?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
block: Add bdrv_aio_cancel_async
[qemu/ar7.git] / target-arm / helper.c
blobece967397ff2c0d533ec7e65208bac30066efc9c
1 #include "cpu.h"
2 #include "internals.h"
3 #include "exec/gdbstub.h"
4 #include "exec/helper-proto.h"
5 #include "qemu/host-utils.h"
6 #include "sysemu/arch_init.h"
7 #include "sysemu/sysemu.h"
8 #include "qemu/bitops.h"
9 #include "qemu/crc32c.h"
10 #include "exec/cpu_ldst.h"
11 #include "arm_ldst.h"
12 #include <zlib.h> /* For crc32 */
13
14 #ifndef CONFIG_USER_ONLY
15 static inline int get_phys_addr(CPUARMState *env, target_ulong address,
16 int access_type, int is_user,
17 hwaddr *phys_ptr, int *prot,
18 target_ulong *page_size);
19
20 /* Definitions for the PMCCNTR and PMCR registers */
21 #define PMCRD 0x8
22 #define PMCRC 0x4
23 #define PMCRE 0x1
24 #endif
25
26 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
27 {
28 int nregs;
29
30 /* VFP data registers are always little-endian. */
31 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
32 if (reg < nregs) {
33 stfq_le_p(buf, env->vfp.regs[reg]);
34 return 8;
35 }
36 if (arm_feature(env, ARM_FEATURE_NEON)) {
37 /* Aliases for Q regs. */
38 nregs += 16;
39 if (reg < nregs) {
40 stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
41 stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
42 return 16;
43 }
44 }
45 switch (reg - nregs) {
46 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
47 case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
48 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
49 }
50 return 0;
51 }
52
53 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
54 {
55 int nregs;
56
57 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
58 if (reg < nregs) {
59 env->vfp.regs[reg] = ldfq_le_p(buf);
60 return 8;
61 }
62 if (arm_feature(env, ARM_FEATURE_NEON)) {
63 nregs += 16;
64 if (reg < nregs) {
65 env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
66 env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
67 return 16;
68 }
69 }
70 switch (reg - nregs) {
71 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
72 case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
73 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
74 }
75 return 0;
76 }
77
78 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
79 {
80 switch (reg) {
81 case 0 ... 31:
82 /* 128 bit FP register */
83 stfq_le_p(buf, env->vfp.regs[reg * 2]);
84 stfq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
85 return 16;
86 case 32:
87 /* FPSR */
88 stl_p(buf, vfp_get_fpsr(env));
89 return 4;
90 case 33:
91 /* FPCR */
92 stl_p(buf, vfp_get_fpcr(env));
93 return 4;
94 default:
95 return 0;
96 }
97 }
98
99 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
100 {
101 switch (reg) {
102 case 0 ... 31:
103 /* 128 bit FP register */
104 env->vfp.regs[reg * 2] = ldfq_le_p(buf);
105 env->vfp.regs[reg * 2 + 1] = ldfq_le_p(buf + 8);
106 return 16;
107 case 32:
108 /* FPSR */
109 vfp_set_fpsr(env, ldl_p(buf));
110 return 4;
111 case 33:
112 /* FPCR */
113 vfp_set_fpcr(env, ldl_p(buf));
114 return 4;
115 default:
116 return 0;
117 }
118 }
119
120 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
121 {
122 if (cpreg_field_is_64bit(ri)) {
123 return CPREG_FIELD64(env, ri);
124 } else {
125 return CPREG_FIELD32(env, ri);
126 }
127 }
128
129 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
130 uint64_t value)
131 {
132 if (cpreg_field_is_64bit(ri)) {
133 CPREG_FIELD64(env, ri) = value;
134 } else {
135 CPREG_FIELD32(env, ri) = value;
136 }
137 }
138
139 static uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
140 {
141 /* Raw read of a coprocessor register (as needed for migration, etc). */
142 if (ri->type & ARM_CP_CONST) {
143 return ri->resetvalue;
144 } else if (ri->raw_readfn) {
145 return ri->raw_readfn(env, ri);
146 } else if (ri->readfn) {
147 return ri->readfn(env, ri);
148 } else {
149 return raw_read(env, ri);
150 }
151 }
152
153 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
154 uint64_t v)
155 {
156 /* Raw write of a coprocessor register (as needed for migration, etc).
157 * Note that constant registers are treated as write-ignored; the
158 * caller should check for success by whether a readback gives the
159 * value written.
160 */
161 if (ri->type & ARM_CP_CONST) {
162 return;
163 } else if (ri->raw_writefn) {
164 ri->raw_writefn(env, ri, v);
165 } else if (ri->writefn) {
166 ri->writefn(env, ri, v);
167 } else {
168 raw_write(env, ri, v);
169 }
170 }
171
172 bool write_cpustate_to_list(ARMCPU *cpu)
173 {
174 /* Write the coprocessor state from cpu->env to the (index,value) list. */
175 int i;
176 bool ok = true;
177
178 for (i = 0; i < cpu->cpreg_array_len; i++) {
179 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
180 const ARMCPRegInfo *ri;
181
182 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
183 if (!ri) {
184 ok = false;
185 continue;
186 }
187 if (ri->type & ARM_CP_NO_MIGRATE) {
188 continue;
189 }
190 cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
191 }
192 return ok;
193 }
194
195 bool write_list_to_cpustate(ARMCPU *cpu)
196 {
197 int i;
198 bool ok = true;
199
200 for (i = 0; i < cpu->cpreg_array_len; i++) {
201 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
202 uint64_t v = cpu->cpreg_values[i];
203 const ARMCPRegInfo *ri;
204
205 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
206 if (!ri) {
207 ok = false;
208 continue;
209 }
210 if (ri->type & ARM_CP_NO_MIGRATE) {
211 continue;
212 }
213 /* Write value and confirm it reads back as written
214 * (to catch read-only registers and partially read-only
215 * registers where the incoming migration value doesn't match)
216 */
217 write_raw_cp_reg(&cpu->env, ri, v);
218 if (read_raw_cp_reg(&cpu->env, ri) != v) {
219 ok = false;
220 }
221 }
222 return ok;
223 }
224
225 static void add_cpreg_to_list(gpointer key, gpointer opaque)
226 {
227 ARMCPU *cpu = opaque;
228 uint64_t regidx;
229 const ARMCPRegInfo *ri;
230
231 regidx = *(uint32_t *)key;
232 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
233
234 if (!(ri->type & ARM_CP_NO_MIGRATE)) {
235 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
236 /* The value array need not be initialized at this point */
237 cpu->cpreg_array_len++;
238 }
239 }
240
241 static void count_cpreg(gpointer key, gpointer opaque)
242 {
243 ARMCPU *cpu = opaque;
244 uint64_t regidx;
245 const ARMCPRegInfo *ri;
246
247 regidx = *(uint32_t *)key;
248 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
249
250 if (!(ri->type & ARM_CP_NO_MIGRATE)) {
251 cpu->cpreg_array_len++;
252 }
253 }
254
255 static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
256 {
257 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
258 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
259
260 if (aidx > bidx) {
261 return 1;
262 }
263 if (aidx < bidx) {
264 return -1;
265 }
266 return 0;
267 }
268
269 static void cpreg_make_keylist(gpointer key, gpointer value, gpointer udata)
270 {
271 GList **plist = udata;
272
273 *plist = g_list_prepend(*plist, key);
274 }
275
276 void init_cpreg_list(ARMCPU *cpu)
277 {
278 /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
279 * Note that we require cpreg_tuples[] to be sorted by key ID.
280 */
281 GList *keys = NULL;
282 int arraylen;
283
284 g_hash_table_foreach(cpu->cp_regs, cpreg_make_keylist, &keys);
285
286 keys = g_list_sort(keys, cpreg_key_compare);
287
288 cpu->cpreg_array_len = 0;
289
290 g_list_foreach(keys, count_cpreg, cpu);
291
292 arraylen = cpu->cpreg_array_len;
293 cpu->cpreg_indexes = g_new(uint64_t, arraylen);
294 cpu->cpreg_values = g_new(uint64_t, arraylen);
295 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
296 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
297 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
298 cpu->cpreg_array_len = 0;
299
300 g_list_foreach(keys, add_cpreg_to_list, cpu);
301
302 assert(cpu->cpreg_array_len == arraylen);
303
304 g_list_free(keys);
305 }
306
307 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
308 {
309 ARMCPU *cpu = arm_env_get_cpu(env);
310
311 raw_write(env, ri, value);
312 tlb_flush(CPU(cpu), 1); /* Flush TLB as domain not tracked in TLB */
313 }
314
315 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
316 {
317 ARMCPU *cpu = arm_env_get_cpu(env);
318
319 if (raw_read(env, ri) != value) {
320 /* Unlike real hardware the qemu TLB uses virtual addresses,
321 * not modified virtual addresses, so this causes a TLB flush.
322 */
323 tlb_flush(CPU(cpu), 1);
324 raw_write(env, ri, value);
325 }
326 }
327
328 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
329 uint64_t value)
330 {
331 ARMCPU *cpu = arm_env_get_cpu(env);
332
333 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_MPU)
334 && !extended_addresses_enabled(env)) {
335 /* For VMSA (when not using the LPAE long descriptor page table
336 * format) this register includes the ASID, so do a TLB flush.
337 * For PMSA it is purely a process ID and no action is needed.
338 */
339 tlb_flush(CPU(cpu), 1);
340 }
341 raw_write(env, ri, value);
342 }
343
344 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,
345 uint64_t value)
346 {
347 /* Invalidate all (TLBIALL) */
348 ARMCPU *cpu = arm_env_get_cpu(env);
349
350 tlb_flush(CPU(cpu), 1);
351 }
352
353 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,
354 uint64_t value)
355 {
356 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
357 ARMCPU *cpu = arm_env_get_cpu(env);
358
359 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
360 }
361
362 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,
363 uint64_t value)
364 {
365 /* Invalidate by ASID (TLBIASID) */
366 ARMCPU *cpu = arm_env_get_cpu(env);
367
368 tlb_flush(CPU(cpu), value == 0);
369 }
370
371 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
372 uint64_t value)
373 {
374 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
375 ARMCPU *cpu = arm_env_get_cpu(env);
376
377 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
378 }
379
380 /* IS variants of TLB operations must affect all cores */
381 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
382 uint64_t value)
383 {
384 CPUState *other_cs;
385
386 CPU_FOREACH(other_cs) {
387 tlb_flush(other_cs, 1);
388 }
389 }
390
391 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
392 uint64_t value)
393 {
394 CPUState *other_cs;
395
396 CPU_FOREACH(other_cs) {
397 tlb_flush(other_cs, value == 0);
398 }
399 }
400
401 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
402 uint64_t value)
403 {
404 CPUState *other_cs;
405
406 CPU_FOREACH(other_cs) {
407 tlb_flush_page(other_cs, value & TARGET_PAGE_MASK);
408 }
409 }
410
411 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
412 uint64_t value)
413 {
414 CPUState *other_cs;
415
416 CPU_FOREACH(other_cs) {
417 tlb_flush_page(other_cs, value & TARGET_PAGE_MASK);
418 }
419 }
420
421 static const ARMCPRegInfo cp_reginfo[] = {
422 { .name = "FCSEIDR", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 0,
423 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c13_fcse),
424 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
425 { .name = "CONTEXTIDR", .state = ARM_CP_STATE_BOTH,
426 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
427 .access = PL1_RW,
428 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el1),
429 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
430 REGINFO_SENTINEL
431 };
432
433 static const ARMCPRegInfo not_v8_cp_reginfo[] = {
434 /* NB: Some of these registers exist in v8 but with more precise
435 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
436 */
437 /* MMU Domain access control / MPU write buffer control */
438 { .name = "DACR", .cp = 15,
439 .crn = 3, .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
440 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c3),
441 .resetvalue = 0, .writefn = dacr_write, .raw_writefn = raw_write, },
442 /* ??? This covers not just the impdef TLB lockdown registers but also
443 * some v7VMSA registers relating to TEX remap, so it is overly broad.
444 */
445 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = CP_ANY,
446 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
447 /* Cache maintenance ops; some of this space may be overridden later. */
448 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
449 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
450 .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
451 REGINFO_SENTINEL
452 };
453
454 static const ARMCPRegInfo not_v6_cp_reginfo[] = {
455 /* Not all pre-v6 cores implemented this WFI, so this is slightly
456 * over-broad.
457 */
458 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
459 .access = PL1_W, .type = ARM_CP_WFI },
460 REGINFO_SENTINEL
461 };
462
463 static const ARMCPRegInfo not_v7_cp_reginfo[] = {
464 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
465 * is UNPREDICTABLE; we choose to NOP as most implementations do).
466 */
467 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
468 .access = PL1_W, .type = ARM_CP_WFI },
469 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice
470 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
471 * OMAPCP will override this space.
472 */
473 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
474 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
475 .resetvalue = 0 },
476 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
477 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
478 .resetvalue = 0 },
479 /* v6 doesn't have the cache ID registers but Linux reads them anyway */
480 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
481 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
482 .resetvalue = 0 },
483 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
484 * implementing it as RAZ means the "debug architecture version" bits
485 * will read as a reserved value, which should cause Linux to not try
486 * to use the debug hardware.
487 */
488 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
489 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
490 /* MMU TLB control. Note that the wildcarding means we cover not just
491 * the unified TLB ops but also the dside/iside/inner-shareable variants.
492 */
493 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
494 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
495 .type = ARM_CP_NO_MIGRATE },
496 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
497 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
498 .type = ARM_CP_NO_MIGRATE },
499 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
500 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
501 .type = ARM_CP_NO_MIGRATE },
502 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
503 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
504 .type = ARM_CP_NO_MIGRATE },
505 REGINFO_SENTINEL
506 };
507
508 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
509 uint64_t value)
510 {
511 uint32_t mask = 0;
512
513 /* In ARMv8 most bits of CPACR_EL1 are RES0. */
514 if (!arm_feature(env, ARM_FEATURE_V8)) {
515 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
516 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
517 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
518 */
519 if (arm_feature(env, ARM_FEATURE_VFP)) {
520 /* VFP coprocessor: cp10 & cp11 [23:20] */
521 mask |= (1 << 31) | (1 << 30) | (0xf << 20);
522
523 if (!arm_feature(env, ARM_FEATURE_NEON)) {
524 /* ASEDIS [31] bit is RAO/WI */
525 value |= (1 << 31);
526 }
527
528 /* VFPv3 and upwards with NEON implement 32 double precision
529 * registers (D0-D31).
530 */
531 if (!arm_feature(env, ARM_FEATURE_NEON) ||
532 !arm_feature(env, ARM_FEATURE_VFP3)) {
533 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
534 value |= (1 << 30);
535 }
536 }
537 value &= mask;
538 }
539 env->cp15.c1_coproc = value;
540 }
541
542 static const ARMCPRegInfo v6_cp_reginfo[] = {
543 /* prefetch by MVA in v6, NOP in v7 */
544 { .name = "MVA_prefetch",
545 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
546 .access = PL1_W, .type = ARM_CP_NOP },
547 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
548 .access = PL0_W, .type = ARM_CP_NOP },
549 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
550 .access = PL0_W, .type = ARM_CP_NOP },
551 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
552 .access = PL0_W, .type = ARM_CP_NOP },
553 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
554 .access = PL1_RW,
555 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[1]),
556 .resetvalue = 0, },
557 /* Watchpoint Fault Address Register : should actually only be present
558 * for 1136, 1176, 11MPCore.
559 */
560 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
561 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
562 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
563 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2,
564 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_coproc),
565 .resetvalue = 0, .writefn = cpacr_write },
566 REGINFO_SENTINEL
567 };
568
569 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri)
570 {
571 /* Performance monitor registers user accessibility is controlled
572 * by PMUSERENR.
573 */
574 if (arm_current_pl(env) == 0 && !env->cp15.c9_pmuserenr) {
575 return CP_ACCESS_TRAP;
576 }
577 return CP_ACCESS_OK;
578 }
579
580 #ifndef CONFIG_USER_ONLY
581
582 static inline bool arm_ccnt_enabled(CPUARMState *env)
583 {
584 /* This does not support checking PMCCFILTR_EL0 register */
585
586 if (!(env->cp15.c9_pmcr & PMCRE)) {
587 return false;
588 }
589
590 return true;
591 }
592
593 void pmccntr_sync(CPUARMState *env)
594 {
595 uint64_t temp_ticks;
596
597 temp_ticks = muldiv64(qemu_clock_get_us(QEMU_CLOCK_VIRTUAL),
598 get_ticks_per_sec(), 1000000);
599
600 if (env->cp15.c9_pmcr & PMCRD) {
601 /* Increment once every 64 processor clock cycles */
602 temp_ticks /= 64;
603 }
604
605 if (arm_ccnt_enabled(env)) {
606 env->cp15.c15_ccnt = temp_ticks - env->cp15.c15_ccnt;
607 }
608 }
609
610 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
611 uint64_t value)
612 {
613 pmccntr_sync(env);
614
615 if (value & PMCRC) {
616 /* The counter has been reset */
617 env->cp15.c15_ccnt = 0;
618 }
619
620 /* only the DP, X, D and E bits are writable */
621 env->cp15.c9_pmcr &= ~0x39;
622 env->cp15.c9_pmcr |= (value & 0x39);
623
624 pmccntr_sync(env);
625 }
626
627 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
628 {
629 uint64_t total_ticks;
630
631 if (!arm_ccnt_enabled(env)) {
632 /* Counter is disabled, do not change value */
633 return env->cp15.c15_ccnt;
634 }
635
636 total_ticks = muldiv64(qemu_clock_get_us(QEMU_CLOCK_VIRTUAL),
637 get_ticks_per_sec(), 1000000);
638
639 if (env->cp15.c9_pmcr & PMCRD) {
640 /* Increment once every 64 processor clock cycles */
641 total_ticks /= 64;
642 }
643 return total_ticks - env->cp15.c15_ccnt;
644 }
645
646 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
647 uint64_t value)
648 {
649 uint64_t total_ticks;
650
651 if (!arm_ccnt_enabled(env)) {
652 /* Counter is disabled, set the absolute value */
653 env->cp15.c15_ccnt = value;
654 return;
655 }
656
657 total_ticks = muldiv64(qemu_clock_get_us(QEMU_CLOCK_VIRTUAL),
658 get_ticks_per_sec(), 1000000);
659
660 if (env->cp15.c9_pmcr & PMCRD) {
661 /* Increment once every 64 processor clock cycles */
662 total_ticks /= 64;
663 }
664 env->cp15.c15_ccnt = total_ticks - value;
665 }
666
667 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
668 uint64_t value)
669 {
670 uint64_t cur_val = pmccntr_read(env, NULL);
671
672 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
673 }
674
675 #else /* CONFIG_USER_ONLY */
676
677 void pmccntr_sync(CPUARMState *env)
678 {
679 }
680
681 #endif
682
683 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
684 uint64_t value)
685 {
686 pmccntr_sync(env);
687 env->cp15.pmccfiltr_el0 = value & 0x7E000000;
688 pmccntr_sync(env);
689 }
690
691 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
692 uint64_t value)
693 {
694 value &= (1 << 31);
695 env->cp15.c9_pmcnten |= value;
696 }
697
698 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
699 uint64_t value)
700 {
701 value &= (1 << 31);
702 env->cp15.c9_pmcnten &= ~value;
703 }
704
705 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
706 uint64_t value)
707 {
708 env->cp15.c9_pmovsr &= ~value;
709 }
710
711 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
712 uint64_t value)
713 {
714 env->cp15.c9_pmxevtyper = value & 0xff;
715 }
716
717 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
718 uint64_t value)
719 {
720 env->cp15.c9_pmuserenr = value & 1;
721 }
722
723 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
724 uint64_t value)
725 {
726 /* We have no event counters so only the C bit can be changed */
727 value &= (1 << 31);
728 env->cp15.c9_pminten |= value;
729 }
730
731 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
732 uint64_t value)
733 {
734 value &= (1 << 31);
735 env->cp15.c9_pminten &= ~value;
736 }
737
738 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
739 uint64_t value)
740 {
741 /* Note that even though the AArch64 view of this register has bits
742 * [10:0] all RES0 we can only mask the bottom 5, to comply with the
743 * architectural requirements for bits which are RES0 only in some
744 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
745 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
746 */
747 raw_write(env, ri, value & ~0x1FULL);
748 }
749
750 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
751 {
752 ARMCPU *cpu = arm_env_get_cpu(env);
753 return cpu->ccsidr[env->cp15.c0_cssel];
754 }
755
756 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
757 uint64_t value)
758 {
759 raw_write(env, ri, value & 0xf);
760 }
761
762 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
763 {
764 CPUState *cs = ENV_GET_CPU(env);
765 uint64_t ret = 0;
766
767 if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
768 ret |= CPSR_I;
769 }
770 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
771 ret |= CPSR_F;
772 }
773 /* External aborts are not possible in QEMU so A bit is always clear */
774 return ret;
775 }
776
777 static const ARMCPRegInfo v7_cp_reginfo[] = {
778 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
779 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
780 .access = PL1_W, .type = ARM_CP_NOP },
781 /* Performance monitors are implementation defined in v7,
782 * but with an ARM recommended set of registers, which we
783 * follow (although we don't actually implement any counters)
784 *
785 * Performance registers fall into three categories:
786 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
787 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
788 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
789 * For the cases controlled by PMUSERENR we must set .access to PL0_RW
790 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
791 */
792 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
793 .access = PL0_RW, .type = ARM_CP_NO_MIGRATE,
794 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
795 .writefn = pmcntenset_write,
796 .accessfn = pmreg_access,
797 .raw_writefn = raw_write },
798 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64,
799 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
800 .access = PL0_RW, .accessfn = pmreg_access,
801 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
802 .writefn = pmcntenset_write, .raw_writefn = raw_write },
803 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
804 .access = PL0_RW,
805 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
806 .accessfn = pmreg_access,
807 .writefn = pmcntenclr_write,
808 .type = ARM_CP_NO_MIGRATE },
809 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
810 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
811 .access = PL0_RW, .accessfn = pmreg_access,
812 .type = ARM_CP_NO_MIGRATE,
813 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
814 .writefn = pmcntenclr_write },
815 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
816 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
817 .accessfn = pmreg_access,
818 .writefn = pmovsr_write,
819 .raw_writefn = raw_write },
820 /* Unimplemented so WI. */
821 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
822 .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP },
823 /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.
824 * We choose to RAZ/WI.
825 */
826 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
827 .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
828 .accessfn = pmreg_access },
829 #ifndef CONFIG_USER_ONLY
830 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
831 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
832 .readfn = pmccntr_read, .writefn = pmccntr_write32,
833 .accessfn = pmreg_access },
834 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
835 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
836 .access = PL0_RW, .accessfn = pmreg_access,
837 .type = ARM_CP_IO,
838 .readfn = pmccntr_read, .writefn = pmccntr_write, },
839 #endif
840 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
841 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
842 .writefn = pmccfiltr_write,
843 .access = PL0_RW, .accessfn = pmreg_access,
844 .type = ARM_CP_IO,
845 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
846 .resetvalue = 0, },
847 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
848 .access = PL0_RW,
849 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
850 .accessfn = pmreg_access, .writefn = pmxevtyper_write,
851 .raw_writefn = raw_write },
852 /* Unimplemented, RAZ/WI. */
853 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
854 .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
855 .accessfn = pmreg_access },
856 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
857 .access = PL0_R | PL1_RW,
858 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
859 .resetvalue = 0,
860 .writefn = pmuserenr_write, .raw_writefn = raw_write },
861 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
862 .access = PL1_RW,
863 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
864 .resetvalue = 0,
865 .writefn = pmintenset_write, .raw_writefn = raw_write },
866 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
867 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
868 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
869 .resetvalue = 0, .writefn = pmintenclr_write, },
870 { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
871 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
872 .access = PL1_RW, .writefn = vbar_write,
873 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[1]),
874 .resetvalue = 0 },
875 { .name = "SCR", .cp = 15, .crn = 1, .crm = 1, .opc1 = 0, .opc2 = 0,
876 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_scr),
877 .resetvalue = 0, },
878 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
879 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
880 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_MIGRATE },
881 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
882 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
883 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c0_cssel),
884 .writefn = csselr_write, .resetvalue = 0 },
885 /* Auxiliary ID register: this actually has an IMPDEF value but for now
886 * just RAZ for all cores:
887 */
888 { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
889 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
890 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
891 /* Auxiliary fault status registers: these also are IMPDEF, and we
892 * choose to RAZ/WI for all cores.
893 */
894 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
895 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
896 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
897 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
898 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
899 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
900 /* MAIR can just read-as-written because we don't implement caches
901 * and so don't need to care about memory attributes.
902 */
903 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
904 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
905 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el1),
906 .resetvalue = 0 },
907 /* For non-long-descriptor page tables these are PRRR and NMRR;
908 * regardless they still act as reads-as-written for QEMU.
909 * The override is necessary because of the overly-broad TLB_LOCKDOWN
910 * definition.
911 */
912 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, .type = ARM_CP_OVERRIDE,
913 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW,
914 .fieldoffset = offsetoflow32(CPUARMState, cp15.mair_el1),
915 .resetfn = arm_cp_reset_ignore },
916 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, .type = ARM_CP_OVERRIDE,
917 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW,
918 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el1),
919 .resetfn = arm_cp_reset_ignore },
920 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
921 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
922 .type = ARM_CP_NO_MIGRATE, .access = PL1_R, .readfn = isr_read },
923 /* 32 bit ITLB invalidates */
924 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0,
925 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_write },
926 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
927 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
928 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2,
929 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiasid_write },
930 /* 32 bit DTLB invalidates */
931 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0,
932 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_write },
933 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
934 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
935 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2,
936 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiasid_write },
937 /* 32 bit TLB invalidates */
938 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
939 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_write },
940 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
941 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
942 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
943 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiasid_write },
944 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
945 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimvaa_write },
946 REGINFO_SENTINEL
947 };
948
949 static const ARMCPRegInfo v7mp_cp_reginfo[] = {
950 /* 32 bit TLB invalidates, Inner Shareable */
951 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
952 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_is_write },
953 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
954 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_is_write },
955 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
956 .type = ARM_CP_NO_MIGRATE, .access = PL1_W,
957 .writefn = tlbiasid_is_write },
958 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
959 .type = ARM_CP_NO_MIGRATE, .access = PL1_W,
960 .writefn = tlbimvaa_is_write },
961 REGINFO_SENTINEL
962 };
963
964 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
965 uint64_t value)
966 {
967 value &= 1;
968 env->teecr = value;
969 }
970
971 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri)
972 {
973 if (arm_current_pl(env) == 0 && (env->teecr & 1)) {
974 return CP_ACCESS_TRAP;
975 }
976 return CP_ACCESS_OK;
977 }
978
979 static const ARMCPRegInfo t2ee_cp_reginfo[] = {
980 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
981 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
982 .resetvalue = 0,
983 .writefn = teecr_write },
984 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
985 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
986 .accessfn = teehbr_access, .resetvalue = 0 },
987 REGINFO_SENTINEL
988 };
989
990 static const ARMCPRegInfo v6k_cp_reginfo[] = {
991 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
992 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
993 .access = PL0_RW,
994 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el0), .resetvalue = 0 },
995 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
996 .access = PL0_RW,
997 .fieldoffset = offsetoflow32(CPUARMState, cp15.tpidr_el0),
998 .resetfn = arm_cp_reset_ignore },
999 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
1000 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
1001 .access = PL0_R|PL1_W,
1002 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el0), .resetvalue = 0 },
1003 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
1004 .access = PL0_R|PL1_W,
1005 .fieldoffset = offsetoflow32(CPUARMState, cp15.tpidrro_el0),
1006 .resetfn = arm_cp_reset_ignore },
1007 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_BOTH,
1008 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
1009 .access = PL1_RW,
1010 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el1), .resetvalue = 0 },
1011 REGINFO_SENTINEL
1012 };
1013
1014 #ifndef CONFIG_USER_ONLY
1015
1016 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri)
1017 {
1018 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero */
1019 if (arm_current_pl(env) == 0 && !extract32(env->cp15.c14_cntkctl, 0, 2)) {
1020 return CP_ACCESS_TRAP;
1021 }
1022 return CP_ACCESS_OK;
1023 }
1024
1025 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx)
1026 {
1027 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */
1028 if (arm_current_pl(env) == 0 &&
1029 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
1030 return CP_ACCESS_TRAP;
1031 }
1032 return CP_ACCESS_OK;
1033 }
1034
1035 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx)
1036 {
1037 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if
1038 * EL0[PV]TEN is zero.
1039 */
1040 if (arm_current_pl(env) == 0 &&
1041 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
1042 return CP_ACCESS_TRAP;
1043 }
1044 return CP_ACCESS_OK;
1045 }
1046
1047 static CPAccessResult gt_pct_access(CPUARMState *env,
1048 const ARMCPRegInfo *ri)
1049 {
1050 return gt_counter_access(env, GTIMER_PHYS);
1051 }
1052
1053 static CPAccessResult gt_vct_access(CPUARMState *env,
1054 const ARMCPRegInfo *ri)
1055 {
1056 return gt_counter_access(env, GTIMER_VIRT);
1057 }
1058
1059 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
1060 {
1061 return gt_timer_access(env, GTIMER_PHYS);
1062 }
1063
1064 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
1065 {
1066 return gt_timer_access(env, GTIMER_VIRT);
1067 }
1068
1069 static uint64_t gt_get_countervalue(CPUARMState *env)
1070 {
1071 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
1072 }
1073
1074 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
1075 {
1076 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
1077
1078 if (gt->ctl & 1) {
1079 /* Timer enabled: calculate and set current ISTATUS, irq, and
1080 * reset timer to when ISTATUS next has to change
1081 */
1082 uint64_t count = gt_get_countervalue(&cpu->env);
1083 /* Note that this must be unsigned 64 bit arithmetic: */
1084 int istatus = count >= gt->cval;
1085 uint64_t nexttick;
1086
1087 gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
1088 qemu_set_irq(cpu->gt_timer_outputs[timeridx],
1089 (istatus && !(gt->ctl & 2)));
1090 if (istatus) {
1091 /* Next transition is when count rolls back over to zero */
1092 nexttick = UINT64_MAX;
1093 } else {
1094 /* Next transition is when we hit cval */
1095 nexttick = gt->cval;
1096 }
1097 /* Note that the desired next expiry time might be beyond the
1098 * signed-64-bit range of a QEMUTimer -- in this case we just
1099 * set the timer for as far in the future as possible. When the
1100 * timer expires we will reset the timer for any remaining period.
1101 */
1102 if (nexttick > INT64_MAX / GTIMER_SCALE) {
1103 nexttick = INT64_MAX / GTIMER_SCALE;
1104 }
1105 timer_mod(cpu->gt_timer[timeridx], nexttick);
1106 } else {
1107 /* Timer disabled: ISTATUS and timer output always clear */
1108 gt->ctl &= ~4;
1109 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);
1110 timer_del(cpu->gt_timer[timeridx]);
1111 }
1112 }
1113
1114 static void gt_cnt_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1115 {
1116 ARMCPU *cpu = arm_env_get_cpu(env);
1117 int timeridx = ri->opc1 & 1;
1118
1119 timer_del(cpu->gt_timer[timeridx]);
1120 }
1121
1122 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
1123 {
1124 return gt_get_countervalue(env);
1125 }
1126
1127 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1128 uint64_t value)
1129 {
1130 int timeridx = ri->opc1 & 1;
1131
1132 env->cp15.c14_timer[timeridx].cval = value;
1133 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1134 }
1135
1136 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1137 {
1138 int timeridx = ri->crm & 1;
1139
1140 return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
1141 gt_get_countervalue(env));
1142 }
1143
1144 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1145 uint64_t value)
1146 {
1147 int timeridx = ri->crm & 1;
1148
1149 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) +
1150 + sextract64(value, 0, 32);
1151 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1152 }
1153
1154 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1155 uint64_t value)
1156 {
1157 ARMCPU *cpu = arm_env_get_cpu(env);
1158 int timeridx = ri->crm & 1;
1159 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
1160
1161 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
1162 if ((oldval ^ value) & 1) {
1163 /* Enable toggled */
1164 gt_recalc_timer(cpu, timeridx);
1165 } else if ((oldval ^ value) & 2) {
1166 /* IMASK toggled: don't need to recalculate,
1167 * just set the interrupt line based on ISTATUS
1168 */
1169 qemu_set_irq(cpu->gt_timer_outputs[timeridx],
1170 (oldval & 4) && !(value & 2));
1171 }
1172 }
1173
1174 void arm_gt_ptimer_cb(void *opaque)
1175 {
1176 ARMCPU *cpu = opaque;
1177
1178 gt_recalc_timer(cpu, GTIMER_PHYS);
1179 }
1180
1181 void arm_gt_vtimer_cb(void *opaque)
1182 {
1183 ARMCPU *cpu = opaque;
1184
1185 gt_recalc_timer(cpu, GTIMER_VIRT);
1186 }
1187
1188 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1189 /* Note that CNTFRQ is purely reads-as-written for the benefit
1190 * of software; writing it doesn't actually change the timer frequency.
1191 * Our reset value matches the fixed frequency we implement the timer at.
1192 */
1193 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
1194 .type = ARM_CP_NO_MIGRATE,
1195 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1196 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
1197 .resetfn = arm_cp_reset_ignore,
1198 },
1199 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
1200 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
1201 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1202 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
1203 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
1204 },
1205 /* overall control: mostly access permissions */
1206 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
1207 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
1208 .access = PL1_RW,
1209 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
1210 .resetvalue = 0,
1211 },
1212 /* per-timer control */
1213 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
1214 .type = ARM_CP_IO | ARM_CP_NO_MIGRATE, .access = PL1_RW | PL0_R,
1215 .accessfn = gt_ptimer_access,
1216 .fieldoffset = offsetoflow32(CPUARMState,
1217 cp15.c14_timer[GTIMER_PHYS].ctl),
1218 .resetfn = arm_cp_reset_ignore,
1219 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1220 },
1221 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
1222 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
1223 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1224 .accessfn = gt_ptimer_access,
1225 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
1226 .resetvalue = 0,
1227 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1228 },
1229 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
1230 .type = ARM_CP_IO | ARM_CP_NO_MIGRATE, .access = PL1_RW | PL0_R,
1231 .accessfn = gt_vtimer_access,
1232 .fieldoffset = offsetoflow32(CPUARMState,
1233 cp15.c14_timer[GTIMER_VIRT].ctl),
1234 .resetfn = arm_cp_reset_ignore,
1235 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1236 },
1237 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
1238 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
1239 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1240 .accessfn = gt_vtimer_access,
1241 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
1242 .resetvalue = 0,
1243 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1244 },
1245 /* TimerValue views: a 32 bit downcounting view of the underlying state */
1246 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
1247 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1248 .accessfn = gt_ptimer_access,
1249 .readfn = gt_tval_read, .writefn = gt_tval_write,
1250 },
1251 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1252 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
1253 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1254 .readfn = gt_tval_read, .writefn = gt_tval_write,
1255 },
1256 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
1257 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1258 .accessfn = gt_vtimer_access,
1259 .readfn = gt_tval_read, .writefn = gt_tval_write,
1260 },
1261 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1262 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
1263 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1264 .readfn = gt_tval_read, .writefn = gt_tval_write,
1265 },
1266 /* The counter itself */
1267 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
1268 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE | ARM_CP_IO,
1269 .accessfn = gt_pct_access,
1270 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
1271 },
1272 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
1273 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
1274 .access = PL0_R, .type = ARM_CP_NO_MIGRATE | ARM_CP_IO,
1275 .accessfn = gt_pct_access,
1276 .readfn = gt_cnt_read, .resetfn = gt_cnt_reset,
1277 },
1278 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
1279 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE | ARM_CP_IO,
1280 .accessfn = gt_vct_access,
1281 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
1282 },
1283 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
1284 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
1285 .access = PL0_R, .type = ARM_CP_NO_MIGRATE | ARM_CP_IO,
1286 .accessfn = gt_vct_access,
1287 .readfn = gt_cnt_read, .resetfn = gt_cnt_reset,
1288 },
1289 /* Comparison value, indicating when the timer goes off */
1290 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
1291 .access = PL1_RW | PL0_R,
1292 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_MIGRATE,
1293 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1294 .accessfn = gt_ptimer_access, .resetfn = arm_cp_reset_ignore,
1295 .writefn = gt_cval_write, .raw_writefn = raw_write,
1296 },
1297 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1298 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
1299 .access = PL1_RW | PL0_R,
1300 .type = ARM_CP_IO,
1301 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1302 .resetvalue = 0, .accessfn = gt_vtimer_access,
1303 .writefn = gt_cval_write, .raw_writefn = raw_write,
1304 },
1305 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
1306 .access = PL1_RW | PL0_R,
1307 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_MIGRATE,
1308 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1309 .accessfn = gt_vtimer_access, .resetfn = arm_cp_reset_ignore,
1310 .writefn = gt_cval_write, .raw_writefn = raw_write,
1311 },
1312 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1313 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
1314 .access = PL1_RW | PL0_R,
1315 .type = ARM_CP_IO,
1316 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1317 .resetvalue = 0, .accessfn = gt_vtimer_access,
1318 .writefn = gt_cval_write, .raw_writefn = raw_write,
1319 },
1320 REGINFO_SENTINEL
1321 };
1322
1323 #else
1324 /* In user-mode none of the generic timer registers are accessible,
1325 * and their implementation depends on QEMU_CLOCK_VIRTUAL and qdev gpio outputs,
1326 * so instead just don't register any of them.
1327 */
1328 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1329 REGINFO_SENTINEL
1330 };
1331
1332 #endif
1333
1334 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1335 {
1336 if (arm_feature(env, ARM_FEATURE_LPAE)) {
1337 raw_write(env, ri, value);
1338 } else if (arm_feature(env, ARM_FEATURE_V7)) {
1339 raw_write(env, ri, value & 0xfffff6ff);
1340 } else {
1341 raw_write(env, ri, value & 0xfffff1ff);
1342 }
1343 }
1344
1345 #ifndef CONFIG_USER_ONLY
1346 /* get_phys_addr() isn't present for user-mode-only targets */
1347
1348 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri)
1349 {
1350 if (ri->opc2 & 4) {
1351 /* Other states are only available with TrustZone; in
1352 * a non-TZ implementation these registers don't exist
1353 * at all, which is an Uncategorized trap. This underdecoding
1354 * is safe because the reginfo is NO_MIGRATE.
1355 */
1356 return CP_ACCESS_TRAP_UNCATEGORIZED;
1357 }
1358 return CP_ACCESS_OK;
1359 }
1360
1361 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1362 {
1363 hwaddr phys_addr;
1364 target_ulong page_size;
1365 int prot;
1366 int ret, is_user = ri->opc2 & 2;
1367 int access_type = ri->opc2 & 1;
1368
1369 ret = get_phys_addr(env, value, access_type, is_user,
1370 &phys_addr, &prot, &page_size);
1371 if (extended_addresses_enabled(env)) {
1372 /* ret is a DFSR/IFSR value for the long descriptor
1373 * translation table format, but with WnR always clear.
1374 * Convert it to a 64-bit PAR.
1375 */
1376 uint64_t par64 = (1 << 11); /* LPAE bit always set */
1377 if (ret == 0) {
1378 par64 |= phys_addr & ~0xfffULL;
1379 /* We don't set the ATTR or SH fields in the PAR. */
1380 } else {
1381 par64 |= 1; /* F */
1382 par64 |= (ret & 0x3f) << 1; /* FS */
1383 /* Note that S2WLK and FSTAGE are always zero, because we don't
1384 * implement virtualization and therefore there can't be a stage 2
1385 * fault.
1386 */
1387 }
1388 env->cp15.par_el1 = par64;
1389 } else {
1390 /* ret is a DFSR/IFSR value for the short descriptor
1391 * translation table format (with WnR always clear).
1392 * Convert it to a 32-bit PAR.
1393 */
1394 if (ret == 0) {
1395 /* We do not set any attribute bits in the PAR */
1396 if (page_size == (1 << 24)
1397 && arm_feature(env, ARM_FEATURE_V7)) {
1398 env->cp15.par_el1 = (phys_addr & 0xff000000) | 1 << 1;
1399 } else {
1400 env->cp15.par_el1 = phys_addr & 0xfffff000;
1401 }
1402 } else {
1403 env->cp15.par_el1 = ((ret & (1 << 10)) >> 5) |
1404 ((ret & (1 << 12)) >> 6) |
1405 ((ret & 0xf) << 1) | 1;
1406 }
1407 }
1408 }
1409 #endif
1410
1411 static const ARMCPRegInfo vapa_cp_reginfo[] = {
1412 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
1413 .access = PL1_RW, .resetvalue = 0,
1414 .fieldoffset = offsetoflow32(CPUARMState, cp15.par_el1),
1415 .writefn = par_write },
1416 #ifndef CONFIG_USER_ONLY
1417 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
1418 .access = PL1_W, .accessfn = ats_access,
1419 .writefn = ats_write, .type = ARM_CP_NO_MIGRATE },
1420 #endif
1421 REGINFO_SENTINEL
1422 };
1423
1424 /* Return basic MPU access permission bits. */
1425 static uint32_t simple_mpu_ap_bits(uint32_t val)
1426 {
1427 uint32_t ret;
1428 uint32_t mask;
1429 int i;
1430 ret = 0;
1431 mask = 3;
1432 for (i = 0; i < 16; i += 2) {
1433 ret |= (val >> i) & mask;
1434 mask <<= 2;
1435 }
1436 return ret;
1437 }
1438
1439 /* Pad basic MPU access permission bits to extended format. */
1440 static uint32_t extended_mpu_ap_bits(uint32_t val)
1441 {
1442 uint32_t ret;
1443 uint32_t mask;
1444 int i;
1445 ret = 0;
1446 mask = 3;
1447 for (i = 0; i < 16; i += 2) {
1448 ret |= (val & mask) << i;
1449 mask <<= 2;
1450 }
1451 return ret;
1452 }
1453
1454 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1455 uint64_t value)
1456 {
1457 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
1458 }
1459
1460 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1461 {
1462 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
1463 }
1464
1465 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1466 uint64_t value)
1467 {
1468 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
1469 }
1470
1471 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1472 {
1473 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
1474 }
1475
1476 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
1477 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
1478 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
1479 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
1480 .resetvalue = 0,
1481 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
1482 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
1483 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
1484 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
1485 .resetvalue = 0,
1486 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
1487 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
1488 .access = PL1_RW,
1489 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
1490 .resetvalue = 0, },
1491 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
1492 .access = PL1_RW,
1493 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
1494 .resetvalue = 0, },
1495 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
1496 .access = PL1_RW,
1497 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
1498 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
1499 .access = PL1_RW,
1500 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
1501 /* Protection region base and size registers */
1502 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
1503 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1504 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
1505 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
1506 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1507 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
1508 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
1509 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1510 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
1511 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
1512 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1513 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
1514 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
1515 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1516 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
1517 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
1518 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1519 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
1520 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
1521 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1522 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
1523 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
1524 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1525 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
1526 REGINFO_SENTINEL
1527 };
1528
1529 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
1530 uint64_t value)
1531 {
1532 int maskshift = extract32(value, 0, 3);
1533
1534 if (!arm_feature(env, ARM_FEATURE_V8)) {
1535 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
1536 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
1537 * using Long-desciptor translation table format */
1538 value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
1539 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
1540 /* In an implementation that includes the Security Extensions
1541 * TTBCR has additional fields PD0 [4] and PD1 [5] for
1542 * Short-descriptor translation table format.
1543 */
1544 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N;
1545 } else {
1546 value &= TTBCR_N;
1547 }
1548 }
1549
1550 /* Note that we always calculate c2_mask and c2_base_mask, but
1551 * they are only used for short-descriptor tables (ie if EAE is 0);
1552 * for long-descriptor tables the TTBCR fields are used differently
1553 * and the c2_mask and c2_base_mask values are meaningless.
1554 */
1555 raw_write(env, ri, value);
1556 env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> maskshift);
1557 env->cp15.c2_base_mask = ~((uint32_t)0x3fffu >> maskshift);
1558 }
1559
1560 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1561 uint64_t value)
1562 {
1563 ARMCPU *cpu = arm_env_get_cpu(env);
1564
1565 if (arm_feature(env, ARM_FEATURE_LPAE)) {
1566 /* With LPAE the TTBCR could result in a change of ASID
1567 * via the TTBCR.A1 bit, so do a TLB flush.
1568 */
1569 tlb_flush(CPU(cpu), 1);
1570 }
1571 vmsa_ttbcr_raw_write(env, ri, value);
1572 }
1573
1574 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1575 {
1576 env->cp15.c2_base_mask = 0xffffc000u;
1577 raw_write(env, ri, 0);
1578 env->cp15.c2_mask = 0;
1579 }
1580
1581 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
1582 uint64_t value)
1583 {
1584 ARMCPU *cpu = arm_env_get_cpu(env);
1585
1586 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
1587 tlb_flush(CPU(cpu), 1);
1588 raw_write(env, ri, value);
1589 }
1590
1591 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1592 uint64_t value)
1593 {
1594 /* 64 bit accesses to the TTBRs can change the ASID and so we
1595 * must flush the TLB.
1596 */
1597 if (cpreg_field_is_64bit(ri)) {
1598 ARMCPU *cpu = arm_env_get_cpu(env);
1599
1600 tlb_flush(CPU(cpu), 1);
1601 }
1602 raw_write(env, ri, value);
1603 }
1604
1605 static const ARMCPRegInfo vmsa_cp_reginfo[] = {
1606 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
1607 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
1608 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
1609 .resetfn = arm_cp_reset_ignore, },
1610 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
1611 .access = PL1_RW,
1612 .fieldoffset = offsetof(CPUARMState, cp15.ifsr_el2), .resetvalue = 0, },
1613 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
1614 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
1615 .access = PL1_RW,
1616 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
1617 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
1618 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
1619 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el1),
1620 .writefn = vmsa_ttbr_write, .resetvalue = 0 },
1621 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
1622 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
1623 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el1),
1624 .writefn = vmsa_ttbr_write, .resetvalue = 0 },
1625 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
1626 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
1627 .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
1628 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
1629 .fieldoffset = offsetof(CPUARMState, cp15.c2_control) },
1630 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
1631 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE, .writefn = vmsa_ttbcr_write,
1632 .resetfn = arm_cp_reset_ignore, .raw_writefn = vmsa_ttbcr_raw_write,
1633 .fieldoffset = offsetoflow32(CPUARMState, cp15.c2_control) },
1634 /* 64-bit FAR; this entry also gives us the AArch32 DFAR */
1635 { .name = "FAR_EL1", .state = ARM_CP_STATE_BOTH,
1636 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
1637 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
1638 .resetvalue = 0, },
1639 REGINFO_SENTINEL
1640 };
1641
1642 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri,
1643 uint64_t value)
1644 {
1645 env->cp15.c15_ticonfig = value & 0xe7;
1646 /* The OS_TYPE bit in this register changes the reported CPUID! */
1647 env->cp15.c0_cpuid = (value & (1 << 5)) ?
1648 ARM_CPUID_TI915T : ARM_CPUID_TI925T;
1649 }
1650
1651 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
1652 uint64_t value)
1653 {
1654 env->cp15.c15_threadid = value & 0xffff;
1655 }
1656
1657 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
1658 uint64_t value)
1659 {
1660 /* Wait-for-interrupt (deprecated) */
1661 cpu_interrupt(CPU(arm_env_get_cpu(env)), CPU_INTERRUPT_HALT);
1662 }
1663
1664 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
1665 uint64_t value)
1666 {
1667 /* On OMAP there are registers indicating the max/min index of dcache lines
1668 * containing a dirty line; cache flush operations have to reset these.
1669 */
1670 env->cp15.c15_i_max = 0x000;
1671 env->cp15.c15_i_min = 0xff0;
1672 }
1673
1674 static const ARMCPRegInfo omap_cp_reginfo[] = {
1675 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY,
1676 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE,
1677 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
1678 .resetvalue = 0, },
1679 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,
1680 .access = PL1_RW, .type = ARM_CP_NOP },
1681 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0,
1682 .access = PL1_RW,
1683 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0,
1684 .writefn = omap_ticonfig_write },
1685 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0,
1686 .access = PL1_RW,
1687 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, },
1688 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0,
1689 .access = PL1_RW, .resetvalue = 0xff0,
1690 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) },
1691 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0,
1692 .access = PL1_RW,
1693 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0,
1694 .writefn = omap_threadid_write },
1695 { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
1696 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
1697 .type = ARM_CP_NO_MIGRATE,
1698 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
1699 /* TODO: Peripheral port remap register:
1700 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
1701 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
1702 * when MMU is off.
1703 */
1704 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
1705 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
1706 .type = ARM_CP_OVERRIDE | ARM_CP_NO_MIGRATE,
1707 .writefn = omap_cachemaint_write },
1708 { .name = "C9", .cp = 15, .crn = 9,
1709 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
1710 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
1711 REGINFO_SENTINEL
1712 };
1713
1714 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
1715 uint64_t value)
1716 {
1717 value &= 0x3fff;
1718 if (env->cp15.c15_cpar != value) {
1719 /* Changes cp0 to cp13 behavior, so needs a TB flush. */
1720 tb_flush(env);
1721 env->cp15.c15_cpar = value;
1722 }
1723 }
1724
1725 static const ARMCPRegInfo xscale_cp_reginfo[] = {
1726 { .name = "XSCALE_CPAR",
1727 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
1728 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
1729 .writefn = xscale_cpar_write, },
1730 { .name = "XSCALE_AUXCR",
1731 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
1732 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
1733 .resetvalue = 0, },
1734 /* XScale specific cache-lockdown: since we have no cache we NOP these
1735 * and hope the guest does not really rely on cache behaviour.
1736 */
1737 { .name = "XSCALE_LOCK_ICACHE_LINE",
1738 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
1739 .access = PL1_W, .type = ARM_CP_NOP },
1740 { .name = "XSCALE_UNLOCK_ICACHE",
1741 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
1742 .access = PL1_W, .type = ARM_CP_NOP },
1743 { .name = "XSCALE_DCACHE_LOCK",
1744 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
1745 .access = PL1_RW, .type = ARM_CP_NOP },
1746 { .name = "XSCALE_UNLOCK_DCACHE",
1747 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
1748 .access = PL1_W, .type = ARM_CP_NOP },
1749 REGINFO_SENTINEL
1750 };
1751
1752 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
1753 /* RAZ/WI the whole crn=15 space, when we don't have a more specific
1754 * implementation of this implementation-defined space.
1755 * Ideally this should eventually disappear in favour of actually
1756 * implementing the correct behaviour for all cores.
1757 */
1758 { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
1759 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
1760 .access = PL1_RW,
1761 .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE | ARM_CP_OVERRIDE,
1762 .resetvalue = 0 },
1763 REGINFO_SENTINEL
1764 };
1765
1766 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
1767 /* Cache status: RAZ because we have no cache so it's always clean */
1768 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
1769 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1770 .resetvalue = 0 },
1771 REGINFO_SENTINEL
1772 };
1773
1774 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
1775 /* We never have a a block transfer operation in progress */
1776 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
1777 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1778 .resetvalue = 0 },
1779 /* The cache ops themselves: these all NOP for QEMU */
1780 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
1781 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1782 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
1783 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1784 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
1785 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1786 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
1787 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1788 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
1789 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1790 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
1791 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1792 REGINFO_SENTINEL
1793 };
1794
1795 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
1796 /* The cache test-and-clean instructions always return (1 << 30)
1797 * to indicate that there are no dirty cache lines.
1798 */
1799 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
1800 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1801 .resetvalue = (1 << 30) },
1802 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
1803 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1804 .resetvalue = (1 << 30) },
1805 REGINFO_SENTINEL
1806 };
1807
1808 static const ARMCPRegInfo strongarm_cp_reginfo[] = {
1809 /* Ignore ReadBuffer accesses */
1810 { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
1811 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
1812 .access = PL1_RW, .resetvalue = 0,
1813 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_MIGRATE },
1814 REGINFO_SENTINEL
1815 };
1816
1817 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1818 {
1819 CPUState *cs = CPU(arm_env_get_cpu(env));
1820 uint32_t mpidr = cs->cpu_index;
1821 /* We don't support setting cluster ID ([8..11]) (known as Aff1
1822 * in later ARM ARM versions), or any of the higher affinity level fields,
1823 * so these bits always RAZ.
1824 */
1825 if (arm_feature(env, ARM_FEATURE_V7MP)) {
1826 mpidr |= (1U << 31);
1827 /* Cores which are uniprocessor (non-coherent)
1828 * but still implement the MP extensions set
1829 * bit 30. (For instance, A9UP.) However we do
1830 * not currently model any of those cores.
1831 */
1832 }
1833 return mpidr;
1834 }
1835
1836 static const ARMCPRegInfo mpidr_cp_reginfo[] = {
1837 { .name = "MPIDR", .state = ARM_CP_STATE_BOTH,
1838 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
1839 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_MIGRATE },
1840 REGINFO_SENTINEL
1841 };
1842
1843 static const ARMCPRegInfo lpae_cp_reginfo[] = {
1844 /* NOP AMAIR0/1: the override is because these clash with the rather
1845 * broadly specified TLB_LOCKDOWN entry in the generic cp_reginfo.
1846 */
1847 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
1848 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
1849 .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_OVERRIDE,
1850 .resetvalue = 0 },
1851 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
1852 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
1853 .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_OVERRIDE,
1854 .resetvalue = 0 },
1855 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
1856 .access = PL1_RW, .type = ARM_CP_64BIT,
1857 .fieldoffset = offsetof(CPUARMState, cp15.par_el1), .resetvalue = 0 },
1858 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
1859 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE,
1860 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el1),
1861 .writefn = vmsa_ttbr_write, .resetfn = arm_cp_reset_ignore },
1862 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
1863 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE,
1864 .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el1),
1865 .writefn = vmsa_ttbr_write, .resetfn = arm_cp_reset_ignore },
1866 REGINFO_SENTINEL
1867 };
1868
1869 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1870 {
1871 return vfp_get_fpcr(env);
1872 }
1873
1874 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1875 uint64_t value)
1876 {
1877 vfp_set_fpcr(env, value);
1878 }
1879
1880 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1881 {
1882 return vfp_get_fpsr(env);
1883 }
1884
1885 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1886 uint64_t value)
1887 {
1888 vfp_set_fpsr(env, value);
1889 }
1890
1891 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri)
1892 {
1893 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UMA)) {
1894 return CP_ACCESS_TRAP;
1895 }
1896 return CP_ACCESS_OK;
1897 }
1898
1899 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri,
1900 uint64_t value)
1901 {
1902 env->daif = value & PSTATE_DAIF;
1903 }
1904
1905 static CPAccessResult aa64_cacheop_access(CPUARMState *env,
1906 const ARMCPRegInfo *ri)
1907 {
1908 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
1909 * SCTLR_EL1.UCI is set.
1910 */
1911 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UCI)) {
1912 return CP_ACCESS_TRAP;
1913 }
1914 return CP_ACCESS_OK;
1915 }
1916
1917 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions
1918 * Page D4-1736 (DDI0487A.b)
1919 */
1920
1921 static void tlbi_aa64_va_write(CPUARMState *env, const ARMCPRegInfo *ri,
1922 uint64_t value)
1923 {
1924 /* Invalidate by VA (AArch64 version) */
1925 ARMCPU *cpu = arm_env_get_cpu(env);
1926 uint64_t pageaddr = sextract64(value << 12, 0, 56);
1927
1928 tlb_flush_page(CPU(cpu), pageaddr);
1929 }
1930
1931 static void tlbi_aa64_vaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
1932 uint64_t value)
1933 {
1934 /* Invalidate by VA, all ASIDs (AArch64 version) */
1935 ARMCPU *cpu = arm_env_get_cpu(env);
1936 uint64_t pageaddr = sextract64(value << 12, 0, 56);
1937
1938 tlb_flush_page(CPU(cpu), pageaddr);
1939 }
1940
1941 static void tlbi_aa64_asid_write(CPUARMState *env, const ARMCPRegInfo *ri,
1942 uint64_t value)
1943 {
1944 /* Invalidate by ASID (AArch64 version) */
1945 ARMCPU *cpu = arm_env_get_cpu(env);
1946 int asid = extract64(value, 48, 16);
1947 tlb_flush(CPU(cpu), asid == 0);
1948 }
1949
1950 static void tlbi_aa64_va_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
1951 uint64_t value)
1952 {
1953 CPUState *other_cs;
1954 uint64_t pageaddr = sextract64(value << 12, 0, 56);
1955
1956 CPU_FOREACH(other_cs) {
1957 tlb_flush_page(other_cs, pageaddr);
1958 }
1959 }
1960
1961 static void tlbi_aa64_vaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
1962 uint64_t value)
1963 {
1964 CPUState *other_cs;
1965 uint64_t pageaddr = sextract64(value << 12, 0, 56);
1966
1967 CPU_FOREACH(other_cs) {
1968 tlb_flush_page(other_cs, pageaddr);
1969 }
1970 }
1971
1972 static void tlbi_aa64_asid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
1973 uint64_t value)
1974 {
1975 CPUState *other_cs;
1976 int asid = extract64(value, 48, 16);
1977
1978 CPU_FOREACH(other_cs) {
1979 tlb_flush(other_cs, asid == 0);
1980 }
1981 }
1982
1983 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri)
1984 {
1985 /* We don't implement EL2, so the only control on DC ZVA is the
1986 * bit in the SCTLR which can prohibit access for EL0.
1987 */
1988 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_DZE)) {
1989 return CP_ACCESS_TRAP;
1990 }
1991 return CP_ACCESS_OK;
1992 }
1993
1994 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri)
1995 {
1996 ARMCPU *cpu = arm_env_get_cpu(env);
1997 int dzp_bit = 1 << 4;
1998
1999 /* DZP indicates whether DC ZVA access is allowed */
2000 if (aa64_zva_access(env, NULL) != CP_ACCESS_OK) {
2001 dzp_bit = 0;
2002 }
2003 return cpu->dcz_blocksize | dzp_bit;
2004 }
2005
2006 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
2007 {
2008 if (!(env->pstate & PSTATE_SP)) {
2009 /* Access to SP_EL0 is undefined if it's being used as
2010 * the stack pointer.
2011 */
2012 return CP_ACCESS_TRAP_UNCATEGORIZED;
2013 }
2014 return CP_ACCESS_OK;
2015 }
2016
2017 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri)
2018 {
2019 return env->pstate & PSTATE_SP;
2020 }
2021
2022 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
2023 {
2024 update_spsel(env, val);
2025 }
2026
2027 static const ARMCPRegInfo v8_cp_reginfo[] = {
2028 /* Minimal set of EL0-visible registers. This will need to be expanded
2029 * significantly for system emulation of AArch64 CPUs.
2030 */
2031 { .name = "NZCV", .state = ARM_CP_STATE_AA64,
2032 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
2033 .access = PL0_RW, .type = ARM_CP_NZCV },
2034 { .name = "DAIF", .state = ARM_CP_STATE_AA64,
2035 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
2036 .type = ARM_CP_NO_MIGRATE,
2037 .access = PL0_RW, .accessfn = aa64_daif_access,
2038 .fieldoffset = offsetof(CPUARMState, daif),
2039 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
2040 { .name = "FPCR", .state = ARM_CP_STATE_AA64,
2041 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
2042 .access = PL0_RW, .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
2043 { .name = "FPSR", .state = ARM_CP_STATE_AA64,
2044 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
2045 .access = PL0_RW, .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
2046 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
2047 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
2048 .access = PL0_R, .type = ARM_CP_NO_MIGRATE,
2049 .readfn = aa64_dczid_read },
2050 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
2051 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
2052 .access = PL0_W, .type = ARM_CP_DC_ZVA,
2053 #ifndef CONFIG_USER_ONLY
2054 /* Avoid overhead of an access check that always passes in user-mode */
2055 .accessfn = aa64_zva_access,
2056 #endif
2057 },
2058 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
2059 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
2060 .access = PL1_R, .type = ARM_CP_CURRENTEL },
2061 /* Cache ops: all NOPs since we don't emulate caches */
2062 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
2063 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
2064 .access = PL1_W, .type = ARM_CP_NOP },
2065 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
2066 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
2067 .access = PL1_W, .type = ARM_CP_NOP },
2068 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
2069 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
2070 .access = PL0_W, .type = ARM_CP_NOP,
2071 .accessfn = aa64_cacheop_access },
2072 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
2073 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
2074 .access = PL1_W, .type = ARM_CP_NOP },
2075 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
2076 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
2077 .access = PL1_W, .type = ARM_CP_NOP },
2078 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
2079 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
2080 .access = PL0_W, .type = ARM_CP_NOP,
2081 .accessfn = aa64_cacheop_access },
2082 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
2083 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
2084 .access = PL1_W, .type = ARM_CP_NOP },
2085 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
2086 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
2087 .access = PL0_W, .type = ARM_CP_NOP,
2088 .accessfn = aa64_cacheop_access },
2089 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
2090 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
2091 .access = PL0_W, .type = ARM_CP_NOP,
2092 .accessfn = aa64_cacheop_access },
2093 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
2094 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
2095 .access = PL1_W, .type = ARM_CP_NOP },
2096 /* TLBI operations */
2097 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
2098 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
2099 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2100 .writefn = tlbiall_is_write },
2101 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
2102 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
2103 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2104 .writefn = tlbi_aa64_va_is_write },
2105 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
2106 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
2107 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2108 .writefn = tlbi_aa64_asid_is_write },
2109 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
2110 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
2111 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2112 .writefn = tlbi_aa64_vaa_is_write },
2113 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
2114 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
2115 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2116 .writefn = tlbi_aa64_va_is_write },
2117 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
2118 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
2119 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2120 .writefn = tlbi_aa64_vaa_is_write },
2121 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
2122 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
2123 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2124 .writefn = tlbiall_write },
2125 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
2126 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
2127 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2128 .writefn = tlbi_aa64_va_write },
2129 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
2130 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
2131 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2132 .writefn = tlbi_aa64_asid_write },
2133 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
2134 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
2135 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2136 .writefn = tlbi_aa64_vaa_write },
2137 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
2138 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
2139 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2140 .writefn = tlbi_aa64_va_write },
2141 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
2142 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
2143 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
2144 .writefn = tlbi_aa64_vaa_write },
2145 #ifndef CONFIG_USER_ONLY
2146 /* 64 bit address translation operations */
2147 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
2148 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
2149 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
2150 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
2151 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
2152 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
2153 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
2154 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
2155 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
2156 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
2157 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
2158 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
2159 #endif
2160 /* TLB invalidate last level of translation table walk */
2161 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
2162 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_is_write },
2163 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
2164 .type = ARM_CP_NO_MIGRATE, .access = PL1_W,
2165 .writefn = tlbimvaa_is_write },
2166 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
2167 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
2168 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
2169 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimvaa_write },
2170 /* 32 bit cache operations */
2171 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
2172 .type = ARM_CP_NOP, .access = PL1_W },
2173 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
2174 .type = ARM_CP_NOP, .access = PL1_W },
2175 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
2176 .type = ARM_CP_NOP, .access = PL1_W },
2177 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
2178 .type = ARM_CP_NOP, .access = PL1_W },
2179 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
2180 .type = ARM_CP_NOP, .access = PL1_W },
2181 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
2182 .type = ARM_CP_NOP, .access = PL1_W },
2183 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
2184 .type = ARM_CP_NOP, .access = PL1_W },
2185 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
2186 .type = ARM_CP_NOP, .access = PL1_W },
2187 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
2188 .type = ARM_CP_NOP, .access = PL1_W },
2189 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
2190 .type = ARM_CP_NOP, .access = PL1_W },
2191 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
2192 .type = ARM_CP_NOP, .access = PL1_W },
2193 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
2194 .type = ARM_CP_NOP, .access = PL1_W },
2195 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
2196 .type = ARM_CP_NOP, .access = PL1_W },
2197 /* MMU Domain access control / MPU write buffer control */
2198 { .name = "DACR", .cp = 15,
2199 .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
2200 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c3),
2201 .resetvalue = 0, .writefn = dacr_write, .raw_writefn = raw_write, },
2202 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
2203 .type = ARM_CP_NO_MIGRATE,
2204 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
2205 .access = PL1_RW,
2206 .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
2207 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
2208 .type = ARM_CP_NO_MIGRATE,
2209 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
2210 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[0]) },
2211 /* We rely on the access checks not allowing the guest to write to the
2212 * state field when SPSel indicates that it's being used as the stack
2213 * pointer.
2214 */
2215 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
2216 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
2217 .access = PL1_RW, .accessfn = sp_el0_access,
2218 .type = ARM_CP_NO_MIGRATE,
2219 .fieldoffset = offsetof(CPUARMState, sp_el[0]) },
2220 { .name = "SPSel", .state = ARM_CP_STATE_AA64,
2221 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
2222 .type = ARM_CP_NO_MIGRATE,
2223 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
2224 REGINFO_SENTINEL
2225 };
2226
2227 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */
2228 static const ARMCPRegInfo v8_el3_no_el2_cp_reginfo[] = {
2229 { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
2230 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
2231 .access = PL2_RW,
2232 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
2233 REGINFO_SENTINEL
2234 };
2235
2236 static const ARMCPRegInfo v8_el2_cp_reginfo[] = {
2237 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
2238 .type = ARM_CP_NO_MIGRATE,
2239 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
2240 .access = PL2_RW,
2241 .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
2242 { .name = "ESR_EL2", .state = ARM_CP_STATE_AA64,
2243 .type = ARM_CP_NO_MIGRATE,
2244 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
2245 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
2246 { .name = "FAR_EL2", .state = ARM_CP_STATE_AA64,
2247 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
2248 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
2249 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
2250 .type = ARM_CP_NO_MIGRATE,
2251 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
2252 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[6]) },
2253 { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
2254 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
2255 .access = PL2_RW, .writefn = vbar_write,
2256 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
2257 .resetvalue = 0 },
2258 REGINFO_SENTINEL
2259 };
2260
2261 static const ARMCPRegInfo v8_el3_cp_reginfo[] = {
2262 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
2263 .type = ARM_CP_NO_MIGRATE,
2264 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
2265 .access = PL3_RW,
2266 .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
2267 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
2268 .type = ARM_CP_NO_MIGRATE,
2269 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
2270 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) },
2271 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64,
2272 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0,
2273 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) },
2274 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
2275 .type = ARM_CP_NO_MIGRATE,
2276 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
2277 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[7]) },
2278 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
2279 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
2280 .access = PL3_RW, .writefn = vbar_write,
2281 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
2282 .resetvalue = 0 },
2283 REGINFO_SENTINEL
2284 };
2285
2286 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2287 uint64_t value)
2288 {
2289 ARMCPU *cpu = arm_env_get_cpu(env);
2290
2291 if (raw_read(env, ri) == value) {
2292 /* Skip the TLB flush if nothing actually changed; Linux likes
2293 * to do a lot of pointless SCTLR writes.
2294 */
2295 return;
2296 }
2297
2298 raw_write(env, ri, value);
2299 /* ??? Lots of these bits are not implemented. */
2300 /* This may enable/disable the MMU, so do a TLB flush. */
2301 tlb_flush(CPU(cpu), 1);
2302 }
2303
2304 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
2305 {
2306 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
2307 * but the AArch32 CTR has its own reginfo struct)
2308 */
2309 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UCT)) {
2310 return CP_ACCESS_TRAP;
2311 }
2312 return CP_ACCESS_OK;
2313 }
2314
2315 static const ARMCPRegInfo debug_cp_reginfo[] = {
2316 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
2317 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
2318 * unlike DBGDRAR it is never accessible from EL0.
2319 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
2320 * accessor.
2321 */
2322 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
2323 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2324 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
2325 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
2326 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2327 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
2328 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2329 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
2330 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
2331 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
2332 .access = PL1_RW,
2333 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
2334 .resetvalue = 0 },
2335 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1.
2336 * We don't implement the configurable EL0 access.
2337 */
2338 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH,
2339 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
2340 .type = ARM_CP_NO_MIGRATE,
2341 .access = PL1_R,
2342 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
2343 .resetfn = arm_cp_reset_ignore },
2344 /* We define a dummy WI OSLAR_EL1, because Linux writes to it. */
2345 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
2346 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
2347 .access = PL1_W, .type = ARM_CP_NOP },
2348 /* Dummy OSDLR_EL1: 32-bit Linux will read this */
2349 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
2350 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
2351 .access = PL1_RW, .type = ARM_CP_NOP },
2352 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
2353 * implement vector catch debug events yet.
2354 */
2355 { .name = "DBGVCR",
2356 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
2357 .access = PL1_RW, .type = ARM_CP_NOP },
2358 REGINFO_SENTINEL
2359 };
2360
2361 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
2362 /* 64 bit access versions of the (dummy) debug registers */
2363 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
2364 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
2365 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
2366 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
2367 REGINFO_SENTINEL
2368 };
2369
2370 void hw_watchpoint_update(ARMCPU *cpu, int n)
2371 {
2372 CPUARMState *env = &cpu->env;
2373 vaddr len = 0;
2374 vaddr wvr = env->cp15.dbgwvr[n];
2375 uint64_t wcr = env->cp15.dbgwcr[n];
2376 int mask;
2377 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
2378
2379 if (env->cpu_watchpoint[n]) {
2380 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
2381 env->cpu_watchpoint[n] = NULL;
2382 }
2383
2384 if (!extract64(wcr, 0, 1)) {
2385 /* E bit clear : watchpoint disabled */
2386 return;
2387 }
2388
2389 switch (extract64(wcr, 3, 2)) {
2390 case 0:
2391 /* LSC 00 is reserved and must behave as if the wp is disabled */
2392 return;
2393 case 1:
2394 flags |= BP_MEM_READ;
2395 break;
2396 case 2:
2397 flags |= BP_MEM_WRITE;
2398 break;
2399 case 3:
2400 flags |= BP_MEM_ACCESS;
2401 break;
2402 }
2403
2404 /* Attempts to use both MASK and BAS fields simultaneously are
2405 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
2406 * thus generating a watchpoint for every byte in the masked region.
2407 */
2408 mask = extract64(wcr, 24, 4);
2409 if (mask == 1 || mask == 2) {
2410 /* Reserved values of MASK; we must act as if the mask value was
2411 * some non-reserved value, or as if the watchpoint were disabled.
2412 * We choose the latter.
2413 */
2414 return;
2415 } else if (mask) {
2416 /* Watchpoint covers an aligned area up to 2GB in size */
2417 len = 1ULL << mask;
2418 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
2419 * whether the watchpoint fires when the unmasked bits match; we opt
2420 * to generate the exceptions.
2421 */
2422 wvr &= ~(len - 1);
2423 } else {
2424 /* Watchpoint covers bytes defined by the byte address select bits */
2425 int bas = extract64(wcr, 5, 8);
2426 int basstart;
2427
2428 if (bas == 0) {
2429 /* This must act as if the watchpoint is disabled */
2430 return;
2431 }
2432
2433 if (extract64(wvr, 2, 1)) {
2434 /* Deprecated case of an only 4-aligned address. BAS[7:4] are
2435 * ignored, and BAS[3:0] define which bytes to watch.
2436 */
2437 bas &= 0xf;
2438 }
2439 /* The BAS bits are supposed to be programmed to indicate a contiguous
2440 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
2441 * we fire for each byte in the word/doubleword addressed by the WVR.
2442 * We choose to ignore any non-zero bits after the first range of 1s.
2443 */
2444 basstart = ctz32(bas);
2445 len = cto32(bas >> basstart);
2446 wvr += basstart;
2447 }
2448
2449 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
2450 &env->cpu_watchpoint[n]);
2451 }
2452
2453 void hw_watchpoint_update_all(ARMCPU *cpu)
2454 {
2455 int i;
2456 CPUARMState *env = &cpu->env;
2457
2458 /* Completely clear out existing QEMU watchpoints and our array, to
2459 * avoid possible stale entries following migration load.
2460 */
2461 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
2462 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
2463
2464 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
2465 hw_watchpoint_update(cpu, i);
2466 }
2467 }
2468
2469 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2470 uint64_t value)
2471 {
2472 ARMCPU *cpu = arm_env_get_cpu(env);
2473 int i = ri->crm;
2474
2475 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
2476 * register reads and behaves as if values written are sign extended.
2477 * Bits [1:0] are RES0.
2478 */
2479 value = sextract64(value, 0, 49) & ~3ULL;
2480
2481 raw_write(env, ri, value);
2482 hw_watchpoint_update(cpu, i);
2483 }
2484
2485 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2486 uint64_t value)
2487 {
2488 ARMCPU *cpu = arm_env_get_cpu(env);
2489 int i = ri->crm;
2490
2491 raw_write(env, ri, value);
2492 hw_watchpoint_update(cpu, i);
2493 }
2494
2495 static void define_debug_regs(ARMCPU *cpu)
2496 {
2497 /* Define v7 and v8 architectural debug registers.
2498 * These are just dummy implementations for now.
2499 */
2500 int i;
2501 int wrps, brps, ctx_cmps;
2502 ARMCPRegInfo dbgdidr = {
2503 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
2504 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr,
2505 };
2506
2507 /* Note that all these register fields hold "number of Xs minus 1". */
2508 brps = extract32(cpu->dbgdidr, 24, 4);
2509 wrps = extract32(cpu->dbgdidr, 28, 4);
2510 ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
2511
2512 assert(ctx_cmps <= brps);
2513
2514 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties
2515 * of the debug registers such as number of breakpoints;
2516 * check that if they both exist then they agree.
2517 */
2518 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
2519 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps);
2520 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps);
2521 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps);
2522 }
2523
2524 define_one_arm_cp_reg(cpu, &dbgdidr);
2525 define_arm_cp_regs(cpu, debug_cp_reginfo);
2526
2527 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
2528 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
2529 }
2530
2531 for (i = 0; i < brps + 1; i++) {
2532 ARMCPRegInfo dbgregs[] = {
2533 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH,
2534 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
2535 .access = PL1_RW,
2536 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]) },
2537 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH,
2538 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
2539 .access = PL1_RW,
2540 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]) },
2541 REGINFO_SENTINEL
2542 };
2543 define_arm_cp_regs(cpu, dbgregs);
2544 }
2545
2546 for (i = 0; i < wrps + 1; i++) {
2547 ARMCPRegInfo dbgregs[] = {
2548 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH,
2549 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
2550 .access = PL1_RW,
2551 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
2552 .writefn = dbgwvr_write, .raw_writefn = raw_write
2553 },
2554 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH,
2555 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
2556 .access = PL1_RW,
2557 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
2558 .writefn = dbgwcr_write, .raw_writefn = raw_write
2559 },
2560 REGINFO_SENTINEL
2561 };
2562 define_arm_cp_regs(cpu, dbgregs);
2563 }
2564 }
2565
2566 void register_cp_regs_for_features(ARMCPU *cpu)
2567 {
2568 /* Register all the coprocessor registers based on feature bits */
2569 CPUARMState *env = &cpu->env;
2570 if (arm_feature(env, ARM_FEATURE_M)) {
2571 /* M profile has no coprocessor registers */
2572 return;
2573 }
2574
2575 define_arm_cp_regs(cpu, cp_reginfo);
2576 if (!arm_feature(env, ARM_FEATURE_V8)) {
2577 /* Must go early as it is full of wildcards that may be
2578 * overridden by later definitions.
2579 */
2580 define_arm_cp_regs(cpu, not_v8_cp_reginfo);
2581 }
2582
2583 if (arm_feature(env, ARM_FEATURE_V6)) {
2584 /* The ID registers all have impdef reset values */
2585 ARMCPRegInfo v6_idregs[] = {
2586 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
2587 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
2588 .access = PL1_R, .type = ARM_CP_CONST,
2589 .resetvalue = cpu->id_pfr0 },
2590 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
2591 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
2592 .access = PL1_R, .type = ARM_CP_CONST,
2593 .resetvalue = cpu->id_pfr1 },
2594 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
2595 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
2596 .access = PL1_R, .type = ARM_CP_CONST,
2597 .resetvalue = cpu->id_dfr0 },
2598 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
2599 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
2600 .access = PL1_R, .type = ARM_CP_CONST,
2601 .resetvalue = cpu->id_afr0 },
2602 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
2603 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
2604 .access = PL1_R, .type = ARM_CP_CONST,
2605 .resetvalue = cpu->id_mmfr0 },
2606 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
2607 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
2608 .access = PL1_R, .type = ARM_CP_CONST,
2609 .resetvalue = cpu->id_mmfr1 },
2610 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
2611 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
2612 .access = PL1_R, .type = ARM_CP_CONST,
2613 .resetvalue = cpu->id_mmfr2 },
2614 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
2615 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
2616 .access = PL1_R, .type = ARM_CP_CONST,
2617 .resetvalue = cpu->id_mmfr3 },
2618 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
2619 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
2620 .access = PL1_R, .type = ARM_CP_CONST,
2621 .resetvalue = cpu->id_isar0 },
2622 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
2623 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
2624 .access = PL1_R, .type = ARM_CP_CONST,
2625 .resetvalue = cpu->id_isar1 },
2626 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
2627 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
2628 .access = PL1_R, .type = ARM_CP_CONST,
2629 .resetvalue = cpu->id_isar2 },
2630 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
2631 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
2632 .access = PL1_R, .type = ARM_CP_CONST,
2633 .resetvalue = cpu->id_isar3 },
2634 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
2635 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
2636 .access = PL1_R, .type = ARM_CP_CONST,
2637 .resetvalue = cpu->id_isar4 },
2638 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
2639 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
2640 .access = PL1_R, .type = ARM_CP_CONST,
2641 .resetvalue = cpu->id_isar5 },
2642 /* 6..7 are as yet unallocated and must RAZ */
2643 { .name = "ID_ISAR6", .cp = 15, .crn = 0, .crm = 2,
2644 .opc1 = 0, .opc2 = 6, .access = PL1_R, .type = ARM_CP_CONST,
2645 .resetvalue = 0 },
2646 { .name = "ID_ISAR7", .cp = 15, .crn = 0, .crm = 2,
2647 .opc1 = 0, .opc2 = 7, .access = PL1_R, .type = ARM_CP_CONST,
2648 .resetvalue = 0 },
2649 REGINFO_SENTINEL
2650 };
2651 define_arm_cp_regs(cpu, v6_idregs);
2652 define_arm_cp_regs(cpu, v6_cp_reginfo);
2653 } else {
2654 define_arm_cp_regs(cpu, not_v6_cp_reginfo);
2655 }
2656 if (arm_feature(env, ARM_FEATURE_V6K)) {
2657 define_arm_cp_regs(cpu, v6k_cp_reginfo);
2658 }
2659 if (arm_feature(env, ARM_FEATURE_V7MP)) {
2660 define_arm_cp_regs(cpu, v7mp_cp_reginfo);
2661 }
2662 if (arm_feature(env, ARM_FEATURE_V7)) {
2663 /* v7 performance monitor control register: same implementor
2664 * field as main ID register, and we implement only the cycle
2665 * count register.
2666 */
2667 #ifndef CONFIG_USER_ONLY
2668 ARMCPRegInfo pmcr = {
2669 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
2670 .access = PL0_RW,
2671 .type = ARM_CP_IO | ARM_CP_NO_MIGRATE,
2672 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
2673 .accessfn = pmreg_access, .writefn = pmcr_write,
2674 .raw_writefn = raw_write,
2675 };
2676 ARMCPRegInfo pmcr64 = {
2677 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
2678 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
2679 .access = PL0_RW, .accessfn = pmreg_access,
2680 .type = ARM_CP_IO,
2681 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
2682 .resetvalue = cpu->midr & 0xff000000,
2683 .writefn = pmcr_write, .raw_writefn = raw_write,
2684 };
2685 define_one_arm_cp_reg(cpu, &pmcr);
2686 define_one_arm_cp_reg(cpu, &pmcr64);
2687 #endif
2688 ARMCPRegInfo clidr = {
2689 .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
2690 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
2691 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr
2692 };
2693 define_one_arm_cp_reg(cpu, &clidr);
2694 define_arm_cp_regs(cpu, v7_cp_reginfo);
2695 define_debug_regs(cpu);
2696 } else {
2697 define_arm_cp_regs(cpu, not_v7_cp_reginfo);
2698 }
2699 if (arm_feature(env, ARM_FEATURE_V8)) {
2700 /* AArch64 ID registers, which all have impdef reset values */
2701 ARMCPRegInfo v8_idregs[] = {
2702 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
2703 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
2704 .access = PL1_R, .type = ARM_CP_CONST,
2705 .resetvalue = cpu->id_aa64pfr0 },
2706 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
2707 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
2708 .access = PL1_R, .type = ARM_CP_CONST,
2709 .resetvalue = cpu->id_aa64pfr1},
2710 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
2711 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
2712 .access = PL1_R, .type = ARM_CP_CONST,
2713 /* We mask out the PMUVer field, because we don't currently
2714 * implement the PMU. Not advertising it prevents the guest
2715 * from trying to use it and getting UNDEFs on registers we
2716 * don't implement.
2717 */
2718 .resetvalue = cpu->id_aa64dfr0 & ~0xf00 },
2719 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
2720 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
2721 .access = PL1_R, .type = ARM_CP_CONST,
2722 .resetvalue = cpu->id_aa64dfr1 },
2723 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
2724 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
2725 .access = PL1_R, .type = ARM_CP_CONST,
2726 .resetvalue = cpu->id_aa64afr0 },
2727 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
2728 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
2729 .access = PL1_R, .type = ARM_CP_CONST,
2730 .resetvalue = cpu->id_aa64afr1 },
2731 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
2732 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
2733 .access = PL1_R, .type = ARM_CP_CONST,
2734 .resetvalue = cpu->id_aa64isar0 },
2735 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
2736 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
2737 .access = PL1_R, .type = ARM_CP_CONST,
2738 .resetvalue = cpu->id_aa64isar1 },
2739 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
2740 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
2741 .access = PL1_R, .type = ARM_CP_CONST,
2742 .resetvalue = cpu->id_aa64mmfr0 },
2743 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
2744 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
2745 .access = PL1_R, .type = ARM_CP_CONST,
2746 .resetvalue = cpu->id_aa64mmfr1 },
2747 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
2748 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
2749 .access = PL1_R, .type = ARM_CP_CONST,
2750 .resetvalue = cpu->mvfr0 },
2751 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
2752 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
2753 .access = PL1_R, .type = ARM_CP_CONST,
2754 .resetvalue = cpu->mvfr1 },
2755 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
2756 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
2757 .access = PL1_R, .type = ARM_CP_CONST,
2758 .resetvalue = cpu->mvfr2 },
2759 REGINFO_SENTINEL
2760 };
2761 ARMCPRegInfo rvbar = {
2762 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
2763 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 2,
2764 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
2765 };
2766 define_one_arm_cp_reg(cpu, &rvbar);
2767 define_arm_cp_regs(cpu, v8_idregs);
2768 define_arm_cp_regs(cpu, v8_cp_reginfo);
2769 }
2770 if (arm_feature(env, ARM_FEATURE_EL2)) {
2771 define_arm_cp_regs(cpu, v8_el2_cp_reginfo);
2772 } else {
2773 /* If EL2 is missing but higher ELs are enabled, we need to
2774 * register the no_el2 reginfos.
2775 */
2776 if (arm_feature(env, ARM_FEATURE_EL3)) {
2777 define_arm_cp_regs(cpu, v8_el3_no_el2_cp_reginfo);
2778 }
2779 }
2780 if (arm_feature(env, ARM_FEATURE_EL3)) {
2781 define_arm_cp_regs(cpu, v8_el3_cp_reginfo);
2782 }
2783 if (arm_feature(env, ARM_FEATURE_MPU)) {
2784 /* These are the MPU registers prior to PMSAv6. Any new
2785 * PMSA core later than the ARM946 will require that we
2786 * implement the PMSAv6 or PMSAv7 registers, which are
2787 * completely different.
2788 */
2789 assert(!arm_feature(env, ARM_FEATURE_V6));
2790 define_arm_cp_regs(cpu, pmsav5_cp_reginfo);
2791 } else {
2792 define_arm_cp_regs(cpu, vmsa_cp_reginfo);
2793 }
2794 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
2795 define_arm_cp_regs(cpu, t2ee_cp_reginfo);
2796 }
2797 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
2798 define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
2799 }
2800 if (arm_feature(env, ARM_FEATURE_VAPA)) {
2801 define_arm_cp_regs(cpu, vapa_cp_reginfo);
2802 }
2803 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) {
2804 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo);
2805 }
2806 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) {
2807 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo);
2808 }
2809 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) {
2810 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo);
2811 }
2812 if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
2813 define_arm_cp_regs(cpu, omap_cp_reginfo);
2814 }
2815 if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
2816 define_arm_cp_regs(cpu, strongarm_cp_reginfo);
2817 }
2818 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
2819 define_arm_cp_regs(cpu, xscale_cp_reginfo);
2820 }
2821 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
2822 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
2823 }
2824 if (arm_feature(env, ARM_FEATURE_LPAE)) {
2825 define_arm_cp_regs(cpu, lpae_cp_reginfo);
2826 }
2827 /* Slightly awkwardly, the OMAP and StrongARM cores need all of
2828 * cp15 crn=0 to be writes-ignored, whereas for other cores they should
2829 * be read-only (ie write causes UNDEF exception).
2830 */
2831 {
2832 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = {
2833 /* Pre-v8 MIDR space.
2834 * Note that the MIDR isn't a simple constant register because
2835 * of the TI925 behaviour where writes to another register can
2836 * cause the MIDR value to change.
2837 *
2838 * Unimplemented registers in the c15 0 0 0 space default to
2839 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
2840 * and friends override accordingly.
2841 */
2842 { .name = "MIDR",
2843 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
2844 .access = PL1_R, .resetvalue = cpu->midr,
2845 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
2846 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
2847 .type = ARM_CP_OVERRIDE },
2848 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
2849 { .name = "DUMMY",
2850 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY,
2851 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2852 { .name = "DUMMY",
2853 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY,
2854 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2855 { .name = "DUMMY",
2856 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY,
2857 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2858 { .name = "DUMMY",
2859 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY,
2860 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2861 { .name = "DUMMY",
2862 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
2863 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2864 REGINFO_SENTINEL
2865 };
2866 ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
2867 /* v8 MIDR -- the wildcard isn't necessary, and nor is the
2868 * variable-MIDR TI925 behaviour. Instead we have a single
2869 * (strictly speaking IMPDEF) alias of the MIDR, REVIDR.
2870 */
2871 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
2872 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0,
2873 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->midr },
2874 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
2875 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
2876 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->midr },
2877 REGINFO_SENTINEL
2878 };
2879 ARMCPRegInfo id_cp_reginfo[] = {
2880 /* These are common to v8 and pre-v8 */
2881 { .name = "CTR",
2882 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
2883 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
2884 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64,
2885 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0,
2886 .access = PL0_R, .accessfn = ctr_el0_access,
2887 .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
2888 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
2889 { .name = "TCMTR",
2890 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
2891 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2892 { .name = "TLBTR",
2893 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
2894 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2895 REGINFO_SENTINEL
2896 };
2897 ARMCPRegInfo crn0_wi_reginfo = {
2898 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
2899 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
2900 .type = ARM_CP_NOP | ARM_CP_OVERRIDE
2901 };
2902 if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
2903 arm_feature(env, ARM_FEATURE_STRONGARM)) {
2904 ARMCPRegInfo *r;
2905 /* Register the blanket "writes ignored" value first to cover the
2906 * whole space. Then update the specific ID registers to allow write
2907 * access, so that they ignore writes rather than causing them to
2908 * UNDEF.
2909 */
2910 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
2911 for (r = id_pre_v8_midr_cp_reginfo;
2912 r->type != ARM_CP_SENTINEL; r++) {
2913 r->access = PL1_RW;
2914 }
2915 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
2916 r->access = PL1_RW;
2917 }
2918 }
2919 if (arm_feature(env, ARM_FEATURE_V8)) {
2920 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
2921 } else {
2922 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
2923 }
2924 define_arm_cp_regs(cpu, id_cp_reginfo);
2925 }
2926
2927 if (arm_feature(env, ARM_FEATURE_MPIDR)) {
2928 define_arm_cp_regs(cpu, mpidr_cp_reginfo);
2929 }
2930
2931 if (arm_feature(env, ARM_FEATURE_AUXCR)) {
2932 ARMCPRegInfo auxcr = {
2933 .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH,
2934 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1,
2935 .access = PL1_RW, .type = ARM_CP_CONST,
2936 .resetvalue = cpu->reset_auxcr
2937 };
2938 define_one_arm_cp_reg(cpu, &auxcr);
2939 }
2940
2941 if (arm_feature(env, ARM_FEATURE_CBAR)) {
2942 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
2943 /* 32 bit view is [31:18] 0...0 [43:32]. */
2944 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
2945 | extract64(cpu->reset_cbar, 32, 12);
2946 ARMCPRegInfo cbar_reginfo[] = {
2947 { .name = "CBAR",
2948 .type = ARM_CP_CONST,
2949 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
2950 .access = PL1_R, .resetvalue = cpu->reset_cbar },
2951 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
2952 .type = ARM_CP_CONST,
2953 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
2954 .access = PL1_R, .resetvalue = cbar32 },
2955 REGINFO_SENTINEL
2956 };
2957 /* We don't implement a r/w 64 bit CBAR currently */
2958 assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
2959 define_arm_cp_regs(cpu, cbar_reginfo);
2960 } else {
2961 ARMCPRegInfo cbar = {
2962 .name = "CBAR",
2963 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
2964 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar,
2965 .fieldoffset = offsetof(CPUARMState,
2966 cp15.c15_config_base_address)
2967 };
2968 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
2969 cbar.access = PL1_R;
2970 cbar.fieldoffset = 0;
2971 cbar.type = ARM_CP_CONST;
2972 }
2973 define_one_arm_cp_reg(cpu, &cbar);
2974 }
2975 }
2976
2977 /* Generic registers whose values depend on the implementation */
2978 {
2979 ARMCPRegInfo sctlr = {
2980 .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
2981 .opc0 = 3, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
2982 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_sys),
2983 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
2984 .raw_writefn = raw_write,
2985 };
2986 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
2987 /* Normally we would always end the TB on an SCTLR write, but Linux
2988 * arch/arm/mach-pxa/sleep.S expects two instructions following
2989 * an MMU enable to execute from cache. Imitate this behaviour.
2990 */
2991 sctlr.type |= ARM_CP_SUPPRESS_TB_END;
2992 }
2993 define_one_arm_cp_reg(cpu, &sctlr);
2994 }
2995 }
2996
2997 ARMCPU *cpu_arm_init(const char *cpu_model)
2998 {
2999 return ARM_CPU(cpu_generic_init(TYPE_ARM_CPU, cpu_model));
3000 }
3001
3002 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
3003 {
3004 CPUState *cs = CPU(cpu);
3005 CPUARMState *env = &cpu->env;
3006
3007 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
3008 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
3009 aarch64_fpu_gdb_set_reg,
3010 34, "aarch64-fpu.xml", 0);
3011 } else if (arm_feature(env, ARM_FEATURE_NEON)) {
3012 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
3013 51, "arm-neon.xml", 0);
3014 } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
3015 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
3016 35, "arm-vfp3.xml", 0);
3017 } else if (arm_feature(env, ARM_FEATURE_VFP)) {
3018 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
3019 19, "arm-vfp.xml", 0);
3020 }
3021 }
3022
3023 /* Sort alphabetically by type name, except for "any". */
3024 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b)
3025 {
3026 ObjectClass *class_a = (ObjectClass *)a;
3027 ObjectClass *class_b = (ObjectClass *)b;
3028 const char *name_a, *name_b;
3029
3030 name_a = object_class_get_name(class_a);
3031 name_b = object_class_get_name(class_b);
3032 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) {
3033 return 1;
3034 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) {
3035 return -1;
3036 } else {
3037 return strcmp(name_a, name_b);
3038 }
3039 }
3040
3041 static void arm_cpu_list_entry(gpointer data, gpointer user_data)
3042 {
3043 ObjectClass *oc = data;
3044 CPUListState *s = user_data;
3045 const char *typename;
3046 char *name;
3047
3048 typename = object_class_get_name(oc);
3049 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU));
3050 (*s->cpu_fprintf)(s->file, " %s\n",
3051 name);
3052 g_free(name);
3053 }
3054
3055 void arm_cpu_list(FILE *f, fprintf_function cpu_fprintf)
3056 {
3057 CPUListState s = {
3058 .file = f,
3059 .cpu_fprintf = cpu_fprintf,
3060 };
3061 GSList *list;
3062
3063 list = object_class_get_list(TYPE_ARM_CPU, false);
3064 list = g_slist_sort(list, arm_cpu_list_compare);
3065 (*cpu_fprintf)(f, "Available CPUs:\n");
3066 g_slist_foreach(list, arm_cpu_list_entry, &s);
3067 g_slist_free(list);
3068 #ifdef CONFIG_KVM
3069 /* The 'host' CPU type is dynamically registered only if KVM is
3070 * enabled, so we have to special-case it here:
3071 */
3072 (*cpu_fprintf)(f, " host (only available in KVM mode)\n");
3073 #endif
3074 }
3075
3076 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
3077 {
3078 ObjectClass *oc = data;
3079 CpuDefinitionInfoList **cpu_list = user_data;
3080 CpuDefinitionInfoList *entry;
3081 CpuDefinitionInfo *info;
3082 const char *typename;
3083
3084 typename = object_class_get_name(oc);
3085 info = g_malloc0(sizeof(*info));
3086 info->name = g_strndup(typename,
3087 strlen(typename) - strlen("-" TYPE_ARM_CPU));
3088
3089 entry = g_malloc0(sizeof(*entry));
3090 entry->value = info;
3091 entry->next = *cpu_list;
3092 *cpu_list = entry;
3093 }
3094
3095 CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp)
3096 {
3097 CpuDefinitionInfoList *cpu_list = NULL;
3098 GSList *list;
3099
3100 list = object_class_get_list(TYPE_ARM_CPU, false);
3101 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list);
3102 g_slist_free(list);
3103
3104 return cpu_list;
3105 }
3106
3107 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
3108 void *opaque, int state,
3109 int crm, int opc1, int opc2)
3110 {
3111 /* Private utility function for define_one_arm_cp_reg_with_opaque():
3112 * add a single reginfo struct to the hash table.
3113 */
3114 uint32_t *key = g_new(uint32_t, 1);
3115 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
3116 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
3117 if (r->state == ARM_CP_STATE_BOTH && state == ARM_CP_STATE_AA32) {
3118 /* The AArch32 view of a shared register sees the lower 32 bits
3119 * of a 64 bit backing field. It is not migratable as the AArch64
3120 * view handles that. AArch64 also handles reset.
3121 * We assume it is a cp15 register if the .cp field is left unset.
3122 */
3123 if (r2->cp == 0) {
3124 r2->cp = 15;
3125 }
3126 r2->type |= ARM_CP_NO_MIGRATE;
3127 r2->resetfn = arm_cp_reset_ignore;
3128 #ifdef HOST_WORDS_BIGENDIAN
3129 if (r2->fieldoffset) {
3130 r2->fieldoffset += sizeof(uint32_t);
3131 }
3132 #endif
3133 }
3134 if (state == ARM_CP_STATE_AA64) {
3135 /* To allow abbreviation of ARMCPRegInfo
3136 * definitions, we treat cp == 0 as equivalent to
3137 * the value for "standard guest-visible sysreg".
3138 * STATE_BOTH definitions are also always "standard
3139 * sysreg" in their AArch64 view (the .cp value may
3140 * be non-zero for the benefit of the AArch32 view).
3141 */
3142 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
3143 r2->cp = CP_REG_ARM64_SYSREG_CP;
3144 }
3145 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
3146 r2->opc0, opc1, opc2);
3147 } else {
3148 *key = ENCODE_CP_REG(r2->cp, is64, r2->crn, crm, opc1, opc2);
3149 }
3150 if (opaque) {
3151 r2->opaque = opaque;
3152 }
3153 /* reginfo passed to helpers is correct for the actual access,
3154 * and is never ARM_CP_STATE_BOTH:
3155 */
3156 r2->state = state;
3157 /* Make sure reginfo passed to helpers for wildcarded regs
3158 * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
3159 */
3160 r2->crm = crm;
3161 r2->opc1 = opc1;
3162 r2->opc2 = opc2;
3163 /* By convention, for wildcarded registers only the first
3164 * entry is used for migration; the others are marked as
3165 * NO_MIGRATE so we don't try to transfer the register
3166 * multiple times. Special registers (ie NOP/WFI) are
3167 * never migratable.
3168 */
3169 if ((r->type & ARM_CP_SPECIAL) ||
3170 ((r->crm == CP_ANY) && crm != 0) ||
3171 ((r->opc1 == CP_ANY) && opc1 != 0) ||
3172 ((r->opc2 == CP_ANY) && opc2 != 0)) {
3173 r2->type |= ARM_CP_NO_MIGRATE;
3174 }
3175
3176 /* Overriding of an existing definition must be explicitly
3177 * requested.
3178 */
3179 if (!(r->type & ARM_CP_OVERRIDE)) {
3180 ARMCPRegInfo *oldreg;
3181 oldreg = g_hash_table_lookup(cpu->cp_regs, key);
3182 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
3183 fprintf(stderr, "Register redefined: cp=%d %d bit "
3184 "crn=%d crm=%d opc1=%d opc2=%d, "
3185 "was %s, now %s\n", r2->cp, 32 + 32 * is64,
3186 r2->crn, r2->crm, r2->opc1, r2->opc2,
3187 oldreg->name, r2->name);
3188 g_assert_not_reached();
3189 }
3190 }
3191 g_hash_table_insert(cpu->cp_regs, key, r2);
3192 }
3193
3194
3195 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
3196 const ARMCPRegInfo *r, void *opaque)
3197 {
3198 /* Define implementations of coprocessor registers.
3199 * We store these in a hashtable because typically
3200 * there are less than 150 registers in a space which
3201 * is 16*16*16*8*8 = 262144 in size.
3202 * Wildcarding is supported for the crm, opc1 and opc2 fields.
3203 * If a register is defined twice then the second definition is
3204 * used, so this can be used to define some generic registers and
3205 * then override them with implementation specific variations.
3206 * At least one of the original and the second definition should
3207 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard
3208 * against accidental use.
3209 *
3210 * The state field defines whether the register is to be
3211 * visible in the AArch32 or AArch64 execution state. If the
3212 * state is set to ARM_CP_STATE_BOTH then we synthesise a
3213 * reginfo structure for the AArch32 view, which sees the lower
3214 * 32 bits of the 64 bit register.
3215 *
3216 * Only registers visible in AArch64 may set r->opc0; opc0 cannot
3217 * be wildcarded. AArch64 registers are always considered to be 64
3218 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
3219 * the register, if any.
3220 */
3221 int crm, opc1, opc2, state;
3222 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
3223 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
3224 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
3225 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
3226 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
3227 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
3228 /* 64 bit registers have only CRm and Opc1 fields */
3229 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
3230 /* op0 only exists in the AArch64 encodings */
3231 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0));
3232 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
3233 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT));
3234 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1
3235 * encodes a minimum access level for the register. We roll this
3236 * runtime check into our general permission check code, so check
3237 * here that the reginfo's specified permissions are strict enough
3238 * to encompass the generic architectural permission check.
3239 */
3240 if (r->state != ARM_CP_STATE_AA32) {
3241 int mask = 0;
3242 switch (r->opc1) {
3243 case 0: case 1: case 2:
3244 /* min_EL EL1 */
3245 mask = PL1_RW;
3246 break;
3247 case 3:
3248 /* min_EL EL0 */
3249 mask = PL0_RW;
3250 break;
3251 case 4:
3252 /* min_EL EL2 */
3253 mask = PL2_RW;
3254 break;
3255 case 5:
3256 /* unallocated encoding, so not possible */
3257 assert(false);
3258 break;
3259 case 6:
3260 /* min_EL EL3 */
3261 mask = PL3_RW;
3262 break;
3263 case 7:
3264 /* min_EL EL1, secure mode only (we don't check the latter) */
3265 mask = PL1_RW;
3266 break;
3267 default:
3268 /* broken reginfo with out-of-range opc1 */
3269 assert(false);
3270 break;
3271 }
3272 /* assert our permissions are not too lax (stricter is fine) */
3273 assert((r->access & ~mask) == 0);
3274 }
3275
3276 /* Check that the register definition has enough info to handle
3277 * reads and writes if they are permitted.
3278 */
3279 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) {
3280 if (r->access & PL3_R) {
3281 assert(r->fieldoffset || r->readfn);
3282 }
3283 if (r->access & PL3_W) {
3284 assert(r->fieldoffset || r->writefn);
3285 }
3286 }
3287 /* Bad type field probably means missing sentinel at end of reg list */
3288 assert(cptype_valid(r->type));
3289 for (crm = crmmin; crm <= crmmax; crm++) {
3290 for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
3291 for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
3292 for (state = ARM_CP_STATE_AA32;
3293 state <= ARM_CP_STATE_AA64; state++) {
3294 if (r->state != state && r->state != ARM_CP_STATE_BOTH) {
3295 continue;
3296 }
3297 add_cpreg_to_hashtable(cpu, r, opaque, state,
3298 crm, opc1, opc2);
3299 }
3300 }
3301 }
3302 }
3303 }
3304
3305 void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
3306 const ARMCPRegInfo *regs, void *opaque)
3307 {
3308 /* Define a whole list of registers */
3309 const ARMCPRegInfo *r;
3310 for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
3311 define_one_arm_cp_reg_with_opaque(cpu, r, opaque);
3312 }
3313 }
3314
3315 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
3316 {
3317 return g_hash_table_lookup(cpregs, &encoded_cp);
3318 }
3319
3320 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
3321 uint64_t value)
3322 {
3323 /* Helper coprocessor write function for write-ignore registers */
3324 }
3325
3326 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri)
3327 {
3328 /* Helper coprocessor write function for read-as-zero registers */
3329 return 0;
3330 }
3331
3332 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque)
3333 {
3334 /* Helper coprocessor reset function for do-nothing-on-reset registers */
3335 }
3336
3337 static int bad_mode_switch(CPUARMState *env, int mode)
3338 {
3339 /* Return true if it is not valid for us to switch to
3340 * this CPU mode (ie all the UNPREDICTABLE cases in
3341 * the ARM ARM CPSRWriteByInstr pseudocode).
3342 */
3343 switch (mode) {
3344 case ARM_CPU_MODE_USR:
3345 case ARM_CPU_MODE_SYS:
3346 case ARM_CPU_MODE_SVC:
3347 case ARM_CPU_MODE_ABT:
3348 case ARM_CPU_MODE_UND:
3349 case ARM_CPU_MODE_IRQ:
3350 case ARM_CPU_MODE_FIQ:
3351 return 0;
3352 default:
3353 return 1;
3354 }
3355 }
3356
3357 uint32_t cpsr_read(CPUARMState *env)
3358 {
3359 int ZF;
3360 ZF = (env->ZF == 0);
3361 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
3362 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
3363 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
3364 | ((env->condexec_bits & 0xfc) << 8)
3365 | (env->GE << 16) | (env->daif & CPSR_AIF);
3366 }
3367
3368 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
3369 {
3370 if (mask & CPSR_NZCV) {
3371 env->ZF = (~val) & CPSR_Z;
3372 env->NF = val;
3373 env->CF = (val >> 29) & 1;
3374 env->VF = (val << 3) & 0x80000000;
3375 }
3376 if (mask & CPSR_Q)
3377 env->QF = ((val & CPSR_Q) != 0);
3378 if (mask & CPSR_T)
3379 env->thumb = ((val & CPSR_T) != 0);
3380 if (mask & CPSR_IT_0_1) {
3381 env->condexec_bits &= ~3;
3382 env->condexec_bits |= (val >> 25) & 3;
3383 }
3384 if (mask & CPSR_IT_2_7) {
3385 env->condexec_bits &= 3;
3386 env->condexec_bits |= (val >> 8) & 0xfc;
3387 }
3388 if (mask & CPSR_GE) {
3389 env->GE = (val >> 16) & 0xf;
3390 }
3391
3392 env->daif &= ~(CPSR_AIF & mask);
3393 env->daif |= val & CPSR_AIF & mask;
3394
3395 if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
3396 if (bad_mode_switch(env, val & CPSR_M)) {
3397 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE.
3398 * We choose to ignore the attempt and leave the CPSR M field
3399 * untouched.
3400 */
3401 mask &= ~CPSR_M;
3402 } else {
3403 switch_mode(env, val & CPSR_M);
3404 }
3405 }
3406 mask &= ~CACHED_CPSR_BITS;
3407 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
3408 }
3409
3410 /* Sign/zero extend */
3411 uint32_t HELPER(sxtb16)(uint32_t x)
3412 {
3413 uint32_t res;
3414 res = (uint16_t)(int8_t)x;
3415 res |= (uint32_t)(int8_t)(x >> 16) << 16;
3416 return res;
3417 }
3418
3419 uint32_t HELPER(uxtb16)(uint32_t x)
3420 {
3421 uint32_t res;
3422 res = (uint16_t)(uint8_t)x;
3423 res |= (uint32_t)(uint8_t)(x >> 16) << 16;
3424 return res;
3425 }
3426
3427 uint32_t HELPER(clz)(uint32_t x)
3428 {
3429 return clz32(x);
3430 }
3431
3432 int32_t HELPER(sdiv)(int32_t num, int32_t den)
3433 {
3434 if (den == 0)
3435 return 0;
3436 if (num == INT_MIN && den == -1)
3437 return INT_MIN;
3438 return num / den;
3439 }
3440
3441 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
3442 {
3443 if (den == 0)
3444 return 0;
3445 return num / den;
3446 }
3447
3448 uint32_t HELPER(rbit)(uint32_t x)
3449 {
3450 x = ((x & 0xff000000) >> 24)
3451 | ((x & 0x00ff0000) >> 8)
3452 | ((x & 0x0000ff00) << 8)
3453 | ((x & 0x000000ff) << 24);
3454 x = ((x & 0xf0f0f0f0) >> 4)
3455 | ((x & 0x0f0f0f0f) << 4);
3456 x = ((x & 0x88888888) >> 3)
3457 | ((x & 0x44444444) >> 1)
3458 | ((x & 0x22222222) << 1)
3459 | ((x & 0x11111111) << 3);
3460 return x;
3461 }
3462
3463 #if defined(CONFIG_USER_ONLY)
3464
3465 void arm_cpu_do_interrupt(CPUState *cs)
3466 {
3467 cs->exception_index = -1;
3468 }
3469
3470 int arm_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int rw,
3471 int mmu_idx)
3472 {
3473 ARMCPU *cpu = ARM_CPU(cs);
3474 CPUARMState *env = &cpu->env;
3475
3476 env->exception.vaddress = address;
3477 if (rw == 2) {
3478 cs->exception_index = EXCP_PREFETCH_ABORT;
3479 } else {
3480 cs->exception_index = EXCP_DATA_ABORT;
3481 }
3482 return 1;
3483 }
3484
3485 /* These should probably raise undefined insn exceptions. */
3486 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
3487 {
3488 ARMCPU *cpu = arm_env_get_cpu(env);
3489
3490 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg);
3491 }
3492
3493 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
3494 {
3495 ARMCPU *cpu = arm_env_get_cpu(env);
3496
3497 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg);
3498 return 0;
3499 }
3500
3501 void switch_mode(CPUARMState *env, int mode)
3502 {
3503 ARMCPU *cpu = arm_env_get_cpu(env);
3504
3505 if (mode != ARM_CPU_MODE_USR) {
3506 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n");
3507 }
3508 }
3509
3510 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
3511 {
3512 ARMCPU *cpu = arm_env_get_cpu(env);
3513
3514 cpu_abort(CPU(cpu), "banked r13 write\n");
3515 }
3516
3517 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
3518 {
3519 ARMCPU *cpu = arm_env_get_cpu(env);
3520
3521 cpu_abort(CPU(cpu), "banked r13 read\n");
3522 return 0;
3523 }
3524
3525 #else
3526
3527 /* Map CPU modes onto saved register banks. */
3528 int bank_number(int mode)
3529 {
3530 switch (mode) {
3531 case ARM_CPU_MODE_USR:
3532 case ARM_CPU_MODE_SYS:
3533 return 0;
3534 case ARM_CPU_MODE_SVC:
3535 return 1;
3536 case ARM_CPU_MODE_ABT:
3537 return 2;
3538 case ARM_CPU_MODE_UND:
3539 return 3;
3540 case ARM_CPU_MODE_IRQ:
3541 return 4;
3542 case ARM_CPU_MODE_FIQ:
3543 return 5;
3544 case ARM_CPU_MODE_HYP:
3545 return 6;
3546 case ARM_CPU_MODE_MON:
3547 return 7;
3548 }
3549 hw_error("bank number requested for bad CPSR mode value 0x%x\n", mode);
3550 }
3551
3552 void switch_mode(CPUARMState *env, int mode)
3553 {
3554 int old_mode;
3555 int i;
3556
3557 old_mode = env->uncached_cpsr & CPSR_M;
3558 if (mode == old_mode)
3559 return;
3560
3561 if (old_mode == ARM_CPU_MODE_FIQ) {
3562 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
3563 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
3564 } else if (mode == ARM_CPU_MODE_FIQ) {
3565 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
3566 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
3567 }
3568
3569 i = bank_number(old_mode);
3570 env->banked_r13[i] = env->regs[13];
3571 env->banked_r14[i] = env->regs[14];
3572 env->banked_spsr[i] = env->spsr;
3573
3574 i = bank_number(mode);
3575 env->regs[13] = env->banked_r13[i];
3576 env->regs[14] = env->banked_r14[i];
3577 env->spsr = env->banked_spsr[i];
3578 }
3579
3580 static void v7m_push(CPUARMState *env, uint32_t val)
3581 {
3582 CPUState *cs = CPU(arm_env_get_cpu(env));
3583
3584 env->regs[13] -= 4;
3585 stl_phys(cs->as, env->regs[13], val);
3586 }
3587
3588 static uint32_t v7m_pop(CPUARMState *env)
3589 {
3590 CPUState *cs = CPU(arm_env_get_cpu(env));
3591 uint32_t val;
3592
3593 val = ldl_phys(cs->as, env->regs[13]);
3594 env->regs[13] += 4;
3595 return val;
3596 }
3597
3598 /* Switch to V7M main or process stack pointer. */
3599 static void switch_v7m_sp(CPUARMState *env, int process)
3600 {
3601 uint32_t tmp;
3602 if (env->v7m.current_sp != process) {
3603 tmp = env->v7m.other_sp;
3604 env->v7m.other_sp = env->regs[13];
3605 env->regs[13] = tmp;
3606 env->v7m.current_sp = process;
3607 }
3608 }
3609
3610 static void do_v7m_exception_exit(CPUARMState *env)
3611 {
3612 uint32_t type;
3613 uint32_t xpsr;
3614
3615 type = env->regs[15];
3616 if (env->v7m.exception != 0)
3617 armv7m_nvic_complete_irq(env->nvic, env->v7m.exception);
3618
3619 /* Switch to the target stack. */
3620 switch_v7m_sp(env, (type & 4) != 0);
3621 /* Pop registers. */
3622 env->regs[0] = v7m_pop(env);
3623 env->regs[1] = v7m_pop(env);
3624 env->regs[2] = v7m_pop(env);
3625 env->regs[3] = v7m_pop(env);
3626 env->regs[12] = v7m_pop(env);
3627 env->regs[14] = v7m_pop(env);
3628 env->regs[15] = v7m_pop(env);
3629 xpsr = v7m_pop(env);
3630 xpsr_write(env, xpsr, 0xfffffdff);
3631 /* Undo stack alignment. */
3632 if (xpsr & 0x200)
3633 env->regs[13] |= 4;
3634 /* ??? The exception return type specifies Thread/Handler mode. However
3635 this is also implied by the xPSR value. Not sure what to do
3636 if there is a mismatch. */
3637 /* ??? Likewise for mismatches between the CONTROL register and the stack
3638 pointer. */
3639 }
3640
3641 void arm_v7m_cpu_do_interrupt(CPUState *cs)
3642 {
3643 ARMCPU *cpu = ARM_CPU(cs);
3644 CPUARMState *env = &cpu->env;
3645 uint32_t xpsr = xpsr_read(env);
3646 uint32_t lr;
3647 uint32_t addr;
3648
3649 arm_log_exception(cs->exception_index);
3650
3651 lr = 0xfffffff1;
3652 if (env->v7m.current_sp)
3653 lr |= 4;
3654 if (env->v7m.exception == 0)
3655 lr |= 8;
3656
3657 /* For exceptions we just mark as pending on the NVIC, and let that
3658 handle it. */
3659 /* TODO: Need to escalate if the current priority is higher than the
3660 one we're raising. */
3661 switch (cs->exception_index) {
3662 case EXCP_UDEF:
3663 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
3664 return;
3665 case EXCP_SWI:
3666 /* The PC already points to the next instruction. */
3667 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC);
3668 return;
3669 case EXCP_PREFETCH_ABORT:
3670 case EXCP_DATA_ABORT:
3671 /* TODO: if we implemented the MPU registers, this is where we
3672 * should set the MMFAR, etc from exception.fsr and exception.vaddress.
3673 */
3674 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
3675 return;
3676 case EXCP_BKPT:
3677 if (semihosting_enabled) {
3678 int nr;
3679 nr = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
3680 if (nr == 0xab) {
3681 env->regs[15] += 2;
3682 env->regs[0] = do_arm_semihosting(env);
3683 qemu_log_mask(CPU_LOG_INT, "...handled as semihosting call\n");
3684 return;
3685 }
3686 }
3687 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG);
3688 return;
3689 case EXCP_IRQ:
3690 env->v7m.exception = armv7m_nvic_acknowledge_irq(env->nvic);
3691 break;
3692 case EXCP_EXCEPTION_EXIT:
3693 do_v7m_exception_exit(env);
3694 return;
3695 default:
3696 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
3697 return; /* Never happens. Keep compiler happy. */
3698 }
3699
3700 /* Align stack pointer. */
3701 /* ??? Should only do this if Configuration Control Register
3702 STACKALIGN bit is set. */
3703 if (env->regs[13] & 4) {
3704 env->regs[13] -= 4;
3705 xpsr |= 0x200;
3706 }
3707 /* Switch to the handler mode. */
3708 v7m_push(env, xpsr);
3709 v7m_push(env, env->regs[15]);
3710 v7m_push(env, env->regs[14]);
3711 v7m_push(env, env->regs[12]);
3712 v7m_push(env, env->regs[3]);
3713 v7m_push(env, env->regs[2]);
3714 v7m_push(env, env->regs[1]);
3715 v7m_push(env, env->regs[0]);
3716 switch_v7m_sp(env, 0);
3717 /* Clear IT bits */
3718 env->condexec_bits = 0;
3719 env->regs[14] = lr;
3720 addr = ldl_phys(cs->as, env->v7m.vecbase + env->v7m.exception * 4);
3721 env->regs[15] = addr & 0xfffffffe;
3722 env->thumb = addr & 1;
3723 }
3724
3725 /* Handle a CPU exception. */
3726 void arm_cpu_do_interrupt(CPUState *cs)
3727 {
3728 ARMCPU *cpu = ARM_CPU(cs);
3729 CPUARMState *env = &cpu->env;
3730 uint32_t addr;
3731 uint32_t mask;
3732 int new_mode;
3733 uint32_t offset;
3734 uint32_t moe;
3735
3736 assert(!IS_M(env));
3737
3738 arm_log_exception(cs->exception_index);
3739
3740 /* If this is a debug exception we must update the DBGDSCR.MOE bits */
3741 switch (env->exception.syndrome >> ARM_EL_EC_SHIFT) {
3742 case EC_BREAKPOINT:
3743 case EC_BREAKPOINT_SAME_EL:
3744 moe = 1;
3745 break;
3746 case EC_WATCHPOINT:
3747 case EC_WATCHPOINT_SAME_EL:
3748 moe = 10;
3749 break;
3750 case EC_AA32_BKPT:
3751 moe = 3;
3752 break;
3753 case EC_VECTORCATCH:
3754 moe = 5;
3755 break;
3756 default:
3757 moe = 0;
3758 break;
3759 }
3760
3761 if (moe) {
3762 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe);
3763 }
3764
3765 /* TODO: Vectored interrupt controller. */
3766 switch (cs->exception_index) {
3767 case EXCP_UDEF:
3768 new_mode = ARM_CPU_MODE_UND;
3769 addr = 0x04;
3770 mask = CPSR_I;
3771 if (env->thumb)
3772 offset = 2;
3773 else
3774 offset = 4;
3775 break;
3776 case EXCP_SWI:
3777 if (semihosting_enabled) {
3778 /* Check for semihosting interrupt. */
3779 if (env->thumb) {
3780 mask = arm_lduw_code(env, env->regs[15] - 2, env->bswap_code)
3781 & 0xff;
3782 } else {
3783 mask = arm_ldl_code(env, env->regs[15] - 4, env->bswap_code)
3784 & 0xffffff;
3785 }
3786 /* Only intercept calls from privileged modes, to provide some
3787 semblance of security. */
3788 if (((mask == 0x123456 && !env->thumb)
3789 || (mask == 0xab && env->thumb))
3790 && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
3791 env->regs[0] = do_arm_semihosting(env);
3792 qemu_log_mask(CPU_LOG_INT, "...handled as semihosting call\n");
3793 return;
3794 }
3795 }
3796 new_mode = ARM_CPU_MODE_SVC;
3797 addr = 0x08;
3798 mask = CPSR_I;
3799 /* The PC already points to the next instruction. */
3800 offset = 0;
3801 break;
3802 case EXCP_BKPT:
3803 /* See if this is a semihosting syscall. */
3804 if (env->thumb && semihosting_enabled) {
3805 mask = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
3806 if (mask == 0xab
3807 && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
3808 env->regs[15] += 2;
3809 env->regs[0] = do_arm_semihosting(env);
3810 qemu_log_mask(CPU_LOG_INT, "...handled as semihosting call\n");
3811 return;
3812 }
3813 }
3814 env->exception.fsr = 2;
3815 /* Fall through to prefetch abort. */
3816 case EXCP_PREFETCH_ABORT:
3817 env->cp15.ifsr_el2 = env->exception.fsr;
3818 env->cp15.far_el[1] = deposit64(env->cp15.far_el[1], 32, 32,
3819 env->exception.vaddress);
3820 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n",
3821 env->cp15.ifsr_el2, (uint32_t)env->exception.vaddress);
3822 new_mode = ARM_CPU_MODE_ABT;
3823 addr = 0x0c;
3824 mask = CPSR_A | CPSR_I;
3825 offset = 4;
3826 break;
3827 case EXCP_DATA_ABORT:
3828 env->cp15.esr_el[1] = env->exception.fsr;
3829 env->cp15.far_el[1] = deposit64(env->cp15.far_el[1], 0, 32,
3830 env->exception.vaddress);
3831 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n",
3832 (uint32_t)env->cp15.esr_el[1],
3833 (uint32_t)env->exception.vaddress);
3834 new_mode = ARM_CPU_MODE_ABT;
3835 addr = 0x10;
3836 mask = CPSR_A | CPSR_I;
3837 offset = 8;
3838 break;
3839 case EXCP_IRQ:
3840 new_mode = ARM_CPU_MODE_IRQ;
3841 addr = 0x18;
3842 /* Disable IRQ and imprecise data aborts. */
3843 mask = CPSR_A | CPSR_I;
3844 offset = 4;
3845 break;
3846 case EXCP_FIQ:
3847 new_mode = ARM_CPU_MODE_FIQ;
3848 addr = 0x1c;
3849 /* Disable FIQ, IRQ and imprecise data aborts. */
3850 mask = CPSR_A | CPSR_I | CPSR_F;
3851 offset = 4;
3852 break;
3853 default:
3854 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
3855 return; /* Never happens. Keep compiler happy. */
3856 }
3857 /* High vectors. */
3858 if (env->cp15.c1_sys & SCTLR_V) {
3859 /* when enabled, base address cannot be remapped. */
3860 addr += 0xffff0000;
3861 } else {
3862 /* ARM v7 architectures provide a vector base address register to remap
3863 * the interrupt vector table.
3864 * This register is only followed in non-monitor mode, and has a secure
3865 * and un-secure copy. Since the cpu is always in a un-secure operation
3866 * and is never in monitor mode this feature is always active.
3867 * Note: only bits 31:5 are valid.
3868 */
3869 addr += env->cp15.vbar_el[1];
3870 }
3871 switch_mode (env, new_mode);
3872 /* For exceptions taken to AArch32 we must clear the SS bit in both
3873 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.
3874 */
3875 env->uncached_cpsr &= ~PSTATE_SS;
3876 env->spsr = cpsr_read(env);
3877 /* Clear IT bits. */
3878 env->condexec_bits = 0;
3879 /* Switch to the new mode, and to the correct instruction set. */
3880 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
3881 env->daif |= mask;
3882 /* this is a lie, as the was no c1_sys on V4T/V5, but who cares
3883 * and we should just guard the thumb mode on V4 */
3884 if (arm_feature(env, ARM_FEATURE_V4T)) {
3885 env->thumb = (env->cp15.c1_sys & SCTLR_TE) != 0;
3886 }
3887 env->regs[14] = env->regs[15] + offset;
3888 env->regs[15] = addr;
3889 cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
3890 }
3891
3892 /* Check section/page access permissions.
3893 Returns the page protection flags, or zero if the access is not
3894 permitted. */
3895 static inline int check_ap(CPUARMState *env, int ap, int domain_prot,
3896 int access_type, int is_user)
3897 {
3898 int prot_ro;
3899
3900 if (domain_prot == 3) {
3901 return PAGE_READ | PAGE_WRITE;
3902 }
3903
3904 if (access_type == 1)
3905 prot_ro = 0;
3906 else
3907 prot_ro = PAGE_READ;
3908
3909 switch (ap) {
3910 case 0:
3911 if (arm_feature(env, ARM_FEATURE_V7)) {
3912 return 0;
3913 }
3914 if (access_type == 1)
3915 return 0;
3916 switch (env->cp15.c1_sys & (SCTLR_S | SCTLR_R)) {
3917 case SCTLR_S:
3918 return is_user ? 0 : PAGE_READ;
3919 case SCTLR_R:
3920 return PAGE_READ;
3921 default:
3922 return 0;
3923 }
3924 case 1:
3925 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
3926 case 2:
3927 if (is_user)
3928 return prot_ro;
3929 else
3930 return PAGE_READ | PAGE_WRITE;
3931 case 3:
3932 return PAGE_READ | PAGE_WRITE;
3933 case 4: /* Reserved. */
3934 return 0;
3935 case 5:
3936 return is_user ? 0 : prot_ro;
3937 case 6:
3938 return prot_ro;
3939 case 7:
3940 if (!arm_feature (env, ARM_FEATURE_V6K))
3941 return 0;
3942 return prot_ro;
3943 default:
3944 abort();
3945 }
3946 }
3947
3948 static bool get_level1_table_address(CPUARMState *env, uint32_t *table,
3949 uint32_t address)
3950 {
3951 if (address & env->cp15.c2_mask) {
3952 if ((env->cp15.c2_control & TTBCR_PD1)) {
3953 /* Translation table walk disabled for TTBR1 */
3954 return false;
3955 }
3956 *table = env->cp15.ttbr1_el1 & 0xffffc000;
3957 } else {
3958 if ((env->cp15.c2_control & TTBCR_PD0)) {
3959 /* Translation table walk disabled for TTBR0 */
3960 return false;
3961 }
3962 *table = env->cp15.ttbr0_el1 & env->cp15.c2_base_mask;
3963 }
3964 *table |= (address >> 18) & 0x3ffc;
3965 return true;
3966 }
3967
3968 static int get_phys_addr_v5(CPUARMState *env, uint32_t address, int access_type,
3969 int is_user, hwaddr *phys_ptr,
3970 int *prot, target_ulong *page_size)
3971 {
3972 CPUState *cs = CPU(arm_env_get_cpu(env));
3973 int code;
3974 uint32_t table;
3975 uint32_t desc;
3976 int type;
3977 int ap;
3978 int domain = 0;
3979 int domain_prot;
3980 hwaddr phys_addr;
3981
3982 /* Pagetable walk. */
3983 /* Lookup l1 descriptor. */
3984 if (!get_level1_table_address(env, &table, address)) {
3985 /* Section translation fault if page walk is disabled by PD0 or PD1 */
3986 code = 5;
3987 goto do_fault;
3988 }
3989 desc = ldl_phys(cs->as, table);
3990 type = (desc & 3);
3991 domain = (desc >> 5) & 0x0f;
3992 domain_prot = (env->cp15.c3 >> (domain * 2)) & 3;
3993 if (type == 0) {
3994 /* Section translation fault. */
3995 code = 5;
3996 goto do_fault;
3997 }
3998 if (domain_prot == 0 || domain_prot == 2) {
3999 if (type == 2)
4000 code = 9; /* Section domain fault. */
4001 else
4002 code = 11; /* Page domain fault. */
4003 goto do_fault;
4004 }
4005 if (type == 2) {
4006 /* 1Mb section. */
4007 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
4008 ap = (desc >> 10) & 3;
4009 code = 13;
4010 *page_size = 1024 * 1024;
4011 } else {
4012 /* Lookup l2 entry. */
4013 if (type == 1) {
4014 /* Coarse pagetable. */
4015 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
4016 } else {
4017 /* Fine pagetable. */
4018 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
4019 }
4020 desc = ldl_phys(cs->as, table);
4021 switch (desc & 3) {
4022 case 0: /* Page translation fault. */
4023 code = 7;
4024 goto do_fault;
4025 case 1: /* 64k page. */
4026 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
4027 ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
4028 *page_size = 0x10000;
4029 break;
4030 case 2: /* 4k page. */
4031 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
4032 ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
4033 *page_size = 0x1000;
4034 break;
4035 case 3: /* 1k page. */
4036 if (type == 1) {
4037 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
4038 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
4039 } else {
4040 /* Page translation fault. */
4041 code = 7;
4042 goto do_fault;
4043 }
4044 } else {
4045 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
4046 }
4047 ap = (desc >> 4) & 3;
4048 *page_size = 0x400;
4049 break;
4050 default:
4051 /* Never happens, but compiler isn't smart enough to tell. */
4052 abort();
4053 }
4054 code = 15;
4055 }
4056 *prot = check_ap(env, ap, domain_prot, access_type, is_user);
4057 if (!*prot) {
4058 /* Access permission fault. */
4059 goto do_fault;
4060 }
4061 *prot |= PAGE_EXEC;
4062 *phys_ptr = phys_addr;
4063 return 0;
4064 do_fault:
4065 return code | (domain << 4);
4066 }
4067
4068 static int get_phys_addr_v6(CPUARMState *env, uint32_t address, int access_type,
4069 int is_user, hwaddr *phys_ptr,
4070 int *prot, target_ulong *page_size)
4071 {
4072 CPUState *cs = CPU(arm_env_get_cpu(env));
4073 int code;
4074 uint32_t table;
4075 uint32_t desc;
4076 uint32_t xn;
4077 uint32_t pxn = 0;
4078 int type;
4079 int ap;
4080 int domain = 0;
4081 int domain_prot;
4082 hwaddr phys_addr;
4083
4084 /* Pagetable walk. */
4085 /* Lookup l1 descriptor. */
4086 if (!get_level1_table_address(env, &table, address)) {
4087 /* Section translation fault if page walk is disabled by PD0 or PD1 */
4088 code = 5;
4089 goto do_fault;
4090 }
4091 desc = ldl_phys(cs->as, table);
4092 type = (desc & 3);
4093 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
4094 /* Section translation fault, or attempt to use the encoding
4095 * which is Reserved on implementations without PXN.
4096 */
4097 code = 5;
4098 goto do_fault;
4099 }
4100 if ((type == 1) || !(desc & (1 << 18))) {
4101 /* Page or Section. */
4102 domain = (desc >> 5) & 0x0f;
4103 }
4104 domain_prot = (env->cp15.c3 >> (domain * 2)) & 3;
4105 if (domain_prot == 0 || domain_prot == 2) {
4106 if (type != 1) {
4107 code = 9; /* Section domain fault. */
4108 } else {
4109 code = 11; /* Page domain fault. */
4110 }
4111 goto do_fault;
4112 }
4113 if (type != 1) {
4114 if (desc & (1 << 18)) {
4115 /* Supersection. */
4116 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
4117 *page_size = 0x1000000;
4118 } else {
4119 /* Section. */
4120 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
4121 *page_size = 0x100000;
4122 }
4123 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
4124 xn = desc & (1 << 4);
4125 pxn = desc & 1;
4126 code = 13;
4127 } else {
4128 if (arm_feature(env, ARM_FEATURE_PXN)) {
4129 pxn = (desc >> 2) & 1;
4130 }
4131 /* Lookup l2 entry. */
4132 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
4133 desc = ldl_phys(cs->as, table);
4134 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
4135 switch (desc & 3) {
4136 case 0: /* Page translation fault. */
4137 code = 7;
4138 goto do_fault;
4139 case 1: /* 64k page. */
4140 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
4141 xn = desc & (1 << 15);
4142 *page_size = 0x10000;
4143 break;
4144 case 2: case 3: /* 4k page. */
4145 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
4146 xn = desc & 1;
4147 *page_size = 0x1000;
4148 break;
4149 default:
4150 /* Never happens, but compiler isn't smart enough to tell. */
4151 abort();
4152 }
4153 code = 15;
4154 }
4155 if (domain_prot == 3) {
4156 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
4157 } else {
4158 if (pxn && !is_user) {
4159 xn = 1;
4160 }
4161 if (xn && access_type == 2)
4162 goto do_fault;
4163
4164 /* The simplified model uses AP[0] as an access control bit. */
4165 if ((env->cp15.c1_sys & SCTLR_AFE) && (ap & 1) == 0) {
4166 /* Access flag fault. */
4167 code = (code == 15) ? 6 : 3;
4168 goto do_fault;
4169 }
4170 *prot = check_ap(env, ap, domain_prot, access_type, is_user);
4171 if (!*prot) {
4172 /* Access permission fault. */
4173 goto do_fault;
4174 }
4175 if (!xn) {
4176 *prot |= PAGE_EXEC;
4177 }
4178 }
4179 *phys_ptr = phys_addr;
4180 return 0;
4181 do_fault:
4182 return code | (domain << 4);
4183 }
4184
4185 /* Fault type for long-descriptor MMU fault reporting; this corresponds
4186 * to bits [5..2] in the STATUS field in long-format DFSR/IFSR.
4187 */
4188 typedef enum {
4189 translation_fault = 1,
4190 access_fault = 2,
4191 permission_fault = 3,
4192 } MMUFaultType;
4193
4194 static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
4195 int access_type, int is_user,
4196 hwaddr *phys_ptr, int *prot,
4197 target_ulong *page_size_ptr)
4198 {
4199 CPUState *cs = CPU(arm_env_get_cpu(env));
4200 /* Read an LPAE long-descriptor translation table. */
4201 MMUFaultType fault_type = translation_fault;
4202 uint32_t level = 1;
4203 uint32_t epd;
4204 int32_t tsz;
4205 uint32_t tg;
4206 uint64_t ttbr;
4207 int ttbr_select;
4208 hwaddr descaddr, descmask;
4209 uint32_t tableattrs;
4210 target_ulong page_size;
4211 uint32_t attrs;
4212 int32_t granule_sz = 9;
4213 int32_t va_size = 32;
4214 int32_t tbi = 0;
4215
4216 if (arm_el_is_aa64(env, 1)) {
4217 va_size = 64;
4218 if (extract64(address, 55, 1))
4219 tbi = extract64(env->cp15.c2_control, 38, 1);
4220 else
4221 tbi = extract64(env->cp15.c2_control, 37, 1);
4222 tbi *= 8;
4223 }
4224
4225 /* Determine whether this address is in the region controlled by
4226 * TTBR0 or TTBR1 (or if it is in neither region and should fault).
4227 * This is a Non-secure PL0/1 stage 1 translation, so controlled by
4228 * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
4229 */
4230 uint32_t t0sz = extract32(env->cp15.c2_control, 0, 6);
4231 if (arm_el_is_aa64(env, 1)) {
4232 t0sz = MIN(t0sz, 39);
4233 t0sz = MAX(t0sz, 16);
4234 }
4235 uint32_t t1sz = extract32(env->cp15.c2_control, 16, 6);
4236 if (arm_el_is_aa64(env, 1)) {
4237 t1sz = MIN(t1sz, 39);
4238 t1sz = MAX(t1sz, 16);
4239 }
4240 if (t0sz && !extract64(address, va_size - t0sz, t0sz - tbi)) {
4241 /* there is a ttbr0 region and we are in it (high bits all zero) */
4242 ttbr_select = 0;
4243 } else if (t1sz && !extract64(~address, va_size - t1sz, t1sz - tbi)) {
4244 /* there is a ttbr1 region and we are in it (high bits all one) */
4245 ttbr_select = 1;
4246 } else if (!t0sz) {
4247 /* ttbr0 region is "everything not in the ttbr1 region" */
4248 ttbr_select = 0;
4249 } else if (!t1sz) {
4250 /* ttbr1 region is "everything not in the ttbr0 region" */
4251 ttbr_select = 1;
4252 } else {
4253 /* in the gap between the two regions, this is a Translation fault */
4254 fault_type = translation_fault;
4255 goto do_fault;
4256 }
4257
4258 /* Note that QEMU ignores shareability and cacheability attributes,
4259 * so we don't need to do anything with the SH, ORGN, IRGN fields
4260 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
4261 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
4262 * implement any ASID-like capability so we can ignore it (instead
4263 * we will always flush the TLB any time the ASID is changed).
4264 */
4265 if (ttbr_select == 0) {
4266 ttbr = env->cp15.ttbr0_el1;
4267 epd = extract32(env->cp15.c2_control, 7, 1);
4268 tsz = t0sz;
4269
4270 tg = extract32(env->cp15.c2_control, 14, 2);
4271 if (tg == 1) { /* 64KB pages */
4272 granule_sz = 13;
4273 }
4274 if (tg == 2) { /* 16KB pages */
4275 granule_sz = 11;
4276 }
4277 } else {
4278 ttbr = env->cp15.ttbr1_el1;
4279 epd = extract32(env->cp15.c2_control, 23, 1);
4280 tsz = t1sz;
4281
4282 tg = extract32(env->cp15.c2_control, 30, 2);
4283 if (tg == 3) { /* 64KB pages */
4284 granule_sz = 13;
4285 }
4286 if (tg == 1) { /* 16KB pages */
4287 granule_sz = 11;
4288 }
4289 }
4290
4291 if (epd) {
4292 /* Translation table walk disabled => Translation fault on TLB miss */
4293 goto do_fault;
4294 }
4295
4296 /* The starting level depends on the virtual address size which can be
4297 * up to 48-bits and the translation granule size.
4298 */
4299 if ((va_size - tsz) > (granule_sz * 4 + 3)) {
4300 level = 0;
4301 } else if ((va_size - tsz) > (granule_sz * 3 + 3)) {
4302 level = 1;
4303 } else {
4304 level = 2;
4305 }
4306
4307 /* Clear the vaddr bits which aren't part of the within-region address,
4308 * so that we don't have to special case things when calculating the
4309 * first descriptor address.
4310 */
4311 if (tsz) {
4312 address &= (1ULL << (va_size - tsz)) - 1;
4313 }
4314
4315 descmask = (1ULL << (granule_sz + 3)) - 1;
4316
4317 /* Now we can extract the actual base address from the TTBR */
4318 descaddr = extract64(ttbr, 0, 48);
4319 descaddr &= ~((1ULL << (va_size - tsz - (granule_sz * (4 - level)))) - 1);
4320
4321 tableattrs = 0;
4322 for (;;) {
4323 uint64_t descriptor;
4324
4325 descaddr |= (address >> (granule_sz * (4 - level))) & descmask;
4326 descaddr &= ~7ULL;
4327 descriptor = ldq_phys(cs->as, descaddr);
4328 if (!(descriptor & 1) ||
4329 (!(descriptor & 2) && (level == 3))) {
4330 /* Invalid, or the Reserved level 3 encoding */
4331 goto do_fault;
4332 }
4333 descaddr = descriptor & 0xfffffff000ULL;
4334
4335 if ((descriptor & 2) && (level < 3)) {
4336 /* Table entry. The top five bits are attributes which may
4337 * propagate down through lower levels of the table (and
4338 * which are all arranged so that 0 means "no effect", so
4339 * we can gather them up by ORing in the bits at each level).
4340 */
4341 tableattrs |= extract64(descriptor, 59, 5);
4342 level++;
4343 continue;
4344 }
4345 /* Block entry at level 1 or 2, or page entry at level 3.
4346 * These are basically the same thing, although the number
4347 * of bits we pull in from the vaddr varies.
4348 */
4349 page_size = (1ULL << ((granule_sz * (4 - level)) + 3));
4350 descaddr |= (address & (page_size - 1));
4351 /* Extract attributes from the descriptor and merge with table attrs */
4352 attrs = extract64(descriptor, 2, 10)
4353 | (extract64(descriptor, 52, 12) << 10);
4354 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */
4355 attrs |= extract32(tableattrs, 3, 1) << 5; /* APTable[1] => AP[2] */
4356 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
4357 * means "force PL1 access only", which means forcing AP[1] to 0.
4358 */
4359 if (extract32(tableattrs, 2, 1)) {
4360 attrs &= ~(1 << 4);
4361 }
4362 /* Since we're always in the Non-secure state, NSTable is ignored. */
4363 break;
4364 }
4365 /* Here descaddr is the final physical address, and attributes
4366 * are all in attrs.
4367 */
4368 fault_type = access_fault;
4369 if ((attrs & (1 << 8)) == 0) {
4370 /* Access flag */
4371 goto do_fault;
4372 }
4373 fault_type = permission_fault;
4374 if (is_user && !(attrs & (1 << 4))) {
4375 /* Unprivileged access not enabled */
4376 goto do_fault;
4377 }
4378 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
4379 if ((arm_feature(env, ARM_FEATURE_V8) && is_user && (attrs & (1 << 12))) ||
4380 (!arm_feature(env, ARM_FEATURE_V8) && (attrs & (1 << 12))) ||
4381 (!is_user && (attrs & (1 << 11)))) {
4382 /* XN/UXN or PXN. Since we only implement EL0/EL1 we unconditionally
4383 * treat XN/UXN as UXN for v8.
4384 */
4385 if (access_type == 2) {
4386 goto do_fault;
4387 }
4388 *prot &= ~PAGE_EXEC;
4389 }
4390 if (attrs & (1 << 5)) {
4391 /* Write access forbidden */
4392 if (access_type == 1) {
4393 goto do_fault;
4394 }
4395 *prot &= ~PAGE_WRITE;
4396 }
4397
4398 *phys_ptr = descaddr;
4399 *page_size_ptr = page_size;
4400 return 0;
4401
4402 do_fault:
4403 /* Long-descriptor format IFSR/DFSR value */
4404 return (1 << 9) | (fault_type << 2) | level;
4405 }
4406
4407 static int get_phys_addr_mpu(CPUARMState *env, uint32_t address,
4408 int access_type, int is_user,
4409 hwaddr *phys_ptr, int *prot)
4410 {
4411 int n;
4412 uint32_t mask;
4413 uint32_t base;
4414
4415 *phys_ptr = address;
4416 for (n = 7; n >= 0; n--) {
4417 base = env->cp15.c6_region[n];
4418 if ((base & 1) == 0)
4419 continue;
4420 mask = 1 << ((base >> 1) & 0x1f);
4421 /* Keep this shift separate from the above to avoid an
4422 (undefined) << 32. */
4423 mask = (mask << 1) - 1;
4424 if (((base ^ address) & ~mask) == 0)
4425 break;
4426 }
4427 if (n < 0)
4428 return 2;
4429
4430 if (access_type == 2) {
4431 mask = env->cp15.pmsav5_insn_ap;
4432 } else {
4433 mask = env->cp15.pmsav5_data_ap;
4434 }
4435 mask = (mask >> (n * 4)) & 0xf;
4436 switch (mask) {
4437 case 0:
4438 return 1;
4439 case 1:
4440 if (is_user)
4441 return 1;
4442 *prot = PAGE_READ | PAGE_WRITE;
4443 break;
4444 case 2:
4445 *prot = PAGE_READ;
4446 if (!is_user)
4447 *prot |= PAGE_WRITE;
4448 break;
4449 case 3:
4450 *prot = PAGE_READ | PAGE_WRITE;
4451 break;
4452 case 5:
4453 if (is_user)
4454 return 1;
4455 *prot = PAGE_READ;
4456 break;
4457 case 6:
4458 *prot = PAGE_READ;
4459 break;
4460 default:
4461 /* Bad permission. */
4462 return 1;
4463 }
4464 *prot |= PAGE_EXEC;
4465 return 0;
4466 }
4467
4468 /* get_phys_addr - get the physical address for this virtual address
4469 *
4470 * Find the physical address corresponding to the given virtual address,
4471 * by doing a translation table walk on MMU based systems or using the
4472 * MPU state on MPU based systems.
4473 *
4474 * Returns 0 if the translation was successful. Otherwise, phys_ptr,
4475 * prot and page_size are not filled in, and the return value provides
4476 * information on why the translation aborted, in the format of a
4477 * DFSR/IFSR fault register, with the following caveats:
4478 * * we honour the short vs long DFSR format differences.
4479 * * the WnR bit is never set (the caller must do this).
4480 * * for MPU based systems we don't bother to return a full FSR format
4481 * value.
4482 *
4483 * @env: CPUARMState
4484 * @address: virtual address to get physical address for
4485 * @access_type: 0 for read, 1 for write, 2 for execute
4486 * @is_user: 0 for privileged access, 1 for user
4487 * @phys_ptr: set to the physical address corresponding to the virtual address
4488 * @prot: set to the permissions for the page containing phys_ptr
4489 * @page_size: set to the size of the page containing phys_ptr
4490 */
4491 static inline int get_phys_addr(CPUARMState *env, target_ulong address,
4492 int access_type, int is_user,
4493 hwaddr *phys_ptr, int *prot,
4494 target_ulong *page_size)
4495 {
4496 /* Fast Context Switch Extension. */
4497 if (address < 0x02000000)
4498 address += env->cp15.c13_fcse;
4499
4500 if ((env->cp15.c1_sys & SCTLR_M) == 0) {
4501 /* MMU/MPU disabled. */
4502 *phys_ptr = address;
4503 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
4504 *page_size = TARGET_PAGE_SIZE;
4505 return 0;
4506 } else if (arm_feature(env, ARM_FEATURE_MPU)) {
4507 *page_size = TARGET_PAGE_SIZE;
4508 return get_phys_addr_mpu(env, address, access_type, is_user, phys_ptr,
4509 prot);
4510 } else if (extended_addresses_enabled(env)) {
4511 return get_phys_addr_lpae(env, address, access_type, is_user, phys_ptr,
4512 prot, page_size);
4513 } else if (env->cp15.c1_sys & SCTLR_XP) {
4514 return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,
4515 prot, page_size);
4516 } else {
4517 return get_phys_addr_v5(env, address, access_type, is_user, phys_ptr,
4518 prot, page_size);
4519 }
4520 }
4521
4522 int arm_cpu_handle_mmu_fault(CPUState *cs, vaddr address,
4523 int access_type, int mmu_idx)
4524 {
4525 ARMCPU *cpu = ARM_CPU(cs);
4526 CPUARMState *env = &cpu->env;
4527 hwaddr phys_addr;
4528 target_ulong page_size;
4529 int prot;
4530 int ret, is_user;
4531 uint32_t syn;
4532 bool same_el = (arm_current_pl(env) != 0);
4533
4534 is_user = mmu_idx == MMU_USER_IDX;
4535 ret = get_phys_addr(env, address, access_type, is_user, &phys_addr, &prot,
4536 &page_size);
4537 if (ret == 0) {
4538 /* Map a single [sub]page. */
4539 phys_addr &= TARGET_PAGE_MASK;
4540 address &= TARGET_PAGE_MASK;
4541 tlb_set_page(cs, address, phys_addr, prot, mmu_idx, page_size);
4542 return 0;
4543 }
4544
4545 /* AArch64 syndrome does not have an LPAE bit */
4546 syn = ret & ~(1 << 9);
4547
4548 /* For insn and data aborts we assume there is no instruction syndrome
4549 * information; this is always true for exceptions reported to EL1.
4550 */
4551 if (access_type == 2) {
4552 syn = syn_insn_abort(same_el, 0, 0, syn);
4553 cs->exception_index = EXCP_PREFETCH_ABORT;
4554 } else {
4555 syn = syn_data_abort(same_el, 0, 0, 0, access_type == 1, syn);
4556 if (access_type == 1 && arm_feature(env, ARM_FEATURE_V6)) {
4557 ret |= (1 << 11);
4558 }
4559 cs->exception_index = EXCP_DATA_ABORT;
4560 }
4561
4562 env->exception.syndrome = syn;
4563 env->exception.vaddress = address;
4564 env->exception.fsr = ret;
4565 return 1;
4566 }
4567
4568 hwaddr arm_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
4569 {
4570 ARMCPU *cpu = ARM_CPU(cs);
4571 hwaddr phys_addr;
4572 target_ulong page_size;
4573 int prot;
4574 int ret;
4575
4576 ret = get_phys_addr(&cpu->env, addr, 0, 0, &phys_addr, &prot, &page_size);
4577
4578 if (ret != 0) {
4579 return -1;
4580 }
4581
4582 return phys_addr;
4583 }
4584
4585 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
4586 {
4587 if ((env->uncached_cpsr & CPSR_M) == mode) {
4588 env->regs[13] = val;
4589 } else {
4590 env->banked_r13[bank_number(mode)] = val;
4591 }
4592 }
4593
4594 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
4595 {
4596 if ((env->uncached_cpsr & CPSR_M) == mode) {
4597 return env->regs[13];
4598 } else {
4599 return env->banked_r13[bank_number(mode)];
4600 }
4601 }
4602
4603 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
4604 {
4605 ARMCPU *cpu = arm_env_get_cpu(env);
4606
4607 switch (reg) {
4608 case 0: /* APSR */
4609 return xpsr_read(env) & 0xf8000000;
4610 case 1: /* IAPSR */
4611 return xpsr_read(env) & 0xf80001ff;
4612 case 2: /* EAPSR */
4613 return xpsr_read(env) & 0xff00fc00;
4614 case 3: /* xPSR */
4615 return xpsr_read(env) & 0xff00fdff;
4616 case 5: /* IPSR */
4617 return xpsr_read(env) & 0x000001ff;
4618 case 6: /* EPSR */
4619 return xpsr_read(env) & 0x0700fc00;
4620 case 7: /* IEPSR */
4621 return xpsr_read(env) & 0x0700edff;
4622 case 8: /* MSP */
4623 return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
4624 case 9: /* PSP */
4625 return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
4626 case 16: /* PRIMASK */
4627 return (env->daif & PSTATE_I) != 0;
4628 case 17: /* BASEPRI */
4629 case 18: /* BASEPRI_MAX */
4630 return env->v7m.basepri;
4631 case 19: /* FAULTMASK */
4632 return (env->daif & PSTATE_F) != 0;
4633 case 20: /* CONTROL */
4634 return env->v7m.control;
4635 default:
4636 /* ??? For debugging only. */
4637 cpu_abort(CPU(cpu), "Unimplemented system register read (%d)\n", reg);
4638 return 0;
4639 }
4640 }
4641
4642 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
4643 {
4644 ARMCPU *cpu = arm_env_get_cpu(env);
4645
4646 switch (reg) {
4647 case 0: /* APSR */
4648 xpsr_write(env, val, 0xf8000000);
4649 break;
4650 case 1: /* IAPSR */
4651 xpsr_write(env, val, 0xf8000000);
4652 break;
4653 case 2: /* EAPSR */
4654 xpsr_write(env, val, 0xfe00fc00);
4655 break;
4656 case 3: /* xPSR */
4657 xpsr_write(env, val, 0xfe00fc00);
4658 break;
4659 case 5: /* IPSR */
4660 /* IPSR bits are readonly. */
4661 break;
4662 case 6: /* EPSR */
4663 xpsr_write(env, val, 0x0600fc00);
4664 break;
4665 case 7: /* IEPSR */
4666 xpsr_write(env, val, 0x0600fc00);
4667 break;
4668 case 8: /* MSP */
4669 if (env->v7m.current_sp)
4670 env->v7m.other_sp = val;
4671 else
4672 env->regs[13] = val;
4673 break;
4674 case 9: /* PSP */
4675 if (env->v7m.current_sp)
4676 env->regs[13] = val;
4677 else
4678 env->v7m.other_sp = val;
4679 break;
4680 case 16: /* PRIMASK */
4681 if (val & 1) {
4682 env->daif |= PSTATE_I;
4683 } else {
4684 env->daif &= ~PSTATE_I;
4685 }
4686 break;
4687 case 17: /* BASEPRI */
4688 env->v7m.basepri = val & 0xff;
4689 break;
4690 case 18: /* BASEPRI_MAX */
4691 val &= 0xff;
4692 if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
4693 env->v7m.basepri = val;
4694 break;
4695 case 19: /* FAULTMASK */
4696 if (val & 1) {
4697 env->daif |= PSTATE_F;
4698 } else {
4699 env->daif &= ~PSTATE_F;
4700 }
4701 break;
4702 case 20: /* CONTROL */
4703 env->v7m.control = val & 3;
4704 switch_v7m_sp(env, (val & 2) != 0);
4705 break;
4706 default:
4707 /* ??? For debugging only. */
4708 cpu_abort(CPU(cpu), "Unimplemented system register write (%d)\n", reg);
4709 return;
4710 }
4711 }
4712
4713 #endif
4714
4715 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
4716 {
4717 /* Implement DC ZVA, which zeroes a fixed-length block of memory.
4718 * Note that we do not implement the (architecturally mandated)
4719 * alignment fault for attempts to use this on Device memory
4720 * (which matches the usual QEMU behaviour of not implementing either
4721 * alignment faults or any memory attribute handling).
4722 */
4723
4724 ARMCPU *cpu = arm_env_get_cpu(env);
4725 uint64_t blocklen = 4 << cpu->dcz_blocksize;
4726 uint64_t vaddr = vaddr_in & ~(blocklen - 1);
4727
4728 #ifndef CONFIG_USER_ONLY
4729 {
4730 /* Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than
4731 * the block size so we might have to do more than one TLB lookup.
4732 * We know that in fact for any v8 CPU the page size is at least 4K
4733 * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
4734 * 1K as an artefact of legacy v5 subpage support being present in the
4735 * same QEMU executable.
4736 */
4737 int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
4738 void *hostaddr[maxidx];
4739 int try, i;
4740
4741 for (try = 0; try < 2; try++) {
4742
4743 for (i = 0; i < maxidx; i++) {
4744 hostaddr[i] = tlb_vaddr_to_host(env,
4745 vaddr + TARGET_PAGE_SIZE * i,
4746 1, cpu_mmu_index(env));
4747 if (!hostaddr[i]) {
4748 break;
4749 }
4750 }
4751 if (i == maxidx) {
4752 /* If it's all in the TLB it's fair game for just writing to;
4753 * we know we don't need to update dirty status, etc.
4754 */
4755 for (i = 0; i < maxidx - 1; i++) {
4756 memset(hostaddr[i], 0, TARGET_PAGE_SIZE);
4757 }
4758 memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE));
4759 return;
4760 }
4761 /* OK, try a store and see if we can populate the tlb. This
4762 * might cause an exception if the memory isn't writable,
4763 * in which case we will longjmp out of here. We must for
4764 * this purpose use the actual register value passed to us
4765 * so that we get the fault address right.
4766 */
4767 helper_ret_stb_mmu(env, vaddr_in, 0, cpu_mmu_index(env), GETRA());
4768 /* Now we can populate the other TLB entries, if any */
4769 for (i = 0; i < maxidx; i++) {
4770 uint64_t va = vaddr + TARGET_PAGE_SIZE * i;
4771 if (va != (vaddr_in & TARGET_PAGE_MASK)) {
4772 helper_ret_stb_mmu(env, va, 0, cpu_mmu_index(env), GETRA());
4773 }
4774 }
4775 }
4776
4777 /* Slow path (probably attempt to do this to an I/O device or
4778 * similar, or clearing of a block of code we have translations
4779 * cached for). Just do a series of byte writes as the architecture
4780 * demands. It's not worth trying to use a cpu_physical_memory_map(),
4781 * memset(), unmap() sequence here because:
4782 * + we'd need to account for the blocksize being larger than a page
4783 * + the direct-RAM access case is almost always going to be dealt
4784 * with in the fastpath code above, so there's no speed benefit
4785 * + we would have to deal with the map returning NULL because the
4786 * bounce buffer was in use
4787 */
4788 for (i = 0; i < blocklen; i++) {
4789 helper_ret_stb_mmu(env, vaddr + i, 0, cpu_mmu_index(env), GETRA());
4790 }
4791 }
4792 #else
4793 memset(g2h(vaddr), 0, blocklen);
4794 #endif
4795 }
4796
4797 /* Note that signed overflow is undefined in C. The following routines are
4798 careful to use unsigned types where modulo arithmetic is required.
4799 Failure to do so _will_ break on newer gcc. */
4800
4801 /* Signed saturating arithmetic. */
4802
4803 /* Perform 16-bit signed saturating addition. */
4804 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
4805 {
4806 uint16_t res;
4807
4808 res = a + b;
4809 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
4810 if (a & 0x8000)
4811 res = 0x8000;
4812 else
4813 res = 0x7fff;
4814 }
4815 return res;
4816 }
4817
4818 /* Perform 8-bit signed saturating addition. */
4819 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
4820 {
4821 uint8_t res;
4822
4823 res = a + b;
4824 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
4825 if (a & 0x80)
4826 res = 0x80;
4827 else
4828 res = 0x7f;
4829 }
4830 return res;
4831 }
4832
4833 /* Perform 16-bit signed saturating subtraction. */
4834 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
4835 {
4836 uint16_t res;
4837
4838 res = a - b;
4839 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
4840 if (a & 0x8000)
4841 res = 0x8000;
4842 else
4843 res = 0x7fff;
4844 }
4845 return res;
4846 }
4847
4848 /* Perform 8-bit signed saturating subtraction. */
4849 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
4850 {
4851 uint8_t res;
4852
4853 res = a - b;
4854 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
4855 if (a & 0x80)
4856 res = 0x80;
4857 else
4858 res = 0x7f;
4859 }
4860 return res;
4861 }
4862
4863 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
4864 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
4865 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8);
4866 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8);
4867 #define PFX q
4868
4869 #include "op_addsub.h"
4870
4871 /* Unsigned saturating arithmetic. */
4872 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
4873 {
4874 uint16_t res;
4875 res = a + b;
4876 if (res < a)
4877 res = 0xffff;
4878 return res;
4879 }
4880
4881 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
4882 {
4883 if (a > b)
4884 return a - b;
4885 else
4886 return 0;
4887 }
4888
4889 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
4890 {
4891 uint8_t res;
4892 res = a + b;
4893 if (res < a)
4894 res = 0xff;
4895 return res;
4896 }
4897
4898 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
4899 {
4900 if (a > b)
4901 return a - b;
4902 else
4903 return 0;
4904 }
4905
4906 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
4907 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
4908 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8);
4909 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8);
4910 #define PFX uq
4911
4912 #include "op_addsub.h"
4913
4914 /* Signed modulo arithmetic. */
4915 #define SARITH16(a, b, n, op) do { \
4916 int32_t sum; \
4917 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
4918 RESULT(sum, n, 16); \
4919 if (sum >= 0) \
4920 ge |= 3 << (n * 2); \
4921 } while(0)
4922
4923 #define SARITH8(a, b, n, op) do { \
4924 int32_t sum; \
4925 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
4926 RESULT(sum, n, 8); \
4927 if (sum >= 0) \
4928 ge |= 1 << n; \
4929 } while(0)
4930
4931
4932 #define ADD16(a, b, n) SARITH16(a, b, n, +)
4933 #define SUB16(a, b, n) SARITH16(a, b, n, -)
4934 #define ADD8(a, b, n) SARITH8(a, b, n, +)
4935 #define SUB8(a, b, n) SARITH8(a, b, n, -)
4936 #define PFX s
4937 #define ARITH_GE
4938
4939 #include "op_addsub.h"
4940
4941 /* Unsigned modulo arithmetic. */
4942 #define ADD16(a, b, n) do { \
4943 uint32_t sum; \
4944 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
4945 RESULT(sum, n, 16); \
4946 if ((sum >> 16) == 1) \
4947 ge |= 3 << (n * 2); \
4948 } while(0)
4949
4950 #define ADD8(a, b, n) do { \
4951 uint32_t sum; \
4952 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
4953 RESULT(sum, n, 8); \
4954 if ((sum >> 8) == 1) \
4955 ge |= 1 << n; \
4956 } while(0)
4957
4958 #define SUB16(a, b, n) do { \
4959 uint32_t sum; \
4960 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
4961 RESULT(sum, n, 16); \
4962 if ((sum >> 16) == 0) \
4963 ge |= 3 << (n * 2); \
4964 } while(0)
4965
4966 #define SUB8(a, b, n) do { \
4967 uint32_t sum; \
4968 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
4969 RESULT(sum, n, 8); \
4970 if ((sum >> 8) == 0) \
4971 ge |= 1 << n; \
4972 } while(0)
4973
4974 #define PFX u
4975 #define ARITH_GE
4976
4977 #include "op_addsub.h"
4978
4979 /* Halved signed arithmetic. */
4980 #define ADD16(a, b, n) \
4981 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
4982 #define SUB16(a, b, n) \
4983 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
4984 #define ADD8(a, b, n) \
4985 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
4986 #define SUB8(a, b, n) \
4987 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
4988 #define PFX sh
4989
4990 #include "op_addsub.h"
4991
4992 /* Halved unsigned arithmetic. */
4993 #define ADD16(a, b, n) \
4994 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
4995 #define SUB16(a, b, n) \
4996 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
4997 #define ADD8(a, b, n) \
4998 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
4999 #define SUB8(a, b, n) \
5000 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
5001 #define PFX uh
5002
5003 #include "op_addsub.h"
5004
5005 static inline uint8_t do_usad(uint8_t a, uint8_t b)
5006 {
5007 if (a > b)
5008 return a - b;
5009 else
5010 return b - a;
5011 }
5012
5013 /* Unsigned sum of absolute byte differences. */
5014 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
5015 {
5016 uint32_t sum;
5017 sum = do_usad(a, b);
5018 sum += do_usad(a >> 8, b >> 8);
5019 sum += do_usad(a >> 16, b >>16);
5020 sum += do_usad(a >> 24, b >> 24);
5021 return sum;
5022 }
5023
5024 /* For ARMv6 SEL instruction. */
5025 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
5026 {
5027 uint32_t mask;
5028
5029 mask = 0;
5030 if (flags & 1)
5031 mask |= 0xff;
5032 if (flags & 2)
5033 mask |= 0xff00;
5034 if (flags & 4)
5035 mask |= 0xff0000;
5036 if (flags & 8)
5037 mask |= 0xff000000;
5038 return (a & mask) | (b & ~mask);
5039 }
5040
5041 /* VFP support. We follow the convention used for VFP instructions:
5042 Single precision routines have a "s" suffix, double precision a
5043 "d" suffix. */
5044
5045 /* Convert host exception flags to vfp form. */
5046 static inline int vfp_exceptbits_from_host(int host_bits)
5047 {
5048 int target_bits = 0;
5049
5050 if (host_bits & float_flag_invalid)
5051 target_bits |= 1;
5052 if (host_bits & float_flag_divbyzero)
5053 target_bits |= 2;
5054 if (host_bits & float_flag_overflow)
5055 target_bits |= 4;
5056 if (host_bits & (float_flag_underflow | float_flag_output_denormal))
5057 target_bits |= 8;
5058 if (host_bits & float_flag_inexact)
5059 target_bits |= 0x10;
5060 if (host_bits & float_flag_input_denormal)
5061 target_bits |= 0x80;
5062 return target_bits;
5063 }
5064
5065 uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
5066 {
5067 int i;
5068 uint32_t fpscr;
5069
5070 fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
5071 | (env->vfp.vec_len << 16)
5072 | (env->vfp.vec_stride << 20);
5073 i = get_float_exception_flags(&env->vfp.fp_status);
5074 i |= get_float_exception_flags(&env->vfp.standard_fp_status);
5075 fpscr |= vfp_exceptbits_from_host(i);
5076 return fpscr;
5077 }
5078
5079 uint32_t vfp_get_fpscr(CPUARMState *env)
5080 {
5081 return HELPER(vfp_get_fpscr)(env);
5082 }
5083
5084 /* Convert vfp exception flags to target form. */
5085 static inline int vfp_exceptbits_to_host(int target_bits)
5086 {
5087 int host_bits = 0;
5088
5089 if (target_bits & 1)
5090 host_bits |= float_flag_invalid;
5091 if (target_bits & 2)
5092 host_bits |= float_flag_divbyzero;
5093 if (target_bits & 4)
5094 host_bits |= float_flag_overflow;
5095 if (target_bits & 8)
5096 host_bits |= float_flag_underflow;
5097 if (target_bits & 0x10)
5098 host_bits |= float_flag_inexact;
5099 if (target_bits & 0x80)
5100 host_bits |= float_flag_input_denormal;
5101 return host_bits;
5102 }
5103
5104 void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
5105 {
5106 int i;
5107 uint32_t changed;
5108
5109 changed = env->vfp.xregs[ARM_VFP_FPSCR];
5110 env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
5111 env->vfp.vec_len = (val >> 16) & 7;
5112 env->vfp.vec_stride = (val >> 20) & 3;
5113
5114 changed ^= val;
5115 if (changed & (3 << 22)) {
5116 i = (val >> 22) & 3;
5117 switch (i) {
5118 case FPROUNDING_TIEEVEN:
5119 i = float_round_nearest_even;
5120 break;
5121 case FPROUNDING_POSINF:
5122 i = float_round_up;
5123 break;
5124 case FPROUNDING_NEGINF:
5125 i = float_round_down;
5126 break;
5127 case FPROUNDING_ZERO:
5128 i = float_round_to_zero;
5129 break;
5130 }
5131 set_float_rounding_mode(i, &env->vfp.fp_status);
5132 }
5133 if (changed & (1 << 24)) {
5134 set_flush_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
5135 set_flush_inputs_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
5136 }
5137 if (changed & (1 << 25))
5138 set_default_nan_mode((val & (1 << 25)) != 0, &env->vfp.fp_status);
5139
5140 i = vfp_exceptbits_to_host(val);
5141 set_float_exception_flags(i, &env->vfp.fp_status);
5142 set_float_exception_flags(0, &env->vfp.standard_fp_status);
5143 }
5144
5145 void vfp_set_fpscr(CPUARMState *env, uint32_t val)
5146 {
5147 HELPER(vfp_set_fpscr)(env, val);
5148 }
5149
5150 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
5151
5152 #define VFP_BINOP(name) \
5153 float32 VFP_HELPER(name, s)(float32 a, float32 b, void *fpstp) \
5154 { \
5155 float_status *fpst = fpstp; \
5156 return float32_ ## name(a, b, fpst); \
5157 } \
5158 float64 VFP_HELPER(name, d)(float64 a, float64 b, void *fpstp) \
5159 { \
5160 float_status *fpst = fpstp; \
5161 return float64_ ## name(a, b, fpst); \
5162 }
5163 VFP_BINOP(add)
5164 VFP_BINOP(sub)
5165 VFP_BINOP(mul)
5166 VFP_BINOP(div)
5167 VFP_BINOP(min)
5168 VFP_BINOP(max)
5169 VFP_BINOP(minnum)
5170 VFP_BINOP(maxnum)
5171 #undef VFP_BINOP
5172
5173 float32 VFP_HELPER(neg, s)(float32 a)
5174 {
5175 return float32_chs(a);
5176 }
5177
5178 float64 VFP_HELPER(neg, d)(float64 a)
5179 {
5180 return float64_chs(a);
5181 }
5182
5183 float32 VFP_HELPER(abs, s)(float32 a)
5184 {
5185 return float32_abs(a);
5186 }
5187
5188 float64 VFP_HELPER(abs, d)(float64 a)
5189 {
5190 return float64_abs(a);
5191 }
5192
5193 float32 VFP_HELPER(sqrt, s)(float32 a, CPUARMState *env)
5194 {
5195 return float32_sqrt(a, &env->vfp.fp_status);
5196 }
5197
5198 float64 VFP_HELPER(sqrt, d)(float64 a, CPUARMState *env)
5199 {
5200 return float64_sqrt(a, &env->vfp.fp_status);
5201 }
5202
5203 /* XXX: check quiet/signaling case */
5204 #define DO_VFP_cmp(p, type) \
5205 void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env) \
5206 { \
5207 uint32_t flags; \
5208 switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
5209 case 0: flags = 0x6; break; \
5210 case -1: flags = 0x8; break; \
5211 case 1: flags = 0x2; break; \
5212 default: case 2: flags = 0x3; break; \
5213 } \
5214 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
5215 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
5216 } \
5217 void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \
5218 { \
5219 uint32_t flags; \
5220 switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
5221 case 0: flags = 0x6; break; \
5222 case -1: flags = 0x8; break; \
5223 case 1: flags = 0x2; break; \
5224 default: case 2: flags = 0x3; break; \
5225 } \
5226 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
5227 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
5228 }
5229 DO_VFP_cmp(s, float32)
5230 DO_VFP_cmp(d, float64)
5231 #undef DO_VFP_cmp
5232
5233 /* Integer to float and float to integer conversions */
5234
5235 #define CONV_ITOF(name, fsz, sign) \
5236 float##fsz HELPER(name)(uint32_t x, void *fpstp) \
5237 { \
5238 float_status *fpst = fpstp; \
5239 return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \
5240 }
5241
5242 #define CONV_FTOI(name, fsz, sign, round) \
5243 uint32_t HELPER(name)(float##fsz x, void *fpstp) \
5244 { \
5245 float_status *fpst = fpstp; \
5246 if (float##fsz##_is_any_nan(x)) { \
5247 float_raise(float_flag_invalid, fpst); \
5248 return 0; \
5249 } \
5250 return float##fsz##_to_##sign##int32##round(x, fpst); \
5251 }
5252
5253 #define FLOAT_CONVS(name, p, fsz, sign) \
5254 CONV_ITOF(vfp_##name##to##p, fsz, sign) \
5255 CONV_FTOI(vfp_to##name##p, fsz, sign, ) \
5256 CONV_FTOI(vfp_to##name##z##p, fsz, sign, _round_to_zero)
5257
5258 FLOAT_CONVS(si, s, 32, )
5259 FLOAT_CONVS(si, d, 64, )
5260 FLOAT_CONVS(ui, s, 32, u)
5261 FLOAT_CONVS(ui, d, 64, u)
5262
5263 #undef CONV_ITOF
5264 #undef CONV_FTOI
5265 #undef FLOAT_CONVS
5266
5267 /* floating point conversion */
5268 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUARMState *env)
5269 {
5270 float64 r = float32_to_float64(x, &env->vfp.fp_status);
5271 /* ARM requires that S<->D conversion of any kind of NaN generates
5272 * a quiet NaN by forcing the most significant frac bit to 1.
5273 */
5274 return float64_maybe_silence_nan(r);
5275 }
5276
5277 float32 VFP_HELPER(fcvts, d)(float64 x, CPUARMState *env)
5278 {
5279 float32 r = float64_to_float32(x, &env->vfp.fp_status);
5280 /* ARM requires that S<->D conversion of any kind of NaN generates
5281 * a quiet NaN by forcing the most significant frac bit to 1.
5282 */
5283 return float32_maybe_silence_nan(r);
5284 }
5285
5286 /* VFP3 fixed point conversion. */
5287 #define VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
5288 float##fsz HELPER(vfp_##name##to##p)(uint##isz##_t x, uint32_t shift, \
5289 void *fpstp) \
5290 { \
5291 float_status *fpst = fpstp; \
5292 float##fsz tmp; \
5293 tmp = itype##_to_##float##fsz(x, fpst); \
5294 return float##fsz##_scalbn(tmp, -(int)shift, fpst); \
5295 }
5296
5297 /* Notice that we want only input-denormal exception flags from the
5298 * scalbn operation: the other possible flags (overflow+inexact if
5299 * we overflow to infinity, output-denormal) aren't correct for the
5300 * complete scale-and-convert operation.
5301 */
5302 #define VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, round) \
5303 uint##isz##_t HELPER(vfp_to##name##p##round)(float##fsz x, \
5304 uint32_t shift, \
5305 void *fpstp) \
5306 { \
5307 float_status *fpst = fpstp; \
5308 int old_exc_flags = get_float_exception_flags(fpst); \
5309 float##fsz tmp; \
5310 if (float##fsz##_is_any_nan(x)) { \
5311 float_raise(float_flag_invalid, fpst); \
5312 return 0; \
5313 } \
5314 tmp = float##fsz##_scalbn(x, shift, fpst); \
5315 old_exc_flags |= get_float_exception_flags(fpst) \
5316 & float_flag_input_denormal; \
5317 set_float_exception_flags(old_exc_flags, fpst); \
5318 return float##fsz##_to_##itype##round(tmp, fpst); \
5319 }
5320
5321 #define VFP_CONV_FIX(name, p, fsz, isz, itype) \
5322 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
5323 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, _round_to_zero) \
5324 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
5325
5326 #define VFP_CONV_FIX_A64(name, p, fsz, isz, itype) \
5327 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
5328 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
5329
5330 VFP_CONV_FIX(sh, d, 64, 64, int16)
5331 VFP_CONV_FIX(sl, d, 64, 64, int32)
5332 VFP_CONV_FIX_A64(sq, d, 64, 64, int64)
5333 VFP_CONV_FIX(uh, d, 64, 64, uint16)
5334 VFP_CONV_FIX(ul, d, 64, 64, uint32)
5335 VFP_CONV_FIX_A64(uq, d, 64, 64, uint64)
5336 VFP_CONV_FIX(sh, s, 32, 32, int16)
5337 VFP_CONV_FIX(sl, s, 32, 32, int32)
5338 VFP_CONV_FIX_A64(sq, s, 32, 64, int64)
5339 VFP_CONV_FIX(uh, s, 32, 32, uint16)
5340 VFP_CONV_FIX(ul, s, 32, 32, uint32)
5341 VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
5342 #undef VFP_CONV_FIX
5343 #undef VFP_CONV_FIX_FLOAT
5344 #undef VFP_CONV_FLOAT_FIX_ROUND
5345
5346 /* Set the current fp rounding mode and return the old one.
5347 * The argument is a softfloat float_round_ value.
5348 */
5349 uint32_t HELPER(set_rmode)(uint32_t rmode, CPUARMState *env)
5350 {
5351 float_status *fp_status = &env->vfp.fp_status;
5352
5353 uint32_t prev_rmode = get_float_rounding_mode(fp_status);
5354 set_float_rounding_mode(rmode, fp_status);
5355
5356 return prev_rmode;
5357 }
5358
5359 /* Set the current fp rounding mode in the standard fp status and return
5360 * the old one. This is for NEON instructions that need to change the
5361 * rounding mode but wish to use the standard FPSCR values for everything
5362 * else. Always set the rounding mode back to the correct value after
5363 * modifying it.
5364 * The argument is a softfloat float_round_ value.
5365 */
5366 uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env)
5367 {
5368 float_status *fp_status = &env->vfp.standard_fp_status;
5369
5370 uint32_t prev_rmode = get_float_rounding_mode(fp_status);
5371 set_float_rounding_mode(rmode, fp_status);
5372
5373 return prev_rmode;
5374 }
5375
5376 /* Half precision conversions. */
5377 static float32 do_fcvt_f16_to_f32(uint32_t a, CPUARMState *env, float_status *s)
5378 {
5379 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
5380 float32 r = float16_to_float32(make_float16(a), ieee, s);
5381 if (ieee) {
5382 return float32_maybe_silence_nan(r);
5383 }
5384 return r;
5385 }
5386
5387 static uint32_t do_fcvt_f32_to_f16(float32 a, CPUARMState *env, float_status *s)
5388 {
5389 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
5390 float16 r = float32_to_float16(a, ieee, s);
5391 if (ieee) {
5392 r = float16_maybe_silence_nan(r);
5393 }
5394 return float16_val(r);
5395 }
5396
5397 float32 HELPER(neon_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)
5398 {
5399 return do_fcvt_f16_to_f32(a, env, &env->vfp.standard_fp_status);
5400 }
5401
5402 uint32_t HELPER(neon_fcvt_f32_to_f16)(float32 a, CPUARMState *env)
5403 {
5404 return do_fcvt_f32_to_f16(a, env, &env->vfp.standard_fp_status);
5405 }
5406
5407 float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)
5408 {
5409 return do_fcvt_f16_to_f32(a, env, &env->vfp.fp_status);
5410 }
5411
5412 uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, CPUARMState *env)
5413 {
5414 return do_fcvt_f32_to_f16(a, env, &env->vfp.fp_status);
5415 }
5416
5417 float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, CPUARMState *env)
5418 {
5419 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
5420 float64 r = float16_to_float64(make_float16(a), ieee, &env->vfp.fp_status);
5421 if (ieee) {
5422 return float64_maybe_silence_nan(r);
5423 }
5424 return r;
5425 }
5426
5427 uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, CPUARMState *env)
5428 {
5429 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
5430 float16 r = float64_to_float16(a, ieee, &env->vfp.fp_status);
5431 if (ieee) {
5432 r = float16_maybe_silence_nan(r);
5433 }
5434 return float16_val(r);
5435 }
5436
5437 #define float32_two make_float32(0x40000000)
5438 #define float32_three make_float32(0x40400000)
5439 #define float32_one_point_five make_float32(0x3fc00000)
5440
5441 float32 HELPER(recps_f32)(float32 a, float32 b, CPUARMState *env)
5442 {
5443 float_status *s = &env->vfp.standard_fp_status;
5444 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
5445 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
5446 if (!(float32_is_zero(a) || float32_is_zero(b))) {
5447 float_raise(float_flag_input_denormal, s);
5448 }
5449 return float32_two;
5450 }
5451 return float32_sub(float32_two, float32_mul(a, b, s), s);
5452 }
5453
5454 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUARMState *env)
5455 {
5456 float_status *s = &env->vfp.standard_fp_status;
5457 float32 product;
5458 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
5459 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
5460 if (!(float32_is_zero(a) || float32_is_zero(b))) {
5461 float_raise(float_flag_input_denormal, s);
5462 }
5463 return float32_one_point_five;
5464 }
5465 product = float32_mul(a, b, s);
5466 return float32_div(float32_sub(float32_three, product, s), float32_two, s);
5467 }
5468
5469 /* NEON helpers. */
5470
5471 /* Constants 256 and 512 are used in some helpers; we avoid relying on
5472 * int->float conversions at run-time. */
5473 #define float64_256 make_float64(0x4070000000000000LL)
5474 #define float64_512 make_float64(0x4080000000000000LL)
5475 #define float32_maxnorm make_float32(0x7f7fffff)
5476 #define float64_maxnorm make_float64(0x7fefffffffffffffLL)
5477
5478 /* Reciprocal functions
5479 *
5480 * The algorithm that must be used to calculate the estimate
5481 * is specified by the ARM ARM, see FPRecipEstimate()
5482 */
5483
5484 static float64 recip_estimate(float64 a, float_status *real_fp_status)
5485 {
5486 /* These calculations mustn't set any fp exception flags,
5487 * so we use a local copy of the fp_status.
5488 */
5489 float_status dummy_status = *real_fp_status;
5490 float_status *s = &dummy_status;
5491 /* q = (int)(a * 512.0) */
5492 float64 q = float64_mul(float64_512, a, s);
5493 int64_t q_int = float64_to_int64_round_to_zero(q, s);
5494
5495 /* r = 1.0 / (((double)q + 0.5) / 512.0) */
5496 q = int64_to_float64(q_int, s);
5497 q = float64_add(q, float64_half, s);
5498 q = float64_div(q, float64_512, s);
5499 q = float64_div(float64_one, q, s);
5500
5501 /* s = (int)(256.0 * r + 0.5) */
5502 q = float64_mul(q, float64_256, s);
5503 q = float64_add(q, float64_half, s);
5504 q_int = float64_to_int64_round_to_zero(q, s);
5505
5506 /* return (double)s / 256.0 */
5507 return float64_div(int64_to_float64(q_int, s), float64_256, s);
5508 }
5509
5510 /* Common wrapper to call recip_estimate */
5511 static float64 call_recip_estimate(float64 num, int off, float_status *fpst)
5512 {
5513 uint64_t val64 = float64_val(num);
5514 uint64_t frac = extract64(val64, 0, 52);
5515 int64_t exp = extract64(val64, 52, 11);
5516 uint64_t sbit;
5517 float64 scaled, estimate;
5518
5519 /* Generate the scaled number for the estimate function */
5520 if (exp == 0) {
5521 if (extract64(frac, 51, 1) == 0) {
5522 exp = -1;
5523 frac = extract64(frac, 0, 50) << 2;
5524 } else {
5525 frac = extract64(frac, 0, 51) << 1;
5526 }
5527 }
5528
5529 /* scaled = '0' : '01111111110' : fraction<51:44> : Zeros(44); */
5530 scaled = make_float64((0x3feULL << 52)
5531 | extract64(frac, 44, 8) << 44);
5532
5533 estimate = recip_estimate(scaled, fpst);
5534
5535 /* Build new result */
5536 val64 = float64_val(estimate);
5537 sbit = 0x8000000000000000ULL & val64;
5538 exp = off - exp;
5539 frac = extract64(val64, 0, 52);
5540
5541 if (exp == 0) {
5542 frac = 1ULL << 51 | extract64(frac, 1, 51);
5543 } else if (exp == -1) {
5544 frac = 1ULL << 50 | extract64(frac, 2, 50);
5545 exp = 0;
5546 }
5547
5548 return make_float64(sbit | (exp << 52) | frac);
5549 }
5550
5551 static bool round_to_inf(float_status *fpst, bool sign_bit)
5552 {
5553 switch (fpst->float_rounding_mode) {
5554 case float_round_nearest_even: /* Round to Nearest */
5555 return true;
5556 case float_round_up: /* Round to +Inf */
5557 return !sign_bit;
5558 case float_round_down: /* Round to -Inf */
5559 return sign_bit;
5560 case float_round_to_zero: /* Round to Zero */
5561 return false;
5562 }
5563
5564 g_assert_not_reached();
5565 }
5566
5567 float32 HELPER(recpe_f32)(float32 input, void *fpstp)
5568 {
5569 float_status *fpst = fpstp;
5570 float32 f32 = float32_squash_input_denormal(input, fpst);
5571 uint32_t f32_val = float32_val(f32);
5572 uint32_t f32_sbit = 0x80000000ULL & f32_val;
5573 int32_t f32_exp = extract32(f32_val, 23, 8);
5574 uint32_t f32_frac = extract32(f32_val, 0, 23);
5575 float64 f64, r64;
5576 uint64_t r64_val;
5577 int64_t r64_exp;
5578 uint64_t r64_frac;
5579
5580 if (float32_is_any_nan(f32)) {
5581 float32 nan = f32;
5582 if (float32_is_signaling_nan(f32)) {
5583 float_raise(float_flag_invalid, fpst);
5584 nan = float32_maybe_silence_nan(f32);
5585 }
5586 if (fpst->default_nan_mode) {
5587 nan = float32_default_nan;
5588 }
5589 return nan;
5590 } else if (float32_is_infinity(f32)) {
5591 return float32_set_sign(float32_zero, float32_is_neg(f32));
5592 } else if (float32_is_zero(f32)) {
5593 float_raise(float_flag_divbyzero, fpst);
5594 return float32_set_sign(float32_infinity, float32_is_neg(f32));
5595 } else if ((f32_val & ~(1ULL << 31)) < (1ULL << 21)) {
5596 /* Abs(value) < 2.0^-128 */
5597 float_raise(float_flag_overflow | float_flag_inexact, fpst);
5598 if (round_to_inf(fpst, f32_sbit)) {
5599 return float32_set_sign(float32_infinity, float32_is_neg(f32));
5600 } else {
5601 return float32_set_sign(float32_maxnorm, float32_is_neg(f32));
5602 }
5603 } else if (f32_exp >= 253 && fpst->flush_to_zero) {
5604 float_raise(float_flag_underflow, fpst);
5605 return float32_set_sign(float32_zero, float32_is_neg(f32));
5606 }
5607
5608
5609 f64 = make_float64(((int64_t)(f32_exp) << 52) | (int64_t)(f32_frac) << 29);
5610 r64 = call_recip_estimate(f64, 253, fpst);
5611 r64_val = float64_val(r64);
5612 r64_exp = extract64(r64_val, 52, 11);
5613 r64_frac = extract64(r64_val, 0, 52);
5614
5615 /* result = sign : result_exp<7:0> : fraction<51:29>; */
5616 return make_float32(f32_sbit |
5617 (r64_exp & 0xff) << 23 |
5618 extract64(r64_frac, 29, 24));
5619 }
5620
5621 float64 HELPER(recpe_f64)(float64 input, void *fpstp)
5622 {
5623 float_status *fpst = fpstp;
5624 float64 f64 = float64_squash_input_denormal(input, fpst);
5625 uint64_t f64_val = float64_val(f64);
5626 uint64_t f64_sbit = 0x8000000000000000ULL & f64_val;
5627 int64_t f64_exp = extract64(f64_val, 52, 11);
5628 float64 r64;
5629 uint64_t r64_val;
5630 int64_t r64_exp;
5631 uint64_t r64_frac;
5632
5633 /* Deal with any special cases */
5634 if (float64_is_any_nan(f64)) {
5635 float64 nan = f64;
5636 if (float64_is_signaling_nan(f64)) {
5637 float_raise(float_flag_invalid, fpst);
5638 nan = float64_maybe_silence_nan(f64);
5639 }
5640 if (fpst->default_nan_mode) {
5641 nan = float64_default_nan;
5642 }
5643 return nan;
5644 } else if (float64_is_infinity(f64)) {
5645 return float64_set_sign(float64_zero, float64_is_neg(f64));
5646 } else if (float64_is_zero(f64)) {
5647 float_raise(float_flag_divbyzero, fpst);
5648 return float64_set_sign(float64_infinity, float64_is_neg(f64));
5649 } else if ((f64_val & ~(1ULL << 63)) < (1ULL << 50)) {
5650 /* Abs(value) < 2.0^-1024 */
5651 float_raise(float_flag_overflow | float_flag_inexact, fpst);
5652 if (round_to_inf(fpst, f64_sbit)) {
5653 return float64_set_sign(float64_infinity, float64_is_neg(f64));
5654 } else {
5655 return float64_set_sign(float64_maxnorm, float64_is_neg(f64));
5656 }
5657 } else if (f64_exp >= 1023 && fpst->flush_to_zero) {
5658 float_raise(float_flag_underflow, fpst);
5659 return float64_set_sign(float64_zero, float64_is_neg(f64));
5660 }
5661
5662 r64 = call_recip_estimate(f64, 2045, fpst);
5663 r64_val = float64_val(r64);
5664 r64_exp = extract64(r64_val, 52, 11);
5665 r64_frac = extract64(r64_val, 0, 52);
5666
5667 /* result = sign : result_exp<10:0> : fraction<51:0> */
5668 return make_float64(f64_sbit |
5669 ((r64_exp & 0x7ff) << 52) |
5670 r64_frac);
5671 }
5672
5673 /* The algorithm that must be used to calculate the estimate
5674 * is specified by the ARM ARM.
5675 */
5676 static float64 recip_sqrt_estimate(float64 a, float_status *real_fp_status)
5677 {
5678 /* These calculations mustn't set any fp exception flags,
5679 * so we use a local copy of the fp_status.
5680 */
5681 float_status dummy_status = *real_fp_status;
5682 float_status *s = &dummy_status;
5683 float64 q;
5684 int64_t q_int;
5685
5686 if (float64_lt(a, float64_half, s)) {
5687 /* range 0.25 <= a < 0.5 */
5688
5689 /* a in units of 1/512 rounded down */
5690 /* q0 = (int)(a * 512.0); */
5691 q = float64_mul(float64_512, a, s);
5692 q_int = float64_to_int64_round_to_zero(q, s);
5693
5694 /* reciprocal root r */
5695 /* r = 1.0 / sqrt(((double)q0 + 0.5) / 512.0); */
5696 q = int64_to_float64(q_int, s);
5697 q = float64_add(q, float64_half, s);
5698 q = float64_div(q, float64_512, s);
5699 q = float64_sqrt(q, s);
5700 q = float64_div(float64_one, q, s);
5701 } else {
5702 /* range 0.5 <= a < 1.0 */
5703
5704 /* a in units of 1/256 rounded down */
5705 /* q1 = (int)(a * 256.0); */
5706 q = float64_mul(float64_256, a, s);
5707 int64_t q_int = float64_to_int64_round_to_zero(q, s);
5708
5709 /* reciprocal root r */
5710 /* r = 1.0 /sqrt(((double)q1 + 0.5) / 256); */
5711 q = int64_to_float64(q_int, s);
5712 q = float64_add(q, float64_half, s);
5713 q = float64_div(q, float64_256, s);
5714 q = float64_sqrt(q, s);
5715 q = float64_div(float64_one, q, s);
5716 }
5717 /* r in units of 1/256 rounded to nearest */
5718 /* s = (int)(256.0 * r + 0.5); */
5719
5720 q = float64_mul(q, float64_256,s );
5721 q = float64_add(q, float64_half, s);
5722 q_int = float64_to_int64_round_to_zero(q, s);
5723
5724 /* return (double)s / 256.0;*/
5725 return float64_div(int64_to_float64(q_int, s), float64_256, s);
5726 }
5727
5728 float32 HELPER(rsqrte_f32)(float32 input, void *fpstp)
5729 {
5730 float_status *s = fpstp;
5731 float32 f32 = float32_squash_input_denormal(input, s);
5732 uint32_t val = float32_val(f32);
5733 uint32_t f32_sbit = 0x80000000 & val;
5734 int32_t f32_exp = extract32(val, 23, 8);
5735 uint32_t f32_frac = extract32(val, 0, 23);
5736 uint64_t f64_frac;
5737 uint64_t val64;
5738 int result_exp;
5739 float64 f64;
5740
5741 if (float32_is_any_nan(f32)) {
5742 float32 nan = f32;
5743 if (float32_is_signaling_nan(f32)) {
5744 float_raise(float_flag_invalid, s);
5745 nan = float32_maybe_silence_nan(f32);
5746 }
5747 if (s->default_nan_mode) {
5748 nan = float32_default_nan;
5749 }
5750 return nan;
5751 } else if (float32_is_zero(f32)) {
5752 float_raise(float_flag_divbyzero, s);
5753 return float32_set_sign(float32_infinity, float32_is_neg(f32));
5754 } else if (float32_is_neg(f32)) {
5755 float_raise(float_flag_invalid, s);
5756 return float32_default_nan;
5757 } else if (float32_is_infinity(f32)) {
5758 return float32_zero;
5759 }
5760
5761 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
5762 * preserving the parity of the exponent. */
5763
5764 f64_frac = ((uint64_t) f32_frac) << 29;
5765 if (f32_exp == 0) {
5766 while (extract64(f64_frac, 51, 1) == 0) {
5767 f64_frac = f64_frac << 1;
5768 f32_exp = f32_exp-1;
5769 }
5770 f64_frac = extract64(f64_frac, 0, 51) << 1;
5771 }
5772
5773 if (extract64(f32_exp, 0, 1) == 0) {
5774 f64 = make_float64(((uint64_t) f32_sbit) << 32
5775 | (0x3feULL << 52)
5776 | f64_frac);
5777 } else {
5778 f64 = make_float64(((uint64_t) f32_sbit) << 32
5779 | (0x3fdULL << 52)
5780 | f64_frac);
5781 }
5782
5783 result_exp = (380 - f32_exp) / 2;
5784
5785 f64 = recip_sqrt_estimate(f64, s);
5786
5787 val64 = float64_val(f64);
5788
5789 val = ((result_exp & 0xff) << 23)
5790 | ((val64 >> 29) & 0x7fffff);
5791 return make_float32(val);
5792 }
5793
5794 float64 HELPER(rsqrte_f64)(float64 input, void *fpstp)
5795 {
5796 float_status *s = fpstp;
5797 float64 f64 = float64_squash_input_denormal(input, s);
5798 uint64_t val = float64_val(f64);
5799 uint64_t f64_sbit = 0x8000000000000000ULL & val;
5800 int64_t f64_exp = extract64(val, 52, 11);
5801 uint64_t f64_frac = extract64(val, 0, 52);
5802 int64_t result_exp;
5803 uint64_t result_frac;
5804
5805 if (float64_is_any_nan(f64)) {
5806 float64 nan = f64;
5807 if (float64_is_signaling_nan(f64)) {
5808 float_raise(float_flag_invalid, s);
5809 nan = float64_maybe_silence_nan(f64);
5810 }
5811 if (s->default_nan_mode) {
5812 nan = float64_default_nan;
5813 }
5814 return nan;
5815 } else if (float64_is_zero(f64)) {
5816 float_raise(float_flag_divbyzero, s);
5817 return float64_set_sign(float64_infinity, float64_is_neg(f64));
5818 } else if (float64_is_neg(f64)) {
5819 float_raise(float_flag_invalid, s);
5820 return float64_default_nan;
5821 } else if (float64_is_infinity(f64)) {
5822 return float64_zero;
5823 }
5824
5825 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
5826 * preserving the parity of the exponent. */
5827
5828 if (f64_exp == 0) {
5829 while (extract64(f64_frac, 51, 1) == 0) {
5830 f64_frac = f64_frac << 1;
5831 f64_exp = f64_exp - 1;
5832 }
5833 f64_frac = extract64(f64_frac, 0, 51) << 1;
5834 }
5835
5836 if (extract64(f64_exp, 0, 1) == 0) {
5837 f64 = make_float64(f64_sbit
5838 | (0x3feULL << 52)
5839 | f64_frac);
5840 } else {
5841 f64 = make_float64(f64_sbit
5842 | (0x3fdULL << 52)
5843 | f64_frac);
5844 }
5845
5846 result_exp = (3068 - f64_exp) / 2;
5847
5848 f64 = recip_sqrt_estimate(f64, s);
5849
5850 result_frac = extract64(float64_val(f64), 0, 52);
5851
5852 return make_float64(f64_sbit |
5853 ((result_exp & 0x7ff) << 52) |
5854 result_frac);
5855 }
5856
5857 uint32_t HELPER(recpe_u32)(uint32_t a, void *fpstp)
5858 {
5859 float_status *s = fpstp;
5860 float64 f64;
5861
5862 if ((a & 0x80000000) == 0) {
5863 return 0xffffffff;
5864 }
5865
5866 f64 = make_float64((0x3feULL << 52)
5867 | ((int64_t)(a & 0x7fffffff) << 21));
5868
5869 f64 = recip_estimate(f64, s);
5870
5871 return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
5872 }
5873
5874 uint32_t HELPER(rsqrte_u32)(uint32_t a, void *fpstp)
5875 {
5876 float_status *fpst = fpstp;
5877 float64 f64;
5878
5879 if ((a & 0xc0000000) == 0) {
5880 return 0xffffffff;
5881 }
5882
5883 if (a & 0x80000000) {
5884 f64 = make_float64((0x3feULL << 52)
5885 | ((uint64_t)(a & 0x7fffffff) << 21));
5886 } else { /* bits 31-30 == '01' */
5887 f64 = make_float64((0x3fdULL << 52)
5888 | ((uint64_t)(a & 0x3fffffff) << 22));
5889 }
5890
5891 f64 = recip_sqrt_estimate(f64, fpst);
5892
5893 return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
5894 }
5895
5896 /* VFPv4 fused multiply-accumulate */
5897 float32 VFP_HELPER(muladd, s)(float32 a, float32 b, float32 c, void *fpstp)
5898 {
5899 float_status *fpst = fpstp;
5900 return float32_muladd(a, b, c, 0, fpst);
5901 }
5902
5903 float64 VFP_HELPER(muladd, d)(float64 a, float64 b, float64 c, void *fpstp)
5904 {
5905 float_status *fpst = fpstp;
5906 return float64_muladd(a, b, c, 0, fpst);
5907 }
5908
5909 /* ARMv8 round to integral */
5910 float32 HELPER(rints_exact)(float32 x, void *fp_status)
5911 {
5912 return float32_round_to_int(x, fp_status);
5913 }
5914
5915 float64 HELPER(rintd_exact)(float64 x, void *fp_status)
5916 {
5917 return float64_round_to_int(x, fp_status);
5918 }
5919
5920 float32 HELPER(rints)(float32 x, void *fp_status)
5921 {
5922 int old_flags = get_float_exception_flags(fp_status), new_flags;
5923 float32 ret;
5924
5925 ret = float32_round_to_int(x, fp_status);
5926
5927 /* Suppress any inexact exceptions the conversion produced */
5928 if (!(old_flags & float_flag_inexact)) {
5929 new_flags = get_float_exception_flags(fp_status);
5930 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
5931 }
5932
5933 return ret;
5934 }
5935
5936 float64 HELPER(rintd)(float64 x, void *fp_status)
5937 {
5938 int old_flags = get_float_exception_flags(fp_status), new_flags;
5939 float64 ret;
5940
5941 ret = float64_round_to_int(x, fp_status);
5942
5943 new_flags = get_float_exception_flags(fp_status);
5944
5945 /* Suppress any inexact exceptions the conversion produced */
5946 if (!(old_flags & float_flag_inexact)) {
5947 new_flags = get_float_exception_flags(fp_status);
5948 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
5949 }
5950
5951 return ret;
5952 }
5953
5954 /* Convert ARM rounding mode to softfloat */
5955 int arm_rmode_to_sf(int rmode)
5956 {
5957 switch (rmode) {
5958 case FPROUNDING_TIEAWAY:
5959 rmode = float_round_ties_away;
5960 break;
5961 case FPROUNDING_ODD:
5962 /* FIXME: add support for TIEAWAY and ODD */
5963 qemu_log_mask(LOG_UNIMP, "arm: unimplemented rounding mode: %d\n",
5964 rmode);
5965 case FPROUNDING_TIEEVEN:
5966 default:
5967 rmode = float_round_nearest_even;
5968 break;
5969 case FPROUNDING_POSINF:
5970 rmode = float_round_up;
5971 break;
5972 case FPROUNDING_NEGINF:
5973 rmode = float_round_down;
5974 break;
5975 case FPROUNDING_ZERO:
5976 rmode = float_round_to_zero;
5977 break;
5978 }
5979 return rmode;
5980 }
5981
5982 /* CRC helpers.
5983 * The upper bytes of val (above the number specified by 'bytes') must have
5984 * been zeroed out by the caller.
5985 */
5986 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes)
5987 {
5988 uint8_t buf[4];
5989
5990 stl_le_p(buf, val);
5991
5992 /* zlib crc32 converts the accumulator and output to one's complement. */
5993 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff;
5994 }
5995
5996 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
5997 {
5998 uint8_t buf[4];
5999
6000 stl_le_p(buf, val);
6001
6002 /* Linux crc32c converts the output to one's complement. */
6003 return crc32c(acc, buf, bytes) ^ 0xffffffff;
6004 }
AR7 emulation for QEMU