?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
target/arm: Remove redundant scaling of nexttick
[qemu/ar7.git] / target / arm / helper.c
blob31fab098c55b43d8e9740e4783a88f106ac8f939
1 /*
2 * ARM generic helpers.
3 *
4 * This code is licensed under the GNU GPL v2 or later.
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9 #include "qemu/osdep.h"
10 #include "qemu/units.h"
11 #include "target/arm/idau.h"
12 #include "trace.h"
13 #include "cpu.h"
14 #include "internals.h"
15 #include "exec/gdbstub.h"
16 #include "exec/helper-proto.h"
17 #include "qemu/host-utils.h"
18 #include "qemu/main-loop.h"
19 #include "qemu/bitops.h"
20 #include "qemu/crc32c.h"
21 #include "qemu/qemu-print.h"
22 #include "exec/exec-all.h"
23 #include <zlib.h> /* For crc32 */
24 #include "hw/irq.h"
25 #include "hw/semihosting/semihost.h"
26 #include "sysemu/cpus.h"
27 #include "sysemu/kvm.h"
28 #include "qemu/range.h"
29 #include "qapi/qapi-commands-machine-target.h"
30 #include "qapi/error.h"
31 #include "qemu/guest-random.h"
32 #ifdef CONFIG_TCG
33 #include "arm_ldst.h"
34 #include "exec/cpu_ldst.h"
35 #endif
36
37 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
38
39 #ifndef CONFIG_USER_ONLY
40
41 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
42 MMUAccessType access_type, ARMMMUIdx mmu_idx,
43 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
44 target_ulong *page_size_ptr,
45 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
46 #endif
47
48 static void switch_mode(CPUARMState *env, int mode);
49
50 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
51 {
52 int nregs;
53
54 /* VFP data registers are always little-endian. */
55 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
56 if (reg < nregs) {
57 stq_le_p(buf, *aa32_vfp_dreg(env, reg));
58 return 8;
59 }
60 if (arm_feature(env, ARM_FEATURE_NEON)) {
61 /* Aliases for Q regs. */
62 nregs += 16;
63 if (reg < nregs) {
64 uint64_t *q = aa32_vfp_qreg(env, reg - 32);
65 stq_le_p(buf, q[0]);
66 stq_le_p(buf + 8, q[1]);
67 return 16;
68 }
69 }
70 switch (reg - nregs) {
71 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
72 case 1: stl_p(buf, vfp_get_fpscr(env)); return 4;
73 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
74 }
75 return 0;
76 }
77
78 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
79 {
80 int nregs;
81
82 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
83 if (reg < nregs) {
84 *aa32_vfp_dreg(env, reg) = ldq_le_p(buf);
85 return 8;
86 }
87 if (arm_feature(env, ARM_FEATURE_NEON)) {
88 nregs += 16;
89 if (reg < nregs) {
90 uint64_t *q = aa32_vfp_qreg(env, reg - 32);
91 q[0] = ldq_le_p(buf);
92 q[1] = ldq_le_p(buf + 8);
93 return 16;
94 }
95 }
96 switch (reg - nregs) {
97 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
98 case 1: vfp_set_fpscr(env, ldl_p(buf)); return 4;
99 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
100 }
101 return 0;
102 }
103
104 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
105 {
106 switch (reg) {
107 case 0 ... 31:
108 /* 128 bit FP register */
109 {
110 uint64_t *q = aa64_vfp_qreg(env, reg);
111 stq_le_p(buf, q[0]);
112 stq_le_p(buf + 8, q[1]);
113 return 16;
114 }
115 case 32:
116 /* FPSR */
117 stl_p(buf, vfp_get_fpsr(env));
118 return 4;
119 case 33:
120 /* FPCR */
121 stl_p(buf, vfp_get_fpcr(env));
122 return 4;
123 default:
124 return 0;
125 }
126 }
127
128 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
129 {
130 switch (reg) {
131 case 0 ... 31:
132 /* 128 bit FP register */
133 {
134 uint64_t *q = aa64_vfp_qreg(env, reg);
135 q[0] = ldq_le_p(buf);
136 q[1] = ldq_le_p(buf + 8);
137 return 16;
138 }
139 case 32:
140 /* FPSR */
141 vfp_set_fpsr(env, ldl_p(buf));
142 return 4;
143 case 33:
144 /* FPCR */
145 vfp_set_fpcr(env, ldl_p(buf));
146 return 4;
147 default:
148 return 0;
149 }
150 }
151
152 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
153 {
154 assert(ri->fieldoffset);
155 if (cpreg_field_is_64bit(ri)) {
156 return CPREG_FIELD64(env, ri);
157 } else {
158 return CPREG_FIELD32(env, ri);
159 }
160 }
161
162 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
163 uint64_t value)
164 {
165 assert(ri->fieldoffset);
166 if (cpreg_field_is_64bit(ri)) {
167 CPREG_FIELD64(env, ri) = value;
168 } else {
169 CPREG_FIELD32(env, ri) = value;
170 }
171 }
172
173 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri)
174 {
175 return (char *)env + ri->fieldoffset;
176 }
177
178 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
179 {
180 /* Raw read of a coprocessor register (as needed for migration, etc). */
181 if (ri->type & ARM_CP_CONST) {
182 return ri->resetvalue;
183 } else if (ri->raw_readfn) {
184 return ri->raw_readfn(env, ri);
185 } else if (ri->readfn) {
186 return ri->readfn(env, ri);
187 } else {
188 return raw_read(env, ri);
189 }
190 }
191
192 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
193 uint64_t v)
194 {
195 /* Raw write of a coprocessor register (as needed for migration, etc).
196 * Note that constant registers are treated as write-ignored; the
197 * caller should check for success by whether a readback gives the
198 * value written.
199 */
200 if (ri->type & ARM_CP_CONST) {
201 return;
202 } else if (ri->raw_writefn) {
203 ri->raw_writefn(env, ri, v);
204 } else if (ri->writefn) {
205 ri->writefn(env, ri, v);
206 } else {
207 raw_write(env, ri, v);
208 }
209 }
210
211 static int arm_gdb_get_sysreg(CPUARMState *env, uint8_t *buf, int reg)
212 {
213 ARMCPU *cpu = env_archcpu(env);
214 const ARMCPRegInfo *ri;
215 uint32_t key;
216
217 key = cpu->dyn_xml.cpregs_keys[reg];
218 ri = get_arm_cp_reginfo(cpu->cp_regs, key);
219 if (ri) {
220 if (cpreg_field_is_64bit(ri)) {
221 return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri));
222 } else {
223 return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri));
224 }
225 }
226 return 0;
227 }
228
229 static int arm_gdb_set_sysreg(CPUARMState *env, uint8_t *buf, int reg)
230 {
231 return 0;
232 }
233
234 static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
235 {
236 /* Return true if the regdef would cause an assertion if you called
237 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
238 * program bug for it not to have the NO_RAW flag).
239 * NB that returning false here doesn't necessarily mean that calling
240 * read/write_raw_cp_reg() is safe, because we can't distinguish "has
241 * read/write access functions which are safe for raw use" from "has
242 * read/write access functions which have side effects but has forgotten
243 * to provide raw access functions".
244 * The tests here line up with the conditions in read/write_raw_cp_reg()
245 * and assertions in raw_read()/raw_write().
246 */
247 if ((ri->type & ARM_CP_CONST) ||
248 ri->fieldoffset ||
249 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) {
250 return false;
251 }
252 return true;
253 }
254
255 bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
256 {
257 /* Write the coprocessor state from cpu->env to the (index,value) list. */
258 int i;
259 bool ok = true;
260
261 for (i = 0; i < cpu->cpreg_array_len; i++) {
262 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
263 const ARMCPRegInfo *ri;
264 uint64_t newval;
265
266 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
267 if (!ri) {
268 ok = false;
269 continue;
270 }
271 if (ri->type & ARM_CP_NO_RAW) {
272 continue;
273 }
274
275 newval = read_raw_cp_reg(&cpu->env, ri);
276 if (kvm_sync) {
277 /*
278 * Only sync if the previous list->cpustate sync succeeded.
279 * Rather than tracking the success/failure state for every
280 * item in the list, we just recheck "does the raw write we must
281 * have made in write_list_to_cpustate() read back OK" here.
282 */
283 uint64_t oldval = cpu->cpreg_values[i];
284
285 if (oldval == newval) {
286 continue;
287 }
288
289 write_raw_cp_reg(&cpu->env, ri, oldval);
290 if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
291 continue;
292 }
293
294 write_raw_cp_reg(&cpu->env, ri, newval);
295 }
296 cpu->cpreg_values[i] = newval;
297 }
298 return ok;
299 }
300
301 bool write_list_to_cpustate(ARMCPU *cpu)
302 {
303 int i;
304 bool ok = true;
305
306 for (i = 0; i < cpu->cpreg_array_len; i++) {
307 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
308 uint64_t v = cpu->cpreg_values[i];
309 const ARMCPRegInfo *ri;
310
311 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
312 if (!ri) {
313 ok = false;
314 continue;
315 }
316 if (ri->type & ARM_CP_NO_RAW) {
317 continue;
318 }
319 /* Write value and confirm it reads back as written
320 * (to catch read-only registers and partially read-only
321 * registers where the incoming migration value doesn't match)
322 */
323 write_raw_cp_reg(&cpu->env, ri, v);
324 if (read_raw_cp_reg(&cpu->env, ri) != v) {
325 ok = false;
326 }
327 }
328 return ok;
329 }
330
331 static void add_cpreg_to_list(gpointer key, gpointer opaque)
332 {
333 ARMCPU *cpu = opaque;
334 uint64_t regidx;
335 const ARMCPRegInfo *ri;
336
337 regidx = *(uint32_t *)key;
338 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
339
340 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
341 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
342 /* The value array need not be initialized at this point */
343 cpu->cpreg_array_len++;
344 }
345 }
346
347 static void count_cpreg(gpointer key, gpointer opaque)
348 {
349 ARMCPU *cpu = opaque;
350 uint64_t regidx;
351 const ARMCPRegInfo *ri;
352
353 regidx = *(uint32_t *)key;
354 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
355
356 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
357 cpu->cpreg_array_len++;
358 }
359 }
360
361 static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
362 {
363 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
364 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
365
366 if (aidx > bidx) {
367 return 1;
368 }
369 if (aidx < bidx) {
370 return -1;
371 }
372 return 0;
373 }
374
375 void init_cpreg_list(ARMCPU *cpu)
376 {
377 /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
378 * Note that we require cpreg_tuples[] to be sorted by key ID.
379 */
380 GList *keys;
381 int arraylen;
382
383 keys = g_hash_table_get_keys(cpu->cp_regs);
384 keys = g_list_sort(keys, cpreg_key_compare);
385
386 cpu->cpreg_array_len = 0;
387
388 g_list_foreach(keys, count_cpreg, cpu);
389
390 arraylen = cpu->cpreg_array_len;
391 cpu->cpreg_indexes = g_new(uint64_t, arraylen);
392 cpu->cpreg_values = g_new(uint64_t, arraylen);
393 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
394 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
395 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
396 cpu->cpreg_array_len = 0;
397
398 g_list_foreach(keys, add_cpreg_to_list, cpu);
399
400 assert(cpu->cpreg_array_len == arraylen);
401
402 g_list_free(keys);
403 }
404
405 /*
406 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but
407 * they are accessible when EL3 is using AArch64 regardless of EL3.NS.
408 *
409 * access_el3_aa32ns: Used to check AArch32 register views.
410 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views.
411 */
412 static CPAccessResult access_el3_aa32ns(CPUARMState *env,
413 const ARMCPRegInfo *ri,
414 bool isread)
415 {
416 bool secure = arm_is_secure_below_el3(env);
417
418 assert(!arm_el_is_aa64(env, 3));
419 if (secure) {
420 return CP_ACCESS_TRAP_UNCATEGORIZED;
421 }
422 return CP_ACCESS_OK;
423 }
424
425 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env,
426 const ARMCPRegInfo *ri,
427 bool isread)
428 {
429 if (!arm_el_is_aa64(env, 3)) {
430 return access_el3_aa32ns(env, ri, isread);
431 }
432 return CP_ACCESS_OK;
433 }
434
435 /* Some secure-only AArch32 registers trap to EL3 if used from
436 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts).
437 * Note that an access from Secure EL1 can only happen if EL3 is AArch64.
438 * We assume that the .access field is set to PL1_RW.
439 */
440 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
441 const ARMCPRegInfo *ri,
442 bool isread)
443 {
444 if (arm_current_el(env) == 3) {
445 return CP_ACCESS_OK;
446 }
447 if (arm_is_secure_below_el3(env)) {
448 return CP_ACCESS_TRAP_EL3;
449 }
450 /* This will be EL1 NS and EL2 NS, which just UNDEF */
451 return CP_ACCESS_TRAP_UNCATEGORIZED;
452 }
453
454 /* Check for traps to "powerdown debug" registers, which are controlled
455 * by MDCR.TDOSA
456 */
457 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
458 bool isread)
459 {
460 int el = arm_current_el(env);
461 bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) ||
462 (env->cp15.mdcr_el2 & MDCR_TDE) ||
463 (arm_hcr_el2_eff(env) & HCR_TGE);
464
465 if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) {
466 return CP_ACCESS_TRAP_EL2;
467 }
468 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
469 return CP_ACCESS_TRAP_EL3;
470 }
471 return CP_ACCESS_OK;
472 }
473
474 /* Check for traps to "debug ROM" registers, which are controlled
475 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
476 */
477 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
478 bool isread)
479 {
480 int el = arm_current_el(env);
481 bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) ||
482 (env->cp15.mdcr_el2 & MDCR_TDE) ||
483 (arm_hcr_el2_eff(env) & HCR_TGE);
484
485 if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) {
486 return CP_ACCESS_TRAP_EL2;
487 }
488 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
489 return CP_ACCESS_TRAP_EL3;
490 }
491 return CP_ACCESS_OK;
492 }
493
494 /* Check for traps to general debug registers, which are controlled
495 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
496 */
497 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
498 bool isread)
499 {
500 int el = arm_current_el(env);
501 bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) ||
502 (env->cp15.mdcr_el2 & MDCR_TDE) ||
503 (arm_hcr_el2_eff(env) & HCR_TGE);
504
505 if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) {
506 return CP_ACCESS_TRAP_EL2;
507 }
508 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
509 return CP_ACCESS_TRAP_EL3;
510 }
511 return CP_ACCESS_OK;
512 }
513
514 /* Check for traps to performance monitor registers, which are controlled
515 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
516 */
517 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri,
518 bool isread)
519 {
520 int el = arm_current_el(env);
521
522 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
523 && !arm_is_secure_below_el3(env)) {
524 return CP_ACCESS_TRAP_EL2;
525 }
526 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
527 return CP_ACCESS_TRAP_EL3;
528 }
529 return CP_ACCESS_OK;
530 }
531
532 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
533 {
534 ARMCPU *cpu = env_archcpu(env);
535
536 raw_write(env, ri, value);
537 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */
538 }
539
540 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
541 {
542 ARMCPU *cpu = env_archcpu(env);
543
544 if (raw_read(env, ri) != value) {
545 /* Unlike real hardware the qemu TLB uses virtual addresses,
546 * not modified virtual addresses, so this causes a TLB flush.
547 */
548 tlb_flush(CPU(cpu));
549 raw_write(env, ri, value);
550 }
551 }
552
553 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
554 uint64_t value)
555 {
556 ARMCPU *cpu = env_archcpu(env);
557
558 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA)
559 && !extended_addresses_enabled(env)) {
560 /* For VMSA (when not using the LPAE long descriptor page table
561 * format) this register includes the ASID, so do a TLB flush.
562 * For PMSA it is purely a process ID and no action is needed.
563 */
564 tlb_flush(CPU(cpu));
565 }
566 raw_write(env, ri, value);
567 }
568
569 /* IS variants of TLB operations must affect all cores */
570 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
571 uint64_t value)
572 {
573 CPUState *cs = env_cpu(env);
574
575 tlb_flush_all_cpus_synced(cs);
576 }
577
578 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
579 uint64_t value)
580 {
581 CPUState *cs = env_cpu(env);
582
583 tlb_flush_all_cpus_synced(cs);
584 }
585
586 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
587 uint64_t value)
588 {
589 CPUState *cs = env_cpu(env);
590
591 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK);
592 }
593
594 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
595 uint64_t value)
596 {
597 CPUState *cs = env_cpu(env);
598
599 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK);
600 }
601
602 /*
603 * Non-IS variants of TLB operations are upgraded to
604 * IS versions if we are at NS EL1 and HCR_EL2.FB is set to
605 * force broadcast of these operations.
606 */
607 static bool tlb_force_broadcast(CPUARMState *env)
608 {
609 return (env->cp15.hcr_el2 & HCR_FB) &&
610 arm_current_el(env) == 1 && arm_is_secure_below_el3(env);
611 }
612
613 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,
614 uint64_t value)
615 {
616 /* Invalidate all (TLBIALL) */
617 ARMCPU *cpu = env_archcpu(env);
618
619 if (tlb_force_broadcast(env)) {
620 tlbiall_is_write(env, NULL, value);
621 return;
622 }
623
624 tlb_flush(CPU(cpu));
625 }
626
627 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,
628 uint64_t value)
629 {
630 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
631 ARMCPU *cpu = env_archcpu(env);
632
633 if (tlb_force_broadcast(env)) {
634 tlbimva_is_write(env, NULL, value);
635 return;
636 }
637
638 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
639 }
640
641 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,
642 uint64_t value)
643 {
644 /* Invalidate by ASID (TLBIASID) */
645 ARMCPU *cpu = env_archcpu(env);
646
647 if (tlb_force_broadcast(env)) {
648 tlbiasid_is_write(env, NULL, value);
649 return;
650 }
651
652 tlb_flush(CPU(cpu));
653 }
654
655 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
656 uint64_t value)
657 {
658 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
659 ARMCPU *cpu = env_archcpu(env);
660
661 if (tlb_force_broadcast(env)) {
662 tlbimvaa_is_write(env, NULL, value);
663 return;
664 }
665
666 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
667 }
668
669 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,
670 uint64_t value)
671 {
672 CPUState *cs = env_cpu(env);
673
674 tlb_flush_by_mmuidx(cs,
675 ARMMMUIdxBit_S12NSE1 |
676 ARMMMUIdxBit_S12NSE0 |
677 ARMMMUIdxBit_S2NS);
678 }
679
680 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
681 uint64_t value)
682 {
683 CPUState *cs = env_cpu(env);
684
685 tlb_flush_by_mmuidx_all_cpus_synced(cs,
686 ARMMMUIdxBit_S12NSE1 |
687 ARMMMUIdxBit_S12NSE0 |
688 ARMMMUIdxBit_S2NS);
689 }
690
691 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
692 uint64_t value)
693 {
694 /* Invalidate by IPA. This has to invalidate any structures that
695 * contain only stage 2 translation information, but does not need
696 * to apply to structures that contain combined stage 1 and stage 2
697 * translation information.
698 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
699 */
700 CPUState *cs = env_cpu(env);
701 uint64_t pageaddr;
702
703 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
704 return;
705 }
706
707 pageaddr = sextract64(value << 12, 0, 40);
708
709 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
710 }
711
712 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
713 uint64_t value)
714 {
715 CPUState *cs = env_cpu(env);
716 uint64_t pageaddr;
717
718 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
719 return;
720 }
721
722 pageaddr = sextract64(value << 12, 0, 40);
723
724 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
725 ARMMMUIdxBit_S2NS);
726 }
727
728 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
729 uint64_t value)
730 {
731 CPUState *cs = env_cpu(env);
732
733 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
734 }
735
736 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
737 uint64_t value)
738 {
739 CPUState *cs = env_cpu(env);
740
741 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
742 }
743
744 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
745 uint64_t value)
746 {
747 CPUState *cs = env_cpu(env);
748 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
749
750 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
751 }
752
753 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
754 uint64_t value)
755 {
756 CPUState *cs = env_cpu(env);
757 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
758
759 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
760 ARMMMUIdxBit_S1E2);
761 }
762
763 static const ARMCPRegInfo cp_reginfo[] = {
764 /* Define the secure and non-secure FCSE identifier CP registers
765 * separately because there is no secure bank in V8 (no _EL3). This allows
766 * the secure register to be properly reset and migrated. There is also no
767 * v8 EL1 version of the register so the non-secure instance stands alone.
768 */
769 { .name = "FCSEIDR",
770 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
771 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
772 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns),
773 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
774 { .name = "FCSEIDR_S",
775 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
776 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
777 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s),
778 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
779 /* Define the secure and non-secure context identifier CP registers
780 * separately because there is no secure bank in V8 (no _EL3). This allows
781 * the secure register to be properly reset and migrated. In the
782 * non-secure case, the 32-bit register will have reset and migration
783 * disabled during registration as it is handled by the 64-bit instance.
784 */
785 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH,
786 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
787 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
788 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]),
789 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
790 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32,
791 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
792 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
793 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s),
794 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
795 REGINFO_SENTINEL
796 };
797
798 static const ARMCPRegInfo not_v8_cp_reginfo[] = {
799 /* NB: Some of these registers exist in v8 but with more precise
800 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
801 */
802 /* MMU Domain access control / MPU write buffer control */
803 { .name = "DACR",
804 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY,
805 .access = PL1_RW, .resetvalue = 0,
806 .writefn = dacr_write, .raw_writefn = raw_write,
807 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
808 offsetoflow32(CPUARMState, cp15.dacr_ns) } },
809 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs.
810 * For v6 and v5, these mappings are overly broad.
811 */
812 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0,
813 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
814 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1,
815 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
816 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4,
817 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
818 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8,
819 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
820 /* Cache maintenance ops; some of this space may be overridden later. */
821 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
822 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
823 .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
824 REGINFO_SENTINEL
825 };
826
827 static const ARMCPRegInfo not_v6_cp_reginfo[] = {
828 /* Not all pre-v6 cores implemented this WFI, so this is slightly
829 * over-broad.
830 */
831 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
832 .access = PL1_W, .type = ARM_CP_WFI },
833 REGINFO_SENTINEL
834 };
835
836 static const ARMCPRegInfo not_v7_cp_reginfo[] = {
837 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
838 * is UNPREDICTABLE; we choose to NOP as most implementations do).
839 */
840 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
841 .access = PL1_W, .type = ARM_CP_WFI },
842 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice
843 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
844 * OMAPCP will override this space.
845 */
846 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
847 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
848 .resetvalue = 0 },
849 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
850 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
851 .resetvalue = 0 },
852 /* v6 doesn't have the cache ID registers but Linux reads them anyway */
853 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
854 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
855 .resetvalue = 0 },
856 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
857 * implementing it as RAZ means the "debug architecture version" bits
858 * will read as a reserved value, which should cause Linux to not try
859 * to use the debug hardware.
860 */
861 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
862 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
863 /* MMU TLB control. Note that the wildcarding means we cover not just
864 * the unified TLB ops but also the dside/iside/inner-shareable variants.
865 */
866 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
867 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
868 .type = ARM_CP_NO_RAW },
869 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
870 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
871 .type = ARM_CP_NO_RAW },
872 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
873 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
874 .type = ARM_CP_NO_RAW },
875 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
876 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
877 .type = ARM_CP_NO_RAW },
878 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2,
879 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP },
880 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2,
881 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP },
882 REGINFO_SENTINEL
883 };
884
885 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
886 uint64_t value)
887 {
888 uint32_t mask = 0;
889
890 /* In ARMv8 most bits of CPACR_EL1 are RES0. */
891 if (!arm_feature(env, ARM_FEATURE_V8)) {
892 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
893 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
894 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
895 */
896 if (arm_feature(env, ARM_FEATURE_VFP)) {
897 /* VFP coprocessor: cp10 & cp11 [23:20] */
898 mask |= (1 << 31) | (1 << 30) | (0xf << 20);
899
900 if (!arm_feature(env, ARM_FEATURE_NEON)) {
901 /* ASEDIS [31] bit is RAO/WI */
902 value |= (1 << 31);
903 }
904
905 /* VFPv3 and upwards with NEON implement 32 double precision
906 * registers (D0-D31).
907 */
908 if (!arm_feature(env, ARM_FEATURE_NEON) ||
909 !arm_feature(env, ARM_FEATURE_VFP3)) {
910 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
911 value |= (1 << 30);
912 }
913 }
914 value &= mask;
915 }
916
917 /*
918 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10
919 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00.
920 */
921 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
922 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
923 value &= ~(0xf << 20);
924 value |= env->cp15.cpacr_el1 & (0xf << 20);
925 }
926
927 env->cp15.cpacr_el1 = value;
928 }
929
930 static uint64_t cpacr_read(CPUARMState *env, const ARMCPRegInfo *ri)
931 {
932 /*
933 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10
934 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00.
935 */
936 uint64_t value = env->cp15.cpacr_el1;
937
938 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
939 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
940 value &= ~(0xf << 20);
941 }
942 return value;
943 }
944
945
946 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
947 {
948 /* Call cpacr_write() so that we reset with the correct RAO bits set
949 * for our CPU features.
950 */
951 cpacr_write(env, ri, 0);
952 }
953
954 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
955 bool isread)
956 {
957 if (arm_feature(env, ARM_FEATURE_V8)) {
958 /* Check if CPACR accesses are to be trapped to EL2 */
959 if (arm_current_el(env) == 1 &&
960 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) {
961 return CP_ACCESS_TRAP_EL2;
962 /* Check if CPACR accesses are to be trapped to EL3 */
963 } else if (arm_current_el(env) < 3 &&
964 (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
965 return CP_ACCESS_TRAP_EL3;
966 }
967 }
968
969 return CP_ACCESS_OK;
970 }
971
972 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri,
973 bool isread)
974 {
975 /* Check if CPTR accesses are set to trap to EL3 */
976 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
977 return CP_ACCESS_TRAP_EL3;
978 }
979
980 return CP_ACCESS_OK;
981 }
982
983 static const ARMCPRegInfo v6_cp_reginfo[] = {
984 /* prefetch by MVA in v6, NOP in v7 */
985 { .name = "MVA_prefetch",
986 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
987 .access = PL1_W, .type = ARM_CP_NOP },
988 /* We need to break the TB after ISB to execute self-modifying code
989 * correctly and also to take any pending interrupts immediately.
990 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag.
991 */
992 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
993 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore },
994 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
995 .access = PL0_W, .type = ARM_CP_NOP },
996 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
997 .access = PL0_W, .type = ARM_CP_NOP },
998 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
999 .access = PL1_RW,
1000 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s),
1001 offsetof(CPUARMState, cp15.ifar_ns) },
1002 .resetvalue = 0, },
1003 /* Watchpoint Fault Address Register : should actually only be present
1004 * for 1136, 1176, 11MPCore.
1005 */
1006 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
1007 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
1008 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
1009 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
1010 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
1011 .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read },
1012 REGINFO_SENTINEL
1013 };
1014
1015 /* Definitions for the PMU registers */
1016 #define PMCRN_MASK 0xf800
1017 #define PMCRN_SHIFT 11
1018 #define PMCRLC 0x40
1019 #define PMCRDP 0x10
1020 #define PMCRD 0x8
1021 #define PMCRC 0x4
1022 #define PMCRP 0x2
1023 #define PMCRE 0x1
1024
1025 #define PMXEVTYPER_P 0x80000000
1026 #define PMXEVTYPER_U 0x40000000
1027 #define PMXEVTYPER_NSK 0x20000000
1028 #define PMXEVTYPER_NSU 0x10000000
1029 #define PMXEVTYPER_NSH 0x08000000
1030 #define PMXEVTYPER_M 0x04000000
1031 #define PMXEVTYPER_MT 0x02000000
1032 #define PMXEVTYPER_EVTCOUNT 0x0000ffff
1033 #define PMXEVTYPER_MASK (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \
1034 PMXEVTYPER_NSU | PMXEVTYPER_NSH | \
1035 PMXEVTYPER_M | PMXEVTYPER_MT | \
1036 PMXEVTYPER_EVTCOUNT)
1037
1038 #define PMCCFILTR 0xf8000000
1039 #define PMCCFILTR_M PMXEVTYPER_M
1040 #define PMCCFILTR_EL0 (PMCCFILTR | PMCCFILTR_M)
1041
1042 static inline uint32_t pmu_num_counters(CPUARMState *env)
1043 {
1044 return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
1045 }
1046
1047 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
1048 static inline uint64_t pmu_counter_mask(CPUARMState *env)
1049 {
1050 return (1 << 31) | ((1 << pmu_num_counters(env)) - 1);
1051 }
1052
1053 typedef struct pm_event {
1054 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */
1055 /* If the event is supported on this CPU (used to generate PMCEID[01]) */
1056 bool (*supported)(CPUARMState *);
1057 /*
1058 * Retrieve the current count of the underlying event. The programmed
1059 * counters hold a difference from the return value from this function
1060 */
1061 uint64_t (*get_count)(CPUARMState *);
1062 /*
1063 * Return how many nanoseconds it will take (at a minimum) for count events
1064 * to occur. A negative value indicates the counter will never overflow, or
1065 * that the counter has otherwise arranged for the overflow bit to be set
1066 * and the PMU interrupt to be raised on overflow.
1067 */
1068 int64_t (*ns_per_count)(uint64_t);
1069 } pm_event;
1070
1071 static bool event_always_supported(CPUARMState *env)
1072 {
1073 return true;
1074 }
1075
1076 static uint64_t swinc_get_count(CPUARMState *env)
1077 {
1078 /*
1079 * SW_INCR events are written directly to the pmevcntr's by writes to
1080 * PMSWINC, so there is no underlying count maintained by the PMU itself
1081 */
1082 return 0;
1083 }
1084
1085 static int64_t swinc_ns_per(uint64_t ignored)
1086 {
1087 return -1;
1088 }
1089
1090 /*
1091 * Return the underlying cycle count for the PMU cycle counters. If we're in
1092 * usermode, simply return 0.
1093 */
1094 static uint64_t cycles_get_count(CPUARMState *env)
1095 {
1096 #ifndef CONFIG_USER_ONLY
1097 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
1098 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
1099 #else
1100 return cpu_get_host_ticks();
1101 #endif
1102 }
1103
1104 #ifndef CONFIG_USER_ONLY
1105 static int64_t cycles_ns_per(uint64_t cycles)
1106 {
1107 return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles;
1108 }
1109
1110 static bool instructions_supported(CPUARMState *env)
1111 {
1112 return use_icount == 1 /* Precise instruction counting */;
1113 }
1114
1115 static uint64_t instructions_get_count(CPUARMState *env)
1116 {
1117 return (uint64_t)cpu_get_icount_raw();
1118 }
1119
1120 static int64_t instructions_ns_per(uint64_t icount)
1121 {
1122 return cpu_icount_to_ns((int64_t)icount);
1123 }
1124 #endif
1125
1126 static const pm_event pm_events[] = {
1127 { .number = 0x000, /* SW_INCR */
1128 .supported = event_always_supported,
1129 .get_count = swinc_get_count,
1130 .ns_per_count = swinc_ns_per,
1131 },
1132 #ifndef CONFIG_USER_ONLY
1133 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */
1134 .supported = instructions_supported,
1135 .get_count = instructions_get_count,
1136 .ns_per_count = instructions_ns_per,
1137 },
1138 { .number = 0x011, /* CPU_CYCLES, Cycle */
1139 .supported = event_always_supported,
1140 .get_count = cycles_get_count,
1141 .ns_per_count = cycles_ns_per,
1142 }
1143 #endif
1144 };
1145
1146 /*
1147 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of
1148 * events (i.e. the statistical profiling extension), this implementation
1149 * should first be updated to something sparse instead of the current
1150 * supported_event_map[] array.
1151 */
1152 #define MAX_EVENT_ID 0x11
1153 #define UNSUPPORTED_EVENT UINT16_MAX
1154 static uint16_t supported_event_map[MAX_EVENT_ID + 1];
1155
1156 /*
1157 * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map
1158 * of ARM event numbers to indices in our pm_events array.
1159 *
1160 * Note: Events in the 0x40XX range are not currently supported.
1161 */
1162 void pmu_init(ARMCPU *cpu)
1163 {
1164 unsigned int i;
1165
1166 /*
1167 * Empty supported_event_map and cpu->pmceid[01] before adding supported
1168 * events to them
1169 */
1170 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) {
1171 supported_event_map[i] = UNSUPPORTED_EVENT;
1172 }
1173 cpu->pmceid0 = 0;
1174 cpu->pmceid1 = 0;
1175
1176 for (i = 0; i < ARRAY_SIZE(pm_events); i++) {
1177 const pm_event *cnt = &pm_events[i];
1178 assert(cnt->number <= MAX_EVENT_ID);
1179 /* We do not currently support events in the 0x40xx range */
1180 assert(cnt->number <= 0x3f);
1181
1182 if (cnt->supported(&cpu->env)) {
1183 supported_event_map[cnt->number] = i;
1184 uint64_t event_mask = 1ULL << (cnt->number & 0x1f);
1185 if (cnt->number & 0x20) {
1186 cpu->pmceid1 |= event_mask;
1187 } else {
1188 cpu->pmceid0 |= event_mask;
1189 }
1190 }
1191 }
1192 }
1193
1194 /*
1195 * Check at runtime whether a PMU event is supported for the current machine
1196 */
1197 static bool event_supported(uint16_t number)
1198 {
1199 if (number > MAX_EVENT_ID) {
1200 return false;
1201 }
1202 return supported_event_map[number] != UNSUPPORTED_EVENT;
1203 }
1204
1205 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
1206 bool isread)
1207 {
1208 /* Performance monitor registers user accessibility is controlled
1209 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable
1210 * trapping to EL2 or EL3 for other accesses.
1211 */
1212 int el = arm_current_el(env);
1213
1214 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) {
1215 return CP_ACCESS_TRAP;
1216 }
1217 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
1218 && !arm_is_secure_below_el3(env)) {
1219 return CP_ACCESS_TRAP_EL2;
1220 }
1221 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
1222 return CP_ACCESS_TRAP_EL3;
1223 }
1224
1225 return CP_ACCESS_OK;
1226 }
1227
1228 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env,
1229 const ARMCPRegInfo *ri,
1230 bool isread)
1231 {
1232 /* ER: event counter read trap control */
1233 if (arm_feature(env, ARM_FEATURE_V8)
1234 && arm_current_el(env) == 0
1235 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0
1236 && isread) {
1237 return CP_ACCESS_OK;
1238 }
1239
1240 return pmreg_access(env, ri, isread);
1241 }
1242
1243 static CPAccessResult pmreg_access_swinc(CPUARMState *env,
1244 const ARMCPRegInfo *ri,
1245 bool isread)
1246 {
1247 /* SW: software increment write trap control */
1248 if (arm_feature(env, ARM_FEATURE_V8)
1249 && arm_current_el(env) == 0
1250 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0
1251 && !isread) {
1252 return CP_ACCESS_OK;
1253 }
1254
1255 return pmreg_access(env, ri, isread);
1256 }
1257
1258 static CPAccessResult pmreg_access_selr(CPUARMState *env,
1259 const ARMCPRegInfo *ri,
1260 bool isread)
1261 {
1262 /* ER: event counter read trap control */
1263 if (arm_feature(env, ARM_FEATURE_V8)
1264 && arm_current_el(env) == 0
1265 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) {
1266 return CP_ACCESS_OK;
1267 }
1268
1269 return pmreg_access(env, ri, isread);
1270 }
1271
1272 static CPAccessResult pmreg_access_ccntr(CPUARMState *env,
1273 const ARMCPRegInfo *ri,
1274 bool isread)
1275 {
1276 /* CR: cycle counter read trap control */
1277 if (arm_feature(env, ARM_FEATURE_V8)
1278 && arm_current_el(env) == 0
1279 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0
1280 && isread) {
1281 return CP_ACCESS_OK;
1282 }
1283
1284 return pmreg_access(env, ri, isread);
1285 }
1286
1287 /* Returns true if the counter (pass 31 for PMCCNTR) should count events using
1288 * the current EL, security state, and register configuration.
1289 */
1290 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
1291 {
1292 uint64_t filter;
1293 bool e, p, u, nsk, nsu, nsh, m;
1294 bool enabled, prohibited, filtered;
1295 bool secure = arm_is_secure(env);
1296 int el = arm_current_el(env);
1297 uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN;
1298
1299 if (!arm_feature(env, ARM_FEATURE_PMU)) {
1300 return false;
1301 }
1302
1303 if (!arm_feature(env, ARM_FEATURE_EL2) ||
1304 (counter < hpmn || counter == 31)) {
1305 e = env->cp15.c9_pmcr & PMCRE;
1306 } else {
1307 e = env->cp15.mdcr_el2 & MDCR_HPME;
1308 }
1309 enabled = e && (env->cp15.c9_pmcnten & (1 << counter));
1310
1311 if (!secure) {
1312 if (el == 2 && (counter < hpmn || counter == 31)) {
1313 prohibited = env->cp15.mdcr_el2 & MDCR_HPMD;
1314 } else {
1315 prohibited = false;
1316 }
1317 } else {
1318 prohibited = arm_feature(env, ARM_FEATURE_EL3) &&
1319 (env->cp15.mdcr_el3 & MDCR_SPME);
1320 }
1321
1322 if (prohibited && counter == 31) {
1323 prohibited = env->cp15.c9_pmcr & PMCRDP;
1324 }
1325
1326 if (counter == 31) {
1327 filter = env->cp15.pmccfiltr_el0;
1328 } else {
1329 filter = env->cp15.c14_pmevtyper[counter];
1330 }
1331
1332 p = filter & PMXEVTYPER_P;
1333 u = filter & PMXEVTYPER_U;
1334 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK);
1335 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU);
1336 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH);
1337 m = arm_el_is_aa64(env, 1) &&
1338 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M);
1339
1340 if (el == 0) {
1341 filtered = secure ? u : u != nsu;
1342 } else if (el == 1) {
1343 filtered = secure ? p : p != nsk;
1344 } else if (el == 2) {
1345 filtered = !nsh;
1346 } else { /* EL3 */
1347 filtered = m != p;
1348 }
1349
1350 if (counter != 31) {
1351 /*
1352 * If not checking PMCCNTR, ensure the counter is setup to an event we
1353 * support
1354 */
1355 uint16_t event = filter & PMXEVTYPER_EVTCOUNT;
1356 if (!event_supported(event)) {
1357 return false;
1358 }
1359 }
1360
1361 return enabled && !prohibited && !filtered;
1362 }
1363
1364 static void pmu_update_irq(CPUARMState *env)
1365 {
1366 ARMCPU *cpu = env_archcpu(env);
1367 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) &&
1368 (env->cp15.c9_pminten & env->cp15.c9_pmovsr));
1369 }
1370
1371 /*
1372 * Ensure c15_ccnt is the guest-visible count so that operations such as
1373 * enabling/disabling the counter or filtering, modifying the count itself,
1374 * etc. can be done logically. This is essentially a no-op if the counter is
1375 * not enabled at the time of the call.
1376 */
1377 static void pmccntr_op_start(CPUARMState *env)
1378 {
1379 uint64_t cycles = cycles_get_count(env);
1380
1381 if (pmu_counter_enabled(env, 31)) {
1382 uint64_t eff_cycles = cycles;
1383 if (env->cp15.c9_pmcr & PMCRD) {
1384 /* Increment once every 64 processor clock cycles */
1385 eff_cycles /= 64;
1386 }
1387
1388 uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta;
1389
1390 uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \
1391 1ull << 63 : 1ull << 31;
1392 if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) {
1393 env->cp15.c9_pmovsr |= (1 << 31);
1394 pmu_update_irq(env);
1395 }
1396
1397 env->cp15.c15_ccnt = new_pmccntr;
1398 }
1399 env->cp15.c15_ccnt_delta = cycles;
1400 }
1401
1402 /*
1403 * If PMCCNTR is enabled, recalculate the delta between the clock and the
1404 * guest-visible count. A call to pmccntr_op_finish should follow every call to
1405 * pmccntr_op_start.
1406 */
1407 static void pmccntr_op_finish(CPUARMState *env)
1408 {
1409 if (pmu_counter_enabled(env, 31)) {
1410 #ifndef CONFIG_USER_ONLY
1411 /* Calculate when the counter will next overflow */
1412 uint64_t remaining_cycles = -env->cp15.c15_ccnt;
1413 if (!(env->cp15.c9_pmcr & PMCRLC)) {
1414 remaining_cycles = (uint32_t)remaining_cycles;
1415 }
1416 int64_t overflow_in = cycles_ns_per(remaining_cycles);
1417
1418 if (overflow_in > 0) {
1419 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
1420 overflow_in;
1421 ARMCPU *cpu = env_archcpu(env);
1422 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
1423 }
1424 #endif
1425
1426 uint64_t prev_cycles = env->cp15.c15_ccnt_delta;
1427 if (env->cp15.c9_pmcr & PMCRD) {
1428 /* Increment once every 64 processor clock cycles */
1429 prev_cycles /= 64;
1430 }
1431 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt;
1432 }
1433 }
1434
1435 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter)
1436 {
1437
1438 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
1439 uint64_t count = 0;
1440 if (event_supported(event)) {
1441 uint16_t event_idx = supported_event_map[event];
1442 count = pm_events[event_idx].get_count(env);
1443 }
1444
1445 if (pmu_counter_enabled(env, counter)) {
1446 uint32_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter];
1447
1448 if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & INT32_MIN) {
1449 env->cp15.c9_pmovsr |= (1 << counter);
1450 pmu_update_irq(env);
1451 }
1452 env->cp15.c14_pmevcntr[counter] = new_pmevcntr;
1453 }
1454 env->cp15.c14_pmevcntr_delta[counter] = count;
1455 }
1456
1457 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter)
1458 {
1459 if (pmu_counter_enabled(env, counter)) {
1460 #ifndef CONFIG_USER_ONLY
1461 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
1462 uint16_t event_idx = supported_event_map[event];
1463 uint64_t delta = UINT32_MAX -
1464 (uint32_t)env->cp15.c14_pmevcntr[counter] + 1;
1465 int64_t overflow_in = pm_events[event_idx].ns_per_count(delta);
1466
1467 if (overflow_in > 0) {
1468 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
1469 overflow_in;
1470 ARMCPU *cpu = env_archcpu(env);
1471 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
1472 }
1473 #endif
1474
1475 env->cp15.c14_pmevcntr_delta[counter] -=
1476 env->cp15.c14_pmevcntr[counter];
1477 }
1478 }
1479
1480 void pmu_op_start(CPUARMState *env)
1481 {
1482 unsigned int i;
1483 pmccntr_op_start(env);
1484 for (i = 0; i < pmu_num_counters(env); i++) {
1485 pmevcntr_op_start(env, i);
1486 }
1487 }
1488
1489 void pmu_op_finish(CPUARMState *env)
1490 {
1491 unsigned int i;
1492 pmccntr_op_finish(env);
1493 for (i = 0; i < pmu_num_counters(env); i++) {
1494 pmevcntr_op_finish(env, i);
1495 }
1496 }
1497
1498 void pmu_pre_el_change(ARMCPU *cpu, void *ignored)
1499 {
1500 pmu_op_start(&cpu->env);
1501 }
1502
1503 void pmu_post_el_change(ARMCPU *cpu, void *ignored)
1504 {
1505 pmu_op_finish(&cpu->env);
1506 }
1507
1508 void arm_pmu_timer_cb(void *opaque)
1509 {
1510 ARMCPU *cpu = opaque;
1511
1512 /*
1513 * Update all the counter values based on the current underlying counts,
1514 * triggering interrupts to be raised, if necessary. pmu_op_finish() also
1515 * has the effect of setting the cpu->pmu_timer to the next earliest time a
1516 * counter may expire.
1517 */
1518 pmu_op_start(&cpu->env);
1519 pmu_op_finish(&cpu->env);
1520 }
1521
1522 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1523 uint64_t value)
1524 {
1525 pmu_op_start(env);
1526
1527 if (value & PMCRC) {
1528 /* The counter has been reset */
1529 env->cp15.c15_ccnt = 0;
1530 }
1531
1532 if (value & PMCRP) {
1533 unsigned int i;
1534 for (i = 0; i < pmu_num_counters(env); i++) {
1535 env->cp15.c14_pmevcntr[i] = 0;
1536 }
1537 }
1538
1539 /* only the DP, X, D and E bits are writable */
1540 env->cp15.c9_pmcr &= ~0x39;
1541 env->cp15.c9_pmcr |= (value & 0x39);
1542
1543 pmu_op_finish(env);
1544 }
1545
1546 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri,
1547 uint64_t value)
1548 {
1549 unsigned int i;
1550 for (i = 0; i < pmu_num_counters(env); i++) {
1551 /* Increment a counter's count iff: */
1552 if ((value & (1 << i)) && /* counter's bit is set */
1553 /* counter is enabled and not filtered */
1554 pmu_counter_enabled(env, i) &&
1555 /* counter is SW_INCR */
1556 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) {
1557 pmevcntr_op_start(env, i);
1558
1559 /*
1560 * Detect if this write causes an overflow since we can't predict
1561 * PMSWINC overflows like we can for other events
1562 */
1563 uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1;
1564
1565 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) {
1566 env->cp15.c9_pmovsr |= (1 << i);
1567 pmu_update_irq(env);
1568 }
1569
1570 env->cp15.c14_pmevcntr[i] = new_pmswinc;
1571
1572 pmevcntr_op_finish(env, i);
1573 }
1574 }
1575 }
1576
1577 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1578 {
1579 uint64_t ret;
1580 pmccntr_op_start(env);
1581 ret = env->cp15.c15_ccnt;
1582 pmccntr_op_finish(env);
1583 return ret;
1584 }
1585
1586 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1587 uint64_t value)
1588 {
1589 /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and
1590 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the
1591 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are
1592 * accessed.
1593 */
1594 env->cp15.c9_pmselr = value & 0x1f;
1595 }
1596
1597 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1598 uint64_t value)
1599 {
1600 pmccntr_op_start(env);
1601 env->cp15.c15_ccnt = value;
1602 pmccntr_op_finish(env);
1603 }
1604
1605 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
1606 uint64_t value)
1607 {
1608 uint64_t cur_val = pmccntr_read(env, NULL);
1609
1610 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
1611 }
1612
1613 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1614 uint64_t value)
1615 {
1616 pmccntr_op_start(env);
1617 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0;
1618 pmccntr_op_finish(env);
1619 }
1620
1621 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri,
1622 uint64_t value)
1623 {
1624 pmccntr_op_start(env);
1625 /* M is not accessible from AArch32 */
1626 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) |
1627 (value & PMCCFILTR);
1628 pmccntr_op_finish(env);
1629 }
1630
1631 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri)
1632 {
1633 /* M is not visible in AArch32 */
1634 return env->cp15.pmccfiltr_el0 & PMCCFILTR;
1635 }
1636
1637 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1638 uint64_t value)
1639 {
1640 value &= pmu_counter_mask(env);
1641 env->cp15.c9_pmcnten |= value;
1642 }
1643
1644 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1645 uint64_t value)
1646 {
1647 value &= pmu_counter_mask(env);
1648 env->cp15.c9_pmcnten &= ~value;
1649 }
1650
1651 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1652 uint64_t value)
1653 {
1654 value &= pmu_counter_mask(env);
1655 env->cp15.c9_pmovsr &= ~value;
1656 pmu_update_irq(env);
1657 }
1658
1659 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1660 uint64_t value)
1661 {
1662 value &= pmu_counter_mask(env);
1663 env->cp15.c9_pmovsr |= value;
1664 pmu_update_irq(env);
1665 }
1666
1667 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
1668 uint64_t value, const uint8_t counter)
1669 {
1670 if (counter == 31) {
1671 pmccfiltr_write(env, ri, value);
1672 } else if (counter < pmu_num_counters(env)) {
1673 pmevcntr_op_start(env, counter);
1674
1675 /*
1676 * If this counter's event type is changing, store the current
1677 * underlying count for the new type in c14_pmevcntr_delta[counter] so
1678 * pmevcntr_op_finish has the correct baseline when it converts back to
1679 * a delta.
1680 */
1681 uint16_t old_event = env->cp15.c14_pmevtyper[counter] &
1682 PMXEVTYPER_EVTCOUNT;
1683 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT;
1684 if (old_event != new_event) {
1685 uint64_t count = 0;
1686 if (event_supported(new_event)) {
1687 uint16_t event_idx = supported_event_map[new_event];
1688 count = pm_events[event_idx].get_count(env);
1689 }
1690 env->cp15.c14_pmevcntr_delta[counter] = count;
1691 }
1692
1693 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK;
1694 pmevcntr_op_finish(env, counter);
1695 }
1696 /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
1697 * PMSELR value is equal to or greater than the number of implemented
1698 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI.
1699 */
1700 }
1701
1702 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri,
1703 const uint8_t counter)
1704 {
1705 if (counter == 31) {
1706 return env->cp15.pmccfiltr_el0;
1707 } else if (counter < pmu_num_counters(env)) {
1708 return env->cp15.c14_pmevtyper[counter];
1709 } else {
1710 /*
1711 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER
1712 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write().
1713 */
1714 return 0;
1715 }
1716 }
1717
1718 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
1719 uint64_t value)
1720 {
1721 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1722 pmevtyper_write(env, ri, value, counter);
1723 }
1724
1725 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
1726 uint64_t value)
1727 {
1728 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1729 env->cp15.c14_pmevtyper[counter] = value;
1730
1731 /*
1732 * pmevtyper_rawwrite is called between a pair of pmu_op_start and
1733 * pmu_op_finish calls when loading saved state for a migration. Because
1734 * we're potentially updating the type of event here, the value written to
1735 * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a
1736 * different counter type. Therefore, we need to set this value to the
1737 * current count for the counter type we're writing so that pmu_op_finish
1738 * has the correct count for its calculation.
1739 */
1740 uint16_t event = value & PMXEVTYPER_EVTCOUNT;
1741 if (event_supported(event)) {
1742 uint16_t event_idx = supported_event_map[event];
1743 env->cp15.c14_pmevcntr_delta[counter] =
1744 pm_events[event_idx].get_count(env);
1745 }
1746 }
1747
1748 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
1749 {
1750 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1751 return pmevtyper_read(env, ri, counter);
1752 }
1753
1754 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
1755 uint64_t value)
1756 {
1757 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31);
1758 }
1759
1760 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri)
1761 {
1762 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31);
1763 }
1764
1765 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1766 uint64_t value, uint8_t counter)
1767 {
1768 if (counter < pmu_num_counters(env)) {
1769 pmevcntr_op_start(env, counter);
1770 env->cp15.c14_pmevcntr[counter] = value;
1771 pmevcntr_op_finish(env, counter);
1772 }
1773 /*
1774 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
1775 * are CONSTRAINED UNPREDICTABLE.
1776 */
1777 }
1778
1779 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri,
1780 uint8_t counter)
1781 {
1782 if (counter < pmu_num_counters(env)) {
1783 uint64_t ret;
1784 pmevcntr_op_start(env, counter);
1785 ret = env->cp15.c14_pmevcntr[counter];
1786 pmevcntr_op_finish(env, counter);
1787 return ret;
1788 } else {
1789 /* We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
1790 * are CONSTRAINED UNPREDICTABLE. */
1791 return 0;
1792 }
1793 }
1794
1795 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
1796 uint64_t value)
1797 {
1798 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1799 pmevcntr_write(env, ri, value, counter);
1800 }
1801
1802 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
1803 {
1804 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1805 return pmevcntr_read(env, ri, counter);
1806 }
1807
1808 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
1809 uint64_t value)
1810 {
1811 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1812 assert(counter < pmu_num_counters(env));
1813 env->cp15.c14_pmevcntr[counter] = value;
1814 pmevcntr_write(env, ri, value, counter);
1815 }
1816
1817 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri)
1818 {
1819 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1820 assert(counter < pmu_num_counters(env));
1821 return env->cp15.c14_pmevcntr[counter];
1822 }
1823
1824 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1825 uint64_t value)
1826 {
1827 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31);
1828 }
1829
1830 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1831 {
1832 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31);
1833 }
1834
1835 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1836 uint64_t value)
1837 {
1838 if (arm_feature(env, ARM_FEATURE_V8)) {
1839 env->cp15.c9_pmuserenr = value & 0xf;
1840 } else {
1841 env->cp15.c9_pmuserenr = value & 1;
1842 }
1843 }
1844
1845 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1846 uint64_t value)
1847 {
1848 /* We have no event counters so only the C bit can be changed */
1849 value &= pmu_counter_mask(env);
1850 env->cp15.c9_pminten |= value;
1851 pmu_update_irq(env);
1852 }
1853
1854 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1855 uint64_t value)
1856 {
1857 value &= pmu_counter_mask(env);
1858 env->cp15.c9_pminten &= ~value;
1859 pmu_update_irq(env);
1860 }
1861
1862 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
1863 uint64_t value)
1864 {
1865 /* Note that even though the AArch64 view of this register has bits
1866 * [10:0] all RES0 we can only mask the bottom 5, to comply with the
1867 * architectural requirements for bits which are RES0 only in some
1868 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
1869 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
1870 */
1871 raw_write(env, ri, value & ~0x1FULL);
1872 }
1873
1874 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1875 {
1876 /* Begin with base v8.0 state. */
1877 uint32_t valid_mask = 0x3fff;
1878 ARMCPU *cpu = env_archcpu(env);
1879
1880 if (arm_el_is_aa64(env, 3)) {
1881 value |= SCR_FW | SCR_AW; /* these two bits are RES1. */
1882 valid_mask &= ~SCR_NET;
1883 } else {
1884 valid_mask &= ~(SCR_RW | SCR_ST);
1885 }
1886
1887 if (!arm_feature(env, ARM_FEATURE_EL2)) {
1888 valid_mask &= ~SCR_HCE;
1889
1890 /* On ARMv7, SMD (or SCD as it is called in v7) is only
1891 * supported if EL2 exists. The bit is UNK/SBZP when
1892 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero
1893 * when EL2 is unavailable.
1894 * On ARMv8, this bit is always available.
1895 */
1896 if (arm_feature(env, ARM_FEATURE_V7) &&
1897 !arm_feature(env, ARM_FEATURE_V8)) {
1898 valid_mask &= ~SCR_SMD;
1899 }
1900 }
1901 if (cpu_isar_feature(aa64_lor, cpu)) {
1902 valid_mask |= SCR_TLOR;
1903 }
1904 if (cpu_isar_feature(aa64_pauth, cpu)) {
1905 valid_mask |= SCR_API | SCR_APK;
1906 }
1907
1908 /* Clear all-context RES0 bits. */
1909 value &= valid_mask;
1910 raw_write(env, ri, value);
1911 }
1912
1913 static CPAccessResult access_aa64_tid2(CPUARMState *env,
1914 const ARMCPRegInfo *ri,
1915 bool isread)
1916 {
1917 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID2)) {
1918 return CP_ACCESS_TRAP_EL2;
1919 }
1920
1921 return CP_ACCESS_OK;
1922 }
1923
1924 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1925 {
1926 ARMCPU *cpu = env_archcpu(env);
1927
1928 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR
1929 * bank
1930 */
1931 uint32_t index = A32_BANKED_REG_GET(env, csselr,
1932 ri->secure & ARM_CP_SECSTATE_S);
1933
1934 return cpu->ccsidr[index];
1935 }
1936
1937 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1938 uint64_t value)
1939 {
1940 raw_write(env, ri, value & 0xf);
1941 }
1942
1943 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1944 {
1945 CPUState *cs = env_cpu(env);
1946 uint64_t hcr_el2 = arm_hcr_el2_eff(env);
1947 uint64_t ret = 0;
1948 bool allow_virt = (arm_current_el(env) == 1 &&
1949 (!arm_is_secure_below_el3(env) ||
1950 (env->cp15.scr_el3 & SCR_EEL2)));
1951
1952 if (allow_virt && (hcr_el2 & HCR_IMO)) {
1953 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
1954 ret |= CPSR_I;
1955 }
1956 } else {
1957 if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
1958 ret |= CPSR_I;
1959 }
1960 }
1961
1962 if (allow_virt && (hcr_el2 & HCR_FMO)) {
1963 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
1964 ret |= CPSR_F;
1965 }
1966 } else {
1967 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
1968 ret |= CPSR_F;
1969 }
1970 }
1971
1972 /* External aborts are not possible in QEMU so A bit is always clear */
1973 return ret;
1974 }
1975
1976 static CPAccessResult access_aa64_tid1(CPUARMState *env, const ARMCPRegInfo *ri,
1977 bool isread)
1978 {
1979 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID1)) {
1980 return CP_ACCESS_TRAP_EL2;
1981 }
1982
1983 return CP_ACCESS_OK;
1984 }
1985
1986 static CPAccessResult access_aa32_tid1(CPUARMState *env, const ARMCPRegInfo *ri,
1987 bool isread)
1988 {
1989 if (arm_feature(env, ARM_FEATURE_V8)) {
1990 return access_aa64_tid1(env, ri, isread);
1991 }
1992
1993 return CP_ACCESS_OK;
1994 }
1995
1996 static const ARMCPRegInfo v7_cp_reginfo[] = {
1997 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
1998 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
1999 .access = PL1_W, .type = ARM_CP_NOP },
2000 /* Performance monitors are implementation defined in v7,
2001 * but with an ARM recommended set of registers, which we
2002 * follow.
2003 *
2004 * Performance registers fall into three categories:
2005 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
2006 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
2007 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
2008 * For the cases controlled by PMUSERENR we must set .access to PL0_RW
2009 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
2010 */
2011 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
2012 .access = PL0_RW, .type = ARM_CP_ALIAS,
2013 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
2014 .writefn = pmcntenset_write,
2015 .accessfn = pmreg_access,
2016 .raw_writefn = raw_write },
2017 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64,
2018 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
2019 .access = PL0_RW, .accessfn = pmreg_access,
2020 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
2021 .writefn = pmcntenset_write, .raw_writefn = raw_write },
2022 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
2023 .access = PL0_RW,
2024 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
2025 .accessfn = pmreg_access,
2026 .writefn = pmcntenclr_write,
2027 .type = ARM_CP_ALIAS },
2028 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
2029 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
2030 .access = PL0_RW, .accessfn = pmreg_access,
2031 .type = ARM_CP_ALIAS,
2032 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
2033 .writefn = pmcntenclr_write },
2034 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
2035 .access = PL0_RW, .type = ARM_CP_IO,
2036 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
2037 .accessfn = pmreg_access,
2038 .writefn = pmovsr_write,
2039 .raw_writefn = raw_write },
2040 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64,
2041 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3,
2042 .access = PL0_RW, .accessfn = pmreg_access,
2043 .type = ARM_CP_ALIAS | ARM_CP_IO,
2044 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
2045 .writefn = pmovsr_write,
2046 .raw_writefn = raw_write },
2047 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
2048 .access = PL0_W, .accessfn = pmreg_access_swinc,
2049 .type = ARM_CP_NO_RAW | ARM_CP_IO,
2050 .writefn = pmswinc_write },
2051 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64,
2052 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4,
2053 .access = PL0_W, .accessfn = pmreg_access_swinc,
2054 .type = ARM_CP_NO_RAW | ARM_CP_IO,
2055 .writefn = pmswinc_write },
2056 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
2057 .access = PL0_RW, .type = ARM_CP_ALIAS,
2058 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr),
2059 .accessfn = pmreg_access_selr, .writefn = pmselr_write,
2060 .raw_writefn = raw_write},
2061 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64,
2062 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5,
2063 .access = PL0_RW, .accessfn = pmreg_access_selr,
2064 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
2065 .writefn = pmselr_write, .raw_writefn = raw_write, },
2066 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
2067 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO,
2068 .readfn = pmccntr_read, .writefn = pmccntr_write32,
2069 .accessfn = pmreg_access_ccntr },
2070 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
2071 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
2072 .access = PL0_RW, .accessfn = pmreg_access_ccntr,
2073 .type = ARM_CP_IO,
2074 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt),
2075 .readfn = pmccntr_read, .writefn = pmccntr_write,
2076 .raw_readfn = raw_read, .raw_writefn = raw_write, },
2077 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7,
2078 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32,
2079 .access = PL0_RW, .accessfn = pmreg_access,
2080 .type = ARM_CP_ALIAS | ARM_CP_IO,
2081 .resetvalue = 0, },
2082 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
2083 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
2084 .writefn = pmccfiltr_write, .raw_writefn = raw_write,
2085 .access = PL0_RW, .accessfn = pmreg_access,
2086 .type = ARM_CP_IO,
2087 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
2088 .resetvalue = 0, },
2089 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
2090 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2091 .accessfn = pmreg_access,
2092 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
2093 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
2094 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
2095 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2096 .accessfn = pmreg_access,
2097 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
2098 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
2099 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2100 .accessfn = pmreg_access_xevcntr,
2101 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
2102 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64,
2103 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2,
2104 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2105 .accessfn = pmreg_access_xevcntr,
2106 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
2107 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
2108 .access = PL0_R | PL1_RW, .accessfn = access_tpm,
2109 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr),
2110 .resetvalue = 0,
2111 .writefn = pmuserenr_write, .raw_writefn = raw_write },
2112 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64,
2113 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0,
2114 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
2115 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
2116 .resetvalue = 0,
2117 .writefn = pmuserenr_write, .raw_writefn = raw_write },
2118 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
2119 .access = PL1_RW, .accessfn = access_tpm,
2120 .type = ARM_CP_ALIAS | ARM_CP_IO,
2121 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
2122 .resetvalue = 0,
2123 .writefn = pmintenset_write, .raw_writefn = raw_write },
2124 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
2125 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
2126 .access = PL1_RW, .accessfn = access_tpm,
2127 .type = ARM_CP_IO,
2128 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2129 .writefn = pmintenset_write, .raw_writefn = raw_write,
2130 .resetvalue = 0x0 },
2131 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
2132 .access = PL1_RW, .accessfn = access_tpm,
2133 .type = ARM_CP_ALIAS | ARM_CP_IO,
2134 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2135 .writefn = pmintenclr_write, },
2136 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
2137 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
2138 .access = PL1_RW, .accessfn = access_tpm,
2139 .type = ARM_CP_ALIAS | ARM_CP_IO,
2140 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2141 .writefn = pmintenclr_write },
2142 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
2143 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
2144 .access = PL1_R,
2145 .accessfn = access_aa64_tid2,
2146 .readfn = ccsidr_read, .type = ARM_CP_NO_RAW },
2147 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
2148 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
2149 .access = PL1_RW,
2150 .accessfn = access_aa64_tid2,
2151 .writefn = csselr_write, .resetvalue = 0,
2152 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s),
2153 offsetof(CPUARMState, cp15.csselr_ns) } },
2154 /* Auxiliary ID register: this actually has an IMPDEF value but for now
2155 * just RAZ for all cores:
2156 */
2157 { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
2158 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
2159 .access = PL1_R, .type = ARM_CP_CONST,
2160 .accessfn = access_aa64_tid1,
2161 .resetvalue = 0 },
2162 /* Auxiliary fault status registers: these also are IMPDEF, and we
2163 * choose to RAZ/WI for all cores.
2164 */
2165 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
2166 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
2167 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2168 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
2169 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
2170 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2171 /* MAIR can just read-as-written because we don't implement caches
2172 * and so don't need to care about memory attributes.
2173 */
2174 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
2175 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
2176 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]),
2177 .resetvalue = 0 },
2178 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64,
2179 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0,
2180 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]),
2181 .resetvalue = 0 },
2182 /* For non-long-descriptor page tables these are PRRR and NMRR;
2183 * regardless they still act as reads-as-written for QEMU.
2184 */
2185 /* MAIR0/1 are defined separately from their 64-bit counterpart which
2186 * allows them to assign the correct fieldoffset based on the endianness
2187 * handled in the field definitions.
2188 */
2189 { .name = "MAIR0", .state = ARM_CP_STATE_AA32,
2190 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW,
2191 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s),
2192 offsetof(CPUARMState, cp15.mair0_ns) },
2193 .resetfn = arm_cp_reset_ignore },
2194 { .name = "MAIR1", .state = ARM_CP_STATE_AA32,
2195 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW,
2196 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s),
2197 offsetof(CPUARMState, cp15.mair1_ns) },
2198 .resetfn = arm_cp_reset_ignore },
2199 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
2200 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
2201 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read },
2202 /* 32 bit ITLB invalidates */
2203 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0,
2204 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
2205 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
2206 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
2207 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2,
2208 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
2209 /* 32 bit DTLB invalidates */
2210 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0,
2211 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
2212 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
2213 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
2214 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2,
2215 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
2216 /* 32 bit TLB invalidates */
2217 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
2218 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
2219 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
2220 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
2221 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
2222 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
2223 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
2224 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
2225 REGINFO_SENTINEL
2226 };
2227
2228 static const ARMCPRegInfo v7mp_cp_reginfo[] = {
2229 /* 32 bit TLB invalidates, Inner Shareable */
2230 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
2231 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write },
2232 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
2233 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
2234 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
2235 .type = ARM_CP_NO_RAW, .access = PL1_W,
2236 .writefn = tlbiasid_is_write },
2237 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
2238 .type = ARM_CP_NO_RAW, .access = PL1_W,
2239 .writefn = tlbimvaa_is_write },
2240 REGINFO_SENTINEL
2241 };
2242
2243 static const ARMCPRegInfo pmovsset_cp_reginfo[] = {
2244 /* PMOVSSET is not implemented in v7 before v7ve */
2245 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3,
2246 .access = PL0_RW, .accessfn = pmreg_access,
2247 .type = ARM_CP_ALIAS | ARM_CP_IO,
2248 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
2249 .writefn = pmovsset_write,
2250 .raw_writefn = raw_write },
2251 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64,
2252 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3,
2253 .access = PL0_RW, .accessfn = pmreg_access,
2254 .type = ARM_CP_ALIAS | ARM_CP_IO,
2255 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
2256 .writefn = pmovsset_write,
2257 .raw_writefn = raw_write },
2258 REGINFO_SENTINEL
2259 };
2260
2261 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2262 uint64_t value)
2263 {
2264 value &= 1;
2265 env->teecr = value;
2266 }
2267
2268 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri,
2269 bool isread)
2270 {
2271 if (arm_current_el(env) == 0 && (env->teecr & 1)) {
2272 return CP_ACCESS_TRAP;
2273 }
2274 return CP_ACCESS_OK;
2275 }
2276
2277 static const ARMCPRegInfo t2ee_cp_reginfo[] = {
2278 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
2279 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
2280 .resetvalue = 0,
2281 .writefn = teecr_write },
2282 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
2283 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
2284 .accessfn = teehbr_access, .resetvalue = 0 },
2285 REGINFO_SENTINEL
2286 };
2287
2288 static const ARMCPRegInfo v6k_cp_reginfo[] = {
2289 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
2290 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
2291 .access = PL0_RW,
2292 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 },
2293 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
2294 .access = PL0_RW,
2295 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s),
2296 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) },
2297 .resetfn = arm_cp_reset_ignore },
2298 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
2299 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
2300 .access = PL0_R|PL1_W,
2301 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]),
2302 .resetvalue = 0},
2303 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
2304 .access = PL0_R|PL1_W,
2305 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s),
2306 offsetoflow32(CPUARMState, cp15.tpidruro_ns) },
2307 .resetfn = arm_cp_reset_ignore },
2308 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64,
2309 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
2310 .access = PL1_RW,
2311 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 },
2312 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4,
2313 .access = PL1_RW,
2314 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s),
2315 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) },
2316 .resetvalue = 0 },
2317 REGINFO_SENTINEL
2318 };
2319
2320 #ifndef CONFIG_USER_ONLY
2321
2322 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri,
2323 bool isread)
2324 {
2325 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero.
2326 * Writable only at the highest implemented exception level.
2327 */
2328 int el = arm_current_el(env);
2329
2330 switch (el) {
2331 case 0:
2332 if (!extract32(env->cp15.c14_cntkctl, 0, 2)) {
2333 return CP_ACCESS_TRAP;
2334 }
2335 break;
2336 case 1:
2337 if (!isread && ri->state == ARM_CP_STATE_AA32 &&
2338 arm_is_secure_below_el3(env)) {
2339 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */
2340 return CP_ACCESS_TRAP_UNCATEGORIZED;
2341 }
2342 break;
2343 case 2:
2344 case 3:
2345 break;
2346 }
2347
2348 if (!isread && el < arm_highest_el(env)) {
2349 return CP_ACCESS_TRAP_UNCATEGORIZED;
2350 }
2351
2352 return CP_ACCESS_OK;
2353 }
2354
2355 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
2356 bool isread)
2357 {
2358 unsigned int cur_el = arm_current_el(env);
2359 bool secure = arm_is_secure(env);
2360
2361 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */
2362 if (cur_el == 0 &&
2363 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
2364 return CP_ACCESS_TRAP;
2365 }
2366
2367 if (arm_feature(env, ARM_FEATURE_EL2) &&
2368 timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
2369 !extract32(env->cp15.cnthctl_el2, 0, 1)) {
2370 return CP_ACCESS_TRAP_EL2;
2371 }
2372 return CP_ACCESS_OK;
2373 }
2374
2375 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
2376 bool isread)
2377 {
2378 unsigned int cur_el = arm_current_el(env);
2379 bool secure = arm_is_secure(env);
2380
2381 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if
2382 * EL0[PV]TEN is zero.
2383 */
2384 if (cur_el == 0 &&
2385 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
2386 return CP_ACCESS_TRAP;
2387 }
2388
2389 if (arm_feature(env, ARM_FEATURE_EL2) &&
2390 timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
2391 !extract32(env->cp15.cnthctl_el2, 1, 1)) {
2392 return CP_ACCESS_TRAP_EL2;
2393 }
2394 return CP_ACCESS_OK;
2395 }
2396
2397 static CPAccessResult gt_pct_access(CPUARMState *env,
2398 const ARMCPRegInfo *ri,
2399 bool isread)
2400 {
2401 return gt_counter_access(env, GTIMER_PHYS, isread);
2402 }
2403
2404 static CPAccessResult gt_vct_access(CPUARMState *env,
2405 const ARMCPRegInfo *ri,
2406 bool isread)
2407 {
2408 return gt_counter_access(env, GTIMER_VIRT, isread);
2409 }
2410
2411 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri,
2412 bool isread)
2413 {
2414 return gt_timer_access(env, GTIMER_PHYS, isread);
2415 }
2416
2417 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri,
2418 bool isread)
2419 {
2420 return gt_timer_access(env, GTIMER_VIRT, isread);
2421 }
2422
2423 static CPAccessResult gt_stimer_access(CPUARMState *env,
2424 const ARMCPRegInfo *ri,
2425 bool isread)
2426 {
2427 /* The AArch64 register view of the secure physical timer is
2428 * always accessible from EL3, and configurably accessible from
2429 * Secure EL1.
2430 */
2431 switch (arm_current_el(env)) {
2432 case 1:
2433 if (!arm_is_secure(env)) {
2434 return CP_ACCESS_TRAP;
2435 }
2436 if (!(env->cp15.scr_el3 & SCR_ST)) {
2437 return CP_ACCESS_TRAP_EL3;
2438 }
2439 return CP_ACCESS_OK;
2440 case 0:
2441 case 2:
2442 return CP_ACCESS_TRAP;
2443 case 3:
2444 return CP_ACCESS_OK;
2445 default:
2446 g_assert_not_reached();
2447 }
2448 }
2449
2450 static uint64_t gt_get_countervalue(CPUARMState *env)
2451 {
2452 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
2453 }
2454
2455 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
2456 {
2457 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
2458
2459 if (gt->ctl & 1) {
2460 /* Timer enabled: calculate and set current ISTATUS, irq, and
2461 * reset timer to when ISTATUS next has to change
2462 */
2463 uint64_t offset = timeridx == GTIMER_VIRT ?
2464 cpu->env.cp15.cntvoff_el2 : 0;
2465 uint64_t count = gt_get_countervalue(&cpu->env);
2466 /* Note that this must be unsigned 64 bit arithmetic: */
2467 int istatus = count - offset >= gt->cval;
2468 uint64_t nexttick;
2469 int irqstate;
2470
2471 gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
2472
2473 irqstate = (istatus && !(gt->ctl & 2));
2474 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
2475
2476 if (istatus) {
2477 /* Next transition is when count rolls back over to zero */
2478 nexttick = UINT64_MAX;
2479 } else {
2480 /* Next transition is when we hit cval */
2481 nexttick = gt->cval + offset;
2482 }
2483 /* Note that the desired next expiry time might be beyond the
2484 * signed-64-bit range of a QEMUTimer -- in this case we just
2485 * set the timer for as far in the future as possible. When the
2486 * timer expires we will reset the timer for any remaining period.
2487 */
2488 if (nexttick > INT64_MAX / GTIMER_SCALE) {
2489 timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX);
2490 } else {
2491 timer_mod(cpu->gt_timer[timeridx], nexttick);
2492 }
2493 trace_arm_gt_recalc(timeridx, irqstate, nexttick);
2494 } else {
2495 /* Timer disabled: ISTATUS and timer output always clear */
2496 gt->ctl &= ~4;
2497 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);
2498 timer_del(cpu->gt_timer[timeridx]);
2499 trace_arm_gt_recalc_disabled(timeridx);
2500 }
2501 }
2502
2503 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
2504 int timeridx)
2505 {
2506 ARMCPU *cpu = env_archcpu(env);
2507
2508 timer_del(cpu->gt_timer[timeridx]);
2509 }
2510
2511 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2512 {
2513 return gt_get_countervalue(env);
2514 }
2515
2516 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2517 {
2518 return gt_get_countervalue(env) - env->cp15.cntvoff_el2;
2519 }
2520
2521 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2522 int timeridx,
2523 uint64_t value)
2524 {
2525 trace_arm_gt_cval_write(timeridx, value);
2526 env->cp15.c14_timer[timeridx].cval = value;
2527 gt_recalc_timer(env_archcpu(env), timeridx);
2528 }
2529
2530 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
2531 int timeridx)
2532 {
2533 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
2534
2535 return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
2536 (gt_get_countervalue(env) - offset));
2537 }
2538
2539 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2540 int timeridx,
2541 uint64_t value)
2542 {
2543 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
2544
2545 trace_arm_gt_tval_write(timeridx, value);
2546 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset +
2547 sextract64(value, 0, 32);
2548 gt_recalc_timer(env_archcpu(env), timeridx);
2549 }
2550
2551 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2552 int timeridx,
2553 uint64_t value)
2554 {
2555 ARMCPU *cpu = env_archcpu(env);
2556 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
2557
2558 trace_arm_gt_ctl_write(timeridx, value);
2559 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
2560 if ((oldval ^ value) & 1) {
2561 /* Enable toggled */
2562 gt_recalc_timer(cpu, timeridx);
2563 } else if ((oldval ^ value) & 2) {
2564 /* IMASK toggled: don't need to recalculate,
2565 * just set the interrupt line based on ISTATUS
2566 */
2567 int irqstate = (oldval & 4) && !(value & 2);
2568
2569 trace_arm_gt_imask_toggle(timeridx, irqstate);
2570 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
2571 }
2572 }
2573
2574 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2575 {
2576 gt_timer_reset(env, ri, GTIMER_PHYS);
2577 }
2578
2579 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2580 uint64_t value)
2581 {
2582 gt_cval_write(env, ri, GTIMER_PHYS, value);
2583 }
2584
2585 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2586 {
2587 return gt_tval_read(env, ri, GTIMER_PHYS);
2588 }
2589
2590 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2591 uint64_t value)
2592 {
2593 gt_tval_write(env, ri, GTIMER_PHYS, value);
2594 }
2595
2596 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2597 uint64_t value)
2598 {
2599 gt_ctl_write(env, ri, GTIMER_PHYS, value);
2600 }
2601
2602 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2603 {
2604 gt_timer_reset(env, ri, GTIMER_VIRT);
2605 }
2606
2607 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2608 uint64_t value)
2609 {
2610 gt_cval_write(env, ri, GTIMER_VIRT, value);
2611 }
2612
2613 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2614 {
2615 return gt_tval_read(env, ri, GTIMER_VIRT);
2616 }
2617
2618 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2619 uint64_t value)
2620 {
2621 gt_tval_write(env, ri, GTIMER_VIRT, value);
2622 }
2623
2624 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2625 uint64_t value)
2626 {
2627 gt_ctl_write(env, ri, GTIMER_VIRT, value);
2628 }
2629
2630 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
2631 uint64_t value)
2632 {
2633 ARMCPU *cpu = env_archcpu(env);
2634
2635 trace_arm_gt_cntvoff_write(value);
2636 raw_write(env, ri, value);
2637 gt_recalc_timer(cpu, GTIMER_VIRT);
2638 }
2639
2640 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2641 {
2642 gt_timer_reset(env, ri, GTIMER_HYP);
2643 }
2644
2645 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2646 uint64_t value)
2647 {
2648 gt_cval_write(env, ri, GTIMER_HYP, value);
2649 }
2650
2651 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2652 {
2653 return gt_tval_read(env, ri, GTIMER_HYP);
2654 }
2655
2656 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2657 uint64_t value)
2658 {
2659 gt_tval_write(env, ri, GTIMER_HYP, value);
2660 }
2661
2662 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2663 uint64_t value)
2664 {
2665 gt_ctl_write(env, ri, GTIMER_HYP, value);
2666 }
2667
2668 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2669 {
2670 gt_timer_reset(env, ri, GTIMER_SEC);
2671 }
2672
2673 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2674 uint64_t value)
2675 {
2676 gt_cval_write(env, ri, GTIMER_SEC, value);
2677 }
2678
2679 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2680 {
2681 return gt_tval_read(env, ri, GTIMER_SEC);
2682 }
2683
2684 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2685 uint64_t value)
2686 {
2687 gt_tval_write(env, ri, GTIMER_SEC, value);
2688 }
2689
2690 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2691 uint64_t value)
2692 {
2693 gt_ctl_write(env, ri, GTIMER_SEC, value);
2694 }
2695
2696 void arm_gt_ptimer_cb(void *opaque)
2697 {
2698 ARMCPU *cpu = opaque;
2699
2700 gt_recalc_timer(cpu, GTIMER_PHYS);
2701 }
2702
2703 void arm_gt_vtimer_cb(void *opaque)
2704 {
2705 ARMCPU *cpu = opaque;
2706
2707 gt_recalc_timer(cpu, GTIMER_VIRT);
2708 }
2709
2710 void arm_gt_htimer_cb(void *opaque)
2711 {
2712 ARMCPU *cpu = opaque;
2713
2714 gt_recalc_timer(cpu, GTIMER_HYP);
2715 }
2716
2717 void arm_gt_stimer_cb(void *opaque)
2718 {
2719 ARMCPU *cpu = opaque;
2720
2721 gt_recalc_timer(cpu, GTIMER_SEC);
2722 }
2723
2724 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
2725 /* Note that CNTFRQ is purely reads-as-written for the benefit
2726 * of software; writing it doesn't actually change the timer frequency.
2727 * Our reset value matches the fixed frequency we implement the timer at.
2728 */
2729 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
2730 .type = ARM_CP_ALIAS,
2731 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
2732 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
2733 },
2734 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
2735 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
2736 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
2737 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
2738 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
2739 },
2740 /* overall control: mostly access permissions */
2741 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
2742 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
2743 .access = PL1_RW,
2744 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
2745 .resetvalue = 0,
2746 },
2747 /* per-timer control */
2748 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
2749 .secure = ARM_CP_SECSTATE_NS,
2750 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
2751 .accessfn = gt_ptimer_access,
2752 .fieldoffset = offsetoflow32(CPUARMState,
2753 cp15.c14_timer[GTIMER_PHYS].ctl),
2754 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
2755 },
2756 { .name = "CNTP_CTL_S",
2757 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
2758 .secure = ARM_CP_SECSTATE_S,
2759 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
2760 .accessfn = gt_ptimer_access,
2761 .fieldoffset = offsetoflow32(CPUARMState,
2762 cp15.c14_timer[GTIMER_SEC].ctl),
2763 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
2764 },
2765 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
2766 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
2767 .type = ARM_CP_IO, .access = PL0_RW,
2768 .accessfn = gt_ptimer_access,
2769 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
2770 .resetvalue = 0,
2771 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
2772 },
2773 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
2774 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
2775 .accessfn = gt_vtimer_access,
2776 .fieldoffset = offsetoflow32(CPUARMState,
2777 cp15.c14_timer[GTIMER_VIRT].ctl),
2778 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
2779 },
2780 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
2781 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
2782 .type = ARM_CP_IO, .access = PL0_RW,
2783 .accessfn = gt_vtimer_access,
2784 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
2785 .resetvalue = 0,
2786 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
2787 },
2788 /* TimerValue views: a 32 bit downcounting view of the underlying state */
2789 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
2790 .secure = ARM_CP_SECSTATE_NS,
2791 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2792 .accessfn = gt_ptimer_access,
2793 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
2794 },
2795 { .name = "CNTP_TVAL_S",
2796 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
2797 .secure = ARM_CP_SECSTATE_S,
2798 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2799 .accessfn = gt_ptimer_access,
2800 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
2801 },
2802 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
2803 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
2804 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2805 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
2806 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
2807 },
2808 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
2809 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2810 .accessfn = gt_vtimer_access,
2811 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
2812 },
2813 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
2814 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
2815 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2816 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
2817 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
2818 },
2819 /* The counter itself */
2820 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
2821 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
2822 .accessfn = gt_pct_access,
2823 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
2824 },
2825 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
2826 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
2827 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2828 .accessfn = gt_pct_access, .readfn = gt_cnt_read,
2829 },
2830 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
2831 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
2832 .accessfn = gt_vct_access,
2833 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
2834 },
2835 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
2836 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
2837 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2838 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
2839 },
2840 /* Comparison value, indicating when the timer goes off */
2841 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
2842 .secure = ARM_CP_SECSTATE_NS,
2843 .access = PL0_RW,
2844 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2845 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
2846 .accessfn = gt_ptimer_access,
2847 .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
2848 },
2849 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
2850 .secure = ARM_CP_SECSTATE_S,
2851 .access = PL0_RW,
2852 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2853 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
2854 .accessfn = gt_ptimer_access,
2855 .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
2856 },
2857 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
2858 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
2859 .access = PL0_RW,
2860 .type = ARM_CP_IO,
2861 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
2862 .resetvalue = 0, .accessfn = gt_ptimer_access,
2863 .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
2864 },
2865 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
2866 .access = PL0_RW,
2867 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2868 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
2869 .accessfn = gt_vtimer_access,
2870 .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
2871 },
2872 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
2873 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
2874 .access = PL0_RW,
2875 .type = ARM_CP_IO,
2876 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
2877 .resetvalue = 0, .accessfn = gt_vtimer_access,
2878 .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
2879 },
2880 /* Secure timer -- this is actually restricted to only EL3
2881 * and configurably Secure-EL1 via the accessfn.
2882 */
2883 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64,
2884 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0,
2885 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW,
2886 .accessfn = gt_stimer_access,
2887 .readfn = gt_sec_tval_read,
2888 .writefn = gt_sec_tval_write,
2889 .resetfn = gt_sec_timer_reset,
2890 },
2891 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64,
2892 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1,
2893 .type = ARM_CP_IO, .access = PL1_RW,
2894 .accessfn = gt_stimer_access,
2895 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl),
2896 .resetvalue = 0,
2897 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
2898 },
2899 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64,
2900 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2,
2901 .type = ARM_CP_IO, .access = PL1_RW,
2902 .accessfn = gt_stimer_access,
2903 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
2904 .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
2905 },
2906 REGINFO_SENTINEL
2907 };
2908
2909 #else
2910
2911 /* In user-mode most of the generic timer registers are inaccessible
2912 * however modern kernels (4.12+) allow access to cntvct_el0
2913 */
2914
2915 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2916 {
2917 /* Currently we have no support for QEMUTimer in linux-user so we
2918 * can't call gt_get_countervalue(env), instead we directly
2919 * call the lower level functions.
2920 */
2921 return cpu_get_clock() / GTIMER_SCALE;
2922 }
2923
2924 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
2925 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
2926 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
2927 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */,
2928 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
2929 .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE,
2930 },
2931 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
2932 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
2933 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2934 .readfn = gt_virt_cnt_read,
2935 },
2936 REGINFO_SENTINEL
2937 };
2938
2939 #endif
2940
2941 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
2942 {
2943 if (arm_feature(env, ARM_FEATURE_LPAE)) {
2944 raw_write(env, ri, value);
2945 } else if (arm_feature(env, ARM_FEATURE_V7)) {
2946 raw_write(env, ri, value & 0xfffff6ff);
2947 } else {
2948 raw_write(env, ri, value & 0xfffff1ff);
2949 }
2950 }
2951
2952 #ifndef CONFIG_USER_ONLY
2953 /* get_phys_addr() isn't present for user-mode-only targets */
2954
2955 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
2956 bool isread)
2957 {
2958 if (ri->opc2 & 4) {
2959 /* The ATS12NSO* operations must trap to EL3 if executed in
2960 * Secure EL1 (which can only happen if EL3 is AArch64).
2961 * They are simply UNDEF if executed from NS EL1.
2962 * They function normally from EL2 or EL3.
2963 */
2964 if (arm_current_el(env) == 1) {
2965 if (arm_is_secure_below_el3(env)) {
2966 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3;
2967 }
2968 return CP_ACCESS_TRAP_UNCATEGORIZED;
2969 }
2970 }
2971 return CP_ACCESS_OK;
2972 }
2973
2974 static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
2975 MMUAccessType access_type, ARMMMUIdx mmu_idx)
2976 {
2977 hwaddr phys_addr;
2978 target_ulong page_size;
2979 int prot;
2980 bool ret;
2981 uint64_t par64;
2982 bool format64 = false;
2983 MemTxAttrs attrs = {};
2984 ARMMMUFaultInfo fi = {};
2985 ARMCacheAttrs cacheattrs = {};
2986
2987 ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs,
2988 &prot, &page_size, &fi, &cacheattrs);
2989
2990 if (ret) {
2991 /*
2992 * Some kinds of translation fault must cause exceptions rather
2993 * than being reported in the PAR.
2994 */
2995 int current_el = arm_current_el(env);
2996 int target_el;
2997 uint32_t syn, fsr, fsc;
2998 bool take_exc = false;
2999
3000 if (fi.s1ptw && current_el == 1 && !arm_is_secure(env)
3001 && (mmu_idx == ARMMMUIdx_S1NSE1 || mmu_idx == ARMMMUIdx_S1NSE0)) {
3002 /*
3003 * Synchronous stage 2 fault on an access made as part of the
3004 * translation table walk for AT S1E0* or AT S1E1* insn
3005 * executed from NS EL1. If this is a synchronous external abort
3006 * and SCR_EL3.EA == 1, then we take a synchronous external abort
3007 * to EL3. Otherwise the fault is taken as an exception to EL2,
3008 * and HPFAR_EL2 holds the faulting IPA.
3009 */
3010 if (fi.type == ARMFault_SyncExternalOnWalk &&
3011 (env->cp15.scr_el3 & SCR_EA)) {
3012 target_el = 3;
3013 } else {
3014 env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4;
3015 target_el = 2;
3016 }
3017 take_exc = true;
3018 } else if (fi.type == ARMFault_SyncExternalOnWalk) {
3019 /*
3020 * Synchronous external aborts during a translation table walk
3021 * are taken as Data Abort exceptions.
3022 */
3023 if (fi.stage2) {
3024 if (current_el == 3) {
3025 target_el = 3;
3026 } else {
3027 target_el = 2;
3028 }
3029 } else {
3030 target_el = exception_target_el(env);
3031 }
3032 take_exc = true;
3033 }
3034
3035 if (take_exc) {
3036 /* Construct FSR and FSC using same logic as arm_deliver_fault() */
3037 if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
3038 arm_s1_regime_using_lpae_format(env, mmu_idx)) {
3039 fsr = arm_fi_to_lfsc(&fi);
3040 fsc = extract32(fsr, 0, 6);
3041 } else {
3042 fsr = arm_fi_to_sfsc(&fi);
3043 fsc = 0x3f;
3044 }
3045 /*
3046 * Report exception with ESR indicating a fault due to a
3047 * translation table walk for a cache maintenance instruction.
3048 */
3049 syn = syn_data_abort_no_iss(current_el == target_el,
3050 fi.ea, 1, fi.s1ptw, 1, fsc);
3051 env->exception.vaddress = value;
3052 env->exception.fsr = fsr;
3053 raise_exception(env, EXCP_DATA_ABORT, syn, target_el);
3054 }
3055 }
3056
3057 if (is_a64(env)) {
3058 format64 = true;
3059 } else if (arm_feature(env, ARM_FEATURE_LPAE)) {
3060 /*
3061 * ATS1Cxx:
3062 * * TTBCR.EAE determines whether the result is returned using the
3063 * 32-bit or the 64-bit PAR format
3064 * * Instructions executed in Hyp mode always use the 64bit format
3065 *
3066 * ATS1S2NSOxx uses the 64bit format if any of the following is true:
3067 * * The Non-secure TTBCR.EAE bit is set to 1
3068 * * The implementation includes EL2, and the value of HCR.VM is 1
3069 *
3070 * (Note that HCR.DC makes HCR.VM behave as if it is 1.)
3071 *
3072 * ATS1Hx always uses the 64bit format.
3073 */
3074 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx);
3075
3076 if (arm_feature(env, ARM_FEATURE_EL2)) {
3077 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
3078 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC);
3079 } else {
3080 format64 |= arm_current_el(env) == 2;
3081 }
3082 }
3083 }
3084
3085 if (format64) {
3086 /* Create a 64-bit PAR */
3087 par64 = (1 << 11); /* LPAE bit always set */
3088 if (!ret) {
3089 par64 |= phys_addr & ~0xfffULL;
3090 if (!attrs.secure) {
3091 par64 |= (1 << 9); /* NS */
3092 }
3093 par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */
3094 par64 |= cacheattrs.shareability << 7; /* SH */
3095 } else {
3096 uint32_t fsr = arm_fi_to_lfsc(&fi);
3097
3098 par64 |= 1; /* F */
3099 par64 |= (fsr & 0x3f) << 1; /* FS */
3100 if (fi.stage2) {
3101 par64 |= (1 << 9); /* S */
3102 }
3103 if (fi.s1ptw) {
3104 par64 |= (1 << 8); /* PTW */
3105 }
3106 }
3107 } else {
3108 /* fsr is a DFSR/IFSR value for the short descriptor
3109 * translation table format (with WnR always clear).
3110 * Convert it to a 32-bit PAR.
3111 */
3112 if (!ret) {
3113 /* We do not set any attribute bits in the PAR */
3114 if (page_size == (1 << 24)
3115 && arm_feature(env, ARM_FEATURE_V7)) {
3116 par64 = (phys_addr & 0xff000000) | (1 << 1);
3117 } else {
3118 par64 = phys_addr & 0xfffff000;
3119 }
3120 if (!attrs.secure) {
3121 par64 |= (1 << 9); /* NS */
3122 }
3123 } else {
3124 uint32_t fsr = arm_fi_to_sfsc(&fi);
3125
3126 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) |
3127 ((fsr & 0xf) << 1) | 1;
3128 }
3129 }
3130 return par64;
3131 }
3132
3133 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
3134 {
3135 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3136 uint64_t par64;
3137 ARMMMUIdx mmu_idx;
3138 int el = arm_current_el(env);
3139 bool secure = arm_is_secure_below_el3(env);
3140
3141 switch (ri->opc2 & 6) {
3142 case 0:
3143 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */
3144 switch (el) {
3145 case 3:
3146 mmu_idx = ARMMMUIdx_S1E3;
3147 break;
3148 case 2:
3149 mmu_idx = ARMMMUIdx_S1NSE1;
3150 break;
3151 case 1:
3152 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
3153 break;
3154 default:
3155 g_assert_not_reached();
3156 }
3157 break;
3158 case 2:
3159 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
3160 switch (el) {
3161 case 3:
3162 mmu_idx = ARMMMUIdx_S1SE0;
3163 break;
3164 case 2:
3165 mmu_idx = ARMMMUIdx_S1NSE0;
3166 break;
3167 case 1:
3168 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
3169 break;
3170 default:
3171 g_assert_not_reached();
3172 }
3173 break;
3174 case 4:
3175 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
3176 mmu_idx = ARMMMUIdx_S12NSE1;
3177 break;
3178 case 6:
3179 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
3180 mmu_idx = ARMMMUIdx_S12NSE0;
3181 break;
3182 default:
3183 g_assert_not_reached();
3184 }
3185
3186 par64 = do_ats_write(env, value, access_type, mmu_idx);
3187
3188 A32_BANKED_CURRENT_REG_SET(env, par, par64);
3189 }
3190
3191 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
3192 uint64_t value)
3193 {
3194 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3195 uint64_t par64;
3196
3197 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S1E2);
3198
3199 A32_BANKED_CURRENT_REG_SET(env, par, par64);
3200 }
3201
3202 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
3203 bool isread)
3204 {
3205 if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) {
3206 return CP_ACCESS_TRAP;
3207 }
3208 return CP_ACCESS_OK;
3209 }
3210
3211 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
3212 uint64_t value)
3213 {
3214 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3215 ARMMMUIdx mmu_idx;
3216 int secure = arm_is_secure_below_el3(env);
3217
3218 switch (ri->opc2 & 6) {
3219 case 0:
3220 switch (ri->opc1) {
3221 case 0: /* AT S1E1R, AT S1E1W */
3222 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
3223 break;
3224 case 4: /* AT S1E2R, AT S1E2W */
3225 mmu_idx = ARMMMUIdx_S1E2;
3226 break;
3227 case 6: /* AT S1E3R, AT S1E3W */
3228 mmu_idx = ARMMMUIdx_S1E3;
3229 break;
3230 default:
3231 g_assert_not_reached();
3232 }
3233 break;
3234 case 2: /* AT S1E0R, AT S1E0W */
3235 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
3236 break;
3237 case 4: /* AT S12E1R, AT S12E1W */
3238 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S12NSE1;
3239 break;
3240 case 6: /* AT S12E0R, AT S12E0W */
3241 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S12NSE0;
3242 break;
3243 default:
3244 g_assert_not_reached();
3245 }
3246
3247 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx);
3248 }
3249 #endif
3250
3251 static const ARMCPRegInfo vapa_cp_reginfo[] = {
3252 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
3253 .access = PL1_RW, .resetvalue = 0,
3254 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s),
3255 offsetoflow32(CPUARMState, cp15.par_ns) },
3256 .writefn = par_write },
3257 #ifndef CONFIG_USER_ONLY
3258 /* This underdecoding is safe because the reginfo is NO_RAW. */
3259 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
3260 .access = PL1_W, .accessfn = ats_access,
3261 .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
3262 #endif
3263 REGINFO_SENTINEL
3264 };
3265
3266 /* Return basic MPU access permission bits. */
3267 static uint32_t simple_mpu_ap_bits(uint32_t val)
3268 {
3269 uint32_t ret;
3270 uint32_t mask;
3271 int i;
3272 ret = 0;
3273 mask = 3;
3274 for (i = 0; i < 16; i += 2) {
3275 ret |= (val >> i) & mask;
3276 mask <<= 2;
3277 }
3278 return ret;
3279 }
3280
3281 /* Pad basic MPU access permission bits to extended format. */
3282 static uint32_t extended_mpu_ap_bits(uint32_t val)
3283 {
3284 uint32_t ret;
3285 uint32_t mask;
3286 int i;
3287 ret = 0;
3288 mask = 3;
3289 for (i = 0; i < 16; i += 2) {
3290 ret |= (val & mask) << i;
3291 mask <<= 2;
3292 }
3293 return ret;
3294 }
3295
3296 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
3297 uint64_t value)
3298 {
3299 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
3300 }
3301
3302 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
3303 {
3304 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
3305 }
3306
3307 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
3308 uint64_t value)
3309 {
3310 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
3311 }
3312
3313 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
3314 {
3315 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
3316 }
3317
3318 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri)
3319 {
3320 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
3321
3322 if (!u32p) {
3323 return 0;
3324 }
3325
3326 u32p += env->pmsav7.rnr[M_REG_NS];
3327 return *u32p;
3328 }
3329
3330 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
3331 uint64_t value)
3332 {
3333 ARMCPU *cpu = env_archcpu(env);
3334 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
3335
3336 if (!u32p) {
3337 return;
3338 }
3339
3340 u32p += env->pmsav7.rnr[M_REG_NS];
3341 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
3342 *u32p = value;
3343 }
3344
3345 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3346 uint64_t value)
3347 {
3348 ARMCPU *cpu = env_archcpu(env);
3349 uint32_t nrgs = cpu->pmsav7_dregion;
3350
3351 if (value >= nrgs) {
3352 qemu_log_mask(LOG_GUEST_ERROR,
3353 "PMSAv7 RGNR write >= # supported regions, %" PRIu32
3354 " > %" PRIu32 "\n", (uint32_t)value, nrgs);
3355 return;
3356 }
3357
3358 raw_write(env, ri, value);
3359 }
3360
3361 static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
3362 /* Reset for all these registers is handled in arm_cpu_reset(),
3363 * because the PMSAv7 is also used by M-profile CPUs, which do
3364 * not register cpregs but still need the state to be reset.
3365 */
3366 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0,
3367 .access = PL1_RW, .type = ARM_CP_NO_RAW,
3368 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar),
3369 .readfn = pmsav7_read, .writefn = pmsav7_write,
3370 .resetfn = arm_cp_reset_ignore },
3371 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2,
3372 .access = PL1_RW, .type = ARM_CP_NO_RAW,
3373 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr),
3374 .readfn = pmsav7_read, .writefn = pmsav7_write,
3375 .resetfn = arm_cp_reset_ignore },
3376 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4,
3377 .access = PL1_RW, .type = ARM_CP_NO_RAW,
3378 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr),
3379 .readfn = pmsav7_read, .writefn = pmsav7_write,
3380 .resetfn = arm_cp_reset_ignore },
3381 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
3382 .access = PL1_RW,
3383 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]),
3384 .writefn = pmsav7_rgnr_write,
3385 .resetfn = arm_cp_reset_ignore },
3386 REGINFO_SENTINEL
3387 };
3388
3389 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
3390 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
3391 .access = PL1_RW, .type = ARM_CP_ALIAS,
3392 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
3393 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
3394 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
3395 .access = PL1_RW, .type = ARM_CP_ALIAS,
3396 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
3397 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
3398 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
3399 .access = PL1_RW,
3400 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
3401 .resetvalue = 0, },
3402 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
3403 .access = PL1_RW,
3404 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
3405 .resetvalue = 0, },
3406 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
3407 .access = PL1_RW,
3408 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
3409 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
3410 .access = PL1_RW,
3411 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
3412 /* Protection region base and size registers */
3413 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
3414 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3415 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
3416 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
3417 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3418 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
3419 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
3420 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3421 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
3422 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
3423 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3424 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
3425 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
3426 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3427 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
3428 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
3429 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3430 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
3431 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
3432 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3433 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
3434 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
3435 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3436 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
3437 REGINFO_SENTINEL
3438 };
3439
3440 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
3441 uint64_t value)
3442 {
3443 TCR *tcr = raw_ptr(env, ri);
3444 int maskshift = extract32(value, 0, 3);
3445
3446 if (!arm_feature(env, ARM_FEATURE_V8)) {
3447 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
3448 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
3449 * using Long-desciptor translation table format */
3450 value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
3451 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
3452 /* In an implementation that includes the Security Extensions
3453 * TTBCR has additional fields PD0 [4] and PD1 [5] for
3454 * Short-descriptor translation table format.
3455 */
3456 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N;
3457 } else {
3458 value &= TTBCR_N;
3459 }
3460 }
3461
3462 /* Update the masks corresponding to the TCR bank being written
3463 * Note that we always calculate mask and base_mask, but
3464 * they are only used for short-descriptor tables (ie if EAE is 0);
3465 * for long-descriptor tables the TCR fields are used differently
3466 * and the mask and base_mask values are meaningless.
3467 */
3468 tcr->raw_tcr = value;
3469 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift);
3470 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift);
3471 }
3472
3473 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3474 uint64_t value)
3475 {
3476 ARMCPU *cpu = env_archcpu(env);
3477 TCR *tcr = raw_ptr(env, ri);
3478
3479 if (arm_feature(env, ARM_FEATURE_LPAE)) {
3480 /* With LPAE the TTBCR could result in a change of ASID
3481 * via the TTBCR.A1 bit, so do a TLB flush.
3482 */
3483 tlb_flush(CPU(cpu));
3484 }
3485 /* Preserve the high half of TCR_EL1, set via TTBCR2. */
3486 value = deposit64(tcr->raw_tcr, 0, 32, value);
3487 vmsa_ttbcr_raw_write(env, ri, value);
3488 }
3489
3490 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
3491 {
3492 TCR *tcr = raw_ptr(env, ri);
3493
3494 /* Reset both the TCR as well as the masks corresponding to the bank of
3495 * the TCR being reset.
3496 */
3497 tcr->raw_tcr = 0;
3498 tcr->mask = 0;
3499 tcr->base_mask = 0xffffc000u;
3500 }
3501
3502 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3503 uint64_t value)
3504 {
3505 ARMCPU *cpu = env_archcpu(env);
3506 TCR *tcr = raw_ptr(env, ri);
3507
3508 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
3509 tlb_flush(CPU(cpu));
3510 tcr->raw_tcr = value;
3511 }
3512
3513 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3514 uint64_t value)
3515 {
3516 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */
3517 if (cpreg_field_is_64bit(ri) &&
3518 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) {
3519 ARMCPU *cpu = env_archcpu(env);
3520 tlb_flush(CPU(cpu));
3521 }
3522 raw_write(env, ri, value);
3523 }
3524
3525 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3526 uint64_t value)
3527 {
3528 ARMCPU *cpu = env_archcpu(env);
3529 CPUState *cs = CPU(cpu);
3530
3531 /* Accesses to VTTBR may change the VMID so we must flush the TLB. */
3532 if (raw_read(env, ri) != value) {
3533 tlb_flush_by_mmuidx(cs,
3534 ARMMMUIdxBit_S12NSE1 |
3535 ARMMMUIdxBit_S12NSE0 |
3536 ARMMMUIdxBit_S2NS);
3537 raw_write(env, ri, value);
3538 }
3539 }
3540
3541 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
3542 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
3543 .access = PL1_RW, .type = ARM_CP_ALIAS,
3544 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s),
3545 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, },
3546 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
3547 .access = PL1_RW, .resetvalue = 0,
3548 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s),
3549 offsetoflow32(CPUARMState, cp15.ifsr_ns) } },
3550 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0,
3551 .access = PL1_RW, .resetvalue = 0,
3552 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s),
3553 offsetof(CPUARMState, cp15.dfar_ns) } },
3554 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64,
3555 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
3556 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
3557 .resetvalue = 0, },
3558 REGINFO_SENTINEL
3559 };
3560
3561 static const ARMCPRegInfo vmsa_cp_reginfo[] = {
3562 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
3563 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
3564 .access = PL1_RW,
3565 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
3566 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
3567 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
3568 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
3569 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
3570 offsetof(CPUARMState, cp15.ttbr0_ns) } },
3571 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
3572 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
3573 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
3574 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
3575 offsetof(CPUARMState, cp15.ttbr1_ns) } },
3576 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
3577 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
3578 .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
3579 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
3580 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) },
3581 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
3582 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write,
3583 .raw_writefn = vmsa_ttbcr_raw_write,
3584 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]),
3585 offsetoflow32(CPUARMState, cp15.tcr_el[1])} },
3586 REGINFO_SENTINEL
3587 };
3588
3589 /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing
3590 * qemu tlbs nor adjusting cached masks.
3591 */
3592 static const ARMCPRegInfo ttbcr2_reginfo = {
3593 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3,
3594 .access = PL1_RW, .type = ARM_CP_ALIAS,
3595 .bank_fieldoffsets = { offsetofhigh32(CPUARMState, cp15.tcr_el[3]),
3596 offsetofhigh32(CPUARMState, cp15.tcr_el[1]) },
3597 };
3598
3599 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri,
3600 uint64_t value)
3601 {
3602 env->cp15.c15_ticonfig = value & 0xe7;
3603 /* The OS_TYPE bit in this register changes the reported CPUID! */
3604 env->cp15.c0_cpuid = (value & (1 << 5)) ?
3605 ARM_CPUID_TI915T : ARM_CPUID_TI925T;
3606 }
3607
3608 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
3609 uint64_t value)
3610 {
3611 env->cp15.c15_threadid = value & 0xffff;
3612 }
3613
3614 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
3615 uint64_t value)
3616 {
3617 /* Wait-for-interrupt (deprecated) */
3618 cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HALT);
3619 }
3620
3621 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
3622 uint64_t value)
3623 {
3624 /* On OMAP there are registers indicating the max/min index of dcache lines
3625 * containing a dirty line; cache flush operations have to reset these.
3626 */
3627 env->cp15.c15_i_max = 0x000;
3628 env->cp15.c15_i_min = 0xff0;
3629 }
3630
3631 static const ARMCPRegInfo omap_cp_reginfo[] = {
3632 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY,
3633 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE,
3634 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
3635 .resetvalue = 0, },
3636 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,
3637 .access = PL1_RW, .type = ARM_CP_NOP },
3638 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0,
3639 .access = PL1_RW,
3640 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0,
3641 .writefn = omap_ticonfig_write },
3642 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0,
3643 .access = PL1_RW,
3644 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, },
3645 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0,
3646 .access = PL1_RW, .resetvalue = 0xff0,
3647 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) },
3648 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0,
3649 .access = PL1_RW,
3650 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0,
3651 .writefn = omap_threadid_write },
3652 { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
3653 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
3654 .type = ARM_CP_NO_RAW,
3655 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
3656 /* TODO: Peripheral port remap register:
3657 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
3658 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
3659 * when MMU is off.
3660 */
3661 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
3662 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
3663 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW,
3664 .writefn = omap_cachemaint_write },
3665 { .name = "C9", .cp = 15, .crn = 9,
3666 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
3667 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
3668 REGINFO_SENTINEL
3669 };
3670
3671 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
3672 uint64_t value)
3673 {
3674 env->cp15.c15_cpar = value & 0x3fff;
3675 }
3676
3677 static const ARMCPRegInfo xscale_cp_reginfo[] = {
3678 { .name = "XSCALE_CPAR",
3679 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
3680 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
3681 .writefn = xscale_cpar_write, },
3682 { .name = "XSCALE_AUXCR",
3683 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
3684 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
3685 .resetvalue = 0, },
3686 /* XScale specific cache-lockdown: since we have no cache we NOP these
3687 * and hope the guest does not really rely on cache behaviour.
3688 */
3689 { .name = "XSCALE_LOCK_ICACHE_LINE",
3690 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
3691 .access = PL1_W, .type = ARM_CP_NOP },
3692 { .name = "XSCALE_UNLOCK_ICACHE",
3693 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
3694 .access = PL1_W, .type = ARM_CP_NOP },
3695 { .name = "XSCALE_DCACHE_LOCK",
3696 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
3697 .access = PL1_RW, .type = ARM_CP_NOP },
3698 { .name = "XSCALE_UNLOCK_DCACHE",
3699 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
3700 .access = PL1_W, .type = ARM_CP_NOP },
3701 REGINFO_SENTINEL
3702 };
3703
3704 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
3705 /* RAZ/WI the whole crn=15 space, when we don't have a more specific
3706 * implementation of this implementation-defined space.
3707 * Ideally this should eventually disappear in favour of actually
3708 * implementing the correct behaviour for all cores.
3709 */
3710 { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
3711 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
3712 .access = PL1_RW,
3713 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE,
3714 .resetvalue = 0 },
3715 REGINFO_SENTINEL
3716 };
3717
3718 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
3719 /* Cache status: RAZ because we have no cache so it's always clean */
3720 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
3721 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3722 .resetvalue = 0 },
3723 REGINFO_SENTINEL
3724 };
3725
3726 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
3727 /* We never have a a block transfer operation in progress */
3728 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
3729 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3730 .resetvalue = 0 },
3731 /* The cache ops themselves: these all NOP for QEMU */
3732 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
3733 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3734 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
3735 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3736 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
3737 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3738 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
3739 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3740 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
3741 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3742 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
3743 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3744 REGINFO_SENTINEL
3745 };
3746
3747 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
3748 /* The cache test-and-clean instructions always return (1 << 30)
3749 * to indicate that there are no dirty cache lines.
3750 */
3751 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
3752 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3753 .resetvalue = (1 << 30) },
3754 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
3755 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3756 .resetvalue = (1 << 30) },
3757 REGINFO_SENTINEL
3758 };
3759
3760 static const ARMCPRegInfo strongarm_cp_reginfo[] = {
3761 /* Ignore ReadBuffer accesses */
3762 { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
3763 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
3764 .access = PL1_RW, .resetvalue = 0,
3765 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW },
3766 REGINFO_SENTINEL
3767 };
3768
3769 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3770 {
3771 ARMCPU *cpu = env_archcpu(env);
3772 unsigned int cur_el = arm_current_el(env);
3773 bool secure = arm_is_secure(env);
3774
3775 if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
3776 return env->cp15.vpidr_el2;
3777 }
3778 return raw_read(env, ri);
3779 }
3780
3781 static uint64_t mpidr_read_val(CPUARMState *env)
3782 {
3783 ARMCPU *cpu = env_archcpu(env);
3784 uint64_t mpidr = cpu->mp_affinity;
3785
3786 if (arm_feature(env, ARM_FEATURE_V7MP)) {
3787 mpidr |= (1U << 31);
3788 /* Cores which are uniprocessor (non-coherent)
3789 * but still implement the MP extensions set
3790 * bit 30. (For instance, Cortex-R5).
3791 */
3792 if (cpu->mp_is_up) {
3793 mpidr |= (1u << 30);
3794 }
3795 }
3796 return mpidr;
3797 }
3798
3799 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3800 {
3801 unsigned int cur_el = arm_current_el(env);
3802 bool secure = arm_is_secure(env);
3803
3804 if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
3805 return env->cp15.vmpidr_el2;
3806 }
3807 return mpidr_read_val(env);
3808 }
3809
3810 static const ARMCPRegInfo lpae_cp_reginfo[] = {
3811 /* NOP AMAIR0/1 */
3812 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
3813 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
3814 .access = PL1_RW, .type = ARM_CP_CONST,
3815 .resetvalue = 0 },
3816 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
3817 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
3818 .access = PL1_RW, .type = ARM_CP_CONST,
3819 .resetvalue = 0 },
3820 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
3821 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0,
3822 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s),
3823 offsetof(CPUARMState, cp15.par_ns)} },
3824 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
3825 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3826 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
3827 offsetof(CPUARMState, cp15.ttbr0_ns) },
3828 .writefn = vmsa_ttbr_write, },
3829 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
3830 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3831 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
3832 offsetof(CPUARMState, cp15.ttbr1_ns) },
3833 .writefn = vmsa_ttbr_write, },
3834 REGINFO_SENTINEL
3835 };
3836
3837 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3838 {
3839 return vfp_get_fpcr(env);
3840 }
3841
3842 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3843 uint64_t value)
3844 {
3845 vfp_set_fpcr(env, value);
3846 }
3847
3848 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3849 {
3850 return vfp_get_fpsr(env);
3851 }
3852
3853 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3854 uint64_t value)
3855 {
3856 vfp_set_fpsr(env, value);
3857 }
3858
3859 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri,
3860 bool isread)
3861 {
3862 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
3863 return CP_ACCESS_TRAP;
3864 }
3865 return CP_ACCESS_OK;
3866 }
3867
3868 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri,
3869 uint64_t value)
3870 {
3871 env->daif = value & PSTATE_DAIF;
3872 }
3873
3874 static CPAccessResult aa64_cacheop_access(CPUARMState *env,
3875 const ARMCPRegInfo *ri,
3876 bool isread)
3877 {
3878 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
3879 * SCTLR_EL1.UCI is set.
3880 */
3881 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) {
3882 return CP_ACCESS_TRAP;
3883 }
3884 return CP_ACCESS_OK;
3885 }
3886
3887 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions
3888 * Page D4-1736 (DDI0487A.b)
3889 */
3890
3891 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3892 uint64_t value)
3893 {
3894 CPUState *cs = env_cpu(env);
3895 bool sec = arm_is_secure_below_el3(env);
3896
3897 if (sec) {
3898 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3899 ARMMMUIdxBit_S1SE1 |
3900 ARMMMUIdxBit_S1SE0);
3901 } else {
3902 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3903 ARMMMUIdxBit_S12NSE1 |
3904 ARMMMUIdxBit_S12NSE0);
3905 }
3906 }
3907
3908 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3909 uint64_t value)
3910 {
3911 CPUState *cs = env_cpu(env);
3912
3913 if (tlb_force_broadcast(env)) {
3914 tlbi_aa64_vmalle1is_write(env, NULL, value);
3915 return;
3916 }
3917
3918 if (arm_is_secure_below_el3(env)) {
3919 tlb_flush_by_mmuidx(cs,
3920 ARMMMUIdxBit_S1SE1 |
3921 ARMMMUIdxBit_S1SE0);
3922 } else {
3923 tlb_flush_by_mmuidx(cs,
3924 ARMMMUIdxBit_S12NSE1 |
3925 ARMMMUIdxBit_S12NSE0);
3926 }
3927 }
3928
3929 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3930 uint64_t value)
3931 {
3932 /* Note that the 'ALL' scope must invalidate both stage 1 and
3933 * stage 2 translations, whereas most other scopes only invalidate
3934 * stage 1 translations.
3935 */
3936 ARMCPU *cpu = env_archcpu(env);
3937 CPUState *cs = CPU(cpu);
3938
3939 if (arm_is_secure_below_el3(env)) {
3940 tlb_flush_by_mmuidx(cs,
3941 ARMMMUIdxBit_S1SE1 |
3942 ARMMMUIdxBit_S1SE0);
3943 } else {
3944 if (arm_feature(env, ARM_FEATURE_EL2)) {
3945 tlb_flush_by_mmuidx(cs,
3946 ARMMMUIdxBit_S12NSE1 |
3947 ARMMMUIdxBit_S12NSE0 |
3948 ARMMMUIdxBit_S2NS);
3949 } else {
3950 tlb_flush_by_mmuidx(cs,
3951 ARMMMUIdxBit_S12NSE1 |
3952 ARMMMUIdxBit_S12NSE0);
3953 }
3954 }
3955 }
3956
3957 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
3958 uint64_t value)
3959 {
3960 ARMCPU *cpu = env_archcpu(env);
3961 CPUState *cs = CPU(cpu);
3962
3963 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
3964 }
3965
3966 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
3967 uint64_t value)
3968 {
3969 ARMCPU *cpu = env_archcpu(env);
3970 CPUState *cs = CPU(cpu);
3971
3972 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3);
3973 }
3974
3975 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3976 uint64_t value)
3977 {
3978 /* Note that the 'ALL' scope must invalidate both stage 1 and
3979 * stage 2 translations, whereas most other scopes only invalidate
3980 * stage 1 translations.
3981 */
3982 CPUState *cs = env_cpu(env);
3983 bool sec = arm_is_secure_below_el3(env);
3984 bool has_el2 = arm_feature(env, ARM_FEATURE_EL2);
3985
3986 if (sec) {
3987 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3988 ARMMMUIdxBit_S1SE1 |
3989 ARMMMUIdxBit_S1SE0);
3990 } else if (has_el2) {
3991 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3992 ARMMMUIdxBit_S12NSE1 |
3993 ARMMMUIdxBit_S12NSE0 |
3994 ARMMMUIdxBit_S2NS);
3995 } else {
3996 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3997 ARMMMUIdxBit_S12NSE1 |
3998 ARMMMUIdxBit_S12NSE0);
3999 }
4000 }
4001
4002 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4003 uint64_t value)
4004 {
4005 CPUState *cs = env_cpu(env);
4006
4007 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
4008 }
4009
4010 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4011 uint64_t value)
4012 {
4013 CPUState *cs = env_cpu(env);
4014
4015 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3);
4016 }
4017
4018 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
4019 uint64_t value)
4020 {
4021 /* Invalidate by VA, EL2
4022 * Currently handles both VAE2 and VALE2, since we don't support
4023 * flush-last-level-only.
4024 */
4025 ARMCPU *cpu = env_archcpu(env);
4026 CPUState *cs = CPU(cpu);
4027 uint64_t pageaddr = sextract64(value << 12, 0, 56);
4028
4029 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
4030 }
4031
4032 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
4033 uint64_t value)
4034 {
4035 /* Invalidate by VA, EL3
4036 * Currently handles both VAE3 and VALE3, since we don't support
4037 * flush-last-level-only.
4038 */
4039 ARMCPU *cpu = env_archcpu(env);
4040 CPUState *cs = CPU(cpu);
4041 uint64_t pageaddr = sextract64(value << 12, 0, 56);
4042
4043 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3);
4044 }
4045
4046 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4047 uint64_t value)
4048 {
4049 ARMCPU *cpu = env_archcpu(env);
4050 CPUState *cs = CPU(cpu);
4051 bool sec = arm_is_secure_below_el3(env);
4052 uint64_t pageaddr = sextract64(value << 12, 0, 56);
4053
4054 if (sec) {
4055 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4056 ARMMMUIdxBit_S1SE1 |
4057 ARMMMUIdxBit_S1SE0);
4058 } else {
4059 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4060 ARMMMUIdxBit_S12NSE1 |
4061 ARMMMUIdxBit_S12NSE0);
4062 }
4063 }
4064
4065 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
4066 uint64_t value)
4067 {
4068 /* Invalidate by VA, EL1&0 (AArch64 version).
4069 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1,
4070 * since we don't support flush-for-specific-ASID-only or
4071 * flush-last-level-only.
4072 */
4073 ARMCPU *cpu = env_archcpu(env);
4074 CPUState *cs = CPU(cpu);
4075 uint64_t pageaddr = sextract64(value << 12, 0, 56);
4076
4077 if (tlb_force_broadcast(env)) {
4078 tlbi_aa64_vae1is_write(env, NULL, value);
4079 return;
4080 }
4081
4082 if (arm_is_secure_below_el3(env)) {
4083 tlb_flush_page_by_mmuidx(cs, pageaddr,
4084 ARMMMUIdxBit_S1SE1 |
4085 ARMMMUIdxBit_S1SE0);
4086 } else {
4087 tlb_flush_page_by_mmuidx(cs, pageaddr,
4088 ARMMMUIdxBit_S12NSE1 |
4089 ARMMMUIdxBit_S12NSE0);
4090 }
4091 }
4092
4093 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4094 uint64_t value)
4095 {
4096 CPUState *cs = env_cpu(env);
4097 uint64_t pageaddr = sextract64(value << 12, 0, 56);
4098
4099 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4100 ARMMMUIdxBit_S1E2);
4101 }
4102
4103 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4104 uint64_t value)
4105 {
4106 CPUState *cs = env_cpu(env);
4107 uint64_t pageaddr = sextract64(value << 12, 0, 56);
4108
4109 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4110 ARMMMUIdxBit_S1E3);
4111 }
4112
4113 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
4114 uint64_t value)
4115 {
4116 /* Invalidate by IPA. This has to invalidate any structures that
4117 * contain only stage 2 translation information, but does not need
4118 * to apply to structures that contain combined stage 1 and stage 2
4119 * translation information.
4120 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
4121 */
4122 ARMCPU *cpu = env_archcpu(env);
4123 CPUState *cs = CPU(cpu);
4124 uint64_t pageaddr;
4125
4126 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
4127 return;
4128 }
4129
4130 pageaddr = sextract64(value << 12, 0, 48);
4131
4132 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
4133 }
4134
4135 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4136 uint64_t value)
4137 {
4138 CPUState *cs = env_cpu(env);
4139 uint64_t pageaddr;
4140
4141 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
4142 return;
4143 }
4144
4145 pageaddr = sextract64(value << 12, 0, 48);
4146
4147 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4148 ARMMMUIdxBit_S2NS);
4149 }
4150
4151 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,
4152 bool isread)
4153 {
4154 /* We don't implement EL2, so the only control on DC ZVA is the
4155 * bit in the SCTLR which can prohibit access for EL0.
4156 */
4157 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) {
4158 return CP_ACCESS_TRAP;
4159 }
4160 return CP_ACCESS_OK;
4161 }
4162
4163 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri)
4164 {
4165 ARMCPU *cpu = env_archcpu(env);
4166 int dzp_bit = 1 << 4;
4167
4168 /* DZP indicates whether DC ZVA access is allowed */
4169 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) {
4170 dzp_bit = 0;
4171 }
4172 return cpu->dcz_blocksize | dzp_bit;
4173 }
4174
4175 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
4176 bool isread)
4177 {
4178 if (!(env->pstate & PSTATE_SP)) {
4179 /* Access to SP_EL0 is undefined if it's being used as
4180 * the stack pointer.
4181 */
4182 return CP_ACCESS_TRAP_UNCATEGORIZED;
4183 }
4184 return CP_ACCESS_OK;
4185 }
4186
4187 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri)
4188 {
4189 return env->pstate & PSTATE_SP;
4190 }
4191
4192 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
4193 {
4194 update_spsel(env, val);
4195 }
4196
4197 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4198 uint64_t value)
4199 {
4200 ARMCPU *cpu = env_archcpu(env);
4201
4202 if (raw_read(env, ri) == value) {
4203 /* Skip the TLB flush if nothing actually changed; Linux likes
4204 * to do a lot of pointless SCTLR writes.
4205 */
4206 return;
4207 }
4208
4209 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {
4210 /* M bit is RAZ/WI for PMSA with no MPU implemented */
4211 value &= ~SCTLR_M;
4212 }
4213
4214 raw_write(env, ri, value);
4215 /* ??? Lots of these bits are not implemented. */
4216 /* This may enable/disable the MMU, so do a TLB flush. */
4217 tlb_flush(CPU(cpu));
4218
4219 if (ri->type & ARM_CP_SUPPRESS_TB_END) {
4220 /*
4221 * Normally we would always end the TB on an SCTLR write; see the
4222 * comment in ARMCPRegInfo sctlr initialization below for why Xscale
4223 * is special. Setting ARM_CP_SUPPRESS_TB_END also stops the rebuild
4224 * of hflags from the translator, so do it here.
4225 */
4226 arm_rebuild_hflags(env);
4227 }
4228 }
4229
4230 static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri,
4231 bool isread)
4232 {
4233 if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) {
4234 return CP_ACCESS_TRAP_FP_EL2;
4235 }
4236 if (env->cp15.cptr_el[3] & CPTR_TFP) {
4237 return CP_ACCESS_TRAP_FP_EL3;
4238 }
4239 return CP_ACCESS_OK;
4240 }
4241
4242 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4243 uint64_t value)
4244 {
4245 env->cp15.mdcr_el3 = value & SDCR_VALID_MASK;
4246 }
4247
4248 static const ARMCPRegInfo v8_cp_reginfo[] = {
4249 /* Minimal set of EL0-visible registers. This will need to be expanded
4250 * significantly for system emulation of AArch64 CPUs.
4251 */
4252 { .name = "NZCV", .state = ARM_CP_STATE_AA64,
4253 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
4254 .access = PL0_RW, .type = ARM_CP_NZCV },
4255 { .name = "DAIF", .state = ARM_CP_STATE_AA64,
4256 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
4257 .type = ARM_CP_NO_RAW,
4258 .access = PL0_RW, .accessfn = aa64_daif_access,
4259 .fieldoffset = offsetof(CPUARMState, daif),
4260 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
4261 { .name = "FPCR", .state = ARM_CP_STATE_AA64,
4262 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
4263 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
4264 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
4265 { .name = "FPSR", .state = ARM_CP_STATE_AA64,
4266 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
4267 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
4268 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
4269 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
4270 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
4271 .access = PL0_R, .type = ARM_CP_NO_RAW,
4272 .readfn = aa64_dczid_read },
4273 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
4274 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
4275 .access = PL0_W, .type = ARM_CP_DC_ZVA,
4276 #ifndef CONFIG_USER_ONLY
4277 /* Avoid overhead of an access check that always passes in user-mode */
4278 .accessfn = aa64_zva_access,
4279 #endif
4280 },
4281 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
4282 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
4283 .access = PL1_R, .type = ARM_CP_CURRENTEL },
4284 /* Cache ops: all NOPs since we don't emulate caches */
4285 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
4286 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
4287 .access = PL1_W, .type = ARM_CP_NOP },
4288 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
4289 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
4290 .access = PL1_W, .type = ARM_CP_NOP },
4291 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
4292 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
4293 .access = PL0_W, .type = ARM_CP_NOP,
4294 .accessfn = aa64_cacheop_access },
4295 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
4296 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
4297 .access = PL1_W, .type = ARM_CP_NOP },
4298 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
4299 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
4300 .access = PL1_W, .type = ARM_CP_NOP },
4301 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
4302 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
4303 .access = PL0_W, .type = ARM_CP_NOP,
4304 .accessfn = aa64_cacheop_access },
4305 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
4306 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
4307 .access = PL1_W, .type = ARM_CP_NOP },
4308 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
4309 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
4310 .access = PL0_W, .type = ARM_CP_NOP,
4311 .accessfn = aa64_cacheop_access },
4312 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
4313 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
4314 .access = PL0_W, .type = ARM_CP_NOP,
4315 .accessfn = aa64_cacheop_access },
4316 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
4317 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
4318 .access = PL1_W, .type = ARM_CP_NOP },
4319 /* TLBI operations */
4320 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
4321 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
4322 .access = PL1_W, .type = ARM_CP_NO_RAW,
4323 .writefn = tlbi_aa64_vmalle1is_write },
4324 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
4325 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
4326 .access = PL1_W, .type = ARM_CP_NO_RAW,
4327 .writefn = tlbi_aa64_vae1is_write },
4328 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
4329 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
4330 .access = PL1_W, .type = ARM_CP_NO_RAW,
4331 .writefn = tlbi_aa64_vmalle1is_write },
4332 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
4333 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
4334 .access = PL1_W, .type = ARM_CP_NO_RAW,
4335 .writefn = tlbi_aa64_vae1is_write },
4336 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
4337 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
4338 .access = PL1_W, .type = ARM_CP_NO_RAW,
4339 .writefn = tlbi_aa64_vae1is_write },
4340 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
4341 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
4342 .access = PL1_W, .type = ARM_CP_NO_RAW,
4343 .writefn = tlbi_aa64_vae1is_write },
4344 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
4345 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
4346 .access = PL1_W, .type = ARM_CP_NO_RAW,
4347 .writefn = tlbi_aa64_vmalle1_write },
4348 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
4349 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
4350 .access = PL1_W, .type = ARM_CP_NO_RAW,
4351 .writefn = tlbi_aa64_vae1_write },
4352 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
4353 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
4354 .access = PL1_W, .type = ARM_CP_NO_RAW,
4355 .writefn = tlbi_aa64_vmalle1_write },
4356 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
4357 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
4358 .access = PL1_W, .type = ARM_CP_NO_RAW,
4359 .writefn = tlbi_aa64_vae1_write },
4360 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
4361 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
4362 .access = PL1_W, .type = ARM_CP_NO_RAW,
4363 .writefn = tlbi_aa64_vae1_write },
4364 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
4365 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
4366 .access = PL1_W, .type = ARM_CP_NO_RAW,
4367 .writefn = tlbi_aa64_vae1_write },
4368 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64,
4369 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
4370 .access = PL2_W, .type = ARM_CP_NO_RAW,
4371 .writefn = tlbi_aa64_ipas2e1is_write },
4372 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64,
4373 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
4374 .access = PL2_W, .type = ARM_CP_NO_RAW,
4375 .writefn = tlbi_aa64_ipas2e1is_write },
4376 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,
4377 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
4378 .access = PL2_W, .type = ARM_CP_NO_RAW,
4379 .writefn = tlbi_aa64_alle1is_write },
4380 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64,
4381 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6,
4382 .access = PL2_W, .type = ARM_CP_NO_RAW,
4383 .writefn = tlbi_aa64_alle1is_write },
4384 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64,
4385 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
4386 .access = PL2_W, .type = ARM_CP_NO_RAW,
4387 .writefn = tlbi_aa64_ipas2e1_write },
4388 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64,
4389 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
4390 .access = PL2_W, .type = ARM_CP_NO_RAW,
4391 .writefn = tlbi_aa64_ipas2e1_write },
4392 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,
4393 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
4394 .access = PL2_W, .type = ARM_CP_NO_RAW,
4395 .writefn = tlbi_aa64_alle1_write },
4396 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64,
4397 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6,
4398 .access = PL2_W, .type = ARM_CP_NO_RAW,
4399 .writefn = tlbi_aa64_alle1is_write },
4400 #ifndef CONFIG_USER_ONLY
4401 /* 64 bit address translation operations */
4402 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
4403 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
4404 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4405 .writefn = ats_write64 },
4406 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
4407 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
4408 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4409 .writefn = ats_write64 },
4410 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
4411 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
4412 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4413 .writefn = ats_write64 },
4414 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
4415 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
4416 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4417 .writefn = ats_write64 },
4418 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64,
4419 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4,
4420 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4421 .writefn = ats_write64 },
4422 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64,
4423 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5,
4424 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4425 .writefn = ats_write64 },
4426 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64,
4427 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6,
4428 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4429 .writefn = ats_write64 },
4430 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64,
4431 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7,
4432 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4433 .writefn = ats_write64 },
4434 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */
4435 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64,
4436 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0,
4437 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4438 .writefn = ats_write64 },
4439 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64,
4440 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1,
4441 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4442 .writefn = ats_write64 },
4443 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64,
4444 .type = ARM_CP_ALIAS,
4445 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0,
4446 .access = PL1_RW, .resetvalue = 0,
4447 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]),
4448 .writefn = par_write },
4449 #endif
4450 /* TLB invalidate last level of translation table walk */
4451 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
4452 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
4453 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
4454 .type = ARM_CP_NO_RAW, .access = PL1_W,
4455 .writefn = tlbimvaa_is_write },
4456 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
4457 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
4458 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
4459 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
4460 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
4461 .type = ARM_CP_NO_RAW, .access = PL2_W,
4462 .writefn = tlbimva_hyp_write },
4463 { .name = "TLBIMVALHIS",
4464 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
4465 .type = ARM_CP_NO_RAW, .access = PL2_W,
4466 .writefn = tlbimva_hyp_is_write },
4467 { .name = "TLBIIPAS2",
4468 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
4469 .type = ARM_CP_NO_RAW, .access = PL2_W,
4470 .writefn = tlbiipas2_write },
4471 { .name = "TLBIIPAS2IS",
4472 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
4473 .type = ARM_CP_NO_RAW, .access = PL2_W,
4474 .writefn = tlbiipas2_is_write },
4475 { .name = "TLBIIPAS2L",
4476 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
4477 .type = ARM_CP_NO_RAW, .access = PL2_W,
4478 .writefn = tlbiipas2_write },
4479 { .name = "TLBIIPAS2LIS",
4480 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
4481 .type = ARM_CP_NO_RAW, .access = PL2_W,
4482 .writefn = tlbiipas2_is_write },
4483 /* 32 bit cache operations */
4484 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
4485 .type = ARM_CP_NOP, .access = PL1_W },
4486 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
4487 .type = ARM_CP_NOP, .access = PL1_W },
4488 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
4489 .type = ARM_CP_NOP, .access = PL1_W },
4490 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
4491 .type = ARM_CP_NOP, .access = PL1_W },
4492 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
4493 .type = ARM_CP_NOP, .access = PL1_W },
4494 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
4495 .type = ARM_CP_NOP, .access = PL1_W },
4496 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
4497 .type = ARM_CP_NOP, .access = PL1_W },
4498 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
4499 .type = ARM_CP_NOP, .access = PL1_W },
4500 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
4501 .type = ARM_CP_NOP, .access = PL1_W },
4502 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
4503 .type = ARM_CP_NOP, .access = PL1_W },
4504 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
4505 .type = ARM_CP_NOP, .access = PL1_W },
4506 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
4507 .type = ARM_CP_NOP, .access = PL1_W },
4508 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
4509 .type = ARM_CP_NOP, .access = PL1_W },
4510 /* MMU Domain access control / MPU write buffer control */
4511 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
4512 .access = PL1_RW, .resetvalue = 0,
4513 .writefn = dacr_write, .raw_writefn = raw_write,
4514 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
4515 offsetoflow32(CPUARMState, cp15.dacr_ns) } },
4516 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
4517 .type = ARM_CP_ALIAS,
4518 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
4519 .access = PL1_RW,
4520 .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
4521 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
4522 .type = ARM_CP_ALIAS,
4523 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
4524 .access = PL1_RW,
4525 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) },
4526 /* We rely on the access checks not allowing the guest to write to the
4527 * state field when SPSel indicates that it's being used as the stack
4528 * pointer.
4529 */
4530 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
4531 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
4532 .access = PL1_RW, .accessfn = sp_el0_access,
4533 .type = ARM_CP_ALIAS,
4534 .fieldoffset = offsetof(CPUARMState, sp_el[0]) },
4535 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64,
4536 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0,
4537 .access = PL2_RW, .type = ARM_CP_ALIAS,
4538 .fieldoffset = offsetof(CPUARMState, sp_el[1]) },
4539 { .name = "SPSel", .state = ARM_CP_STATE_AA64,
4540 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
4541 .type = ARM_CP_NO_RAW,
4542 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
4543 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64,
4544 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0,
4545 .type = ARM_CP_ALIAS,
4546 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]),
4547 .access = PL2_RW, .accessfn = fpexc32_access },
4548 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64,
4549 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0,
4550 .access = PL2_RW, .resetvalue = 0,
4551 .writefn = dacr_write, .raw_writefn = raw_write,
4552 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) },
4553 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64,
4554 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1,
4555 .access = PL2_RW, .resetvalue = 0,
4556 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) },
4557 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64,
4558 .type = ARM_CP_ALIAS,
4559 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0,
4560 .access = PL2_RW,
4561 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) },
4562 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64,
4563 .type = ARM_CP_ALIAS,
4564 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1,
4565 .access = PL2_RW,
4566 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) },
4567 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64,
4568 .type = ARM_CP_ALIAS,
4569 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2,
4570 .access = PL2_RW,
4571 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) },
4572 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64,
4573 .type = ARM_CP_ALIAS,
4574 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3,
4575 .access = PL2_RW,
4576 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) },
4577 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64,
4578 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1,
4579 .resetvalue = 0,
4580 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) },
4581 { .name = "SDCR", .type = ARM_CP_ALIAS,
4582 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1,
4583 .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
4584 .writefn = sdcr_write,
4585 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
4586 REGINFO_SENTINEL
4587 };
4588
4589 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */
4590 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
4591 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
4592 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
4593 .access = PL2_RW,
4594 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
4595 { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH,
4596 .type = ARM_CP_NO_RAW,
4597 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4598 .access = PL2_RW,
4599 .type = ARM_CP_CONST, .resetvalue = 0 },
4600 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
4601 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
4602 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4603 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
4604 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
4605 .access = PL2_RW,
4606 .type = ARM_CP_CONST, .resetvalue = 0 },
4607 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
4608 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
4609 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4610 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
4611 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
4612 .access = PL2_RW, .type = ARM_CP_CONST,
4613 .resetvalue = 0 },
4614 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
4615 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
4616 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4617 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
4618 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
4619 .access = PL2_RW, .type = ARM_CP_CONST,
4620 .resetvalue = 0 },
4621 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
4622 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
4623 .access = PL2_RW, .type = ARM_CP_CONST,
4624 .resetvalue = 0 },
4625 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
4626 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
4627 .access = PL2_RW, .type = ARM_CP_CONST,
4628 .resetvalue = 0 },
4629 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
4630 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
4631 .access = PL2_RW, .type = ARM_CP_CONST,
4632 .resetvalue = 0 },
4633 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
4634 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
4635 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4636 { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH,
4637 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4638 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
4639 .type = ARM_CP_CONST, .resetvalue = 0 },
4640 { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
4641 .cp = 15, .opc1 = 6, .crm = 2,
4642 .access = PL2_RW, .accessfn = access_el3_aa32ns,
4643 .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
4644 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
4645 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
4646 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4647 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
4648 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
4649 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4650 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4651 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
4652 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4653 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
4654 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
4655 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4656 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
4657 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
4658 .resetvalue = 0 },
4659 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
4660 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
4661 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4662 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
4663 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
4664 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4665 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
4666 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
4667 .resetvalue = 0 },
4668 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
4669 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
4670 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4671 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
4672 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
4673 .resetvalue = 0 },
4674 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
4675 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
4676 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4677 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
4678 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
4679 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4680 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
4681 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
4682 .access = PL2_RW, .accessfn = access_tda,
4683 .type = ARM_CP_CONST, .resetvalue = 0 },
4684 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH,
4685 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
4686 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
4687 .type = ARM_CP_CONST, .resetvalue = 0 },
4688 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
4689 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
4690 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4691 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
4692 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
4693 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4694 { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
4695 .type = ARM_CP_CONST,
4696 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
4697 .access = PL2_RW, .resetvalue = 0 },
4698 REGINFO_SENTINEL
4699 };
4700
4701 /* Ditto, but for registers which exist in ARMv8 but not v7 */
4702 static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {
4703 { .name = "HCR2", .state = ARM_CP_STATE_AA32,
4704 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
4705 .access = PL2_RW,
4706 .type = ARM_CP_CONST, .resetvalue = 0 },
4707 REGINFO_SENTINEL
4708 };
4709
4710 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
4711 {
4712 ARMCPU *cpu = env_archcpu(env);
4713 uint64_t valid_mask = HCR_MASK;
4714
4715 if (arm_feature(env, ARM_FEATURE_EL3)) {
4716 valid_mask &= ~HCR_HCD;
4717 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
4718 /* Architecturally HCR.TSC is RES0 if EL3 is not implemented.
4719 * However, if we're using the SMC PSCI conduit then QEMU is
4720 * effectively acting like EL3 firmware and so the guest at
4721 * EL2 should retain the ability to prevent EL1 from being
4722 * able to make SMC calls into the ersatz firmware, so in
4723 * that case HCR.TSC should be read/write.
4724 */
4725 valid_mask &= ~HCR_TSC;
4726 }
4727 if (cpu_isar_feature(aa64_lor, cpu)) {
4728 valid_mask |= HCR_TLOR;
4729 }
4730 if (cpu_isar_feature(aa64_pauth, cpu)) {
4731 valid_mask |= HCR_API | HCR_APK;
4732 }
4733
4734 /* Clear RES0 bits. */
4735 value &= valid_mask;
4736
4737 /* These bits change the MMU setup:
4738 * HCR_VM enables stage 2 translation
4739 * HCR_PTW forbids certain page-table setups
4740 * HCR_DC Disables stage1 and enables stage2 translation
4741 */
4742 if ((env->cp15.hcr_el2 ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) {
4743 tlb_flush(CPU(cpu));
4744 }
4745 env->cp15.hcr_el2 = value;
4746
4747 /*
4748 * Updates to VI and VF require us to update the status of
4749 * virtual interrupts, which are the logical OR of these bits
4750 * and the state of the input lines from the GIC. (This requires
4751 * that we have the iothread lock, which is done by marking the
4752 * reginfo structs as ARM_CP_IO.)
4753 * Note that if a write to HCR pends a VIRQ or VFIQ it is never
4754 * possible for it to be taken immediately, because VIRQ and
4755 * VFIQ are masked unless running at EL0 or EL1, and HCR
4756 * can only be written at EL2.
4757 */
4758 g_assert(qemu_mutex_iothread_locked());
4759 arm_cpu_update_virq(cpu);
4760 arm_cpu_update_vfiq(cpu);
4761 }
4762
4763 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri,
4764 uint64_t value)
4765 {
4766 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */
4767 value = deposit64(env->cp15.hcr_el2, 32, 32, value);
4768 hcr_write(env, NULL, value);
4769 }
4770
4771 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
4772 uint64_t value)
4773 {
4774 /* Handle HCR write, i.e. write to low half of HCR_EL2 */
4775 value = deposit64(env->cp15.hcr_el2, 0, 32, value);
4776 hcr_write(env, NULL, value);
4777 }
4778
4779 /*
4780 * Return the effective value of HCR_EL2.
4781 * Bits that are not included here:
4782 * RW (read from SCR_EL3.RW as needed)
4783 */
4784 uint64_t arm_hcr_el2_eff(CPUARMState *env)
4785 {
4786 uint64_t ret = env->cp15.hcr_el2;
4787
4788 if (arm_is_secure_below_el3(env)) {
4789 /*
4790 * "This register has no effect if EL2 is not enabled in the
4791 * current Security state". This is ARMv8.4-SecEL2 speak for
4792 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1).
4793 *
4794 * Prior to that, the language was "In an implementation that
4795 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves
4796 * as if this field is 0 for all purposes other than a direct
4797 * read or write access of HCR_EL2". With lots of enumeration
4798 * on a per-field basis. In current QEMU, this is condition
4799 * is arm_is_secure_below_el3.
4800 *
4801 * Since the v8.4 language applies to the entire register, and
4802 * appears to be backward compatible, use that.
4803 */
4804 ret = 0;
4805 } else if (ret & HCR_TGE) {
4806 /* These bits are up-to-date as of ARMv8.4. */
4807 if (ret & HCR_E2H) {
4808 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO |
4809 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE |
4810 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU |
4811 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE);
4812 } else {
4813 ret |= HCR_FMO | HCR_IMO | HCR_AMO;
4814 }
4815 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE |
4816 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR |
4817 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM |
4818 HCR_TLOR);
4819 }
4820
4821 return ret;
4822 }
4823
4824 static void cptr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
4825 uint64_t value)
4826 {
4827 /*
4828 * For A-profile AArch32 EL3, if NSACR.CP10
4829 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1.
4830 */
4831 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
4832 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
4833 value &= ~(0x3 << 10);
4834 value |= env->cp15.cptr_el[2] & (0x3 << 10);
4835 }
4836 env->cp15.cptr_el[2] = value;
4837 }
4838
4839 static uint64_t cptr_el2_read(CPUARMState *env, const ARMCPRegInfo *ri)
4840 {
4841 /*
4842 * For A-profile AArch32 EL3, if NSACR.CP10
4843 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1.
4844 */
4845 uint64_t value = env->cp15.cptr_el[2];
4846
4847 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
4848 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
4849 value |= 0x3 << 10;
4850 }
4851 return value;
4852 }
4853
4854 static const ARMCPRegInfo el2_cp_reginfo[] = {
4855 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
4856 .type = ARM_CP_IO,
4857 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4858 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
4859 .writefn = hcr_write },
4860 { .name = "HCR", .state = ARM_CP_STATE_AA32,
4861 .type = ARM_CP_ALIAS | ARM_CP_IO,
4862 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4863 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
4864 .writefn = hcr_writelow },
4865 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
4866 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
4867 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4868 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
4869 .type = ARM_CP_ALIAS,
4870 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
4871 .access = PL2_RW,
4872 .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
4873 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
4874 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
4875 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
4876 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
4877 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
4878 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
4879 { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
4880 .type = ARM_CP_ALIAS,
4881 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
4882 .access = PL2_RW,
4883 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) },
4884 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
4885 .type = ARM_CP_ALIAS,
4886 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
4887 .access = PL2_RW,
4888 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) },
4889 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
4890 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
4891 .access = PL2_RW, .writefn = vbar_write,
4892 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
4893 .resetvalue = 0 },
4894 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64,
4895 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0,
4896 .access = PL3_RW, .type = ARM_CP_ALIAS,
4897 .fieldoffset = offsetof(CPUARMState, sp_el[2]) },
4898 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
4899 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
4900 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0,
4901 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]),
4902 .readfn = cptr_el2_read, .writefn = cptr_el2_write },
4903 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
4904 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
4905 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),
4906 .resetvalue = 0 },
4907 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
4908 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
4909 .access = PL2_RW, .type = ARM_CP_ALIAS,
4910 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },
4911 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
4912 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
4913 .access = PL2_RW, .type = ARM_CP_CONST,
4914 .resetvalue = 0 },
4915 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
4916 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
4917 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
4918 .access = PL2_RW, .type = ARM_CP_CONST,
4919 .resetvalue = 0 },
4920 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
4921 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
4922 .access = PL2_RW, .type = ARM_CP_CONST,
4923 .resetvalue = 0 },
4924 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
4925 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
4926 .access = PL2_RW, .type = ARM_CP_CONST,
4927 .resetvalue = 0 },
4928 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
4929 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
4930 .access = PL2_RW,
4931 /* no .writefn needed as this can't cause an ASID change;
4932 * no .raw_writefn or .resetfn needed as we never use mask/base_mask
4933 */
4934 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
4935 { .name = "VTCR", .state = ARM_CP_STATE_AA32,
4936 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4937 .type = ARM_CP_ALIAS,
4938 .access = PL2_RW, .accessfn = access_el3_aa32ns,
4939 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
4940 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
4941 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4942 .access = PL2_RW,
4943 /* no .writefn needed as this can't cause an ASID change;
4944 * no .raw_writefn or .resetfn needed as we never use mask/base_mask
4945 */
4946 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
4947 { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
4948 .cp = 15, .opc1 = 6, .crm = 2,
4949 .type = ARM_CP_64BIT | ARM_CP_ALIAS,
4950 .access = PL2_RW, .accessfn = access_el3_aa32ns,
4951 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2),
4952 .writefn = vttbr_write },
4953 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
4954 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
4955 .access = PL2_RW, .writefn = vttbr_write,
4956 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) },
4957 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
4958 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
4959 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
4960 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) },
4961 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4962 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
4963 .access = PL2_RW, .resetvalue = 0,
4964 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
4965 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
4966 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
4967 .access = PL2_RW, .resetvalue = 0,
4968 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
4969 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
4970 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
4971 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
4972 { .name = "TLBIALLNSNH",
4973 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
4974 .type = ARM_CP_NO_RAW, .access = PL2_W,
4975 .writefn = tlbiall_nsnh_write },
4976 { .name = "TLBIALLNSNHIS",
4977 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
4978 .type = ARM_CP_NO_RAW, .access = PL2_W,
4979 .writefn = tlbiall_nsnh_is_write },
4980 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
4981 .type = ARM_CP_NO_RAW, .access = PL2_W,
4982 .writefn = tlbiall_hyp_write },
4983 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
4984 .type = ARM_CP_NO_RAW, .access = PL2_W,
4985 .writefn = tlbiall_hyp_is_write },
4986 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
4987 .type = ARM_CP_NO_RAW, .access = PL2_W,
4988 .writefn = tlbimva_hyp_write },
4989 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
4990 .type = ARM_CP_NO_RAW, .access = PL2_W,
4991 .writefn = tlbimva_hyp_is_write },
4992 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64,
4993 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
4994 .type = ARM_CP_NO_RAW, .access = PL2_W,
4995 .writefn = tlbi_aa64_alle2_write },
4996 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64,
4997 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
4998 .type = ARM_CP_NO_RAW, .access = PL2_W,
4999 .writefn = tlbi_aa64_vae2_write },
5000 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64,
5001 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
5002 .access = PL2_W, .type = ARM_CP_NO_RAW,
5003 .writefn = tlbi_aa64_vae2_write },
5004 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64,
5005 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
5006 .access = PL2_W, .type = ARM_CP_NO_RAW,
5007 .writefn = tlbi_aa64_alle2is_write },
5008 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64,
5009 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
5010 .type = ARM_CP_NO_RAW, .access = PL2_W,
5011 .writefn = tlbi_aa64_vae2is_write },
5012 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64,
5013 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
5014 .access = PL2_W, .type = ARM_CP_NO_RAW,
5015 .writefn = tlbi_aa64_vae2is_write },
5016 #ifndef CONFIG_USER_ONLY
5017 /* Unlike the other EL2-related AT operations, these must
5018 * UNDEF from EL3 if EL2 is not implemented, which is why we
5019 * define them here rather than with the rest of the AT ops.
5020 */
5021 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64,
5022 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
5023 .access = PL2_W, .accessfn = at_s1e2_access,
5024 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 },
5025 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64,
5026 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
5027 .access = PL2_W, .accessfn = at_s1e2_access,
5028 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 },
5029 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
5030 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
5031 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
5032 * to behave as if SCR.NS was 1.
5033 */
5034 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
5035 .access = PL2_W,
5036 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
5037 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
5038 .access = PL2_W,
5039 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
5040 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
5041 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
5042 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the
5043 * reset values as IMPDEF. We choose to reset to 3 to comply with
5044 * both ARMv7 and ARMv8.
5045 */
5046 .access = PL2_RW, .resetvalue = 3,
5047 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) },
5048 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
5049 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
5050 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
5051 .writefn = gt_cntvoff_write,
5052 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
5053 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
5054 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO,
5055 .writefn = gt_cntvoff_write,
5056 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
5057 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
5058 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
5059 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
5060 .type = ARM_CP_IO, .access = PL2_RW,
5061 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
5062 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
5063 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
5064 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO,
5065 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
5066 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
5067 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
5068 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW,
5069 .resetfn = gt_hyp_timer_reset,
5070 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write },
5071 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
5072 .type = ARM_CP_IO,
5073 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
5074 .access = PL2_RW,
5075 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl),
5076 .resetvalue = 0,
5077 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
5078 #endif
5079 /* The only field of MDCR_EL2 that has a defined architectural reset value
5080 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we
5081 * don't implement any PMU event counters, so using zero as a reset
5082 * value for MDCR_EL2 is okay
5083 */
5084 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
5085 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
5086 .access = PL2_RW, .resetvalue = 0,
5087 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), },
5088 { .name = "HPFAR", .state = ARM_CP_STATE_AA32,
5089 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
5090 .access = PL2_RW, .accessfn = access_el3_aa32ns,
5091 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
5092 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64,
5093 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
5094 .access = PL2_RW,
5095 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
5096 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
5097 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
5098 .access = PL2_RW,
5099 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) },
5100 REGINFO_SENTINEL
5101 };
5102
5103 static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
5104 { .name = "HCR2", .state = ARM_CP_STATE_AA32,
5105 .type = ARM_CP_ALIAS | ARM_CP_IO,
5106 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
5107 .access = PL2_RW,
5108 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
5109 .writefn = hcr_writehigh },
5110 REGINFO_SENTINEL
5111 };
5112
5113 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
5114 bool isread)
5115 {
5116 /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2.
5117 * At Secure EL1 it traps to EL3.
5118 */
5119 if (arm_current_el(env) == 3) {
5120 return CP_ACCESS_OK;
5121 }
5122 if (arm_is_secure_below_el3(env)) {
5123 return CP_ACCESS_TRAP_EL3;
5124 }
5125 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */
5126 if (isread) {
5127 return CP_ACCESS_OK;
5128 }
5129 return CP_ACCESS_TRAP_UNCATEGORIZED;
5130 }
5131
5132 static const ARMCPRegInfo el3_cp_reginfo[] = {
5133 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
5134 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
5135 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
5136 .resetvalue = 0, .writefn = scr_write },
5137 { .name = "SCR", .type = ARM_CP_ALIAS | ARM_CP_NEWEL,
5138 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
5139 .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
5140 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
5141 .writefn = scr_write },
5142 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
5143 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
5144 .access = PL3_RW, .resetvalue = 0,
5145 .fieldoffset = offsetof(CPUARMState, cp15.sder) },
5146 { .name = "SDER",
5147 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1,
5148 .access = PL3_RW, .resetvalue = 0,
5149 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) },
5150 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
5151 .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
5152 .writefn = vbar_write, .resetvalue = 0,
5153 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) },
5154 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64,
5155 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0,
5156 .access = PL3_RW, .resetvalue = 0,
5157 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) },
5158 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
5159 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2,
5160 .access = PL3_RW,
5161 /* no .writefn needed as this can't cause an ASID change;
5162 * we must provide a .raw_writefn and .resetfn because we handle
5163 * reset and migration for the AArch32 TTBCR(S), which might be
5164 * using mask and base_mask.
5165 */
5166 .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write,
5167 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) },
5168 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
5169 .type = ARM_CP_ALIAS,
5170 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
5171 .access = PL3_RW,
5172 .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
5173 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
5174 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
5175 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) },
5176 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64,
5177 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0,
5178 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) },
5179 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
5180 .type = ARM_CP_ALIAS,
5181 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
5182 .access = PL3_RW,
5183 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) },
5184 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
5185 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
5186 .access = PL3_RW, .writefn = vbar_write,
5187 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
5188 .resetvalue = 0 },
5189 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64,
5190 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2,
5191 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0,
5192 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) },
5193 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64,
5194 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2,
5195 .access = PL3_RW, .resetvalue = 0,
5196 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) },
5197 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64,
5198 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0,
5199 .access = PL3_RW, .type = ARM_CP_CONST,
5200 .resetvalue = 0 },
5201 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH,
5202 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0,
5203 .access = PL3_RW, .type = ARM_CP_CONST,
5204 .resetvalue = 0 },
5205 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH,
5206 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1,
5207 .access = PL3_RW, .type = ARM_CP_CONST,
5208 .resetvalue = 0 },
5209 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64,
5210 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0,
5211 .access = PL3_W, .type = ARM_CP_NO_RAW,
5212 .writefn = tlbi_aa64_alle3is_write },
5213 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64,
5214 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1,
5215 .access = PL3_W, .type = ARM_CP_NO_RAW,
5216 .writefn = tlbi_aa64_vae3is_write },
5217 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64,
5218 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5,
5219 .access = PL3_W, .type = ARM_CP_NO_RAW,
5220 .writefn = tlbi_aa64_vae3is_write },
5221 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64,
5222 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0,
5223 .access = PL3_W, .type = ARM_CP_NO_RAW,
5224 .writefn = tlbi_aa64_alle3_write },
5225 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64,
5226 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1,
5227 .access = PL3_W, .type = ARM_CP_NO_RAW,
5228 .writefn = tlbi_aa64_vae3_write },
5229 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64,
5230 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5,
5231 .access = PL3_W, .type = ARM_CP_NO_RAW,
5232 .writefn = tlbi_aa64_vae3_write },
5233 REGINFO_SENTINEL
5234 };
5235
5236 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
5237 bool isread)
5238 {
5239 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
5240 * but the AArch32 CTR has its own reginfo struct)
5241 */
5242 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) {
5243 return CP_ACCESS_TRAP;
5244 }
5245
5246 if (arm_current_el(env) < 2 && arm_hcr_el2_eff(env) & HCR_TID2) {
5247 return CP_ACCESS_TRAP_EL2;
5248 }
5249
5250 return CP_ACCESS_OK;
5251 }
5252
5253 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
5254 uint64_t value)
5255 {
5256 /* Writes to OSLAR_EL1 may update the OS lock status, which can be
5257 * read via a bit in OSLSR_EL1.
5258 */
5259 int oslock;
5260
5261 if (ri->state == ARM_CP_STATE_AA32) {
5262 oslock = (value == 0xC5ACCE55);
5263 } else {
5264 oslock = value & 1;
5265 }
5266
5267 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
5268 }
5269
5270 static const ARMCPRegInfo debug_cp_reginfo[] = {
5271 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
5272 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
5273 * unlike DBGDRAR it is never accessible from EL0.
5274 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
5275 * accessor.
5276 */
5277 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
5278 .access = PL0_R, .accessfn = access_tdra,
5279 .type = ARM_CP_CONST, .resetvalue = 0 },
5280 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
5281 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
5282 .access = PL1_R, .accessfn = access_tdra,
5283 .type = ARM_CP_CONST, .resetvalue = 0 },
5284 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
5285 .access = PL0_R, .accessfn = access_tdra,
5286 .type = ARM_CP_CONST, .resetvalue = 0 },
5287 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
5288 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
5289 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
5290 .access = PL1_RW, .accessfn = access_tda,
5291 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
5292 .resetvalue = 0 },
5293 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1.
5294 * We don't implement the configurable EL0 access.
5295 */
5296 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH,
5297 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
5298 .type = ARM_CP_ALIAS,
5299 .access = PL1_R, .accessfn = access_tda,
5300 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
5301 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
5302 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
5303 .access = PL1_W, .type = ARM_CP_NO_RAW,
5304 .accessfn = access_tdosa,
5305 .writefn = oslar_write },
5306 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
5307 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
5308 .access = PL1_R, .resetvalue = 10,
5309 .accessfn = access_tdosa,
5310 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
5311 /* Dummy OSDLR_EL1: 32-bit Linux will read this */
5312 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
5313 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
5314 .access = PL1_RW, .accessfn = access_tdosa,
5315 .type = ARM_CP_NOP },
5316 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
5317 * implement vector catch debug events yet.
5318 */
5319 { .name = "DBGVCR",
5320 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
5321 .access = PL1_RW, .accessfn = access_tda,
5322 .type = ARM_CP_NOP },
5323 /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
5324 * to save and restore a 32-bit guest's DBGVCR)
5325 */
5326 { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
5327 .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
5328 .access = PL2_RW, .accessfn = access_tda,
5329 .type = ARM_CP_NOP },
5330 /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications
5331 * Channel but Linux may try to access this register. The 32-bit
5332 * alias is DBGDCCINT.
5333 */
5334 { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
5335 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
5336 .access = PL1_RW, .accessfn = access_tda,
5337 .type = ARM_CP_NOP },
5338 REGINFO_SENTINEL
5339 };
5340
5341 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
5342 /* 64 bit access versions of the (dummy) debug registers */
5343 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
5344 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
5345 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
5346 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
5347 REGINFO_SENTINEL
5348 };
5349
5350 /* Return the exception level to which exceptions should be taken
5351 * via SVEAccessTrap. If an exception should be routed through
5352 * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should
5353 * take care of raising that exception.
5354 * C.f. the ARM pseudocode function CheckSVEEnabled.
5355 */
5356 int sve_exception_el(CPUARMState *env, int el)
5357 {
5358 #ifndef CONFIG_USER_ONLY
5359 if (el <= 1) {
5360 bool disabled = false;
5361
5362 /* The CPACR.ZEN controls traps to EL1:
5363 * 0, 2 : trap EL0 and EL1 accesses
5364 * 1 : trap only EL0 accesses
5365 * 3 : trap no accesses
5366 */
5367 if (!extract32(env->cp15.cpacr_el1, 16, 1)) {
5368 disabled = true;
5369 } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) {
5370 disabled = el == 0;
5371 }
5372 if (disabled) {
5373 /* route_to_el2 */
5374 return (arm_feature(env, ARM_FEATURE_EL2)
5375 && (arm_hcr_el2_eff(env) & HCR_TGE) ? 2 : 1);
5376 }
5377
5378 /* Check CPACR.FPEN. */
5379 if (!extract32(env->cp15.cpacr_el1, 20, 1)) {
5380 disabled = true;
5381 } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) {
5382 disabled = el == 0;
5383 }
5384 if (disabled) {
5385 return 0;
5386 }
5387 }
5388
5389 /* CPTR_EL2. Since TZ and TFP are positive,
5390 * they will be zero when EL2 is not present.
5391 */
5392 if (el <= 2 && !arm_is_secure_below_el3(env)) {
5393 if (env->cp15.cptr_el[2] & CPTR_TZ) {
5394 return 2;
5395 }
5396 if (env->cp15.cptr_el[2] & CPTR_TFP) {
5397 return 0;
5398 }
5399 }
5400
5401 /* CPTR_EL3. Since EZ is negative we must check for EL3. */
5402 if (arm_feature(env, ARM_FEATURE_EL3)
5403 && !(env->cp15.cptr_el[3] & CPTR_EZ)) {
5404 return 3;
5405 }
5406 #endif
5407 return 0;
5408 }
5409
5410 static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
5411 {
5412 uint32_t end_len;
5413
5414 end_len = start_len &= 0xf;
5415 if (!test_bit(start_len, cpu->sve_vq_map)) {
5416 end_len = find_last_bit(cpu->sve_vq_map, start_len);
5417 assert(end_len < start_len);
5418 }
5419 return end_len;
5420 }
5421
5422 /*
5423 * Given that SVE is enabled, return the vector length for EL.
5424 */
5425 uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
5426 {
5427 ARMCPU *cpu = env_archcpu(env);
5428 uint32_t zcr_len = cpu->sve_max_vq - 1;
5429
5430 if (el <= 1) {
5431 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
5432 }
5433 if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) {
5434 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
5435 }
5436 if (arm_feature(env, ARM_FEATURE_EL3)) {
5437 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
5438 }
5439
5440 return sve_zcr_get_valid_len(cpu, zcr_len);
5441 }
5442
5443 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5444 uint64_t value)
5445 {
5446 int cur_el = arm_current_el(env);
5447 int old_len = sve_zcr_len_for_el(env, cur_el);
5448 int new_len;
5449
5450 /* Bits other than [3:0] are RAZ/WI. */
5451 QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
5452 raw_write(env, ri, value & 0xf);
5453
5454 /*
5455 * Because we arrived here, we know both FP and SVE are enabled;
5456 * otherwise we would have trapped access to the ZCR_ELn register.
5457 */
5458 new_len = sve_zcr_len_for_el(env, cur_el);
5459 if (new_len < old_len) {
5460 aarch64_sve_narrow_vq(env, new_len + 1);
5461 }
5462 }
5463
5464 static const ARMCPRegInfo zcr_el1_reginfo = {
5465 .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
5466 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
5467 .access = PL1_RW, .type = ARM_CP_SVE,
5468 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
5469 .writefn = zcr_write, .raw_writefn = raw_write
5470 };
5471
5472 static const ARMCPRegInfo zcr_el2_reginfo = {
5473 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
5474 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
5475 .access = PL2_RW, .type = ARM_CP_SVE,
5476 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
5477 .writefn = zcr_write, .raw_writefn = raw_write
5478 };
5479
5480 static const ARMCPRegInfo zcr_no_el2_reginfo = {
5481 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
5482 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
5483 .access = PL2_RW, .type = ARM_CP_SVE,
5484 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore
5485 };
5486
5487 static const ARMCPRegInfo zcr_el3_reginfo = {
5488 .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
5489 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
5490 .access = PL3_RW, .type = ARM_CP_SVE,
5491 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
5492 .writefn = zcr_write, .raw_writefn = raw_write
5493 };
5494
5495 void hw_watchpoint_update(ARMCPU *cpu, int n)
5496 {
5497 CPUARMState *env = &cpu->env;
5498 vaddr len = 0;
5499 vaddr wvr = env->cp15.dbgwvr[n];
5500 uint64_t wcr = env->cp15.dbgwcr[n];
5501 int mask;
5502 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
5503
5504 if (env->cpu_watchpoint[n]) {
5505 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
5506 env->cpu_watchpoint[n] = NULL;
5507 }
5508
5509 if (!extract64(wcr, 0, 1)) {
5510 /* E bit clear : watchpoint disabled */
5511 return;
5512 }
5513
5514 switch (extract64(wcr, 3, 2)) {
5515 case 0:
5516 /* LSC 00 is reserved and must behave as if the wp is disabled */
5517 return;
5518 case 1:
5519 flags |= BP_MEM_READ;
5520 break;
5521 case 2:
5522 flags |= BP_MEM_WRITE;
5523 break;
5524 case 3:
5525 flags |= BP_MEM_ACCESS;
5526 break;
5527 }
5528
5529 /* Attempts to use both MASK and BAS fields simultaneously are
5530 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
5531 * thus generating a watchpoint for every byte in the masked region.
5532 */
5533 mask = extract64(wcr, 24, 4);
5534 if (mask == 1 || mask == 2) {
5535 /* Reserved values of MASK; we must act as if the mask value was
5536 * some non-reserved value, or as if the watchpoint were disabled.
5537 * We choose the latter.
5538 */
5539 return;
5540 } else if (mask) {
5541 /* Watchpoint covers an aligned area up to 2GB in size */
5542 len = 1ULL << mask;
5543 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
5544 * whether the watchpoint fires when the unmasked bits match; we opt
5545 * to generate the exceptions.
5546 */
5547 wvr &= ~(len - 1);
5548 } else {
5549 /* Watchpoint covers bytes defined by the byte address select bits */
5550 int bas = extract64(wcr, 5, 8);
5551 int basstart;
5552
5553 if (bas == 0) {
5554 /* This must act as if the watchpoint is disabled */
5555 return;
5556 }
5557
5558 if (extract64(wvr, 2, 1)) {
5559 /* Deprecated case of an only 4-aligned address. BAS[7:4] are
5560 * ignored, and BAS[3:0] define which bytes to watch.
5561 */
5562 bas &= 0xf;
5563 }
5564 /* The BAS bits are supposed to be programmed to indicate a contiguous
5565 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
5566 * we fire for each byte in the word/doubleword addressed by the WVR.
5567 * We choose to ignore any non-zero bits after the first range of 1s.
5568 */
5569 basstart = ctz32(bas);
5570 len = cto32(bas >> basstart);
5571 wvr += basstart;
5572 }
5573
5574 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
5575 &env->cpu_watchpoint[n]);
5576 }
5577
5578 void hw_watchpoint_update_all(ARMCPU *cpu)
5579 {
5580 int i;
5581 CPUARMState *env = &cpu->env;
5582
5583 /* Completely clear out existing QEMU watchpoints and our array, to
5584 * avoid possible stale entries following migration load.
5585 */
5586 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
5587 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
5588
5589 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
5590 hw_watchpoint_update(cpu, i);
5591 }
5592 }
5593
5594 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5595 uint64_t value)
5596 {
5597 ARMCPU *cpu = env_archcpu(env);
5598 int i = ri->crm;
5599
5600 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
5601 * register reads and behaves as if values written are sign extended.
5602 * Bits [1:0] are RES0.
5603 */
5604 value = sextract64(value, 0, 49) & ~3ULL;
5605
5606 raw_write(env, ri, value);
5607 hw_watchpoint_update(cpu, i);
5608 }
5609
5610 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5611 uint64_t value)
5612 {
5613 ARMCPU *cpu = env_archcpu(env);
5614 int i = ri->crm;
5615
5616 raw_write(env, ri, value);
5617 hw_watchpoint_update(cpu, i);
5618 }
5619
5620 void hw_breakpoint_update(ARMCPU *cpu, int n)
5621 {
5622 CPUARMState *env = &cpu->env;
5623 uint64_t bvr = env->cp15.dbgbvr[n];
5624 uint64_t bcr = env->cp15.dbgbcr[n];
5625 vaddr addr;
5626 int bt;
5627 int flags = BP_CPU;
5628
5629 if (env->cpu_breakpoint[n]) {
5630 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
5631 env->cpu_breakpoint[n] = NULL;
5632 }
5633
5634 if (!extract64(bcr, 0, 1)) {
5635 /* E bit clear : watchpoint disabled */
5636 return;
5637 }
5638
5639 bt = extract64(bcr, 20, 4);
5640
5641 switch (bt) {
5642 case 4: /* unlinked address mismatch (reserved if AArch64) */
5643 case 5: /* linked address mismatch (reserved if AArch64) */
5644 qemu_log_mask(LOG_UNIMP,
5645 "arm: address mismatch breakpoint types not implemented\n");
5646 return;
5647 case 0: /* unlinked address match */
5648 case 1: /* linked address match */
5649 {
5650 /* Bits [63:49] are hardwired to the value of bit [48]; that is,
5651 * we behave as if the register was sign extended. Bits [1:0] are
5652 * RES0. The BAS field is used to allow setting breakpoints on 16
5653 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether
5654 * a bp will fire if the addresses covered by the bp and the addresses
5655 * covered by the insn overlap but the insn doesn't start at the
5656 * start of the bp address range. We choose to require the insn and
5657 * the bp to have the same address. The constraints on writing to
5658 * BAS enforced in dbgbcr_write mean we have only four cases:
5659 * 0b0000 => no breakpoint
5660 * 0b0011 => breakpoint on addr
5661 * 0b1100 => breakpoint on addr + 2
5662 * 0b1111 => breakpoint on addr
5663 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
5664 */
5665 int bas = extract64(bcr, 5, 4);
5666 addr = sextract64(bvr, 0, 49) & ~3ULL;
5667 if (bas == 0) {
5668 return;
5669 }
5670 if (bas == 0xc) {
5671 addr += 2;
5672 }
5673 break;
5674 }
5675 case 2: /* unlinked context ID match */
5676 case 8: /* unlinked VMID match (reserved if no EL2) */
5677 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
5678 qemu_log_mask(LOG_UNIMP,
5679 "arm: unlinked context breakpoint types not implemented\n");
5680 return;
5681 case 9: /* linked VMID match (reserved if no EL2) */
5682 case 11: /* linked context ID and VMID match (reserved if no EL2) */
5683 case 3: /* linked context ID match */
5684 default:
5685 /* We must generate no events for Linked context matches (unless
5686 * they are linked to by some other bp/wp, which is handled in
5687 * updates for the linking bp/wp). We choose to also generate no events
5688 * for reserved values.
5689 */
5690 return;
5691 }
5692
5693 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
5694 }
5695
5696 void hw_breakpoint_update_all(ARMCPU *cpu)
5697 {
5698 int i;
5699 CPUARMState *env = &cpu->env;
5700
5701 /* Completely clear out existing QEMU breakpoints and our array, to
5702 * avoid possible stale entries following migration load.
5703 */
5704 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
5705 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
5706
5707 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
5708 hw_breakpoint_update(cpu, i);
5709 }
5710 }
5711
5712 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5713 uint64_t value)
5714 {
5715 ARMCPU *cpu = env_archcpu(env);
5716 int i = ri->crm;
5717
5718 raw_write(env, ri, value);
5719 hw_breakpoint_update(cpu, i);
5720 }
5721
5722 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5723 uint64_t value)
5724 {
5725 ARMCPU *cpu = env_archcpu(env);
5726 int i = ri->crm;
5727
5728 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
5729 * copy of BAS[0].
5730 */
5731 value = deposit64(value, 6, 1, extract64(value, 5, 1));
5732 value = deposit64(value, 8, 1, extract64(value, 7, 1));
5733
5734 raw_write(env, ri, value);
5735 hw_breakpoint_update(cpu, i);
5736 }
5737
5738 static void define_debug_regs(ARMCPU *cpu)
5739 {
5740 /* Define v7 and v8 architectural debug registers.
5741 * These are just dummy implementations for now.
5742 */
5743 int i;
5744 int wrps, brps, ctx_cmps;
5745 ARMCPRegInfo dbgdidr = {
5746 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
5747 .access = PL0_R, .accessfn = access_tda,
5748 .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr,
5749 };
5750
5751 /* Note that all these register fields hold "number of Xs minus 1". */
5752 brps = extract32(cpu->dbgdidr, 24, 4);
5753 wrps = extract32(cpu->dbgdidr, 28, 4);
5754 ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
5755
5756 assert(ctx_cmps <= brps);
5757
5758 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties
5759 * of the debug registers such as number of breakpoints;
5760 * check that if they both exist then they agree.
5761 */
5762 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
5763 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps);
5764 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps);
5765 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps);
5766 }
5767
5768 define_one_arm_cp_reg(cpu, &dbgdidr);
5769 define_arm_cp_regs(cpu, debug_cp_reginfo);
5770
5771 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
5772 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
5773 }
5774
5775 for (i = 0; i < brps + 1; i++) {
5776 ARMCPRegInfo dbgregs[] = {
5777 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH,
5778 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
5779 .access = PL1_RW, .accessfn = access_tda,
5780 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
5781 .writefn = dbgbvr_write, .raw_writefn = raw_write
5782 },
5783 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH,
5784 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
5785 .access = PL1_RW, .accessfn = access_tda,
5786 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
5787 .writefn = dbgbcr_write, .raw_writefn = raw_write
5788 },
5789 REGINFO_SENTINEL
5790 };
5791 define_arm_cp_regs(cpu, dbgregs);
5792 }
5793
5794 for (i = 0; i < wrps + 1; i++) {
5795 ARMCPRegInfo dbgregs[] = {
5796 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH,
5797 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
5798 .access = PL1_RW, .accessfn = access_tda,
5799 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
5800 .writefn = dbgwvr_write, .raw_writefn = raw_write
5801 },
5802 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH,
5803 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
5804 .access = PL1_RW, .accessfn = access_tda,
5805 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
5806 .writefn = dbgwcr_write, .raw_writefn = raw_write
5807 },
5808 REGINFO_SENTINEL
5809 };
5810 define_arm_cp_regs(cpu, dbgregs);
5811 }
5812 }
5813
5814 /* We don't know until after realize whether there's a GICv3
5815 * attached, and that is what registers the gicv3 sysregs.
5816 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1
5817 * at runtime.
5818 */
5819 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
5820 {
5821 ARMCPU *cpu = env_archcpu(env);
5822 uint64_t pfr1 = cpu->id_pfr1;
5823
5824 if (env->gicv3state) {
5825 pfr1 |= 1 << 28;
5826 }
5827 return pfr1;
5828 }
5829
5830 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri)
5831 {
5832 ARMCPU *cpu = env_archcpu(env);
5833 uint64_t pfr0 = cpu->isar.id_aa64pfr0;
5834
5835 if (env->gicv3state) {
5836 pfr0 |= 1 << 24;
5837 }
5838 return pfr0;
5839 }
5840
5841 /* Shared logic between LORID and the rest of the LOR* registers.
5842 * Secure state has already been delt with.
5843 */
5844 static CPAccessResult access_lor_ns(CPUARMState *env)
5845 {
5846 int el = arm_current_el(env);
5847
5848 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) {
5849 return CP_ACCESS_TRAP_EL2;
5850 }
5851 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) {
5852 return CP_ACCESS_TRAP_EL3;
5853 }
5854 return CP_ACCESS_OK;
5855 }
5856
5857 static CPAccessResult access_lorid(CPUARMState *env, const ARMCPRegInfo *ri,
5858 bool isread)
5859 {
5860 if (arm_is_secure_below_el3(env)) {
5861 /* Access ok in secure mode. */
5862 return CP_ACCESS_OK;
5863 }
5864 return access_lor_ns(env);
5865 }
5866
5867 static CPAccessResult access_lor_other(CPUARMState *env,
5868 const ARMCPRegInfo *ri, bool isread)
5869 {
5870 if (arm_is_secure_below_el3(env)) {
5871 /* Access denied in secure mode. */
5872 return CP_ACCESS_TRAP;
5873 }
5874 return access_lor_ns(env);
5875 }
5876
5877 #ifdef TARGET_AARCH64
5878 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri,
5879 bool isread)
5880 {
5881 int el = arm_current_el(env);
5882
5883 if (el < 2 &&
5884 arm_feature(env, ARM_FEATURE_EL2) &&
5885 !(arm_hcr_el2_eff(env) & HCR_APK)) {
5886 return CP_ACCESS_TRAP_EL2;
5887 }
5888 if (el < 3 &&
5889 arm_feature(env, ARM_FEATURE_EL3) &&
5890 !(env->cp15.scr_el3 & SCR_APK)) {
5891 return CP_ACCESS_TRAP_EL3;
5892 }
5893 return CP_ACCESS_OK;
5894 }
5895
5896 static const ARMCPRegInfo pauth_reginfo[] = {
5897 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5898 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0,
5899 .access = PL1_RW, .accessfn = access_pauth,
5900 .fieldoffset = offsetof(CPUARMState, keys.apda.lo) },
5901 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5902 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1,
5903 .access = PL1_RW, .accessfn = access_pauth,
5904 .fieldoffset = offsetof(CPUARMState, keys.apda.hi) },
5905 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5906 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2,
5907 .access = PL1_RW, .accessfn = access_pauth,
5908 .fieldoffset = offsetof(CPUARMState, keys.apdb.lo) },
5909 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5910 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3,
5911 .access = PL1_RW, .accessfn = access_pauth,
5912 .fieldoffset = offsetof(CPUARMState, keys.apdb.hi) },
5913 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5914 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0,
5915 .access = PL1_RW, .accessfn = access_pauth,
5916 .fieldoffset = offsetof(CPUARMState, keys.apga.lo) },
5917 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5918 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1,
5919 .access = PL1_RW, .accessfn = access_pauth,
5920 .fieldoffset = offsetof(CPUARMState, keys.apga.hi) },
5921 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5922 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0,
5923 .access = PL1_RW, .accessfn = access_pauth,
5924 .fieldoffset = offsetof(CPUARMState, keys.apia.lo) },
5925 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5926 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1,
5927 .access = PL1_RW, .accessfn = access_pauth,
5928 .fieldoffset = offsetof(CPUARMState, keys.apia.hi) },
5929 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5930 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2,
5931 .access = PL1_RW, .accessfn = access_pauth,
5932 .fieldoffset = offsetof(CPUARMState, keys.apib.lo) },
5933 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5934 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3,
5935 .access = PL1_RW, .accessfn = access_pauth,
5936 .fieldoffset = offsetof(CPUARMState, keys.apib.hi) },
5937 REGINFO_SENTINEL
5938 };
5939
5940 static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
5941 {
5942 Error *err = NULL;
5943 uint64_t ret;
5944
5945 /* Success sets NZCV = 0000. */
5946 env->NF = env->CF = env->VF = 0, env->ZF = 1;
5947
5948 if (qemu_guest_getrandom(&ret, sizeof(ret), &err) < 0) {
5949 /*
5950 * ??? Failed, for unknown reasons in the crypto subsystem.
5951 * The best we can do is log the reason and return the
5952 * timed-out indication to the guest. There is no reason
5953 * we know to expect this failure to be transitory, so the
5954 * guest may well hang retrying the operation.
5955 */
5956 qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
5957 ri->name, error_get_pretty(err));
5958 error_free(err);
5959
5960 env->ZF = 0; /* NZCF = 0100 */
5961 return 0;
5962 }
5963 return ret;
5964 }
5965
5966 /* We do not support re-seeding, so the two registers operate the same. */
5967 static const ARMCPRegInfo rndr_reginfo[] = {
5968 { .name = "RNDR", .state = ARM_CP_STATE_AA64,
5969 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO,
5970 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 0,
5971 .access = PL0_R, .readfn = rndr_readfn },
5972 { .name = "RNDRRS", .state = ARM_CP_STATE_AA64,
5973 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO,
5974 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1,
5975 .access = PL0_R, .readfn = rndr_readfn },
5976 REGINFO_SENTINEL
5977 };
5978
5979 #ifndef CONFIG_USER_ONLY
5980 static void dccvap_writefn(CPUARMState *env, const ARMCPRegInfo *opaque,
5981 uint64_t value)
5982 {
5983 ARMCPU *cpu = env_archcpu(env);
5984 /* CTR_EL0 System register -> DminLine, bits [19:16] */
5985 uint64_t dline_size = 4 << ((cpu->ctr >> 16) & 0xF);
5986 uint64_t vaddr_in = (uint64_t) value;
5987 uint64_t vaddr = vaddr_in & ~(dline_size - 1);
5988 void *haddr;
5989 int mem_idx = cpu_mmu_index(env, false);
5990
5991 /* This won't be crossing page boundaries */
5992 haddr = probe_read(env, vaddr, dline_size, mem_idx, GETPC());
5993 if (haddr) {
5994
5995 ram_addr_t offset;
5996 MemoryRegion *mr;
5997
5998 /* RCU lock is already being held */
5999 mr = memory_region_from_host(haddr, &offset);
6000
6001 if (mr) {
6002 memory_region_do_writeback(mr, offset, dline_size);
6003 }
6004 }
6005 }
6006
6007 static const ARMCPRegInfo dcpop_reg[] = {
6008 { .name = "DC_CVAP", .state = ARM_CP_STATE_AA64,
6009 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 1,
6010 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END,
6011 .accessfn = aa64_cacheop_access, .writefn = dccvap_writefn },
6012 REGINFO_SENTINEL
6013 };
6014
6015 static const ARMCPRegInfo dcpodp_reg[] = {
6016 { .name = "DC_CVADP", .state = ARM_CP_STATE_AA64,
6017 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 1,
6018 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END,
6019 .accessfn = aa64_cacheop_access, .writefn = dccvap_writefn },
6020 REGINFO_SENTINEL
6021 };
6022 #endif /*CONFIG_USER_ONLY*/
6023
6024 #endif
6025
6026 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri,
6027 bool isread)
6028 {
6029 int el = arm_current_el(env);
6030
6031 if (el == 0) {
6032 uint64_t sctlr = arm_sctlr(env, el);
6033 if (!(sctlr & SCTLR_EnRCTX)) {
6034 return CP_ACCESS_TRAP;
6035 }
6036 } else if (el == 1) {
6037 uint64_t hcr = arm_hcr_el2_eff(env);
6038 if (hcr & HCR_NV) {
6039 return CP_ACCESS_TRAP_EL2;
6040 }
6041 }
6042 return CP_ACCESS_OK;
6043 }
6044
6045 static const ARMCPRegInfo predinv_reginfo[] = {
6046 { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64,
6047 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4,
6048 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
6049 { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64,
6050 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5,
6051 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
6052 { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64,
6053 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7,
6054 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
6055 /*
6056 * Note the AArch32 opcodes have a different OPC1.
6057 */
6058 { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32,
6059 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4,
6060 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
6061 { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32,
6062 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5,
6063 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
6064 { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32,
6065 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7,
6066 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
6067 REGINFO_SENTINEL
6068 };
6069
6070 static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
6071 bool isread)
6072 {
6073 if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
6074 return CP_ACCESS_TRAP_EL2;
6075 }
6076
6077 return CP_ACCESS_OK;
6078 }
6079
6080 static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
6081 bool isread)
6082 {
6083 if (arm_feature(env, ARM_FEATURE_V8)) {
6084 return access_aa64_tid3(env, ri, isread);
6085 }
6086
6087 return CP_ACCESS_OK;
6088 }
6089
6090 static CPAccessResult access_jazelle(CPUARMState *env, const ARMCPRegInfo *ri,
6091 bool isread)
6092 {
6093 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID0)) {
6094 return CP_ACCESS_TRAP_EL2;
6095 }
6096
6097 return CP_ACCESS_OK;
6098 }
6099
6100 static const ARMCPRegInfo jazelle_regs[] = {
6101 { .name = "JIDR",
6102 .cp = 14, .crn = 0, .crm = 0, .opc1 = 7, .opc2 = 0,
6103 .access = PL1_R, .accessfn = access_jazelle,
6104 .type = ARM_CP_CONST, .resetvalue = 0 },
6105 { .name = "JOSCR",
6106 .cp = 14, .crn = 1, .crm = 0, .opc1 = 7, .opc2 = 0,
6107 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
6108 { .name = "JMCR",
6109 .cp = 14, .crn = 2, .crm = 0, .opc1 = 7, .opc2 = 0,
6110 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
6111 REGINFO_SENTINEL
6112 };
6113
6114 void register_cp_regs_for_features(ARMCPU *cpu)
6115 {
6116 /* Register all the coprocessor registers based on feature bits */
6117 CPUARMState *env = &cpu->env;
6118 if (arm_feature(env, ARM_FEATURE_M)) {
6119 /* M profile has no coprocessor registers */
6120 return;
6121 }
6122
6123 define_arm_cp_regs(cpu, cp_reginfo);
6124 if (!arm_feature(env, ARM_FEATURE_V8)) {
6125 /* Must go early as it is full of wildcards that may be
6126 * overridden by later definitions.
6127 */
6128 define_arm_cp_regs(cpu, not_v8_cp_reginfo);
6129 }
6130
6131 if (arm_feature(env, ARM_FEATURE_V6)) {
6132 /* The ID registers all have impdef reset values */
6133 ARMCPRegInfo v6_idregs[] = {
6134 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
6135 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
6136 .access = PL1_R, .type = ARM_CP_CONST,
6137 .accessfn = access_aa32_tid3,
6138 .resetvalue = cpu->id_pfr0 },
6139 /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
6140 * the value of the GIC field until after we define these regs.
6141 */
6142 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
6143 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
6144 .access = PL1_R, .type = ARM_CP_NO_RAW,
6145 .accessfn = access_aa32_tid3,
6146 .readfn = id_pfr1_read,
6147 .writefn = arm_cp_write_ignore },
6148 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
6149 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
6150 .access = PL1_R, .type = ARM_CP_CONST,
6151 .accessfn = access_aa32_tid3,
6152 .resetvalue = cpu->id_dfr0 },
6153 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
6154 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
6155 .access = PL1_R, .type = ARM_CP_CONST,
6156 .accessfn = access_aa32_tid3,
6157 .resetvalue = cpu->id_afr0 },
6158 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
6159 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
6160 .access = PL1_R, .type = ARM_CP_CONST,
6161 .accessfn = access_aa32_tid3,
6162 .resetvalue = cpu->id_mmfr0 },
6163 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
6164 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
6165 .access = PL1_R, .type = ARM_CP_CONST,
6166 .accessfn = access_aa32_tid3,
6167 .resetvalue = cpu->id_mmfr1 },
6168 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
6169 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
6170 .access = PL1_R, .type = ARM_CP_CONST,
6171 .accessfn = access_aa32_tid3,
6172 .resetvalue = cpu->id_mmfr2 },
6173 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
6174 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
6175 .access = PL1_R, .type = ARM_CP_CONST,
6176 .accessfn = access_aa32_tid3,
6177 .resetvalue = cpu->id_mmfr3 },
6178 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
6179 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
6180 .access = PL1_R, .type = ARM_CP_CONST,
6181 .accessfn = access_aa32_tid3,
6182 .resetvalue = cpu->isar.id_isar0 },
6183 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
6184 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
6185 .access = PL1_R, .type = ARM_CP_CONST,
6186 .accessfn = access_aa32_tid3,
6187 .resetvalue = cpu->isar.id_isar1 },
6188 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
6189 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
6190 .access = PL1_R, .type = ARM_CP_CONST,
6191 .accessfn = access_aa32_tid3,
6192 .resetvalue = cpu->isar.id_isar2 },
6193 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
6194 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
6195 .access = PL1_R, .type = ARM_CP_CONST,
6196 .accessfn = access_aa32_tid3,
6197 .resetvalue = cpu->isar.id_isar3 },
6198 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
6199 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
6200 .access = PL1_R, .type = ARM_CP_CONST,
6201 .accessfn = access_aa32_tid3,
6202 .resetvalue = cpu->isar.id_isar4 },
6203 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
6204 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
6205 .access = PL1_R, .type = ARM_CP_CONST,
6206 .accessfn = access_aa32_tid3,
6207 .resetvalue = cpu->isar.id_isar5 },
6208 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
6209 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
6210 .access = PL1_R, .type = ARM_CP_CONST,
6211 .accessfn = access_aa32_tid3,
6212 .resetvalue = cpu->id_mmfr4 },
6213 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
6214 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
6215 .access = PL1_R, .type = ARM_CP_CONST,
6216 .accessfn = access_aa32_tid3,
6217 .resetvalue = cpu->isar.id_isar6 },
6218 REGINFO_SENTINEL
6219 };
6220 define_arm_cp_regs(cpu, v6_idregs);
6221 define_arm_cp_regs(cpu, v6_cp_reginfo);
6222 } else {
6223 define_arm_cp_regs(cpu, not_v6_cp_reginfo);
6224 }
6225 if (arm_feature(env, ARM_FEATURE_V6K)) {
6226 define_arm_cp_regs(cpu, v6k_cp_reginfo);
6227 }
6228 if (arm_feature(env, ARM_FEATURE_V7MP) &&
6229 !arm_feature(env, ARM_FEATURE_PMSA)) {
6230 define_arm_cp_regs(cpu, v7mp_cp_reginfo);
6231 }
6232 if (arm_feature(env, ARM_FEATURE_V7VE)) {
6233 define_arm_cp_regs(cpu, pmovsset_cp_reginfo);
6234 }
6235 if (arm_feature(env, ARM_FEATURE_V7)) {
6236 /* v7 performance monitor control register: same implementor
6237 * field as main ID register, and we implement four counters in
6238 * addition to the cycle count register.
6239 */
6240 unsigned int i, pmcrn = 4;
6241 ARMCPRegInfo pmcr = {
6242 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
6243 .access = PL0_RW,
6244 .type = ARM_CP_IO | ARM_CP_ALIAS,
6245 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
6246 .accessfn = pmreg_access, .writefn = pmcr_write,
6247 .raw_writefn = raw_write,
6248 };
6249 ARMCPRegInfo pmcr64 = {
6250 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
6251 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
6252 .access = PL0_RW, .accessfn = pmreg_access,
6253 .type = ARM_CP_IO,
6254 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
6255 .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT),
6256 .writefn = pmcr_write, .raw_writefn = raw_write,
6257 };
6258 define_one_arm_cp_reg(cpu, &pmcr);
6259 define_one_arm_cp_reg(cpu, &pmcr64);
6260 for (i = 0; i < pmcrn; i++) {
6261 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i);
6262 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i);
6263 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i);
6264 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i);
6265 ARMCPRegInfo pmev_regs[] = {
6266 { .name = pmevcntr_name, .cp = 15, .crn = 14,
6267 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
6268 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
6269 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
6270 .accessfn = pmreg_access },
6271 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64,
6272 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)),
6273 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
6274 .type = ARM_CP_IO,
6275 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
6276 .raw_readfn = pmevcntr_rawread,
6277 .raw_writefn = pmevcntr_rawwrite },
6278 { .name = pmevtyper_name, .cp = 15, .crn = 14,
6279 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
6280 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
6281 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
6282 .accessfn = pmreg_access },
6283 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64,
6284 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)),
6285 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
6286 .type = ARM_CP_IO,
6287 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
6288 .raw_writefn = pmevtyper_rawwrite },
6289 REGINFO_SENTINEL
6290 };
6291 define_arm_cp_regs(cpu, pmev_regs);
6292 g_free(pmevcntr_name);
6293 g_free(pmevcntr_el0_name);
6294 g_free(pmevtyper_name);
6295 g_free(pmevtyper_el0_name);
6296 }
6297 ARMCPRegInfo clidr = {
6298 .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
6299 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
6300 .access = PL1_R, .type = ARM_CP_CONST,
6301 .accessfn = access_aa64_tid2,
6302 .resetvalue = cpu->clidr
6303 };
6304 define_one_arm_cp_reg(cpu, &clidr);
6305 define_arm_cp_regs(cpu, v7_cp_reginfo);
6306 define_debug_regs(cpu);
6307 } else {
6308 define_arm_cp_regs(cpu, not_v7_cp_reginfo);
6309 }
6310 if (FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) >= 4 &&
6311 FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) != 0xf) {
6312 ARMCPRegInfo v81_pmu_regs[] = {
6313 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32,
6314 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4,
6315 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6316 .resetvalue = extract64(cpu->pmceid0, 32, 32) },
6317 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32,
6318 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5,
6319 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6320 .resetvalue = extract64(cpu->pmceid1, 32, 32) },
6321 REGINFO_SENTINEL
6322 };
6323 define_arm_cp_regs(cpu, v81_pmu_regs);
6324 }
6325 if (arm_feature(env, ARM_FEATURE_V8)) {
6326 /* AArch64 ID registers, which all have impdef reset values.
6327 * Note that within the ID register ranges the unused slots
6328 * must all RAZ, not UNDEF; future architecture versions may
6329 * define new registers here.
6330 */
6331 ARMCPRegInfo v8_idregs[] = {
6332 /* ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST because we don't
6333 * know the right value for the GIC field until after we
6334 * define these regs.
6335 */
6336 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
6337 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
6338 .access = PL1_R, .type = ARM_CP_NO_RAW,
6339 .accessfn = access_aa64_tid3,
6340 .readfn = id_aa64pfr0_read,
6341 .writefn = arm_cp_write_ignore },
6342 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
6343 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
6344 .access = PL1_R, .type = ARM_CP_CONST,
6345 .accessfn = access_aa64_tid3,
6346 .resetvalue = cpu->isar.id_aa64pfr1},
6347 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6348 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
6349 .access = PL1_R, .type = ARM_CP_CONST,
6350 .accessfn = access_aa64_tid3,
6351 .resetvalue = 0 },
6352 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6353 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
6354 .access = PL1_R, .type = ARM_CP_CONST,
6355 .accessfn = access_aa64_tid3,
6356 .resetvalue = 0 },
6357 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
6358 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
6359 .access = PL1_R, .type = ARM_CP_CONST,
6360 .accessfn = access_aa64_tid3,
6361 /* At present, only SVEver == 0 is defined anyway. */
6362 .resetvalue = 0 },
6363 { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6364 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
6365 .access = PL1_R, .type = ARM_CP_CONST,
6366 .accessfn = access_aa64_tid3,
6367 .resetvalue = 0 },
6368 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6369 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
6370 .access = PL1_R, .type = ARM_CP_CONST,
6371 .accessfn = access_aa64_tid3,
6372 .resetvalue = 0 },
6373 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6374 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
6375 .access = PL1_R, .type = ARM_CP_CONST,
6376 .accessfn = access_aa64_tid3,
6377 .resetvalue = 0 },
6378 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
6379 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
6380 .access = PL1_R, .type = ARM_CP_CONST,
6381 .accessfn = access_aa64_tid3,
6382 .resetvalue = cpu->id_aa64dfr0 },
6383 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
6384 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
6385 .access = PL1_R, .type = ARM_CP_CONST,
6386 .accessfn = access_aa64_tid3,
6387 .resetvalue = cpu->id_aa64dfr1 },
6388 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6389 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
6390 .access = PL1_R, .type = ARM_CP_CONST,
6391 .accessfn = access_aa64_tid3,
6392 .resetvalue = 0 },
6393 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6394 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
6395 .access = PL1_R, .type = ARM_CP_CONST,
6396 .accessfn = access_aa64_tid3,
6397 .resetvalue = 0 },
6398 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
6399 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
6400 .access = PL1_R, .type = ARM_CP_CONST,
6401 .accessfn = access_aa64_tid3,
6402 .resetvalue = cpu->id_aa64afr0 },
6403 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
6404 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
6405 .access = PL1_R, .type = ARM_CP_CONST,
6406 .accessfn = access_aa64_tid3,
6407 .resetvalue = cpu->id_aa64afr1 },
6408 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6409 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
6410 .access = PL1_R, .type = ARM_CP_CONST,
6411 .accessfn = access_aa64_tid3,
6412 .resetvalue = 0 },
6413 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6414 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
6415 .access = PL1_R, .type = ARM_CP_CONST,
6416 .accessfn = access_aa64_tid3,
6417 .resetvalue = 0 },
6418 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
6419 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
6420 .access = PL1_R, .type = ARM_CP_CONST,
6421 .accessfn = access_aa64_tid3,
6422 .resetvalue = cpu->isar.id_aa64isar0 },
6423 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
6424 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
6425 .access = PL1_R, .type = ARM_CP_CONST,
6426 .accessfn = access_aa64_tid3,
6427 .resetvalue = cpu->isar.id_aa64isar1 },
6428 { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6429 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
6430 .access = PL1_R, .type = ARM_CP_CONST,
6431 .accessfn = access_aa64_tid3,
6432 .resetvalue = 0 },
6433 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6434 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
6435 .access = PL1_R, .type = ARM_CP_CONST,
6436 .accessfn = access_aa64_tid3,
6437 .resetvalue = 0 },
6438 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6439 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
6440 .access = PL1_R, .type = ARM_CP_CONST,
6441 .accessfn = access_aa64_tid3,
6442 .resetvalue = 0 },
6443 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6444 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
6445 .access = PL1_R, .type = ARM_CP_CONST,
6446 .accessfn = access_aa64_tid3,
6447 .resetvalue = 0 },
6448 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6449 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
6450 .access = PL1_R, .type = ARM_CP_CONST,
6451 .accessfn = access_aa64_tid3,
6452 .resetvalue = 0 },
6453 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6454 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
6455 .access = PL1_R, .type = ARM_CP_CONST,
6456 .accessfn = access_aa64_tid3,
6457 .resetvalue = 0 },
6458 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
6459 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
6460 .access = PL1_R, .type = ARM_CP_CONST,
6461 .accessfn = access_aa64_tid3,
6462 .resetvalue = cpu->isar.id_aa64mmfr0 },
6463 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
6464 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
6465 .access = PL1_R, .type = ARM_CP_CONST,
6466 .accessfn = access_aa64_tid3,
6467 .resetvalue = cpu->isar.id_aa64mmfr1 },
6468 { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6469 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
6470 .access = PL1_R, .type = ARM_CP_CONST,
6471 .accessfn = access_aa64_tid3,
6472 .resetvalue = 0 },
6473 { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6474 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
6475 .access = PL1_R, .type = ARM_CP_CONST,
6476 .accessfn = access_aa64_tid3,
6477 .resetvalue = 0 },
6478 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6479 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
6480 .access = PL1_R, .type = ARM_CP_CONST,
6481 .accessfn = access_aa64_tid3,
6482 .resetvalue = 0 },
6483 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6484 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
6485 .access = PL1_R, .type = ARM_CP_CONST,
6486 .accessfn = access_aa64_tid3,
6487 .resetvalue = 0 },
6488 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6489 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
6490 .access = PL1_R, .type = ARM_CP_CONST,
6491 .accessfn = access_aa64_tid3,
6492 .resetvalue = 0 },
6493 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6494 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
6495 .access = PL1_R, .type = ARM_CP_CONST,
6496 .accessfn = access_aa64_tid3,
6497 .resetvalue = 0 },
6498 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
6499 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
6500 .access = PL1_R, .type = ARM_CP_CONST,
6501 .accessfn = access_aa64_tid3,
6502 .resetvalue = cpu->isar.mvfr0 },
6503 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
6504 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
6505 .access = PL1_R, .type = ARM_CP_CONST,
6506 .accessfn = access_aa64_tid3,
6507 .resetvalue = cpu->isar.mvfr1 },
6508 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
6509 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
6510 .access = PL1_R, .type = ARM_CP_CONST,
6511 .accessfn = access_aa64_tid3,
6512 .resetvalue = cpu->isar.mvfr2 },
6513 { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6514 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
6515 .access = PL1_R, .type = ARM_CP_CONST,
6516 .accessfn = access_aa64_tid3,
6517 .resetvalue = 0 },
6518 { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6519 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
6520 .access = PL1_R, .type = ARM_CP_CONST,
6521 .accessfn = access_aa64_tid3,
6522 .resetvalue = 0 },
6523 { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6524 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
6525 .access = PL1_R, .type = ARM_CP_CONST,
6526 .accessfn = access_aa64_tid3,
6527 .resetvalue = 0 },
6528 { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6529 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
6530 .access = PL1_R, .type = ARM_CP_CONST,
6531 .accessfn = access_aa64_tid3,
6532 .resetvalue = 0 },
6533 { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6534 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
6535 .access = PL1_R, .type = ARM_CP_CONST,
6536 .accessfn = access_aa64_tid3,
6537 .resetvalue = 0 },
6538 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
6539 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
6540 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6541 .resetvalue = extract64(cpu->pmceid0, 0, 32) },
6542 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64,
6543 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6,
6544 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6545 .resetvalue = cpu->pmceid0 },
6546 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32,
6547 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7,
6548 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6549 .resetvalue = extract64(cpu->pmceid1, 0, 32) },
6550 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64,
6551 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7,
6552 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6553 .resetvalue = cpu->pmceid1 },
6554 REGINFO_SENTINEL
6555 };
6556 #ifdef CONFIG_USER_ONLY
6557 ARMCPRegUserSpaceInfo v8_user_idregs[] = {
6558 { .name = "ID_AA64PFR0_EL1",
6559 .exported_bits = 0x000f000f00ff0000,
6560 .fixed_bits = 0x0000000000000011 },
6561 { .name = "ID_AA64PFR1_EL1",
6562 .exported_bits = 0x00000000000000f0 },
6563 { .name = "ID_AA64PFR*_EL1_RESERVED",
6564 .is_glob = true },
6565 { .name = "ID_AA64ZFR0_EL1" },
6566 { .name = "ID_AA64MMFR0_EL1",
6567 .fixed_bits = 0x00000000ff000000 },
6568 { .name = "ID_AA64MMFR1_EL1" },
6569 { .name = "ID_AA64MMFR*_EL1_RESERVED",
6570 .is_glob = true },
6571 { .name = "ID_AA64DFR0_EL1",
6572 .fixed_bits = 0x0000000000000006 },
6573 { .name = "ID_AA64DFR1_EL1" },
6574 { .name = "ID_AA64DFR*_EL1_RESERVED",
6575 .is_glob = true },
6576 { .name = "ID_AA64AFR*",
6577 .is_glob = true },
6578 { .name = "ID_AA64ISAR0_EL1",
6579 .exported_bits = 0x00fffffff0fffff0 },
6580 { .name = "ID_AA64ISAR1_EL1",
6581 .exported_bits = 0x000000f0ffffffff },
6582 { .name = "ID_AA64ISAR*_EL1_RESERVED",
6583 .is_glob = true },
6584 REGUSERINFO_SENTINEL
6585 };
6586 modify_arm_cp_regs(v8_idregs, v8_user_idregs);
6587 #endif
6588 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */
6589 if (!arm_feature(env, ARM_FEATURE_EL3) &&
6590 !arm_feature(env, ARM_FEATURE_EL2)) {
6591 ARMCPRegInfo rvbar = {
6592 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
6593 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
6594 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
6595 };
6596 define_one_arm_cp_reg(cpu, &rvbar);
6597 }
6598 define_arm_cp_regs(cpu, v8_idregs);
6599 define_arm_cp_regs(cpu, v8_cp_reginfo);
6600 }
6601 if (arm_feature(env, ARM_FEATURE_EL2)) {
6602 uint64_t vmpidr_def = mpidr_read_val(env);
6603 ARMCPRegInfo vpidr_regs[] = {
6604 { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
6605 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
6606 .access = PL2_RW, .accessfn = access_el3_aa32ns,
6607 .resetvalue = cpu->midr, .type = ARM_CP_ALIAS,
6608 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) },
6609 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64,
6610 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
6611 .access = PL2_RW, .resetvalue = cpu->midr,
6612 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
6613 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32,
6614 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
6615 .access = PL2_RW, .accessfn = access_el3_aa32ns,
6616 .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS,
6617 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) },
6618 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64,
6619 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
6620 .access = PL2_RW,
6621 .resetvalue = vmpidr_def,
6622 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
6623 REGINFO_SENTINEL
6624 };
6625 define_arm_cp_regs(cpu, vpidr_regs);
6626 define_arm_cp_regs(cpu, el2_cp_reginfo);
6627 if (arm_feature(env, ARM_FEATURE_V8)) {
6628 define_arm_cp_regs(cpu, el2_v8_cp_reginfo);
6629 }
6630 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */
6631 if (!arm_feature(env, ARM_FEATURE_EL3)) {
6632 ARMCPRegInfo rvbar = {
6633 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
6634 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
6635 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar
6636 };
6637 define_one_arm_cp_reg(cpu, &rvbar);
6638 }
6639 } else {
6640 /* If EL2 is missing but higher ELs are enabled, we need to
6641 * register the no_el2 reginfos.
6642 */
6643 if (arm_feature(env, ARM_FEATURE_EL3)) {
6644 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value
6645 * of MIDR_EL1 and MPIDR_EL1.
6646 */
6647 ARMCPRegInfo vpidr_regs[] = {
6648 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH,
6649 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
6650 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
6651 .type = ARM_CP_CONST, .resetvalue = cpu->midr,
6652 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
6653 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH,
6654 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
6655 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
6656 .type = ARM_CP_NO_RAW,
6657 .writefn = arm_cp_write_ignore, .readfn = mpidr_read },
6658 REGINFO_SENTINEL
6659 };
6660 define_arm_cp_regs(cpu, vpidr_regs);
6661 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo);
6662 if (arm_feature(env, ARM_FEATURE_V8)) {
6663 define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo);
6664 }
6665 }
6666 }
6667 if (arm_feature(env, ARM_FEATURE_EL3)) {
6668 define_arm_cp_regs(cpu, el3_cp_reginfo);
6669 ARMCPRegInfo el3_regs[] = {
6670 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
6671 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
6672 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar },
6673 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
6674 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
6675 .access = PL3_RW,
6676 .raw_writefn = raw_write, .writefn = sctlr_write,
6677 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]),
6678 .resetvalue = cpu->reset_sctlr },
6679 REGINFO_SENTINEL
6680 };
6681
6682 define_arm_cp_regs(cpu, el3_regs);
6683 }
6684 /* The behaviour of NSACR is sufficiently various that we don't
6685 * try to describe it in a single reginfo:
6686 * if EL3 is 64 bit, then trap to EL3 from S EL1,
6687 * reads as constant 0xc00 from NS EL1 and NS EL2
6688 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2
6689 * if v7 without EL3, register doesn't exist
6690 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2
6691 */
6692 if (arm_feature(env, ARM_FEATURE_EL3)) {
6693 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
6694 ARMCPRegInfo nsacr = {
6695 .name = "NSACR", .type = ARM_CP_CONST,
6696 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
6697 .access = PL1_RW, .accessfn = nsacr_access,
6698 .resetvalue = 0xc00
6699 };
6700 define_one_arm_cp_reg(cpu, &nsacr);
6701 } else {
6702 ARMCPRegInfo nsacr = {
6703 .name = "NSACR",
6704 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
6705 .access = PL3_RW | PL1_R,
6706 .resetvalue = 0,
6707 .fieldoffset = offsetof(CPUARMState, cp15.nsacr)
6708 };
6709 define_one_arm_cp_reg(cpu, &nsacr);
6710 }
6711 } else {
6712 if (arm_feature(env, ARM_FEATURE_V8)) {
6713 ARMCPRegInfo nsacr = {
6714 .name = "NSACR", .type = ARM_CP_CONST,
6715 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
6716 .access = PL1_R,
6717 .resetvalue = 0xc00
6718 };
6719 define_one_arm_cp_reg(cpu, &nsacr);
6720 }
6721 }
6722
6723 if (arm_feature(env, ARM_FEATURE_PMSA)) {
6724 if (arm_feature(env, ARM_FEATURE_V6)) {
6725 /* PMSAv6 not implemented */
6726 assert(arm_feature(env, ARM_FEATURE_V7));
6727 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
6728 define_arm_cp_regs(cpu, pmsav7_cp_reginfo);
6729 } else {
6730 define_arm_cp_regs(cpu, pmsav5_cp_reginfo);
6731 }
6732 } else {
6733 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
6734 define_arm_cp_regs(cpu, vmsa_cp_reginfo);
6735 /* TTCBR2 is introduced with ARMv8.2-A32HPD. */
6736 if (FIELD_EX32(cpu->id_mmfr4, ID_MMFR4, HPDS) != 0) {
6737 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo);
6738 }
6739 }
6740 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
6741 define_arm_cp_regs(cpu, t2ee_cp_reginfo);
6742 }
6743 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
6744 define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
6745 }
6746 if (arm_feature(env, ARM_FEATURE_VAPA)) {
6747 define_arm_cp_regs(cpu, vapa_cp_reginfo);
6748 }
6749 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) {
6750 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo);
6751 }
6752 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) {
6753 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo);
6754 }
6755 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) {
6756 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo);
6757 }
6758 if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
6759 define_arm_cp_regs(cpu, omap_cp_reginfo);
6760 }
6761 if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
6762 define_arm_cp_regs(cpu, strongarm_cp_reginfo);
6763 }
6764 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
6765 define_arm_cp_regs(cpu, xscale_cp_reginfo);
6766 }
6767 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
6768 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
6769 }
6770 if (arm_feature(env, ARM_FEATURE_LPAE)) {
6771 define_arm_cp_regs(cpu, lpae_cp_reginfo);
6772 }
6773 if (cpu_isar_feature(jazelle, cpu)) {
6774 define_arm_cp_regs(cpu, jazelle_regs);
6775 }
6776 /* Slightly awkwardly, the OMAP and StrongARM cores need all of
6777 * cp15 crn=0 to be writes-ignored, whereas for other cores they should
6778 * be read-only (ie write causes UNDEF exception).
6779 */
6780 {
6781 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = {
6782 /* Pre-v8 MIDR space.
6783 * Note that the MIDR isn't a simple constant register because
6784 * of the TI925 behaviour where writes to another register can
6785 * cause the MIDR value to change.
6786 *
6787 * Unimplemented registers in the c15 0 0 0 space default to
6788 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
6789 * and friends override accordingly.
6790 */
6791 { .name = "MIDR",
6792 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
6793 .access = PL1_R, .resetvalue = cpu->midr,
6794 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
6795 .readfn = midr_read,
6796 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
6797 .type = ARM_CP_OVERRIDE },
6798 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
6799 { .name = "DUMMY",
6800 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY,
6801 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6802 { .name = "DUMMY",
6803 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY,
6804 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6805 { .name = "DUMMY",
6806 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY,
6807 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6808 { .name = "DUMMY",
6809 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY,
6810 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6811 { .name = "DUMMY",
6812 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
6813 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6814 REGINFO_SENTINEL
6815 };
6816 ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
6817 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
6818 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0,
6819 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr,
6820 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
6821 .readfn = midr_read },
6822 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */
6823 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
6824 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
6825 .access = PL1_R, .resetvalue = cpu->midr },
6826 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
6827 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7,
6828 .access = PL1_R, .resetvalue = cpu->midr },
6829 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
6830 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
6831 .access = PL1_R,
6832 .accessfn = access_aa64_tid1,
6833 .type = ARM_CP_CONST, .resetvalue = cpu->revidr },
6834 REGINFO_SENTINEL
6835 };
6836 ARMCPRegInfo id_cp_reginfo[] = {
6837 /* These are common to v8 and pre-v8 */
6838 { .name = "CTR",
6839 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
6840 .access = PL1_R, .accessfn = ctr_el0_access,
6841 .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
6842 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64,
6843 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0,
6844 .access = PL0_R, .accessfn = ctr_el0_access,
6845 .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
6846 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
6847 { .name = "TCMTR",
6848 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
6849 .access = PL1_R,
6850 .accessfn = access_aa32_tid1,
6851 .type = ARM_CP_CONST, .resetvalue = 0 },
6852 REGINFO_SENTINEL
6853 };
6854 /* TLBTR is specific to VMSA */
6855 ARMCPRegInfo id_tlbtr_reginfo = {
6856 .name = "TLBTR",
6857 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
6858 .access = PL1_R,
6859 .accessfn = access_aa32_tid1,
6860 .type = ARM_CP_CONST, .resetvalue = 0,
6861 };
6862 /* MPUIR is specific to PMSA V6+ */
6863 ARMCPRegInfo id_mpuir_reginfo = {
6864 .name = "MPUIR",
6865 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
6866 .access = PL1_R, .type = ARM_CP_CONST,
6867 .resetvalue = cpu->pmsav7_dregion << 8
6868 };
6869 ARMCPRegInfo crn0_wi_reginfo = {
6870 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
6871 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
6872 .type = ARM_CP_NOP | ARM_CP_OVERRIDE
6873 };
6874 #ifdef CONFIG_USER_ONLY
6875 ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = {
6876 { .name = "MIDR_EL1",
6877 .exported_bits = 0x00000000ffffffff },
6878 { .name = "REVIDR_EL1" },
6879 REGUSERINFO_SENTINEL
6880 };
6881 modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo);
6882 #endif
6883 if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
6884 arm_feature(env, ARM_FEATURE_STRONGARM)) {
6885 ARMCPRegInfo *r;
6886 /* Register the blanket "writes ignored" value first to cover the
6887 * whole space. Then update the specific ID registers to allow write
6888 * access, so that they ignore writes rather than causing them to
6889 * UNDEF.
6890 */
6891 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
6892 for (r = id_pre_v8_midr_cp_reginfo;
6893 r->type != ARM_CP_SENTINEL; r++) {
6894 r->access = PL1_RW;
6895 }
6896 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
6897 r->access = PL1_RW;
6898 }
6899 id_mpuir_reginfo.access = PL1_RW;
6900 id_tlbtr_reginfo.access = PL1_RW;
6901 }
6902 if (arm_feature(env, ARM_FEATURE_V8)) {
6903 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
6904 } else {
6905 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
6906 }
6907 define_arm_cp_regs(cpu, id_cp_reginfo);
6908 if (!arm_feature(env, ARM_FEATURE_PMSA)) {
6909 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
6910 } else if (arm_feature(env, ARM_FEATURE_V7)) {
6911 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
6912 }
6913 }
6914
6915 if (arm_feature(env, ARM_FEATURE_MPIDR)) {
6916 ARMCPRegInfo mpidr_cp_reginfo[] = {
6917 { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH,
6918 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
6919 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
6920 REGINFO_SENTINEL
6921 };
6922 #ifdef CONFIG_USER_ONLY
6923 ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
6924 { .name = "MPIDR_EL1",
6925 .fixed_bits = 0x0000000080000000 },
6926 REGUSERINFO_SENTINEL
6927 };
6928 modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo);
6929 #endif
6930 define_arm_cp_regs(cpu, mpidr_cp_reginfo);
6931 }
6932
6933 if (arm_feature(env, ARM_FEATURE_AUXCR)) {
6934 ARMCPRegInfo auxcr_reginfo[] = {
6935 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH,
6936 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1,
6937 .access = PL1_RW, .type = ARM_CP_CONST,
6938 .resetvalue = cpu->reset_auxcr },
6939 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH,
6940 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1,
6941 .access = PL2_RW, .type = ARM_CP_CONST,
6942 .resetvalue = 0 },
6943 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64,
6944 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1,
6945 .access = PL3_RW, .type = ARM_CP_CONST,
6946 .resetvalue = 0 },
6947 REGINFO_SENTINEL
6948 };
6949 define_arm_cp_regs(cpu, auxcr_reginfo);
6950 if (arm_feature(env, ARM_FEATURE_V8)) {
6951 /* HACTLR2 maps to ACTLR_EL2[63:32] and is not in ARMv7 */
6952 ARMCPRegInfo hactlr2_reginfo = {
6953 .name = "HACTLR2", .state = ARM_CP_STATE_AA32,
6954 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3,
6955 .access = PL2_RW, .type = ARM_CP_CONST,
6956 .resetvalue = 0
6957 };
6958 define_one_arm_cp_reg(cpu, &hactlr2_reginfo);
6959 }
6960 }
6961
6962 if (arm_feature(env, ARM_FEATURE_CBAR)) {
6963 /*
6964 * CBAR is IMPDEF, but common on Arm Cortex-A implementations.
6965 * There are two flavours:
6966 * (1) older 32-bit only cores have a simple 32-bit CBAR
6967 * (2) 64-bit cores have a 64-bit CBAR visible to AArch64, plus a
6968 * 32-bit register visible to AArch32 at a different encoding
6969 * to the "flavour 1" register and with the bits rearranged to
6970 * be able to squash a 64-bit address into the 32-bit view.
6971 * We distinguish the two via the ARM_FEATURE_AARCH64 flag, but
6972 * in future if we support AArch32-only configs of some of the
6973 * AArch64 cores we might need to add a specific feature flag
6974 * to indicate cores with "flavour 2" CBAR.
6975 */
6976 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
6977 /* 32 bit view is [31:18] 0...0 [43:32]. */
6978 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
6979 | extract64(cpu->reset_cbar, 32, 12);
6980 ARMCPRegInfo cbar_reginfo[] = {
6981 { .name = "CBAR",
6982 .type = ARM_CP_CONST,
6983 .cp = 15, .crn = 15, .crm = 3, .opc1 = 1, .opc2 = 0,
6984 .access = PL1_R, .resetvalue = cbar32 },
6985 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
6986 .type = ARM_CP_CONST,
6987 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
6988 .access = PL1_R, .resetvalue = cpu->reset_cbar },
6989 REGINFO_SENTINEL
6990 };
6991 /* We don't implement a r/w 64 bit CBAR currently */
6992 assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
6993 define_arm_cp_regs(cpu, cbar_reginfo);
6994 } else {
6995 ARMCPRegInfo cbar = {
6996 .name = "CBAR",
6997 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
6998 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar,
6999 .fieldoffset = offsetof(CPUARMState,
7000 cp15.c15_config_base_address)
7001 };
7002 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
7003 cbar.access = PL1_R;
7004 cbar.fieldoffset = 0;
7005 cbar.type = ARM_CP_CONST;
7006 }
7007 define_one_arm_cp_reg(cpu, &cbar);
7008 }
7009 }
7010
7011 if (arm_feature(env, ARM_FEATURE_VBAR)) {
7012 ARMCPRegInfo vbar_cp_reginfo[] = {
7013 { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
7014 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
7015 .access = PL1_RW, .writefn = vbar_write,
7016 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s),
7017 offsetof(CPUARMState, cp15.vbar_ns) },
7018 .resetvalue = 0 },
7019 REGINFO_SENTINEL
7020 };
7021 define_arm_cp_regs(cpu, vbar_cp_reginfo);
7022 }
7023
7024 /* Generic registers whose values depend on the implementation */
7025 {
7026 ARMCPRegInfo sctlr = {
7027 .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
7028 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
7029 .access = PL1_RW,
7030 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s),
7031 offsetof(CPUARMState, cp15.sctlr_ns) },
7032 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
7033 .raw_writefn = raw_write,
7034 };
7035 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
7036 /* Normally we would always end the TB on an SCTLR write, but Linux
7037 * arch/arm/mach-pxa/sleep.S expects two instructions following
7038 * an MMU enable to execute from cache. Imitate this behaviour.
7039 */
7040 sctlr.type |= ARM_CP_SUPPRESS_TB_END;
7041 }
7042 define_one_arm_cp_reg(cpu, &sctlr);
7043 }
7044
7045 if (cpu_isar_feature(aa64_lor, cpu)) {
7046 /*
7047 * A trivial implementation of ARMv8.1-LOR leaves all of these
7048 * registers fixed at 0, which indicates that there are zero
7049 * supported Limited Ordering regions.
7050 */
7051 static const ARMCPRegInfo lor_reginfo[] = {
7052 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64,
7053 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0,
7054 .access = PL1_RW, .accessfn = access_lor_other,
7055 .type = ARM_CP_CONST, .resetvalue = 0 },
7056 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64,
7057 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1,
7058 .access = PL1_RW, .accessfn = access_lor_other,
7059 .type = ARM_CP_CONST, .resetvalue = 0 },
7060 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64,
7061 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2,
7062 .access = PL1_RW, .accessfn = access_lor_other,
7063 .type = ARM_CP_CONST, .resetvalue = 0 },
7064 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64,
7065 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3,
7066 .access = PL1_RW, .accessfn = access_lor_other,
7067 .type = ARM_CP_CONST, .resetvalue = 0 },
7068 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64,
7069 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7,
7070 .access = PL1_R, .accessfn = access_lorid,
7071 .type = ARM_CP_CONST, .resetvalue = 0 },
7072 REGINFO_SENTINEL
7073 };
7074 define_arm_cp_regs(cpu, lor_reginfo);
7075 }
7076
7077 if (cpu_isar_feature(aa64_sve, cpu)) {
7078 define_one_arm_cp_reg(cpu, &zcr_el1_reginfo);
7079 if (arm_feature(env, ARM_FEATURE_EL2)) {
7080 define_one_arm_cp_reg(cpu, &zcr_el2_reginfo);
7081 } else {
7082 define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo);
7083 }
7084 if (arm_feature(env, ARM_FEATURE_EL3)) {
7085 define_one_arm_cp_reg(cpu, &zcr_el3_reginfo);
7086 }
7087 }
7088
7089 #ifdef TARGET_AARCH64
7090 if (cpu_isar_feature(aa64_pauth, cpu)) {
7091 define_arm_cp_regs(cpu, pauth_reginfo);
7092 }
7093 if (cpu_isar_feature(aa64_rndr, cpu)) {
7094 define_arm_cp_regs(cpu, rndr_reginfo);
7095 }
7096 #ifndef CONFIG_USER_ONLY
7097 /* Data Cache clean instructions up to PoP */
7098 if (cpu_isar_feature(aa64_dcpop, cpu)) {
7099 define_one_arm_cp_reg(cpu, dcpop_reg);
7100
7101 if (cpu_isar_feature(aa64_dcpodp, cpu)) {
7102 define_one_arm_cp_reg(cpu, dcpodp_reg);
7103 }
7104 }
7105 #endif /*CONFIG_USER_ONLY*/
7106 #endif
7107
7108 /*
7109 * While all v8.0 cpus support aarch64, QEMU does have configurations
7110 * that do not set ID_AA64ISAR1, e.g. user-only qemu-arm -cpu max,
7111 * which will set ID_ISAR6.
7112 */
7113 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)
7114 ? cpu_isar_feature(aa64_predinv, cpu)
7115 : cpu_isar_feature(aa32_predinv, cpu)) {
7116 define_arm_cp_regs(cpu, predinv_reginfo);
7117 }
7118 }
7119
7120 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
7121 {
7122 CPUState *cs = CPU(cpu);
7123 CPUARMState *env = &cpu->env;
7124
7125 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
7126 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
7127 aarch64_fpu_gdb_set_reg,
7128 34, "aarch64-fpu.xml", 0);
7129 } else if (arm_feature(env, ARM_FEATURE_NEON)) {
7130 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
7131 51, "arm-neon.xml", 0);
7132 } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
7133 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
7134 35, "arm-vfp3.xml", 0);
7135 } else if (arm_feature(env, ARM_FEATURE_VFP)) {
7136 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
7137 19, "arm-vfp.xml", 0);
7138 }
7139 gdb_register_coprocessor(cs, arm_gdb_get_sysreg, arm_gdb_set_sysreg,
7140 arm_gen_dynamic_xml(cs),
7141 "system-registers.xml", 0);
7142 }
7143
7144 /* Sort alphabetically by type name, except for "any". */
7145 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b)
7146 {
7147 ObjectClass *class_a = (ObjectClass *)a;
7148 ObjectClass *class_b = (ObjectClass *)b;
7149 const char *name_a, *name_b;
7150
7151 name_a = object_class_get_name(class_a);
7152 name_b = object_class_get_name(class_b);
7153 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) {
7154 return 1;
7155 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) {
7156 return -1;
7157 } else {
7158 return strcmp(name_a, name_b);
7159 }
7160 }
7161
7162 static void arm_cpu_list_entry(gpointer data, gpointer user_data)
7163 {
7164 ObjectClass *oc = data;
7165 const char *typename;
7166 char *name;
7167
7168 typename = object_class_get_name(oc);
7169 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU));
7170 qemu_printf(" %s\n", name);
7171 g_free(name);
7172 }
7173
7174 void arm_cpu_list(void)
7175 {
7176 GSList *list;
7177
7178 list = object_class_get_list(TYPE_ARM_CPU, false);
7179 list = g_slist_sort(list, arm_cpu_list_compare);
7180 qemu_printf("Available CPUs:\n");
7181 g_slist_foreach(list, arm_cpu_list_entry, NULL);
7182 g_slist_free(list);
7183 }
7184
7185 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
7186 {
7187 ObjectClass *oc = data;
7188 CpuDefinitionInfoList **cpu_list = user_data;
7189 CpuDefinitionInfoList *entry;
7190 CpuDefinitionInfo *info;
7191 const char *typename;
7192
7193 typename = object_class_get_name(oc);
7194 info = g_malloc0(sizeof(*info));
7195 info->name = g_strndup(typename,
7196 strlen(typename) - strlen("-" TYPE_ARM_CPU));
7197 info->q_typename = g_strdup(typename);
7198
7199 entry = g_malloc0(sizeof(*entry));
7200 entry->value = info;
7201 entry->next = *cpu_list;
7202 *cpu_list = entry;
7203 }
7204
7205 CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
7206 {
7207 CpuDefinitionInfoList *cpu_list = NULL;
7208 GSList *list;
7209
7210 list = object_class_get_list(TYPE_ARM_CPU, false);
7211 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list);
7212 g_slist_free(list);
7213
7214 return cpu_list;
7215 }
7216
7217 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
7218 void *opaque, int state, int secstate,
7219 int crm, int opc1, int opc2,
7220 const char *name)
7221 {
7222 /* Private utility function for define_one_arm_cp_reg_with_opaque():
7223 * add a single reginfo struct to the hash table.
7224 */
7225 uint32_t *key = g_new(uint32_t, 1);
7226 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
7227 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
7228 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
7229
7230 r2->name = g_strdup(name);
7231 /* Reset the secure state to the specific incoming state. This is
7232 * necessary as the register may have been defined with both states.
7233 */
7234 r2->secure = secstate;
7235
7236 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
7237 /* Register is banked (using both entries in array).
7238 * Overwriting fieldoffset as the array is only used to define
7239 * banked registers but later only fieldoffset is used.
7240 */
7241 r2->fieldoffset = r->bank_fieldoffsets[ns];
7242 }
7243
7244 if (state == ARM_CP_STATE_AA32) {
7245 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
7246 /* If the register is banked then we don't need to migrate or
7247 * reset the 32-bit instance in certain cases:
7248 *
7249 * 1) If the register has both 32-bit and 64-bit instances then we
7250 * can count on the 64-bit instance taking care of the
7251 * non-secure bank.
7252 * 2) If ARMv8 is enabled then we can count on a 64-bit version
7253 * taking care of the secure bank. This requires that separate
7254 * 32 and 64-bit definitions are provided.
7255 */
7256 if ((r->state == ARM_CP_STATE_BOTH && ns) ||
7257 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) {
7258 r2->type |= ARM_CP_ALIAS;
7259 }
7260 } else if ((secstate != r->secure) && !ns) {
7261 /* The register is not banked so we only want to allow migration of
7262 * the non-secure instance.
7263 */
7264 r2->type |= ARM_CP_ALIAS;
7265 }
7266
7267 if (r->state == ARM_CP_STATE_BOTH) {
7268 /* We assume it is a cp15 register if the .cp field is left unset.
7269 */
7270 if (r2->cp == 0) {
7271 r2->cp = 15;
7272 }
7273
7274 #ifdef HOST_WORDS_BIGENDIAN
7275 if (r2->fieldoffset) {
7276 r2->fieldoffset += sizeof(uint32_t);
7277 }
7278 #endif
7279 }
7280 }
7281 if (state == ARM_CP_STATE_AA64) {
7282 /* To allow abbreviation of ARMCPRegInfo
7283 * definitions, we treat cp == 0 as equivalent to
7284 * the value for "standard guest-visible sysreg".
7285 * STATE_BOTH definitions are also always "standard
7286 * sysreg" in their AArch64 view (the .cp value may
7287 * be non-zero for the benefit of the AArch32 view).
7288 */
7289 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
7290 r2->cp = CP_REG_ARM64_SYSREG_CP;
7291 }
7292 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
7293 r2->opc0, opc1, opc2);
7294 } else {
7295 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
7296 }
7297 if (opaque) {
7298 r2->opaque = opaque;
7299 }
7300 /* reginfo passed to helpers is correct for the actual access,
7301 * and is never ARM_CP_STATE_BOTH:
7302 */
7303 r2->state = state;
7304 /* Make sure reginfo passed to helpers for wildcarded regs
7305 * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
7306 */
7307 r2->crm = crm;
7308 r2->opc1 = opc1;
7309 r2->opc2 = opc2;
7310 /* By convention, for wildcarded registers only the first
7311 * entry is used for migration; the others are marked as
7312 * ALIAS so we don't try to transfer the register
7313 * multiple times. Special registers (ie NOP/WFI) are
7314 * never migratable and not even raw-accessible.
7315 */
7316 if ((r->type & ARM_CP_SPECIAL)) {
7317 r2->type |= ARM_CP_NO_RAW;
7318 }
7319 if (((r->crm == CP_ANY) && crm != 0) ||
7320 ((r->opc1 == CP_ANY) && opc1 != 0) ||
7321 ((r->opc2 == CP_ANY) && opc2 != 0)) {
7322 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
7323 }
7324
7325 /* Check that raw accesses are either forbidden or handled. Note that
7326 * we can't assert this earlier because the setup of fieldoffset for
7327 * banked registers has to be done first.
7328 */
7329 if (!(r2->type & ARM_CP_NO_RAW)) {
7330 assert(!raw_accessors_invalid(r2));
7331 }
7332
7333 /* Overriding of an existing definition must be explicitly
7334 * requested.
7335 */
7336 if (!(r->type & ARM_CP_OVERRIDE)) {
7337 ARMCPRegInfo *oldreg;
7338 oldreg = g_hash_table_lookup(cpu->cp_regs, key);
7339 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
7340 fprintf(stderr, "Register redefined: cp=%d %d bit "
7341 "crn=%d crm=%d opc1=%d opc2=%d, "
7342 "was %s, now %s\n", r2->cp, 32 + 32 * is64,
7343 r2->crn, r2->crm, r2->opc1, r2->opc2,
7344 oldreg->name, r2->name);
7345 g_assert_not_reached();
7346 }
7347 }
7348 g_hash_table_insert(cpu->cp_regs, key, r2);
7349 }
7350
7351
7352 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
7353 const ARMCPRegInfo *r, void *opaque)
7354 {
7355 /* Define implementations of coprocessor registers.
7356 * We store these in a hashtable because typically
7357 * there are less than 150 registers in a space which
7358 * is 16*16*16*8*8 = 262144 in size.
7359 * Wildcarding is supported for the crm, opc1 and opc2 fields.
7360 * If a register is defined twice then the second definition is
7361 * used, so this can be used to define some generic registers and
7362 * then override them with implementation specific variations.
7363 * At least one of the original and the second definition should
7364 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard
7365 * against accidental use.
7366 *
7367 * The state field defines whether the register is to be
7368 * visible in the AArch32 or AArch64 execution state. If the
7369 * state is set to ARM_CP_STATE_BOTH then we synthesise a
7370 * reginfo structure for the AArch32 view, which sees the lower
7371 * 32 bits of the 64 bit register.
7372 *
7373 * Only registers visible in AArch64 may set r->opc0; opc0 cannot
7374 * be wildcarded. AArch64 registers are always considered to be 64
7375 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
7376 * the register, if any.
7377 */
7378 int crm, opc1, opc2, state;
7379 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
7380 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
7381 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
7382 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
7383 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
7384 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
7385 /* 64 bit registers have only CRm and Opc1 fields */
7386 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
7387 /* op0 only exists in the AArch64 encodings */
7388 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0));
7389 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
7390 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT));
7391 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1
7392 * encodes a minimum access level for the register. We roll this
7393 * runtime check into our general permission check code, so check
7394 * here that the reginfo's specified permissions are strict enough
7395 * to encompass the generic architectural permission check.
7396 */
7397 if (r->state != ARM_CP_STATE_AA32) {
7398 int mask = 0;
7399 switch (r->opc1) {
7400 case 0:
7401 /* min_EL EL1, but some accessible to EL0 via kernel ABI */
7402 mask = PL0U_R | PL1_RW;
7403 break;
7404 case 1: case 2:
7405 /* min_EL EL1 */
7406 mask = PL1_RW;
7407 break;
7408 case 3:
7409 /* min_EL EL0 */
7410 mask = PL0_RW;
7411 break;
7412 case 4:
7413 /* min_EL EL2 */
7414 mask = PL2_RW;
7415 break;
7416 case 5:
7417 /* unallocated encoding, so not possible */
7418 assert(false);
7419 break;
7420 case 6:
7421 /* min_EL EL3 */
7422 mask = PL3_RW;
7423 break;
7424 case 7:
7425 /* min_EL EL1, secure mode only (we don't check the latter) */
7426 mask = PL1_RW;
7427 break;
7428 default:
7429 /* broken reginfo with out-of-range opc1 */
7430 assert(false);
7431 break;
7432 }
7433 /* assert our permissions are not too lax (stricter is fine) */
7434 assert((r->access & ~mask) == 0);
7435 }
7436
7437 /* Check that the register definition has enough info to handle
7438 * reads and writes if they are permitted.
7439 */
7440 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) {
7441 if (r->access & PL3_R) {
7442 assert((r->fieldoffset ||
7443 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
7444 r->readfn);
7445 }
7446 if (r->access & PL3_W) {
7447 assert((r->fieldoffset ||
7448 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
7449 r->writefn);
7450 }
7451 }
7452 /* Bad type field probably means missing sentinel at end of reg list */
7453 assert(cptype_valid(r->type));
7454 for (crm = crmmin; crm <= crmmax; crm++) {
7455 for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
7456 for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
7457 for (state = ARM_CP_STATE_AA32;
7458 state <= ARM_CP_STATE_AA64; state++) {
7459 if (r->state != state && r->state != ARM_CP_STATE_BOTH) {
7460 continue;
7461 }
7462 if (state == ARM_CP_STATE_AA32) {
7463 /* Under AArch32 CP registers can be common
7464 * (same for secure and non-secure world) or banked.
7465 */
7466 char *name;
7467
7468 switch (r->secure) {
7469 case ARM_CP_SECSTATE_S:
7470 case ARM_CP_SECSTATE_NS:
7471 add_cpreg_to_hashtable(cpu, r, opaque, state,
7472 r->secure, crm, opc1, opc2,
7473 r->name);
7474 break;
7475 default:
7476 name = g_strdup_printf("%s_S", r->name);
7477 add_cpreg_to_hashtable(cpu, r, opaque, state,
7478 ARM_CP_SECSTATE_S,
7479 crm, opc1, opc2, name);
7480 g_free(name);
7481 add_cpreg_to_hashtable(cpu, r, opaque, state,
7482 ARM_CP_SECSTATE_NS,
7483 crm, opc1, opc2, r->name);
7484 break;
7485 }
7486 } else {
7487 /* AArch64 registers get mapped to non-secure instance
7488 * of AArch32 */
7489 add_cpreg_to_hashtable(cpu, r, opaque, state,
7490 ARM_CP_SECSTATE_NS,
7491 crm, opc1, opc2, r->name);
7492 }
7493 }
7494 }
7495 }
7496 }
7497 }
7498
7499 void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
7500 const ARMCPRegInfo *regs, void *opaque)
7501 {
7502 /* Define a whole list of registers */
7503 const ARMCPRegInfo *r;
7504 for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
7505 define_one_arm_cp_reg_with_opaque(cpu, r, opaque);
7506 }
7507 }
7508
7509 /*
7510 * Modify ARMCPRegInfo for access from userspace.
7511 *
7512 * This is a data driven modification directed by
7513 * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as
7514 * user-space cannot alter any values and dynamic values pertaining to
7515 * execution state are hidden from user space view anyway.
7516 */
7517 void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods)
7518 {
7519 const ARMCPRegUserSpaceInfo *m;
7520 ARMCPRegInfo *r;
7521
7522 for (m = mods; m->name; m++) {
7523 GPatternSpec *pat = NULL;
7524 if (m->is_glob) {
7525 pat = g_pattern_spec_new(m->name);
7526 }
7527 for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
7528 if (pat && g_pattern_match_string(pat, r->name)) {
7529 r->type = ARM_CP_CONST;
7530 r->access = PL0U_R;
7531 r->resetvalue = 0;
7532 /* continue */
7533 } else if (strcmp(r->name, m->name) == 0) {
7534 r->type = ARM_CP_CONST;
7535 r->access = PL0U_R;
7536 r->resetvalue &= m->exported_bits;
7537 r->resetvalue |= m->fixed_bits;
7538 break;
7539 }
7540 }
7541 if (pat) {
7542 g_pattern_spec_free(pat);
7543 }
7544 }
7545 }
7546
7547 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
7548 {
7549 return g_hash_table_lookup(cpregs, &encoded_cp);
7550 }
7551
7552 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
7553 uint64_t value)
7554 {
7555 /* Helper coprocessor write function for write-ignore registers */
7556 }
7557
7558 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri)
7559 {
7560 /* Helper coprocessor write function for read-as-zero registers */
7561 return 0;
7562 }
7563
7564 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque)
7565 {
7566 /* Helper coprocessor reset function for do-nothing-on-reset registers */
7567 }
7568
7569 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type)
7570 {
7571 /* Return true if it is not valid for us to switch to
7572 * this CPU mode (ie all the UNPREDICTABLE cases in
7573 * the ARM ARM CPSRWriteByInstr pseudocode).
7574 */
7575
7576 /* Changes to or from Hyp via MSR and CPS are illegal. */
7577 if (write_type == CPSRWriteByInstr &&
7578 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP ||
7579 mode == ARM_CPU_MODE_HYP)) {
7580 return 1;
7581 }
7582
7583 switch (mode) {
7584 case ARM_CPU_MODE_USR:
7585 return 0;
7586 case ARM_CPU_MODE_SYS:
7587 case ARM_CPU_MODE_SVC:
7588 case ARM_CPU_MODE_ABT:
7589 case ARM_CPU_MODE_UND:
7590 case ARM_CPU_MODE_IRQ:
7591 case ARM_CPU_MODE_FIQ:
7592 /* Note that we don't implement the IMPDEF NSACR.RFR which in v7
7593 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.)
7594 */
7595 /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR
7596 * and CPS are treated as illegal mode changes.
7597 */
7598 if (write_type == CPSRWriteByInstr &&
7599 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON &&
7600 (arm_hcr_el2_eff(env) & HCR_TGE)) {
7601 return 1;
7602 }
7603 return 0;
7604 case ARM_CPU_MODE_HYP:
7605 return !arm_feature(env, ARM_FEATURE_EL2)
7606 || arm_current_el(env) < 2 || arm_is_secure_below_el3(env);
7607 case ARM_CPU_MODE_MON:
7608 return arm_current_el(env) < 3;
7609 default:
7610 return 1;
7611 }
7612 }
7613
7614 uint32_t cpsr_read(CPUARMState *env)
7615 {
7616 int ZF;
7617 ZF = (env->ZF == 0);
7618 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
7619 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
7620 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
7621 | ((env->condexec_bits & 0xfc) << 8)
7622 | (env->GE << 16) | (env->daif & CPSR_AIF);
7623 }
7624
7625 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask,
7626 CPSRWriteType write_type)
7627 {
7628 uint32_t changed_daif;
7629
7630 if (mask & CPSR_NZCV) {
7631 env->ZF = (~val) & CPSR_Z;
7632 env->NF = val;
7633 env->CF = (val >> 29) & 1;
7634 env->VF = (val << 3) & 0x80000000;
7635 }
7636 if (mask & CPSR_Q)
7637 env->QF = ((val & CPSR_Q) != 0);
7638 if (mask & CPSR_T)
7639 env->thumb = ((val & CPSR_T) != 0);
7640 if (mask & CPSR_IT_0_1) {
7641 env->condexec_bits &= ~3;
7642 env->condexec_bits |= (val >> 25) & 3;
7643 }
7644 if (mask & CPSR_IT_2_7) {
7645 env->condexec_bits &= 3;
7646 env->condexec_bits |= (val >> 8) & 0xfc;
7647 }
7648 if (mask & CPSR_GE) {
7649 env->GE = (val >> 16) & 0xf;
7650 }
7651
7652 /* In a V7 implementation that includes the security extensions but does
7653 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control
7654 * whether non-secure software is allowed to change the CPSR_F and CPSR_A
7655 * bits respectively.
7656 *
7657 * In a V8 implementation, it is permitted for privileged software to
7658 * change the CPSR A/F bits regardless of the SCR.AW/FW bits.
7659 */
7660 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) &&
7661 arm_feature(env, ARM_FEATURE_EL3) &&
7662 !arm_feature(env, ARM_FEATURE_EL2) &&
7663 !arm_is_secure(env)) {
7664
7665 changed_daif = (env->daif ^ val) & mask;
7666
7667 if (changed_daif & CPSR_A) {
7668 /* Check to see if we are allowed to change the masking of async
7669 * abort exceptions from a non-secure state.
7670 */
7671 if (!(env->cp15.scr_el3 & SCR_AW)) {
7672 qemu_log_mask(LOG_GUEST_ERROR,
7673 "Ignoring attempt to switch CPSR_A flag from "
7674 "non-secure world with SCR.AW bit clear\n");
7675 mask &= ~CPSR_A;
7676 }
7677 }
7678
7679 if (changed_daif & CPSR_F) {
7680 /* Check to see if we are allowed to change the masking of FIQ
7681 * exceptions from a non-secure state.
7682 */
7683 if (!(env->cp15.scr_el3 & SCR_FW)) {
7684 qemu_log_mask(LOG_GUEST_ERROR,
7685 "Ignoring attempt to switch CPSR_F flag from "
7686 "non-secure world with SCR.FW bit clear\n");
7687 mask &= ~CPSR_F;
7688 }
7689
7690 /* Check whether non-maskable FIQ (NMFI) support is enabled.
7691 * If this bit is set software is not allowed to mask
7692 * FIQs, but is allowed to set CPSR_F to 0.
7693 */
7694 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) &&
7695 (val & CPSR_F)) {
7696 qemu_log_mask(LOG_GUEST_ERROR,
7697 "Ignoring attempt to enable CPSR_F flag "
7698 "(non-maskable FIQ [NMFI] support enabled)\n");
7699 mask &= ~CPSR_F;
7700 }
7701 }
7702 }
7703
7704 env->daif &= ~(CPSR_AIF & mask);
7705 env->daif |= val & CPSR_AIF & mask;
7706
7707 if (write_type != CPSRWriteRaw &&
7708 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) {
7709 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) {
7710 /* Note that we can only get here in USR mode if this is a
7711 * gdb stub write; for this case we follow the architectural
7712 * behaviour for guest writes in USR mode of ignoring an attempt
7713 * to switch mode. (Those are caught by translate.c for writes
7714 * triggered by guest instructions.)
7715 */
7716 mask &= ~CPSR_M;
7717 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) {
7718 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in
7719 * v7, and has defined behaviour in v8:
7720 * + leave CPSR.M untouched
7721 * + allow changes to the other CPSR fields
7722 * + set PSTATE.IL
7723 * For user changes via the GDB stub, we don't set PSTATE.IL,
7724 * as this would be unnecessarily harsh for a user error.
7725 */
7726 mask &= ~CPSR_M;
7727 if (write_type != CPSRWriteByGDBStub &&
7728 arm_feature(env, ARM_FEATURE_V8)) {
7729 mask |= CPSR_IL;
7730 val |= CPSR_IL;
7731 }
7732 qemu_log_mask(LOG_GUEST_ERROR,
7733 "Illegal AArch32 mode switch attempt from %s to %s\n",
7734 aarch32_mode_name(env->uncached_cpsr),
7735 aarch32_mode_name(val));
7736 } else {
7737 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n",
7738 write_type == CPSRWriteExceptionReturn ?
7739 "Exception return from AArch32" :
7740 "AArch32 mode switch from",
7741 aarch32_mode_name(env->uncached_cpsr),
7742 aarch32_mode_name(val), env->regs[15]);
7743 switch_mode(env, val & CPSR_M);
7744 }
7745 }
7746 mask &= ~CACHED_CPSR_BITS;
7747 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
7748 }
7749
7750 /* Sign/zero extend */
7751 uint32_t HELPER(sxtb16)(uint32_t x)
7752 {
7753 uint32_t res;
7754 res = (uint16_t)(int8_t)x;
7755 res |= (uint32_t)(int8_t)(x >> 16) << 16;
7756 return res;
7757 }
7758
7759 uint32_t HELPER(uxtb16)(uint32_t x)
7760 {
7761 uint32_t res;
7762 res = (uint16_t)(uint8_t)x;
7763 res |= (uint32_t)(uint8_t)(x >> 16) << 16;
7764 return res;
7765 }
7766
7767 int32_t HELPER(sdiv)(int32_t num, int32_t den)
7768 {
7769 if (den == 0)
7770 return 0;
7771 if (num == INT_MIN && den == -1)
7772 return INT_MIN;
7773 return num / den;
7774 }
7775
7776 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
7777 {
7778 if (den == 0)
7779 return 0;
7780 return num / den;
7781 }
7782
7783 uint32_t HELPER(rbit)(uint32_t x)
7784 {
7785 return revbit32(x);
7786 }
7787
7788 #ifdef CONFIG_USER_ONLY
7789
7790 static void switch_mode(CPUARMState *env, int mode)
7791 {
7792 ARMCPU *cpu = env_archcpu(env);
7793
7794 if (mode != ARM_CPU_MODE_USR) {
7795 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n");
7796 }
7797 }
7798
7799 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
7800 uint32_t cur_el, bool secure)
7801 {
7802 return 1;
7803 }
7804
7805 void aarch64_sync_64_to_32(CPUARMState *env)
7806 {
7807 g_assert_not_reached();
7808 }
7809
7810 #else
7811
7812 static void switch_mode(CPUARMState *env, int mode)
7813 {
7814 int old_mode;
7815 int i;
7816
7817 old_mode = env->uncached_cpsr & CPSR_M;
7818 if (mode == old_mode)
7819 return;
7820
7821 if (old_mode == ARM_CPU_MODE_FIQ) {
7822 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
7823 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
7824 } else if (mode == ARM_CPU_MODE_FIQ) {
7825 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
7826 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
7827 }
7828
7829 i = bank_number(old_mode);
7830 env->banked_r13[i] = env->regs[13];
7831 env->banked_spsr[i] = env->spsr;
7832
7833 i = bank_number(mode);
7834 env->regs[13] = env->banked_r13[i];
7835 env->spsr = env->banked_spsr[i];
7836
7837 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14];
7838 env->regs[14] = env->banked_r14[r14_bank_number(mode)];
7839 }
7840
7841 /* Physical Interrupt Target EL Lookup Table
7842 *
7843 * [ From ARM ARM section G1.13.4 (Table G1-15) ]
7844 *
7845 * The below multi-dimensional table is used for looking up the target
7846 * exception level given numerous condition criteria. Specifically, the
7847 * target EL is based on SCR and HCR routing controls as well as the
7848 * currently executing EL and secure state.
7849 *
7850 * Dimensions:
7851 * target_el_table[2][2][2][2][2][4]
7852 * | | | | | +--- Current EL
7853 * | | | | +------ Non-secure(0)/Secure(1)
7854 * | | | +--------- HCR mask override
7855 * | | +------------ SCR exec state control
7856 * | +--------------- SCR mask override
7857 * +------------------ 32-bit(0)/64-bit(1) EL3
7858 *
7859 * The table values are as such:
7860 * 0-3 = EL0-EL3
7861 * -1 = Cannot occur
7862 *
7863 * The ARM ARM target EL table includes entries indicating that an "exception
7864 * is not taken". The two cases where this is applicable are:
7865 * 1) An exception is taken from EL3 but the SCR does not have the exception
7866 * routed to EL3.
7867 * 2) An exception is taken from EL2 but the HCR does not have the exception
7868 * routed to EL2.
7869 * In these two cases, the below table contain a target of EL1. This value is
7870 * returned as it is expected that the consumer of the table data will check
7871 * for "target EL >= current EL" to ensure the exception is not taken.
7872 *
7873 * SCR HCR
7874 * 64 EA AMO From
7875 * BIT IRQ IMO Non-secure Secure
7876 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3
7877 */
7878 static const int8_t target_el_table[2][2][2][2][2][4] = {
7879 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
7880 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},
7881 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
7882 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},},
7883 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
7884 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},
7885 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
7886 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},},
7887 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },},
7888 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},
7889 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },},
7890 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},},
7891 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
7892 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},
7893 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
7894 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},},
7895 };
7896
7897 /*
7898 * Determine the target EL for physical exceptions
7899 */
7900 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
7901 uint32_t cur_el, bool secure)
7902 {
7903 CPUARMState *env = cs->env_ptr;
7904 bool rw;
7905 bool scr;
7906 bool hcr;
7907 int target_el;
7908 /* Is the highest EL AArch64? */
7909 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64);
7910 uint64_t hcr_el2;
7911
7912 if (arm_feature(env, ARM_FEATURE_EL3)) {
7913 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
7914 } else {
7915 /* Either EL2 is the highest EL (and so the EL2 register width
7916 * is given by is64); or there is no EL2 or EL3, in which case
7917 * the value of 'rw' does not affect the table lookup anyway.
7918 */
7919 rw = is64;
7920 }
7921
7922 hcr_el2 = arm_hcr_el2_eff(env);
7923 switch (excp_idx) {
7924 case EXCP_IRQ:
7925 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ);
7926 hcr = hcr_el2 & HCR_IMO;
7927 break;
7928 case EXCP_FIQ:
7929 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ);
7930 hcr = hcr_el2 & HCR_FMO;
7931 break;
7932 default:
7933 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA);
7934 hcr = hcr_el2 & HCR_AMO;
7935 break;
7936 };
7937
7938 /* Perform a table-lookup for the target EL given the current state */
7939 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el];
7940
7941 assert(target_el > 0);
7942
7943 return target_el;
7944 }
7945
7946 void arm_log_exception(int idx)
7947 {
7948 if (qemu_loglevel_mask(CPU_LOG_INT)) {
7949 const char *exc = NULL;
7950 static const char * const excnames[] = {
7951 [EXCP_UDEF] = "Undefined Instruction",
7952 [EXCP_SWI] = "SVC",
7953 [EXCP_PREFETCH_ABORT] = "Prefetch Abort",
7954 [EXCP_DATA_ABORT] = "Data Abort",
7955 [EXCP_IRQ] = "IRQ",
7956 [EXCP_FIQ] = "FIQ",
7957 [EXCP_BKPT] = "Breakpoint",
7958 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit",
7959 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage",
7960 [EXCP_HVC] = "Hypervisor Call",
7961 [EXCP_HYP_TRAP] = "Hypervisor Trap",
7962 [EXCP_SMC] = "Secure Monitor Call",
7963 [EXCP_VIRQ] = "Virtual IRQ",
7964 [EXCP_VFIQ] = "Virtual FIQ",
7965 [EXCP_SEMIHOST] = "Semihosting call",
7966 [EXCP_NOCP] = "v7M NOCP UsageFault",
7967 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault",
7968 [EXCP_STKOF] = "v8M STKOF UsageFault",
7969 [EXCP_LAZYFP] = "v7M exception during lazy FP stacking",
7970 [EXCP_LSERR] = "v8M LSERR UsageFault",
7971 [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault",
7972 };
7973
7974 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
7975 exc = excnames[idx];
7976 }
7977 if (!exc) {
7978 exc = "unknown";
7979 }
7980 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc);
7981 }
7982 }
7983
7984 /*
7985 * Function used to synchronize QEMU's AArch64 register set with AArch32
7986 * register set. This is necessary when switching between AArch32 and AArch64
7987 * execution state.
7988 */
7989 void aarch64_sync_32_to_64(CPUARMState *env)
7990 {
7991 int i;
7992 uint32_t mode = env->uncached_cpsr & CPSR_M;
7993
7994 /* We can blanket copy R[0:7] to X[0:7] */
7995 for (i = 0; i < 8; i++) {
7996 env->xregs[i] = env->regs[i];
7997 }
7998
7999 /*
8000 * Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12.
8001 * Otherwise, they come from the banked user regs.
8002 */
8003 if (mode == ARM_CPU_MODE_FIQ) {
8004 for (i = 8; i < 13; i++) {
8005 env->xregs[i] = env->usr_regs[i - 8];
8006 }
8007 } else {
8008 for (i = 8; i < 13; i++) {
8009 env->xregs[i] = env->regs[i];
8010 }
8011 }
8012
8013 /*
8014 * Registers x13-x23 are the various mode SP and FP registers. Registers
8015 * r13 and r14 are only copied if we are in that mode, otherwise we copy
8016 * from the mode banked register.
8017 */
8018 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
8019 env->xregs[13] = env->regs[13];
8020 env->xregs[14] = env->regs[14];
8021 } else {
8022 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)];
8023 /* HYP is an exception in that it is copied from r14 */
8024 if (mode == ARM_CPU_MODE_HYP) {
8025 env->xregs[14] = env->regs[14];
8026 } else {
8027 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)];
8028 }
8029 }
8030
8031 if (mode == ARM_CPU_MODE_HYP) {
8032 env->xregs[15] = env->regs[13];
8033 } else {
8034 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)];
8035 }
8036
8037 if (mode == ARM_CPU_MODE_IRQ) {
8038 env->xregs[16] = env->regs[14];
8039 env->xregs[17] = env->regs[13];
8040 } else {
8041 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)];
8042 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)];
8043 }
8044
8045 if (mode == ARM_CPU_MODE_SVC) {
8046 env->xregs[18] = env->regs[14];
8047 env->xregs[19] = env->regs[13];
8048 } else {
8049 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)];
8050 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)];
8051 }
8052
8053 if (mode == ARM_CPU_MODE_ABT) {
8054 env->xregs[20] = env->regs[14];
8055 env->xregs[21] = env->regs[13];
8056 } else {
8057 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)];
8058 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)];
8059 }
8060
8061 if (mode == ARM_CPU_MODE_UND) {
8062 env->xregs[22] = env->regs[14];
8063 env->xregs[23] = env->regs[13];
8064 } else {
8065 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)];
8066 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)];
8067 }
8068
8069 /*
8070 * Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
8071 * mode, then we can copy from r8-r14. Otherwise, we copy from the
8072 * FIQ bank for r8-r14.
8073 */
8074 if (mode == ARM_CPU_MODE_FIQ) {
8075 for (i = 24; i < 31; i++) {
8076 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */
8077 }
8078 } else {
8079 for (i = 24; i < 29; i++) {
8080 env->xregs[i] = env->fiq_regs[i - 24];
8081 }
8082 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)];
8083 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)];
8084 }
8085
8086 env->pc = env->regs[15];
8087 }
8088
8089 /*
8090 * Function used to synchronize QEMU's AArch32 register set with AArch64
8091 * register set. This is necessary when switching between AArch32 and AArch64
8092 * execution state.
8093 */
8094 void aarch64_sync_64_to_32(CPUARMState *env)
8095 {
8096 int i;
8097 uint32_t mode = env->uncached_cpsr & CPSR_M;
8098
8099 /* We can blanket copy X[0:7] to R[0:7] */
8100 for (i = 0; i < 8; i++) {
8101 env->regs[i] = env->xregs[i];
8102 }
8103
8104 /*
8105 * Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12.
8106 * Otherwise, we copy x8-x12 into the banked user regs.
8107 */
8108 if (mode == ARM_CPU_MODE_FIQ) {
8109 for (i = 8; i < 13; i++) {
8110 env->usr_regs[i - 8] = env->xregs[i];
8111 }
8112 } else {
8113 for (i = 8; i < 13; i++) {
8114 env->regs[i] = env->xregs[i];
8115 }
8116 }
8117
8118 /*
8119 * Registers r13 & r14 depend on the current mode.
8120 * If we are in a given mode, we copy the corresponding x registers to r13
8121 * and r14. Otherwise, we copy the x register to the banked r13 and r14
8122 * for the mode.
8123 */
8124 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
8125 env->regs[13] = env->xregs[13];
8126 env->regs[14] = env->xregs[14];
8127 } else {
8128 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13];
8129
8130 /*
8131 * HYP is an exception in that it does not have its own banked r14 but
8132 * shares the USR r14
8133 */
8134 if (mode == ARM_CPU_MODE_HYP) {
8135 env->regs[14] = env->xregs[14];
8136 } else {
8137 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
8138 }
8139 }
8140
8141 if (mode == ARM_CPU_MODE_HYP) {
8142 env->regs[13] = env->xregs[15];
8143 } else {
8144 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15];
8145 }
8146
8147 if (mode == ARM_CPU_MODE_IRQ) {
8148 env->regs[14] = env->xregs[16];
8149 env->regs[13] = env->xregs[17];
8150 } else {
8151 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
8152 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17];
8153 }
8154
8155 if (mode == ARM_CPU_MODE_SVC) {
8156 env->regs[14] = env->xregs[18];
8157 env->regs[13] = env->xregs[19];
8158 } else {
8159 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
8160 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19];
8161 }
8162
8163 if (mode == ARM_CPU_MODE_ABT) {
8164 env->regs[14] = env->xregs[20];
8165 env->regs[13] = env->xregs[21];
8166 } else {
8167 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
8168 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21];
8169 }
8170
8171 if (mode == ARM_CPU_MODE_UND) {
8172 env->regs[14] = env->xregs[22];
8173 env->regs[13] = env->xregs[23];
8174 } else {
8175 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
8176 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23];
8177 }
8178
8179 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
8180 * mode, then we can copy to r8-r14. Otherwise, we copy to the
8181 * FIQ bank for r8-r14.
8182 */
8183 if (mode == ARM_CPU_MODE_FIQ) {
8184 for (i = 24; i < 31; i++) {
8185 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */
8186 }
8187 } else {
8188 for (i = 24; i < 29; i++) {
8189 env->fiq_regs[i - 24] = env->xregs[i];
8190 }
8191 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29];
8192 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
8193 }
8194
8195 env->regs[15] = env->pc;
8196 }
8197
8198 static void take_aarch32_exception(CPUARMState *env, int new_mode,
8199 uint32_t mask, uint32_t offset,
8200 uint32_t newpc)
8201 {
8202 /* Change the CPU state so as to actually take the exception. */
8203 switch_mode(env, new_mode);
8204 /*
8205 * For exceptions taken to AArch32 we must clear the SS bit in both
8206 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.
8207 */
8208 env->uncached_cpsr &= ~PSTATE_SS;
8209 env->spsr = cpsr_read(env);
8210 /* Clear IT bits. */
8211 env->condexec_bits = 0;
8212 /* Switch to the new mode, and to the correct instruction set. */
8213 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
8214 /* Set new mode endianness */
8215 env->uncached_cpsr &= ~CPSR_E;
8216 if (env->cp15.sctlr_el[arm_current_el(env)] & SCTLR_EE) {
8217 env->uncached_cpsr |= CPSR_E;
8218 }
8219 /* J and IL must always be cleared for exception entry */
8220 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J);
8221 env->daif |= mask;
8222
8223 if (new_mode == ARM_CPU_MODE_HYP) {
8224 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0;
8225 env->elr_el[2] = env->regs[15];
8226 } else {
8227 /*
8228 * this is a lie, as there was no c1_sys on V4T/V5, but who cares
8229 * and we should just guard the thumb mode on V4
8230 */
8231 if (arm_feature(env, ARM_FEATURE_V4T)) {
8232 env->thumb =
8233 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0;
8234 }
8235 env->regs[14] = env->regs[15] + offset;
8236 }
8237 env->regs[15] = newpc;
8238 arm_rebuild_hflags(env);
8239 }
8240
8241 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
8242 {
8243 /*
8244 * Handle exception entry to Hyp mode; this is sufficiently
8245 * different to entry to other AArch32 modes that we handle it
8246 * separately here.
8247 *
8248 * The vector table entry used is always the 0x14 Hyp mode entry point,
8249 * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp.
8250 * The offset applied to the preferred return address is always zero
8251 * (see DDI0487C.a section G1.12.3).
8252 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values.
8253 */
8254 uint32_t addr, mask;
8255 ARMCPU *cpu = ARM_CPU(cs);
8256 CPUARMState *env = &cpu->env;
8257
8258 switch (cs->exception_index) {
8259 case EXCP_UDEF:
8260 addr = 0x04;
8261 break;
8262 case EXCP_SWI:
8263 addr = 0x14;
8264 break;
8265 case EXCP_BKPT:
8266 /* Fall through to prefetch abort. */
8267 case EXCP_PREFETCH_ABORT:
8268 env->cp15.ifar_s = env->exception.vaddress;
8269 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n",
8270 (uint32_t)env->exception.vaddress);
8271 addr = 0x0c;
8272 break;
8273 case EXCP_DATA_ABORT:
8274 env->cp15.dfar_s = env->exception.vaddress;
8275 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n",
8276 (uint32_t)env->exception.vaddress);
8277 addr = 0x10;
8278 break;
8279 case EXCP_IRQ:
8280 addr = 0x18;
8281 break;
8282 case EXCP_FIQ:
8283 addr = 0x1c;
8284 break;
8285 case EXCP_HVC:
8286 addr = 0x08;
8287 break;
8288 case EXCP_HYP_TRAP:
8289 addr = 0x14;
8290 break;
8291 default:
8292 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
8293 }
8294
8295 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) {
8296 if (!arm_feature(env, ARM_FEATURE_V8)) {
8297 /*
8298 * QEMU syndrome values are v8-style. v7 has the IL bit
8299 * UNK/SBZP for "field not valid" cases, where v8 uses RES1.
8300 * If this is a v7 CPU, squash the IL bit in those cases.
8301 */
8302 if (cs->exception_index == EXCP_PREFETCH_ABORT ||
8303 (cs->exception_index == EXCP_DATA_ABORT &&
8304 !(env->exception.syndrome & ARM_EL_ISV)) ||
8305 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) {
8306 env->exception.syndrome &= ~ARM_EL_IL;
8307 }
8308 }
8309 env->cp15.esr_el[2] = env->exception.syndrome;
8310 }
8311
8312 if (arm_current_el(env) != 2 && addr < 0x14) {
8313 addr = 0x14;
8314 }
8315
8316 mask = 0;
8317 if (!(env->cp15.scr_el3 & SCR_EA)) {
8318 mask |= CPSR_A;
8319 }
8320 if (!(env->cp15.scr_el3 & SCR_IRQ)) {
8321 mask |= CPSR_I;
8322 }
8323 if (!(env->cp15.scr_el3 & SCR_FIQ)) {
8324 mask |= CPSR_F;
8325 }
8326
8327 addr += env->cp15.hvbar;
8328
8329 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr);
8330 }
8331
8332 static void arm_cpu_do_interrupt_aarch32(CPUState *cs)
8333 {
8334 ARMCPU *cpu = ARM_CPU(cs);
8335 CPUARMState *env = &cpu->env;
8336 uint32_t addr;
8337 uint32_t mask;
8338 int new_mode;
8339 uint32_t offset;
8340 uint32_t moe;
8341
8342 /* If this is a debug exception we must update the DBGDSCR.MOE bits */
8343 switch (syn_get_ec(env->exception.syndrome)) {
8344 case EC_BREAKPOINT:
8345 case EC_BREAKPOINT_SAME_EL:
8346 moe = 1;
8347 break;
8348 case EC_WATCHPOINT:
8349 case EC_WATCHPOINT_SAME_EL:
8350 moe = 10;
8351 break;
8352 case EC_AA32_BKPT:
8353 moe = 3;
8354 break;
8355 case EC_VECTORCATCH:
8356 moe = 5;
8357 break;
8358 default:
8359 moe = 0;
8360 break;
8361 }
8362
8363 if (moe) {
8364 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe);
8365 }
8366
8367 if (env->exception.target_el == 2) {
8368 arm_cpu_do_interrupt_aarch32_hyp(cs);
8369 return;
8370 }
8371
8372 switch (cs->exception_index) {
8373 case EXCP_UDEF:
8374 new_mode = ARM_CPU_MODE_UND;
8375 addr = 0x04;
8376 mask = CPSR_I;
8377 if (env->thumb)
8378 offset = 2;
8379 else
8380 offset = 4;
8381 break;
8382 case EXCP_SWI:
8383 new_mode = ARM_CPU_MODE_SVC;
8384 addr = 0x08;
8385 mask = CPSR_I;
8386 /* The PC already points to the next instruction. */
8387 offset = 0;
8388 break;
8389 case EXCP_BKPT:
8390 /* Fall through to prefetch abort. */
8391 case EXCP_PREFETCH_ABORT:
8392 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr);
8393 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress);
8394 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n",
8395 env->exception.fsr, (uint32_t)env->exception.vaddress);
8396 new_mode = ARM_CPU_MODE_ABT;
8397 addr = 0x0c;
8398 mask = CPSR_A | CPSR_I;
8399 offset = 4;
8400 break;
8401 case EXCP_DATA_ABORT:
8402 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr);
8403 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress);
8404 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n",
8405 env->exception.fsr,
8406 (uint32_t)env->exception.vaddress);
8407 new_mode = ARM_CPU_MODE_ABT;
8408 addr = 0x10;
8409 mask = CPSR_A | CPSR_I;
8410 offset = 8;
8411 break;
8412 case EXCP_IRQ:
8413 new_mode = ARM_CPU_MODE_IRQ;
8414 addr = 0x18;
8415 /* Disable IRQ and imprecise data aborts. */
8416 mask = CPSR_A | CPSR_I;
8417 offset = 4;
8418 if (env->cp15.scr_el3 & SCR_IRQ) {
8419 /* IRQ routed to monitor mode */
8420 new_mode = ARM_CPU_MODE_MON;
8421 mask |= CPSR_F;
8422 }
8423 break;
8424 case EXCP_FIQ:
8425 new_mode = ARM_CPU_MODE_FIQ;
8426 addr = 0x1c;
8427 /* Disable FIQ, IRQ and imprecise data aborts. */
8428 mask = CPSR_A | CPSR_I | CPSR_F;
8429 if (env->cp15.scr_el3 & SCR_FIQ) {
8430 /* FIQ routed to monitor mode */
8431 new_mode = ARM_CPU_MODE_MON;
8432 }
8433 offset = 4;
8434 break;
8435 case EXCP_VIRQ:
8436 new_mode = ARM_CPU_MODE_IRQ;
8437 addr = 0x18;
8438 /* Disable IRQ and imprecise data aborts. */
8439 mask = CPSR_A | CPSR_I;
8440 offset = 4;
8441 break;
8442 case EXCP_VFIQ:
8443 new_mode = ARM_CPU_MODE_FIQ;
8444 addr = 0x1c;
8445 /* Disable FIQ, IRQ and imprecise data aborts. */
8446 mask = CPSR_A | CPSR_I | CPSR_F;
8447 offset = 4;
8448 break;
8449 case EXCP_SMC:
8450 new_mode = ARM_CPU_MODE_MON;
8451 addr = 0x08;
8452 mask = CPSR_A | CPSR_I | CPSR_F;
8453 offset = 0;
8454 break;
8455 default:
8456 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
8457 return; /* Never happens. Keep compiler happy. */
8458 }
8459
8460 if (new_mode == ARM_CPU_MODE_MON) {
8461 addr += env->cp15.mvbar;
8462 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
8463 /* High vectors. When enabled, base address cannot be remapped. */
8464 addr += 0xffff0000;
8465 } else {
8466 /* ARM v7 architectures provide a vector base address register to remap
8467 * the interrupt vector table.
8468 * This register is only followed in non-monitor mode, and is banked.
8469 * Note: only bits 31:5 are valid.
8470 */
8471 addr += A32_BANKED_CURRENT_REG_GET(env, vbar);
8472 }
8473
8474 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
8475 env->cp15.scr_el3 &= ~SCR_NS;
8476 }
8477
8478 take_aarch32_exception(env, new_mode, mask, offset, addr);
8479 }
8480
8481 /* Handle exception entry to a target EL which is using AArch64 */
8482 static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
8483 {
8484 ARMCPU *cpu = ARM_CPU(cs);
8485 CPUARMState *env = &cpu->env;
8486 unsigned int new_el = env->exception.target_el;
8487 target_ulong addr = env->cp15.vbar_el[new_el];
8488 unsigned int new_mode = aarch64_pstate_mode(new_el, true);
8489 unsigned int cur_el = arm_current_el(env);
8490
8491 /*
8492 * Note that new_el can never be 0. If cur_el is 0, then
8493 * el0_a64 is is_a64(), else el0_a64 is ignored.
8494 */
8495 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
8496
8497 if (cur_el < new_el) {
8498 /* Entry vector offset depends on whether the implemented EL
8499 * immediately lower than the target level is using AArch32 or AArch64
8500 */
8501 bool is_aa64;
8502
8503 switch (new_el) {
8504 case 3:
8505 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0;
8506 break;
8507 case 2:
8508 is_aa64 = (env->cp15.hcr_el2 & HCR_RW) != 0;
8509 break;
8510 case 1:
8511 is_aa64 = is_a64(env);
8512 break;
8513 default:
8514 g_assert_not_reached();
8515 }
8516
8517 if (is_aa64) {
8518 addr += 0x400;
8519 } else {
8520 addr += 0x600;
8521 }
8522 } else if (pstate_read(env) & PSTATE_SP) {
8523 addr += 0x200;
8524 }
8525
8526 switch (cs->exception_index) {
8527 case EXCP_PREFETCH_ABORT:
8528 case EXCP_DATA_ABORT:
8529 env->cp15.far_el[new_el] = env->exception.vaddress;
8530 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n",
8531 env->cp15.far_el[new_el]);
8532 /* fall through */
8533 case EXCP_BKPT:
8534 case EXCP_UDEF:
8535 case EXCP_SWI:
8536 case EXCP_HVC:
8537 case EXCP_HYP_TRAP:
8538 case EXCP_SMC:
8539 if (syn_get_ec(env->exception.syndrome) == EC_ADVSIMDFPACCESSTRAP) {
8540 /*
8541 * QEMU internal FP/SIMD syndromes from AArch32 include the
8542 * TA and coproc fields which are only exposed if the exception
8543 * is taken to AArch32 Hyp mode. Mask them out to get a valid
8544 * AArch64 format syndrome.
8545 */
8546 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20);
8547 }
8548 env->cp15.esr_el[new_el] = env->exception.syndrome;
8549 break;
8550 case EXCP_IRQ:
8551 case EXCP_VIRQ:
8552 addr += 0x80;
8553 break;
8554 case EXCP_FIQ:
8555 case EXCP_VFIQ:
8556 addr += 0x100;
8557 break;
8558 case EXCP_SEMIHOST:
8559 qemu_log_mask(CPU_LOG_INT,
8560 "...handling as semihosting call 0x%" PRIx64 "\n",
8561 env->xregs[0]);
8562 env->xregs[0] = do_arm_semihosting(env);
8563 return;
8564 default:
8565 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
8566 }
8567
8568 if (is_a64(env)) {
8569 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = pstate_read(env);
8570 aarch64_save_sp(env, arm_current_el(env));
8571 env->elr_el[new_el] = env->pc;
8572 } else {
8573 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = cpsr_read(env);
8574 env->elr_el[new_el] = env->regs[15];
8575
8576 aarch64_sync_32_to_64(env);
8577
8578 env->condexec_bits = 0;
8579 }
8580 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n",
8581 env->elr_el[new_el]);
8582
8583 pstate_write(env, PSTATE_DAIF | new_mode);
8584 env->aarch64 = 1;
8585 aarch64_restore_sp(env, new_el);
8586 helper_rebuild_hflags_a64(env, new_el);
8587
8588 env->pc = addr;
8589
8590 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n",
8591 new_el, env->pc, pstate_read(env));
8592 }
8593
8594 /*
8595 * Do semihosting call and set the appropriate return value. All the
8596 * permission and validity checks have been done at translate time.
8597 *
8598 * We only see semihosting exceptions in TCG only as they are not
8599 * trapped to the hypervisor in KVM.
8600 */
8601 #ifdef CONFIG_TCG
8602 static void handle_semihosting(CPUState *cs)
8603 {
8604 ARMCPU *cpu = ARM_CPU(cs);
8605 CPUARMState *env = &cpu->env;
8606
8607 if (is_a64(env)) {
8608 qemu_log_mask(CPU_LOG_INT,
8609 "...handling as semihosting call 0x%" PRIx64 "\n",
8610 env->xregs[0]);
8611 env->xregs[0] = do_arm_semihosting(env);
8612 } else {
8613 qemu_log_mask(CPU_LOG_INT,
8614 "...handling as semihosting call 0x%x\n",
8615 env->regs[0]);
8616 env->regs[0] = do_arm_semihosting(env);
8617 }
8618 }
8619 #endif
8620
8621 /* Handle a CPU exception for A and R profile CPUs.
8622 * Do any appropriate logging, handle PSCI calls, and then hand off
8623 * to the AArch64-entry or AArch32-entry function depending on the
8624 * target exception level's register width.
8625 */
8626 void arm_cpu_do_interrupt(CPUState *cs)
8627 {
8628 ARMCPU *cpu = ARM_CPU(cs);
8629 CPUARMState *env = &cpu->env;
8630 unsigned int new_el = env->exception.target_el;
8631
8632 assert(!arm_feature(env, ARM_FEATURE_M));
8633
8634 arm_log_exception(cs->exception_index);
8635 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env),
8636 new_el);
8637 if (qemu_loglevel_mask(CPU_LOG_INT)
8638 && !excp_is_internal(cs->exception_index)) {
8639 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n",
8640 syn_get_ec(env->exception.syndrome),
8641 env->exception.syndrome);
8642 }
8643
8644 if (arm_is_psci_call(cpu, cs->exception_index)) {
8645 arm_handle_psci_call(cpu);
8646 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
8647 return;
8648 }
8649
8650 /*
8651 * Semihosting semantics depend on the register width of the code
8652 * that caused the exception, not the target exception level, so
8653 * must be handled here.
8654 */
8655 #ifdef CONFIG_TCG
8656 if (cs->exception_index == EXCP_SEMIHOST) {
8657 handle_semihosting(cs);
8658 return;
8659 }
8660 #endif
8661
8662 /* Hooks may change global state so BQL should be held, also the
8663 * BQL needs to be held for any modification of
8664 * cs->interrupt_request.
8665 */
8666 g_assert(qemu_mutex_iothread_locked());
8667
8668 arm_call_pre_el_change_hook(cpu);
8669
8670 assert(!excp_is_internal(cs->exception_index));
8671 if (arm_el_is_aa64(env, new_el)) {
8672 arm_cpu_do_interrupt_aarch64(cs);
8673 } else {
8674 arm_cpu_do_interrupt_aarch32(cs);
8675 }
8676
8677 arm_call_el_change_hook(cpu);
8678
8679 if (!kvm_enabled()) {
8680 cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
8681 }
8682 }
8683 #endif /* !CONFIG_USER_ONLY */
8684
8685 /* Return the exception level which controls this address translation regime */
8686 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
8687 {
8688 switch (mmu_idx) {
8689 case ARMMMUIdx_S2NS:
8690 case ARMMMUIdx_S1E2:
8691 return 2;
8692 case ARMMMUIdx_S1E3:
8693 return 3;
8694 case ARMMMUIdx_S1SE0:
8695 return arm_el_is_aa64(env, 3) ? 1 : 3;
8696 case ARMMMUIdx_S1SE1:
8697 case ARMMMUIdx_S1NSE0:
8698 case ARMMMUIdx_S1NSE1:
8699 case ARMMMUIdx_MPrivNegPri:
8700 case ARMMMUIdx_MUserNegPri:
8701 case ARMMMUIdx_MPriv:
8702 case ARMMMUIdx_MUser:
8703 case ARMMMUIdx_MSPrivNegPri:
8704 case ARMMMUIdx_MSUserNegPri:
8705 case ARMMMUIdx_MSPriv:
8706 case ARMMMUIdx_MSUser:
8707 return 1;
8708 default:
8709 g_assert_not_reached();
8710 }
8711 }
8712
8713 #ifndef CONFIG_USER_ONLY
8714
8715 /* Return the SCTLR value which controls this address translation regime */
8716 static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
8717 {
8718 return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
8719 }
8720
8721 /* Return true if the specified stage of address translation is disabled */
8722 static inline bool regime_translation_disabled(CPUARMState *env,
8723 ARMMMUIdx mmu_idx)
8724 {
8725 if (arm_feature(env, ARM_FEATURE_M)) {
8726 switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] &
8727 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
8728 case R_V7M_MPU_CTRL_ENABLE_MASK:
8729 /* Enabled, but not for HardFault and NMI */
8730 return mmu_idx & ARM_MMU_IDX_M_NEGPRI;
8731 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK:
8732 /* Enabled for all cases */
8733 return false;
8734 case 0:
8735 default:
8736 /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
8737 * we warned about that in armv7m_nvic.c when the guest set it.
8738 */
8739 return true;
8740 }
8741 }
8742
8743 if (mmu_idx == ARMMMUIdx_S2NS) {
8744 /* HCR.DC means HCR.VM behaves as 1 */
8745 return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0;
8746 }
8747
8748 if (env->cp15.hcr_el2 & HCR_TGE) {
8749 /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
8750 if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) {
8751 return true;
8752 }
8753 }
8754
8755 if ((env->cp15.hcr_el2 & HCR_DC) &&
8756 (mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1)) {
8757 /* HCR.DC means SCTLR_EL1.M behaves as 0 */
8758 return true;
8759 }
8760
8761 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
8762 }
8763
8764 static inline bool regime_translation_big_endian(CPUARMState *env,
8765 ARMMMUIdx mmu_idx)
8766 {
8767 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
8768 }
8769
8770 /* Return the TTBR associated with this translation regime */
8771 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
8772 int ttbrn)
8773 {
8774 if (mmu_idx == ARMMMUIdx_S2NS) {
8775 return env->cp15.vttbr_el2;
8776 }
8777 if (ttbrn == 0) {
8778 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
8779 } else {
8780 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
8781 }
8782 }
8783
8784 #endif /* !CONFIG_USER_ONLY */
8785
8786 /* Return the TCR controlling this translation regime */
8787 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
8788 {
8789 if (mmu_idx == ARMMMUIdx_S2NS) {
8790 return &env->cp15.vtcr_el2;
8791 }
8792 return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
8793 }
8794
8795 /* Convert a possible stage1+2 MMU index into the appropriate
8796 * stage 1 MMU index
8797 */
8798 static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
8799 {
8800 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
8801 mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0);
8802 }
8803 return mmu_idx;
8804 }
8805
8806 /* Return true if the translation regime is using LPAE format page tables */
8807 static inline bool regime_using_lpae_format(CPUARMState *env,
8808 ARMMMUIdx mmu_idx)
8809 {
8810 int el = regime_el(env, mmu_idx);
8811 if (el == 2 || arm_el_is_aa64(env, el)) {
8812 return true;
8813 }
8814 if (arm_feature(env, ARM_FEATURE_LPAE)
8815 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) {
8816 return true;
8817 }
8818 return false;
8819 }
8820
8821 /* Returns true if the stage 1 translation regime is using LPAE format page
8822 * tables. Used when raising alignment exceptions, whose FSR changes depending
8823 * on whether the long or short descriptor format is in use. */
8824 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
8825 {
8826 mmu_idx = stage_1_mmu_idx(mmu_idx);
8827
8828 return regime_using_lpae_format(env, mmu_idx);
8829 }
8830
8831 #ifndef CONFIG_USER_ONLY
8832 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
8833 {
8834 switch (mmu_idx) {
8835 case ARMMMUIdx_S1SE0:
8836 case ARMMMUIdx_S1NSE0:
8837 case ARMMMUIdx_MUser:
8838 case ARMMMUIdx_MSUser:
8839 case ARMMMUIdx_MUserNegPri:
8840 case ARMMMUIdx_MSUserNegPri:
8841 return true;
8842 default:
8843 return false;
8844 case ARMMMUIdx_S12NSE0:
8845 case ARMMMUIdx_S12NSE1:
8846 g_assert_not_reached();
8847 }
8848 }
8849
8850 /* Translate section/page access permissions to page
8851 * R/W protection flags
8852 *
8853 * @env: CPUARMState
8854 * @mmu_idx: MMU index indicating required translation regime
8855 * @ap: The 3-bit access permissions (AP[2:0])
8856 * @domain_prot: The 2-bit domain access permissions
8857 */
8858 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
8859 int ap, int domain_prot)
8860 {
8861 bool is_user = regime_is_user(env, mmu_idx);
8862
8863 if (domain_prot == 3) {
8864 return PAGE_READ | PAGE_WRITE;
8865 }
8866
8867 switch (ap) {
8868 case 0:
8869 if (arm_feature(env, ARM_FEATURE_V7)) {
8870 return 0;
8871 }
8872 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) {
8873 case SCTLR_S:
8874 return is_user ? 0 : PAGE_READ;
8875 case SCTLR_R:
8876 return PAGE_READ;
8877 default:
8878 return 0;
8879 }
8880 case 1:
8881 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
8882 case 2:
8883 if (is_user) {
8884 return PAGE_READ;
8885 } else {
8886 return PAGE_READ | PAGE_WRITE;
8887 }
8888 case 3:
8889 return PAGE_READ | PAGE_WRITE;
8890 case 4: /* Reserved. */
8891 return 0;
8892 case 5:
8893 return is_user ? 0 : PAGE_READ;
8894 case 6:
8895 return PAGE_READ;
8896 case 7:
8897 if (!arm_feature(env, ARM_FEATURE_V6K)) {
8898 return 0;
8899 }
8900 return PAGE_READ;
8901 default:
8902 g_assert_not_reached();
8903 }
8904 }
8905
8906 /* Translate section/page access permissions to page
8907 * R/W protection flags.
8908 *
8909 * @ap: The 2-bit simple AP (AP[2:1])
8910 * @is_user: TRUE if accessing from PL0
8911 */
8912 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
8913 {
8914 switch (ap) {
8915 case 0:
8916 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
8917 case 1:
8918 return PAGE_READ | PAGE_WRITE;
8919 case 2:
8920 return is_user ? 0 : PAGE_READ;
8921 case 3:
8922 return PAGE_READ;
8923 default:
8924 g_assert_not_reached();
8925 }
8926 }
8927
8928 static inline int
8929 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
8930 {
8931 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
8932 }
8933
8934 /* Translate S2 section/page access permissions to protection flags
8935 *
8936 * @env: CPUARMState
8937 * @s2ap: The 2-bit stage2 access permissions (S2AP)
8938 * @xn: XN (execute-never) bit
8939 */
8940 static int get_S2prot(CPUARMState *env, int s2ap, int xn)
8941 {
8942 int prot = 0;
8943
8944 if (s2ap & 1) {
8945 prot |= PAGE_READ;
8946 }
8947 if (s2ap & 2) {
8948 prot |= PAGE_WRITE;
8949 }
8950 if (!xn) {
8951 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
8952 prot |= PAGE_EXEC;
8953 }
8954 }
8955 return prot;
8956 }
8957
8958 /* Translate section/page access permissions to protection flags
8959 *
8960 * @env: CPUARMState
8961 * @mmu_idx: MMU index indicating required translation regime
8962 * @is_aa64: TRUE if AArch64
8963 * @ap: The 2-bit simple AP (AP[2:1])
8964 * @ns: NS (non-secure) bit
8965 * @xn: XN (execute-never) bit
8966 * @pxn: PXN (privileged execute-never) bit
8967 */
8968 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
8969 int ap, int ns, int xn, int pxn)
8970 {
8971 bool is_user = regime_is_user(env, mmu_idx);
8972 int prot_rw, user_rw;
8973 bool have_wxn;
8974 int wxn = 0;
8975
8976 assert(mmu_idx != ARMMMUIdx_S2NS);
8977
8978 user_rw = simple_ap_to_rw_prot_is_user(ap, true);
8979 if (is_user) {
8980 prot_rw = user_rw;
8981 } else {
8982 prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
8983 }
8984
8985 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
8986 return prot_rw;
8987 }
8988
8989 /* TODO have_wxn should be replaced with
8990 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
8991 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
8992 * compatible processors have EL2, which is required for [U]WXN.
8993 */
8994 have_wxn = arm_feature(env, ARM_FEATURE_LPAE);
8995
8996 if (have_wxn) {
8997 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
8998 }
8999
9000 if (is_aa64) {
9001 switch (regime_el(env, mmu_idx)) {
9002 case 1:
9003 if (!is_user) {
9004 xn = pxn || (user_rw & PAGE_WRITE);
9005 }
9006 break;
9007 case 2:
9008 case 3:
9009 break;
9010 }
9011 } else if (arm_feature(env, ARM_FEATURE_V7)) {
9012 switch (regime_el(env, mmu_idx)) {
9013 case 1:
9014 case 3:
9015 if (is_user) {
9016 xn = xn || !(user_rw & PAGE_READ);
9017 } else {
9018 int uwxn = 0;
9019 if (have_wxn) {
9020 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
9021 }
9022 xn = xn || !(prot_rw & PAGE_READ) || pxn ||
9023 (uwxn && (user_rw & PAGE_WRITE));
9024 }
9025 break;
9026 case 2:
9027 break;
9028 }
9029 } else {
9030 xn = wxn = 0;
9031 }
9032
9033 if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
9034 return prot_rw;
9035 }
9036 return prot_rw | PAGE_EXEC;
9037 }
9038
9039 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
9040 uint32_t *table, uint32_t address)
9041 {
9042 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
9043 TCR *tcr = regime_tcr(env, mmu_idx);
9044
9045 if (address & tcr->mask) {
9046 if (tcr->raw_tcr & TTBCR_PD1) {
9047 /* Translation table walk disabled for TTBR1 */
9048 return false;
9049 }
9050 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
9051 } else {
9052 if (tcr->raw_tcr & TTBCR_PD0) {
9053 /* Translation table walk disabled for TTBR0 */
9054 return false;
9055 }
9056 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask;
9057 }
9058 *table |= (address >> 18) & 0x3ffc;
9059 return true;
9060 }
9061
9062 /* Translate a S1 pagetable walk through S2 if needed. */
9063 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
9064 hwaddr addr, MemTxAttrs txattrs,
9065 ARMMMUFaultInfo *fi)
9066 {
9067 if ((mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1) &&
9068 !regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
9069 target_ulong s2size;
9070 hwaddr s2pa;
9071 int s2prot;
9072 int ret;
9073 ARMCacheAttrs cacheattrs = {};
9074 ARMCacheAttrs *pcacheattrs = NULL;
9075
9076 if (env->cp15.hcr_el2 & HCR_PTW) {
9077 /*
9078 * PTW means we must fault if this S1 walk touches S2 Device
9079 * memory; otherwise we don't care about the attributes and can
9080 * save the S2 translation the effort of computing them.
9081 */
9082 pcacheattrs = &cacheattrs;
9083 }
9084
9085 ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
9086 &txattrs, &s2prot, &s2size, fi, pcacheattrs);
9087 if (ret) {
9088 assert(fi->type != ARMFault_None);
9089 fi->s2addr = addr;
9090 fi->stage2 = true;
9091 fi->s1ptw = true;
9092 return ~0;
9093 }
9094 if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) {
9095 /* Access was to Device memory: generate Permission fault */
9096 fi->type = ARMFault_Permission;
9097 fi->s2addr = addr;
9098 fi->stage2 = true;
9099 fi->s1ptw = true;
9100 return ~0;
9101 }
9102 addr = s2pa;
9103 }
9104 return addr;
9105 }
9106
9107 /* All loads done in the course of a page table walk go through here. */
9108 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
9109 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi)
9110 {
9111 ARMCPU *cpu = ARM_CPU(cs);
9112 CPUARMState *env = &cpu->env;
9113 MemTxAttrs attrs = {};
9114 MemTxResult result = MEMTX_OK;
9115 AddressSpace *as;
9116 uint32_t data;
9117
9118 attrs.secure = is_secure;
9119 as = arm_addressspace(cs, attrs);
9120 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
9121 if (fi->s1ptw) {
9122 return 0;
9123 }
9124 if (regime_translation_big_endian(env, mmu_idx)) {
9125 data = address_space_ldl_be(as, addr, attrs, &result);
9126 } else {
9127 data = address_space_ldl_le(as, addr, attrs, &result);
9128 }
9129 if (result == MEMTX_OK) {
9130 return data;
9131 }
9132 fi->type = ARMFault_SyncExternalOnWalk;
9133 fi->ea = arm_extabort_type(result);
9134 return 0;
9135 }
9136
9137 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
9138 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi)
9139 {
9140 ARMCPU *cpu = ARM_CPU(cs);
9141 CPUARMState *env = &cpu->env;
9142 MemTxAttrs attrs = {};
9143 MemTxResult result = MEMTX_OK;
9144 AddressSpace *as;
9145 uint64_t data;
9146
9147 attrs.secure = is_secure;
9148 as = arm_addressspace(cs, attrs);
9149 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
9150 if (fi->s1ptw) {
9151 return 0;
9152 }
9153 if (regime_translation_big_endian(env, mmu_idx)) {
9154 data = address_space_ldq_be(as, addr, attrs, &result);
9155 } else {
9156 data = address_space_ldq_le(as, addr, attrs, &result);
9157 }
9158 if (result == MEMTX_OK) {
9159 return data;
9160 }
9161 fi->type = ARMFault_SyncExternalOnWalk;
9162 fi->ea = arm_extabort_type(result);
9163 return 0;
9164 }
9165
9166 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
9167 MMUAccessType access_type, ARMMMUIdx mmu_idx,
9168 hwaddr *phys_ptr, int *prot,
9169 target_ulong *page_size,
9170 ARMMMUFaultInfo *fi)
9171 {
9172 CPUState *cs = env_cpu(env);
9173 int level = 1;
9174 uint32_t table;
9175 uint32_t desc;
9176 int type;
9177 int ap;
9178 int domain = 0;
9179 int domain_prot;
9180 hwaddr phys_addr;
9181 uint32_t dacr;
9182
9183 /* Pagetable walk. */
9184 /* Lookup l1 descriptor. */
9185 if (!get_level1_table_address(env, mmu_idx, &table, address)) {
9186 /* Section translation fault if page walk is disabled by PD0 or PD1 */
9187 fi->type = ARMFault_Translation;
9188 goto do_fault;
9189 }
9190 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9191 mmu_idx, fi);
9192 if (fi->type != ARMFault_None) {
9193 goto do_fault;
9194 }
9195 type = (desc & 3);
9196 domain = (desc >> 5) & 0x0f;
9197 if (regime_el(env, mmu_idx) == 1) {
9198 dacr = env->cp15.dacr_ns;
9199 } else {
9200 dacr = env->cp15.dacr_s;
9201 }
9202 domain_prot = (dacr >> (domain * 2)) & 3;
9203 if (type == 0) {
9204 /* Section translation fault. */
9205 fi->type = ARMFault_Translation;
9206 goto do_fault;
9207 }
9208 if (type != 2) {
9209 level = 2;
9210 }
9211 if (domain_prot == 0 || domain_prot == 2) {
9212 fi->type = ARMFault_Domain;
9213 goto do_fault;
9214 }
9215 if (type == 2) {
9216 /* 1Mb section. */
9217 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
9218 ap = (desc >> 10) & 3;
9219 *page_size = 1024 * 1024;
9220 } else {
9221 /* Lookup l2 entry. */
9222 if (type == 1) {
9223 /* Coarse pagetable. */
9224 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
9225 } else {
9226 /* Fine pagetable. */
9227 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
9228 }
9229 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9230 mmu_idx, fi);
9231 if (fi->type != ARMFault_None) {
9232 goto do_fault;
9233 }
9234 switch (desc & 3) {
9235 case 0: /* Page translation fault. */
9236 fi->type = ARMFault_Translation;
9237 goto do_fault;
9238 case 1: /* 64k page. */
9239 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
9240 ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
9241 *page_size = 0x10000;
9242 break;
9243 case 2: /* 4k page. */
9244 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
9245 ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
9246 *page_size = 0x1000;
9247 break;
9248 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
9249 if (type == 1) {
9250 /* ARMv6/XScale extended small page format */
9251 if (arm_feature(env, ARM_FEATURE_XSCALE)
9252 || arm_feature(env, ARM_FEATURE_V6)) {
9253 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
9254 *page_size = 0x1000;
9255 } else {
9256 /* UNPREDICTABLE in ARMv5; we choose to take a
9257 * page translation fault.
9258 */
9259 fi->type = ARMFault_Translation;
9260 goto do_fault;
9261 }
9262 } else {
9263 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
9264 *page_size = 0x400;
9265 }
9266 ap = (desc >> 4) & 3;
9267 break;
9268 default:
9269 /* Never happens, but compiler isn't smart enough to tell. */
9270 abort();
9271 }
9272 }
9273 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
9274 *prot |= *prot ? PAGE_EXEC : 0;
9275 if (!(*prot & (1 << access_type))) {
9276 /* Access permission fault. */
9277 fi->type = ARMFault_Permission;
9278 goto do_fault;
9279 }
9280 *phys_ptr = phys_addr;
9281 return false;
9282 do_fault:
9283 fi->domain = domain;
9284 fi->level = level;
9285 return true;
9286 }
9287
9288 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
9289 MMUAccessType access_type, ARMMMUIdx mmu_idx,
9290 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
9291 target_ulong *page_size, ARMMMUFaultInfo *fi)
9292 {
9293 CPUState *cs = env_cpu(env);
9294 int level = 1;
9295 uint32_t table;
9296 uint32_t desc;
9297 uint32_t xn;
9298 uint32_t pxn = 0;
9299 int type;
9300 int ap;
9301 int domain = 0;
9302 int domain_prot;
9303 hwaddr phys_addr;
9304 uint32_t dacr;
9305 bool ns;
9306
9307 /* Pagetable walk. */
9308 /* Lookup l1 descriptor. */
9309 if (!get_level1_table_address(env, mmu_idx, &table, address)) {
9310 /* Section translation fault if page walk is disabled by PD0 or PD1 */
9311 fi->type = ARMFault_Translation;
9312 goto do_fault;
9313 }
9314 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9315 mmu_idx, fi);
9316 if (fi->type != ARMFault_None) {
9317 goto do_fault;
9318 }
9319 type = (desc & 3);
9320 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
9321 /* Section translation fault, or attempt to use the encoding
9322 * which is Reserved on implementations without PXN.
9323 */
9324 fi->type = ARMFault_Translation;
9325 goto do_fault;
9326 }
9327 if ((type == 1) || !(desc & (1 << 18))) {
9328 /* Page or Section. */
9329 domain = (desc >> 5) & 0x0f;
9330 }
9331 if (regime_el(env, mmu_idx) == 1) {
9332 dacr = env->cp15.dacr_ns;
9333 } else {
9334 dacr = env->cp15.dacr_s;
9335 }
9336 if (type == 1) {
9337 level = 2;
9338 }
9339 domain_prot = (dacr >> (domain * 2)) & 3;
9340 if (domain_prot == 0 || domain_prot == 2) {
9341 /* Section or Page domain fault */
9342 fi->type = ARMFault_Domain;
9343 goto do_fault;
9344 }
9345 if (type != 1) {
9346 if (desc & (1 << 18)) {
9347 /* Supersection. */
9348 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
9349 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
9350 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
9351 *page_size = 0x1000000;
9352 } else {
9353 /* Section. */
9354 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
9355 *page_size = 0x100000;
9356 }
9357 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
9358 xn = desc & (1 << 4);
9359 pxn = desc & 1;
9360 ns = extract32(desc, 19, 1);
9361 } else {
9362 if (arm_feature(env, ARM_FEATURE_PXN)) {
9363 pxn = (desc >> 2) & 1;
9364 }
9365 ns = extract32(desc, 3, 1);
9366 /* Lookup l2 entry. */
9367 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
9368 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9369 mmu_idx, fi);
9370 if (fi->type != ARMFault_None) {
9371 goto do_fault;
9372 }
9373 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
9374 switch (desc & 3) {
9375 case 0: /* Page translation fault. */
9376 fi->type = ARMFault_Translation;
9377 goto do_fault;
9378 case 1: /* 64k page. */
9379 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
9380 xn = desc & (1 << 15);
9381 *page_size = 0x10000;
9382 break;
9383 case 2: case 3: /* 4k page. */
9384 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
9385 xn = desc & 1;
9386 *page_size = 0x1000;
9387 break;
9388 default:
9389 /* Never happens, but compiler isn't smart enough to tell. */
9390 abort();
9391 }
9392 }
9393 if (domain_prot == 3) {
9394 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
9395 } else {
9396 if (pxn && !regime_is_user(env, mmu_idx)) {
9397 xn = 1;
9398 }
9399 if (xn && access_type == MMU_INST_FETCH) {
9400 fi->type = ARMFault_Permission;
9401 goto do_fault;
9402 }
9403
9404 if (arm_feature(env, ARM_FEATURE_V6K) &&
9405 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) {
9406 /* The simplified model uses AP[0] as an access control bit. */
9407 if ((ap & 1) == 0) {
9408 /* Access flag fault. */
9409 fi->type = ARMFault_AccessFlag;
9410 goto do_fault;
9411 }
9412 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
9413 } else {
9414 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
9415 }
9416 if (*prot && !xn) {
9417 *prot |= PAGE_EXEC;
9418 }
9419 if (!(*prot & (1 << access_type))) {
9420 /* Access permission fault. */
9421 fi->type = ARMFault_Permission;
9422 goto do_fault;
9423 }
9424 }
9425 if (ns) {
9426 /* The NS bit will (as required by the architecture) have no effect if
9427 * the CPU doesn't support TZ or this is a non-secure translation
9428 * regime, because the attribute will already be non-secure.
9429 */
9430 attrs->secure = false;
9431 }
9432 *phys_ptr = phys_addr;
9433 return false;
9434 do_fault:
9435 fi->domain = domain;
9436 fi->level = level;
9437 return true;
9438 }
9439
9440 /*
9441 * check_s2_mmu_setup
9442 * @cpu: ARMCPU
9443 * @is_aa64: True if the translation regime is in AArch64 state
9444 * @startlevel: Suggested starting level
9445 * @inputsize: Bitsize of IPAs
9446 * @stride: Page-table stride (See the ARM ARM)
9447 *
9448 * Returns true if the suggested S2 translation parameters are OK and
9449 * false otherwise.
9450 */
9451 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
9452 int inputsize, int stride)
9453 {
9454 const int grainsize = stride + 3;
9455 int startsizecheck;
9456
9457 /* Negative levels are never allowed. */
9458 if (level < 0) {
9459 return false;
9460 }
9461
9462 startsizecheck = inputsize - ((3 - level) * stride + grainsize);
9463 if (startsizecheck < 1 || startsizecheck > stride + 4) {
9464 return false;
9465 }
9466
9467 if (is_aa64) {
9468 CPUARMState *env = &cpu->env;
9469 unsigned int pamax = arm_pamax(cpu);
9470
9471 switch (stride) {
9472 case 13: /* 64KB Pages. */
9473 if (level == 0 || (level == 1 && pamax <= 42)) {
9474 return false;
9475 }
9476 break;
9477 case 11: /* 16KB Pages. */
9478 if (level == 0 || (level == 1 && pamax <= 40)) {
9479 return false;
9480 }
9481 break;
9482 case 9: /* 4KB Pages. */
9483 if (level == 0 && pamax <= 42) {
9484 return false;
9485 }
9486 break;
9487 default:
9488 g_assert_not_reached();
9489 }
9490
9491 /* Inputsize checks. */
9492 if (inputsize > pamax &&
9493 (arm_el_is_aa64(env, 1) || inputsize > 40)) {
9494 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */
9495 return false;
9496 }
9497 } else {
9498 /* AArch32 only supports 4KB pages. Assert on that. */
9499 assert(stride == 9);
9500
9501 if (level == 0) {
9502 return false;
9503 }
9504 }
9505 return true;
9506 }
9507
9508 /* Translate from the 4-bit stage 2 representation of
9509 * memory attributes (without cache-allocation hints) to
9510 * the 8-bit representation of the stage 1 MAIR registers
9511 * (which includes allocation hints).
9512 *
9513 * ref: shared/translation/attrs/S2AttrDecode()
9514 * .../S2ConvertAttrsHints()
9515 */
9516 static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
9517 {
9518 uint8_t hiattr = extract32(s2attrs, 2, 2);
9519 uint8_t loattr = extract32(s2attrs, 0, 2);
9520 uint8_t hihint = 0, lohint = 0;
9521
9522 if (hiattr != 0) { /* normal memory */
9523 if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
9524 hiattr = loattr = 1; /* non-cacheable */
9525 } else {
9526 if (hiattr != 1) { /* Write-through or write-back */
9527 hihint = 3; /* RW allocate */
9528 }
9529 if (loattr != 1) { /* Write-through or write-back */
9530 lohint = 3; /* RW allocate */
9531 }
9532 }
9533 }
9534
9535 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
9536 }
9537 #endif /* !CONFIG_USER_ONLY */
9538
9539 ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va,
9540 ARMMMUIdx mmu_idx)
9541 {
9542 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
9543 uint32_t el = regime_el(env, mmu_idx);
9544 bool tbi, tbid, epd, hpd, using16k, using64k;
9545 int select, tsz;
9546
9547 /*
9548 * Bit 55 is always between the two regions, and is canonical for
9549 * determining if address tagging is enabled.
9550 */
9551 select = extract64(va, 55, 1);
9552
9553 if (el > 1) {
9554 tsz = extract32(tcr, 0, 6);
9555 using64k = extract32(tcr, 14, 1);
9556 using16k = extract32(tcr, 15, 1);
9557 if (mmu_idx == ARMMMUIdx_S2NS) {
9558 /* VTCR_EL2 */
9559 tbi = tbid = hpd = false;
9560 } else {
9561 tbi = extract32(tcr, 20, 1);
9562 hpd = extract32(tcr, 24, 1);
9563 tbid = extract32(tcr, 29, 1);
9564 }
9565 epd = false;
9566 } else if (!select) {
9567 tsz = extract32(tcr, 0, 6);
9568 epd = extract32(tcr, 7, 1);
9569 using64k = extract32(tcr, 14, 1);
9570 using16k = extract32(tcr, 15, 1);
9571 tbi = extract64(tcr, 37, 1);
9572 hpd = extract64(tcr, 41, 1);
9573 tbid = extract64(tcr, 51, 1);
9574 } else {
9575 int tg = extract32(tcr, 30, 2);
9576 using16k = tg == 1;
9577 using64k = tg == 3;
9578 tsz = extract32(tcr, 16, 6);
9579 epd = extract32(tcr, 23, 1);
9580 tbi = extract64(tcr, 38, 1);
9581 hpd = extract64(tcr, 42, 1);
9582 tbid = extract64(tcr, 52, 1);
9583 }
9584 tsz = MIN(tsz, 39); /* TODO: ARMv8.4-TTST */
9585 tsz = MAX(tsz, 16); /* TODO: ARMv8.2-LVA */
9586
9587 return (ARMVAParameters) {
9588 .tsz = tsz,
9589 .select = select,
9590 .tbi = tbi,
9591 .tbid = tbid,
9592 .epd = epd,
9593 .hpd = hpd,
9594 .using16k = using16k,
9595 .using64k = using64k,
9596 };
9597 }
9598
9599 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
9600 ARMMMUIdx mmu_idx, bool data)
9601 {
9602 ARMVAParameters ret = aa64_va_parameters_both(env, va, mmu_idx);
9603
9604 /* Present TBI as a composite with TBID. */
9605 ret.tbi &= (data || !ret.tbid);
9606 return ret;
9607 }
9608
9609 #ifndef CONFIG_USER_ONLY
9610 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
9611 ARMMMUIdx mmu_idx)
9612 {
9613 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
9614 uint32_t el = regime_el(env, mmu_idx);
9615 int select, tsz;
9616 bool epd, hpd;
9617
9618 if (mmu_idx == ARMMMUIdx_S2NS) {
9619 /* VTCR */
9620 bool sext = extract32(tcr, 4, 1);
9621 bool sign = extract32(tcr, 3, 1);
9622
9623 /*
9624 * If the sign-extend bit is not the same as t0sz[3], the result
9625 * is unpredictable. Flag this as a guest error.
9626 */
9627 if (sign != sext) {
9628 qemu_log_mask(LOG_GUEST_ERROR,
9629 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
9630 }
9631 tsz = sextract32(tcr, 0, 4) + 8;
9632 select = 0;
9633 hpd = false;
9634 epd = false;
9635 } else if (el == 2) {
9636 /* HTCR */
9637 tsz = extract32(tcr, 0, 3);
9638 select = 0;
9639 hpd = extract64(tcr, 24, 1);
9640 epd = false;
9641 } else {
9642 int t0sz = extract32(tcr, 0, 3);
9643 int t1sz = extract32(tcr, 16, 3);
9644
9645 if (t1sz == 0) {
9646 select = va > (0xffffffffu >> t0sz);
9647 } else {
9648 /* Note that we will detect errors later. */
9649 select = va >= ~(0xffffffffu >> t1sz);
9650 }
9651 if (!select) {
9652 tsz = t0sz;
9653 epd = extract32(tcr, 7, 1);
9654 hpd = extract64(tcr, 41, 1);
9655 } else {
9656 tsz = t1sz;
9657 epd = extract32(tcr, 23, 1);
9658 hpd = extract64(tcr, 42, 1);
9659 }
9660 /* For aarch32, hpd0 is not enabled without t2e as well. */
9661 hpd &= extract32(tcr, 6, 1);
9662 }
9663
9664 return (ARMVAParameters) {
9665 .tsz = tsz,
9666 .select = select,
9667 .epd = epd,
9668 .hpd = hpd,
9669 };
9670 }
9671
9672 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
9673 MMUAccessType access_type, ARMMMUIdx mmu_idx,
9674 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
9675 target_ulong *page_size_ptr,
9676 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
9677 {
9678 ARMCPU *cpu = env_archcpu(env);
9679 CPUState *cs = CPU(cpu);
9680 /* Read an LPAE long-descriptor translation table. */
9681 ARMFaultType fault_type = ARMFault_Translation;
9682 uint32_t level;
9683 ARMVAParameters param;
9684 uint64_t ttbr;
9685 hwaddr descaddr, indexmask, indexmask_grainsize;
9686 uint32_t tableattrs;
9687 target_ulong page_size;
9688 uint32_t attrs;
9689 int32_t stride;
9690 int addrsize, inputsize;
9691 TCR *tcr = regime_tcr(env, mmu_idx);
9692 int ap, ns, xn, pxn;
9693 uint32_t el = regime_el(env, mmu_idx);
9694 bool ttbr1_valid;
9695 uint64_t descaddrmask;
9696 bool aarch64 = arm_el_is_aa64(env, el);
9697 bool guarded = false;
9698
9699 /* TODO:
9700 * This code does not handle the different format TCR for VTCR_EL2.
9701 * This code also does not support shareability levels.
9702 * Attribute and permission bit handling should also be checked when adding
9703 * support for those page table walks.
9704 */
9705 if (aarch64) {
9706 param = aa64_va_parameters(env, address, mmu_idx,
9707 access_type != MMU_INST_FETCH);
9708 level = 0;
9709 /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it
9710 * invalid.
9711 */
9712 ttbr1_valid = (el < 2);
9713 addrsize = 64 - 8 * param.tbi;
9714 inputsize = 64 - param.tsz;
9715 } else {
9716 param = aa32_va_parameters(env, address, mmu_idx);
9717 level = 1;
9718 /* There is no TTBR1 for EL2 */
9719 ttbr1_valid = (el != 2);
9720 addrsize = (mmu_idx == ARMMMUIdx_S2NS ? 40 : 32);
9721 inputsize = addrsize - param.tsz;
9722 }
9723
9724 /*
9725 * We determined the region when collecting the parameters, but we
9726 * have not yet validated that the address is valid for the region.
9727 * Extract the top bits and verify that they all match select.
9728 *
9729 * For aa32, if inputsize == addrsize, then we have selected the
9730 * region by exclusion in aa32_va_parameters and there is no more
9731 * validation to do here.
9732 */
9733 if (inputsize < addrsize) {
9734 target_ulong top_bits = sextract64(address, inputsize,
9735 addrsize - inputsize);
9736 if (-top_bits != param.select || (param.select && !ttbr1_valid)) {
9737 /* The gap between the two regions is a Translation fault */
9738 fault_type = ARMFault_Translation;
9739 goto do_fault;
9740 }
9741 }
9742
9743 if (param.using64k) {
9744 stride = 13;
9745 } else if (param.using16k) {
9746 stride = 11;
9747 } else {
9748 stride = 9;
9749 }
9750
9751 /* Note that QEMU ignores shareability and cacheability attributes,
9752 * so we don't need to do anything with the SH, ORGN, IRGN fields
9753 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
9754 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
9755 * implement any ASID-like capability so we can ignore it (instead
9756 * we will always flush the TLB any time the ASID is changed).
9757 */
9758 ttbr = regime_ttbr(env, mmu_idx, param.select);
9759
9760 /* Here we should have set up all the parameters for the translation:
9761 * inputsize, ttbr, epd, stride, tbi
9762 */
9763
9764 if (param.epd) {
9765 /* Translation table walk disabled => Translation fault on TLB miss
9766 * Note: This is always 0 on 64-bit EL2 and EL3.
9767 */
9768 goto do_fault;
9769 }
9770
9771 if (mmu_idx != ARMMMUIdx_S2NS) {
9772 /* The starting level depends on the virtual address size (which can
9773 * be up to 48 bits) and the translation granule size. It indicates
9774 * the number of strides (stride bits at a time) needed to
9775 * consume the bits of the input address. In the pseudocode this is:
9776 * level = 4 - RoundUp((inputsize - grainsize) / stride)
9777 * where their 'inputsize' is our 'inputsize', 'grainsize' is
9778 * our 'stride + 3' and 'stride' is our 'stride'.
9779 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
9780 * = 4 - (inputsize - stride - 3 + stride - 1) / stride
9781 * = 4 - (inputsize - 4) / stride;
9782 */
9783 level = 4 - (inputsize - 4) / stride;
9784 } else {
9785 /* For stage 2 translations the starting level is specified by the
9786 * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
9787 */
9788 uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2);
9789 uint32_t startlevel;
9790 bool ok;
9791
9792 if (!aarch64 || stride == 9) {
9793 /* AArch32 or 4KB pages */
9794 startlevel = 2 - sl0;
9795 } else {
9796 /* 16KB or 64KB pages */
9797 startlevel = 3 - sl0;
9798 }
9799
9800 /* Check that the starting level is valid. */
9801 ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
9802 inputsize, stride);
9803 if (!ok) {
9804 fault_type = ARMFault_Translation;
9805 goto do_fault;
9806 }
9807 level = startlevel;
9808 }
9809
9810 indexmask_grainsize = (1ULL << (stride + 3)) - 1;
9811 indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
9812
9813 /* Now we can extract the actual base address from the TTBR */
9814 descaddr = extract64(ttbr, 0, 48);
9815 descaddr &= ~indexmask;
9816
9817 /* The address field in the descriptor goes up to bit 39 for ARMv7
9818 * but up to bit 47 for ARMv8, but we use the descaddrmask
9819 * up to bit 39 for AArch32, because we don't need other bits in that case
9820 * to construct next descriptor address (anyway they should be all zeroes).
9821 */
9822 descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) &
9823 ~indexmask_grainsize;
9824
9825 /* Secure accesses start with the page table in secure memory and
9826 * can be downgraded to non-secure at any step. Non-secure accesses
9827 * remain non-secure. We implement this by just ORing in the NSTable/NS
9828 * bits at each step.
9829 */
9830 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4);
9831 for (;;) {
9832 uint64_t descriptor;
9833 bool nstable;
9834
9835 descaddr |= (address >> (stride * (4 - level))) & indexmask;
9836 descaddr &= ~7ULL;
9837 nstable = extract32(tableattrs, 4, 1);
9838 descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi);
9839 if (fi->type != ARMFault_None) {
9840 goto do_fault;
9841 }
9842
9843 if (!(descriptor & 1) ||
9844 (!(descriptor & 2) && (level == 3))) {
9845 /* Invalid, or the Reserved level 3 encoding */
9846 goto do_fault;
9847 }
9848 descaddr = descriptor & descaddrmask;
9849
9850 if ((descriptor & 2) && (level < 3)) {
9851 /* Table entry. The top five bits are attributes which may
9852 * propagate down through lower levels of the table (and
9853 * which are all arranged so that 0 means "no effect", so
9854 * we can gather them up by ORing in the bits at each level).
9855 */
9856 tableattrs |= extract64(descriptor, 59, 5);
9857 level++;
9858 indexmask = indexmask_grainsize;
9859 continue;
9860 }
9861 /* Block entry at level 1 or 2, or page entry at level 3.
9862 * These are basically the same thing, although the number
9863 * of bits we pull in from the vaddr varies.
9864 */
9865 page_size = (1ULL << ((stride * (4 - level)) + 3));
9866 descaddr |= (address & (page_size - 1));
9867 /* Extract attributes from the descriptor */
9868 attrs = extract64(descriptor, 2, 10)
9869 | (extract64(descriptor, 52, 12) << 10);
9870
9871 if (mmu_idx == ARMMMUIdx_S2NS) {
9872 /* Stage 2 table descriptors do not include any attribute fields */
9873 break;
9874 }
9875 /* Merge in attributes from table descriptors */
9876 attrs |= nstable << 3; /* NS */
9877 guarded = extract64(descriptor, 50, 1); /* GP */
9878 if (param.hpd) {
9879 /* HPD disables all the table attributes except NSTable. */
9880 break;
9881 }
9882 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */
9883 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
9884 * means "force PL1 access only", which means forcing AP[1] to 0.
9885 */
9886 attrs &= ~(extract32(tableattrs, 2, 1) << 4); /* !APT[0] => AP[1] */
9887 attrs |= extract32(tableattrs, 3, 1) << 5; /* APT[1] => AP[2] */
9888 break;
9889 }
9890 /* Here descaddr is the final physical address, and attributes
9891 * are all in attrs.
9892 */
9893 fault_type = ARMFault_AccessFlag;
9894 if ((attrs & (1 << 8)) == 0) {
9895 /* Access flag */
9896 goto do_fault;
9897 }
9898
9899 ap = extract32(attrs, 4, 2);
9900 xn = extract32(attrs, 12, 1);
9901
9902 if (mmu_idx == ARMMMUIdx_S2NS) {
9903 ns = true;
9904 *prot = get_S2prot(env, ap, xn);
9905 } else {
9906 ns = extract32(attrs, 3, 1);
9907 pxn = extract32(attrs, 11, 1);
9908 *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
9909 }
9910
9911 fault_type = ARMFault_Permission;
9912 if (!(*prot & (1 << access_type))) {
9913 goto do_fault;
9914 }
9915
9916 if (ns) {
9917 /* The NS bit will (as required by the architecture) have no effect if
9918 * the CPU doesn't support TZ or this is a non-secure translation
9919 * regime, because the attribute will already be non-secure.
9920 */
9921 txattrs->secure = false;
9922 }
9923 /* When in aarch64 mode, and BTI is enabled, remember GP in the IOTLB. */
9924 if (aarch64 && guarded && cpu_isar_feature(aa64_bti, cpu)) {
9925 txattrs->target_tlb_bit0 = true;
9926 }
9927
9928 if (cacheattrs != NULL) {
9929 if (mmu_idx == ARMMMUIdx_S2NS) {
9930 cacheattrs->attrs = convert_stage2_attrs(env,
9931 extract32(attrs, 0, 4));
9932 } else {
9933 /* Index into MAIR registers for cache attributes */
9934 uint8_t attrindx = extract32(attrs, 0, 3);
9935 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
9936 assert(attrindx <= 7);
9937 cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
9938 }
9939 cacheattrs->shareability = extract32(attrs, 6, 2);
9940 }
9941
9942 *phys_ptr = descaddr;
9943 *page_size_ptr = page_size;
9944 return false;
9945
9946 do_fault:
9947 fi->type = fault_type;
9948 fi->level = level;
9949 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */
9950 fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_S2NS);
9951 return true;
9952 }
9953
9954 static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
9955 ARMMMUIdx mmu_idx,
9956 int32_t address, int *prot)
9957 {
9958 if (!arm_feature(env, ARM_FEATURE_M)) {
9959 *prot = PAGE_READ | PAGE_WRITE;
9960 switch (address) {
9961 case 0xF0000000 ... 0xFFFFFFFF:
9962 if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
9963 /* hivecs execing is ok */
9964 *prot |= PAGE_EXEC;
9965 }
9966 break;
9967 case 0x00000000 ... 0x7FFFFFFF:
9968 *prot |= PAGE_EXEC;
9969 break;
9970 }
9971 } else {
9972 /* Default system address map for M profile cores.
9973 * The architecture specifies which regions are execute-never;
9974 * at the MPU level no other checks are defined.
9975 */
9976 switch (address) {
9977 case 0x00000000 ... 0x1fffffff: /* ROM */
9978 case 0x20000000 ... 0x3fffffff: /* SRAM */
9979 case 0x60000000 ... 0x7fffffff: /* RAM */
9980 case 0x80000000 ... 0x9fffffff: /* RAM */
9981 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
9982 break;
9983 case 0x40000000 ... 0x5fffffff: /* Peripheral */
9984 case 0xa0000000 ... 0xbfffffff: /* Device */
9985 case 0xc0000000 ... 0xdfffffff: /* Device */
9986 case 0xe0000000 ... 0xffffffff: /* System */
9987 *prot = PAGE_READ | PAGE_WRITE;
9988 break;
9989 default:
9990 g_assert_not_reached();
9991 }
9992 }
9993 }
9994
9995 static bool pmsav7_use_background_region(ARMCPU *cpu,
9996 ARMMMUIdx mmu_idx, bool is_user)
9997 {
9998 /* Return true if we should use the default memory map as a
9999 * "background" region if there are no hits against any MPU regions.
10000 */
10001 CPUARMState *env = &cpu->env;
10002
10003 if (is_user) {
10004 return false;
10005 }
10006
10007 if (arm_feature(env, ARM_FEATURE_M)) {
10008 return env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)]
10009 & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
10010 } else {
10011 return regime_sctlr(env, mmu_idx) & SCTLR_BR;
10012 }
10013 }
10014
10015 static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address)
10016 {
10017 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
10018 return arm_feature(env, ARM_FEATURE_M) &&
10019 extract32(address, 20, 12) == 0xe00;
10020 }
10021
10022 static inline bool m_is_system_region(CPUARMState *env, uint32_t address)
10023 {
10024 /* True if address is in the M profile system region
10025 * 0xe0000000 - 0xffffffff
10026 */
10027 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7;
10028 }
10029
10030 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
10031 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10032 hwaddr *phys_ptr, int *prot,
10033 target_ulong *page_size,
10034 ARMMMUFaultInfo *fi)
10035 {
10036 ARMCPU *cpu = env_archcpu(env);
10037 int n;
10038 bool is_user = regime_is_user(env, mmu_idx);
10039
10040 *phys_ptr = address;
10041 *page_size = TARGET_PAGE_SIZE;
10042 *prot = 0;
10043
10044 if (regime_translation_disabled(env, mmu_idx) ||
10045 m_is_ppb_region(env, address)) {
10046 /* MPU disabled or M profile PPB access: use default memory map.
10047 * The other case which uses the default memory map in the
10048 * v7M ARM ARM pseudocode is exception vector reads from the vector
10049 * table. In QEMU those accesses are done in arm_v7m_load_vector(),
10050 * which always does a direct read using address_space_ldl(), rather
10051 * than going via this function, so we don't need to check that here.
10052 */
10053 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
10054 } else { /* MPU enabled */
10055 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
10056 /* region search */
10057 uint32_t base = env->pmsav7.drbar[n];
10058 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5);
10059 uint32_t rmask;
10060 bool srdis = false;
10061
10062 if (!(env->pmsav7.drsr[n] & 0x1)) {
10063 continue;
10064 }
10065
10066 if (!rsize) {
10067 qemu_log_mask(LOG_GUEST_ERROR,
10068 "DRSR[%d]: Rsize field cannot be 0\n", n);
10069 continue;
10070 }
10071 rsize++;
10072 rmask = (1ull << rsize) - 1;
10073
10074 if (base & rmask) {
10075 qemu_log_mask(LOG_GUEST_ERROR,
10076 "DRBAR[%d]: 0x%" PRIx32 " misaligned "
10077 "to DRSR region size, mask = 0x%" PRIx32 "\n",
10078 n, base, rmask);
10079 continue;
10080 }
10081
10082 if (address < base || address > base + rmask) {
10083 /*
10084 * Address not in this region. We must check whether the
10085 * region covers addresses in the same page as our address.
10086 * In that case we must not report a size that covers the
10087 * whole page for a subsequent hit against a different MPU
10088 * region or the background region, because it would result in
10089 * incorrect TLB hits for subsequent accesses to addresses that
10090 * are in this MPU region.
10091 */
10092 if (ranges_overlap(base, rmask,
10093 address & TARGET_PAGE_MASK,
10094 TARGET_PAGE_SIZE)) {
10095 *page_size = 1;
10096 }
10097 continue;
10098 }
10099
10100 /* Region matched */
10101
10102 if (rsize >= 8) { /* no subregions for regions < 256 bytes */
10103 int i, snd;
10104 uint32_t srdis_mask;
10105
10106 rsize -= 3; /* sub region size (power of 2) */
10107 snd = ((address - base) >> rsize) & 0x7;
10108 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1);
10109
10110 srdis_mask = srdis ? 0x3 : 0x0;
10111 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) {
10112 /* This will check in groups of 2, 4 and then 8, whether
10113 * the subregion bits are consistent. rsize is incremented
10114 * back up to give the region size, considering consistent
10115 * adjacent subregions as one region. Stop testing if rsize
10116 * is already big enough for an entire QEMU page.
10117 */
10118 int snd_rounded = snd & ~(i - 1);
10119 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n],
10120 snd_rounded + 8, i);
10121 if (srdis_mask ^ srdis_multi) {
10122 break;
10123 }
10124 srdis_mask = (srdis_mask << i) | srdis_mask;
10125 rsize++;
10126 }
10127 }
10128 if (srdis) {
10129 continue;
10130 }
10131 if (rsize < TARGET_PAGE_BITS) {
10132 *page_size = 1 << rsize;
10133 }
10134 break;
10135 }
10136
10137 if (n == -1) { /* no hits */
10138 if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
10139 /* background fault */
10140 fi->type = ARMFault_Background;
10141 return true;
10142 }
10143 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
10144 } else { /* a MPU hit! */
10145 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
10146 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
10147
10148 if (m_is_system_region(env, address)) {
10149 /* System space is always execute never */
10150 xn = 1;
10151 }
10152
10153 if (is_user) { /* User mode AP bit decoding */
10154 switch (ap) {
10155 case 0:
10156 case 1:
10157 case 5:
10158 break; /* no access */
10159 case 3:
10160 *prot |= PAGE_WRITE;
10161 /* fall through */
10162 case 2:
10163 case 6:
10164 *prot |= PAGE_READ | PAGE_EXEC;
10165 break;
10166 case 7:
10167 /* for v7M, same as 6; for R profile a reserved value */
10168 if (arm_feature(env, ARM_FEATURE_M)) {
10169 *prot |= PAGE_READ | PAGE_EXEC;
10170 break;
10171 }
10172 /* fall through */
10173 default:
10174 qemu_log_mask(LOG_GUEST_ERROR,
10175 "DRACR[%d]: Bad value for AP bits: 0x%"
10176 PRIx32 "\n", n, ap);
10177 }
10178 } else { /* Priv. mode AP bits decoding */
10179 switch (ap) {
10180 case 0:
10181 break; /* no access */
10182 case 1:
10183 case 2:
10184 case 3:
10185 *prot |= PAGE_WRITE;
10186 /* fall through */
10187 case 5:
10188 case 6:
10189 *prot |= PAGE_READ | PAGE_EXEC;
10190 break;
10191 case 7:
10192 /* for v7M, same as 6; for R profile a reserved value */
10193 if (arm_feature(env, ARM_FEATURE_M)) {
10194 *prot |= PAGE_READ | PAGE_EXEC;
10195 break;
10196 }
10197 /* fall through */
10198 default:
10199 qemu_log_mask(LOG_GUEST_ERROR,
10200 "DRACR[%d]: Bad value for AP bits: 0x%"
10201 PRIx32 "\n", n, ap);
10202 }
10203 }
10204
10205 /* execute never */
10206 if (xn) {
10207 *prot &= ~PAGE_EXEC;
10208 }
10209 }
10210 }
10211
10212 fi->type = ARMFault_Permission;
10213 fi->level = 1;
10214 return !(*prot & (1 << access_type));
10215 }
10216
10217 static bool v8m_is_sau_exempt(CPUARMState *env,
10218 uint32_t address, MMUAccessType access_type)
10219 {
10220 /* The architecture specifies that certain address ranges are
10221 * exempt from v8M SAU/IDAU checks.
10222 */
10223 return
10224 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
10225 (address >= 0xe0000000 && address <= 0xe0002fff) ||
10226 (address >= 0xe000e000 && address <= 0xe000efff) ||
10227 (address >= 0xe002e000 && address <= 0xe002efff) ||
10228 (address >= 0xe0040000 && address <= 0xe0041fff) ||
10229 (address >= 0xe00ff000 && address <= 0xe00fffff);
10230 }
10231
10232 void v8m_security_lookup(CPUARMState *env, uint32_t address,
10233 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10234 V8M_SAttributes *sattrs)
10235 {
10236 /* Look up the security attributes for this address. Compare the
10237 * pseudocode SecurityCheck() function.
10238 * We assume the caller has zero-initialized *sattrs.
10239 */
10240 ARMCPU *cpu = env_archcpu(env);
10241 int r;
10242 bool idau_exempt = false, idau_ns = true, idau_nsc = true;
10243 int idau_region = IREGION_NOTVALID;
10244 uint32_t addr_page_base = address & TARGET_PAGE_MASK;
10245 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
10246
10247 if (cpu->idau) {
10248 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau);
10249 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau);
10250
10251 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns,
10252 &idau_nsc);
10253 }
10254
10255 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
10256 /* 0xf0000000..0xffffffff is always S for insn fetches */
10257 return;
10258 }
10259
10260 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) {
10261 sattrs->ns = !regime_is_secure(env, mmu_idx);
10262 return;
10263 }
10264
10265 if (idau_region != IREGION_NOTVALID) {
10266 sattrs->irvalid = true;
10267 sattrs->iregion = idau_region;
10268 }
10269
10270 switch (env->sau.ctrl & 3) {
10271 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
10272 break;
10273 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
10274 sattrs->ns = true;
10275 break;
10276 default: /* SAU.ENABLE == 1 */
10277 for (r = 0; r < cpu->sau_sregion; r++) {
10278 if (env->sau.rlar[r] & 1) {
10279 uint32_t base = env->sau.rbar[r] & ~0x1f;
10280 uint32_t limit = env->sau.rlar[r] | 0x1f;
10281
10282 if (base <= address && limit >= address) {
10283 if (base > addr_page_base || limit < addr_page_limit) {
10284 sattrs->subpage = true;
10285 }
10286 if (sattrs->srvalid) {
10287 /* If we hit in more than one region then we must report
10288 * as Secure, not NS-Callable, with no valid region
10289 * number info.
10290 */
10291 sattrs->ns = false;
10292 sattrs->nsc = false;
10293 sattrs->sregion = 0;
10294 sattrs->srvalid = false;
10295 break;
10296 } else {
10297 if (env->sau.rlar[r] & 2) {
10298 sattrs->nsc = true;
10299 } else {
10300 sattrs->ns = true;
10301 }
10302 sattrs->srvalid = true;
10303 sattrs->sregion = r;
10304 }
10305 } else {
10306 /*
10307 * Address not in this region. We must check whether the
10308 * region covers addresses in the same page as our address.
10309 * In that case we must not report a size that covers the
10310 * whole page for a subsequent hit against a different MPU
10311 * region or the background region, because it would result
10312 * in incorrect TLB hits for subsequent accesses to
10313 * addresses that are in this MPU region.
10314 */
10315 if (limit >= base &&
10316 ranges_overlap(base, limit - base + 1,
10317 addr_page_base,
10318 TARGET_PAGE_SIZE)) {
10319 sattrs->subpage = true;
10320 }
10321 }
10322 }
10323 }
10324 break;
10325 }
10326
10327 /*
10328 * The IDAU will override the SAU lookup results if it specifies
10329 * higher security than the SAU does.
10330 */
10331 if (!idau_ns) {
10332 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) {
10333 sattrs->ns = false;
10334 sattrs->nsc = idau_nsc;
10335 }
10336 }
10337 }
10338
10339 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
10340 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10341 hwaddr *phys_ptr, MemTxAttrs *txattrs,
10342 int *prot, bool *is_subpage,
10343 ARMMMUFaultInfo *fi, uint32_t *mregion)
10344 {
10345 /* Perform a PMSAv8 MPU lookup (without also doing the SAU check
10346 * that a full phys-to-virt translation does).
10347 * mregion is (if not NULL) set to the region number which matched,
10348 * or -1 if no region number is returned (MPU off, address did not
10349 * hit a region, address hit in multiple regions).
10350 * We set is_subpage to true if the region hit doesn't cover the
10351 * entire TARGET_PAGE the address is within.
10352 */
10353 ARMCPU *cpu = env_archcpu(env);
10354 bool is_user = regime_is_user(env, mmu_idx);
10355 uint32_t secure = regime_is_secure(env, mmu_idx);
10356 int n;
10357 int matchregion = -1;
10358 bool hit = false;
10359 uint32_t addr_page_base = address & TARGET_PAGE_MASK;
10360 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
10361
10362 *is_subpage = false;
10363 *phys_ptr = address;
10364 *prot = 0;
10365 if (mregion) {
10366 *mregion = -1;
10367 }
10368
10369 /* Unlike the ARM ARM pseudocode, we don't need to check whether this
10370 * was an exception vector read from the vector table (which is always
10371 * done using the default system address map), because those accesses
10372 * are done in arm_v7m_load_vector(), which always does a direct
10373 * read using address_space_ldl(), rather than going via this function.
10374 */
10375 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */
10376 hit = true;
10377 } else if (m_is_ppb_region(env, address)) {
10378 hit = true;
10379 } else {
10380 if (pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
10381 hit = true;
10382 }
10383
10384 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
10385 /* region search */
10386 /* Note that the base address is bits [31:5] from the register
10387 * with bits [4:0] all zeroes, but the limit address is bits
10388 * [31:5] from the register with bits [4:0] all ones.
10389 */
10390 uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f;
10391 uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f;
10392
10393 if (!(env->pmsav8.rlar[secure][n] & 0x1)) {
10394 /* Region disabled */
10395 continue;
10396 }
10397
10398 if (address < base || address > limit) {
10399 /*
10400 * Address not in this region. We must check whether the
10401 * region covers addresses in the same page as our address.
10402 * In that case we must not report a size that covers the
10403 * whole page for a subsequent hit against a different MPU
10404 * region or the background region, because it would result in
10405 * incorrect TLB hits for subsequent accesses to addresses that
10406 * are in this MPU region.
10407 */
10408 if (limit >= base &&
10409 ranges_overlap(base, limit - base + 1,
10410 addr_page_base,
10411 TARGET_PAGE_SIZE)) {
10412 *is_subpage = true;
10413 }
10414 continue;
10415 }
10416
10417 if (base > addr_page_base || limit < addr_page_limit) {
10418 *is_subpage = true;
10419 }
10420
10421 if (matchregion != -1) {
10422 /* Multiple regions match -- always a failure (unlike
10423 * PMSAv7 where highest-numbered-region wins)
10424 */
10425 fi->type = ARMFault_Permission;
10426 fi->level = 1;
10427 return true;
10428 }
10429
10430 matchregion = n;
10431 hit = true;
10432 }
10433 }
10434
10435 if (!hit) {
10436 /* background fault */
10437 fi->type = ARMFault_Background;
10438 return true;
10439 }
10440
10441 if (matchregion == -1) {
10442 /* hit using the background region */
10443 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
10444 } else {
10445 uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2);
10446 uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1);
10447
10448 if (m_is_system_region(env, address)) {
10449 /* System space is always execute never */
10450 xn = 1;
10451 }
10452
10453 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
10454 if (*prot && !xn) {
10455 *prot |= PAGE_EXEC;
10456 }
10457 /* We don't need to look the attribute up in the MAIR0/MAIR1
10458 * registers because that only tells us about cacheability.
10459 */
10460 if (mregion) {
10461 *mregion = matchregion;
10462 }
10463 }
10464
10465 fi->type = ARMFault_Permission;
10466 fi->level = 1;
10467 return !(*prot & (1 << access_type));
10468 }
10469
10470
10471 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
10472 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10473 hwaddr *phys_ptr, MemTxAttrs *txattrs,
10474 int *prot, target_ulong *page_size,
10475 ARMMMUFaultInfo *fi)
10476 {
10477 uint32_t secure = regime_is_secure(env, mmu_idx);
10478 V8M_SAttributes sattrs = {};
10479 bool ret;
10480 bool mpu_is_subpage;
10481
10482 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
10483 v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs);
10484 if (access_type == MMU_INST_FETCH) {
10485 /* Instruction fetches always use the MMU bank and the
10486 * transaction attribute determined by the fetch address,
10487 * regardless of CPU state. This is painful for QEMU
10488 * to handle, because it would mean we need to encode
10489 * into the mmu_idx not just the (user, negpri) information
10490 * for the current security state but also that for the
10491 * other security state, which would balloon the number
10492 * of mmu_idx values needed alarmingly.
10493 * Fortunately we can avoid this because it's not actually
10494 * possible to arbitrarily execute code from memory with
10495 * the wrong security attribute: it will always generate
10496 * an exception of some kind or another, apart from the
10497 * special case of an NS CPU executing an SG instruction
10498 * in S&NSC memory. So we always just fail the translation
10499 * here and sort things out in the exception handler
10500 * (including possibly emulating an SG instruction).
10501 */
10502 if (sattrs.ns != !secure) {
10503 if (sattrs.nsc) {
10504 fi->type = ARMFault_QEMU_NSCExec;
10505 } else {
10506 fi->type = ARMFault_QEMU_SFault;
10507 }
10508 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
10509 *phys_ptr = address;
10510 *prot = 0;
10511 return true;
10512 }
10513 } else {
10514 /* For data accesses we always use the MMU bank indicated
10515 * by the current CPU state, but the security attributes
10516 * might downgrade a secure access to nonsecure.
10517 */
10518 if (sattrs.ns) {
10519 txattrs->secure = false;
10520 } else if (!secure) {
10521 /* NS access to S memory must fault.
10522 * Architecturally we should first check whether the
10523 * MPU information for this address indicates that we
10524 * are doing an unaligned access to Device memory, which
10525 * should generate a UsageFault instead. QEMU does not
10526 * currently check for that kind of unaligned access though.
10527 * If we added it we would need to do so as a special case
10528 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
10529 */
10530 fi->type = ARMFault_QEMU_SFault;
10531 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
10532 *phys_ptr = address;
10533 *prot = 0;
10534 return true;
10535 }
10536 }
10537 }
10538
10539 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr,
10540 txattrs, prot, &mpu_is_subpage, fi, NULL);
10541 *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE;
10542 return ret;
10543 }
10544
10545 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
10546 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10547 hwaddr *phys_ptr, int *prot,
10548 ARMMMUFaultInfo *fi)
10549 {
10550 int n;
10551 uint32_t mask;
10552 uint32_t base;
10553 bool is_user = regime_is_user(env, mmu_idx);
10554
10555 if (regime_translation_disabled(env, mmu_idx)) {
10556 /* MPU disabled. */
10557 *phys_ptr = address;
10558 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
10559 return false;
10560 }
10561
10562 *phys_ptr = address;
10563 for (n = 7; n >= 0; n--) {
10564 base = env->cp15.c6_region[n];
10565 if ((base & 1) == 0) {
10566 continue;
10567 }
10568 mask = 1 << ((base >> 1) & 0x1f);
10569 /* Keep this shift separate from the above to avoid an
10570 (undefined) << 32. */
10571 mask = (mask << 1) - 1;
10572 if (((base ^ address) & ~mask) == 0) {
10573 break;
10574 }
10575 }
10576 if (n < 0) {
10577 fi->type = ARMFault_Background;
10578 return true;
10579 }
10580
10581 if (access_type == MMU_INST_FETCH) {
10582 mask = env->cp15.pmsav5_insn_ap;
10583 } else {
10584 mask = env->cp15.pmsav5_data_ap;
10585 }
10586 mask = (mask >> (n * 4)) & 0xf;
10587 switch (mask) {
10588 case 0:
10589 fi->type = ARMFault_Permission;
10590 fi->level = 1;
10591 return true;
10592 case 1:
10593 if (is_user) {
10594 fi->type = ARMFault_Permission;
10595 fi->level = 1;
10596 return true;
10597 }
10598 *prot = PAGE_READ | PAGE_WRITE;
10599 break;
10600 case 2:
10601 *prot = PAGE_READ;
10602 if (!is_user) {
10603 *prot |= PAGE_WRITE;
10604 }
10605 break;
10606 case 3:
10607 *prot = PAGE_READ | PAGE_WRITE;
10608 break;
10609 case 5:
10610 if (is_user) {
10611 fi->type = ARMFault_Permission;
10612 fi->level = 1;
10613 return true;
10614 }
10615 *prot = PAGE_READ;
10616 break;
10617 case 6:
10618 *prot = PAGE_READ;
10619 break;
10620 default:
10621 /* Bad permission. */
10622 fi->type = ARMFault_Permission;
10623 fi->level = 1;
10624 return true;
10625 }
10626 *prot |= PAGE_EXEC;
10627 return false;
10628 }
10629
10630 /* Combine either inner or outer cacheability attributes for normal
10631 * memory, according to table D4-42 and pseudocode procedure
10632 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
10633 *
10634 * NB: only stage 1 includes allocation hints (RW bits), leading to
10635 * some asymmetry.
10636 */
10637 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
10638 {
10639 if (s1 == 4 || s2 == 4) {
10640 /* non-cacheable has precedence */
10641 return 4;
10642 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
10643 /* stage 1 write-through takes precedence */
10644 return s1;
10645 } else if (extract32(s2, 2, 2) == 2) {
10646 /* stage 2 write-through takes precedence, but the allocation hint
10647 * is still taken from stage 1
10648 */
10649 return (2 << 2) | extract32(s1, 0, 2);
10650 } else { /* write-back */
10651 return s1;
10652 }
10653 }
10654
10655 /* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
10656 * and CombineS1S2Desc()
10657 *
10658 * @s1: Attributes from stage 1 walk
10659 * @s2: Attributes from stage 2 walk
10660 */
10661 static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2)
10662 {
10663 uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4);
10664 uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4);
10665 ARMCacheAttrs ret;
10666
10667 /* Combine shareability attributes (table D4-43) */
10668 if (s1.shareability == 2 || s2.shareability == 2) {
10669 /* if either are outer-shareable, the result is outer-shareable */
10670 ret.shareability = 2;
10671 } else if (s1.shareability == 3 || s2.shareability == 3) {
10672 /* if either are inner-shareable, the result is inner-shareable */
10673 ret.shareability = 3;
10674 } else {
10675 /* both non-shareable */
10676 ret.shareability = 0;
10677 }
10678
10679 /* Combine memory type and cacheability attributes */
10680 if (s1hi == 0 || s2hi == 0) {
10681 /* Device has precedence over normal */
10682 if (s1lo == 0 || s2lo == 0) {
10683 /* nGnRnE has precedence over anything */
10684 ret.attrs = 0;
10685 } else if (s1lo == 4 || s2lo == 4) {
10686 /* non-Reordering has precedence over Reordering */
10687 ret.attrs = 4; /* nGnRE */
10688 } else if (s1lo == 8 || s2lo == 8) {
10689 /* non-Gathering has precedence over Gathering */
10690 ret.attrs = 8; /* nGRE */
10691 } else {
10692 ret.attrs = 0xc; /* GRE */
10693 }
10694
10695 /* Any location for which the resultant memory type is any
10696 * type of Device memory is always treated as Outer Shareable.
10697 */
10698 ret.shareability = 2;
10699 } else { /* Normal memory */
10700 /* Outer/inner cacheability combine independently */
10701 ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
10702 | combine_cacheattr_nibble(s1lo, s2lo);
10703
10704 if (ret.attrs == 0x44) {
10705 /* Any location for which the resultant memory type is Normal
10706 * Inner Non-cacheable, Outer Non-cacheable is always treated
10707 * as Outer Shareable.
10708 */
10709 ret.shareability = 2;
10710 }
10711 }
10712
10713 return ret;
10714 }
10715
10716
10717 /* get_phys_addr - get the physical address for this virtual address
10718 *
10719 * Find the physical address corresponding to the given virtual address,
10720 * by doing a translation table walk on MMU based systems or using the
10721 * MPU state on MPU based systems.
10722 *
10723 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
10724 * prot and page_size may not be filled in, and the populated fsr value provides
10725 * information on why the translation aborted, in the format of a
10726 * DFSR/IFSR fault register, with the following caveats:
10727 * * we honour the short vs long DFSR format differences.
10728 * * the WnR bit is never set (the caller must do this).
10729 * * for PSMAv5 based systems we don't bother to return a full FSR format
10730 * value.
10731 *
10732 * @env: CPUARMState
10733 * @address: virtual address to get physical address for
10734 * @access_type: 0 for read, 1 for write, 2 for execute
10735 * @mmu_idx: MMU index indicating required translation regime
10736 * @phys_ptr: set to the physical address corresponding to the virtual address
10737 * @attrs: set to the memory transaction attributes to use
10738 * @prot: set to the permissions for the page containing phys_ptr
10739 * @page_size: set to the size of the page containing phys_ptr
10740 * @fi: set to fault info if the translation fails
10741 * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
10742 */
10743 bool get_phys_addr(CPUARMState *env, target_ulong address,
10744 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10745 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
10746 target_ulong *page_size,
10747 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
10748 {
10749 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
10750 /* Call ourselves recursively to do the stage 1 and then stage 2
10751 * translations.
10752 */
10753 if (arm_feature(env, ARM_FEATURE_EL2)) {
10754 hwaddr ipa;
10755 int s2_prot;
10756 int ret;
10757 ARMCacheAttrs cacheattrs2 = {};
10758
10759 ret = get_phys_addr(env, address, access_type,
10760 stage_1_mmu_idx(mmu_idx), &ipa, attrs,
10761 prot, page_size, fi, cacheattrs);
10762
10763 /* If S1 fails or S2 is disabled, return early. */
10764 if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
10765 *phys_ptr = ipa;
10766 return ret;
10767 }
10768
10769 /* S1 is done. Now do S2 translation. */
10770 ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS,
10771 phys_ptr, attrs, &s2_prot,
10772 page_size, fi,
10773 cacheattrs != NULL ? &cacheattrs2 : NULL);
10774 fi->s2addr = ipa;
10775 /* Combine the S1 and S2 perms. */
10776 *prot &= s2_prot;
10777
10778 /* Combine the S1 and S2 cache attributes, if needed */
10779 if (!ret && cacheattrs != NULL) {
10780 if (env->cp15.hcr_el2 & HCR_DC) {
10781 /*
10782 * HCR.DC forces the first stage attributes to
10783 * Normal Non-Shareable,
10784 * Inner Write-Back Read-Allocate Write-Allocate,
10785 * Outer Write-Back Read-Allocate Write-Allocate.
10786 */
10787 cacheattrs->attrs = 0xff;
10788 cacheattrs->shareability = 0;
10789 }
10790 *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
10791 }
10792
10793 return ret;
10794 } else {
10795 /*
10796 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
10797 */
10798 mmu_idx = stage_1_mmu_idx(mmu_idx);
10799 }
10800 }
10801
10802 /* The page table entries may downgrade secure to non-secure, but
10803 * cannot upgrade an non-secure translation regime's attributes
10804 * to secure.
10805 */
10806 attrs->secure = regime_is_secure(env, mmu_idx);
10807 attrs->user = regime_is_user(env, mmu_idx);
10808
10809 /* Fast Context Switch Extension. This doesn't exist at all in v8.
10810 * In v7 and earlier it affects all stage 1 translations.
10811 */
10812 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS
10813 && !arm_feature(env, ARM_FEATURE_V8)) {
10814 if (regime_el(env, mmu_idx) == 3) {
10815 address += env->cp15.fcseidr_s;
10816 } else {
10817 address += env->cp15.fcseidr_ns;
10818 }
10819 }
10820
10821 if (arm_feature(env, ARM_FEATURE_PMSA)) {
10822 bool ret;
10823 *page_size = TARGET_PAGE_SIZE;
10824
10825 if (arm_feature(env, ARM_FEATURE_V8)) {
10826 /* PMSAv8 */
10827 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx,
10828 phys_ptr, attrs, prot, page_size, fi);
10829 } else if (arm_feature(env, ARM_FEATURE_V7)) {
10830 /* PMSAv7 */
10831 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
10832 phys_ptr, prot, page_size, fi);
10833 } else {
10834 /* Pre-v7 MPU */
10835 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
10836 phys_ptr, prot, fi);
10837 }
10838 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32
10839 " mmu_idx %u -> %s (prot %c%c%c)\n",
10840 access_type == MMU_DATA_LOAD ? "reading" :
10841 (access_type == MMU_DATA_STORE ? "writing" : "execute"),
10842 (uint32_t)address, mmu_idx,
10843 ret ? "Miss" : "Hit",
10844 *prot & PAGE_READ ? 'r' : '-',
10845 *prot & PAGE_WRITE ? 'w' : '-',
10846 *prot & PAGE_EXEC ? 'x' : '-');
10847
10848 return ret;
10849 }
10850
10851 /* Definitely a real MMU, not an MPU */
10852
10853 if (regime_translation_disabled(env, mmu_idx)) {
10854 /* MMU disabled. */
10855 *phys_ptr = address;
10856 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
10857 *page_size = TARGET_PAGE_SIZE;
10858 return 0;
10859 }
10860
10861 if (regime_using_lpae_format(env, mmu_idx)) {
10862 return get_phys_addr_lpae(env, address, access_type, mmu_idx,
10863 phys_ptr, attrs, prot, page_size,
10864 fi, cacheattrs);
10865 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
10866 return get_phys_addr_v6(env, address, access_type, mmu_idx,
10867 phys_ptr, attrs, prot, page_size, fi);
10868 } else {
10869 return get_phys_addr_v5(env, address, access_type, mmu_idx,
10870 phys_ptr, prot, page_size, fi);
10871 }
10872 }
10873
10874 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
10875 MemTxAttrs *attrs)
10876 {
10877 ARMCPU *cpu = ARM_CPU(cs);
10878 CPUARMState *env = &cpu->env;
10879 hwaddr phys_addr;
10880 target_ulong page_size;
10881 int prot;
10882 bool ret;
10883 ARMMMUFaultInfo fi = {};
10884 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
10885
10886 *attrs = (MemTxAttrs) {};
10887
10888 ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
10889 attrs, &prot, &page_size, &fi, NULL);
10890
10891 if (ret) {
10892 return -1;
10893 }
10894 return phys_addr;
10895 }
10896
10897 #endif
10898
10899 /* Note that signed overflow is undefined in C. The following routines are
10900 careful to use unsigned types where modulo arithmetic is required.
10901 Failure to do so _will_ break on newer gcc. */
10902
10903 /* Signed saturating arithmetic. */
10904
10905 /* Perform 16-bit signed saturating addition. */
10906 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
10907 {
10908 uint16_t res;
10909
10910 res = a + b;
10911 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
10912 if (a & 0x8000)
10913 res = 0x8000;
10914 else
10915 res = 0x7fff;
10916 }
10917 return res;
10918 }
10919
10920 /* Perform 8-bit signed saturating addition. */
10921 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
10922 {
10923 uint8_t res;
10924
10925 res = a + b;
10926 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
10927 if (a & 0x80)
10928 res = 0x80;
10929 else
10930 res = 0x7f;
10931 }
10932 return res;
10933 }
10934
10935 /* Perform 16-bit signed saturating subtraction. */
10936 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
10937 {
10938 uint16_t res;
10939
10940 res = a - b;
10941 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
10942 if (a & 0x8000)
10943 res = 0x8000;
10944 else
10945 res = 0x7fff;
10946 }
10947 return res;
10948 }
10949
10950 /* Perform 8-bit signed saturating subtraction. */
10951 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
10952 {
10953 uint8_t res;
10954
10955 res = a - b;
10956 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
10957 if (a & 0x80)
10958 res = 0x80;
10959 else
10960 res = 0x7f;
10961 }
10962 return res;
10963 }
10964
10965 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
10966 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
10967 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8);
10968 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8);
10969 #define PFX q
10970
10971 #include "op_addsub.h"
10972
10973 /* Unsigned saturating arithmetic. */
10974 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
10975 {
10976 uint16_t res;
10977 res = a + b;
10978 if (res < a)
10979 res = 0xffff;
10980 return res;
10981 }
10982
10983 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
10984 {
10985 if (a > b)
10986 return a - b;
10987 else
10988 return 0;
10989 }
10990
10991 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
10992 {
10993 uint8_t res;
10994 res = a + b;
10995 if (res < a)
10996 res = 0xff;
10997 return res;
10998 }
10999
11000 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
11001 {
11002 if (a > b)
11003 return a - b;
11004 else
11005 return 0;
11006 }
11007
11008 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
11009 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
11010 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8);
11011 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8);
11012 #define PFX uq
11013
11014 #include "op_addsub.h"
11015
11016 /* Signed modulo arithmetic. */
11017 #define SARITH16(a, b, n, op) do { \
11018 int32_t sum; \
11019 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
11020 RESULT(sum, n, 16); \
11021 if (sum >= 0) \
11022 ge |= 3 << (n * 2); \
11023 } while(0)
11024
11025 #define SARITH8(a, b, n, op) do { \
11026 int32_t sum; \
11027 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
11028 RESULT(sum, n, 8); \
11029 if (sum >= 0) \
11030 ge |= 1 << n; \
11031 } while(0)
11032
11033
11034 #define ADD16(a, b, n) SARITH16(a, b, n, +)
11035 #define SUB16(a, b, n) SARITH16(a, b, n, -)
11036 #define ADD8(a, b, n) SARITH8(a, b, n, +)
11037 #define SUB8(a, b, n) SARITH8(a, b, n, -)
11038 #define PFX s
11039 #define ARITH_GE
11040
11041 #include "op_addsub.h"
11042
11043 /* Unsigned modulo arithmetic. */
11044 #define ADD16(a, b, n) do { \
11045 uint32_t sum; \
11046 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
11047 RESULT(sum, n, 16); \
11048 if ((sum >> 16) == 1) \
11049 ge |= 3 << (n * 2); \
11050 } while(0)
11051
11052 #define ADD8(a, b, n) do { \
11053 uint32_t sum; \
11054 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
11055 RESULT(sum, n, 8); \
11056 if ((sum >> 8) == 1) \
11057 ge |= 1 << n; \
11058 } while(0)
11059
11060 #define SUB16(a, b, n) do { \
11061 uint32_t sum; \
11062 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
11063 RESULT(sum, n, 16); \
11064 if ((sum >> 16) == 0) \
11065 ge |= 3 << (n * 2); \
11066 } while(0)
11067
11068 #define SUB8(a, b, n) do { \
11069 uint32_t sum; \
11070 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
11071 RESULT(sum, n, 8); \
11072 if ((sum >> 8) == 0) \
11073 ge |= 1 << n; \
11074 } while(0)
11075
11076 #define PFX u
11077 #define ARITH_GE
11078
11079 #include "op_addsub.h"
11080
11081 /* Halved signed arithmetic. */
11082 #define ADD16(a, b, n) \
11083 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
11084 #define SUB16(a, b, n) \
11085 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
11086 #define ADD8(a, b, n) \
11087 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
11088 #define SUB8(a, b, n) \
11089 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
11090 #define PFX sh
11091
11092 #include "op_addsub.h"
11093
11094 /* Halved unsigned arithmetic. */
11095 #define ADD16(a, b, n) \
11096 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
11097 #define SUB16(a, b, n) \
11098 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
11099 #define ADD8(a, b, n) \
11100 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
11101 #define SUB8(a, b, n) \
11102 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
11103 #define PFX uh
11104
11105 #include "op_addsub.h"
11106
11107 static inline uint8_t do_usad(uint8_t a, uint8_t b)
11108 {
11109 if (a > b)
11110 return a - b;
11111 else
11112 return b - a;
11113 }
11114
11115 /* Unsigned sum of absolute byte differences. */
11116 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
11117 {
11118 uint32_t sum;
11119 sum = do_usad(a, b);
11120 sum += do_usad(a >> 8, b >> 8);
11121 sum += do_usad(a >> 16, b >>16);
11122 sum += do_usad(a >> 24, b >> 24);
11123 return sum;
11124 }
11125
11126 /* For ARMv6 SEL instruction. */
11127 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
11128 {
11129 uint32_t mask;
11130
11131 mask = 0;
11132 if (flags & 1)
11133 mask |= 0xff;
11134 if (flags & 2)
11135 mask |= 0xff00;
11136 if (flags & 4)
11137 mask |= 0xff0000;
11138 if (flags & 8)
11139 mask |= 0xff000000;
11140 return (a & mask) | (b & ~mask);
11141 }
11142
11143 /* CRC helpers.
11144 * The upper bytes of val (above the number specified by 'bytes') must have
11145 * been zeroed out by the caller.
11146 */
11147 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes)
11148 {
11149 uint8_t buf[4];
11150
11151 stl_le_p(buf, val);
11152
11153 /* zlib crc32 converts the accumulator and output to one's complement. */
11154 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff;
11155 }
11156
11157 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
11158 {
11159 uint8_t buf[4];
11160
11161 stl_le_p(buf, val);
11162
11163 /* Linux crc32c converts the output to one's complement. */
11164 return crc32c(acc, buf, bytes) ^ 0xffffffff;
11165 }
11166
11167 /* Return the exception level to which FP-disabled exceptions should
11168 * be taken, or 0 if FP is enabled.
11169 */
11170 int fp_exception_el(CPUARMState *env, int cur_el)
11171 {
11172 #ifndef CONFIG_USER_ONLY
11173 int fpen;
11174
11175 /* CPACR and the CPTR registers don't exist before v6, so FP is
11176 * always accessible
11177 */
11178 if (!arm_feature(env, ARM_FEATURE_V6)) {
11179 return 0;
11180 }
11181
11182 if (arm_feature(env, ARM_FEATURE_M)) {
11183 /* CPACR can cause a NOCP UsageFault taken to current security state */
11184 if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) {
11185 return 1;
11186 }
11187
11188 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) {
11189 if (!extract32(env->v7m.nsacr, 10, 1)) {
11190 /* FP insns cause a NOCP UsageFault taken to Secure */
11191 return 3;
11192 }
11193 }
11194
11195 return 0;
11196 }
11197
11198 /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
11199 * 0, 2 : trap EL0 and EL1/PL1 accesses
11200 * 1 : trap only EL0 accesses
11201 * 3 : trap no accesses
11202 */
11203 fpen = extract32(env->cp15.cpacr_el1, 20, 2);
11204 switch (fpen) {
11205 case 0:
11206 case 2:
11207 if (cur_el == 0 || cur_el == 1) {
11208 /* Trap to PL1, which might be EL1 or EL3 */
11209 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
11210 return 3;
11211 }
11212 return 1;
11213 }
11214 if (cur_el == 3 && !is_a64(env)) {
11215 /* Secure PL1 running at EL3 */
11216 return 3;
11217 }
11218 break;
11219 case 1:
11220 if (cur_el == 0) {
11221 return 1;
11222 }
11223 break;
11224 case 3:
11225 break;
11226 }
11227
11228 /*
11229 * The NSACR allows A-profile AArch32 EL3 and M-profile secure mode
11230 * to control non-secure access to the FPU. It doesn't have any
11231 * effect if EL3 is AArch64 or if EL3 doesn't exist at all.
11232 */
11233 if ((arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
11234 cur_el <= 2 && !arm_is_secure_below_el3(env))) {
11235 if (!extract32(env->cp15.nsacr, 10, 1)) {
11236 /* FP insns act as UNDEF */
11237 return cur_el == 2 ? 2 : 1;
11238 }
11239 }
11240
11241 /* For the CPTR registers we don't need to guard with an ARM_FEATURE
11242 * check because zero bits in the registers mean "don't trap".
11243 */
11244
11245 /* CPTR_EL2 : present in v7VE or v8 */
11246 if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
11247 && !arm_is_secure_below_el3(env)) {
11248 /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
11249 return 2;
11250 }
11251
11252 /* CPTR_EL3 : present in v8 */
11253 if (extract32(env->cp15.cptr_el[3], 10, 1)) {
11254 /* Trap all FP ops to EL3 */
11255 return 3;
11256 }
11257 #endif
11258 return 0;
11259 }
11260
11261 #ifndef CONFIG_TCG
11262 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
11263 {
11264 g_assert_not_reached();
11265 }
11266 #endif
11267
11268 ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
11269 {
11270 if (arm_feature(env, ARM_FEATURE_M)) {
11271 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
11272 }
11273
11274 if (el < 2 && arm_is_secure_below_el3(env)) {
11275 return ARMMMUIdx_S1SE0 + el;
11276 } else {
11277 return ARMMMUIdx_S12NSE0 + el;
11278 }
11279 }
11280
11281 ARMMMUIdx arm_mmu_idx(CPUARMState *env)
11282 {
11283 return arm_mmu_idx_el(env, arm_current_el(env));
11284 }
11285
11286 int cpu_mmu_index(CPUARMState *env, bool ifetch)
11287 {
11288 return arm_to_core_mmu_idx(arm_mmu_idx(env));
11289 }
11290
11291 #ifndef CONFIG_USER_ONLY
11292 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
11293 {
11294 return stage_1_mmu_idx(arm_mmu_idx(env));
11295 }
11296 #endif
11297
11298 static uint32_t rebuild_hflags_common(CPUARMState *env, int fp_el,
11299 ARMMMUIdx mmu_idx, uint32_t flags)
11300 {
11301 flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el);
11302 flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX,
11303 arm_to_core_mmu_idx(mmu_idx));
11304
11305 if (arm_singlestep_active(env)) {
11306 flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1);
11307 }
11308 return flags;
11309 }
11310
11311 static uint32_t rebuild_hflags_common_32(CPUARMState *env, int fp_el,
11312 ARMMMUIdx mmu_idx, uint32_t flags)
11313 {
11314 bool sctlr_b = arm_sctlr_b(env);
11315
11316 if (sctlr_b) {
11317 flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, 1);
11318 }
11319 if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) {
11320 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1);
11321 }
11322 flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env));
11323
11324 return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
11325 }
11326
11327 static uint32_t rebuild_hflags_m32(CPUARMState *env, int fp_el,
11328 ARMMMUIdx mmu_idx)
11329 {
11330 uint32_t flags = 0;
11331
11332 /* v8M always enables the fpu. */
11333 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1);
11334
11335 if (arm_v7m_is_handler_mode(env)) {
11336 flags = FIELD_DP32(flags, TBFLAG_A32, HANDLER, 1);
11337 }
11338
11339 /*
11340 * v8M always applies stack limit checks unless CCR.STKOFHFNMIGN
11341 * is suppressing them because the requested execution priority
11342 * is less than 0.
11343 */
11344 if (arm_feature(env, ARM_FEATURE_V8) &&
11345 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) &&
11346 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
11347 flags = FIELD_DP32(flags, TBFLAG_A32, STACKCHECK, 1);
11348 }
11349
11350 return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
11351 }
11352
11353 static uint32_t rebuild_hflags_aprofile(CPUARMState *env)
11354 {
11355 int flags = 0;
11356
11357 flags = FIELD_DP32(flags, TBFLAG_ANY, DEBUG_TARGET_EL,
11358 arm_debug_target_el(env));
11359 return flags;
11360 }
11361
11362 static uint32_t rebuild_hflags_a32(CPUARMState *env, int fp_el,
11363 ARMMMUIdx mmu_idx)
11364 {
11365 uint32_t flags = rebuild_hflags_aprofile(env);
11366
11367 if (arm_el_is_aa64(env, 1)) {
11368 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1);
11369 }
11370
11371 if (arm_current_el(env) < 2 && env->cp15.hstr_el2 &&
11372 (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
11373 flags = FIELD_DP32(flags, TBFLAG_A32, HSTR_ACTIVE, 1);
11374 }
11375
11376 return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
11377 }
11378
11379 static uint32_t rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
11380 ARMMMUIdx mmu_idx)
11381 {
11382 uint32_t flags = rebuild_hflags_aprofile(env);
11383 ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
11384 ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1);
11385 uint64_t sctlr;
11386 int tbii, tbid;
11387
11388 flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1);
11389
11390 /* FIXME: ARMv8.1-VHE S2 translation regime. */
11391 if (regime_el(env, stage1) < 2) {
11392 ARMVAParameters p1 = aa64_va_parameters_both(env, -1, stage1);
11393 tbid = (p1.tbi << 1) | p0.tbi;
11394 tbii = tbid & ~((p1.tbid << 1) | p0.tbid);
11395 } else {
11396 tbid = p0.tbi;
11397 tbii = tbid & !p0.tbid;
11398 }
11399
11400 flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii);
11401 flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid);
11402
11403 if (cpu_isar_feature(aa64_sve, env_archcpu(env))) {
11404 int sve_el = sve_exception_el(env, el);
11405 uint32_t zcr_len;
11406
11407 /*
11408 * If SVE is disabled, but FP is enabled,
11409 * then the effective len is 0.
11410 */
11411 if (sve_el != 0 && fp_el == 0) {
11412 zcr_len = 0;
11413 } else {
11414 zcr_len = sve_zcr_len_for_el(env, el);
11415 }
11416 flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el);
11417 flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len);
11418 }
11419
11420 sctlr = arm_sctlr(env, el);
11421
11422 if (arm_cpu_data_is_big_endian_a64(el, sctlr)) {
11423 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1);
11424 }
11425
11426 if (cpu_isar_feature(aa64_pauth, env_archcpu(env))) {
11427 /*
11428 * In order to save space in flags, we record only whether
11429 * pauth is "inactive", meaning all insns are implemented as
11430 * a nop, or "active" when some action must be performed.
11431 * The decision of which action to take is left to a helper.
11432 */
11433 if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
11434 flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1);
11435 }
11436 }
11437
11438 if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
11439 /* Note that SCTLR_EL[23].BT == SCTLR_BT1. */
11440 if (sctlr & (el == 0 ? SCTLR_BT0 : SCTLR_BT1)) {
11441 flags = FIELD_DP32(flags, TBFLAG_A64, BT, 1);
11442 }
11443 }
11444
11445 return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
11446 }
11447
11448 static uint32_t rebuild_hflags_internal(CPUARMState *env)
11449 {
11450 int el = arm_current_el(env);
11451 int fp_el = fp_exception_el(env, el);
11452 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
11453
11454 if (is_a64(env)) {
11455 return rebuild_hflags_a64(env, el, fp_el, mmu_idx);
11456 } else if (arm_feature(env, ARM_FEATURE_M)) {
11457 return rebuild_hflags_m32(env, fp_el, mmu_idx);
11458 } else {
11459 return rebuild_hflags_a32(env, fp_el, mmu_idx);
11460 }
11461 }
11462
11463 void arm_rebuild_hflags(CPUARMState *env)
11464 {
11465 env->hflags = rebuild_hflags_internal(env);
11466 }
11467
11468 void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
11469 {
11470 int fp_el = fp_exception_el(env, el);
11471 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
11472
11473 env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
11474 }
11475
11476 /*
11477 * If we have triggered a EL state change we can't rely on the
11478 * translator having passed it too us, we need to recompute.
11479 */
11480 void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env)
11481 {
11482 int el = arm_current_el(env);
11483 int fp_el = fp_exception_el(env, el);
11484 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
11485 env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
11486 }
11487
11488 void HELPER(rebuild_hflags_a32)(CPUARMState *env, int el)
11489 {
11490 int fp_el = fp_exception_el(env, el);
11491 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
11492
11493 env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
11494 }
11495
11496 void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el)
11497 {
11498 int fp_el = fp_exception_el(env, el);
11499 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
11500
11501 env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx);
11502 }
11503
11504 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
11505 target_ulong *cs_base, uint32_t *pflags)
11506 {
11507 uint32_t flags = env->hflags;
11508 uint32_t pstate_for_ss;
11509
11510 *cs_base = 0;
11511 #ifdef CONFIG_DEBUG_TCG
11512 assert(flags == rebuild_hflags_internal(env));
11513 #endif
11514
11515 if (FIELD_EX32(flags, TBFLAG_ANY, AARCH64_STATE)) {
11516 *pc = env->pc;
11517 if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
11518 flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype);
11519 }
11520 pstate_for_ss = env->pstate;
11521 } else {
11522 *pc = env->regs[15];
11523
11524 if (arm_feature(env, ARM_FEATURE_M)) {
11525 if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
11526 FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S)
11527 != env->v7m.secure) {
11528 flags = FIELD_DP32(flags, TBFLAG_A32, FPCCR_S_WRONG, 1);
11529 }
11530
11531 if ((env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) &&
11532 (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) ||
11533 (env->v7m.secure &&
11534 !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) {
11535 /*
11536 * ASPEN is set, but FPCA/SFPA indicate that there is no
11537 * active FP context; we must create a new FP context before
11538 * executing any FP insn.
11539 */
11540 flags = FIELD_DP32(flags, TBFLAG_A32, NEW_FP_CTXT_NEEDED, 1);
11541 }
11542
11543 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
11544 if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) {
11545 flags = FIELD_DP32(flags, TBFLAG_A32, LSPACT, 1);
11546 }
11547 } else {
11548 /*
11549 * Note that XSCALE_CPAR shares bits with VECSTRIDE.
11550 * Note that VECLEN+VECSTRIDE are RES0 for M-profile.
11551 */
11552 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
11553 flags = FIELD_DP32(flags, TBFLAG_A32,
11554 XSCALE_CPAR, env->cp15.c15_cpar);
11555 } else {
11556 flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN,
11557 env->vfp.vec_len);
11558 flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE,
11559 env->vfp.vec_stride);
11560 }
11561 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) {
11562 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1);
11563 }
11564 }
11565
11566 flags = FIELD_DP32(flags, TBFLAG_A32, THUMB, env->thumb);
11567 flags = FIELD_DP32(flags, TBFLAG_A32, CONDEXEC, env->condexec_bits);
11568 pstate_for_ss = env->uncached_cpsr;
11569 }
11570
11571 /*
11572 * The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
11573 * states defined in the ARM ARM for software singlestep:
11574 * SS_ACTIVE PSTATE.SS State
11575 * 0 x Inactive (the TB flag for SS is always 0)
11576 * 1 0 Active-pending
11577 * 1 1 Active-not-pending
11578 * SS_ACTIVE is set in hflags; PSTATE_SS is computed every TB.
11579 */
11580 if (FIELD_EX32(flags, TBFLAG_ANY, SS_ACTIVE) &&
11581 (pstate_for_ss & PSTATE_SS)) {
11582 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1);
11583 }
11584
11585 *pflags = flags;
11586 }
11587
11588 #ifdef TARGET_AARCH64
11589 /*
11590 * The manual says that when SVE is enabled and VQ is widened the
11591 * implementation is allowed to zero the previously inaccessible
11592 * portion of the registers. The corollary to that is that when
11593 * SVE is enabled and VQ is narrowed we are also allowed to zero
11594 * the now inaccessible portion of the registers.
11595 *
11596 * The intent of this is that no predicate bit beyond VQ is ever set.
11597 * Which means that some operations on predicate registers themselves
11598 * may operate on full uint64_t or even unrolled across the maximum
11599 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally
11600 * may well be cheaper than conditionals to restrict the operation
11601 * to the relevant portion of a uint16_t[16].
11602 */
11603 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq)
11604 {
11605 int i, j;
11606 uint64_t pmask;
11607
11608 assert(vq >= 1 && vq <= ARM_MAX_VQ);
11609 assert(vq <= env_archcpu(env)->sve_max_vq);
11610
11611 /* Zap the high bits of the zregs. */
11612 for (i = 0; i < 32; i++) {
11613 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq));
11614 }
11615
11616 /* Zap the high bits of the pregs and ffr. */
11617 pmask = 0;
11618 if (vq & 3) {
11619 pmask = ~(-1ULL << (16 * (vq & 3)));
11620 }
11621 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) {
11622 for (i = 0; i < 17; ++i) {
11623 env->vfp.pregs[i].p[j] &= pmask;
11624 }
11625 pmask = 0;
11626 }
11627 }
11628
11629 /*
11630 * Notice a change in SVE vector size when changing EL.
11631 */
11632 void aarch64_sve_change_el(CPUARMState *env, int old_el,
11633 int new_el, bool el0_a64)
11634 {
11635 ARMCPU *cpu = env_archcpu(env);
11636 int old_len, new_len;
11637 bool old_a64, new_a64;
11638
11639 /* Nothing to do if no SVE. */
11640 if (!cpu_isar_feature(aa64_sve, cpu)) {
11641 return;
11642 }
11643
11644 /* Nothing to do if FP is disabled in either EL. */
11645 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) {
11646 return;
11647 }
11648
11649 /*
11650 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped
11651 * at ELx, or not available because the EL is in AArch32 state, then
11652 * for all purposes other than a direct read, the ZCR_ELx.LEN field
11653 * has an effective value of 0".
11654 *
11655 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0).
11656 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition
11657 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that
11658 * we already have the correct register contents when encountering the
11659 * vq0->vq0 transition between EL0->EL1.
11660 */
11661 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64;
11662 old_len = (old_a64 && !sve_exception_el(env, old_el)
11663 ? sve_zcr_len_for_el(env, old_el) : 0);
11664 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64;
11665 new_len = (new_a64 && !sve_exception_el(env, new_el)
11666 ? sve_zcr_len_for_el(env, new_el) : 0);
11667
11668 /* When changing vector length, clear inaccessible state. */
11669 if (new_len < old_len) {
11670 aarch64_sve_narrow_vq(env, new_len + 1);
11671 }
11672 }
11673 #endif
AR7 emulation for QEMU