1 #include "qemu/osdep.h"
5 #include "exec/gdbstub.h"
6 #include "exec/helper-proto.h"
7 #include "qemu/host-utils.h"
8 #include "sysemu/arch_init.h"
9 #include "sysemu/sysemu.h"
10 #include "qemu/bitops.h"
11 #include "qemu/crc32c.h"
12 #include "exec/exec-all.h"
13 #include "exec/cpu_ldst.h"
15 #include <zlib.h> /* For crc32 */
16 #include "exec/semihost.h"
17 #include "sysemu/kvm.h"
19 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
21 #ifndef CONFIG_USER_ONLY
22 static bool get_phys_addr(CPUARMState
*env
, target_ulong address
,
23 int access_type
, ARMMMUIdx mmu_idx
,
24 hwaddr
*phys_ptr
, MemTxAttrs
*attrs
, int *prot
,
25 target_ulong
*page_size
, uint32_t *fsr
,
28 static bool get_phys_addr_lpae(CPUARMState
*env
, target_ulong address
,
29 int access_type
, ARMMMUIdx mmu_idx
,
30 hwaddr
*phys_ptr
, MemTxAttrs
*txattrs
, int *prot
,
31 target_ulong
*page_size_ptr
, uint32_t *fsr
,
34 /* Definitions for the PMCCNTR and PMCR registers */
40 static int vfp_gdb_get_reg(CPUARMState
*env
, uint8_t *buf
, int reg
)
44 /* VFP data registers are always little-endian. */
45 nregs
= arm_feature(env
, ARM_FEATURE_VFP3
) ? 32 : 16;
47 stfq_le_p(buf
, env
->vfp
.regs
[reg
]);
50 if (arm_feature(env
, ARM_FEATURE_NEON
)) {
51 /* Aliases for Q regs. */
54 stfq_le_p(buf
, env
->vfp
.regs
[(reg
- 32) * 2]);
55 stfq_le_p(buf
+ 8, env
->vfp
.regs
[(reg
- 32) * 2 + 1]);
59 switch (reg
- nregs
) {
60 case 0: stl_p(buf
, env
->vfp
.xregs
[ARM_VFP_FPSID
]); return 4;
61 case 1: stl_p(buf
, env
->vfp
.xregs
[ARM_VFP_FPSCR
]); return 4;
62 case 2: stl_p(buf
, env
->vfp
.xregs
[ARM_VFP_FPEXC
]); return 4;
67 static int vfp_gdb_set_reg(CPUARMState
*env
, uint8_t *buf
, int reg
)
71 nregs
= arm_feature(env
, ARM_FEATURE_VFP3
) ? 32 : 16;
73 env
->vfp
.regs
[reg
] = ldfq_le_p(buf
);
76 if (arm_feature(env
, ARM_FEATURE_NEON
)) {
79 env
->vfp
.regs
[(reg
- 32) * 2] = ldfq_le_p(buf
);
80 env
->vfp
.regs
[(reg
- 32) * 2 + 1] = ldfq_le_p(buf
+ 8);
84 switch (reg
- nregs
) {
85 case 0: env
->vfp
.xregs
[ARM_VFP_FPSID
] = ldl_p(buf
); return 4;
86 case 1: env
->vfp
.xregs
[ARM_VFP_FPSCR
] = ldl_p(buf
); return 4;
87 case 2: env
->vfp
.xregs
[ARM_VFP_FPEXC
] = ldl_p(buf
) & (1 << 30); return 4;
92 static int aarch64_fpu_gdb_get_reg(CPUARMState
*env
, uint8_t *buf
, int reg
)
96 /* 128 bit FP register */
97 stfq_le_p(buf
, env
->vfp
.regs
[reg
* 2]);
98 stfq_le_p(buf
+ 8, env
->vfp
.regs
[reg
* 2 + 1]);
102 stl_p(buf
, vfp_get_fpsr(env
));
106 stl_p(buf
, vfp_get_fpcr(env
));
113 static int aarch64_fpu_gdb_set_reg(CPUARMState
*env
, uint8_t *buf
, int reg
)
117 /* 128 bit FP register */
118 env
->vfp
.regs
[reg
* 2] = ldfq_le_p(buf
);
119 env
->vfp
.regs
[reg
* 2 + 1] = ldfq_le_p(buf
+ 8);
123 vfp_set_fpsr(env
, ldl_p(buf
));
127 vfp_set_fpcr(env
, ldl_p(buf
));
134 static uint64_t raw_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
136 assert(ri
->fieldoffset
);
137 if (cpreg_field_is_64bit(ri
)) {
138 return CPREG_FIELD64(env
, ri
);
140 return CPREG_FIELD32(env
, ri
);
144 static void raw_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
147 assert(ri
->fieldoffset
);
148 if (cpreg_field_is_64bit(ri
)) {
149 CPREG_FIELD64(env
, ri
) = value
;
151 CPREG_FIELD32(env
, ri
) = value
;
155 static void *raw_ptr(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
157 return (char *)env
+ ri
->fieldoffset
;
160 uint64_t read_raw_cp_reg(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
162 /* Raw read of a coprocessor register (as needed for migration, etc). */
163 if (ri
->type
& ARM_CP_CONST
) {
164 return ri
->resetvalue
;
165 } else if (ri
->raw_readfn
) {
166 return ri
->raw_readfn(env
, ri
);
167 } else if (ri
->readfn
) {
168 return ri
->readfn(env
, ri
);
170 return raw_read(env
, ri
);
174 static void write_raw_cp_reg(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
177 /* Raw write of a coprocessor register (as needed for migration, etc).
178 * Note that constant registers are treated as write-ignored; the
179 * caller should check for success by whether a readback gives the
182 if (ri
->type
& ARM_CP_CONST
) {
184 } else if (ri
->raw_writefn
) {
185 ri
->raw_writefn(env
, ri
, v
);
186 } else if (ri
->writefn
) {
187 ri
->writefn(env
, ri
, v
);
189 raw_write(env
, ri
, v
);
193 static bool raw_accessors_invalid(const ARMCPRegInfo
*ri
)
195 /* Return true if the regdef would cause an assertion if you called
196 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
197 * program bug for it not to have the NO_RAW flag).
198 * NB that returning false here doesn't necessarily mean that calling
199 * read/write_raw_cp_reg() is safe, because we can't distinguish "has
200 * read/write access functions which are safe for raw use" from "has
201 * read/write access functions which have side effects but has forgotten
202 * to provide raw access functions".
203 * The tests here line up with the conditions in read/write_raw_cp_reg()
204 * and assertions in raw_read()/raw_write().
206 if ((ri
->type
& ARM_CP_CONST
) ||
208 ((ri
->raw_writefn
|| ri
->writefn
) && (ri
->raw_readfn
|| ri
->readfn
))) {
214 bool write_cpustate_to_list(ARMCPU
*cpu
)
216 /* Write the coprocessor state from cpu->env to the (index,value) list. */
220 for (i
= 0; i
< cpu
->cpreg_array_len
; i
++) {
221 uint32_t regidx
= kvm_to_cpreg_id(cpu
->cpreg_indexes
[i
]);
222 const ARMCPRegInfo
*ri
;
224 ri
= get_arm_cp_reginfo(cpu
->cp_regs
, regidx
);
229 if (ri
->type
& ARM_CP_NO_RAW
) {
232 cpu
->cpreg_values
[i
] = read_raw_cp_reg(&cpu
->env
, ri
);
237 bool write_list_to_cpustate(ARMCPU
*cpu
)
242 for (i
= 0; i
< cpu
->cpreg_array_len
; i
++) {
243 uint32_t regidx
= kvm_to_cpreg_id(cpu
->cpreg_indexes
[i
]);
244 uint64_t v
= cpu
->cpreg_values
[i
];
245 const ARMCPRegInfo
*ri
;
247 ri
= get_arm_cp_reginfo(cpu
->cp_regs
, regidx
);
252 if (ri
->type
& ARM_CP_NO_RAW
) {
255 /* Write value and confirm it reads back as written
256 * (to catch read-only registers and partially read-only
257 * registers where the incoming migration value doesn't match)
259 write_raw_cp_reg(&cpu
->env
, ri
, v
);
260 if (read_raw_cp_reg(&cpu
->env
, ri
) != v
) {
267 static void add_cpreg_to_list(gpointer key
, gpointer opaque
)
269 ARMCPU
*cpu
= opaque
;
271 const ARMCPRegInfo
*ri
;
273 regidx
= *(uint32_t *)key
;
274 ri
= get_arm_cp_reginfo(cpu
->cp_regs
, regidx
);
276 if (!(ri
->type
& (ARM_CP_NO_RAW
|ARM_CP_ALIAS
))) {
277 cpu
->cpreg_indexes
[cpu
->cpreg_array_len
] = cpreg_to_kvm_id(regidx
);
278 /* The value array need not be initialized at this point */
279 cpu
->cpreg_array_len
++;
283 static void count_cpreg(gpointer key
, gpointer opaque
)
285 ARMCPU
*cpu
= opaque
;
287 const ARMCPRegInfo
*ri
;
289 regidx
= *(uint32_t *)key
;
290 ri
= get_arm_cp_reginfo(cpu
->cp_regs
, regidx
);
292 if (!(ri
->type
& (ARM_CP_NO_RAW
|ARM_CP_ALIAS
))) {
293 cpu
->cpreg_array_len
++;
297 static gint
cpreg_key_compare(gconstpointer a
, gconstpointer b
)
299 uint64_t aidx
= cpreg_to_kvm_id(*(uint32_t *)a
);
300 uint64_t bidx
= cpreg_to_kvm_id(*(uint32_t *)b
);
311 void init_cpreg_list(ARMCPU
*cpu
)
313 /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
314 * Note that we require cpreg_tuples[] to be sorted by key ID.
319 keys
= g_hash_table_get_keys(cpu
->cp_regs
);
320 keys
= g_list_sort(keys
, cpreg_key_compare
);
322 cpu
->cpreg_array_len
= 0;
324 g_list_foreach(keys
, count_cpreg
, cpu
);
326 arraylen
= cpu
->cpreg_array_len
;
327 cpu
->cpreg_indexes
= g_new(uint64_t, arraylen
);
328 cpu
->cpreg_values
= g_new(uint64_t, arraylen
);
329 cpu
->cpreg_vmstate_indexes
= g_new(uint64_t, arraylen
);
330 cpu
->cpreg_vmstate_values
= g_new(uint64_t, arraylen
);
331 cpu
->cpreg_vmstate_array_len
= cpu
->cpreg_array_len
;
332 cpu
->cpreg_array_len
= 0;
334 g_list_foreach(keys
, add_cpreg_to_list
, cpu
);
336 assert(cpu
->cpreg_array_len
== arraylen
);
342 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but
343 * they are accessible when EL3 is using AArch64 regardless of EL3.NS.
345 * access_el3_aa32ns: Used to check AArch32 register views.
346 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views.
348 static CPAccessResult
access_el3_aa32ns(CPUARMState
*env
,
349 const ARMCPRegInfo
*ri
,
352 bool secure
= arm_is_secure_below_el3(env
);
354 assert(!arm_el_is_aa64(env
, 3));
356 return CP_ACCESS_TRAP_UNCATEGORIZED
;
361 static CPAccessResult
access_el3_aa32ns_aa64any(CPUARMState
*env
,
362 const ARMCPRegInfo
*ri
,
365 if (!arm_el_is_aa64(env
, 3)) {
366 return access_el3_aa32ns(env
, ri
, isread
);
371 /* Some secure-only AArch32 registers trap to EL3 if used from
372 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts).
373 * Note that an access from Secure EL1 can only happen if EL3 is AArch64.
374 * We assume that the .access field is set to PL1_RW.
376 static CPAccessResult
access_trap_aa32s_el1(CPUARMState
*env
,
377 const ARMCPRegInfo
*ri
,
380 if (arm_current_el(env
) == 3) {
383 if (arm_is_secure_below_el3(env
)) {
384 return CP_ACCESS_TRAP_EL3
;
386 /* This will be EL1 NS and EL2 NS, which just UNDEF */
387 return CP_ACCESS_TRAP_UNCATEGORIZED
;
390 /* Check for traps to "powerdown debug" registers, which are controlled
393 static CPAccessResult
access_tdosa(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
396 int el
= arm_current_el(env
);
398 if (el
< 2 && (env
->cp15
.mdcr_el2
& MDCR_TDOSA
)
399 && !arm_is_secure_below_el3(env
)) {
400 return CP_ACCESS_TRAP_EL2
;
402 if (el
< 3 && (env
->cp15
.mdcr_el3
& MDCR_TDOSA
)) {
403 return CP_ACCESS_TRAP_EL3
;
408 /* Check for traps to "debug ROM" registers, which are controlled
409 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
411 static CPAccessResult
access_tdra(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
414 int el
= arm_current_el(env
);
416 if (el
< 2 && (env
->cp15
.mdcr_el2
& MDCR_TDRA
)
417 && !arm_is_secure_below_el3(env
)) {
418 return CP_ACCESS_TRAP_EL2
;
420 if (el
< 3 && (env
->cp15
.mdcr_el3
& MDCR_TDA
)) {
421 return CP_ACCESS_TRAP_EL3
;
426 /* Check for traps to general debug registers, which are controlled
427 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
429 static CPAccessResult
access_tda(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
432 int el
= arm_current_el(env
);
434 if (el
< 2 && (env
->cp15
.mdcr_el2
& MDCR_TDA
)
435 && !arm_is_secure_below_el3(env
)) {
436 return CP_ACCESS_TRAP_EL2
;
438 if (el
< 3 && (env
->cp15
.mdcr_el3
& MDCR_TDA
)) {
439 return CP_ACCESS_TRAP_EL3
;
444 /* Check for traps to performance monitor registers, which are controlled
445 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
447 static CPAccessResult
access_tpm(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
450 int el
= arm_current_el(env
);
452 if (el
< 2 && (env
->cp15
.mdcr_el2
& MDCR_TPM
)
453 && !arm_is_secure_below_el3(env
)) {
454 return CP_ACCESS_TRAP_EL2
;
456 if (el
< 3 && (env
->cp15
.mdcr_el3
& MDCR_TPM
)) {
457 return CP_ACCESS_TRAP_EL3
;
462 static void dacr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
, uint64_t value
)
464 ARMCPU
*cpu
= arm_env_get_cpu(env
);
466 raw_write(env
, ri
, value
);
467 tlb_flush(CPU(cpu
), 1); /* Flush TLB as domain not tracked in TLB */
470 static void fcse_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
, uint64_t value
)
472 ARMCPU
*cpu
= arm_env_get_cpu(env
);
474 if (raw_read(env
, ri
) != value
) {
475 /* Unlike real hardware the qemu TLB uses virtual addresses,
476 * not modified virtual addresses, so this causes a TLB flush.
478 tlb_flush(CPU(cpu
), 1);
479 raw_write(env
, ri
, value
);
483 static void contextidr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
486 ARMCPU
*cpu
= arm_env_get_cpu(env
);
488 if (raw_read(env
, ri
) != value
&& !arm_feature(env
, ARM_FEATURE_MPU
)
489 && !extended_addresses_enabled(env
)) {
490 /* For VMSA (when not using the LPAE long descriptor page table
491 * format) this register includes the ASID, so do a TLB flush.
492 * For PMSA it is purely a process ID and no action is needed.
494 tlb_flush(CPU(cpu
), 1);
496 raw_write(env
, ri
, value
);
499 static void tlbiall_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
502 /* Invalidate all (TLBIALL) */
503 ARMCPU
*cpu
= arm_env_get_cpu(env
);
505 tlb_flush(CPU(cpu
), 1);
508 static void tlbimva_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
511 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
512 ARMCPU
*cpu
= arm_env_get_cpu(env
);
514 tlb_flush_page(CPU(cpu
), value
& TARGET_PAGE_MASK
);
517 static void tlbiasid_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
520 /* Invalidate by ASID (TLBIASID) */
521 ARMCPU
*cpu
= arm_env_get_cpu(env
);
523 tlb_flush(CPU(cpu
), value
== 0);
526 static void tlbimvaa_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
529 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
530 ARMCPU
*cpu
= arm_env_get_cpu(env
);
532 tlb_flush_page(CPU(cpu
), value
& TARGET_PAGE_MASK
);
535 /* IS variants of TLB operations must affect all cores */
536 static void tlbiall_is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
541 CPU_FOREACH(other_cs
) {
542 tlb_flush(other_cs
, 1);
546 static void tlbiasid_is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
551 CPU_FOREACH(other_cs
) {
552 tlb_flush(other_cs
, value
== 0);
556 static void tlbimva_is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
561 CPU_FOREACH(other_cs
) {
562 tlb_flush_page(other_cs
, value
& TARGET_PAGE_MASK
);
566 static void tlbimvaa_is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
571 CPU_FOREACH(other_cs
) {
572 tlb_flush_page(other_cs
, value
& TARGET_PAGE_MASK
);
576 static void tlbiall_nsnh_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
579 CPUState
*cs
= ENV_GET_CPU(env
);
581 tlb_flush_by_mmuidx(cs
, ARMMMUIdx_S12NSE1
, ARMMMUIdx_S12NSE0
,
585 static void tlbiall_nsnh_is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
590 CPU_FOREACH(other_cs
) {
591 tlb_flush_by_mmuidx(other_cs
, ARMMMUIdx_S12NSE1
,
592 ARMMMUIdx_S12NSE0
, ARMMMUIdx_S2NS
, -1);
596 static void tlbiipas2_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
599 /* Invalidate by IPA. This has to invalidate any structures that
600 * contain only stage 2 translation information, but does not need
601 * to apply to structures that contain combined stage 1 and stage 2
602 * translation information.
603 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
605 CPUState
*cs
= ENV_GET_CPU(env
);
608 if (!arm_feature(env
, ARM_FEATURE_EL2
) || !(env
->cp15
.scr_el3
& SCR_NS
)) {
612 pageaddr
= sextract64(value
<< 12, 0, 40);
614 tlb_flush_page_by_mmuidx(cs
, pageaddr
, ARMMMUIdx_S2NS
, -1);
617 static void tlbiipas2_is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
623 if (!arm_feature(env
, ARM_FEATURE_EL2
) || !(env
->cp15
.scr_el3
& SCR_NS
)) {
627 pageaddr
= sextract64(value
<< 12, 0, 40);
629 CPU_FOREACH(other_cs
) {
630 tlb_flush_page_by_mmuidx(other_cs
, pageaddr
, ARMMMUIdx_S2NS
, -1);
634 static void tlbiall_hyp_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
637 CPUState
*cs
= ENV_GET_CPU(env
);
639 tlb_flush_by_mmuidx(cs
, ARMMMUIdx_S1E2
, -1);
642 static void tlbiall_hyp_is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
647 CPU_FOREACH(other_cs
) {
648 tlb_flush_by_mmuidx(other_cs
, ARMMMUIdx_S1E2
, -1);
652 static void tlbimva_hyp_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
655 CPUState
*cs
= ENV_GET_CPU(env
);
656 uint64_t pageaddr
= value
& ~MAKE_64BIT_MASK(0, 12);
658 tlb_flush_page_by_mmuidx(cs
, pageaddr
, ARMMMUIdx_S1E2
, -1);
661 static void tlbimva_hyp_is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
665 uint64_t pageaddr
= value
& ~MAKE_64BIT_MASK(0, 12);
667 CPU_FOREACH(other_cs
) {
668 tlb_flush_page_by_mmuidx(other_cs
, pageaddr
, ARMMMUIdx_S1E2
, -1);
672 static const ARMCPRegInfo cp_reginfo
[] = {
673 /* Define the secure and non-secure FCSE identifier CP registers
674 * separately because there is no secure bank in V8 (no _EL3). This allows
675 * the secure register to be properly reset and migrated. There is also no
676 * v8 EL1 version of the register so the non-secure instance stands alone.
678 { .name
= "FCSEIDR(NS)",
679 .cp
= 15, .opc1
= 0, .crn
= 13, .crm
= 0, .opc2
= 0,
680 .access
= PL1_RW
, .secure
= ARM_CP_SECSTATE_NS
,
681 .fieldoffset
= offsetof(CPUARMState
, cp15
.fcseidr_ns
),
682 .resetvalue
= 0, .writefn
= fcse_write
, .raw_writefn
= raw_write
, },
683 { .name
= "FCSEIDR(S)",
684 .cp
= 15, .opc1
= 0, .crn
= 13, .crm
= 0, .opc2
= 0,
685 .access
= PL1_RW
, .secure
= ARM_CP_SECSTATE_S
,
686 .fieldoffset
= offsetof(CPUARMState
, cp15
.fcseidr_s
),
687 .resetvalue
= 0, .writefn
= fcse_write
, .raw_writefn
= raw_write
, },
688 /* Define the secure and non-secure context identifier CP registers
689 * separately because there is no secure bank in V8 (no _EL3). This allows
690 * the secure register to be properly reset and migrated. In the
691 * non-secure case, the 32-bit register will have reset and migration
692 * disabled during registration as it is handled by the 64-bit instance.
694 { .name
= "CONTEXTIDR_EL1", .state
= ARM_CP_STATE_BOTH
,
695 .opc0
= 3, .opc1
= 0, .crn
= 13, .crm
= 0, .opc2
= 1,
696 .access
= PL1_RW
, .secure
= ARM_CP_SECSTATE_NS
,
697 .fieldoffset
= offsetof(CPUARMState
, cp15
.contextidr_el
[1]),
698 .resetvalue
= 0, .writefn
= contextidr_write
, .raw_writefn
= raw_write
, },
699 { .name
= "CONTEXTIDR(S)", .state
= ARM_CP_STATE_AA32
,
700 .cp
= 15, .opc1
= 0, .crn
= 13, .crm
= 0, .opc2
= 1,
701 .access
= PL1_RW
, .secure
= ARM_CP_SECSTATE_S
,
702 .fieldoffset
= offsetof(CPUARMState
, cp15
.contextidr_s
),
703 .resetvalue
= 0, .writefn
= contextidr_write
, .raw_writefn
= raw_write
, },
707 static const ARMCPRegInfo not_v8_cp_reginfo
[] = {
708 /* NB: Some of these registers exist in v8 but with more precise
709 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
711 /* MMU Domain access control / MPU write buffer control */
713 .cp
= 15, .opc1
= CP_ANY
, .crn
= 3, .crm
= CP_ANY
, .opc2
= CP_ANY
,
714 .access
= PL1_RW
, .resetvalue
= 0,
715 .writefn
= dacr_write
, .raw_writefn
= raw_write
,
716 .bank_fieldoffsets
= { offsetoflow32(CPUARMState
, cp15
.dacr_s
),
717 offsetoflow32(CPUARMState
, cp15
.dacr_ns
) } },
718 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs.
719 * For v6 and v5, these mappings are overly broad.
721 { .name
= "TLB_LOCKDOWN", .cp
= 15, .crn
= 10, .crm
= 0,
722 .opc1
= CP_ANY
, .opc2
= CP_ANY
, .access
= PL1_RW
, .type
= ARM_CP_NOP
},
723 { .name
= "TLB_LOCKDOWN", .cp
= 15, .crn
= 10, .crm
= 1,
724 .opc1
= CP_ANY
, .opc2
= CP_ANY
, .access
= PL1_RW
, .type
= ARM_CP_NOP
},
725 { .name
= "TLB_LOCKDOWN", .cp
= 15, .crn
= 10, .crm
= 4,
726 .opc1
= CP_ANY
, .opc2
= CP_ANY
, .access
= PL1_RW
, .type
= ARM_CP_NOP
},
727 { .name
= "TLB_LOCKDOWN", .cp
= 15, .crn
= 10, .crm
= 8,
728 .opc1
= CP_ANY
, .opc2
= CP_ANY
, .access
= PL1_RW
, .type
= ARM_CP_NOP
},
729 /* Cache maintenance ops; some of this space may be overridden later. */
730 { .name
= "CACHEMAINT", .cp
= 15, .crn
= 7, .crm
= CP_ANY
,
731 .opc1
= 0, .opc2
= CP_ANY
, .access
= PL1_W
,
732 .type
= ARM_CP_NOP
| ARM_CP_OVERRIDE
},
736 static const ARMCPRegInfo not_v6_cp_reginfo
[] = {
737 /* Not all pre-v6 cores implemented this WFI, so this is slightly
740 { .name
= "WFI_v5", .cp
= 15, .crn
= 7, .crm
= 8, .opc1
= 0, .opc2
= 2,
741 .access
= PL1_W
, .type
= ARM_CP_WFI
},
745 static const ARMCPRegInfo not_v7_cp_reginfo
[] = {
746 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
747 * is UNPREDICTABLE; we choose to NOP as most implementations do).
749 { .name
= "WFI_v6", .cp
= 15, .crn
= 7, .crm
= 0, .opc1
= 0, .opc2
= 4,
750 .access
= PL1_W
, .type
= ARM_CP_WFI
},
751 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice
752 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
753 * OMAPCP will override this space.
755 { .name
= "DLOCKDOWN", .cp
= 15, .crn
= 9, .crm
= 0, .opc1
= 0, .opc2
= 0,
756 .access
= PL1_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_data
),
758 { .name
= "ILOCKDOWN", .cp
= 15, .crn
= 9, .crm
= 0, .opc1
= 0, .opc2
= 1,
759 .access
= PL1_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_insn
),
761 /* v6 doesn't have the cache ID registers but Linux reads them anyway */
762 { .name
= "DUMMY", .cp
= 15, .crn
= 0, .crm
= 0, .opc1
= 1, .opc2
= CP_ANY
,
763 .access
= PL1_R
, .type
= ARM_CP_CONST
| ARM_CP_NO_RAW
,
765 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
766 * implementing it as RAZ means the "debug architecture version" bits
767 * will read as a reserved value, which should cause Linux to not try
768 * to use the debug hardware.
770 { .name
= "DBGDIDR", .cp
= 14, .crn
= 0, .crm
= 0, .opc1
= 0, .opc2
= 0,
771 .access
= PL0_R
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
772 /* MMU TLB control. Note that the wildcarding means we cover not just
773 * the unified TLB ops but also the dside/iside/inner-shareable variants.
775 { .name
= "TLBIALL", .cp
= 15, .crn
= 8, .crm
= CP_ANY
,
776 .opc1
= CP_ANY
, .opc2
= 0, .access
= PL1_W
, .writefn
= tlbiall_write
,
777 .type
= ARM_CP_NO_RAW
},
778 { .name
= "TLBIMVA", .cp
= 15, .crn
= 8, .crm
= CP_ANY
,
779 .opc1
= CP_ANY
, .opc2
= 1, .access
= PL1_W
, .writefn
= tlbimva_write
,
780 .type
= ARM_CP_NO_RAW
},
781 { .name
= "TLBIASID", .cp
= 15, .crn
= 8, .crm
= CP_ANY
,
782 .opc1
= CP_ANY
, .opc2
= 2, .access
= PL1_W
, .writefn
= tlbiasid_write
,
783 .type
= ARM_CP_NO_RAW
},
784 { .name
= "TLBIMVAA", .cp
= 15, .crn
= 8, .crm
= CP_ANY
,
785 .opc1
= CP_ANY
, .opc2
= 3, .access
= PL1_W
, .writefn
= tlbimvaa_write
,
786 .type
= ARM_CP_NO_RAW
},
787 { .name
= "PRRR", .cp
= 15, .crn
= 10, .crm
= 2,
788 .opc1
= 0, .opc2
= 0, .access
= PL1_RW
, .type
= ARM_CP_NOP
},
789 { .name
= "NMRR", .cp
= 15, .crn
= 10, .crm
= 2,
790 .opc1
= 0, .opc2
= 1, .access
= PL1_RW
, .type
= ARM_CP_NOP
},
794 static void cpacr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
799 /* In ARMv8 most bits of CPACR_EL1 are RES0. */
800 if (!arm_feature(env
, ARM_FEATURE_V8
)) {
801 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
802 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
803 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
805 if (arm_feature(env
, ARM_FEATURE_VFP
)) {
806 /* VFP coprocessor: cp10 & cp11 [23:20] */
807 mask
|= (1 << 31) | (1 << 30) | (0xf << 20);
809 if (!arm_feature(env
, ARM_FEATURE_NEON
)) {
810 /* ASEDIS [31] bit is RAO/WI */
814 /* VFPv3 and upwards with NEON implement 32 double precision
815 * registers (D0-D31).
817 if (!arm_feature(env
, ARM_FEATURE_NEON
) ||
818 !arm_feature(env
, ARM_FEATURE_VFP3
)) {
819 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
825 env
->cp15
.cpacr_el1
= value
;
828 static CPAccessResult
cpacr_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
831 if (arm_feature(env
, ARM_FEATURE_V8
)) {
832 /* Check if CPACR accesses are to be trapped to EL2 */
833 if (arm_current_el(env
) == 1 &&
834 (env
->cp15
.cptr_el
[2] & CPTR_TCPAC
) && !arm_is_secure(env
)) {
835 return CP_ACCESS_TRAP_EL2
;
836 /* Check if CPACR accesses are to be trapped to EL3 */
837 } else if (arm_current_el(env
) < 3 &&
838 (env
->cp15
.cptr_el
[3] & CPTR_TCPAC
)) {
839 return CP_ACCESS_TRAP_EL3
;
846 static CPAccessResult
cptr_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
849 /* Check if CPTR accesses are set to trap to EL3 */
850 if (arm_current_el(env
) == 2 && (env
->cp15
.cptr_el
[3] & CPTR_TCPAC
)) {
851 return CP_ACCESS_TRAP_EL3
;
857 static const ARMCPRegInfo v6_cp_reginfo
[] = {
858 /* prefetch by MVA in v6, NOP in v7 */
859 { .name
= "MVA_prefetch",
860 .cp
= 15, .crn
= 7, .crm
= 13, .opc1
= 0, .opc2
= 1,
861 .access
= PL1_W
, .type
= ARM_CP_NOP
},
862 /* We need to break the TB after ISB to execute self-modifying code
863 * correctly and also to take any pending interrupts immediately.
864 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag.
866 { .name
= "ISB", .cp
= 15, .crn
= 7, .crm
= 5, .opc1
= 0, .opc2
= 4,
867 .access
= PL0_W
, .type
= ARM_CP_NO_RAW
, .writefn
= arm_cp_write_ignore
},
868 { .name
= "DSB", .cp
= 15, .crn
= 7, .crm
= 10, .opc1
= 0, .opc2
= 4,
869 .access
= PL0_W
, .type
= ARM_CP_NOP
},
870 { .name
= "DMB", .cp
= 15, .crn
= 7, .crm
= 10, .opc1
= 0, .opc2
= 5,
871 .access
= PL0_W
, .type
= ARM_CP_NOP
},
872 { .name
= "IFAR", .cp
= 15, .crn
= 6, .crm
= 0, .opc1
= 0, .opc2
= 2,
874 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.ifar_s
),
875 offsetof(CPUARMState
, cp15
.ifar_ns
) },
877 /* Watchpoint Fault Address Register : should actually only be present
878 * for 1136, 1176, 11MPCore.
880 { .name
= "WFAR", .cp
= 15, .crn
= 6, .crm
= 0, .opc1
= 0, .opc2
= 1,
881 .access
= PL1_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0, },
882 { .name
= "CPACR", .state
= ARM_CP_STATE_BOTH
, .opc0
= 3,
883 .crn
= 1, .crm
= 0, .opc1
= 0, .opc2
= 2, .accessfn
= cpacr_access
,
884 .access
= PL1_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.cpacr_el1
),
885 .resetvalue
= 0, .writefn
= cpacr_write
},
889 static CPAccessResult
pmreg_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
892 /* Performance monitor registers user accessibility is controlled
893 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable
894 * trapping to EL2 or EL3 for other accesses.
896 int el
= arm_current_el(env
);
898 if (el
== 0 && !env
->cp15
.c9_pmuserenr
) {
899 return CP_ACCESS_TRAP
;
901 if (el
< 2 && (env
->cp15
.mdcr_el2
& MDCR_TPM
)
902 && !arm_is_secure_below_el3(env
)) {
903 return CP_ACCESS_TRAP_EL2
;
905 if (el
< 3 && (env
->cp15
.mdcr_el3
& MDCR_TPM
)) {
906 return CP_ACCESS_TRAP_EL3
;
912 #ifndef CONFIG_USER_ONLY
914 static inline bool arm_ccnt_enabled(CPUARMState
*env
)
916 /* This does not support checking PMCCFILTR_EL0 register */
918 if (!(env
->cp15
.c9_pmcr
& PMCRE
)) {
925 void pmccntr_sync(CPUARMState
*env
)
929 temp_ticks
= muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
),
930 ARM_CPU_FREQ
, NANOSECONDS_PER_SECOND
);
932 if (env
->cp15
.c9_pmcr
& PMCRD
) {
933 /* Increment once every 64 processor clock cycles */
937 if (arm_ccnt_enabled(env
)) {
938 env
->cp15
.c15_ccnt
= temp_ticks
- env
->cp15
.c15_ccnt
;
942 static void pmcr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
948 /* The counter has been reset */
949 env
->cp15
.c15_ccnt
= 0;
952 /* only the DP, X, D and E bits are writable */
953 env
->cp15
.c9_pmcr
&= ~0x39;
954 env
->cp15
.c9_pmcr
|= (value
& 0x39);
959 static uint64_t pmccntr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
961 uint64_t total_ticks
;
963 if (!arm_ccnt_enabled(env
)) {
964 /* Counter is disabled, do not change value */
965 return env
->cp15
.c15_ccnt
;
968 total_ticks
= muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
),
969 ARM_CPU_FREQ
, NANOSECONDS_PER_SECOND
);
971 if (env
->cp15
.c9_pmcr
& PMCRD
) {
972 /* Increment once every 64 processor clock cycles */
975 return total_ticks
- env
->cp15
.c15_ccnt
;
978 static void pmccntr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
981 uint64_t total_ticks
;
983 if (!arm_ccnt_enabled(env
)) {
984 /* Counter is disabled, set the absolute value */
985 env
->cp15
.c15_ccnt
= value
;
989 total_ticks
= muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
),
990 ARM_CPU_FREQ
, NANOSECONDS_PER_SECOND
);
992 if (env
->cp15
.c9_pmcr
& PMCRD
) {
993 /* Increment once every 64 processor clock cycles */
996 env
->cp15
.c15_ccnt
= total_ticks
- value
;
999 static void pmccntr_write32(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1002 uint64_t cur_val
= pmccntr_read(env
, NULL
);
1004 pmccntr_write(env
, ri
, deposit64(cur_val
, 0, 32, value
));
1007 #else /* CONFIG_USER_ONLY */
1009 void pmccntr_sync(CPUARMState
*env
)
1015 static void pmccfiltr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1019 env
->cp15
.pmccfiltr_el0
= value
& 0x7E000000;
1023 static void pmcntenset_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1027 env
->cp15
.c9_pmcnten
|= value
;
1030 static void pmcntenclr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1034 env
->cp15
.c9_pmcnten
&= ~value
;
1037 static void pmovsr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1040 env
->cp15
.c9_pmovsr
&= ~value
;
1043 static void pmxevtyper_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1046 env
->cp15
.c9_pmxevtyper
= value
& 0xff;
1049 static void pmuserenr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1052 env
->cp15
.c9_pmuserenr
= value
& 1;
1055 static void pmintenset_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1058 /* We have no event counters so only the C bit can be changed */
1060 env
->cp15
.c9_pminten
|= value
;
1063 static void pmintenclr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1067 env
->cp15
.c9_pminten
&= ~value
;
1070 static void vbar_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1073 /* Note that even though the AArch64 view of this register has bits
1074 * [10:0] all RES0 we can only mask the bottom 5, to comply with the
1075 * architectural requirements for bits which are RES0 only in some
1076 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
1077 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
1079 raw_write(env
, ri
, value
& ~0x1FULL
);
1082 static void scr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
, uint64_t value
)
1084 /* We only mask off bits that are RES0 both for AArch64 and AArch32.
1085 * For bits that vary between AArch32/64, code needs to check the
1086 * current execution mode before directly using the feature bit.
1088 uint32_t valid_mask
= SCR_AARCH64_MASK
| SCR_AARCH32_MASK
;
1090 if (!arm_feature(env
, ARM_FEATURE_EL2
)) {
1091 valid_mask
&= ~SCR_HCE
;
1093 /* On ARMv7, SMD (or SCD as it is called in v7) is only
1094 * supported if EL2 exists. The bit is UNK/SBZP when
1095 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero
1096 * when EL2 is unavailable.
1097 * On ARMv8, this bit is always available.
1099 if (arm_feature(env
, ARM_FEATURE_V7
) &&
1100 !arm_feature(env
, ARM_FEATURE_V8
)) {
1101 valid_mask
&= ~SCR_SMD
;
1105 /* Clear all-context RES0 bits. */
1106 value
&= valid_mask
;
1107 raw_write(env
, ri
, value
);
1110 static uint64_t ccsidr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1112 ARMCPU
*cpu
= arm_env_get_cpu(env
);
1114 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR
1117 uint32_t index
= A32_BANKED_REG_GET(env
, csselr
,
1118 ri
->secure
& ARM_CP_SECSTATE_S
);
1120 return cpu
->ccsidr
[index
];
1123 static void csselr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1126 raw_write(env
, ri
, value
& 0xf);
1129 static uint64_t isr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1131 CPUState
*cs
= ENV_GET_CPU(env
);
1134 if (cs
->interrupt_request
& CPU_INTERRUPT_HARD
) {
1137 if (cs
->interrupt_request
& CPU_INTERRUPT_FIQ
) {
1140 /* External aborts are not possible in QEMU so A bit is always clear */
1144 static const ARMCPRegInfo v7_cp_reginfo
[] = {
1145 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
1146 { .name
= "NOP", .cp
= 15, .crn
= 7, .crm
= 0, .opc1
= 0, .opc2
= 4,
1147 .access
= PL1_W
, .type
= ARM_CP_NOP
},
1148 /* Performance monitors are implementation defined in v7,
1149 * but with an ARM recommended set of registers, which we
1150 * follow (although we don't actually implement any counters)
1152 * Performance registers fall into three categories:
1153 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
1154 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
1155 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
1156 * For the cases controlled by PMUSERENR we must set .access to PL0_RW
1157 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
1159 { .name
= "PMCNTENSET", .cp
= 15, .crn
= 9, .crm
= 12, .opc1
= 0, .opc2
= 1,
1160 .access
= PL0_RW
, .type
= ARM_CP_ALIAS
,
1161 .fieldoffset
= offsetoflow32(CPUARMState
, cp15
.c9_pmcnten
),
1162 .writefn
= pmcntenset_write
,
1163 .accessfn
= pmreg_access
,
1164 .raw_writefn
= raw_write
},
1165 { .name
= "PMCNTENSET_EL0", .state
= ARM_CP_STATE_AA64
,
1166 .opc0
= 3, .opc1
= 3, .crn
= 9, .crm
= 12, .opc2
= 1,
1167 .access
= PL0_RW
, .accessfn
= pmreg_access
,
1168 .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_pmcnten
), .resetvalue
= 0,
1169 .writefn
= pmcntenset_write
, .raw_writefn
= raw_write
},
1170 { .name
= "PMCNTENCLR", .cp
= 15, .crn
= 9, .crm
= 12, .opc1
= 0, .opc2
= 2,
1172 .fieldoffset
= offsetoflow32(CPUARMState
, cp15
.c9_pmcnten
),
1173 .accessfn
= pmreg_access
,
1174 .writefn
= pmcntenclr_write
,
1175 .type
= ARM_CP_ALIAS
},
1176 { .name
= "PMCNTENCLR_EL0", .state
= ARM_CP_STATE_AA64
,
1177 .opc0
= 3, .opc1
= 3, .crn
= 9, .crm
= 12, .opc2
= 2,
1178 .access
= PL0_RW
, .accessfn
= pmreg_access
,
1179 .type
= ARM_CP_ALIAS
,
1180 .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_pmcnten
),
1181 .writefn
= pmcntenclr_write
},
1182 { .name
= "PMOVSR", .cp
= 15, .crn
= 9, .crm
= 12, .opc1
= 0, .opc2
= 3,
1183 .access
= PL0_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_pmovsr
),
1184 .accessfn
= pmreg_access
,
1185 .writefn
= pmovsr_write
,
1186 .raw_writefn
= raw_write
},
1187 { .name
= "PMOVSCLR_EL0", .state
= ARM_CP_STATE_AA64
,
1188 .opc0
= 3, .opc1
= 3, .crn
= 9, .crm
= 12, .opc2
= 3,
1189 .access
= PL0_RW
, .accessfn
= pmreg_access
,
1190 .type
= ARM_CP_ALIAS
,
1191 .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_pmovsr
),
1192 .writefn
= pmovsr_write
,
1193 .raw_writefn
= raw_write
},
1194 /* Unimplemented so WI. */
1195 { .name
= "PMSWINC", .cp
= 15, .crn
= 9, .crm
= 12, .opc1
= 0, .opc2
= 4,
1196 .access
= PL0_W
, .accessfn
= pmreg_access
, .type
= ARM_CP_NOP
},
1197 /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.
1198 * We choose to RAZ/WI.
1200 { .name
= "PMSELR", .cp
= 15, .crn
= 9, .crm
= 12, .opc1
= 0, .opc2
= 5,
1201 .access
= PL0_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0,
1202 .accessfn
= pmreg_access
},
1203 #ifndef CONFIG_USER_ONLY
1204 { .name
= "PMCCNTR", .cp
= 15, .crn
= 9, .crm
= 13, .opc1
= 0, .opc2
= 0,
1205 .access
= PL0_RW
, .resetvalue
= 0, .type
= ARM_CP_IO
,
1206 .readfn
= pmccntr_read
, .writefn
= pmccntr_write32
,
1207 .accessfn
= pmreg_access
},
1208 { .name
= "PMCCNTR_EL0", .state
= ARM_CP_STATE_AA64
,
1209 .opc0
= 3, .opc1
= 3, .crn
= 9, .crm
= 13, .opc2
= 0,
1210 .access
= PL0_RW
, .accessfn
= pmreg_access
,
1212 .readfn
= pmccntr_read
, .writefn
= pmccntr_write
, },
1214 { .name
= "PMCCFILTR_EL0", .state
= ARM_CP_STATE_AA64
,
1215 .opc0
= 3, .opc1
= 3, .crn
= 14, .crm
= 15, .opc2
= 7,
1216 .writefn
= pmccfiltr_write
,
1217 .access
= PL0_RW
, .accessfn
= pmreg_access
,
1219 .fieldoffset
= offsetof(CPUARMState
, cp15
.pmccfiltr_el0
),
1221 { .name
= "PMXEVTYPER", .cp
= 15, .crn
= 9, .crm
= 13, .opc1
= 0, .opc2
= 1,
1223 .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_pmxevtyper
),
1224 .accessfn
= pmreg_access
, .writefn
= pmxevtyper_write
,
1225 .raw_writefn
= raw_write
},
1226 /* Unimplemented, RAZ/WI. */
1227 { .name
= "PMXEVCNTR", .cp
= 15, .crn
= 9, .crm
= 13, .opc1
= 0, .opc2
= 2,
1228 .access
= PL0_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0,
1229 .accessfn
= pmreg_access
},
1230 { .name
= "PMUSERENR", .cp
= 15, .crn
= 9, .crm
= 14, .opc1
= 0, .opc2
= 0,
1231 .access
= PL0_R
| PL1_RW
, .accessfn
= access_tpm
,
1232 .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_pmuserenr
),
1234 .writefn
= pmuserenr_write
, .raw_writefn
= raw_write
},
1235 { .name
= "PMUSERENR_EL0", .state
= ARM_CP_STATE_AA64
,
1236 .opc0
= 3, .opc1
= 3, .crn
= 9, .crm
= 14, .opc2
= 0,
1237 .access
= PL0_R
| PL1_RW
, .accessfn
= access_tpm
, .type
= ARM_CP_ALIAS
,
1238 .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_pmuserenr
),
1240 .writefn
= pmuserenr_write
, .raw_writefn
= raw_write
},
1241 { .name
= "PMINTENSET", .cp
= 15, .crn
= 9, .crm
= 14, .opc1
= 0, .opc2
= 1,
1242 .access
= PL1_RW
, .accessfn
= access_tpm
,
1243 .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_pminten
),
1245 .writefn
= pmintenset_write
, .raw_writefn
= raw_write
},
1246 { .name
= "PMINTENCLR", .cp
= 15, .crn
= 9, .crm
= 14, .opc1
= 0, .opc2
= 2,
1247 .access
= PL1_RW
, .accessfn
= access_tpm
, .type
= ARM_CP_ALIAS
,
1248 .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_pminten
),
1249 .writefn
= pmintenclr_write
, },
1250 { .name
= "PMINTENCLR_EL1", .state
= ARM_CP_STATE_AA64
,
1251 .opc0
= 3, .opc1
= 0, .crn
= 9, .crm
= 14, .opc2
= 2,
1252 .access
= PL1_RW
, .accessfn
= access_tpm
, .type
= ARM_CP_ALIAS
,
1253 .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_pminten
),
1254 .writefn
= pmintenclr_write
},
1255 { .name
= "CCSIDR", .state
= ARM_CP_STATE_BOTH
,
1256 .opc0
= 3, .crn
= 0, .crm
= 0, .opc1
= 1, .opc2
= 0,
1257 .access
= PL1_R
, .readfn
= ccsidr_read
, .type
= ARM_CP_NO_RAW
},
1258 { .name
= "CSSELR", .state
= ARM_CP_STATE_BOTH
,
1259 .opc0
= 3, .crn
= 0, .crm
= 0, .opc1
= 2, .opc2
= 0,
1260 .access
= PL1_RW
, .writefn
= csselr_write
, .resetvalue
= 0,
1261 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.csselr_s
),
1262 offsetof(CPUARMState
, cp15
.csselr_ns
) } },
1263 /* Auxiliary ID register: this actually has an IMPDEF value but for now
1264 * just RAZ for all cores:
1266 { .name
= "AIDR", .state
= ARM_CP_STATE_BOTH
,
1267 .opc0
= 3, .opc1
= 1, .crn
= 0, .crm
= 0, .opc2
= 7,
1268 .access
= PL1_R
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
1269 /* Auxiliary fault status registers: these also are IMPDEF, and we
1270 * choose to RAZ/WI for all cores.
1272 { .name
= "AFSR0_EL1", .state
= ARM_CP_STATE_BOTH
,
1273 .opc0
= 3, .opc1
= 0, .crn
= 5, .crm
= 1, .opc2
= 0,
1274 .access
= PL1_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
1275 { .name
= "AFSR1_EL1", .state
= ARM_CP_STATE_BOTH
,
1276 .opc0
= 3, .opc1
= 0, .crn
= 5, .crm
= 1, .opc2
= 1,
1277 .access
= PL1_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
1278 /* MAIR can just read-as-written because we don't implement caches
1279 * and so don't need to care about memory attributes.
1281 { .name
= "MAIR_EL1", .state
= ARM_CP_STATE_AA64
,
1282 .opc0
= 3, .opc1
= 0, .crn
= 10, .crm
= 2, .opc2
= 0,
1283 .access
= PL1_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.mair_el
[1]),
1285 { .name
= "MAIR_EL3", .state
= ARM_CP_STATE_AA64
,
1286 .opc0
= 3, .opc1
= 6, .crn
= 10, .crm
= 2, .opc2
= 0,
1287 .access
= PL3_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.mair_el
[3]),
1289 /* For non-long-descriptor page tables these are PRRR and NMRR;
1290 * regardless they still act as reads-as-written for QEMU.
1292 /* MAIR0/1 are defined separately from their 64-bit counterpart which
1293 * allows them to assign the correct fieldoffset based on the endianness
1294 * handled in the field definitions.
1296 { .name
= "MAIR0", .state
= ARM_CP_STATE_AA32
,
1297 .cp
= 15, .opc1
= 0, .crn
= 10, .crm
= 2, .opc2
= 0, .access
= PL1_RW
,
1298 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.mair0_s
),
1299 offsetof(CPUARMState
, cp15
.mair0_ns
) },
1300 .resetfn
= arm_cp_reset_ignore
},
1301 { .name
= "MAIR1", .state
= ARM_CP_STATE_AA32
,
1302 .cp
= 15, .opc1
= 0, .crn
= 10, .crm
= 2, .opc2
= 1, .access
= PL1_RW
,
1303 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.mair1_s
),
1304 offsetof(CPUARMState
, cp15
.mair1_ns
) },
1305 .resetfn
= arm_cp_reset_ignore
},
1306 { .name
= "ISR_EL1", .state
= ARM_CP_STATE_BOTH
,
1307 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 1, .opc2
= 0,
1308 .type
= ARM_CP_NO_RAW
, .access
= PL1_R
, .readfn
= isr_read
},
1309 /* 32 bit ITLB invalidates */
1310 { .name
= "ITLBIALL", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 5, .opc2
= 0,
1311 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbiall_write
},
1312 { .name
= "ITLBIMVA", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 5, .opc2
= 1,
1313 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbimva_write
},
1314 { .name
= "ITLBIASID", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 5, .opc2
= 2,
1315 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbiasid_write
},
1316 /* 32 bit DTLB invalidates */
1317 { .name
= "DTLBIALL", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 6, .opc2
= 0,
1318 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbiall_write
},
1319 { .name
= "DTLBIMVA", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 6, .opc2
= 1,
1320 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbimva_write
},
1321 { .name
= "DTLBIASID", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 6, .opc2
= 2,
1322 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbiasid_write
},
1323 /* 32 bit TLB invalidates */
1324 { .name
= "TLBIALL", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 0,
1325 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbiall_write
},
1326 { .name
= "TLBIMVA", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 1,
1327 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbimva_write
},
1328 { .name
= "TLBIASID", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 2,
1329 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbiasid_write
},
1330 { .name
= "TLBIMVAA", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 3,
1331 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbimvaa_write
},
1335 static const ARMCPRegInfo v7mp_cp_reginfo
[] = {
1336 /* 32 bit TLB invalidates, Inner Shareable */
1337 { .name
= "TLBIALLIS", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 0,
1338 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbiall_is_write
},
1339 { .name
= "TLBIMVAIS", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 1,
1340 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbimva_is_write
},
1341 { .name
= "TLBIASIDIS", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 2,
1342 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
,
1343 .writefn
= tlbiasid_is_write
},
1344 { .name
= "TLBIMVAAIS", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 3,
1345 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
,
1346 .writefn
= tlbimvaa_is_write
},
1350 static void teecr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1357 static CPAccessResult
teehbr_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1360 if (arm_current_el(env
) == 0 && (env
->teecr
& 1)) {
1361 return CP_ACCESS_TRAP
;
1363 return CP_ACCESS_OK
;
1366 static const ARMCPRegInfo t2ee_cp_reginfo
[] = {
1367 { .name
= "TEECR", .cp
= 14, .crn
= 0, .crm
= 0, .opc1
= 6, .opc2
= 0,
1368 .access
= PL1_RW
, .fieldoffset
= offsetof(CPUARMState
, teecr
),
1370 .writefn
= teecr_write
},
1371 { .name
= "TEEHBR", .cp
= 14, .crn
= 1, .crm
= 0, .opc1
= 6, .opc2
= 0,
1372 .access
= PL0_RW
, .fieldoffset
= offsetof(CPUARMState
, teehbr
),
1373 .accessfn
= teehbr_access
, .resetvalue
= 0 },
1377 static const ARMCPRegInfo v6k_cp_reginfo
[] = {
1378 { .name
= "TPIDR_EL0", .state
= ARM_CP_STATE_AA64
,
1379 .opc0
= 3, .opc1
= 3, .opc2
= 2, .crn
= 13, .crm
= 0,
1381 .fieldoffset
= offsetof(CPUARMState
, cp15
.tpidr_el
[0]), .resetvalue
= 0 },
1382 { .name
= "TPIDRURW", .cp
= 15, .crn
= 13, .crm
= 0, .opc1
= 0, .opc2
= 2,
1384 .bank_fieldoffsets
= { offsetoflow32(CPUARMState
, cp15
.tpidrurw_s
),
1385 offsetoflow32(CPUARMState
, cp15
.tpidrurw_ns
) },
1386 .resetfn
= arm_cp_reset_ignore
},
1387 { .name
= "TPIDRRO_EL0", .state
= ARM_CP_STATE_AA64
,
1388 .opc0
= 3, .opc1
= 3, .opc2
= 3, .crn
= 13, .crm
= 0,
1389 .access
= PL0_R
|PL1_W
,
1390 .fieldoffset
= offsetof(CPUARMState
, cp15
.tpidrro_el
[0]),
1392 { .name
= "TPIDRURO", .cp
= 15, .crn
= 13, .crm
= 0, .opc1
= 0, .opc2
= 3,
1393 .access
= PL0_R
|PL1_W
,
1394 .bank_fieldoffsets
= { offsetoflow32(CPUARMState
, cp15
.tpidruro_s
),
1395 offsetoflow32(CPUARMState
, cp15
.tpidruro_ns
) },
1396 .resetfn
= arm_cp_reset_ignore
},
1397 { .name
= "TPIDR_EL1", .state
= ARM_CP_STATE_AA64
,
1398 .opc0
= 3, .opc1
= 0, .opc2
= 4, .crn
= 13, .crm
= 0,
1400 .fieldoffset
= offsetof(CPUARMState
, cp15
.tpidr_el
[1]), .resetvalue
= 0 },
1401 { .name
= "TPIDRPRW", .opc1
= 0, .cp
= 15, .crn
= 13, .crm
= 0, .opc2
= 4,
1403 .bank_fieldoffsets
= { offsetoflow32(CPUARMState
, cp15
.tpidrprw_s
),
1404 offsetoflow32(CPUARMState
, cp15
.tpidrprw_ns
) },
1409 #ifndef CONFIG_USER_ONLY
1411 static CPAccessResult
gt_cntfrq_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1414 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero.
1415 * Writable only at the highest implemented exception level.
1417 int el
= arm_current_el(env
);
1421 if (!extract32(env
->cp15
.c14_cntkctl
, 0, 2)) {
1422 return CP_ACCESS_TRAP
;
1426 if (!isread
&& ri
->state
== ARM_CP_STATE_AA32
&&
1427 arm_is_secure_below_el3(env
)) {
1428 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */
1429 return CP_ACCESS_TRAP_UNCATEGORIZED
;
1437 if (!isread
&& el
< arm_highest_el(env
)) {
1438 return CP_ACCESS_TRAP_UNCATEGORIZED
;
1441 return CP_ACCESS_OK
;
1444 static CPAccessResult
gt_counter_access(CPUARMState
*env
, int timeridx
,
1447 unsigned int cur_el
= arm_current_el(env
);
1448 bool secure
= arm_is_secure(env
);
1450 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */
1452 !extract32(env
->cp15
.c14_cntkctl
, timeridx
, 1)) {
1453 return CP_ACCESS_TRAP
;
1456 if (arm_feature(env
, ARM_FEATURE_EL2
) &&
1457 timeridx
== GTIMER_PHYS
&& !secure
&& cur_el
< 2 &&
1458 !extract32(env
->cp15
.cnthctl_el2
, 0, 1)) {
1459 return CP_ACCESS_TRAP_EL2
;
1461 return CP_ACCESS_OK
;
1464 static CPAccessResult
gt_timer_access(CPUARMState
*env
, int timeridx
,
1467 unsigned int cur_el
= arm_current_el(env
);
1468 bool secure
= arm_is_secure(env
);
1470 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if
1471 * EL0[PV]TEN is zero.
1474 !extract32(env
->cp15
.c14_cntkctl
, 9 - timeridx
, 1)) {
1475 return CP_ACCESS_TRAP
;
1478 if (arm_feature(env
, ARM_FEATURE_EL2
) &&
1479 timeridx
== GTIMER_PHYS
&& !secure
&& cur_el
< 2 &&
1480 !extract32(env
->cp15
.cnthctl_el2
, 1, 1)) {
1481 return CP_ACCESS_TRAP_EL2
;
1483 return CP_ACCESS_OK
;
1486 static CPAccessResult
gt_pct_access(CPUARMState
*env
,
1487 const ARMCPRegInfo
*ri
,
1490 return gt_counter_access(env
, GTIMER_PHYS
, isread
);
1493 static CPAccessResult
gt_vct_access(CPUARMState
*env
,
1494 const ARMCPRegInfo
*ri
,
1497 return gt_counter_access(env
, GTIMER_VIRT
, isread
);
1500 static CPAccessResult
gt_ptimer_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1503 return gt_timer_access(env
, GTIMER_PHYS
, isread
);
1506 static CPAccessResult
gt_vtimer_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1509 return gt_timer_access(env
, GTIMER_VIRT
, isread
);
1512 static CPAccessResult
gt_stimer_access(CPUARMState
*env
,
1513 const ARMCPRegInfo
*ri
,
1516 /* The AArch64 register view of the secure physical timer is
1517 * always accessible from EL3, and configurably accessible from
1520 switch (arm_current_el(env
)) {
1522 if (!arm_is_secure(env
)) {
1523 return CP_ACCESS_TRAP
;
1525 if (!(env
->cp15
.scr_el3
& SCR_ST
)) {
1526 return CP_ACCESS_TRAP_EL3
;
1528 return CP_ACCESS_OK
;
1531 return CP_ACCESS_TRAP
;
1533 return CP_ACCESS_OK
;
1535 g_assert_not_reached();
1539 static uint64_t gt_get_countervalue(CPUARMState
*env
)
1541 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) / GTIMER_SCALE
;
1544 static void gt_recalc_timer(ARMCPU
*cpu
, int timeridx
)
1546 ARMGenericTimer
*gt
= &cpu
->env
.cp15
.c14_timer
[timeridx
];
1549 /* Timer enabled: calculate and set current ISTATUS, irq, and
1550 * reset timer to when ISTATUS next has to change
1552 uint64_t offset
= timeridx
== GTIMER_VIRT
?
1553 cpu
->env
.cp15
.cntvoff_el2
: 0;
1554 uint64_t count
= gt_get_countervalue(&cpu
->env
);
1555 /* Note that this must be unsigned 64 bit arithmetic: */
1556 int istatus
= count
- offset
>= gt
->cval
;
1560 gt
->ctl
= deposit32(gt
->ctl
, 2, 1, istatus
);
1562 irqstate
= (istatus
&& !(gt
->ctl
& 2));
1563 qemu_set_irq(cpu
->gt_timer_outputs
[timeridx
], irqstate
);
1566 /* Next transition is when count rolls back over to zero */
1567 nexttick
= UINT64_MAX
;
1569 /* Next transition is when we hit cval */
1570 nexttick
= gt
->cval
+ offset
;
1572 /* Note that the desired next expiry time might be beyond the
1573 * signed-64-bit range of a QEMUTimer -- in this case we just
1574 * set the timer for as far in the future as possible. When the
1575 * timer expires we will reset the timer for any remaining period.
1577 if (nexttick
> INT64_MAX
/ GTIMER_SCALE
) {
1578 nexttick
= INT64_MAX
/ GTIMER_SCALE
;
1580 timer_mod(cpu
->gt_timer
[timeridx
], nexttick
);
1581 trace_arm_gt_recalc(timeridx
, irqstate
, nexttick
);
1583 /* Timer disabled: ISTATUS and timer output always clear */
1585 qemu_set_irq(cpu
->gt_timer_outputs
[timeridx
], 0);
1586 timer_del(cpu
->gt_timer
[timeridx
]);
1587 trace_arm_gt_recalc_disabled(timeridx
);
1591 static void gt_timer_reset(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1594 ARMCPU
*cpu
= arm_env_get_cpu(env
);
1596 timer_del(cpu
->gt_timer
[timeridx
]);
1599 static uint64_t gt_cnt_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1601 return gt_get_countervalue(env
);
1604 static uint64_t gt_virt_cnt_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1606 return gt_get_countervalue(env
) - env
->cp15
.cntvoff_el2
;
1609 static void gt_cval_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1613 trace_arm_gt_cval_write(timeridx
, value
);
1614 env
->cp15
.c14_timer
[timeridx
].cval
= value
;
1615 gt_recalc_timer(arm_env_get_cpu(env
), timeridx
);
1618 static uint64_t gt_tval_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1621 uint64_t offset
= timeridx
== GTIMER_VIRT
? env
->cp15
.cntvoff_el2
: 0;
1623 return (uint32_t)(env
->cp15
.c14_timer
[timeridx
].cval
-
1624 (gt_get_countervalue(env
) - offset
));
1627 static void gt_tval_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1631 uint64_t offset
= timeridx
== GTIMER_VIRT
? env
->cp15
.cntvoff_el2
: 0;
1633 trace_arm_gt_tval_write(timeridx
, value
);
1634 env
->cp15
.c14_timer
[timeridx
].cval
= gt_get_countervalue(env
) - offset
+
1635 sextract64(value
, 0, 32);
1636 gt_recalc_timer(arm_env_get_cpu(env
), timeridx
);
1639 static void gt_ctl_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1643 ARMCPU
*cpu
= arm_env_get_cpu(env
);
1644 uint32_t oldval
= env
->cp15
.c14_timer
[timeridx
].ctl
;
1646 trace_arm_gt_ctl_write(timeridx
, value
);
1647 env
->cp15
.c14_timer
[timeridx
].ctl
= deposit64(oldval
, 0, 2, value
);
1648 if ((oldval
^ value
) & 1) {
1649 /* Enable toggled */
1650 gt_recalc_timer(cpu
, timeridx
);
1651 } else if ((oldval
^ value
) & 2) {
1652 /* IMASK toggled: don't need to recalculate,
1653 * just set the interrupt line based on ISTATUS
1655 int irqstate
= (oldval
& 4) && !(value
& 2);
1657 trace_arm_gt_imask_toggle(timeridx
, irqstate
);
1658 qemu_set_irq(cpu
->gt_timer_outputs
[timeridx
], irqstate
);
1662 static void gt_phys_timer_reset(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1664 gt_timer_reset(env
, ri
, GTIMER_PHYS
);
1667 static void gt_phys_cval_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1670 gt_cval_write(env
, ri
, GTIMER_PHYS
, value
);
1673 static uint64_t gt_phys_tval_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1675 return gt_tval_read(env
, ri
, GTIMER_PHYS
);
1678 static void gt_phys_tval_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1681 gt_tval_write(env
, ri
, GTIMER_PHYS
, value
);
1684 static void gt_phys_ctl_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1687 gt_ctl_write(env
, ri
, GTIMER_PHYS
, value
);
1690 static void gt_virt_timer_reset(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1692 gt_timer_reset(env
, ri
, GTIMER_VIRT
);
1695 static void gt_virt_cval_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1698 gt_cval_write(env
, ri
, GTIMER_VIRT
, value
);
1701 static uint64_t gt_virt_tval_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1703 return gt_tval_read(env
, ri
, GTIMER_VIRT
);
1706 static void gt_virt_tval_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1709 gt_tval_write(env
, ri
, GTIMER_VIRT
, value
);
1712 static void gt_virt_ctl_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1715 gt_ctl_write(env
, ri
, GTIMER_VIRT
, value
);
1718 static void gt_cntvoff_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1721 ARMCPU
*cpu
= arm_env_get_cpu(env
);
1723 trace_arm_gt_cntvoff_write(value
);
1724 raw_write(env
, ri
, value
);
1725 gt_recalc_timer(cpu
, GTIMER_VIRT
);
1728 static void gt_hyp_timer_reset(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1730 gt_timer_reset(env
, ri
, GTIMER_HYP
);
1733 static void gt_hyp_cval_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1736 gt_cval_write(env
, ri
, GTIMER_HYP
, value
);
1739 static uint64_t gt_hyp_tval_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1741 return gt_tval_read(env
, ri
, GTIMER_HYP
);
1744 static void gt_hyp_tval_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1747 gt_tval_write(env
, ri
, GTIMER_HYP
, value
);
1750 static void gt_hyp_ctl_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1753 gt_ctl_write(env
, ri
, GTIMER_HYP
, value
);
1756 static void gt_sec_timer_reset(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1758 gt_timer_reset(env
, ri
, GTIMER_SEC
);
1761 static void gt_sec_cval_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1764 gt_cval_write(env
, ri
, GTIMER_SEC
, value
);
1767 static uint64_t gt_sec_tval_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
1769 return gt_tval_read(env
, ri
, GTIMER_SEC
);
1772 static void gt_sec_tval_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1775 gt_tval_write(env
, ri
, GTIMER_SEC
, value
);
1778 static void gt_sec_ctl_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
1781 gt_ctl_write(env
, ri
, GTIMER_SEC
, value
);
1784 void arm_gt_ptimer_cb(void *opaque
)
1786 ARMCPU
*cpu
= opaque
;
1788 gt_recalc_timer(cpu
, GTIMER_PHYS
);
1791 void arm_gt_vtimer_cb(void *opaque
)
1793 ARMCPU
*cpu
= opaque
;
1795 gt_recalc_timer(cpu
, GTIMER_VIRT
);
1798 void arm_gt_htimer_cb(void *opaque
)
1800 ARMCPU
*cpu
= opaque
;
1802 gt_recalc_timer(cpu
, GTIMER_HYP
);
1805 void arm_gt_stimer_cb(void *opaque
)
1807 ARMCPU
*cpu
= opaque
;
1809 gt_recalc_timer(cpu
, GTIMER_SEC
);
1812 static const ARMCPRegInfo generic_timer_cp_reginfo
[] = {
1813 /* Note that CNTFRQ is purely reads-as-written for the benefit
1814 * of software; writing it doesn't actually change the timer frequency.
1815 * Our reset value matches the fixed frequency we implement the timer at.
1817 { .name
= "CNTFRQ", .cp
= 15, .crn
= 14, .crm
= 0, .opc1
= 0, .opc2
= 0,
1818 .type
= ARM_CP_ALIAS
,
1819 .access
= PL1_RW
| PL0_R
, .accessfn
= gt_cntfrq_access
,
1820 .fieldoffset
= offsetoflow32(CPUARMState
, cp15
.c14_cntfrq
),
1822 { .name
= "CNTFRQ_EL0", .state
= ARM_CP_STATE_AA64
,
1823 .opc0
= 3, .opc1
= 3, .crn
= 14, .crm
= 0, .opc2
= 0,
1824 .access
= PL1_RW
| PL0_R
, .accessfn
= gt_cntfrq_access
,
1825 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_cntfrq
),
1826 .resetvalue
= (1000 * 1000 * 1000) / GTIMER_SCALE
,
1828 /* overall control: mostly access permissions */
1829 { .name
= "CNTKCTL", .state
= ARM_CP_STATE_BOTH
,
1830 .opc0
= 3, .opc1
= 0, .crn
= 14, .crm
= 1, .opc2
= 0,
1832 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_cntkctl
),
1835 /* per-timer control */
1836 { .name
= "CNTP_CTL", .cp
= 15, .crn
= 14, .crm
= 2, .opc1
= 0, .opc2
= 1,
1837 .secure
= ARM_CP_SECSTATE_NS
,
1838 .type
= ARM_CP_IO
| ARM_CP_ALIAS
, .access
= PL1_RW
| PL0_R
,
1839 .accessfn
= gt_ptimer_access
,
1840 .fieldoffset
= offsetoflow32(CPUARMState
,
1841 cp15
.c14_timer
[GTIMER_PHYS
].ctl
),
1842 .writefn
= gt_phys_ctl_write
, .raw_writefn
= raw_write
,
1844 { .name
= "CNTP_CTL(S)",
1845 .cp
= 15, .crn
= 14, .crm
= 2, .opc1
= 0, .opc2
= 1,
1846 .secure
= ARM_CP_SECSTATE_S
,
1847 .type
= ARM_CP_IO
| ARM_CP_ALIAS
, .access
= PL1_RW
| PL0_R
,
1848 .accessfn
= gt_ptimer_access
,
1849 .fieldoffset
= offsetoflow32(CPUARMState
,
1850 cp15
.c14_timer
[GTIMER_SEC
].ctl
),
1851 .writefn
= gt_sec_ctl_write
, .raw_writefn
= raw_write
,
1853 { .name
= "CNTP_CTL_EL0", .state
= ARM_CP_STATE_AA64
,
1854 .opc0
= 3, .opc1
= 3, .crn
= 14, .crm
= 2, .opc2
= 1,
1855 .type
= ARM_CP_IO
, .access
= PL1_RW
| PL0_R
,
1856 .accessfn
= gt_ptimer_access
,
1857 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_PHYS
].ctl
),
1859 .writefn
= gt_phys_ctl_write
, .raw_writefn
= raw_write
,
1861 { .name
= "CNTV_CTL", .cp
= 15, .crn
= 14, .crm
= 3, .opc1
= 0, .opc2
= 1,
1862 .type
= ARM_CP_IO
| ARM_CP_ALIAS
, .access
= PL1_RW
| PL0_R
,
1863 .accessfn
= gt_vtimer_access
,
1864 .fieldoffset
= offsetoflow32(CPUARMState
,
1865 cp15
.c14_timer
[GTIMER_VIRT
].ctl
),
1866 .writefn
= gt_virt_ctl_write
, .raw_writefn
= raw_write
,
1868 { .name
= "CNTV_CTL_EL0", .state
= ARM_CP_STATE_AA64
,
1869 .opc0
= 3, .opc1
= 3, .crn
= 14, .crm
= 3, .opc2
= 1,
1870 .type
= ARM_CP_IO
, .access
= PL1_RW
| PL0_R
,
1871 .accessfn
= gt_vtimer_access
,
1872 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_VIRT
].ctl
),
1874 .writefn
= gt_virt_ctl_write
, .raw_writefn
= raw_write
,
1876 /* TimerValue views: a 32 bit downcounting view of the underlying state */
1877 { .name
= "CNTP_TVAL", .cp
= 15, .crn
= 14, .crm
= 2, .opc1
= 0, .opc2
= 0,
1878 .secure
= ARM_CP_SECSTATE_NS
,
1879 .type
= ARM_CP_NO_RAW
| ARM_CP_IO
, .access
= PL1_RW
| PL0_R
,
1880 .accessfn
= gt_ptimer_access
,
1881 .readfn
= gt_phys_tval_read
, .writefn
= gt_phys_tval_write
,
1883 { .name
= "CNTP_TVAL(S)",
1884 .cp
= 15, .crn
= 14, .crm
= 2, .opc1
= 0, .opc2
= 0,
1885 .secure
= ARM_CP_SECSTATE_S
,
1886 .type
= ARM_CP_NO_RAW
| ARM_CP_IO
, .access
= PL1_RW
| PL0_R
,
1887 .accessfn
= gt_ptimer_access
,
1888 .readfn
= gt_sec_tval_read
, .writefn
= gt_sec_tval_write
,
1890 { .name
= "CNTP_TVAL_EL0", .state
= ARM_CP_STATE_AA64
,
1891 .opc0
= 3, .opc1
= 3, .crn
= 14, .crm
= 2, .opc2
= 0,
1892 .type
= ARM_CP_NO_RAW
| ARM_CP_IO
, .access
= PL1_RW
| PL0_R
,
1893 .accessfn
= gt_ptimer_access
, .resetfn
= gt_phys_timer_reset
,
1894 .readfn
= gt_phys_tval_read
, .writefn
= gt_phys_tval_write
,
1896 { .name
= "CNTV_TVAL", .cp
= 15, .crn
= 14, .crm
= 3, .opc1
= 0, .opc2
= 0,
1897 .type
= ARM_CP_NO_RAW
| ARM_CP_IO
, .access
= PL1_RW
| PL0_R
,
1898 .accessfn
= gt_vtimer_access
,
1899 .readfn
= gt_virt_tval_read
, .writefn
= gt_virt_tval_write
,
1901 { .name
= "CNTV_TVAL_EL0", .state
= ARM_CP_STATE_AA64
,
1902 .opc0
= 3, .opc1
= 3, .crn
= 14, .crm
= 3, .opc2
= 0,
1903 .type
= ARM_CP_NO_RAW
| ARM_CP_IO
, .access
= PL1_RW
| PL0_R
,
1904 .accessfn
= gt_vtimer_access
, .resetfn
= gt_virt_timer_reset
,
1905 .readfn
= gt_virt_tval_read
, .writefn
= gt_virt_tval_write
,
1907 /* The counter itself */
1908 { .name
= "CNTPCT", .cp
= 15, .crm
= 14, .opc1
= 0,
1909 .access
= PL0_R
, .type
= ARM_CP_64BIT
| ARM_CP_NO_RAW
| ARM_CP_IO
,
1910 .accessfn
= gt_pct_access
,
1911 .readfn
= gt_cnt_read
, .resetfn
= arm_cp_reset_ignore
,
1913 { .name
= "CNTPCT_EL0", .state
= ARM_CP_STATE_AA64
,
1914 .opc0
= 3, .opc1
= 3, .crn
= 14, .crm
= 0, .opc2
= 1,
1915 .access
= PL0_R
, .type
= ARM_CP_NO_RAW
| ARM_CP_IO
,
1916 .accessfn
= gt_pct_access
, .readfn
= gt_cnt_read
,
1918 { .name
= "CNTVCT", .cp
= 15, .crm
= 14, .opc1
= 1,
1919 .access
= PL0_R
, .type
= ARM_CP_64BIT
| ARM_CP_NO_RAW
| ARM_CP_IO
,
1920 .accessfn
= gt_vct_access
,
1921 .readfn
= gt_virt_cnt_read
, .resetfn
= arm_cp_reset_ignore
,
1923 { .name
= "CNTVCT_EL0", .state
= ARM_CP_STATE_AA64
,
1924 .opc0
= 3, .opc1
= 3, .crn
= 14, .crm
= 0, .opc2
= 2,
1925 .access
= PL0_R
, .type
= ARM_CP_NO_RAW
| ARM_CP_IO
,
1926 .accessfn
= gt_vct_access
, .readfn
= gt_virt_cnt_read
,
1928 /* Comparison value, indicating when the timer goes off */
1929 { .name
= "CNTP_CVAL", .cp
= 15, .crm
= 14, .opc1
= 2,
1930 .secure
= ARM_CP_SECSTATE_NS
,
1931 .access
= PL1_RW
| PL0_R
,
1932 .type
= ARM_CP_64BIT
| ARM_CP_IO
| ARM_CP_ALIAS
,
1933 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_PHYS
].cval
),
1934 .accessfn
= gt_ptimer_access
,
1935 .writefn
= gt_phys_cval_write
, .raw_writefn
= raw_write
,
1937 { .name
= "CNTP_CVAL(S)", .cp
= 15, .crm
= 14, .opc1
= 2,
1938 .secure
= ARM_CP_SECSTATE_S
,
1939 .access
= PL1_RW
| PL0_R
,
1940 .type
= ARM_CP_64BIT
| ARM_CP_IO
| ARM_CP_ALIAS
,
1941 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_SEC
].cval
),
1942 .accessfn
= gt_ptimer_access
,
1943 .writefn
= gt_sec_cval_write
, .raw_writefn
= raw_write
,
1945 { .name
= "CNTP_CVAL_EL0", .state
= ARM_CP_STATE_AA64
,
1946 .opc0
= 3, .opc1
= 3, .crn
= 14, .crm
= 2, .opc2
= 2,
1947 .access
= PL1_RW
| PL0_R
,
1949 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_PHYS
].cval
),
1950 .resetvalue
= 0, .accessfn
= gt_ptimer_access
,
1951 .writefn
= gt_phys_cval_write
, .raw_writefn
= raw_write
,
1953 { .name
= "CNTV_CVAL", .cp
= 15, .crm
= 14, .opc1
= 3,
1954 .access
= PL1_RW
| PL0_R
,
1955 .type
= ARM_CP_64BIT
| ARM_CP_IO
| ARM_CP_ALIAS
,
1956 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_VIRT
].cval
),
1957 .accessfn
= gt_vtimer_access
,
1958 .writefn
= gt_virt_cval_write
, .raw_writefn
= raw_write
,
1960 { .name
= "CNTV_CVAL_EL0", .state
= ARM_CP_STATE_AA64
,
1961 .opc0
= 3, .opc1
= 3, .crn
= 14, .crm
= 3, .opc2
= 2,
1962 .access
= PL1_RW
| PL0_R
,
1964 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_VIRT
].cval
),
1965 .resetvalue
= 0, .accessfn
= gt_vtimer_access
,
1966 .writefn
= gt_virt_cval_write
, .raw_writefn
= raw_write
,
1968 /* Secure timer -- this is actually restricted to only EL3
1969 * and configurably Secure-EL1 via the accessfn.
1971 { .name
= "CNTPS_TVAL_EL1", .state
= ARM_CP_STATE_AA64
,
1972 .opc0
= 3, .opc1
= 7, .crn
= 14, .crm
= 2, .opc2
= 0,
1973 .type
= ARM_CP_NO_RAW
| ARM_CP_IO
, .access
= PL1_RW
,
1974 .accessfn
= gt_stimer_access
,
1975 .readfn
= gt_sec_tval_read
,
1976 .writefn
= gt_sec_tval_write
,
1977 .resetfn
= gt_sec_timer_reset
,
1979 { .name
= "CNTPS_CTL_EL1", .state
= ARM_CP_STATE_AA64
,
1980 .opc0
= 3, .opc1
= 7, .crn
= 14, .crm
= 2, .opc2
= 1,
1981 .type
= ARM_CP_IO
, .access
= PL1_RW
,
1982 .accessfn
= gt_stimer_access
,
1983 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_SEC
].ctl
),
1985 .writefn
= gt_sec_ctl_write
, .raw_writefn
= raw_write
,
1987 { .name
= "CNTPS_CVAL_EL1", .state
= ARM_CP_STATE_AA64
,
1988 .opc0
= 3, .opc1
= 7, .crn
= 14, .crm
= 2, .opc2
= 2,
1989 .type
= ARM_CP_IO
, .access
= PL1_RW
,
1990 .accessfn
= gt_stimer_access
,
1991 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_SEC
].cval
),
1992 .writefn
= gt_sec_cval_write
, .raw_writefn
= raw_write
,
1998 /* In user-mode none of the generic timer registers are accessible,
1999 * and their implementation depends on QEMU_CLOCK_VIRTUAL and qdev gpio outputs,
2000 * so instead just don't register any of them.
2002 static const ARMCPRegInfo generic_timer_cp_reginfo
[] = {
2008 static void par_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
, uint64_t value
)
2010 if (arm_feature(env
, ARM_FEATURE_LPAE
)) {
2011 raw_write(env
, ri
, value
);
2012 } else if (arm_feature(env
, ARM_FEATURE_V7
)) {
2013 raw_write(env
, ri
, value
& 0xfffff6ff);
2015 raw_write(env
, ri
, value
& 0xfffff1ff);
2019 #ifndef CONFIG_USER_ONLY
2020 /* get_phys_addr() isn't present for user-mode-only targets */
2022 static CPAccessResult
ats_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2026 /* The ATS12NSO* operations must trap to EL3 if executed in
2027 * Secure EL1 (which can only happen if EL3 is AArch64).
2028 * They are simply UNDEF if executed from NS EL1.
2029 * They function normally from EL2 or EL3.
2031 if (arm_current_el(env
) == 1) {
2032 if (arm_is_secure_below_el3(env
)) {
2033 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3
;
2035 return CP_ACCESS_TRAP_UNCATEGORIZED
;
2038 return CP_ACCESS_OK
;
2041 static uint64_t do_ats_write(CPUARMState
*env
, uint64_t value
,
2042 int access_type
, ARMMMUIdx mmu_idx
)
2045 target_ulong page_size
;
2050 MemTxAttrs attrs
= {};
2051 ARMMMUFaultInfo fi
= {};
2053 ret
= get_phys_addr(env
, value
, access_type
, mmu_idx
,
2054 &phys_addr
, &attrs
, &prot
, &page_size
, &fsr
, &fi
);
2055 if (extended_addresses_enabled(env
)) {
2056 /* fsr is a DFSR/IFSR value for the long descriptor
2057 * translation table format, but with WnR always clear.
2058 * Convert it to a 64-bit PAR.
2060 par64
= (1 << 11); /* LPAE bit always set */
2062 par64
|= phys_addr
& ~0xfffULL
;
2063 if (!attrs
.secure
) {
2064 par64
|= (1 << 9); /* NS */
2066 /* We don't set the ATTR or SH fields in the PAR. */
2069 par64
|= (fsr
& 0x3f) << 1; /* FS */
2070 /* Note that S2WLK and FSTAGE are always zero, because we don't
2071 * implement virtualization and therefore there can't be a stage 2
2076 /* fsr is a DFSR/IFSR value for the short descriptor
2077 * translation table format (with WnR always clear).
2078 * Convert it to a 32-bit PAR.
2081 /* We do not set any attribute bits in the PAR */
2082 if (page_size
== (1 << 24)
2083 && arm_feature(env
, ARM_FEATURE_V7
)) {
2084 par64
= (phys_addr
& 0xff000000) | (1 << 1);
2086 par64
= phys_addr
& 0xfffff000;
2088 if (!attrs
.secure
) {
2089 par64
|= (1 << 9); /* NS */
2092 par64
= ((fsr
& (1 << 10)) >> 5) | ((fsr
& (1 << 12)) >> 6) |
2093 ((fsr
& 0xf) << 1) | 1;
2099 static void ats_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
, uint64_t value
)
2101 int access_type
= ri
->opc2
& 1;
2104 int el
= arm_current_el(env
);
2105 bool secure
= arm_is_secure_below_el3(env
);
2107 switch (ri
->opc2
& 6) {
2109 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */
2112 mmu_idx
= ARMMMUIdx_S1E3
;
2115 mmu_idx
= ARMMMUIdx_S1NSE1
;
2118 mmu_idx
= secure
? ARMMMUIdx_S1SE1
: ARMMMUIdx_S1NSE1
;
2121 g_assert_not_reached();
2125 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
2128 mmu_idx
= ARMMMUIdx_S1SE0
;
2131 mmu_idx
= ARMMMUIdx_S1NSE0
;
2134 mmu_idx
= secure
? ARMMMUIdx_S1SE0
: ARMMMUIdx_S1NSE0
;
2137 g_assert_not_reached();
2141 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
2142 mmu_idx
= ARMMMUIdx_S12NSE1
;
2145 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
2146 mmu_idx
= ARMMMUIdx_S12NSE0
;
2149 g_assert_not_reached();
2152 par64
= do_ats_write(env
, value
, access_type
, mmu_idx
);
2154 A32_BANKED_CURRENT_REG_SET(env
, par
, par64
);
2157 static void ats1h_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2160 int access_type
= ri
->opc2
& 1;
2163 par64
= do_ats_write(env
, value
, access_type
, ARMMMUIdx_S2NS
);
2165 A32_BANKED_CURRENT_REG_SET(env
, par
, par64
);
2168 static CPAccessResult
at_s1e2_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2171 if (arm_current_el(env
) == 3 && !(env
->cp15
.scr_el3
& SCR_NS
)) {
2172 return CP_ACCESS_TRAP
;
2174 return CP_ACCESS_OK
;
2177 static void ats_write64(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2180 int access_type
= ri
->opc2
& 1;
2182 int secure
= arm_is_secure_below_el3(env
);
2184 switch (ri
->opc2
& 6) {
2187 case 0: /* AT S1E1R, AT S1E1W */
2188 mmu_idx
= secure
? ARMMMUIdx_S1SE1
: ARMMMUIdx_S1NSE1
;
2190 case 4: /* AT S1E2R, AT S1E2W */
2191 mmu_idx
= ARMMMUIdx_S1E2
;
2193 case 6: /* AT S1E3R, AT S1E3W */
2194 mmu_idx
= ARMMMUIdx_S1E3
;
2197 g_assert_not_reached();
2200 case 2: /* AT S1E0R, AT S1E0W */
2201 mmu_idx
= secure
? ARMMMUIdx_S1SE0
: ARMMMUIdx_S1NSE0
;
2203 case 4: /* AT S12E1R, AT S12E1W */
2204 mmu_idx
= secure
? ARMMMUIdx_S1SE1
: ARMMMUIdx_S12NSE1
;
2206 case 6: /* AT S12E0R, AT S12E0W */
2207 mmu_idx
= secure
? ARMMMUIdx_S1SE0
: ARMMMUIdx_S12NSE0
;
2210 g_assert_not_reached();
2213 env
->cp15
.par_el
[1] = do_ats_write(env
, value
, access_type
, mmu_idx
);
2217 static const ARMCPRegInfo vapa_cp_reginfo
[] = {
2218 { .name
= "PAR", .cp
= 15, .crn
= 7, .crm
= 4, .opc1
= 0, .opc2
= 0,
2219 .access
= PL1_RW
, .resetvalue
= 0,
2220 .bank_fieldoffsets
= { offsetoflow32(CPUARMState
, cp15
.par_s
),
2221 offsetoflow32(CPUARMState
, cp15
.par_ns
) },
2222 .writefn
= par_write
},
2223 #ifndef CONFIG_USER_ONLY
2224 /* This underdecoding is safe because the reginfo is NO_RAW. */
2225 { .name
= "ATS", .cp
= 15, .crn
= 7, .crm
= 8, .opc1
= 0, .opc2
= CP_ANY
,
2226 .access
= PL1_W
, .accessfn
= ats_access
,
2227 .writefn
= ats_write
, .type
= ARM_CP_NO_RAW
},
2232 /* Return basic MPU access permission bits. */
2233 static uint32_t simple_mpu_ap_bits(uint32_t val
)
2240 for (i
= 0; i
< 16; i
+= 2) {
2241 ret
|= (val
>> i
) & mask
;
2247 /* Pad basic MPU access permission bits to extended format. */
2248 static uint32_t extended_mpu_ap_bits(uint32_t val
)
2255 for (i
= 0; i
< 16; i
+= 2) {
2256 ret
|= (val
& mask
) << i
;
2262 static void pmsav5_data_ap_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2265 env
->cp15
.pmsav5_data_ap
= extended_mpu_ap_bits(value
);
2268 static uint64_t pmsav5_data_ap_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2270 return simple_mpu_ap_bits(env
->cp15
.pmsav5_data_ap
);
2273 static void pmsav5_insn_ap_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2276 env
->cp15
.pmsav5_insn_ap
= extended_mpu_ap_bits(value
);
2279 static uint64_t pmsav5_insn_ap_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2281 return simple_mpu_ap_bits(env
->cp15
.pmsav5_insn_ap
);
2284 static uint64_t pmsav7_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2286 uint32_t *u32p
= *(uint32_t **)raw_ptr(env
, ri
);
2292 u32p
+= env
->cp15
.c6_rgnr
;
2296 static void pmsav7_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2299 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2300 uint32_t *u32p
= *(uint32_t **)raw_ptr(env
, ri
);
2306 u32p
+= env
->cp15
.c6_rgnr
;
2307 tlb_flush(CPU(cpu
), 1); /* Mappings may have changed - purge! */
2311 static void pmsav7_reset(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2313 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2314 uint32_t *u32p
= *(uint32_t **)raw_ptr(env
, ri
);
2320 memset(u32p
, 0, sizeof(*u32p
) * cpu
->pmsav7_dregion
);
2323 static void pmsav7_rgnr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2326 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2327 uint32_t nrgs
= cpu
->pmsav7_dregion
;
2329 if (value
>= nrgs
) {
2330 qemu_log_mask(LOG_GUEST_ERROR
,
2331 "PMSAv7 RGNR write >= # supported regions, %" PRIu32
2332 " > %" PRIu32
"\n", (uint32_t)value
, nrgs
);
2336 raw_write(env
, ri
, value
);
2339 static const ARMCPRegInfo pmsav7_cp_reginfo
[] = {
2340 { .name
= "DRBAR", .cp
= 15, .crn
= 6, .opc1
= 0, .crm
= 1, .opc2
= 0,
2341 .access
= PL1_RW
, .type
= ARM_CP_NO_RAW
,
2342 .fieldoffset
= offsetof(CPUARMState
, pmsav7
.drbar
),
2343 .readfn
= pmsav7_read
, .writefn
= pmsav7_write
, .resetfn
= pmsav7_reset
},
2344 { .name
= "DRSR", .cp
= 15, .crn
= 6, .opc1
= 0, .crm
= 1, .opc2
= 2,
2345 .access
= PL1_RW
, .type
= ARM_CP_NO_RAW
,
2346 .fieldoffset
= offsetof(CPUARMState
, pmsav7
.drsr
),
2347 .readfn
= pmsav7_read
, .writefn
= pmsav7_write
, .resetfn
= pmsav7_reset
},
2348 { .name
= "DRACR", .cp
= 15, .crn
= 6, .opc1
= 0, .crm
= 1, .opc2
= 4,
2349 .access
= PL1_RW
, .type
= ARM_CP_NO_RAW
,
2350 .fieldoffset
= offsetof(CPUARMState
, pmsav7
.dracr
),
2351 .readfn
= pmsav7_read
, .writefn
= pmsav7_write
, .resetfn
= pmsav7_reset
},
2352 { .name
= "RGNR", .cp
= 15, .crn
= 6, .opc1
= 0, .crm
= 2, .opc2
= 0,
2354 .fieldoffset
= offsetof(CPUARMState
, cp15
.c6_rgnr
),
2355 .writefn
= pmsav7_rgnr_write
},
2359 static const ARMCPRegInfo pmsav5_cp_reginfo
[] = {
2360 { .name
= "DATA_AP", .cp
= 15, .crn
= 5, .crm
= 0, .opc1
= 0, .opc2
= 0,
2361 .access
= PL1_RW
, .type
= ARM_CP_ALIAS
,
2362 .fieldoffset
= offsetof(CPUARMState
, cp15
.pmsav5_data_ap
),
2363 .readfn
= pmsav5_data_ap_read
, .writefn
= pmsav5_data_ap_write
, },
2364 { .name
= "INSN_AP", .cp
= 15, .crn
= 5, .crm
= 0, .opc1
= 0, .opc2
= 1,
2365 .access
= PL1_RW
, .type
= ARM_CP_ALIAS
,
2366 .fieldoffset
= offsetof(CPUARMState
, cp15
.pmsav5_insn_ap
),
2367 .readfn
= pmsav5_insn_ap_read
, .writefn
= pmsav5_insn_ap_write
, },
2368 { .name
= "DATA_EXT_AP", .cp
= 15, .crn
= 5, .crm
= 0, .opc1
= 0, .opc2
= 2,
2370 .fieldoffset
= offsetof(CPUARMState
, cp15
.pmsav5_data_ap
),
2372 { .name
= "INSN_EXT_AP", .cp
= 15, .crn
= 5, .crm
= 0, .opc1
= 0, .opc2
= 3,
2374 .fieldoffset
= offsetof(CPUARMState
, cp15
.pmsav5_insn_ap
),
2376 { .name
= "DCACHE_CFG", .cp
= 15, .crn
= 2, .crm
= 0, .opc1
= 0, .opc2
= 0,
2378 .fieldoffset
= offsetof(CPUARMState
, cp15
.c2_data
), .resetvalue
= 0, },
2379 { .name
= "ICACHE_CFG", .cp
= 15, .crn
= 2, .crm
= 0, .opc1
= 0, .opc2
= 1,
2381 .fieldoffset
= offsetof(CPUARMState
, cp15
.c2_insn
), .resetvalue
= 0, },
2382 /* Protection region base and size registers */
2383 { .name
= "946_PRBS0", .cp
= 15, .crn
= 6, .crm
= 0, .opc1
= 0,
2384 .opc2
= CP_ANY
, .access
= PL1_RW
, .resetvalue
= 0,
2385 .fieldoffset
= offsetof(CPUARMState
, cp15
.c6_region
[0]) },
2386 { .name
= "946_PRBS1", .cp
= 15, .crn
= 6, .crm
= 1, .opc1
= 0,
2387 .opc2
= CP_ANY
, .access
= PL1_RW
, .resetvalue
= 0,
2388 .fieldoffset
= offsetof(CPUARMState
, cp15
.c6_region
[1]) },
2389 { .name
= "946_PRBS2", .cp
= 15, .crn
= 6, .crm
= 2, .opc1
= 0,
2390 .opc2
= CP_ANY
, .access
= PL1_RW
, .resetvalue
= 0,
2391 .fieldoffset
= offsetof(CPUARMState
, cp15
.c6_region
[2]) },
2392 { .name
= "946_PRBS3", .cp
= 15, .crn
= 6, .crm
= 3, .opc1
= 0,
2393 .opc2
= CP_ANY
, .access
= PL1_RW
, .resetvalue
= 0,
2394 .fieldoffset
= offsetof(CPUARMState
, cp15
.c6_region
[3]) },
2395 { .name
= "946_PRBS4", .cp
= 15, .crn
= 6, .crm
= 4, .opc1
= 0,
2396 .opc2
= CP_ANY
, .access
= PL1_RW
, .resetvalue
= 0,
2397 .fieldoffset
= offsetof(CPUARMState
, cp15
.c6_region
[4]) },
2398 { .name
= "946_PRBS5", .cp
= 15, .crn
= 6, .crm
= 5, .opc1
= 0,
2399 .opc2
= CP_ANY
, .access
= PL1_RW
, .resetvalue
= 0,
2400 .fieldoffset
= offsetof(CPUARMState
, cp15
.c6_region
[5]) },
2401 { .name
= "946_PRBS6", .cp
= 15, .crn
= 6, .crm
= 6, .opc1
= 0,
2402 .opc2
= CP_ANY
, .access
= PL1_RW
, .resetvalue
= 0,
2403 .fieldoffset
= offsetof(CPUARMState
, cp15
.c6_region
[6]) },
2404 { .name
= "946_PRBS7", .cp
= 15, .crn
= 6, .crm
= 7, .opc1
= 0,
2405 .opc2
= CP_ANY
, .access
= PL1_RW
, .resetvalue
= 0,
2406 .fieldoffset
= offsetof(CPUARMState
, cp15
.c6_region
[7]) },
2410 static void vmsa_ttbcr_raw_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2413 TCR
*tcr
= raw_ptr(env
, ri
);
2414 int maskshift
= extract32(value
, 0, 3);
2416 if (!arm_feature(env
, ARM_FEATURE_V8
)) {
2417 if (arm_feature(env
, ARM_FEATURE_LPAE
) && (value
& TTBCR_EAE
)) {
2418 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
2419 * using Long-desciptor translation table format */
2420 value
&= ~((7 << 19) | (3 << 14) | (0xf << 3));
2421 } else if (arm_feature(env
, ARM_FEATURE_EL3
)) {
2422 /* In an implementation that includes the Security Extensions
2423 * TTBCR has additional fields PD0 [4] and PD1 [5] for
2424 * Short-descriptor translation table format.
2426 value
&= TTBCR_PD1
| TTBCR_PD0
| TTBCR_N
;
2432 /* Update the masks corresponding to the TCR bank being written
2433 * Note that we always calculate mask and base_mask, but
2434 * they are only used for short-descriptor tables (ie if EAE is 0);
2435 * for long-descriptor tables the TCR fields are used differently
2436 * and the mask and base_mask values are meaningless.
2438 tcr
->raw_tcr
= value
;
2439 tcr
->mask
= ~(((uint32_t)0xffffffffu
) >> maskshift
);
2440 tcr
->base_mask
= ~((uint32_t)0x3fffu
>> maskshift
);
2443 static void vmsa_ttbcr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2446 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2448 if (arm_feature(env
, ARM_FEATURE_LPAE
)) {
2449 /* With LPAE the TTBCR could result in a change of ASID
2450 * via the TTBCR.A1 bit, so do a TLB flush.
2452 tlb_flush(CPU(cpu
), 1);
2454 vmsa_ttbcr_raw_write(env
, ri
, value
);
2457 static void vmsa_ttbcr_reset(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2459 TCR
*tcr
= raw_ptr(env
, ri
);
2461 /* Reset both the TCR as well as the masks corresponding to the bank of
2462 * the TCR being reset.
2466 tcr
->base_mask
= 0xffffc000u
;
2469 static void vmsa_tcr_el1_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2472 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2473 TCR
*tcr
= raw_ptr(env
, ri
);
2475 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
2476 tlb_flush(CPU(cpu
), 1);
2477 tcr
->raw_tcr
= value
;
2480 static void vmsa_ttbr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2483 /* 64 bit accesses to the TTBRs can change the ASID and so we
2484 * must flush the TLB.
2486 if (cpreg_field_is_64bit(ri
)) {
2487 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2489 tlb_flush(CPU(cpu
), 1);
2491 raw_write(env
, ri
, value
);
2494 static void vttbr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2497 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2498 CPUState
*cs
= CPU(cpu
);
2500 /* Accesses to VTTBR may change the VMID so we must flush the TLB. */
2501 if (raw_read(env
, ri
) != value
) {
2502 tlb_flush_by_mmuidx(cs
, ARMMMUIdx_S12NSE1
, ARMMMUIdx_S12NSE0
,
2503 ARMMMUIdx_S2NS
, -1);
2504 raw_write(env
, ri
, value
);
2508 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo
[] = {
2509 { .name
= "DFSR", .cp
= 15, .crn
= 5, .crm
= 0, .opc1
= 0, .opc2
= 0,
2510 .access
= PL1_RW
, .type
= ARM_CP_ALIAS
,
2511 .bank_fieldoffsets
= { offsetoflow32(CPUARMState
, cp15
.dfsr_s
),
2512 offsetoflow32(CPUARMState
, cp15
.dfsr_ns
) }, },
2513 { .name
= "IFSR", .cp
= 15, .crn
= 5, .crm
= 0, .opc1
= 0, .opc2
= 1,
2514 .access
= PL1_RW
, .resetvalue
= 0,
2515 .bank_fieldoffsets
= { offsetoflow32(CPUARMState
, cp15
.ifsr_s
),
2516 offsetoflow32(CPUARMState
, cp15
.ifsr_ns
) } },
2517 { .name
= "DFAR", .cp
= 15, .opc1
= 0, .crn
= 6, .crm
= 0, .opc2
= 0,
2518 .access
= PL1_RW
, .resetvalue
= 0,
2519 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.dfar_s
),
2520 offsetof(CPUARMState
, cp15
.dfar_ns
) } },
2521 { .name
= "FAR_EL1", .state
= ARM_CP_STATE_AA64
,
2522 .opc0
= 3, .crn
= 6, .crm
= 0, .opc1
= 0, .opc2
= 0,
2523 .access
= PL1_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.far_el
[1]),
2528 static const ARMCPRegInfo vmsa_cp_reginfo
[] = {
2529 { .name
= "ESR_EL1", .state
= ARM_CP_STATE_AA64
,
2530 .opc0
= 3, .crn
= 5, .crm
= 2, .opc1
= 0, .opc2
= 0,
2532 .fieldoffset
= offsetof(CPUARMState
, cp15
.esr_el
[1]), .resetvalue
= 0, },
2533 { .name
= "TTBR0_EL1", .state
= ARM_CP_STATE_BOTH
,
2534 .opc0
= 3, .opc1
= 0, .crn
= 2, .crm
= 0, .opc2
= 0,
2535 .access
= PL1_RW
, .writefn
= vmsa_ttbr_write
, .resetvalue
= 0,
2536 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.ttbr0_s
),
2537 offsetof(CPUARMState
, cp15
.ttbr0_ns
) } },
2538 { .name
= "TTBR1_EL1", .state
= ARM_CP_STATE_BOTH
,
2539 .opc0
= 3, .opc1
= 0, .crn
= 2, .crm
= 0, .opc2
= 1,
2540 .access
= PL1_RW
, .writefn
= vmsa_ttbr_write
, .resetvalue
= 0,
2541 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.ttbr1_s
),
2542 offsetof(CPUARMState
, cp15
.ttbr1_ns
) } },
2543 { .name
= "TCR_EL1", .state
= ARM_CP_STATE_AA64
,
2544 .opc0
= 3, .crn
= 2, .crm
= 0, .opc1
= 0, .opc2
= 2,
2545 .access
= PL1_RW
, .writefn
= vmsa_tcr_el1_write
,
2546 .resetfn
= vmsa_ttbcr_reset
, .raw_writefn
= raw_write
,
2547 .fieldoffset
= offsetof(CPUARMState
, cp15
.tcr_el
[1]) },
2548 { .name
= "TTBCR", .cp
= 15, .crn
= 2, .crm
= 0, .opc1
= 0, .opc2
= 2,
2549 .access
= PL1_RW
, .type
= ARM_CP_ALIAS
, .writefn
= vmsa_ttbcr_write
,
2550 .raw_writefn
= vmsa_ttbcr_raw_write
,
2551 .bank_fieldoffsets
= { offsetoflow32(CPUARMState
, cp15
.tcr_el
[3]),
2552 offsetoflow32(CPUARMState
, cp15
.tcr_el
[1])} },
2556 static void omap_ticonfig_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2559 env
->cp15
.c15_ticonfig
= value
& 0xe7;
2560 /* The OS_TYPE bit in this register changes the reported CPUID! */
2561 env
->cp15
.c0_cpuid
= (value
& (1 << 5)) ?
2562 ARM_CPUID_TI915T
: ARM_CPUID_TI925T
;
2565 static void omap_threadid_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2568 env
->cp15
.c15_threadid
= value
& 0xffff;
2571 static void omap_wfi_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2574 /* Wait-for-interrupt (deprecated) */
2575 cpu_interrupt(CPU(arm_env_get_cpu(env
)), CPU_INTERRUPT_HALT
);
2578 static void omap_cachemaint_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2581 /* On OMAP there are registers indicating the max/min index of dcache lines
2582 * containing a dirty line; cache flush operations have to reset these.
2584 env
->cp15
.c15_i_max
= 0x000;
2585 env
->cp15
.c15_i_min
= 0xff0;
2588 static const ARMCPRegInfo omap_cp_reginfo
[] = {
2589 { .name
= "DFSR", .cp
= 15, .crn
= 5, .crm
= CP_ANY
,
2590 .opc1
= CP_ANY
, .opc2
= CP_ANY
, .access
= PL1_RW
, .type
= ARM_CP_OVERRIDE
,
2591 .fieldoffset
= offsetoflow32(CPUARMState
, cp15
.esr_el
[1]),
2593 { .name
= "", .cp
= 15, .crn
= 15, .crm
= 0, .opc1
= 0, .opc2
= 0,
2594 .access
= PL1_RW
, .type
= ARM_CP_NOP
},
2595 { .name
= "TICONFIG", .cp
= 15, .crn
= 15, .crm
= 1, .opc1
= 0, .opc2
= 0,
2597 .fieldoffset
= offsetof(CPUARMState
, cp15
.c15_ticonfig
), .resetvalue
= 0,
2598 .writefn
= omap_ticonfig_write
},
2599 { .name
= "IMAX", .cp
= 15, .crn
= 15, .crm
= 2, .opc1
= 0, .opc2
= 0,
2601 .fieldoffset
= offsetof(CPUARMState
, cp15
.c15_i_max
), .resetvalue
= 0, },
2602 { .name
= "IMIN", .cp
= 15, .crn
= 15, .crm
= 3, .opc1
= 0, .opc2
= 0,
2603 .access
= PL1_RW
, .resetvalue
= 0xff0,
2604 .fieldoffset
= offsetof(CPUARMState
, cp15
.c15_i_min
) },
2605 { .name
= "THREADID", .cp
= 15, .crn
= 15, .crm
= 4, .opc1
= 0, .opc2
= 0,
2607 .fieldoffset
= offsetof(CPUARMState
, cp15
.c15_threadid
), .resetvalue
= 0,
2608 .writefn
= omap_threadid_write
},
2609 { .name
= "TI925T_STATUS", .cp
= 15, .crn
= 15,
2610 .crm
= 8, .opc1
= 0, .opc2
= 0, .access
= PL1_RW
,
2611 .type
= ARM_CP_NO_RAW
,
2612 .readfn
= arm_cp_read_zero
, .writefn
= omap_wfi_write
, },
2613 /* TODO: Peripheral port remap register:
2614 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
2615 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
2618 { .name
= "OMAP_CACHEMAINT", .cp
= 15, .crn
= 7, .crm
= CP_ANY
,
2619 .opc1
= 0, .opc2
= CP_ANY
, .access
= PL1_W
,
2620 .type
= ARM_CP_OVERRIDE
| ARM_CP_NO_RAW
,
2621 .writefn
= omap_cachemaint_write
},
2622 { .name
= "C9", .cp
= 15, .crn
= 9,
2623 .crm
= CP_ANY
, .opc1
= CP_ANY
, .opc2
= CP_ANY
, .access
= PL1_RW
,
2624 .type
= ARM_CP_CONST
| ARM_CP_OVERRIDE
, .resetvalue
= 0 },
2628 static void xscale_cpar_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2631 env
->cp15
.c15_cpar
= value
& 0x3fff;
2634 static const ARMCPRegInfo xscale_cp_reginfo
[] = {
2635 { .name
= "XSCALE_CPAR",
2636 .cp
= 15, .crn
= 15, .crm
= 1, .opc1
= 0, .opc2
= 0, .access
= PL1_RW
,
2637 .fieldoffset
= offsetof(CPUARMState
, cp15
.c15_cpar
), .resetvalue
= 0,
2638 .writefn
= xscale_cpar_write
, },
2639 { .name
= "XSCALE_AUXCR",
2640 .cp
= 15, .crn
= 1, .crm
= 0, .opc1
= 0, .opc2
= 1, .access
= PL1_RW
,
2641 .fieldoffset
= offsetof(CPUARMState
, cp15
.c1_xscaleauxcr
),
2643 /* XScale specific cache-lockdown: since we have no cache we NOP these
2644 * and hope the guest does not really rely on cache behaviour.
2646 { .name
= "XSCALE_LOCK_ICACHE_LINE",
2647 .cp
= 15, .opc1
= 0, .crn
= 9, .crm
= 1, .opc2
= 0,
2648 .access
= PL1_W
, .type
= ARM_CP_NOP
},
2649 { .name
= "XSCALE_UNLOCK_ICACHE",
2650 .cp
= 15, .opc1
= 0, .crn
= 9, .crm
= 1, .opc2
= 1,
2651 .access
= PL1_W
, .type
= ARM_CP_NOP
},
2652 { .name
= "XSCALE_DCACHE_LOCK",
2653 .cp
= 15, .opc1
= 0, .crn
= 9, .crm
= 2, .opc2
= 0,
2654 .access
= PL1_RW
, .type
= ARM_CP_NOP
},
2655 { .name
= "XSCALE_UNLOCK_DCACHE",
2656 .cp
= 15, .opc1
= 0, .crn
= 9, .crm
= 2, .opc2
= 1,
2657 .access
= PL1_W
, .type
= ARM_CP_NOP
},
2661 static const ARMCPRegInfo dummy_c15_cp_reginfo
[] = {
2662 /* RAZ/WI the whole crn=15 space, when we don't have a more specific
2663 * implementation of this implementation-defined space.
2664 * Ideally this should eventually disappear in favour of actually
2665 * implementing the correct behaviour for all cores.
2667 { .name
= "C15_IMPDEF", .cp
= 15, .crn
= 15,
2668 .crm
= CP_ANY
, .opc1
= CP_ANY
, .opc2
= CP_ANY
,
2670 .type
= ARM_CP_CONST
| ARM_CP_NO_RAW
| ARM_CP_OVERRIDE
,
2675 static const ARMCPRegInfo cache_dirty_status_cp_reginfo
[] = {
2676 /* Cache status: RAZ because we have no cache so it's always clean */
2677 { .name
= "CDSR", .cp
= 15, .crn
= 7, .crm
= 10, .opc1
= 0, .opc2
= 6,
2678 .access
= PL1_R
, .type
= ARM_CP_CONST
| ARM_CP_NO_RAW
,
2683 static const ARMCPRegInfo cache_block_ops_cp_reginfo
[] = {
2684 /* We never have a a block transfer operation in progress */
2685 { .name
= "BXSR", .cp
= 15, .crn
= 7, .crm
= 12, .opc1
= 0, .opc2
= 4,
2686 .access
= PL0_R
, .type
= ARM_CP_CONST
| ARM_CP_NO_RAW
,
2688 /* The cache ops themselves: these all NOP for QEMU */
2689 { .name
= "IICR", .cp
= 15, .crm
= 5, .opc1
= 0,
2690 .access
= PL1_W
, .type
= ARM_CP_NOP
|ARM_CP_64BIT
},
2691 { .name
= "IDCR", .cp
= 15, .crm
= 6, .opc1
= 0,
2692 .access
= PL1_W
, .type
= ARM_CP_NOP
|ARM_CP_64BIT
},
2693 { .name
= "CDCR", .cp
= 15, .crm
= 12, .opc1
= 0,
2694 .access
= PL0_W
, .type
= ARM_CP_NOP
|ARM_CP_64BIT
},
2695 { .name
= "PIR", .cp
= 15, .crm
= 12, .opc1
= 1,
2696 .access
= PL0_W
, .type
= ARM_CP_NOP
|ARM_CP_64BIT
},
2697 { .name
= "PDR", .cp
= 15, .crm
= 12, .opc1
= 2,
2698 .access
= PL0_W
, .type
= ARM_CP_NOP
|ARM_CP_64BIT
},
2699 { .name
= "CIDCR", .cp
= 15, .crm
= 14, .opc1
= 0,
2700 .access
= PL1_W
, .type
= ARM_CP_NOP
|ARM_CP_64BIT
},
2704 static const ARMCPRegInfo cache_test_clean_cp_reginfo
[] = {
2705 /* The cache test-and-clean instructions always return (1 << 30)
2706 * to indicate that there are no dirty cache lines.
2708 { .name
= "TC_DCACHE", .cp
= 15, .crn
= 7, .crm
= 10, .opc1
= 0, .opc2
= 3,
2709 .access
= PL0_R
, .type
= ARM_CP_CONST
| ARM_CP_NO_RAW
,
2710 .resetvalue
= (1 << 30) },
2711 { .name
= "TCI_DCACHE", .cp
= 15, .crn
= 7, .crm
= 14, .opc1
= 0, .opc2
= 3,
2712 .access
= PL0_R
, .type
= ARM_CP_CONST
| ARM_CP_NO_RAW
,
2713 .resetvalue
= (1 << 30) },
2717 static const ARMCPRegInfo strongarm_cp_reginfo
[] = {
2718 /* Ignore ReadBuffer accesses */
2719 { .name
= "C9_READBUFFER", .cp
= 15, .crn
= 9,
2720 .crm
= CP_ANY
, .opc1
= CP_ANY
, .opc2
= CP_ANY
,
2721 .access
= PL1_RW
, .resetvalue
= 0,
2722 .type
= ARM_CP_CONST
| ARM_CP_OVERRIDE
| ARM_CP_NO_RAW
},
2726 static uint64_t midr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2728 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2729 unsigned int cur_el
= arm_current_el(env
);
2730 bool secure
= arm_is_secure(env
);
2732 if (arm_feature(&cpu
->env
, ARM_FEATURE_EL2
) && !secure
&& cur_el
== 1) {
2733 return env
->cp15
.vpidr_el2
;
2735 return raw_read(env
, ri
);
2738 static uint64_t mpidr_read_val(CPUARMState
*env
)
2740 ARMCPU
*cpu
= ARM_CPU(arm_env_get_cpu(env
));
2741 uint64_t mpidr
= cpu
->mp_affinity
;
2743 if (arm_feature(env
, ARM_FEATURE_V7MP
)) {
2744 mpidr
|= (1U << 31);
2745 /* Cores which are uniprocessor (non-coherent)
2746 * but still implement the MP extensions set
2747 * bit 30. (For instance, Cortex-R5).
2749 if (cpu
->mp_is_up
) {
2750 mpidr
|= (1u << 30);
2756 static uint64_t mpidr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2758 unsigned int cur_el
= arm_current_el(env
);
2759 bool secure
= arm_is_secure(env
);
2761 if (arm_feature(env
, ARM_FEATURE_EL2
) && !secure
&& cur_el
== 1) {
2762 return env
->cp15
.vmpidr_el2
;
2764 return mpidr_read_val(env
);
2767 static const ARMCPRegInfo mpidr_cp_reginfo
[] = {
2768 { .name
= "MPIDR", .state
= ARM_CP_STATE_BOTH
,
2769 .opc0
= 3, .crn
= 0, .crm
= 0, .opc1
= 0, .opc2
= 5,
2770 .access
= PL1_R
, .readfn
= mpidr_read
, .type
= ARM_CP_NO_RAW
},
2774 static const ARMCPRegInfo lpae_cp_reginfo
[] = {
2776 { .name
= "AMAIR0", .state
= ARM_CP_STATE_BOTH
,
2777 .opc0
= 3, .crn
= 10, .crm
= 3, .opc1
= 0, .opc2
= 0,
2778 .access
= PL1_RW
, .type
= ARM_CP_CONST
,
2780 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
2781 { .name
= "AMAIR1", .cp
= 15, .crn
= 10, .crm
= 3, .opc1
= 0, .opc2
= 1,
2782 .access
= PL1_RW
, .type
= ARM_CP_CONST
,
2784 { .name
= "PAR", .cp
= 15, .crm
= 7, .opc1
= 0,
2785 .access
= PL1_RW
, .type
= ARM_CP_64BIT
, .resetvalue
= 0,
2786 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.par_s
),
2787 offsetof(CPUARMState
, cp15
.par_ns
)} },
2788 { .name
= "TTBR0", .cp
= 15, .crm
= 2, .opc1
= 0,
2789 .access
= PL1_RW
, .type
= ARM_CP_64BIT
| ARM_CP_ALIAS
,
2790 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.ttbr0_s
),
2791 offsetof(CPUARMState
, cp15
.ttbr0_ns
) },
2792 .writefn
= vmsa_ttbr_write
, },
2793 { .name
= "TTBR1", .cp
= 15, .crm
= 2, .opc1
= 1,
2794 .access
= PL1_RW
, .type
= ARM_CP_64BIT
| ARM_CP_ALIAS
,
2795 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.ttbr1_s
),
2796 offsetof(CPUARMState
, cp15
.ttbr1_ns
) },
2797 .writefn
= vmsa_ttbr_write
, },
2801 static uint64_t aa64_fpcr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2803 return vfp_get_fpcr(env
);
2806 static void aa64_fpcr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2809 vfp_set_fpcr(env
, value
);
2812 static uint64_t aa64_fpsr_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
2814 return vfp_get_fpsr(env
);
2817 static void aa64_fpsr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2820 vfp_set_fpsr(env
, value
);
2823 static CPAccessResult
aa64_daif_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2826 if (arm_current_el(env
) == 0 && !(env
->cp15
.sctlr_el
[1] & SCTLR_UMA
)) {
2827 return CP_ACCESS_TRAP
;
2829 return CP_ACCESS_OK
;
2832 static void aa64_daif_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2835 env
->daif
= value
& PSTATE_DAIF
;
2838 static CPAccessResult
aa64_cacheop_access(CPUARMState
*env
,
2839 const ARMCPRegInfo
*ri
,
2842 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
2843 * SCTLR_EL1.UCI is set.
2845 if (arm_current_el(env
) == 0 && !(env
->cp15
.sctlr_el
[1] & SCTLR_UCI
)) {
2846 return CP_ACCESS_TRAP
;
2848 return CP_ACCESS_OK
;
2851 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions
2852 * Page D4-1736 (DDI0487A.b)
2855 static void tlbi_aa64_vmalle1_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2858 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2859 CPUState
*cs
= CPU(cpu
);
2861 if (arm_is_secure_below_el3(env
)) {
2862 tlb_flush_by_mmuidx(cs
, ARMMMUIdx_S1SE1
, ARMMMUIdx_S1SE0
, -1);
2864 tlb_flush_by_mmuidx(cs
, ARMMMUIdx_S12NSE1
, ARMMMUIdx_S12NSE0
, -1);
2868 static void tlbi_aa64_vmalle1is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2871 bool sec
= arm_is_secure_below_el3(env
);
2874 CPU_FOREACH(other_cs
) {
2876 tlb_flush_by_mmuidx(other_cs
, ARMMMUIdx_S1SE1
, ARMMMUIdx_S1SE0
, -1);
2878 tlb_flush_by_mmuidx(other_cs
, ARMMMUIdx_S12NSE1
,
2879 ARMMMUIdx_S12NSE0
, -1);
2884 static void tlbi_aa64_alle1_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2887 /* Note that the 'ALL' scope must invalidate both stage 1 and
2888 * stage 2 translations, whereas most other scopes only invalidate
2889 * stage 1 translations.
2891 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2892 CPUState
*cs
= CPU(cpu
);
2894 if (arm_is_secure_below_el3(env
)) {
2895 tlb_flush_by_mmuidx(cs
, ARMMMUIdx_S1SE1
, ARMMMUIdx_S1SE0
, -1);
2897 if (arm_feature(env
, ARM_FEATURE_EL2
)) {
2898 tlb_flush_by_mmuidx(cs
, ARMMMUIdx_S12NSE1
, ARMMMUIdx_S12NSE0
,
2899 ARMMMUIdx_S2NS
, -1);
2901 tlb_flush_by_mmuidx(cs
, ARMMMUIdx_S12NSE1
, ARMMMUIdx_S12NSE0
, -1);
2906 static void tlbi_aa64_alle2_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2909 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2910 CPUState
*cs
= CPU(cpu
);
2912 tlb_flush_by_mmuidx(cs
, ARMMMUIdx_S1E2
, -1);
2915 static void tlbi_aa64_alle3_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2918 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2919 CPUState
*cs
= CPU(cpu
);
2921 tlb_flush_by_mmuidx(cs
, ARMMMUIdx_S1E3
, -1);
2924 static void tlbi_aa64_alle1is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2927 /* Note that the 'ALL' scope must invalidate both stage 1 and
2928 * stage 2 translations, whereas most other scopes only invalidate
2929 * stage 1 translations.
2931 bool sec
= arm_is_secure_below_el3(env
);
2932 bool has_el2
= arm_feature(env
, ARM_FEATURE_EL2
);
2935 CPU_FOREACH(other_cs
) {
2937 tlb_flush_by_mmuidx(other_cs
, ARMMMUIdx_S1SE1
, ARMMMUIdx_S1SE0
, -1);
2938 } else if (has_el2
) {
2939 tlb_flush_by_mmuidx(other_cs
, ARMMMUIdx_S12NSE1
,
2940 ARMMMUIdx_S12NSE0
, ARMMMUIdx_S2NS
, -1);
2942 tlb_flush_by_mmuidx(other_cs
, ARMMMUIdx_S12NSE1
,
2943 ARMMMUIdx_S12NSE0
, -1);
2948 static void tlbi_aa64_alle2is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2953 CPU_FOREACH(other_cs
) {
2954 tlb_flush_by_mmuidx(other_cs
, ARMMMUIdx_S1E2
, -1);
2958 static void tlbi_aa64_alle3is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2963 CPU_FOREACH(other_cs
) {
2964 tlb_flush_by_mmuidx(other_cs
, ARMMMUIdx_S1E3
, -1);
2968 static void tlbi_aa64_vae1_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2971 /* Invalidate by VA, EL1&0 (AArch64 version).
2972 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1,
2973 * since we don't support flush-for-specific-ASID-only or
2974 * flush-last-level-only.
2976 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2977 CPUState
*cs
= CPU(cpu
);
2978 uint64_t pageaddr
= sextract64(value
<< 12, 0, 56);
2980 if (arm_is_secure_below_el3(env
)) {
2981 tlb_flush_page_by_mmuidx(cs
, pageaddr
, ARMMMUIdx_S1SE1
,
2982 ARMMMUIdx_S1SE0
, -1);
2984 tlb_flush_page_by_mmuidx(cs
, pageaddr
, ARMMMUIdx_S12NSE1
,
2985 ARMMMUIdx_S12NSE0
, -1);
2989 static void tlbi_aa64_vae2_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
2992 /* Invalidate by VA, EL2
2993 * Currently handles both VAE2 and VALE2, since we don't support
2994 * flush-last-level-only.
2996 ARMCPU
*cpu
= arm_env_get_cpu(env
);
2997 CPUState
*cs
= CPU(cpu
);
2998 uint64_t pageaddr
= sextract64(value
<< 12, 0, 56);
3000 tlb_flush_page_by_mmuidx(cs
, pageaddr
, ARMMMUIdx_S1E2
, -1);
3003 static void tlbi_aa64_vae3_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3006 /* Invalidate by VA, EL3
3007 * Currently handles both VAE3 and VALE3, since we don't support
3008 * flush-last-level-only.
3010 ARMCPU
*cpu
= arm_env_get_cpu(env
);
3011 CPUState
*cs
= CPU(cpu
);
3012 uint64_t pageaddr
= sextract64(value
<< 12, 0, 56);
3014 tlb_flush_page_by_mmuidx(cs
, pageaddr
, ARMMMUIdx_S1E3
, -1);
3017 static void tlbi_aa64_vae1is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3020 bool sec
= arm_is_secure_below_el3(env
);
3022 uint64_t pageaddr
= sextract64(value
<< 12, 0, 56);
3024 CPU_FOREACH(other_cs
) {
3026 tlb_flush_page_by_mmuidx(other_cs
, pageaddr
, ARMMMUIdx_S1SE1
,
3027 ARMMMUIdx_S1SE0
, -1);
3029 tlb_flush_page_by_mmuidx(other_cs
, pageaddr
, ARMMMUIdx_S12NSE1
,
3030 ARMMMUIdx_S12NSE0
, -1);
3035 static void tlbi_aa64_vae2is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3039 uint64_t pageaddr
= sextract64(value
<< 12, 0, 56);
3041 CPU_FOREACH(other_cs
) {
3042 tlb_flush_page_by_mmuidx(other_cs
, pageaddr
, ARMMMUIdx_S1E2
, -1);
3046 static void tlbi_aa64_vae3is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3050 uint64_t pageaddr
= sextract64(value
<< 12, 0, 56);
3052 CPU_FOREACH(other_cs
) {
3053 tlb_flush_page_by_mmuidx(other_cs
, pageaddr
, ARMMMUIdx_S1E3
, -1);
3057 static void tlbi_aa64_ipas2e1_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3060 /* Invalidate by IPA. This has to invalidate any structures that
3061 * contain only stage 2 translation information, but does not need
3062 * to apply to structures that contain combined stage 1 and stage 2
3063 * translation information.
3064 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
3066 ARMCPU
*cpu
= arm_env_get_cpu(env
);
3067 CPUState
*cs
= CPU(cpu
);
3070 if (!arm_feature(env
, ARM_FEATURE_EL2
) || !(env
->cp15
.scr_el3
& SCR_NS
)) {
3074 pageaddr
= sextract64(value
<< 12, 0, 48);
3076 tlb_flush_page_by_mmuidx(cs
, pageaddr
, ARMMMUIdx_S2NS
, -1);
3079 static void tlbi_aa64_ipas2e1is_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3085 if (!arm_feature(env
, ARM_FEATURE_EL2
) || !(env
->cp15
.scr_el3
& SCR_NS
)) {
3089 pageaddr
= sextract64(value
<< 12, 0, 48);
3091 CPU_FOREACH(other_cs
) {
3092 tlb_flush_page_by_mmuidx(other_cs
, pageaddr
, ARMMMUIdx_S2NS
, -1);
3096 static CPAccessResult
aa64_zva_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3099 /* We don't implement EL2, so the only control on DC ZVA is the
3100 * bit in the SCTLR which can prohibit access for EL0.
3102 if (arm_current_el(env
) == 0 && !(env
->cp15
.sctlr_el
[1] & SCTLR_DZE
)) {
3103 return CP_ACCESS_TRAP
;
3105 return CP_ACCESS_OK
;
3108 static uint64_t aa64_dczid_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
3110 ARMCPU
*cpu
= arm_env_get_cpu(env
);
3111 int dzp_bit
= 1 << 4;
3113 /* DZP indicates whether DC ZVA access is allowed */
3114 if (aa64_zva_access(env
, NULL
, false) == CP_ACCESS_OK
) {
3117 return cpu
->dcz_blocksize
| dzp_bit
;
3120 static CPAccessResult
sp_el0_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3123 if (!(env
->pstate
& PSTATE_SP
)) {
3124 /* Access to SP_EL0 is undefined if it's being used as
3125 * the stack pointer.
3127 return CP_ACCESS_TRAP_UNCATEGORIZED
;
3129 return CP_ACCESS_OK
;
3132 static uint64_t spsel_read(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
3134 return env
->pstate
& PSTATE_SP
;
3137 static void spsel_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
, uint64_t val
)
3139 update_spsel(env
, val
);
3142 static void sctlr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3145 ARMCPU
*cpu
= arm_env_get_cpu(env
);
3147 if (raw_read(env
, ri
) == value
) {
3148 /* Skip the TLB flush if nothing actually changed; Linux likes
3149 * to do a lot of pointless SCTLR writes.
3154 raw_write(env
, ri
, value
);
3155 /* ??? Lots of these bits are not implemented. */
3156 /* This may enable/disable the MMU, so do a TLB flush. */
3157 tlb_flush(CPU(cpu
), 1);
3160 static CPAccessResult
fpexc32_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3163 if ((env
->cp15
.cptr_el
[2] & CPTR_TFP
) && arm_current_el(env
) == 2) {
3164 return CP_ACCESS_TRAP_FP_EL2
;
3166 if (env
->cp15
.cptr_el
[3] & CPTR_TFP
) {
3167 return CP_ACCESS_TRAP_FP_EL3
;
3169 return CP_ACCESS_OK
;
3172 static void sdcr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3175 env
->cp15
.mdcr_el3
= value
& SDCR_VALID_MASK
;
3178 static const ARMCPRegInfo v8_cp_reginfo
[] = {
3179 /* Minimal set of EL0-visible registers. This will need to be expanded
3180 * significantly for system emulation of AArch64 CPUs.
3182 { .name
= "NZCV", .state
= ARM_CP_STATE_AA64
,
3183 .opc0
= 3, .opc1
= 3, .opc2
= 0, .crn
= 4, .crm
= 2,
3184 .access
= PL0_RW
, .type
= ARM_CP_NZCV
},
3185 { .name
= "DAIF", .state
= ARM_CP_STATE_AA64
,
3186 .opc0
= 3, .opc1
= 3, .opc2
= 1, .crn
= 4, .crm
= 2,
3187 .type
= ARM_CP_NO_RAW
,
3188 .access
= PL0_RW
, .accessfn
= aa64_daif_access
,
3189 .fieldoffset
= offsetof(CPUARMState
, daif
),
3190 .writefn
= aa64_daif_write
, .resetfn
= arm_cp_reset_ignore
},
3191 { .name
= "FPCR", .state
= ARM_CP_STATE_AA64
,
3192 .opc0
= 3, .opc1
= 3, .opc2
= 0, .crn
= 4, .crm
= 4,
3193 .access
= PL0_RW
, .readfn
= aa64_fpcr_read
, .writefn
= aa64_fpcr_write
},
3194 { .name
= "FPSR", .state
= ARM_CP_STATE_AA64
,
3195 .opc0
= 3, .opc1
= 3, .opc2
= 1, .crn
= 4, .crm
= 4,
3196 .access
= PL0_RW
, .readfn
= aa64_fpsr_read
, .writefn
= aa64_fpsr_write
},
3197 { .name
= "DCZID_EL0", .state
= ARM_CP_STATE_AA64
,
3198 .opc0
= 3, .opc1
= 3, .opc2
= 7, .crn
= 0, .crm
= 0,
3199 .access
= PL0_R
, .type
= ARM_CP_NO_RAW
,
3200 .readfn
= aa64_dczid_read
},
3201 { .name
= "DC_ZVA", .state
= ARM_CP_STATE_AA64
,
3202 .opc0
= 1, .opc1
= 3, .crn
= 7, .crm
= 4, .opc2
= 1,
3203 .access
= PL0_W
, .type
= ARM_CP_DC_ZVA
,
3204 #ifndef CONFIG_USER_ONLY
3205 /* Avoid overhead of an access check that always passes in user-mode */
3206 .accessfn
= aa64_zva_access
,
3209 { .name
= "CURRENTEL", .state
= ARM_CP_STATE_AA64
,
3210 .opc0
= 3, .opc1
= 0, .opc2
= 2, .crn
= 4, .crm
= 2,
3211 .access
= PL1_R
, .type
= ARM_CP_CURRENTEL
},
3212 /* Cache ops: all NOPs since we don't emulate caches */
3213 { .name
= "IC_IALLUIS", .state
= ARM_CP_STATE_AA64
,
3214 .opc0
= 1, .opc1
= 0, .crn
= 7, .crm
= 1, .opc2
= 0,
3215 .access
= PL1_W
, .type
= ARM_CP_NOP
},
3216 { .name
= "IC_IALLU", .state
= ARM_CP_STATE_AA64
,
3217 .opc0
= 1, .opc1
= 0, .crn
= 7, .crm
= 5, .opc2
= 0,
3218 .access
= PL1_W
, .type
= ARM_CP_NOP
},
3219 { .name
= "IC_IVAU", .state
= ARM_CP_STATE_AA64
,
3220 .opc0
= 1, .opc1
= 3, .crn
= 7, .crm
= 5, .opc2
= 1,
3221 .access
= PL0_W
, .type
= ARM_CP_NOP
,
3222 .accessfn
= aa64_cacheop_access
},
3223 { .name
= "DC_IVAC", .state
= ARM_CP_STATE_AA64
,
3224 .opc0
= 1, .opc1
= 0, .crn
= 7, .crm
= 6, .opc2
= 1,
3225 .access
= PL1_W
, .type
= ARM_CP_NOP
},
3226 { .name
= "DC_ISW", .state
= ARM_CP_STATE_AA64
,
3227 .opc0
= 1, .opc1
= 0, .crn
= 7, .crm
= 6, .opc2
= 2,
3228 .access
= PL1_W
, .type
= ARM_CP_NOP
},
3229 { .name
= "DC_CVAC", .state
= ARM_CP_STATE_AA64
,
3230 .opc0
= 1, .opc1
= 3, .crn
= 7, .crm
= 10, .opc2
= 1,
3231 .access
= PL0_W
, .type
= ARM_CP_NOP
,
3232 .accessfn
= aa64_cacheop_access
},
3233 { .name
= "DC_CSW", .state
= ARM_CP_STATE_AA64
,
3234 .opc0
= 1, .opc1
= 0, .crn
= 7, .crm
= 10, .opc2
= 2,
3235 .access
= PL1_W
, .type
= ARM_CP_NOP
},
3236 { .name
= "DC_CVAU", .state
= ARM_CP_STATE_AA64
,
3237 .opc0
= 1, .opc1
= 3, .crn
= 7, .crm
= 11, .opc2
= 1,
3238 .access
= PL0_W
, .type
= ARM_CP_NOP
,
3239 .accessfn
= aa64_cacheop_access
},
3240 { .name
= "DC_CIVAC", .state
= ARM_CP_STATE_AA64
,
3241 .opc0
= 1, .opc1
= 3, .crn
= 7, .crm
= 14, .opc2
= 1,
3242 .access
= PL0_W
, .type
= ARM_CP_NOP
,
3243 .accessfn
= aa64_cacheop_access
},
3244 { .name
= "DC_CISW", .state
= ARM_CP_STATE_AA64
,
3245 .opc0
= 1, .opc1
= 0, .crn
= 7, .crm
= 14, .opc2
= 2,
3246 .access
= PL1_W
, .type
= ARM_CP_NOP
},
3247 /* TLBI operations */
3248 { .name
= "TLBI_VMALLE1IS", .state
= ARM_CP_STATE_AA64
,
3249 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 0,
3250 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3251 .writefn
= tlbi_aa64_vmalle1is_write
},
3252 { .name
= "TLBI_VAE1IS", .state
= ARM_CP_STATE_AA64
,
3253 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 1,
3254 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3255 .writefn
= tlbi_aa64_vae1is_write
},
3256 { .name
= "TLBI_ASIDE1IS", .state
= ARM_CP_STATE_AA64
,
3257 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 2,
3258 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3259 .writefn
= tlbi_aa64_vmalle1is_write
},
3260 { .name
= "TLBI_VAAE1IS", .state
= ARM_CP_STATE_AA64
,
3261 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 3,
3262 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3263 .writefn
= tlbi_aa64_vae1is_write
},
3264 { .name
= "TLBI_VALE1IS", .state
= ARM_CP_STATE_AA64
,
3265 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 5,
3266 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3267 .writefn
= tlbi_aa64_vae1is_write
},
3268 { .name
= "TLBI_VAALE1IS", .state
= ARM_CP_STATE_AA64
,
3269 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 7,
3270 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3271 .writefn
= tlbi_aa64_vae1is_write
},
3272 { .name
= "TLBI_VMALLE1", .state
= ARM_CP_STATE_AA64
,
3273 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 0,
3274 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3275 .writefn
= tlbi_aa64_vmalle1_write
},
3276 { .name
= "TLBI_VAE1", .state
= ARM_CP_STATE_AA64
,
3277 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 1,
3278 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3279 .writefn
= tlbi_aa64_vae1_write
},
3280 { .name
= "TLBI_ASIDE1", .state
= ARM_CP_STATE_AA64
,
3281 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 2,
3282 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3283 .writefn
= tlbi_aa64_vmalle1_write
},
3284 { .name
= "TLBI_VAAE1", .state
= ARM_CP_STATE_AA64
,
3285 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 3,
3286 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3287 .writefn
= tlbi_aa64_vae1_write
},
3288 { .name
= "TLBI_VALE1", .state
= ARM_CP_STATE_AA64
,
3289 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 5,
3290 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3291 .writefn
= tlbi_aa64_vae1_write
},
3292 { .name
= "TLBI_VAALE1", .state
= ARM_CP_STATE_AA64
,
3293 .opc0
= 1, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 7,
3294 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
3295 .writefn
= tlbi_aa64_vae1_write
},
3296 { .name
= "TLBI_IPAS2E1IS", .state
= ARM_CP_STATE_AA64
,
3297 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 0, .opc2
= 1,
3298 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
,
3299 .writefn
= tlbi_aa64_ipas2e1is_write
},
3300 { .name
= "TLBI_IPAS2LE1IS", .state
= ARM_CP_STATE_AA64
,
3301 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 0, .opc2
= 5,
3302 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
,
3303 .writefn
= tlbi_aa64_ipas2e1is_write
},
3304 { .name
= "TLBI_ALLE1IS", .state
= ARM_CP_STATE_AA64
,
3305 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 3, .opc2
= 4,
3306 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
,
3307 .writefn
= tlbi_aa64_alle1is_write
},
3308 { .name
= "TLBI_VMALLS12E1IS", .state
= ARM_CP_STATE_AA64
,
3309 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 3, .opc2
= 6,
3310 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
,
3311 .writefn
= tlbi_aa64_alle1is_write
},
3312 { .name
= "TLBI_IPAS2E1", .state
= ARM_CP_STATE_AA64
,
3313 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 4, .opc2
= 1,
3314 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
,
3315 .writefn
= tlbi_aa64_ipas2e1_write
},
3316 { .name
= "TLBI_IPAS2LE1", .state
= ARM_CP_STATE_AA64
,
3317 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 4, .opc2
= 5,
3318 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
,
3319 .writefn
= tlbi_aa64_ipas2e1_write
},
3320 { .name
= "TLBI_ALLE1", .state
= ARM_CP_STATE_AA64
,
3321 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 7, .opc2
= 4,
3322 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
,
3323 .writefn
= tlbi_aa64_alle1_write
},
3324 { .name
= "TLBI_VMALLS12E1", .state
= ARM_CP_STATE_AA64
,
3325 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 7, .opc2
= 6,
3326 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
,
3327 .writefn
= tlbi_aa64_alle1is_write
},
3328 #ifndef CONFIG_USER_ONLY
3329 /* 64 bit address translation operations */
3330 { .name
= "AT_S1E1R", .state
= ARM_CP_STATE_AA64
,
3331 .opc0
= 1, .opc1
= 0, .crn
= 7, .crm
= 8, .opc2
= 0,
3332 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3333 { .name
= "AT_S1E1W", .state
= ARM_CP_STATE_AA64
,
3334 .opc0
= 1, .opc1
= 0, .crn
= 7, .crm
= 8, .opc2
= 1,
3335 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3336 { .name
= "AT_S1E0R", .state
= ARM_CP_STATE_AA64
,
3337 .opc0
= 1, .opc1
= 0, .crn
= 7, .crm
= 8, .opc2
= 2,
3338 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3339 { .name
= "AT_S1E0W", .state
= ARM_CP_STATE_AA64
,
3340 .opc0
= 1, .opc1
= 0, .crn
= 7, .crm
= 8, .opc2
= 3,
3341 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3342 { .name
= "AT_S12E1R", .state
= ARM_CP_STATE_AA64
,
3343 .opc0
= 1, .opc1
= 4, .crn
= 7, .crm
= 8, .opc2
= 4,
3344 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3345 { .name
= "AT_S12E1W", .state
= ARM_CP_STATE_AA64
,
3346 .opc0
= 1, .opc1
= 4, .crn
= 7, .crm
= 8, .opc2
= 5,
3347 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3348 { .name
= "AT_S12E0R", .state
= ARM_CP_STATE_AA64
,
3349 .opc0
= 1, .opc1
= 4, .crn
= 7, .crm
= 8, .opc2
= 6,
3350 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3351 { .name
= "AT_S12E0W", .state
= ARM_CP_STATE_AA64
,
3352 .opc0
= 1, .opc1
= 4, .crn
= 7, .crm
= 8, .opc2
= 7,
3353 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3354 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */
3355 { .name
= "AT_S1E3R", .state
= ARM_CP_STATE_AA64
,
3356 .opc0
= 1, .opc1
= 6, .crn
= 7, .crm
= 8, .opc2
= 0,
3357 .access
= PL3_W
, .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3358 { .name
= "AT_S1E3W", .state
= ARM_CP_STATE_AA64
,
3359 .opc0
= 1, .opc1
= 6, .crn
= 7, .crm
= 8, .opc2
= 1,
3360 .access
= PL3_W
, .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3361 { .name
= "PAR_EL1", .state
= ARM_CP_STATE_AA64
,
3362 .type
= ARM_CP_ALIAS
,
3363 .opc0
= 3, .opc1
= 0, .crn
= 7, .crm
= 4, .opc2
= 0,
3364 .access
= PL1_RW
, .resetvalue
= 0,
3365 .fieldoffset
= offsetof(CPUARMState
, cp15
.par_el
[1]),
3366 .writefn
= par_write
},
3368 /* TLB invalidate last level of translation table walk */
3369 { .name
= "TLBIMVALIS", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 5,
3370 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbimva_is_write
},
3371 { .name
= "TLBIMVAALIS", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 3, .opc2
= 7,
3372 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
,
3373 .writefn
= tlbimvaa_is_write
},
3374 { .name
= "TLBIMVAL", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 5,
3375 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbimva_write
},
3376 { .name
= "TLBIMVAAL", .cp
= 15, .opc1
= 0, .crn
= 8, .crm
= 7, .opc2
= 7,
3377 .type
= ARM_CP_NO_RAW
, .access
= PL1_W
, .writefn
= tlbimvaa_write
},
3378 { .name
= "TLBIMVALH", .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 7, .opc2
= 5,
3379 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3380 .writefn
= tlbimva_hyp_write
},
3381 { .name
= "TLBIMVALHIS",
3382 .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 3, .opc2
= 5,
3383 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3384 .writefn
= tlbimva_hyp_is_write
},
3385 { .name
= "TLBIIPAS2",
3386 .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 4, .opc2
= 1,
3387 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3388 .writefn
= tlbiipas2_write
},
3389 { .name
= "TLBIIPAS2IS",
3390 .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 0, .opc2
= 1,
3391 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3392 .writefn
= tlbiipas2_is_write
},
3393 { .name
= "TLBIIPAS2L",
3394 .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 4, .opc2
= 5,
3395 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3396 .writefn
= tlbiipas2_write
},
3397 { .name
= "TLBIIPAS2LIS",
3398 .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 0, .opc2
= 5,
3399 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3400 .writefn
= tlbiipas2_is_write
},
3401 /* 32 bit cache operations */
3402 { .name
= "ICIALLUIS", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 1, .opc2
= 0,
3403 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3404 { .name
= "BPIALLUIS", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 1, .opc2
= 6,
3405 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3406 { .name
= "ICIALLU", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 5, .opc2
= 0,
3407 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3408 { .name
= "ICIMVAU", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 5, .opc2
= 1,
3409 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3410 { .name
= "BPIALL", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 5, .opc2
= 6,
3411 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3412 { .name
= "BPIMVA", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 5, .opc2
= 7,
3413 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3414 { .name
= "DCIMVAC", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 6, .opc2
= 1,
3415 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3416 { .name
= "DCISW", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 6, .opc2
= 2,
3417 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3418 { .name
= "DCCMVAC", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 10, .opc2
= 1,
3419 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3420 { .name
= "DCCSW", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 10, .opc2
= 2,
3421 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3422 { .name
= "DCCMVAU", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 11, .opc2
= 1,
3423 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3424 { .name
= "DCCIMVAC", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 14, .opc2
= 1,
3425 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3426 { .name
= "DCCISW", .cp
= 15, .opc1
= 0, .crn
= 7, .crm
= 14, .opc2
= 2,
3427 .type
= ARM_CP_NOP
, .access
= PL1_W
},
3428 /* MMU Domain access control / MPU write buffer control */
3429 { .name
= "DACR", .cp
= 15, .opc1
= 0, .crn
= 3, .crm
= 0, .opc2
= 0,
3430 .access
= PL1_RW
, .resetvalue
= 0,
3431 .writefn
= dacr_write
, .raw_writefn
= raw_write
,
3432 .bank_fieldoffsets
= { offsetoflow32(CPUARMState
, cp15
.dacr_s
),
3433 offsetoflow32(CPUARMState
, cp15
.dacr_ns
) } },
3434 { .name
= "ELR_EL1", .state
= ARM_CP_STATE_AA64
,
3435 .type
= ARM_CP_ALIAS
,
3436 .opc0
= 3, .opc1
= 0, .crn
= 4, .crm
= 0, .opc2
= 1,
3438 .fieldoffset
= offsetof(CPUARMState
, elr_el
[1]) },
3439 { .name
= "SPSR_EL1", .state
= ARM_CP_STATE_AA64
,
3440 .type
= ARM_CP_ALIAS
,
3441 .opc0
= 3, .opc1
= 0, .crn
= 4, .crm
= 0, .opc2
= 0,
3443 .fieldoffset
= offsetof(CPUARMState
, banked_spsr
[BANK_SVC
]) },
3444 /* We rely on the access checks not allowing the guest to write to the
3445 * state field when SPSel indicates that it's being used as the stack
3448 { .name
= "SP_EL0", .state
= ARM_CP_STATE_AA64
,
3449 .opc0
= 3, .opc1
= 0, .crn
= 4, .crm
= 1, .opc2
= 0,
3450 .access
= PL1_RW
, .accessfn
= sp_el0_access
,
3451 .type
= ARM_CP_ALIAS
,
3452 .fieldoffset
= offsetof(CPUARMState
, sp_el
[0]) },
3453 { .name
= "SP_EL1", .state
= ARM_CP_STATE_AA64
,
3454 .opc0
= 3, .opc1
= 4, .crn
= 4, .crm
= 1, .opc2
= 0,
3455 .access
= PL2_RW
, .type
= ARM_CP_ALIAS
,
3456 .fieldoffset
= offsetof(CPUARMState
, sp_el
[1]) },
3457 { .name
= "SPSel", .state
= ARM_CP_STATE_AA64
,
3458 .opc0
= 3, .opc1
= 0, .crn
= 4, .crm
= 2, .opc2
= 0,
3459 .type
= ARM_CP_NO_RAW
,
3460 .access
= PL1_RW
, .readfn
= spsel_read
, .writefn
= spsel_write
},
3461 { .name
= "FPEXC32_EL2", .state
= ARM_CP_STATE_AA64
,
3462 .opc0
= 3, .opc1
= 4, .crn
= 5, .crm
= 3, .opc2
= 0,
3463 .type
= ARM_CP_ALIAS
,
3464 .fieldoffset
= offsetof(CPUARMState
, vfp
.xregs
[ARM_VFP_FPEXC
]),
3465 .access
= PL2_RW
, .accessfn
= fpexc32_access
},
3466 { .name
= "DACR32_EL2", .state
= ARM_CP_STATE_AA64
,
3467 .opc0
= 3, .opc1
= 4, .crn
= 3, .crm
= 0, .opc2
= 0,
3468 .access
= PL2_RW
, .resetvalue
= 0,
3469 .writefn
= dacr_write
, .raw_writefn
= raw_write
,
3470 .fieldoffset
= offsetof(CPUARMState
, cp15
.dacr32_el2
) },
3471 { .name
= "IFSR32_EL2", .state
= ARM_CP_STATE_AA64
,
3472 .opc0
= 3, .opc1
= 4, .crn
= 5, .crm
= 0, .opc2
= 1,
3473 .access
= PL2_RW
, .resetvalue
= 0,
3474 .fieldoffset
= offsetof(CPUARMState
, cp15
.ifsr32_el2
) },
3475 { .name
= "SPSR_IRQ", .state
= ARM_CP_STATE_AA64
,
3476 .type
= ARM_CP_ALIAS
,
3477 .opc0
= 3, .opc1
= 4, .crn
= 4, .crm
= 3, .opc2
= 0,
3479 .fieldoffset
= offsetof(CPUARMState
, banked_spsr
[BANK_IRQ
]) },
3480 { .name
= "SPSR_ABT", .state
= ARM_CP_STATE_AA64
,
3481 .type
= ARM_CP_ALIAS
,
3482 .opc0
= 3, .opc1
= 4, .crn
= 4, .crm
= 3, .opc2
= 1,
3484 .fieldoffset
= offsetof(CPUARMState
, banked_spsr
[BANK_ABT
]) },
3485 { .name
= "SPSR_UND", .state
= ARM_CP_STATE_AA64
,
3486 .type
= ARM_CP_ALIAS
,
3487 .opc0
= 3, .opc1
= 4, .crn
= 4, .crm
= 3, .opc2
= 2,
3489 .fieldoffset
= offsetof(CPUARMState
, banked_spsr
[BANK_UND
]) },
3490 { .name
= "SPSR_FIQ", .state
= ARM_CP_STATE_AA64
,
3491 .type
= ARM_CP_ALIAS
,
3492 .opc0
= 3, .opc1
= 4, .crn
= 4, .crm
= 3, .opc2
= 3,
3494 .fieldoffset
= offsetof(CPUARMState
, banked_spsr
[BANK_FIQ
]) },
3495 { .name
= "MDCR_EL3", .state
= ARM_CP_STATE_AA64
,
3496 .opc0
= 3, .opc1
= 6, .crn
= 1, .crm
= 3, .opc2
= 1,
3498 .access
= PL3_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.mdcr_el3
) },
3499 { .name
= "SDCR", .type
= ARM_CP_ALIAS
,
3500 .cp
= 15, .opc1
= 0, .crn
= 1, .crm
= 3, .opc2
= 1,
3501 .access
= PL1_RW
, .accessfn
= access_trap_aa32s_el1
,
3502 .writefn
= sdcr_write
,
3503 .fieldoffset
= offsetoflow32(CPUARMState
, cp15
.mdcr_el3
) },
3507 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */
3508 static const ARMCPRegInfo el3_no_el2_cp_reginfo
[] = {
3509 { .name
= "VBAR_EL2", .state
= ARM_CP_STATE_AA64
,
3510 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 0, .opc2
= 0,
3512 .readfn
= arm_cp_read_zero
, .writefn
= arm_cp_write_ignore
},
3513 { .name
= "HCR_EL2", .state
= ARM_CP_STATE_AA64
,
3514 .type
= ARM_CP_NO_RAW
,
3515 .opc0
= 3, .opc1
= 4, .crn
= 1, .crm
= 1, .opc2
= 0,
3517 .readfn
= arm_cp_read_zero
, .writefn
= arm_cp_write_ignore
},
3518 { .name
= "CPTR_EL2", .state
= ARM_CP_STATE_BOTH
,
3519 .opc0
= 3, .opc1
= 4, .crn
= 1, .crm
= 1, .opc2
= 2,
3520 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3521 { .name
= "MAIR_EL2", .state
= ARM_CP_STATE_BOTH
,
3522 .opc0
= 3, .opc1
= 4, .crn
= 10, .crm
= 2, .opc2
= 0,
3523 .access
= PL2_RW
, .type
= ARM_CP_CONST
,
3525 { .name
= "HMAIR1", .state
= ARM_CP_STATE_AA32
,
3526 .opc1
= 4, .crn
= 10, .crm
= 2, .opc2
= 1,
3527 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3528 { .name
= "AMAIR_EL2", .state
= ARM_CP_STATE_BOTH
,
3529 .opc0
= 3, .opc1
= 4, .crn
= 10, .crm
= 3, .opc2
= 0,
3530 .access
= PL2_RW
, .type
= ARM_CP_CONST
,
3532 { .name
= "HMAIR1", .state
= ARM_CP_STATE_AA32
,
3533 .opc1
= 4, .crn
= 10, .crm
= 3, .opc2
= 1,
3534 .access
= PL2_RW
, .type
= ARM_CP_CONST
,
3536 { .name
= "AFSR0_EL2", .state
= ARM_CP_STATE_BOTH
,
3537 .opc0
= 3, .opc1
= 4, .crn
= 5, .crm
= 1, .opc2
= 0,
3538 .access
= PL2_RW
, .type
= ARM_CP_CONST
,
3540 { .name
= "AFSR1_EL2", .state
= ARM_CP_STATE_BOTH
,
3541 .opc0
= 3, .opc1
= 4, .crn
= 5, .crm
= 1, .opc2
= 1,
3542 .access
= PL2_RW
, .type
= ARM_CP_CONST
,
3544 { .name
= "TCR_EL2", .state
= ARM_CP_STATE_BOTH
,
3545 .opc0
= 3, .opc1
= 4, .crn
= 2, .crm
= 0, .opc2
= 2,
3546 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3547 { .name
= "VTCR_EL2", .state
= ARM_CP_STATE_BOTH
,
3548 .opc0
= 3, .opc1
= 4, .crn
= 2, .crm
= 1, .opc2
= 2,
3549 .access
= PL2_RW
, .accessfn
= access_el3_aa32ns_aa64any
,
3550 .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3551 { .name
= "VTTBR", .state
= ARM_CP_STATE_AA32
,
3552 .cp
= 15, .opc1
= 6, .crm
= 2,
3553 .access
= PL2_RW
, .accessfn
= access_el3_aa32ns
,
3554 .type
= ARM_CP_CONST
| ARM_CP_64BIT
, .resetvalue
= 0 },
3555 { .name
= "VTTBR_EL2", .state
= ARM_CP_STATE_AA64
,
3556 .opc0
= 3, .opc1
= 4, .crn
= 2, .crm
= 1, .opc2
= 0,
3557 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3558 { .name
= "SCTLR_EL2", .state
= ARM_CP_STATE_BOTH
,
3559 .opc0
= 3, .opc1
= 4, .crn
= 1, .crm
= 0, .opc2
= 0,
3560 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3561 { .name
= "TPIDR_EL2", .state
= ARM_CP_STATE_BOTH
,
3562 .opc0
= 3, .opc1
= 4, .crn
= 13, .crm
= 0, .opc2
= 2,
3563 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3564 { .name
= "TTBR0_EL2", .state
= ARM_CP_STATE_AA64
,
3565 .opc0
= 3, .opc1
= 4, .crn
= 2, .crm
= 0, .opc2
= 0,
3566 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3567 { .name
= "HTTBR", .cp
= 15, .opc1
= 4, .crm
= 2,
3568 .access
= PL2_RW
, .type
= ARM_CP_64BIT
| ARM_CP_CONST
,
3570 { .name
= "CNTHCTL_EL2", .state
= ARM_CP_STATE_BOTH
,
3571 .opc0
= 3, .opc1
= 4, .crn
= 14, .crm
= 1, .opc2
= 0,
3572 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3573 { .name
= "CNTVOFF_EL2", .state
= ARM_CP_STATE_AA64
,
3574 .opc0
= 3, .opc1
= 4, .crn
= 14, .crm
= 0, .opc2
= 3,
3575 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3576 { .name
= "CNTVOFF", .cp
= 15, .opc1
= 4, .crm
= 14,
3577 .access
= PL2_RW
, .type
= ARM_CP_64BIT
| ARM_CP_CONST
,
3579 { .name
= "CNTHP_CVAL_EL2", .state
= ARM_CP_STATE_AA64
,
3580 .opc0
= 3, .opc1
= 4, .crn
= 14, .crm
= 2, .opc2
= 2,
3581 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3582 { .name
= "CNTHP_CVAL", .cp
= 15, .opc1
= 6, .crm
= 14,
3583 .access
= PL2_RW
, .type
= ARM_CP_64BIT
| ARM_CP_CONST
,
3585 { .name
= "CNTHP_TVAL_EL2", .state
= ARM_CP_STATE_BOTH
,
3586 .opc0
= 3, .opc1
= 4, .crn
= 14, .crm
= 2, .opc2
= 0,
3587 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3588 { .name
= "CNTHP_CTL_EL2", .state
= ARM_CP_STATE_BOTH
,
3589 .opc0
= 3, .opc1
= 4, .crn
= 14, .crm
= 2, .opc2
= 1,
3590 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3591 { .name
= "MDCR_EL2", .state
= ARM_CP_STATE_BOTH
,
3592 .opc0
= 3, .opc1
= 4, .crn
= 1, .crm
= 1, .opc2
= 1,
3593 .access
= PL2_RW
, .accessfn
= access_tda
,
3594 .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3595 { .name
= "HPFAR_EL2", .state
= ARM_CP_STATE_BOTH
,
3596 .opc0
= 3, .opc1
= 4, .crn
= 6, .crm
= 0, .opc2
= 4,
3597 .access
= PL2_RW
, .accessfn
= access_el3_aa32ns_aa64any
,
3598 .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3599 { .name
= "HSTR_EL2", .state
= ARM_CP_STATE_BOTH
,
3600 .opc0
= 3, .opc1
= 4, .crn
= 1, .crm
= 1, .opc2
= 3,
3601 .access
= PL2_RW
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
3605 static void hcr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
, uint64_t value
)
3607 ARMCPU
*cpu
= arm_env_get_cpu(env
);
3608 uint64_t valid_mask
= HCR_MASK
;
3610 if (arm_feature(env
, ARM_FEATURE_EL3
)) {
3611 valid_mask
&= ~HCR_HCD
;
3613 valid_mask
&= ~HCR_TSC
;
3616 /* Clear RES0 bits. */
3617 value
&= valid_mask
;
3619 /* These bits change the MMU setup:
3620 * HCR_VM enables stage 2 translation
3621 * HCR_PTW forbids certain page-table setups
3622 * HCR_DC Disables stage1 and enables stage2 translation
3624 if ((raw_read(env
, ri
) ^ value
) & (HCR_VM
| HCR_PTW
| HCR_DC
)) {
3625 tlb_flush(CPU(cpu
), 1);
3627 raw_write(env
, ri
, value
);
3630 static const ARMCPRegInfo el2_cp_reginfo
[] = {
3631 { .name
= "HCR_EL2", .state
= ARM_CP_STATE_AA64
,
3632 .opc0
= 3, .opc1
= 4, .crn
= 1, .crm
= 1, .opc2
= 0,
3633 .access
= PL2_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.hcr_el2
),
3634 .writefn
= hcr_write
},
3635 { .name
= "ELR_EL2", .state
= ARM_CP_STATE_AA64
,
3636 .type
= ARM_CP_ALIAS
,
3637 .opc0
= 3, .opc1
= 4, .crn
= 4, .crm
= 0, .opc2
= 1,
3639 .fieldoffset
= offsetof(CPUARMState
, elr_el
[2]) },
3640 { .name
= "ESR_EL2", .state
= ARM_CP_STATE_AA64
,
3641 .opc0
= 3, .opc1
= 4, .crn
= 5, .crm
= 2, .opc2
= 0,
3642 .access
= PL2_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.esr_el
[2]) },
3643 { .name
= "FAR_EL2", .state
= ARM_CP_STATE_AA64
,
3644 .opc0
= 3, .opc1
= 4, .crn
= 6, .crm
= 0, .opc2
= 0,
3645 .access
= PL2_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.far_el
[2]) },
3646 { .name
= "SPSR_EL2", .state
= ARM_CP_STATE_AA64
,
3647 .type
= ARM_CP_ALIAS
,
3648 .opc0
= 3, .opc1
= 4, .crn
= 4, .crm
= 0, .opc2
= 0,
3650 .fieldoffset
= offsetof(CPUARMState
, banked_spsr
[BANK_HYP
]) },
3651 { .name
= "VBAR_EL2", .state
= ARM_CP_STATE_AA64
,
3652 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 0, .opc2
= 0,
3653 .access
= PL2_RW
, .writefn
= vbar_write
,
3654 .fieldoffset
= offsetof(CPUARMState
, cp15
.vbar_el
[2]),
3656 { .name
= "SP_EL2", .state
= ARM_CP_STATE_AA64
,
3657 .opc0
= 3, .opc1
= 6, .crn
= 4, .crm
= 1, .opc2
= 0,
3658 .access
= PL3_RW
, .type
= ARM_CP_ALIAS
,
3659 .fieldoffset
= offsetof(CPUARMState
, sp_el
[2]) },
3660 { .name
= "CPTR_EL2", .state
= ARM_CP_STATE_BOTH
,
3661 .opc0
= 3, .opc1
= 4, .crn
= 1, .crm
= 1, .opc2
= 2,
3662 .access
= PL2_RW
, .accessfn
= cptr_access
, .resetvalue
= 0,
3663 .fieldoffset
= offsetof(CPUARMState
, cp15
.cptr_el
[2]) },
3664 { .name
= "MAIR_EL2", .state
= ARM_CP_STATE_BOTH
,
3665 .opc0
= 3, .opc1
= 4, .crn
= 10, .crm
= 2, .opc2
= 0,
3666 .access
= PL2_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.mair_el
[2]),
3668 { .name
= "HMAIR1", .state
= ARM_CP_STATE_AA32
,
3669 .opc1
= 4, .crn
= 10, .crm
= 2, .opc2
= 1,
3670 .access
= PL2_RW
, .type
= ARM_CP_ALIAS
,
3671 .fieldoffset
= offsetofhigh32(CPUARMState
, cp15
.mair_el
[2]) },
3672 { .name
= "AMAIR_EL2", .state
= ARM_CP_STATE_BOTH
,
3673 .opc0
= 3, .opc1
= 4, .crn
= 10, .crm
= 3, .opc2
= 0,
3674 .access
= PL2_RW
, .type
= ARM_CP_CONST
,
3676 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
3677 { .name
= "HMAIR1", .state
= ARM_CP_STATE_AA32
,
3678 .opc1
= 4, .crn
= 10, .crm
= 3, .opc2
= 1,
3679 .access
= PL2_RW
, .type
= ARM_CP_CONST
,
3681 { .name
= "AFSR0_EL2", .state
= ARM_CP_STATE_BOTH
,
3682 .opc0
= 3, .opc1
= 4, .crn
= 5, .crm
= 1, .opc2
= 0,
3683 .access
= PL2_RW
, .type
= ARM_CP_CONST
,
3685 { .name
= "AFSR1_EL2", .state
= ARM_CP_STATE_BOTH
,
3686 .opc0
= 3, .opc1
= 4, .crn
= 5, .crm
= 1, .opc2
= 1,
3687 .access
= PL2_RW
, .type
= ARM_CP_CONST
,
3689 { .name
= "TCR_EL2", .state
= ARM_CP_STATE_BOTH
,
3690 .opc0
= 3, .opc1
= 4, .crn
= 2, .crm
= 0, .opc2
= 2,
3692 /* no .writefn needed as this can't cause an ASID change;
3693 * no .raw_writefn or .resetfn needed as we never use mask/base_mask
3695 .fieldoffset
= offsetof(CPUARMState
, cp15
.tcr_el
[2]) },
3696 { .name
= "VTCR", .state
= ARM_CP_STATE_AA32
,
3697 .cp
= 15, .opc1
= 4, .crn
= 2, .crm
= 1, .opc2
= 2,
3698 .type
= ARM_CP_ALIAS
,
3699 .access
= PL2_RW
, .accessfn
= access_el3_aa32ns
,
3700 .fieldoffset
= offsetof(CPUARMState
, cp15
.vtcr_el2
) },
3701 { .name
= "VTCR_EL2", .state
= ARM_CP_STATE_AA64
,
3702 .opc0
= 3, .opc1
= 4, .crn
= 2, .crm
= 1, .opc2
= 2,
3704 /* no .writefn needed as this can't cause an ASID change;
3705 * no .raw_writefn or .resetfn needed as we never use mask/base_mask
3707 .fieldoffset
= offsetof(CPUARMState
, cp15
.vtcr_el2
) },
3708 { .name
= "VTTBR", .state
= ARM_CP_STATE_AA32
,
3709 .cp
= 15, .opc1
= 6, .crm
= 2,
3710 .type
= ARM_CP_64BIT
| ARM_CP_ALIAS
,
3711 .access
= PL2_RW
, .accessfn
= access_el3_aa32ns
,
3712 .fieldoffset
= offsetof(CPUARMState
, cp15
.vttbr_el2
),
3713 .writefn
= vttbr_write
},
3714 { .name
= "VTTBR_EL2", .state
= ARM_CP_STATE_AA64
,
3715 .opc0
= 3, .opc1
= 4, .crn
= 2, .crm
= 1, .opc2
= 0,
3716 .access
= PL2_RW
, .writefn
= vttbr_write
,
3717 .fieldoffset
= offsetof(CPUARMState
, cp15
.vttbr_el2
) },
3718 { .name
= "SCTLR_EL2", .state
= ARM_CP_STATE_BOTH
,
3719 .opc0
= 3, .opc1
= 4, .crn
= 1, .crm
= 0, .opc2
= 0,
3720 .access
= PL2_RW
, .raw_writefn
= raw_write
, .writefn
= sctlr_write
,
3721 .fieldoffset
= offsetof(CPUARMState
, cp15
.sctlr_el
[2]) },
3722 { .name
= "TPIDR_EL2", .state
= ARM_CP_STATE_BOTH
,
3723 .opc0
= 3, .opc1
= 4, .crn
= 13, .crm
= 0, .opc2
= 2,
3724 .access
= PL2_RW
, .resetvalue
= 0,
3725 .fieldoffset
= offsetof(CPUARMState
, cp15
.tpidr_el
[2]) },
3726 { .name
= "TTBR0_EL2", .state
= ARM_CP_STATE_AA64
,
3727 .opc0
= 3, .opc1
= 4, .crn
= 2, .crm
= 0, .opc2
= 0,
3728 .access
= PL2_RW
, .resetvalue
= 0,
3729 .fieldoffset
= offsetof(CPUARMState
, cp15
.ttbr0_el
[2]) },
3730 { .name
= "HTTBR", .cp
= 15, .opc1
= 4, .crm
= 2,
3731 .access
= PL2_RW
, .type
= ARM_CP_64BIT
| ARM_CP_ALIAS
,
3732 .fieldoffset
= offsetof(CPUARMState
, cp15
.ttbr0_el
[2]) },
3733 { .name
= "TLBIALLNSNH",
3734 .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 7, .opc2
= 4,
3735 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3736 .writefn
= tlbiall_nsnh_write
},
3737 { .name
= "TLBIALLNSNHIS",
3738 .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 3, .opc2
= 4,
3739 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3740 .writefn
= tlbiall_nsnh_is_write
},
3741 { .name
= "TLBIALLH", .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 7, .opc2
= 0,
3742 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3743 .writefn
= tlbiall_hyp_write
},
3744 { .name
= "TLBIALLHIS", .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 3, .opc2
= 0,
3745 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3746 .writefn
= tlbiall_hyp_is_write
},
3747 { .name
= "TLBIMVAH", .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 7, .opc2
= 1,
3748 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3749 .writefn
= tlbimva_hyp_write
},
3750 { .name
= "TLBIMVAHIS", .cp
= 15, .opc1
= 4, .crn
= 8, .crm
= 3, .opc2
= 1,
3751 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3752 .writefn
= tlbimva_hyp_is_write
},
3753 { .name
= "TLBI_ALLE2", .state
= ARM_CP_STATE_AA64
,
3754 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 7, .opc2
= 0,
3755 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3756 .writefn
= tlbi_aa64_alle2_write
},
3757 { .name
= "TLBI_VAE2", .state
= ARM_CP_STATE_AA64
,
3758 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 7, .opc2
= 1,
3759 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3760 .writefn
= tlbi_aa64_vae2_write
},
3761 { .name
= "TLBI_VALE2", .state
= ARM_CP_STATE_AA64
,
3762 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 7, .opc2
= 5,
3763 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
,
3764 .writefn
= tlbi_aa64_vae2_write
},
3765 { .name
= "TLBI_ALLE2IS", .state
= ARM_CP_STATE_AA64
,
3766 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 3, .opc2
= 0,
3767 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
,
3768 .writefn
= tlbi_aa64_alle2is_write
},
3769 { .name
= "TLBI_VAE2IS", .state
= ARM_CP_STATE_AA64
,
3770 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 3, .opc2
= 1,
3771 .type
= ARM_CP_NO_RAW
, .access
= PL2_W
,
3772 .writefn
= tlbi_aa64_vae2is_write
},
3773 { .name
= "TLBI_VALE2IS", .state
= ARM_CP_STATE_AA64
,
3774 .opc0
= 1, .opc1
= 4, .crn
= 8, .crm
= 3, .opc2
= 5,
3775 .access
= PL2_W
, .type
= ARM_CP_NO_RAW
,
3776 .writefn
= tlbi_aa64_vae2is_write
},
3777 #ifndef CONFIG_USER_ONLY
3778 /* Unlike the other EL2-related AT operations, these must
3779 * UNDEF from EL3 if EL2 is not implemented, which is why we
3780 * define them here rather than with the rest of the AT ops.
3782 { .name
= "AT_S1E2R", .state
= ARM_CP_STATE_AA64
,
3783 .opc0
= 1, .opc1
= 4, .crn
= 7, .crm
= 8, .opc2
= 0,
3784 .access
= PL2_W
, .accessfn
= at_s1e2_access
,
3785 .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3786 { .name
= "AT_S1E2W", .state
= ARM_CP_STATE_AA64
,
3787 .opc0
= 1, .opc1
= 4, .crn
= 7, .crm
= 8, .opc2
= 1,
3788 .access
= PL2_W
, .accessfn
= at_s1e2_access
,
3789 .type
= ARM_CP_NO_RAW
, .writefn
= ats_write64
},
3790 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
3791 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
3792 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
3793 * to behave as if SCR.NS was 1.
3795 { .name
= "ATS1HR", .cp
= 15, .opc1
= 4, .crn
= 7, .crm
= 8, .opc2
= 0,
3797 .writefn
= ats1h_write
, .type
= ARM_CP_NO_RAW
},
3798 { .name
= "ATS1HW", .cp
= 15, .opc1
= 4, .crn
= 7, .crm
= 8, .opc2
= 1,
3800 .writefn
= ats1h_write
, .type
= ARM_CP_NO_RAW
},
3801 { .name
= "CNTHCTL_EL2", .state
= ARM_CP_STATE_BOTH
,
3802 .opc0
= 3, .opc1
= 4, .crn
= 14, .crm
= 1, .opc2
= 0,
3803 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the
3804 * reset values as IMPDEF. We choose to reset to 3 to comply with
3805 * both ARMv7 and ARMv8.
3807 .access
= PL2_RW
, .resetvalue
= 3,
3808 .fieldoffset
= offsetof(CPUARMState
, cp15
.cnthctl_el2
) },
3809 { .name
= "CNTVOFF_EL2", .state
= ARM_CP_STATE_AA64
,
3810 .opc0
= 3, .opc1
= 4, .crn
= 14, .crm
= 0, .opc2
= 3,
3811 .access
= PL2_RW
, .type
= ARM_CP_IO
, .resetvalue
= 0,
3812 .writefn
= gt_cntvoff_write
,
3813 .fieldoffset
= offsetof(CPUARMState
, cp15
.cntvoff_el2
) },
3814 { .name
= "CNTVOFF", .cp
= 15, .opc1
= 4, .crm
= 14,
3815 .access
= PL2_RW
, .type
= ARM_CP_64BIT
| ARM_CP_ALIAS
| ARM_CP_IO
,
3816 .writefn
= gt_cntvoff_write
,
3817 .fieldoffset
= offsetof(CPUARMState
, cp15
.cntvoff_el2
) },
3818 { .name
= "CNTHP_CVAL_EL2", .state
= ARM_CP_STATE_AA64
,
3819 .opc0
= 3, .opc1
= 4, .crn
= 14, .crm
= 2, .opc2
= 2,
3820 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_HYP
].cval
),
3821 .type
= ARM_CP_IO
, .access
= PL2_RW
,
3822 .writefn
= gt_hyp_cval_write
, .raw_writefn
= raw_write
},
3823 { .name
= "CNTHP_CVAL", .cp
= 15, .opc1
= 6, .crm
= 14,
3824 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_HYP
].cval
),
3825 .access
= PL2_RW
, .type
= ARM_CP_64BIT
| ARM_CP_IO
,
3826 .writefn
= gt_hyp_cval_write
, .raw_writefn
= raw_write
},
3827 { .name
= "CNTHP_TVAL_EL2", .state
= ARM_CP_STATE_BOTH
,
3828 .opc0
= 3, .opc1
= 4, .crn
= 14, .crm
= 2, .opc2
= 0,
3829 .type
= ARM_CP_NO_RAW
| ARM_CP_IO
, .access
= PL2_RW
,
3830 .resetfn
= gt_hyp_timer_reset
,
3831 .readfn
= gt_hyp_tval_read
, .writefn
= gt_hyp_tval_write
},
3832 { .name
= "CNTHP_CTL_EL2", .state
= ARM_CP_STATE_BOTH
,
3834 .opc0
= 3, .opc1
= 4, .crn
= 14, .crm
= 2, .opc2
= 1,
3836 .fieldoffset
= offsetof(CPUARMState
, cp15
.c14_timer
[GTIMER_HYP
].ctl
),
3838 .writefn
= gt_hyp_ctl_write
, .raw_writefn
= raw_write
},
3840 /* The only field of MDCR_EL2 that has a defined architectural reset value
3841 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we
3842 * don't impelment any PMU event counters, so using zero as a reset
3843 * value for MDCR_EL2 is okay
3845 { .name
= "MDCR_EL2", .state
= ARM_CP_STATE_BOTH
,
3846 .opc0
= 3, .opc1
= 4, .crn
= 1, .crm
= 1, .opc2
= 1,
3847 .access
= PL2_RW
, .resetvalue
= 0,
3848 .fieldoffset
= offsetof(CPUARMState
, cp15
.mdcr_el2
), },
3849 { .name
= "HPFAR", .state
= ARM_CP_STATE_AA32
,
3850 .cp
= 15, .opc1
= 4, .crn
= 6, .crm
= 0, .opc2
= 4,
3851 .access
= PL2_RW
, .accessfn
= access_el3_aa32ns
,
3852 .fieldoffset
= offsetof(CPUARMState
, cp15
.hpfar_el2
) },
3853 { .name
= "HPFAR_EL2", .state
= ARM_CP_STATE_AA64
,
3854 .opc0
= 3, .opc1
= 4, .crn
= 6, .crm
= 0, .opc2
= 4,
3856 .fieldoffset
= offsetof(CPUARMState
, cp15
.hpfar_el2
) },
3857 { .name
= "HSTR_EL2", .state
= ARM_CP_STATE_BOTH
,
3858 .cp
= 15, .opc0
= 3, .opc1
= 4, .crn
= 1, .crm
= 1, .opc2
= 3,
3860 .fieldoffset
= offsetof(CPUARMState
, cp15
.hstr_el2
) },
3864 static CPAccessResult
nsacr_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3867 /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2.
3868 * At Secure EL1 it traps to EL3.
3870 if (arm_current_el(env
) == 3) {
3871 return CP_ACCESS_OK
;
3873 if (arm_is_secure_below_el3(env
)) {
3874 return CP_ACCESS_TRAP_EL3
;
3876 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */
3878 return CP_ACCESS_OK
;
3880 return CP_ACCESS_TRAP_UNCATEGORIZED
;
3883 static const ARMCPRegInfo el3_cp_reginfo
[] = {
3884 { .name
= "SCR_EL3", .state
= ARM_CP_STATE_AA64
,
3885 .opc0
= 3, .opc1
= 6, .crn
= 1, .crm
= 1, .opc2
= 0,
3886 .access
= PL3_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.scr_el3
),
3887 .resetvalue
= 0, .writefn
= scr_write
},
3888 { .name
= "SCR", .type
= ARM_CP_ALIAS
,
3889 .cp
= 15, .opc1
= 0, .crn
= 1, .crm
= 1, .opc2
= 0,
3890 .access
= PL1_RW
, .accessfn
= access_trap_aa32s_el1
,
3891 .fieldoffset
= offsetoflow32(CPUARMState
, cp15
.scr_el3
),
3892 .writefn
= scr_write
},
3893 { .name
= "SDER32_EL3", .state
= ARM_CP_STATE_AA64
,
3894 .opc0
= 3, .opc1
= 6, .crn
= 1, .crm
= 1, .opc2
= 1,
3895 .access
= PL3_RW
, .resetvalue
= 0,
3896 .fieldoffset
= offsetof(CPUARMState
, cp15
.sder
) },
3898 .cp
= 15, .opc1
= 0, .crn
= 1, .crm
= 1, .opc2
= 1,
3899 .access
= PL3_RW
, .resetvalue
= 0,
3900 .fieldoffset
= offsetoflow32(CPUARMState
, cp15
.sder
) },
3901 { .name
= "MVBAR", .cp
= 15, .opc1
= 0, .crn
= 12, .crm
= 0, .opc2
= 1,
3902 .access
= PL1_RW
, .accessfn
= access_trap_aa32s_el1
,
3903 .writefn
= vbar_write
, .resetvalue
= 0,
3904 .fieldoffset
= offsetof(CPUARMState
, cp15
.mvbar
) },
3905 { .name
= "TTBR0_EL3", .state
= ARM_CP_STATE_AA64
,
3906 .opc0
= 3, .opc1
= 6, .crn
= 2, .crm
= 0, .opc2
= 0,
3907 .access
= PL3_RW
, .writefn
= vmsa_ttbr_write
, .resetvalue
= 0,
3908 .fieldoffset
= offsetof(CPUARMState
, cp15
.ttbr0_el
[3]) },
3909 { .name
= "TCR_EL3", .state
= ARM_CP_STATE_AA64
,
3910 .opc0
= 3, .opc1
= 6, .crn
= 2, .crm
= 0, .opc2
= 2,
3912 /* no .writefn needed as this can't cause an ASID change;
3913 * we must provide a .raw_writefn and .resetfn because we handle
3914 * reset and migration for the AArch32 TTBCR(S), which might be
3915 * using mask and base_mask.
3917 .resetfn
= vmsa_ttbcr_reset
, .raw_writefn
= vmsa_ttbcr_raw_write
,
3918 .fieldoffset
= offsetof(CPUARMState
, cp15
.tcr_el
[3]) },
3919 { .name
= "ELR_EL3", .state
= ARM_CP_STATE_AA64
,
3920 .type
= ARM_CP_ALIAS
,
3921 .opc0
= 3, .opc1
= 6, .crn
= 4, .crm
= 0, .opc2
= 1,
3923 .fieldoffset
= offsetof(CPUARMState
, elr_el
[3]) },
3924 { .name
= "ESR_EL3", .state
= ARM_CP_STATE_AA64
,
3925 .opc0
= 3, .opc1
= 6, .crn
= 5, .crm
= 2, .opc2
= 0,
3926 .access
= PL3_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.esr_el
[3]) },
3927 { .name
= "FAR_EL3", .state
= ARM_CP_STATE_AA64
,
3928 .opc0
= 3, .opc1
= 6, .crn
= 6, .crm
= 0, .opc2
= 0,
3929 .access
= PL3_RW
, .fieldoffset
= offsetof(CPUARMState
, cp15
.far_el
[3]) },
3930 { .name
= "SPSR_EL3", .state
= ARM_CP_STATE_AA64
,
3931 .type
= ARM_CP_ALIAS
,
3932 .opc0
= 3, .opc1
= 6, .crn
= 4, .crm
= 0, .opc2
= 0,
3934 .fieldoffset
= offsetof(CPUARMState
, banked_spsr
[BANK_MON
]) },
3935 { .name
= "VBAR_EL3", .state
= ARM_CP_STATE_AA64
,
3936 .opc0
= 3, .opc1
= 6, .crn
= 12, .crm
= 0, .opc2
= 0,
3937 .access
= PL3_RW
, .writefn
= vbar_write
,
3938 .fieldoffset
= offsetof(CPUARMState
, cp15
.vbar_el
[3]),
3940 { .name
= "CPTR_EL3", .state
= ARM_CP_STATE_AA64
,
3941 .opc0
= 3, .opc1
= 6, .crn
= 1, .crm
= 1, .opc2
= 2,
3942 .access
= PL3_RW
, .accessfn
= cptr_access
, .resetvalue
= 0,
3943 .fieldoffset
= offsetof(CPUARMState
, cp15
.cptr_el
[3]) },
3944 { .name
= "TPIDR_EL3", .state
= ARM_CP_STATE_AA64
,
3945 .opc0
= 3, .opc1
= 6, .crn
= 13, .crm
= 0, .opc2
= 2,
3946 .access
= PL3_RW
, .resetvalue
= 0,
3947 .fieldoffset
= offsetof(CPUARMState
, cp15
.tpidr_el
[3]) },
3948 { .name
= "AMAIR_EL3", .state
= ARM_CP_STATE_AA64
,
3949 .opc0
= 3, .opc1
= 6, .crn
= 10, .crm
= 3, .opc2
= 0,
3950 .access
= PL3_RW
, .type
= ARM_CP_CONST
,
3952 { .name
= "AFSR0_EL3", .state
= ARM_CP_STATE_BOTH
,
3953 .opc0
= 3, .opc1
= 6, .crn
= 5, .crm
= 1, .opc2
= 0,
3954 .access
= PL3_RW
, .type
= ARM_CP_CONST
,
3956 { .name
= "AFSR1_EL3", .state
= ARM_CP_STATE_BOTH
,
3957 .opc0
= 3, .opc1
= 6, .crn
= 5, .crm
= 1, .opc2
= 1,
3958 .access
= PL3_RW
, .type
= ARM_CP_CONST
,
3960 { .name
= "TLBI_ALLE3IS", .state
= ARM_CP_STATE_AA64
,
3961 .opc0
= 1, .opc1
= 6, .crn
= 8, .crm
= 3, .opc2
= 0,
3962 .access
= PL3_W
, .type
= ARM_CP_NO_RAW
,
3963 .writefn
= tlbi_aa64_alle3is_write
},
3964 { .name
= "TLBI_VAE3IS", .state
= ARM_CP_STATE_AA64
,
3965 .opc0
= 1, .opc1
= 6, .crn
= 8, .crm
= 3, .opc2
= 1,
3966 .access
= PL3_W
, .type
= ARM_CP_NO_RAW
,
3967 .writefn
= tlbi_aa64_vae3is_write
},
3968 { .name
= "TLBI_VALE3IS", .state
= ARM_CP_STATE_AA64
,
3969 .opc0
= 1, .opc1
= 6, .crn
= 8, .crm
= 3, .opc2
= 5,
3970 .access
= PL3_W
, .type
= ARM_CP_NO_RAW
,
3971 .writefn
= tlbi_aa64_vae3is_write
},
3972 { .name
= "TLBI_ALLE3", .state
= ARM_CP_STATE_AA64
,
3973 .opc0
= 1, .opc1
= 6, .crn
= 8, .crm
= 7, .opc2
= 0,
3974 .access
= PL3_W
, .type
= ARM_CP_NO_RAW
,
3975 .writefn
= tlbi_aa64_alle3_write
},
3976 { .name
= "TLBI_VAE3", .state
= ARM_CP_STATE_AA64
,
3977 .opc0
= 1, .opc1
= 6, .crn
= 8, .crm
= 7, .opc2
= 1,
3978 .access
= PL3_W
, .type
= ARM_CP_NO_RAW
,
3979 .writefn
= tlbi_aa64_vae3_write
},
3980 { .name
= "TLBI_VALE3", .state
= ARM_CP_STATE_AA64
,
3981 .opc0
= 1, .opc1
= 6, .crn
= 8, .crm
= 7, .opc2
= 5,
3982 .access
= PL3_W
, .type
= ARM_CP_NO_RAW
,
3983 .writefn
= tlbi_aa64_vae3_write
},
3987 static CPAccessResult
ctr_el0_access(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
3990 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
3991 * but the AArch32 CTR has its own reginfo struct)
3993 if (arm_current_el(env
) == 0 && !(env
->cp15
.sctlr_el
[1] & SCTLR_UCT
)) {
3994 return CP_ACCESS_TRAP
;
3996 return CP_ACCESS_OK
;
3999 static void oslar_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
4002 /* Writes to OSLAR_EL1 may update the OS lock status, which can be
4003 * read via a bit in OSLSR_EL1.
4007 if (ri
->state
== ARM_CP_STATE_AA32
) {
4008 oslock
= (value
== 0xC5ACCE55);
4013 env
->cp15
.oslsr_el1
= deposit32(env
->cp15
.oslsr_el1
, 1, 1, oslock
);
4016 static const ARMCPRegInfo debug_cp_reginfo
[] = {
4017 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
4018 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
4019 * unlike DBGDRAR it is never accessible from EL0.
4020 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
4023 { .name
= "DBGDRAR", .cp
= 14, .crn
= 1, .crm
= 0, .opc1
= 0, .opc2
= 0,
4024 .access
= PL0_R
, .accessfn
= access_tdra
,
4025 .type
= ARM_CP_CONST
, .resetvalue
= 0 },
4026 { .name
= "MDRAR_EL1", .state
= ARM_CP_STATE_AA64
,
4027 .opc0
= 2, .opc1
= 0, .crn
= 1, .crm
= 0, .opc2
= 0,
4028 .access
= PL1_R
, .accessfn
= access_tdra
,
4029 .type
= ARM_CP_CONST
, .resetvalue
= 0 },
4030 { .name
= "DBGDSAR", .cp
= 14, .crn
= 2, .crm
= 0, .opc1
= 0, .opc2
= 0,
4031 .access
= PL0_R
, .accessfn
= access_tdra
,
4032 .type
= ARM_CP_CONST
, .resetvalue
= 0 },
4033 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
4034 { .name
= "MDSCR_EL1", .state
= ARM_CP_STATE_BOTH
,
4035 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 2,
4036 .access
= PL1_RW
, .accessfn
= access_tda
,
4037 .fieldoffset
= offsetof(CPUARMState
, cp15
.mdscr_el1
),
4039 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1.
4040 * We don't implement the configurable EL0 access.
4042 { .name
= "MDCCSR_EL0", .state
= ARM_CP_STATE_BOTH
,
4043 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= 1, .opc2
= 0,
4044 .type
= ARM_CP_ALIAS
,
4045 .access
= PL1_R
, .accessfn
= access_tda
,
4046 .fieldoffset
= offsetof(CPUARMState
, cp15
.mdscr_el1
), },
4047 { .name
= "OSLAR_EL1", .state
= ARM_CP_STATE_BOTH
,
4048 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 1, .crm
= 0, .opc2
= 4,
4049 .access
= PL1_W
, .type
= ARM_CP_NO_RAW
,
4050 .accessfn
= access_tdosa
,
4051 .writefn
= oslar_write
},
4052 { .name
= "OSLSR_EL1", .state
= ARM_CP_STATE_BOTH
,
4053 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 1, .crm
= 1, .opc2
= 4,
4054 .access
= PL1_R
, .resetvalue
= 10,
4055 .accessfn
= access_tdosa
,
4056 .fieldoffset
= offsetof(CPUARMState
, cp15
.oslsr_el1
) },
4057 /* Dummy OSDLR_EL1: 32-bit Linux will read this */
4058 { .name
= "OSDLR_EL1", .state
= ARM_CP_STATE_BOTH
,
4059 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 1, .crm
= 3, .opc2
= 4,
4060 .access
= PL1_RW
, .accessfn
= access_tdosa
,
4061 .type
= ARM_CP_NOP
},
4062 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
4063 * implement vector catch debug events yet.
4066 .cp
= 14, .opc1
= 0, .crn
= 0, .crm
= 7, .opc2
= 0,
4067 .access
= PL1_RW
, .accessfn
= access_tda
,
4068 .type
= ARM_CP_NOP
},
4069 /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications
4070 * Channel but Linux may try to access this register. The 32-bit
4071 * alias is DBGDCCINT.
4073 { .name
= "MDCCINT_EL1", .state
= ARM_CP_STATE_BOTH
,
4074 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 0,
4075 .access
= PL1_RW
, .accessfn
= access_tda
,
4076 .type
= ARM_CP_NOP
},
4080 static const ARMCPRegInfo debug_lpae_cp_reginfo
[] = {
4081 /* 64 bit access versions of the (dummy) debug registers */
4082 { .name
= "DBGDRAR", .cp
= 14, .crm
= 1, .opc1
= 0,
4083 .access
= PL0_R
, .type
= ARM_CP_CONST
|ARM_CP_64BIT
, .resetvalue
= 0 },
4084 { .name
= "DBGDSAR", .cp
= 14, .crm
= 2, .opc1
= 0,
4085 .access
= PL0_R
, .type
= ARM_CP_CONST
|ARM_CP_64BIT
, .resetvalue
= 0 },
4089 void hw_watchpoint_update(ARMCPU
*cpu
, int n
)
4091 CPUARMState
*env
= &cpu
->env
;
4093 vaddr wvr
= env
->cp15
.dbgwvr
[n
];
4094 uint64_t wcr
= env
->cp15
.dbgwcr
[n
];
4096 int flags
= BP_CPU
| BP_STOP_BEFORE_ACCESS
;
4098 if (env
->cpu_watchpoint
[n
]) {
4099 cpu_watchpoint_remove_by_ref(CPU(cpu
), env
->cpu_watchpoint
[n
]);
4100 env
->cpu_watchpoint
[n
] = NULL
;
4103 if (!extract64(wcr
, 0, 1)) {
4104 /* E bit clear : watchpoint disabled */
4108 switch (extract64(wcr
, 3, 2)) {
4110 /* LSC 00 is reserved and must behave as if the wp is disabled */
4113 flags
|= BP_MEM_READ
;
4116 flags
|= BP_MEM_WRITE
;
4119 flags
|= BP_MEM_ACCESS
;
4123 /* Attempts to use both MASK and BAS fields simultaneously are
4124 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
4125 * thus generating a watchpoint for every byte in the masked region.
4127 mask
= extract64(wcr
, 24, 4);
4128 if (mask
== 1 || mask
== 2) {
4129 /* Reserved values of MASK; we must act as if the mask value was
4130 * some non-reserved value, or as if the watchpoint were disabled.
4131 * We choose the latter.
4135 /* Watchpoint covers an aligned area up to 2GB in size */
4137 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
4138 * whether the watchpoint fires when the unmasked bits match; we opt
4139 * to generate the exceptions.
4143 /* Watchpoint covers bytes defined by the byte address select bits */
4144 int bas
= extract64(wcr
, 5, 8);
4148 /* This must act as if the watchpoint is disabled */
4152 if (extract64(wvr
, 2, 1)) {
4153 /* Deprecated case of an only 4-aligned address. BAS[7:4] are
4154 * ignored, and BAS[3:0] define which bytes to watch.
4158 /* The BAS bits are supposed to be programmed to indicate a contiguous
4159 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
4160 * we fire for each byte in the word/doubleword addressed by the WVR.
4161 * We choose to ignore any non-zero bits after the first range of 1s.
4163 basstart
= ctz32(bas
);
4164 len
= cto32(bas
>> basstart
);
4168 cpu_watchpoint_insert(CPU(cpu
), wvr
, len
, flags
,
4169 &env
->cpu_watchpoint
[n
]);
4172 void hw_watchpoint_update_all(ARMCPU
*cpu
)
4175 CPUARMState
*env
= &cpu
->env
;
4177 /* Completely clear out existing QEMU watchpoints and our array, to
4178 * avoid possible stale entries following migration load.
4180 cpu_watchpoint_remove_all(CPU(cpu
), BP_CPU
);
4181 memset(env
->cpu_watchpoint
, 0, sizeof(env
->cpu_watchpoint
));
4183 for (i
= 0; i
< ARRAY_SIZE(cpu
->env
.cpu_watchpoint
); i
++) {
4184 hw_watchpoint_update(cpu
, i
);
4188 static void dbgwvr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
4191 ARMCPU
*cpu
= arm_env_get_cpu(env
);
4194 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
4195 * register reads and behaves as if values written are sign extended.
4196 * Bits [1:0] are RES0.
4198 value
= sextract64(value
, 0, 49) & ~3ULL;
4200 raw_write(env
, ri
, value
);
4201 hw_watchpoint_update(cpu
, i
);
4204 static void dbgwcr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
4207 ARMCPU
*cpu
= arm_env_get_cpu(env
);
4210 raw_write(env
, ri
, value
);
4211 hw_watchpoint_update(cpu
, i
);
4214 void hw_breakpoint_update(ARMCPU
*cpu
, int n
)
4216 CPUARMState
*env
= &cpu
->env
;
4217 uint64_t bvr
= env
->cp15
.dbgbvr
[n
];
4218 uint64_t bcr
= env
->cp15
.dbgbcr
[n
];
4223 if (env
->cpu_breakpoint
[n
]) {
4224 cpu_breakpoint_remove_by_ref(CPU(cpu
), env
->cpu_breakpoint
[n
]);
4225 env
->cpu_breakpoint
[n
] = NULL
;
4228 if (!extract64(bcr
, 0, 1)) {
4229 /* E bit clear : watchpoint disabled */
4233 bt
= extract64(bcr
, 20, 4);
4236 case 4: /* unlinked address mismatch (reserved if AArch64) */
4237 case 5: /* linked address mismatch (reserved if AArch64) */
4238 qemu_log_mask(LOG_UNIMP
,
4239 "arm: address mismatch breakpoint types not implemented");
4241 case 0: /* unlinked address match */
4242 case 1: /* linked address match */
4244 /* Bits [63:49] are hardwired to the value of bit [48]; that is,
4245 * we behave as if the register was sign extended. Bits [1:0] are
4246 * RES0. The BAS field is used to allow setting breakpoints on 16
4247 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether
4248 * a bp will fire if the addresses covered by the bp and the addresses
4249 * covered by the insn overlap but the insn doesn't start at the
4250 * start of the bp address range. We choose to require the insn and
4251 * the bp to have the same address. The constraints on writing to
4252 * BAS enforced in dbgbcr_write mean we have only four cases:
4253 * 0b0000 => no breakpoint
4254 * 0b0011 => breakpoint on addr
4255 * 0b1100 => breakpoint on addr + 2
4256 * 0b1111 => breakpoint on addr
4257 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
4259 int bas
= extract64(bcr
, 5, 4);
4260 addr
= sextract64(bvr
, 0, 49) & ~3ULL;
4269 case 2: /* unlinked context ID match */
4270 case 8: /* unlinked VMID match (reserved if no EL2) */
4271 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
4272 qemu_log_mask(LOG_UNIMP
,
4273 "arm: unlinked context breakpoint types not implemented");
4275 case 9: /* linked VMID match (reserved if no EL2) */
4276 case 11: /* linked context ID and VMID match (reserved if no EL2) */
4277 case 3: /* linked context ID match */
4279 /* We must generate no events for Linked context matches (unless
4280 * they are linked to by some other bp/wp, which is handled in
4281 * updates for the linking bp/wp). We choose to also generate no events
4282 * for reserved values.
4287 cpu_breakpoint_insert(CPU(cpu
), addr
, flags
, &env
->cpu_breakpoint
[n
]);
4290 void hw_breakpoint_update_all(ARMCPU
*cpu
)
4293 CPUARMState
*env
= &cpu
->env
;
4295 /* Completely clear out existing QEMU breakpoints and our array, to
4296 * avoid possible stale entries following migration load.
4298 cpu_breakpoint_remove_all(CPU(cpu
), BP_CPU
);
4299 memset(env
->cpu_breakpoint
, 0, sizeof(env
->cpu_breakpoint
));
4301 for (i
= 0; i
< ARRAY_SIZE(cpu
->env
.cpu_breakpoint
); i
++) {
4302 hw_breakpoint_update(cpu
, i
);
4306 static void dbgbvr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
4309 ARMCPU
*cpu
= arm_env_get_cpu(env
);
4312 raw_write(env
, ri
, value
);
4313 hw_breakpoint_update(cpu
, i
);
4316 static void dbgbcr_write(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
4319 ARMCPU
*cpu
= arm_env_get_cpu(env
);
4322 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
4325 value
= deposit64(value
, 6, 1, extract64(value
, 5, 1));
4326 value
= deposit64(value
, 8, 1, extract64(value
, 7, 1));
4328 raw_write(env
, ri
, value
);
4329 hw_breakpoint_update(cpu
, i
);
4332 static void define_debug_regs(ARMCPU
*cpu
)
4334 /* Define v7 and v8 architectural debug registers.
4335 * These are just dummy implementations for now.
4338 int wrps
, brps
, ctx_cmps
;
4339 ARMCPRegInfo dbgdidr
= {
4340 .name
= "DBGDIDR", .cp
= 14, .crn
= 0, .crm
= 0, .opc1
= 0, .opc2
= 0,
4341 .access
= PL0_R
, .accessfn
= access_tda
,
4342 .type
= ARM_CP_CONST
, .resetvalue
= cpu
->dbgdidr
,
4345 /* Note that all these register fields hold "number of Xs minus 1". */
4346 brps
= extract32(cpu
->dbgdidr
, 24, 4);
4347 wrps
= extract32(cpu
->dbgdidr
, 28, 4);
4348 ctx_cmps
= extract32(cpu
->dbgdidr
, 20, 4);
4350 assert(ctx_cmps
<= brps
);
4352 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties
4353 * of the debug registers such as number of breakpoints;
4354 * check that if they both exist then they agree.
4356 if (arm_feature(&cpu
->env
, ARM_FEATURE_AARCH64
)) {
4357 assert(extract32(cpu
->id_aa64dfr0
, 12, 4) == brps
);
4358 assert(extract32(cpu
->id_aa64dfr0
, 20, 4) == wrps
);
4359 assert(extract32(cpu
->id_aa64dfr0
, 28, 4) == ctx_cmps
);
4362 define_one_arm_cp_reg(cpu
, &dbgdidr
);
4363 define_arm_cp_regs(cpu
, debug_cp_reginfo
);
4365 if (arm_feature(&cpu
->env
, ARM_FEATURE_LPAE
)) {
4366 define_arm_cp_regs(cpu
, debug_lpae_cp_reginfo
);
4369 for (i
= 0; i
< brps
+ 1; i
++) {
4370 ARMCPRegInfo dbgregs
[] = {
4371 { .name
= "DBGBVR", .state
= ARM_CP_STATE_BOTH
,
4372 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= i
, .opc2
= 4,
4373 .access
= PL1_RW
, .accessfn
= access_tda
,
4374 .fieldoffset
= offsetof(CPUARMState
, cp15
.dbgbvr
[i
]),
4375 .writefn
= dbgbvr_write
, .raw_writefn
= raw_write
4377 { .name
= "DBGBCR", .state
= ARM_CP_STATE_BOTH
,
4378 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= i
, .opc2
= 5,
4379 .access
= PL1_RW
, .accessfn
= access_tda
,
4380 .fieldoffset
= offsetof(CPUARMState
, cp15
.dbgbcr
[i
]),
4381 .writefn
= dbgbcr_write
, .raw_writefn
= raw_write
4385 define_arm_cp_regs(cpu
, dbgregs
);
4388 for (i
= 0; i
< wrps
+ 1; i
++) {
4389 ARMCPRegInfo dbgregs
[] = {
4390 { .name
= "DBGWVR", .state
= ARM_CP_STATE_BOTH
,
4391 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= i
, .opc2
= 6,
4392 .access
= PL1_RW
, .accessfn
= access_tda
,
4393 .fieldoffset
= offsetof(CPUARMState
, cp15
.dbgwvr
[i
]),
4394 .writefn
= dbgwvr_write
, .raw_writefn
= raw_write
4396 { .name
= "DBGWCR", .state
= ARM_CP_STATE_BOTH
,
4397 .cp
= 14, .opc0
= 2, .opc1
= 0, .crn
= 0, .crm
= i
, .opc2
= 7,
4398 .access
= PL1_RW
, .accessfn
= access_tda
,
4399 .fieldoffset
= offsetof(CPUARMState
, cp15
.dbgwcr
[i
]),
4400 .writefn
= dbgwcr_write
, .raw_writefn
= raw_write
4404 define_arm_cp_regs(cpu
, dbgregs
);
4408 void register_cp_regs_for_features(ARMCPU
*cpu
)
4410 /* Register all the coprocessor registers based on feature bits */
4411 CPUARMState
*env
= &cpu
->env
;
4412 if (arm_feature(env
, ARM_FEATURE_M
)) {
4413 /* M profile has no coprocessor registers */
4417 define_arm_cp_regs(cpu
, cp_reginfo
);
4418 if (!arm_feature(env
, ARM_FEATURE_V8
)) {
4419 /* Must go early as it is full of wildcards that may be
4420 * overridden by later definitions.
4422 define_arm_cp_regs(cpu
, not_v8_cp_reginfo
);
4425 if (arm_feature(env
, ARM_FEATURE_V6
)) {
4426 /* The ID registers all have impdef reset values */
4427 ARMCPRegInfo v6_idregs
[] = {
4428 { .name
= "ID_PFR0", .state
= ARM_CP_STATE_BOTH
,
4429 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 1, .opc2
= 0,
4430 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4431 .resetvalue
= cpu
->id_pfr0
},
4432 { .name
= "ID_PFR1", .state
= ARM_CP_STATE_BOTH
,
4433 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 1, .opc2
= 1,
4434 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4435 .resetvalue
= cpu
->id_pfr1
},
4436 { .name
= "ID_DFR0", .state
= ARM_CP_STATE_BOTH
,
4437 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 1, .opc2
= 2,
4438 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4439 .resetvalue
= cpu
->id_dfr0
},
4440 { .name
= "ID_AFR0", .state
= ARM_CP_STATE_BOTH
,
4441 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 1, .opc2
= 3,
4442 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4443 .resetvalue
= cpu
->id_afr0
},
4444 { .name
= "ID_MMFR0", .state
= ARM_CP_STATE_BOTH
,
4445 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 1, .opc2
= 4,
4446 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4447 .resetvalue
= cpu
->id_mmfr0
},
4448 { .name
= "ID_MMFR1", .state
= ARM_CP_STATE_BOTH
,
4449 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 1, .opc2
= 5,
4450 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4451 .resetvalue
= cpu
->id_mmfr1
},
4452 { .name
= "ID_MMFR2", .state
= ARM_CP_STATE_BOTH
,
4453 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 1, .opc2
= 6,
4454 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4455 .resetvalue
= cpu
->id_mmfr2
},
4456 { .name
= "ID_MMFR3", .state
= ARM_CP_STATE_BOTH
,
4457 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 1, .opc2
= 7,
4458 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4459 .resetvalue
= cpu
->id_mmfr3
},
4460 { .name
= "ID_ISAR0", .state
= ARM_CP_STATE_BOTH
,
4461 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 0,
4462 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4463 .resetvalue
= cpu
->id_isar0
},
4464 { .name
= "ID_ISAR1", .state
= ARM_CP_STATE_BOTH
,
4465 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 1,
4466 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4467 .resetvalue
= cpu
->id_isar1
},
4468 { .name
= "ID_ISAR2", .state
= ARM_CP_STATE_BOTH
,
4469 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 2,
4470 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4471 .resetvalue
= cpu
->id_isar2
},
4472 { .name
= "ID_ISAR3", .state
= ARM_CP_STATE_BOTH
,
4473 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 3,
4474 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4475 .resetvalue
= cpu
->id_isar3
},
4476 { .name
= "ID_ISAR4", .state
= ARM_CP_STATE_BOTH
,
4477 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 4,
4478 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4479 .resetvalue
= cpu
->id_isar4
},
4480 { .name
= "ID_ISAR5", .state
= ARM_CP_STATE_BOTH
,
4481 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 5,
4482 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4483 .resetvalue
= cpu
->id_isar5
},
4484 { .name
= "ID_MMFR4", .state
= ARM_CP_STATE_BOTH
,
4485 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 6,
4486 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4487 .resetvalue
= cpu
->id_mmfr4
},
4488 /* 7 is as yet unallocated and must RAZ */
4489 { .name
= "ID_ISAR7_RESERVED", .state
= ARM_CP_STATE_BOTH
,
4490 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 2, .opc2
= 7,
4491 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4495 define_arm_cp_regs(cpu
, v6_idregs
);
4496 define_arm_cp_regs(cpu
, v6_cp_reginfo
);
4498 define_arm_cp_regs(cpu
, not_v6_cp_reginfo
);
4500 if (arm_feature(env
, ARM_FEATURE_V6K
)) {
4501 define_arm_cp_regs(cpu
, v6k_cp_reginfo
);
4503 if (arm_feature(env
, ARM_FEATURE_V7MP
) &&
4504 !arm_feature(env
, ARM_FEATURE_MPU
)) {
4505 define_arm_cp_regs(cpu
, v7mp_cp_reginfo
);
4507 if (arm_feature(env
, ARM_FEATURE_V7
)) {
4508 /* v7 performance monitor control register: same implementor
4509 * field as main ID register, and we implement only the cycle
4512 #ifndef CONFIG_USER_ONLY
4513 ARMCPRegInfo pmcr
= {
4514 .name
= "PMCR", .cp
= 15, .crn
= 9, .crm
= 12, .opc1
= 0, .opc2
= 0,
4516 .type
= ARM_CP_IO
| ARM_CP_ALIAS
,
4517 .fieldoffset
= offsetoflow32(CPUARMState
, cp15
.c9_pmcr
),
4518 .accessfn
= pmreg_access
, .writefn
= pmcr_write
,
4519 .raw_writefn
= raw_write
,
4521 ARMCPRegInfo pmcr64
= {
4522 .name
= "PMCR_EL0", .state
= ARM_CP_STATE_AA64
,
4523 .opc0
= 3, .opc1
= 3, .crn
= 9, .crm
= 12, .opc2
= 0,
4524 .access
= PL0_RW
, .accessfn
= pmreg_access
,
4526 .fieldoffset
= offsetof(CPUARMState
, cp15
.c9_pmcr
),
4527 .resetvalue
= cpu
->midr
& 0xff000000,
4528 .writefn
= pmcr_write
, .raw_writefn
= raw_write
,
4530 define_one_arm_cp_reg(cpu
, &pmcr
);
4531 define_one_arm_cp_reg(cpu
, &pmcr64
);
4533 ARMCPRegInfo clidr
= {
4534 .name
= "CLIDR", .state
= ARM_CP_STATE_BOTH
,
4535 .opc0
= 3, .crn
= 0, .crm
= 0, .opc1
= 1, .opc2
= 1,
4536 .access
= PL1_R
, .type
= ARM_CP_CONST
, .resetvalue
= cpu
->clidr
4538 define_one_arm_cp_reg(cpu
, &clidr
);
4539 define_arm_cp_regs(cpu
, v7_cp_reginfo
);
4540 define_debug_regs(cpu
);
4542 define_arm_cp_regs(cpu
, not_v7_cp_reginfo
);
4544 if (arm_feature(env
, ARM_FEATURE_V8
)) {
4545 /* AArch64 ID registers, which all have impdef reset values.
4546 * Note that within the ID register ranges the unused slots
4547 * must all RAZ, not UNDEF; future architecture versions may
4548 * define new registers here.
4550 ARMCPRegInfo v8_idregs
[] = {
4551 { .name
= "ID_AA64PFR0_EL1", .state
= ARM_CP_STATE_AA64
,
4552 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 4, .opc2
= 0,
4553 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4554 .resetvalue
= cpu
->id_aa64pfr0
},
4555 { .name
= "ID_AA64PFR1_EL1", .state
= ARM_CP_STATE_AA64
,
4556 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 4, .opc2
= 1,
4557 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4558 .resetvalue
= cpu
->id_aa64pfr1
},
4559 { .name
= "ID_AA64PFR2_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4560 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 4, .opc2
= 2,
4561 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4563 { .name
= "ID_AA64PFR3_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4564 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 4, .opc2
= 3,
4565 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4567 { .name
= "ID_AA64PFR4_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4568 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 4, .opc2
= 4,
4569 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4571 { .name
= "ID_AA64PFR5_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4572 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 4, .opc2
= 5,
4573 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4575 { .name
= "ID_AA64PFR6_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4576 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 4, .opc2
= 6,
4577 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4579 { .name
= "ID_AA64PFR7_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4580 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 4, .opc2
= 7,
4581 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4583 { .name
= "ID_AA64DFR0_EL1", .state
= ARM_CP_STATE_AA64
,
4584 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 5, .opc2
= 0,
4585 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4586 /* We mask out the PMUVer field, because we don't currently
4587 * implement the PMU. Not advertising it prevents the guest
4588 * from trying to use it and getting UNDEFs on registers we
4591 .resetvalue
= cpu
->id_aa64dfr0
& ~0xf00 },
4592 { .name
= "ID_AA64DFR1_EL1", .state
= ARM_CP_STATE_AA64
,
4593 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 5, .opc2
= 1,
4594 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4595 .resetvalue
= cpu
->id_aa64dfr1
},
4596 { .name
= "ID_AA64DFR2_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4597 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 5, .opc2
= 2,
4598 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4600 { .name
= "ID_AA64DFR3_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4601 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 5, .opc2
= 3,
4602 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4604 { .name
= "ID_AA64AFR0_EL1", .state
= ARM_CP_STATE_AA64
,
4605 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 5, .opc2
= 4,
4606 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4607 .resetvalue
= cpu
->id_aa64afr0
},
4608 { .name
= "ID_AA64AFR1_EL1", .state
= ARM_CP_STATE_AA64
,
4609 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 5, .opc2
= 5,
4610 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4611 .resetvalue
= cpu
->id_aa64afr1
},
4612 { .name
= "ID_AA64AFR2_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4613 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 5, .opc2
= 6,
4614 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4616 { .name
= "ID_AA64AFR3_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4617 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 5, .opc2
= 7,
4618 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4620 { .name
= "ID_AA64ISAR0_EL1", .state
= ARM_CP_STATE_AA64
,
4621 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 6, .opc2
= 0,
4622 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4623 .resetvalue
= cpu
->id_aa64isar0
},
4624 { .name
= "ID_AA64ISAR1_EL1", .state
= ARM_CP_STATE_AA64
,
4625 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 6, .opc2
= 1,
4626 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4627 .resetvalue
= cpu
->id_aa64isar1
},
4628 { .name
= "ID_AA64ISAR2_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4629 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 6, .opc2
= 2,
4630 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4632 { .name
= "ID_AA64ISAR3_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4633 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 6, .opc2
= 3,
4634 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4636 { .name
= "ID_AA64ISAR4_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4637 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 6, .opc2
= 4,
4638 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4640 { .name
= "ID_AA64ISAR5_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4641 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 6, .opc2
= 5,
4642 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4644 { .name
= "ID_AA64ISAR6_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4645 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 6, .opc2
= 6,
4646 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4648 { .name
= "ID_AA64ISAR7_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4649 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 6, .opc2
= 7,
4650 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4652 { .name
= "ID_AA64MMFR0_EL1", .state
= ARM_CP_STATE_AA64
,
4653 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 7, .opc2
= 0,
4654 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4655 .resetvalue
= cpu
->id_aa64mmfr0
},
4656 { .name
= "ID_AA64MMFR1_EL1", .state
= ARM_CP_STATE_AA64
,
4657 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 7, .opc2
= 1,
4658 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4659 .resetvalue
= cpu
->id_aa64mmfr1
},
4660 { .name
= "ID_AA64MMFR2_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4661 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 7, .opc2
= 2,
4662 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4664 { .name
= "ID_AA64MMFR3_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4665 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 7, .opc2
= 3,
4666 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4668 { .name
= "ID_AA64MMFR4_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4669 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 7, .opc2
= 4,
4670 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4672 { .name
= "ID_AA64MMFR5_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4673 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 7, .opc2
= 5,
4674 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4676 { .name
= "ID_AA64MMFR6_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4677 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 7, .opc2
= 6,
4678 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4680 { .name
= "ID_AA64MMFR7_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4681 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 7, .opc2
= 7,
4682 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4684 { .name
= "MVFR0_EL1", .state
= ARM_CP_STATE_AA64
,
4685 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 3, .opc2
= 0,
4686 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4687 .resetvalue
= cpu
->mvfr0
},
4688 { .name
= "MVFR1_EL1", .state
= ARM_CP_STATE_AA64
,
4689 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 3, .opc2
= 1,
4690 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4691 .resetvalue
= cpu
->mvfr1
},
4692 { .name
= "MVFR2_EL1", .state
= ARM_CP_STATE_AA64
,
4693 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 3, .opc2
= 2,
4694 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4695 .resetvalue
= cpu
->mvfr2
},
4696 { .name
= "MVFR3_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4697 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 3, .opc2
= 3,
4698 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4700 { .name
= "MVFR4_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4701 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 3, .opc2
= 4,
4702 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4704 { .name
= "MVFR5_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4705 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 3, .opc2
= 5,
4706 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4708 { .name
= "MVFR6_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4709 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 3, .opc2
= 6,
4710 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4712 { .name
= "MVFR7_EL1_RESERVED", .state
= ARM_CP_STATE_AA64
,
4713 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 3, .opc2
= 7,
4714 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4716 { .name
= "PMCEID0", .state
= ARM_CP_STATE_AA32
,
4717 .cp
= 15, .opc1
= 0, .crn
= 9, .crm
= 12, .opc2
= 6,
4718 .access
= PL0_R
, .accessfn
= pmreg_access
, .type
= ARM_CP_CONST
,
4719 .resetvalue
= cpu
->pmceid0
},
4720 { .name
= "PMCEID0_EL0", .state
= ARM_CP_STATE_AA64
,
4721 .opc0
= 3, .opc1
= 3, .crn
= 9, .crm
= 12, .opc2
= 6,
4722 .access
= PL0_R
, .accessfn
= pmreg_access
, .type
= ARM_CP_CONST
,
4723 .resetvalue
= cpu
->pmceid0
},
4724 { .name
= "PMCEID1", .state
= ARM_CP_STATE_AA32
,
4725 .cp
= 15, .opc1
= 0, .crn
= 9, .crm
= 12, .opc2
= 7,
4726 .access
= PL0_R
, .accessfn
= pmreg_access
, .type
= ARM_CP_CONST
,
4727 .resetvalue
= cpu
->pmceid1
},
4728 { .name
= "PMCEID1_EL0", .state
= ARM_CP_STATE_AA64
,
4729 .opc0
= 3, .opc1
= 3, .crn
= 9, .crm
= 12, .opc2
= 7,
4730 .access
= PL0_R
, .accessfn
= pmreg_access
, .type
= ARM_CP_CONST
,
4731 .resetvalue
= cpu
->pmceid1
},
4734 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */
4735 if (!arm_feature(env
, ARM_FEATURE_EL3
) &&
4736 !arm_feature(env
, ARM_FEATURE_EL2
)) {
4737 ARMCPRegInfo rvbar
= {
4738 .name
= "RVBAR_EL1", .state
= ARM_CP_STATE_AA64
,
4739 .opc0
= 3, .opc1
= 0, .crn
= 12, .crm
= 0, .opc2
= 1,
4740 .type
= ARM_CP_CONST
, .access
= PL1_R
, .resetvalue
= cpu
->rvbar
4742 define_one_arm_cp_reg(cpu
, &rvbar
);
4744 define_arm_cp_regs(cpu
, v8_idregs
);
4745 define_arm_cp_regs(cpu
, v8_cp_reginfo
);
4747 if (arm_feature(env
, ARM_FEATURE_EL2
)) {
4748 uint64_t vmpidr_def
= mpidr_read_val(env
);
4749 ARMCPRegInfo vpidr_regs
[] = {
4750 { .name
= "VPIDR", .state
= ARM_CP_STATE_AA32
,
4751 .cp
= 15, .opc1
= 4, .crn
= 0, .crm
= 0, .opc2
= 0,
4752 .access
= PL2_RW
, .accessfn
= access_el3_aa32ns
,
4753 .resetvalue
= cpu
->midr
,
4754 .fieldoffset
= offsetof(CPUARMState
, cp15
.vpidr_el2
) },
4755 { .name
= "VPIDR_EL2", .state
= ARM_CP_STATE_AA64
,
4756 .opc0
= 3, .opc1
= 4, .crn
= 0, .crm
= 0, .opc2
= 0,
4757 .access
= PL2_RW
, .resetvalue
= cpu
->midr
,
4758 .fieldoffset
= offsetof(CPUARMState
, cp15
.vpidr_el2
) },
4759 { .name
= "VMPIDR", .state
= ARM_CP_STATE_AA32
,
4760 .cp
= 15, .opc1
= 4, .crn
= 0, .crm
= 0, .opc2
= 5,
4761 .access
= PL2_RW
, .accessfn
= access_el3_aa32ns
,
4762 .resetvalue
= vmpidr_def
,
4763 .fieldoffset
= offsetof(CPUARMState
, cp15
.vmpidr_el2
) },
4764 { .name
= "VMPIDR_EL2", .state
= ARM_CP_STATE_AA64
,
4765 .opc0
= 3, .opc1
= 4, .crn
= 0, .crm
= 0, .opc2
= 5,
4767 .resetvalue
= vmpidr_def
,
4768 .fieldoffset
= offsetof(CPUARMState
, cp15
.vmpidr_el2
) },
4771 define_arm_cp_regs(cpu
, vpidr_regs
);
4772 define_arm_cp_regs(cpu
, el2_cp_reginfo
);
4773 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */
4774 if (!arm_feature(env
, ARM_FEATURE_EL3
)) {
4775 ARMCPRegInfo rvbar
= {
4776 .name
= "RVBAR_EL2", .state
= ARM_CP_STATE_AA64
,
4777 .opc0
= 3, .opc1
= 4, .crn
= 12, .crm
= 0, .opc2
= 1,
4778 .type
= ARM_CP_CONST
, .access
= PL2_R
, .resetvalue
= cpu
->rvbar
4780 define_one_arm_cp_reg(cpu
, &rvbar
);
4783 /* If EL2 is missing but higher ELs are enabled, we need to
4784 * register the no_el2 reginfos.
4786 if (arm_feature(env
, ARM_FEATURE_EL3
)) {
4787 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value
4788 * of MIDR_EL1 and MPIDR_EL1.
4790 ARMCPRegInfo vpidr_regs
[] = {
4791 { .name
= "VPIDR_EL2", .state
= ARM_CP_STATE_BOTH
,
4792 .opc0
= 3, .opc1
= 4, .crn
= 0, .crm
= 0, .opc2
= 0,
4793 .access
= PL2_RW
, .accessfn
= access_el3_aa32ns_aa64any
,
4794 .type
= ARM_CP_CONST
, .resetvalue
= cpu
->midr
,
4795 .fieldoffset
= offsetof(CPUARMState
, cp15
.vpidr_el2
) },
4796 { .name
= "VMPIDR_EL2", .state
= ARM_CP_STATE_BOTH
,
4797 .opc0
= 3, .opc1
= 4, .crn
= 0, .crm
= 0, .opc2
= 5,
4798 .access
= PL2_RW
, .accessfn
= access_el3_aa32ns_aa64any
,
4799 .type
= ARM_CP_NO_RAW
,
4800 .writefn
= arm_cp_write_ignore
, .readfn
= mpidr_read
},
4803 define_arm_cp_regs(cpu
, vpidr_regs
);
4804 define_arm_cp_regs(cpu
, el3_no_el2_cp_reginfo
);
4807 if (arm_feature(env
, ARM_FEATURE_EL3
)) {
4808 define_arm_cp_regs(cpu
, el3_cp_reginfo
);
4809 ARMCPRegInfo el3_regs
[] = {
4810 { .name
= "RVBAR_EL3", .state
= ARM_CP_STATE_AA64
,
4811 .opc0
= 3, .opc1
= 6, .crn
= 12, .crm
= 0, .opc2
= 1,
4812 .type
= ARM_CP_CONST
, .access
= PL3_R
, .resetvalue
= cpu
->rvbar
},
4813 { .name
= "SCTLR_EL3", .state
= ARM_CP_STATE_AA64
,
4814 .opc0
= 3, .opc1
= 6, .crn
= 1, .crm
= 0, .opc2
= 0,
4816 .raw_writefn
= raw_write
, .writefn
= sctlr_write
,
4817 .fieldoffset
= offsetof(CPUARMState
, cp15
.sctlr_el
[3]),
4818 .resetvalue
= cpu
->reset_sctlr
},
4822 define_arm_cp_regs(cpu
, el3_regs
);
4824 /* The behaviour of NSACR is sufficiently various that we don't
4825 * try to describe it in a single reginfo:
4826 * if EL3 is 64 bit, then trap to EL3 from S EL1,
4827 * reads as constant 0xc00 from NS EL1 and NS EL2
4828 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2
4829 * if v7 without EL3, register doesn't exist
4830 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2
4832 if (arm_feature(env
, ARM_FEATURE_EL3
)) {
4833 if (arm_feature(env
, ARM_FEATURE_AARCH64
)) {
4834 ARMCPRegInfo nsacr
= {
4835 .name
= "NSACR", .type
= ARM_CP_CONST
,
4836 .cp
= 15, .opc1
= 0, .crn
= 1, .crm
= 1, .opc2
= 2,
4837 .access
= PL1_RW
, .accessfn
= nsacr_access
,
4840 define_one_arm_cp_reg(cpu
, &nsacr
);
4842 ARMCPRegInfo nsacr
= {
4844 .cp
= 15, .opc1
= 0, .crn
= 1, .crm
= 1, .opc2
= 2,
4845 .access
= PL3_RW
| PL1_R
,
4847 .fieldoffset
= offsetof(CPUARMState
, cp15
.nsacr
)
4849 define_one_arm_cp_reg(cpu
, &nsacr
);
4852 if (arm_feature(env
, ARM_FEATURE_V8
)) {
4853 ARMCPRegInfo nsacr
= {
4854 .name
= "NSACR", .type
= ARM_CP_CONST
,
4855 .cp
= 15, .opc1
= 0, .crn
= 1, .crm
= 1, .opc2
= 2,
4859 define_one_arm_cp_reg(cpu
, &nsacr
);
4863 if (arm_feature(env
, ARM_FEATURE_MPU
)) {
4864 if (arm_feature(env
, ARM_FEATURE_V6
)) {
4865 /* PMSAv6 not implemented */
4866 assert(arm_feature(env
, ARM_FEATURE_V7
));
4867 define_arm_cp_regs(cpu
, vmsa_pmsa_cp_reginfo
);
4868 define_arm_cp_regs(cpu
, pmsav7_cp_reginfo
);
4870 define_arm_cp_regs(cpu
, pmsav5_cp_reginfo
);
4873 define_arm_cp_regs(cpu
, vmsa_pmsa_cp_reginfo
);
4874 define_arm_cp_regs(cpu
, vmsa_cp_reginfo
);
4876 if (arm_feature(env
, ARM_FEATURE_THUMB2EE
)) {
4877 define_arm_cp_regs(cpu
, t2ee_cp_reginfo
);
4879 if (arm_feature(env
, ARM_FEATURE_GENERIC_TIMER
)) {
4880 define_arm_cp_regs(cpu
, generic_timer_cp_reginfo
);
4882 if (arm_feature(env
, ARM_FEATURE_VAPA
)) {
4883 define_arm_cp_regs(cpu
, vapa_cp_reginfo
);
4885 if (arm_feature(env
, ARM_FEATURE_CACHE_TEST_CLEAN
)) {
4886 define_arm_cp_regs(cpu
, cache_test_clean_cp_reginfo
);
4888 if (arm_feature(env
, ARM_FEATURE_CACHE_DIRTY_REG
)) {
4889 define_arm_cp_regs(cpu
, cache_dirty_status_cp_reginfo
);
4891 if (arm_feature(env
, ARM_FEATURE_CACHE_BLOCK_OPS
)) {
4892 define_arm_cp_regs(cpu
, cache_block_ops_cp_reginfo
);
4894 if (arm_feature(env
, ARM_FEATURE_OMAPCP
)) {
4895 define_arm_cp_regs(cpu
, omap_cp_reginfo
);
4897 if (arm_feature(env
, ARM_FEATURE_STRONGARM
)) {
4898 define_arm_cp_regs(cpu
, strongarm_cp_reginfo
);
4900 if (arm_feature(env
, ARM_FEATURE_XSCALE
)) {
4901 define_arm_cp_regs(cpu
, xscale_cp_reginfo
);
4903 if (arm_feature(env
, ARM_FEATURE_DUMMY_C15_REGS
)) {
4904 define_arm_cp_regs(cpu
, dummy_c15_cp_reginfo
);
4906 if (arm_feature(env
, ARM_FEATURE_LPAE
)) {
4907 define_arm_cp_regs(cpu
, lpae_cp_reginfo
);
4909 /* Slightly awkwardly, the OMAP and StrongARM cores need all of
4910 * cp15 crn=0 to be writes-ignored, whereas for other cores they should
4911 * be read-only (ie write causes UNDEF exception).
4914 ARMCPRegInfo id_pre_v8_midr_cp_reginfo
[] = {
4915 /* Pre-v8 MIDR space.
4916 * Note that the MIDR isn't a simple constant register because
4917 * of the TI925 behaviour where writes to another register can
4918 * cause the MIDR value to change.
4920 * Unimplemented registers in the c15 0 0 0 space default to
4921 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
4922 * and friends override accordingly.
4925 .cp
= 15, .crn
= 0, .crm
= 0, .opc1
= 0, .opc2
= CP_ANY
,
4926 .access
= PL1_R
, .resetvalue
= cpu
->midr
,
4927 .writefn
= arm_cp_write_ignore
, .raw_writefn
= raw_write
,
4928 .readfn
= midr_read
,
4929 .fieldoffset
= offsetof(CPUARMState
, cp15
.c0_cpuid
),
4930 .type
= ARM_CP_OVERRIDE
},
4931 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
4933 .cp
= 15, .crn
= 0, .crm
= 3, .opc1
= 0, .opc2
= CP_ANY
,
4934 .access
= PL1_R
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
4936 .cp
= 15, .crn
= 0, .crm
= 4, .opc1
= 0, .opc2
= CP_ANY
,
4937 .access
= PL1_R
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
4939 .cp
= 15, .crn
= 0, .crm
= 5, .opc1
= 0, .opc2
= CP_ANY
,
4940 .access
= PL1_R
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
4942 .cp
= 15, .crn
= 0, .crm
= 6, .opc1
= 0, .opc2
= CP_ANY
,
4943 .access
= PL1_R
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
4945 .cp
= 15, .crn
= 0, .crm
= 7, .opc1
= 0, .opc2
= CP_ANY
,
4946 .access
= PL1_R
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
4949 ARMCPRegInfo id_v8_midr_cp_reginfo
[] = {
4950 { .name
= "MIDR_EL1", .state
= ARM_CP_STATE_BOTH
,
4951 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 0, .opc2
= 0,
4952 .access
= PL1_R
, .type
= ARM_CP_NO_RAW
, .resetvalue
= cpu
->midr
,
4953 .fieldoffset
= offsetof(CPUARMState
, cp15
.c0_cpuid
),
4954 .readfn
= midr_read
},
4955 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */
4956 { .name
= "MIDR", .type
= ARM_CP_ALIAS
| ARM_CP_CONST
,
4957 .cp
= 15, .crn
= 0, .crm
= 0, .opc1
= 0, .opc2
= 4,
4958 .access
= PL1_R
, .resetvalue
= cpu
->midr
},
4959 { .name
= "MIDR", .type
= ARM_CP_ALIAS
| ARM_CP_CONST
,
4960 .cp
= 15, .crn
= 0, .crm
= 0, .opc1
= 0, .opc2
= 7,
4961 .access
= PL1_R
, .resetvalue
= cpu
->midr
},
4962 { .name
= "REVIDR_EL1", .state
= ARM_CP_STATE_BOTH
,
4963 .opc0
= 3, .opc1
= 0, .crn
= 0, .crm
= 0, .opc2
= 6,
4964 .access
= PL1_R
, .type
= ARM_CP_CONST
, .resetvalue
= cpu
->revidr
},
4967 ARMCPRegInfo id_cp_reginfo
[] = {
4968 /* These are common to v8 and pre-v8 */
4970 .cp
= 15, .crn
= 0, .crm
= 0, .opc1
= 0, .opc2
= 1,
4971 .access
= PL1_R
, .type
= ARM_CP_CONST
, .resetvalue
= cpu
->ctr
},
4972 { .name
= "CTR_EL0", .state
= ARM_CP_STATE_AA64
,
4973 .opc0
= 3, .opc1
= 3, .opc2
= 1, .crn
= 0, .crm
= 0,
4974 .access
= PL0_R
, .accessfn
= ctr_el0_access
,
4975 .type
= ARM_CP_CONST
, .resetvalue
= cpu
->ctr
},
4976 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
4978 .cp
= 15, .crn
= 0, .crm
= 0, .opc1
= 0, .opc2
= 2,
4979 .access
= PL1_R
, .type
= ARM_CP_CONST
, .resetvalue
= 0 },
4982 /* TLBTR is specific to VMSA */
4983 ARMCPRegInfo id_tlbtr_reginfo
= {
4985 .cp
= 15, .crn
= 0, .crm
= 0, .opc1
= 0, .opc2
= 3,
4986 .access
= PL1_R
, .type
= ARM_CP_CONST
, .resetvalue
= 0,
4988 /* MPUIR is specific to PMSA V6+ */
4989 ARMCPRegInfo id_mpuir_reginfo
= {
4991 .cp
= 15, .crn
= 0, .crm
= 0, .opc1
= 0, .opc2
= 4,
4992 .access
= PL1_R
, .type
= ARM_CP_CONST
,
4993 .resetvalue
= cpu
->pmsav7_dregion
<< 8
4995 ARMCPRegInfo crn0_wi_reginfo
= {
4996 .name
= "CRN0_WI", .cp
= 15, .crn
= 0, .crm
= CP_ANY
,
4997 .opc1
= CP_ANY
, .opc2
= CP_ANY
, .access
= PL1_W
,
4998 .type
= ARM_CP_NOP
| ARM_CP_OVERRIDE
5000 if (arm_feature(env
, ARM_FEATURE_OMAPCP
) ||
5001 arm_feature(env
, ARM_FEATURE_STRONGARM
)) {
5003 /* Register the blanket "writes ignored" value first to cover the
5004 * whole space. Then update the specific ID registers to allow write
5005 * access, so that they ignore writes rather than causing them to
5008 define_one_arm_cp_reg(cpu
, &crn0_wi_reginfo
);
5009 for (r
= id_pre_v8_midr_cp_reginfo
;
5010 r
->type
!= ARM_CP_SENTINEL
; r
++) {
5013 for (r
= id_cp_reginfo
; r
->type
!= ARM_CP_SENTINEL
; r
++) {
5016 id_tlbtr_reginfo
.access
= PL1_RW
;
5017 id_tlbtr_reginfo
.access
= PL1_RW
;
5019 if (arm_feature(env
, ARM_FEATURE_V8
)) {
5020 define_arm_cp_regs(cpu
, id_v8_midr_cp_reginfo
);
5022 define_arm_cp_regs(cpu
, id_pre_v8_midr_cp_reginfo
);
5024 define_arm_cp_regs(cpu
, id_cp_reginfo
);
5025 if (!arm_feature(env
, ARM_FEATURE_MPU
)) {
5026 define_one_arm_cp_reg(cpu
, &id_tlbtr_reginfo
);
5027 } else if (arm_feature(env
, ARM_FEATURE_V7
)) {
5028 define_one_arm_cp_reg(cpu
, &id_mpuir_reginfo
);
5032 if (arm_feature(env
, ARM_FEATURE_MPIDR
)) {
5033 define_arm_cp_regs(cpu
, mpidr_cp_reginfo
);
5036 if (arm_feature(env
, ARM_FEATURE_AUXCR
)) {
5037 ARMCPRegInfo auxcr_reginfo
[] = {
5038 { .name
= "ACTLR_EL1", .state
= ARM_CP_STATE_BOTH
,
5039 .opc0
= 3, .opc1
= 0, .crn
= 1, .crm
= 0, .opc2
= 1,
5040 .access
= PL1_RW
, .type
= ARM_CP_CONST
,
5041 .resetvalue
= cpu
->reset_auxcr
},
5042 { .name
= "ACTLR_EL2", .state
= ARM_CP_STATE_BOTH
,
5043 .opc0
= 3, .opc1
= 4, .crn
= 1, .crm
= 0, .opc2
= 1,
5044 .access
= PL2_RW
, .type
= ARM_CP_CONST
,
5046 { .name
= "ACTLR_EL3", .state
= ARM_CP_STATE_AA64
,
5047 .opc0
= 3, .opc1
= 6, .crn
= 1, .crm
= 0, .opc2
= 1,
5048 .access
= PL3_RW
, .type
= ARM_CP_CONST
,
5052 define_arm_cp_regs(cpu
, auxcr_reginfo
);
5055 if (arm_feature(env
, ARM_FEATURE_CBAR
)) {
5056 if (arm_feature(env
, ARM_FEATURE_AARCH64
)) {
5057 /* 32 bit view is [31:18] 0...0 [43:32]. */
5058 uint32_t cbar32
= (extract64(cpu
->reset_cbar
, 18, 14) << 18)
5059 | extract64(cpu
->reset_cbar
, 32, 12);
5060 ARMCPRegInfo cbar_reginfo
[] = {
5062 .type
= ARM_CP_CONST
,
5063 .cp
= 15, .crn
= 15, .crm
= 0, .opc1
= 4, .opc2
= 0,
5064 .access
= PL1_R
, .resetvalue
= cpu
->reset_cbar
},
5065 { .name
= "CBAR_EL1", .state
= ARM_CP_STATE_AA64
,
5066 .type
= ARM_CP_CONST
,
5067 .opc0
= 3, .opc1
= 1, .crn
= 15, .crm
= 3, .opc2
= 0,
5068 .access
= PL1_R
, .resetvalue
= cbar32
},
5071 /* We don't implement a r/w 64 bit CBAR currently */
5072 assert(arm_feature(env
, ARM_FEATURE_CBAR_RO
));
5073 define_arm_cp_regs(cpu
, cbar_reginfo
);
5075 ARMCPRegInfo cbar
= {
5077 .cp
= 15, .crn
= 15, .crm
= 0, .opc1
= 4, .opc2
= 0,
5078 .access
= PL1_R
|PL3_W
, .resetvalue
= cpu
->reset_cbar
,
5079 .fieldoffset
= offsetof(CPUARMState
,
5080 cp15
.c15_config_base_address
)
5082 if (arm_feature(env
, ARM_FEATURE_CBAR_RO
)) {
5083 cbar
.access
= PL1_R
;
5084 cbar
.fieldoffset
= 0;
5085 cbar
.type
= ARM_CP_CONST
;
5087 define_one_arm_cp_reg(cpu
, &cbar
);
5091 if (arm_feature(env
, ARM_FEATURE_VBAR
)) {
5092 ARMCPRegInfo vbar_cp_reginfo
[] = {
5093 { .name
= "VBAR", .state
= ARM_CP_STATE_BOTH
,
5094 .opc0
= 3, .crn
= 12, .crm
= 0, .opc1
= 0, .opc2
= 0,
5095 .access
= PL1_RW
, .writefn
= vbar_write
,
5096 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.vbar_s
),
5097 offsetof(CPUARMState
, cp15
.vbar_ns
) },
5101 define_arm_cp_regs(cpu
, vbar_cp_reginfo
);
5104 /* Generic registers whose values depend on the implementation */
5106 ARMCPRegInfo sctlr
= {
5107 .name
= "SCTLR", .state
= ARM_CP_STATE_BOTH
,
5108 .opc0
= 3, .opc1
= 0, .crn
= 1, .crm
= 0, .opc2
= 0,
5110 .bank_fieldoffsets
= { offsetof(CPUARMState
, cp15
.sctlr_s
),
5111 offsetof(CPUARMState
, cp15
.sctlr_ns
) },
5112 .writefn
= sctlr_write
, .resetvalue
= cpu
->reset_sctlr
,
5113 .raw_writefn
= raw_write
,
5115 if (arm_feature(env
, ARM_FEATURE_XSCALE
)) {
5116 /* Normally we would always end the TB on an SCTLR write, but Linux
5117 * arch/arm/mach-pxa/sleep.S expects two instructions following
5118 * an MMU enable to execute from cache. Imitate this behaviour.
5120 sctlr
.type
|= ARM_CP_SUPPRESS_TB_END
;
5122 define_one_arm_cp_reg(cpu
, &sctlr
);
5126 ARMCPU
*cpu_arm_init(const char *cpu_model
)
5128 return ARM_CPU(cpu_generic_init(TYPE_ARM_CPU
, cpu_model
));
5131 void arm_cpu_register_gdb_regs_for_features(ARMCPU
*cpu
)
5133 CPUState
*cs
= CPU(cpu
);
5134 CPUARMState
*env
= &cpu
->env
;
5136 if (arm_feature(env
, ARM_FEATURE_AARCH64
)) {
5137 gdb_register_coprocessor(cs
, aarch64_fpu_gdb_get_reg
,
5138 aarch64_fpu_gdb_set_reg
,
5139 34, "aarch64-fpu.xml", 0);
5140 } else if (arm_feature(env
, ARM_FEATURE_NEON
)) {
5141 gdb_register_coprocessor(cs
, vfp_gdb_get_reg
, vfp_gdb_set_reg
,
5142 51, "arm-neon.xml", 0);
5143 } else if (arm_feature(env
, ARM_FEATURE_VFP3
)) {
5144 gdb_register_coprocessor(cs
, vfp_gdb_get_reg
, vfp_gdb_set_reg
,
5145 35, "arm-vfp3.xml", 0);
5146 } else if (arm_feature(env
, ARM_FEATURE_VFP
)) {
5147 gdb_register_coprocessor(cs
, vfp_gdb_get_reg
, vfp_gdb_set_reg
,
5148 19, "arm-vfp.xml", 0);
5152 /* Sort alphabetically by type name, except for "any". */
5153 static gint
arm_cpu_list_compare(gconstpointer a
, gconstpointer b
)
5155 ObjectClass
*class_a
= (ObjectClass
*)a
;
5156 ObjectClass
*class_b
= (ObjectClass
*)b
;
5157 const char *name_a
, *name_b
;
5159 name_a
= object_class_get_name(class_a
);
5160 name_b
= object_class_get_name(class_b
);
5161 if (strcmp(name_a
, "any-" TYPE_ARM_CPU
) == 0) {
5163 } else if (strcmp(name_b
, "any-" TYPE_ARM_CPU
) == 0) {
5166 return strcmp(name_a
, name_b
);
5170 static void arm_cpu_list_entry(gpointer data
, gpointer user_data
)
5172 ObjectClass
*oc
= data
;
5173 CPUListState
*s
= user_data
;
5174 const char *typename
;
5177 typename
= object_class_get_name(oc
);
5178 name
= g_strndup(typename
, strlen(typename
) - strlen("-" TYPE_ARM_CPU
));
5179 (*s
->cpu_fprintf
)(s
->file
, " %s\n",
5184 void arm_cpu_list(FILE *f
, fprintf_function cpu_fprintf
)
5188 .cpu_fprintf
= cpu_fprintf
,
5192 list
= object_class_get_list(TYPE_ARM_CPU
, false);
5193 list
= g_slist_sort(list
, arm_cpu_list_compare
);
5194 (*cpu_fprintf
)(f
, "Available CPUs:\n");
5195 g_slist_foreach(list
, arm_cpu_list_entry
, &s
);
5198 /* The 'host' CPU type is dynamically registered only if KVM is
5199 * enabled, so we have to special-case it here:
5201 (*cpu_fprintf
)(f
, " host (only available in KVM mode)\n");
5205 static void arm_cpu_add_definition(gpointer data
, gpointer user_data
)
5207 ObjectClass
*oc
= data
;
5208 CpuDefinitionInfoList
**cpu_list
= user_data
;
5209 CpuDefinitionInfoList
*entry
;
5210 CpuDefinitionInfo
*info
;
5211 const char *typename
;
5213 typename
= object_class_get_name(oc
);
5214 info
= g_malloc0(sizeof(*info
));
5215 info
->name
= g_strndup(typename
,
5216 strlen(typename
) - strlen("-" TYPE_ARM_CPU
));
5217 info
->q_typename
= g_strdup(typename
);
5219 entry
= g_malloc0(sizeof(*entry
));
5220 entry
->value
= info
;
5221 entry
->next
= *cpu_list
;
5225 CpuDefinitionInfoList
*arch_query_cpu_definitions(Error
**errp
)
5227 CpuDefinitionInfoList
*cpu_list
= NULL
;
5230 list
= object_class_get_list(TYPE_ARM_CPU
, false);
5231 g_slist_foreach(list
, arm_cpu_add_definition
, &cpu_list
);
5237 static void add_cpreg_to_hashtable(ARMCPU
*cpu
, const ARMCPRegInfo
*r
,
5238 void *opaque
, int state
, int secstate
,
5239 int crm
, int opc1
, int opc2
)
5241 /* Private utility function for define_one_arm_cp_reg_with_opaque():
5242 * add a single reginfo struct to the hash table.
5244 uint32_t *key
= g_new(uint32_t, 1);
5245 ARMCPRegInfo
*r2
= g_memdup(r
, sizeof(ARMCPRegInfo
));
5246 int is64
= (r
->type
& ARM_CP_64BIT
) ? 1 : 0;
5247 int ns
= (secstate
& ARM_CP_SECSTATE_NS
) ? 1 : 0;
5249 /* Reset the secure state to the specific incoming state. This is
5250 * necessary as the register may have been defined with both states.
5252 r2
->secure
= secstate
;
5254 if (r
->bank_fieldoffsets
[0] && r
->bank_fieldoffsets
[1]) {
5255 /* Register is banked (using both entries in array).
5256 * Overwriting fieldoffset as the array is only used to define
5257 * banked registers but later only fieldoffset is used.
5259 r2
->fieldoffset
= r
->bank_fieldoffsets
[ns
];
5262 if (state
== ARM_CP_STATE_AA32
) {
5263 if (r
->bank_fieldoffsets
[0] && r
->bank_fieldoffsets
[1]) {
5264 /* If the register is banked then we don't need to migrate or
5265 * reset the 32-bit instance in certain cases:
5267 * 1) If the register has both 32-bit and 64-bit instances then we
5268 * can count on the 64-bit instance taking care of the
5270 * 2) If ARMv8 is enabled then we can count on a 64-bit version
5271 * taking care of the secure bank. This requires that separate
5272 * 32 and 64-bit definitions are provided.
5274 if ((r
->state
== ARM_CP_STATE_BOTH
&& ns
) ||
5275 (arm_feature(&cpu
->env
, ARM_FEATURE_V8
) && !ns
)) {
5276 r2
->type
|= ARM_CP_ALIAS
;
5278 } else if ((secstate
!= r
->secure
) && !ns
) {
5279 /* The register is not banked so we only want to allow migration of
5280 * the non-secure instance.
5282 r2
->type
|= ARM_CP_ALIAS
;
5285 if (r
->state
== ARM_CP_STATE_BOTH
) {
5286 /* We assume it is a cp15 register if the .cp field is left unset.
5292 #ifdef HOST_WORDS_BIGENDIAN
5293 if (r2
->fieldoffset
) {
5294 r2
->fieldoffset
+= sizeof(uint32_t);
5299 if (state
== ARM_CP_STATE_AA64
) {
5300 /* To allow abbreviation of ARMCPRegInfo
5301 * definitions, we treat cp == 0 as equivalent to
5302 * the value for "standard guest-visible sysreg".
5303 * STATE_BOTH definitions are also always "standard
5304 * sysreg" in their AArch64 view (the .cp value may
5305 * be non-zero for the benefit of the AArch32 view).
5307 if (r
->cp
== 0 || r
->state
== ARM_CP_STATE_BOTH
) {
5308 r2
->cp
= CP_REG_ARM64_SYSREG_CP
;
5310 *key
= ENCODE_AA64_CP_REG(r2
->cp
, r2
->crn
, crm
,
5311 r2
->opc0
, opc1
, opc2
);
5313 *key
= ENCODE_CP_REG(r2
->cp
, is64
, ns
, r2
->crn
, crm
, opc1
, opc2
);
5316 r2
->opaque
= opaque
;
5318 /* reginfo passed to helpers is correct for the actual access,
5319 * and is never ARM_CP_STATE_BOTH:
5322 /* Make sure reginfo passed to helpers for wildcarded regs
5323 * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
5328 /* By convention, for wildcarded registers only the first
5329 * entry is used for migration; the others are marked as
5330 * ALIAS so we don't try to transfer the register
5331 * multiple times. Special registers (ie NOP/WFI) are
5332 * never migratable and not even raw-accessible.
5334 if ((r
->type
& ARM_CP_SPECIAL
)) {
5335 r2
->type
|= ARM_CP_NO_RAW
;
5337 if (((r
->crm
== CP_ANY
) && crm
!= 0) ||
5338 ((r
->opc1
== CP_ANY
) && opc1
!= 0) ||
5339 ((r
->opc2
== CP_ANY
) && opc2
!= 0)) {
5340 r2
->type
|= ARM_CP_ALIAS
;
5343 /* Check that raw accesses are either forbidden or handled. Note that
5344 * we can't assert this earlier because the setup of fieldoffset for
5345 * banked registers has to be done first.
5347 if (!(r2
->type
& ARM_CP_NO_RAW
)) {
5348 assert(!raw_accessors_invalid(r2
));
5351 /* Overriding of an existing definition must be explicitly
5354 if (!(r
->type
& ARM_CP_OVERRIDE
)) {
5355 ARMCPRegInfo
*oldreg
;
5356 oldreg
= g_hash_table_lookup(cpu
->cp_regs
, key
);
5357 if (oldreg
&& !(oldreg
->type
& ARM_CP_OVERRIDE
)) {
5358 fprintf(stderr
, "Register redefined: cp=%d %d bit "
5359 "crn=%d crm=%d opc1=%d opc2=%d, "
5360 "was %s, now %s\n", r2
->cp
, 32 + 32 * is64
,
5361 r2
->crn
, r2
->crm
, r2
->opc1
, r2
->opc2
,
5362 oldreg
->name
, r2
->name
);
5363 g_assert_not_reached();
5366 g_hash_table_insert(cpu
->cp_regs
, key
, r2
);
5370 void define_one_arm_cp_reg_with_opaque(ARMCPU
*cpu
,
5371 const ARMCPRegInfo
*r
, void *opaque
)
5373 /* Define implementations of coprocessor registers.
5374 * We store these in a hashtable because typically
5375 * there are less than 150 registers in a space which
5376 * is 16*16*16*8*8 = 262144 in size.
5377 * Wildcarding is supported for the crm, opc1 and opc2 fields.
5378 * If a register is defined twice then the second definition is
5379 * used, so this can be used to define some generic registers and
5380 * then override them with implementation specific variations.
5381 * At least one of the original and the second definition should
5382 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard
5383 * against accidental use.
5385 * The state field defines whether the register is to be
5386 * visible in the AArch32 or AArch64 execution state. If the
5387 * state is set to ARM_CP_STATE_BOTH then we synthesise a
5388 * reginfo structure for the AArch32 view, which sees the lower
5389 * 32 bits of the 64 bit register.
5391 * Only registers visible in AArch64 may set r->opc0; opc0 cannot
5392 * be wildcarded. AArch64 registers are always considered to be 64
5393 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
5394 * the register, if any.
5396 int crm
, opc1
, opc2
, state
;
5397 int crmmin
= (r
->crm
== CP_ANY
) ? 0 : r
->crm
;
5398 int crmmax
= (r
->crm
== CP_ANY
) ? 15 : r
->crm
;
5399 int opc1min
= (r
->opc1
== CP_ANY
) ? 0 : r
->opc1
;
5400 int opc1max
= (r
->opc1
== CP_ANY
) ? 7 : r
->opc1
;
5401 int opc2min
= (r
->opc2
== CP_ANY
) ? 0 : r
->opc2
;
5402 int opc2max
= (r
->opc2
== CP_ANY
) ? 7 : r
->opc2
;
5403 /* 64 bit registers have only CRm and Opc1 fields */
5404 assert(!((r
->type
& ARM_CP_64BIT
) && (r
->opc2
|| r
->crn
)));
5405 /* op0 only exists in the AArch64 encodings */
5406 assert((r
->state
!= ARM_CP_STATE_AA32
) || (r
->opc0
== 0));
5407 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
5408 assert((r
->state
!= ARM_CP_STATE_AA64
) || !(r
->type
& ARM_CP_64BIT
));
5409 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1
5410 * encodes a minimum access level for the register. We roll this
5411 * runtime check into our general permission check code, so check
5412 * here that the reginfo's specified permissions are strict enough
5413 * to encompass the generic architectural permission check.
5415 if (r
->state
!= ARM_CP_STATE_AA32
) {
5418 case 0: case 1: case 2:
5431 /* unallocated encoding, so not possible */
5439 /* min_EL EL1, secure mode only (we don't check the latter) */
5443 /* broken reginfo with out-of-range opc1 */
5447 /* assert our permissions are not too lax (stricter is fine) */
5448 assert((r
->access
& ~mask
) == 0);
5451 /* Check that the register definition has enough info to handle
5452 * reads and writes if they are permitted.
5454 if (!(r
->type
& (ARM_CP_SPECIAL
|ARM_CP_CONST
))) {
5455 if (r
->access
& PL3_R
) {
5456 assert((r
->fieldoffset
||
5457 (r
->bank_fieldoffsets
[0] && r
->bank_fieldoffsets
[1])) ||
5460 if (r
->access
& PL3_W
) {
5461 assert((r
->fieldoffset
||
5462 (r
->bank_fieldoffsets
[0] && r
->bank_fieldoffsets
[1])) ||
5466 /* Bad type field probably means missing sentinel at end of reg list */
5467 assert(cptype_valid(r
->type
));
5468 for (crm
= crmmin
; crm
<= crmmax
; crm
++) {
5469 for (opc1
= opc1min
; opc1
<= opc1max
; opc1
++) {
5470 for (opc2
= opc2min
; opc2
<= opc2max
; opc2
++) {
5471 for (state
= ARM_CP_STATE_AA32
;
5472 state
<= ARM_CP_STATE_AA64
; state
++) {
5473 if (r
->state
!= state
&& r
->state
!= ARM_CP_STATE_BOTH
) {
5476 if (state
== ARM_CP_STATE_AA32
) {
5477 /* Under AArch32 CP registers can be common
5478 * (same for secure and non-secure world) or banked.
5480 switch (r
->secure
) {
5481 case ARM_CP_SECSTATE_S
:
5482 case ARM_CP_SECSTATE_NS
:
5483 add_cpreg_to_hashtable(cpu
, r
, opaque
, state
,
5484 r
->secure
, crm
, opc1
, opc2
);
5487 add_cpreg_to_hashtable(cpu
, r
, opaque
, state
,
5490 add_cpreg_to_hashtable(cpu
, r
, opaque
, state
,
5496 /* AArch64 registers get mapped to non-secure instance
5498 add_cpreg_to_hashtable(cpu
, r
, opaque
, state
,
5508 void define_arm_cp_regs_with_opaque(ARMCPU
*cpu
,
5509 const ARMCPRegInfo
*regs
, void *opaque
)
5511 /* Define a whole list of registers */
5512 const ARMCPRegInfo
*r
;
5513 for (r
= regs
; r
->type
!= ARM_CP_SENTINEL
; r
++) {
5514 define_one_arm_cp_reg_with_opaque(cpu
, r
, opaque
);
5518 const ARMCPRegInfo
*get_arm_cp_reginfo(GHashTable
*cpregs
, uint32_t encoded_cp
)
5520 return g_hash_table_lookup(cpregs
, &encoded_cp
);
5523 void arm_cp_write_ignore(CPUARMState
*env
, const ARMCPRegInfo
*ri
,
5526 /* Helper coprocessor write function for write-ignore registers */
5529 uint64_t arm_cp_read_zero(CPUARMState
*env
, const ARMCPRegInfo
*ri
)
5531 /* Helper coprocessor write function for read-as-zero registers */
5535 void arm_cp_reset_ignore(CPUARMState
*env
, const ARMCPRegInfo
*opaque
)
5537 /* Helper coprocessor reset function for do-nothing-on-reset registers */
5540 static int bad_mode_switch(CPUARMState
*env
, int mode
, CPSRWriteType write_type
)
5542 /* Return true if it is not valid for us to switch to
5543 * this CPU mode (ie all the UNPREDICTABLE cases in
5544 * the ARM ARM CPSRWriteByInstr pseudocode).
5547 /* Changes to or from Hyp via MSR and CPS are illegal. */
5548 if (write_type
== CPSRWriteByInstr
&&
5549 ((env
->uncached_cpsr
& CPSR_M
) == ARM_CPU_MODE_HYP
||
5550 mode
== ARM_CPU_MODE_HYP
)) {
5555 case ARM_CPU_MODE_USR
:
5557 case ARM_CPU_MODE_SYS
:
5558 case ARM_CPU_MODE_SVC
:
5559 case ARM_CPU_MODE_ABT
:
5560 case ARM_CPU_MODE_UND
:
5561 case ARM_CPU_MODE_IRQ
:
5562 case ARM_CPU_MODE_FIQ
:
5563 /* Note that we don't implement the IMPDEF NSACR.RFR which in v7
5564 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.)
5566 /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR
5567 * and CPS are treated as illegal mode changes.
5569 if (write_type
== CPSRWriteByInstr
&&
5570 (env
->cp15
.hcr_el2
& HCR_TGE
) &&
5571 (env
->uncached_cpsr
& CPSR_M
) == ARM_CPU_MODE_MON
&&
5572 !arm_is_secure_below_el3(env
)) {
5576 case ARM_CPU_MODE_HYP
:
5577 return !arm_feature(env
, ARM_FEATURE_EL2
)
5578 || arm_current_el(env
) < 2 || arm_is_secure(env
);
5579 case ARM_CPU_MODE_MON
:
5580 return arm_current_el(env
) < 3;
5586 uint32_t cpsr_read(CPUARMState
*env
)
5589 ZF
= (env
->ZF
== 0);
5590 return env
->uncached_cpsr
| (env
->NF
& 0x80000000) | (ZF
<< 30) |
5591 (env
->CF
<< 29) | ((env
->VF
& 0x80000000) >> 3) | (env
->QF
<< 27)
5592 | (env
->thumb
<< 5) | ((env
->condexec_bits
& 3) << 25)
5593 | ((env
->condexec_bits
& 0xfc) << 8)
5594 | (env
->GE
<< 16) | (env
->daif
& CPSR_AIF
);
5597 void cpsr_write(CPUARMState
*env
, uint32_t val
, uint32_t mask
,
5598 CPSRWriteType write_type
)
5600 uint32_t changed_daif
;
5602 if (mask
& CPSR_NZCV
) {
5603 env
->ZF
= (~val
) & CPSR_Z
;
5605 env
->CF
= (val
>> 29) & 1;
5606 env
->VF
= (val
<< 3) & 0x80000000;
5609 env
->QF
= ((val
& CPSR_Q
) != 0);
5611 env
->thumb
= ((val
& CPSR_T
) != 0);
5612 if (mask
& CPSR_IT_0_1
) {
5613 env
->condexec_bits
&= ~3;
5614 env
->condexec_bits
|= (val
>> 25) & 3;
5616 if (mask
& CPSR_IT_2_7
) {
5617 env
->condexec_bits
&= 3;
5618 env
->condexec_bits
|= (val
>> 8) & 0xfc;
5620 if (mask
& CPSR_GE
) {
5621 env
->GE
= (val
>> 16) & 0xf;
5624 /* In a V7 implementation that includes the security extensions but does
5625 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control
5626 * whether non-secure software is allowed to change the CPSR_F and CPSR_A
5627 * bits respectively.
5629 * In a V8 implementation, it is permitted for privileged software to
5630 * change the CPSR A/F bits regardless of the SCR.AW/FW bits.
5632 if (write_type
!= CPSRWriteRaw
&& !arm_feature(env
, ARM_FEATURE_V8
) &&
5633 arm_feature(env
, ARM_FEATURE_EL3
) &&
5634 !arm_feature(env
, ARM_FEATURE_EL2
) &&
5635 !arm_is_secure(env
)) {
5637 changed_daif
= (env
->daif
^ val
) & mask
;
5639 if (changed_daif
& CPSR_A
) {
5640 /* Check to see if we are allowed to change the masking of async
5641 * abort exceptions from a non-secure state.
5643 if (!(env
->cp15
.scr_el3
& SCR_AW
)) {
5644 qemu_log_mask(LOG_GUEST_ERROR
,
5645 "Ignoring attempt to switch CPSR_A flag from "
5646 "non-secure world with SCR.AW bit clear\n");
5651 if (changed_daif
& CPSR_F
) {
5652 /* Check to see if we are allowed to change the masking of FIQ
5653 * exceptions from a non-secure state.
5655 if (!(env
->cp15
.scr_el3
& SCR_FW
)) {
5656 qemu_log_mask(LOG_GUEST_ERROR
,
5657 "Ignoring attempt to switch CPSR_F flag from "
5658 "non-secure world with SCR.FW bit clear\n");
5662 /* Check whether non-maskable FIQ (NMFI) support is enabled.
5663 * If this bit is set software is not allowed to mask
5664 * FIQs, but is allowed to set CPSR_F to 0.
5666 if ((A32_BANKED_CURRENT_REG_GET(env
, sctlr
) & SCTLR_NMFI
) &&
5668 qemu_log_mask(LOG_GUEST_ERROR
,
5669 "Ignoring attempt to enable CPSR_F flag "
5670 "(non-maskable FIQ [NMFI] support enabled)\n");
5676 env
->daif
&= ~(CPSR_AIF
& mask
);
5677 env
->daif
|= val
& CPSR_AIF
& mask
;
5679 if (write_type
!= CPSRWriteRaw
&&
5680 ((env
->uncached_cpsr
^ val
) & mask
& CPSR_M
)) {
5681 if ((env
->uncached_cpsr
& CPSR_M
) == ARM_CPU_MODE_USR
) {
5682 /* Note that we can only get here in USR mode if this is a
5683 * gdb stub write; for this case we follow the architectural
5684 * behaviour for guest writes in USR mode of ignoring an attempt
5685 * to switch mode. (Those are caught by translate.c for writes
5686 * triggered by guest instructions.)
5689 } else if (bad_mode_switch(env
, val
& CPSR_M
, write_type
)) {
5690 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in
5691 * v7, and has defined behaviour in v8:
5692 * + leave CPSR.M untouched
5693 * + allow changes to the other CPSR fields
5695 * For user changes via the GDB stub, we don't set PSTATE.IL,
5696 * as this would be unnecessarily harsh for a user error.
5699 if (write_type
!= CPSRWriteByGDBStub
&&
5700 arm_feature(env
, ARM_FEATURE_V8
)) {
5705 switch_mode(env
, val
& CPSR_M
);
5708 mask
&= ~CACHED_CPSR_BITS
;
5709 env
->uncached_cpsr
= (env
->uncached_cpsr
& ~mask
) | (val
& mask
);
5712 /* Sign/zero extend */
5713 uint32_t HELPER(sxtb16
)(uint32_t x
)
5716 res
= (uint16_t)(int8_t)x
;
5717 res
|= (uint32_t)(int8_t)(x
>> 16) << 16;
5721 uint32_t HELPER(uxtb16
)(uint32_t x
)
5724 res
= (uint16_t)(uint8_t)x
;
5725 res
|= (uint32_t)(uint8_t)(x
>> 16) << 16;
5729 int32_t HELPER(sdiv
)(int32_t num
, int32_t den
)
5733 if (num
== INT_MIN
&& den
== -1)
5738 uint32_t HELPER(udiv
)(uint32_t num
, uint32_t den
)
5745 uint32_t HELPER(rbit
)(uint32_t x
)
5750 #if defined(CONFIG_USER_ONLY)
5752 /* These should probably raise undefined insn exceptions. */
5753 void HELPER(v7m_msr
)(CPUARMState
*env
, uint32_t reg
, uint32_t val
)
5755 ARMCPU
*cpu
= arm_env_get_cpu(env
);
5757 cpu_abort(CPU(cpu
), "v7m_msr %d\n", reg
);
5760 uint32_t QEMU_NORETURN
HELPER(v7m_mrs
)(CPUARMState
*env
, uint32_t reg
)
5762 ARMCPU
*cpu
= arm_env_get_cpu(env
);
5764 cpu_abort(CPU(cpu
), "v7m_mrs %d\n", reg
);
5767 void switch_mode(CPUARMState
*env
, int mode
)
5769 ARMCPU
*cpu
= arm_env_get_cpu(env
);
5771 if (mode
!= ARM_CPU_MODE_USR
) {
5772 cpu_abort(CPU(cpu
), "Tried to switch out of user mode\n");
5776 uint32_t arm_phys_excp_target_el(CPUState
*cs
, uint32_t excp_idx
,
5777 uint32_t cur_el
, bool secure
)
5782 void aarch64_sync_64_to_32(CPUARMState
*env
)
5784 g_assert_not_reached();
5789 void switch_mode(CPUARMState
*env
, int mode
)
5794 old_mode
= env
->uncached_cpsr
& CPSR_M
;
5795 if (mode
== old_mode
)
5798 if (old_mode
== ARM_CPU_MODE_FIQ
) {
5799 memcpy (env
->fiq_regs
, env
->regs
+ 8, 5 * sizeof(uint32_t));
5800 memcpy (env
->regs
+ 8, env
->usr_regs
, 5 * sizeof(uint32_t));
5801 } else if (mode
== ARM_CPU_MODE_FIQ
) {
5802 memcpy (env
->usr_regs
, env
->regs
+ 8, 5 * sizeof(uint32_t));
5803 memcpy (env
->regs
+ 8, env
->fiq_regs
, 5 * sizeof(uint32_t));
5806 i
= bank_number(old_mode
);
5807 env
->banked_r13
[i
] = env
->regs
[13];
5808 env
->banked_r14
[i
] = env
->regs
[14];
5809 env
->banked_spsr
[i
] = env
->spsr
;
5811 i
= bank_number(mode
);
5812 env
->regs
[13] = env
->banked_r13
[i
];
5813 env
->regs
[14] = env
->banked_r14
[i
];
5814 env
->spsr
= env
->banked_spsr
[i
];
5817 /* Physical Interrupt Target EL Lookup Table
5819 * [ From ARM ARM section G1.13.4 (Table G1-15) ]
5821 * The below multi-dimensional table is used for looking up the target
5822 * exception level given numerous condition criteria. Specifically, the
5823 * target EL is based on SCR and HCR routing controls as well as the
5824 * currently executing EL and secure state.
5827 * target_el_table[2][2][2][2][2][4]
5828 * | | | | | +--- Current EL
5829 * | | | | +------ Non-secure(0)/Secure(1)
5830 * | | | +--------- HCR mask override
5831 * | | +------------ SCR exec state control
5832 * | +--------------- SCR mask override
5833 * +------------------ 32-bit(0)/64-bit(1) EL3
5835 * The table values are as such:
5839 * The ARM ARM target EL table includes entries indicating that an "exception
5840 * is not taken". The two cases where this is applicable are:
5841 * 1) An exception is taken from EL3 but the SCR does not have the exception
5843 * 2) An exception is taken from EL2 but the HCR does not have the exception
5845 * In these two cases, the below table contain a target of EL1. This value is
5846 * returned as it is expected that the consumer of the table data will check
5847 * for "target EL >= current EL" to ensure the exception is not taken.
5851 * BIT IRQ IMO Non-secure Secure
5852 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3
5854 static const int8_t target_el_table
[2][2][2][2][2][4] = {
5855 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
5856 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},
5857 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
5858 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},},
5859 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
5860 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},
5861 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
5862 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},},
5863 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },},
5864 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},
5865 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },},
5866 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},},
5867 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
5868 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},
5869 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
5870 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},},
5874 * Determine the target EL for physical exceptions
5876 uint32_t arm_phys_excp_target_el(CPUState
*cs
, uint32_t excp_idx
,
5877 uint32_t cur_el
, bool secure
)
5879 CPUARMState
*env
= cs
->env_ptr
;
5884 /* Is the highest EL AArch64? */
5885 int is64
= arm_feature(env
, ARM_FEATURE_AARCH64
);
5887 if (arm_feature(env
, ARM_FEATURE_EL3
)) {
5888 rw
= ((env
->cp15
.scr_el3
& SCR_RW
) == SCR_RW
);
5890 /* Either EL2 is the highest EL (and so the EL2 register width
5891 * is given by is64); or there is no EL2 or EL3, in which case
5892 * the value of 'rw' does not affect the table lookup anyway.
5899 scr
= ((env
->cp15
.scr_el3
& SCR_IRQ
) == SCR_IRQ
);
5900 hcr
= ((env
->cp15
.hcr_el2
& HCR_IMO
) == HCR_IMO
);
5903 scr
= ((env
->cp15
.scr_el3
& SCR_FIQ
) == SCR_FIQ
);
5904 hcr
= ((env
->cp15
.hcr_el2
& HCR_FMO
) == HCR_FMO
);
5907 scr
= ((env
->cp15
.scr_el3
& SCR_EA
) == SCR_EA
);
5908 hcr
= ((env
->cp15
.hcr_el2
& HCR_AMO
) == HCR_AMO
);
5912 /* If HCR.TGE is set then HCR is treated as being 1 */
5913 hcr
|= ((env
->cp15
.hcr_el2
& HCR_TGE
) == HCR_TGE
);
5915 /* Perform a table-lookup for the target EL given the current state */
5916 target_el
= target_el_table
[is64
][scr
][rw
][hcr
][secure
][cur_el
];
5918 assert(target_el
> 0);
5923 static void v7m_push(CPUARMState
*env
, uint32_t val
)
5925 CPUState
*cs
= CPU(arm_env_get_cpu(env
));
5928 stl_phys(cs
->as
, env
->regs
[13], val
);
5931 static uint32_t v7m_pop(CPUARMState
*env
)
5933 CPUState
*cs
= CPU(arm_env_get_cpu(env
));
5936 val
= ldl_phys(cs
->as
, env
->regs
[13]);
5941 /* Switch to V7M main or process stack pointer. */
5942 static void switch_v7m_sp(CPUARMState
*env
, int process
)
5945 if (env
->v7m
.current_sp
!= process
) {
5946 tmp
= env
->v7m
.other_sp
;
5947 env
->v7m
.other_sp
= env
->regs
[13];
5948 env
->regs
[13] = tmp
;
5949 env
->v7m
.current_sp
= process
;
5953 static void do_v7m_exception_exit(CPUARMState
*env
)
5958 type
= env
->regs
[15];
5959 if (env
->v7m
.exception
!= 0)
5960 armv7m_nvic_complete_irq(env
->nvic
, env
->v7m
.exception
);
5962 /* Switch to the target stack. */
5963 switch_v7m_sp(env
, (type
& 4) != 0);
5964 /* Pop registers. */
5965 env
->regs
[0] = v7m_pop(env
);
5966 env
->regs
[1] = v7m_pop(env
);
5967 env
->regs
[2] = v7m_pop(env
);
5968 env
->regs
[3] = v7m_pop(env
);
5969 env
->regs
[12] = v7m_pop(env
);
5970 env
->regs
[14] = v7m_pop(env
);
5971 env
->regs
[15] = v7m_pop(env
);
5972 if (env
->regs
[15] & 1) {
5973 qemu_log_mask(LOG_GUEST_ERROR
,
5974 "M profile return from interrupt with misaligned "
5975 "PC is UNPREDICTABLE\n");
5976 /* Actual hardware seems to ignore the lsbit, and there are several
5977 * RTOSes out there which incorrectly assume the r15 in the stack
5978 * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
5980 env
->regs
[15] &= ~1U;
5982 xpsr
= v7m_pop(env
);
5983 xpsr_write(env
, xpsr
, 0xfffffdff);
5984 /* Undo stack alignment. */
5987 /* ??? The exception return type specifies Thread/Handler mode. However
5988 this is also implied by the xPSR value. Not sure what to do
5989 if there is a mismatch. */
5990 /* ??? Likewise for mismatches between the CONTROL register and the stack
5994 static void arm_log_exception(int idx
)
5996 if (qemu_loglevel_mask(CPU_LOG_INT
)) {
5997 const char *exc
= NULL
;
5999 if (idx
>= 0 && idx
< ARRAY_SIZE(excnames
)) {
6000 exc
= excnames
[idx
];
6005 qemu_log_mask(CPU_LOG_INT
, "Taking exception %d [%s]\n", idx
, exc
);
6009 void arm_v7m_cpu_do_interrupt(CPUState
*cs
)
6011 ARMCPU
*cpu
= ARM_CPU(cs
);
6012 CPUARMState
*env
= &cpu
->env
;
6013 uint32_t xpsr
= xpsr_read(env
);
6017 arm_log_exception(cs
->exception_index
);
6020 if (env
->v7m
.current_sp
)
6022 if (env
->v7m
.exception
== 0)
6025 /* For exceptions we just mark as pending on the NVIC, and let that
6027 /* TODO: Need to escalate if the current priority is higher than the
6028 one we're raising. */
6029 switch (cs
->exception_index
) {
6031 armv7m_nvic_set_pending(env
->nvic
, ARMV7M_EXCP_USAGE
);
6034 /* The PC already points to the next instruction. */
6035 armv7m_nvic_set_pending(env
->nvic
, ARMV7M_EXCP_SVC
);
6037 case EXCP_PREFETCH_ABORT
:
6038 case EXCP_DATA_ABORT
:
6039 /* TODO: if we implemented the MPU registers, this is where we
6040 * should set the MMFAR, etc from exception.fsr and exception.vaddress.
6042 armv7m_nvic_set_pending(env
->nvic
, ARMV7M_EXCP_MEM
);
6045 if (semihosting_enabled()) {
6047 nr
= arm_lduw_code(env
, env
->regs
[15], arm_sctlr_b(env
)) & 0xff;
6050 qemu_log_mask(CPU_LOG_INT
,
6051 "...handling as semihosting call 0x%x\n",
6053 env
->regs
[0] = do_arm_semihosting(env
);
6057 armv7m_nvic_set_pending(env
->nvic
, ARMV7M_EXCP_DEBUG
);
6060 env
->v7m
.exception
= armv7m_nvic_acknowledge_irq(env
->nvic
);
6062 case EXCP_EXCEPTION_EXIT
:
6063 do_v7m_exception_exit(env
);
6066 cpu_abort(cs
, "Unhandled exception 0x%x\n", cs
->exception_index
);
6067 return; /* Never happens. Keep compiler happy. */
6070 /* Align stack pointer. */
6071 /* ??? Should only do this if Configuration Control Register
6072 STACKALIGN bit is set. */
6073 if (env
->regs
[13] & 4) {
6077 /* Switch to the handler mode. */
6078 v7m_push(env
, xpsr
);
6079 v7m_push(env
, env
->regs
[15]);
6080 v7m_push(env
, env
->regs
[14]);
6081 v7m_push(env
, env
->regs
[12]);
6082 v7m_push(env
, env
->regs
[3]);
6083 v7m_push(env
, env
->regs
[2]);
6084 v7m_push(env
, env
->regs
[1]);
6085 v7m_push(env
, env
->regs
[0]);
6086 switch_v7m_sp(env
, 0);
6088 env
->condexec_bits
= 0;
6090 addr
= ldl_phys(cs
->as
, env
->v7m
.vecbase
+ env
->v7m
.exception
* 4);
6091 env
->regs
[15] = addr
& 0xfffffffe;
6092 env
->thumb
= addr
& 1;
6095 /* Function used to synchronize QEMU's AArch64 register set with AArch32
6096 * register set. This is necessary when switching between AArch32 and AArch64
6099 void aarch64_sync_32_to_64(CPUARMState
*env
)
6102 uint32_t mode
= env
->uncached_cpsr
& CPSR_M
;
6104 /* We can blanket copy R[0:7] to X[0:7] */
6105 for (i
= 0; i
< 8; i
++) {
6106 env
->xregs
[i
] = env
->regs
[i
];
6109 /* Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12.
6110 * Otherwise, they come from the banked user regs.
6112 if (mode
== ARM_CPU_MODE_FIQ
) {
6113 for (i
= 8; i
< 13; i
++) {
6114 env
->xregs
[i
] = env
->usr_regs
[i
- 8];
6117 for (i
= 8; i
< 13; i
++) {
6118 env
->xregs
[i
] = env
->regs
[i
];
6122 /* Registers x13-x23 are the various mode SP and FP registers. Registers
6123 * r13 and r14 are only copied if we are in that mode, otherwise we copy
6124 * from the mode banked register.
6126 if (mode
== ARM_CPU_MODE_USR
|| mode
== ARM_CPU_MODE_SYS
) {
6127 env
->xregs
[13] = env
->regs
[13];
6128 env
->xregs
[14] = env
->regs
[14];
6130 env
->xregs
[13] = env
->banked_r13
[bank_number(ARM_CPU_MODE_USR
)];
6131 /* HYP is an exception in that it is copied from r14 */
6132 if (mode
== ARM_CPU_MODE_HYP
) {
6133 env
->xregs
[14] = env
->regs
[14];
6135 env
->xregs
[14] = env
->banked_r14
[bank_number(ARM_CPU_MODE_USR
)];
6139 if (mode
== ARM_CPU_MODE_HYP
) {
6140 env
->xregs
[15] = env
->regs
[13];
6142 env
->xregs
[15] = env
->banked_r13
[bank_number(ARM_CPU_MODE_HYP
)];
6145 if (mode
== ARM_CPU_MODE_IRQ
) {
6146 env
->xregs
[16] = env
->regs
[14];
6147 env
->xregs
[17] = env
->regs
[13];
6149 env
->xregs
[16] = env
->banked_r14
[bank_number(ARM_CPU_MODE_IRQ
)];
6150 env
->xregs
[17] = env
->banked_r13
[bank_number(ARM_CPU_MODE_IRQ
)];
6153 if (mode
== ARM_CPU_MODE_SVC
) {
6154 env
->xregs
[18] = env
->regs
[14];
6155 env
->xregs
[19] = env
->regs
[13];
6157 env
->xregs
[18] = env
->banked_r14
[bank_number(ARM_CPU_MODE_SVC
)];
6158 env
->xregs
[19] = env
->banked_r13
[bank_number(ARM_CPU_MODE_SVC
)];
6161 if (mode
== ARM_CPU_MODE_ABT
) {
6162 env
->xregs
[20] = env
->regs
[14];
6163 env
->xregs
[21] = env
->regs
[13];
6165 env
->xregs
[20] = env
->banked_r14
[bank_number(ARM_CPU_MODE_ABT
)];
6166 env
->xregs
[21] = env
->banked_r13
[bank_number(ARM_CPU_MODE_ABT
)];
6169 if (mode
== ARM_CPU_MODE_UND
) {
6170 env
->xregs
[22] = env
->regs
[14];
6171 env
->xregs
[23] = env
->regs
[13];
6173 env
->xregs
[22] = env
->banked_r14
[bank_number(ARM_CPU_MODE_UND
)];
6174 env
->xregs
[23] = env
->banked_r13
[bank_number(ARM_CPU_MODE_UND
)];
6177 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
6178 * mode, then we can copy from r8-r14. Otherwise, we copy from the
6179 * FIQ bank for r8-r14.
6181 if (mode
== ARM_CPU_MODE_FIQ
) {
6182 for (i
= 24; i
< 31; i
++) {
6183 env
->xregs
[i
] = env
->regs
[i
- 16]; /* X[24:30] <- R[8:14] */
6186 for (i
= 24; i
< 29; i
++) {
6187 env
->xregs
[i
] = env
->fiq_regs
[i
- 24];
6189 env
->xregs
[29] = env
->banked_r13
[bank_number(ARM_CPU_MODE_FIQ
)];
6190 env
->xregs
[30] = env
->banked_r14
[bank_number(ARM_CPU_MODE_FIQ
)];
6193 env
->pc
= env
->regs
[15];
6196 /* Function used to synchronize QEMU's AArch32 register set with AArch64
6197 * register set. This is necessary when switching between AArch32 and AArch64
6200 void aarch64_sync_64_to_32(CPUARMState
*env
)
6203 uint32_t mode
= env
->uncached_cpsr
& CPSR_M
;
6205 /* We can blanket copy X[0:7] to R[0:7] */
6206 for (i
= 0; i
< 8; i
++) {
6207 env
->regs
[i
] = env
->xregs
[i
];
6210 /* Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12.
6211 * Otherwise, we copy x8-x12 into the banked user regs.
6213 if (mode
== ARM_CPU_MODE_FIQ
) {
6214 for (i
= 8; i
< 13; i
++) {
6215 env
->usr_regs
[i
- 8] = env
->xregs
[i
];
6218 for (i
= 8; i
< 13; i
++) {
6219 env
->regs
[i
] = env
->xregs
[i
];
6223 /* Registers r13 & r14 depend on the current mode.
6224 * If we are in a given mode, we copy the corresponding x registers to r13
6225 * and r14. Otherwise, we copy the x register to the banked r13 and r14
6228 if (mode
== ARM_CPU_MODE_USR
|| mode
== ARM_CPU_MODE_SYS
) {
6229 env
->regs
[13] = env
->xregs
[13];
6230 env
->regs
[14] = env
->xregs
[14];
6232 env
->banked_r13
[bank_number(ARM_CPU_MODE_USR
)] = env
->xregs
[13];
6234 /* HYP is an exception in that it does not have its own banked r14 but
6235 * shares the USR r14
6237 if (mode
== ARM_CPU_MODE_HYP
) {
6238 env
->regs
[14] = env
->xregs
[14];
6240 env
->banked_r14
[bank_number(ARM_CPU_MODE_USR
)] = env
->xregs
[14];
6244 if (mode
== ARM_CPU_MODE_HYP
) {
6245 env
->regs
[13] = env
->xregs
[15];
6247 env
->banked_r13
[bank_number(ARM_CPU_MODE_HYP
)] = env
->xregs
[15];
6250 if (mode
== ARM_CPU_MODE_IRQ
) {
6251 env
->regs
[14] = env
->xregs
[16];
6252 env
->regs
[13] = env
->xregs
[17];
6254 env
->banked_r14
[bank_number(ARM_CPU_MODE_IRQ
)] = env
->xregs
[16];
6255 env
->banked_r13
[bank_number(ARM_CPU_MODE_IRQ
)] = env
->xregs
[17];
6258 if (mode
== ARM_CPU_MODE_SVC
) {
6259 env
->regs
[14] = env
->xregs
[18];
6260 env
->regs
[13] = env
->xregs
[19];
6262 env
->banked_r14
[bank_number(ARM_CPU_MODE_SVC
)] = env
->xregs
[18];
6263 env
->banked_r13
[bank_number(ARM_CPU_MODE_SVC
)] = env
->xregs
[19];
6266 if (mode
== ARM_CPU_MODE_ABT
) {
6267 env
->regs
[14] = env
->xregs
[20];
6268 env
->regs
[13] = env
->xregs
[21];
6270 env
->banked_r14
[bank_number(ARM_CPU_MODE_ABT
)] = env
->xregs
[20];
6271 env
->banked_r13
[bank_number(ARM_CPU_MODE_ABT
)] = env
->xregs
[21];
6274 if (mode
== ARM_CPU_MODE_UND
) {
6275 env
->regs
[14] = env
->xregs
[22];
6276 env
->regs
[13] = env
->xregs
[23];
6278 env
->banked_r14
[bank_number(ARM_CPU_MODE_UND
)] = env
->xregs
[22];
6279 env
->banked_r13
[bank_number(ARM_CPU_MODE_UND
)] = env
->xregs
[23];
6282 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
6283 * mode, then we can copy to r8-r14. Otherwise, we copy to the
6284 * FIQ bank for r8-r14.
6286 if (mode
== ARM_CPU_MODE_FIQ
) {
6287 for (i
= 24; i
< 31; i
++) {
6288 env
->regs
[i
- 16] = env
->xregs
[i
]; /* X[24:30] -> R[8:14] */
6291 for (i
= 24; i
< 29; i
++) {
6292 env
->fiq_regs
[i
- 24] = env
->xregs
[i
];
6294 env
->banked_r13
[bank_number(ARM_CPU_MODE_FIQ
)] = env
->xregs
[29];
6295 env
->banked_r14
[bank_number(ARM_CPU_MODE_FIQ
)] = env
->xregs
[30];
6298 env
->regs
[15] = env
->pc
;
6301 static void arm_cpu_do_interrupt_aarch32(CPUState
*cs
)
6303 ARMCPU
*cpu
= ARM_CPU(cs
);
6304 CPUARMState
*env
= &cpu
->env
;
6311 /* If this is a debug exception we must update the DBGDSCR.MOE bits */
6312 switch (env
->exception
.syndrome
>> ARM_EL_EC_SHIFT
) {
6314 case EC_BREAKPOINT_SAME_EL
:
6318 case EC_WATCHPOINT_SAME_EL
:
6324 case EC_VECTORCATCH
:
6333 env
->cp15
.mdscr_el1
= deposit64(env
->cp15
.mdscr_el1
, 2, 4, moe
);
6336 /* TODO: Vectored interrupt controller. */
6337 switch (cs
->exception_index
) {
6339 new_mode
= ARM_CPU_MODE_UND
;
6348 new_mode
= ARM_CPU_MODE_SVC
;
6351 /* The PC already points to the next instruction. */
6355 env
->exception
.fsr
= 2;
6356 /* Fall through to prefetch abort. */
6357 case EXCP_PREFETCH_ABORT
:
6358 A32_BANKED_CURRENT_REG_SET(env
, ifsr
, env
->exception
.fsr
);
6359 A32_BANKED_CURRENT_REG_SET(env
, ifar
, env
->exception
.vaddress
);
6360 qemu_log_mask(CPU_LOG_INT
, "...with IFSR 0x%x IFAR 0x%x\n",
6361 env
->exception
.fsr
, (uint32_t)env
->exception
.vaddress
);
6362 new_mode
= ARM_CPU_MODE_ABT
;
6364 mask
= CPSR_A
| CPSR_I
;
6367 case EXCP_DATA_ABORT
:
6368 A32_BANKED_CURRENT_REG_SET(env
, dfsr
, env
->exception
.fsr
);
6369 A32_BANKED_CURRENT_REG_SET(env
, dfar
, env
->exception
.vaddress
);
6370 qemu_log_mask(CPU_LOG_INT
, "...with DFSR 0x%x DFAR 0x%x\n",
6372 (uint32_t)env
->exception
.vaddress
);
6373 new_mode
= ARM_CPU_MODE_ABT
;
6375 mask
= CPSR_A
| CPSR_I
;
6379 new_mode
= ARM_CPU_MODE_IRQ
;
6381 /* Disable IRQ and imprecise data aborts. */
6382 mask
= CPSR_A
| CPSR_I
;
6384 if (env
->cp15
.scr_el3
& SCR_IRQ
) {
6385 /* IRQ routed to monitor mode */
6386 new_mode
= ARM_CPU_MODE_MON
;
6391 new_mode
= ARM_CPU_MODE_FIQ
;
6393 /* Disable FIQ, IRQ and imprecise data aborts. */
6394 mask
= CPSR_A
| CPSR_I
| CPSR_F
;
6395 if (env
->cp15
.scr_el3
& SCR_FIQ
) {
6396 /* FIQ routed to monitor mode */
6397 new_mode
= ARM_CPU_MODE_MON
;
6402 new_mode
= ARM_CPU_MODE_MON
;
6404 mask
= CPSR_A
| CPSR_I
| CPSR_F
;
6408 cpu_abort(cs
, "Unhandled exception 0x%x\n", cs
->exception_index
);
6409 return; /* Never happens. Keep compiler happy. */
6412 if (new_mode
== ARM_CPU_MODE_MON
) {
6413 addr
+= env
->cp15
.mvbar
;
6414 } else if (A32_BANKED_CURRENT_REG_GET(env
, sctlr
) & SCTLR_V
) {
6415 /* High vectors. When enabled, base address cannot be remapped. */
6418 /* ARM v7 architectures provide a vector base address register to remap
6419 * the interrupt vector table.
6420 * This register is only followed in non-monitor mode, and is banked.
6421 * Note: only bits 31:5 are valid.
6423 addr
+= A32_BANKED_CURRENT_REG_GET(env
, vbar
);
6426 if ((env
->uncached_cpsr
& CPSR_M
) == ARM_CPU_MODE_MON
) {
6427 env
->cp15
.scr_el3
&= ~SCR_NS
;
6430 switch_mode (env
, new_mode
);
6431 /* For exceptions taken to AArch32 we must clear the SS bit in both
6432 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.
6434 env
->uncached_cpsr
&= ~PSTATE_SS
;
6435 env
->spsr
= cpsr_read(env
);
6436 /* Clear IT bits. */
6437 env
->condexec_bits
= 0;
6438 /* Switch to the new mode, and to the correct instruction set. */
6439 env
->uncached_cpsr
= (env
->uncached_cpsr
& ~CPSR_M
) | new_mode
;
6440 /* Set new mode endianness */
6441 env
->uncached_cpsr
&= ~CPSR_E
;
6442 if (env
->cp15
.sctlr_el
[arm_current_el(env
)] & SCTLR_EE
) {
6443 env
->uncached_cpsr
|= CPSR_E
;
6446 /* this is a lie, as the was no c1_sys on V4T/V5, but who cares
6447 * and we should just guard the thumb mode on V4 */
6448 if (arm_feature(env
, ARM_FEATURE_V4T
)) {
6449 env
->thumb
= (A32_BANKED_CURRENT_REG_GET(env
, sctlr
) & SCTLR_TE
) != 0;
6451 env
->regs
[14] = env
->regs
[15] + offset
;
6452 env
->regs
[15] = addr
;
6455 /* Handle exception entry to a target EL which is using AArch64 */
6456 static void arm_cpu_do_interrupt_aarch64(CPUState
*cs
)
6458 ARMCPU
*cpu
= ARM_CPU(cs
);
6459 CPUARMState
*env
= &cpu
->env
;
6460 unsigned int new_el
= env
->exception
.target_el
;
6461 target_ulong addr
= env
->cp15
.vbar_el
[new_el
];
6462 unsigned int new_mode
= aarch64_pstate_mode(new_el
, true);
6464 if (arm_current_el(env
) < new_el
) {
6465 /* Entry vector offset depends on whether the implemented EL
6466 * immediately lower than the target level is using AArch32 or AArch64
6472 is_aa64
= (env
->cp15
.scr_el3
& SCR_RW
) != 0;
6475 is_aa64
= (env
->cp15
.hcr_el2
& HCR_RW
) != 0;
6478 is_aa64
= is_a64(env
);
6481 g_assert_not_reached();
6489 } else if (pstate_read(env
) & PSTATE_SP
) {
6493 switch (cs
->exception_index
) {
6494 case EXCP_PREFETCH_ABORT
:
6495 case EXCP_DATA_ABORT
:
6496 env
->cp15
.far_el
[new_el
] = env
->exception
.vaddress
;
6497 qemu_log_mask(CPU_LOG_INT
, "...with FAR 0x%" PRIx64
"\n",
6498 env
->cp15
.far_el
[new_el
]);
6506 env
->cp15
.esr_el
[new_el
] = env
->exception
.syndrome
;
6517 qemu_log_mask(CPU_LOG_INT
,
6518 "...handling as semihosting call 0x%" PRIx64
"\n",
6520 env
->xregs
[0] = do_arm_semihosting(env
);
6523 cpu_abort(cs
, "Unhandled exception 0x%x\n", cs
->exception_index
);
6527 env
->banked_spsr
[aarch64_banked_spsr_index(new_el
)] = pstate_read(env
);
6528 aarch64_save_sp(env
, arm_current_el(env
));
6529 env
->elr_el
[new_el
] = env
->pc
;
6531 env
->banked_spsr
[aarch64_banked_spsr_index(new_el
)] = cpsr_read(env
);
6532 env
->elr_el
[new_el
] = env
->regs
[15];
6534 aarch64_sync_32_to_64(env
);
6536 env
->condexec_bits
= 0;
6538 qemu_log_mask(CPU_LOG_INT
, "...with ELR 0x%" PRIx64
"\n",
6539 env
->elr_el
[new_el
]);
6541 pstate_write(env
, PSTATE_DAIF
| new_mode
);
6543 aarch64_restore_sp(env
, new_el
);
6547 qemu_log_mask(CPU_LOG_INT
, "...to EL%d PC 0x%" PRIx64
" PSTATE 0x%x\n",
6548 new_el
, env
->pc
, pstate_read(env
));
6551 static inline bool check_for_semihosting(CPUState
*cs
)
6553 /* Check whether this exception is a semihosting call; if so
6554 * then handle it and return true; otherwise return false.
6556 ARMCPU
*cpu
= ARM_CPU(cs
);
6557 CPUARMState
*env
= &cpu
->env
;
6560 if (cs
->exception_index
== EXCP_SEMIHOST
) {
6561 /* This is always the 64-bit semihosting exception.
6562 * The "is this usermode" and "is semihosting enabled"
6563 * checks have been done at translate time.
6565 qemu_log_mask(CPU_LOG_INT
,
6566 "...handling as semihosting call 0x%" PRIx64
"\n",
6568 env
->xregs
[0] = do_arm_semihosting(env
);
6575 /* Only intercept calls from privileged modes, to provide some
6576 * semblance of security.
6578 if (cs
->exception_index
!= EXCP_SEMIHOST
&&
6579 (!semihosting_enabled() ||
6580 ((env
->uncached_cpsr
& CPSR_M
) == ARM_CPU_MODE_USR
))) {
6584 switch (cs
->exception_index
) {
6586 /* This is always a semihosting call; the "is this usermode"
6587 * and "is semihosting enabled" checks have been done at
6592 /* Check for semihosting interrupt. */
6594 imm
= arm_lduw_code(env
, env
->regs
[15] - 2, arm_sctlr_b(env
))
6600 imm
= arm_ldl_code(env
, env
->regs
[15] - 4, arm_sctlr_b(env
))
6602 if (imm
== 0x123456) {
6608 /* See if this is a semihosting syscall. */
6610 imm
= arm_lduw_code(env
, env
->regs
[15], arm_sctlr_b(env
))
6622 qemu_log_mask(CPU_LOG_INT
,
6623 "...handling as semihosting call 0x%x\n",
6625 env
->regs
[0] = do_arm_semihosting(env
);
6630 /* Handle a CPU exception for A and R profile CPUs.
6631 * Do any appropriate logging, handle PSCI calls, and then hand off
6632 * to the AArch64-entry or AArch32-entry function depending on the
6633 * target exception level's register width.
6635 void arm_cpu_do_interrupt(CPUState
*cs
)
6637 ARMCPU
*cpu
= ARM_CPU(cs
);
6638 CPUARMState
*env
= &cpu
->env
;
6639 unsigned int new_el
= env
->exception
.target_el
;
6643 arm_log_exception(cs
->exception_index
);
6644 qemu_log_mask(CPU_LOG_INT
, "...from EL%d to EL%d\n", arm_current_el(env
),
6646 if (qemu_loglevel_mask(CPU_LOG_INT
)
6647 && !excp_is_internal(cs
->exception_index
)) {
6648 qemu_log_mask(CPU_LOG_INT
, "...with ESR %x/0x%" PRIx32
"\n",
6649 env
->exception
.syndrome
>> ARM_EL_EC_SHIFT
,
6650 env
->exception
.syndrome
);
6653 if (arm_is_psci_call(cpu
, cs
->exception_index
)) {
6654 arm_handle_psci_call(cpu
);
6655 qemu_log_mask(CPU_LOG_INT
, "...handled as PSCI call\n");
6659 /* Semihosting semantics depend on the register width of the
6660 * code that caused the exception, not the target exception level,
6661 * so must be handled here.
6663 if (check_for_semihosting(cs
)) {
6667 assert(!excp_is_internal(cs
->exception_index
));
6668 if (arm_el_is_aa64(env
, new_el
)) {
6669 arm_cpu_do_interrupt_aarch64(cs
);
6671 arm_cpu_do_interrupt_aarch32(cs
);
6674 arm_call_el_change_hook(cpu
);
6676 if (!kvm_enabled()) {
6677 cs
->interrupt_request
|= CPU_INTERRUPT_EXITTB
;
6681 /* Return the exception level which controls this address translation regime */
6682 static inline uint32_t regime_el(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
6685 case ARMMMUIdx_S2NS
:
6686 case ARMMMUIdx_S1E2
:
6688 case ARMMMUIdx_S1E3
:
6690 case ARMMMUIdx_S1SE0
:
6691 return arm_el_is_aa64(env
, 3) ? 1 : 3;
6692 case ARMMMUIdx_S1SE1
:
6693 case ARMMMUIdx_S1NSE0
:
6694 case ARMMMUIdx_S1NSE1
:
6697 g_assert_not_reached();
6701 /* Return true if this address translation regime is secure */
6702 static inline bool regime_is_secure(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
6705 case ARMMMUIdx_S12NSE0
:
6706 case ARMMMUIdx_S12NSE1
:
6707 case ARMMMUIdx_S1NSE0
:
6708 case ARMMMUIdx_S1NSE1
:
6709 case ARMMMUIdx_S1E2
:
6710 case ARMMMUIdx_S2NS
:
6712 case ARMMMUIdx_S1E3
:
6713 case ARMMMUIdx_S1SE0
:
6714 case ARMMMUIdx_S1SE1
:
6717 g_assert_not_reached();
6721 /* Return the SCTLR value which controls this address translation regime */
6722 static inline uint32_t regime_sctlr(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
6724 return env
->cp15
.sctlr_el
[regime_el(env
, mmu_idx
)];
6727 /* Return true if the specified stage of address translation is disabled */
6728 static inline bool regime_translation_disabled(CPUARMState
*env
,
6731 if (mmu_idx
== ARMMMUIdx_S2NS
) {
6732 return (env
->cp15
.hcr_el2
& HCR_VM
) == 0;
6734 return (regime_sctlr(env
, mmu_idx
) & SCTLR_M
) == 0;
6737 static inline bool regime_translation_big_endian(CPUARMState
*env
,
6740 return (regime_sctlr(env
, mmu_idx
) & SCTLR_EE
) != 0;
6743 /* Return the TCR controlling this translation regime */
6744 static inline TCR
*regime_tcr(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
6746 if (mmu_idx
== ARMMMUIdx_S2NS
) {
6747 return &env
->cp15
.vtcr_el2
;
6749 return &env
->cp15
.tcr_el
[regime_el(env
, mmu_idx
)];
6752 /* Returns TBI0 value for current regime el */
6753 uint32_t arm_regime_tbi0(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
6758 /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
6759 * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
6761 if (mmu_idx
== ARMMMUIdx_S12NSE0
|| mmu_idx
== ARMMMUIdx_S12NSE1
) {
6762 mmu_idx
+= ARMMMUIdx_S1NSE0
;
6765 tcr
= regime_tcr(env
, mmu_idx
);
6766 el
= regime_el(env
, mmu_idx
);
6769 return extract64(tcr
->raw_tcr
, 20, 1);
6771 return extract64(tcr
->raw_tcr
, 37, 1);
6775 /* Returns TBI1 value for current regime el */
6776 uint32_t arm_regime_tbi1(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
6781 /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
6782 * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
6784 if (mmu_idx
== ARMMMUIdx_S12NSE0
|| mmu_idx
== ARMMMUIdx_S12NSE1
) {
6785 mmu_idx
+= ARMMMUIdx_S1NSE0
;
6788 tcr
= regime_tcr(env
, mmu_idx
);
6789 el
= regime_el(env
, mmu_idx
);
6794 return extract64(tcr
->raw_tcr
, 38, 1);
6798 /* Return the TTBR associated with this translation regime */
6799 static inline uint64_t regime_ttbr(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
6802 if (mmu_idx
== ARMMMUIdx_S2NS
) {
6803 return env
->cp15
.vttbr_el2
;
6806 return env
->cp15
.ttbr0_el
[regime_el(env
, mmu_idx
)];
6808 return env
->cp15
.ttbr1_el
[regime_el(env
, mmu_idx
)];
6812 /* Return true if the translation regime is using LPAE format page tables */
6813 static inline bool regime_using_lpae_format(CPUARMState
*env
,
6816 int el
= regime_el(env
, mmu_idx
);
6817 if (el
== 2 || arm_el_is_aa64(env
, el
)) {
6820 if (arm_feature(env
, ARM_FEATURE_LPAE
)
6821 && (regime_tcr(env
, mmu_idx
)->raw_tcr
& TTBCR_EAE
)) {
6827 /* Returns true if the stage 1 translation regime is using LPAE format page
6828 * tables. Used when raising alignment exceptions, whose FSR changes depending
6829 * on whether the long or short descriptor format is in use. */
6830 bool arm_s1_regime_using_lpae_format(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
6832 if (mmu_idx
== ARMMMUIdx_S12NSE0
|| mmu_idx
== ARMMMUIdx_S12NSE1
) {
6833 mmu_idx
+= ARMMMUIdx_S1NSE0
;
6836 return regime_using_lpae_format(env
, mmu_idx
);
6839 static inline bool regime_is_user(CPUARMState
*env
, ARMMMUIdx mmu_idx
)
6842 case ARMMMUIdx_S1SE0
:
6843 case ARMMMUIdx_S1NSE0
:
6847 case ARMMMUIdx_S12NSE0
:
6848 case ARMMMUIdx_S12NSE1
:
6849 g_assert_not_reached();
6853 /* Translate section/page access permissions to page
6854 * R/W protection flags
6857 * @mmu_idx: MMU index indicating required translation regime
6858 * @ap: The 3-bit access permissions (AP[2:0])
6859 * @domain_prot: The 2-bit domain access permissions
6861 static inline int ap_to_rw_prot(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
6862 int ap
, int domain_prot
)
6864 bool is_user
= regime_is_user(env
, mmu_idx
);
6866 if (domain_prot
== 3) {
6867 return PAGE_READ
| PAGE_WRITE
;
6872 if (arm_feature(env
, ARM_FEATURE_V7
)) {
6875 switch (regime_sctlr(env
, mmu_idx
) & (SCTLR_S
| SCTLR_R
)) {
6877 return is_user
? 0 : PAGE_READ
;
6884 return is_user
? 0 : PAGE_READ
| PAGE_WRITE
;
6889 return PAGE_READ
| PAGE_WRITE
;
6892 return PAGE_READ
| PAGE_WRITE
;
6893 case 4: /* Reserved. */
6896 return is_user
? 0 : PAGE_READ
;
6900 if (!arm_feature(env
, ARM_FEATURE_V6K
)) {
6905 g_assert_not_reached();
6909 /* Translate section/page access permissions to page
6910 * R/W protection flags.
6912 * @ap: The 2-bit simple AP (AP[2:1])
6913 * @is_user: TRUE if accessing from PL0
6915 static inline int simple_ap_to_rw_prot_is_user(int ap
, bool is_user
)
6919 return is_user
? 0 : PAGE_READ
| PAGE_WRITE
;
6921 return PAGE_READ
| PAGE_WRITE
;
6923 return is_user
? 0 : PAGE_READ
;
6927 g_assert_not_reached();
6932 simple_ap_to_rw_prot(CPUARMState
*env
, ARMMMUIdx mmu_idx
, int ap
)
6934 return simple_ap_to_rw_prot_is_user(ap
, regime_is_user(env
, mmu_idx
));
6937 /* Translate S2 section/page access permissions to protection flags
6940 * @s2ap: The 2-bit stage2 access permissions (S2AP)
6941 * @xn: XN (execute-never) bit
6943 static int get_S2prot(CPUARMState
*env
, int s2ap
, int xn
)
6954 if (arm_el_is_aa64(env
, 2) || prot
& PAGE_READ
) {
6961 /* Translate section/page access permissions to protection flags
6964 * @mmu_idx: MMU index indicating required translation regime
6965 * @is_aa64: TRUE if AArch64
6966 * @ap: The 2-bit simple AP (AP[2:1])
6967 * @ns: NS (non-secure) bit
6968 * @xn: XN (execute-never) bit
6969 * @pxn: PXN (privileged execute-never) bit
6971 static int get_S1prot(CPUARMState
*env
, ARMMMUIdx mmu_idx
, bool is_aa64
,
6972 int ap
, int ns
, int xn
, int pxn
)
6974 bool is_user
= regime_is_user(env
, mmu_idx
);
6975 int prot_rw
, user_rw
;
6979 assert(mmu_idx
!= ARMMMUIdx_S2NS
);
6981 user_rw
= simple_ap_to_rw_prot_is_user(ap
, true);
6985 prot_rw
= simple_ap_to_rw_prot_is_user(ap
, false);
6988 if (ns
&& arm_is_secure(env
) && (env
->cp15
.scr_el3
& SCR_SIF
)) {
6992 /* TODO have_wxn should be replaced with
6993 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
6994 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
6995 * compatible processors have EL2, which is required for [U]WXN.
6997 have_wxn
= arm_feature(env
, ARM_FEATURE_LPAE
);
7000 wxn
= regime_sctlr(env
, mmu_idx
) & SCTLR_WXN
;
7004 switch (regime_el(env
, mmu_idx
)) {
7007 xn
= pxn
|| (user_rw
& PAGE_WRITE
);
7014 } else if (arm_feature(env
, ARM_FEATURE_V7
)) {
7015 switch (regime_el(env
, mmu_idx
)) {
7019 xn
= xn
|| !(user_rw
& PAGE_READ
);
7023 uwxn
= regime_sctlr(env
, mmu_idx
) & SCTLR_UWXN
;
7025 xn
= xn
|| !(prot_rw
& PAGE_READ
) || pxn
||
7026 (uwxn
&& (user_rw
& PAGE_WRITE
));
7036 if (xn
|| (wxn
&& (prot_rw
& PAGE_WRITE
))) {
7039 return prot_rw
| PAGE_EXEC
;
7042 static bool get_level1_table_address(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
7043 uint32_t *table
, uint32_t address
)
7045 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
7046 TCR
*tcr
= regime_tcr(env
, mmu_idx
);
7048 if (address
& tcr
->mask
) {
7049 if (tcr
->raw_tcr
& TTBCR_PD1
) {
7050 /* Translation table walk disabled for TTBR1 */
7053 *table
= regime_ttbr(env
, mmu_idx
, 1) & 0xffffc000;
7055 if (tcr
->raw_tcr
& TTBCR_PD0
) {
7056 /* Translation table walk disabled for TTBR0 */
7059 *table
= regime_ttbr(env
, mmu_idx
, 0) & tcr
->base_mask
;
7061 *table
|= (address
>> 18) & 0x3ffc;
7065 /* Translate a S1 pagetable walk through S2 if needed. */
7066 static hwaddr
S1_ptw_translate(CPUARMState
*env
, ARMMMUIdx mmu_idx
,
7067 hwaddr addr
, MemTxAttrs txattrs
,
7069 ARMMMUFaultInfo
*fi
)
7071 if ((mmu_idx
== ARMMMUIdx_S1NSE0
|| mmu_idx
== ARMMMUIdx_S1NSE1
) &&
7072 !regime_translation_disabled(env
, ARMMMUIdx_S2NS
)) {
7073 target_ulong s2size
;
7078 ret
= get_phys_addr_lpae(env
, addr
, 0, ARMMMUIdx_S2NS
, &s2pa
,
7079 &txattrs
, &s2prot
, &s2size
, fsr
, fi
);
7091 /* All loads done in the course of a page table walk go through here.
7092 * TODO: rather than ignoring errors from physical memory reads (which
7093 * are external aborts in ARM terminology) we should propagate this
7094 * error out so that we can turn it into a Data Abort if this walk
7095 * was being done for a CPU load/store or an address translation instruction
7096 * (but not if it was for a debug access).
7098 static uint32_t arm_ldl_ptw(CPUState
*cs
, hwaddr addr
, bool is_secure
,
7099 ARMMMUIdx mmu_idx
, uint32_t *fsr
,
7100 ARMMMUFaultInfo
*fi
)
7102 ARMCPU
*cpu
= ARM_CPU(cs
);
7103 CPUARMState
*env
= &cpu
->env
;
7104 MemTxAttrs attrs
= {};
7107 attrs
.secure
= is_secure
;
7108 as
= arm_addressspace(cs
, attrs
);
7109 addr
= S1_ptw_translate(env
, mmu_idx
, addr
, attrs
, fsr
, fi
);
7113 if (regime_translation_big_endian(env
, mmu_idx
)) {
7114 return address_space_ldl_be(as
, addr
, attrs
, NULL
);
7116 return address_space_ldl_le(as
, addr
, attrs
, NULL
);
7120 static uint64_t arm_ldq_ptw(CPUState
*cs
, hwaddr addr
, bool is_secure
,
7121 ARMMMUIdx mmu_idx
, uint32_t *fsr
,
7122 ARMMMUFaultInfo
*fi
)
7124 ARMCPU
*cpu
= ARM_CPU(cs
);
7125 CPUARMState
*env
= &cpu
->env
;
7126 MemTxAttrs attrs
= {};
7129 attrs
.secure
= is_secure
;
7130 as
= arm_addressspace(cs
, attrs
);
7131 addr
= S1_ptw_translate(env
, mmu_idx
, addr
, attrs
, fsr
, fi
);
7135 if (regime_translation_big_endian(env
, mmu_idx
)) {
7136 return address_space_ldq_be(as
, addr
, attrs
, NULL
);
7138 return address_space_ldq_le(as
, addr
, attrs
, NULL
);
7142 static bool get_phys_addr_v5(CPUARMState
*env
, uint32_t address
,
7143 int access_type
, ARMMMUIdx mmu_idx
,
7144 hwaddr
*phys_ptr
, int *prot
,
7145 target_ulong
*page_size
, uint32_t *fsr
,
7146 ARMMMUFaultInfo
*fi
)
7148 CPUState
*cs
= CPU(arm_env_get_cpu(env
));
7159 /* Pagetable walk. */
7160 /* Lookup l1 descriptor. */
7161 if (!get_level1_table_address(env
, mmu_idx
, &table
, address
)) {
7162 /* Section translation fault if page walk is disabled by PD0 or PD1 */
7166 desc
= arm_ldl_ptw(cs
, table
, regime_is_secure(env
, mmu_idx
),
7169 domain
= (desc
>> 5) & 0x0f;
7170 if (regime_el(env
, mmu_idx
) == 1) {
7171 dacr
= env
->cp15
.dacr_ns
;
7173 dacr
= env
->cp15
.dacr_s
;
7175 domain_prot
= (dacr
>> (domain
* 2)) & 3;
7177 /* Section translation fault. */
7181 if (domain_prot
== 0 || domain_prot
== 2) {
7183 code
= 9; /* Section domain fault. */
7185 code
= 11; /* Page domain fault. */
7190 phys_addr
= (desc
& 0xfff00000) | (address
& 0x000fffff);
7191 ap
= (desc
>> 10) & 3;
7193 *page_size
= 1024 * 1024;
7195 /* Lookup l2 entry. */
7197 /* Coarse pagetable. */
7198 table
= (desc
& 0xfffffc00) | ((address
>> 10) & 0x3fc);
7200 /* Fine pagetable. */
7201 table
= (desc
& 0xfffff000) | ((address
>> 8) & 0xffc);
7203 desc
= arm_ldl_ptw(cs
, table
, regime_is_secure(env
, mmu_idx
),
7206 case 0: /* Page translation fault. */
7209 case 1: /* 64k page. */
7210 phys_addr
= (desc
& 0xffff0000) | (address
& 0xffff);
7211 ap
= (desc
>> (4 + ((address
>> 13) & 6))) & 3;
7212 *page_size
= 0x10000;
7214 case 2: /* 4k page. */
7215 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
7216 ap
= (desc
>> (4 + ((address
>> 9) & 6))) & 3;
7217 *page_size
= 0x1000;
7219 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
7221 /* ARMv6/XScale extended small page format */
7222 if (arm_feature(env
, ARM_FEATURE_XSCALE
)
7223 || arm_feature(env
, ARM_FEATURE_V6
)) {
7224 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
7225 *page_size
= 0x1000;
7227 /* UNPREDICTABLE in ARMv5; we choose to take a
7228 * page translation fault.
7234 phys_addr
= (desc
& 0xfffffc00) | (address
& 0x3ff);
7237 ap
= (desc
>> 4) & 3;
7240 /* Never happens, but compiler isn't smart enough to tell. */
7245 *prot
= ap_to_rw_prot(env
, mmu_idx
, ap
, domain_prot
);
7246 *prot
|= *prot
? PAGE_EXEC
: 0;
7247 if (!(*prot
& (1 << access_type
))) {
7248 /* Access permission fault. */
7251 *phys_ptr
= phys_addr
;
7254 *fsr
= code
| (domain
<< 4);
7258 static bool get_phys_addr_v6(CPUARMState
*env
, uint32_t address
,
7259 int access_type
, ARMMMUIdx mmu_idx
,
7260 hwaddr
*phys_ptr
, MemTxAttrs
*attrs
, int *prot
,
7261 target_ulong
*page_size
, uint32_t *fsr
,
7262 ARMMMUFaultInfo
*fi
)
7264 CPUState
*cs
= CPU(arm_env_get_cpu(env
));
7278 /* Pagetable walk. */
7279 /* Lookup l1 descriptor. */
7280 if (!get_level1_table_address(env
, mmu_idx
, &table
, address
)) {
7281 /* Section translation fault if page walk is disabled by PD0 or PD1 */
7285 desc
= arm_ldl_ptw(cs
, table
, regime_is_secure(env
, mmu_idx
),
7288 if (type
== 0 || (type
== 3 && !arm_feature(env
, ARM_FEATURE_PXN
))) {
7289 /* Section translation fault, or attempt to use the encoding
7290 * which is Reserved on implementations without PXN.
7295 if ((type
== 1) || !(desc
& (1 << 18))) {
7296 /* Page or Section. */
7297 domain
= (desc
>> 5) & 0x0f;
7299 if (regime_el(env
, mmu_idx
) == 1) {
7300 dacr
= env
->cp15
.dacr_ns
;
7302 dacr
= env
->cp15
.dacr_s
;
7304 domain_prot
= (dacr
>> (domain
* 2)) & 3;
7305 if (domain_prot
== 0 || domain_prot
== 2) {
7307 code
= 9; /* Section domain fault. */
7309 code
= 11; /* Page domain fault. */
7314 if (desc
& (1 << 18)) {
7316 phys_addr
= (desc
& 0xff000000) | (address
& 0x00ffffff);
7317 phys_addr
|= (uint64_t)extract32(desc
, 20, 4) << 32;
7318 phys_addr
|= (uint64_t)extract32(desc
, 5, 4) << 36;
7319 *page_size
= 0x1000000;
7322 phys_addr
= (desc
& 0xfff00000) | (address
& 0x000fffff);
7323 *page_size
= 0x100000;
7325 ap
= ((desc
>> 10) & 3) | ((desc
>> 13) & 4);
7326 xn
= desc
& (1 << 4);
7329 ns
= extract32(desc
, 19, 1);
7331 if (arm_feature(env
, ARM_FEATURE_PXN
)) {
7332 pxn
= (desc
>> 2) & 1;
7334 ns
= extract32(desc
, 3, 1);
7335 /* Lookup l2 entry. */
7336 table
= (desc
& 0xfffffc00) | ((address
>> 10) & 0x3fc);
7337 desc
= arm_ldl_ptw(cs
, table
, regime_is_secure(env
, mmu_idx
),
7339 ap
= ((desc
>> 4) & 3) | ((desc
>> 7) & 4);
7341 case 0: /* Page translation fault. */
7344 case 1: /* 64k page. */
7345 phys_addr
= (desc
& 0xffff0000) | (address
& 0xffff);
7346 xn
= desc
& (1 << 15);
7347 *page_size
= 0x10000;
7349 case 2: case 3: /* 4k page. */
7350 phys_addr
= (desc
& 0xfffff000) | (address
& 0xfff);
7352 *page_size
= 0x1000;
7355 /* Never happens, but compiler isn't smart enough to tell. */
7360 if (domain_prot
== 3) {
7361 *prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
7363 if (pxn
&& !regime_is_user(env
, mmu_idx
)) {
7366 if (xn
&& access_type
== 2)
7369 if (arm_feature(env
, ARM_FEATURE_V6K
) &&
7370 (regime_sctlr(env
, mmu_idx
) & SCTLR_AFE
)) {
7371 /* The simplified model uses AP[0] as an access control bit. */
7372 if ((ap
& 1) == 0) {
7373 /* Access flag fault. */
7374 code
= (code
== 15) ? 6 : 3;
7377 *prot
= simple_ap_to_rw_prot(env
, mmu_idx
, ap
>> 1);
7379 *prot
= ap_to_rw_prot(env
, mmu_idx
, ap
, domain_prot
);
7384 if (!(*prot
& (1 << access_type
))) {
7385 /* Access permission fault. */
7390 /* The NS bit will (as required by the architecture) have no effect if
7391 * the CPU doesn't support TZ or this is a non-secure translation
7392 * regime, because the attribute will already be non-secure.
7394 attrs
->secure
= false;
7396 *phys_ptr
= phys_addr
;
7399 *fsr
= code
| (domain
<< 4);
7403 /* Fault type for long-descriptor MMU fault reporting; this corresponds
7404 * to bits [5..2] in the STATUS field in long-format DFSR/IFSR.
7407 translation_fault
= 1,
7409 permission_fault
= 3,
7413 * check_s2_mmu_setup
7415 * @is_aa64: True if the translation regime is in AArch64 state
7416 * @startlevel: Suggested starting level
7417 * @inputsize: Bitsize of IPAs
7418 * @stride: Page-table stride (See the ARM ARM)
7420 * Returns true if the suggested S2 translation parameters are OK and
7423 static bool check_s2_mmu_setup(ARMCPU
*cpu
, bool is_aa64
, int level
,
7424 int inputsize
, int stride
)
7426 const int grainsize
= stride
+ 3;
7429 /* Negative levels are never allowed. */
7434 startsizecheck
= inputsize
- ((3 - level
) * stride
+ grainsize
);
7435 if (startsizecheck
< 1 || startsizecheck
> stride
+ 4) {
7440 CPUARMState
*env
= &cpu
->env
;
7441 unsigned int pamax
= arm_pamax(cpu
);
7444 case 13: /* 64KB Pages. */
7445 if (level
== 0 || (level
== 1 && pamax
<= 42)) {
7449 case 11: /* 16KB Pages. */
7450 if (level
== 0 || (level
== 1 && pamax
<= 40)) {
7454 case 9: /* 4KB Pages. */
7455 if (level
== 0 && pamax
<= 42) {
7460 g_assert_not_reached();
7463 /* Inputsize checks. */
7464 if (inputsize
> pamax
&&
7465 (arm_el_is_aa64(env
, 1) || inputsize
> 40)) {
7466 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */
7470 /* AArch32 only supports 4KB pages. Assert on that. */
7471 assert(stride
== 9);
7480 static bool get_phys_addr_lpae(CPUARMState
*env
, target_ulong address
,
7481 int access_type
, ARMMMUIdx mmu_idx
,
7482 hwaddr
*phys_ptr
, MemTxAttrs
*txattrs
, int *prot
,
7483 target_ulong
*page_size_ptr
, uint32_t *fsr
,
7484 ARMMMUFaultInfo
*fi
)
7486 ARMCPU
*cpu
= arm_env_get_cpu(env
);
7487 CPUState
*cs
= CPU(cpu
);
7488 /* Read an LPAE long-descriptor translation table. */
7489 MMUFaultType fault_type
= translation_fault
;
7496 hwaddr descaddr
, indexmask
, indexmask_grainsize
;
7497 uint32_t tableattrs
;
7498 target_ulong page_size
;
7504 TCR
*tcr
= regime_tcr(env
, mmu_idx
);
7505 int ap
, ns
, xn
, pxn
;
7506 uint32_t el
= regime_el(env
, mmu_idx
);
7507 bool ttbr1_valid
= true;
7508 uint64_t descaddrmask
;
7509 bool aarch64
= arm_el_is_aa64(env
, el
);
7512 * This code does not handle the different format TCR for VTCR_EL2.
7513 * This code also does not support shareability levels.
7514 * Attribute and permission bit handling should also be checked when adding
7515 * support for those page table walks.
7521 if (mmu_idx
!= ARMMMUIdx_S2NS
) {
7522 tbi
= extract64(tcr
->raw_tcr
, 20, 1);
7525 if (extract64(address
, 55, 1)) {
7526 tbi
= extract64(tcr
->raw_tcr
, 38, 1);
7528 tbi
= extract64(tcr
->raw_tcr
, 37, 1);
7533 /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it
7537 ttbr1_valid
= false;
7542 /* There is no TTBR1 for EL2 */
7544 ttbr1_valid
= false;
7548 /* Determine whether this address is in the region controlled by
7549 * TTBR0 or TTBR1 (or if it is in neither region and should fault).
7550 * This is a Non-secure PL0/1 stage 1 translation, so controlled by
7551 * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
7554 /* AArch64 translation. */
7555 t0sz
= extract32(tcr
->raw_tcr
, 0, 6);
7556 t0sz
= MIN(t0sz
, 39);
7557 t0sz
= MAX(t0sz
, 16);
7558 } else if (mmu_idx
!= ARMMMUIdx_S2NS
) {
7559 /* AArch32 stage 1 translation. */
7560 t0sz
= extract32(tcr
->raw_tcr
, 0, 3);
7562 /* AArch32 stage 2 translation. */
7563 bool sext
= extract32(tcr
->raw_tcr
, 4, 1);
7564 bool sign
= extract32(tcr
->raw_tcr
, 3, 1);
7565 /* Address size is 40-bit for a stage 2 translation,
7566 * and t0sz can be negative (from -8 to 7),
7567 * so we need to adjust it to use the TTBR selecting logic below.
7570 t0sz
= sextract32(tcr
->raw_tcr
, 0, 4) + 8;
7572 /* If the sign-extend bit is not the same as t0sz[3], the result
7573 * is unpredictable. Flag this as a guest error. */
7575 qemu_log_mask(LOG_GUEST_ERROR
,
7576 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
7579 t1sz
= extract32(tcr
->raw_tcr
, 16, 6);
7581 t1sz
= MIN(t1sz
, 39);
7582 t1sz
= MAX(t1sz
, 16);
7584 if (t0sz
&& !extract64(address
, addrsize
- t0sz
, t0sz
- tbi
)) {
7585 /* there is a ttbr0 region and we are in it (high bits all zero) */
7587 } else if (ttbr1_valid
&& t1sz
&&
7588 !extract64(~address
, addrsize
- t1sz
, t1sz
- tbi
)) {
7589 /* there is a ttbr1 region and we are in it (high bits all one) */
7592 /* ttbr0 region is "everything not in the ttbr1 region" */
7594 } else if (!t1sz
&& ttbr1_valid
) {
7595 /* ttbr1 region is "everything not in the ttbr0 region" */
7598 /* in the gap between the two regions, this is a Translation fault */
7599 fault_type
= translation_fault
;
7603 /* Note that QEMU ignores shareability and cacheability attributes,
7604 * so we don't need to do anything with the SH, ORGN, IRGN fields
7605 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
7606 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
7607 * implement any ASID-like capability so we can ignore it (instead
7608 * we will always flush the TLB any time the ASID is changed).
7610 if (ttbr_select
== 0) {
7611 ttbr
= regime_ttbr(env
, mmu_idx
, 0);
7613 epd
= extract32(tcr
->raw_tcr
, 7, 1);
7615 inputsize
= addrsize
- t0sz
;
7617 tg
= extract32(tcr
->raw_tcr
, 14, 2);
7618 if (tg
== 1) { /* 64KB pages */
7621 if (tg
== 2) { /* 16KB pages */
7625 /* We should only be here if TTBR1 is valid */
7626 assert(ttbr1_valid
);
7628 ttbr
= regime_ttbr(env
, mmu_idx
, 1);
7629 epd
= extract32(tcr
->raw_tcr
, 23, 1);
7630 inputsize
= addrsize
- t1sz
;
7632 tg
= extract32(tcr
->raw_tcr
, 30, 2);
7633 if (tg
== 3) { /* 64KB pages */
7636 if (tg
== 1) { /* 16KB pages */
7641 /* Here we should have set up all the parameters for the translation:
7642 * inputsize, ttbr, epd, stride, tbi
7646 /* Translation table walk disabled => Translation fault on TLB miss
7647 * Note: This is always 0 on 64-bit EL2 and EL3.
7652 if (mmu_idx
!= ARMMMUIdx_S2NS
) {
7653 /* The starting level depends on the virtual address size (which can
7654 * be up to 48 bits) and the translation granule size. It indicates
7655 * the number of strides (stride bits at a time) needed to
7656 * consume the bits of the input address. In the pseudocode this is:
7657 * level = 4 - RoundUp((inputsize - grainsize) / stride)
7658 * where their 'inputsize' is our 'inputsize', 'grainsize' is
7659 * our 'stride + 3' and 'stride' is our 'stride'.
7660 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
7661 * = 4 - (inputsize - stride - 3 + stride - 1) / stride
7662 * = 4 - (inputsize - 4) / stride;
7664 level
= 4 - (inputsize
- 4) / stride
;
7666 /* For stage 2 translations the starting level is specified by the
7667 * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
7669 uint32_t sl0
= extract32(tcr
->raw_tcr
, 6, 2);
7670 uint32_t startlevel
;
7673 if (!aarch64
|| stride
== 9) {
7674 /* AArch32 or 4KB pages */
7675 startlevel
= 2 - sl0
;
7677 /* 16KB or 64KB pages */
7678 startlevel
= 3 - sl0
;
7681 /* Check that the starting level is valid. */
7682 ok
= check_s2_mmu_setup(cpu
, aarch64
, startlevel
,
7685 fault_type
= translation_fault
;
7691 indexmask_grainsize
= (1ULL << (stride
+ 3)) - 1;
7692 indexmask
= (1ULL << (inputsize
- (stride
* (4 - level
)))) - 1;
7694 /* Now we can extract the actual base address from the TTBR */
7695 descaddr
= extract64(ttbr
, 0, 48);
7696 descaddr
&= ~indexmask
;
7698 /* The address field in the descriptor goes up to bit 39 for ARMv7
7699 * but up to bit 47 for ARMv8, but we use the descaddrmask
7700 * up to bit 39 for AArch32, because we don't need other bits in that case
7701 * to construct next descriptor address (anyway they should be all zeroes).
7703 descaddrmask
= ((1ull << (aarch64
? 48 : 40)) - 1) &
7704 ~indexmask_grainsize
;
7706 /* Secure accesses start with the page table in secure memory and
7707 * can be downgraded to non-secure at any step. Non-secure accesses
7708 * remain non-secure. We implement this by just ORing in the NSTable/NS
7709 * bits at each step.
7711 tableattrs
= regime_is_secure(env
, mmu_idx
) ? 0 : (1 << 4);
7713 uint64_t descriptor
;
7716 descaddr
|= (address
>> (stride
* (4 - level
))) & indexmask
;
7718 nstable
= extract32(tableattrs
, 4, 1);
7719 descriptor
= arm_ldq_ptw(cs
, descaddr
, !nstable
, mmu_idx
, fsr
, fi
);
7724 if (!(descriptor
& 1) ||
7725 (!(descriptor
& 2) && (level
== 3))) {
7726 /* Invalid, or the Reserved level 3 encoding */
7729 descaddr
= descriptor
& descaddrmask
;
7731 if ((descriptor
& 2) && (level
< 3)) {
7732 /* Table entry. The top five bits are attributes which may
7733 * propagate down through lower levels of the table (and
7734 * which are all arranged so that 0 means "no effect", so
7735 * we can gather them up by ORing in the bits at each level).
7737 tableattrs
|= extract64(descriptor
, 59, 5);
7739 indexmask
= indexmask_grainsize
;
7742 /* Block entry at level 1 or 2, or page entry at level 3.
7743 * These are basically the same thing, although the number
7744 * of bits we pull in from the vaddr varies.
7746 page_size
= (1ULL << ((stride
* (4 - level
)) + 3));
7747 descaddr
|= (address
& (page_size
- 1));
7748 /* Extract attributes from the descriptor */
7749 attrs
= extract64(descriptor
, 2, 10)
7750 | (extract64(descriptor
, 52, 12) << 10);
7752 if (mmu_idx
== ARMMMUIdx_S2NS
) {
7753 /* Stage 2 table descriptors do not include any attribute fields */
7756 /* Merge in attributes from table descriptors */
7757 attrs
|= extract32(tableattrs
, 0, 2) << 11; /* XN, PXN */
7758 attrs
|= extract32(tableattrs
, 3, 1) << 5; /* APTable[1] => AP[2] */
7759 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
7760 * means "force PL1 access only", which means forcing AP[1] to 0.
7762 if (extract32(tableattrs
, 2, 1)) {
7765 attrs
|= nstable
<< 3; /* NS */
7768 /* Here descaddr is the final physical address, and attributes
7771 fault_type
= access_fault
;
7772 if ((attrs
& (1 << 8)) == 0) {
7777 ap
= extract32(attrs
, 4, 2);
7778 xn
= extract32(attrs
, 12, 1);
7780 if (mmu_idx
== ARMMMUIdx_S2NS
) {
7782 *prot
= get_S2prot(env
, ap
, xn
);
7784 ns
= extract32(attrs
, 3, 1);
7785 pxn
= extract32(attrs
, 11, 1);
7786 *prot
= get_S1prot(env
, mmu_idx
, aarch64
, ap
, ns
, xn
, pxn
);
7789 fault_type
= permission_fault
;
7790 if (!(*prot
& (1 << access_type
))) {
7795 /* The NS bit will (as required by the architecture) have no effect if
7796 * the CPU doesn't support TZ or this is a non-secure translation
7797 * regime, because the attribute will already be non-secure.
7799 txattrs
->secure
= false;
7801 *phys_ptr
= descaddr
;
7802 *page_size_ptr
= page_size
;
7806 /* Long-descriptor format IFSR/DFSR value */
7807 *fsr
= (1 << 9) | (fault_type
<< 2) | level
;
7808 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */
7809 fi
->stage2
= fi
->s1ptw
|| (mmu_idx
== ARMMMUIdx_S2NS
);
7813 static inline void get_phys_addr_pmsav7_default(CPUARMState
*env
,
7815 int32_t address
, int *prot
)
7817 *prot
= PAGE_READ
| PAGE_WRITE
;
7819 case 0xF0000000 ... 0xFFFFFFFF:
7820 if (regime_sctlr(env
, mmu_idx
) & SCTLR_V
) { /* hivecs execing is ok */
7824 case 0x00000000 ... 0x7FFFFFFF:
7831 static bool get_phys_addr_pmsav7(CPUARMState
*env
, uint32_t address
,
7832 int access_type
, ARMMMUIdx mmu_idx
,
7833 hwaddr
*phys_ptr
, int *prot
, uint32_t *fsr
)
7835 ARMCPU
*cpu
= arm_env_get_cpu(env
);
7837 bool is_user
= regime_is_user(env
, mmu_idx
);
7839 *phys_ptr
= address
;
7842 if (regime_translation_disabled(env
, mmu_idx
)) { /* MPU disabled */
7843 get_phys_addr_pmsav7_default(env
, mmu_idx
, address
, prot
);
7844 } else { /* MPU enabled */
7845 for (n
= (int)cpu
->pmsav7_dregion
- 1; n
>= 0; n
--) {
7847 uint32_t base
= env
->pmsav7
.drbar
[n
];
7848 uint32_t rsize
= extract32(env
->pmsav7
.drsr
[n
], 1, 5);
7852 if (!(env
->pmsav7
.drsr
[n
] & 0x1)) {
7857 qemu_log_mask(LOG_GUEST_ERROR
, "DRSR.Rsize field can not be 0");
7861 rmask
= (1ull << rsize
) - 1;
7864 qemu_log_mask(LOG_GUEST_ERROR
, "DRBAR %" PRIx32
" misaligned "
7865 "to DRSR region size, mask = %" PRIx32
,
7870 if (address
< base
|| address
> base
+ rmask
) {
7874 /* Region matched */
7876 if (rsize
>= 8) { /* no subregions for regions < 256 bytes */
7878 uint32_t srdis_mask
;
7880 rsize
-= 3; /* sub region size (power of 2) */
7881 snd
= ((address
- base
) >> rsize
) & 0x7;
7882 srdis
= extract32(env
->pmsav7
.drsr
[n
], snd
+ 8, 1);
7884 srdis_mask
= srdis
? 0x3 : 0x0;
7885 for (i
= 2; i
<= 8 && rsize
< TARGET_PAGE_BITS
; i
*= 2) {
7886 /* This will check in groups of 2, 4 and then 8, whether
7887 * the subregion bits are consistent. rsize is incremented
7888 * back up to give the region size, considering consistent
7889 * adjacent subregions as one region. Stop testing if rsize
7890 * is already big enough for an entire QEMU page.
7892 int snd_rounded
= snd
& ~(i
- 1);
7893 uint32_t srdis_multi
= extract32(env
->pmsav7
.drsr
[n
],
7894 snd_rounded
+ 8, i
);
7895 if (srdis_mask
^ srdis_multi
) {
7898 srdis_mask
= (srdis_mask
<< i
) | srdis_mask
;
7902 if (rsize
< TARGET_PAGE_BITS
) {
7903 qemu_log_mask(LOG_UNIMP
, "No support for MPU (sub)region"
7904 "alignment of %" PRIu32
" bits. Minimum is %d\n",
7905 rsize
, TARGET_PAGE_BITS
);
7914 if (n
== -1) { /* no hits */
7915 if (cpu
->pmsav7_dregion
&&
7916 (is_user
|| !(regime_sctlr(env
, mmu_idx
) & SCTLR_BR
))) {
7917 /* background fault */
7921 get_phys_addr_pmsav7_default(env
, mmu_idx
, address
, prot
);
7922 } else { /* a MPU hit! */
7923 uint32_t ap
= extract32(env
->pmsav7
.dracr
[n
], 8, 3);
7925 if (is_user
) { /* User mode AP bit decoding */
7930 break; /* no access */
7932 *prot
|= PAGE_WRITE
;
7936 *prot
|= PAGE_READ
| PAGE_EXEC
;
7939 qemu_log_mask(LOG_GUEST_ERROR
,
7940 "Bad value for AP bits in DRACR %"
7943 } else { /* Priv. mode AP bits decoding */
7946 break; /* no access */
7950 *prot
|= PAGE_WRITE
;
7954 *prot
|= PAGE_READ
| PAGE_EXEC
;
7957 qemu_log_mask(LOG_GUEST_ERROR
,
7958 "Bad value for AP bits in DRACR %"
7964 if (env
->pmsav7
.dracr
[n
] & (1 << 12)) {
7965 *prot
&= ~PAGE_EXEC
;
7970 *fsr
= 0x00d; /* Permission fault */
7971 return !(*prot
& (1 << access_type
));
7974 static bool get_phys_addr_pmsav5(CPUARMState
*env
, uint32_t address
,
7975 int access_type
, ARMMMUIdx mmu_idx
,
7976 hwaddr
*phys_ptr
, int *prot
, uint32_t *fsr
)
7981 bool is_user
= regime_is_user(env
, mmu_idx
);
7983 *phys_ptr
= address
;
7984 for (n
= 7; n
>= 0; n
--) {
7985 base
= env
->cp15
.c6_region
[n
];
7986 if ((base
& 1) == 0) {
7989 mask
= 1 << ((base
>> 1) & 0x1f);
7990 /* Keep this shift separate from the above to avoid an
7991 (undefined) << 32. */
7992 mask
= (mask
<< 1) - 1;
7993 if (((base
^ address
) & ~mask
) == 0) {
8002 if (access_type
== 2) {
8003 mask
= env
->cp15
.pmsav5_insn_ap
;
8005 mask
= env
->cp15
.pmsav5_data_ap
;
8007 mask
= (mask
>> (n
* 4)) & 0xf;
8017 *prot
= PAGE_READ
| PAGE_WRITE
;
8022 *prot
|= PAGE_WRITE
;
8026 *prot
= PAGE_READ
| PAGE_WRITE
;
8039 /* Bad permission. */
8047 /* get_phys_addr - get the physical address for this virtual address
8049 * Find the physical address corresponding to the given virtual address,
8050 * by doing a translation table walk on MMU based systems or using the
8051 * MPU state on MPU based systems.
8053 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
8054 * prot and page_size may not be filled in, and the populated fsr value provides
8055 * information on why the translation aborted, in the format of a
8056 * DFSR/IFSR fault register, with the following caveats:
8057 * * we honour the short vs long DFSR format differences.
8058 * * the WnR bit is never set (the caller must do this).
8059 * * for PSMAv5 based systems we don't bother to return a full FSR format
8063 * @address: virtual address to get physical address for
8064 * @access_type: 0 for read, 1 for write, 2 for execute
8065 * @mmu_idx: MMU index indicating required translation regime
8066 * @phys_ptr: set to the physical address corresponding to the virtual address
8067 * @attrs: set to the memory transaction attributes to use
8068 * @prot: set to the permissions for the page containing phys_ptr
8069 * @page_size: set to the size of the page containing phys_ptr
8070 * @fsr: set to the DFSR/IFSR value on failure
8072 static bool get_phys_addr(CPUARMState
*env
, target_ulong address
,
8073 int access_type
, ARMMMUIdx mmu_idx
,
8074 hwaddr
*phys_ptr
, MemTxAttrs
*attrs
, int *prot
,
8075 target_ulong
*page_size
, uint32_t *fsr
,
8076 ARMMMUFaultInfo
*fi
)
8078 if (mmu_idx
== ARMMMUIdx_S12NSE0
|| mmu_idx
== ARMMMUIdx_S12NSE1
) {
8079 /* Call ourselves recursively to do the stage 1 and then stage 2
8082 if (arm_feature(env
, ARM_FEATURE_EL2
)) {
8087 ret
= get_phys_addr(env
, address
, access_type
,
8088 mmu_idx
+ ARMMMUIdx_S1NSE0
, &ipa
, attrs
,
8089 prot
, page_size
, fsr
, fi
);
8091 /* If S1 fails or S2 is disabled, return early. */
8092 if (ret
|| regime_translation_disabled(env
, ARMMMUIdx_S2NS
)) {
8097 /* S1 is done. Now do S2 translation. */
8098 ret
= get_phys_addr_lpae(env
, ipa
, access_type
, ARMMMUIdx_S2NS
,
8099 phys_ptr
, attrs
, &s2_prot
,
8100 page_size
, fsr
, fi
);
8102 /* Combine the S1 and S2 perms. */
8107 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
8109 mmu_idx
+= ARMMMUIdx_S1NSE0
;
8113 /* The page table entries may downgrade secure to non-secure, but
8114 * cannot upgrade an non-secure translation regime's attributes
8117 attrs
->secure
= regime_is_secure(env
, mmu_idx
);
8118 attrs
->user
= regime_is_user(env
, mmu_idx
);
8120 /* Fast Context Switch Extension. This doesn't exist at all in v8.
8121 * In v7 and earlier it affects all stage 1 translations.
8123 if (address
< 0x02000000 && mmu_idx
!= ARMMMUIdx_S2NS
8124 && !arm_feature(env
, ARM_FEATURE_V8
)) {
8125 if (regime_el(env
, mmu_idx
) == 3) {
8126 address
+= env
->cp15
.fcseidr_s
;
8128 address
+= env
->cp15
.fcseidr_ns
;
8132 /* pmsav7 has special handling for when MPU is disabled so call it before
8133 * the common MMU/MPU disabled check below.
8135 if (arm_feature(env
, ARM_FEATURE_MPU
) &&
8136 arm_feature(env
, ARM_FEATURE_V7
)) {
8137 *page_size
= TARGET_PAGE_SIZE
;
8138 return get_phys_addr_pmsav7(env
, address
, access_type
, mmu_idx
,
8139 phys_ptr
, prot
, fsr
);
8142 if (regime_translation_disabled(env
, mmu_idx
)) {
8143 /* MMU/MPU disabled. */
8144 *phys_ptr
= address
;
8145 *prot
= PAGE_READ
| PAGE_WRITE
| PAGE_EXEC
;
8146 *page_size
= TARGET_PAGE_SIZE
;
8150 if (arm_feature(env
, ARM_FEATURE_MPU
)) {
8152 *page_size
= TARGET_PAGE_SIZE
;
8153 return get_phys_addr_pmsav5(env
, address
, access_type
, mmu_idx
,
8154 phys_ptr
, prot
, fsr
);
8157 if (regime_using_lpae_format(env
, mmu_idx
)) {
8158 return get_phys_addr_lpae(env
, address
, access_type
, mmu_idx
, phys_ptr
,
8159 attrs
, prot
, page_size
, fsr
, fi
);
8160 } else if (regime_sctlr(env
, mmu_idx
) & SCTLR_XP
) {
8161 return get_phys_addr_v6(env
, address
, access_type
, mmu_idx
, phys_ptr
,
8162 attrs
, prot
, page_size
, fsr
, fi
);
8164 return get_phys_addr_v5(env
, address
, access_type
, mmu_idx
, phys_ptr
,
8165 prot
, page_size
, fsr
, fi
);
8169 /* Walk the page table and (if the mapping exists) add the page
8170 * to the TLB. Return false on success, or true on failure. Populate
8171 * fsr with ARM DFSR/IFSR fault register format value on failure.
8173 bool arm_tlb_fill(CPUState
*cs
, vaddr address
,
8174 int access_type
, int mmu_idx
, uint32_t *fsr
,
8175 ARMMMUFaultInfo
*fi
)
8177 ARMCPU
*cpu
= ARM_CPU(cs
);
8178 CPUARMState
*env
= &cpu
->env
;
8180 target_ulong page_size
;
8183 MemTxAttrs attrs
= {};
8185 ret
= get_phys_addr(env
, address
, access_type
, mmu_idx
, &phys_addr
,
8186 &attrs
, &prot
, &page_size
, fsr
, fi
);
8188 /* Map a single [sub]page. */
8189 phys_addr
&= TARGET_PAGE_MASK
;
8190 address
&= TARGET_PAGE_MASK
;
8191 tlb_set_page_with_attrs(cs
, address
, phys_addr
, attrs
,
8192 prot
, mmu_idx
, page_size
);
8199 hwaddr
arm_cpu_get_phys_page_attrs_debug(CPUState
*cs
, vaddr addr
,
8202 ARMCPU
*cpu
= ARM_CPU(cs
);
8203 CPUARMState
*env
= &cpu
->env
;
8205 target_ulong page_size
;
8209 ARMMMUFaultInfo fi
= {};
8211 *attrs
= (MemTxAttrs
) {};
8213 ret
= get_phys_addr(env
, addr
, 0, cpu_mmu_index(env
, false), &phys_addr
,
8214 attrs
, &prot
, &page_size
, &fsr
, &fi
);
8222 uint32_t HELPER(v7m_mrs
)(CPUARMState
*env
, uint32_t reg
)
8224 ARMCPU
*cpu
= arm_env_get_cpu(env
);
8228 return xpsr_read(env
) & 0xf8000000;
8230 return xpsr_read(env
) & 0xf80001ff;
8232 return xpsr_read(env
) & 0xff00fc00;
8234 return xpsr_read(env
) & 0xff00fdff;
8236 return xpsr_read(env
) & 0x000001ff;
8238 return xpsr_read(env
) & 0x0700fc00;
8240 return xpsr_read(env
) & 0x0700edff;
8242 return env
->v7m
.current_sp
? env
->v7m
.other_sp
: env
->regs
[13];
8244 return env
->v7m
.current_sp
? env
->regs
[13] : env
->v7m
.other_sp
;
8245 case 16: /* PRIMASK */
8246 return (env
->daif
& PSTATE_I
) != 0;
8247 case 17: /* BASEPRI */
8248 case 18: /* BASEPRI_MAX */
8249 return env
->v7m
.basepri
;
8250 case 19: /* FAULTMASK */
8251 return (env
->daif
& PSTATE_F
) != 0;
8252 case 20: /* CONTROL */
8253 return env
->v7m
.control
;
8255 /* ??? For debugging only. */
8256 cpu_abort(CPU(cpu
), "Unimplemented system register read (%d)\n", reg
);
8261 void HELPER(v7m_msr
)(CPUARMState
*env
, uint32_t reg
, uint32_t val
)
8263 ARMCPU
*cpu
= arm_env_get_cpu(env
);
8267 xpsr_write(env
, val
, 0xf8000000);
8270 xpsr_write(env
, val
, 0xf8000000);
8273 xpsr_write(env
, val
, 0xfe00fc00);
8276 xpsr_write(env
, val
, 0xfe00fc00);
8279 /* IPSR bits are readonly. */
8282 xpsr_write(env
, val
, 0x0600fc00);
8285 xpsr_write(env
, val
, 0x0600fc00);
8288 if (env
->v7m
.current_sp
)
8289 env
->v7m
.other_sp
= val
;
8291 env
->regs
[13] = val
;
8294 if (env
->v7m
.current_sp
)
8295 env
->regs
[13] = val
;
8297 env
->v7m
.other_sp
= val
;
8299 case 16: /* PRIMASK */
8301 env
->daif
|= PSTATE_I
;
8303 env
->daif
&= ~PSTATE_I
;
8306 case 17: /* BASEPRI */
8307 env
->v7m
.basepri
= val
& 0xff;
8309 case 18: /* BASEPRI_MAX */
8311 if (val
!= 0 && (val
< env
->v7m
.basepri
|| env
->v7m
.basepri
== 0))
8312 env
->v7m
.basepri
= val
;
8314 case 19: /* FAULTMASK */
8316 env
->daif
|= PSTATE_F
;
8318 env
->daif
&= ~PSTATE_F
;
8321 case 20: /* CONTROL */
8322 env
->v7m
.control
= val
& 3;
8323 switch_v7m_sp(env
, (val
& 2) != 0);
8326 /* ??? For debugging only. */
8327 cpu_abort(CPU(cpu
), "Unimplemented system register write (%d)\n", reg
);
8334 void HELPER(dc_zva
)(CPUARMState
*env
, uint64_t vaddr_in
)
8336 /* Implement DC ZVA, which zeroes a fixed-length block of memory.
8337 * Note that we do not implement the (architecturally mandated)
8338 * alignment fault for attempts to use this on Device memory
8339 * (which matches the usual QEMU behaviour of not implementing either
8340 * alignment faults or any memory attribute handling).
8343 ARMCPU
*cpu
= arm_env_get_cpu(env
);
8344 uint64_t blocklen
= 4 << cpu
->dcz_blocksize
;
8345 uint64_t vaddr
= vaddr_in
& ~(blocklen
- 1);
8347 #ifndef CONFIG_USER_ONLY
8349 /* Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than
8350 * the block size so we might have to do more than one TLB lookup.
8351 * We know that in fact for any v8 CPU the page size is at least 4K
8352 * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
8353 * 1K as an artefact of legacy v5 subpage support being present in the
8354 * same QEMU executable.
8356 int maxidx
= DIV_ROUND_UP(blocklen
, TARGET_PAGE_SIZE
);
8357 void *hostaddr
[maxidx
];
8359 unsigned mmu_idx
= cpu_mmu_index(env
, false);
8360 TCGMemOpIdx oi
= make_memop_idx(MO_UB
, mmu_idx
);
8362 for (try = 0; try < 2; try++) {
8364 for (i
= 0; i
< maxidx
; i
++) {
8365 hostaddr
[i
] = tlb_vaddr_to_host(env
,
8366 vaddr
+ TARGET_PAGE_SIZE
* i
,
8373 /* If it's all in the TLB it's fair game for just writing to;
8374 * we know we don't need to update dirty status, etc.
8376 for (i
= 0; i
< maxidx
- 1; i
++) {
8377 memset(hostaddr
[i
], 0, TARGET_PAGE_SIZE
);
8379 memset(hostaddr
[i
], 0, blocklen
- (i
* TARGET_PAGE_SIZE
));
8382 /* OK, try a store and see if we can populate the tlb. This
8383 * might cause an exception if the memory isn't writable,
8384 * in which case we will longjmp out of here. We must for
8385 * this purpose use the actual register value passed to us
8386 * so that we get the fault address right.
8388 helper_ret_stb_mmu(env
, vaddr_in
, 0, oi
, GETPC());
8389 /* Now we can populate the other TLB entries, if any */
8390 for (i
= 0; i
< maxidx
; i
++) {
8391 uint64_t va
= vaddr
+ TARGET_PAGE_SIZE
* i
;
8392 if (va
!= (vaddr_in
& TARGET_PAGE_MASK
)) {
8393 helper_ret_stb_mmu(env
, va
, 0, oi
, GETPC());
8398 /* Slow path (probably attempt to do this to an I/O device or
8399 * similar, or clearing of a block of code we have translations
8400 * cached for). Just do a series of byte writes as the architecture
8401 * demands. It's not worth trying to use a cpu_physical_memory_map(),
8402 * memset(), unmap() sequence here because:
8403 * + we'd need to account for the blocksize being larger than a page
8404 * + the direct-RAM access case is almost always going to be dealt
8405 * with in the fastpath code above, so there's no speed benefit
8406 * + we would have to deal with the map returning NULL because the
8407 * bounce buffer was in use
8409 for (i
= 0; i
< blocklen
; i
++) {
8410 helper_ret_stb_mmu(env
, vaddr
+ i
, 0, oi
, GETPC());
8414 memset(g2h(vaddr
), 0, blocklen
);
8418 /* Note that signed overflow is undefined in C. The following routines are
8419 careful to use unsigned types where modulo arithmetic is required.
8420 Failure to do so _will_ break on newer gcc. */
8422 /* Signed saturating arithmetic. */
8424 /* Perform 16-bit signed saturating addition. */
8425 static inline uint16_t add16_sat(uint16_t a
, uint16_t b
)
8430 if (((res
^ a
) & 0x8000) && !((a
^ b
) & 0x8000)) {
8439 /* Perform 8-bit signed saturating addition. */
8440 static inline uint8_t add8_sat(uint8_t a
, uint8_t b
)
8445 if (((res
^ a
) & 0x80) && !((a
^ b
) & 0x80)) {
8454 /* Perform 16-bit signed saturating subtraction. */
8455 static inline uint16_t sub16_sat(uint16_t a
, uint16_t b
)
8460 if (((res
^ a
) & 0x8000) && ((a
^ b
) & 0x8000)) {
8469 /* Perform 8-bit signed saturating subtraction. */
8470 static inline uint8_t sub8_sat(uint8_t a
, uint8_t b
)
8475 if (((res
^ a
) & 0x80) && ((a
^ b
) & 0x80)) {
8484 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
8485 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
8486 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8);
8487 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8);
8490 #include "op_addsub.h"
8492 /* Unsigned saturating arithmetic. */
8493 static inline uint16_t add16_usat(uint16_t a
, uint16_t b
)
8502 static inline uint16_t sub16_usat(uint16_t a
, uint16_t b
)
8510 static inline uint8_t add8_usat(uint8_t a
, uint8_t b
)
8519 static inline uint8_t sub8_usat(uint8_t a
, uint8_t b
)
8527 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
8528 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
8529 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8);
8530 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8);
8533 #include "op_addsub.h"
8535 /* Signed modulo arithmetic. */
8536 #define SARITH16(a, b, n, op) do { \
8538 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
8539 RESULT(sum, n, 16); \
8541 ge |= 3 << (n * 2); \
8544 #define SARITH8(a, b, n, op) do { \
8546 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
8547 RESULT(sum, n, 8); \
8553 #define ADD16(a, b, n) SARITH16(a, b, n, +)
8554 #define SUB16(a, b, n) SARITH16(a, b, n, -)
8555 #define ADD8(a, b, n) SARITH8(a, b, n, +)
8556 #define SUB8(a, b, n) SARITH8(a, b, n, -)
8560 #include "op_addsub.h"
8562 /* Unsigned modulo arithmetic. */
8563 #define ADD16(a, b, n) do { \
8565 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
8566 RESULT(sum, n, 16); \
8567 if ((sum >> 16) == 1) \
8568 ge |= 3 << (n * 2); \
8571 #define ADD8(a, b, n) do { \
8573 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
8574 RESULT(sum, n, 8); \
8575 if ((sum >> 8) == 1) \
8579 #define SUB16(a, b, n) do { \
8581 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
8582 RESULT(sum, n, 16); \
8583 if ((sum >> 16) == 0) \
8584 ge |= 3 << (n * 2); \
8587 #define SUB8(a, b, n) do { \
8589 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
8590 RESULT(sum, n, 8); \
8591 if ((sum >> 8) == 0) \
8598 #include "op_addsub.h"
8600 /* Halved signed arithmetic. */
8601 #define ADD16(a, b, n) \
8602 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
8603 #define SUB16(a, b, n) \
8604 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
8605 #define ADD8(a, b, n) \
8606 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
8607 #define SUB8(a, b, n) \
8608 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
8611 #include "op_addsub.h"
8613 /* Halved unsigned arithmetic. */
8614 #define ADD16(a, b, n) \
8615 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
8616 #define SUB16(a, b, n) \
8617 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
8618 #define ADD8(a, b, n) \
8619 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
8620 #define SUB8(a, b, n) \
8621 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
8624 #include "op_addsub.h"
8626 static inline uint8_t do_usad(uint8_t a
, uint8_t b
)
8634 /* Unsigned sum of absolute byte differences. */
8635 uint32_t HELPER(usad8
)(uint32_t a
, uint32_t b
)
8638 sum
= do_usad(a
, b
);
8639 sum
+= do_usad(a
>> 8, b
>> 8);
8640 sum
+= do_usad(a
>> 16, b
>>16);
8641 sum
+= do_usad(a
>> 24, b
>> 24);
8645 /* For ARMv6 SEL instruction. */
8646 uint32_t HELPER(sel_flags
)(uint32_t flags
, uint32_t a
, uint32_t b
)
8659 return (a
& mask
) | (b
& ~mask
);
8662 /* VFP support. We follow the convention used for VFP instructions:
8663 Single precision routines have a "s" suffix, double precision a
8666 /* Convert host exception flags to vfp form. */
8667 static inline int vfp_exceptbits_from_host(int host_bits
)
8669 int target_bits
= 0;
8671 if (host_bits
& float_flag_invalid
)
8673 if (host_bits
& float_flag_divbyzero
)
8675 if (host_bits
& float_flag_overflow
)
8677 if (host_bits
& (float_flag_underflow
| float_flag_output_denormal
))
8679 if (host_bits
& float_flag_inexact
)
8680 target_bits
|= 0x10;
8681 if (host_bits
& float_flag_input_denormal
)
8682 target_bits
|= 0x80;
8686 uint32_t HELPER(vfp_get_fpscr
)(CPUARMState
*env
)
8691 fpscr
= (env
->vfp
.xregs
[ARM_VFP_FPSCR
] & 0xffc8ffff)
8692 | (env
->vfp
.vec_len
<< 16)
8693 | (env
->vfp
.vec_stride
<< 20);
8694 i
= get_float_exception_flags(&env
->vfp
.fp_status
);
8695 i
|= get_float_exception_flags(&env
->vfp
.standard_fp_status
);
8696 fpscr
|= vfp_exceptbits_from_host(i
);
8700 uint32_t vfp_get_fpscr(CPUARMState
*env
)
8702 return HELPER(vfp_get_fpscr
)(env
);
8705 /* Convert vfp exception flags to target form. */
8706 static inline int vfp_exceptbits_to_host(int target_bits
)
8710 if (target_bits
& 1)
8711 host_bits
|= float_flag_invalid
;
8712 if (target_bits
& 2)
8713 host_bits
|= float_flag_divbyzero
;
8714 if (target_bits
& 4)
8715 host_bits
|= float_flag_overflow
;
8716 if (target_bits
& 8)
8717 host_bits
|= float_flag_underflow
;
8718 if (target_bits
& 0x10)
8719 host_bits
|= float_flag_inexact
;
8720 if (target_bits
& 0x80)
8721 host_bits
|= float_flag_input_denormal
;
8725 void HELPER(vfp_set_fpscr
)(CPUARMState
*env
, uint32_t val
)
8730 changed
= env
->vfp
.xregs
[ARM_VFP_FPSCR
];
8731 env
->vfp
.xregs
[ARM_VFP_FPSCR
] = (val
& 0xffc8ffff);
8732 env
->vfp
.vec_len
= (val
>> 16) & 7;
8733 env
->vfp
.vec_stride
= (val
>> 20) & 3;
8736 if (changed
& (3 << 22)) {
8737 i
= (val
>> 22) & 3;
8739 case FPROUNDING_TIEEVEN
:
8740 i
= float_round_nearest_even
;
8742 case FPROUNDING_POSINF
:
8745 case FPROUNDING_NEGINF
:
8746 i
= float_round_down
;
8748 case FPROUNDING_ZERO
:
8749 i
= float_round_to_zero
;
8752 set_float_rounding_mode(i
, &env
->vfp
.fp_status
);
8754 if (changed
& (1 << 24)) {
8755 set_flush_to_zero((val
& (1 << 24)) != 0, &env
->vfp
.fp_status
);
8756 set_flush_inputs_to_zero((val
& (1 << 24)) != 0, &env
->vfp
.fp_status
);
8758 if (changed
& (1 << 25))
8759 set_default_nan_mode((val
& (1 << 25)) != 0, &env
->vfp
.fp_status
);
8761 i
= vfp_exceptbits_to_host(val
);
8762 set_float_exception_flags(i
, &env
->vfp
.fp_status
);
8763 set_float_exception_flags(0, &env
->vfp
.standard_fp_status
);
8766 void vfp_set_fpscr(CPUARMState
*env
, uint32_t val
)
8768 HELPER(vfp_set_fpscr
)(env
, val
);
8771 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
8773 #define VFP_BINOP(name) \
8774 float32 VFP_HELPER(name, s)(float32 a, float32 b, void *fpstp) \
8776 float_status *fpst = fpstp; \
8777 return float32_ ## name(a, b, fpst); \
8779 float64 VFP_HELPER(name, d)(float64 a, float64 b, void *fpstp) \
8781 float_status *fpst = fpstp; \
8782 return float64_ ## name(a, b, fpst); \
8794 float32
VFP_HELPER(neg
, s
)(float32 a
)
8796 return float32_chs(a
);
8799 float64
VFP_HELPER(neg
, d
)(float64 a
)
8801 return float64_chs(a
);
8804 float32
VFP_HELPER(abs
, s
)(float32 a
)
8806 return float32_abs(a
);
8809 float64
VFP_HELPER(abs
, d
)(float64 a
)
8811 return float64_abs(a
);
8814 float32
VFP_HELPER(sqrt
, s
)(float32 a
, CPUARMState
*env
)
8816 return float32_sqrt(a
, &env
->vfp
.fp_status
);
8819 float64
VFP_HELPER(sqrt
, d
)(float64 a
, CPUARMState
*env
)
8821 return float64_sqrt(a
, &env
->vfp
.fp_status
);
8824 /* XXX: check quiet/signaling case */
8825 #define DO_VFP_cmp(p, type) \
8826 void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env) \
8829 switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
8830 case 0: flags = 0x6; break; \
8831 case -1: flags = 0x8; break; \
8832 case 1: flags = 0x2; break; \
8833 default: case 2: flags = 0x3; break; \
8835 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
8836 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
8838 void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \
8841 switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
8842 case 0: flags = 0x6; break; \
8843 case -1: flags = 0x8; break; \
8844 case 1: flags = 0x2; break; \
8845 default: case 2: flags = 0x3; break; \
8847 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
8848 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
8850 DO_VFP_cmp(s
, float32
)
8851 DO_VFP_cmp(d
, float64
)
8854 /* Integer to float and float to integer conversions */
8856 #define CONV_ITOF(name, fsz, sign) \
8857 float##fsz HELPER(name)(uint32_t x, void *fpstp) \
8859 float_status *fpst = fpstp; \
8860 return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \
8863 #define CONV_FTOI(name, fsz, sign, round) \
8864 uint32_t HELPER(name)(float##fsz x, void *fpstp) \
8866 float_status *fpst = fpstp; \
8867 if (float##fsz##_is_any_nan(x)) { \
8868 float_raise(float_flag_invalid, fpst); \
8871 return float##fsz##_to_##sign##int32##round(x, fpst); \
8874 #define FLOAT_CONVS(name, p, fsz, sign) \
8875 CONV_ITOF(vfp_##name##to##p, fsz, sign) \
8876 CONV_FTOI(vfp_to##name##p, fsz, sign, ) \
8877 CONV_FTOI(vfp_to##name##z##p, fsz, sign, _round_to_zero)
8879 FLOAT_CONVS(si
, s
, 32, )
8880 FLOAT_CONVS(si
, d
, 64, )
8881 FLOAT_CONVS(ui
, s
, 32, u
)
8882 FLOAT_CONVS(ui
, d
, 64, u
)
8888 /* floating point conversion */
8889 float64
VFP_HELPER(fcvtd
, s
)(float32 x
, CPUARMState
*env
)
8891 float64 r
= float32_to_float64(x
, &env
->vfp
.fp_status
);
8892 /* ARM requires that S<->D conversion of any kind of NaN generates
8893 * a quiet NaN by forcing the most significant frac bit to 1.
8895 return float64_maybe_silence_nan(r
, &env
->vfp
.fp_status
);
8898 float32
VFP_HELPER(fcvts
, d
)(float64 x
, CPUARMState
*env
)
8900 float32 r
= float64_to_float32(x
, &env
->vfp
.fp_status
);
8901 /* ARM requires that S<->D conversion of any kind of NaN generates
8902 * a quiet NaN by forcing the most significant frac bit to 1.
8904 return float32_maybe_silence_nan(r
, &env
->vfp
.fp_status
);
8907 /* VFP3 fixed point conversion. */
8908 #define VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
8909 float##fsz HELPER(vfp_##name##to##p)(uint##isz##_t x, uint32_t shift, \
8912 float_status *fpst = fpstp; \
8914 tmp = itype##_to_##float##fsz(x, fpst); \
8915 return float##fsz##_scalbn(tmp, -(int)shift, fpst); \
8918 /* Notice that we want only input-denormal exception flags from the
8919 * scalbn operation: the other possible flags (overflow+inexact if
8920 * we overflow to infinity, output-denormal) aren't correct for the
8921 * complete scale-and-convert operation.
8923 #define VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, round) \
8924 uint##isz##_t HELPER(vfp_to##name##p##round)(float##fsz x, \
8928 float_status *fpst = fpstp; \
8929 int old_exc_flags = get_float_exception_flags(fpst); \
8931 if (float##fsz##_is_any_nan(x)) { \
8932 float_raise(float_flag_invalid, fpst); \
8935 tmp = float##fsz##_scalbn(x, shift, fpst); \
8936 old_exc_flags |= get_float_exception_flags(fpst) \
8937 & float_flag_input_denormal; \
8938 set_float_exception_flags(old_exc_flags, fpst); \
8939 return float##fsz##_to_##itype##round(tmp, fpst); \
8942 #define VFP_CONV_FIX(name, p, fsz, isz, itype) \
8943 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
8944 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, _round_to_zero) \
8945 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
8947 #define VFP_CONV_FIX_A64(name, p, fsz, isz, itype) \
8948 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
8949 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
8951 VFP_CONV_FIX(sh
, d
, 64, 64, int16
)
8952 VFP_CONV_FIX(sl
, d
, 64, 64, int32
)
8953 VFP_CONV_FIX_A64(sq
, d
, 64, 64, int64
)
8954 VFP_CONV_FIX(uh
, d
, 64, 64, uint16
)
8955 VFP_CONV_FIX(ul
, d
, 64, 64, uint32
)
8956 VFP_CONV_FIX_A64(uq
, d
, 64, 64, uint64
)
8957 VFP_CONV_FIX(sh
, s
, 32, 32, int16
)
8958 VFP_CONV_FIX(sl
, s
, 32, 32, int32
)
8959 VFP_CONV_FIX_A64(sq
, s
, 32, 64, int64
)
8960 VFP_CONV_FIX(uh
, s
, 32, 32, uint16
)
8961 VFP_CONV_FIX(ul
, s
, 32, 32, uint32
)
8962 VFP_CONV_FIX_A64(uq
, s
, 32, 64, uint64
)
8964 #undef VFP_CONV_FIX_FLOAT
8965 #undef VFP_CONV_FLOAT_FIX_ROUND
8967 /* Set the current fp rounding mode and return the old one.
8968 * The argument is a softfloat float_round_ value.
8970 uint32_t HELPER(set_rmode
)(uint32_t rmode
, CPUARMState
*env
)
8972 float_status
*fp_status
= &env
->vfp
.fp_status
;
8974 uint32_t prev_rmode
= get_float_rounding_mode(fp_status
);
8975 set_float_rounding_mode(rmode
, fp_status
);
8980 /* Set the current fp rounding mode in the standard fp status and return
8981 * the old one. This is for NEON instructions that need to change the
8982 * rounding mode but wish to use the standard FPSCR values for everything
8983 * else. Always set the rounding mode back to the correct value after
8985 * The argument is a softfloat float_round_ value.
8987 uint32_t HELPER(set_neon_rmode
)(uint32_t rmode
, CPUARMState
*env
)
8989 float_status
*fp_status
= &env
->vfp
.standard_fp_status
;
8991 uint32_t prev_rmode
= get_float_rounding_mode(fp_status
);
8992 set_float_rounding_mode(rmode
, fp_status
);
8997 /* Half precision conversions. */
8998 static float32
do_fcvt_f16_to_f32(uint32_t a
, CPUARMState
*env
, float_status
*s
)
9000 int ieee
= (env
->vfp
.xregs
[ARM_VFP_FPSCR
] & (1 << 26)) == 0;
9001 float32 r
= float16_to_float32(make_float16(a
), ieee
, s
);
9003 return float32_maybe_silence_nan(r
, s
);
9008 static uint32_t do_fcvt_f32_to_f16(float32 a
, CPUARMState
*env
, float_status
*s
)
9010 int ieee
= (env
->vfp
.xregs
[ARM_VFP_FPSCR
] & (1 << 26)) == 0;
9011 float16 r
= float32_to_float16(a
, ieee
, s
);
9013 r
= float16_maybe_silence_nan(r
, s
);
9015 return float16_val(r
);
9018 float32
HELPER(neon_fcvt_f16_to_f32
)(uint32_t a
, CPUARMState
*env
)
9020 return do_fcvt_f16_to_f32(a
, env
, &env
->vfp
.standard_fp_status
);
9023 uint32_t HELPER(neon_fcvt_f32_to_f16
)(float32 a
, CPUARMState
*env
)
9025 return do_fcvt_f32_to_f16(a
, env
, &env
->vfp
.standard_fp_status
);
9028 float32
HELPER(vfp_fcvt_f16_to_f32
)(uint32_t a
, CPUARMState
*env
)
9030 return do_fcvt_f16_to_f32(a
, env
, &env
->vfp
.fp_status
);
9033 uint32_t HELPER(vfp_fcvt_f32_to_f16
)(float32 a
, CPUARMState
*env
)
9035 return do_fcvt_f32_to_f16(a
, env
, &env
->vfp
.fp_status
);
9038 float64
HELPER(vfp_fcvt_f16_to_f64
)(uint32_t a
, CPUARMState
*env
)
9040 int ieee
= (env
->vfp
.xregs
[ARM_VFP_FPSCR
] & (1 << 26)) == 0;
9041 float64 r
= float16_to_float64(make_float16(a
), ieee
, &env
->vfp
.fp_status
);
9043 return float64_maybe_silence_nan(r
, &env
->vfp
.fp_status
);
9048 uint32_t HELPER(vfp_fcvt_f64_to_f16
)(float64 a
, CPUARMState
*env
)
9050 int ieee
= (env
->vfp
.xregs
[ARM_VFP_FPSCR
] & (1 << 26)) == 0;
9051 float16 r
= float64_to_float16(a
, ieee
, &env
->vfp
.fp_status
);
9053 r
= float16_maybe_silence_nan(r
, &env
->vfp
.fp_status
);
9055 return float16_val(r
);
9058 #define float32_two make_float32(0x40000000)
9059 #define float32_three make_float32(0x40400000)
9060 #define float32_one_point_five make_float32(0x3fc00000)
9062 float32
HELPER(recps_f32
)(float32 a
, float32 b
, CPUARMState
*env
)
9064 float_status
*s
= &env
->vfp
.standard_fp_status
;
9065 if ((float32_is_infinity(a
) && float32_is_zero_or_denormal(b
)) ||
9066 (float32_is_infinity(b
) && float32_is_zero_or_denormal(a
))) {
9067 if (!(float32_is_zero(a
) || float32_is_zero(b
))) {
9068 float_raise(float_flag_input_denormal
, s
);
9072 return float32_sub(float32_two
, float32_mul(a
, b
, s
), s
);
9075 float32
HELPER(rsqrts_f32
)(float32 a
, float32 b
, CPUARMState
*env
)
9077 float_status
*s
= &env
->vfp
.standard_fp_status
;
9079 if ((float32_is_infinity(a
) && float32_is_zero_or_denormal(b
)) ||
9080 (float32_is_infinity(b
) && float32_is_zero_or_denormal(a
))) {
9081 if (!(float32_is_zero(a
) || float32_is_zero(b
))) {
9082 float_raise(float_flag_input_denormal
, s
);
9084 return float32_one_point_five
;
9086 product
= float32_mul(a
, b
, s
);
9087 return float32_div(float32_sub(float32_three
, product
, s
), float32_two
, s
);
9092 /* Constants 256 and 512 are used in some helpers; we avoid relying on
9093 * int->float conversions at run-time. */
9094 #define float64_256 make_float64(0x4070000000000000LL)
9095 #define float64_512 make_float64(0x4080000000000000LL)
9096 #define float32_maxnorm make_float32(0x7f7fffff)
9097 #define float64_maxnorm make_float64(0x7fefffffffffffffLL)
9099 /* Reciprocal functions
9101 * The algorithm that must be used to calculate the estimate
9102 * is specified by the ARM ARM, see FPRecipEstimate()
9105 static float64
recip_estimate(float64 a
, float_status
*real_fp_status
)
9107 /* These calculations mustn't set any fp exception flags,
9108 * so we use a local copy of the fp_status.
9110 float_status dummy_status
= *real_fp_status
;
9111 float_status
*s
= &dummy_status
;
9112 /* q = (int)(a * 512.0) */
9113 float64 q
= float64_mul(float64_512
, a
, s
);
9114 int64_t q_int
= float64_to_int64_round_to_zero(q
, s
);
9116 /* r = 1.0 / (((double)q + 0.5) / 512.0) */
9117 q
= int64_to_float64(q_int
, s
);
9118 q
= float64_add(q
, float64_half
, s
);
9119 q
= float64_div(q
, float64_512
, s
);
9120 q
= float64_div(float64_one
, q
, s
);
9122 /* s = (int)(256.0 * r + 0.5) */
9123 q
= float64_mul(q
, float64_256
, s
);
9124 q
= float64_add(q
, float64_half
, s
);
9125 q_int
= float64_to_int64_round_to_zero(q
, s
);
9127 /* return (double)s / 256.0 */
9128 return float64_div(int64_to_float64(q_int
, s
), float64_256
, s
);
9131 /* Common wrapper to call recip_estimate */
9132 static float64
call_recip_estimate(float64 num
, int off
, float_status
*fpst
)
9134 uint64_t val64
= float64_val(num
);
9135 uint64_t frac
= extract64(val64
, 0, 52);
9136 int64_t exp
= extract64(val64
, 52, 11);
9138 float64 scaled
, estimate
;
9140 /* Generate the scaled number for the estimate function */
9142 if (extract64(frac
, 51, 1) == 0) {
9144 frac
= extract64(frac
, 0, 50) << 2;
9146 frac
= extract64(frac
, 0, 51) << 1;
9150 /* scaled = '0' : '01111111110' : fraction<51:44> : Zeros(44); */
9151 scaled
= make_float64((0x3feULL
<< 52)
9152 | extract64(frac
, 44, 8) << 44);
9154 estimate
= recip_estimate(scaled
, fpst
);
9156 /* Build new result */
9157 val64
= float64_val(estimate
);
9158 sbit
= 0x8000000000000000ULL
& val64
;
9160 frac
= extract64(val64
, 0, 52);
9163 frac
= 1ULL << 51 | extract64(frac
, 1, 51);
9164 } else if (exp
== -1) {
9165 frac
= 1ULL << 50 | extract64(frac
, 2, 50);
9169 return make_float64(sbit
| (exp
<< 52) | frac
);
9172 static bool round_to_inf(float_status
*fpst
, bool sign_bit
)
9174 switch (fpst
->float_rounding_mode
) {
9175 case float_round_nearest_even
: /* Round to Nearest */
9177 case float_round_up
: /* Round to +Inf */
9179 case float_round_down
: /* Round to -Inf */
9181 case float_round_to_zero
: /* Round to Zero */
9185 g_assert_not_reached();
9188 float32
HELPER(recpe_f32
)(float32 input
, void *fpstp
)
9190 float_status
*fpst
= fpstp
;
9191 float32 f32
= float32_squash_input_denormal(input
, fpst
);
9192 uint32_t f32_val
= float32_val(f32
);
9193 uint32_t f32_sbit
= 0x80000000ULL
& f32_val
;
9194 int32_t f32_exp
= extract32(f32_val
, 23, 8);
9195 uint32_t f32_frac
= extract32(f32_val
, 0, 23);
9201 if (float32_is_any_nan(f32
)) {
9203 if (float32_is_signaling_nan(f32
, fpst
)) {
9204 float_raise(float_flag_invalid
, fpst
);
9205 nan
= float32_maybe_silence_nan(f32
, fpst
);
9207 if (fpst
->default_nan_mode
) {
9208 nan
= float32_default_nan(fpst
);
9211 } else if (float32_is_infinity(f32
)) {
9212 return float32_set_sign(float32_zero
, float32_is_neg(f32
));
9213 } else if (float32_is_zero(f32
)) {
9214 float_raise(float_flag_divbyzero
, fpst
);
9215 return float32_set_sign(float32_infinity
, float32_is_neg(f32
));
9216 } else if ((f32_val
& ~(1ULL << 31)) < (1ULL << 21)) {
9217 /* Abs(value) < 2.0^-128 */
9218 float_raise(float_flag_overflow
| float_flag_inexact
, fpst
);
9219 if (round_to_inf(fpst
, f32_sbit
)) {
9220 return float32_set_sign(float32_infinity
, float32_is_neg(f32
));
9222 return float32_set_sign(float32_maxnorm
, float32_is_neg(f32
));
9224 } else if (f32_exp
>= 253 && fpst
->flush_to_zero
) {
9225 float_raise(float_flag_underflow
, fpst
);
9226 return float32_set_sign(float32_zero
, float32_is_neg(f32
));
9230 f64
= make_float64(((int64_t)(f32_exp
) << 52) | (int64_t)(f32_frac
) << 29);
9231 r64
= call_recip_estimate(f64
, 253, fpst
);
9232 r64_val
= float64_val(r64
);
9233 r64_exp
= extract64(r64_val
, 52, 11);
9234 r64_frac
= extract64(r64_val
, 0, 52);
9236 /* result = sign : result_exp<7:0> : fraction<51:29>; */
9237 return make_float32(f32_sbit
|
9238 (r64_exp
& 0xff) << 23 |
9239 extract64(r64_frac
, 29, 24));
9242 float64
HELPER(recpe_f64
)(float64 input
, void *fpstp
)
9244 float_status
*fpst
= fpstp
;
9245 float64 f64
= float64_squash_input_denormal(input
, fpst
);
9246 uint64_t f64_val
= float64_val(f64
);
9247 uint64_t f64_sbit
= 0x8000000000000000ULL
& f64_val
;
9248 int64_t f64_exp
= extract64(f64_val
, 52, 11);
9254 /* Deal with any special cases */
9255 if (float64_is_any_nan(f64
)) {
9257 if (float64_is_signaling_nan(f64
, fpst
)) {
9258 float_raise(float_flag_invalid
, fpst
);
9259 nan
= float64_maybe_silence_nan(f64
, fpst
);
9261 if (fpst
->default_nan_mode
) {
9262 nan
= float64_default_nan(fpst
);
9265 } else if (float64_is_infinity(f64
)) {
9266 return float64_set_sign(float64_zero
, float64_is_neg(f64
));
9267 } else if (float64_is_zero(f64
)) {
9268 float_raise(float_flag_divbyzero
, fpst
);
9269 return float64_set_sign(float64_infinity
, float64_is_neg(f64
));
9270 } else if ((f64_val
& ~(1ULL << 63)) < (1ULL << 50)) {
9271 /* Abs(value) < 2.0^-1024 */
9272 float_raise(float_flag_overflow
| float_flag_inexact
, fpst
);
9273 if (round_to_inf(fpst
, f64_sbit
)) {
9274 return float64_set_sign(float64_infinity
, float64_is_neg(f64
));
9276 return float64_set_sign(float64_maxnorm
, float64_is_neg(f64
));
9278 } else if (f64_exp
>= 2045 && fpst
->flush_to_zero
) {
9279 float_raise(float_flag_underflow
, fpst
);
9280 return float64_set_sign(float64_zero
, float64_is_neg(f64
));
9283 r64
= call_recip_estimate(f64
, 2045, fpst
);
9284 r64_val
= float64_val(r64
);
9285 r64_exp
= extract64(r64_val
, 52, 11);
9286 r64_frac
= extract64(r64_val
, 0, 52);
9288 /* result = sign : result_exp<10:0> : fraction<51:0> */
9289 return make_float64(f64_sbit
|
9290 ((r64_exp
& 0x7ff) << 52) |
9294 /* The algorithm that must be used to calculate the estimate
9295 * is specified by the ARM ARM.
9297 static float64
recip_sqrt_estimate(float64 a
, float_status
*real_fp_status
)
9299 /* These calculations mustn't set any fp exception flags,
9300 * so we use a local copy of the fp_status.
9302 float_status dummy_status
= *real_fp_status
;
9303 float_status
*s
= &dummy_status
;
9307 if (float64_lt(a
, float64_half
, s
)) {
9308 /* range 0.25 <= a < 0.5 */
9310 /* a in units of 1/512 rounded down */
9311 /* q0 = (int)(a * 512.0); */
9312 q
= float64_mul(float64_512
, a
, s
);
9313 q_int
= float64_to_int64_round_to_zero(q
, s
);
9315 /* reciprocal root r */
9316 /* r = 1.0 / sqrt(((double)q0 + 0.5) / 512.0); */
9317 q
= int64_to_float64(q_int
, s
);
9318 q
= float64_add(q
, float64_half
, s
);
9319 q
= float64_div(q
, float64_512
, s
);
9320 q
= float64_sqrt(q
, s
);
9321 q
= float64_div(float64_one
, q
, s
);
9323 /* range 0.5 <= a < 1.0 */
9325 /* a in units of 1/256 rounded down */
9326 /* q1 = (int)(a * 256.0); */
9327 q
= float64_mul(float64_256
, a
, s
);
9328 int64_t q_int
= float64_to_int64_round_to_zero(q
, s
);
9330 /* reciprocal root r */
9331 /* r = 1.0 /sqrt(((double)q1 + 0.5) / 256); */
9332 q
= int64_to_float64(q_int
, s
);
9333 q
= float64_add(q
, float64_half
, s
);
9334 q
= float64_div(q
, float64_256
, s
);
9335 q
= float64_sqrt(q
, s
);
9336 q
= float64_div(float64_one
, q
, s
);
9338 /* r in units of 1/256 rounded to nearest */
9339 /* s = (int)(256.0 * r + 0.5); */
9341 q
= float64_mul(q
, float64_256
,s
);
9342 q
= float64_add(q
, float64_half
, s
);
9343 q_int
= float64_to_int64_round_to_zero(q
, s
);
9345 /* return (double)s / 256.0;*/
9346 return float64_div(int64_to_float64(q_int
, s
), float64_256
, s
);
9349 float32
HELPER(rsqrte_f32
)(float32 input
, void *fpstp
)
9351 float_status
*s
= fpstp
;
9352 float32 f32
= float32_squash_input_denormal(input
, s
);
9353 uint32_t val
= float32_val(f32
);
9354 uint32_t f32_sbit
= 0x80000000 & val
;
9355 int32_t f32_exp
= extract32(val
, 23, 8);
9356 uint32_t f32_frac
= extract32(val
, 0, 23);
9362 if (float32_is_any_nan(f32
)) {
9364 if (float32_is_signaling_nan(f32
, s
)) {
9365 float_raise(float_flag_invalid
, s
);
9366 nan
= float32_maybe_silence_nan(f32
, s
);
9368 if (s
->default_nan_mode
) {
9369 nan
= float32_default_nan(s
);
9372 } else if (float32_is_zero(f32
)) {
9373 float_raise(float_flag_divbyzero
, s
);
9374 return float32_set_sign(float32_infinity
, float32_is_neg(f32
));
9375 } else if (float32_is_neg(f32
)) {
9376 float_raise(float_flag_invalid
, s
);
9377 return float32_default_nan(s
);
9378 } else if (float32_is_infinity(f32
)) {
9379 return float32_zero
;
9382 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
9383 * preserving the parity of the exponent. */
9385 f64_frac
= ((uint64_t) f32_frac
) << 29;
9387 while (extract64(f64_frac
, 51, 1) == 0) {
9388 f64_frac
= f64_frac
<< 1;
9389 f32_exp
= f32_exp
-1;
9391 f64_frac
= extract64(f64_frac
, 0, 51) << 1;
9394 if (extract64(f32_exp
, 0, 1) == 0) {
9395 f64
= make_float64(((uint64_t) f32_sbit
) << 32
9399 f64
= make_float64(((uint64_t) f32_sbit
) << 32
9404 result_exp
= (380 - f32_exp
) / 2;
9406 f64
= recip_sqrt_estimate(f64
, s
);
9408 val64
= float64_val(f64
);
9410 val
= ((result_exp
& 0xff) << 23)
9411 | ((val64
>> 29) & 0x7fffff);
9412 return make_float32(val
);
9415 float64
HELPER(rsqrte_f64
)(float64 input
, void *fpstp
)
9417 float_status
*s
= fpstp
;
9418 float64 f64
= float64_squash_input_denormal(input
, s
);
9419 uint64_t val
= float64_val(f64
);
9420 uint64_t f64_sbit
= 0x8000000000000000ULL
& val
;
9421 int64_t f64_exp
= extract64(val
, 52, 11);
9422 uint64_t f64_frac
= extract64(val
, 0, 52);
9424 uint64_t result_frac
;
9426 if (float64_is_any_nan(f64
)) {
9428 if (float64_is_signaling_nan(f64
, s
)) {
9429 float_raise(float_flag_invalid
, s
);
9430 nan
= float64_maybe_silence_nan(f64
, s
);
9432 if (s
->default_nan_mode
) {
9433 nan
= float64_default_nan(s
);
9436 } else if (float64_is_zero(f64
)) {
9437 float_raise(float_flag_divbyzero
, s
);
9438 return float64_set_sign(float64_infinity
, float64_is_neg(f64
));
9439 } else if (float64_is_neg(f64
)) {
9440 float_raise(float_flag_invalid
, s
);
9441 return float64_default_nan(s
);
9442 } else if (float64_is_infinity(f64
)) {
9443 return float64_zero
;
9446 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
9447 * preserving the parity of the exponent. */
9450 while (extract64(f64_frac
, 51, 1) == 0) {
9451 f64_frac
= f64_frac
<< 1;
9452 f64_exp
= f64_exp
- 1;
9454 f64_frac
= extract64(f64_frac
, 0, 51) << 1;
9457 if (extract64(f64_exp
, 0, 1) == 0) {
9458 f64
= make_float64(f64_sbit
9462 f64
= make_float64(f64_sbit
9467 result_exp
= (3068 - f64_exp
) / 2;
9469 f64
= recip_sqrt_estimate(f64
, s
);
9471 result_frac
= extract64(float64_val(f64
), 0, 52);
9473 return make_float64(f64_sbit
|
9474 ((result_exp
& 0x7ff) << 52) |
9478 uint32_t HELPER(recpe_u32
)(uint32_t a
, void *fpstp
)
9480 float_status
*s
= fpstp
;
9483 if ((a
& 0x80000000) == 0) {
9487 f64
= make_float64((0x3feULL
<< 52)
9488 | ((int64_t)(a
& 0x7fffffff) << 21));
9490 f64
= recip_estimate(f64
, s
);
9492 return 0x80000000 | ((float64_val(f64
) >> 21) & 0x7fffffff);
9495 uint32_t HELPER(rsqrte_u32
)(uint32_t a
, void *fpstp
)
9497 float_status
*fpst
= fpstp
;
9500 if ((a
& 0xc0000000) == 0) {
9504 if (a
& 0x80000000) {
9505 f64
= make_float64((0x3feULL
<< 52)
9506 | ((uint64_t)(a
& 0x7fffffff) << 21));
9507 } else { /* bits 31-30 == '01' */
9508 f64
= make_float64((0x3fdULL
<< 52)
9509 | ((uint64_t)(a
& 0x3fffffff) << 22));
9512 f64
= recip_sqrt_estimate(f64
, fpst
);
9514 return 0x80000000 | ((float64_val(f64
) >> 21) & 0x7fffffff);
9517 /* VFPv4 fused multiply-accumulate */
9518 float32
VFP_HELPER(muladd
, s
)(float32 a
, float32 b
, float32 c
, void *fpstp
)
9520 float_status
*fpst
= fpstp
;
9521 return float32_muladd(a
, b
, c
, 0, fpst
);
9524 float64
VFP_HELPER(muladd
, d
)(float64 a
, float64 b
, float64 c
, void *fpstp
)
9526 float_status
*fpst
= fpstp
;
9527 return float64_muladd(a
, b
, c
, 0, fpst
);
9530 /* ARMv8 round to integral */
9531 float32
HELPER(rints_exact
)(float32 x
, void *fp_status
)
9533 return float32_round_to_int(x
, fp_status
);
9536 float64
HELPER(rintd_exact
)(float64 x
, void *fp_status
)
9538 return float64_round_to_int(x
, fp_status
);
9541 float32
HELPER(rints
)(float32 x
, void *fp_status
)
9543 int old_flags
= get_float_exception_flags(fp_status
), new_flags
;
9546 ret
= float32_round_to_int(x
, fp_status
);
9548 /* Suppress any inexact exceptions the conversion produced */
9549 if (!(old_flags
& float_flag_inexact
)) {
9550 new_flags
= get_float_exception_flags(fp_status
);
9551 set_float_exception_flags(new_flags
& ~float_flag_inexact
, fp_status
);
9557 float64
HELPER(rintd
)(float64 x
, void *fp_status
)
9559 int old_flags
= get_float_exception_flags(fp_status
), new_flags
;
9562 ret
= float64_round_to_int(x
, fp_status
);
9564 new_flags
= get_float_exception_flags(fp_status
);
9566 /* Suppress any inexact exceptions the conversion produced */
9567 if (!(old_flags
& float_flag_inexact
)) {
9568 new_flags
= get_float_exception_flags(fp_status
);
9569 set_float_exception_flags(new_flags
& ~float_flag_inexact
, fp_status
);
9575 /* Convert ARM rounding mode to softfloat */
9576 int arm_rmode_to_sf(int rmode
)
9579 case FPROUNDING_TIEAWAY
:
9580 rmode
= float_round_ties_away
;
9582 case FPROUNDING_ODD
:
9583 /* FIXME: add support for TIEAWAY and ODD */
9584 qemu_log_mask(LOG_UNIMP
, "arm: unimplemented rounding mode: %d\n",
9586 case FPROUNDING_TIEEVEN
:
9588 rmode
= float_round_nearest_even
;
9590 case FPROUNDING_POSINF
:
9591 rmode
= float_round_up
;
9593 case FPROUNDING_NEGINF
:
9594 rmode
= float_round_down
;
9596 case FPROUNDING_ZERO
:
9597 rmode
= float_round_to_zero
;
9604 * The upper bytes of val (above the number specified by 'bytes') must have
9605 * been zeroed out by the caller.
9607 uint32_t HELPER(crc32
)(uint32_t acc
, uint32_t val
, uint32_t bytes
)
9613 /* zlib crc32 converts the accumulator and output to one's complement. */
9614 return crc32(acc
^ 0xffffffff, buf
, bytes
) ^ 0xffffffff;
9617 uint32_t HELPER(crc32c
)(uint32_t acc
, uint32_t val
, uint32_t bytes
)
9623 /* Linux crc32c converts the output to one's complement. */
9624 return crc32c(acc
, buf
, bytes
) ^ 0xffffffff;