?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
target-arm: Add HCR_EL2
[qemu.git] / target-arm / helper.c
blobd117e83c146bc468dca9c3e11691fc601e8ae1d8
1 #include "cpu.h"
2 #include "internals.h"
3 #include "exec/gdbstub.h"
4 #include "exec/helper-proto.h"
5 #include "qemu/host-utils.h"
6 #include "sysemu/arch_init.h"
7 #include "sysemu/sysemu.h"
8 #include "qemu/bitops.h"
9 #include "qemu/crc32c.h"
10 #include "exec/cpu_ldst.h"
11 #include "arm_ldst.h"
12 #include <zlib.h> /* For crc32 */
13
14 #ifndef CONFIG_USER_ONLY
15 static inline int get_phys_addr(CPUARMState *env, target_ulong address,
16 int access_type, int is_user,
17 hwaddr *phys_ptr, int *prot,
18 target_ulong *page_size);
19
20 /* Definitions for the PMCCNTR and PMCR registers */
21 #define PMCRD 0x8
22 #define PMCRC 0x4
23 #define PMCRE 0x1
24 #endif
25
26 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
27 {
28 int nregs;
29
30 /* VFP data registers are always little-endian. */
31 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
32 if (reg < nregs) {
33 stfq_le_p(buf, env->vfp.regs[reg]);
34 return 8;
35 }
36 if (arm_feature(env, ARM_FEATURE_NEON)) {
37 /* Aliases for Q regs. */
38 nregs += 16;
39 if (reg < nregs) {
40 stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
41 stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
42 return 16;
43 }
44 }
45 switch (reg - nregs) {
46 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
47 case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
48 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
49 }
50 return 0;
51 }
52
53 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
54 {
55 int nregs;
56
57 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
58 if (reg < nregs) {
59 env->vfp.regs[reg] = ldfq_le_p(buf);
60 return 8;
61 }
62 if (arm_feature(env, ARM_FEATURE_NEON)) {
63 nregs += 16;
64 if (reg < nregs) {
65 env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
66 env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
67 return 16;
68 }
69 }
70 switch (reg - nregs) {
71 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
72 case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
73 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
74 }
75 return 0;
76 }
77
78 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
79 {
80 switch (reg) {
81 case 0 ... 31:
82 /* 128 bit FP register */
83 stfq_le_p(buf, env->vfp.regs[reg * 2]);
84 stfq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
85 return 16;
86 case 32:
87 /* FPSR */
88 stl_p(buf, vfp_get_fpsr(env));
89 return 4;
90 case 33:
91 /* FPCR */
92 stl_p(buf, vfp_get_fpcr(env));
93 return 4;
94 default:
95 return 0;
96 }
97 }
98
99 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
100 {
101 switch (reg) {
102 case 0 ... 31:
103 /* 128 bit FP register */
104 env->vfp.regs[reg * 2] = ldfq_le_p(buf);
105 env->vfp.regs[reg * 2 + 1] = ldfq_le_p(buf + 8);
106 return 16;
107 case 32:
108 /* FPSR */
109 vfp_set_fpsr(env, ldl_p(buf));
110 return 4;
111 case 33:
112 /* FPCR */
113 vfp_set_fpcr(env, ldl_p(buf));
114 return 4;
115 default:
116 return 0;
117 }
118 }
119
120 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
121 {
122 if (cpreg_field_is_64bit(ri)) {
123 return CPREG_FIELD64(env, ri);
124 } else {
125 return CPREG_FIELD32(env, ri);
126 }
127 }
128
129 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
130 uint64_t value)
131 {
132 if (cpreg_field_is_64bit(ri)) {
133 CPREG_FIELD64(env, ri) = value;
134 } else {
135 CPREG_FIELD32(env, ri) = value;
136 }
137 }
138
139 static uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
140 {
141 /* Raw read of a coprocessor register (as needed for migration, etc). */
142 if (ri->type & ARM_CP_CONST) {
143 return ri->resetvalue;
144 } else if (ri->raw_readfn) {
145 return ri->raw_readfn(env, ri);
146 } else if (ri->readfn) {
147 return ri->readfn(env, ri);
148 } else {
149 return raw_read(env, ri);
150 }
151 }
152
153 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
154 uint64_t v)
155 {
156 /* Raw write of a coprocessor register (as needed for migration, etc).
157 * Note that constant registers are treated as write-ignored; the
158 * caller should check for success by whether a readback gives the
159 * value written.
160 */
161 if (ri->type & ARM_CP_CONST) {
162 return;
163 } else if (ri->raw_writefn) {
164 ri->raw_writefn(env, ri, v);
165 } else if (ri->writefn) {
166 ri->writefn(env, ri, v);
167 } else {
168 raw_write(env, ri, v);
169 }
170 }
171
172 bool write_cpustate_to_list(ARMCPU *cpu)
173 {
174 /* Write the coprocessor state from cpu->env to the (index,value) list. */
175 int i;
176 bool ok = true;
177
178 for (i = 0; i < cpu->cpreg_array_len; i++) {
179 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
180 const ARMCPRegInfo *ri;
181
182 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
183 if (!ri) {
184 ok = false;
185 continue;
186 }
187 if (ri->type & ARM_CP_NO_MIGRATE) {
188 continue;
189 }
190 cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
191 }
192 return ok;
193 }
194
195 bool write_list_to_cpustate(ARMCPU *cpu)
196 {
197 int i;
198 bool ok = true;
199
200 for (i = 0; i < cpu->cpreg_array_len; i++) {
201 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
202 uint64_t v = cpu->cpreg_values[i];
203 const ARMCPRegInfo *ri;
204
205 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
206 if (!ri) {
207 ok = false;
208 continue;
209 }
210 if (ri->type & ARM_CP_NO_MIGRATE) {
211 continue;
212 }
213 /* Write value and confirm it reads back as written
214 * (to catch read-only registers and partially read-only
215 * registers where the incoming migration value doesn't match)
216 */
217 write_raw_cp_reg(&cpu->env, ri, v);
218 if (read_raw_cp_reg(&cpu->env, ri) != v) {
219 ok = false;
220 }
221 }
222 return ok;
223 }
224
225 static void add_cpreg_to_list(gpointer key, gpointer opaque)
226 {
227 ARMCPU *cpu = opaque;
228 uint64_t regidx;
229 const ARMCPRegInfo *ri;
230
231 regidx = *(uint32_t *)key;
232 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
233
234 if (!(ri->type & ARM_CP_NO_MIGRATE)) {
235 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
236 /* The value array need not be initialized at this point */
237 cpu->cpreg_array_len++;
238 }
239 }
240
241 static void count_cpreg(gpointer key, gpointer opaque)
242 {
243 ARMCPU *cpu = opaque;
244 uint64_t regidx;
245 const ARMCPRegInfo *ri;
246
247 regidx = *(uint32_t *)key;
248 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
249
250 if (!(ri->type & ARM_CP_NO_MIGRATE)) {
251 cpu->cpreg_array_len++;
252 }
253 }
254
255 static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
256 {
257 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
258 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
259
260 if (aidx > bidx) {
261 return 1;
262 }
263 if (aidx < bidx) {
264 return -1;
265 }
266 return 0;
267 }
268
269 static void cpreg_make_keylist(gpointer key, gpointer value, gpointer udata)
270 {
271 GList **plist = udata;
272
273 *plist = g_list_prepend(*plist, key);
274 }
275
276 void init_cpreg_list(ARMCPU *cpu)
277 {
278 /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
279 * Note that we require cpreg_tuples[] to be sorted by key ID.
280 */
281 GList *keys = NULL;
282 int arraylen;
283
284 g_hash_table_foreach(cpu->cp_regs, cpreg_make_keylist, &keys);
285
286 keys = g_list_sort(keys, cpreg_key_compare);
287
288 cpu->cpreg_array_len = 0;
289
290 g_list_foreach(keys, count_cpreg, cpu);
291
292 arraylen = cpu->cpreg_array_len;
293 cpu->cpreg_indexes = g_new(uint64_t, arraylen);
294 cpu->cpreg_values = g_new(uint64_t, arraylen);
295 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
296 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
297 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
298 cpu->cpreg_array_len = 0;
299
300 g_list_foreach(keys, add_cpreg_to_list, cpu);
301
302 assert(cpu->cpreg_array_len == arraylen);
303
304 g_list_free(keys);
305 }
306
307 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
308 {
309 ARMCPU *cpu = arm_env_get_cpu(env);
310
311 raw_write(env, ri, value);
312 tlb_flush(CPU(cpu), 1); /* Flush TLB as domain not tracked in TLB */
313 }
314
315 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
316 {
317 ARMCPU *cpu = arm_env_get_cpu(env);
318
319 if (raw_read(env, ri) != value) {
320 /* Unlike real hardware the qemu TLB uses virtual addresses,
321 * not modified virtual addresses, so this causes a TLB flush.
322 */
323 tlb_flush(CPU(cpu), 1);
324 raw_write(env, ri, value);
325 }
326 }
327
328 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
329 uint64_t value)
330 {
331 ARMCPU *cpu = arm_env_get_cpu(env);
332
333 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_MPU)
334 && !extended_addresses_enabled(env)) {
335 /* For VMSA (when not using the LPAE long descriptor page table
336 * format) this register includes the ASID, so do a TLB flush.
337 * For PMSA it is purely a process ID and no action is needed.
338 */
339 tlb_flush(CPU(cpu), 1);
340 }
341 raw_write(env, ri, value);
342 }
343
344 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,
345 uint64_t value)
346 {
347 /* Invalidate all (TLBIALL) */
348 ARMCPU *cpu = arm_env_get_cpu(env);
349
350 tlb_flush(CPU(cpu), 1);
351 }
352
353 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,
354 uint64_t value)
355 {
356 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
357 ARMCPU *cpu = arm_env_get_cpu(env);
358
359 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
360 }
361
362 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,
363 uint64_t value)
364 {
365 /* Invalidate by ASID (TLBIASID) */
366 ARMCPU *cpu = arm_env_get_cpu(env);
367
368 tlb_flush(CPU(cpu), value == 0);
369 }
370
371 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
372 uint64_t value)
373 {
374 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
375 ARMCPU *cpu = arm_env_get_cpu(env);
376
377 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
378 }
379
380 /* IS variants of TLB operations must affect all cores */
381 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
382 uint64_t value)
383 {
384 CPUState *other_cs;
385
386 CPU_FOREACH(other_cs) {
387 tlb_flush(other_cs, 1);
388 }
389 }
390
391 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
392 uint64_t value)
393 {
394 CPUState *other_cs;
395
396 CPU_FOREACH(other_cs) {
397 tlb_flush(other_cs, value == 0);
398 }
399 }
400
401 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
402 uint64_t value)
403 {
404 CPUState *other_cs;
405
406 CPU_FOREACH(other_cs) {
407 tlb_flush_page(other_cs, value & TARGET_PAGE_MASK);
408 }
409 }
410
411 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
412 uint64_t value)
413 {
414 CPUState *other_cs;
415
416 CPU_FOREACH(other_cs) {
417 tlb_flush_page(other_cs, value & TARGET_PAGE_MASK);
418 }
419 }
420
421 static const ARMCPRegInfo cp_reginfo[] = {
422 { .name = "FCSEIDR", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 0,
423 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c13_fcse),
424 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
425 { .name = "CONTEXTIDR", .state = ARM_CP_STATE_BOTH,
426 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
427 .access = PL1_RW,
428 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el1),
429 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
430 REGINFO_SENTINEL
431 };
432
433 static const ARMCPRegInfo not_v8_cp_reginfo[] = {
434 /* NB: Some of these registers exist in v8 but with more precise
435 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
436 */
437 /* MMU Domain access control / MPU write buffer control */
438 { .name = "DACR", .cp = 15,
439 .crn = 3, .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
440 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c3),
441 .resetvalue = 0, .writefn = dacr_write, .raw_writefn = raw_write, },
442 /* ??? This covers not just the impdef TLB lockdown registers but also
443 * some v7VMSA registers relating to TEX remap, so it is overly broad.
444 */
445 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = CP_ANY,
446 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
447 /* Cache maintenance ops; some of this space may be overridden later. */
448 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
449 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
450 .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
451 REGINFO_SENTINEL
452 };
453
454 static const ARMCPRegInfo not_v6_cp_reginfo[] = {
455 /* Not all pre-v6 cores implemented this WFI, so this is slightly
456 * over-broad.
457 */
458 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
459 .access = PL1_W, .type = ARM_CP_WFI },
460 REGINFO_SENTINEL
461 };
462
463 static const ARMCPRegInfo not_v7_cp_reginfo[] = {
464 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
465 * is UNPREDICTABLE; we choose to NOP as most implementations do).
466 */
467 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
468 .access = PL1_W, .type = ARM_CP_WFI },
469 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice
470 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
471 * OMAPCP will override this space.
472 */
473 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
474 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
475 .resetvalue = 0 },
476 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
477 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
478 .resetvalue = 0 },
479 /* v6 doesn't have the cache ID registers but Linux reads them anyway */
480 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
481 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
482 .resetvalue = 0 },
483 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
484 * implementing it as RAZ means the "debug architecture version" bits
485 * will read as a reserved value, which should cause Linux to not try
486 * to use the debug hardware.
487 */
488 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
489 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
490 /* MMU TLB control. Note that the wildcarding means we cover not just
491 * the unified TLB ops but also the dside/iside/inner-shareable variants.
492 */
493 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
494 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
495 .type = ARM_CP_NO_MIGRATE },
496 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
497 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
498 .type = ARM_CP_NO_MIGRATE },
499 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
500 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
501 .type = ARM_CP_NO_MIGRATE },
502 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
503 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
504 .type = ARM_CP_NO_MIGRATE },
505 REGINFO_SENTINEL
506 };
507
508 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
509 uint64_t value)
510 {
511 uint32_t mask = 0;
512
513 /* In ARMv8 most bits of CPACR_EL1 are RES0. */
514 if (!arm_feature(env, ARM_FEATURE_V8)) {
515 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
516 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
517 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
518 */
519 if (arm_feature(env, ARM_FEATURE_VFP)) {
520 /* VFP coprocessor: cp10 & cp11 [23:20] */
521 mask |= (1 << 31) | (1 << 30) | (0xf << 20);
522
523 if (!arm_feature(env, ARM_FEATURE_NEON)) {
524 /* ASEDIS [31] bit is RAO/WI */
525 value |= (1 << 31);
526 }
527
528 /* VFPv3 and upwards with NEON implement 32 double precision
529 * registers (D0-D31).
530 */
531 if (!arm_feature(env, ARM_FEATURE_NEON) ||
532 !arm_feature(env, ARM_FEATURE_VFP3)) {
533 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
534 value |= (1 << 30);
535 }
536 }
537 value &= mask;
538 }
539 env->cp15.c1_coproc = value;
540 }
541
542 static const ARMCPRegInfo v6_cp_reginfo[] = {
543 /* prefetch by MVA in v6, NOP in v7 */
544 { .name = "MVA_prefetch",
545 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
546 .access = PL1_W, .type = ARM_CP_NOP },
547 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
548 .access = PL0_W, .type = ARM_CP_NOP },
549 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
550 .access = PL0_W, .type = ARM_CP_NOP },
551 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
552 .access = PL0_W, .type = ARM_CP_NOP },
553 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
554 .access = PL1_RW,
555 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[1]),
556 .resetvalue = 0, },
557 /* Watchpoint Fault Address Register : should actually only be present
558 * for 1136, 1176, 11MPCore.
559 */
560 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
561 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
562 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
563 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2,
564 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_coproc),
565 .resetvalue = 0, .writefn = cpacr_write },
566 REGINFO_SENTINEL
567 };
568
569 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri)
570 {
571 /* Performance monitor registers user accessibility is controlled
572 * by PMUSERENR.
573 */
574 if (arm_current_pl(env) == 0 && !env->cp15.c9_pmuserenr) {
575 return CP_ACCESS_TRAP;
576 }
577 return CP_ACCESS_OK;
578 }
579
580 #ifndef CONFIG_USER_ONLY
581
582 static inline bool arm_ccnt_enabled(CPUARMState *env)
583 {
584 /* This does not support checking PMCCFILTR_EL0 register */
585
586 if (!(env->cp15.c9_pmcr & PMCRE)) {
587 return false;
588 }
589
590 return true;
591 }
592
593 void pmccntr_sync(CPUARMState *env)
594 {
595 uint64_t temp_ticks;
596
597 temp_ticks = muldiv64(qemu_clock_get_us(QEMU_CLOCK_VIRTUAL),
598 get_ticks_per_sec(), 1000000);
599
600 if (env->cp15.c9_pmcr & PMCRD) {
601 /* Increment once every 64 processor clock cycles */
602 temp_ticks /= 64;
603 }
604
605 if (arm_ccnt_enabled(env)) {
606 env->cp15.c15_ccnt = temp_ticks - env->cp15.c15_ccnt;
607 }
608 }
609
610 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
611 uint64_t value)
612 {
613 pmccntr_sync(env);
614
615 if (value & PMCRC) {
616 /* The counter has been reset */
617 env->cp15.c15_ccnt = 0;
618 }
619
620 /* only the DP, X, D and E bits are writable */
621 env->cp15.c9_pmcr &= ~0x39;
622 env->cp15.c9_pmcr |= (value & 0x39);
623
624 pmccntr_sync(env);
625 }
626
627 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
628 {
629 uint64_t total_ticks;
630
631 if (!arm_ccnt_enabled(env)) {
632 /* Counter is disabled, do not change value */
633 return env->cp15.c15_ccnt;
634 }
635
636 total_ticks = muldiv64(qemu_clock_get_us(QEMU_CLOCK_VIRTUAL),
637 get_ticks_per_sec(), 1000000);
638
639 if (env->cp15.c9_pmcr & PMCRD) {
640 /* Increment once every 64 processor clock cycles */
641 total_ticks /= 64;
642 }
643 return total_ticks - env->cp15.c15_ccnt;
644 }
645
646 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
647 uint64_t value)
648 {
649 uint64_t total_ticks;
650
651 if (!arm_ccnt_enabled(env)) {
652 /* Counter is disabled, set the absolute value */
653 env->cp15.c15_ccnt = value;
654 return;
655 }
656
657 total_ticks = muldiv64(qemu_clock_get_us(QEMU_CLOCK_VIRTUAL),
658 get_ticks_per_sec(), 1000000);
659
660 if (env->cp15.c9_pmcr & PMCRD) {
661 /* Increment once every 64 processor clock cycles */
662 total_ticks /= 64;
663 }
664 env->cp15.c15_ccnt = total_ticks - value;
665 }
666
667 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
668 uint64_t value)
669 {
670 uint64_t cur_val = pmccntr_read(env, NULL);
671
672 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
673 }
674
675 #else /* CONFIG_USER_ONLY */
676
677 void pmccntr_sync(CPUARMState *env)
678 {
679 }
680
681 #endif
682
683 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
684 uint64_t value)
685 {
686 pmccntr_sync(env);
687 env->cp15.pmccfiltr_el0 = value & 0x7E000000;
688 pmccntr_sync(env);
689 }
690
691 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
692 uint64_t value)
693 {
694 value &= (1 << 31);
695 env->cp15.c9_pmcnten |= value;
696 }
697
698 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
699 uint64_t value)
700 {
701 value &= (1 << 31);
702 env->cp15.c9_pmcnten &= ~value;
703 }
704
705 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
706 uint64_t value)
707 {
708 env->cp15.c9_pmovsr &= ~value;
709 }
710
711 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
712 uint64_t value)
713 {
714 env->cp15.c9_pmxevtyper = value & 0xff;
715 }
716
717 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
718 uint64_t value)
719 {
720 env->cp15.c9_pmuserenr = value & 1;
721 }
722
723 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
724 uint64_t value)
725 {
726 /* We have no event counters so only the C bit can be changed */
727 value &= (1 << 31);
728 env->cp15.c9_pminten |= value;
729 }
730
731 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
732 uint64_t value)
733 {
734 value &= (1 << 31);
735 env->cp15.c9_pminten &= ~value;
736 }
737
738 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
739 uint64_t value)
740 {
741 /* Note that even though the AArch64 view of this register has bits
742 * [10:0] all RES0 we can only mask the bottom 5, to comply with the
743 * architectural requirements for bits which are RES0 only in some
744 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
745 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
746 */
747 raw_write(env, ri, value & ~0x1FULL);
748 }
749
750 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
751 {
752 ARMCPU *cpu = arm_env_get_cpu(env);
753 return cpu->ccsidr[env->cp15.c0_cssel];
754 }
755
756 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
757 uint64_t value)
758 {
759 raw_write(env, ri, value & 0xf);
760 }
761
762 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
763 {
764 CPUState *cs = ENV_GET_CPU(env);
765 uint64_t ret = 0;
766
767 if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
768 ret |= CPSR_I;
769 }
770 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
771 ret |= CPSR_F;
772 }
773 /* External aborts are not possible in QEMU so A bit is always clear */
774 return ret;
775 }
776
777 static const ARMCPRegInfo v7_cp_reginfo[] = {
778 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
779 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
780 .access = PL1_W, .type = ARM_CP_NOP },
781 /* Performance monitors are implementation defined in v7,
782 * but with an ARM recommended set of registers, which we
783 * follow (although we don't actually implement any counters)
784 *
785 * Performance registers fall into three categories:
786 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
787 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
788 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
789 * For the cases controlled by PMUSERENR we must set .access to PL0_RW
790 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
791 */
792 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
793 .access = PL0_RW, .type = ARM_CP_NO_MIGRATE,
794 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
795 .writefn = pmcntenset_write,
796 .accessfn = pmreg_access,
797 .raw_writefn = raw_write },
798 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64,
799 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
800 .access = PL0_RW, .accessfn = pmreg_access,
801 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
802 .writefn = pmcntenset_write, .raw_writefn = raw_write },
803 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
804 .access = PL0_RW,
805 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
806 .accessfn = pmreg_access,
807 .writefn = pmcntenclr_write,
808 .type = ARM_CP_NO_MIGRATE },
809 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
810 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
811 .access = PL0_RW, .accessfn = pmreg_access,
812 .type = ARM_CP_NO_MIGRATE,
813 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
814 .writefn = pmcntenclr_write },
815 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
816 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
817 .accessfn = pmreg_access,
818 .writefn = pmovsr_write,
819 .raw_writefn = raw_write },
820 /* Unimplemented so WI. */
821 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
822 .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP },
823 /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.
824 * We choose to RAZ/WI.
825 */
826 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
827 .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
828 .accessfn = pmreg_access },
829 #ifndef CONFIG_USER_ONLY
830 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
831 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
832 .readfn = pmccntr_read, .writefn = pmccntr_write32,
833 .accessfn = pmreg_access },
834 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
835 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
836 .access = PL0_RW, .accessfn = pmreg_access,
837 .type = ARM_CP_IO,
838 .readfn = pmccntr_read, .writefn = pmccntr_write, },
839 #endif
840 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
841 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
842 .writefn = pmccfiltr_write,
843 .access = PL0_RW, .accessfn = pmreg_access,
844 .type = ARM_CP_IO,
845 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
846 .resetvalue = 0, },
847 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
848 .access = PL0_RW,
849 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
850 .accessfn = pmreg_access, .writefn = pmxevtyper_write,
851 .raw_writefn = raw_write },
852 /* Unimplemented, RAZ/WI. */
853 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
854 .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
855 .accessfn = pmreg_access },
856 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
857 .access = PL0_R | PL1_RW,
858 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
859 .resetvalue = 0,
860 .writefn = pmuserenr_write, .raw_writefn = raw_write },
861 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
862 .access = PL1_RW,
863 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
864 .resetvalue = 0,
865 .writefn = pmintenset_write, .raw_writefn = raw_write },
866 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
867 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
868 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
869 .resetvalue = 0, .writefn = pmintenclr_write, },
870 { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
871 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
872 .access = PL1_RW, .writefn = vbar_write,
873 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[1]),
874 .resetvalue = 0 },
875 { .name = "SCR", .cp = 15, .crn = 1, .crm = 1, .opc1 = 0, .opc2 = 0,
876 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_scr),
877 .resetvalue = 0, },
878 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
879 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
880 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_MIGRATE },
881 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
882 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
883 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c0_cssel),
884 .writefn = csselr_write, .resetvalue = 0 },
885 /* Auxiliary ID register: this actually has an IMPDEF value but for now
886 * just RAZ for all cores:
887 */
888 { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
889 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
890 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
891 /* Auxiliary fault status registers: these also are IMPDEF, and we
892 * choose to RAZ/WI for all cores.
893 */
894 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
895 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
896 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
897 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
898 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
899 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
900 /* MAIR can just read-as-written because we don't implement caches
901 * and so don't need to care about memory attributes.
902 */
903 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
904 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
905 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el1),
906 .resetvalue = 0 },
907 /* For non-long-descriptor page tables these are PRRR and NMRR;
908 * regardless they still act as reads-as-written for QEMU.
909 * The override is necessary because of the overly-broad TLB_LOCKDOWN
910 * definition.
911 */
912 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, .type = ARM_CP_OVERRIDE,
913 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW,
914 .fieldoffset = offsetoflow32(CPUARMState, cp15.mair_el1),
915 .resetfn = arm_cp_reset_ignore },
916 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, .type = ARM_CP_OVERRIDE,
917 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW,
918 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el1),
919 .resetfn = arm_cp_reset_ignore },
920 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
921 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
922 .type = ARM_CP_NO_MIGRATE, .access = PL1_R, .readfn = isr_read },
923 /* 32 bit ITLB invalidates */
924 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0,
925 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_write },
926 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
927 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
928 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2,
929 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiasid_write },
930 /* 32 bit DTLB invalidates */
931 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0,
932 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_write },
933 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
934 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
935 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2,
936 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiasid_write },
937 /* 32 bit TLB invalidates */
938 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
939 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_write },
940 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
941 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
942 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
943 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiasid_write },
944 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
945 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimvaa_write },
946 REGINFO_SENTINEL
947 };
948
949 static const ARMCPRegInfo v7mp_cp_reginfo[] = {
950 /* 32 bit TLB invalidates, Inner Shareable */
951 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
952 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_is_write },
953 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
954 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_is_write },
955 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
956 .type = ARM_CP_NO_MIGRATE, .access = PL1_W,
957 .writefn = tlbiasid_is_write },
958 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
959 .type = ARM_CP_NO_MIGRATE, .access = PL1_W,
960 .writefn = tlbimvaa_is_write },
961 REGINFO_SENTINEL
962 };
963
964 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
965 uint64_t value)
966 {
967 value &= 1;
968 env->teecr = value;
969 }
970
971 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri)
972 {
973 if (arm_current_pl(env) == 0 && (env->teecr & 1)) {
974 return CP_ACCESS_TRAP;
975 }
976 return CP_ACCESS_OK;
977 }
978
979 static const ARMCPRegInfo t2ee_cp_reginfo[] = {
980 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
981 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
982 .resetvalue = 0,
983 .writefn = teecr_write },
984 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
985 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
986 .accessfn = teehbr_access, .resetvalue = 0 },
987 REGINFO_SENTINEL
988 };
989
990 static const ARMCPRegInfo v6k_cp_reginfo[] = {
991 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
992 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
993 .access = PL0_RW,
994 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el0), .resetvalue = 0 },
995 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
996 .access = PL0_RW,
997 .fieldoffset = offsetoflow32(CPUARMState, cp15.tpidr_el0),
998 .resetfn = arm_cp_reset_ignore },
999 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
1000 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
1001 .access = PL0_R|PL1_W,
1002 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el0), .resetvalue = 0 },
1003 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
1004 .access = PL0_R|PL1_W,
1005 .fieldoffset = offsetoflow32(CPUARMState, cp15.tpidrro_el0),
1006 .resetfn = arm_cp_reset_ignore },
1007 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_BOTH,
1008 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
1009 .access = PL1_RW,
1010 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el1), .resetvalue = 0 },
1011 REGINFO_SENTINEL
1012 };
1013
1014 #ifndef CONFIG_USER_ONLY
1015
1016 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri)
1017 {
1018 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero */
1019 if (arm_current_pl(env) == 0 && !extract32(env->cp15.c14_cntkctl, 0, 2)) {
1020 return CP_ACCESS_TRAP;
1021 }
1022 return CP_ACCESS_OK;
1023 }
1024
1025 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx)
1026 {
1027 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */
1028 if (arm_current_pl(env) == 0 &&
1029 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
1030 return CP_ACCESS_TRAP;
1031 }
1032 return CP_ACCESS_OK;
1033 }
1034
1035 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx)
1036 {
1037 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if
1038 * EL0[PV]TEN is zero.
1039 */
1040 if (arm_current_pl(env) == 0 &&
1041 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
1042 return CP_ACCESS_TRAP;
1043 }
1044 return CP_ACCESS_OK;
1045 }
1046
1047 static CPAccessResult gt_pct_access(CPUARMState *env,
1048 const ARMCPRegInfo *ri)
1049 {
1050 return gt_counter_access(env, GTIMER_PHYS);
1051 }
1052
1053 static CPAccessResult gt_vct_access(CPUARMState *env,
1054 const ARMCPRegInfo *ri)
1055 {
1056 return gt_counter_access(env, GTIMER_VIRT);
1057 }
1058
1059 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
1060 {
1061 return gt_timer_access(env, GTIMER_PHYS);
1062 }
1063
1064 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
1065 {
1066 return gt_timer_access(env, GTIMER_VIRT);
1067 }
1068
1069 static uint64_t gt_get_countervalue(CPUARMState *env)
1070 {
1071 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
1072 }
1073
1074 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
1075 {
1076 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
1077
1078 if (gt->ctl & 1) {
1079 /* Timer enabled: calculate and set current ISTATUS, irq, and
1080 * reset timer to when ISTATUS next has to change
1081 */
1082 uint64_t count = gt_get_countervalue(&cpu->env);
1083 /* Note that this must be unsigned 64 bit arithmetic: */
1084 int istatus = count >= gt->cval;
1085 uint64_t nexttick;
1086
1087 gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
1088 qemu_set_irq(cpu->gt_timer_outputs[timeridx],
1089 (istatus && !(gt->ctl & 2)));
1090 if (istatus) {
1091 /* Next transition is when count rolls back over to zero */
1092 nexttick = UINT64_MAX;
1093 } else {
1094 /* Next transition is when we hit cval */
1095 nexttick = gt->cval;
1096 }
1097 /* Note that the desired next expiry time might be beyond the
1098 * signed-64-bit range of a QEMUTimer -- in this case we just
1099 * set the timer for as far in the future as possible. When the
1100 * timer expires we will reset the timer for any remaining period.
1101 */
1102 if (nexttick > INT64_MAX / GTIMER_SCALE) {
1103 nexttick = INT64_MAX / GTIMER_SCALE;
1104 }
1105 timer_mod(cpu->gt_timer[timeridx], nexttick);
1106 } else {
1107 /* Timer disabled: ISTATUS and timer output always clear */
1108 gt->ctl &= ~4;
1109 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);
1110 timer_del(cpu->gt_timer[timeridx]);
1111 }
1112 }
1113
1114 static void gt_cnt_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1115 {
1116 ARMCPU *cpu = arm_env_get_cpu(env);
1117 int timeridx = ri->opc1 & 1;
1118
1119 timer_del(cpu->gt_timer[timeridx]);
1120 }
1121
1122 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
1123 {
1124 return gt_get_countervalue(env);
1125 }
1126
1127 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1128 uint64_t value)
1129 {
1130 int timeridx = ri->opc1 & 1;
1131
1132 env->cp15.c14_timer[timeridx].cval = value;
1133 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1134 }
1135
1136 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1137 {
1138 int timeridx = ri->crm & 1;
1139
1140 return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
1141 gt_get_countervalue(env));
1142 }
1143
1144 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1145 uint64_t value)
1146 {
1147 int timeridx = ri->crm & 1;
1148
1149 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) +
1150 + sextract64(value, 0, 32);
1151 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1152 }
1153
1154 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1155 uint64_t value)
1156 {
1157 ARMCPU *cpu = arm_env_get_cpu(env);
1158 int timeridx = ri->crm & 1;
1159 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
1160
1161 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
1162 if ((oldval ^ value) & 1) {
1163 /* Enable toggled */
1164 gt_recalc_timer(cpu, timeridx);
1165 } else if ((oldval ^ value) & 2) {
1166 /* IMASK toggled: don't need to recalculate,
1167 * just set the interrupt line based on ISTATUS
1168 */
1169 qemu_set_irq(cpu->gt_timer_outputs[timeridx],
1170 (oldval & 4) && !(value & 2));
1171 }
1172 }
1173
1174 void arm_gt_ptimer_cb(void *opaque)
1175 {
1176 ARMCPU *cpu = opaque;
1177
1178 gt_recalc_timer(cpu, GTIMER_PHYS);
1179 }
1180
1181 void arm_gt_vtimer_cb(void *opaque)
1182 {
1183 ARMCPU *cpu = opaque;
1184
1185 gt_recalc_timer(cpu, GTIMER_VIRT);
1186 }
1187
1188 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1189 /* Note that CNTFRQ is purely reads-as-written for the benefit
1190 * of software; writing it doesn't actually change the timer frequency.
1191 * Our reset value matches the fixed frequency we implement the timer at.
1192 */
1193 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
1194 .type = ARM_CP_NO_MIGRATE,
1195 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1196 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
1197 .resetfn = arm_cp_reset_ignore,
1198 },
1199 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
1200 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
1201 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1202 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
1203 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
1204 },
1205 /* overall control: mostly access permissions */
1206 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
1207 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
1208 .access = PL1_RW,
1209 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
1210 .resetvalue = 0,
1211 },
1212 /* per-timer control */
1213 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
1214 .type = ARM_CP_IO | ARM_CP_NO_MIGRATE, .access = PL1_RW | PL0_R,
1215 .accessfn = gt_ptimer_access,
1216 .fieldoffset = offsetoflow32(CPUARMState,
1217 cp15.c14_timer[GTIMER_PHYS].ctl),
1218 .resetfn = arm_cp_reset_ignore,
1219 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1220 },
1221 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
1222 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
1223 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1224 .accessfn = gt_ptimer_access,
1225 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
1226 .resetvalue = 0,
1227 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1228 },
1229 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
1230 .type = ARM_CP_IO | ARM_CP_NO_MIGRATE, .access = PL1_RW | PL0_R,
1231 .accessfn = gt_vtimer_access,
1232 .fieldoffset = offsetoflow32(CPUARMState,
1233 cp15.c14_timer[GTIMER_VIRT].ctl),
1234 .resetfn = arm_cp_reset_ignore,
1235 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1236 },
1237 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
1238 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
1239 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1240 .accessfn = gt_vtimer_access,
1241 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
1242 .resetvalue = 0,
1243 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1244 },
1245 /* TimerValue views: a 32 bit downcounting view of the underlying state */
1246 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
1247 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1248 .accessfn = gt_ptimer_access,
1249 .readfn = gt_tval_read, .writefn = gt_tval_write,
1250 },
1251 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1252 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
1253 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1254 .readfn = gt_tval_read, .writefn = gt_tval_write,
1255 },
1256 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
1257 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1258 .accessfn = gt_vtimer_access,
1259 .readfn = gt_tval_read, .writefn = gt_tval_write,
1260 },
1261 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1262 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
1263 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1264 .readfn = gt_tval_read, .writefn = gt_tval_write,
1265 },
1266 /* The counter itself */
1267 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
1268 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE | ARM_CP_IO,
1269 .accessfn = gt_pct_access,
1270 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
1271 },
1272 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
1273 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
1274 .access = PL0_R, .type = ARM_CP_NO_MIGRATE | ARM_CP_IO,
1275 .accessfn = gt_pct_access,
1276 .readfn = gt_cnt_read, .resetfn = gt_cnt_reset,
1277 },
1278 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
1279 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE | ARM_CP_IO,
1280 .accessfn = gt_vct_access,
1281 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
1282 },
1283 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
1284 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
1285 .access = PL0_R, .type = ARM_CP_NO_MIGRATE | ARM_CP_IO,
1286 .accessfn = gt_vct_access,
1287 .readfn = gt_cnt_read, .resetfn = gt_cnt_reset,
1288 },
1289 /* Comparison value, indicating when the timer goes off */
1290 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
1291 .access = PL1_RW | PL0_R,
1292 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_MIGRATE,
1293 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1294 .accessfn = gt_ptimer_access, .resetfn = arm_cp_reset_ignore,
1295 .writefn = gt_cval_write, .raw_writefn = raw_write,
1296 },
1297 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1298 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
1299 .access = PL1_RW | PL0_R,
1300 .type = ARM_CP_IO,
1301 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1302 .resetvalue = 0, .accessfn = gt_vtimer_access,
1303 .writefn = gt_cval_write, .raw_writefn = raw_write,
1304 },
1305 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
1306 .access = PL1_RW | PL0_R,
1307 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_MIGRATE,
1308 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1309 .accessfn = gt_vtimer_access, .resetfn = arm_cp_reset_ignore,
1310 .writefn = gt_cval_write, .raw_writefn = raw_write,
1311 },
1312 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1313 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
1314 .access = PL1_RW | PL0_R,
1315 .type = ARM_CP_IO,
1316 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1317 .resetvalue = 0, .accessfn = gt_vtimer_access,
1318 .writefn = gt_cval_write, .raw_writefn = raw_write,
1319 },
1320 REGINFO_SENTINEL
1321 };
1322
1323 #else
1324 /* In user-mode none of the generic timer registers are accessible,
1325 * and their implementation depends on QEMU_CLOCK_VIRTUAL and qdev gpio outputs,
1326 * so instead just don't register any of them.
1327 */
1328 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1329 REGINFO_SENTINEL
1330 };
1331
1332 #endif
1333
1334 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1335 {
1336 if (arm_feature(env, ARM_FEATURE_LPAE)) {
1337 raw_write(env, ri, value);
1338 } else if (arm_feature(env, ARM_FEATURE_V7)) {
1339 raw_write(env, ri, value & 0xfffff6ff);
1340 } else {
1341 raw_write(env, ri, value & 0xfffff1ff);
1342 }
1343 }
1344
1345 #ifndef CONFIG_USER_ONLY
1346 /* get_phys_addr() isn't present for user-mode-only targets */
1347
1348 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri)
1349 {
1350 if (ri->opc2 & 4) {
1351 /* Other states are only available with TrustZone; in
1352 * a non-TZ implementation these registers don't exist
1353 * at all, which is an Uncategorized trap. This underdecoding
1354 * is safe because the reginfo is NO_MIGRATE.
1355 */
1356 return CP_ACCESS_TRAP_UNCATEGORIZED;
1357 }
1358 return CP_ACCESS_OK;
1359 }
1360
1361 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1362 {
1363 hwaddr phys_addr;
1364 target_ulong page_size;
1365 int prot;
1366 int ret, is_user = ri->opc2 & 2;
1367 int access_type = ri->opc2 & 1;
1368
1369 ret = get_phys_addr(env, value, access_type, is_user,
1370 &phys_addr, &prot, &page_size);
1371 if (extended_addresses_enabled(env)) {
1372 /* ret is a DFSR/IFSR value for the long descriptor
1373 * translation table format, but with WnR always clear.
1374 * Convert it to a 64-bit PAR.
1375 */
1376 uint64_t par64 = (1 << 11); /* LPAE bit always set */
1377 if (ret == 0) {
1378 par64 |= phys_addr & ~0xfffULL;
1379 /* We don't set the ATTR or SH fields in the PAR. */
1380 } else {
1381 par64 |= 1; /* F */
1382 par64 |= (ret & 0x3f) << 1; /* FS */
1383 /* Note that S2WLK and FSTAGE are always zero, because we don't
1384 * implement virtualization and therefore there can't be a stage 2
1385 * fault.
1386 */
1387 }
1388 env->cp15.par_el1 = par64;
1389 } else {
1390 /* ret is a DFSR/IFSR value for the short descriptor
1391 * translation table format (with WnR always clear).
1392 * Convert it to a 32-bit PAR.
1393 */
1394 if (ret == 0) {
1395 /* We do not set any attribute bits in the PAR */
1396 if (page_size == (1 << 24)
1397 && arm_feature(env, ARM_FEATURE_V7)) {
1398 env->cp15.par_el1 = (phys_addr & 0xff000000) | 1 << 1;
1399 } else {
1400 env->cp15.par_el1 = phys_addr & 0xfffff000;
1401 }
1402 } else {
1403 env->cp15.par_el1 = ((ret & (1 << 10)) >> 5) |
1404 ((ret & (1 << 12)) >> 6) |
1405 ((ret & 0xf) << 1) | 1;
1406 }
1407 }
1408 }
1409 #endif
1410
1411 static const ARMCPRegInfo vapa_cp_reginfo[] = {
1412 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
1413 .access = PL1_RW, .resetvalue = 0,
1414 .fieldoffset = offsetoflow32(CPUARMState, cp15.par_el1),
1415 .writefn = par_write },
1416 #ifndef CONFIG_USER_ONLY
1417 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
1418 .access = PL1_W, .accessfn = ats_access,
1419 .writefn = ats_write, .type = ARM_CP_NO_MIGRATE },
1420 #endif
1421 REGINFO_SENTINEL
1422 };
1423
1424 /* Return basic MPU access permission bits. */
1425 static uint32_t simple_mpu_ap_bits(uint32_t val)
1426 {
1427 uint32_t ret;
1428 uint32_t mask;
1429 int i;
1430 ret = 0;
1431 mask = 3;
1432 for (i = 0; i < 16; i += 2) {
1433 ret |= (val >> i) & mask;
1434 mask <<= 2;
1435 }
1436 return ret;
1437 }
1438
1439 /* Pad basic MPU access permission bits to extended format. */
1440 static uint32_t extended_mpu_ap_bits(uint32_t val)
1441 {
1442 uint32_t ret;
1443 uint32_t mask;
1444 int i;
1445 ret = 0;
1446 mask = 3;
1447 for (i = 0; i < 16; i += 2) {
1448 ret |= (val & mask) << i;
1449 mask <<= 2;
1450 }
1451 return ret;
1452 }
1453
1454 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1455 uint64_t value)
1456 {
1457 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
1458 }
1459
1460 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1461 {
1462 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
1463 }
1464
1465 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1466 uint64_t value)
1467 {
1468 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
1469 }
1470
1471 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1472 {
1473 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
1474 }
1475
1476 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
1477 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
1478 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
1479 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
1480 .resetvalue = 0,
1481 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
1482 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
1483 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
1484 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
1485 .resetvalue = 0,
1486 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
1487 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
1488 .access = PL1_RW,
1489 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
1490 .resetvalue = 0, },
1491 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
1492 .access = PL1_RW,
1493 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
1494 .resetvalue = 0, },
1495 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
1496 .access = PL1_RW,
1497 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
1498 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
1499 .access = PL1_RW,
1500 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
1501 /* Protection region base and size registers */
1502 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
1503 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1504 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
1505 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
1506 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1507 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
1508 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
1509 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1510 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
1511 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
1512 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1513 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
1514 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
1515 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1516 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
1517 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
1518 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1519 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
1520 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
1521 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1522 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
1523 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
1524 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1525 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
1526 REGINFO_SENTINEL
1527 };
1528
1529 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
1530 uint64_t value)
1531 {
1532 int maskshift = extract32(value, 0, 3);
1533
1534 if (!arm_feature(env, ARM_FEATURE_V8)) {
1535 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
1536 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
1537 * using Long-desciptor translation table format */
1538 value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
1539 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
1540 /* In an implementation that includes the Security Extensions
1541 * TTBCR has additional fields PD0 [4] and PD1 [5] for
1542 * Short-descriptor translation table format.
1543 */
1544 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N;
1545 } else {
1546 value &= TTBCR_N;
1547 }
1548 }
1549
1550 /* Note that we always calculate c2_mask and c2_base_mask, but
1551 * they are only used for short-descriptor tables (ie if EAE is 0);
1552 * for long-descriptor tables the TTBCR fields are used differently
1553 * and the c2_mask and c2_base_mask values are meaningless.
1554 */
1555 raw_write(env, ri, value);
1556 env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> maskshift);
1557 env->cp15.c2_base_mask = ~((uint32_t)0x3fffu >> maskshift);
1558 }
1559
1560 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1561 uint64_t value)
1562 {
1563 ARMCPU *cpu = arm_env_get_cpu(env);
1564
1565 if (arm_feature(env, ARM_FEATURE_LPAE)) {
1566 /* With LPAE the TTBCR could result in a change of ASID
1567 * via the TTBCR.A1 bit, so do a TLB flush.
1568 */
1569 tlb_flush(CPU(cpu), 1);
1570 }
1571 vmsa_ttbcr_raw_write(env, ri, value);
1572 }
1573
1574 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1575 {
1576 env->cp15.c2_base_mask = 0xffffc000u;
1577 raw_write(env, ri, 0);
1578 env->cp15.c2_mask = 0;
1579 }
1580
1581 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
1582 uint64_t value)
1583 {
1584 ARMCPU *cpu = arm_env_get_cpu(env);
1585
1586 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
1587 tlb_flush(CPU(cpu), 1);
1588 raw_write(env, ri, value);
1589 }
1590
1591 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1592 uint64_t value)
1593 {
1594 /* 64 bit accesses to the TTBRs can change the ASID and so we
1595 * must flush the TLB.
1596 */
1597 if (cpreg_field_is_64bit(ri)) {
1598 ARMCPU *cpu = arm_env_get_cpu(env);
1599
1600 tlb_flush(CPU(cpu), 1);
1601 }
1602 raw_write(env, ri, value);
1603 }
1604
1605 static const ARMCPRegInfo vmsa_cp_reginfo[] = {
1606 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
1607 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
1608 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
1609 .resetfn = arm_cp_reset_ignore, },
1610 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
1611 .access = PL1_RW,
1612 .fieldoffset = offsetof(CPUARMState, cp15.ifsr_el2), .resetvalue = 0, },
1613 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
1614 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
1615 .access = PL1_RW,
1616 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
1617 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
1618 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
1619 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el1),
1620 .writefn = vmsa_ttbr_write, .resetvalue = 0 },
1621 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
1622 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
1623 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el1),
1624 .writefn = vmsa_ttbr_write, .resetvalue = 0 },
1625 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
1626 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
1627 .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
1628 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
1629 .fieldoffset = offsetof(CPUARMState, cp15.c2_control) },
1630 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
1631 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE, .writefn = vmsa_ttbcr_write,
1632 .resetfn = arm_cp_reset_ignore, .raw_writefn = vmsa_ttbcr_raw_write,
1633 .fieldoffset = offsetoflow32(CPUARMState, cp15.c2_control) },
1634 /* 64-bit FAR; this entry also gives us the AArch32 DFAR */
1635 { .name = "FAR_EL1", .state = ARM_CP_STATE_BOTH,
1636 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
1637 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
1638 .resetvalue = 0, },
1639 REGINFO_SENTINEL
1640 };
1641
1642 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri,
1643 uint64_t value)
1644 {
1645 env->cp15.c15_ticonfig = value & 0xe7;
1646 /* The OS_TYPE bit in this register changes the reported CPUID! */
1647 env->cp15.c0_cpuid = (value & (1 << 5)) ?
1648 ARM_CPUID_TI915T : ARM_CPUID_TI925T;
1649 }
1650
1651 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
1652 uint64_t value)
1653 {
1654 env->cp15.c15_threadid = value & 0xffff;
1655 }
1656
1657 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
1658 uint64_t value)
1659 {
1660 /* Wait-for-interrupt (deprecated) */
1661 cpu_interrupt(CPU(arm_env_get_cpu(env)), CPU_INTERRUPT_HALT);
1662 }
1663
1664 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
1665 uint64_t value)
1666 {
1667 /* On OMAP there are registers indicating the max/min index of dcache lines
1668 * containing a dirty line; cache flush operations have to reset these.
1669 */
1670 env->cp15.c15_i_max = 0x000;
1671 env->cp15.c15_i_min = 0xff0;
1672 }
1673
1674 static const ARMCPRegInfo omap_cp_reginfo[] = {
1675 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY,
1676 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE,
1677 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
1678 .resetvalue = 0, },
1679 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,
1680 .access = PL1_RW, .type = ARM_CP_NOP },
1681 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0,
1682 .access = PL1_RW,
1683 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0,
1684 .writefn = omap_ticonfig_write },
1685 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0,
1686 .access = PL1_RW,
1687 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, },
1688 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0,
1689 .access = PL1_RW, .resetvalue = 0xff0,
1690 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) },
1691 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0,
1692 .access = PL1_RW,
1693 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0,
1694 .writefn = omap_threadid_write },
1695 { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
1696 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
1697 .type = ARM_CP_NO_MIGRATE,
1698 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
1699 /* TODO: Peripheral port remap register:
1700 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
1701 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
1702 * when MMU is off.
1703 */
1704 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
1705 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
1706 .type = ARM_CP_OVERRIDE | ARM_CP_NO_MIGRATE,
1707 .writefn = omap_cachemaint_write },
1708 { .name = "C9", .cp = 15, .crn = 9,
1709 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
1710 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
1711 REGINFO_SENTINEL
1712 };
1713
1714 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
1715 uint64_t value)
1716 {
1717 env->cp15.c15_cpar = value & 0x3fff;
1718 }
1719
1720 static const ARMCPRegInfo xscale_cp_reginfo[] = {
1721 { .name = "XSCALE_CPAR",
1722 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
1723 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
1724 .writefn = xscale_cpar_write, },
1725 { .name = "XSCALE_AUXCR",
1726 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
1727 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
1728 .resetvalue = 0, },
1729 /* XScale specific cache-lockdown: since we have no cache we NOP these
1730 * and hope the guest does not really rely on cache behaviour.
1731 */
1732 { .name = "XSCALE_LOCK_ICACHE_LINE",
1733 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
1734 .access = PL1_W, .type = ARM_CP_NOP },
1735 { .name = "XSCALE_UNLOCK_ICACHE",
1736 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
1737 .access = PL1_W, .type = ARM_CP_NOP },
1738 { .name = "XSCALE_DCACHE_LOCK",
1739 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
1740 .access = PL1_RW, .type = ARM_CP_NOP },
1741 { .name = "XSCALE_UNLOCK_DCACHE",
1742 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
1743 .access = PL1_W, .type = ARM_CP_NOP },
1744 REGINFO_SENTINEL
1745 };
1746
1747 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
1748 /* RAZ/WI the whole crn=15 space, when we don't have a more specific
1749 * implementation of this implementation-defined space.
1750 * Ideally this should eventually disappear in favour of actually
1751 * implementing the correct behaviour for all cores.
1752 */
1753 { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
1754 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
1755 .access = PL1_RW,
1756 .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE | ARM_CP_OVERRIDE,
1757 .resetvalue = 0 },
1758 REGINFO_SENTINEL
1759 };
1760
1761 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
1762 /* Cache status: RAZ because we have no cache so it's always clean */
1763 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
1764 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1765 .resetvalue = 0 },
1766 REGINFO_SENTINEL
1767 };
1768
1769 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
1770 /* We never have a a block transfer operation in progress */
1771 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
1772 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1773 .resetvalue = 0 },
1774 /* The cache ops themselves: these all NOP for QEMU */
1775 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
1776 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1777 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
1778 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1779 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
1780 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1781 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
1782 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1783 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
1784 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1785 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
1786 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1787 REGINFO_SENTINEL
1788 };
1789
1790 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
1791 /* The cache test-and-clean instructions always return (1 << 30)
1792 * to indicate that there are no dirty cache lines.
1793 */
1794 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
1795 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1796 .resetvalue = (1 << 30) },
1797 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
1798 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1799 .resetvalue = (1 << 30) },
1800 REGINFO_SENTINEL
1801 };
1802
1803 static const ARMCPRegInfo strongarm_cp_reginfo[] = {
1804 /* Ignore ReadBuffer accesses */
1805 { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
1806 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
1807 .access = PL1_RW, .resetvalue = 0,
1808 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_MIGRATE },
1809 REGINFO_SENTINEL
1810 };
1811
1812 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1813 {
1814 CPUState *cs = CPU(arm_env_get_cpu(env));
1815 uint32_t mpidr = cs->cpu_index;
1816 /* We don't support setting cluster ID ([8..11]) (known as Aff1
1817 * in later ARM ARM versions), or any of the higher affinity level fields,
1818 * so these bits always RAZ.
1819 */
1820 if (arm_feature(env, ARM_FEATURE_V7MP)) {
1821 mpidr |= (1U << 31);
1822 /* Cores which are uniprocessor (non-coherent)
1823 * but still implement the MP extensions set
1824 * bit 30. (For instance, A9UP.) However we do
1825 * not currently model any of those cores.
1826 */
1827 }
1828 return mpidr;
1829 }
1830
1831 static const ARMCPRegInfo mpidr_cp_reginfo[] = {
1832 { .name = "MPIDR", .state = ARM_CP_STATE_BOTH,
1833 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
1834 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_MIGRATE },
1835 REGINFO_SENTINEL
1836 };
1837
1838 static const ARMCPRegInfo lpae_cp_reginfo[] = {
1839 /* NOP AMAIR0/1: the override is because these clash with the rather
1840 * broadly specified TLB_LOCKDOWN entry in the generic cp_reginfo.
1841 */
1842 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
1843 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
1844 .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_OVERRIDE,
1845 .resetvalue = 0 },
1846 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
1847 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
1848 .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_OVERRIDE,
1849 .resetvalue = 0 },
1850 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
1851 .access = PL1_RW, .type = ARM_CP_64BIT,
1852 .fieldoffset = offsetof(CPUARMState, cp15.par_el1), .resetvalue = 0 },
1853 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
1854 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE,
1855 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el1),
1856 .writefn = vmsa_ttbr_write, .resetfn = arm_cp_reset_ignore },
1857 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
1858 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE,
1859 .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el1),
1860 .writefn = vmsa_ttbr_write, .resetfn = arm_cp_reset_ignore },
1861 REGINFO_SENTINEL
1862 };
1863
1864 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1865 {
1866 return vfp_get_fpcr(env);
1867 }
1868
1869 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1870 uint64_t value)
1871 {
1872 vfp_set_fpcr(env, value);
1873 }
1874
1875 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1876 {
1877 return vfp_get_fpsr(env);
1878 }
1879
1880 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1881 uint64_t value)
1882 {
1883 vfp_set_fpsr(env, value);
1884 }
1885
1886 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri)
1887 {
1888 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UMA)) {
1889 return CP_ACCESS_TRAP;
1890 }
1891 return CP_ACCESS_OK;
1892 }
1893
1894 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri,
1895 uint64_t value)
1896 {
1897 env->daif = value & PSTATE_DAIF;
1898 }
1899
1900 static CPAccessResult aa64_cacheop_access(CPUARMState *env,
1901 const ARMCPRegInfo *ri)
1902 {
1903 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
1904 * SCTLR_EL1.UCI is set.
1905 */
1906 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UCI)) {
1907 return CP_ACCESS_TRAP;
1908 }
1909 return CP_ACCESS_OK;
1910 }
1911
1912 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions
1913 * Page D4-1736 (DDI0487A.b)
1914 */
1915
1916 static void tlbi_aa64_va_write(CPUARMState *env, const ARMCPRegInfo *ri,
1917 uint64_t value)
1918 {
1919 /* Invalidate by VA (AArch64 version) */
1920 ARMCPU *cpu = arm_env_get_cpu(env);
1921 uint64_t pageaddr = sextract64(value << 12, 0, 56);
1922
1923 tlb_flush_page(CPU(cpu), pageaddr);
1924 }
1925
1926 static void tlbi_aa64_vaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
1927 uint64_t value)
1928 {
1929 /* Invalidate by VA, all ASIDs (AArch64 version) */
1930 ARMCPU *cpu = arm_env_get_cpu(env);
1931 uint64_t pageaddr = sextract64(value << 12, 0, 56);
1932
1933 tlb_flush_page(CPU(cpu), pageaddr);
1934 }
1935
1936 static void tlbi_aa64_asid_write(CPUARMState *env, const ARMCPRegInfo *ri,
1937 uint64_t value)
1938 {
1939 /* Invalidate by ASID (AArch64 version) */
1940 ARMCPU *cpu = arm_env_get_cpu(env);
1941 int asid = extract64(value, 48, 16);
1942 tlb_flush(CPU(cpu), asid == 0);
1943 }
1944
1945 static void tlbi_aa64_va_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
1946 uint64_t value)
1947 {
1948 CPUState *other_cs;
1949 uint64_t pageaddr = sextract64(value << 12, 0, 56);
1950
1951 CPU_FOREACH(other_cs) {
1952 tlb_flush_page(other_cs, pageaddr);
1953 }
1954 }
1955
1956 static void tlbi_aa64_vaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
1957 uint64_t value)
1958 {
1959 CPUState *other_cs;
1960 uint64_t pageaddr = sextract64(value << 12, 0, 56);
1961
1962 CPU_FOREACH(other_cs) {
1963 tlb_flush_page(other_cs, pageaddr);
1964 }
1965 }
1966
1967 static void tlbi_aa64_asid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
1968 uint64_t value)
1969 {
1970 CPUState *other_cs;
1971 int asid = extract64(value, 48, 16);
1972
1973 CPU_FOREACH(other_cs) {
1974 tlb_flush(other_cs, asid == 0);
1975 }
1976 }
1977
1978 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri)
1979 {
1980 /* We don't implement EL2, so the only control on DC ZVA is the
1981 * bit in the SCTLR which can prohibit access for EL0.
1982 */
1983 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_DZE)) {
1984 return CP_ACCESS_TRAP;
1985 }
1986 return CP_ACCESS_OK;
1987 }
1988
1989 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri)
1990 {
1991 ARMCPU *cpu = arm_env_get_cpu(env);
1992 int dzp_bit = 1 << 4;
1993
1994 /* DZP indicates whether DC ZVA access is allowed */
1995 if (aa64_zva_access(env, NULL) != CP_ACCESS_OK) {
1996 dzp_bit = 0;
1997 }
1998 return cpu->dcz_blocksize | dzp_bit;
1999 }
2000
2001 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
2002 {
2003 if (!(env->pstate & PSTATE_SP)) {
2004 /* Access to SP_EL0 is undefined if it's being used as
2005 * the stack pointer.
2006 */
2007 return CP_ACCESS_TRAP_UNCATEGORIZED;
2008 }
2009 return CP_ACCESS_OK;
2010 }
2011
2012 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri)
2013 {
2014 return env->pstate & PSTATE_SP;
2015 }
2016
2017 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
2018 {
2019 update_spsel(env, val);
2020 }
2021
2022 static const ARMCPRegInfo v8_cp_reginfo[] = {
2023 /* Minimal set of EL0-visible registers. This will need to be expanded
2024 * significantly for system emulation of AArch64 CPUs.
2025 */
2026 { .name = "NZCV", .state = ARM_CP_STATE_AA64,
2027 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
2028 .access = PL0_RW, .type = ARM_CP_NZCV },
2029 { .name = "DAIF", .state = ARM_CP_STATE_AA64,
2030 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
2031 .type = ARM_CP_NO_MIGRATE,
2032 .access = PL0_RW, .accessfn = aa64_daif_access,
2033 .fieldoffset = offsetof(CPUARMState, daif),
2034 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
2035 { .name = "FPCR", .state = ARM_CP_STATE_AA64,
2036 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
2037 .access = PL0_RW, .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
2038 { .name = "FPSR", .state = ARM_CP_STATE_AA64,
2039 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
2040 .access = PL0_RW, .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
2041 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
2042 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
2043 .access = PL0_R, .type = ARM_CP_NO_MIGRATE,
2044 .readfn = aa64_dczid_read },
2045 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
2046 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
2047 .access = PL0_W, .type = ARM_CP_DC_ZVA,
2048 #ifndef CONFIG_USER_ONLY
2049 /* Avoid overhead of an access check that always passes in user-mode */
2050 .accessfn = aa64_zva_access,
2051 #endif
2052 },
2053 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
2054 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
2055 .access = PL1_R, .type = ARM_CP_CURRENTEL },
2056 /* Cache ops: all NOPs since we don't emulate caches */
2057 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
2058 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
2059 .access = PL1_W, .type = ARM_CP_NOP },
2060 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
2061 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
2062 .access = PL1_W, .type = ARM_CP_NOP },
2063 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
2064 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
2065 .access = PL0_W, .type = ARM_CP_NOP,
2066 .accessfn = aa64_cacheop_access },
2067 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
2068 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
2069 .access = PL1_W, .type = ARM_CP_NOP },
2070 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
2071 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
2072 .access = PL1_W, .type = ARM_CP_NOP },
2073 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
2074 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
2075 .access = PL0_W, .type = ARM_CP_NOP,
2076 .accessfn = aa64_cacheop_access },
2077 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
2078 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
2079 .access = PL1_W, .type = ARM_CP_NOP },
2080 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
2081 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
2082 .access = PL0_W, .type = ARM_CP_NOP,
2083 .accessfn = aa64_cacheop_access },
2084 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
2085 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
2086 .access = PL0_W, .type = ARM_CP_NOP,
2087 .accessfn = aa64_cacheop_access },
2088 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
2089 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
2090 .access = PL1_W, .type = ARM_CP_NOP },
2091 /* TLBI operations */
2092 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
2093 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
2094 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2095 .writefn = tlbiall_is_write },
2096 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
2097 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
2098 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2099 .writefn = tlbi_aa64_va_is_write },
2100 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
2101 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
2102 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2103 .writefn = tlbi_aa64_asid_is_write },
2104 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
2105 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
2106 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2107 .writefn = tlbi_aa64_vaa_is_write },
2108 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
2109 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
2110 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2111 .writefn = tlbi_aa64_va_is_write },
2112 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
2113 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
2114 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2115 .writefn = tlbi_aa64_vaa_is_write },
2116 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
2117 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
2118 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2119 .writefn = tlbiall_write },
2120 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
2121 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
2122 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2123 .writefn = tlbi_aa64_va_write },
2124 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
2125 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
2126 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2127 .writefn = tlbi_aa64_asid_write },
2128 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
2129 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
2130 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2131 .writefn = tlbi_aa64_vaa_write },
2132 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
2133 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
2134 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2135 .writefn = tlbi_aa64_va_write },
2136 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
2137 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
2138 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2139 .writefn = tlbi_aa64_vaa_write },
2140 #ifndef CONFIG_USER_ONLY
2141 /* 64 bit address translation operations */
2142 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
2143 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
2144 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
2145 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
2146 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
2147 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
2148 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
2149 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
2150 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
2151 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
2152 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
2153 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
2154 #endif
2155 /* TLB invalidate last level of translation table walk */
2156 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
2157 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_is_write },
2158 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
2159 .type = ARM_CP_NO_MIGRATE, .access = PL1_W,
2160 .writefn = tlbimvaa_is_write },
2161 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
2162 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
2163 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
2164 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimvaa_write },
2165 /* 32 bit cache operations */
2166 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
2167 .type = ARM_CP_NOP, .access = PL1_W },
2168 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
2169 .type = ARM_CP_NOP, .access = PL1_W },
2170 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
2171 .type = ARM_CP_NOP, .access = PL1_W },
2172 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
2173 .type = ARM_CP_NOP, .access = PL1_W },
2174 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
2175 .type = ARM_CP_NOP, .access = PL1_W },
2176 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
2177 .type = ARM_CP_NOP, .access = PL1_W },
2178 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
2179 .type = ARM_CP_NOP, .access = PL1_W },
2180 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
2181 .type = ARM_CP_NOP, .access = PL1_W },
2182 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
2183 .type = ARM_CP_NOP, .access = PL1_W },
2184 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
2185 .type = ARM_CP_NOP, .access = PL1_W },
2186 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
2187 .type = ARM_CP_NOP, .access = PL1_W },
2188 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
2189 .type = ARM_CP_NOP, .access = PL1_W },
2190 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
2191 .type = ARM_CP_NOP, .access = PL1_W },
2192 /* MMU Domain access control / MPU write buffer control */
2193 { .name = "DACR", .cp = 15,
2194 .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
2195 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c3),
2196 .resetvalue = 0, .writefn = dacr_write, .raw_writefn = raw_write, },
2197 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
2198 .type = ARM_CP_NO_MIGRATE,
2199 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
2200 .access = PL1_RW,
2201 .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
2202 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
2203 .type = ARM_CP_NO_MIGRATE,
2204 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
2205 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[0]) },
2206 /* We rely on the access checks not allowing the guest to write to the
2207 * state field when SPSel indicates that it's being used as the stack
2208 * pointer.
2209 */
2210 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
2211 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
2212 .access = PL1_RW, .accessfn = sp_el0_access,
2213 .type = ARM_CP_NO_MIGRATE,
2214 .fieldoffset = offsetof(CPUARMState, sp_el[0]) },
2215 { .name = "SPSel", .state = ARM_CP_STATE_AA64,
2216 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
2217 .type = ARM_CP_NO_MIGRATE,
2218 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
2219 REGINFO_SENTINEL
2220 };
2221
2222 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */
2223 static const ARMCPRegInfo v8_el3_no_el2_cp_reginfo[] = {
2224 { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
2225 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
2226 .access = PL2_RW,
2227 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
2228 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
2229 .type = ARM_CP_NO_MIGRATE,
2230 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
2231 .access = PL2_RW,
2232 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
2233 REGINFO_SENTINEL
2234 };
2235
2236 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
2237 {
2238 ARMCPU *cpu = arm_env_get_cpu(env);
2239 uint64_t valid_mask = HCR_MASK;
2240
2241 if (arm_feature(env, ARM_FEATURE_EL3)) {
2242 valid_mask &= ~HCR_HCD;
2243 } else {
2244 valid_mask &= ~HCR_TSC;
2245 }
2246
2247 /* Clear RES0 bits. */
2248 value &= valid_mask;
2249
2250 /* These bits change the MMU setup:
2251 * HCR_VM enables stage 2 translation
2252 * HCR_PTW forbids certain page-table setups
2253 * HCR_DC Disables stage1 and enables stage2 translation
2254 */
2255 if ((raw_read(env, ri) ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) {
2256 tlb_flush(CPU(cpu), 1);
2257 }
2258 raw_write(env, ri, value);
2259 }
2260
2261 static const ARMCPRegInfo v8_el2_cp_reginfo[] = {
2262 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
2263 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
2264 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
2265 .writefn = hcr_write },
2266 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
2267 .type = ARM_CP_NO_MIGRATE,
2268 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
2269 .access = PL2_RW,
2270 .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
2271 { .name = "ESR_EL2", .state = ARM_CP_STATE_AA64,
2272 .type = ARM_CP_NO_MIGRATE,
2273 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
2274 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
2275 { .name = "FAR_EL2", .state = ARM_CP_STATE_AA64,
2276 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
2277 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
2278 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
2279 .type = ARM_CP_NO_MIGRATE,
2280 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
2281 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[6]) },
2282 { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
2283 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
2284 .access = PL2_RW, .writefn = vbar_write,
2285 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
2286 .resetvalue = 0 },
2287 REGINFO_SENTINEL
2288 };
2289
2290 static const ARMCPRegInfo v8_el3_cp_reginfo[] = {
2291 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
2292 .type = ARM_CP_NO_MIGRATE,
2293 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
2294 .access = PL3_RW,
2295 .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
2296 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
2297 .type = ARM_CP_NO_MIGRATE,
2298 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
2299 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) },
2300 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64,
2301 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0,
2302 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) },
2303 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
2304 .type = ARM_CP_NO_MIGRATE,
2305 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
2306 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[7]) },
2307 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
2308 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
2309 .access = PL3_RW, .writefn = vbar_write,
2310 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
2311 .resetvalue = 0 },
2312 REGINFO_SENTINEL
2313 };
2314
2315 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2316 uint64_t value)
2317 {
2318 ARMCPU *cpu = arm_env_get_cpu(env);
2319
2320 if (raw_read(env, ri) == value) {
2321 /* Skip the TLB flush if nothing actually changed; Linux likes
2322 * to do a lot of pointless SCTLR writes.
2323 */
2324 return;
2325 }
2326
2327 raw_write(env, ri, value);
2328 /* ??? Lots of these bits are not implemented. */
2329 /* This may enable/disable the MMU, so do a TLB flush. */
2330 tlb_flush(CPU(cpu), 1);
2331 }
2332
2333 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
2334 {
2335 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
2336 * but the AArch32 CTR has its own reginfo struct)
2337 */
2338 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UCT)) {
2339 return CP_ACCESS_TRAP;
2340 }
2341 return CP_ACCESS_OK;
2342 }
2343
2344 static const ARMCPRegInfo debug_cp_reginfo[] = {
2345 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
2346 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
2347 * unlike DBGDRAR it is never accessible from EL0.
2348 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
2349 * accessor.
2350 */
2351 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
2352 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2353 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
2354 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
2355 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2356 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
2357 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2358 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
2359 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
2360 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
2361 .access = PL1_RW,
2362 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
2363 .resetvalue = 0 },
2364 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1.
2365 * We don't implement the configurable EL0 access.
2366 */
2367 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH,
2368 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
2369 .type = ARM_CP_NO_MIGRATE,
2370 .access = PL1_R,
2371 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
2372 .resetfn = arm_cp_reset_ignore },
2373 /* We define a dummy WI OSLAR_EL1, because Linux writes to it. */
2374 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
2375 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
2376 .access = PL1_W, .type = ARM_CP_NOP },
2377 /* Dummy OSDLR_EL1: 32-bit Linux will read this */
2378 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
2379 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
2380 .access = PL1_RW, .type = ARM_CP_NOP },
2381 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
2382 * implement vector catch debug events yet.
2383 */
2384 { .name = "DBGVCR",
2385 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
2386 .access = PL1_RW, .type = ARM_CP_NOP },
2387 REGINFO_SENTINEL
2388 };
2389
2390 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
2391 /* 64 bit access versions of the (dummy) debug registers */
2392 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
2393 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
2394 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
2395 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
2396 REGINFO_SENTINEL
2397 };
2398
2399 void hw_watchpoint_update(ARMCPU *cpu, int n)
2400 {
2401 CPUARMState *env = &cpu->env;
2402 vaddr len = 0;
2403 vaddr wvr = env->cp15.dbgwvr[n];
2404 uint64_t wcr = env->cp15.dbgwcr[n];
2405 int mask;
2406 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
2407
2408 if (env->cpu_watchpoint[n]) {
2409 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
2410 env->cpu_watchpoint[n] = NULL;
2411 }
2412
2413 if (!extract64(wcr, 0, 1)) {
2414 /* E bit clear : watchpoint disabled */
2415 return;
2416 }
2417
2418 switch (extract64(wcr, 3, 2)) {
2419 case 0:
2420 /* LSC 00 is reserved and must behave as if the wp is disabled */
2421 return;
2422 case 1:
2423 flags |= BP_MEM_READ;
2424 break;
2425 case 2:
2426 flags |= BP_MEM_WRITE;
2427 break;
2428 case 3:
2429 flags |= BP_MEM_ACCESS;
2430 break;
2431 }
2432
2433 /* Attempts to use both MASK and BAS fields simultaneously are
2434 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
2435 * thus generating a watchpoint for every byte in the masked region.
2436 */
2437 mask = extract64(wcr, 24, 4);
2438 if (mask == 1 || mask == 2) {
2439 /* Reserved values of MASK; we must act as if the mask value was
2440 * some non-reserved value, or as if the watchpoint were disabled.
2441 * We choose the latter.
2442 */
2443 return;
2444 } else if (mask) {
2445 /* Watchpoint covers an aligned area up to 2GB in size */
2446 len = 1ULL << mask;
2447 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
2448 * whether the watchpoint fires when the unmasked bits match; we opt
2449 * to generate the exceptions.
2450 */
2451 wvr &= ~(len - 1);
2452 } else {
2453 /* Watchpoint covers bytes defined by the byte address select bits */
2454 int bas = extract64(wcr, 5, 8);
2455 int basstart;
2456
2457 if (bas == 0) {
2458 /* This must act as if the watchpoint is disabled */
2459 return;
2460 }
2461
2462 if (extract64(wvr, 2, 1)) {
2463 /* Deprecated case of an only 4-aligned address. BAS[7:4] are
2464 * ignored, and BAS[3:0] define which bytes to watch.
2465 */
2466 bas &= 0xf;
2467 }
2468 /* The BAS bits are supposed to be programmed to indicate a contiguous
2469 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
2470 * we fire for each byte in the word/doubleword addressed by the WVR.
2471 * We choose to ignore any non-zero bits after the first range of 1s.
2472 */
2473 basstart = ctz32(bas);
2474 len = cto32(bas >> basstart);
2475 wvr += basstart;
2476 }
2477
2478 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
2479 &env->cpu_watchpoint[n]);
2480 }
2481
2482 void hw_watchpoint_update_all(ARMCPU *cpu)
2483 {
2484 int i;
2485 CPUARMState *env = &cpu->env;
2486
2487 /* Completely clear out existing QEMU watchpoints and our array, to
2488 * avoid possible stale entries following migration load.
2489 */
2490 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
2491 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
2492
2493 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
2494 hw_watchpoint_update(cpu, i);
2495 }
2496 }
2497
2498 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2499 uint64_t value)
2500 {
2501 ARMCPU *cpu = arm_env_get_cpu(env);
2502 int i = ri->crm;
2503
2504 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
2505 * register reads and behaves as if values written are sign extended.
2506 * Bits [1:0] are RES0.
2507 */
2508 value = sextract64(value, 0, 49) & ~3ULL;
2509
2510 raw_write(env, ri, value);
2511 hw_watchpoint_update(cpu, i);
2512 }
2513
2514 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2515 uint64_t value)
2516 {
2517 ARMCPU *cpu = arm_env_get_cpu(env);
2518 int i = ri->crm;
2519
2520 raw_write(env, ri, value);
2521 hw_watchpoint_update(cpu, i);
2522 }
2523
2524 void hw_breakpoint_update(ARMCPU *cpu, int n)
2525 {
2526 CPUARMState *env = &cpu->env;
2527 uint64_t bvr = env->cp15.dbgbvr[n];
2528 uint64_t bcr = env->cp15.dbgbcr[n];
2529 vaddr addr;
2530 int bt;
2531 int flags = BP_CPU;
2532
2533 if (env->cpu_breakpoint[n]) {
2534 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
2535 env->cpu_breakpoint[n] = NULL;
2536 }
2537
2538 if (!extract64(bcr, 0, 1)) {
2539 /* E bit clear : watchpoint disabled */
2540 return;
2541 }
2542
2543 bt = extract64(bcr, 20, 4);
2544
2545 switch (bt) {
2546 case 4: /* unlinked address mismatch (reserved if AArch64) */
2547 case 5: /* linked address mismatch (reserved if AArch64) */
2548 qemu_log_mask(LOG_UNIMP,
2549 "arm: address mismatch breakpoint types not implemented");
2550 return;
2551 case 0: /* unlinked address match */
2552 case 1: /* linked address match */
2553 {
2554 /* Bits [63:49] are hardwired to the value of bit [48]; that is,
2555 * we behave as if the register was sign extended. Bits [1:0] are
2556 * RES0. The BAS field is used to allow setting breakpoints on 16
2557 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether
2558 * a bp will fire if the addresses covered by the bp and the addresses
2559 * covered by the insn overlap but the insn doesn't start at the
2560 * start of the bp address range. We choose to require the insn and
2561 * the bp to have the same address. The constraints on writing to
2562 * BAS enforced in dbgbcr_write mean we have only four cases:
2563 * 0b0000 => no breakpoint
2564 * 0b0011 => breakpoint on addr
2565 * 0b1100 => breakpoint on addr + 2
2566 * 0b1111 => breakpoint on addr
2567 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
2568 */
2569 int bas = extract64(bcr, 5, 4);
2570 addr = sextract64(bvr, 0, 49) & ~3ULL;
2571 if (bas == 0) {
2572 return;
2573 }
2574 if (bas == 0xc) {
2575 addr += 2;
2576 }
2577 break;
2578 }
2579 case 2: /* unlinked context ID match */
2580 case 8: /* unlinked VMID match (reserved if no EL2) */
2581 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
2582 qemu_log_mask(LOG_UNIMP,
2583 "arm: unlinked context breakpoint types not implemented");
2584 return;
2585 case 9: /* linked VMID match (reserved if no EL2) */
2586 case 11: /* linked context ID and VMID match (reserved if no EL2) */
2587 case 3: /* linked context ID match */
2588 default:
2589 /* We must generate no events for Linked context matches (unless
2590 * they are linked to by some other bp/wp, which is handled in
2591 * updates for the linking bp/wp). We choose to also generate no events
2592 * for reserved values.
2593 */
2594 return;
2595 }
2596
2597 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
2598 }
2599
2600 void hw_breakpoint_update_all(ARMCPU *cpu)
2601 {
2602 int i;
2603 CPUARMState *env = &cpu->env;
2604
2605 /* Completely clear out existing QEMU breakpoints and our array, to
2606 * avoid possible stale entries following migration load.
2607 */
2608 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
2609 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
2610
2611 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
2612 hw_breakpoint_update(cpu, i);
2613 }
2614 }
2615
2616 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2617 uint64_t value)
2618 {
2619 ARMCPU *cpu = arm_env_get_cpu(env);
2620 int i = ri->crm;
2621
2622 raw_write(env, ri, value);
2623 hw_breakpoint_update(cpu, i);
2624 }
2625
2626 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2627 uint64_t value)
2628 {
2629 ARMCPU *cpu = arm_env_get_cpu(env);
2630 int i = ri->crm;
2631
2632 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
2633 * copy of BAS[0].
2634 */
2635 value = deposit64(value, 6, 1, extract64(value, 5, 1));
2636 value = deposit64(value, 8, 1, extract64(value, 7, 1));
2637
2638 raw_write(env, ri, value);
2639 hw_breakpoint_update(cpu, i);
2640 }
2641
2642 static void define_debug_regs(ARMCPU *cpu)
2643 {
2644 /* Define v7 and v8 architectural debug registers.
2645 * These are just dummy implementations for now.
2646 */
2647 int i;
2648 int wrps, brps, ctx_cmps;
2649 ARMCPRegInfo dbgdidr = {
2650 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
2651 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr,
2652 };
2653
2654 /* Note that all these register fields hold "number of Xs minus 1". */
2655 brps = extract32(cpu->dbgdidr, 24, 4);
2656 wrps = extract32(cpu->dbgdidr, 28, 4);
2657 ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
2658
2659 assert(ctx_cmps <= brps);
2660
2661 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties
2662 * of the debug registers such as number of breakpoints;
2663 * check that if they both exist then they agree.
2664 */
2665 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
2666 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps);
2667 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps);
2668 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps);
2669 }
2670
2671 define_one_arm_cp_reg(cpu, &dbgdidr);
2672 define_arm_cp_regs(cpu, debug_cp_reginfo);
2673
2674 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
2675 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
2676 }
2677
2678 for (i = 0; i < brps + 1; i++) {
2679 ARMCPRegInfo dbgregs[] = {
2680 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH,
2681 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
2682 .access = PL1_RW,
2683 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
2684 .writefn = dbgbvr_write, .raw_writefn = raw_write
2685 },
2686 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH,
2687 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
2688 .access = PL1_RW,
2689 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
2690 .writefn = dbgbcr_write, .raw_writefn = raw_write
2691 },
2692 REGINFO_SENTINEL
2693 };
2694 define_arm_cp_regs(cpu, dbgregs);
2695 }
2696
2697 for (i = 0; i < wrps + 1; i++) {
2698 ARMCPRegInfo dbgregs[] = {
2699 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH,
2700 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
2701 .access = PL1_RW,
2702 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
2703 .writefn = dbgwvr_write, .raw_writefn = raw_write
2704 },
2705 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH,
2706 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
2707 .access = PL1_RW,
2708 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
2709 .writefn = dbgwcr_write, .raw_writefn = raw_write
2710 },
2711 REGINFO_SENTINEL
2712 };
2713 define_arm_cp_regs(cpu, dbgregs);
2714 }
2715 }
2716
2717 void register_cp_regs_for_features(ARMCPU *cpu)
2718 {
2719 /* Register all the coprocessor registers based on feature bits */
2720 CPUARMState *env = &cpu->env;
2721 if (arm_feature(env, ARM_FEATURE_M)) {
2722 /* M profile has no coprocessor registers */
2723 return;
2724 }
2725
2726 define_arm_cp_regs(cpu, cp_reginfo);
2727 if (!arm_feature(env, ARM_FEATURE_V8)) {
2728 /* Must go early as it is full of wildcards that may be
2729 * overridden by later definitions.
2730 */
2731 define_arm_cp_regs(cpu, not_v8_cp_reginfo);
2732 }
2733
2734 if (arm_feature(env, ARM_FEATURE_V6)) {
2735 /* The ID registers all have impdef reset values */
2736 ARMCPRegInfo v6_idregs[] = {
2737 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
2738 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
2739 .access = PL1_R, .type = ARM_CP_CONST,
2740 .resetvalue = cpu->id_pfr0 },
2741 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
2742 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
2743 .access = PL1_R, .type = ARM_CP_CONST,
2744 .resetvalue = cpu->id_pfr1 },
2745 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
2746 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
2747 .access = PL1_R, .type = ARM_CP_CONST,
2748 .resetvalue = cpu->id_dfr0 },
2749 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
2750 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
2751 .access = PL1_R, .type = ARM_CP_CONST,
2752 .resetvalue = cpu->id_afr0 },
2753 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
2754 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
2755 .access = PL1_R, .type = ARM_CP_CONST,
2756 .resetvalue = cpu->id_mmfr0 },
2757 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
2758 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
2759 .access = PL1_R, .type = ARM_CP_CONST,
2760 .resetvalue = cpu->id_mmfr1 },
2761 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
2762 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
2763 .access = PL1_R, .type = ARM_CP_CONST,
2764 .resetvalue = cpu->id_mmfr2 },
2765 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
2766 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
2767 .access = PL1_R, .type = ARM_CP_CONST,
2768 .resetvalue = cpu->id_mmfr3 },
2769 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
2770 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
2771 .access = PL1_R, .type = ARM_CP_CONST,
2772 .resetvalue = cpu->id_isar0 },
2773 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
2774 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
2775 .access = PL1_R, .type = ARM_CP_CONST,
2776 .resetvalue = cpu->id_isar1 },
2777 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
2778 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
2779 .access = PL1_R, .type = ARM_CP_CONST,
2780 .resetvalue = cpu->id_isar2 },
2781 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
2782 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
2783 .access = PL1_R, .type = ARM_CP_CONST,
2784 .resetvalue = cpu->id_isar3 },
2785 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
2786 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
2787 .access = PL1_R, .type = ARM_CP_CONST,
2788 .resetvalue = cpu->id_isar4 },
2789 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
2790 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
2791 .access = PL1_R, .type = ARM_CP_CONST,
2792 .resetvalue = cpu->id_isar5 },
2793 /* 6..7 are as yet unallocated and must RAZ */
2794 { .name = "ID_ISAR6", .cp = 15, .crn = 0, .crm = 2,
2795 .opc1 = 0, .opc2 = 6, .access = PL1_R, .type = ARM_CP_CONST,
2796 .resetvalue = 0 },
2797 { .name = "ID_ISAR7", .cp = 15, .crn = 0, .crm = 2,
2798 .opc1 = 0, .opc2 = 7, .access = PL1_R, .type = ARM_CP_CONST,
2799 .resetvalue = 0 },
2800 REGINFO_SENTINEL
2801 };
2802 define_arm_cp_regs(cpu, v6_idregs);
2803 define_arm_cp_regs(cpu, v6_cp_reginfo);
2804 } else {
2805 define_arm_cp_regs(cpu, not_v6_cp_reginfo);
2806 }
2807 if (arm_feature(env, ARM_FEATURE_V6K)) {
2808 define_arm_cp_regs(cpu, v6k_cp_reginfo);
2809 }
2810 if (arm_feature(env, ARM_FEATURE_V7MP)) {
2811 define_arm_cp_regs(cpu, v7mp_cp_reginfo);
2812 }
2813 if (arm_feature(env, ARM_FEATURE_V7)) {
2814 /* v7 performance monitor control register: same implementor
2815 * field as main ID register, and we implement only the cycle
2816 * count register.
2817 */
2818 #ifndef CONFIG_USER_ONLY
2819 ARMCPRegInfo pmcr = {
2820 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
2821 .access = PL0_RW,
2822 .type = ARM_CP_IO | ARM_CP_NO_MIGRATE,
2823 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
2824 .accessfn = pmreg_access, .writefn = pmcr_write,
2825 .raw_writefn = raw_write,
2826 };
2827 ARMCPRegInfo pmcr64 = {
2828 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
2829 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
2830 .access = PL0_RW, .accessfn = pmreg_access,
2831 .type = ARM_CP_IO,
2832 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
2833 .resetvalue = cpu->midr & 0xff000000,
2834 .writefn = pmcr_write, .raw_writefn = raw_write,
2835 };
2836 define_one_arm_cp_reg(cpu, &pmcr);
2837 define_one_arm_cp_reg(cpu, &pmcr64);
2838 #endif
2839 ARMCPRegInfo clidr = {
2840 .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
2841 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
2842 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr
2843 };
2844 define_one_arm_cp_reg(cpu, &clidr);
2845 define_arm_cp_regs(cpu, v7_cp_reginfo);
2846 define_debug_regs(cpu);
2847 } else {
2848 define_arm_cp_regs(cpu, not_v7_cp_reginfo);
2849 }
2850 if (arm_feature(env, ARM_FEATURE_V8)) {
2851 /* AArch64 ID registers, which all have impdef reset values */
2852 ARMCPRegInfo v8_idregs[] = {
2853 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
2854 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
2855 .access = PL1_R, .type = ARM_CP_CONST,
2856 .resetvalue = cpu->id_aa64pfr0 },
2857 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
2858 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
2859 .access = PL1_R, .type = ARM_CP_CONST,
2860 .resetvalue = cpu->id_aa64pfr1},
2861 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
2862 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
2863 .access = PL1_R, .type = ARM_CP_CONST,
2864 /* We mask out the PMUVer field, because we don't currently
2865 * implement the PMU. Not advertising it prevents the guest
2866 * from trying to use it and getting UNDEFs on registers we
2867 * don't implement.
2868 */
2869 .resetvalue = cpu->id_aa64dfr0 & ~0xf00 },
2870 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
2871 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
2872 .access = PL1_R, .type = ARM_CP_CONST,
2873 .resetvalue = cpu->id_aa64dfr1 },
2874 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
2875 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
2876 .access = PL1_R, .type = ARM_CP_CONST,
2877 .resetvalue = cpu->id_aa64afr0 },
2878 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
2879 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
2880 .access = PL1_R, .type = ARM_CP_CONST,
2881 .resetvalue = cpu->id_aa64afr1 },
2882 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
2883 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
2884 .access = PL1_R, .type = ARM_CP_CONST,
2885 .resetvalue = cpu->id_aa64isar0 },
2886 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
2887 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
2888 .access = PL1_R, .type = ARM_CP_CONST,
2889 .resetvalue = cpu->id_aa64isar1 },
2890 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
2891 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
2892 .access = PL1_R, .type = ARM_CP_CONST,
2893 .resetvalue = cpu->id_aa64mmfr0 },
2894 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
2895 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
2896 .access = PL1_R, .type = ARM_CP_CONST,
2897 .resetvalue = cpu->id_aa64mmfr1 },
2898 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
2899 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
2900 .access = PL1_R, .type = ARM_CP_CONST,
2901 .resetvalue = cpu->mvfr0 },
2902 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
2903 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
2904 .access = PL1_R, .type = ARM_CP_CONST,
2905 .resetvalue = cpu->mvfr1 },
2906 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
2907 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
2908 .access = PL1_R, .type = ARM_CP_CONST,
2909 .resetvalue = cpu->mvfr2 },
2910 REGINFO_SENTINEL
2911 };
2912 ARMCPRegInfo rvbar = {
2913 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
2914 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 2,
2915 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
2916 };
2917 define_one_arm_cp_reg(cpu, &rvbar);
2918 define_arm_cp_regs(cpu, v8_idregs);
2919 define_arm_cp_regs(cpu, v8_cp_reginfo);
2920 }
2921 if (arm_feature(env, ARM_FEATURE_EL2)) {
2922 define_arm_cp_regs(cpu, v8_el2_cp_reginfo);
2923 } else {
2924 /* If EL2 is missing but higher ELs are enabled, we need to
2925 * register the no_el2 reginfos.
2926 */
2927 if (arm_feature(env, ARM_FEATURE_EL3)) {
2928 define_arm_cp_regs(cpu, v8_el3_no_el2_cp_reginfo);
2929 }
2930 }
2931 if (arm_feature(env, ARM_FEATURE_EL3)) {
2932 define_arm_cp_regs(cpu, v8_el3_cp_reginfo);
2933 }
2934 if (arm_feature(env, ARM_FEATURE_MPU)) {
2935 /* These are the MPU registers prior to PMSAv6. Any new
2936 * PMSA core later than the ARM946 will require that we
2937 * implement the PMSAv6 or PMSAv7 registers, which are
2938 * completely different.
2939 */
2940 assert(!arm_feature(env, ARM_FEATURE_V6));
2941 define_arm_cp_regs(cpu, pmsav5_cp_reginfo);
2942 } else {
2943 define_arm_cp_regs(cpu, vmsa_cp_reginfo);
2944 }
2945 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
2946 define_arm_cp_regs(cpu, t2ee_cp_reginfo);
2947 }
2948 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
2949 define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
2950 }
2951 if (arm_feature(env, ARM_FEATURE_VAPA)) {
2952 define_arm_cp_regs(cpu, vapa_cp_reginfo);
2953 }
2954 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) {
2955 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo);
2956 }
2957 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) {
2958 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo);
2959 }
2960 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) {
2961 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo);
2962 }
2963 if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
2964 define_arm_cp_regs(cpu, omap_cp_reginfo);
2965 }
2966 if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
2967 define_arm_cp_regs(cpu, strongarm_cp_reginfo);
2968 }
2969 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
2970 define_arm_cp_regs(cpu, xscale_cp_reginfo);
2971 }
2972 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
2973 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
2974 }
2975 if (arm_feature(env, ARM_FEATURE_LPAE)) {
2976 define_arm_cp_regs(cpu, lpae_cp_reginfo);
2977 }
2978 /* Slightly awkwardly, the OMAP and StrongARM cores need all of
2979 * cp15 crn=0 to be writes-ignored, whereas for other cores they should
2980 * be read-only (ie write causes UNDEF exception).
2981 */
2982 {
2983 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = {
2984 /* Pre-v8 MIDR space.
2985 * Note that the MIDR isn't a simple constant register because
2986 * of the TI925 behaviour where writes to another register can
2987 * cause the MIDR value to change.
2988 *
2989 * Unimplemented registers in the c15 0 0 0 space default to
2990 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
2991 * and friends override accordingly.
2992 */
2993 { .name = "MIDR",
2994 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
2995 .access = PL1_R, .resetvalue = cpu->midr,
2996 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
2997 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
2998 .type = ARM_CP_OVERRIDE },
2999 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
3000 { .name = "DUMMY",
3001 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY,
3002 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3003 { .name = "DUMMY",
3004 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY,
3005 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3006 { .name = "DUMMY",
3007 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY,
3008 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3009 { .name = "DUMMY",
3010 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY,
3011 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3012 { .name = "DUMMY",
3013 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
3014 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3015 REGINFO_SENTINEL
3016 };
3017 ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
3018 /* v8 MIDR -- the wildcard isn't necessary, and nor is the
3019 * variable-MIDR TI925 behaviour. Instead we have a single
3020 * (strictly speaking IMPDEF) alias of the MIDR, REVIDR.
3021 */
3022 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
3023 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0,
3024 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->midr },
3025 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
3026 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
3027 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->midr },
3028 REGINFO_SENTINEL
3029 };
3030 ARMCPRegInfo id_cp_reginfo[] = {
3031 /* These are common to v8 and pre-v8 */
3032 { .name = "CTR",
3033 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
3034 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
3035 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64,
3036 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0,
3037 .access = PL0_R, .accessfn = ctr_el0_access,
3038 .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
3039 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
3040 { .name = "TCMTR",
3041 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
3042 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3043 { .name = "TLBTR",
3044 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
3045 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3046 REGINFO_SENTINEL
3047 };
3048 ARMCPRegInfo crn0_wi_reginfo = {
3049 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
3050 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
3051 .type = ARM_CP_NOP | ARM_CP_OVERRIDE
3052 };
3053 if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
3054 arm_feature(env, ARM_FEATURE_STRONGARM)) {
3055 ARMCPRegInfo *r;
3056 /* Register the blanket "writes ignored" value first to cover the
3057 * whole space. Then update the specific ID registers to allow write
3058 * access, so that they ignore writes rather than causing them to
3059 * UNDEF.
3060 */
3061 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
3062 for (r = id_pre_v8_midr_cp_reginfo;
3063 r->type != ARM_CP_SENTINEL; r++) {
3064 r->access = PL1_RW;
3065 }
3066 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
3067 r->access = PL1_RW;
3068 }
3069 }
3070 if (arm_feature(env, ARM_FEATURE_V8)) {
3071 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
3072 } else {
3073 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
3074 }
3075 define_arm_cp_regs(cpu, id_cp_reginfo);
3076 }
3077
3078 if (arm_feature(env, ARM_FEATURE_MPIDR)) {
3079 define_arm_cp_regs(cpu, mpidr_cp_reginfo);
3080 }
3081
3082 if (arm_feature(env, ARM_FEATURE_AUXCR)) {
3083 ARMCPRegInfo auxcr = {
3084 .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH,
3085 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1,
3086 .access = PL1_RW, .type = ARM_CP_CONST,
3087 .resetvalue = cpu->reset_auxcr
3088 };
3089 define_one_arm_cp_reg(cpu, &auxcr);
3090 }
3091
3092 if (arm_feature(env, ARM_FEATURE_CBAR)) {
3093 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
3094 /* 32 bit view is [31:18] 0...0 [43:32]. */
3095 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
3096 | extract64(cpu->reset_cbar, 32, 12);
3097 ARMCPRegInfo cbar_reginfo[] = {
3098 { .name = "CBAR",
3099 .type = ARM_CP_CONST,
3100 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
3101 .access = PL1_R, .resetvalue = cpu->reset_cbar },
3102 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
3103 .type = ARM_CP_CONST,
3104 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
3105 .access = PL1_R, .resetvalue = cbar32 },
3106 REGINFO_SENTINEL
3107 };
3108 /* We don't implement a r/w 64 bit CBAR currently */
3109 assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
3110 define_arm_cp_regs(cpu, cbar_reginfo);
3111 } else {
3112 ARMCPRegInfo cbar = {
3113 .name = "CBAR",
3114 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
3115 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar,
3116 .fieldoffset = offsetof(CPUARMState,
3117 cp15.c15_config_base_address)
3118 };
3119 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
3120 cbar.access = PL1_R;
3121 cbar.fieldoffset = 0;
3122 cbar.type = ARM_CP_CONST;
3123 }
3124 define_one_arm_cp_reg(cpu, &cbar);
3125 }
3126 }
3127
3128 /* Generic registers whose values depend on the implementation */
3129 {
3130 ARMCPRegInfo sctlr = {
3131 .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
3132 .opc0 = 3, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
3133 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_sys),
3134 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
3135 .raw_writefn = raw_write,
3136 };
3137 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
3138 /* Normally we would always end the TB on an SCTLR write, but Linux
3139 * arch/arm/mach-pxa/sleep.S expects two instructions following
3140 * an MMU enable to execute from cache. Imitate this behaviour.
3141 */
3142 sctlr.type |= ARM_CP_SUPPRESS_TB_END;
3143 }
3144 define_one_arm_cp_reg(cpu, &sctlr);
3145 }
3146 }
3147
3148 ARMCPU *cpu_arm_init(const char *cpu_model)
3149 {
3150 return ARM_CPU(cpu_generic_init(TYPE_ARM_CPU, cpu_model));
3151 }
3152
3153 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
3154 {
3155 CPUState *cs = CPU(cpu);
3156 CPUARMState *env = &cpu->env;
3157
3158 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
3159 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
3160 aarch64_fpu_gdb_set_reg,
3161 34, "aarch64-fpu.xml", 0);
3162 } else if (arm_feature(env, ARM_FEATURE_NEON)) {
3163 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
3164 51, "arm-neon.xml", 0);
3165 } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
3166 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
3167 35, "arm-vfp3.xml", 0);
3168 } else if (arm_feature(env, ARM_FEATURE_VFP)) {
3169 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
3170 19, "arm-vfp.xml", 0);
3171 }
3172 }
3173
3174 /* Sort alphabetically by type name, except for "any". */
3175 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b)
3176 {
3177 ObjectClass *class_a = (ObjectClass *)a;
3178 ObjectClass *class_b = (ObjectClass *)b;
3179 const char *name_a, *name_b;
3180
3181 name_a = object_class_get_name(class_a);
3182 name_b = object_class_get_name(class_b);
3183 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) {
3184 return 1;
3185 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) {
3186 return -1;
3187 } else {
3188 return strcmp(name_a, name_b);
3189 }
3190 }
3191
3192 static void arm_cpu_list_entry(gpointer data, gpointer user_data)
3193 {
3194 ObjectClass *oc = data;
3195 CPUListState *s = user_data;
3196 const char *typename;
3197 char *name;
3198
3199 typename = object_class_get_name(oc);
3200 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU));
3201 (*s->cpu_fprintf)(s->file, " %s\n",
3202 name);
3203 g_free(name);
3204 }
3205
3206 void arm_cpu_list(FILE *f, fprintf_function cpu_fprintf)
3207 {
3208 CPUListState s = {
3209 .file = f,
3210 .cpu_fprintf = cpu_fprintf,
3211 };
3212 GSList *list;
3213
3214 list = object_class_get_list(TYPE_ARM_CPU, false);
3215 list = g_slist_sort(list, arm_cpu_list_compare);
3216 (*cpu_fprintf)(f, "Available CPUs:\n");
3217 g_slist_foreach(list, arm_cpu_list_entry, &s);
3218 g_slist_free(list);
3219 #ifdef CONFIG_KVM
3220 /* The 'host' CPU type is dynamically registered only if KVM is
3221 * enabled, so we have to special-case it here:
3222 */
3223 (*cpu_fprintf)(f, " host (only available in KVM mode)\n");
3224 #endif
3225 }
3226
3227 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
3228 {
3229 ObjectClass *oc = data;
3230 CpuDefinitionInfoList **cpu_list = user_data;
3231 CpuDefinitionInfoList *entry;
3232 CpuDefinitionInfo *info;
3233 const char *typename;
3234
3235 typename = object_class_get_name(oc);
3236 info = g_malloc0(sizeof(*info));
3237 info->name = g_strndup(typename,
3238 strlen(typename) - strlen("-" TYPE_ARM_CPU));
3239
3240 entry = g_malloc0(sizeof(*entry));
3241 entry->value = info;
3242 entry->next = *cpu_list;
3243 *cpu_list = entry;
3244 }
3245
3246 CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp)
3247 {
3248 CpuDefinitionInfoList *cpu_list = NULL;
3249 GSList *list;
3250
3251 list = object_class_get_list(TYPE_ARM_CPU, false);
3252 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list);
3253 g_slist_free(list);
3254
3255 return cpu_list;
3256 }
3257
3258 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
3259 void *opaque, int state,
3260 int crm, int opc1, int opc2)
3261 {
3262 /* Private utility function for define_one_arm_cp_reg_with_opaque():
3263 * add a single reginfo struct to the hash table.
3264 */
3265 uint32_t *key = g_new(uint32_t, 1);
3266 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
3267 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
3268 if (r->state == ARM_CP_STATE_BOTH && state == ARM_CP_STATE_AA32) {
3269 /* The AArch32 view of a shared register sees the lower 32 bits
3270 * of a 64 bit backing field. It is not migratable as the AArch64
3271 * view handles that. AArch64 also handles reset.
3272 * We assume it is a cp15 register if the .cp field is left unset.
3273 */
3274 if (r2->cp == 0) {
3275 r2->cp = 15;
3276 }
3277 r2->type |= ARM_CP_NO_MIGRATE;
3278 r2->resetfn = arm_cp_reset_ignore;
3279 #ifdef HOST_WORDS_BIGENDIAN
3280 if (r2->fieldoffset) {
3281 r2->fieldoffset += sizeof(uint32_t);
3282 }
3283 #endif
3284 }
3285 if (state == ARM_CP_STATE_AA64) {
3286 /* To allow abbreviation of ARMCPRegInfo
3287 * definitions, we treat cp == 0 as equivalent to
3288 * the value for "standard guest-visible sysreg".
3289 * STATE_BOTH definitions are also always "standard
3290 * sysreg" in their AArch64 view (the .cp value may
3291 * be non-zero for the benefit of the AArch32 view).
3292 */
3293 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
3294 r2->cp = CP_REG_ARM64_SYSREG_CP;
3295 }
3296 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
3297 r2->opc0, opc1, opc2);
3298 } else {
3299 *key = ENCODE_CP_REG(r2->cp, is64, r2->crn, crm, opc1, opc2);
3300 }
3301 if (opaque) {
3302 r2->opaque = opaque;
3303 }
3304 /* reginfo passed to helpers is correct for the actual access,
3305 * and is never ARM_CP_STATE_BOTH:
3306 */
3307 r2->state = state;
3308 /* Make sure reginfo passed to helpers for wildcarded regs
3309 * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
3310 */
3311 r2->crm = crm;
3312 r2->opc1 = opc1;
3313 r2->opc2 = opc2;
3314 /* By convention, for wildcarded registers only the first
3315 * entry is used for migration; the others are marked as
3316 * NO_MIGRATE so we don't try to transfer the register
3317 * multiple times. Special registers (ie NOP/WFI) are
3318 * never migratable.
3319 */
3320 if ((r->type & ARM_CP_SPECIAL) ||
3321 ((r->crm == CP_ANY) && crm != 0) ||
3322 ((r->opc1 == CP_ANY) && opc1 != 0) ||
3323 ((r->opc2 == CP_ANY) && opc2 != 0)) {
3324 r2->type |= ARM_CP_NO_MIGRATE;
3325 }
3326
3327 /* Overriding of an existing definition must be explicitly
3328 * requested.
3329 */
3330 if (!(r->type & ARM_CP_OVERRIDE)) {
3331 ARMCPRegInfo *oldreg;
3332 oldreg = g_hash_table_lookup(cpu->cp_regs, key);
3333 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
3334 fprintf(stderr, "Register redefined: cp=%d %d bit "
3335 "crn=%d crm=%d opc1=%d opc2=%d, "
3336 "was %s, now %s\n", r2->cp, 32 + 32 * is64,
3337 r2->crn, r2->crm, r2->opc1, r2->opc2,
3338 oldreg->name, r2->name);
3339 g_assert_not_reached();
3340 }
3341 }
3342 g_hash_table_insert(cpu->cp_regs, key, r2);
3343 }
3344
3345
3346 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
3347 const ARMCPRegInfo *r, void *opaque)
3348 {
3349 /* Define implementations of coprocessor registers.
3350 * We store these in a hashtable because typically
3351 * there are less than 150 registers in a space which
3352 * is 16*16*16*8*8 = 262144 in size.
3353 * Wildcarding is supported for the crm, opc1 and opc2 fields.
3354 * If a register is defined twice then the second definition is
3355 * used, so this can be used to define some generic registers and
3356 * then override them with implementation specific variations.
3357 * At least one of the original and the second definition should
3358 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard
3359 * against accidental use.
3360 *
3361 * The state field defines whether the register is to be
3362 * visible in the AArch32 or AArch64 execution state. If the
3363 * state is set to ARM_CP_STATE_BOTH then we synthesise a
3364 * reginfo structure for the AArch32 view, which sees the lower
3365 * 32 bits of the 64 bit register.
3366 *
3367 * Only registers visible in AArch64 may set r->opc0; opc0 cannot
3368 * be wildcarded. AArch64 registers are always considered to be 64
3369 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
3370 * the register, if any.
3371 */
3372 int crm, opc1, opc2, state;
3373 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
3374 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
3375 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
3376 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
3377 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
3378 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
3379 /* 64 bit registers have only CRm and Opc1 fields */
3380 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
3381 /* op0 only exists in the AArch64 encodings */
3382 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0));
3383 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
3384 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT));
3385 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1
3386 * encodes a minimum access level for the register. We roll this
3387 * runtime check into our general permission check code, so check
3388 * here that the reginfo's specified permissions are strict enough
3389 * to encompass the generic architectural permission check.
3390 */
3391 if (r->state != ARM_CP_STATE_AA32) {
3392 int mask = 0;
3393 switch (r->opc1) {
3394 case 0: case 1: case 2:
3395 /* min_EL EL1 */
3396 mask = PL1_RW;
3397 break;
3398 case 3:
3399 /* min_EL EL0 */
3400 mask = PL0_RW;
3401 break;
3402 case 4:
3403 /* min_EL EL2 */
3404 mask = PL2_RW;
3405 break;
3406 case 5:
3407 /* unallocated encoding, so not possible */
3408 assert(false);
3409 break;
3410 case 6:
3411 /* min_EL EL3 */
3412 mask = PL3_RW;
3413 break;
3414 case 7:
3415 /* min_EL EL1, secure mode only (we don't check the latter) */
3416 mask = PL1_RW;
3417 break;
3418 default:
3419 /* broken reginfo with out-of-range opc1 */
3420 assert(false);
3421 break;
3422 }
3423 /* assert our permissions are not too lax (stricter is fine) */
3424 assert((r->access & ~mask) == 0);
3425 }
3426
3427 /* Check that the register definition has enough info to handle
3428 * reads and writes if they are permitted.
3429 */
3430 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) {
3431 if (r->access & PL3_R) {
3432 assert(r->fieldoffset || r->readfn);
3433 }
3434 if (r->access & PL3_W) {
3435 assert(r->fieldoffset || r->writefn);
3436 }
3437 }
3438 /* Bad type field probably means missing sentinel at end of reg list */
3439 assert(cptype_valid(r->type));
3440 for (crm = crmmin; crm <= crmmax; crm++) {
3441 for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
3442 for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
3443 for (state = ARM_CP_STATE_AA32;
3444 state <= ARM_CP_STATE_AA64; state++) {
3445 if (r->state != state && r->state != ARM_CP_STATE_BOTH) {
3446 continue;
3447 }
3448 add_cpreg_to_hashtable(cpu, r, opaque, state,
3449 crm, opc1, opc2);
3450 }
3451 }
3452 }
3453 }
3454 }
3455
3456 void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
3457 const ARMCPRegInfo *regs, void *opaque)
3458 {
3459 /* Define a whole list of registers */
3460 const ARMCPRegInfo *r;
3461 for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
3462 define_one_arm_cp_reg_with_opaque(cpu, r, opaque);
3463 }
3464 }
3465
3466 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
3467 {
3468 return g_hash_table_lookup(cpregs, &encoded_cp);
3469 }
3470
3471 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
3472 uint64_t value)
3473 {
3474 /* Helper coprocessor write function for write-ignore registers */
3475 }
3476
3477 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri)
3478 {
3479 /* Helper coprocessor write function for read-as-zero registers */
3480 return 0;
3481 }
3482
3483 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque)
3484 {
3485 /* Helper coprocessor reset function for do-nothing-on-reset registers */
3486 }
3487
3488 static int bad_mode_switch(CPUARMState *env, int mode)
3489 {
3490 /* Return true if it is not valid for us to switch to
3491 * this CPU mode (ie all the UNPREDICTABLE cases in
3492 * the ARM ARM CPSRWriteByInstr pseudocode).
3493 */
3494 switch (mode) {
3495 case ARM_CPU_MODE_USR:
3496 case ARM_CPU_MODE_SYS:
3497 case ARM_CPU_MODE_SVC:
3498 case ARM_CPU_MODE_ABT:
3499 case ARM_CPU_MODE_UND:
3500 case ARM_CPU_MODE_IRQ:
3501 case ARM_CPU_MODE_FIQ:
3502 return 0;
3503 default:
3504 return 1;
3505 }
3506 }
3507
3508 uint32_t cpsr_read(CPUARMState *env)
3509 {
3510 int ZF;
3511 ZF = (env->ZF == 0);
3512 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
3513 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
3514 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
3515 | ((env->condexec_bits & 0xfc) << 8)
3516 | (env->GE << 16) | (env->daif & CPSR_AIF);
3517 }
3518
3519 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
3520 {
3521 if (mask & CPSR_NZCV) {
3522 env->ZF = (~val) & CPSR_Z;
3523 env->NF = val;
3524 env->CF = (val >> 29) & 1;
3525 env->VF = (val << 3) & 0x80000000;
3526 }
3527 if (mask & CPSR_Q)
3528 env->QF = ((val & CPSR_Q) != 0);
3529 if (mask & CPSR_T)
3530 env->thumb = ((val & CPSR_T) != 0);
3531 if (mask & CPSR_IT_0_1) {
3532 env->condexec_bits &= ~3;
3533 env->condexec_bits |= (val >> 25) & 3;
3534 }
3535 if (mask & CPSR_IT_2_7) {
3536 env->condexec_bits &= 3;
3537 env->condexec_bits |= (val >> 8) & 0xfc;
3538 }
3539 if (mask & CPSR_GE) {
3540 env->GE = (val >> 16) & 0xf;
3541 }
3542
3543 env->daif &= ~(CPSR_AIF & mask);
3544 env->daif |= val & CPSR_AIF & mask;
3545
3546 if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
3547 if (bad_mode_switch(env, val & CPSR_M)) {
3548 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE.
3549 * We choose to ignore the attempt and leave the CPSR M field
3550 * untouched.
3551 */
3552 mask &= ~CPSR_M;
3553 } else {
3554 switch_mode(env, val & CPSR_M);
3555 }
3556 }
3557 mask &= ~CACHED_CPSR_BITS;
3558 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
3559 }
3560
3561 /* Sign/zero extend */
3562 uint32_t HELPER(sxtb16)(uint32_t x)
3563 {
3564 uint32_t res;
3565 res = (uint16_t)(int8_t)x;
3566 res |= (uint32_t)(int8_t)(x >> 16) << 16;
3567 return res;
3568 }
3569
3570 uint32_t HELPER(uxtb16)(uint32_t x)
3571 {
3572 uint32_t res;
3573 res = (uint16_t)(uint8_t)x;
3574 res |= (uint32_t)(uint8_t)(x >> 16) << 16;
3575 return res;
3576 }
3577
3578 uint32_t HELPER(clz)(uint32_t x)
3579 {
3580 return clz32(x);
3581 }
3582
3583 int32_t HELPER(sdiv)(int32_t num, int32_t den)
3584 {
3585 if (den == 0)
3586 return 0;
3587 if (num == INT_MIN && den == -1)
3588 return INT_MIN;
3589 return num / den;
3590 }
3591
3592 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
3593 {
3594 if (den == 0)
3595 return 0;
3596 return num / den;
3597 }
3598
3599 uint32_t HELPER(rbit)(uint32_t x)
3600 {
3601 x = ((x & 0xff000000) >> 24)
3602 | ((x & 0x00ff0000) >> 8)
3603 | ((x & 0x0000ff00) << 8)
3604 | ((x & 0x000000ff) << 24);
3605 x = ((x & 0xf0f0f0f0) >> 4)
3606 | ((x & 0x0f0f0f0f) << 4);
3607 x = ((x & 0x88888888) >> 3)
3608 | ((x & 0x44444444) >> 1)
3609 | ((x & 0x22222222) << 1)
3610 | ((x & 0x11111111) << 3);
3611 return x;
3612 }
3613
3614 #if defined(CONFIG_USER_ONLY)
3615
3616 void arm_cpu_do_interrupt(CPUState *cs)
3617 {
3618 cs->exception_index = -1;
3619 }
3620
3621 int arm_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int rw,
3622 int mmu_idx)
3623 {
3624 ARMCPU *cpu = ARM_CPU(cs);
3625 CPUARMState *env = &cpu->env;
3626
3627 env->exception.vaddress = address;
3628 if (rw == 2) {
3629 cs->exception_index = EXCP_PREFETCH_ABORT;
3630 } else {
3631 cs->exception_index = EXCP_DATA_ABORT;
3632 }
3633 return 1;
3634 }
3635
3636 /* These should probably raise undefined insn exceptions. */
3637 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
3638 {
3639 ARMCPU *cpu = arm_env_get_cpu(env);
3640
3641 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg);
3642 }
3643
3644 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
3645 {
3646 ARMCPU *cpu = arm_env_get_cpu(env);
3647
3648 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg);
3649 return 0;
3650 }
3651
3652 void switch_mode(CPUARMState *env, int mode)
3653 {
3654 ARMCPU *cpu = arm_env_get_cpu(env);
3655
3656 if (mode != ARM_CPU_MODE_USR) {
3657 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n");
3658 }
3659 }
3660
3661 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
3662 {
3663 ARMCPU *cpu = arm_env_get_cpu(env);
3664
3665 cpu_abort(CPU(cpu), "banked r13 write\n");
3666 }
3667
3668 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
3669 {
3670 ARMCPU *cpu = arm_env_get_cpu(env);
3671
3672 cpu_abort(CPU(cpu), "banked r13 read\n");
3673 return 0;
3674 }
3675
3676 #else
3677
3678 /* Map CPU modes onto saved register banks. */
3679 int bank_number(int mode)
3680 {
3681 switch (mode) {
3682 case ARM_CPU_MODE_USR:
3683 case ARM_CPU_MODE_SYS:
3684 return 0;
3685 case ARM_CPU_MODE_SVC:
3686 return 1;
3687 case ARM_CPU_MODE_ABT:
3688 return 2;
3689 case ARM_CPU_MODE_UND:
3690 return 3;
3691 case ARM_CPU_MODE_IRQ:
3692 return 4;
3693 case ARM_CPU_MODE_FIQ:
3694 return 5;
3695 case ARM_CPU_MODE_HYP:
3696 return 6;
3697 case ARM_CPU_MODE_MON:
3698 return 7;
3699 }
3700 hw_error("bank number requested for bad CPSR mode value 0x%x\n", mode);
3701 }
3702
3703 void switch_mode(CPUARMState *env, int mode)
3704 {
3705 int old_mode;
3706 int i;
3707
3708 old_mode = env->uncached_cpsr & CPSR_M;
3709 if (mode == old_mode)
3710 return;
3711
3712 if (old_mode == ARM_CPU_MODE_FIQ) {
3713 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
3714 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
3715 } else if (mode == ARM_CPU_MODE_FIQ) {
3716 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
3717 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
3718 }
3719
3720 i = bank_number(old_mode);
3721 env->banked_r13[i] = env->regs[13];
3722 env->banked_r14[i] = env->regs[14];
3723 env->banked_spsr[i] = env->spsr;
3724
3725 i = bank_number(mode);
3726 env->regs[13] = env->banked_r13[i];
3727 env->regs[14] = env->banked_r14[i];
3728 env->spsr = env->banked_spsr[i];
3729 }
3730
3731 static void v7m_push(CPUARMState *env, uint32_t val)
3732 {
3733 CPUState *cs = CPU(arm_env_get_cpu(env));
3734
3735 env->regs[13] -= 4;
3736 stl_phys(cs->as, env->regs[13], val);
3737 }
3738
3739 static uint32_t v7m_pop(CPUARMState *env)
3740 {
3741 CPUState *cs = CPU(arm_env_get_cpu(env));
3742 uint32_t val;
3743
3744 val = ldl_phys(cs->as, env->regs[13]);
3745 env->regs[13] += 4;
3746 return val;
3747 }
3748
3749 /* Switch to V7M main or process stack pointer. */
3750 static void switch_v7m_sp(CPUARMState *env, int process)
3751 {
3752 uint32_t tmp;
3753 if (env->v7m.current_sp != process) {
3754 tmp = env->v7m.other_sp;
3755 env->v7m.other_sp = env->regs[13];
3756 env->regs[13] = tmp;
3757 env->v7m.current_sp = process;
3758 }
3759 }
3760
3761 static void do_v7m_exception_exit(CPUARMState *env)
3762 {
3763 uint32_t type;
3764 uint32_t xpsr;
3765
3766 type = env->regs[15];
3767 if (env->v7m.exception != 0)
3768 armv7m_nvic_complete_irq(env->nvic, env->v7m.exception);
3769
3770 /* Switch to the target stack. */
3771 switch_v7m_sp(env, (type & 4) != 0);
3772 /* Pop registers. */
3773 env->regs[0] = v7m_pop(env);
3774 env->regs[1] = v7m_pop(env);
3775 env->regs[2] = v7m_pop(env);
3776 env->regs[3] = v7m_pop(env);
3777 env->regs[12] = v7m_pop(env);
3778 env->regs[14] = v7m_pop(env);
3779 env->regs[15] = v7m_pop(env);
3780 xpsr = v7m_pop(env);
3781 xpsr_write(env, xpsr, 0xfffffdff);
3782 /* Undo stack alignment. */
3783 if (xpsr & 0x200)
3784 env->regs[13] |= 4;
3785 /* ??? The exception return type specifies Thread/Handler mode. However
3786 this is also implied by the xPSR value. Not sure what to do
3787 if there is a mismatch. */
3788 /* ??? Likewise for mismatches between the CONTROL register and the stack
3789 pointer. */
3790 }
3791
3792 void arm_v7m_cpu_do_interrupt(CPUState *cs)
3793 {
3794 ARMCPU *cpu = ARM_CPU(cs);
3795 CPUARMState *env = &cpu->env;
3796 uint32_t xpsr = xpsr_read(env);
3797 uint32_t lr;
3798 uint32_t addr;
3799
3800 arm_log_exception(cs->exception_index);
3801
3802 lr = 0xfffffff1;
3803 if (env->v7m.current_sp)
3804 lr |= 4;
3805 if (env->v7m.exception == 0)
3806 lr |= 8;
3807
3808 /* For exceptions we just mark as pending on the NVIC, and let that
3809 handle it. */
3810 /* TODO: Need to escalate if the current priority is higher than the
3811 one we're raising. */
3812 switch (cs->exception_index) {
3813 case EXCP_UDEF:
3814 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
3815 return;
3816 case EXCP_SWI:
3817 /* The PC already points to the next instruction. */
3818 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC);
3819 return;
3820 case EXCP_PREFETCH_ABORT:
3821 case EXCP_DATA_ABORT:
3822 /* TODO: if we implemented the MPU registers, this is where we
3823 * should set the MMFAR, etc from exception.fsr and exception.vaddress.
3824 */
3825 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
3826 return;
3827 case EXCP_BKPT:
3828 if (semihosting_enabled) {
3829 int nr;
3830 nr = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
3831 if (nr == 0xab) {
3832 env->regs[15] += 2;
3833 env->regs[0] = do_arm_semihosting(env);
3834 qemu_log_mask(CPU_LOG_INT, "...handled as semihosting call\n");
3835 return;
3836 }
3837 }
3838 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG);
3839 return;
3840 case EXCP_IRQ:
3841 env->v7m.exception = armv7m_nvic_acknowledge_irq(env->nvic);
3842 break;
3843 case EXCP_EXCEPTION_EXIT:
3844 do_v7m_exception_exit(env);
3845 return;
3846 default:
3847 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
3848 return; /* Never happens. Keep compiler happy. */
3849 }
3850
3851 /* Align stack pointer. */
3852 /* ??? Should only do this if Configuration Control Register
3853 STACKALIGN bit is set. */
3854 if (env->regs[13] & 4) {
3855 env->regs[13] -= 4;
3856 xpsr |= 0x200;
3857 }
3858 /* Switch to the handler mode. */
3859 v7m_push(env, xpsr);
3860 v7m_push(env, env->regs[15]);
3861 v7m_push(env, env->regs[14]);
3862 v7m_push(env, env->regs[12]);
3863 v7m_push(env, env->regs[3]);
3864 v7m_push(env, env->regs[2]);
3865 v7m_push(env, env->regs[1]);
3866 v7m_push(env, env->regs[0]);
3867 switch_v7m_sp(env, 0);
3868 /* Clear IT bits */
3869 env->condexec_bits = 0;
3870 env->regs[14] = lr;
3871 addr = ldl_phys(cs->as, env->v7m.vecbase + env->v7m.exception * 4);
3872 env->regs[15] = addr & 0xfffffffe;
3873 env->thumb = addr & 1;
3874 }
3875
3876 /* Handle a CPU exception. */
3877 void arm_cpu_do_interrupt(CPUState *cs)
3878 {
3879 ARMCPU *cpu = ARM_CPU(cs);
3880 CPUARMState *env = &cpu->env;
3881 uint32_t addr;
3882 uint32_t mask;
3883 int new_mode;
3884 uint32_t offset;
3885 uint32_t moe;
3886
3887 assert(!IS_M(env));
3888
3889 arm_log_exception(cs->exception_index);
3890
3891 /* If this is a debug exception we must update the DBGDSCR.MOE bits */
3892 switch (env->exception.syndrome >> ARM_EL_EC_SHIFT) {
3893 case EC_BREAKPOINT:
3894 case EC_BREAKPOINT_SAME_EL:
3895 moe = 1;
3896 break;
3897 case EC_WATCHPOINT:
3898 case EC_WATCHPOINT_SAME_EL:
3899 moe = 10;
3900 break;
3901 case EC_AA32_BKPT:
3902 moe = 3;
3903 break;
3904 case EC_VECTORCATCH:
3905 moe = 5;
3906 break;
3907 default:
3908 moe = 0;
3909 break;
3910 }
3911
3912 if (moe) {
3913 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe);
3914 }
3915
3916 /* TODO: Vectored interrupt controller. */
3917 switch (cs->exception_index) {
3918 case EXCP_UDEF:
3919 new_mode = ARM_CPU_MODE_UND;
3920 addr = 0x04;
3921 mask = CPSR_I;
3922 if (env->thumb)
3923 offset = 2;
3924 else
3925 offset = 4;
3926 break;
3927 case EXCP_SWI:
3928 if (semihosting_enabled) {
3929 /* Check for semihosting interrupt. */
3930 if (env->thumb) {
3931 mask = arm_lduw_code(env, env->regs[15] - 2, env->bswap_code)
3932 & 0xff;
3933 } else {
3934 mask = arm_ldl_code(env, env->regs[15] - 4, env->bswap_code)
3935 & 0xffffff;
3936 }
3937 /* Only intercept calls from privileged modes, to provide some
3938 semblance of security. */
3939 if (((mask == 0x123456 && !env->thumb)
3940 || (mask == 0xab && env->thumb))
3941 && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
3942 env->regs[0] = do_arm_semihosting(env);
3943 qemu_log_mask(CPU_LOG_INT, "...handled as semihosting call\n");
3944 return;
3945 }
3946 }
3947 new_mode = ARM_CPU_MODE_SVC;
3948 addr = 0x08;
3949 mask = CPSR_I;
3950 /* The PC already points to the next instruction. */
3951 offset = 0;
3952 break;
3953 case EXCP_BKPT:
3954 /* See if this is a semihosting syscall. */
3955 if (env->thumb && semihosting_enabled) {
3956 mask = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
3957 if (mask == 0xab
3958 && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
3959 env->regs[15] += 2;
3960 env->regs[0] = do_arm_semihosting(env);
3961 qemu_log_mask(CPU_LOG_INT, "...handled as semihosting call\n");
3962 return;
3963 }
3964 }
3965 env->exception.fsr = 2;
3966 /* Fall through to prefetch abort. */
3967 case EXCP_PREFETCH_ABORT:
3968 env->cp15.ifsr_el2 = env->exception.fsr;
3969 env->cp15.far_el[1] = deposit64(env->cp15.far_el[1], 32, 32,
3970 env->exception.vaddress);
3971 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n",
3972 env->cp15.ifsr_el2, (uint32_t)env->exception.vaddress);
3973 new_mode = ARM_CPU_MODE_ABT;
3974 addr = 0x0c;
3975 mask = CPSR_A | CPSR_I;
3976 offset = 4;
3977 break;
3978 case EXCP_DATA_ABORT:
3979 env->cp15.esr_el[1] = env->exception.fsr;
3980 env->cp15.far_el[1] = deposit64(env->cp15.far_el[1], 0, 32,
3981 env->exception.vaddress);
3982 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n",
3983 (uint32_t)env->cp15.esr_el[1],
3984 (uint32_t)env->exception.vaddress);
3985 new_mode = ARM_CPU_MODE_ABT;
3986 addr = 0x10;
3987 mask = CPSR_A | CPSR_I;
3988 offset = 8;
3989 break;
3990 case EXCP_IRQ:
3991 new_mode = ARM_CPU_MODE_IRQ;
3992 addr = 0x18;
3993 /* Disable IRQ and imprecise data aborts. */
3994 mask = CPSR_A | CPSR_I;
3995 offset = 4;
3996 break;
3997 case EXCP_FIQ:
3998 new_mode = ARM_CPU_MODE_FIQ;
3999 addr = 0x1c;
4000 /* Disable FIQ, IRQ and imprecise data aborts. */
4001 mask = CPSR_A | CPSR_I | CPSR_F;
4002 offset = 4;
4003 break;
4004 default:
4005 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
4006 return; /* Never happens. Keep compiler happy. */
4007 }
4008 /* High vectors. */
4009 if (env->cp15.c1_sys & SCTLR_V) {
4010 /* when enabled, base address cannot be remapped. */
4011 addr += 0xffff0000;
4012 } else {
4013 /* ARM v7 architectures provide a vector base address register to remap
4014 * the interrupt vector table.
4015 * This register is only followed in non-monitor mode, and has a secure
4016 * and un-secure copy. Since the cpu is always in a un-secure operation
4017 * and is never in monitor mode this feature is always active.
4018 * Note: only bits 31:5 are valid.
4019 */
4020 addr += env->cp15.vbar_el[1];
4021 }
4022 switch_mode (env, new_mode);
4023 /* For exceptions taken to AArch32 we must clear the SS bit in both
4024 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.
4025 */
4026 env->uncached_cpsr &= ~PSTATE_SS;
4027 env->spsr = cpsr_read(env);
4028 /* Clear IT bits. */
4029 env->condexec_bits = 0;
4030 /* Switch to the new mode, and to the correct instruction set. */
4031 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
4032 env->daif |= mask;
4033 /* this is a lie, as the was no c1_sys on V4T/V5, but who cares
4034 * and we should just guard the thumb mode on V4 */
4035 if (arm_feature(env, ARM_FEATURE_V4T)) {
4036 env->thumb = (env->cp15.c1_sys & SCTLR_TE) != 0;
4037 }
4038 env->regs[14] = env->regs[15] + offset;
4039 env->regs[15] = addr;
4040 cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
4041 }
4042
4043 /* Check section/page access permissions.
4044 Returns the page protection flags, or zero if the access is not
4045 permitted. */
4046 static inline int check_ap(CPUARMState *env, int ap, int domain_prot,
4047 int access_type, int is_user)
4048 {
4049 int prot_ro;
4050
4051 if (domain_prot == 3) {
4052 return PAGE_READ | PAGE_WRITE;
4053 }
4054
4055 if (access_type == 1)
4056 prot_ro = 0;
4057 else
4058 prot_ro = PAGE_READ;
4059
4060 switch (ap) {
4061 case 0:
4062 if (arm_feature(env, ARM_FEATURE_V7)) {
4063 return 0;
4064 }
4065 if (access_type == 1)
4066 return 0;
4067 switch (env->cp15.c1_sys & (SCTLR_S | SCTLR_R)) {
4068 case SCTLR_S:
4069 return is_user ? 0 : PAGE_READ;
4070 case SCTLR_R:
4071 return PAGE_READ;
4072 default:
4073 return 0;
4074 }
4075 case 1:
4076 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
4077 case 2:
4078 if (is_user)
4079 return prot_ro;
4080 else
4081 return PAGE_READ | PAGE_WRITE;
4082 case 3:
4083 return PAGE_READ | PAGE_WRITE;
4084 case 4: /* Reserved. */
4085 return 0;
4086 case 5:
4087 return is_user ? 0 : prot_ro;
4088 case 6:
4089 return prot_ro;
4090 case 7:
4091 if (!arm_feature (env, ARM_FEATURE_V6K))
4092 return 0;
4093 return prot_ro;
4094 default:
4095 abort();
4096 }
4097 }
4098
4099 static bool get_level1_table_address(CPUARMState *env, uint32_t *table,
4100 uint32_t address)
4101 {
4102 if (address & env->cp15.c2_mask) {
4103 if ((env->cp15.c2_control & TTBCR_PD1)) {
4104 /* Translation table walk disabled for TTBR1 */
4105 return false;
4106 }
4107 *table = env->cp15.ttbr1_el1 & 0xffffc000;
4108 } else {
4109 if ((env->cp15.c2_control & TTBCR_PD0)) {
4110 /* Translation table walk disabled for TTBR0 */
4111 return false;
4112 }
4113 *table = env->cp15.ttbr0_el1 & env->cp15.c2_base_mask;
4114 }
4115 *table |= (address >> 18) & 0x3ffc;
4116 return true;
4117 }
4118
4119 static int get_phys_addr_v5(CPUARMState *env, uint32_t address, int access_type,
4120 int is_user, hwaddr *phys_ptr,
4121 int *prot, target_ulong *page_size)
4122 {
4123 CPUState *cs = CPU(arm_env_get_cpu(env));
4124 int code;
4125 uint32_t table;
4126 uint32_t desc;
4127 int type;
4128 int ap;
4129 int domain = 0;
4130 int domain_prot;
4131 hwaddr phys_addr;
4132
4133 /* Pagetable walk. */
4134 /* Lookup l1 descriptor. */
4135 if (!get_level1_table_address(env, &table, address)) {
4136 /* Section translation fault if page walk is disabled by PD0 or PD1 */
4137 code = 5;
4138 goto do_fault;
4139 }
4140 desc = ldl_phys(cs->as, table);
4141 type = (desc & 3);
4142 domain = (desc >> 5) & 0x0f;
4143 domain_prot = (env->cp15.c3 >> (domain * 2)) & 3;
4144 if (type == 0) {
4145 /* Section translation fault. */
4146 code = 5;
4147 goto do_fault;
4148 }
4149 if (domain_prot == 0 || domain_prot == 2) {
4150 if (type == 2)
4151 code = 9; /* Section domain fault. */
4152 else
4153 code = 11; /* Page domain fault. */
4154 goto do_fault;
4155 }
4156 if (type == 2) {
4157 /* 1Mb section. */
4158 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
4159 ap = (desc >> 10) & 3;
4160 code = 13;
4161 *page_size = 1024 * 1024;
4162 } else {
4163 /* Lookup l2 entry. */
4164 if (type == 1) {
4165 /* Coarse pagetable. */
4166 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
4167 } else {
4168 /* Fine pagetable. */
4169 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
4170 }
4171 desc = ldl_phys(cs->as, table);
4172 switch (desc & 3) {
4173 case 0: /* Page translation fault. */
4174 code = 7;
4175 goto do_fault;
4176 case 1: /* 64k page. */
4177 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
4178 ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
4179 *page_size = 0x10000;
4180 break;
4181 case 2: /* 4k page. */
4182 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
4183 ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
4184 *page_size = 0x1000;
4185 break;
4186 case 3: /* 1k page. */
4187 if (type == 1) {
4188 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
4189 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
4190 } else {
4191 /* Page translation fault. */
4192 code = 7;
4193 goto do_fault;
4194 }
4195 } else {
4196 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
4197 }
4198 ap = (desc >> 4) & 3;
4199 *page_size = 0x400;
4200 break;
4201 default:
4202 /* Never happens, but compiler isn't smart enough to tell. */
4203 abort();
4204 }
4205 code = 15;
4206 }
4207 *prot = check_ap(env, ap, domain_prot, access_type, is_user);
4208 if (!*prot) {
4209 /* Access permission fault. */
4210 goto do_fault;
4211 }
4212 *prot |= PAGE_EXEC;
4213 *phys_ptr = phys_addr;
4214 return 0;
4215 do_fault:
4216 return code | (domain << 4);
4217 }
4218
4219 static int get_phys_addr_v6(CPUARMState *env, uint32_t address, int access_type,
4220 int is_user, hwaddr *phys_ptr,
4221 int *prot, target_ulong *page_size)
4222 {
4223 CPUState *cs = CPU(arm_env_get_cpu(env));
4224 int code;
4225 uint32_t table;
4226 uint32_t desc;
4227 uint32_t xn;
4228 uint32_t pxn = 0;
4229 int type;
4230 int ap;
4231 int domain = 0;
4232 int domain_prot;
4233 hwaddr phys_addr;
4234
4235 /* Pagetable walk. */
4236 /* Lookup l1 descriptor. */
4237 if (!get_level1_table_address(env, &table, address)) {
4238 /* Section translation fault if page walk is disabled by PD0 or PD1 */
4239 code = 5;
4240 goto do_fault;
4241 }
4242 desc = ldl_phys(cs->as, table);
4243 type = (desc & 3);
4244 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
4245 /* Section translation fault, or attempt to use the encoding
4246 * which is Reserved on implementations without PXN.
4247 */
4248 code = 5;
4249 goto do_fault;
4250 }
4251 if ((type == 1) || !(desc & (1 << 18))) {
4252 /* Page or Section. */
4253 domain = (desc >> 5) & 0x0f;
4254 }
4255 domain_prot = (env->cp15.c3 >> (domain * 2)) & 3;
4256 if (domain_prot == 0 || domain_prot == 2) {
4257 if (type != 1) {
4258 code = 9; /* Section domain fault. */
4259 } else {
4260 code = 11; /* Page domain fault. */
4261 }
4262 goto do_fault;
4263 }
4264 if (type != 1) {
4265 if (desc & (1 << 18)) {
4266 /* Supersection. */
4267 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
4268 *page_size = 0x1000000;
4269 } else {
4270 /* Section. */
4271 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
4272 *page_size = 0x100000;
4273 }
4274 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
4275 xn = desc & (1 << 4);
4276 pxn = desc & 1;
4277 code = 13;
4278 } else {
4279 if (arm_feature(env, ARM_FEATURE_PXN)) {
4280 pxn = (desc >> 2) & 1;
4281 }
4282 /* Lookup l2 entry. */
4283 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
4284 desc = ldl_phys(cs->as, table);
4285 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
4286 switch (desc & 3) {
4287 case 0: /* Page translation fault. */
4288 code = 7;
4289 goto do_fault;
4290 case 1: /* 64k page. */
4291 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
4292 xn = desc & (1 << 15);
4293 *page_size = 0x10000;
4294 break;
4295 case 2: case 3: /* 4k page. */
4296 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
4297 xn = desc & 1;
4298 *page_size = 0x1000;
4299 break;
4300 default:
4301 /* Never happens, but compiler isn't smart enough to tell. */
4302 abort();
4303 }
4304 code = 15;
4305 }
4306 if (domain_prot == 3) {
4307 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
4308 } else {
4309 if (pxn && !is_user) {
4310 xn = 1;
4311 }
4312 if (xn && access_type == 2)
4313 goto do_fault;
4314
4315 /* The simplified model uses AP[0] as an access control bit. */
4316 if ((env->cp15.c1_sys & SCTLR_AFE) && (ap & 1) == 0) {
4317 /* Access flag fault. */
4318 code = (code == 15) ? 6 : 3;
4319 goto do_fault;
4320 }
4321 *prot = check_ap(env, ap, domain_prot, access_type, is_user);
4322 if (!*prot) {
4323 /* Access permission fault. */
4324 goto do_fault;
4325 }
4326 if (!xn) {
4327 *prot |= PAGE_EXEC;
4328 }
4329 }
4330 *phys_ptr = phys_addr;
4331 return 0;
4332 do_fault:
4333 return code | (domain << 4);
4334 }
4335
4336 /* Fault type for long-descriptor MMU fault reporting; this corresponds
4337 * to bits [5..2] in the STATUS field in long-format DFSR/IFSR.
4338 */
4339 typedef enum {
4340 translation_fault = 1,
4341 access_fault = 2,
4342 permission_fault = 3,
4343 } MMUFaultType;
4344
4345 static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
4346 int access_type, int is_user,
4347 hwaddr *phys_ptr, int *prot,
4348 target_ulong *page_size_ptr)
4349 {
4350 CPUState *cs = CPU(arm_env_get_cpu(env));
4351 /* Read an LPAE long-descriptor translation table. */
4352 MMUFaultType fault_type = translation_fault;
4353 uint32_t level = 1;
4354 uint32_t epd;
4355 int32_t tsz;
4356 uint32_t tg;
4357 uint64_t ttbr;
4358 int ttbr_select;
4359 hwaddr descaddr, descmask;
4360 uint32_t tableattrs;
4361 target_ulong page_size;
4362 uint32_t attrs;
4363 int32_t granule_sz = 9;
4364 int32_t va_size = 32;
4365 int32_t tbi = 0;
4366
4367 if (arm_el_is_aa64(env, 1)) {
4368 va_size = 64;
4369 if (extract64(address, 55, 1))
4370 tbi = extract64(env->cp15.c2_control, 38, 1);
4371 else
4372 tbi = extract64(env->cp15.c2_control, 37, 1);
4373 tbi *= 8;
4374 }
4375
4376 /* Determine whether this address is in the region controlled by
4377 * TTBR0 or TTBR1 (or if it is in neither region and should fault).
4378 * This is a Non-secure PL0/1 stage 1 translation, so controlled by
4379 * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
4380 */
4381 uint32_t t0sz = extract32(env->cp15.c2_control, 0, 6);
4382 if (arm_el_is_aa64(env, 1)) {
4383 t0sz = MIN(t0sz, 39);
4384 t0sz = MAX(t0sz, 16);
4385 }
4386 uint32_t t1sz = extract32(env->cp15.c2_control, 16, 6);
4387 if (arm_el_is_aa64(env, 1)) {
4388 t1sz = MIN(t1sz, 39);
4389 t1sz = MAX(t1sz, 16);
4390 }
4391 if (t0sz && !extract64(address, va_size - t0sz, t0sz - tbi)) {
4392 /* there is a ttbr0 region and we are in it (high bits all zero) */
4393 ttbr_select = 0;
4394 } else if (t1sz && !extract64(~address, va_size - t1sz, t1sz - tbi)) {
4395 /* there is a ttbr1 region and we are in it (high bits all one) */
4396 ttbr_select = 1;
4397 } else if (!t0sz) {
4398 /* ttbr0 region is "everything not in the ttbr1 region" */
4399 ttbr_select = 0;
4400 } else if (!t1sz) {
4401 /* ttbr1 region is "everything not in the ttbr0 region" */
4402 ttbr_select = 1;
4403 } else {
4404 /* in the gap between the two regions, this is a Translation fault */
4405 fault_type = translation_fault;
4406 goto do_fault;
4407 }
4408
4409 /* Note that QEMU ignores shareability and cacheability attributes,
4410 * so we don't need to do anything with the SH, ORGN, IRGN fields
4411 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
4412 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
4413 * implement any ASID-like capability so we can ignore it (instead
4414 * we will always flush the TLB any time the ASID is changed).
4415 */
4416 if (ttbr_select == 0) {
4417 ttbr = env->cp15.ttbr0_el1;
4418 epd = extract32(env->cp15.c2_control, 7, 1);
4419 tsz = t0sz;
4420
4421 tg = extract32(env->cp15.c2_control, 14, 2);
4422 if (tg == 1) { /* 64KB pages */
4423 granule_sz = 13;
4424 }
4425 if (tg == 2) { /* 16KB pages */
4426 granule_sz = 11;
4427 }
4428 } else {
4429 ttbr = env->cp15.ttbr1_el1;
4430 epd = extract32(env->cp15.c2_control, 23, 1);
4431 tsz = t1sz;
4432
4433 tg = extract32(env->cp15.c2_control, 30, 2);
4434 if (tg == 3) { /* 64KB pages */
4435 granule_sz = 13;
4436 }
4437 if (tg == 1) { /* 16KB pages */
4438 granule_sz = 11;
4439 }
4440 }
4441
4442 if (epd) {
4443 /* Translation table walk disabled => Translation fault on TLB miss */
4444 goto do_fault;
4445 }
4446
4447 /* The starting level depends on the virtual address size which can be
4448 * up to 48-bits and the translation granule size.
4449 */
4450 if ((va_size - tsz) > (granule_sz * 4 + 3)) {
4451 level = 0;
4452 } else if ((va_size - tsz) > (granule_sz * 3 + 3)) {
4453 level = 1;
4454 } else {
4455 level = 2;
4456 }
4457
4458 /* Clear the vaddr bits which aren't part of the within-region address,
4459 * so that we don't have to special case things when calculating the
4460 * first descriptor address.
4461 */
4462 if (tsz) {
4463 address &= (1ULL << (va_size - tsz)) - 1;
4464 }
4465
4466 descmask = (1ULL << (granule_sz + 3)) - 1;
4467
4468 /* Now we can extract the actual base address from the TTBR */
4469 descaddr = extract64(ttbr, 0, 48);
4470 descaddr &= ~((1ULL << (va_size - tsz - (granule_sz * (4 - level)))) - 1);
4471
4472 tableattrs = 0;
4473 for (;;) {
4474 uint64_t descriptor;
4475
4476 descaddr |= (address >> (granule_sz * (4 - level))) & descmask;
4477 descaddr &= ~7ULL;
4478 descriptor = ldq_phys(cs->as, descaddr);
4479 if (!(descriptor & 1) ||
4480 (!(descriptor & 2) && (level == 3))) {
4481 /* Invalid, or the Reserved level 3 encoding */
4482 goto do_fault;
4483 }
4484 descaddr = descriptor & 0xfffffff000ULL;
4485
4486 if ((descriptor & 2) && (level < 3)) {
4487 /* Table entry. The top five bits are attributes which may
4488 * propagate down through lower levels of the table (and
4489 * which are all arranged so that 0 means "no effect", so
4490 * we can gather them up by ORing in the bits at each level).
4491 */
4492 tableattrs |= extract64(descriptor, 59, 5);
4493 level++;
4494 continue;
4495 }
4496 /* Block entry at level 1 or 2, or page entry at level 3.
4497 * These are basically the same thing, although the number
4498 * of bits we pull in from the vaddr varies.
4499 */
4500 page_size = (1ULL << ((granule_sz * (4 - level)) + 3));
4501 descaddr |= (address & (page_size - 1));
4502 /* Extract attributes from the descriptor and merge with table attrs */
4503 attrs = extract64(descriptor, 2, 10)
4504 | (extract64(descriptor, 52, 12) << 10);
4505 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */
4506 attrs |= extract32(tableattrs, 3, 1) << 5; /* APTable[1] => AP[2] */
4507 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
4508 * means "force PL1 access only", which means forcing AP[1] to 0.
4509 */
4510 if (extract32(tableattrs, 2, 1)) {
4511 attrs &= ~(1 << 4);
4512 }
4513 /* Since we're always in the Non-secure state, NSTable is ignored. */
4514 break;
4515 }
4516 /* Here descaddr is the final physical address, and attributes
4517 * are all in attrs.
4518 */
4519 fault_type = access_fault;
4520 if ((attrs & (1 << 8)) == 0) {
4521 /* Access flag */
4522 goto do_fault;
4523 }
4524 fault_type = permission_fault;
4525 if (is_user && !(attrs & (1 << 4))) {
4526 /* Unprivileged access not enabled */
4527 goto do_fault;
4528 }
4529 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
4530 if ((arm_feature(env, ARM_FEATURE_V8) && is_user && (attrs & (1 << 12))) ||
4531 (!arm_feature(env, ARM_FEATURE_V8) && (attrs & (1 << 12))) ||
4532 (!is_user && (attrs & (1 << 11)))) {
4533 /* XN/UXN or PXN. Since we only implement EL0/EL1 we unconditionally
4534 * treat XN/UXN as UXN for v8.
4535 */
4536 if (access_type == 2) {
4537 goto do_fault;
4538 }
4539 *prot &= ~PAGE_EXEC;
4540 }
4541 if (attrs & (1 << 5)) {
4542 /* Write access forbidden */
4543 if (access_type == 1) {
4544 goto do_fault;
4545 }
4546 *prot &= ~PAGE_WRITE;
4547 }
4548
4549 *phys_ptr = descaddr;
4550 *page_size_ptr = page_size;
4551 return 0;
4552
4553 do_fault:
4554 /* Long-descriptor format IFSR/DFSR value */
4555 return (1 << 9) | (fault_type << 2) | level;
4556 }
4557
4558 static int get_phys_addr_mpu(CPUARMState *env, uint32_t address,
4559 int access_type, int is_user,
4560 hwaddr *phys_ptr, int *prot)
4561 {
4562 int n;
4563 uint32_t mask;
4564 uint32_t base;
4565
4566 *phys_ptr = address;
4567 for (n = 7; n >= 0; n--) {
4568 base = env->cp15.c6_region[n];
4569 if ((base & 1) == 0)
4570 continue;
4571 mask = 1 << ((base >> 1) & 0x1f);
4572 /* Keep this shift separate from the above to avoid an
4573 (undefined) << 32. */
4574 mask = (mask << 1) - 1;
4575 if (((base ^ address) & ~mask) == 0)
4576 break;
4577 }
4578 if (n < 0)
4579 return 2;
4580
4581 if (access_type == 2) {
4582 mask = env->cp15.pmsav5_insn_ap;
4583 } else {
4584 mask = env->cp15.pmsav5_data_ap;
4585 }
4586 mask = (mask >> (n * 4)) & 0xf;
4587 switch (mask) {
4588 case 0:
4589 return 1;
4590 case 1:
4591 if (is_user)
4592 return 1;
4593 *prot = PAGE_READ | PAGE_WRITE;
4594 break;
4595 case 2:
4596 *prot = PAGE_READ;
4597 if (!is_user)
4598 *prot |= PAGE_WRITE;
4599 break;
4600 case 3:
4601 *prot = PAGE_READ | PAGE_WRITE;
4602 break;
4603 case 5:
4604 if (is_user)
4605 return 1;
4606 *prot = PAGE_READ;
4607 break;
4608 case 6:
4609 *prot = PAGE_READ;
4610 break;
4611 default:
4612 /* Bad permission. */
4613 return 1;
4614 }
4615 *prot |= PAGE_EXEC;
4616 return 0;
4617 }
4618
4619 /* get_phys_addr - get the physical address for this virtual address
4620 *
4621 * Find the physical address corresponding to the given virtual address,
4622 * by doing a translation table walk on MMU based systems or using the
4623 * MPU state on MPU based systems.
4624 *
4625 * Returns 0 if the translation was successful. Otherwise, phys_ptr,
4626 * prot and page_size are not filled in, and the return value provides
4627 * information on why the translation aborted, in the format of a
4628 * DFSR/IFSR fault register, with the following caveats:
4629 * * we honour the short vs long DFSR format differences.
4630 * * the WnR bit is never set (the caller must do this).
4631 * * for MPU based systems we don't bother to return a full FSR format
4632 * value.
4633 *
4634 * @env: CPUARMState
4635 * @address: virtual address to get physical address for
4636 * @access_type: 0 for read, 1 for write, 2 for execute
4637 * @is_user: 0 for privileged access, 1 for user
4638 * @phys_ptr: set to the physical address corresponding to the virtual address
4639 * @prot: set to the permissions for the page containing phys_ptr
4640 * @page_size: set to the size of the page containing phys_ptr
4641 */
4642 static inline int get_phys_addr(CPUARMState *env, target_ulong address,
4643 int access_type, int is_user,
4644 hwaddr *phys_ptr, int *prot,
4645 target_ulong *page_size)
4646 {
4647 /* Fast Context Switch Extension. */
4648 if (address < 0x02000000)
4649 address += env->cp15.c13_fcse;
4650
4651 if ((env->cp15.c1_sys & SCTLR_M) == 0) {
4652 /* MMU/MPU disabled. */
4653 *phys_ptr = address;
4654 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
4655 *page_size = TARGET_PAGE_SIZE;
4656 return 0;
4657 } else if (arm_feature(env, ARM_FEATURE_MPU)) {
4658 *page_size = TARGET_PAGE_SIZE;
4659 return get_phys_addr_mpu(env, address, access_type, is_user, phys_ptr,
4660 prot);
4661 } else if (extended_addresses_enabled(env)) {
4662 return get_phys_addr_lpae(env, address, access_type, is_user, phys_ptr,
4663 prot, page_size);
4664 } else if (env->cp15.c1_sys & SCTLR_XP) {
4665 return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,
4666 prot, page_size);
4667 } else {
4668 return get_phys_addr_v5(env, address, access_type, is_user, phys_ptr,
4669 prot, page_size);
4670 }
4671 }
4672
4673 int arm_cpu_handle_mmu_fault(CPUState *cs, vaddr address,
4674 int access_type, int mmu_idx)
4675 {
4676 ARMCPU *cpu = ARM_CPU(cs);
4677 CPUARMState *env = &cpu->env;
4678 hwaddr phys_addr;
4679 target_ulong page_size;
4680 int prot;
4681 int ret, is_user;
4682 uint32_t syn;
4683 bool same_el = (arm_current_pl(env) != 0);
4684
4685 is_user = mmu_idx == MMU_USER_IDX;
4686 ret = get_phys_addr(env, address, access_type, is_user, &phys_addr, &prot,
4687 &page_size);
4688 if (ret == 0) {
4689 /* Map a single [sub]page. */
4690 phys_addr &= TARGET_PAGE_MASK;
4691 address &= TARGET_PAGE_MASK;
4692 tlb_set_page(cs, address, phys_addr, prot, mmu_idx, page_size);
4693 return 0;
4694 }
4695
4696 /* AArch64 syndrome does not have an LPAE bit */
4697 syn = ret & ~(1 << 9);
4698
4699 /* For insn and data aborts we assume there is no instruction syndrome
4700 * information; this is always true for exceptions reported to EL1.
4701 */
4702 if (access_type == 2) {
4703 syn = syn_insn_abort(same_el, 0, 0, syn);
4704 cs->exception_index = EXCP_PREFETCH_ABORT;
4705 } else {
4706 syn = syn_data_abort(same_el, 0, 0, 0, access_type == 1, syn);
4707 if (access_type == 1 && arm_feature(env, ARM_FEATURE_V6)) {
4708 ret |= (1 << 11);
4709 }
4710 cs->exception_index = EXCP_DATA_ABORT;
4711 }
4712
4713 env->exception.syndrome = syn;
4714 env->exception.vaddress = address;
4715 env->exception.fsr = ret;
4716 return 1;
4717 }
4718
4719 hwaddr arm_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
4720 {
4721 ARMCPU *cpu = ARM_CPU(cs);
4722 hwaddr phys_addr;
4723 target_ulong page_size;
4724 int prot;
4725 int ret;
4726
4727 ret = get_phys_addr(&cpu->env, addr, 0, 0, &phys_addr, &prot, &page_size);
4728
4729 if (ret != 0) {
4730 return -1;
4731 }
4732
4733 return phys_addr;
4734 }
4735
4736 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
4737 {
4738 if ((env->uncached_cpsr & CPSR_M) == mode) {
4739 env->regs[13] = val;
4740 } else {
4741 env->banked_r13[bank_number(mode)] = val;
4742 }
4743 }
4744
4745 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
4746 {
4747 if ((env->uncached_cpsr & CPSR_M) == mode) {
4748 return env->regs[13];
4749 } else {
4750 return env->banked_r13[bank_number(mode)];
4751 }
4752 }
4753
4754 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
4755 {
4756 ARMCPU *cpu = arm_env_get_cpu(env);
4757
4758 switch (reg) {
4759 case 0: /* APSR */
4760 return xpsr_read(env) & 0xf8000000;
4761 case 1: /* IAPSR */
4762 return xpsr_read(env) & 0xf80001ff;
4763 case 2: /* EAPSR */
4764 return xpsr_read(env) & 0xff00fc00;
4765 case 3: /* xPSR */
4766 return xpsr_read(env) & 0xff00fdff;
4767 case 5: /* IPSR */
4768 return xpsr_read(env) & 0x000001ff;
4769 case 6: /* EPSR */
4770 return xpsr_read(env) & 0x0700fc00;
4771 case 7: /* IEPSR */
4772 return xpsr_read(env) & 0x0700edff;
4773 case 8: /* MSP */
4774 return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
4775 case 9: /* PSP */
4776 return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
4777 case 16: /* PRIMASK */
4778 return (env->daif & PSTATE_I) != 0;
4779 case 17: /* BASEPRI */
4780 case 18: /* BASEPRI_MAX */
4781 return env->v7m.basepri;
4782 case 19: /* FAULTMASK */
4783 return (env->daif & PSTATE_F) != 0;
4784 case 20: /* CONTROL */
4785 return env->v7m.control;
4786 default:
4787 /* ??? For debugging only. */
4788 cpu_abort(CPU(cpu), "Unimplemented system register read (%d)\n", reg);
4789 return 0;
4790 }
4791 }
4792
4793 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
4794 {
4795 ARMCPU *cpu = arm_env_get_cpu(env);
4796
4797 switch (reg) {
4798 case 0: /* APSR */
4799 xpsr_write(env, val, 0xf8000000);
4800 break;
4801 case 1: /* IAPSR */
4802 xpsr_write(env, val, 0xf8000000);
4803 break;
4804 case 2: /* EAPSR */
4805 xpsr_write(env, val, 0xfe00fc00);
4806 break;
4807 case 3: /* xPSR */
4808 xpsr_write(env, val, 0xfe00fc00);
4809 break;
4810 case 5: /* IPSR */
4811 /* IPSR bits are readonly. */
4812 break;
4813 case 6: /* EPSR */
4814 xpsr_write(env, val, 0x0600fc00);
4815 break;
4816 case 7: /* IEPSR */
4817 xpsr_write(env, val, 0x0600fc00);
4818 break;
4819 case 8: /* MSP */
4820 if (env->v7m.current_sp)
4821 env->v7m.other_sp = val;
4822 else
4823 env->regs[13] = val;
4824 break;
4825 case 9: /* PSP */
4826 if (env->v7m.current_sp)
4827 env->regs[13] = val;
4828 else
4829 env->v7m.other_sp = val;
4830 break;
4831 case 16: /* PRIMASK */
4832 if (val & 1) {
4833 env->daif |= PSTATE_I;
4834 } else {
4835 env->daif &= ~PSTATE_I;
4836 }
4837 break;
4838 case 17: /* BASEPRI */
4839 env->v7m.basepri = val & 0xff;
4840 break;
4841 case 18: /* BASEPRI_MAX */
4842 val &= 0xff;
4843 if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
4844 env->v7m.basepri = val;
4845 break;
4846 case 19: /* FAULTMASK */
4847 if (val & 1) {
4848 env->daif |= PSTATE_F;
4849 } else {
4850 env->daif &= ~PSTATE_F;
4851 }
4852 break;
4853 case 20: /* CONTROL */
4854 env->v7m.control = val & 3;
4855 switch_v7m_sp(env, (val & 2) != 0);
4856 break;
4857 default:
4858 /* ??? For debugging only. */
4859 cpu_abort(CPU(cpu), "Unimplemented system register write (%d)\n", reg);
4860 return;
4861 }
4862 }
4863
4864 #endif
4865
4866 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
4867 {
4868 /* Implement DC ZVA, which zeroes a fixed-length block of memory.
4869 * Note that we do not implement the (architecturally mandated)
4870 * alignment fault for attempts to use this on Device memory
4871 * (which matches the usual QEMU behaviour of not implementing either
4872 * alignment faults or any memory attribute handling).
4873 */
4874
4875 ARMCPU *cpu = arm_env_get_cpu(env);
4876 uint64_t blocklen = 4 << cpu->dcz_blocksize;
4877 uint64_t vaddr = vaddr_in & ~(blocklen - 1);
4878
4879 #ifndef CONFIG_USER_ONLY
4880 {
4881 /* Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than
4882 * the block size so we might have to do more than one TLB lookup.
4883 * We know that in fact for any v8 CPU the page size is at least 4K
4884 * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
4885 * 1K as an artefact of legacy v5 subpage support being present in the
4886 * same QEMU executable.
4887 */
4888 int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
4889 void *hostaddr[maxidx];
4890 int try, i;
4891
4892 for (try = 0; try < 2; try++) {
4893
4894 for (i = 0; i < maxidx; i++) {
4895 hostaddr[i] = tlb_vaddr_to_host(env,
4896 vaddr + TARGET_PAGE_SIZE * i,
4897 1, cpu_mmu_index(env));
4898 if (!hostaddr[i]) {
4899 break;
4900 }
4901 }
4902 if (i == maxidx) {
4903 /* If it's all in the TLB it's fair game for just writing to;
4904 * we know we don't need to update dirty status, etc.
4905 */
4906 for (i = 0; i < maxidx - 1; i++) {
4907 memset(hostaddr[i], 0, TARGET_PAGE_SIZE);
4908 }
4909 memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE));
4910 return;
4911 }
4912 /* OK, try a store and see if we can populate the tlb. This
4913 * might cause an exception if the memory isn't writable,
4914 * in which case we will longjmp out of here. We must for
4915 * this purpose use the actual register value passed to us
4916 * so that we get the fault address right.
4917 */
4918 helper_ret_stb_mmu(env, vaddr_in, 0, cpu_mmu_index(env), GETRA());
4919 /* Now we can populate the other TLB entries, if any */
4920 for (i = 0; i < maxidx; i++) {
4921 uint64_t va = vaddr + TARGET_PAGE_SIZE * i;
4922 if (va != (vaddr_in & TARGET_PAGE_MASK)) {
4923 helper_ret_stb_mmu(env, va, 0, cpu_mmu_index(env), GETRA());
4924 }
4925 }
4926 }
4927
4928 /* Slow path (probably attempt to do this to an I/O device or
4929 * similar, or clearing of a block of code we have translations
4930 * cached for). Just do a series of byte writes as the architecture
4931 * demands. It's not worth trying to use a cpu_physical_memory_map(),
4932 * memset(), unmap() sequence here because:
4933 * + we'd need to account for the blocksize being larger than a page
4934 * + the direct-RAM access case is almost always going to be dealt
4935 * with in the fastpath code above, so there's no speed benefit
4936 * + we would have to deal with the map returning NULL because the
4937 * bounce buffer was in use
4938 */
4939 for (i = 0; i < blocklen; i++) {
4940 helper_ret_stb_mmu(env, vaddr + i, 0, cpu_mmu_index(env), GETRA());
4941 }
4942 }
4943 #else
4944 memset(g2h(vaddr), 0, blocklen);
4945 #endif
4946 }
4947
4948 /* Note that signed overflow is undefined in C. The following routines are
4949 careful to use unsigned types where modulo arithmetic is required.
4950 Failure to do so _will_ break on newer gcc. */
4951
4952 /* Signed saturating arithmetic. */
4953
4954 /* Perform 16-bit signed saturating addition. */
4955 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
4956 {
4957 uint16_t res;
4958
4959 res = a + b;
4960 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
4961 if (a & 0x8000)
4962 res = 0x8000;
4963 else
4964 res = 0x7fff;
4965 }
4966 return res;
4967 }
4968
4969 /* Perform 8-bit signed saturating addition. */
4970 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
4971 {
4972 uint8_t res;
4973
4974 res = a + b;
4975 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
4976 if (a & 0x80)
4977 res = 0x80;
4978 else
4979 res = 0x7f;
4980 }
4981 return res;
4982 }
4983
4984 /* Perform 16-bit signed saturating subtraction. */
4985 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
4986 {
4987 uint16_t res;
4988
4989 res = a - b;
4990 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
4991 if (a & 0x8000)
4992 res = 0x8000;
4993 else
4994 res = 0x7fff;
4995 }
4996 return res;
4997 }
4998
4999 /* Perform 8-bit signed saturating subtraction. */
5000 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
5001 {
5002 uint8_t res;
5003
5004 res = a - b;
5005 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
5006 if (a & 0x80)
5007 res = 0x80;
5008 else
5009 res = 0x7f;
5010 }
5011 return res;
5012 }
5013
5014 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
5015 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
5016 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8);
5017 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8);
5018 #define PFX q
5019
5020 #include "op_addsub.h"
5021
5022 /* Unsigned saturating arithmetic. */
5023 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
5024 {
5025 uint16_t res;
5026 res = a + b;
5027 if (res < a)
5028 res = 0xffff;
5029 return res;
5030 }
5031
5032 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
5033 {
5034 if (a > b)
5035 return a - b;
5036 else
5037 return 0;
5038 }
5039
5040 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
5041 {
5042 uint8_t res;
5043 res = a + b;
5044 if (res < a)
5045 res = 0xff;
5046 return res;
5047 }
5048
5049 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
5050 {
5051 if (a > b)
5052 return a - b;
5053 else
5054 return 0;
5055 }
5056
5057 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
5058 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
5059 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8);
5060 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8);
5061 #define PFX uq
5062
5063 #include "op_addsub.h"
5064
5065 /* Signed modulo arithmetic. */
5066 #define SARITH16(a, b, n, op) do { \
5067 int32_t sum; \
5068 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
5069 RESULT(sum, n, 16); \
5070 if (sum >= 0) \
5071 ge |= 3 << (n * 2); \
5072 } while(0)
5073
5074 #define SARITH8(a, b, n, op) do { \
5075 int32_t sum; \
5076 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
5077 RESULT(sum, n, 8); \
5078 if (sum >= 0) \
5079 ge |= 1 << n; \
5080 } while(0)
5081
5082
5083 #define ADD16(a, b, n) SARITH16(a, b, n, +)
5084 #define SUB16(a, b, n) SARITH16(a, b, n, -)
5085 #define ADD8(a, b, n) SARITH8(a, b, n, +)
5086 #define SUB8(a, b, n) SARITH8(a, b, n, -)
5087 #define PFX s
5088 #define ARITH_GE
5089
5090 #include "op_addsub.h"
5091
5092 /* Unsigned modulo arithmetic. */
5093 #define ADD16(a, b, n) do { \
5094 uint32_t sum; \
5095 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
5096 RESULT(sum, n, 16); \
5097 if ((sum >> 16) == 1) \
5098 ge |= 3 << (n * 2); \
5099 } while(0)
5100
5101 #define ADD8(a, b, n) do { \
5102 uint32_t sum; \
5103 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
5104 RESULT(sum, n, 8); \
5105 if ((sum >> 8) == 1) \
5106 ge |= 1 << n; \
5107 } while(0)
5108
5109 #define SUB16(a, b, n) do { \
5110 uint32_t sum; \
5111 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
5112 RESULT(sum, n, 16); \
5113 if ((sum >> 16) == 0) \
5114 ge |= 3 << (n * 2); \
5115 } while(0)
5116
5117 #define SUB8(a, b, n) do { \
5118 uint32_t sum; \
5119 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
5120 RESULT(sum, n, 8); \
5121 if ((sum >> 8) == 0) \
5122 ge |= 1 << n; \
5123 } while(0)
5124
5125 #define PFX u
5126 #define ARITH_GE
5127
5128 #include "op_addsub.h"
5129
5130 /* Halved signed arithmetic. */
5131 #define ADD16(a, b, n) \
5132 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
5133 #define SUB16(a, b, n) \
5134 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
5135 #define ADD8(a, b, n) \
5136 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
5137 #define SUB8(a, b, n) \
5138 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
5139 #define PFX sh
5140
5141 #include "op_addsub.h"
5142
5143 /* Halved unsigned arithmetic. */
5144 #define ADD16(a, b, n) \
5145 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
5146 #define SUB16(a, b, n) \
5147 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
5148 #define ADD8(a, b, n) \
5149 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
5150 #define SUB8(a, b, n) \
5151 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
5152 #define PFX uh
5153
5154 #include "op_addsub.h"
5155
5156 static inline uint8_t do_usad(uint8_t a, uint8_t b)
5157 {
5158 if (a > b)
5159 return a - b;
5160 else
5161 return b - a;
5162 }
5163
5164 /* Unsigned sum of absolute byte differences. */
5165 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
5166 {
5167 uint32_t sum;
5168 sum = do_usad(a, b);
5169 sum += do_usad(a >> 8, b >> 8);
5170 sum += do_usad(a >> 16, b >>16);
5171 sum += do_usad(a >> 24, b >> 24);
5172 return sum;
5173 }
5174
5175 /* For ARMv6 SEL instruction. */
5176 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
5177 {
5178 uint32_t mask;
5179
5180 mask = 0;
5181 if (flags & 1)
5182 mask |= 0xff;
5183 if (flags & 2)
5184 mask |= 0xff00;
5185 if (flags & 4)
5186 mask |= 0xff0000;
5187 if (flags & 8)
5188 mask |= 0xff000000;
5189 return (a & mask) | (b & ~mask);
5190 }
5191
5192 /* VFP support. We follow the convention used for VFP instructions:
5193 Single precision routines have a "s" suffix, double precision a
5194 "d" suffix. */
5195
5196 /* Convert host exception flags to vfp form. */
5197 static inline int vfp_exceptbits_from_host(int host_bits)
5198 {
5199 int target_bits = 0;
5200
5201 if (host_bits & float_flag_invalid)
5202 target_bits |= 1;
5203 if (host_bits & float_flag_divbyzero)
5204 target_bits |= 2;
5205 if (host_bits & float_flag_overflow)
5206 target_bits |= 4;
5207 if (host_bits & (float_flag_underflow | float_flag_output_denormal))
5208 target_bits |= 8;
5209 if (host_bits & float_flag_inexact)
5210 target_bits |= 0x10;
5211 if (host_bits & float_flag_input_denormal)
5212 target_bits |= 0x80;
5213 return target_bits;
5214 }
5215
5216 uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
5217 {
5218 int i;
5219 uint32_t fpscr;
5220
5221 fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
5222 | (env->vfp.vec_len << 16)
5223 | (env->vfp.vec_stride << 20);
5224 i = get_float_exception_flags(&env->vfp.fp_status);
5225 i |= get_float_exception_flags(&env->vfp.standard_fp_status);
5226 fpscr |= vfp_exceptbits_from_host(i);
5227 return fpscr;
5228 }
5229
5230 uint32_t vfp_get_fpscr(CPUARMState *env)
5231 {
5232 return HELPER(vfp_get_fpscr)(env);
5233 }
5234
5235 /* Convert vfp exception flags to target form. */
5236 static inline int vfp_exceptbits_to_host(int target_bits)
5237 {
5238 int host_bits = 0;
5239
5240 if (target_bits & 1)
5241 host_bits |= float_flag_invalid;
5242 if (target_bits & 2)
5243 host_bits |= float_flag_divbyzero;
5244 if (target_bits & 4)
5245 host_bits |= float_flag_overflow;
5246 if (target_bits & 8)
5247 host_bits |= float_flag_underflow;
5248 if (target_bits & 0x10)
5249 host_bits |= float_flag_inexact;
5250 if (target_bits & 0x80)
5251 host_bits |= float_flag_input_denormal;
5252 return host_bits;
5253 }
5254
5255 void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
5256 {
5257 int i;
5258 uint32_t changed;
5259
5260 changed = env->vfp.xregs[ARM_VFP_FPSCR];
5261 env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
5262 env->vfp.vec_len = (val >> 16) & 7;
5263 env->vfp.vec_stride = (val >> 20) & 3;
5264
5265 changed ^= val;
5266 if (changed & (3 << 22)) {
5267 i = (val >> 22) & 3;
5268 switch (i) {
5269 case FPROUNDING_TIEEVEN:
5270 i = float_round_nearest_even;
5271 break;
5272 case FPROUNDING_POSINF:
5273 i = float_round_up;
5274 break;
5275 case FPROUNDING_NEGINF:
5276 i = float_round_down;
5277 break;
5278 case FPROUNDING_ZERO:
5279 i = float_round_to_zero;
5280 break;
5281 }
5282 set_float_rounding_mode(i, &env->vfp.fp_status);
5283 }
5284 if (changed & (1 << 24)) {
5285 set_flush_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
5286 set_flush_inputs_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
5287 }
5288 if (changed & (1 << 25))
5289 set_default_nan_mode((val & (1 << 25)) != 0, &env->vfp.fp_status);
5290
5291 i = vfp_exceptbits_to_host(val);
5292 set_float_exception_flags(i, &env->vfp.fp_status);
5293 set_float_exception_flags(0, &env->vfp.standard_fp_status);
5294 }
5295
5296 void vfp_set_fpscr(CPUARMState *env, uint32_t val)
5297 {
5298 HELPER(vfp_set_fpscr)(env, val);
5299 }
5300
5301 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
5302
5303 #define VFP_BINOP(name) \
5304 float32 VFP_HELPER(name, s)(float32 a, float32 b, void *fpstp) \
5305 { \
5306 float_status *fpst = fpstp; \
5307 return float32_ ## name(a, b, fpst); \
5308 } \
5309 float64 VFP_HELPER(name, d)(float64 a, float64 b, void *fpstp) \
5310 { \
5311 float_status *fpst = fpstp; \
5312 return float64_ ## name(a, b, fpst); \
5313 }
5314 VFP_BINOP(add)
5315 VFP_BINOP(sub)
5316 VFP_BINOP(mul)
5317 VFP_BINOP(div)
5318 VFP_BINOP(min)
5319 VFP_BINOP(max)
5320 VFP_BINOP(minnum)
5321 VFP_BINOP(maxnum)
5322 #undef VFP_BINOP
5323
5324 float32 VFP_HELPER(neg, s)(float32 a)
5325 {
5326 return float32_chs(a);
5327 }
5328
5329 float64 VFP_HELPER(neg, d)(float64 a)
5330 {
5331 return float64_chs(a);
5332 }
5333
5334 float32 VFP_HELPER(abs, s)(float32 a)
5335 {
5336 return float32_abs(a);
5337 }
5338
5339 float64 VFP_HELPER(abs, d)(float64 a)
5340 {
5341 return float64_abs(a);
5342 }
5343
5344 float32 VFP_HELPER(sqrt, s)(float32 a, CPUARMState *env)
5345 {
5346 return float32_sqrt(a, &env->vfp.fp_status);
5347 }
5348
5349 float64 VFP_HELPER(sqrt, d)(float64 a, CPUARMState *env)
5350 {
5351 return float64_sqrt(a, &env->vfp.fp_status);
5352 }
5353
5354 /* XXX: check quiet/signaling case */
5355 #define DO_VFP_cmp(p, type) \
5356 void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env) \
5357 { \
5358 uint32_t flags; \
5359 switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
5360 case 0: flags = 0x6; break; \
5361 case -1: flags = 0x8; break; \
5362 case 1: flags = 0x2; break; \
5363 default: case 2: flags = 0x3; break; \
5364 } \
5365 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
5366 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
5367 } \
5368 void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \
5369 { \
5370 uint32_t flags; \
5371 switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
5372 case 0: flags = 0x6; break; \
5373 case -1: flags = 0x8; break; \
5374 case 1: flags = 0x2; break; \
5375 default: case 2: flags = 0x3; break; \
5376 } \
5377 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
5378 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
5379 }
5380 DO_VFP_cmp(s, float32)
5381 DO_VFP_cmp(d, float64)
5382 #undef DO_VFP_cmp
5383
5384 /* Integer to float and float to integer conversions */
5385
5386 #define CONV_ITOF(name, fsz, sign) \
5387 float##fsz HELPER(name)(uint32_t x, void *fpstp) \
5388 { \
5389 float_status *fpst = fpstp; \
5390 return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \
5391 }
5392
5393 #define CONV_FTOI(name, fsz, sign, round) \
5394 uint32_t HELPER(name)(float##fsz x, void *fpstp) \
5395 { \
5396 float_status *fpst = fpstp; \
5397 if (float##fsz##_is_any_nan(x)) { \
5398 float_raise(float_flag_invalid, fpst); \
5399 return 0; \
5400 } \
5401 return float##fsz##_to_##sign##int32##round(x, fpst); \
5402 }
5403
5404 #define FLOAT_CONVS(name, p, fsz, sign) \
5405 CONV_ITOF(vfp_##name##to##p, fsz, sign) \
5406 CONV_FTOI(vfp_to##name##p, fsz, sign, ) \
5407 CONV_FTOI(vfp_to##name##z##p, fsz, sign, _round_to_zero)
5408
5409 FLOAT_CONVS(si, s, 32, )
5410 FLOAT_CONVS(si, d, 64, )
5411 FLOAT_CONVS(ui, s, 32, u)
5412 FLOAT_CONVS(ui, d, 64, u)
5413
5414 #undef CONV_ITOF
5415 #undef CONV_FTOI
5416 #undef FLOAT_CONVS
5417
5418 /* floating point conversion */
5419 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUARMState *env)
5420 {
5421 float64 r = float32_to_float64(x, &env->vfp.fp_status);
5422 /* ARM requires that S<->D conversion of any kind of NaN generates
5423 * a quiet NaN by forcing the most significant frac bit to 1.
5424 */
5425 return float64_maybe_silence_nan(r);
5426 }
5427
5428 float32 VFP_HELPER(fcvts, d)(float64 x, CPUARMState *env)
5429 {
5430 float32 r = float64_to_float32(x, &env->vfp.fp_status);
5431 /* ARM requires that S<->D conversion of any kind of NaN generates
5432 * a quiet NaN by forcing the most significant frac bit to 1.
5433 */
5434 return float32_maybe_silence_nan(r);
5435 }
5436
5437 /* VFP3 fixed point conversion. */
5438 #define VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
5439 float##fsz HELPER(vfp_##name##to##p)(uint##isz##_t x, uint32_t shift, \
5440 void *fpstp) \
5441 { \
5442 float_status *fpst = fpstp; \
5443 float##fsz tmp; \
5444 tmp = itype##_to_##float##fsz(x, fpst); \
5445 return float##fsz##_scalbn(tmp, -(int)shift, fpst); \
5446 }
5447
5448 /* Notice that we want only input-denormal exception flags from the
5449 * scalbn operation: the other possible flags (overflow+inexact if
5450 * we overflow to infinity, output-denormal) aren't correct for the
5451 * complete scale-and-convert operation.
5452 */
5453 #define VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, round) \
5454 uint##isz##_t HELPER(vfp_to##name##p##round)(float##fsz x, \
5455 uint32_t shift, \
5456 void *fpstp) \
5457 { \
5458 float_status *fpst = fpstp; \
5459 int old_exc_flags = get_float_exception_flags(fpst); \
5460 float##fsz tmp; \
5461 if (float##fsz##_is_any_nan(x)) { \
5462 float_raise(float_flag_invalid, fpst); \
5463 return 0; \
5464 } \
5465 tmp = float##fsz##_scalbn(x, shift, fpst); \
5466 old_exc_flags |= get_float_exception_flags(fpst) \
5467 & float_flag_input_denormal; \
5468 set_float_exception_flags(old_exc_flags, fpst); \
5469 return float##fsz##_to_##itype##round(tmp, fpst); \
5470 }
5471
5472 #define VFP_CONV_FIX(name, p, fsz, isz, itype) \
5473 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
5474 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, _round_to_zero) \
5475 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
5476
5477 #define VFP_CONV_FIX_A64(name, p, fsz, isz, itype) \
5478 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
5479 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
5480
5481 VFP_CONV_FIX(sh, d, 64, 64, int16)
5482 VFP_CONV_FIX(sl, d, 64, 64, int32)
5483 VFP_CONV_FIX_A64(sq, d, 64, 64, int64)
5484 VFP_CONV_FIX(uh, d, 64, 64, uint16)
5485 VFP_CONV_FIX(ul, d, 64, 64, uint32)
5486 VFP_CONV_FIX_A64(uq, d, 64, 64, uint64)
5487 VFP_CONV_FIX(sh, s, 32, 32, int16)
5488 VFP_CONV_FIX(sl, s, 32, 32, int32)
5489 VFP_CONV_FIX_A64(sq, s, 32, 64, int64)
5490 VFP_CONV_FIX(uh, s, 32, 32, uint16)
5491 VFP_CONV_FIX(ul, s, 32, 32, uint32)
5492 VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
5493 #undef VFP_CONV_FIX
5494 #undef VFP_CONV_FIX_FLOAT
5495 #undef VFP_CONV_FLOAT_FIX_ROUND
5496
5497 /* Set the current fp rounding mode and return the old one.
5498 * The argument is a softfloat float_round_ value.
5499 */
5500 uint32_t HELPER(set_rmode)(uint32_t rmode, CPUARMState *env)
5501 {
5502 float_status *fp_status = &env->vfp.fp_status;
5503
5504 uint32_t prev_rmode = get_float_rounding_mode(fp_status);
5505 set_float_rounding_mode(rmode, fp_status);
5506
5507 return prev_rmode;
5508 }
5509
5510 /* Set the current fp rounding mode in the standard fp status and return
5511 * the old one. This is for NEON instructions that need to change the
5512 * rounding mode but wish to use the standard FPSCR values for everything
5513 * else. Always set the rounding mode back to the correct value after
5514 * modifying it.
5515 * The argument is a softfloat float_round_ value.
5516 */
5517 uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env)
5518 {
5519 float_status *fp_status = &env->vfp.standard_fp_status;
5520
5521 uint32_t prev_rmode = get_float_rounding_mode(fp_status);
5522 set_float_rounding_mode(rmode, fp_status);
5523
5524 return prev_rmode;
5525 }
5526
5527 /* Half precision conversions. */
5528 static float32 do_fcvt_f16_to_f32(uint32_t a, CPUARMState *env, float_status *s)
5529 {
5530 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
5531 float32 r = float16_to_float32(make_float16(a), ieee, s);
5532 if (ieee) {
5533 return float32_maybe_silence_nan(r);
5534 }
5535 return r;
5536 }
5537
5538 static uint32_t do_fcvt_f32_to_f16(float32 a, CPUARMState *env, float_status *s)
5539 {
5540 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
5541 float16 r = float32_to_float16(a, ieee, s);
5542 if (ieee) {
5543 r = float16_maybe_silence_nan(r);
5544 }
5545 return float16_val(r);
5546 }
5547
5548 float32 HELPER(neon_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)
5549 {
5550 return do_fcvt_f16_to_f32(a, env, &env->vfp.standard_fp_status);
5551 }
5552
5553 uint32_t HELPER(neon_fcvt_f32_to_f16)(float32 a, CPUARMState *env)
5554 {
5555 return do_fcvt_f32_to_f16(a, env, &env->vfp.standard_fp_status);
5556 }
5557
5558 float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)
5559 {
5560 return do_fcvt_f16_to_f32(a, env, &env->vfp.fp_status);
5561 }
5562
5563 uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, CPUARMState *env)
5564 {
5565 return do_fcvt_f32_to_f16(a, env, &env->vfp.fp_status);
5566 }
5567
5568 float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, CPUARMState *env)
5569 {
5570 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
5571 float64 r = float16_to_float64(make_float16(a), ieee, &env->vfp.fp_status);
5572 if (ieee) {
5573 return float64_maybe_silence_nan(r);
5574 }
5575 return r;
5576 }
5577
5578 uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, CPUARMState *env)
5579 {
5580 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
5581 float16 r = float64_to_float16(a, ieee, &env->vfp.fp_status);
5582 if (ieee) {
5583 r = float16_maybe_silence_nan(r);
5584 }
5585 return float16_val(r);
5586 }
5587
5588 #define float32_two make_float32(0x40000000)
5589 #define float32_three make_float32(0x40400000)
5590 #define float32_one_point_five make_float32(0x3fc00000)
5591
5592 float32 HELPER(recps_f32)(float32 a, float32 b, CPUARMState *env)
5593 {
5594 float_status *s = &env->vfp.standard_fp_status;
5595 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
5596 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
5597 if (!(float32_is_zero(a) || float32_is_zero(b))) {
5598 float_raise(float_flag_input_denormal, s);
5599 }
5600 return float32_two;
5601 }
5602 return float32_sub(float32_two, float32_mul(a, b, s), s);
5603 }
5604
5605 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUARMState *env)
5606 {
5607 float_status *s = &env->vfp.standard_fp_status;
5608 float32 product;
5609 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
5610 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
5611 if (!(float32_is_zero(a) || float32_is_zero(b))) {
5612 float_raise(float_flag_input_denormal, s);
5613 }
5614 return float32_one_point_five;
5615 }
5616 product = float32_mul(a, b, s);
5617 return float32_div(float32_sub(float32_three, product, s), float32_two, s);
5618 }
5619
5620 /* NEON helpers. */
5621
5622 /* Constants 256 and 512 are used in some helpers; we avoid relying on
5623 * int->float conversions at run-time. */
5624 #define float64_256 make_float64(0x4070000000000000LL)
5625 #define float64_512 make_float64(0x4080000000000000LL)
5626 #define float32_maxnorm make_float32(0x7f7fffff)
5627 #define float64_maxnorm make_float64(0x7fefffffffffffffLL)
5628
5629 /* Reciprocal functions
5630 *
5631 * The algorithm that must be used to calculate the estimate
5632 * is specified by the ARM ARM, see FPRecipEstimate()
5633 */
5634
5635 static float64 recip_estimate(float64 a, float_status *real_fp_status)
5636 {
5637 /* These calculations mustn't set any fp exception flags,
5638 * so we use a local copy of the fp_status.
5639 */
5640 float_status dummy_status = *real_fp_status;
5641 float_status *s = &dummy_status;
5642 /* q = (int)(a * 512.0) */
5643 float64 q = float64_mul(float64_512, a, s);
5644 int64_t q_int = float64_to_int64_round_to_zero(q, s);
5645
5646 /* r = 1.0 / (((double)q + 0.5) / 512.0) */
5647 q = int64_to_float64(q_int, s);
5648 q = float64_add(q, float64_half, s);
5649 q = float64_div(q, float64_512, s);
5650 q = float64_div(float64_one, q, s);
5651
5652 /* s = (int)(256.0 * r + 0.5) */
5653 q = float64_mul(q, float64_256, s);
5654 q = float64_add(q, float64_half, s);
5655 q_int = float64_to_int64_round_to_zero(q, s);
5656
5657 /* return (double)s / 256.0 */
5658 return float64_div(int64_to_float64(q_int, s), float64_256, s);
5659 }
5660
5661 /* Common wrapper to call recip_estimate */
5662 static float64 call_recip_estimate(float64 num, int off, float_status *fpst)
5663 {
5664 uint64_t val64 = float64_val(num);
5665 uint64_t frac = extract64(val64, 0, 52);
5666 int64_t exp = extract64(val64, 52, 11);
5667 uint64_t sbit;
5668 float64 scaled, estimate;
5669
5670 /* Generate the scaled number for the estimate function */
5671 if (exp == 0) {
5672 if (extract64(frac, 51, 1) == 0) {
5673 exp = -1;
5674 frac = extract64(frac, 0, 50) << 2;
5675 } else {
5676 frac = extract64(frac, 0, 51) << 1;
5677 }
5678 }
5679
5680 /* scaled = '0' : '01111111110' : fraction<51:44> : Zeros(44); */
5681 scaled = make_float64((0x3feULL << 52)
5682 | extract64(frac, 44, 8) << 44);
5683
5684 estimate = recip_estimate(scaled, fpst);
5685
5686 /* Build new result */
5687 val64 = float64_val(estimate);
5688 sbit = 0x8000000000000000ULL & val64;
5689 exp = off - exp;
5690 frac = extract64(val64, 0, 52);
5691
5692 if (exp == 0) {
5693 frac = 1ULL << 51 | extract64(frac, 1, 51);
5694 } else if (exp == -1) {
5695 frac = 1ULL << 50 | extract64(frac, 2, 50);
5696 exp = 0;
5697 }
5698
5699 return make_float64(sbit | (exp << 52) | frac);
5700 }
5701
5702 static bool round_to_inf(float_status *fpst, bool sign_bit)
5703 {
5704 switch (fpst->float_rounding_mode) {
5705 case float_round_nearest_even: /* Round to Nearest */
5706 return true;
5707 case float_round_up: /* Round to +Inf */
5708 return !sign_bit;
5709 case float_round_down: /* Round to -Inf */
5710 return sign_bit;
5711 case float_round_to_zero: /* Round to Zero */
5712 return false;
5713 }
5714
5715 g_assert_not_reached();
5716 }
5717
5718 float32 HELPER(recpe_f32)(float32 input, void *fpstp)
5719 {
5720 float_status *fpst = fpstp;
5721 float32 f32 = float32_squash_input_denormal(input, fpst);
5722 uint32_t f32_val = float32_val(f32);
5723 uint32_t f32_sbit = 0x80000000ULL & f32_val;
5724 int32_t f32_exp = extract32(f32_val, 23, 8);
5725 uint32_t f32_frac = extract32(f32_val, 0, 23);
5726 float64 f64, r64;
5727 uint64_t r64_val;
5728 int64_t r64_exp;
5729 uint64_t r64_frac;
5730
5731 if (float32_is_any_nan(f32)) {
5732 float32 nan = f32;
5733 if (float32_is_signaling_nan(f32)) {
5734 float_raise(float_flag_invalid, fpst);
5735 nan = float32_maybe_silence_nan(f32);
5736 }
5737 if (fpst->default_nan_mode) {
5738 nan = float32_default_nan;
5739 }
5740 return nan;
5741 } else if (float32_is_infinity(f32)) {
5742 return float32_set_sign(float32_zero, float32_is_neg(f32));
5743 } else if (float32_is_zero(f32)) {
5744 float_raise(float_flag_divbyzero, fpst);
5745 return float32_set_sign(float32_infinity, float32_is_neg(f32));
5746 } else if ((f32_val & ~(1ULL << 31)) < (1ULL << 21)) {
5747 /* Abs(value) < 2.0^-128 */
5748 float_raise(float_flag_overflow | float_flag_inexact, fpst);
5749 if (round_to_inf(fpst, f32_sbit)) {
5750 return float32_set_sign(float32_infinity, float32_is_neg(f32));
5751 } else {
5752 return float32_set_sign(float32_maxnorm, float32_is_neg(f32));
5753 }
5754 } else if (f32_exp >= 253 && fpst->flush_to_zero) {
5755 float_raise(float_flag_underflow, fpst);
5756 return float32_set_sign(float32_zero, float32_is_neg(f32));
5757 }
5758
5759
5760 f64 = make_float64(((int64_t)(f32_exp) << 52) | (int64_t)(f32_frac) << 29);
5761 r64 = call_recip_estimate(f64, 253, fpst);
5762 r64_val = float64_val(r64);
5763 r64_exp = extract64(r64_val, 52, 11);
5764 r64_frac = extract64(r64_val, 0, 52);
5765
5766 /* result = sign : result_exp<7:0> : fraction<51:29>; */
5767 return make_float32(f32_sbit |
5768 (r64_exp & 0xff) << 23 |
5769 extract64(r64_frac, 29, 24));
5770 }
5771
5772 float64 HELPER(recpe_f64)(float64 input, void *fpstp)
5773 {
5774 float_status *fpst = fpstp;
5775 float64 f64 = float64_squash_input_denormal(input, fpst);
5776 uint64_t f64_val = float64_val(f64);
5777 uint64_t f64_sbit = 0x8000000000000000ULL & f64_val;
5778 int64_t f64_exp = extract64(f64_val, 52, 11);
5779 float64 r64;
5780 uint64_t r64_val;
5781 int64_t r64_exp;
5782 uint64_t r64_frac;
5783
5784 /* Deal with any special cases */
5785 if (float64_is_any_nan(f64)) {
5786 float64 nan = f64;
5787 if (float64_is_signaling_nan(f64)) {
5788 float_raise(float_flag_invalid, fpst);
5789 nan = float64_maybe_silence_nan(f64);
5790 }
5791 if (fpst->default_nan_mode) {
5792 nan = float64_default_nan;
5793 }
5794 return nan;
5795 } else if (float64_is_infinity(f64)) {
5796 return float64_set_sign(float64_zero, float64_is_neg(f64));
5797 } else if (float64_is_zero(f64)) {
5798 float_raise(float_flag_divbyzero, fpst);
5799 return float64_set_sign(float64_infinity, float64_is_neg(f64));
5800 } else if ((f64_val & ~(1ULL << 63)) < (1ULL << 50)) {
5801 /* Abs(value) < 2.0^-1024 */
5802 float_raise(float_flag_overflow | float_flag_inexact, fpst);
5803 if (round_to_inf(fpst, f64_sbit)) {
5804 return float64_set_sign(float64_infinity, float64_is_neg(f64));
5805 } else {
5806 return float64_set_sign(float64_maxnorm, float64_is_neg(f64));
5807 }
5808 } else if (f64_exp >= 1023 && fpst->flush_to_zero) {
5809 float_raise(float_flag_underflow, fpst);
5810 return float64_set_sign(float64_zero, float64_is_neg(f64));
5811 }
5812
5813 r64 = call_recip_estimate(f64, 2045, fpst);
5814 r64_val = float64_val(r64);
5815 r64_exp = extract64(r64_val, 52, 11);
5816 r64_frac = extract64(r64_val, 0, 52);
5817
5818 /* result = sign : result_exp<10:0> : fraction<51:0> */
5819 return make_float64(f64_sbit |
5820 ((r64_exp & 0x7ff) << 52) |
5821 r64_frac);
5822 }
5823
5824 /* The algorithm that must be used to calculate the estimate
5825 * is specified by the ARM ARM.
5826 */
5827 static float64 recip_sqrt_estimate(float64 a, float_status *real_fp_status)
5828 {
5829 /* These calculations mustn't set any fp exception flags,
5830 * so we use a local copy of the fp_status.
5831 */
5832 float_status dummy_status = *real_fp_status;
5833 float_status *s = &dummy_status;
5834 float64 q;
5835 int64_t q_int;
5836
5837 if (float64_lt(a, float64_half, s)) {
5838 /* range 0.25 <= a < 0.5 */
5839
5840 /* a in units of 1/512 rounded down */
5841 /* q0 = (int)(a * 512.0); */
5842 q = float64_mul(float64_512, a, s);
5843 q_int = float64_to_int64_round_to_zero(q, s);
5844
5845 /* reciprocal root r */
5846 /* r = 1.0 / sqrt(((double)q0 + 0.5) / 512.0); */
5847 q = int64_to_float64(q_int, s);
5848 q = float64_add(q, float64_half, s);
5849 q = float64_div(q, float64_512, s);
5850 q = float64_sqrt(q, s);
5851 q = float64_div(float64_one, q, s);
5852 } else {
5853 /* range 0.5 <= a < 1.0 */
5854
5855 /* a in units of 1/256 rounded down */
5856 /* q1 = (int)(a * 256.0); */
5857 q = float64_mul(float64_256, a, s);
5858 int64_t q_int = float64_to_int64_round_to_zero(q, s);
5859
5860 /* reciprocal root r */
5861 /* r = 1.0 /sqrt(((double)q1 + 0.5) / 256); */
5862 q = int64_to_float64(q_int, s);
5863 q = float64_add(q, float64_half, s);
5864 q = float64_div(q, float64_256, s);
5865 q = float64_sqrt(q, s);
5866 q = float64_div(float64_one, q, s);
5867 }
5868 /* r in units of 1/256 rounded to nearest */
5869 /* s = (int)(256.0 * r + 0.5); */
5870
5871 q = float64_mul(q, float64_256,s );
5872 q = float64_add(q, float64_half, s);
5873 q_int = float64_to_int64_round_to_zero(q, s);
5874
5875 /* return (double)s / 256.0;*/
5876 return float64_div(int64_to_float64(q_int, s), float64_256, s);
5877 }
5878
5879 float32 HELPER(rsqrte_f32)(float32 input, void *fpstp)
5880 {
5881 float_status *s = fpstp;
5882 float32 f32 = float32_squash_input_denormal(input, s);
5883 uint32_t val = float32_val(f32);
5884 uint32_t f32_sbit = 0x80000000 & val;
5885 int32_t f32_exp = extract32(val, 23, 8);
5886 uint32_t f32_frac = extract32(val, 0, 23);
5887 uint64_t f64_frac;
5888 uint64_t val64;
5889 int result_exp;
5890 float64 f64;
5891
5892 if (float32_is_any_nan(f32)) {
5893 float32 nan = f32;
5894 if (float32_is_signaling_nan(f32)) {
5895 float_raise(float_flag_invalid, s);
5896 nan = float32_maybe_silence_nan(f32);
5897 }
5898 if (s->default_nan_mode) {
5899 nan = float32_default_nan;
5900 }
5901 return nan;
5902 } else if (float32_is_zero(f32)) {
5903 float_raise(float_flag_divbyzero, s);
5904 return float32_set_sign(float32_infinity, float32_is_neg(f32));
5905 } else if (float32_is_neg(f32)) {
5906 float_raise(float_flag_invalid, s);
5907 return float32_default_nan;
5908 } else if (float32_is_infinity(f32)) {
5909 return float32_zero;
5910 }
5911
5912 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
5913 * preserving the parity of the exponent. */
5914
5915 f64_frac = ((uint64_t) f32_frac) << 29;
5916 if (f32_exp == 0) {
5917 while (extract64(f64_frac, 51, 1) == 0) {
5918 f64_frac = f64_frac << 1;
5919 f32_exp = f32_exp-1;
5920 }
5921 f64_frac = extract64(f64_frac, 0, 51) << 1;
5922 }
5923
5924 if (extract64(f32_exp, 0, 1) == 0) {
5925 f64 = make_float64(((uint64_t) f32_sbit) << 32
5926 | (0x3feULL << 52)
5927 | f64_frac);
5928 } else {
5929 f64 = make_float64(((uint64_t) f32_sbit) << 32
5930 | (0x3fdULL << 52)
5931 | f64_frac);
5932 }
5933
5934 result_exp = (380 - f32_exp) / 2;
5935
5936 f64 = recip_sqrt_estimate(f64, s);
5937
5938 val64 = float64_val(f64);
5939
5940 val = ((result_exp & 0xff) << 23)
5941 | ((val64 >> 29) & 0x7fffff);
5942 return make_float32(val);
5943 }
5944
5945 float64 HELPER(rsqrte_f64)(float64 input, void *fpstp)
5946 {
5947 float_status *s = fpstp;
5948 float64 f64 = float64_squash_input_denormal(input, s);
5949 uint64_t val = float64_val(f64);
5950 uint64_t f64_sbit = 0x8000000000000000ULL & val;
5951 int64_t f64_exp = extract64(val, 52, 11);
5952 uint64_t f64_frac = extract64(val, 0, 52);
5953 int64_t result_exp;
5954 uint64_t result_frac;
5955
5956 if (float64_is_any_nan(f64)) {
5957 float64 nan = f64;
5958 if (float64_is_signaling_nan(f64)) {
5959 float_raise(float_flag_invalid, s);
5960 nan = float64_maybe_silence_nan(f64);
5961 }
5962 if (s->default_nan_mode) {
5963 nan = float64_default_nan;
5964 }
5965 return nan;
5966 } else if (float64_is_zero(f64)) {
5967 float_raise(float_flag_divbyzero, s);
5968 return float64_set_sign(float64_infinity, float64_is_neg(f64));
5969 } else if (float64_is_neg(f64)) {
5970 float_raise(float_flag_invalid, s);
5971 return float64_default_nan;
5972 } else if (float64_is_infinity(f64)) {
5973 return float64_zero;
5974 }
5975
5976 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
5977 * preserving the parity of the exponent. */
5978
5979 if (f64_exp == 0) {
5980 while (extract64(f64_frac, 51, 1) == 0) {
5981 f64_frac = f64_frac << 1;
5982 f64_exp = f64_exp - 1;
5983 }
5984 f64_frac = extract64(f64_frac, 0, 51) << 1;
5985 }
5986
5987 if (extract64(f64_exp, 0, 1) == 0) {
5988 f64 = make_float64(f64_sbit
5989 | (0x3feULL << 52)
5990 | f64_frac);
5991 } else {
5992 f64 = make_float64(f64_sbit
5993 | (0x3fdULL << 52)
5994 | f64_frac);
5995 }
5996
5997 result_exp = (3068 - f64_exp) / 2;
5998
5999 f64 = recip_sqrt_estimate(f64, s);
6000
6001 result_frac = extract64(float64_val(f64), 0, 52);
6002
6003 return make_float64(f64_sbit |
6004 ((result_exp & 0x7ff) << 52) |
6005 result_frac);
6006 }
6007
6008 uint32_t HELPER(recpe_u32)(uint32_t a, void *fpstp)
6009 {
6010 float_status *s = fpstp;
6011 float64 f64;
6012
6013 if ((a & 0x80000000) == 0) {
6014 return 0xffffffff;
6015 }
6016
6017 f64 = make_float64((0x3feULL << 52)
6018 | ((int64_t)(a & 0x7fffffff) << 21));
6019
6020 f64 = recip_estimate(f64, s);
6021
6022 return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
6023 }
6024
6025 uint32_t HELPER(rsqrte_u32)(uint32_t a, void *fpstp)
6026 {
6027 float_status *fpst = fpstp;
6028 float64 f64;
6029
6030 if ((a & 0xc0000000) == 0) {
6031 return 0xffffffff;
6032 }
6033
6034 if (a & 0x80000000) {
6035 f64 = make_float64((0x3feULL << 52)
6036 | ((uint64_t)(a & 0x7fffffff) << 21));
6037 } else { /* bits 31-30 == '01' */
6038 f64 = make_float64((0x3fdULL << 52)
6039 | ((uint64_t)(a & 0x3fffffff) << 22));
6040 }
6041
6042 f64 = recip_sqrt_estimate(f64, fpst);
6043
6044 return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
6045 }
6046
6047 /* VFPv4 fused multiply-accumulate */
6048 float32 VFP_HELPER(muladd, s)(float32 a, float32 b, float32 c, void *fpstp)
6049 {
6050 float_status *fpst = fpstp;
6051 return float32_muladd(a, b, c, 0, fpst);
6052 }
6053
6054 float64 VFP_HELPER(muladd, d)(float64 a, float64 b, float64 c, void *fpstp)
6055 {
6056 float_status *fpst = fpstp;
6057 return float64_muladd(a, b, c, 0, fpst);
6058 }
6059
6060 /* ARMv8 round to integral */
6061 float32 HELPER(rints_exact)(float32 x, void *fp_status)
6062 {
6063 return float32_round_to_int(x, fp_status);
6064 }
6065
6066 float64 HELPER(rintd_exact)(float64 x, void *fp_status)
6067 {
6068 return float64_round_to_int(x, fp_status);
6069 }
6070
6071 float32 HELPER(rints)(float32 x, void *fp_status)
6072 {
6073 int old_flags = get_float_exception_flags(fp_status), new_flags;
6074 float32 ret;
6075
6076 ret = float32_round_to_int(x, fp_status);
6077
6078 /* Suppress any inexact exceptions the conversion produced */
6079 if (!(old_flags & float_flag_inexact)) {
6080 new_flags = get_float_exception_flags(fp_status);
6081 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
6082 }
6083
6084 return ret;
6085 }
6086
6087 float64 HELPER(rintd)(float64 x, void *fp_status)
6088 {
6089 int old_flags = get_float_exception_flags(fp_status), new_flags;
6090 float64 ret;
6091
6092 ret = float64_round_to_int(x, fp_status);
6093
6094 new_flags = get_float_exception_flags(fp_status);
6095
6096 /* Suppress any inexact exceptions the conversion produced */
6097 if (!(old_flags & float_flag_inexact)) {
6098 new_flags = get_float_exception_flags(fp_status);
6099 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
6100 }
6101
6102 return ret;
6103 }
6104
6105 /* Convert ARM rounding mode to softfloat */
6106 int arm_rmode_to_sf(int rmode)
6107 {
6108 switch (rmode) {
6109 case FPROUNDING_TIEAWAY:
6110 rmode = float_round_ties_away;
6111 break;
6112 case FPROUNDING_ODD:
6113 /* FIXME: add support for TIEAWAY and ODD */
6114 qemu_log_mask(LOG_UNIMP, "arm: unimplemented rounding mode: %d\n",
6115 rmode);
6116 case FPROUNDING_TIEEVEN:
6117 default:
6118 rmode = float_round_nearest_even;
6119 break;
6120 case FPROUNDING_POSINF:
6121 rmode = float_round_up;
6122 break;
6123 case FPROUNDING_NEGINF:
6124 rmode = float_round_down;
6125 break;
6126 case FPROUNDING_ZERO:
6127 rmode = float_round_to_zero;
6128 break;
6129 }
6130 return rmode;
6131 }
6132
6133 /* CRC helpers.
6134 * The upper bytes of val (above the number specified by 'bytes') must have
6135 * been zeroed out by the caller.
6136 */
6137 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes)
6138 {
6139 uint8_t buf[4];
6140
6141 stl_le_p(buf, val);
6142
6143 /* zlib crc32 converts the accumulator and output to one's complement. */
6144 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff;
6145 }
6146
6147 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
6148 {
6149 uint8_t buf[4];
6150
6151 stl_le_p(buf, val);
6152
6153 /* Linux crc32c converts the output to one's complement. */
6154 return crc32c(acc, buf, bytes) ^ 0xffffffff;
6155 }
QEmu