target-arm/helper.c

   1 #include "cpu.h"
   2 #include "internals.h"
   3 #include "exec/gdbstub.h"
   4 #include "exec/helper-proto.h"
   5 #include "qemu/host-utils.h"
   6 #include "sysemu/arch_init.h"
   7 #include "sysemu/sysemu.h"
   8 #include "qemu/bitops.h"
   9 #include "qemu/crc32c.h"
  10 #include "exec/cpu_ldst.h"
  11 #include "arm_ldst.h"
  12 #include <zlib.h> /* For crc32 */
  13 #include "exec/semihost.h"
  14
  15 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
  16
  17 #ifndef CONFIG_USER_ONLY
  18 static inline bool get_phys_addr(CPUARMState *env, target_ulong address,
  19                                  int access_type, ARMMMUIdx mmu_idx,
  20                                  hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
  21                                  target_ulong *page_size, uint32_t *fsr);
  22
  23 /* Definitions for the PMCCNTR and PMCR registers */
  24 #define PMCRD   0x8
  25 #define PMCRC   0x4
  26 #define PMCRE   0x1
  27 #endif
  28
  29 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
  30 {
  31     int nregs;
  32
  33     /* VFP data registers are always little-endian.  */
  34     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
  35     if (reg < nregs) {
  36         stfq_le_p(buf, env->vfp.regs[reg]);
  37         return 8;
  38     }
  39     if (arm_feature(env, ARM_FEATURE_NEON)) {
  40         /* Aliases for Q regs.  */
  41         nregs += 16;
  42         if (reg < nregs) {
  43             stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
  44             stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
  45             return 16;
  46         }
  47     }
  48     switch (reg - nregs) {
  49     case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
  50     case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
  51     case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
  52     }
  53     return 0;
  54 }
  55
  56 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
  57 {
  58     int nregs;
  59
  60     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
  61     if (reg < nregs) {
  62         env->vfp.regs[reg] = ldfq_le_p(buf);
  63         return 8;
  64     }
  65     if (arm_feature(env, ARM_FEATURE_NEON)) {
  66         nregs += 16;
  67         if (reg < nregs) {
  68             env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
  69             env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
  70             return 16;
  71         }
  72     }
  73     switch (reg - nregs) {
  74     case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
  75     case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
  76     case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
  77     }
  78     return 0;
  79 }
  80
  81 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
  82 {
  83     switch (reg) {
  84     case 0 ... 31:
  85         /* 128 bit FP register */
  86         stfq_le_p(buf, env->vfp.regs[reg * 2]);
  87         stfq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
  88         return 16;
  89     case 32:
  90         /* FPSR */
  91         stl_p(buf, vfp_get_fpsr(env));
  92         return 4;
  93     case 33:
  94         /* FPCR */
  95         stl_p(buf, vfp_get_fpcr(env));
  96         return 4;
  97     default:
  98         return 0;
  99     }
 100 }
 101
 102 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
 103 {
 104     switch (reg) {
 105     case 0 ... 31:
 106         /* 128 bit FP register */
 107         env->vfp.regs[reg * 2] = ldfq_le_p(buf);
 108         env->vfp.regs[reg * 2 + 1] = ldfq_le_p(buf + 8);
 109         return 16;
 110     case 32:
 111         /* FPSR */
 112         vfp_set_fpsr(env, ldl_p(buf));
 113         return 4;
 114     case 33:
 115         /* FPCR */
 116         vfp_set_fpcr(env, ldl_p(buf));
 117         return 4;
 118     default:
 119         return 0;
 120     }
 121 }
 122
 123 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
 124 {
 125     assert(ri->fieldoffset);
 126     if (cpreg_field_is_64bit(ri)) {
 127         return CPREG_FIELD64(env, ri);
 128     } else {
 129         return CPREG_FIELD32(env, ri);
 130     }
 131 }
 132
 133 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
 134                       uint64_t value)
 135 {
 136     assert(ri->fieldoffset);
 137     if (cpreg_field_is_64bit(ri)) {
 138         CPREG_FIELD64(env, ri) = value;
 139     } else {
 140         CPREG_FIELD32(env, ri) = value;
 141     }
 142 }
 143
 144 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri)
 145 {
 146     return (char *)env + ri->fieldoffset;
 147 }
 148
 149 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
 150 {
 151     /* Raw read of a coprocessor register (as needed for migration, etc). */
 152     if (ri->type & ARM_CP_CONST) {
 153         return ri->resetvalue;
 154     } else if (ri->raw_readfn) {
 155         return ri->raw_readfn(env, ri);
 156     } else if (ri->readfn) {
 157         return ri->readfn(env, ri);
 158     } else {
 159         return raw_read(env, ri);
 160     }
 161 }
 162
 163 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
 164                              uint64_t v)
 165 {
 166     /* Raw write of a coprocessor register (as needed for migration, etc).
 167      * Note that constant registers are treated as write-ignored; the
 168      * caller should check for success by whether a readback gives the
 169      * value written.
 170      */
 171     if (ri->type & ARM_CP_CONST) {
 172         return;
 173     } else if (ri->raw_writefn) {
 174         ri->raw_writefn(env, ri, v);
 175     } else if (ri->writefn) {
 176         ri->writefn(env, ri, v);
 177     } else {
 178         raw_write(env, ri, v);
 179     }
 180 }
 181
 182 static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
 183 {
 184    /* Return true if the regdef would cause an assertion if you called
 185     * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
 186     * program bug for it not to have the NO_RAW flag).
 187     * NB that returning false here doesn't necessarily mean that calling
 188     * read/write_raw_cp_reg() is safe, because we can't distinguish "has
 189     * read/write access functions which are safe for raw use" from "has
 190     * read/write access functions which have side effects but has forgotten
 191     * to provide raw access functions".
 192     * The tests here line up with the conditions in read/write_raw_cp_reg()
 193     * and assertions in raw_read()/raw_write().
 194     */
 195     if ((ri->type & ARM_CP_CONST) ||
 196         ri->fieldoffset ||
 197         ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) {
 198         return false;
 199     }
 200     return true;
 201 }
 202
 203 bool write_cpustate_to_list(ARMCPU *cpu)
 204 {
 205     /* Write the coprocessor state from cpu->env to the (index,value) list. */
 206     int i;
 207     bool ok = true;
 208
 209     for (i = 0; i < cpu->cpreg_array_len; i++) {
 210         uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
 211         const ARMCPRegInfo *ri;
 212
 213         ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
 214         if (!ri) {
 215             ok = false;
 216             continue;
 217         }
 218         if (ri->type & ARM_CP_NO_RAW) {
 219             continue;
 220         }
 221         cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
 222     }
 223     return ok;
 224 }
 225
 226 bool write_list_to_cpustate(ARMCPU *cpu)
 227 {
 228     int i;
 229     bool ok = true;
 230
 231     for (i = 0; i < cpu->cpreg_array_len; i++) {
 232         uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
 233         uint64_t v = cpu->cpreg_values[i];
 234         const ARMCPRegInfo *ri;
 235
 236         ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
 237         if (!ri) {
 238             ok = false;
 239             continue;
 240         }
 241         if (ri->type & ARM_CP_NO_RAW) {
 242             continue;
 243         }
 244         /* Write value and confirm it reads back as written
 245          * (to catch read-only registers and partially read-only
 246          * registers where the incoming migration value doesn't match)
 247          */
 248         write_raw_cp_reg(&cpu->env, ri, v);
 249         if (read_raw_cp_reg(&cpu->env, ri) != v) {
 250             ok = false;
 251         }
 252     }
 253     return ok;
 254 }
 255
 256 static void add_cpreg_to_list(gpointer key, gpointer opaque)
 257 {
 258     ARMCPU *cpu = opaque;
 259     uint64_t regidx;
 260     const ARMCPRegInfo *ri;
 261
 262     regidx = *(uint32_t *)key;
 263     ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
 264
 265     if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
 266         cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
 267         /* The value array need not be initialized at this point */
 268         cpu->cpreg_array_len++;
 269     }
 270 }
 271
 272 static void count_cpreg(gpointer key, gpointer opaque)
 273 {
 274     ARMCPU *cpu = opaque;
 275     uint64_t regidx;
 276     const ARMCPRegInfo *ri;
 277
 278     regidx = *(uint32_t *)key;
 279     ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
 280
 281     if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
 282         cpu->cpreg_array_len++;
 283     }
 284 }
 285
 286 static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
 287 {
 288     uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
 289     uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
 290
 291     if (aidx > bidx) {
 292         return 1;
 293     }
 294     if (aidx < bidx) {
 295         return -1;
 296     }
 297     return 0;
 298 }
 299
 300 void init_cpreg_list(ARMCPU *cpu)
 301 {
 302     /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
 303      * Note that we require cpreg_tuples[] to be sorted by key ID.
 304      */
 305     GList *keys;
 306     int arraylen;
 307
 308     keys = g_hash_table_get_keys(cpu->cp_regs);
 309     keys = g_list_sort(keys, cpreg_key_compare);
 310
 311     cpu->cpreg_array_len = 0;
 312
 313     g_list_foreach(keys, count_cpreg, cpu);
 314
 315     arraylen = cpu->cpreg_array_len;
 316     cpu->cpreg_indexes = g_new(uint64_t, arraylen);
 317     cpu->cpreg_values = g_new(uint64_t, arraylen);
 318     cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
 319     cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
 320     cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
 321     cpu->cpreg_array_len = 0;
 322
 323     g_list_foreach(keys, add_cpreg_to_list, cpu);
 324
 325     assert(cpu->cpreg_array_len == arraylen);
 326
 327     g_list_free(keys);
 328 }
 329
 330 /*
 331  * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but
 332  * they are accessible when EL3 is using AArch64 regardless of EL3.NS.
 333  *
 334  * access_el3_aa32ns: Used to check AArch32 register views.
 335  * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views.
 336  */
 337 static CPAccessResult access_el3_aa32ns(CPUARMState *env,
 338                                         const ARMCPRegInfo *ri)
 339 {
 340     bool secure = arm_is_secure_below_el3(env);
 341
 342     assert(!arm_el_is_aa64(env, 3));
 343     if (secure) {
 344         return CP_ACCESS_TRAP_UNCATEGORIZED;
 345     }
 346     return CP_ACCESS_OK;
 347 }
 348
 349 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env,
 350                                                 const ARMCPRegInfo *ri)
 351 {
 352     if (!arm_el_is_aa64(env, 3)) {
 353         return access_el3_aa32ns(env, ri);
 354     }
 355     return CP_ACCESS_OK;
 356 }
 357
 358 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 359 {
 360     ARMCPU *cpu = arm_env_get_cpu(env);
 361
 362     raw_write(env, ri, value);
 363     tlb_flush(CPU(cpu), 1); /* Flush TLB as domain not tracked in TLB */
 364 }
 365
 366 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 367 {
 368     ARMCPU *cpu = arm_env_get_cpu(env);
 369
 370     if (raw_read(env, ri) != value) {
 371         /* Unlike real hardware the qemu TLB uses virtual addresses,
 372          * not modified virtual addresses, so this causes a TLB flush.
 373          */
 374         tlb_flush(CPU(cpu), 1);
 375         raw_write(env, ri, value);
 376     }
 377 }
 378
 379 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 380                              uint64_t value)
 381 {
 382     ARMCPU *cpu = arm_env_get_cpu(env);
 383
 384     if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_MPU)
 385         && !extended_addresses_enabled(env)) {
 386         /* For VMSA (when not using the LPAE long descriptor page table
 387          * format) this register includes the ASID, so do a TLB flush.
 388          * For PMSA it is purely a process ID and no action is needed.
 389          */
 390         tlb_flush(CPU(cpu), 1);
 391     }
 392     raw_write(env, ri, value);
 393 }
 394
 395 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,
 396                           uint64_t value)
 397 {
 398     /* Invalidate all (TLBIALL) */
 399     ARMCPU *cpu = arm_env_get_cpu(env);
 400
 401     tlb_flush(CPU(cpu), 1);
 402 }
 403
 404 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,
 405                           uint64_t value)
 406 {
 407     /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
 408     ARMCPU *cpu = arm_env_get_cpu(env);
 409
 410     tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
 411 }
 412
 413 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,
 414                            uint64_t value)
 415 {
 416     /* Invalidate by ASID (TLBIASID) */
 417     ARMCPU *cpu = arm_env_get_cpu(env);
 418
 419     tlb_flush(CPU(cpu), value == 0);
 420 }
 421
 422 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
 423                            uint64_t value)
 424 {
 425     /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
 426     ARMCPU *cpu = arm_env_get_cpu(env);
 427
 428     tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
 429 }
 430
 431 /* IS variants of TLB operations must affect all cores */
 432 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 433                              uint64_t value)
 434 {
 435     CPUState *other_cs;
 436
 437     CPU_FOREACH(other_cs) {
 438         tlb_flush(other_cs, 1);
 439     }
 440 }
 441
 442 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 443                              uint64_t value)
 444 {
 445     CPUState *other_cs;
 446
 447     CPU_FOREACH(other_cs) {
 448         tlb_flush(other_cs, value == 0);
 449     }
 450 }
 451
 452 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 453                              uint64_t value)
 454 {
 455     CPUState *other_cs;
 456
 457     CPU_FOREACH(other_cs) {
 458         tlb_flush_page(other_cs, value & TARGET_PAGE_MASK);
 459     }
 460 }
 461
 462 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 463                              uint64_t value)
 464 {
 465     CPUState *other_cs;
 466
 467     CPU_FOREACH(other_cs) {
 468         tlb_flush_page(other_cs, value & TARGET_PAGE_MASK);
 469     }
 470 }
 471
 472 static const ARMCPRegInfo cp_reginfo[] = {
 473     /* Define the secure and non-secure FCSE identifier CP registers
 474      * separately because there is no secure bank in V8 (no _EL3).  This allows
 475      * the secure register to be properly reset and migrated. There is also no
 476      * v8 EL1 version of the register so the non-secure instance stands alone.
 477      */
 478     { .name = "FCSEIDR(NS)",
 479       .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
 480       .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
 481       .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns),
 482       .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
 483     { .name = "FCSEIDR(S)",
 484       .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
 485       .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
 486       .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s),
 487       .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
 488     /* Define the secure and non-secure context identifier CP registers
 489      * separately because there is no secure bank in V8 (no _EL3).  This allows
 490      * the secure register to be properly reset and migrated.  In the
 491      * non-secure case, the 32-bit register will have reset and migration
 492      * disabled during registration as it is handled by the 64-bit instance.
 493      */
 494     { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH,
 495       .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
 496       .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
 497       .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]),
 498       .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
 499     { .name = "CONTEXTIDR(S)", .state = ARM_CP_STATE_AA32,
 500       .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
 501       .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
 502       .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s),
 503       .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
 504     REGINFO_SENTINEL
 505 };
 506
 507 static const ARMCPRegInfo not_v8_cp_reginfo[] = {
 508     /* NB: Some of these registers exist in v8 but with more precise
 509      * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
 510      */
 511     /* MMU Domain access control / MPU write buffer control */
 512     { .name = "DACR",
 513       .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY,
 514       .access = PL1_RW, .resetvalue = 0,
 515       .writefn = dacr_write, .raw_writefn = raw_write,
 516       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
 517                              offsetoflow32(CPUARMState, cp15.dacr_ns) } },
 518     /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs.
 519      * For v6 and v5, these mappings are overly broad.
 520      */
 521     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0,
 522       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
 523     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1,
 524       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
 525     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4,
 526       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
 527     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8,
 528       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
 529     /* Cache maintenance ops; some of this space may be overridden later. */
 530     { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
 531       .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
 532       .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
 533     REGINFO_SENTINEL
 534 };
 535
 536 static const ARMCPRegInfo not_v6_cp_reginfo[] = {
 537     /* Not all pre-v6 cores implemented this WFI, so this is slightly
 538      * over-broad.
 539      */
 540     { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
 541       .access = PL1_W, .type = ARM_CP_WFI },
 542     REGINFO_SENTINEL
 543 };
 544
 545 static const ARMCPRegInfo not_v7_cp_reginfo[] = {
 546     /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
 547      * is UNPREDICTABLE; we choose to NOP as most implementations do).
 548      */
 549     { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
 550       .access = PL1_W, .type = ARM_CP_WFI },
 551     /* L1 cache lockdown. Not architectural in v6 and earlier but in practice
 552      * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
 553      * OMAPCP will override this space.
 554      */
 555     { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
 556       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
 557       .resetvalue = 0 },
 558     { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
 559       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
 560       .resetvalue = 0 },
 561     /* v6 doesn't have the cache ID registers but Linux reads them anyway */
 562     { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
 563       .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
 564       .resetvalue = 0 },
 565     /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
 566      * implementing it as RAZ means the "debug architecture version" bits
 567      * will read as a reserved value, which should cause Linux to not try
 568      * to use the debug hardware.
 569      */
 570     { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
 571       .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
 572     /* MMU TLB control. Note that the wildcarding means we cover not just
 573      * the unified TLB ops but also the dside/iside/inner-shareable variants.
 574      */
 575     { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
 576       .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
 577       .type = ARM_CP_NO_RAW },
 578     { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
 579       .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
 580       .type = ARM_CP_NO_RAW },
 581     { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
 582       .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
 583       .type = ARM_CP_NO_RAW },
 584     { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
 585       .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
 586       .type = ARM_CP_NO_RAW },
 587     { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2,
 588       .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP },
 589     { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2,
 590       .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP },
 591     REGINFO_SENTINEL
 592 };
 593
 594 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 595                         uint64_t value)
 596 {
 597     uint32_t mask = 0;
 598
 599     /* In ARMv8 most bits of CPACR_EL1 are RES0. */
 600     if (!arm_feature(env, ARM_FEATURE_V8)) {
 601         /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
 602          * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
 603          * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
 604          */
 605         if (arm_feature(env, ARM_FEATURE_VFP)) {
 606             /* VFP coprocessor: cp10 & cp11 [23:20] */
 607             mask |= (1 << 31) | (1 << 30) | (0xf << 20);
 608
 609             if (!arm_feature(env, ARM_FEATURE_NEON)) {
 610                 /* ASEDIS [31] bit is RAO/WI */
 611                 value |= (1 << 31);
 612             }
 613
 614             /* VFPv3 and upwards with NEON implement 32 double precision
 615              * registers (D0-D31).
 616              */
 617             if (!arm_feature(env, ARM_FEATURE_NEON) ||
 618                     !arm_feature(env, ARM_FEATURE_VFP3)) {
 619                 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
 620                 value |= (1 << 30);
 621             }
 622         }
 623         value &= mask;
 624     }
 625     env->cp15.cpacr_el1 = value;
 626 }
 627
 628 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri)
 629 {
 630     if (arm_feature(env, ARM_FEATURE_V8)) {
 631         /* Check if CPACR accesses are to be trapped to EL2 */
 632         if (arm_current_el(env) == 1 &&
 633             (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) {
 634             return CP_ACCESS_TRAP_EL2;
 635         /* Check if CPACR accesses are to be trapped to EL3 */
 636         } else if (arm_current_el(env) < 3 &&
 637                    (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
 638             return CP_ACCESS_TRAP_EL3;
 639         }
 640     }
 641
 642     return CP_ACCESS_OK;
 643 }
 644
 645 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri)
 646 {
 647     /* Check if CPTR accesses are set to trap to EL3 */
 648     if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
 649         return CP_ACCESS_TRAP_EL3;
 650     }
 651
 652     return CP_ACCESS_OK;
 653 }
 654
 655 static const ARMCPRegInfo v6_cp_reginfo[] = {
 656     /* prefetch by MVA in v6, NOP in v7 */
 657     { .name = "MVA_prefetch",
 658       .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
 659       .access = PL1_W, .type = ARM_CP_NOP },
 660     { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
 661       .access = PL0_W, .type = ARM_CP_NOP },
 662     { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
 663       .access = PL0_W, .type = ARM_CP_NOP },
 664     { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
 665       .access = PL0_W, .type = ARM_CP_NOP },
 666     { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
 667       .access = PL1_RW,
 668       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s),
 669                              offsetof(CPUARMState, cp15.ifar_ns) },
 670       .resetvalue = 0, },
 671     /* Watchpoint Fault Address Register : should actually only be present
 672      * for 1136, 1176, 11MPCore.
 673      */
 674     { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
 675       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
 676     { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
 677       .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
 678       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
 679       .resetvalue = 0, .writefn = cpacr_write },
 680     REGINFO_SENTINEL
 681 };
 682
 683 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri)
 684 {
 685     /* Performance monitor registers user accessibility is controlled
 686      * by PMUSERENR.
 687      */
 688     if (arm_current_el(env) == 0 && !env->cp15.c9_pmuserenr) {
 689         return CP_ACCESS_TRAP;
 690     }
 691     return CP_ACCESS_OK;
 692 }
 693
 694 #ifndef CONFIG_USER_ONLY
 695
 696 static inline bool arm_ccnt_enabled(CPUARMState *env)
 697 {
 698     /* This does not support checking PMCCFILTR_EL0 register */
 699
 700     if (!(env->cp15.c9_pmcr & PMCRE)) {
 701         return false;
 702     }
 703
 704     return true;
 705 }
 706
 707 void pmccntr_sync(CPUARMState *env)
 708 {
 709     uint64_t temp_ticks;
 710
 711     temp_ticks = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
 712                           ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
 713
 714     if (env->cp15.c9_pmcr & PMCRD) {
 715         /* Increment once every 64 processor clock cycles */
 716         temp_ticks /= 64;
 717     }
 718
 719     if (arm_ccnt_enabled(env)) {
 720         env->cp15.c15_ccnt = temp_ticks - env->cp15.c15_ccnt;
 721     }
 722 }
 723
 724 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 725                        uint64_t value)
 726 {
 727     pmccntr_sync(env);
 728
 729     if (value & PMCRC) {
 730         /* The counter has been reset */
 731         env->cp15.c15_ccnt = 0;
 732     }
 733
 734     /* only the DP, X, D and E bits are writable */
 735     env->cp15.c9_pmcr &= ~0x39;
 736     env->cp15.c9_pmcr |= (value & 0x39);
 737
 738     pmccntr_sync(env);
 739 }
 740
 741 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
 742 {
 743     uint64_t total_ticks;
 744
 745     if (!arm_ccnt_enabled(env)) {
 746         /* Counter is disabled, do not change value */
 747         return env->cp15.c15_ccnt;
 748     }
 749
 750     total_ticks = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
 751                            ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
 752
 753     if (env->cp15.c9_pmcr & PMCRD) {
 754         /* Increment once every 64 processor clock cycles */
 755         total_ticks /= 64;
 756     }
 757     return total_ticks - env->cp15.c15_ccnt;
 758 }
 759
 760 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 761                         uint64_t value)
 762 {
 763     uint64_t total_ticks;
 764
 765     if (!arm_ccnt_enabled(env)) {
 766         /* Counter is disabled, set the absolute value */
 767         env->cp15.c15_ccnt = value;
 768         return;
 769     }
 770
 771     total_ticks = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
 772                            ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
 773
 774     if (env->cp15.c9_pmcr & PMCRD) {
 775         /* Increment once every 64 processor clock cycles */
 776         total_ticks /= 64;
 777     }
 778     env->cp15.c15_ccnt = total_ticks - value;
 779 }
 780
 781 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
 782                             uint64_t value)
 783 {
 784     uint64_t cur_val = pmccntr_read(env, NULL);
 785
 786     pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
 787 }
 788
 789 #else /* CONFIG_USER_ONLY */
 790
 791 void pmccntr_sync(CPUARMState *env)
 792 {
 793 }
 794
 795 #endif
 796
 797 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 798                             uint64_t value)
 799 {
 800     pmccntr_sync(env);
 801     env->cp15.pmccfiltr_el0 = value & 0x7E000000;
 802     pmccntr_sync(env);
 803 }
 804
 805 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
 806                             uint64_t value)
 807 {
 808     value &= (1 << 31);
 809     env->cp15.c9_pmcnten |= value;
 810 }
 811
 812 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 813                              uint64_t value)
 814 {
 815     value &= (1 << 31);
 816     env->cp15.c9_pmcnten &= ~value;
 817 }
 818
 819 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 820                          uint64_t value)
 821 {
 822     env->cp15.c9_pmovsr &= ~value;
 823 }
 824
 825 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
 826                              uint64_t value)
 827 {
 828     env->cp15.c9_pmxevtyper = value & 0xff;
 829 }
 830
 831 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 832                             uint64_t value)
 833 {
 834     env->cp15.c9_pmuserenr = value & 1;
 835 }
 836
 837 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
 838                              uint64_t value)
 839 {
 840     /* We have no event counters so only the C bit can be changed */
 841     value &= (1 << 31);
 842     env->cp15.c9_pminten |= value;
 843 }
 844
 845 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 846                              uint64_t value)
 847 {
 848     value &= (1 << 31);
 849     env->cp15.c9_pminten &= ~value;
 850 }
 851
 852 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
 853                        uint64_t value)
 854 {
 855     /* Note that even though the AArch64 view of this register has bits
 856      * [10:0] all RES0 we can only mask the bottom 5, to comply with the
 857      * architectural requirements for bits which are RES0 only in some
 858      * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
 859      * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
 860      */
 861     raw_write(env, ri, value & ~0x1FULL);
 862 }
 863
 864 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 865 {
 866     /* We only mask off bits that are RES0 both for AArch64 and AArch32.
 867      * For bits that vary between AArch32/64, code needs to check the
 868      * current execution mode before directly using the feature bit.
 869      */
 870     uint32_t valid_mask = SCR_AARCH64_MASK | SCR_AARCH32_MASK;
 871
 872     if (!arm_feature(env, ARM_FEATURE_EL2)) {
 873         valid_mask &= ~SCR_HCE;
 874
 875         /* On ARMv7, SMD (or SCD as it is called in v7) is only
 876          * supported if EL2 exists. The bit is UNK/SBZP when
 877          * EL2 is unavailable. In QEMU ARMv7, we force it to always zero
 878          * when EL2 is unavailable.
 879          * On ARMv8, this bit is always available.
 880          */
 881         if (arm_feature(env, ARM_FEATURE_V7) &&
 882             !arm_feature(env, ARM_FEATURE_V8)) {
 883             valid_mask &= ~SCR_SMD;
 884         }
 885     }
 886
 887     /* Clear all-context RES0 bits.  */
 888     value &= valid_mask;
 889     raw_write(env, ri, value);
 890 }
 891
 892 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
 893 {
 894     ARMCPU *cpu = arm_env_get_cpu(env);
 895
 896     /* Acquire the CSSELR index from the bank corresponding to the CCSIDR
 897      * bank
 898      */
 899     uint32_t index = A32_BANKED_REG_GET(env, csselr,
 900                                         ri->secure & ARM_CP_SECSTATE_S);
 901
 902     return cpu->ccsidr[index];
 903 }
 904
 905 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 906                          uint64_t value)
 907 {
 908     raw_write(env, ri, value & 0xf);
 909 }
 910
 911 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
 912 {
 913     CPUState *cs = ENV_GET_CPU(env);
 914     uint64_t ret = 0;
 915
 916     if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
 917         ret |= CPSR_I;
 918     }
 919     if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
 920         ret |= CPSR_F;
 921     }
 922     /* External aborts are not possible in QEMU so A bit is always clear */
 923     return ret;
 924 }
 925
 926 static const ARMCPRegInfo v7_cp_reginfo[] = {
 927     /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
 928     { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
 929       .access = PL1_W, .type = ARM_CP_NOP },
 930     /* Performance monitors are implementation defined in v7,
 931      * but with an ARM recommended set of registers, which we
 932      * follow (although we don't actually implement any counters)
 933      *
 934      * Performance registers fall into three categories:
 935      *  (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
 936      *  (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
 937      *  (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
 938      * For the cases controlled by PMUSERENR we must set .access to PL0_RW
 939      * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
 940      */
 941     { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
 942       .access = PL0_RW, .type = ARM_CP_ALIAS,
 943       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
 944       .writefn = pmcntenset_write,
 945       .accessfn = pmreg_access,
 946       .raw_writefn = raw_write },
 947     { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64,
 948       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
 949       .access = PL0_RW, .accessfn = pmreg_access,
 950       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
 951       .writefn = pmcntenset_write, .raw_writefn = raw_write },
 952     { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
 953       .access = PL0_RW,
 954       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
 955       .accessfn = pmreg_access,
 956       .writefn = pmcntenclr_write,
 957       .type = ARM_CP_ALIAS },
 958     { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
 959       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
 960       .access = PL0_RW, .accessfn = pmreg_access,
 961       .type = ARM_CP_ALIAS,
 962       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
 963       .writefn = pmcntenclr_write },
 964     { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
 965       .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
 966       .accessfn = pmreg_access,
 967       .writefn = pmovsr_write,
 968       .raw_writefn = raw_write },
 969     /* Unimplemented so WI. */
 970     { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
 971       .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP },
 972     /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.
 973      * We choose to RAZ/WI.
 974      */
 975     { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
 976       .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
 977       .accessfn = pmreg_access },
 978 #ifndef CONFIG_USER_ONLY
 979     { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
 980       .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
 981       .readfn = pmccntr_read, .writefn = pmccntr_write32,
 982       .accessfn = pmreg_access },
 983     { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
 984       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
 985       .access = PL0_RW, .accessfn = pmreg_access,
 986       .type = ARM_CP_IO,
 987       .readfn = pmccntr_read, .writefn = pmccntr_write, },
 988 #endif
 989     { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
 990       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
 991       .writefn = pmccfiltr_write,
 992       .access = PL0_RW, .accessfn = pmreg_access,
 993       .type = ARM_CP_IO,
 994       .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
 995       .resetvalue = 0, },
 996     { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
 997       .access = PL0_RW,
 998       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
 999       .accessfn = pmreg_access, .writefn = pmxevtyper_write,
1000       .raw_writefn = raw_write },
1001     /* Unimplemented, RAZ/WI. */
1002     { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
1003       .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
1004       .accessfn = pmreg_access },
1005     { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
1006       .access = PL0_R | PL1_RW,
1007       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
1008       .resetvalue = 0,
1009       .writefn = pmuserenr_write, .raw_writefn = raw_write },
1010     { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
1011       .access = PL1_RW,
1012       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
1013       .resetvalue = 0,
1014       .writefn = pmintenset_write, .raw_writefn = raw_write },
1015     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
1016       .access = PL1_RW, .type = ARM_CP_ALIAS,
1017       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
1018       .writefn = pmintenclr_write, },
1019     { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
1020       .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
1021       .access = PL1_RW, .writefn = vbar_write,
1022       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s),
1023                              offsetof(CPUARMState, cp15.vbar_ns) },
1024       .resetvalue = 0 },
1025     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
1026       .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
1027       .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_RAW },
1028     { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
1029       .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
1030       .access = PL1_RW, .writefn = csselr_write, .resetvalue = 0,
1031       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s),
1032                              offsetof(CPUARMState, cp15.csselr_ns) } },
1033     /* Auxiliary ID register: this actually has an IMPDEF value but for now
1034      * just RAZ for all cores:
1035      */
1036     { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
1037       .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
1038       .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
1039     /* Auxiliary fault status registers: these also are IMPDEF, and we
1040      * choose to RAZ/WI for all cores.
1041      */
1042     { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
1043       .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
1044       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
1045     { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
1046       .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
1047       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
1048     /* MAIR can just read-as-written because we don't implement caches
1049      * and so don't need to care about memory attributes.
1050      */
1051     { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
1052       .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
1053       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]),
1054       .resetvalue = 0 },
1055     { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64,
1056       .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0,
1057       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]),
1058       .resetvalue = 0 },
1059     /* For non-long-descriptor page tables these are PRRR and NMRR;
1060      * regardless they still act as reads-as-written for QEMU.
1061      */
1062      /* MAIR0/1 are defined separately from their 64-bit counterpart which
1063       * allows them to assign the correct fieldoffset based on the endianness
1064       * handled in the field definitions.
1065       */
1066     { .name = "MAIR0", .state = ARM_CP_STATE_AA32,
1067       .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW,
1068       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s),
1069                              offsetof(CPUARMState, cp15.mair0_ns) },
1070       .resetfn = arm_cp_reset_ignore },
1071     { .name = "MAIR1", .state = ARM_CP_STATE_AA32,
1072       .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW,
1073       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s),
1074                              offsetof(CPUARMState, cp15.mair1_ns) },
1075       .resetfn = arm_cp_reset_ignore },
1076     { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
1077       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
1078       .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read },
1079     /* 32 bit ITLB invalidates */
1080     { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0,
1081       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1082     { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
1083       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1084     { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2,
1085       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1086     /* 32 bit DTLB invalidates */
1087     { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0,
1088       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1089     { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
1090       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1091     { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2,
1092       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1093     /* 32 bit TLB invalidates */
1094     { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
1095       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1096     { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
1097       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1098     { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
1099       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1100     { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
1101       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
1102     REGINFO_SENTINEL
1103 };
1104
1105 static const ARMCPRegInfo v7mp_cp_reginfo[] = {
1106     /* 32 bit TLB invalidates, Inner Shareable */
1107     { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
1108       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write },
1109     { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
1110       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
1111     { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
1112       .type = ARM_CP_NO_RAW, .access = PL1_W,
1113       .writefn = tlbiasid_is_write },
1114     { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
1115       .type = ARM_CP_NO_RAW, .access = PL1_W,
1116       .writefn = tlbimvaa_is_write },
1117     REGINFO_SENTINEL
1118 };
1119
1120 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1121                         uint64_t value)
1122 {
1123     value &= 1;
1124     env->teecr = value;
1125 }
1126
1127 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri)
1128 {
1129     if (arm_current_el(env) == 0 && (env->teecr & 1)) {
1130         return CP_ACCESS_TRAP;
1131     }
1132     return CP_ACCESS_OK;
1133 }
1134
1135 static const ARMCPRegInfo t2ee_cp_reginfo[] = {
1136     { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
1137       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
1138       .resetvalue = 0,
1139       .writefn = teecr_write },
1140     { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
1141       .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
1142       .accessfn = teehbr_access, .resetvalue = 0 },
1143     REGINFO_SENTINEL
1144 };
1145
1146 static const ARMCPRegInfo v6k_cp_reginfo[] = {
1147     { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
1148       .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
1149       .access = PL0_RW,
1150       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 },
1151     { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
1152       .access = PL0_RW,
1153       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s),
1154                              offsetoflow32(CPUARMState, cp15.tpidrurw_ns) },
1155       .resetfn = arm_cp_reset_ignore },
1156     { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
1157       .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
1158       .access = PL0_R|PL1_W,
1159       .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]),
1160       .resetvalue = 0},
1161     { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
1162       .access = PL0_R|PL1_W,
1163       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s),
1164                              offsetoflow32(CPUARMState, cp15.tpidruro_ns) },
1165       .resetfn = arm_cp_reset_ignore },
1166     { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64,
1167       .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
1168       .access = PL1_RW,
1169       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 },
1170     { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4,
1171       .access = PL1_RW,
1172       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s),
1173                              offsetoflow32(CPUARMState, cp15.tpidrprw_ns) },
1174       .resetvalue = 0 },
1175     REGINFO_SENTINEL
1176 };
1177
1178 #ifndef CONFIG_USER_ONLY
1179
1180 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri)
1181 {
1182     /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero */
1183     if (arm_current_el(env) == 0 && !extract32(env->cp15.c14_cntkctl, 0, 2)) {
1184         return CP_ACCESS_TRAP;
1185     }
1186     return CP_ACCESS_OK;
1187 }
1188
1189 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx)
1190 {
1191     unsigned int cur_el = arm_current_el(env);
1192     bool secure = arm_is_secure(env);
1193
1194     /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */
1195     if (cur_el == 0 &&
1196         !extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
1197         return CP_ACCESS_TRAP;
1198     }
1199
1200     if (arm_feature(env, ARM_FEATURE_EL2) &&
1201         timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
1202         !extract32(env->cp15.cnthctl_el2, 0, 1)) {
1203         return CP_ACCESS_TRAP_EL2;
1204     }
1205     return CP_ACCESS_OK;
1206 }
1207
1208 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx)
1209 {
1210     unsigned int cur_el = arm_current_el(env);
1211     bool secure = arm_is_secure(env);
1212
1213     /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if
1214      * EL0[PV]TEN is zero.
1215      */
1216     if (cur_el == 0 &&
1217         !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
1218         return CP_ACCESS_TRAP;
1219     }
1220
1221     if (arm_feature(env, ARM_FEATURE_EL2) &&
1222         timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
1223         !extract32(env->cp15.cnthctl_el2, 1, 1)) {
1224         return CP_ACCESS_TRAP_EL2;
1225     }
1226     return CP_ACCESS_OK;
1227 }
1228
1229 static CPAccessResult gt_pct_access(CPUARMState *env,
1230                                          const ARMCPRegInfo *ri)
1231 {
1232     return gt_counter_access(env, GTIMER_PHYS);
1233 }
1234
1235 static CPAccessResult gt_vct_access(CPUARMState *env,
1236                                          const ARMCPRegInfo *ri)
1237 {
1238     return gt_counter_access(env, GTIMER_VIRT);
1239 }
1240
1241 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
1242 {
1243     return gt_timer_access(env, GTIMER_PHYS);
1244 }
1245
1246 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
1247 {
1248     return gt_timer_access(env, GTIMER_VIRT);
1249 }
1250
1251 static CPAccessResult gt_stimer_access(CPUARMState *env,
1252                                        const ARMCPRegInfo *ri)
1253 {
1254     /* The AArch64 register view of the secure physical timer is
1255      * always accessible from EL3, and configurably accessible from
1256      * Secure EL1.
1257      */
1258     switch (arm_current_el(env)) {
1259     case 1:
1260         if (!arm_is_secure(env)) {
1261             return CP_ACCESS_TRAP;
1262         }
1263         if (!(env->cp15.scr_el3 & SCR_ST)) {
1264             return CP_ACCESS_TRAP_EL3;
1265         }
1266         return CP_ACCESS_OK;
1267     case 0:
1268     case 2:
1269         return CP_ACCESS_TRAP;
1270     case 3:
1271         return CP_ACCESS_OK;
1272     default:
1273         g_assert_not_reached();
1274     }
1275 }
1276
1277 static uint64_t gt_get_countervalue(CPUARMState *env)
1278 {
1279     return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
1280 }
1281
1282 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
1283 {
1284     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
1285
1286     if (gt->ctl & 1) {
1287         /* Timer enabled: calculate and set current ISTATUS, irq, and
1288          * reset timer to when ISTATUS next has to change
1289          */
1290         uint64_t offset = timeridx == GTIMER_VIRT ?
1291                                       cpu->env.cp15.cntvoff_el2 : 0;
1292         uint64_t count = gt_get_countervalue(&cpu->env);
1293         /* Note that this must be unsigned 64 bit arithmetic: */
1294         int istatus = count - offset >= gt->cval;
1295         uint64_t nexttick;
1296
1297         gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
1298         qemu_set_irq(cpu->gt_timer_outputs[timeridx],
1299                      (istatus && !(gt->ctl & 2)));
1300         if (istatus) {
1301             /* Next transition is when count rolls back over to zero */
1302             nexttick = UINT64_MAX;
1303         } else {
1304             /* Next transition is when we hit cval */
1305             nexttick = gt->cval + offset;
1306         }
1307         /* Note that the desired next expiry time might be beyond the
1308          * signed-64-bit range of a QEMUTimer -- in this case we just
1309          * set the timer for as far in the future as possible. When the
1310          * timer expires we will reset the timer for any remaining period.
1311          */
1312         if (nexttick > INT64_MAX / GTIMER_SCALE) {
1313             nexttick = INT64_MAX / GTIMER_SCALE;
1314         }
1315         timer_mod(cpu->gt_timer[timeridx], nexttick);
1316     } else {
1317         /* Timer disabled: ISTATUS and timer output always clear */
1318         gt->ctl &= ~4;
1319         qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);
1320         timer_del(cpu->gt_timer[timeridx]);
1321     }
1322 }
1323
1324 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
1325                            int timeridx)
1326 {
1327     ARMCPU *cpu = arm_env_get_cpu(env);
1328
1329     timer_del(cpu->gt_timer[timeridx]);
1330 }
1331
1332 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
1333 {
1334     return gt_get_countervalue(env);
1335 }
1336
1337 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
1338 {
1339     return gt_get_countervalue(env) - env->cp15.cntvoff_el2;
1340 }
1341
1342 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1343                           int timeridx,
1344                           uint64_t value)
1345 {
1346     env->cp15.c14_timer[timeridx].cval = value;
1347     gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1348 }
1349
1350 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
1351                              int timeridx)
1352 {
1353     uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
1354
1355     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
1356                       (gt_get_countervalue(env) - offset));
1357 }
1358
1359 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1360                           int timeridx,
1361                           uint64_t value)
1362 {
1363     uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
1364
1365     env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset +
1366                                          sextract64(value, 0, 32);
1367     gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1368 }
1369
1370 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1371                          int timeridx,
1372                          uint64_t value)
1373 {
1374     ARMCPU *cpu = arm_env_get_cpu(env);
1375     uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
1376
1377     env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
1378     if ((oldval ^ value) & 1) {
1379         /* Enable toggled */
1380         gt_recalc_timer(cpu, timeridx);
1381     } else if ((oldval ^ value) & 2) {
1382         /* IMASK toggled: don't need to recalculate,
1383          * just set the interrupt line based on ISTATUS
1384          */
1385         qemu_set_irq(cpu->gt_timer_outputs[timeridx],
1386                      (oldval & 4) && !(value & 2));
1387     }
1388 }
1389
1390 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1391 {
1392     gt_timer_reset(env, ri, GTIMER_PHYS);
1393 }
1394
1395 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1396                                uint64_t value)
1397 {
1398     gt_cval_write(env, ri, GTIMER_PHYS, value);
1399 }
1400
1401 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1402 {
1403     return gt_tval_read(env, ri, GTIMER_PHYS);
1404 }
1405
1406 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1407                                uint64_t value)
1408 {
1409     gt_tval_write(env, ri, GTIMER_PHYS, value);
1410 }
1411
1412 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1413                               uint64_t value)
1414 {
1415     gt_ctl_write(env, ri, GTIMER_PHYS, value);
1416 }
1417
1418 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1419 {
1420     gt_timer_reset(env, ri, GTIMER_VIRT);
1421 }
1422
1423 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1424                                uint64_t value)
1425 {
1426     gt_cval_write(env, ri, GTIMER_VIRT, value);
1427 }
1428
1429 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1430 {
1431     return gt_tval_read(env, ri, GTIMER_VIRT);
1432 }
1433
1434 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1435                                uint64_t value)
1436 {
1437     gt_tval_write(env, ri, GTIMER_VIRT, value);
1438 }
1439
1440 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1441                               uint64_t value)
1442 {
1443     gt_ctl_write(env, ri, GTIMER_VIRT, value);
1444 }
1445
1446 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
1447                               uint64_t value)
1448 {
1449     ARMCPU *cpu = arm_env_get_cpu(env);
1450
1451     raw_write(env, ri, value);
1452     gt_recalc_timer(cpu, GTIMER_VIRT);
1453 }
1454
1455 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1456 {
1457     gt_timer_reset(env, ri, GTIMER_HYP);
1458 }
1459
1460 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1461                               uint64_t value)
1462 {
1463     gt_cval_write(env, ri, GTIMER_HYP, value);
1464 }
1465
1466 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1467 {
1468     return gt_tval_read(env, ri, GTIMER_HYP);
1469 }
1470
1471 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1472                               uint64_t value)
1473 {
1474     gt_tval_write(env, ri, GTIMER_HYP, value);
1475 }
1476
1477 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1478                               uint64_t value)
1479 {
1480     gt_ctl_write(env, ri, GTIMER_HYP, value);
1481 }
1482
1483 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1484 {
1485     gt_timer_reset(env, ri, GTIMER_SEC);
1486 }
1487
1488 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1489                               uint64_t value)
1490 {
1491     gt_cval_write(env, ri, GTIMER_SEC, value);
1492 }
1493
1494 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1495 {
1496     return gt_tval_read(env, ri, GTIMER_SEC);
1497 }
1498
1499 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1500                               uint64_t value)
1501 {
1502     gt_tval_write(env, ri, GTIMER_SEC, value);
1503 }
1504
1505 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1506                               uint64_t value)
1507 {
1508     gt_ctl_write(env, ri, GTIMER_SEC, value);
1509 }
1510
1511 void arm_gt_ptimer_cb(void *opaque)
1512 {
1513     ARMCPU *cpu = opaque;
1514
1515     gt_recalc_timer(cpu, GTIMER_PHYS);
1516 }
1517
1518 void arm_gt_vtimer_cb(void *opaque)
1519 {
1520     ARMCPU *cpu = opaque;
1521
1522     gt_recalc_timer(cpu, GTIMER_VIRT);
1523 }
1524
1525 void arm_gt_htimer_cb(void *opaque)
1526 {
1527     ARMCPU *cpu = opaque;
1528
1529     gt_recalc_timer(cpu, GTIMER_HYP);
1530 }
1531
1532 void arm_gt_stimer_cb(void *opaque)
1533 {
1534     ARMCPU *cpu = opaque;
1535
1536     gt_recalc_timer(cpu, GTIMER_SEC);
1537 }
1538
1539 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1540     /* Note that CNTFRQ is purely reads-as-written for the benefit
1541      * of software; writing it doesn't actually change the timer frequency.
1542      * Our reset value matches the fixed frequency we implement the timer at.
1543      */
1544     { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
1545       .type = ARM_CP_ALIAS,
1546       .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1547       .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
1548     },
1549     { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
1550       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
1551       .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1552       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
1553       .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
1554     },
1555     /* overall control: mostly access permissions */
1556     { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
1557       .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
1558       .access = PL1_RW,
1559       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
1560       .resetvalue = 0,
1561     },
1562     /* per-timer control */
1563     { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
1564       .secure = ARM_CP_SECSTATE_NS,
1565       .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
1566       .accessfn = gt_ptimer_access,
1567       .fieldoffset = offsetoflow32(CPUARMState,
1568                                    cp15.c14_timer[GTIMER_PHYS].ctl),
1569       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
1570     },
1571     { .name = "CNTP_CTL(S)",
1572       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
1573       .secure = ARM_CP_SECSTATE_S,
1574       .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
1575       .accessfn = gt_ptimer_access,
1576       .fieldoffset = offsetoflow32(CPUARMState,
1577                                    cp15.c14_timer[GTIMER_SEC].ctl),
1578       .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
1579     },
1580     { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
1581       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
1582       .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1583       .accessfn = gt_ptimer_access,
1584       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
1585       .resetvalue = 0,
1586       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
1587     },
1588     { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
1589       .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
1590       .accessfn = gt_vtimer_access,
1591       .fieldoffset = offsetoflow32(CPUARMState,
1592                                    cp15.c14_timer[GTIMER_VIRT].ctl),
1593       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
1594     },
1595     { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
1596       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
1597       .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1598       .accessfn = gt_vtimer_access,
1599       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
1600       .resetvalue = 0,
1601       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
1602     },
1603     /* TimerValue views: a 32 bit downcounting view of the underlying state */
1604     { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
1605       .secure = ARM_CP_SECSTATE_NS,
1606       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1607       .accessfn = gt_ptimer_access,
1608       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
1609     },
1610     { .name = "CNTP_TVAL(S)",
1611       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
1612       .secure = ARM_CP_SECSTATE_S,
1613       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1614       .accessfn = gt_ptimer_access,
1615       .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
1616     },
1617     { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1618       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
1619       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1620       .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
1621       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
1622     },
1623     { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
1624       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1625       .accessfn = gt_vtimer_access,
1626       .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
1627     },
1628     { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1629       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
1630       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1631       .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
1632       .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
1633     },
1634     /* The counter itself */
1635     { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
1636       .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
1637       .accessfn = gt_pct_access,
1638       .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
1639     },
1640     { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
1641       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
1642       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
1643       .accessfn = gt_pct_access, .readfn = gt_cnt_read,
1644     },
1645     { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
1646       .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
1647       .accessfn = gt_vct_access,
1648       .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
1649     },
1650     { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
1651       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
1652       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
1653       .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
1654     },
1655     /* Comparison value, indicating when the timer goes off */
1656     { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
1657       .secure = ARM_CP_SECSTATE_NS,
1658       .access = PL1_RW | PL0_R,
1659       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
1660       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1661       .accessfn = gt_ptimer_access,
1662       .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
1663     },
1664     { .name = "CNTP_CVAL(S)", .cp = 15, .crm = 14, .opc1 = 2,
1665       .secure = ARM_CP_SECSTATE_S,
1666       .access = PL1_RW | PL0_R,
1667       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
1668       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
1669       .accessfn = gt_ptimer_access,
1670       .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
1671     },
1672     { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1673       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
1674       .access = PL1_RW | PL0_R,
1675       .type = ARM_CP_IO,
1676       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1677       .resetvalue = 0, .accessfn = gt_ptimer_access,
1678       .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
1679     },
1680     { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
1681       .access = PL1_RW | PL0_R,
1682       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
1683       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1684       .accessfn = gt_vtimer_access,
1685       .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
1686     },
1687     { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1688       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
1689       .access = PL1_RW | PL0_R,
1690       .type = ARM_CP_IO,
1691       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1692       .resetvalue = 0, .accessfn = gt_vtimer_access,
1693       .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
1694     },
1695     /* Secure timer -- this is actually restricted to only EL3
1696      * and configurably Secure-EL1 via the accessfn.
1697      */
1698     { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64,
1699       .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0,
1700       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW,
1701       .accessfn = gt_stimer_access,
1702       .readfn = gt_sec_tval_read,
1703       .writefn = gt_sec_tval_write,
1704       .resetfn = gt_sec_timer_reset,
1705     },
1706     { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64,
1707       .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1,
1708       .type = ARM_CP_IO, .access = PL1_RW,
1709       .accessfn = gt_stimer_access,
1710       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl),
1711       .resetvalue = 0,
1712       .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
1713     },
1714     { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64,
1715       .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2,
1716       .type = ARM_CP_IO, .access = PL1_RW,
1717       .accessfn = gt_stimer_access,
1718       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
1719       .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
1720     },
1721     REGINFO_SENTINEL
1722 };
1723
1724 #else
1725 /* In user-mode none of the generic timer registers are accessible,
1726  * and their implementation depends on QEMU_CLOCK_VIRTUAL and qdev gpio outputs,
1727  * so instead just don't register any of them.
1728  */
1729 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1730     REGINFO_SENTINEL
1731 };
1732
1733 #endif
1734
1735 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1736 {
1737     if (arm_feature(env, ARM_FEATURE_LPAE)) {
1738         raw_write(env, ri, value);
1739     } else if (arm_feature(env, ARM_FEATURE_V7)) {
1740         raw_write(env, ri, value & 0xfffff6ff);
1741     } else {
1742         raw_write(env, ri, value & 0xfffff1ff);
1743     }
1744 }
1745
1746 #ifndef CONFIG_USER_ONLY
1747 /* get_phys_addr() isn't present for user-mode-only targets */
1748
1749 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri)
1750 {
1751     if (ri->opc2 & 4) {
1752         /* The ATS12NSO* operations must trap to EL3 if executed in
1753          * Secure EL1 (which can only happen if EL3 is AArch64).
1754          * They are simply UNDEF if executed from NS EL1.
1755          * They function normally from EL2 or EL3.
1756          */
1757         if (arm_current_el(env) == 1) {
1758             if (arm_is_secure_below_el3(env)) {
1759                 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3;
1760             }
1761             return CP_ACCESS_TRAP_UNCATEGORIZED;
1762         }
1763     }
1764     return CP_ACCESS_OK;
1765 }
1766
1767 static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
1768                              int access_type, ARMMMUIdx mmu_idx)
1769 {
1770     hwaddr phys_addr;
1771     target_ulong page_size;
1772     int prot;
1773     uint32_t fsr;
1774     bool ret;
1775     uint64_t par64;
1776     MemTxAttrs attrs = {};
1777
1778     ret = get_phys_addr(env, value, access_type, mmu_idx,
1779                         &phys_addr, &attrs, &prot, &page_size, &fsr);
1780     if (extended_addresses_enabled(env)) {
1781         /* fsr is a DFSR/IFSR value for the long descriptor
1782          * translation table format, but with WnR always clear.
1783          * Convert it to a 64-bit PAR.
1784          */
1785         par64 = (1 << 11); /* LPAE bit always set */
1786         if (!ret) {
1787             par64 |= phys_addr & ~0xfffULL;
1788             if (!attrs.secure) {
1789                 par64 |= (1 << 9); /* NS */
1790             }
1791             /* We don't set the ATTR or SH fields in the PAR. */
1792         } else {
1793             par64 |= 1; /* F */
1794             par64 |= (fsr & 0x3f) << 1; /* FS */
1795             /* Note that S2WLK and FSTAGE are always zero, because we don't
1796              * implement virtualization and therefore there can't be a stage 2
1797              * fault.
1798              */
1799         }
1800     } else {
1801         /* fsr is a DFSR/IFSR value for the short descriptor
1802          * translation table format (with WnR always clear).
1803          * Convert it to a 32-bit PAR.
1804          */
1805         if (!ret) {
1806             /* We do not set any attribute bits in the PAR */
1807             if (page_size == (1 << 24)
1808                 && arm_feature(env, ARM_FEATURE_V7)) {
1809                 par64 = (phys_addr & 0xff000000) | (1 << 1);
1810             } else {
1811                 par64 = phys_addr & 0xfffff000;
1812             }
1813             if (!attrs.secure) {
1814                 par64 |= (1 << 9); /* NS */
1815             }
1816         } else {
1817             par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) |
1818                     ((fsr & 0xf) << 1) | 1;
1819         }
1820     }
1821     return par64;
1822 }
1823
1824 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1825 {
1826     int access_type = ri->opc2 & 1;
1827     uint64_t par64;
1828     ARMMMUIdx mmu_idx;
1829     int el = arm_current_el(env);
1830     bool secure = arm_is_secure_below_el3(env);
1831
1832     switch (ri->opc2 & 6) {
1833     case 0:
1834         /* stage 1 current state PL1: ATS1CPR, ATS1CPW */
1835         switch (el) {
1836         case 3:
1837             mmu_idx = ARMMMUIdx_S1E3;
1838             break;
1839         case 2:
1840             mmu_idx = ARMMMUIdx_S1NSE1;
1841             break;
1842         case 1:
1843             mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
1844             break;
1845         default:
1846             g_assert_not_reached();
1847         }
1848         break;
1849     case 2:
1850         /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
1851         switch (el) {
1852         case 3:
1853             mmu_idx = ARMMMUIdx_S1SE0;
1854             break;
1855         case 2:
1856             mmu_idx = ARMMMUIdx_S1NSE0;
1857             break;
1858         case 1:
1859             mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
1860             break;
1861         default:
1862             g_assert_not_reached();
1863         }
1864         break;
1865     case 4:
1866         /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
1867         mmu_idx = ARMMMUIdx_S12NSE1;
1868         break;
1869     case 6:
1870         /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
1871         mmu_idx = ARMMMUIdx_S12NSE0;
1872         break;
1873     default:
1874         g_assert_not_reached();
1875     }
1876
1877     par64 = do_ats_write(env, value, access_type, mmu_idx);
1878
1879     A32_BANKED_CURRENT_REG_SET(env, par, par64);
1880 }
1881
1882 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
1883                         uint64_t value)
1884 {
1885     int access_type = ri->opc2 & 1;
1886     uint64_t par64;
1887
1888     par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S2NS);
1889
1890     A32_BANKED_CURRENT_REG_SET(env, par, par64);
1891 }
1892
1893 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri)
1894 {
1895     if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) {
1896         return CP_ACCESS_TRAP;
1897     }
1898     return CP_ACCESS_OK;
1899 }
1900
1901 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
1902                         uint64_t value)
1903 {
1904     int access_type = ri->opc2 & 1;
1905     ARMMMUIdx mmu_idx;
1906     int secure = arm_is_secure_below_el3(env);
1907
1908     switch (ri->opc2 & 6) {
1909     case 0:
1910         switch (ri->opc1) {
1911         case 0: /* AT S1E1R, AT S1E1W */
1912             mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
1913             break;
1914         case 4: /* AT S1E2R, AT S1E2W */
1915             mmu_idx = ARMMMUIdx_S1E2;
1916             break;
1917         case 6: /* AT S1E3R, AT S1E3W */
1918             mmu_idx = ARMMMUIdx_S1E3;
1919             break;
1920         default:
1921             g_assert_not_reached();
1922         }
1923         break;
1924     case 2: /* AT S1E0R, AT S1E0W */
1925         mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
1926         break;
1927     case 4: /* AT S12E1R, AT S12E1W */
1928         mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S12NSE1;
1929         break;
1930     case 6: /* AT S12E0R, AT S12E0W */
1931         mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S12NSE0;
1932         break;
1933     default:
1934         g_assert_not_reached();
1935     }
1936
1937     env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx);
1938 }
1939 #endif
1940
1941 static const ARMCPRegInfo vapa_cp_reginfo[] = {
1942     { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
1943       .access = PL1_RW, .resetvalue = 0,
1944       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s),
1945                              offsetoflow32(CPUARMState, cp15.par_ns) },
1946       .writefn = par_write },
1947 #ifndef CONFIG_USER_ONLY
1948     /* This underdecoding is safe because the reginfo is NO_RAW. */
1949     { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
1950       .access = PL1_W, .accessfn = ats_access,
1951       .writefn = ats_write, .type = ARM_CP_NO_RAW },
1952 #endif
1953     REGINFO_SENTINEL
1954 };
1955
1956 /* Return basic MPU access permission bits.  */
1957 static uint32_t simple_mpu_ap_bits(uint32_t val)
1958 {
1959     uint32_t ret;
1960     uint32_t mask;
1961     int i;
1962     ret = 0;
1963     mask = 3;
1964     for (i = 0; i < 16; i += 2) {
1965         ret |= (val >> i) & mask;
1966         mask <<= 2;
1967     }
1968     return ret;
1969 }
1970
1971 /* Pad basic MPU access permission bits to extended format.  */
1972 static uint32_t extended_mpu_ap_bits(uint32_t val)
1973 {
1974     uint32_t ret;
1975     uint32_t mask;
1976     int i;
1977     ret = 0;
1978     mask = 3;
1979     for (i = 0; i < 16; i += 2) {
1980         ret |= (val & mask) << i;
1981         mask <<= 2;
1982     }
1983     return ret;
1984 }
1985
1986 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1987                                  uint64_t value)
1988 {
1989     env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
1990 }
1991
1992 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1993 {
1994     return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
1995 }
1996
1997 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1998                                  uint64_t value)
1999 {
2000     env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
2001 }
2002
2003 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
2004 {
2005     return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
2006 }
2007
2008 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri)
2009 {
2010     uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
2011
2012     if (!u32p) {
2013         return 0;
2014     }
2015
2016     u32p += env->cp15.c6_rgnr;
2017     return *u32p;
2018 }
2019
2020 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
2021                          uint64_t value)
2022 {
2023     ARMCPU *cpu = arm_env_get_cpu(env);
2024     uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
2025
2026     if (!u32p) {
2027         return;
2028     }
2029
2030     u32p += env->cp15.c6_rgnr;
2031     tlb_flush(CPU(cpu), 1); /* Mappings may have changed - purge! */
2032     *u32p = value;
2033 }
2034
2035 static void pmsav7_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2036 {
2037     ARMCPU *cpu = arm_env_get_cpu(env);
2038     uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
2039
2040     if (!u32p) {
2041         return;
2042     }
2043
2044     memset(u32p, 0, sizeof(*u32p) * cpu->pmsav7_dregion);
2045 }
2046
2047 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2048                               uint64_t value)
2049 {
2050     ARMCPU *cpu = arm_env_get_cpu(env);
2051     uint32_t nrgs = cpu->pmsav7_dregion;
2052
2053     if (value >= nrgs) {
2054         qemu_log_mask(LOG_GUEST_ERROR,
2055                       "PMSAv7 RGNR write >= # supported regions, %" PRIu32
2056                       " > %" PRIu32 "\n", (uint32_t)value, nrgs);
2057         return;
2058     }
2059
2060     raw_write(env, ri, value);
2061 }
2062
2063 static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
2064     { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0,
2065       .access = PL1_RW, .type = ARM_CP_NO_RAW,
2066       .fieldoffset = offsetof(CPUARMState, pmsav7.drbar),
2067       .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
2068     { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2,
2069       .access = PL1_RW, .type = ARM_CP_NO_RAW,
2070       .fieldoffset = offsetof(CPUARMState, pmsav7.drsr),
2071       .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
2072     { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4,
2073       .access = PL1_RW, .type = ARM_CP_NO_RAW,
2074       .fieldoffset = offsetof(CPUARMState, pmsav7.dracr),
2075       .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
2076     { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
2077       .access = PL1_RW,
2078       .fieldoffset = offsetof(CPUARMState, cp15.c6_rgnr),
2079       .writefn = pmsav7_rgnr_write },
2080     REGINFO_SENTINEL
2081 };
2082
2083 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
2084     { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
2085       .access = PL1_RW, .type = ARM_CP_ALIAS,
2086       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
2087       .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
2088     { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
2089       .access = PL1_RW, .type = ARM_CP_ALIAS,
2090       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
2091       .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
2092     { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
2093       .access = PL1_RW,
2094       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
2095       .resetvalue = 0, },
2096     { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
2097       .access = PL1_RW,
2098       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
2099       .resetvalue = 0, },
2100     { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
2101       .access = PL1_RW,
2102       .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
2103     { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
2104       .access = PL1_RW,
2105       .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
2106     /* Protection region base and size registers */
2107     { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
2108       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2109       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
2110     { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
2111       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2112       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
2113     { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
2114       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2115       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
2116     { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
2117       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2118       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
2119     { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
2120       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2121       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
2122     { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
2123       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2124       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
2125     { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
2126       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2127       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
2128     { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
2129       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2130       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
2131     REGINFO_SENTINEL
2132 };
2133
2134 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
2135                                  uint64_t value)
2136 {
2137     TCR *tcr = raw_ptr(env, ri);
2138     int maskshift = extract32(value, 0, 3);
2139
2140     if (!arm_feature(env, ARM_FEATURE_V8)) {
2141         if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
2142             /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
2143              * using Long-desciptor translation table format */
2144             value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
2145         } else if (arm_feature(env, ARM_FEATURE_EL3)) {
2146             /* In an implementation that includes the Security Extensions
2147              * TTBCR has additional fields PD0 [4] and PD1 [5] for
2148              * Short-descriptor translation table format.
2149              */
2150             value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N;
2151         } else {
2152             value &= TTBCR_N;
2153         }
2154     }
2155
2156     /* Update the masks corresponding to the TCR bank being written
2157      * Note that we always calculate mask and base_mask, but
2158      * they are only used for short-descriptor tables (ie if EAE is 0);
2159      * for long-descriptor tables the TCR fields are used differently
2160      * and the mask and base_mask values are meaningless.
2161      */
2162     tcr->raw_tcr = value;
2163     tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift);
2164     tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift);
2165 }
2166
2167 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2168                              uint64_t value)
2169 {
2170     ARMCPU *cpu = arm_env_get_cpu(env);
2171
2172     if (arm_feature(env, ARM_FEATURE_LPAE)) {
2173         /* With LPAE the TTBCR could result in a change of ASID
2174          * via the TTBCR.A1 bit, so do a TLB flush.
2175          */
2176         tlb_flush(CPU(cpu), 1);
2177     }
2178     vmsa_ttbcr_raw_write(env, ri, value);
2179 }
2180
2181 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2182 {
2183     TCR *tcr = raw_ptr(env, ri);
2184
2185     /* Reset both the TCR as well as the masks corresponding to the bank of
2186      * the TCR being reset.
2187      */
2188     tcr->raw_tcr = 0;
2189     tcr->mask = 0;
2190     tcr->base_mask = 0xffffc000u;
2191 }
2192
2193 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2194                                uint64_t value)
2195 {
2196     ARMCPU *cpu = arm_env_get_cpu(env);
2197     TCR *tcr = raw_ptr(env, ri);
2198
2199     /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
2200     tlb_flush(CPU(cpu), 1);
2201     tcr->raw_tcr = value;
2202 }
2203
2204 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2205                             uint64_t value)
2206 {
2207     /* 64 bit accesses to the TTBRs can change the ASID and so we
2208      * must flush the TLB.
2209      */
2210     if (cpreg_field_is_64bit(ri)) {
2211         ARMCPU *cpu = arm_env_get_cpu(env);
2212
2213         tlb_flush(CPU(cpu), 1);
2214     }
2215     raw_write(env, ri, value);
2216 }
2217
2218 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2219                         uint64_t value)
2220 {
2221     ARMCPU *cpu = arm_env_get_cpu(env);
2222     CPUState *cs = CPU(cpu);
2223
2224     /* Accesses to VTTBR may change the VMID so we must flush the TLB.  */
2225     if (raw_read(env, ri) != value) {
2226         tlb_flush_by_mmuidx(cs, ARMMMUIdx_S12NSE1, ARMMMUIdx_S12NSE0,
2227                             ARMMMUIdx_S2NS, -1);
2228         raw_write(env, ri, value);
2229     }
2230 }
2231
2232 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
2233     { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
2234       .access = PL1_RW, .type = ARM_CP_ALIAS,
2235       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s),
2236                              offsetoflow32(CPUARMState, cp15.dfsr_ns) }, },
2237     { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
2238       .access = PL1_RW, .resetvalue = 0,
2239       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s),
2240                              offsetoflow32(CPUARMState, cp15.ifsr_ns) } },
2241     { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0,
2242       .access = PL1_RW, .resetvalue = 0,
2243       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s),
2244                              offsetof(CPUARMState, cp15.dfar_ns) } },
2245     { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64,
2246       .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
2247       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
2248       .resetvalue = 0, },
2249     REGINFO_SENTINEL
2250 };
2251
2252 static const ARMCPRegInfo vmsa_cp_reginfo[] = {
2253     { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
2254       .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
2255       .access = PL1_RW,
2256       .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
2257     { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
2258       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
2259       .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
2260       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
2261                              offsetof(CPUARMState, cp15.ttbr0_ns) } },
2262     { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
2263       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
2264       .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
2265       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
2266                              offsetof(CPUARMState, cp15.ttbr1_ns) } },
2267     { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
2268       .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
2269       .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
2270       .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
2271       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) },
2272     { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
2273       .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write,
2274       .raw_writefn = vmsa_ttbcr_raw_write,
2275       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]),
2276                              offsetoflow32(CPUARMState, cp15.tcr_el[1])} },
2277     REGINFO_SENTINEL
2278 };
2279
2280 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri,
2281                                 uint64_t value)
2282 {
2283     env->cp15.c15_ticonfig = value & 0xe7;
2284     /* The OS_TYPE bit in this register changes the reported CPUID! */
2285     env->cp15.c0_cpuid = (value & (1 << 5)) ?
2286         ARM_CPUID_TI915T : ARM_CPUID_TI925T;
2287 }
2288
2289 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
2290                                 uint64_t value)
2291 {
2292     env->cp15.c15_threadid = value & 0xffff;
2293 }
2294
2295 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
2296                            uint64_t value)
2297 {
2298     /* Wait-for-interrupt (deprecated) */
2299     cpu_interrupt(CPU(arm_env_get_cpu(env)), CPU_INTERRUPT_HALT);
2300 }
2301
2302 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
2303                                   uint64_t value)
2304 {
2305     /* On OMAP there are registers indicating the max/min index of dcache lines
2306      * containing a dirty line; cache flush operations have to reset these.
2307      */
2308     env->cp15.c15_i_max = 0x000;
2309     env->cp15.c15_i_min = 0xff0;
2310 }
2311
2312 static const ARMCPRegInfo omap_cp_reginfo[] = {
2313     { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY,
2314       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE,
2315       .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
2316       .resetvalue = 0, },
2317     { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,
2318       .access = PL1_RW, .type = ARM_CP_NOP },
2319     { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0,
2320       .access = PL1_RW,
2321       .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0,
2322       .writefn = omap_ticonfig_write },
2323     { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0,
2324       .access = PL1_RW,
2325       .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, },
2326     { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0,
2327       .access = PL1_RW, .resetvalue = 0xff0,
2328       .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) },
2329     { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0,
2330       .access = PL1_RW,
2331       .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0,
2332       .writefn = omap_threadid_write },
2333     { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
2334       .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
2335       .type = ARM_CP_NO_RAW,
2336       .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
2337     /* TODO: Peripheral port remap register:
2338      * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
2339      * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
2340      * when MMU is off.
2341      */
2342     { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
2343       .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
2344       .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW,
2345       .writefn = omap_cachemaint_write },
2346     { .name = "C9", .cp = 15, .crn = 9,
2347       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
2348       .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
2349     REGINFO_SENTINEL
2350 };
2351
2352 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
2353                               uint64_t value)
2354 {
2355     env->cp15.c15_cpar = value & 0x3fff;
2356 }
2357
2358 static const ARMCPRegInfo xscale_cp_reginfo[] = {
2359     { .name = "XSCALE_CPAR",
2360       .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
2361       .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
2362       .writefn = xscale_cpar_write, },
2363     { .name = "XSCALE_AUXCR",
2364       .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
2365       .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
2366       .resetvalue = 0, },
2367     /* XScale specific cache-lockdown: since we have no cache we NOP these
2368      * and hope the guest does not really rely on cache behaviour.
2369      */
2370     { .name = "XSCALE_LOCK_ICACHE_LINE",
2371       .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
2372       .access = PL1_W, .type = ARM_CP_NOP },
2373     { .name = "XSCALE_UNLOCK_ICACHE",
2374       .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
2375       .access = PL1_W, .type = ARM_CP_NOP },
2376     { .name = "XSCALE_DCACHE_LOCK",
2377       .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
2378       .access = PL1_RW, .type = ARM_CP_NOP },
2379     { .name = "XSCALE_UNLOCK_DCACHE",
2380       .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
2381       .access = PL1_W, .type = ARM_CP_NOP },
2382     REGINFO_SENTINEL
2383 };
2384
2385 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
2386     /* RAZ/WI the whole crn=15 space, when we don't have a more specific
2387      * implementation of this implementation-defined space.
2388      * Ideally this should eventually disappear in favour of actually
2389      * implementing the correct behaviour for all cores.
2390      */
2391     { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
2392       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
2393       .access = PL1_RW,
2394       .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE,
2395       .resetvalue = 0 },
2396     REGINFO_SENTINEL
2397 };
2398
2399 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
2400     /* Cache status: RAZ because we have no cache so it's always clean */
2401     { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
2402       .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2403       .resetvalue = 0 },
2404     REGINFO_SENTINEL
2405 };
2406
2407 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
2408     /* We never have a a block transfer operation in progress */
2409     { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
2410       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2411       .resetvalue = 0 },
2412     /* The cache ops themselves: these all NOP for QEMU */
2413     { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
2414       .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2415     { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
2416       .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2417     { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
2418       .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2419     { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
2420       .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2421     { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
2422       .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2423     { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
2424       .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2425     REGINFO_SENTINEL
2426 };
2427
2428 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
2429     /* The cache test-and-clean instructions always return (1 << 30)
2430      * to indicate that there are no dirty cache lines.
2431      */
2432     { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
2433       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2434       .resetvalue = (1 << 30) },
2435     { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
2436       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2437       .resetvalue = (1 << 30) },
2438     REGINFO_SENTINEL
2439 };
2440
2441 static const ARMCPRegInfo strongarm_cp_reginfo[] = {
2442     /* Ignore ReadBuffer accesses */
2443     { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
2444       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
2445       .access = PL1_RW, .resetvalue = 0,
2446       .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW },
2447     REGINFO_SENTINEL
2448 };
2449
2450 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2451 {
2452     ARMCPU *cpu = arm_env_get_cpu(env);
2453     unsigned int cur_el = arm_current_el(env);
2454     bool secure = arm_is_secure(env);
2455
2456     if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
2457         return env->cp15.vpidr_el2;
2458     }
2459     return raw_read(env, ri);
2460 }
2461
2462 static uint64_t mpidr_read_val(CPUARMState *env)
2463 {
2464     ARMCPU *cpu = ARM_CPU(arm_env_get_cpu(env));
2465     uint64_t mpidr = cpu->mp_affinity;
2466
2467     if (arm_feature(env, ARM_FEATURE_V7MP)) {
2468         mpidr |= (1U << 31);
2469         /* Cores which are uniprocessor (non-coherent)
2470          * but still implement the MP extensions set
2471          * bit 30. (For instance, Cortex-R5).
2472          */
2473         if (cpu->mp_is_up) {
2474             mpidr |= (1u << 30);
2475         }
2476     }
2477     return mpidr;
2478 }
2479
2480 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2481 {
2482     unsigned int cur_el = arm_current_el(env);
2483     bool secure = arm_is_secure(env);
2484
2485     if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
2486         return env->cp15.vmpidr_el2;
2487     }
2488     return mpidr_read_val(env);
2489 }
2490
2491 static const ARMCPRegInfo mpidr_cp_reginfo[] = {
2492     { .name = "MPIDR", .state = ARM_CP_STATE_BOTH,
2493       .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
2494       .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
2495     REGINFO_SENTINEL
2496 };
2497
2498 static const ARMCPRegInfo lpae_cp_reginfo[] = {
2499     /* NOP AMAIR0/1 */
2500     { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
2501       .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
2502       .access = PL1_RW, .type = ARM_CP_CONST,
2503       .resetvalue = 0 },
2504     /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
2505     { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
2506       .access = PL1_RW, .type = ARM_CP_CONST,
2507       .resetvalue = 0 },
2508     { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
2509       .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0,
2510       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s),
2511                              offsetof(CPUARMState, cp15.par_ns)} },
2512     { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
2513       .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
2514       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
2515                              offsetof(CPUARMState, cp15.ttbr0_ns) },
2516       .writefn = vmsa_ttbr_write, },
2517     { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
2518       .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
2519       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
2520                              offsetof(CPUARMState, cp15.ttbr1_ns) },
2521       .writefn = vmsa_ttbr_write, },
2522     REGINFO_SENTINEL
2523 };
2524
2525 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2526 {
2527     return vfp_get_fpcr(env);
2528 }
2529
2530 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2531                             uint64_t value)
2532 {
2533     vfp_set_fpcr(env, value);
2534 }
2535
2536 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2537 {
2538     return vfp_get_fpsr(env);
2539 }
2540
2541 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2542                             uint64_t value)
2543 {
2544     vfp_set_fpsr(env, value);
2545 }
2546
2547 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri)
2548 {
2549     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
2550         return CP_ACCESS_TRAP;
2551     }
2552     return CP_ACCESS_OK;
2553 }
2554
2555 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri,
2556                             uint64_t value)
2557 {
2558     env->daif = value & PSTATE_DAIF;
2559 }
2560
2561 static CPAccessResult aa64_cacheop_access(CPUARMState *env,
2562                                           const ARMCPRegInfo *ri)
2563 {
2564     /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
2565      * SCTLR_EL1.UCI is set.
2566      */
2567     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) {
2568         return CP_ACCESS_TRAP;
2569     }
2570     return CP_ACCESS_OK;
2571 }
2572
2573 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions
2574  * Page D4-1736 (DDI0487A.b)
2575  */
2576
2577 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2578                                     uint64_t value)
2579 {
2580     ARMCPU *cpu = arm_env_get_cpu(env);
2581     CPUState *cs = CPU(cpu);
2582
2583     if (arm_is_secure_below_el3(env)) {
2584         tlb_flush_by_mmuidx(cs, ARMMMUIdx_S1SE1, ARMMMUIdx_S1SE0, -1);
2585     } else {
2586         tlb_flush_by_mmuidx(cs, ARMMMUIdx_S12NSE1, ARMMMUIdx_S12NSE0, -1);
2587     }
2588 }
2589
2590 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2591                                       uint64_t value)
2592 {
2593     bool sec = arm_is_secure_below_el3(env);
2594     CPUState *other_cs;
2595
2596     CPU_FOREACH(other_cs) {
2597         if (sec) {
2598             tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S1SE1, ARMMMUIdx_S1SE0, -1);
2599         } else {
2600             tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S12NSE1,
2601                                 ARMMMUIdx_S12NSE0, -1);
2602         }
2603     }
2604 }
2605
2606 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2607                                   uint64_t value)
2608 {
2609     /* Note that the 'ALL' scope must invalidate both stage 1 and
2610      * stage 2 translations, whereas most other scopes only invalidate
2611      * stage 1 translations.
2612      */
2613     ARMCPU *cpu = arm_env_get_cpu(env);
2614     CPUState *cs = CPU(cpu);
2615
2616     if (arm_is_secure_below_el3(env)) {
2617         tlb_flush_by_mmuidx(cs, ARMMMUIdx_S1SE1, ARMMMUIdx_S1SE0, -1);
2618     } else {
2619         if (arm_feature(env, ARM_FEATURE_EL2)) {
2620             tlb_flush_by_mmuidx(cs, ARMMMUIdx_S12NSE1, ARMMMUIdx_S12NSE0,
2621                                 ARMMMUIdx_S2NS, -1);
2622         } else {
2623             tlb_flush_by_mmuidx(cs, ARMMMUIdx_S12NSE1, ARMMMUIdx_S12NSE0, -1);
2624         }
2625     }
2626 }
2627
2628 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
2629                                   uint64_t value)
2630 {
2631     ARMCPU *cpu = arm_env_get_cpu(env);
2632     CPUState *cs = CPU(cpu);
2633
2634     tlb_flush_by_mmuidx(cs, ARMMMUIdx_S1E2, -1);
2635 }
2636
2637 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
2638                                   uint64_t value)
2639 {
2640     ARMCPU *cpu = arm_env_get_cpu(env);
2641     CPUState *cs = CPU(cpu);
2642
2643     tlb_flush_by_mmuidx(cs, ARMMMUIdx_S1E3, -1);
2644 }
2645
2646 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2647                                     uint64_t value)
2648 {
2649     /* Note that the 'ALL' scope must invalidate both stage 1 and
2650      * stage 2 translations, whereas most other scopes only invalidate
2651      * stage 1 translations.
2652      */
2653     bool sec = arm_is_secure_below_el3(env);
2654     bool has_el2 = arm_feature(env, ARM_FEATURE_EL2);
2655     CPUState *other_cs;
2656
2657     CPU_FOREACH(other_cs) {
2658         if (sec) {
2659             tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S1SE1, ARMMMUIdx_S1SE0, -1);
2660         } else if (has_el2) {
2661             tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S12NSE1,
2662                                 ARMMMUIdx_S12NSE0, ARMMMUIdx_S2NS, -1);
2663         } else {
2664             tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S12NSE1,
2665                                 ARMMMUIdx_S12NSE0, -1);
2666         }
2667     }
2668 }
2669
2670 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2671                                     uint64_t value)
2672 {
2673     CPUState *other_cs;
2674
2675     CPU_FOREACH(other_cs) {
2676         tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S1E2, -1);
2677     }
2678 }
2679
2680 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2681                                     uint64_t value)
2682 {
2683     CPUState *other_cs;
2684
2685     CPU_FOREACH(other_cs) {
2686         tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S1E3, -1);
2687     }
2688 }
2689
2690 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2691                                  uint64_t value)
2692 {
2693     /* Invalidate by VA, EL1&0 (AArch64 version).
2694      * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1,
2695      * since we don't support flush-for-specific-ASID-only or
2696      * flush-last-level-only.
2697      */
2698     ARMCPU *cpu = arm_env_get_cpu(env);
2699     CPUState *cs = CPU(cpu);
2700     uint64_t pageaddr = sextract64(value << 12, 0, 56);
2701
2702     if (arm_is_secure_below_el3(env)) {
2703         tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdx_S1SE1,
2704                                  ARMMMUIdx_S1SE0, -1);
2705     } else {
2706         tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdx_S12NSE1,
2707                                  ARMMMUIdx_S12NSE0, -1);
2708     }
2709 }
2710
2711 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
2712                                  uint64_t value)
2713 {
2714     /* Invalidate by VA, EL2
2715      * Currently handles both VAE2 and VALE2, since we don't support
2716      * flush-last-level-only.
2717      */
2718     ARMCPU *cpu = arm_env_get_cpu(env);
2719     CPUState *cs = CPU(cpu);
2720     uint64_t pageaddr = sextract64(value << 12, 0, 56);
2721
2722     tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdx_S1E2, -1);
2723 }
2724
2725 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
2726                                  uint64_t value)
2727 {
2728     /* Invalidate by VA, EL3
2729      * Currently handles both VAE3 and VALE3, since we don't support
2730      * flush-last-level-only.
2731      */
2732     ARMCPU *cpu = arm_env_get_cpu(env);
2733     CPUState *cs = CPU(cpu);
2734     uint64_t pageaddr = sextract64(value << 12, 0, 56);
2735
2736     tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdx_S1E3, -1);
2737 }
2738
2739 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2740                                    uint64_t value)
2741 {
2742     bool sec = arm_is_secure_below_el3(env);
2743     CPUState *other_cs;
2744     uint64_t pageaddr = sextract64(value << 12, 0, 56);
2745
2746     CPU_FOREACH(other_cs) {
2747         if (sec) {
2748             tlb_flush_page_by_mmuidx(other_cs, pageaddr, ARMMMUIdx_S1SE1,
2749                                      ARMMMUIdx_S1SE0, -1);
2750         } else {
2751             tlb_flush_page_by_mmuidx(other_cs, pageaddr, ARMMMUIdx_S12NSE1,
2752                                      ARMMMUIdx_S12NSE0, -1);
2753         }
2754     }
2755 }
2756
2757 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2758                                    uint64_t value)
2759 {
2760     CPUState *other_cs;
2761     uint64_t pageaddr = sextract64(value << 12, 0, 56);
2762
2763     CPU_FOREACH(other_cs) {
2764         tlb_flush_page_by_mmuidx(other_cs, pageaddr, ARMMMUIdx_S1E2, -1);
2765     }
2766 }
2767
2768 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2769                                    uint64_t value)
2770 {
2771     CPUState *other_cs;
2772     uint64_t pageaddr = sextract64(value << 12, 0, 56);
2773
2774     CPU_FOREACH(other_cs) {
2775         tlb_flush_page_by_mmuidx(other_cs, pageaddr, ARMMMUIdx_S1E3, -1);
2776     }
2777 }
2778
2779 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2780                                     uint64_t value)
2781 {
2782     /* Invalidate by IPA. This has to invalidate any structures that
2783      * contain only stage 2 translation information, but does not need
2784      * to apply to structures that contain combined stage 1 and stage 2
2785      * translation information.
2786      * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
2787      */
2788     ARMCPU *cpu = arm_env_get_cpu(env);
2789     CPUState *cs = CPU(cpu);
2790     uint64_t pageaddr;
2791
2792     if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
2793         return;
2794     }
2795
2796     pageaddr = sextract64(value << 12, 0, 48);
2797
2798     tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdx_S2NS, -1);
2799 }
2800
2801 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2802                                       uint64_t value)
2803 {
2804     CPUState *other_cs;
2805     uint64_t pageaddr;
2806
2807     if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
2808         return;
2809     }
2810
2811     pageaddr = sextract64(value << 12, 0, 48);
2812
2813     CPU_FOREACH(other_cs) {
2814         tlb_flush_page_by_mmuidx(other_cs, pageaddr, ARMMMUIdx_S2NS, -1);
2815     }
2816 }
2817
2818 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri)
2819 {
2820     /* We don't implement EL2, so the only control on DC ZVA is the
2821      * bit in the SCTLR which can prohibit access for EL0.
2822      */
2823     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) {
2824         return CP_ACCESS_TRAP;
2825     }
2826     return CP_ACCESS_OK;
2827 }
2828
2829 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri)
2830 {
2831     ARMCPU *cpu = arm_env_get_cpu(env);
2832     int dzp_bit = 1 << 4;
2833
2834     /* DZP indicates whether DC ZVA access is allowed */
2835     if (aa64_zva_access(env, NULL) == CP_ACCESS_OK) {
2836         dzp_bit = 0;
2837     }
2838     return cpu->dcz_blocksize | dzp_bit;
2839 }
2840
2841 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
2842 {
2843     if (!(env->pstate & PSTATE_SP)) {
2844         /* Access to SP_EL0 is undefined if it's being used as
2845          * the stack pointer.
2846          */
2847         return CP_ACCESS_TRAP_UNCATEGORIZED;
2848     }
2849     return CP_ACCESS_OK;
2850 }
2851
2852 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri)
2853 {
2854     return env->pstate & PSTATE_SP;
2855 }
2856
2857 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
2858 {
2859     update_spsel(env, val);
2860 }
2861
2862 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2863                         uint64_t value)
2864 {
2865     ARMCPU *cpu = arm_env_get_cpu(env);
2866
2867     if (raw_read(env, ri) == value) {
2868         /* Skip the TLB flush if nothing actually changed; Linux likes
2869          * to do a lot of pointless SCTLR writes.
2870          */
2871         return;
2872     }
2873
2874     raw_write(env, ri, value);
2875     /* ??? Lots of these bits are not implemented.  */
2876     /* This may enable/disable the MMU, so do a TLB flush.  */
2877     tlb_flush(CPU(cpu), 1);
2878 }
2879
2880 static const ARMCPRegInfo v8_cp_reginfo[] = {
2881     /* Minimal set of EL0-visible registers. This will need to be expanded
2882      * significantly for system emulation of AArch64 CPUs.
2883      */
2884     { .name = "NZCV", .state = ARM_CP_STATE_AA64,
2885       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
2886       .access = PL0_RW, .type = ARM_CP_NZCV },
2887     { .name = "DAIF", .state = ARM_CP_STATE_AA64,
2888       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
2889       .type = ARM_CP_NO_RAW,
2890       .access = PL0_RW, .accessfn = aa64_daif_access,
2891       .fieldoffset = offsetof(CPUARMState, daif),
2892       .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
2893     { .name = "FPCR", .state = ARM_CP_STATE_AA64,
2894       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
2895       .access = PL0_RW, .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
2896     { .name = "FPSR", .state = ARM_CP_STATE_AA64,
2897       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
2898       .access = PL0_RW, .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
2899     { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
2900       .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
2901       .access = PL0_R, .type = ARM_CP_NO_RAW,
2902       .readfn = aa64_dczid_read },
2903     { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
2904       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
2905       .access = PL0_W, .type = ARM_CP_DC_ZVA,
2906 #ifndef CONFIG_USER_ONLY
2907       /* Avoid overhead of an access check that always passes in user-mode */
2908       .accessfn = aa64_zva_access,
2909 #endif
2910     },
2911     { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
2912       .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
2913       .access = PL1_R, .type = ARM_CP_CURRENTEL },
2914     /* Cache ops: all NOPs since we don't emulate caches */
2915     { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
2916       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
2917       .access = PL1_W, .type = ARM_CP_NOP },
2918     { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
2919       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
2920       .access = PL1_W, .type = ARM_CP_NOP },
2921     { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
2922       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
2923       .access = PL0_W, .type = ARM_CP_NOP,
2924       .accessfn = aa64_cacheop_access },
2925     { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
2926       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
2927       .access = PL1_W, .type = ARM_CP_NOP },
2928     { .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
2929       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
2930       .access = PL1_W, .type = ARM_CP_NOP },
2931     { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
2932       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
2933       .access = PL0_W, .type = ARM_CP_NOP,
2934       .accessfn = aa64_cacheop_access },
2935     { .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
2936       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
2937       .access = PL1_W, .type = ARM_CP_NOP },
2938     { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
2939       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
2940       .access = PL0_W, .type = ARM_CP_NOP,
2941       .accessfn = aa64_cacheop_access },
2942     { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
2943       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
2944       .access = PL0_W, .type = ARM_CP_NOP,
2945       .accessfn = aa64_cacheop_access },
2946     { .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
2947       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
2948       .access = PL1_W, .type = ARM_CP_NOP },
2949     /* TLBI operations */
2950     { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
2951       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
2952       .access = PL1_W, .type = ARM_CP_NO_RAW,
2953       .writefn = tlbi_aa64_vmalle1is_write },
2954     { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
2955       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
2956       .access = PL1_W, .type = ARM_CP_NO_RAW,
2957       .writefn = tlbi_aa64_vae1is_write },
2958     { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
2959       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
2960       .access = PL1_W, .type = ARM_CP_NO_RAW,
2961       .writefn = tlbi_aa64_vmalle1is_write },
2962     { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
2963       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
2964       .access = PL1_W, .type = ARM_CP_NO_RAW,
2965       .writefn = tlbi_aa64_vae1is_write },
2966     { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
2967       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
2968       .access = PL1_W, .type = ARM_CP_NO_RAW,
2969       .writefn = tlbi_aa64_vae1is_write },
2970     { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
2971       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
2972       .access = PL1_W, .type = ARM_CP_NO_RAW,
2973       .writefn = tlbi_aa64_vae1is_write },
2974     { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
2975       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
2976       .access = PL1_W, .type = ARM_CP_NO_RAW,
2977       .writefn = tlbi_aa64_vmalle1_write },
2978     { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
2979       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
2980       .access = PL1_W, .type = ARM_CP_NO_RAW,
2981       .writefn = tlbi_aa64_vae1_write },
2982     { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
2983       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
2984       .access = PL1_W, .type = ARM_CP_NO_RAW,
2985       .writefn = tlbi_aa64_vmalle1_write },
2986     { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
2987       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
2988       .access = PL1_W, .type = ARM_CP_NO_RAW,
2989       .writefn = tlbi_aa64_vae1_write },
2990     { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
2991       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
2992       .access = PL1_W, .type = ARM_CP_NO_RAW,
2993       .writefn = tlbi_aa64_vae1_write },
2994     { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
2995       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
2996       .access = PL1_W, .type = ARM_CP_NO_RAW,
2997       .writefn = tlbi_aa64_vae1_write },
2998     { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64,
2999       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
3000       .access = PL2_W, .type = ARM_CP_NO_RAW,
3001       .writefn = tlbi_aa64_ipas2e1is_write },
3002     { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64,
3003       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
3004       .access = PL2_W, .type = ARM_CP_NO_RAW,
3005       .writefn = tlbi_aa64_ipas2e1is_write },
3006     { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,
3007       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
3008       .access = PL2_W, .type = ARM_CP_NO_RAW,
3009       .writefn = tlbi_aa64_alle1is_write },
3010     { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64,
3011       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6,
3012       .access = PL2_W, .type = ARM_CP_NO_RAW,
3013       .writefn = tlbi_aa64_alle1is_write },
3014     { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64,
3015       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
3016       .access = PL2_W, .type = ARM_CP_NO_RAW,
3017       .writefn = tlbi_aa64_ipas2e1_write },
3018     { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64,
3019       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
3020       .access = PL2_W, .type = ARM_CP_NO_RAW,
3021       .writefn = tlbi_aa64_ipas2e1_write },
3022     { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,
3023       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
3024       .access = PL2_W, .type = ARM_CP_NO_RAW,
3025       .writefn = tlbi_aa64_alle1_write },
3026     { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64,
3027       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6,
3028       .access = PL2_W, .type = ARM_CP_NO_RAW,
3029       .writefn = tlbi_aa64_alle1is_write },
3030 #ifndef CONFIG_USER_ONLY
3031     /* 64 bit address translation operations */
3032     { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
3033       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
3034       .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3035     { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
3036       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
3037       .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3038     { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
3039       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
3040       .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3041     { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
3042       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
3043       .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3044     { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64,
3045       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4,
3046       .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3047     { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64,
3048       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5,
3049       .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3050     { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64,
3051       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6,
3052       .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3053     { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64,
3054       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7,
3055       .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3056     /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */
3057     { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64,
3058       .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0,
3059       .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3060     { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64,
3061       .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1,
3062       .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3063     { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64,
3064       .type = ARM_CP_ALIAS,
3065       .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0,
3066       .access = PL1_RW, .resetvalue = 0,
3067       .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]),
3068       .writefn = par_write },
3069 #endif
3070     /* TLB invalidate last level of translation table walk */
3071     { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
3072       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
3073     { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
3074       .type = ARM_CP_NO_RAW, .access = PL1_W,
3075       .writefn = tlbimvaa_is_write },
3076     { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
3077       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
3078     { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
3079       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
3080     /* 32 bit cache operations */
3081     { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
3082       .type = ARM_CP_NOP, .access = PL1_W },
3083     { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
3084       .type = ARM_CP_NOP, .access = PL1_W },
3085     { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
3086       .type = ARM_CP_NOP, .access = PL1_W },
3087     { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
3088       .type = ARM_CP_NOP, .access = PL1_W },
3089     { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
3090       .type = ARM_CP_NOP, .access = PL1_W },
3091     { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
3092       .type = ARM_CP_NOP, .access = PL1_W },
3093     { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
3094       .type = ARM_CP_NOP, .access = PL1_W },
3095     { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
3096       .type = ARM_CP_NOP, .access = PL1_W },
3097     { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
3098       .type = ARM_CP_NOP, .access = PL1_W },
3099     { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
3100       .type = ARM_CP_NOP, .access = PL1_W },
3101     { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
3102       .type = ARM_CP_NOP, .access = PL1_W },
3103     { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
3104       .type = ARM_CP_NOP, .access = PL1_W },
3105     { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
3106       .type = ARM_CP_NOP, .access = PL1_W },
3107     /* MMU Domain access control / MPU write buffer control */
3108     { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
3109       .access = PL1_RW, .resetvalue = 0,
3110       .writefn = dacr_write, .raw_writefn = raw_write,
3111       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
3112                              offsetoflow32(CPUARMState, cp15.dacr_ns) } },
3113     { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
3114       .type = ARM_CP_ALIAS,
3115       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
3116       .access = PL1_RW,
3117       .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
3118     { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
3119       .type = ARM_CP_ALIAS,
3120       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
3121       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[1]) },
3122     /* We rely on the access checks not allowing the guest to write to the
3123      * state field when SPSel indicates that it's being used as the stack
3124      * pointer.
3125      */
3126     { .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
3127       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
3128       .access = PL1_RW, .accessfn = sp_el0_access,
3129       .type = ARM_CP_ALIAS,
3130       .fieldoffset = offsetof(CPUARMState, sp_el[0]) },
3131     { .name = "SP_EL1", .state = ARM_CP_STATE_AA64,
3132       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0,
3133       .access = PL2_RW, .type = ARM_CP_ALIAS,
3134       .fieldoffset = offsetof(CPUARMState, sp_el[1]) },
3135     { .name = "SPSel", .state = ARM_CP_STATE_AA64,
3136       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
3137       .type = ARM_CP_NO_RAW,
3138       .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
3139     REGINFO_SENTINEL
3140 };
3141
3142 /* Used to describe the behaviour of EL2 regs when EL2 does not exist.  */
3143 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
3144     { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
3145       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
3146       .access = PL2_RW,
3147       .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
3148     { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
3149       .type = ARM_CP_NO_RAW,
3150       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
3151       .access = PL2_RW,
3152       .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
3153     { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
3154       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
3155       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3156     { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
3157       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
3158       .access = PL2_RW, .type = ARM_CP_CONST,
3159       .resetvalue = 0 },
3160     { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
3161       .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
3162       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3163     { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
3164       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
3165       .access = PL2_RW, .type = ARM_CP_CONST,
3166       .resetvalue = 0 },
3167     { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
3168       .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
3169       .access = PL2_RW, .type = ARM_CP_CONST,
3170       .resetvalue = 0 },
3171     { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
3172       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
3173       .access = PL2_RW, .type = ARM_CP_CONST,
3174       .resetvalue = 0 },
3175     { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
3176       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
3177       .access = PL2_RW, .type = ARM_CP_CONST,
3178       .resetvalue = 0 },
3179     { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
3180       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
3181       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3182     { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH,
3183       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
3184       .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
3185       .type = ARM_CP_CONST, .resetvalue = 0 },
3186     { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
3187       .cp = 15, .opc1 = 6, .crm = 2,
3188       .access = PL2_RW, .accessfn = access_el3_aa32ns,
3189       .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
3190     { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
3191       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
3192       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3193     { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
3194       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
3195       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3196     { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
3197       .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
3198       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3199     { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
3200       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
3201       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3202     { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
3203       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
3204       .resetvalue = 0 },
3205     { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
3206       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
3207       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3208     { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
3209       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
3210       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3211     { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
3212       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
3213       .resetvalue = 0 },
3214     { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
3215       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
3216       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3217     { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
3218       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
3219       .resetvalue = 0 },
3220     { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
3221       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
3222       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3223     { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
3224       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
3225       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3226     REGINFO_SENTINEL
3227 };
3228
3229 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
3230 {
3231     ARMCPU *cpu = arm_env_get_cpu(env);
3232     uint64_t valid_mask = HCR_MASK;
3233
3234     if (arm_feature(env, ARM_FEATURE_EL3)) {
3235         valid_mask &= ~HCR_HCD;
3236     } else {
3237         valid_mask &= ~HCR_TSC;
3238     }
3239
3240     /* Clear RES0 bits.  */
3241     value &= valid_mask;
3242
3243     /* These bits change the MMU setup:
3244      * HCR_VM enables stage 2 translation
3245      * HCR_PTW forbids certain page-table setups
3246      * HCR_DC Disables stage1 and enables stage2 translation
3247      */
3248     if ((raw_read(env, ri) ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) {
3249         tlb_flush(CPU(cpu), 1);
3250     }
3251     raw_write(env, ri, value);
3252 }
3253
3254 static const ARMCPRegInfo el2_cp_reginfo[] = {
3255     { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
3256       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
3257       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
3258       .writefn = hcr_write },
3259     { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64,
3260       .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0,
3261       .access = PL2_RW, .resetvalue = 0,
3262       .writefn = dacr_write, .raw_writefn = raw_write,
3263       .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) },
3264     { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
3265       .type = ARM_CP_ALIAS,
3266       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
3267       .access = PL2_RW,
3268       .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
3269     { .name = "ESR_EL2", .state = ARM_CP_STATE_AA64,
3270       .type = ARM_CP_ALIAS,
3271       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
3272       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
3273     { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64,
3274       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1,
3275       .access = PL2_RW, .resetvalue = 0,
3276       .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) },
3277     { .name = "FAR_EL2", .state = ARM_CP_STATE_AA64,
3278       .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
3279       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
3280     { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
3281       .type = ARM_CP_ALIAS,
3282       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
3283       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[6]) },
3284     { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
3285       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
3286       .access = PL2_RW, .writefn = vbar_write,
3287       .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
3288       .resetvalue = 0 },
3289     { .name = "SP_EL2", .state = ARM_CP_STATE_AA64,
3290       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0,
3291       .access = PL3_RW, .type = ARM_CP_ALIAS,
3292       .fieldoffset = offsetof(CPUARMState, sp_el[2]) },
3293     { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
3294       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
3295       .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0,
3296       .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]) },
3297     { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
3298       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
3299       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),
3300       .resetvalue = 0 },
3301     { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
3302       .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
3303       .access = PL2_RW, .type = ARM_CP_ALIAS,
3304       .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },
3305     { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
3306       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
3307       .access = PL2_RW, .type = ARM_CP_CONST,
3308       .resetvalue = 0 },
3309     /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
3310     { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
3311       .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
3312       .access = PL2_RW, .type = ARM_CP_CONST,
3313       .resetvalue = 0 },
3314     { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
3315       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
3316       .access = PL2_RW, .type = ARM_CP_CONST,
3317       .resetvalue = 0 },
3318     { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
3319       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
3320       .access = PL2_RW, .type = ARM_CP_CONST,
3321       .resetvalue = 0 },
3322     { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
3323       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
3324       .access = PL2_RW, .writefn = vmsa_tcr_el1_write,
3325       .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
3326       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
3327     { .name = "VTCR", .state = ARM_CP_STATE_AA32,
3328       .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
3329       .access = PL2_RW, .accessfn = access_el3_aa32ns,
3330       .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
3331     { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
3332       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
3333       .access = PL2_RW, .type = ARM_CP_ALIAS,
3334       .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
3335     { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
3336       .cp = 15, .opc1 = 6, .crm = 2,
3337       .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3338       .access = PL2_RW, .accessfn = access_el3_aa32ns,
3339       .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2),
3340       .writefn = vttbr_write },
3341     { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
3342       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
3343       .access = PL2_RW, .writefn = vttbr_write,
3344       .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) },
3345     { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
3346       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
3347       .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
3348       .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) },
3349     { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
3350       .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
3351       .access = PL2_RW, .resetvalue = 0,
3352       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
3353     { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
3354       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
3355       .access = PL2_RW, .resetvalue = 0,
3356       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
3357     { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
3358       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3359       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
3360     { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64,
3361       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
3362       .type = ARM_CP_NO_RAW, .access = PL2_W,
3363       .writefn = tlbi_aa64_alle2_write },
3364     { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64,
3365       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
3366       .type = ARM_CP_NO_RAW, .access = PL2_W,
3367       .writefn = tlbi_aa64_vae2_write },
3368     { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64,
3369       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
3370       .access = PL2_W, .type = ARM_CP_NO_RAW,
3371       .writefn = tlbi_aa64_vae2_write },
3372     { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64,
3373       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
3374       .access = PL2_W, .type = ARM_CP_NO_RAW,
3375       .writefn = tlbi_aa64_alle2is_write },
3376     { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64,
3377       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
3378       .type = ARM_CP_NO_RAW, .access = PL2_W,
3379       .writefn = tlbi_aa64_vae2is_write },
3380     { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64,
3381       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
3382       .access = PL2_W, .type = ARM_CP_NO_RAW,
3383       .writefn = tlbi_aa64_vae2is_write },
3384 #ifndef CONFIG_USER_ONLY
3385     /* Unlike the other EL2-related AT operations, these must
3386      * UNDEF from EL3 if EL2 is not implemented, which is why we
3387      * define them here rather than with the rest of the AT ops.
3388      */
3389     { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64,
3390       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
3391       .access = PL2_W, .accessfn = at_s1e2_access,
3392       .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3393     { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64,
3394       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
3395       .access = PL2_W, .accessfn = at_s1e2_access,
3396       .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3397     /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
3398      * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
3399      * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
3400      * to behave as if SCR.NS was 1.
3401      */
3402     { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
3403       .access = PL2_W,
3404       .writefn = ats1h_write, .type = ARM_CP_NO_RAW },
3405     { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
3406       .access = PL2_W,
3407       .writefn = ats1h_write, .type = ARM_CP_NO_RAW },
3408     { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
3409       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
3410       /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the
3411        * reset values as IMPDEF. We choose to reset to 3 to comply with
3412        * both ARMv7 and ARMv8.
3413        */
3414       .access = PL2_RW, .resetvalue = 3,
3415       .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) },
3416     { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
3417       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
3418       .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
3419       .writefn = gt_cntvoff_write,
3420       .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
3421     { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
3422       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO,
3423       .writefn = gt_cntvoff_write,
3424       .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
3425     { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
3426       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
3427       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
3428       .type = ARM_CP_IO, .access = PL2_RW,
3429       .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
3430     { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
3431       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
3432       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO,
3433       .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
3434     { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
3435       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
3436       .type = ARM_CP_IO, .access = PL2_RW,
3437       .resetfn = gt_hyp_timer_reset,
3438       .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write },
3439     { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
3440       .type = ARM_CP_IO,
3441       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
3442       .access = PL2_RW,
3443       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl),
3444       .resetvalue = 0,
3445       .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
3446 #endif
3447     REGINFO_SENTINEL
3448 };
3449
3450 static const ARMCPRegInfo el3_cp_reginfo[] = {
3451     { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
3452       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
3453       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
3454       .resetvalue = 0, .writefn = scr_write },
3455     { .name = "SCR",  .type = ARM_CP_ALIAS,
3456       .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
3457       .access = PL3_RW, .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
3458       .writefn = scr_write },
3459     { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
3460       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
3461       .access = PL3_RW, .resetvalue = 0,
3462       .fieldoffset = offsetof(CPUARMState, cp15.sder) },
3463     { .name = "SDER",
3464       .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1,
3465       .access = PL3_RW, .resetvalue = 0,
3466       .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) },
3467       /* TODO: Implement NSACR trapping of secure EL1 accesses to EL3 */
3468     { .name = "NSACR", .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
3469       .access = PL3_W | PL1_R, .resetvalue = 0,
3470       .fieldoffset = offsetof(CPUARMState, cp15.nsacr) },
3471     { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
3472       .access = PL3_RW, .writefn = vbar_write, .resetvalue = 0,
3473       .fieldoffset = offsetof(CPUARMState, cp15.mvbar) },
3474     { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
3475       .type = ARM_CP_ALIAS, /* reset handled by AArch32 view */
3476       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
3477       .access = PL3_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
3478       .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]) },
3479     { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64,
3480       .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0,
3481       .access = PL3_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
3482       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) },
3483     { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
3484       .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2,
3485       .access = PL3_RW, .writefn = vmsa_tcr_el1_write,
3486       .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
3487       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) },
3488     { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
3489       .type = ARM_CP_ALIAS,
3490       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
3491       .access = PL3_RW,
3492       .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
3493     { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
3494       .type = ARM_CP_ALIAS,
3495       .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
3496       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) },
3497     { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64,
3498       .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0,
3499       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) },
3500     { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
3501       .type = ARM_CP_ALIAS,
3502       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
3503       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[7]) },
3504     { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
3505       .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
3506       .access = PL3_RW, .writefn = vbar_write,
3507       .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
3508       .resetvalue = 0 },
3509     { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64,
3510       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2,
3511       .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0,
3512       .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) },
3513     { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64,
3514       .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2,
3515       .access = PL3_RW, .resetvalue = 0,
3516       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) },
3517     { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64,
3518       .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0,
3519       .access = PL3_RW, .type = ARM_CP_CONST,
3520       .resetvalue = 0 },
3521     { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH,
3522       .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0,
3523       .access = PL3_RW, .type = ARM_CP_CONST,
3524       .resetvalue = 0 },
3525     { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH,
3526       .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1,
3527       .access = PL3_RW, .type = ARM_CP_CONST,
3528       .resetvalue = 0 },
3529     { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64,
3530       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0,
3531       .access = PL3_W, .type = ARM_CP_NO_RAW,
3532       .writefn = tlbi_aa64_alle3is_write },
3533     { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64,
3534       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1,
3535       .access = PL3_W, .type = ARM_CP_NO_RAW,
3536       .writefn = tlbi_aa64_vae3is_write },
3537     { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64,
3538       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5,
3539       .access = PL3_W, .type = ARM_CP_NO_RAW,
3540       .writefn = tlbi_aa64_vae3is_write },
3541     { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64,
3542       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0,
3543       .access = PL3_W, .type = ARM_CP_NO_RAW,
3544       .writefn = tlbi_aa64_alle3_write },
3545     { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64,
3546       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1,
3547       .access = PL3_W, .type = ARM_CP_NO_RAW,
3548       .writefn = tlbi_aa64_vae3_write },
3549     { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64,
3550       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5,
3551       .access = PL3_W, .type = ARM_CP_NO_RAW,
3552       .writefn = tlbi_aa64_vae3_write },
3553     REGINFO_SENTINEL
3554 };
3555
3556 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
3557 {
3558     /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
3559      * but the AArch32 CTR has its own reginfo struct)
3560      */
3561     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) {
3562         return CP_ACCESS_TRAP;
3563     }
3564     return CP_ACCESS_OK;
3565 }
3566
3567 static const ARMCPRegInfo debug_cp_reginfo[] = {
3568     /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
3569      * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
3570      * unlike DBGDRAR it is never accessible from EL0.
3571      * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
3572      * accessor.
3573      */
3574     { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
3575       .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3576     { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
3577       .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
3578       .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3579     { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
3580       .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3581     /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
3582     { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
3583       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
3584       .access = PL1_RW,
3585       .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
3586       .resetvalue = 0 },
3587     /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1.
3588      * We don't implement the configurable EL0 access.
3589      */
3590     { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH,
3591       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
3592       .type = ARM_CP_ALIAS,
3593       .access = PL1_R,
3594       .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
3595     /* We define a dummy WI OSLAR_EL1, because Linux writes to it. */
3596     { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
3597       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
3598       .access = PL1_W, .type = ARM_CP_NOP },
3599     /* Dummy OSDLR_EL1: 32-bit Linux will read this */
3600     { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
3601       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
3602       .access = PL1_RW, .type = ARM_CP_NOP },
3603     /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
3604      * implement vector catch debug events yet.
3605      */
3606     { .name = "DBGVCR",
3607       .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
3608       .access = PL1_RW, .type = ARM_CP_NOP },
3609     REGINFO_SENTINEL
3610 };
3611
3612 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
3613     /* 64 bit access versions of the (dummy) debug registers */
3614     { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
3615       .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
3616     { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
3617       .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
3618     REGINFO_SENTINEL
3619 };
3620
3621 void hw_watchpoint_update(ARMCPU *cpu, int n)
3622 {
3623     CPUARMState *env = &cpu->env;
3624     vaddr len = 0;
3625     vaddr wvr = env->cp15.dbgwvr[n];
3626     uint64_t wcr = env->cp15.dbgwcr[n];
3627     int mask;
3628     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
3629
3630     if (env->cpu_watchpoint[n]) {
3631         cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
3632         env->cpu_watchpoint[n] = NULL;
3633     }
3634
3635     if (!extract64(wcr, 0, 1)) {
3636         /* E bit clear : watchpoint disabled */
3637         return;
3638     }
3639
3640     switch (extract64(wcr, 3, 2)) {
3641     case 0:
3642         /* LSC 00 is reserved and must behave as if the wp is disabled */
3643         return;
3644     case 1:
3645         flags |= BP_MEM_READ;
3646         break;
3647     case 2:
3648         flags |= BP_MEM_WRITE;
3649         break;
3650     case 3:
3651         flags |= BP_MEM_ACCESS;
3652         break;
3653     }
3654
3655     /* Attempts to use both MASK and BAS fields simultaneously are
3656      * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
3657      * thus generating a watchpoint for every byte in the masked region.
3658      */
3659     mask = extract64(wcr, 24, 4);
3660     if (mask == 1 || mask == 2) {
3661         /* Reserved values of MASK; we must act as if the mask value was
3662          * some non-reserved value, or as if the watchpoint were disabled.
3663          * We choose the latter.
3664          */
3665         return;
3666     } else if (mask) {
3667         /* Watchpoint covers an aligned area up to 2GB in size */
3668         len = 1ULL << mask;
3669         /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
3670          * whether the watchpoint fires when the unmasked bits match; we opt
3671          * to generate the exceptions.
3672          */
3673         wvr &= ~(len - 1);
3674     } else {
3675         /* Watchpoint covers bytes defined by the byte address select bits */
3676         int bas = extract64(wcr, 5, 8);
3677         int basstart;
3678
3679         if (bas == 0) {
3680             /* This must act as if the watchpoint is disabled */
3681             return;
3682         }
3683
3684         if (extract64(wvr, 2, 1)) {
3685             /* Deprecated case of an only 4-aligned address. BAS[7:4] are
3686              * ignored, and BAS[3:0] define which bytes to watch.
3687              */
3688             bas &= 0xf;
3689         }
3690         /* The BAS bits are supposed to be programmed to indicate a contiguous
3691          * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
3692          * we fire for each byte in the word/doubleword addressed by the WVR.
3693          * We choose to ignore any non-zero bits after the first range of 1s.
3694          */
3695         basstart = ctz32(bas);
3696         len = cto32(bas >> basstart);
3697         wvr += basstart;
3698     }
3699
3700     cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
3701                           &env->cpu_watchpoint[n]);
3702 }
3703
3704 void hw_watchpoint_update_all(ARMCPU *cpu)
3705 {
3706     int i;
3707     CPUARMState *env = &cpu->env;
3708
3709     /* Completely clear out existing QEMU watchpoints and our array, to
3710      * avoid possible stale entries following migration load.
3711      */
3712     cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
3713     memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
3714
3715     for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
3716         hw_watchpoint_update(cpu, i);
3717     }
3718 }
3719
3720 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3721                          uint64_t value)
3722 {
3723     ARMCPU *cpu = arm_env_get_cpu(env);
3724     int i = ri->crm;
3725
3726     /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
3727      * register reads and behaves as if values written are sign extended.
3728      * Bits [1:0] are RES0.
3729      */
3730     value = sextract64(value, 0, 49) & ~3ULL;
3731
3732     raw_write(env, ri, value);
3733     hw_watchpoint_update(cpu, i);
3734 }
3735
3736 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3737                          uint64_t value)
3738 {
3739     ARMCPU *cpu = arm_env_get_cpu(env);
3740     int i = ri->crm;
3741
3742     raw_write(env, ri, value);
3743     hw_watchpoint_update(cpu, i);
3744 }
3745
3746 void hw_breakpoint_update(ARMCPU *cpu, int n)
3747 {
3748     CPUARMState *env = &cpu->env;
3749     uint64_t bvr = env->cp15.dbgbvr[n];
3750     uint64_t bcr = env->cp15.dbgbcr[n];
3751     vaddr addr;
3752     int bt;
3753     int flags = BP_CPU;
3754
3755     if (env->cpu_breakpoint[n]) {
3756         cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
3757         env->cpu_breakpoint[n] = NULL;
3758     }
3759
3760     if (!extract64(bcr, 0, 1)) {
3761         /* E bit clear : watchpoint disabled */
3762         return;
3763     }
3764
3765     bt = extract64(bcr, 20, 4);
3766
3767     switch (bt) {
3768     case 4: /* unlinked address mismatch (reserved if AArch64) */
3769     case 5: /* linked address mismatch (reserved if AArch64) */
3770         qemu_log_mask(LOG_UNIMP,
3771                       "arm: address mismatch breakpoint types not implemented");
3772         return;
3773     case 0: /* unlinked address match */
3774     case 1: /* linked address match */
3775     {
3776         /* Bits [63:49] are hardwired to the value of bit [48]; that is,
3777          * we behave as if the register was sign extended. Bits [1:0] are
3778          * RES0. The BAS field is used to allow setting breakpoints on 16
3779          * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether
3780          * a bp will fire if the addresses covered by the bp and the addresses
3781          * covered by the insn overlap but the insn doesn't start at the
3782          * start of the bp address range. We choose to require the insn and
3783          * the bp to have the same address. The constraints on writing to
3784          * BAS enforced in dbgbcr_write mean we have only four cases:
3785          *  0b0000  => no breakpoint
3786          *  0b0011  => breakpoint on addr
3787          *  0b1100  => breakpoint on addr + 2
3788          *  0b1111  => breakpoint on addr
3789          * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
3790          */
3791         int bas = extract64(bcr, 5, 4);
3792         addr = sextract64(bvr, 0, 49) & ~3ULL;
3793         if (bas == 0) {
3794             return;
3795         }
3796         if (bas == 0xc) {
3797             addr += 2;
3798         }
3799         break;
3800     }
3801     case 2: /* unlinked context ID match */
3802     case 8: /* unlinked VMID match (reserved if no EL2) */
3803     case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
3804         qemu_log_mask(LOG_UNIMP,
3805                       "arm: unlinked context breakpoint types not implemented");
3806         return;
3807     case 9: /* linked VMID match (reserved if no EL2) */
3808     case 11: /* linked context ID and VMID match (reserved if no EL2) */
3809     case 3: /* linked context ID match */
3810     default:
3811         /* We must generate no events for Linked context matches (unless
3812          * they are linked to by some other bp/wp, which is handled in
3813          * updates for the linking bp/wp). We choose to also generate no events
3814          * for reserved values.
3815          */
3816         return;
3817     }
3818
3819     cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
3820 }
3821
3822 void hw_breakpoint_update_all(ARMCPU *cpu)
3823 {
3824     int i;
3825     CPUARMState *env = &cpu->env;
3826
3827     /* Completely clear out existing QEMU breakpoints and our array, to
3828      * avoid possible stale entries following migration load.
3829      */
3830     cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
3831     memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
3832
3833     for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
3834         hw_breakpoint_update(cpu, i);
3835     }
3836 }
3837
3838 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3839                          uint64_t value)
3840 {
3841     ARMCPU *cpu = arm_env_get_cpu(env);
3842     int i = ri->crm;
3843
3844     raw_write(env, ri, value);
3845     hw_breakpoint_update(cpu, i);
3846 }
3847
3848 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3849                          uint64_t value)
3850 {
3851     ARMCPU *cpu = arm_env_get_cpu(env);
3852     int i = ri->crm;
3853
3854     /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
3855      * copy of BAS[0].
3856      */
3857     value = deposit64(value, 6, 1, extract64(value, 5, 1));
3858     value = deposit64(value, 8, 1, extract64(value, 7, 1));
3859
3860     raw_write(env, ri, value);
3861     hw_breakpoint_update(cpu, i);
3862 }
3863
3864 static void define_debug_regs(ARMCPU *cpu)
3865 {
3866     /* Define v7 and v8 architectural debug registers.
3867      * These are just dummy implementations for now.
3868      */
3869     int i;
3870     int wrps, brps, ctx_cmps;
3871     ARMCPRegInfo dbgdidr = {
3872         .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
3873         .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr,
3874     };
3875
3876     /* Note that all these register fields hold "number of Xs minus 1". */
3877     brps = extract32(cpu->dbgdidr, 24, 4);
3878     wrps = extract32(cpu->dbgdidr, 28, 4);
3879     ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
3880
3881     assert(ctx_cmps <= brps);
3882
3883     /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties
3884      * of the debug registers such as number of breakpoints;
3885      * check that if they both exist then they agree.
3886      */
3887     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
3888         assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps);
3889         assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps);
3890         assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps);
3891     }
3892
3893     define_one_arm_cp_reg(cpu, &dbgdidr);
3894     define_arm_cp_regs(cpu, debug_cp_reginfo);
3895
3896     if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
3897         define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
3898     }
3899
3900     for (i = 0; i < brps + 1; i++) {
3901         ARMCPRegInfo dbgregs[] = {
3902             { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH,
3903               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
3904               .access = PL1_RW,
3905               .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
3906               .writefn = dbgbvr_write, .raw_writefn = raw_write
3907             },
3908             { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH,
3909               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
3910               .access = PL1_RW,
3911               .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
3912               .writefn = dbgbcr_write, .raw_writefn = raw_write
3913             },
3914             REGINFO_SENTINEL
3915         };
3916         define_arm_cp_regs(cpu, dbgregs);
3917     }
3918
3919     for (i = 0; i < wrps + 1; i++) {
3920         ARMCPRegInfo dbgregs[] = {
3921             { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH,
3922               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
3923               .access = PL1_RW,
3924               .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
3925               .writefn = dbgwvr_write, .raw_writefn = raw_write
3926             },
3927             { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH,
3928               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
3929               .access = PL1_RW,
3930               .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
3931               .writefn = dbgwcr_write, .raw_writefn = raw_write
3932             },
3933             REGINFO_SENTINEL
3934         };
3935         define_arm_cp_regs(cpu, dbgregs);
3936     }
3937 }
3938
3939 void register_cp_regs_for_features(ARMCPU *cpu)
3940 {
3941     /* Register all the coprocessor registers based on feature bits */
3942     CPUARMState *env = &cpu->env;
3943     if (arm_feature(env, ARM_FEATURE_M)) {
3944         /* M profile has no coprocessor registers */
3945         return;
3946     }
3947
3948     define_arm_cp_regs(cpu, cp_reginfo);
3949     if (!arm_feature(env, ARM_FEATURE_V8)) {
3950         /* Must go early as it is full of wildcards that may be
3951          * overridden by later definitions.
3952          */
3953         define_arm_cp_regs(cpu, not_v8_cp_reginfo);
3954     }
3955
3956     if (arm_feature(env, ARM_FEATURE_V6)) {
3957         /* The ID registers all have impdef reset values */
3958         ARMCPRegInfo v6_idregs[] = {
3959             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
3960               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
3961               .access = PL1_R, .type = ARM_CP_CONST,
3962               .resetvalue = cpu->id_pfr0 },
3963             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
3964               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
3965               .access = PL1_R, .type = ARM_CP_CONST,
3966               .resetvalue = cpu->id_pfr1 },
3967             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
3968               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
3969               .access = PL1_R, .type = ARM_CP_CONST,
3970               .resetvalue = cpu->id_dfr0 },
3971             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
3972               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
3973               .access = PL1_R, .type = ARM_CP_CONST,
3974               .resetvalue = cpu->id_afr0 },
3975             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
3976               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
3977               .access = PL1_R, .type = ARM_CP_CONST,
3978               .resetvalue = cpu->id_mmfr0 },
3979             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
3980               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
3981               .access = PL1_R, .type = ARM_CP_CONST,
3982               .resetvalue = cpu->id_mmfr1 },
3983             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
3984               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
3985               .access = PL1_R, .type = ARM_CP_CONST,
3986               .resetvalue = cpu->id_mmfr2 },
3987             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
3988               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
3989               .access = PL1_R, .type = ARM_CP_CONST,
3990               .resetvalue = cpu->id_mmfr3 },
3991             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
3992               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
3993               .access = PL1_R, .type = ARM_CP_CONST,
3994               .resetvalue = cpu->id_isar0 },
3995             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
3996               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
3997               .access = PL1_R, .type = ARM_CP_CONST,
3998               .resetvalue = cpu->id_isar1 },
3999             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
4000               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
4001               .access = PL1_R, .type = ARM_CP_CONST,
4002               .resetvalue = cpu->id_isar2 },
4003             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
4004               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
4005               .access = PL1_R, .type = ARM_CP_CONST,
4006               .resetvalue = cpu->id_isar3 },
4007             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
4008               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
4009               .access = PL1_R, .type = ARM_CP_CONST,
4010               .resetvalue = cpu->id_isar4 },
4011             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
4012               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
4013               .access = PL1_R, .type = ARM_CP_CONST,
4014               .resetvalue = cpu->id_isar5 },
4015             /* 6..7 are as yet unallocated and must RAZ */
4016             { .name = "ID_ISAR6", .cp = 15, .crn = 0, .crm = 2,
4017               .opc1 = 0, .opc2 = 6, .access = PL1_R, .type = ARM_CP_CONST,
4018               .resetvalue = 0 },
4019             { .name = "ID_ISAR7", .cp = 15, .crn = 0, .crm = 2,
4020               .opc1 = 0, .opc2 = 7, .access = PL1_R, .type = ARM_CP_CONST,
4021               .resetvalue = 0 },
4022             REGINFO_SENTINEL
4023         };
4024         define_arm_cp_regs(cpu, v6_idregs);
4025         define_arm_cp_regs(cpu, v6_cp_reginfo);
4026     } else {
4027         define_arm_cp_regs(cpu, not_v6_cp_reginfo);
4028     }
4029     if (arm_feature(env, ARM_FEATURE_V6K)) {
4030         define_arm_cp_regs(cpu, v6k_cp_reginfo);
4031     }
4032     if (arm_feature(env, ARM_FEATURE_V7MP) &&
4033         !arm_feature(env, ARM_FEATURE_MPU)) {
4034         define_arm_cp_regs(cpu, v7mp_cp_reginfo);
4035     }
4036     if (arm_feature(env, ARM_FEATURE_V7)) {
4037         /* v7 performance monitor control register: same implementor
4038          * field as main ID register, and we implement only the cycle
4039          * count register.
4040          */
4041 #ifndef CONFIG_USER_ONLY
4042         ARMCPRegInfo pmcr = {
4043             .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
4044             .access = PL0_RW,
4045             .type = ARM_CP_IO | ARM_CP_ALIAS,
4046             .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
4047             .accessfn = pmreg_access, .writefn = pmcr_write,
4048             .raw_writefn = raw_write,
4049         };
4050         ARMCPRegInfo pmcr64 = {
4051             .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
4052             .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
4053             .access = PL0_RW, .accessfn = pmreg_access,
4054             .type = ARM_CP_IO,
4055             .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
4056             .resetvalue = cpu->midr & 0xff000000,
4057             .writefn = pmcr_write, .raw_writefn = raw_write,
4058         };
4059         define_one_arm_cp_reg(cpu, &pmcr);
4060         define_one_arm_cp_reg(cpu, &pmcr64);
4061 #endif
4062         ARMCPRegInfo clidr = {
4063             .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
4064             .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
4065             .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr
4066         };
4067         define_one_arm_cp_reg(cpu, &clidr);
4068         define_arm_cp_regs(cpu, v7_cp_reginfo);
4069         define_debug_regs(cpu);
4070     } else {
4071         define_arm_cp_regs(cpu, not_v7_cp_reginfo);
4072     }
4073     if (arm_feature(env, ARM_FEATURE_V8)) {
4074         /* AArch64 ID registers, which all have impdef reset values */
4075         ARMCPRegInfo v8_idregs[] = {
4076             { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
4077               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
4078               .access = PL1_R, .type = ARM_CP_CONST,
4079               .resetvalue = cpu->id_aa64pfr0 },
4080             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
4081               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
4082               .access = PL1_R, .type = ARM_CP_CONST,
4083               .resetvalue = cpu->id_aa64pfr1},
4084             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
4085               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
4086               .access = PL1_R, .type = ARM_CP_CONST,
4087               /* We mask out the PMUVer field, because we don't currently
4088                * implement the PMU. Not advertising it prevents the guest
4089                * from trying to use it and getting UNDEFs on registers we
4090                * don't implement.
4091                */
4092               .resetvalue = cpu->id_aa64dfr0 & ~0xf00 },
4093             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
4094               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
4095               .access = PL1_R, .type = ARM_CP_CONST,
4096               .resetvalue = cpu->id_aa64dfr1 },
4097             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
4098               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
4099               .access = PL1_R, .type = ARM_CP_CONST,
4100               .resetvalue = cpu->id_aa64afr0 },
4101             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
4102               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
4103               .access = PL1_R, .type = ARM_CP_CONST,
4104               .resetvalue = cpu->id_aa64afr1 },
4105             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
4106               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
4107               .access = PL1_R, .type = ARM_CP_CONST,
4108               .resetvalue = cpu->id_aa64isar0 },
4109             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
4110               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
4111               .access = PL1_R, .type = ARM_CP_CONST,
4112               .resetvalue = cpu->id_aa64isar1 },
4113             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
4114               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
4115               .access = PL1_R, .type = ARM_CP_CONST,
4116               .resetvalue = cpu->id_aa64mmfr0 },
4117             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
4118               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
4119               .access = PL1_R, .type = ARM_CP_CONST,
4120               .resetvalue = cpu->id_aa64mmfr1 },
4121             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
4122               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
4123               .access = PL1_R, .type = ARM_CP_CONST,
4124               .resetvalue = cpu->mvfr0 },
4125             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
4126               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
4127               .access = PL1_R, .type = ARM_CP_CONST,
4128               .resetvalue = cpu->mvfr1 },
4129             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
4130               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
4131               .access = PL1_R, .type = ARM_CP_CONST,
4132               .resetvalue = cpu->mvfr2 },
4133             REGINFO_SENTINEL
4134         };
4135         /* RVBAR_EL1 is only implemented if EL1 is the highest EL */
4136         if (!arm_feature(env, ARM_FEATURE_EL3) &&
4137             !arm_feature(env, ARM_FEATURE_EL2)) {
4138             ARMCPRegInfo rvbar = {
4139                 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
4140                 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
4141                 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
4142             };
4143             define_one_arm_cp_reg(cpu, &rvbar);
4144         }
4145         define_arm_cp_regs(cpu, v8_idregs);
4146         define_arm_cp_regs(cpu, v8_cp_reginfo);
4147     }
4148     if (arm_feature(env, ARM_FEATURE_EL2)) {
4149         uint64_t vmpidr_def = mpidr_read_val(env);
4150         ARMCPRegInfo vpidr_regs[] = {
4151             { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
4152               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
4153               .access = PL2_RW, .accessfn = access_el3_aa32ns,
4154               .resetvalue = cpu->midr,
4155               .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
4156             { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64,
4157               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
4158               .access = PL2_RW, .resetvalue = cpu->midr,
4159               .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
4160             { .name = "VMPIDR", .state = ARM_CP_STATE_AA32,
4161               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
4162               .access = PL2_RW, .accessfn = access_el3_aa32ns,
4163               .resetvalue = vmpidr_def,
4164               .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
4165             { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64,
4166               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
4167               .access = PL2_RW,
4168               .resetvalue = vmpidr_def,
4169               .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
4170             REGINFO_SENTINEL
4171         };
4172         define_arm_cp_regs(cpu, vpidr_regs);
4173         define_arm_cp_regs(cpu, el2_cp_reginfo);
4174         /* RVBAR_EL2 is only implemented if EL2 is the highest EL */
4175         if (!arm_feature(env, ARM_FEATURE_EL3)) {
4176             ARMCPRegInfo rvbar = {
4177                 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
4178                 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
4179                 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar
4180             };
4181             define_one_arm_cp_reg(cpu, &rvbar);
4182         }
4183     } else {
4184         /* If EL2 is missing but higher ELs are enabled, we need to
4185          * register the no_el2 reginfos.
4186          */
4187         if (arm_feature(env, ARM_FEATURE_EL3)) {
4188             /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value
4189              * of MIDR_EL1 and MPIDR_EL1.
4190              */
4191             ARMCPRegInfo vpidr_regs[] = {
4192                 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4193                   .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
4194                   .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
4195                   .type = ARM_CP_CONST, .resetvalue = cpu->midr,
4196                   .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
4197                 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4198                   .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
4199                   .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
4200                   .type = ARM_CP_NO_RAW,
4201                   .writefn = arm_cp_write_ignore, .readfn = mpidr_read },
4202                 REGINFO_SENTINEL
4203             };
4204             define_arm_cp_regs(cpu, vpidr_regs);
4205             define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo);
4206         }
4207     }
4208     if (arm_feature(env, ARM_FEATURE_EL3)) {
4209         define_arm_cp_regs(cpu, el3_cp_reginfo);
4210         ARMCPRegInfo rvbar = {
4211             .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
4212             .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
4213             .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar
4214         };
4215         define_one_arm_cp_reg(cpu, &rvbar);
4216     }
4217     if (arm_feature(env, ARM_FEATURE_MPU)) {
4218         if (arm_feature(env, ARM_FEATURE_V6)) {
4219             /* PMSAv6 not implemented */
4220             assert(arm_feature(env, ARM_FEATURE_V7));
4221             define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
4222             define_arm_cp_regs(cpu, pmsav7_cp_reginfo);
4223         } else {
4224             define_arm_cp_regs(cpu, pmsav5_cp_reginfo);
4225         }
4226     } else {
4227         define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
4228         define_arm_cp_regs(cpu, vmsa_cp_reginfo);
4229     }
4230     if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
4231         define_arm_cp_regs(cpu, t2ee_cp_reginfo);
4232     }
4233     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
4234         define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
4235     }
4236     if (arm_feature(env, ARM_FEATURE_VAPA)) {
4237         define_arm_cp_regs(cpu, vapa_cp_reginfo);
4238     }
4239     if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) {
4240         define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo);
4241     }
4242     if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) {
4243         define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo);
4244     }
4245     if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) {
4246         define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo);
4247     }
4248     if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
4249         define_arm_cp_regs(cpu, omap_cp_reginfo);
4250     }
4251     if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
4252         define_arm_cp_regs(cpu, strongarm_cp_reginfo);
4253     }
4254     if (arm_feature(env, ARM_FEATURE_XSCALE)) {
4255         define_arm_cp_regs(cpu, xscale_cp_reginfo);
4256     }
4257     if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
4258         define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
4259     }
4260     if (arm_feature(env, ARM_FEATURE_LPAE)) {
4261         define_arm_cp_regs(cpu, lpae_cp_reginfo);
4262     }
4263     /* Slightly awkwardly, the OMAP and StrongARM cores need all of
4264      * cp15 crn=0 to be writes-ignored, whereas for other cores they should
4265      * be read-only (ie write causes UNDEF exception).
4266      */
4267     {
4268         ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = {
4269             /* Pre-v8 MIDR space.
4270              * Note that the MIDR isn't a simple constant register because
4271              * of the TI925 behaviour where writes to another register can
4272              * cause the MIDR value to change.
4273              *
4274              * Unimplemented registers in the c15 0 0 0 space default to
4275              * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
4276              * and friends override accordingly.
4277              */
4278             { .name = "MIDR",
4279               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
4280               .access = PL1_R, .resetvalue = cpu->midr,
4281               .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
4282               .readfn = midr_read,
4283               .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
4284               .type = ARM_CP_OVERRIDE },
4285             /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
4286             { .name = "DUMMY",
4287               .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY,
4288               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4289             { .name = "DUMMY",
4290               .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY,
4291               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4292             { .name = "DUMMY",
4293               .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY,
4294               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4295             { .name = "DUMMY",
4296               .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY,
4297               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4298             { .name = "DUMMY",
4299               .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
4300               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4301             REGINFO_SENTINEL
4302         };
4303         ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
4304             { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
4305               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0,
4306               .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr,
4307               .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
4308               .readfn = midr_read },
4309             /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */
4310             { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
4311               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
4312               .access = PL1_R, .resetvalue = cpu->midr },
4313             { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
4314               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7,
4315               .access = PL1_R, .resetvalue = cpu->midr },
4316             { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
4317               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
4318               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->revidr },
4319             REGINFO_SENTINEL
4320         };
4321         ARMCPRegInfo id_cp_reginfo[] = {
4322             /* These are common to v8 and pre-v8 */
4323             { .name = "CTR",
4324               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
4325               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
4326             { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64,
4327               .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0,
4328               .access = PL0_R, .accessfn = ctr_el0_access,
4329               .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
4330             /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
4331             { .name = "TCMTR",
4332               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
4333               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4334             REGINFO_SENTINEL
4335         };
4336         /* TLBTR is specific to VMSA */
4337         ARMCPRegInfo id_tlbtr_reginfo = {
4338               .name = "TLBTR",
4339               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
4340               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0,
4341         };
4342         /* MPUIR is specific to PMSA V6+ */
4343         ARMCPRegInfo id_mpuir_reginfo = {
4344               .name = "MPUIR",
4345               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
4346               .access = PL1_R, .type = ARM_CP_CONST,
4347               .resetvalue = cpu->pmsav7_dregion << 8
4348         };
4349         ARMCPRegInfo crn0_wi_reginfo = {
4350             .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
4351             .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
4352             .type = ARM_CP_NOP | ARM_CP_OVERRIDE
4353         };
4354         if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
4355             arm_feature(env, ARM_FEATURE_STRONGARM)) {
4356             ARMCPRegInfo *r;
4357             /* Register the blanket "writes ignored" value first to cover the
4358              * whole space. Then update the specific ID registers to allow write
4359              * access, so that they ignore writes rather than causing them to
4360              * UNDEF.
4361              */
4362             define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
4363             for (r = id_pre_v8_midr_cp_reginfo;
4364                  r->type != ARM_CP_SENTINEL; r++) {
4365                 r->access = PL1_RW;
4366             }
4367             for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
4368                 r->access = PL1_RW;
4369             }
4370             id_tlbtr_reginfo.access = PL1_RW;
4371             id_tlbtr_reginfo.access = PL1_RW;
4372         }
4373         if (arm_feature(env, ARM_FEATURE_V8)) {
4374             define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
4375         } else {
4376             define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
4377         }
4378         define_arm_cp_regs(cpu, id_cp_reginfo);
4379         if (!arm_feature(env, ARM_FEATURE_MPU)) {
4380             define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
4381         } else if (arm_feature(env, ARM_FEATURE_V7)) {
4382             define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
4383         }
4384     }
4385
4386     if (arm_feature(env, ARM_FEATURE_MPIDR)) {
4387         define_arm_cp_regs(cpu, mpidr_cp_reginfo);
4388     }
4389
4390     if (arm_feature(env, ARM_FEATURE_AUXCR)) {
4391         ARMCPRegInfo auxcr_reginfo[] = {
4392             { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH,
4393               .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1,
4394               .access = PL1_RW, .type = ARM_CP_CONST,
4395               .resetvalue = cpu->reset_auxcr },
4396             { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH,
4397               .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1,
4398               .access = PL2_RW, .type = ARM_CP_CONST,
4399               .resetvalue = 0 },
4400             { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64,
4401               .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1,
4402               .access = PL3_RW, .type = ARM_CP_CONST,
4403               .resetvalue = 0 },
4404             REGINFO_SENTINEL
4405         };
4406         define_arm_cp_regs(cpu, auxcr_reginfo);
4407     }
4408
4409     if (arm_feature(env, ARM_FEATURE_CBAR)) {
4410         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
4411             /* 32 bit view is [31:18] 0...0 [43:32]. */
4412             uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
4413                 | extract64(cpu->reset_cbar, 32, 12);
4414             ARMCPRegInfo cbar_reginfo[] = {
4415                 { .name = "CBAR",
4416                   .type = ARM_CP_CONST,
4417                   .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
4418                   .access = PL1_R, .resetvalue = cpu->reset_cbar },
4419                 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
4420                   .type = ARM_CP_CONST,
4421                   .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
4422                   .access = PL1_R, .resetvalue = cbar32 },
4423                 REGINFO_SENTINEL
4424             };
4425             /* We don't implement a r/w 64 bit CBAR currently */
4426             assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
4427             define_arm_cp_regs(cpu, cbar_reginfo);
4428         } else {
4429             ARMCPRegInfo cbar = {
4430                 .name = "CBAR",
4431                 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
4432                 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar,
4433                 .fieldoffset = offsetof(CPUARMState,
4434                                         cp15.c15_config_base_address)
4435             };
4436             if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
4437                 cbar.access = PL1_R;
4438                 cbar.fieldoffset = 0;
4439                 cbar.type = ARM_CP_CONST;
4440             }
4441             define_one_arm_cp_reg(cpu, &cbar);
4442         }
4443     }
4444
4445     /* Generic registers whose values depend on the implementation */
4446     {
4447         ARMCPRegInfo sctlr = {
4448             .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
4449             .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
4450             .access = PL1_RW,
4451             .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s),
4452                                    offsetof(CPUARMState, cp15.sctlr_ns) },
4453             .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
4454             .raw_writefn = raw_write,
4455         };
4456         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
4457             /* Normally we would always end the TB on an SCTLR write, but Linux
4458              * arch/arm/mach-pxa/sleep.S expects two instructions following
4459              * an MMU enable to execute from cache.  Imitate this behaviour.
4460              */
4461             sctlr.type |= ARM_CP_SUPPRESS_TB_END;
4462         }
4463         define_one_arm_cp_reg(cpu, &sctlr);
4464     }
4465 }
4466
4467 ARMCPU *cpu_arm_init(const char *cpu_model)
4468 {
4469     return ARM_CPU(cpu_generic_init(TYPE_ARM_CPU, cpu_model));
4470 }
4471
4472 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
4473 {
4474     CPUState *cs = CPU(cpu);
4475     CPUARMState *env = &cpu->env;
4476
4477     if (arm_feature(env, ARM_FEATURE_AARCH64)) {
4478         gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
4479                                  aarch64_fpu_gdb_set_reg,
4480                                  34, "aarch64-fpu.xml", 0);
4481     } else if (arm_feature(env, ARM_FEATURE_NEON)) {
4482         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
4483                                  51, "arm-neon.xml", 0);
4484     } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
4485         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
4486                                  35, "arm-vfp3.xml", 0);
4487     } else if (arm_feature(env, ARM_FEATURE_VFP)) {
4488         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
4489                                  19, "arm-vfp.xml", 0);
4490     }
4491 }
4492
4493 /* Sort alphabetically by type name, except for "any". */
4494 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b)
4495 {
4496     ObjectClass *class_a = (ObjectClass *)a;
4497     ObjectClass *class_b = (ObjectClass *)b;
4498     const char *name_a, *name_b;
4499
4500     name_a = object_class_get_name(class_a);
4501     name_b = object_class_get_name(class_b);
4502     if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) {
4503         return 1;
4504     } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) {
4505         return -1;
4506     } else {
4507         return strcmp(name_a, name_b);
4508     }
4509 }
4510
4511 static void arm_cpu_list_entry(gpointer data, gpointer user_data)
4512 {
4513     ObjectClass *oc = data;
4514     CPUListState *s = user_data;
4515     const char *typename;
4516     char *name;
4517
4518     typename = object_class_get_name(oc);
4519     name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU));
4520     (*s->cpu_fprintf)(s->file, "  %s\n",
4521                       name);
4522     g_free(name);
4523 }
4524
4525 void arm_cpu_list(FILE *f, fprintf_function cpu_fprintf)
4526 {
4527     CPUListState s = {
4528         .file = f,
4529         .cpu_fprintf = cpu_fprintf,
4530     };
4531     GSList *list;
4532
4533     list = object_class_get_list(TYPE_ARM_CPU, false);
4534     list = g_slist_sort(list, arm_cpu_list_compare);
4535     (*cpu_fprintf)(f, "Available CPUs:\n");
4536     g_slist_foreach(list, arm_cpu_list_entry, &s);
4537     g_slist_free(list);
4538 #ifdef CONFIG_KVM
4539     /* The 'host' CPU type is dynamically registered only if KVM is
4540      * enabled, so we have to special-case it here:
4541      */
4542     (*cpu_fprintf)(f, "  host (only available in KVM mode)\n");
4543 #endif
4544 }
4545
4546 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
4547 {
4548     ObjectClass *oc = data;
4549     CpuDefinitionInfoList **cpu_list = user_data;
4550     CpuDefinitionInfoList *entry;
4551     CpuDefinitionInfo *info;
4552     const char *typename;
4553
4554     typename = object_class_get_name(oc);
4555     info = g_malloc0(sizeof(*info));
4556     info->name = g_strndup(typename,
4557                            strlen(typename) - strlen("-" TYPE_ARM_CPU));
4558
4559     entry = g_malloc0(sizeof(*entry));
4560     entry->value = info;
4561     entry->next = *cpu_list;
4562     *cpu_list = entry;
4563 }
4564
4565 CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp)
4566 {
4567     CpuDefinitionInfoList *cpu_list = NULL;
4568     GSList *list;
4569
4570     list = object_class_get_list(TYPE_ARM_CPU, false);
4571     g_slist_foreach(list, arm_cpu_add_definition, &cpu_list);
4572     g_slist_free(list);
4573
4574     return cpu_list;
4575 }
4576
4577 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
4578                                    void *opaque, int state, int secstate,
4579                                    int crm, int opc1, int opc2)
4580 {
4581     /* Private utility function for define_one_arm_cp_reg_with_opaque():
4582      * add a single reginfo struct to the hash table.
4583      */
4584     uint32_t *key = g_new(uint32_t, 1);
4585     ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
4586     int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
4587     int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
4588
4589     /* Reset the secure state to the specific incoming state.  This is
4590      * necessary as the register may have been defined with both states.
4591      */
4592     r2->secure = secstate;
4593
4594     if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
4595         /* Register is banked (using both entries in array).
4596          * Overwriting fieldoffset as the array is only used to define
4597          * banked registers but later only fieldoffset is used.
4598          */
4599         r2->fieldoffset = r->bank_fieldoffsets[ns];
4600     }
4601
4602     if (state == ARM_CP_STATE_AA32) {
4603         if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
4604             /* If the register is banked then we don't need to migrate or
4605              * reset the 32-bit instance in certain cases:
4606              *
4607              * 1) If the register has both 32-bit and 64-bit instances then we
4608              *    can count on the 64-bit instance taking care of the
4609              *    non-secure bank.
4610              * 2) If ARMv8 is enabled then we can count on a 64-bit version
4611              *    taking care of the secure bank.  This requires that separate
4612              *    32 and 64-bit definitions are provided.
4613              */
4614             if ((r->state == ARM_CP_STATE_BOTH && ns) ||
4615                 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) {
4616                 r2->type |= ARM_CP_ALIAS;
4617             }
4618         } else if ((secstate != r->secure) && !ns) {
4619             /* The register is not banked so we only want to allow migration of
4620              * the non-secure instance.
4621              */
4622             r2->type |= ARM_CP_ALIAS;
4623         }
4624
4625         if (r->state == ARM_CP_STATE_BOTH) {
4626             /* We assume it is a cp15 register if the .cp field is left unset.
4627              */
4628             if (r2->cp == 0) {
4629                 r2->cp = 15;
4630             }
4631
4632 #ifdef HOST_WORDS_BIGENDIAN
4633             if (r2->fieldoffset) {
4634                 r2->fieldoffset += sizeof(uint32_t);
4635             }
4636 #endif
4637         }
4638     }
4639     if (state == ARM_CP_STATE_AA64) {
4640         /* To allow abbreviation of ARMCPRegInfo
4641          * definitions, we treat cp == 0 as equivalent to
4642          * the value for "standard guest-visible sysreg".
4643          * STATE_BOTH definitions are also always "standard
4644          * sysreg" in their AArch64 view (the .cp value may
4645          * be non-zero for the benefit of the AArch32 view).
4646          */
4647         if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
4648             r2->cp = CP_REG_ARM64_SYSREG_CP;
4649         }
4650         *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
4651                                   r2->opc0, opc1, opc2);
4652     } else {
4653         *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
4654     }
4655     if (opaque) {
4656         r2->opaque = opaque;
4657     }
4658     /* reginfo passed to helpers is correct for the actual access,
4659      * and is never ARM_CP_STATE_BOTH:
4660      */
4661     r2->state = state;
4662     /* Make sure reginfo passed to helpers for wildcarded regs
4663      * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
4664      */
4665     r2->crm = crm;
4666     r2->opc1 = opc1;
4667     r2->opc2 = opc2;
4668     /* By convention, for wildcarded registers only the first
4669      * entry is used for migration; the others are marked as
4670      * ALIAS so we don't try to transfer the register
4671      * multiple times. Special registers (ie NOP/WFI) are
4672      * never migratable and not even raw-accessible.
4673      */
4674     if ((r->type & ARM_CP_SPECIAL)) {
4675         r2->type |= ARM_CP_NO_RAW;
4676     }
4677     if (((r->crm == CP_ANY) && crm != 0) ||
4678         ((r->opc1 == CP_ANY) && opc1 != 0) ||
4679         ((r->opc2 == CP_ANY) && opc2 != 0)) {
4680         r2->type |= ARM_CP_ALIAS;
4681     }
4682
4683     /* Check that raw accesses are either forbidden or handled. Note that
4684      * we can't assert this earlier because the setup of fieldoffset for
4685      * banked registers has to be done first.
4686      */
4687     if (!(r2->type & ARM_CP_NO_RAW)) {
4688         assert(!raw_accessors_invalid(r2));
4689     }
4690
4691     /* Overriding of an existing definition must be explicitly
4692      * requested.
4693      */
4694     if (!(r->type & ARM_CP_OVERRIDE)) {
4695         ARMCPRegInfo *oldreg;
4696         oldreg = g_hash_table_lookup(cpu->cp_regs, key);
4697         if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
4698             fprintf(stderr, "Register redefined: cp=%d %d bit "
4699                     "crn=%d crm=%d opc1=%d opc2=%d, "
4700                     "was %s, now %s\n", r2->cp, 32 + 32 * is64,
4701                     r2->crn, r2->crm, r2->opc1, r2->opc2,
4702                     oldreg->name, r2->name);
4703             g_assert_not_reached();
4704         }
4705     }
4706     g_hash_table_insert(cpu->cp_regs, key, r2);
4707 }
4708
4709
4710 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
4711                                        const ARMCPRegInfo *r, void *opaque)
4712 {
4713     /* Define implementations of coprocessor registers.
4714      * We store these in a hashtable because typically
4715      * there are less than 150 registers in a space which
4716      * is 16*16*16*8*8 = 262144 in size.
4717      * Wildcarding is supported for the crm, opc1 and opc2 fields.
4718      * If a register is defined twice then the second definition is
4719      * used, so this can be used to define some generic registers and
4720      * then override them with implementation specific variations.
4721      * At least one of the original and the second definition should
4722      * include ARM_CP_OVERRIDE in its type bits -- this is just a guard
4723      * against accidental use.
4724      *
4725      * The state field defines whether the register is to be
4726      * visible in the AArch32 or AArch64 execution state. If the
4727      * state is set to ARM_CP_STATE_BOTH then we synthesise a
4728      * reginfo structure for the AArch32 view, which sees the lower
4729      * 32 bits of the 64 bit register.
4730      *
4731      * Only registers visible in AArch64 may set r->opc0; opc0 cannot
4732      * be wildcarded. AArch64 registers are always considered to be 64
4733      * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
4734      * the register, if any.
4735      */
4736     int crm, opc1, opc2, state;
4737     int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
4738     int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
4739     int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
4740     int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
4741     int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
4742     int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
4743     /* 64 bit registers have only CRm and Opc1 fields */
4744     assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
4745     /* op0 only exists in the AArch64 encodings */
4746     assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0));
4747     /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
4748     assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT));
4749     /* The AArch64 pseudocode CheckSystemAccess() specifies that op1
4750      * encodes a minimum access level for the register. We roll this
4751      * runtime check into our general permission check code, so check
4752      * here that the reginfo's specified permissions are strict enough
4753      * to encompass the generic architectural permission check.
4754      */
4755     if (r->state != ARM_CP_STATE_AA32) {
4756         int mask = 0;
4757         switch (r->opc1) {
4758         case 0: case 1: case 2:
4759             /* min_EL EL1 */
4760             mask = PL1_RW;
4761             break;
4762         case 3:
4763             /* min_EL EL0 */
4764             mask = PL0_RW;
4765             break;
4766         case 4:
4767             /* min_EL EL2 */
4768             mask = PL2_RW;
4769             break;
4770         case 5:
4771             /* unallocated encoding, so not possible */
4772             assert(false);
4773             break;
4774         case 6:
4775             /* min_EL EL3 */
4776             mask = PL3_RW;
4777             break;
4778         case 7:
4779             /* min_EL EL1, secure mode only (we don't check the latter) */
4780             mask = PL1_RW;
4781             break;
4782         default:
4783             /* broken reginfo with out-of-range opc1 */
4784             assert(false);
4785             break;
4786         }
4787         /* assert our permissions are not too lax (stricter is fine) */
4788         assert((r->access & ~mask) == 0);
4789     }
4790
4791     /* Check that the register definition has enough info to handle
4792      * reads and writes if they are permitted.
4793      */
4794     if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) {
4795         if (r->access & PL3_R) {
4796             assert((r->fieldoffset ||
4797                    (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
4798                    r->readfn);
4799         }
4800         if (r->access & PL3_W) {
4801             assert((r->fieldoffset ||
4802                    (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
4803                    r->writefn);
4804         }
4805     }
4806     /* Bad type field probably means missing sentinel at end of reg list */
4807     assert(cptype_valid(r->type));
4808     for (crm = crmmin; crm <= crmmax; crm++) {
4809         for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
4810             for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
4811                 for (state = ARM_CP_STATE_AA32;
4812                      state <= ARM_CP_STATE_AA64; state++) {
4813                     if (r->state != state && r->state != ARM_CP_STATE_BOTH) {
4814                         continue;
4815                     }
4816                     if (state == ARM_CP_STATE_AA32) {
4817                         /* Under AArch32 CP registers can be common
4818                          * (same for secure and non-secure world) or banked.
4819                          */
4820                         switch (r->secure) {
4821                         case ARM_CP_SECSTATE_S:
4822                         case ARM_CP_SECSTATE_NS:
4823                             add_cpreg_to_hashtable(cpu, r, opaque, state,
4824                                                    r->secure, crm, opc1, opc2);
4825                             break;
4826                         default:
4827                             add_cpreg_to_hashtable(cpu, r, opaque, state,
4828                                                    ARM_CP_SECSTATE_S,
4829                                                    crm, opc1, opc2);
4830                             add_cpreg_to_hashtable(cpu, r, opaque, state,
4831                                                    ARM_CP_SECSTATE_NS,
4832                                                    crm, opc1, opc2);
4833                             break;
4834                         }
4835                     } else {
4836                         /* AArch64 registers get mapped to non-secure instance
4837                          * of AArch32 */
4838                         add_cpreg_to_hashtable(cpu, r, opaque, state,
4839                                                ARM_CP_SECSTATE_NS,
4840                                                crm, opc1, opc2);
4841                     }
4842                 }
4843             }
4844         }
4845     }
4846 }
4847
4848 void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
4849                                     const ARMCPRegInfo *regs, void *opaque)
4850 {
4851     /* Define a whole list of registers */
4852     const ARMCPRegInfo *r;
4853     for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
4854         define_one_arm_cp_reg_with_opaque(cpu, r, opaque);
4855     }
4856 }
4857
4858 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
4859 {
4860     return g_hash_table_lookup(cpregs, &encoded_cp);
4861 }
4862
4863 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
4864                          uint64_t value)
4865 {
4866     /* Helper coprocessor write function for write-ignore registers */
4867 }
4868
4869 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri)
4870 {
4871     /* Helper coprocessor write function for read-as-zero registers */
4872     return 0;
4873 }
4874
4875 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque)
4876 {
4877     /* Helper coprocessor reset function for do-nothing-on-reset registers */
4878 }
4879
4880 static int bad_mode_switch(CPUARMState *env, int mode)
4881 {
4882     /* Return true if it is not valid for us to switch to
4883      * this CPU mode (ie all the UNPREDICTABLE cases in
4884      * the ARM ARM CPSRWriteByInstr pseudocode).
4885      */
4886     switch (mode) {
4887     case ARM_CPU_MODE_USR:
4888     case ARM_CPU_MODE_SYS:
4889     case ARM_CPU_MODE_SVC:
4890     case ARM_CPU_MODE_ABT:
4891     case ARM_CPU_MODE_UND:
4892     case ARM_CPU_MODE_IRQ:
4893     case ARM_CPU_MODE_FIQ:
4894         return 0;
4895     case ARM_CPU_MODE_MON:
4896         return !arm_is_secure(env);
4897     default:
4898         return 1;
4899     }
4900 }
4901
4902 uint32_t cpsr_read(CPUARMState *env)
4903 {
4904     int ZF;
4905     ZF = (env->ZF == 0);
4906     return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
4907         (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
4908         | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
4909         | ((env->condexec_bits & 0xfc) << 8)
4910         | (env->GE << 16) | (env->daif & CPSR_AIF);
4911 }
4912
4913 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
4914 {
4915     uint32_t changed_daif;
4916
4917     if (mask & CPSR_NZCV) {
4918         env->ZF = (~val) & CPSR_Z;
4919         env->NF = val;
4920         env->CF = (val >> 29) & 1;
4921         env->VF = (val << 3) & 0x80000000;
4922     }
4923     if (mask & CPSR_Q)
4924         env->QF = ((val & CPSR_Q) != 0);
4925     if (mask & CPSR_T)
4926         env->thumb = ((val & CPSR_T) != 0);
4927     if (mask & CPSR_IT_0_1) {
4928         env->condexec_bits &= ~3;
4929         env->condexec_bits |= (val >> 25) & 3;
4930     }
4931     if (mask & CPSR_IT_2_7) {
4932         env->condexec_bits &= 3;
4933         env->condexec_bits |= (val >> 8) & 0xfc;
4934     }
4935     if (mask & CPSR_GE) {
4936         env->GE = (val >> 16) & 0xf;
4937     }
4938
4939     /* In a V7 implementation that includes the security extensions but does
4940      * not include Virtualization Extensions the SCR.FW and SCR.AW bits control
4941      * whether non-secure software is allowed to change the CPSR_F and CPSR_A
4942      * bits respectively.
4943      *
4944      * In a V8 implementation, it is permitted for privileged software to
4945      * change the CPSR A/F bits regardless of the SCR.AW/FW bits.
4946      */
4947     if (!arm_feature(env, ARM_FEATURE_V8) &&
4948         arm_feature(env, ARM_FEATURE_EL3) &&
4949         !arm_feature(env, ARM_FEATURE_EL2) &&
4950         !arm_is_secure(env)) {
4951
4952         changed_daif = (env->daif ^ val) & mask;
4953
4954         if (changed_daif & CPSR_A) {
4955             /* Check to see if we are allowed to change the masking of async
4956              * abort exceptions from a non-secure state.
4957              */
4958             if (!(env->cp15.scr_el3 & SCR_AW)) {
4959                 qemu_log_mask(LOG_GUEST_ERROR,
4960                               "Ignoring attempt to switch CPSR_A flag from "
4961                               "non-secure world with SCR.AW bit clear\n");
4962                 mask &= ~CPSR_A;
4963             }
4964         }
4965
4966         if (changed_daif & CPSR_F) {
4967             /* Check to see if we are allowed to change the masking of FIQ
4968              * exceptions from a non-secure state.
4969              */
4970             if (!(env->cp15.scr_el3 & SCR_FW)) {
4971                 qemu_log_mask(LOG_GUEST_ERROR,
4972                               "Ignoring attempt to switch CPSR_F flag from "
4973                               "non-secure world with SCR.FW bit clear\n");
4974                 mask &= ~CPSR_F;
4975             }
4976
4977             /* Check whether non-maskable FIQ (NMFI) support is enabled.
4978              * If this bit is set software is not allowed to mask
4979              * FIQs, but is allowed to set CPSR_F to 0.
4980              */
4981             if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) &&
4982                 (val & CPSR_F)) {
4983                 qemu_log_mask(LOG_GUEST_ERROR,
4984                               "Ignoring attempt to enable CPSR_F flag "
4985                               "(non-maskable FIQ [NMFI] support enabled)\n");
4986                 mask &= ~CPSR_F;
4987             }
4988         }
4989     }
4990
4991     env->daif &= ~(CPSR_AIF & mask);
4992     env->daif |= val & CPSR_AIF & mask;
4993
4994     if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
4995         if (bad_mode_switch(env, val & CPSR_M)) {
4996             /* Attempt to switch to an invalid mode: this is UNPREDICTABLE.
4997              * We choose to ignore the attempt and leave the CPSR M field
4998              * untouched.
4999              */
5000             mask &= ~CPSR_M;
5001         } else {
5002             switch_mode(env, val & CPSR_M);
5003         }
5004     }
5005     mask &= ~CACHED_CPSR_BITS;
5006     env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
5007 }
5008
5009 /* Sign/zero extend */
5010 uint32_t HELPER(sxtb16)(uint32_t x)
5011 {
5012     uint32_t res;
5013     res = (uint16_t)(int8_t)x;
5014     res |= (uint32_t)(int8_t)(x >> 16) << 16;
5015     return res;
5016 }
5017
5018 uint32_t HELPER(uxtb16)(uint32_t x)
5019 {
5020     uint32_t res;
5021     res = (uint16_t)(uint8_t)x;
5022     res |= (uint32_t)(uint8_t)(x >> 16) << 16;
5023     return res;
5024 }
5025
5026 uint32_t HELPER(clz)(uint32_t x)
5027 {
5028     return clz32(x);
5029 }
5030
5031 int32_t HELPER(sdiv)(int32_t num, int32_t den)
5032 {
5033     if (den == 0)
5034       return 0;
5035     if (num == INT_MIN && den == -1)
5036       return INT_MIN;
5037     return num / den;
5038 }
5039
5040 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
5041 {
5042     if (den == 0)
5043       return 0;
5044     return num / den;
5045 }
5046
5047 uint32_t HELPER(rbit)(uint32_t x)
5048 {
5049     return revbit32(x);
5050 }
5051
5052 #if defined(CONFIG_USER_ONLY)
5053
5054 /* These should probably raise undefined insn exceptions.  */
5055 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
5056 {
5057     ARMCPU *cpu = arm_env_get_cpu(env);
5058
5059     cpu_abort(CPU(cpu), "v7m_msr %d\n", reg);
5060 }
5061
5062 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
5063 {
5064     ARMCPU *cpu = arm_env_get_cpu(env);
5065
5066     cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg);
5067     return 0;
5068 }
5069
5070 void switch_mode(CPUARMState *env, int mode)
5071 {
5072     ARMCPU *cpu = arm_env_get_cpu(env);
5073
5074     if (mode != ARM_CPU_MODE_USR) {
5075         cpu_abort(CPU(cpu), "Tried to switch out of user mode\n");
5076     }
5077 }
5078
5079 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
5080 {
5081     ARMCPU *cpu = arm_env_get_cpu(env);
5082
5083     cpu_abort(CPU(cpu), "banked r13 write\n");
5084 }
5085
5086 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
5087 {
5088     ARMCPU *cpu = arm_env_get_cpu(env);
5089
5090     cpu_abort(CPU(cpu), "banked r13 read\n");
5091     return 0;
5092 }
5093
5094 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
5095                                  uint32_t cur_el, bool secure)
5096 {
5097     return 1;
5098 }
5099
5100 void aarch64_sync_64_to_32(CPUARMState *env)
5101 {
5102     g_assert_not_reached();
5103 }
5104
5105 #else
5106
5107 /* Map CPU modes onto saved register banks.  */
5108 int bank_number(int mode)
5109 {
5110     switch (mode) {
5111     case ARM_CPU_MODE_USR:
5112     case ARM_CPU_MODE_SYS:
5113         return 0;
5114     case ARM_CPU_MODE_SVC:
5115         return 1;
5116     case ARM_CPU_MODE_ABT:
5117         return 2;
5118     case ARM_CPU_MODE_UND:
5119         return 3;
5120     case ARM_CPU_MODE_IRQ:
5121         return 4;
5122     case ARM_CPU_MODE_FIQ:
5123         return 5;
5124     case ARM_CPU_MODE_HYP:
5125         return 6;
5126     case ARM_CPU_MODE_MON:
5127         return 7;
5128     }
5129     g_assert_not_reached();
5130 }
5131
5132 void switch_mode(CPUARMState *env, int mode)
5133 {
5134     int old_mode;
5135     int i;
5136
5137     old_mode = env->uncached_cpsr & CPSR_M;
5138     if (mode == old_mode)
5139         return;
5140
5141     if (old_mode == ARM_CPU_MODE_FIQ) {
5142         memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
5143         memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
5144     } else if (mode == ARM_CPU_MODE_FIQ) {
5145         memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
5146         memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
5147     }
5148
5149     i = bank_number(old_mode);
5150     env->banked_r13[i] = env->regs[13];
5151     env->banked_r14[i] = env->regs[14];
5152     env->banked_spsr[i] = env->spsr;
5153
5154     i = bank_number(mode);
5155     env->regs[13] = env->banked_r13[i];
5156     env->regs[14] = env->banked_r14[i];
5157     env->spsr = env->banked_spsr[i];
5158 }
5159
5160 /* Physical Interrupt Target EL Lookup Table
5161  *
5162  * [ From ARM ARM section G1.13.4 (Table G1-15) ]
5163  *
5164  * The below multi-dimensional table is used for looking up the target
5165  * exception level given numerous condition criteria.  Specifically, the
5166  * target EL is based on SCR and HCR routing controls as well as the
5167  * currently executing EL and secure state.
5168  *
5169  *    Dimensions:
5170  *    target_el_table[2][2][2][2][2][4]
5171  *                    |  |  |  |  |  +--- Current EL
5172  *                    |  |  |  |  +------ Non-secure(0)/Secure(1)
5173  *                    |  |  |  +--------- HCR mask override
5174  *                    |  |  +------------ SCR exec state control
5175  *                    |  +--------------- SCR mask override
5176  *                    +------------------ 32-bit(0)/64-bit(1) EL3
5177  *
5178  *    The table values are as such:
5179  *    0-3 = EL0-EL3
5180  *     -1 = Cannot occur
5181  *
5182  * The ARM ARM target EL table includes entries indicating that an "exception
5183  * is not taken".  The two cases where this is applicable are:
5184  *    1) An exception is taken from EL3 but the SCR does not have the exception
5185  *    routed to EL3.
5186  *    2) An exception is taken from EL2 but the HCR does not have the exception
5187  *    routed to EL2.
5188  * In these two cases, the below table contain a target of EL1.  This value is
5189  * returned as it is expected that the consumer of the table data will check
5190  * for "target EL >= current EL" to ensure the exception is not taken.
5191  *
5192  *            SCR     HCR
5193  *         64  EA     AMO                 From
5194  *        BIT IRQ     IMO      Non-secure         Secure
5195  *        EL3 FIQ  RW FMO   EL0 EL1 EL2 EL3   EL0 EL1 EL2 EL3
5196  */
5197 const int8_t target_el_table[2][2][2][2][2][4] = {
5198     {{{{/* 0   0   0   0 */{ 1,  1,  2, -1 },{ 3, -1, -1,  3 },},
5199        {/* 0   0   0   1 */{ 2,  2,  2, -1 },{ 3, -1, -1,  3 },},},
5200       {{/* 0   0   1   0 */{ 1,  1,  2, -1 },{ 3, -1, -1,  3 },},
5201        {/* 0   0   1   1 */{ 2,  2,  2, -1 },{ 3, -1, -1,  3 },},},},
5202      {{{/* 0   1   0   0 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},
5203        {/* 0   1   0   1 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},},
5204       {{/* 0   1   1   0 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},
5205        {/* 0   1   1   1 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},},},},
5206     {{{{/* 1   0   0   0 */{ 1,  1,  2, -1 },{ 1,  1, -1,  1 },},
5207        {/* 1   0   0   1 */{ 2,  2,  2, -1 },{ 1,  1, -1,  1 },},},
5208       {{/* 1   0   1   0 */{ 1,  1,  1, -1 },{ 1,  1, -1,  1 },},
5209        {/* 1   0   1   1 */{ 2,  2,  2, -1 },{ 1,  1, -1,  1 },},},},
5210      {{{/* 1   1   0   0 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},
5211        {/* 1   1   0   1 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},},
5212       {{/* 1   1   1   0 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},
5213        {/* 1   1   1   1 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},},},},
5214 };
5215
5216 /*
5217  * Determine the target EL for physical exceptions
5218  */
5219 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
5220                                  uint32_t cur_el, bool secure)
5221 {
5222     CPUARMState *env = cs->env_ptr;
5223     int rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
5224     int scr;
5225     int hcr;
5226     int target_el;
5227     int is64 = arm_el_is_aa64(env, 3);
5228
5229     switch (excp_idx) {
5230     case EXCP_IRQ:
5231         scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ);
5232         hcr = ((env->cp15.hcr_el2 & HCR_IMO) == HCR_IMO);
5233         break;
5234     case EXCP_FIQ:
5235         scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ);
5236         hcr = ((env->cp15.hcr_el2 & HCR_FMO) == HCR_FMO);
5237         break;
5238     default:
5239         scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA);
5240         hcr = ((env->cp15.hcr_el2 & HCR_AMO) == HCR_AMO);
5241         break;
5242     };
5243
5244     /* If HCR.TGE is set then HCR is treated as being 1 */
5245     hcr |= ((env->cp15.hcr_el2 & HCR_TGE) == HCR_TGE);
5246
5247     /* Perform a table-lookup for the target EL given the current state */
5248     target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el];
5249
5250     assert(target_el > 0);
5251
5252     return target_el;
5253 }
5254
5255 static void v7m_push(CPUARMState *env, uint32_t val)
5256 {
5257     CPUState *cs = CPU(arm_env_get_cpu(env));
5258
5259     env->regs[13] -= 4;
5260     stl_phys(cs->as, env->regs[13], val);
5261 }
5262
5263 static uint32_t v7m_pop(CPUARMState *env)
5264 {
5265     CPUState *cs = CPU(arm_env_get_cpu(env));
5266     uint32_t val;
5267
5268     val = ldl_phys(cs->as, env->regs[13]);
5269     env->regs[13] += 4;
5270     return val;
5271 }
5272
5273 /* Switch to V7M main or process stack pointer.  */
5274 static void switch_v7m_sp(CPUARMState *env, int process)
5275 {
5276     uint32_t tmp;
5277     if (env->v7m.current_sp != process) {
5278         tmp = env->v7m.other_sp;
5279         env->v7m.other_sp = env->regs[13];
5280         env->regs[13] = tmp;
5281         env->v7m.current_sp = process;
5282     }
5283 }
5284
5285 static void do_v7m_exception_exit(CPUARMState *env)
5286 {
5287     uint32_t type;
5288     uint32_t xpsr;
5289
5290     type = env->regs[15];
5291     if (env->v7m.exception != 0)
5292         armv7m_nvic_complete_irq(env->nvic, env->v7m.exception);
5293
5294     /* Switch to the target stack.  */
5295     switch_v7m_sp(env, (type & 4) != 0);
5296     /* Pop registers.  */
5297     env->regs[0] = v7m_pop(env);
5298     env->regs[1] = v7m_pop(env);
5299     env->regs[2] = v7m_pop(env);
5300     env->regs[3] = v7m_pop(env);
5301     env->regs[12] = v7m_pop(env);
5302     env->regs[14] = v7m_pop(env);
5303     env->regs[15] = v7m_pop(env);
5304     if (env->regs[15] & 1) {
5305         qemu_log_mask(LOG_GUEST_ERROR,
5306                       "M profile return from interrupt with misaligned "
5307                       "PC is UNPREDICTABLE\n");
5308         /* Actual hardware seems to ignore the lsbit, and there are several
5309          * RTOSes out there which incorrectly assume the r15 in the stack
5310          * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
5311          */
5312         env->regs[15] &= ~1U;
5313     }
5314     xpsr = v7m_pop(env);
5315     xpsr_write(env, xpsr, 0xfffffdff);
5316     /* Undo stack alignment.  */
5317     if (xpsr & 0x200)
5318         env->regs[13] |= 4;
5319     /* ??? The exception return type specifies Thread/Handler mode.  However
5320        this is also implied by the xPSR value. Not sure what to do
5321        if there is a mismatch.  */
5322     /* ??? Likewise for mismatches between the CONTROL register and the stack
5323        pointer.  */
5324 }
5325
5326 void arm_v7m_cpu_do_interrupt(CPUState *cs)
5327 {
5328     ARMCPU *cpu = ARM_CPU(cs);
5329     CPUARMState *env = &cpu->env;
5330     uint32_t xpsr = xpsr_read(env);
5331     uint32_t lr;
5332     uint32_t addr;
5333
5334     arm_log_exception(cs->exception_index);
5335
5336     lr = 0xfffffff1;
5337     if (env->v7m.current_sp)
5338         lr |= 4;
5339     if (env->v7m.exception == 0)
5340         lr |= 8;
5341
5342     /* For exceptions we just mark as pending on the NVIC, and let that
5343        handle it.  */
5344     /* TODO: Need to escalate if the current priority is higher than the
5345        one we're raising.  */
5346     switch (cs->exception_index) {
5347     case EXCP_UDEF:
5348         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
5349         return;
5350     case EXCP_SWI:
5351         /* The PC already points to the next instruction.  */
5352         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC);
5353         return;
5354     case EXCP_PREFETCH_ABORT:
5355     case EXCP_DATA_ABORT:
5356         /* TODO: if we implemented the MPU registers, this is where we
5357          * should set the MMFAR, etc from exception.fsr and exception.vaddress.
5358          */
5359         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
5360         return;
5361     case EXCP_BKPT:
5362         if (semihosting_enabled()) {
5363             int nr;
5364             nr = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
5365             if (nr == 0xab) {
5366                 env->regs[15] += 2;
5367                 qemu_log_mask(CPU_LOG_INT,
5368                               "...handling as semihosting call 0x%x\n",
5369                               env->regs[0]);
5370                 env->regs[0] = do_arm_semihosting(env);
5371                 return;
5372             }
5373         }
5374         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG);
5375         return;
5376     case EXCP_IRQ:
5377         env->v7m.exception = armv7m_nvic_acknowledge_irq(env->nvic);
5378         break;
5379     case EXCP_EXCEPTION_EXIT:
5380         do_v7m_exception_exit(env);
5381         return;
5382     default:
5383         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
5384         return; /* Never happens.  Keep compiler happy.  */
5385     }
5386
5387     /* Align stack pointer.  */
5388     /* ??? Should only do this if Configuration Control Register
5389        STACKALIGN bit is set.  */
5390     if (env->regs[13] & 4) {
5391         env->regs[13] -= 4;
5392         xpsr |= 0x200;
5393     }
5394     /* Switch to the handler mode.  */
5395     v7m_push(env, xpsr);
5396     v7m_push(env, env->regs[15]);
5397     v7m_push(env, env->regs[14]);
5398     v7m_push(env, env->regs[12]);
5399     v7m_push(env, env->regs[3]);
5400     v7m_push(env, env->regs[2]);
5401     v7m_push(env, env->regs[1]);
5402     v7m_push(env, env->regs[0]);
5403     switch_v7m_sp(env, 0);
5404     /* Clear IT bits */
5405     env->condexec_bits = 0;
5406     env->regs[14] = lr;
5407     addr = ldl_phys(cs->as, env->v7m.vecbase + env->v7m.exception * 4);
5408     env->regs[15] = addr & 0xfffffffe;
5409     env->thumb = addr & 1;
5410 }
5411
5412 /* Function used to synchronize QEMU's AArch64 register set with AArch32
5413  * register set.  This is necessary when switching between AArch32 and AArch64
5414  * execution state.
5415  */
5416 void aarch64_sync_32_to_64(CPUARMState *env)
5417 {
5418     int i;
5419     uint32_t mode = env->uncached_cpsr & CPSR_M;
5420
5421     /* We can blanket copy R[0:7] to X[0:7] */
5422     for (i = 0; i < 8; i++) {
5423         env->xregs[i] = env->regs[i];
5424     }
5425
5426     /* Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12.
5427      * Otherwise, they come from the banked user regs.
5428      */
5429     if (mode == ARM_CPU_MODE_FIQ) {
5430         for (i = 8; i < 13; i++) {
5431             env->xregs[i] = env->usr_regs[i - 8];
5432         }
5433     } else {
5434         for (i = 8; i < 13; i++) {
5435             env->xregs[i] = env->regs[i];
5436         }
5437     }
5438
5439     /* Registers x13-x23 are the various mode SP and FP registers. Registers
5440      * r13 and r14 are only copied if we are in that mode, otherwise we copy
5441      * from the mode banked register.
5442      */
5443     if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
5444         env->xregs[13] = env->regs[13];
5445         env->xregs[14] = env->regs[14];
5446     } else {
5447         env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)];
5448         /* HYP is an exception in that it is copied from r14 */
5449         if (mode == ARM_CPU_MODE_HYP) {
5450             env->xregs[14] = env->regs[14];
5451         } else {
5452             env->xregs[14] = env->banked_r14[bank_number(ARM_CPU_MODE_USR)];
5453         }
5454     }
5455
5456     if (mode == ARM_CPU_MODE_HYP) {
5457         env->xregs[15] = env->regs[13];
5458     } else {
5459         env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)];
5460     }
5461
5462     if (mode == ARM_CPU_MODE_IRQ) {
5463         env->xregs[16] = env->regs[14];
5464         env->xregs[17] = env->regs[13];
5465     } else {
5466         env->xregs[16] = env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)];
5467         env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)];
5468     }
5469
5470     if (mode == ARM_CPU_MODE_SVC) {
5471         env->xregs[18] = env->regs[14];
5472         env->xregs[19] = env->regs[13];
5473     } else {
5474         env->xregs[18] = env->banked_r14[bank_number(ARM_CPU_MODE_SVC)];
5475         env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)];
5476     }
5477
5478     if (mode == ARM_CPU_MODE_ABT) {
5479         env->xregs[20] = env->regs[14];
5480         env->xregs[21] = env->regs[13];
5481     } else {
5482         env->xregs[20] = env->banked_r14[bank_number(ARM_CPU_MODE_ABT)];
5483         env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)];
5484     }
5485
5486     if (mode == ARM_CPU_MODE_UND) {
5487         env->xregs[22] = env->regs[14];
5488         env->xregs[23] = env->regs[13];
5489     } else {
5490         env->xregs[22] = env->banked_r14[bank_number(ARM_CPU_MODE_UND)];
5491         env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)];
5492     }
5493
5494     /* Registers x24-x30 are mapped to r8-r14 in FIQ mode.  If we are in FIQ
5495      * mode, then we can copy from r8-r14.  Otherwise, we copy from the
5496      * FIQ bank for r8-r14.
5497      */
5498     if (mode == ARM_CPU_MODE_FIQ) {
5499         for (i = 24; i < 31; i++) {
5500             env->xregs[i] = env->regs[i - 16];   /* X[24:30] <- R[8:14] */
5501         }
5502     } else {
5503         for (i = 24; i < 29; i++) {
5504             env->xregs[i] = env->fiq_regs[i - 24];
5505         }
5506         env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)];
5507         env->xregs[30] = env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)];
5508     }
5509
5510     env->pc = env->regs[15];
5511 }
5512
5513 /* Function used to synchronize QEMU's AArch32 register set with AArch64
5514  * register set.  This is necessary when switching between AArch32 and AArch64
5515  * execution state.
5516  */
5517 void aarch64_sync_64_to_32(CPUARMState *env)
5518 {
5519     int i;
5520     uint32_t mode = env->uncached_cpsr & CPSR_M;
5521
5522     /* We can blanket copy X[0:7] to R[0:7] */
5523     for (i = 0; i < 8; i++) {
5524         env->regs[i] = env->xregs[i];
5525     }
5526
5527     /* Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12.
5528      * Otherwise, we copy x8-x12 into the banked user regs.
5529      */
5530     if (mode == ARM_CPU_MODE_FIQ) {
5531         for (i = 8; i < 13; i++) {
5532             env->usr_regs[i - 8] = env->xregs[i];
5533         }
5534     } else {
5535         for (i = 8; i < 13; i++) {
5536             env->regs[i] = env->xregs[i];
5537         }
5538     }
5539
5540     /* Registers r13 & r14 depend on the current mode.
5541      * If we are in a given mode, we copy the corresponding x registers to r13
5542      * and r14.  Otherwise, we copy the x register to the banked r13 and r14
5543      * for the mode.
5544      */
5545     if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
5546         env->regs[13] = env->xregs[13];
5547         env->regs[14] = env->xregs[14];
5548     } else {
5549         env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13];
5550
5551         /* HYP is an exception in that it does not have its own banked r14 but
5552          * shares the USR r14
5553          */
5554         if (mode == ARM_CPU_MODE_HYP) {
5555             env->regs[14] = env->xregs[14];
5556         } else {
5557             env->banked_r14[bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
5558         }
5559     }
5560
5561     if (mode == ARM_CPU_MODE_HYP) {
5562         env->regs[13] = env->xregs[15];
5563     } else {
5564         env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15];
5565     }
5566
5567     if (mode == ARM_CPU_MODE_IRQ) {
5568         env->regs[14] = env->xregs[16];
5569         env->regs[13] = env->xregs[17];
5570     } else {
5571         env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
5572         env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17];
5573     }
5574
5575     if (mode == ARM_CPU_MODE_SVC) {
5576         env->regs[14] = env->xregs[18];
5577         env->regs[13] = env->xregs[19];
5578     } else {
5579         env->banked_r14[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
5580         env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19];
5581     }
5582
5583     if (mode == ARM_CPU_MODE_ABT) {
5584         env->regs[14] = env->xregs[20];
5585         env->regs[13] = env->xregs[21];
5586     } else {
5587         env->banked_r14[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
5588         env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21];
5589     }
5590
5591     if (mode == ARM_CPU_MODE_UND) {
5592         env->regs[14] = env->xregs[22];
5593         env->regs[13] = env->xregs[23];
5594     } else {
5595         env->banked_r14[bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
5596         env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23];
5597     }
5598
5599     /* Registers x24-x30 are mapped to r8-r14 in FIQ mode.  If we are in FIQ
5600      * mode, then we can copy to r8-r14.  Otherwise, we copy to the
5601      * FIQ bank for r8-r14.
5602      */
5603     if (mode == ARM_CPU_MODE_FIQ) {
5604         for (i = 24; i < 31; i++) {
5605             env->regs[i - 16] = env->xregs[i];   /* X[24:30] -> R[8:14] */
5606         }
5607     } else {
5608         for (i = 24; i < 29; i++) {
5609             env->fiq_regs[i - 24] = env->xregs[i];
5610         }
5611         env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29];
5612         env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
5613     }
5614
5615     env->regs[15] = env->pc;
5616 }
5617
5618 /* Handle a CPU exception.  */
5619 void arm_cpu_do_interrupt(CPUState *cs)
5620 {
5621     ARMCPU *cpu = ARM_CPU(cs);
5622     CPUARMState *env = &cpu->env;
5623     uint32_t addr;
5624     uint32_t mask;
5625     int new_mode;
5626     uint32_t offset;
5627     uint32_t moe;
5628
5629     assert(!IS_M(env));
5630
5631     arm_log_exception(cs->exception_index);
5632
5633     if (arm_is_psci_call(cpu, cs->exception_index)) {
5634         arm_handle_psci_call(cpu);
5635         qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
5636         return;
5637     }
5638
5639     /* If this is a debug exception we must update the DBGDSCR.MOE bits */
5640     switch (env->exception.syndrome >> ARM_EL_EC_SHIFT) {
5641     case EC_BREAKPOINT:
5642     case EC_BREAKPOINT_SAME_EL:
5643         moe = 1;
5644         break;
5645     case EC_WATCHPOINT:
5646     case EC_WATCHPOINT_SAME_EL:
5647         moe = 10;
5648         break;
5649     case EC_AA32_BKPT:
5650         moe = 3;
5651         break;
5652     case EC_VECTORCATCH:
5653         moe = 5;
5654         break;
5655     default:
5656         moe = 0;
5657         break;
5658     }
5659
5660     if (moe) {
5661         env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe);
5662     }
5663
5664     /* TODO: Vectored interrupt controller.  */
5665     switch (cs->exception_index) {
5666     case EXCP_UDEF:
5667         new_mode = ARM_CPU_MODE_UND;
5668         addr = 0x04;
5669         mask = CPSR_I;
5670         if (env->thumb)
5671             offset = 2;
5672         else
5673             offset = 4;
5674         break;
5675     case EXCP_SWI:
5676         if (semihosting_enabled()) {
5677             /* Check for semihosting interrupt.  */
5678             if (env->thumb) {
5679                 mask = arm_lduw_code(env, env->regs[15] - 2, env->bswap_code)
5680                     & 0xff;
5681             } else {
5682                 mask = arm_ldl_code(env, env->regs[15] - 4, env->bswap_code)
5683                     & 0xffffff;
5684             }
5685             /* Only intercept calls from privileged modes, to provide some
5686                semblance of security.  */
5687             if (((mask == 0x123456 && !env->thumb)
5688                     || (mask == 0xab && env->thumb))
5689                   && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
5690                 qemu_log_mask(CPU_LOG_INT,
5691                               "...handling as semihosting call 0x%x\n",
5692                               env->regs[0]);
5693                 env->regs[0] = do_arm_semihosting(env);
5694                 return;
5695             }
5696         }
5697         new_mode = ARM_CPU_MODE_SVC;
5698         addr = 0x08;
5699         mask = CPSR_I;
5700         /* The PC already points to the next instruction.  */
5701         offset = 0;
5702         break;
5703     case EXCP_BKPT:
5704         /* See if this is a semihosting syscall.  */
5705         if (env->thumb && semihosting_enabled()) {
5706             mask = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
5707             if (mask == 0xab
5708                   && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
5709                 env->regs[15] += 2;
5710                 qemu_log_mask(CPU_LOG_INT,
5711                               "...handling as semihosting call 0x%x\n",
5712                               env->regs[0]);
5713                 env->regs[0] = do_arm_semihosting(env);
5714                 return;
5715             }
5716         }
5717         env->exception.fsr = 2;
5718         /* Fall through to prefetch abort.  */
5719     case EXCP_PREFETCH_ABORT:
5720         A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr);
5721         A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress);
5722         qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n",
5723                       env->exception.fsr, (uint32_t)env->exception.vaddress);
5724         new_mode = ARM_CPU_MODE_ABT;
5725         addr = 0x0c;
5726         mask = CPSR_A | CPSR_I;
5727         offset = 4;
5728         break;
5729     case EXCP_DATA_ABORT:
5730         A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr);
5731         A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress);
5732         qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n",
5733                       env->exception.fsr,
5734                       (uint32_t)env->exception.vaddress);
5735         new_mode = ARM_CPU_MODE_ABT;
5736         addr = 0x10;
5737         mask = CPSR_A | CPSR_I;
5738         offset = 8;
5739         break;
5740     case EXCP_IRQ:
5741         new_mode = ARM_CPU_MODE_IRQ;
5742         addr = 0x18;
5743         /* Disable IRQ and imprecise data aborts.  */
5744         mask = CPSR_A | CPSR_I;
5745         offset = 4;
5746         if (env->cp15.scr_el3 & SCR_IRQ) {
5747             /* IRQ routed to monitor mode */
5748             new_mode = ARM_CPU_MODE_MON;
5749             mask |= CPSR_F;
5750         }
5751         break;
5752     case EXCP_FIQ:
5753         new_mode = ARM_CPU_MODE_FIQ;
5754         addr = 0x1c;
5755         /* Disable FIQ, IRQ and imprecise data aborts.  */
5756         mask = CPSR_A | CPSR_I | CPSR_F;
5757         if (env->cp15.scr_el3 & SCR_FIQ) {
5758             /* FIQ routed to monitor mode */
5759             new_mode = ARM_CPU_MODE_MON;
5760         }
5761         offset = 4;
5762         break;
5763     case EXCP_SMC:
5764         new_mode = ARM_CPU_MODE_MON;
5765         addr = 0x08;
5766         mask = CPSR_A | CPSR_I | CPSR_F;
5767         offset = 0;
5768         break;
5769     default:
5770         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
5771         return; /* Never happens.  Keep compiler happy.  */
5772     }
5773
5774     if (new_mode == ARM_CPU_MODE_MON) {
5775         addr += env->cp15.mvbar;
5776     } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
5777         /* High vectors. When enabled, base address cannot be remapped. */
5778         addr += 0xffff0000;
5779     } else {
5780         /* ARM v7 architectures provide a vector base address register to remap
5781          * the interrupt vector table.
5782          * This register is only followed in non-monitor mode, and is banked.
5783          * Note: only bits 31:5 are valid.
5784          */
5785         addr += A32_BANKED_CURRENT_REG_GET(env, vbar);
5786     }
5787
5788     if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
5789         env->cp15.scr_el3 &= ~SCR_NS;
5790     }
5791
5792     switch_mode (env, new_mode);
5793     /* For exceptions taken to AArch32 we must clear the SS bit in both
5794      * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.
5795      */
5796     env->uncached_cpsr &= ~PSTATE_SS;
5797     env->spsr = cpsr_read(env);
5798     /* Clear IT bits.  */
5799     env->condexec_bits = 0;
5800     /* Switch to the new mode, and to the correct instruction set.  */
5801     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
5802     env->daif |= mask;
5803     /* this is a lie, as the was no c1_sys on V4T/V5, but who cares
5804      * and we should just guard the thumb mode on V4 */
5805     if (arm_feature(env, ARM_FEATURE_V4T)) {
5806         env->thumb = (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0;
5807     }
5808     env->regs[14] = env->regs[15] + offset;
5809     env->regs[15] = addr;
5810     cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
5811 }
5812
5813
5814 /* Return the exception level which controls this address translation regime */
5815 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
5816 {
5817     switch (mmu_idx) {
5818     case ARMMMUIdx_S2NS:
5819     case ARMMMUIdx_S1E2:
5820         return 2;
5821     case ARMMMUIdx_S1E3:
5822         return 3;
5823     case ARMMMUIdx_S1SE0:
5824         return arm_el_is_aa64(env, 3) ? 1 : 3;
5825     case ARMMMUIdx_S1SE1:
5826     case ARMMMUIdx_S1NSE0:
5827     case ARMMMUIdx_S1NSE1:
5828         return 1;
5829     default:
5830         g_assert_not_reached();
5831     }
5832 }
5833
5834 /* Return true if this address translation regime is secure */
5835 static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
5836 {
5837     switch (mmu_idx) {
5838     case ARMMMUIdx_S12NSE0:
5839     case ARMMMUIdx_S12NSE1:
5840     case ARMMMUIdx_S1NSE0:
5841     case ARMMMUIdx_S1NSE1:
5842     case ARMMMUIdx_S1E2:
5843     case ARMMMUIdx_S2NS:
5844         return false;
5845     case ARMMMUIdx_S1E3:
5846     case ARMMMUIdx_S1SE0:
5847     case ARMMMUIdx_S1SE1:
5848         return true;
5849     default:
5850         g_assert_not_reached();
5851     }
5852 }
5853
5854 /* Return the SCTLR value which controls this address translation regime */
5855 static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
5856 {
5857     return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
5858 }
5859
5860 /* Return true if the specified stage of address translation is disabled */
5861 static inline bool regime_translation_disabled(CPUARMState *env,
5862                                                ARMMMUIdx mmu_idx)
5863 {
5864     if (mmu_idx == ARMMMUIdx_S2NS) {
5865         return (env->cp15.hcr_el2 & HCR_VM) == 0;
5866     }
5867     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
5868 }
5869
5870 /* Return the TCR controlling this translation regime */
5871 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
5872 {
5873     if (mmu_idx == ARMMMUIdx_S2NS) {
5874         return &env->cp15.vtcr_el2;
5875     }
5876     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
5877 }
5878
5879 /* Return the TTBR associated with this translation regime */
5880 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
5881                                    int ttbrn)
5882 {
5883     if (mmu_idx == ARMMMUIdx_S2NS) {
5884         return env->cp15.vttbr_el2;
5885     }
5886     if (ttbrn == 0) {
5887         return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
5888     } else {
5889         return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
5890     }
5891 }
5892
5893 /* Return true if the translation regime is using LPAE format page tables */
5894 static inline bool regime_using_lpae_format(CPUARMState *env,
5895                                             ARMMMUIdx mmu_idx)
5896 {
5897     int el = regime_el(env, mmu_idx);
5898     if (el == 2 || arm_el_is_aa64(env, el)) {
5899         return true;
5900     }
5901     if (arm_feature(env, ARM_FEATURE_LPAE)
5902         && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) {
5903         return true;
5904     }
5905     return false;
5906 }
5907
5908 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
5909 {
5910     switch (mmu_idx) {
5911     case ARMMMUIdx_S1SE0:
5912     case ARMMMUIdx_S1NSE0:
5913         return true;
5914     default:
5915         return false;
5916     case ARMMMUIdx_S12NSE0:
5917     case ARMMMUIdx_S12NSE1:
5918         g_assert_not_reached();
5919     }
5920 }
5921
5922 /* Translate section/page access permissions to page
5923  * R/W protection flags
5924  *
5925  * @env:         CPUARMState
5926  * @mmu_idx:     MMU index indicating required translation regime
5927  * @ap:          The 3-bit access permissions (AP[2:0])
5928  * @domain_prot: The 2-bit domain access permissions
5929  */
5930 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
5931                                 int ap, int domain_prot)
5932 {
5933     bool is_user = regime_is_user(env, mmu_idx);
5934
5935     if (domain_prot == 3) {
5936         return PAGE_READ | PAGE_WRITE;
5937     }
5938
5939     switch (ap) {
5940     case 0:
5941         if (arm_feature(env, ARM_FEATURE_V7)) {
5942             return 0;
5943         }
5944         switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) {
5945         case SCTLR_S:
5946             return is_user ? 0 : PAGE_READ;
5947         case SCTLR_R:
5948             return PAGE_READ;
5949         default:
5950             return 0;
5951         }
5952     case 1:
5953         return is_user ? 0 : PAGE_READ | PAGE_WRITE;
5954     case 2:
5955         if (is_user) {
5956             return PAGE_READ;
5957         } else {
5958             return PAGE_READ | PAGE_WRITE;
5959         }
5960     case 3:
5961         return PAGE_READ | PAGE_WRITE;
5962     case 4: /* Reserved.  */
5963         return 0;
5964     case 5:
5965         return is_user ? 0 : PAGE_READ;
5966     case 6:
5967         return PAGE_READ;
5968     case 7:
5969         if (!arm_feature(env, ARM_FEATURE_V6K)) {
5970             return 0;
5971         }
5972         return PAGE_READ;
5973     default:
5974         g_assert_not_reached();
5975     }
5976 }
5977
5978 /* Translate section/page access permissions to page
5979  * R/W protection flags.
5980  *
5981  * @ap:      The 2-bit simple AP (AP[2:1])
5982  * @is_user: TRUE if accessing from PL0
5983  */
5984 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
5985 {
5986     switch (ap) {
5987     case 0:
5988         return is_user ? 0 : PAGE_READ | PAGE_WRITE;
5989     case 1:
5990         return PAGE_READ | PAGE_WRITE;
5991     case 2:
5992         return is_user ? 0 : PAGE_READ;
5993     case 3:
5994         return PAGE_READ;
5995     default:
5996         g_assert_not_reached();
5997     }
5998 }
5999
6000 static inline int
6001 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
6002 {
6003     return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
6004 }
6005
6006 /* Translate section/page access permissions to protection flags
6007  *
6008  * @env:     CPUARMState
6009  * @mmu_idx: MMU index indicating required translation regime
6010  * @is_aa64: TRUE if AArch64
6011  * @ap:      The 2-bit simple AP (AP[2:1])
6012  * @ns:      NS (non-secure) bit
6013  * @xn:      XN (execute-never) bit
6014  * @pxn:     PXN (privileged execute-never) bit
6015  */
6016 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
6017                       int ap, int ns, int xn, int pxn)
6018 {
6019     bool is_user = regime_is_user(env, mmu_idx);
6020     int prot_rw, user_rw;
6021     bool have_wxn;
6022     int wxn = 0;
6023
6024     assert(mmu_idx != ARMMMUIdx_S2NS);
6025
6026     user_rw = simple_ap_to_rw_prot_is_user(ap, true);
6027     if (is_user) {
6028         prot_rw = user_rw;
6029     } else {
6030         prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
6031     }
6032
6033     if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
6034         return prot_rw;
6035     }
6036
6037     /* TODO have_wxn should be replaced with
6038      *   ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
6039      * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
6040      * compatible processors have EL2, which is required for [U]WXN.
6041      */
6042     have_wxn = arm_feature(env, ARM_FEATURE_LPAE);
6043
6044     if (have_wxn) {
6045         wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
6046     }
6047
6048     if (is_aa64) {
6049         switch (regime_el(env, mmu_idx)) {
6050         case 1:
6051             if (!is_user) {
6052                 xn = pxn || (user_rw & PAGE_WRITE);
6053             }
6054             break;
6055         case 2:
6056         case 3:
6057             break;
6058         }
6059     } else if (arm_feature(env, ARM_FEATURE_V7)) {
6060         switch (regime_el(env, mmu_idx)) {
6061         case 1:
6062         case 3:
6063             if (is_user) {
6064                 xn = xn || !(user_rw & PAGE_READ);
6065             } else {
6066                 int uwxn = 0;
6067                 if (have_wxn) {
6068                     uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
6069                 }
6070                 xn = xn || !(prot_rw & PAGE_READ) || pxn ||
6071                      (uwxn && (user_rw & PAGE_WRITE));
6072             }
6073             break;
6074         case 2:
6075             break;
6076         }
6077     } else {
6078         xn = wxn = 0;
6079     }
6080
6081     if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
6082         return prot_rw;
6083     }
6084     return prot_rw | PAGE_EXEC;
6085 }
6086
6087 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
6088                                      uint32_t *table, uint32_t address)
6089 {
6090     /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
6091     TCR *tcr = regime_tcr(env, mmu_idx);
6092
6093     if (address & tcr->mask) {
6094         if (tcr->raw_tcr & TTBCR_PD1) {
6095             /* Translation table walk disabled for TTBR1 */
6096             return false;
6097         }
6098         *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
6099     } else {
6100         if (tcr->raw_tcr & TTBCR_PD0) {
6101             /* Translation table walk disabled for TTBR0 */
6102             return false;
6103         }
6104         *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask;
6105     }
6106     *table |= (address >> 18) & 0x3ffc;
6107     return true;
6108 }
6109
6110 /* All loads done in the course of a page table walk go through here.
6111  * TODO: rather than ignoring errors from physical memory reads (which
6112  * are external aborts in ARM terminology) we should propagate this
6113  * error out so that we can turn it into a Data Abort if this walk
6114  * was being done for a CPU load/store or an address translation instruction
6115  * (but not if it was for a debug access).
6116  */
6117 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure)
6118 {
6119     MemTxAttrs attrs = {};
6120
6121     attrs.secure = is_secure;
6122     return address_space_ldl(cs->as, addr, attrs, NULL);
6123 }
6124
6125 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure)
6126 {
6127     MemTxAttrs attrs = {};
6128
6129     attrs.secure = is_secure;
6130     return address_space_ldq(cs->as, addr, attrs, NULL);
6131 }
6132
6133 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
6134                              int access_type, ARMMMUIdx mmu_idx,
6135                              hwaddr *phys_ptr, int *prot,
6136                              target_ulong *page_size, uint32_t *fsr)
6137 {
6138     CPUState *cs = CPU(arm_env_get_cpu(env));
6139     int code;
6140     uint32_t table;
6141     uint32_t desc;
6142     int type;
6143     int ap;
6144     int domain = 0;
6145     int domain_prot;
6146     hwaddr phys_addr;
6147     uint32_t dacr;
6148
6149     /* Pagetable walk.  */
6150     /* Lookup l1 descriptor.  */
6151     if (!get_level1_table_address(env, mmu_idx, &table, address)) {
6152         /* Section translation fault if page walk is disabled by PD0 or PD1 */
6153         code = 5;
6154         goto do_fault;
6155     }
6156     desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
6157     type = (desc & 3);
6158     domain = (desc >> 5) & 0x0f;
6159     if (regime_el(env, mmu_idx) == 1) {
6160         dacr = env->cp15.dacr_ns;
6161     } else {
6162         dacr = env->cp15.dacr_s;
6163     }
6164     domain_prot = (dacr >> (domain * 2)) & 3;
6165     if (type == 0) {
6166         /* Section translation fault.  */
6167         code = 5;
6168         goto do_fault;
6169     }
6170     if (domain_prot == 0 || domain_prot == 2) {
6171         if (type == 2)
6172             code = 9; /* Section domain fault.  */
6173         else
6174             code = 11; /* Page domain fault.  */
6175         goto do_fault;
6176     }
6177     if (type == 2) {
6178         /* 1Mb section.  */
6179         phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
6180         ap = (desc >> 10) & 3;
6181         code = 13;
6182         *page_size = 1024 * 1024;
6183     } else {
6184         /* Lookup l2 entry.  */
6185         if (type == 1) {
6186             /* Coarse pagetable.  */
6187             table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
6188         } else {
6189             /* Fine pagetable.  */
6190             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
6191         }
6192         desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
6193         switch (desc & 3) {
6194         case 0: /* Page translation fault.  */
6195             code = 7;
6196             goto do_fault;
6197         case 1: /* 64k page.  */
6198             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
6199             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
6200             *page_size = 0x10000;
6201             break;
6202         case 2: /* 4k page.  */
6203             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
6204             ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
6205             *page_size = 0x1000;
6206             break;
6207         case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
6208             if (type == 1) {
6209                 /* ARMv6/XScale extended small page format */
6210                 if (arm_feature(env, ARM_FEATURE_XSCALE)
6211                     || arm_feature(env, ARM_FEATURE_V6)) {
6212                     phys_addr = (desc & 0xfffff000) | (address & 0xfff);
6213                     *page_size = 0x1000;
6214                 } else {
6215                     /* UNPREDICTABLE in ARMv5; we choose to take a
6216                      * page translation fault.
6217                      */
6218                     code = 7;
6219                     goto do_fault;
6220                 }
6221             } else {
6222                 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
6223                 *page_size = 0x400;
6224             }
6225             ap = (desc >> 4) & 3;
6226             break;
6227         default:
6228             /* Never happens, but compiler isn't smart enough to tell.  */
6229             abort();
6230         }
6231         code = 15;
6232     }
6233     *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
6234     *prot |= *prot ? PAGE_EXEC : 0;
6235     if (!(*prot & (1 << access_type))) {
6236         /* Access permission fault.  */
6237         goto do_fault;
6238     }
6239     *phys_ptr = phys_addr;
6240     return false;
6241 do_fault:
6242     *fsr = code | (domain << 4);
6243     return true;
6244 }
6245
6246 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
6247                              int access_type, ARMMMUIdx mmu_idx,
6248                              hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
6249                              target_ulong *page_size, uint32_t *fsr)
6250 {
6251     CPUState *cs = CPU(arm_env_get_cpu(env));
6252     int code;
6253     uint32_t table;
6254     uint32_t desc;
6255     uint32_t xn;
6256     uint32_t pxn = 0;
6257     int type;
6258     int ap;
6259     int domain = 0;
6260     int domain_prot;
6261     hwaddr phys_addr;
6262     uint32_t dacr;
6263     bool ns;
6264
6265     /* Pagetable walk.  */
6266     /* Lookup l1 descriptor.  */
6267     if (!get_level1_table_address(env, mmu_idx, &table, address)) {
6268         /* Section translation fault if page walk is disabled by PD0 or PD1 */
6269         code = 5;
6270         goto do_fault;
6271     }
6272     desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
6273     type = (desc & 3);
6274     if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
6275         /* Section translation fault, or attempt to use the encoding
6276          * which is Reserved on implementations without PXN.
6277          */
6278         code = 5;
6279         goto do_fault;
6280     }
6281     if ((type == 1) || !(desc & (1 << 18))) {
6282         /* Page or Section.  */
6283         domain = (desc >> 5) & 0x0f;
6284     }
6285     if (regime_el(env, mmu_idx) == 1) {
6286         dacr = env->cp15.dacr_ns;
6287     } else {
6288         dacr = env->cp15.dacr_s;
6289     }
6290     domain_prot = (dacr >> (domain * 2)) & 3;
6291     if (domain_prot == 0 || domain_prot == 2) {
6292         if (type != 1) {
6293             code = 9; /* Section domain fault.  */
6294         } else {
6295             code = 11; /* Page domain fault.  */
6296         }
6297         goto do_fault;
6298     }
6299     if (type != 1) {
6300         if (desc & (1 << 18)) {
6301             /* Supersection.  */
6302             phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
6303             phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
6304             phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
6305             *page_size = 0x1000000;
6306         } else {
6307             /* Section.  */
6308             phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
6309             *page_size = 0x100000;
6310         }
6311         ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
6312         xn = desc & (1 << 4);
6313         pxn = desc & 1;
6314         code = 13;
6315         ns = extract32(desc, 19, 1);
6316     } else {
6317         if (arm_feature(env, ARM_FEATURE_PXN)) {
6318             pxn = (desc >> 2) & 1;
6319         }
6320         ns = extract32(desc, 3, 1);
6321         /* Lookup l2 entry.  */
6322         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
6323         desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
6324         ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
6325         switch (desc & 3) {
6326         case 0: /* Page translation fault.  */
6327             code = 7;
6328             goto do_fault;
6329         case 1: /* 64k page.  */
6330             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
6331             xn = desc & (1 << 15);
6332             *page_size = 0x10000;
6333             break;
6334         case 2: case 3: /* 4k page.  */
6335             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
6336             xn = desc & 1;
6337             *page_size = 0x1000;
6338             break;
6339         default:
6340             /* Never happens, but compiler isn't smart enough to tell.  */
6341             abort();
6342         }
6343         code = 15;
6344     }
6345     if (domain_prot == 3) {
6346         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
6347     } else {
6348         if (pxn && !regime_is_user(env, mmu_idx)) {
6349             xn = 1;
6350         }
6351         if (xn && access_type == 2)
6352             goto do_fault;
6353
6354         if (arm_feature(env, ARM_FEATURE_V6K) &&
6355                 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) {
6356             /* The simplified model uses AP[0] as an access control bit.  */
6357             if ((ap & 1) == 0) {
6358                 /* Access flag fault.  */
6359                 code = (code == 15) ? 6 : 3;
6360                 goto do_fault;
6361             }
6362             *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
6363         } else {
6364             *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
6365         }
6366         if (*prot && !xn) {
6367             *prot |= PAGE_EXEC;
6368         }
6369         if (!(*prot & (1 << access_type))) {
6370             /* Access permission fault.  */
6371             goto do_fault;
6372         }
6373     }
6374     if (ns) {
6375         /* The NS bit will (as required by the architecture) have no effect if
6376          * the CPU doesn't support TZ or this is a non-secure translation
6377          * regime, because the attribute will already be non-secure.
6378          */
6379         attrs->secure = false;
6380     }
6381     *phys_ptr = phys_addr;
6382     return false;
6383 do_fault:
6384     *fsr = code | (domain << 4);
6385     return true;
6386 }
6387
6388 /* Fault type for long-descriptor MMU fault reporting; this corresponds
6389  * to bits [5..2] in the STATUS field in long-format DFSR/IFSR.
6390  */
6391 typedef enum {
6392     translation_fault = 1,
6393     access_fault = 2,
6394     permission_fault = 3,
6395 } MMUFaultType;
6396
6397 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
6398                                int access_type, ARMMMUIdx mmu_idx,
6399                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
6400                                target_ulong *page_size_ptr, uint32_t *fsr)
6401 {
6402     CPUState *cs = CPU(arm_env_get_cpu(env));
6403     /* Read an LPAE long-descriptor translation table. */
6404     MMUFaultType fault_type = translation_fault;
6405     uint32_t level = 1;
6406     uint32_t epd = 0;
6407     int32_t tsz;
6408     uint32_t tg;
6409     uint64_t ttbr;
6410     int ttbr_select;
6411     hwaddr descaddr, descmask;
6412     uint32_t tableattrs;
6413     target_ulong page_size;
6414     uint32_t attrs;
6415     int32_t granule_sz = 9;
6416     int32_t va_size = 32;
6417     int32_t tbi = 0;
6418     TCR *tcr = regime_tcr(env, mmu_idx);
6419     int ap, ns, xn, pxn;
6420     uint32_t el = regime_el(env, mmu_idx);
6421     bool ttbr1_valid = true;
6422
6423     /* TODO:
6424      * This code does not handle the different format TCR for VTCR_EL2.
6425      * This code also does not support shareability levels.
6426      * Attribute and permission bit handling should also be checked when adding
6427      * support for those page table walks.
6428      */
6429     if (arm_el_is_aa64(env, el)) {
6430         va_size = 64;
6431         if (el > 1) {
6432             if (mmu_idx != ARMMMUIdx_S2NS) {
6433                 tbi = extract64(tcr->raw_tcr, 20, 1);
6434             }
6435         } else {
6436             if (extract64(address, 55, 1)) {
6437                 tbi = extract64(tcr->raw_tcr, 38, 1);
6438             } else {
6439                 tbi = extract64(tcr->raw_tcr, 37, 1);
6440             }
6441         }
6442         tbi *= 8;
6443
6444         /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it
6445          * invalid.
6446          */
6447         if (el > 1) {
6448             ttbr1_valid = false;
6449         }
6450     } else {
6451         /* There is no TTBR1 for EL2 */
6452         if (el == 2) {
6453             ttbr1_valid = false;
6454         }
6455     }
6456
6457     /* Determine whether this address is in the region controlled by
6458      * TTBR0 or TTBR1 (or if it is in neither region and should fault).
6459      * This is a Non-secure PL0/1 stage 1 translation, so controlled by
6460      * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
6461      */
6462     uint32_t t0sz = extract32(tcr->raw_tcr, 0, 6);
6463     if (va_size == 64) {
6464         t0sz = MIN(t0sz, 39);
6465         t0sz = MAX(t0sz, 16);
6466     }
6467     uint32_t t1sz = extract32(tcr->raw_tcr, 16, 6);
6468     if (va_size == 64) {
6469         t1sz = MIN(t1sz, 39);
6470         t1sz = MAX(t1sz, 16);
6471     }
6472     if (t0sz && !extract64(address, va_size - t0sz, t0sz - tbi)) {
6473         /* there is a ttbr0 region and we are in it (high bits all zero) */
6474         ttbr_select = 0;
6475     } else if (ttbr1_valid && t1sz &&
6476                !extract64(~address, va_size - t1sz, t1sz - tbi)) {
6477         /* there is a ttbr1 region and we are in it (high bits all one) */
6478         ttbr_select = 1;
6479     } else if (!t0sz) {
6480         /* ttbr0 region is "everything not in the ttbr1 region" */
6481         ttbr_select = 0;
6482     } else if (!t1sz && ttbr1_valid) {
6483         /* ttbr1 region is "everything not in the ttbr0 region" */
6484         ttbr_select = 1;
6485     } else {
6486         /* in the gap between the two regions, this is a Translation fault */
6487         fault_type = translation_fault;
6488         goto do_fault;
6489     }
6490
6491     /* Note that QEMU ignores shareability and cacheability attributes,
6492      * so we don't need to do anything with the SH, ORGN, IRGN fields
6493      * in the TTBCR.  Similarly, TTBCR:A1 selects whether we get the
6494      * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
6495      * implement any ASID-like capability so we can ignore it (instead
6496      * we will always flush the TLB any time the ASID is changed).
6497      */
6498     if (ttbr_select == 0) {
6499         ttbr = regime_ttbr(env, mmu_idx, 0);
6500         if (el < 2) {
6501             epd = extract32(tcr->raw_tcr, 7, 1);
6502         }
6503         tsz = t0sz;
6504
6505         tg = extract32(tcr->raw_tcr, 14, 2);
6506         if (tg == 1) { /* 64KB pages */
6507             granule_sz = 13;
6508         }
6509         if (tg == 2) { /* 16KB pages */
6510             granule_sz = 11;
6511         }
6512     } else {
6513         /* We should only be here if TTBR1 is valid */
6514         assert(ttbr1_valid);
6515
6516         ttbr = regime_ttbr(env, mmu_idx, 1);
6517         epd = extract32(tcr->raw_tcr, 23, 1);
6518         tsz = t1sz;
6519
6520         tg = extract32(tcr->raw_tcr, 30, 2);
6521         if (tg == 3)  { /* 64KB pages */
6522             granule_sz = 13;
6523         }
6524         if (tg == 1) { /* 16KB pages */
6525             granule_sz = 11;
6526         }
6527     }
6528
6529     /* Here we should have set up all the parameters for the translation:
6530      * va_size, ttbr, epd, tsz, granule_sz, tbi
6531      */
6532
6533     if (epd) {
6534         /* Translation table walk disabled => Translation fault on TLB miss
6535          * Note: This is always 0 on 64-bit EL2 and EL3.
6536          */
6537         goto do_fault;
6538     }
6539
6540     /* The starting level depends on the virtual address size (which can be
6541      * up to 48 bits) and the translation granule size. It indicates the number
6542      * of strides (granule_sz bits at a time) needed to consume the bits
6543      * of the input address. In the pseudocode this is:
6544      *  level = 4 - RoundUp((inputsize - grainsize) / stride)
6545      * where their 'inputsize' is our 'va_size - tsz', 'grainsize' is
6546      * our 'granule_sz + 3' and 'stride' is our 'granule_sz'.
6547      * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
6548      *     = 4 - (va_size - tsz - granule_sz - 3 + granule_sz - 1) / granule_sz
6549      *     = 4 - (va_size - tsz - 4) / granule_sz;
6550      */
6551     level = 4 - (va_size - tsz - 4) / granule_sz;
6552
6553     /* Clear the vaddr bits which aren't part of the within-region address,
6554      * so that we don't have to special case things when calculating the
6555      * first descriptor address.
6556      */
6557     if (tsz) {
6558         address &= (1ULL << (va_size - tsz)) - 1;
6559     }
6560
6561     descmask = (1ULL << (granule_sz + 3)) - 1;
6562
6563     /* Now we can extract the actual base address from the TTBR */
6564     descaddr = extract64(ttbr, 0, 48);
6565     descaddr &= ~((1ULL << (va_size - tsz - (granule_sz * (4 - level)))) - 1);
6566
6567     /* Secure accesses start with the page table in secure memory and
6568      * can be downgraded to non-secure at any step. Non-secure accesses
6569      * remain non-secure. We implement this by just ORing in the NSTable/NS
6570      * bits at each step.
6571      */
6572     tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4);
6573     for (;;) {
6574         uint64_t descriptor;
6575         bool nstable;
6576
6577         descaddr |= (address >> (granule_sz * (4 - level))) & descmask;
6578         descaddr &= ~7ULL;
6579         nstable = extract32(tableattrs, 4, 1);
6580         descriptor = arm_ldq_ptw(cs, descaddr, !nstable);
6581         if (!(descriptor & 1) ||
6582             (!(descriptor & 2) && (level == 3))) {
6583             /* Invalid, or the Reserved level 3 encoding */
6584             goto do_fault;
6585         }
6586         descaddr = descriptor & 0xfffffff000ULL;
6587
6588         if ((descriptor & 2) && (level < 3)) {
6589             /* Table entry. The top five bits are attributes which  may
6590              * propagate down through lower levels of the table (and
6591              * which are all arranged so that 0 means "no effect", so
6592              * we can gather them up by ORing in the bits at each level).
6593              */
6594             tableattrs |= extract64(descriptor, 59, 5);
6595             level++;
6596             continue;
6597         }
6598         /* Block entry at level 1 or 2, or page entry at level 3.
6599          * These are basically the same thing, although the number
6600          * of bits we pull in from the vaddr varies.
6601          */
6602         page_size = (1ULL << ((granule_sz * (4 - level)) + 3));
6603         descaddr |= (address & (page_size - 1));
6604         /* Extract attributes from the descriptor and merge with table attrs */
6605         attrs = extract64(descriptor, 2, 10)
6606             | (extract64(descriptor, 52, 12) << 10);
6607         attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */
6608         attrs |= extract32(tableattrs, 3, 1) << 5; /* APTable[1] => AP[2] */
6609         /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
6610          * means "force PL1 access only", which means forcing AP[1] to 0.
6611          */
6612         if (extract32(tableattrs, 2, 1)) {
6613             attrs &= ~(1 << 4);
6614         }
6615         attrs |= nstable << 3; /* NS */
6616         break;
6617     }
6618     /* Here descaddr is the final physical address, and attributes
6619      * are all in attrs.
6620      */
6621     fault_type = access_fault;
6622     if ((attrs & (1 << 8)) == 0) {
6623         /* Access flag */
6624         goto do_fault;
6625     }
6626
6627     ap = extract32(attrs, 4, 2);
6628     ns = extract32(attrs, 3, 1);
6629     xn = extract32(attrs, 12, 1);
6630     pxn = extract32(attrs, 11, 1);
6631
6632     *prot = get_S1prot(env, mmu_idx, va_size == 64, ap, ns, xn, pxn);
6633
6634     fault_type = permission_fault;
6635     if (!(*prot & (1 << access_type))) {
6636         goto do_fault;
6637     }
6638
6639     if (ns) {
6640         /* The NS bit will (as required by the architecture) have no effect if
6641          * the CPU doesn't support TZ or this is a non-secure translation
6642          * regime, because the attribute will already be non-secure.
6643          */
6644         txattrs->secure = false;
6645     }
6646     *phys_ptr = descaddr;
6647     *page_size_ptr = page_size;
6648     return false;
6649
6650 do_fault:
6651     /* Long-descriptor format IFSR/DFSR value */
6652     *fsr = (1 << 9) | (fault_type << 2) | level;
6653     return true;
6654 }
6655
6656 static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
6657                                                 ARMMMUIdx mmu_idx,
6658                                                 int32_t address, int *prot)
6659 {
6660     *prot = PAGE_READ | PAGE_WRITE;
6661     switch (address) {
6662     case 0xF0000000 ... 0xFFFFFFFF:
6663         if (regime_sctlr(env, mmu_idx) & SCTLR_V) { /* hivecs execing is ok */
6664             *prot |= PAGE_EXEC;
6665         }
6666         break;
6667     case 0x00000000 ... 0x7FFFFFFF:
6668         *prot |= PAGE_EXEC;
6669         break;
6670     }
6671
6672 }
6673
6674 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
6675                                  int access_type, ARMMMUIdx mmu_idx,
6676                                  hwaddr *phys_ptr, int *prot, uint32_t *fsr)
6677 {
6678     ARMCPU *cpu = arm_env_get_cpu(env);
6679     int n;
6680     bool is_user = regime_is_user(env, mmu_idx);
6681
6682     *phys_ptr = address;
6683     *prot = 0;
6684
6685     if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */
6686         get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
6687     } else { /* MPU enabled */
6688         for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
6689             /* region search */
6690             uint32_t base = env->pmsav7.drbar[n];
6691             uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5);
6692             uint32_t rmask;
6693             bool srdis = false;
6694
6695             if (!(env->pmsav7.drsr[n] & 0x1)) {
6696                 continue;
6697             }
6698
6699             if (!rsize) {
6700                 qemu_log_mask(LOG_GUEST_ERROR, "DRSR.Rsize field can not be 0");
6701                 continue;
6702             }
6703             rsize++;
6704             rmask = (1ull << rsize) - 1;
6705
6706             if (base & rmask) {
6707                 qemu_log_mask(LOG_GUEST_ERROR, "DRBAR %" PRIx32 " misaligned "
6708                               "to DRSR region size, mask = %" PRIx32,
6709                               base, rmask);
6710                 continue;
6711             }
6712
6713             if (address < base || address > base + rmask) {
6714                 continue;
6715             }
6716
6717             /* Region matched */
6718
6719             if (rsize >= 8) { /* no subregions for regions < 256 bytes */
6720                 int i, snd;
6721                 uint32_t srdis_mask;
6722
6723                 rsize -= 3; /* sub region size (power of 2) */
6724                 snd = ((address - base) >> rsize) & 0x7;
6725                 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1);
6726
6727                 srdis_mask = srdis ? 0x3 : 0x0;
6728                 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) {
6729                     /* This will check in groups of 2, 4 and then 8, whether
6730                      * the subregion bits are consistent. rsize is incremented
6731                      * back up to give the region size, considering consistent
6732                      * adjacent subregions as one region. Stop testing if rsize
6733                      * is already big enough for an entire QEMU page.
6734                      */
6735                     int snd_rounded = snd & ~(i - 1);
6736                     uint32_t srdis_multi = extract32(env->pmsav7.drsr[n],
6737                                                      snd_rounded + 8, i);
6738                     if (srdis_mask ^ srdis_multi) {
6739                         break;
6740                     }
6741                     srdis_mask = (srdis_mask << i) | srdis_mask;
6742                     rsize++;
6743                 }
6744             }
6745             if (rsize < TARGET_PAGE_BITS) {
6746                 qemu_log_mask(LOG_UNIMP, "No support for MPU (sub)region"
6747                               "alignment of %" PRIu32 " bits. Minimum is %d\n",
6748                               rsize, TARGET_PAGE_BITS);
6749                 continue;
6750             }
6751             if (srdis) {
6752                 continue;
6753             }
6754             break;
6755         }
6756
6757         if (n == -1) { /* no hits */
6758             if (cpu->pmsav7_dregion &&
6759                 (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR))) {
6760                 /* background fault */
6761                 *fsr = 0;
6762                 return true;
6763             }
6764             get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
6765         } else { /* a MPU hit! */
6766             uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
6767
6768             if (is_user) { /* User mode AP bit decoding */
6769                 switch (ap) {
6770                 case 0:
6771                 case 1:
6772                 case 5:
6773                     break; /* no access */
6774                 case 3:
6775                     *prot |= PAGE_WRITE;
6776                     /* fall through */
6777                 case 2:
6778                 case 6:
6779                     *prot |= PAGE_READ | PAGE_EXEC;
6780                     break;
6781                 default:
6782                     qemu_log_mask(LOG_GUEST_ERROR,
6783                                   "Bad value for AP bits in DRACR %"
6784                                   PRIx32 "\n", ap);
6785                 }
6786             } else { /* Priv. mode AP bits decoding */
6787                 switch (ap) {
6788                 case 0:
6789                     break; /* no access */
6790                 case 1:
6791                 case 2:
6792                 case 3:
6793                     *prot |= PAGE_WRITE;
6794                     /* fall through */
6795                 case 5:
6796                 case 6:
6797                     *prot |= PAGE_READ | PAGE_EXEC;
6798                     break;
6799                 default:
6800                     qemu_log_mask(LOG_GUEST_ERROR,
6801                                   "Bad value for AP bits in DRACR %"
6802                                   PRIx32 "\n", ap);
6803                 }
6804             }
6805
6806             /* execute never */
6807             if (env->pmsav7.dracr[n] & (1 << 12)) {
6808                 *prot &= ~PAGE_EXEC;
6809             }
6810         }
6811     }
6812
6813     *fsr = 0x00d; /* Permission fault */
6814     return !(*prot & (1 << access_type));
6815 }
6816
6817 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
6818                                  int access_type, ARMMMUIdx mmu_idx,
6819                                  hwaddr *phys_ptr, int *prot, uint32_t *fsr)
6820 {
6821     int n;
6822     uint32_t mask;
6823     uint32_t base;
6824     bool is_user = regime_is_user(env, mmu_idx);
6825
6826     *phys_ptr = address;
6827     for (n = 7; n >= 0; n--) {
6828         base = env->cp15.c6_region[n];
6829         if ((base & 1) == 0) {
6830             continue;
6831         }
6832         mask = 1 << ((base >> 1) & 0x1f);
6833         /* Keep this shift separate from the above to avoid an
6834            (undefined) << 32.  */
6835         mask = (mask << 1) - 1;
6836         if (((base ^ address) & ~mask) == 0) {
6837             break;
6838         }
6839     }
6840     if (n < 0) {
6841         *fsr = 2;
6842         return true;
6843     }
6844
6845     if (access_type == 2) {
6846         mask = env->cp15.pmsav5_insn_ap;
6847     } else {
6848         mask = env->cp15.pmsav5_data_ap;
6849     }
6850     mask = (mask >> (n * 4)) & 0xf;
6851     switch (mask) {
6852     case 0:
6853         *fsr = 1;
6854         return true;
6855     case 1:
6856         if (is_user) {
6857             *fsr = 1;
6858             return true;
6859         }
6860         *prot = PAGE_READ | PAGE_WRITE;
6861         break;
6862     case 2:
6863         *prot = PAGE_READ;
6864         if (!is_user) {
6865             *prot |= PAGE_WRITE;
6866         }
6867         break;
6868     case 3:
6869         *prot = PAGE_READ | PAGE_WRITE;
6870         break;
6871     case 5:
6872         if (is_user) {
6873             *fsr = 1;
6874             return true;
6875         }
6876         *prot = PAGE_READ;
6877         break;
6878     case 6:
6879         *prot = PAGE_READ;
6880         break;
6881     default:
6882         /* Bad permission.  */
6883         *fsr = 1;
6884         return true;
6885     }
6886     *prot |= PAGE_EXEC;
6887     return false;
6888 }
6889
6890 /* get_phys_addr - get the physical address for this virtual address
6891  *
6892  * Find the physical address corresponding to the given virtual address,
6893  * by doing a translation table walk on MMU based systems or using the
6894  * MPU state on MPU based systems.
6895  *
6896  * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
6897  * prot and page_size may not be filled in, and the populated fsr value provides
6898  * information on why the translation aborted, in the format of a
6899  * DFSR/IFSR fault register, with the following caveats:
6900  *  * we honour the short vs long DFSR format differences.
6901  *  * the WnR bit is never set (the caller must do this).
6902  *  * for PSMAv5 based systems we don't bother to return a full FSR format
6903  *    value.
6904  *
6905  * @env: CPUARMState
6906  * @address: virtual address to get physical address for
6907  * @access_type: 0 for read, 1 for write, 2 for execute
6908  * @mmu_idx: MMU index indicating required translation regime
6909  * @phys_ptr: set to the physical address corresponding to the virtual address
6910  * @attrs: set to the memory transaction attributes to use
6911  * @prot: set to the permissions for the page containing phys_ptr
6912  * @page_size: set to the size of the page containing phys_ptr
6913  * @fsr: set to the DFSR/IFSR value on failure
6914  */
6915 static inline bool get_phys_addr(CPUARMState *env, target_ulong address,
6916                                  int access_type, ARMMMUIdx mmu_idx,
6917                                  hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
6918                                  target_ulong *page_size, uint32_t *fsr)
6919 {
6920     if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
6921         /* TODO: when we support EL2 we should here call ourselves recursively
6922          * to do the stage 1 and then stage 2 translations. The arm_ld*_ptw
6923          * functions will also need changing to perform ARMMMUIdx_S2NS loads
6924          * rather than direct physical memory loads when appropriate.
6925          * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
6926          */
6927         assert(!arm_feature(env, ARM_FEATURE_EL2));
6928         mmu_idx += ARMMMUIdx_S1NSE0;
6929     }
6930
6931     /* The page table entries may downgrade secure to non-secure, but
6932      * cannot upgrade an non-secure translation regime's attributes
6933      * to secure.
6934      */
6935     attrs->secure = regime_is_secure(env, mmu_idx);
6936     attrs->user = regime_is_user(env, mmu_idx);
6937
6938     /* Fast Context Switch Extension. This doesn't exist at all in v8.
6939      * In v7 and earlier it affects all stage 1 translations.
6940      */
6941     if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS
6942         && !arm_feature(env, ARM_FEATURE_V8)) {
6943         if (regime_el(env, mmu_idx) == 3) {
6944             address += env->cp15.fcseidr_s;
6945         } else {
6946             address += env->cp15.fcseidr_ns;
6947         }
6948     }
6949
6950     /* pmsav7 has special handling for when MPU is disabled so call it before
6951      * the common MMU/MPU disabled check below.
6952      */
6953     if (arm_feature(env, ARM_FEATURE_MPU) &&
6954         arm_feature(env, ARM_FEATURE_V7)) {
6955         *page_size = TARGET_PAGE_SIZE;
6956         return get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
6957                                     phys_ptr, prot, fsr);
6958     }
6959
6960     if (regime_translation_disabled(env, mmu_idx)) {
6961         /* MMU/MPU disabled.  */
6962         *phys_ptr = address;
6963         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
6964         *page_size = TARGET_PAGE_SIZE;
6965         return 0;
6966     }
6967
6968     if (arm_feature(env, ARM_FEATURE_MPU)) {
6969         /* Pre-v7 MPU */
6970         *page_size = TARGET_PAGE_SIZE;
6971         return get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
6972                                     phys_ptr, prot, fsr);
6973     }
6974
6975     if (regime_using_lpae_format(env, mmu_idx)) {
6976         return get_phys_addr_lpae(env, address, access_type, mmu_idx, phys_ptr,
6977                                   attrs, prot, page_size, fsr);
6978     } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
6979         return get_phys_addr_v6(env, address, access_type, mmu_idx, phys_ptr,
6980                                 attrs, prot, page_size, fsr);
6981     } else {
6982         return get_phys_addr_v5(env, address, access_type, mmu_idx, phys_ptr,
6983                                 prot, page_size, fsr);
6984     }
6985 }
6986
6987 /* Walk the page table and (if the mapping exists) add the page
6988  * to the TLB. Return false on success, or true on failure. Populate
6989  * fsr with ARM DFSR/IFSR fault register format value on failure.
6990  */
6991 bool arm_tlb_fill(CPUState *cs, vaddr address,
6992                   int access_type, int mmu_idx, uint32_t *fsr)
6993 {
6994     ARMCPU *cpu = ARM_CPU(cs);
6995     CPUARMState *env = &cpu->env;
6996     hwaddr phys_addr;
6997     target_ulong page_size;
6998     int prot;
6999     int ret;
7000     MemTxAttrs attrs = {};
7001
7002     ret = get_phys_addr(env, address, access_type, mmu_idx, &phys_addr,
7003                         &attrs, &prot, &page_size, fsr);
7004     if (!ret) {
7005         /* Map a single [sub]page.  */
7006         phys_addr &= TARGET_PAGE_MASK;
7007         address &= TARGET_PAGE_MASK;
7008         tlb_set_page_with_attrs(cs, address, phys_addr, attrs,
7009                                 prot, mmu_idx, page_size);
7010         return 0;
7011     }
7012
7013     return ret;
7014 }
7015
7016 hwaddr arm_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
7017 {
7018     ARMCPU *cpu = ARM_CPU(cs);
7019     CPUARMState *env = &cpu->env;
7020     hwaddr phys_addr;
7021     target_ulong page_size;
7022     int prot;
7023     bool ret;
7024     uint32_t fsr;
7025     MemTxAttrs attrs = {};
7026
7027     ret = get_phys_addr(env, addr, 0, cpu_mmu_index(env, false), &phys_addr,
7028                         &attrs, &prot, &page_size, &fsr);
7029
7030     if (ret) {
7031         return -1;
7032     }
7033
7034     return phys_addr;
7035 }
7036
7037 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
7038 {
7039     if ((env->uncached_cpsr & CPSR_M) == mode) {
7040         env->regs[13] = val;
7041     } else {
7042         env->banked_r13[bank_number(mode)] = val;
7043     }
7044 }
7045
7046 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
7047 {
7048     if ((env->uncached_cpsr & CPSR_M) == mode) {
7049         return env->regs[13];
7050     } else {
7051         return env->banked_r13[bank_number(mode)];
7052     }
7053 }
7054
7055 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
7056 {
7057     ARMCPU *cpu = arm_env_get_cpu(env);
7058
7059     switch (reg) {
7060     case 0: /* APSR */
7061         return xpsr_read(env) & 0xf8000000;
7062     case 1: /* IAPSR */
7063         return xpsr_read(env) & 0xf80001ff;
7064     case 2: /* EAPSR */
7065         return xpsr_read(env) & 0xff00fc00;
7066     case 3: /* xPSR */
7067         return xpsr_read(env) & 0xff00fdff;
7068     case 5: /* IPSR */
7069         return xpsr_read(env) & 0x000001ff;
7070     case 6: /* EPSR */
7071         return xpsr_read(env) & 0x0700fc00;
7072     case 7: /* IEPSR */
7073         return xpsr_read(env) & 0x0700edff;
7074     case 8: /* MSP */
7075         return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
7076     case 9: /* PSP */
7077         return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
7078     case 16: /* PRIMASK */
7079         return (env->daif & PSTATE_I) != 0;
7080     case 17: /* BASEPRI */
7081     case 18: /* BASEPRI_MAX */
7082         return env->v7m.basepri;
7083     case 19: /* FAULTMASK */
7084         return (env->daif & PSTATE_F) != 0;
7085     case 20: /* CONTROL */
7086         return env->v7m.control;
7087     default:
7088         /* ??? For debugging only.  */
7089         cpu_abort(CPU(cpu), "Unimplemented system register read (%d)\n", reg);
7090         return 0;
7091     }
7092 }
7093
7094 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
7095 {
7096     ARMCPU *cpu = arm_env_get_cpu(env);
7097
7098     switch (reg) {
7099     case 0: /* APSR */
7100         xpsr_write(env, val, 0xf8000000);
7101         break;
7102     case 1: /* IAPSR */
7103         xpsr_write(env, val, 0xf8000000);
7104         break;
7105     case 2: /* EAPSR */
7106         xpsr_write(env, val, 0xfe00fc00);
7107         break;
7108     case 3: /* xPSR */
7109         xpsr_write(env, val, 0xfe00fc00);
7110         break;
7111     case 5: /* IPSR */
7112         /* IPSR bits are readonly.  */
7113         break;
7114     case 6: /* EPSR */
7115         xpsr_write(env, val, 0x0600fc00);
7116         break;
7117     case 7: /* IEPSR */
7118         xpsr_write(env, val, 0x0600fc00);
7119         break;
7120     case 8: /* MSP */
7121         if (env->v7m.current_sp)
7122             env->v7m.other_sp = val;
7123         else
7124             env->regs[13] = val;
7125         break;
7126     case 9: /* PSP */
7127         if (env->v7m.current_sp)
7128             env->regs[13] = val;
7129         else
7130             env->v7m.other_sp = val;
7131         break;
7132     case 16: /* PRIMASK */
7133         if (val & 1) {
7134             env->daif |= PSTATE_I;
7135         } else {
7136             env->daif &= ~PSTATE_I;
7137         }
7138         break;
7139     case 17: /* BASEPRI */
7140         env->v7m.basepri = val & 0xff;
7141         break;
7142     case 18: /* BASEPRI_MAX */
7143         val &= 0xff;
7144         if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
7145             env->v7m.basepri = val;
7146         break;
7147     case 19: /* FAULTMASK */
7148         if (val & 1) {
7149             env->daif |= PSTATE_F;
7150         } else {
7151             env->daif &= ~PSTATE_F;
7152         }
7153         break;
7154     case 20: /* CONTROL */
7155         env->v7m.control = val & 3;
7156         switch_v7m_sp(env, (val & 2) != 0);
7157         break;
7158     default:
7159         /* ??? For debugging only.  */
7160         cpu_abort(CPU(cpu), "Unimplemented system register write (%d)\n", reg);
7161         return;
7162     }
7163 }
7164
7165 #endif
7166
7167 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
7168 {
7169     /* Implement DC ZVA, which zeroes a fixed-length block of memory.
7170      * Note that we do not implement the (architecturally mandated)
7171      * alignment fault for attempts to use this on Device memory
7172      * (which matches the usual QEMU behaviour of not implementing either
7173      * alignment faults or any memory attribute handling).
7174      */
7175
7176     ARMCPU *cpu = arm_env_get_cpu(env);
7177     uint64_t blocklen = 4 << cpu->dcz_blocksize;
7178     uint64_t vaddr = vaddr_in & ~(blocklen - 1);
7179
7180 #ifndef CONFIG_USER_ONLY
7181     {
7182         /* Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than
7183          * the block size so we might have to do more than one TLB lookup.
7184          * We know that in fact for any v8 CPU the page size is at least 4K
7185          * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
7186          * 1K as an artefact of legacy v5 subpage support being present in the
7187          * same QEMU executable.
7188          */
7189         int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
7190         void *hostaddr[maxidx];
7191         int try, i;
7192         unsigned mmu_idx = cpu_mmu_index(env, false);
7193         TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
7194
7195         for (try = 0; try < 2; try++) {
7196
7197             for (i = 0; i < maxidx; i++) {
7198                 hostaddr[i] = tlb_vaddr_to_host(env,
7199                                                 vaddr + TARGET_PAGE_SIZE * i,
7200                                                 1, mmu_idx);
7201                 if (!hostaddr[i]) {
7202                     break;
7203                 }
7204             }
7205             if (i == maxidx) {
7206                 /* If it's all in the TLB it's fair game for just writing to;
7207                  * we know we don't need to update dirty status, etc.
7208                  */
7209                 for (i = 0; i < maxidx - 1; i++) {
7210                     memset(hostaddr[i], 0, TARGET_PAGE_SIZE);
7211                 }
7212                 memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE));
7213                 return;
7214             }
7215             /* OK, try a store and see if we can populate the tlb. This
7216              * might cause an exception if the memory isn't writable,
7217              * in which case we will longjmp out of here. We must for
7218              * this purpose use the actual register value passed to us
7219              * so that we get the fault address right.
7220              */
7221             helper_ret_stb_mmu(env, vaddr_in, 0, oi, GETRA());
7222             /* Now we can populate the other TLB entries, if any */
7223             for (i = 0; i < maxidx; i++) {
7224                 uint64_t va = vaddr + TARGET_PAGE_SIZE * i;
7225                 if (va != (vaddr_in & TARGET_PAGE_MASK)) {
7226                     helper_ret_stb_mmu(env, va, 0, oi, GETRA());
7227                 }
7228             }
7229         }
7230
7231         /* Slow path (probably attempt to do this to an I/O device or
7232          * similar, or clearing of a block of code we have translations
7233          * cached for). Just do a series of byte writes as the architecture
7234          * demands. It's not worth trying to use a cpu_physical_memory_map(),
7235          * memset(), unmap() sequence here because:
7236          *  + we'd need to account for the blocksize being larger than a page
7237          *  + the direct-RAM access case is almost always going to be dealt
7238          *    with in the fastpath code above, so there's no speed benefit
7239          *  + we would have to deal with the map returning NULL because the
7240          *    bounce buffer was in use
7241          */
7242         for (i = 0; i < blocklen; i++) {
7243             helper_ret_stb_mmu(env, vaddr + i, 0, oi, GETRA());
7244         }
7245     }
7246 #else
7247     memset(g2h(vaddr), 0, blocklen);
7248 #endif
7249 }
7250
7251 /* Note that signed overflow is undefined in C.  The following routines are
7252    careful to use unsigned types where modulo arithmetic is required.
7253    Failure to do so _will_ break on newer gcc.  */
7254
7255 /* Signed saturating arithmetic.  */
7256
7257 /* Perform 16-bit signed saturating addition.  */
7258 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
7259 {
7260     uint16_t res;
7261
7262     res = a + b;
7263     if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
7264         if (a & 0x8000)
7265             res = 0x8000;
7266         else
7267             res = 0x7fff;
7268     }
7269     return res;
7270 }
7271
7272 /* Perform 8-bit signed saturating addition.  */
7273 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
7274 {
7275     uint8_t res;
7276
7277     res = a + b;
7278     if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
7279         if (a & 0x80)
7280             res = 0x80;
7281         else
7282             res = 0x7f;
7283     }
7284     return res;
7285 }
7286
7287 /* Perform 16-bit signed saturating subtraction.  */
7288 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
7289 {
7290     uint16_t res;
7291
7292     res = a - b;
7293     if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
7294         if (a & 0x8000)
7295             res = 0x8000;
7296         else
7297             res = 0x7fff;
7298     }
7299     return res;
7300 }
7301
7302 /* Perform 8-bit signed saturating subtraction.  */
7303 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
7304 {
7305     uint8_t res;
7306
7307     res = a - b;
7308     if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
7309         if (a & 0x80)
7310             res = 0x80;
7311         else
7312             res = 0x7f;
7313     }
7314     return res;
7315 }
7316
7317 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
7318 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
7319 #define ADD8(a, b, n)  RESULT(add8_sat(a, b), n, 8);
7320 #define SUB8(a, b, n)  RESULT(sub8_sat(a, b), n, 8);
7321 #define PFX q
7322
7323 #include "op_addsub.h"
7324
7325 /* Unsigned saturating arithmetic.  */
7326 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
7327 {
7328     uint16_t res;
7329     res = a + b;
7330     if (res < a)
7331         res = 0xffff;
7332     return res;
7333 }
7334
7335 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
7336 {
7337     if (a > b)
7338         return a - b;
7339     else
7340         return 0;
7341 }
7342
7343 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
7344 {
7345     uint8_t res;
7346     res = a + b;
7347     if (res < a)
7348         res = 0xff;
7349     return res;
7350 }
7351
7352 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
7353 {
7354     if (a > b)
7355         return a - b;
7356     else
7357         return 0;
7358 }
7359
7360 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
7361 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
7362 #define ADD8(a, b, n)  RESULT(add8_usat(a, b), n, 8);
7363 #define SUB8(a, b, n)  RESULT(sub8_usat(a, b), n, 8);
7364 #define PFX uq
7365
7366 #include "op_addsub.h"
7367
7368 /* Signed modulo arithmetic.  */
7369 #define SARITH16(a, b, n, op) do { \
7370     int32_t sum; \
7371     sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
7372     RESULT(sum, n, 16); \
7373     if (sum >= 0) \
7374         ge |= 3 << (n * 2); \
7375     } while(0)
7376
7377 #define SARITH8(a, b, n, op) do { \
7378     int32_t sum; \
7379     sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
7380     RESULT(sum, n, 8); \
7381     if (sum >= 0) \
7382         ge |= 1 << n; \
7383     } while(0)
7384
7385
7386 #define ADD16(a, b, n) SARITH16(a, b, n, +)
7387 #define SUB16(a, b, n) SARITH16(a, b, n, -)
7388 #define ADD8(a, b, n)  SARITH8(a, b, n, +)
7389 #define SUB8(a, b, n)  SARITH8(a, b, n, -)
7390 #define PFX s
7391 #define ARITH_GE
7392
7393 #include "op_addsub.h"
7394
7395 /* Unsigned modulo arithmetic.  */
7396 #define ADD16(a, b, n) do { \
7397     uint32_t sum; \
7398     sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
7399     RESULT(sum, n, 16); \
7400     if ((sum >> 16) == 1) \
7401         ge |= 3 << (n * 2); \
7402     } while(0)
7403
7404 #define ADD8(a, b, n) do { \
7405     uint32_t sum; \
7406     sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
7407     RESULT(sum, n, 8); \
7408     if ((sum >> 8) == 1) \
7409         ge |= 1 << n; \
7410     } while(0)
7411
7412 #define SUB16(a, b, n) do { \
7413     uint32_t sum; \
7414     sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
7415     RESULT(sum, n, 16); \
7416     if ((sum >> 16) == 0) \
7417         ge |= 3 << (n * 2); \
7418     } while(0)
7419
7420 #define SUB8(a, b, n) do { \
7421     uint32_t sum; \
7422     sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
7423     RESULT(sum, n, 8); \
7424     if ((sum >> 8) == 0) \
7425         ge |= 1 << n; \
7426     } while(0)
7427
7428 #define PFX u
7429 #define ARITH_GE
7430
7431 #include "op_addsub.h"
7432
7433 /* Halved signed arithmetic.  */
7434 #define ADD16(a, b, n) \
7435   RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
7436 #define SUB16(a, b, n) \
7437   RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
7438 #define ADD8(a, b, n) \
7439   RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
7440 #define SUB8(a, b, n) \
7441   RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
7442 #define PFX sh
7443
7444 #include "op_addsub.h"
7445
7446 /* Halved unsigned arithmetic.  */
7447 #define ADD16(a, b, n) \
7448   RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
7449 #define SUB16(a, b, n) \
7450   RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
7451 #define ADD8(a, b, n) \
7452   RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
7453 #define SUB8(a, b, n) \
7454   RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
7455 #define PFX uh
7456
7457 #include "op_addsub.h"
7458
7459 static inline uint8_t do_usad(uint8_t a, uint8_t b)
7460 {
7461     if (a > b)
7462         return a - b;
7463     else
7464         return b - a;
7465 }
7466
7467 /* Unsigned sum of absolute byte differences.  */
7468 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
7469 {
7470     uint32_t sum;
7471     sum = do_usad(a, b);
7472     sum += do_usad(a >> 8, b >> 8);
7473     sum += do_usad(a >> 16, b >>16);
7474     sum += do_usad(a >> 24, b >> 24);
7475     return sum;
7476 }
7477
7478 /* For ARMv6 SEL instruction.  */
7479 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
7480 {
7481     uint32_t mask;
7482
7483     mask = 0;
7484     if (flags & 1)
7485         mask |= 0xff;
7486     if (flags & 2)
7487         mask |= 0xff00;
7488     if (flags & 4)
7489         mask |= 0xff0000;
7490     if (flags & 8)
7491         mask |= 0xff000000;
7492     return (a & mask) | (b & ~mask);
7493 }
7494
7495 /* VFP support.  We follow the convention used for VFP instructions:
7496    Single precision routines have a "s" suffix, double precision a
7497    "d" suffix.  */
7498
7499 /* Convert host exception flags to vfp form.  */
7500 static inline int vfp_exceptbits_from_host(int host_bits)
7501 {
7502     int target_bits = 0;
7503
7504     if (host_bits & float_flag_invalid)
7505         target_bits |= 1;
7506     if (host_bits & float_flag_divbyzero)
7507         target_bits |= 2;
7508     if (host_bits & float_flag_overflow)
7509         target_bits |= 4;
7510     if (host_bits & (float_flag_underflow | float_flag_output_denormal))
7511         target_bits |= 8;
7512     if (host_bits & float_flag_inexact)
7513         target_bits |= 0x10;
7514     if (host_bits & float_flag_input_denormal)
7515         target_bits |= 0x80;
7516     return target_bits;
7517 }
7518
7519 uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
7520 {
7521     int i;
7522     uint32_t fpscr;
7523
7524     fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
7525             | (env->vfp.vec_len << 16)
7526             | (env->vfp.vec_stride << 20);
7527     i = get_float_exception_flags(&env->vfp.fp_status);
7528     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
7529     fpscr |= vfp_exceptbits_from_host(i);
7530     return fpscr;
7531 }
7532
7533 uint32_t vfp_get_fpscr(CPUARMState *env)
7534 {
7535     return HELPER(vfp_get_fpscr)(env);
7536 }
7537
7538 /* Convert vfp exception flags to target form.  */
7539 static inline int vfp_exceptbits_to_host(int target_bits)
7540 {
7541     int host_bits = 0;
7542
7543     if (target_bits & 1)
7544         host_bits |= float_flag_invalid;
7545     if (target_bits & 2)
7546         host_bits |= float_flag_divbyzero;
7547     if (target_bits & 4)
7548         host_bits |= float_flag_overflow;
7549     if (target_bits & 8)
7550         host_bits |= float_flag_underflow;
7551     if (target_bits & 0x10)
7552         host_bits |= float_flag_inexact;
7553     if (target_bits & 0x80)
7554         host_bits |= float_flag_input_denormal;
7555     return host_bits;
7556 }
7557
7558 void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
7559 {
7560     int i;
7561     uint32_t changed;
7562
7563     changed = env->vfp.xregs[ARM_VFP_FPSCR];
7564     env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
7565     env->vfp.vec_len = (val >> 16) & 7;
7566     env->vfp.vec_stride = (val >> 20) & 3;
7567
7568     changed ^= val;
7569     if (changed & (3 << 22)) {
7570         i = (val >> 22) & 3;
7571         switch (i) {
7572         case FPROUNDING_TIEEVEN:
7573             i = float_round_nearest_even;
7574             break;
7575         case FPROUNDING_POSINF:
7576             i = float_round_up;
7577             break;
7578         case FPROUNDING_NEGINF:
7579             i = float_round_down;
7580             break;
7581         case FPROUNDING_ZERO:
7582             i = float_round_to_zero;
7583             break;
7584         }
7585         set_float_rounding_mode(i, &env->vfp.fp_status);
7586     }
7587     if (changed & (1 << 24)) {
7588         set_flush_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
7589         set_flush_inputs_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
7590     }
7591     if (changed & (1 << 25))
7592         set_default_nan_mode((val & (1 << 25)) != 0, &env->vfp.fp_status);
7593
7594     i = vfp_exceptbits_to_host(val);
7595     set_float_exception_flags(i, &env->vfp.fp_status);
7596     set_float_exception_flags(0, &env->vfp.standard_fp_status);
7597 }
7598
7599 void vfp_set_fpscr(CPUARMState *env, uint32_t val)
7600 {
7601     HELPER(vfp_set_fpscr)(env, val);
7602 }
7603
7604 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
7605
7606 #define VFP_BINOP(name) \
7607 float32 VFP_HELPER(name, s)(float32 a, float32 b, void *fpstp) \
7608 { \
7609     float_status *fpst = fpstp; \
7610     return float32_ ## name(a, b, fpst); \
7611 } \
7612 float64 VFP_HELPER(name, d)(float64 a, float64 b, void *fpstp) \
7613 { \
7614     float_status *fpst = fpstp; \
7615     return float64_ ## name(a, b, fpst); \
7616 }
7617 VFP_BINOP(add)
7618 VFP_BINOP(sub)
7619 VFP_BINOP(mul)
7620 VFP_BINOP(div)
7621 VFP_BINOP(min)
7622 VFP_BINOP(max)
7623 VFP_BINOP(minnum)
7624 VFP_BINOP(maxnum)
7625 #undef VFP_BINOP
7626
7627 float32 VFP_HELPER(neg, s)(float32 a)
7628 {
7629     return float32_chs(a);
7630 }
7631
7632 float64 VFP_HELPER(neg, d)(float64 a)
7633 {
7634     return float64_chs(a);
7635 }
7636
7637 float32 VFP_HELPER(abs, s)(float32 a)
7638 {
7639     return float32_abs(a);
7640 }
7641
7642 float64 VFP_HELPER(abs, d)(float64 a)
7643 {
7644     return float64_abs(a);
7645 }
7646
7647 float32 VFP_HELPER(sqrt, s)(float32 a, CPUARMState *env)
7648 {
7649     return float32_sqrt(a, &env->vfp.fp_status);
7650 }
7651
7652 float64 VFP_HELPER(sqrt, d)(float64 a, CPUARMState *env)
7653 {
7654     return float64_sqrt(a, &env->vfp.fp_status);
7655 }
7656
7657 /* XXX: check quiet/signaling case */
7658 #define DO_VFP_cmp(p, type) \
7659 void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env)  \
7660 { \
7661     uint32_t flags; \
7662     switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
7663     case 0: flags = 0x6; break; \
7664     case -1: flags = 0x8; break; \
7665     case 1: flags = 0x2; break; \
7666     default: case 2: flags = 0x3; break; \
7667     } \
7668     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
7669         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
7670 } \
7671 void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \
7672 { \
7673     uint32_t flags; \
7674     switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
7675     case 0: flags = 0x6; break; \
7676     case -1: flags = 0x8; break; \
7677     case 1: flags = 0x2; break; \
7678     default: case 2: flags = 0x3; break; \
7679     } \
7680     env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
7681         | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
7682 }
7683 DO_VFP_cmp(s, float32)
7684 DO_VFP_cmp(d, float64)
7685 #undef DO_VFP_cmp
7686
7687 /* Integer to float and float to integer conversions */
7688
7689 #define CONV_ITOF(name, fsz, sign) \
7690     float##fsz HELPER(name)(uint32_t x, void *fpstp) \
7691 { \
7692     float_status *fpst = fpstp; \
7693     return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \
7694 }
7695
7696 #define CONV_FTOI(name, fsz, sign, round) \
7697 uint32_t HELPER(name)(float##fsz x, void *fpstp) \
7698 { \
7699     float_status *fpst = fpstp; \
7700     if (float##fsz##_is_any_nan(x)) { \
7701         float_raise(float_flag_invalid, fpst); \
7702         return 0; \
7703     } \
7704     return float##fsz##_to_##sign##int32##round(x, fpst); \
7705 }
7706
7707 #define FLOAT_CONVS(name, p, fsz, sign) \
7708 CONV_ITOF(vfp_##name##to##p, fsz, sign) \
7709 CONV_FTOI(vfp_to##name##p, fsz, sign, ) \
7710 CONV_FTOI(vfp_to##name##z##p, fsz, sign, _round_to_zero)
7711
7712 FLOAT_CONVS(si, s, 32, )
7713 FLOAT_CONVS(si, d, 64, )
7714 FLOAT_CONVS(ui, s, 32, u)
7715 FLOAT_CONVS(ui, d, 64, u)
7716
7717 #undef CONV_ITOF
7718 #undef CONV_FTOI
7719 #undef FLOAT_CONVS
7720
7721 /* floating point conversion */
7722 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUARMState *env)
7723 {
7724     float64 r = float32_to_float64(x, &env->vfp.fp_status);
7725     /* ARM requires that S<->D conversion of any kind of NaN generates
7726      * a quiet NaN by forcing the most significant frac bit to 1.
7727      */
7728     return float64_maybe_silence_nan(r);
7729 }
7730
7731 float32 VFP_HELPER(fcvts, d)(float64 x, CPUARMState *env)
7732 {
7733     float32 r =  float64_to_float32(x, &env->vfp.fp_status);
7734     /* ARM requires that S<->D conversion of any kind of NaN generates
7735      * a quiet NaN by forcing the most significant frac bit to 1.
7736      */
7737     return float32_maybe_silence_nan(r);
7738 }
7739
7740 /* VFP3 fixed point conversion.  */
7741 #define VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
7742 float##fsz HELPER(vfp_##name##to##p)(uint##isz##_t  x, uint32_t shift, \
7743                                      void *fpstp) \
7744 { \
7745     float_status *fpst = fpstp; \
7746     float##fsz tmp; \
7747     tmp = itype##_to_##float##fsz(x, fpst); \
7748     return float##fsz##_scalbn(tmp, -(int)shift, fpst); \
7749 }
7750
7751 /* Notice that we want only input-denormal exception flags from the
7752  * scalbn operation: the other possible flags (overflow+inexact if
7753  * we overflow to infinity, output-denormal) aren't correct for the
7754  * complete scale-and-convert operation.
7755  */
7756 #define VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, round) \
7757 uint##isz##_t HELPER(vfp_to##name##p##round)(float##fsz x, \
7758                                              uint32_t shift, \
7759                                              void *fpstp) \
7760 { \
7761     float_status *fpst = fpstp; \
7762     int old_exc_flags = get_float_exception_flags(fpst); \
7763     float##fsz tmp; \
7764     if (float##fsz##_is_any_nan(x)) { \
7765         float_raise(float_flag_invalid, fpst); \
7766         return 0; \
7767     } \
7768     tmp = float##fsz##_scalbn(x, shift, fpst); \
7769     old_exc_flags |= get_float_exception_flags(fpst) \
7770         & float_flag_input_denormal; \
7771     set_float_exception_flags(old_exc_flags, fpst); \
7772     return float##fsz##_to_##itype##round(tmp, fpst); \
7773 }
7774
7775 #define VFP_CONV_FIX(name, p, fsz, isz, itype)                   \
7776 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype)                     \
7777 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, _round_to_zero) \
7778 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
7779
7780 #define VFP_CONV_FIX_A64(name, p, fsz, isz, itype)               \
7781 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype)                     \
7782 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
7783
7784 VFP_CONV_FIX(sh, d, 64, 64, int16)
7785 VFP_CONV_FIX(sl, d, 64, 64, int32)
7786 VFP_CONV_FIX_A64(sq, d, 64, 64, int64)
7787 VFP_CONV_FIX(uh, d, 64, 64, uint16)
7788 VFP_CONV_FIX(ul, d, 64, 64, uint32)
7789 VFP_CONV_FIX_A64(uq, d, 64, 64, uint64)
7790 VFP_CONV_FIX(sh, s, 32, 32, int16)
7791 VFP_CONV_FIX(sl, s, 32, 32, int32)
7792 VFP_CONV_FIX_A64(sq, s, 32, 64, int64)
7793 VFP_CONV_FIX(uh, s, 32, 32, uint16)
7794 VFP_CONV_FIX(ul, s, 32, 32, uint32)
7795 VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
7796 #undef VFP_CONV_FIX
7797 #undef VFP_CONV_FIX_FLOAT
7798 #undef VFP_CONV_FLOAT_FIX_ROUND
7799
7800 /* Set the current fp rounding mode and return the old one.
7801  * The argument is a softfloat float_round_ value.
7802  */
7803 uint32_t HELPER(set_rmode)(uint32_t rmode, CPUARMState *env)
7804 {
7805     float_status *fp_status = &env->vfp.fp_status;
7806
7807     uint32_t prev_rmode = get_float_rounding_mode(fp_status);
7808     set_float_rounding_mode(rmode, fp_status);
7809
7810     return prev_rmode;
7811 }
7812
7813 /* Set the current fp rounding mode in the standard fp status and return
7814  * the old one. This is for NEON instructions that need to change the
7815  * rounding mode but wish to use the standard FPSCR values for everything
7816  * else. Always set the rounding mode back to the correct value after
7817  * modifying it.
7818  * The argument is a softfloat float_round_ value.
7819  */
7820 uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env)
7821 {
7822     float_status *fp_status = &env->vfp.standard_fp_status;
7823
7824     uint32_t prev_rmode = get_float_rounding_mode(fp_status);
7825     set_float_rounding_mode(rmode, fp_status);
7826
7827     return prev_rmode;
7828 }
7829
7830 /* Half precision conversions.  */
7831 static float32 do_fcvt_f16_to_f32(uint32_t a, CPUARMState *env, float_status *s)
7832 {
7833     int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7834     float32 r = float16_to_float32(make_float16(a), ieee, s);
7835     if (ieee) {
7836         return float32_maybe_silence_nan(r);
7837     }
7838     return r;
7839 }
7840
7841 static uint32_t do_fcvt_f32_to_f16(float32 a, CPUARMState *env, float_status *s)
7842 {
7843     int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7844     float16 r = float32_to_float16(a, ieee, s);
7845     if (ieee) {
7846         r = float16_maybe_silence_nan(r);
7847     }
7848     return float16_val(r);
7849 }
7850
7851 float32 HELPER(neon_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)
7852 {
7853     return do_fcvt_f16_to_f32(a, env, &env->vfp.standard_fp_status);
7854 }
7855
7856 uint32_t HELPER(neon_fcvt_f32_to_f16)(float32 a, CPUARMState *env)
7857 {
7858     return do_fcvt_f32_to_f16(a, env, &env->vfp.standard_fp_status);
7859 }
7860
7861 float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)
7862 {
7863     return do_fcvt_f16_to_f32(a, env, &env->vfp.fp_status);
7864 }
7865
7866 uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, CPUARMState *env)
7867 {
7868     return do_fcvt_f32_to_f16(a, env, &env->vfp.fp_status);
7869 }
7870
7871 float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, CPUARMState *env)
7872 {
7873     int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7874     float64 r = float16_to_float64(make_float16(a), ieee, &env->vfp.fp_status);
7875     if (ieee) {
7876         return float64_maybe_silence_nan(r);
7877     }
7878     return r;
7879 }
7880
7881 uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, CPUARMState *env)
7882 {
7883     int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7884     float16 r = float64_to_float16(a, ieee, &env->vfp.fp_status);
7885     if (ieee) {
7886         r = float16_maybe_silence_nan(r);
7887     }
7888     return float16_val(r);
7889 }
7890
7891 #define float32_two make_float32(0x40000000)
7892 #define float32_three make_float32(0x40400000)
7893 #define float32_one_point_five make_float32(0x3fc00000)
7894
7895 float32 HELPER(recps_f32)(float32 a, float32 b, CPUARMState *env)
7896 {
7897     float_status *s = &env->vfp.standard_fp_status;
7898     if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
7899         (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
7900         if (!(float32_is_zero(a) || float32_is_zero(b))) {
7901             float_raise(float_flag_input_denormal, s);
7902         }
7903         return float32_two;
7904     }
7905     return float32_sub(float32_two, float32_mul(a, b, s), s);
7906 }
7907
7908 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUARMState *env)
7909 {
7910     float_status *s = &env->vfp.standard_fp_status;
7911     float32 product;
7912     if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
7913         (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
7914         if (!(float32_is_zero(a) || float32_is_zero(b))) {
7915             float_raise(float_flag_input_denormal, s);
7916         }
7917         return float32_one_point_five;
7918     }
7919     product = float32_mul(a, b, s);
7920     return float32_div(float32_sub(float32_three, product, s), float32_two, s);
7921 }
7922
7923 /* NEON helpers.  */
7924
7925 /* Constants 256 and 512 are used in some helpers; we avoid relying on
7926  * int->float conversions at run-time.  */
7927 #define float64_256 make_float64(0x4070000000000000LL)
7928 #define float64_512 make_float64(0x4080000000000000LL)
7929 #define float32_maxnorm make_float32(0x7f7fffff)
7930 #define float64_maxnorm make_float64(0x7fefffffffffffffLL)
7931
7932 /* Reciprocal functions
7933  *
7934  * The algorithm that must be used to calculate the estimate
7935  * is specified by the ARM ARM, see FPRecipEstimate()
7936  */
7937
7938 static float64 recip_estimate(float64 a, float_status *real_fp_status)
7939 {
7940     /* These calculations mustn't set any fp exception flags,
7941      * so we use a local copy of the fp_status.
7942      */
7943     float_status dummy_status = *real_fp_status;
7944     float_status *s = &dummy_status;
7945     /* q = (int)(a * 512.0) */
7946     float64 q = float64_mul(float64_512, a, s);
7947     int64_t q_int = float64_to_int64_round_to_zero(q, s);
7948
7949     /* r = 1.0 / (((double)q + 0.5) / 512.0) */
7950     q = int64_to_float64(q_int, s);
7951     q = float64_add(q, float64_half, s);
7952     q = float64_div(q, float64_512, s);
7953     q = float64_div(float64_one, q, s);
7954
7955     /* s = (int)(256.0 * r + 0.5) */
7956     q = float64_mul(q, float64_256, s);
7957     q = float64_add(q, float64_half, s);
7958     q_int = float64_to_int64_round_to_zero(q, s);
7959
7960     /* return (double)s / 256.0 */
7961     return float64_div(int64_to_float64(q_int, s), float64_256, s);
7962 }
7963
7964 /* Common wrapper to call recip_estimate */
7965 static float64 call_recip_estimate(float64 num, int off, float_status *fpst)
7966 {
7967     uint64_t val64 = float64_val(num);
7968     uint64_t frac = extract64(val64, 0, 52);
7969     int64_t exp = extract64(val64, 52, 11);
7970     uint64_t sbit;
7971     float64 scaled, estimate;
7972
7973     /* Generate the scaled number for the estimate function */
7974     if (exp == 0) {
7975         if (extract64(frac, 51, 1) == 0) {
7976             exp = -1;
7977             frac = extract64(frac, 0, 50) << 2;
7978         } else {
7979             frac = extract64(frac, 0, 51) << 1;
7980         }
7981     }
7982
7983     /* scaled = '0' : '01111111110' : fraction<51:44> : Zeros(44); */
7984     scaled = make_float64((0x3feULL << 52)
7985                           | extract64(frac, 44, 8) << 44);
7986
7987     estimate = recip_estimate(scaled, fpst);
7988
7989     /* Build new result */
7990     val64 = float64_val(estimate);
7991     sbit = 0x8000000000000000ULL & val64;
7992     exp = off - exp;
7993     frac = extract64(val64, 0, 52);
7994
7995     if (exp == 0) {
7996         frac = 1ULL << 51 | extract64(frac, 1, 51);
7997     } else if (exp == -1) {
7998         frac = 1ULL << 50 | extract64(frac, 2, 50);
7999         exp = 0;
8000     }
8001
8002     return make_float64(sbit | (exp << 52) | frac);
8003 }
8004
8005 static bool round_to_inf(float_status *fpst, bool sign_bit)
8006 {
8007     switch (fpst->float_rounding_mode) {
8008     case float_round_nearest_even: /* Round to Nearest */
8009         return true;
8010     case float_round_up: /* Round to +Inf */
8011         return !sign_bit;
8012     case float_round_down: /* Round to -Inf */
8013         return sign_bit;
8014     case float_round_to_zero: /* Round to Zero */
8015         return false;
8016     }
8017
8018     g_assert_not_reached();
8019 }
8020
8021 float32 HELPER(recpe_f32)(float32 input, void *fpstp)
8022 {
8023     float_status *fpst = fpstp;
8024     float32 f32 = float32_squash_input_denormal(input, fpst);
8025     uint32_t f32_val = float32_val(f32);
8026     uint32_t f32_sbit = 0x80000000ULL & f32_val;
8027     int32_t f32_exp = extract32(f32_val, 23, 8);
8028     uint32_t f32_frac = extract32(f32_val, 0, 23);
8029     float64 f64, r64;
8030     uint64_t r64_val;
8031     int64_t r64_exp;
8032     uint64_t r64_frac;
8033
8034     if (float32_is_any_nan(f32)) {
8035         float32 nan = f32;
8036         if (float32_is_signaling_nan(f32)) {
8037             float_raise(float_flag_invalid, fpst);
8038             nan = float32_maybe_silence_nan(f32);
8039         }
8040         if (fpst->default_nan_mode) {
8041             nan =  float32_default_nan;
8042         }
8043         return nan;
8044     } else if (float32_is_infinity(f32)) {
8045         return float32_set_sign(float32_zero, float32_is_neg(f32));
8046     } else if (float32_is_zero(f32)) {
8047         float_raise(float_flag_divbyzero, fpst);
8048         return float32_set_sign(float32_infinity, float32_is_neg(f32));
8049     } else if ((f32_val & ~(1ULL << 31)) < (1ULL << 21)) {
8050         /* Abs(value) < 2.0^-128 */
8051         float_raise(float_flag_overflow | float_flag_inexact, fpst);
8052         if (round_to_inf(fpst, f32_sbit)) {
8053             return float32_set_sign(float32_infinity, float32_is_neg(f32));
8054         } else {
8055             return float32_set_sign(float32_maxnorm, float32_is_neg(f32));
8056         }
8057     } else if (f32_exp >= 253 && fpst->flush_to_zero) {
8058         float_raise(float_flag_underflow, fpst);
8059         return float32_set_sign(float32_zero, float32_is_neg(f32));
8060     }
8061
8062
8063     f64 = make_float64(((int64_t)(f32_exp) << 52) | (int64_t)(f32_frac) << 29);
8064     r64 = call_recip_estimate(f64, 253, fpst);
8065     r64_val = float64_val(r64);
8066     r64_exp = extract64(r64_val, 52, 11);
8067     r64_frac = extract64(r64_val, 0, 52);
8068
8069     /* result = sign : result_exp<7:0> : fraction<51:29>; */
8070     return make_float32(f32_sbit |
8071                         (r64_exp & 0xff) << 23 |
8072                         extract64(r64_frac, 29, 24));
8073 }
8074
8075 float64 HELPER(recpe_f64)(float64 input, void *fpstp)
8076 {
8077     float_status *fpst = fpstp;
8078     float64 f64 = float64_squash_input_denormal(input, fpst);
8079     uint64_t f64_val = float64_val(f64);
8080     uint64_t f64_sbit = 0x8000000000000000ULL & f64_val;
8081     int64_t f64_exp = extract64(f64_val, 52, 11);
8082     float64 r64;
8083     uint64_t r64_val;
8084     int64_t r64_exp;
8085     uint64_t r64_frac;
8086
8087     /* Deal with any special cases */
8088     if (float64_is_any_nan(f64)) {
8089         float64 nan = f64;
8090         if (float64_is_signaling_nan(f64)) {
8091             float_raise(float_flag_invalid, fpst);
8092             nan = float64_maybe_silence_nan(f64);
8093         }
8094         if (fpst->default_nan_mode) {
8095             nan =  float64_default_nan;
8096         }
8097         return nan;
8098     } else if (float64_is_infinity(f64)) {
8099         return float64_set_sign(float64_zero, float64_is_neg(f64));
8100     } else if (float64_is_zero(f64)) {
8101         float_raise(float_flag_divbyzero, fpst);
8102         return float64_set_sign(float64_infinity, float64_is_neg(f64));
8103     } else if ((f64_val & ~(1ULL << 63)) < (1ULL << 50)) {
8104         /* Abs(value) < 2.0^-1024 */
8105         float_raise(float_flag_overflow | float_flag_inexact, fpst);
8106         if (round_to_inf(fpst, f64_sbit)) {
8107             return float64_set_sign(float64_infinity, float64_is_neg(f64));
8108         } else {
8109             return float64_set_sign(float64_maxnorm, float64_is_neg(f64));
8110         }
8111     } else if (f64_exp >= 2045 && fpst->flush_to_zero) {
8112         float_raise(float_flag_underflow, fpst);
8113         return float64_set_sign(float64_zero, float64_is_neg(f64));
8114     }
8115
8116     r64 = call_recip_estimate(f64, 2045, fpst);
8117     r64_val = float64_val(r64);
8118     r64_exp = extract64(r64_val, 52, 11);
8119     r64_frac = extract64(r64_val, 0, 52);
8120
8121     /* result = sign : result_exp<10:0> : fraction<51:0> */
8122     return make_float64(f64_sbit |
8123                         ((r64_exp & 0x7ff) << 52) |
8124                         r64_frac);
8125 }
8126
8127 /* The algorithm that must be used to calculate the estimate
8128  * is specified by the ARM ARM.
8129  */
8130 static float64 recip_sqrt_estimate(float64 a, float_status *real_fp_status)
8131 {
8132     /* These calculations mustn't set any fp exception flags,
8133      * so we use a local copy of the fp_status.
8134      */
8135     float_status dummy_status = *real_fp_status;
8136     float_status *s = &dummy_status;
8137     float64 q;
8138     int64_t q_int;
8139
8140     if (float64_lt(a, float64_half, s)) {
8141         /* range 0.25 <= a < 0.5 */
8142
8143         /* a in units of 1/512 rounded down */
8144         /* q0 = (int)(a * 512.0);  */
8145         q = float64_mul(float64_512, a, s);
8146         q_int = float64_to_int64_round_to_zero(q, s);
8147
8148         /* reciprocal root r */
8149         /* r = 1.0 / sqrt(((double)q0 + 0.5) / 512.0);  */
8150         q = int64_to_float64(q_int, s);
8151         q = float64_add(q, float64_half, s);
8152         q = float64_div(q, float64_512, s);
8153         q = float64_sqrt(q, s);
8154         q = float64_div(float64_one, q, s);
8155     } else {
8156         /* range 0.5 <= a < 1.0 */
8157
8158         /* a in units of 1/256 rounded down */
8159         /* q1 = (int)(a * 256.0); */
8160         q = float64_mul(float64_256, a, s);
8161         int64_t q_int = float64_to_int64_round_to_zero(q, s);
8162
8163         /* reciprocal root r */
8164         /* r = 1.0 /sqrt(((double)q1 + 0.5) / 256); */
8165         q = int64_to_float64(q_int, s);
8166         q = float64_add(q, float64_half, s);
8167         q = float64_div(q, float64_256, s);
8168         q = float64_sqrt(q, s);
8169         q = float64_div(float64_one, q, s);
8170     }
8171     /* r in units of 1/256 rounded to nearest */
8172     /* s = (int)(256.0 * r + 0.5); */
8173
8174     q = float64_mul(q, float64_256,s );
8175     q = float64_add(q, float64_half, s);
8176     q_int = float64_to_int64_round_to_zero(q, s);
8177
8178     /* return (double)s / 256.0;*/
8179     return float64_div(int64_to_float64(q_int, s), float64_256, s);
8180 }
8181
8182 float32 HELPER(rsqrte_f32)(float32 input, void *fpstp)
8183 {
8184     float_status *s = fpstp;
8185     float32 f32 = float32_squash_input_denormal(input, s);
8186     uint32_t val = float32_val(f32);
8187     uint32_t f32_sbit = 0x80000000 & val;
8188     int32_t f32_exp = extract32(val, 23, 8);
8189     uint32_t f32_frac = extract32(val, 0, 23);
8190     uint64_t f64_frac;
8191     uint64_t val64;
8192     int result_exp;
8193     float64 f64;
8194
8195     if (float32_is_any_nan(f32)) {
8196         float32 nan = f32;
8197         if (float32_is_signaling_nan(f32)) {
8198             float_raise(float_flag_invalid, s);
8199             nan = float32_maybe_silence_nan(f32);
8200         }
8201         if (s->default_nan_mode) {
8202             nan =  float32_default_nan;
8203         }
8204         return nan;
8205     } else if (float32_is_zero(f32)) {
8206         float_raise(float_flag_divbyzero, s);
8207         return float32_set_sign(float32_infinity, float32_is_neg(f32));
8208     } else if (float32_is_neg(f32)) {
8209         float_raise(float_flag_invalid, s);
8210         return float32_default_nan;
8211     } else if (float32_is_infinity(f32)) {
8212         return float32_zero;
8213     }
8214
8215     /* Scale and normalize to a double-precision value between 0.25 and 1.0,
8216      * preserving the parity of the exponent.  */
8217
8218     f64_frac = ((uint64_t) f32_frac) << 29;
8219     if (f32_exp == 0) {
8220         while (extract64(f64_frac, 51, 1) == 0) {
8221             f64_frac = f64_frac << 1;
8222             f32_exp = f32_exp-1;
8223         }
8224         f64_frac = extract64(f64_frac, 0, 51) << 1;
8225     }
8226
8227     if (extract64(f32_exp, 0, 1) == 0) {
8228         f64 = make_float64(((uint64_t) f32_sbit) << 32
8229                            | (0x3feULL << 52)
8230                            | f64_frac);
8231     } else {
8232         f64 = make_float64(((uint64_t) f32_sbit) << 32
8233                            | (0x3fdULL << 52)
8234                            | f64_frac);
8235     }
8236
8237     result_exp = (380 - f32_exp) / 2;
8238
8239     f64 = recip_sqrt_estimate(f64, s);
8240
8241     val64 = float64_val(f64);
8242
8243     val = ((result_exp & 0xff) << 23)
8244         | ((val64 >> 29)  & 0x7fffff);
8245     return make_float32(val);
8246 }
8247
8248 float64 HELPER(rsqrte_f64)(float64 input, void *fpstp)
8249 {
8250     float_status *s = fpstp;
8251     float64 f64 = float64_squash_input_denormal(input, s);
8252     uint64_t val = float64_val(f64);
8253     uint64_t f64_sbit = 0x8000000000000000ULL & val;
8254     int64_t f64_exp = extract64(val, 52, 11);
8255     uint64_t f64_frac = extract64(val, 0, 52);
8256     int64_t result_exp;
8257     uint64_t result_frac;
8258
8259     if (float64_is_any_nan(f64)) {
8260         float64 nan = f64;
8261         if (float64_is_signaling_nan(f64)) {
8262             float_raise(float_flag_invalid, s);
8263             nan = float64_maybe_silence_nan(f64);
8264         }
8265         if (s->default_nan_mode) {
8266             nan =  float64_default_nan;
8267         }
8268         return nan;
8269     } else if (float64_is_zero(f64)) {
8270         float_raise(float_flag_divbyzero, s);
8271         return float64_set_sign(float64_infinity, float64_is_neg(f64));
8272     } else if (float64_is_neg(f64)) {
8273         float_raise(float_flag_invalid, s);
8274         return float64_default_nan;
8275     } else if (float64_is_infinity(f64)) {
8276         return float64_zero;
8277     }
8278
8279     /* Scale and normalize to a double-precision value between 0.25 and 1.0,
8280      * preserving the parity of the exponent.  */
8281
8282     if (f64_exp == 0) {
8283         while (extract64(f64_frac, 51, 1) == 0) {
8284             f64_frac = f64_frac << 1;
8285             f64_exp = f64_exp - 1;
8286         }
8287         f64_frac = extract64(f64_frac, 0, 51) << 1;
8288     }
8289
8290     if (extract64(f64_exp, 0, 1) == 0) {
8291         f64 = make_float64(f64_sbit
8292                            | (0x3feULL << 52)
8293                            | f64_frac);
8294     } else {
8295         f64 = make_float64(f64_sbit
8296                            | (0x3fdULL << 52)
8297                            | f64_frac);
8298     }
8299
8300     result_exp = (3068 - f64_exp) / 2;
8301
8302     f64 = recip_sqrt_estimate(f64, s);
8303
8304     result_frac = extract64(float64_val(f64), 0, 52);
8305
8306     return make_float64(f64_sbit |
8307                         ((result_exp & 0x7ff) << 52) |
8308                         result_frac);
8309 }
8310
8311 uint32_t HELPER(recpe_u32)(uint32_t a, void *fpstp)
8312 {
8313     float_status *s = fpstp;
8314     float64 f64;
8315
8316     if ((a & 0x80000000) == 0) {
8317         return 0xffffffff;
8318     }
8319
8320     f64 = make_float64((0x3feULL << 52)
8321                        | ((int64_t)(a & 0x7fffffff) << 21));
8322
8323     f64 = recip_estimate(f64, s);
8324
8325     return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
8326 }
8327
8328 uint32_t HELPER(rsqrte_u32)(uint32_t a, void *fpstp)
8329 {
8330     float_status *fpst = fpstp;
8331     float64 f64;
8332
8333     if ((a & 0xc0000000) == 0) {
8334         return 0xffffffff;
8335     }
8336
8337     if (a & 0x80000000) {
8338         f64 = make_float64((0x3feULL << 52)
8339                            | ((uint64_t)(a & 0x7fffffff) << 21));
8340     } else { /* bits 31-30 == '01' */
8341         f64 = make_float64((0x3fdULL << 52)
8342                            | ((uint64_t)(a & 0x3fffffff) << 22));
8343     }
8344
8345     f64 = recip_sqrt_estimate(f64, fpst);
8346
8347     return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
8348 }
8349
8350 /* VFPv4 fused multiply-accumulate */
8351 float32 VFP_HELPER(muladd, s)(float32 a, float32 b, float32 c, void *fpstp)
8352 {
8353     float_status *fpst = fpstp;
8354     return float32_muladd(a, b, c, 0, fpst);
8355 }
8356
8357 float64 VFP_HELPER(muladd, d)(float64 a, float64 b, float64 c, void *fpstp)
8358 {
8359     float_status *fpst = fpstp;
8360     return float64_muladd(a, b, c, 0, fpst);
8361 }
8362
8363 /* ARMv8 round to integral */
8364 float32 HELPER(rints_exact)(float32 x, void *fp_status)
8365 {
8366     return float32_round_to_int(x, fp_status);
8367 }
8368
8369 float64 HELPER(rintd_exact)(float64 x, void *fp_status)
8370 {
8371     return float64_round_to_int(x, fp_status);
8372 }
8373
8374 float32 HELPER(rints)(float32 x, void *fp_status)
8375 {
8376     int old_flags = get_float_exception_flags(fp_status), new_flags;
8377     float32 ret;
8378
8379     ret = float32_round_to_int(x, fp_status);
8380
8381     /* Suppress any inexact exceptions the conversion produced */
8382     if (!(old_flags & float_flag_inexact)) {
8383         new_flags = get_float_exception_flags(fp_status);
8384         set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
8385     }
8386
8387     return ret;
8388 }
8389
8390 float64 HELPER(rintd)(float64 x, void *fp_status)
8391 {
8392     int old_flags = get_float_exception_flags(fp_status), new_flags;
8393     float64 ret;
8394
8395     ret = float64_round_to_int(x, fp_status);
8396
8397     new_flags = get_float_exception_flags(fp_status);
8398
8399     /* Suppress any inexact exceptions the conversion produced */
8400     if (!(old_flags & float_flag_inexact)) {
8401         new_flags = get_float_exception_flags(fp_status);
8402         set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
8403     }
8404
8405     return ret;
8406 }
8407
8408 /* Convert ARM rounding mode to softfloat */
8409 int arm_rmode_to_sf(int rmode)
8410 {
8411     switch (rmode) {
8412     case FPROUNDING_TIEAWAY:
8413         rmode = float_round_ties_away;
8414         break;
8415     case FPROUNDING_ODD:
8416         /* FIXME: add support for TIEAWAY and ODD */
8417         qemu_log_mask(LOG_UNIMP, "arm: unimplemented rounding mode: %d\n",
8418                       rmode);
8419     case FPROUNDING_TIEEVEN:
8420     default:
8421         rmode = float_round_nearest_even;
8422         break;
8423     case FPROUNDING_POSINF:
8424         rmode = float_round_up;
8425         break;
8426     case FPROUNDING_NEGINF:
8427         rmode = float_round_down;
8428         break;
8429     case FPROUNDING_ZERO:
8430         rmode = float_round_to_zero;
8431         break;
8432     }
8433     return rmode;
8434 }
8435
8436 /* CRC helpers.
8437  * The upper bytes of val (above the number specified by 'bytes') must have
8438  * been zeroed out by the caller.
8439  */
8440 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes)
8441 {
8442     uint8_t buf[4];
8443
8444     stl_le_p(buf, val);
8445
8446     /* zlib crc32 converts the accumulator and output to one's complement.  */
8447     return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff;
8448 }
8449
8450 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
8451 {
8452     uint8_t buf[4];
8453
8454     stl_le_p(buf, val);
8455
8456     /* Linux crc32c converts the output to one's complement.  */
8457     return crc32c(acc, buf, bytes) ^ 0xffffffff;
8458 }