEL bit in
11268 * env->v7m.control, so we only need update the others.
11269 * For v7M, we must just ignore explicit writes to SPSEL in handler
11270 * mode; for v8M the write is permitted but will have no effect.
11271 */
11272 if (arm_feature(env, ARM_FEATURE_V8) ||
11273 !arm_v7m_is_handler_mode(env)) {
11274 write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
11275 }
11276 if (arm_feature(env, ARM_FEATURE_M_MAIN)) {
11277 env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
11278 env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
11279 }
11280 break;
11281 default:
11282 bad_reg:
11283 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
11284 " register %d\n", reg);
11285 return;
11286 }
11287 }
11288
11289 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
11290 {
11291 /* Implement the TT instruction. op is bits [7:6] of the insn. */
11292 bool forceunpriv = op & 1;
11293 bool alt = op & 2;
11294 V8M_SAttributes sattrs = {};
11295 uint32_t tt_resp;
11296 bool r, rw, nsr, nsrw, mrvalid;
11297 int prot;
11298 ARMMMUFaultInfo fi = {};
11299 MemTxAttrs attrs = {};
11300 hwaddr phys_addr;
11301 ARMMMUIdx mmu_idx;
11302 uint32_t mregion;
11303 bool targetpriv;
11304 bool targetsec = env->v7m.secure;
11305 bool is_subpage;
11306
11307 /* Work out what the security state and privilege level we're
11308 * interested in is...
11309 */
11310 if (alt) {
11311 targetsec = !targetsec;
11312 }
11313
11314 if (forceunpriv) {
11315 targetpriv = false;
11316 } else {
11317 targetpriv = arm_v7m_is_handler_mode(env) ||
11318 !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK);
11319 }
11320
11321 /* ...and then figure out which MMU index this is */
11322 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv);
11323
11324 /* We know that the MPU and SAU don't care about the access type
11325 * for our purposes beyond that we don't want to claim to be
11326 * an insn fetch, so we arbitrarily call this a read.
11327 */
11328
11329 /* MPU region info only available for privileged or if
11330 * inspecting the other MPU state.
11331 */
11332 if (arm_current_el(env) != 0 || alt) {
11333 /* We can ignore the return value as prot is always set */
11334 pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx,
11335 &phys_addr, &attrs, &prot, &is_subpage,
11336 &fi, &mregion);
11337 if (mregion == -1) {
11338 mrvalid = false;
11339 mregion = 0;
11340 } else {
11341 mrvalid = true;
11342 }
11343 r = prot & PAGE_READ;
11344 rw = prot & PAGE_WRITE;
11345 } else {
11346 r = false;
11347 rw = false;
11348 mrvalid = false;
11349 mregion = 0;
11350 }
11351
11352 if (env->v7m.secure) {
11353 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs);
11354 nsr = sattrs.ns && r;
11355 nsrw = sattrs.ns && rw;
11356 } else {
11357 sattrs.ns = true;
11358 nsr = false;
11359 nsrw = false;
11360 }
11361
11362 tt_resp = (sattrs.iregion << 24) |
11363 (sattrs.irvalid << 23) |
11364 ((!sattrs.ns) << 22) |
11365 (nsrw << 21) |
11366 (nsr << 20) |
11367 (rw << 19) |
11368 (r << 18) |
11369 (sattrs.srvalid << 17) |
11370 (mrvalid << 16) |
11371 (sattrs.sregion << 8) |
11372 mregion;
11373
11374 return tt_resp;
11375 }
11376
11377 #endif
11378
11379 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
11380 {
11381 /* Implement DC ZVA, which zeroes a fixed-length block of memory.
11382 * Note that we do not implement the (architecturally mandated)
11383 * alignment fault for attempts to use this on Device memory
11384 * (which matches the usual QEMU behaviour of not implementing either
11385 * alignment faults or any memory attribute handling).
11386 */
11387
11388 ARMCPU *cpu = arm_env_get_cpu(env);
11389 uint64_t blocklen = 4 << cpu->dcz_blocksize;
11390 uint64_t vaddr = vaddr_in & ~(blocklen - 1);
11391
11392 #ifndef CONFIG_USER_ONLY
11393 {
11394 /* Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than
11395 * the block size so we might have to do more than one TLB lookup.
11396 * We know that in fact for any v8 CPU the page size is at least 4K
11397 * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
11398 * 1K as an artefact of legacy v5 subpage support being present in the
11399 * same QEMU executable.
11400 */
11401 int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
11402 void *hostaddr[maxidx];
11403 int try, i;
11404 unsigned mmu_idx = cpu_mmu_index(env, false);
11405 TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
11406
11407 for (try = 0; try < 2; try++) {
11408
11409 for (i = 0; i < maxidx; i++) {
11410 hostaddr[i] = tlb_vaddr_to_host(env,
11411 vaddr + TARGET_PAGE_SIZE * i,
11412 1, mmu_idx);
11413 if (!hostaddr[i]) {
11414 break;
11415 }
11416 }
11417 if (i == maxidx) {
11418 /* If it's all in the TLB it's fair game for just writing to;
11419 * we know we don't need to update dirty status, etc.
11420 */
11421 for (i = 0; i < maxidx - 1; i++) {
11422 memset(hostaddr[i], 0, TARGET_PAGE_SIZE);
11423 }
11424 memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE));
11425 return;
11426 }
11427 /* OK, try a store and see if we can populate the tlb. This
11428 * might cause an exception if the memory isn't writable,
11429 * in which case we will longjmp out of here. We must for
11430 * this purpose use the actual register value passed to us
11431 * so that we get the fault address right.
11432 */
11433 helper_ret_stb_mmu(env, vaddr_in, 0, oi, GETPC());
11434 /* Now we can populate the other TLB entries, if any */
11435 for (i = 0; i < maxidx; i++) {
11436 uint64_t va = vaddr + TARGET_PAGE_SIZE * i;
11437 if (va != (vaddr_in & TARGET_PAGE_MASK)) {
11438 helper_ret_stb_mmu(env, va, 0, oi, GETPC());
11439 }
11440 }
11441 }
11442
11443 /* Slow path (probably attempt to do this to an I/O device or
11444 * similar, or clearing of a block of code we have translations
11445 * cached for). Just do a series of byte writes as the architecture
11446 * demands. It's not worth trying to use a cpu_physical_memory_map(),
11447 * memset(), unmap() sequence here because:
11448 * + we'd need to account for the blocksize being larger than a page
11449 * + the direct-RAM access case is almost always going to be dealt
11450 * with in the fastpath code above, so there's no speed benefit
11451 * + we would have to deal with the map returning NULL because the
11452 * bounce buffer was in use
11453 */
11454 for (i = 0; i < blocklen; i++) {
11455 helper_ret_stb_mmu(env, vaddr + i, 0, oi, GETPC());
11456 }
11457 }
11458 #else
11459 memset(g2h(vaddr), 0, blocklen);
11460 #endif
11461 }
11462
11463 /* Note that signed overflow is undefined in C. The following routines are
11464 careful to use unsigned types where modulo arithmetic is required.
11465 Failure to do so _will_ break on newer gcc. */
11466
11467 /* Signed saturating arithmetic. */
11468
11469 /* Perform 16-bit signed saturating addition. */
11470 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
11471 {
11472 uint16_t res;
11473
11474 res = a + b;
11475 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
11476 if (a & 0x8000)
11477 res = 0x8000;
11478 else
11479 res = 0x7fff;
11480 }
11481 return res;
11482 }
11483
11484 /* Perform 8-bit signed saturating addition. */
11485 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
11486 {
11487 uint8_t res;
11488
11489 res = a + b;
11490 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
11491 if (a & 0x80)
11492 res = 0x80;
11493 else
11494 res = 0x7f;
11495 }
11496 return res;
11497 }
11498
11499 /* Perform 16-bit signed saturating subtraction. */
11500 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
11501 {
11502 uint16_t res;
11503
11504 res = a - b;
11505 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
11506 if (a & 0x8000)
11507 res = 0x8000;
11508 else
11509 res = 0x7fff;
11510 }
11511 return res;
11512 }
11513
11514 /* Perform 8-bit signed saturating subtraction. */
11515 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
11516 {
11517 uint8_t res;
11518
11519 res = a - b;
11520 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
11521 if (a & 0x80)
11522 res = 0x80;
11523 else
11524 res = 0x7f;
11525 }
11526 return res;
11527 }
11528
11529 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
11530 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
11531 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8);
11532 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8);
11533 #define PFX q
11534
11535 #include "op_addsub.h"
11536
11537 /* Unsigned saturating arithmetic. */
11538 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
11539 {
11540 uint16_t res;
11541 res = a + b;
11542 if (res < a)
11543 res = 0xffff;
11544 return res;
11545 }
11546
11547 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
11548 {
11549 if (a > b)
11550 return a - b;
11551 else
11552 return 0;
11553 }
11554
11555 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
11556 {
11557 uint8_t res;
11558 res = a + b;
11559 if (res < a)
11560 res = 0xff;
11561 return res;
11562 }
11563
11564 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
11565 {
11566 if (a > b)
11567 return a - b;
11568 else
11569 return 0;
11570 }
11571
11572 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
11573 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
11574 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8);
11575 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8);
11576 #define PFX uq
11577
11578 #include "op_addsub.h"
11579
11580 /* Signed modulo arithmetic. */
11581 #define SARITH16(a, b, n, op) do { \
11582 int32_t sum; \
11583 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
11584 RESULT(sum, n, 16); \
11585 if (sum >= 0) \
11586 ge |= 3 << (n * 2); \
11587 } while(0)
11588
11589 #define SARITH8(a, b, n, op) do { \
11590 int32_t sum; \
11591 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
11592 RESULT(sum, n, 8); \
11593 if (sum >= 0) \
11594 ge |= 1 << n; \
11595 } while(0)
11596
11597
11598 #define ADD16(a, b, n) SARITH16(a, b, n, +)
11599 #define SUB16(a, b, n) SARITH16(a, b, n, -)
11600 #define ADD8(a, b, n) SARITH8(a, b, n, +)
11601 #define SUB8(a, b, n) SARITH8(a, b, n, -)
11602 #define PFX s
11603 #define ARITH_GE
11604
11605 #include "op_addsub.h"
11606
11607 /* Unsigned modulo arithmetic. */
11608 #define ADD16(a, b, n) do { \
11609 uint32_t sum; \
11610 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
11611 RESULT(sum, n, 16); \
11612 if ((sum >> 16) == 1) \
11613 ge |= 3 << (n * 2); \
11614 } while(0)
11615
11616 #define ADD8(a, b, n) do { \
11617 uint32_t sum; \
11618 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
11619 RESULT(sum, n, 8); \
11620 if ((sum >> 8) == 1) \
11621 ge |= 1 << n; \
11622 } while(0)
11623
11624 #define SUB16(a, b, n) do { \
11625 uint32_t sum; \
11626 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
11627 RESULT(sum, n, 16); \
11628 if ((sum >> 16) == 0) \
11629 ge |= 3 << (n * 2); \
11630 } while(0)
11631
11632 #define SUB8(a, b, n) do { \
11633 uint32_t sum; \
11634 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
11635 RESULT(sum, n, 8); \
11636 if ((sum >> 8) == 0) \
11637 ge |= 1 << n; \
11638 } while(0)
11639
11640 #define PFX u
11641 #define ARITH_GE
11642
11643 #include "op_addsub.h"
11644
11645 /* Halved signed arithmetic. */
11646 #define ADD16(a, b, n) \
11647 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
11648 #define SUB16(a, b, n) \
11649 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
11650 #define ADD8(a, b, n) \
11651 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
11652 #define SUB8(a, b, n) \
11653 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
11654 #define PFX sh
11655
11656 #include "op_addsub.h"
11657
11658 /* Halved unsigned arithmetic. */
11659 #define ADD16(a, b, n) \
11660 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
11661 #define SUB16(a, b, n) \
11662 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
11663 #define ADD8(a, b, n) \
11664 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
11665 #define SUB8(a, b, n) \
11666 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
11667 #define PFX uh
11668
11669 #include "op_addsub.h"
11670
11671 static inline uint8_t do_usad(uint8_t a, uint8_t b)
11672 {
11673 if (a > b)
11674 return a - b;
11675 else
11676 return b - a;
11677 }
11678
11679 /* Unsigned sum of absolute byte differences. */
11680 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
11681 {
11682 uint32_t sum;
11683 sum = do_usad(a, b);
11684 sum += do_usad(a >> 8, b >> 8);
11685 sum += do_usad(a >> 16, b >>16);
11686 sum += do_usad(a >> 24, b >> 24);
11687 return sum;
11688 }
11689
11690 /* For ARMv6 SEL instruction. */
11691 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
11692 {
11693 uint32_t mask;
11694
11695 mask = 0;
11696 if (flags & 1)
11697 mask |= 0xff;
11698 if (flags & 2)
11699 mask |= 0xff00;
11700 if (flags & 4)
11701 mask |= 0xff0000;
11702 if (flags & 8)
11703 mask |= 0xff000000;
11704 return (a & mask) | (b & ~mask);
11705 }
11706
11707 /* VFP support. We follow the convention used for VFP instructions:
11708 Single precision routines have a "s" suffix, double precision a
11709 "d" suffix. */
11710
11711 /* Convert host exception flags to vfp form. */
11712 static inline int vfp_exceptbits_from_host(int host_bits)
11713 {
11714 int target_bits = 0;
11715
11716 if (host_bits & float_flag_invalid)
11717 target_bits |= 1;
11718 if (host_bits & float_flag_divbyzero)
11719 target_bits |= 2;
11720 if (host_bits & float_flag_overflow)
11721 target_bits |= 4;
11722 if (host_bits & (float_flag_underflow | float_flag_output_denormal))
11723 target_bits |= 8;
11724 if (host_bits & float_flag_inexact)
11725 target_bits |= 0x10;
11726 if (host_bits & float_flag_input_denormal)
11727 target_bits |= 0x80;
11728 return target_bits;
11729 }
11730
11731 uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
11732 {
11733 int i;
11734 uint32_t fpscr;
11735
11736 fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
11737 | (env->vfp.vec_len << 16)
11738 | (env->vfp.vec_stride << 20);
11739
11740 i = get_float_exception_flags(&env->vfp.fp_status);
11741 i |= get_float_exception_flags(&env->vfp.standard_fp_status);
11742 /* FZ16 does not generate an input denormal exception. */
11743 i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
11744 & ~float_flag_input_denormal);
11745
11746 fpscr |= vfp_exceptbits_from_host(i);
11747 return fpscr;
11748 }
11749
11750 uint32_t vfp_get_fpscr(CPUARMState *env)
11751 {
11752 return HELPER(vfp_get_fpscr)(env);
11753 }
11754
11755 /* Convert vfp exception flags to target form. */
11756 static inline int vfp_exceptbits_to_host(int target_bits)
11757 {
11758 int host_bits = 0;
11759
11760 if (target_bits & 1)
11761 host_bits |= float_flag_invalid;
11762 if (target_bits & 2)
11763 host_bits |= float_flag_divbyzero;
11764 if (target_bits & 4)
11765 host_bits |= float_flag_overflow;
11766 if (target_bits & 8)
11767 host_bits |= float_flag_underflow;
11768 if (target_bits & 0x10)
11769 host_bits |= float_flag_inexact;
11770 if (target_bits & 0x80)
11771 host_bits |= float_flag_input_denormal;
11772 return host_bits;
11773 }
11774
11775 void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
11776 {
11777 int i;
11778 uint32_t changed;
11779
11780 /* When ARMv8.2-FP16 is not supported, FZ16 is RES0. */
11781 if (!cpu_isar_feature(aa64_fp16, arm_env_get_cpu(env))) {
11782 val &= ~FPCR_FZ16;
11783 }
11784
11785 changed = env->vfp.xregs[ARM_VFP_FPSCR];
11786 env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
11787 env->vfp.vec_len = (val >> 16) & 7;
11788 env->vfp.vec_stride = (val >> 20) & 3;
11789
11790 changed ^= val;
11791 if (changed & (3 << 22)) {
11792 i = (val >> 22) & 3;
11793 switch (i) {
11794 case FPROUNDING_TIEEVEN:
11795 i = float_round_nearest_even;
11796 break;
11797 case FPROUNDING_POSINF:
11798 i = float_round_up;
11799 break;
11800 case FPROUNDING_NEGINF:
11801 i = float_round_down;
11802 break;
11803 case FPROUNDING_ZERO:
11804 i = float_round_to_zero;
11805 break;
11806 }
11807 set_float_rounding_mode(i, &env->vfp.fp_status);
11808 set_float_rounding_mode(i, &env->vfp.fp_status_f16);
11809 }
11810 if (changed & FPCR_FZ16) {
11811 bool ftz_enabled = val & FPCR_FZ16;
11812 set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
11813 set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
11814 }
11815 if (changed & FPCR_FZ) {
11816 bool ftz_enabled = val & FPCR_FZ;
11817 set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
11818 set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
11819 }
11820 if (changed & FPCR_DN) {
11821 bool dnan_enabled = val & FPCR_DN;
11822 set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
11823 set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
11824 }
11825
11826 /* The exception flags are ORed together when we read fpscr so we
11827 * only need to preserve the current state in one of our
11828 * float_status values.
11829 */
11830 i = vfp_exceptbits_to_host(val);
11831 set_float_exception_flags(i, &env->vfp.fp_status);
11832 set_float_exception_flags(0, &env->vfp.fp_status_f16);
11833 set_float_exception_flags(0, &env->vfp.standard_fp_status);
11834 }
11835
11836 void vfp_set_fpscr(CPUARMState *env, uint32_t val)
11837 {
11838 HELPER(vfp_set_fpscr)(env, val);
11839 }
11840
11841 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
11842
11843 #define VFP_BINOP(name) \
11844 float32 VFP_HELPER(name, s)(float32 a, float32 b, void *fpstp) \
11845 { \
11846 float_status *fpst = fpstp; \
11847 return float32_ ## name(a, b, fpst); \
11848 } \
11849 float64 VFP_HELPER(name, d)(float64 a, float64 b, void *fpstp) \
11850 { \
11851 float_status *fpst = fpstp; \
11852 return float64_ ## name(a, b, fpst); \
11853 }
11854 VFP_BINOP(add)
11855 VFP_BINOP(sub)
11856 VFP_BINOP(mul)
11857 VFP_BINOP(div)
11858 VFP_BINOP(min)
11859 VFP_BINOP(max)
11860 VFP_BINOP(minnum)
11861 VFP_BINOP(maxnum)
11862 #undef VFP_BINOP
11863
11864 float32 VFP_HELPER(neg, s)(float32 a)
11865 {
11866 return float32_chs(a);
11867 }
11868
11869 float64 VFP_HELPER(neg, d)(float64 a)
11870 {
11871 return float64_chs(a);
11872 }
11873
11874 float32 VFP_HELPER(abs, s)(float32 a)
11875 {
11876 return float32_abs(a);
11877 }
11878
11879 float64 VFP_HELPER(abs, d)(float64 a)
11880 {
11881 return float64_abs(a);
11882 }
11883
11884 float32 VFP_HELPER(sqrt, s)(float32 a, CPUARMState *env)
11885 {
11886 return float32_sqrt(a, &env->vfp.fp_status);
11887 }
11888
11889 float64 VFP_HELPER(sqrt, d)(float64 a, CPUARMState *env)
11890 {
11891 return float64_sqrt(a, &env->vfp.fp_status);
11892 }
11893
11894 /* XXX: check quiet/signaling case */
11895 #define DO_VFP_cmp(p, type) \
11896 void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env) \
11897 { \
11898 uint32_t flags; \
11899 switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
11900 case 0: flags = 0x6; break; \
11901 case -1: flags = 0x8; break; \
11902 case 1: flags = 0x2; break; \
11903 default: case 2: flags = 0x3; break; \
11904 } \
11905 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
11906 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
11907 } \
11908 void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \
11909 { \
11910 uint32_t flags; \
11911 switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
11912 case 0: flags = 0x6; break; \
11913 case -1: flags = 0x8; break; \
11914 case 1: flags = 0x2; break; \
11915 default: case 2: flags = 0x3; break; \
11916 } \
11917 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
11918 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
11919 }
11920 DO_VFP_cmp(s, float32)
11921 DO_VFP_cmp(d, float64)
11922 #undef DO_VFP_cmp
11923
11924 /* Integer to float and float to integer conversions */
11925
11926 #define CONV_ITOF(name, ftype, fsz, sign) \
11927 ftype HELPER(name)(uint32_t x, void *fpstp) \
11928 { \
11929 float_status *fpst = fpstp; \
11930 return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \
11931 }
11932
11933 #define CONV_FTOI(name, ftype, fsz, sign, round) \
11934 sign##int32_t HELPER(name)(ftype x, void *fpstp) \
11935 { \
11936 float_status *fpst = fpstp; \
11937 if (float##fsz##_is_any_nan(x)) { \
11938 float_raise(float_flag_invalid, fpst); \
11939 return 0; \
11940 } \
11941 return float##fsz##_to_##sign##int32##round(x, fpst); \
11942 }
11943
11944 #define FLOAT_CONVS(name, p, ftype, fsz, sign) \
11945 CONV_ITOF(vfp_##name##to##p, ftype, fsz, sign) \
11946 CONV_FTOI(vfp_to##name##p, ftype, fsz, sign, ) \
11947 CONV_FTOI(vfp_to##name##z##p, ftype, fsz, sign, _round_to_zero)
11948
11949 FLOAT_CONVS(si, h, uint32_t, 16, )
11950 FLOAT_CONVS(si, s, float32, 32, )
11951 FLOAT_CONVS(si, d, float64, 64, )
11952 FLOAT_CONVS(ui, h, uint32_t, 16, u)
11953 FLOAT_CONVS(ui, s, float32, 32, u)
11954 FLOAT_CONVS(ui, d, float64, 64, u)
11955
11956 #undef CONV_ITOF
11957 #undef CONV_FTOI
11958 #undef FLOAT_CONVS
11959
11960 /* floating point conversion */
11961 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUARMState *env)
11962 {
11963 return float32_to_float64(x, &env->vfp.fp_status);
11964 }
11965
11966 float32 VFP_HELPER(fcvts, d)(float64 x, CPUARMState *env)
11967 {
11968 return float64_to_float32(x, &env->vfp.fp_status);
11969 }
11970
11971 /* VFP3 fixed point conversion. */
11972 #define VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
11973 float##fsz HELPER(vfp_##name##to##p)(uint##isz##_t x, uint32_t shift, \
11974 void *fpstp) \
11975 { return itype##_to_##float##fsz##_scalbn(x, -shift, fpstp); }
11976
11977 #define VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, ROUND, suff) \
11978 uint##isz##_t HELPER(vfp_to##name##p##suff)(float##fsz x, uint32_t shift, \
11979 void *fpst) \
11980 { \
11981 if (unlikely(float##fsz##_is_any_nan(x))) { \
11982 float_raise(float_flag_invalid, fpst); \
11983 return 0; \
11984 } \
11985 return float##fsz##_to_##itype##_scalbn(x, ROUND, shift, fpst); \
11986 }
11987
11988 #define VFP_CONV_FIX(name, p, fsz, isz, itype) \
11989 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
11990 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, \
11991 float_round_to_zero, _round_to_zero) \
11992 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, \
11993 get_float_rounding_mode(fpst), )
11994
11995 #define VFP_CONV_FIX_A64(name, p, fsz, isz, itype) \
11996 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
11997 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, \
11998 get_float_rounding_mode(fpst), )
11999
12000 VFP_CONV_FIX(sh, d, 64, 64, int16)
12001 VFP_CONV_FIX(sl, d, 64, 64, int32)
12002 VFP_CONV_FIX_A64(sq, d, 64, 64, int64)
12003 VFP_CONV_FIX(uh, d, 64, 64, uint16)
12004 VFP_CONV_FIX(ul, d, 64, 64, uint32)
12005 VFP_CONV_FIX_A64(uq, d, 64, 64, uint64)
12006 VFP_CONV_FIX(sh, s, 32, 32, int16)
12007 VFP_CONV_FIX(sl, s, 32, 32, int32)
12008 VFP_CONV_FIX_A64(sq, s, 32, 64, int64)
12009 VFP_CONV_FIX(uh, s, 32, 32, uint16)
12010 VFP_CONV_FIX(ul, s, 32, 32, uint32)
12011 VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
12012
12013 #undef VFP_CONV_FIX
12014 #undef VFP_CONV_FIX_FLOAT
12015 #undef VFP_CONV_FLOAT_FIX_ROUND
12016 #undef VFP_CONV_FIX_A64
12017
12018 uint32_t HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst)
12019 {
12020 return int32_to_float16_scalbn(x, -shift, fpst);
12021 }
12022
12023 uint32_t HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
12024 {
12025 return uint32_to_float16_scalbn(x, -shift, fpst);
12026 }
12027
12028 uint32_t HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
12029 {
12030 return int64_to_float16_scalbn(x, -shift, fpst);
12031 }
12032
12033 uint32_t HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
12034 {
12035 return uint64_to_float16_scalbn(x, -shift, fpst);
12036 }
12037
12038 uint32_t HELPER(vfp_toshh)(uint32_t x, uint32_t shift, void *fpst)
12039 {
12040 if (unlikely(float16_is_any_nan(x))) {
12041 float_raise(float_flag_invalid, fpst);
12042 return 0;
12043 }
12044 return float16_to_int16_scalbn(x, get_float_rounding_mode(fpst),
12045 shift, fpst);
12046 }
12047
12048 uint32_t HELPER(vfp_touhh)(uint32_t x, uint32_t shift, void *fpst)
12049 {
12050 if (unlikely(float16_is_any_nan(x))) {
12051 float_raise(float_flag_invalid, fpst);
12052 return 0;
12053 }
12054 return float16_to_uint16_scalbn(x, get_float_rounding_mode(fpst),
12055 shift, fpst);
12056 }
12057
12058 uint32_t HELPER(vfp_toslh)(uint32_t x, uint32_t shift, void *fpst)
12059 {
12060 if (unlikely(float16_is_any_nan(x))) {
12061 float_raise(float_flag_invalid, fpst);
12062 return 0;
12063 }
12064 return float16_to_int32_scalbn(x, get_float_rounding_mode(fpst),
12065 shift, fpst);
12066 }
12067
12068 uint32_t HELPER(vfp_toulh)(uint32_t x, uint32_t shift, void *fpst)
12069 {
12070 if (unlikely(float16_is_any_nan(x))) {
12071 float_raise(float_flag_invalid, fpst);
12072 return 0;
12073 }
12074 return float16_to_uint32_scalbn(x, get_float_rounding_mode(fpst),
12075 shift, fpst);
12076 }
12077
12078 uint64_t HELPER(vfp_tosqh)(uint32_t x, uint32_t shift, void *fpst)
12079 {
12080 if (unlikely(float16_is_any_nan(x))) {
12081 float_raise(float_flag_invalid, fpst);
12082 return 0;
12083 }
12084 return float16_to_int64_scalbn(x, get_float_rounding_mode(fpst),
12085 shift, fpst);
12086 }
12087
12088 uint64_t HELPER(vfp_touqh)(uint32_t x, uint32_t shift, void *fpst)
12089 {
12090 if (unlikely(float16_is_any_nan(x))) {
12091 float_raise(float_flag_invalid, fpst);
12092 return 0;
12093 }
12094 return float16_to_uint64_scalbn(x, get_float_rounding_mode(fpst),
12095 shift, fpst);
12096 }
12097
12098 /* Set the current fp rounding mode and return the old one.
12099 * The argument is a softfloat float_round_ value.
12100 */
12101 uint32_t HELPER(set_rmode)(uint32_t rmode, void *fpstp)
12102 {
12103 float_status *fp_status = fpstp;
12104
12105 uint32_t prev_rmode = get_float_rounding_mode(fp_status);
12106 set_float_rounding_mode(rmode, fp_status);
12107
12108 return prev_rmode;
12109 }
12110
12111 /* Set the current fp rounding mode in the standard fp status and return
12112 * the old one. This is for NEON instructions that need to change the
12113 * rounding mode but wish to use the standard FPSCR values for everything
12114 * else. Always set the rounding mode back to the correct value after
12115 * modifying it.
12116 * The argument is a softfloat float_round_ value.
12117 */
12118 uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env)
12119 {
12120 float_status *fp_status = &env->vfp.standard_fp_status;
12121
12122 uint32_t prev_rmode = get_float_rounding_mode(fp_status);
12123 set_float_rounding_mode(rmode, fp_status);
12124
12125 return prev_rmode;
12126 }
12127
12128 /* Half precision conversions. */
12129 float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, void *fpstp, uint32_t ahp_mode)
12130 {
12131 /* Squash FZ16 to 0 for the duration of conversion. In this case,
12132 * it would affect flushing input denormals.
12133 */
12134 float_status *fpst = fpstp;
12135 flag save = get_flush_inputs_to_zero(fpst);
12136 set_flush_inputs_to_zero(false, fpst);
12137 float32 r = float16_to_float32(a, !ahp_mode, fpst);
12138 set_flush_inputs_to_zero(save, fpst);
12139 return r;
12140 }
12141
12142 uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)
12143 {
12144 /* Squash FZ16 to 0 for the duration of conversion. In this case,
12145 * it would affect flushing output denormals.
12146 */
12147 float_status *fpst = fpstp;
12148 flag save = get_flush_to_zero(fpst);
12149 set_flush_to_zero(false, fpst);
12150 float16 r = float32_to_float16(a, !ahp_mode, fpst);
12151 set_flush_to_zero(save, fpst);
12152 return r;
12153 }
12154
12155 float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, void *fpstp, uint32_t ahp_mode)
12156 {
12157 /* Squash FZ16 to 0 for the duration of conversion. In this case,
12158 * it would affect flushing input denormals.
12159 */
12160 float_status *fpst = fpstp;
12161 flag save = get_flush_inputs_to_zero(fpst);
12162 set_flush_inputs_to_zero(false, fpst);
12163 float64 r = float16_to_float64(a, !ahp_mode, fpst);
12164 set_flush_inputs_to_zero(save, fpst);
12165 return r;
12166 }
12167
12168 uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, void *fpstp, uint32_t ahp_mode)
12169 {
12170 /* Squash FZ16 to 0 for the duration of conversion. In this case,
12171 * it would affect flushing output denormals.
12172 */
12173 float_status *fpst = fpstp;
12174 flag save = get_flush_to_zero(fpst);
12175 set_flush_to_zero(false, fpst);
12176 float16 r = float64_to_float16(a, !ahp_mode, fpst);
12177 set_flush_to_zero(save, fpst);
12178 return r;
12179 }
12180
12181 #define float32_two make_float32(0x40000000)
12182 #define float32_three make_float32(0x40400000)
12183 #define float32_one_point_five make_float32(0x3fc00000)
12184
12185 float32 HELPER(recps_f32)(float32 a, float32 b, CPUARMState *env)
12186 {
12187 float_status *s = &env->vfp.standard_fp_status;
12188 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
12189 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
12190 if (!(float32_is_zero(a) || float32_is_zero(b))) {
12191 float_raise(float_flag_input_denormal, s);
12192 }
12193 return float32_two;
12194 }
12195 return float32_sub(float32_two, float32_mul(a, b, s), s);
12196 }
12197
12198 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUARMState *env)
12199 {
12200 float_status *s = &env->vfp.standard_fp_status;
12201 float32 product;
12202 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
12203 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
12204 if (!(float32_is_zero(a) || float32_is_zero(b))) {
12205 float_raise(float_flag_input_denormal, s);
12206 }
12207 return float32_one_point_five;
12208 }
12209 product = float32_mul(a, b, s);
12210 return float32_div(float32_sub(float32_three, product, s), float32_two, s);
12211 }
12212
12213 /* NEON helpers. */
12214
12215 /* Constants 256 and 512 are used in some helpers; we avoid relying on
12216 * int->float conversions at run-time. */
12217 #define float64_256 make_float64(0x4070000000000000LL)
12218 #define float64_512 make_float64(0x4080000000000000LL)
12219 #define float16_maxnorm make_float16(0x7bff)
12220 #define float32_maxnorm make_float32(0x7f7fffff)
12221 #define float64_maxnorm make_float64(0x7fefffffffffffffLL)
12222
12223 /* Reciprocal functions
12224 *
12225 * The algorithm that must be used to calculate the estimate
12226 * is specified by the ARM ARM, see FPRecipEstimate()/RecipEstimate
12227 */
12228
12229 /* See RecipEstimate()
12230 *
12231 * input is a 9 bit fixed point number
12232 * input range 256 .. 511 for a number from 0.5 <= x < 1.0.
12233 * result range 256 .. 511 for a number from 1.0 to 511/256.
12234 */
12235
12236 static int recip_estimate(int input)
12237 {
12238 int a, b, r;
12239 assert(256 <= input && input < 512);
12240 a = (input * 2) + 1;
12241 b = (1 << 19) / a;
12242 r = (b + 1) >> 1;
12243 assert(256 <= r && r < 512);
12244 return r;
12245 }
12246
12247 /*
12248 * Common wrapper to call recip_estimate
12249 *
12250 * The parameters are exponent and 64 bit fraction (without implicit
12251 * bit) where the binary point is nominally at bit 52. Returns a
12252 * float64 which can then be rounded to the appropriate size by the
12253 * callee.
12254 */
12255
12256 static uint64_t call_recip_estimate(int *exp, int exp_off, uint64_t frac)
12257 {
12258 uint32_t scaled, estimate;
12259 uint64_t result_frac;
12260 int result_exp;
12261
12262 /* Handle sub-normals */
12263 if (*exp == 0) {
12264 if (extract64(frac, 51, 1) == 0) {
12265 *exp = -1;
12266 frac <<= 2;
12267 } else {
12268 frac <<= 1;
12269 }
12270 }
12271
12272 /* scaled = UInt('1':fraction<51:44>) */
12273 scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8));
12274 estimate = recip_estimate(scaled);
12275
12276 result_exp = exp_off - *exp;
12277 result_frac = deposit64(0, 44, 8, estimate);
12278 if (result_exp == 0) {
12279 result_frac = deposit64(result_frac >> 1, 51, 1, 1);
12280 } else if (result_exp == -1) {
12281 result_frac = deposit64(result_frac >> 2, 50, 2, 1);
12282 result_exp = 0;
12283 }
12284
12285 *exp = result_exp;
12286
12287 return result_frac;
12288 }
12289
12290 static bool round_to_inf(float_status *fpst, bool sign_bit)
12291 {
12292 switch (fpst->float_rounding_mode) {
12293 case float_round_nearest_even: /* Round to Nearest */
12294 return true;
12295 case float_round_up: /* Round to +Inf */
12296 return !sign_bit;
12297 case float_round_down: /* Round to -Inf */
12298 return sign_bit;
12299 case float_round_to_zero: /* Round to Zero */
12300 return false;
12301 }
12302
12303 g_assert_not_reached();
12304 }
12305
12306 uint32_t HELPER(recpe_f16)(uint32_t input, void *fpstp)
12307 {
12308 float_status *fpst = fpstp;
12309 float16 f16 = float16_squash_input_denormal(input, fpst);
12310 uint32_t f16_val = float16_val(f16);
12311 uint32_t f16_sign = float16_is_neg(f16);
12312 int f16_exp = extract32(f16_val, 10, 5);
12313 uint32_t f16_frac = extract32(f16_val, 0, 10);
12314 uint64_t f64_frac;
12315
12316 if (float16_is_any_nan(f16)) {
12317 float16 nan = f16;
12318 if (float16_is_signaling_nan(f16, fpst)) {
12319 float_raise(float_flag_invalid, fpst);
12320 nan = float16_silence_nan(f16, fpst);
12321 }
12322 if (fpst->default_nan_mode) {
12323 nan = float16_default_nan(fpst);
12324 }
12325 return nan;
12326 } else if (float16_is_infinity(f16)) {
12327 return float16_set_sign(float16_zero, float16_is_neg(f16));
12328 } else if (float16_is_zero(f16)) {
12329 float_raise(float_flag_divbyzero, fpst);
12330 return float16_set_sign(float16_infinity, float16_is_neg(f16));
12331 } else if (float16_abs(f16) < (1 << 8)) {
12332 /* Abs(value) < 2.0^-16 */
12333 float_raise(float_flag_overflow | float_flag_inexact, fpst);
12334 if (round_to_inf(fpst, f16_sign)) {
12335 return float16_set_sign(float16_infinity, f16_sign);
12336 } else {
12337 return float16_set_sign(float16_maxnorm, f16_sign);
12338 }
12339 } else if (f16_exp >= 29 && fpst->flush_to_zero) {
12340 float_raise(float_flag_underflow, fpst);
12341 return float16_set_sign(float16_zero, float16_is_neg(f16));
12342 }
12343
12344 f64_frac = call_recip_estimate(&f16_exp, 29,
12345 ((uint64_t) f16_frac) << (52 - 10));
12346
12347 /* result = sign : result_exp<4:0> : fraction<51:42> */
12348 f16_val = deposit32(0, 15, 1, f16_sign);
12349 f16_val = deposit32(f16_val, 10, 5, f16_exp);
12350 f16_val = deposit32(f16_val, 0, 10, extract64(f64_frac, 52 - 10, 10));
12351 return make_float16(f16_val);
12352 }
12353
12354 float32 HELPER(recpe_f32)(float32 input, void *fpstp)
12355 {
12356 float_status *fpst = fpstp;
12357 float32 f32 = float32_squash_input_denormal(input, fpst);
12358 uint32_t f32_val = float32_val(f32);
12359 bool f32_sign = float32_is_neg(f32);
12360 int f32_exp = extract32(f32_val, 23, 8);
12361 uint32_t f32_frac = extract32(f32_val, 0, 23);
12362 uint64_t f64_frac;
12363
12364 if (float32_is_any_nan(f32)) {
12365 float32 nan = f32;
12366 if (float32_is_signaling_nan(f32, fpst)) {
12367 float_raise(float_flag_invalid, fpst);
12368 nan = float32_silence_nan(f32, fpst);
12369 }
12370 if (fpst->default_nan_mode) {
12371 nan = float32_default_nan(fpst);
12372 }
12373 return nan;
12374 } else if (float32_is_infinity(f32)) {
12375 return float32_set_sign(float32_zero, float32_is_neg(f32));
12376 } else if (float32_is_zero(f32)) {
12377 float_raise(float_flag_divbyzero, fpst);
12378 return float32_set_sign(float32_infinity, float32_is_neg(f32));
12379 } else if (float32_abs(f32) < (1ULL << 21)) {
12380 /* Abs(value) < 2.0^-128 */
12381 float_raise(float_flag_overflow | float_flag_inexact, fpst);
12382 if (round_to_inf(fpst, f32_sign)) {
12383 return float32_set_sign(float32_infinity, f32_sign);
12384 } else {
12385 return float32_set_sign(float32_maxnorm, f32_sign);
12386 }
12387 } else if (f32_exp >= 253 && fpst->flush_to_zero) {
12388 float_raise(float_flag_underflow, fpst);
12389 return float32_set_sign(float32_zero, float32_is_neg(f32));
12390 }
12391
12392 f64_frac = call_recip_estimate(&f32_exp, 253,
12393 ((uint64_t) f32_frac) << (52 - 23));
12394
12395 /* result = sign : result_exp<7:0> : fraction<51:29> */
12396 f32_val = deposit32(0, 31, 1, f32_sign);
12397 f32_val = deposit32(f32_val, 23, 8, f32_exp);
12398 f32_val = deposit32(f32_val, 0, 23, extract64(f64_frac, 52 - 23, 23));
12399 return make_float32(f32_val);
12400 }
12401
12402 float64 HELPER(recpe_f64)(float64 input, void *fpstp)
12403 {
12404 float_status *fpst = fpstp;
12405 float64 f64 = float64_squash_input_denormal(input, fpst);
12406 uint64_t f64_val = float64_val(f64);
12407 bool f64_sign = float64_is_neg(f64);
12408 int f64_exp = extract64(f64_val, 52, 11);
12409 uint64_t f64_frac = extract64(f64_val, 0, 52);
12410
12411 /* Deal with any special cases */
12412 if (float64_is_any_nan(f64)) {
12413 float64 nan = f64;
12414 if (float64_is_signaling_nan(f64, fpst)) {
12415 float_raise(float_flag_invalid, fpst);
12416 nan = float64_silence_nan(f64, fpst);
12417 }
12418 if (fpst->default_nan_mode) {
12419 nan = float64_default_nan(fpst);
12420 }
12421 return nan;
12422 } else if (float64_is_infinity(f64)) {
12423 return float64_set_sign(float64_zero, float64_is_neg(f64));
12424 } else if (float64_is_zero(f64)) {
12425 float_raise(float_flag_divbyzero, fpst);
12426 return float64_set_sign(float64_infinity, float64_is_neg(f64));
12427 } else if ((f64_val & ~(1ULL << 63)) < (1ULL << 50)) {
12428 /* Abs(value) < 2.0^-1024 */
12429 float_raise(float_flag_overflow | float_flag_inexact, fpst);
12430 if (round_to_inf(fpst, f64_sign)) {
12431 return float64_set_sign(float64_infinity, f64_sign);
12432 } else {
12433 return float64_set_sign(float64_maxnorm, f64_sign);
12434 }
12435 } else if (f64_exp >= 2045 && fpst->flush_to_zero) {
12436 float_raise(float_flag_underflow, fpst);
12437 return float64_set_sign(float64_zero, float64_is_neg(f64));
12438 }
12439
12440 f64_frac = call_recip_estimate(&f64_exp, 2045, f64_frac);
12441
12442 /* result = sign : result_exp<10:0> : fraction<51:0>; */
12443 f64_val = deposit64(0, 63, 1, f64_sign);
12444 f64_val = deposit64(f64_val, 52, 11, f64_exp);
12445 f64_val = deposit64(f64_val, 0, 52, f64_frac);
12446 return make_float64(f64_val);
12447 }
12448
12449 /* The algorithm that must be used to calculate the estimate
12450 * is specified by the ARM ARM.
12451 */
12452
12453 static int do_recip_sqrt_estimate(int a)
12454 {
12455 int b, estimate;
12456
12457 assert(128 <= a && a < 512);
12458 if (a < 256) {
12459 a = a * 2 + 1;
12460 } else {
12461 a = (a >> 1) << 1;
12462 a = (a + 1) * 2;
12463 }
12464 b = 512;
12465 while (a * (b + 1) * (b + 1) < (1 << 28)) {
12466 b += 1;
12467 }
12468 estimate = (b + 1) / 2;
12469 assert(256 <= estimate && estimate < 512);
12470
12471 return estimate;
12472 }
12473
12474
12475 static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac)
12476 {
12477 int estimate;
12478 uint32_t scaled;
12479
12480 if (*exp == 0) {
12481 while (extract64(frac, 51, 1) == 0) {
12482 frac = frac << 1;
12483 *exp -= 1;
12484 }
12485 frac = extract64(frac, 0, 51) << 1;
12486 }
12487
12488 if (*exp & 1) {
12489 /* scaled = UInt('01':fraction<51:45>) */
12490 scaled = deposit32(1 << 7, 0, 7, extract64(frac, 45, 7));
12491 } else {
12492 /* scaled = UInt('1':fraction<51:44>) */
12493 scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8));
12494 }
12495 estimate = do_recip_sqrt_estimate(scaled);
12496
12497 *exp = (exp_off - *exp) / 2;
12498 return extract64(estimate, 0, 8) << 44;
12499 }
12500
12501 uint32_t HELPER(rsqrte_f16)(uint32_t input, void *fpstp)
12502 {
12503 float_status *s = fpstp;
12504 float16 f16 = float16_squash_input_denormal(input, s);
12505 uint16_t val = float16_val(f16);
12506 bool f16_sign = float16_is_neg(f16);
12507 int f16_exp = extract32(val, 10, 5);
12508 uint16_t f16_frac = extract32(val, 0, 10);
12509 uint64_t f64_frac;
12510
12511 if (float16_is_any_nan(f16)) {
12512 float16 nan = f16;
12513 if (float16_is_signaling_nan(f16, s)) {
12514 float_raise(float_flag_invalid, s);
12515 nan = float16_silence_nan(f16, s);
12516 }
12517 if (s->default_nan_mode) {
12518 nan = float16_default_nan(s);
12519 }
12520 return nan;
12521 } else if (float16_is_zero(f16)) {
12522 float_raise(float_flag_divbyzero, s);
12523 return float16_set_sign(float16_infinity, f16_sign);
12524 } else if (f16_sign) {
12525 float_raise(float_flag_invalid, s);
12526 return float16_default_nan(s);
12527 } else if (float16_is_infinity(f16)) {
12528 return float16_zero;
12529 }
12530
12531 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
12532 * preserving the parity of the exponent. */
12533
12534 f64_frac = ((uint64_t) f16_frac) << (52 - 10);
12535
12536 f64_frac = recip_sqrt_estimate(&f16_exp, 44, f64_frac);
12537
12538 /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(2) */
12539 val = deposit32(0, 15, 1, f16_sign);
12540 val = deposit32(val, 10, 5, f16_exp);
12541 val = deposit32(val, 2, 8, extract64(f64_frac, 52 - 8, 8));
12542 return make_float16(val);
12543 }
12544
12545 float32 HELPER(rsqrte_f32)(float32 input, void *fpstp)
12546 {
12547 float_status *s = fpstp;
12548 float32 f32 = float32_squash_input_denormal(input, s);
12549 uint32_t val = float32_val(f32);
12550 uint32_t f32_sign = float32_is_neg(f32);
12551 int f32_exp = extract32(val, 23, 8);
12552 uint32_t f32_frac = extract32(val, 0, 23);
12553 uint64_t f64_frac;
12554
12555 if (float32_is_any_nan(f32)) {
12556 float32 nan = f32;
12557 if (float32_is_signaling_nan(f32, s)) {
12558 float_raise(float_flag_invalid, s);
12559 nan = float32_silence_nan(f32, s);
12560 }
12561 if (s->default_nan_mode) {
12562 nan = float32_default_nan(s);
12563 }
12564 return nan;
12565 } else if (float32_is_zero(f32)) {
12566 float_raise(float_flag_divbyzero, s);
12567 return float32_set_sign(float32_infinity, float32_is_neg(f32));
12568 } else if (float32_is_neg(f32)) {
12569 float_raise(float_flag_invalid, s);
12570 return float32_default_nan(s);
12571 } else if (float32_is_infinity(f32)) {
12572 return float32_zero;
12573 }
12574
12575 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
12576 * preserving the parity of the exponent. */
12577
12578 f64_frac = ((uint64_t) f32_frac) << 29;
12579
12580 f64_frac = recip_sqrt_estimate(&f32_exp, 380, f64_frac);
12581
12582 /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(15) */
12583 val = deposit32(0, 31, 1, f32_sign);
12584 val = deposit32(val, 23, 8, f32_exp);
12585 val = deposit32(val, 15, 8, extract64(f64_frac, 52 - 8, 8));
12586 return make_float32(val);
12587 }
12588
12589 float64 HELPER(rsqrte_f64)(float64 input, void *fpstp)
12590 {
12591 float_status *s = fpstp;
12592 float64 f64 = float64_squash_input_denormal(input, s);
12593 uint64_t val = float64_val(f64);
12594 bool f64_sign = float64_is_neg(f64);
12595 int f64_exp = extract64(val, 52, 11);
12596 uint64_t f64_frac = extract64(val, 0, 52);
12597
12598 if (float64_is_any_nan(f64)) {
12599 float64 nan = f64;
12600 if (float64_is_signaling_nan(f64, s)) {
12601 float_raise(float_flag_invalid, s);
12602 nan = float64_silence_nan(f64, s);
12603 }
12604 if (s->default_nan_mode) {
12605 nan = float64_default_nan(s);
12606 }
12607 return nan;
12608 } else if (float64_is_zero(f64)) {
12609 float_raise(float_flag_divbyzero, s);
12610 return float64_set_sign(float64_infinity, float64_is_neg(f64));
12611 } else if (float64_is_neg(f64)) {
12612 float_raise(float_flag_invalid, s);
12613 return float64_default_nan(s);
12614 } else if (float64_is_infinity(f64)) {
12615 return float64_zero;
12616 }
12617
12618 f64_frac = recip_sqrt_estimate(&f64_exp, 3068, f64_frac);
12619
12620 /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(44) */
12621 val = deposit64(0, 61, 1, f64_sign);
12622 val = deposit64(val, 52, 11, f64_exp);
12623 val = deposit64(val, 44, 8, extract64(f64_frac, 52 - 8, 8));
12624 return make_float64(val);
12625 }
12626
12627 uint32_t HELPER(recpe_u32)(uint32_t a, void *fpstp)
12628 {
12629 /* float_status *s = fpstp; */
12630 int input, estimate;
12631
12632 if ((a & 0x80000000) == 0) {
12633 return 0xffffffff;
12634 }
12635
12636 input = extract32(a, 23, 9);
12637 estimate = recip_estimate(input);
12638
12639 return deposit32(0, (32 - 9), 9, estimate);
12640 }
12641
12642 uint32_t HELPER(rsqrte_u32)(uint32_t a, void *fpstp)
12643 {
12644 int estimate;
12645
12646 if ((a & 0xc0000000) == 0) {
12647 return 0xffffffff;
12648 }
12649
12650 estimate = do_recip_sqrt_estimate(extract32(a, 23, 9));
12651
12652 return deposit32(0, 23, 9, estimate);
12653 }
12654
12655 /* VFPv4 fused multiply-accumulate */
12656 float32 VFP_HELPER(muladd, s)(float32 a, float32 b, float32 c, void *fpstp)
12657 {
12658 float_status *fpst = fpstp;
12659 return float32_muladd(a, b, c, 0, fpst);
12660 }
12661
12662 float64 VFP_HELPER(muladd, d)(float64 a, float64 b, float64 c, void *fpstp)
12663 {
12664 float_status *fpst = fpstp;
12665 return float64_muladd(a, b, c, 0, fpst);
12666 }
12667
12668 /* ARMv8 round to integral */
12669 float32 HELPER(rints_exact)(float32 x, void *fp_status)
12670 {
12671 return float32_round_to_int(x, fp_status);
12672 }
12673
12674 float64 HELPER(rintd_exact)(float64 x, void *fp_status)
12675 {
12676 return float64_round_to_int(x, fp_status);
12677 }
12678
12679 float32 HELPER(rints)(float32 x, void *fp_status)
12680 {
12681 int old_flags = get_float_exception_flags(fp_status), new_flags;
12682 float32 ret;
12683
12684 ret = float32_round_to_int(x, fp_status);
12685
12686 /* Suppress any inexact exceptions the conversion produced */
12687 if (!(old_flags & float_flag_inexact)) {
12688 new_flags = get_float_exception_flags(fp_status);
12689 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
12690 }
12691
12692 return ret;
12693 }
12694
12695 float64 HELPER(rintd)(float64 x, void *fp_status)
12696 {
12697 int old_flags = get_float_exception_flags(fp_status), new_flags;
12698 float64 ret;
12699
12700 ret = float64_round_to_int(x, fp_status);
12701
12702 new_flags = get_float_exception_flags(fp_status);
12703
12704 /* Suppress any inexact exceptions the conversion produced */
12705 if (!(old_flags & float_flag_inexact)) {
12706 new_flags = get_float_exception_flags(fp_status);
12707 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
12708 }
12709
12710 return ret;
12711 }
12712
12713 /* Convert ARM rounding mode to softfloat */
12714 int arm_rmode_to_sf(int rmode)
12715 {
12716 switch (rmode) {
12717 case FPROUNDING_TIEAWAY:
12718 rmode = float_round_ties_away;
12719 break;
12720 case FPROUNDING_ODD:
12721 /* FIXME: add support for TIEAWAY and ODD */
12722 qemu_log_mask(LOG_UNIMP, "arm: unimplemented rounding mode: %d\n",
12723 rmode);
12724 /* fall through for now */
12725 case FPROUNDING_TIEEVEN:
12726 default:
12727 rmode = float_round_nearest_even;
12728 break;
12729 case FPROUNDING_POSINF:
12730 rmode = float_round_up;
12731 break;
12732 case FPROUNDING_NEGINF:
12733 rmode = float_round_down;
12734 break;
12735 case FPROUNDING_ZERO:
12736 rmode = float_round_to_zero;
12737 break;
12738 }
12739 return rmode;
12740 }
12741
12742 /* CRC helpers.
12743 * The upper bytes of val (above the number specified by 'bytes') must have
12744 * been zeroed out by the caller.
12745 */
12746 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes)
12747 {
12748 uint8_t buf[4];
12749
12750 stl_le_p(buf, val);
12751
12752 /* zlib crc32 converts the accumulator and output to one's complement. */
12753 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff;
12754 }
12755
12756 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
12757 {
12758 uint8_t buf[4];
12759
12760 stl_le_p(buf, val);
12761
12762 /* Linux crc32c converts the output to one's complement. */
12763 return crc32c(acc, buf, bytes) ^ 0xffffffff;
12764 }
12765
12766 /* Return the exception level to which FP-disabled exceptions should
12767 * be taken, or 0 if FP is enabled.
12768 */
12769 int fp_exception_el(CPUARMState *env, int cur_el)
12770 {
12771 #ifndef CONFIG_USER_ONLY
12772 int fpen;
12773
12774 /* CPACR and the CPTR registers don't exist before v6, so FP is
12775 * always accessible
12776 */
12777 if (!arm_feature(env, ARM_FEATURE_V6)) {
12778 return 0;
12779 }
12780
12781 /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
12782 * 0, 2 : trap EL0 and EL1/PL1 accesses
12783 * 1 : trap only EL0 accesses
12784 * 3 : trap no accesses
12785 */
12786 fpen = extract32(env->cp15.cpacr_el1, 20, 2);
12787 switch (fpen) {
12788 case 0:
12789 case 2:
12790 if (cur_el == 0 || cur_el == 1) {
12791 /* Trap to PL1, which might be EL1 or EL3 */
12792 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
12793 return 3;
12794 }
12795 return 1;
12796 }
12797 if (cur_el == 3 && !is_a64(env)) {
12798 /* Secure PL1 running at EL3 */
12799 return 3;
12800 }
12801 break;
12802 case 1:
12803 if (cur_el == 0) {
12804 return 1;
12805 }
12806 break;
12807 case 3:
12808 break;
12809 }
12810
12811 /* For the CPTR registers we don't need to guard with an ARM_FEATURE
12812 * check because zero bits in the registers mean "don't trap".
12813 */
12814
12815 /* CPTR_EL2 : present in v7VE or v8 */
12816 if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
12817 && !arm_is_secure_below_el3(env)) {
12818 /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
12819 return 2;
12820 }
12821
12822 /* CPTR_EL3 : present in v8 */
12823 if (extract32(env->cp15.cptr_el[3], 10, 1)) {
12824 /* Trap all FP ops to EL3 */
12825 return 3;
12826 }
12827 #endif
12828 return 0;
12829 }
12830
12831 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
12832 target_ulong *cs_base, uint32_t *pflags)
12833 {
12834 ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
12835 int current_el = arm_current_el(env);
12836 int fp_el = fp_exception_el(env, current_el);
12837 uint32_t flags;
12838
12839 if (is_a64(env)) {
12840 ARMCPU *cpu = arm_env_get_cpu(env);
12841
12842 *pc = env->pc;
12843 flags = ARM_TBFLAG_AARCH64_STATE_MASK;
12844 /* Get control bits for tagged addresses */
12845 flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
12846 flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
12847
12848 if (cpu_isar_feature(aa64_sve, cpu)) {
12849 int sve_el = sve_exception_el(env, current_el);
12850 uint32_t zcr_len;
12851
12852 /* If SVE is disabled, but FP is enabled,
12853 * then the effective len is 0.
12854 */
12855 if (sve_el != 0 && fp_el == 0) {
12856 zcr_len = 0;
12857 } else {
12858 zcr_len = sve_zcr_len_for_el(env, current_el);
12859 }
12860 flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;
12861 flags |= zcr_len << ARM_TBFLAG_ZCR_LEN_SHIFT;
12862 }
12863 } else {
12864 *pc = env->regs[15];
12865 flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
12866 | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
12867 | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
12868 | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
12869 | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
12870 if (!(access_secure_reg(env))) {
12871 flags |= ARM_TBFLAG_NS_MASK;
12872 }
12873 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
12874 || arm_el_is_aa64(env, 1)) {
12875 flags |= ARM_TBFLAG_VFPEN_MASK;
12876 }
12877 flags |= (extract32(env->cp15.c15_cpar, 0, 2)
12878 << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
12879 }
12880
12881 flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
12882
12883 /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
12884 * states defined in the ARM ARM for software singlestep:
12885 * SS_ACTIVE PSTATE.SS State
12886 * 0 x Inactive (the TB flag for SS is always 0)
12887 * 1 0 Active-pending
12888 * 1 1 Active-not-pending
12889 */
12890 if (arm_singlestep_active(env)) {
12891 flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
12892 if (is_a64(env)) {
12893 if (env->pstate & PSTATE_SS) {
12894 flags |= ARM_TBFLAG_PSTATE_SS_MASK;
12895 }
12896 } else {
12897 if (env->uncached_cpsr & PSTATE_SS) {
12898 flags |= ARM_TBFLAG_PSTATE_SS_MASK;
12899 }
12900 }
12901 }
12902 if (arm_cpu_data_is_big_endian(env)) {
12903 flags |= ARM_TBFLAG_BE_DATA_MASK;
12904 }
12905 flags |= fp_el << ARM_TBFLAG_FPEXC_EL_SHIFT;
12906
12907 if (arm_v7m_is_handler_mode(env)) {
12908 flags |= ARM_TBFLAG_HANDLER_MASK;
12909 }
12910
12911 /* v8M always applies stack limit checks unless CCR.STKOFHFNMIGN is
12912 * suppressing them because the requested execution priority is less than 0.
12913 */
12914 if (arm_feature(env, ARM_FEATURE_V8) &&
12915 arm_feature(env, ARM_FEATURE_M) &&
12916 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) &&
12917 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
12918 flags |= ARM_TBFLAG_STACKCHECK_MASK;
12919 }
12920
12921 *pflags = flags;
12922 *cs_base = 0;
12923 }
12924
12925 #ifdef TARGET_AARCH64
12926 /*
12927 * The manual says that when SVE is enabled and VQ is widened the
12928 * implementation is allowed to zero the previously inaccessible
12929 * portion of the registers. The corollary to that is that when
12930 * SVE is enabled and VQ is narrowed we are also allowed to zero
12931 * the now inaccessible portion of the registers.
12932 *
12933 * The intent of this is that no predicate bit beyond VQ is ever set.
12934 * Which means that some operations on predicate registers themselves
12935 * may operate on full uint64_t or even unrolled across the maximum
12936 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally
12937 * may well be cheaper than conditionals to restrict the operation
12938 * to the relevant portion of a uint16_t[16].
12939 */
12940 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq)
12941 {
12942 int i, j;
12943 uint64_t pmask;
12944
12945 assert(vq >= 1 && vq <= ARM_MAX_VQ);
12946 assert(vq <= arm_env_get_cpu(env)->sve_max_vq);
12947
12948 /* Zap the high bits of the zregs. */
12949 for (i = 0; i < 32; i++) {
12950 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq));
12951 }
12952
12953 /* Zap the high bits of the pregs and ffr. */
12954 pmask = 0;
12955 if (vq & 3) {
12956 pmask = ~(-1ULL << (16 * (vq & 3)));
12957 }
12958 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) {
12959 for (i = 0; i < 17; ++i) {
12960 env->vfp.pregs[i].p[j] &= pmask;
12961 }
12962 pmask = 0;
12963 }
12964 }
12965
12966 /*
12967 * Notice a change in SVE vector size when changing EL.
12968 */
12969 void aarch64_sve_change_el(CPUARMState *env, int old_el,
12970 int new_el, bool el0_a64)
12971 {
12972 ARMCPU *cpu = arm_env_get_cpu(env);
12973 int old_len, new_len;
12974 bool old_a64, new_a64;
12975
12976 /* Nothing to do if no SVE. */
12977 if (!cpu_isar_feature(aa64_sve, cpu)) {
12978 return;
12979 }
12980
12981 /* Nothing to do if FP is disabled in either EL. */
12982 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) {
12983 return;
12984 }
12985
12986 /*
12987 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped
12988 * at ELx, or not available because the EL is in AArch32 state, then
12989 * for all purposes other than a direct read, the ZCR_ELx.LEN field
12990 * has an effective value of 0".
12991 *
12992 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0).
12993 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition
12994 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that
12995 * we already have the correct register contents when encountering the
12996 * vq0->vq0 transition between EL0->EL1.
12997 */
12998 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64;
12999 old_len = (old_a64 && !sve_exception_el(env, old_el)
13000 ? sve_zcr_len_for_el(env, old_el) : 0);
13001 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64;
13002 new_len = (new_a64 && !sve_exception_el(env, new_el)
13003 ? sve_zcr_len_for_el(env, new_el) : 0);
13004
13005 /* When changing vector length, clear inaccessible state. */
13006 if (new_len < old_len) {
13007 aarch64_sve_narrow_vq(env, new_len + 1);
13008 }
13009 }
13010 #endif
QEmu