?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
target-arm: Implement missing AMAIR registers
[qemu/cris-port.git] / target-arm / helper.c
blob54f99aeb840867bbce5b8ad0ba4ec2478760415b
1 #include "cpu.h"
2 #include "internals.h"
3 #include "exec/gdbstub.h"
4 #include "exec/helper-proto.h"
5 #include "qemu/host-utils.h"
6 #include "sysemu/arch_init.h"
7 #include "sysemu/sysemu.h"
8 #include "qemu/bitops.h"
9 #include "qemu/crc32c.h"
10 #include "exec/cpu_ldst.h"
11 #include "arm_ldst.h"
12 #include <zlib.h> /* For crc32 */
13 #include "exec/semihost.h"
14
15 #ifndef CONFIG_USER_ONLY
16 static inline bool get_phys_addr(CPUARMState *env, target_ulong address,
17 int access_type, ARMMMUIdx mmu_idx,
18 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
19 target_ulong *page_size, uint32_t *fsr);
20
21 /* Definitions for the PMCCNTR and PMCR registers */
22 #define PMCRD 0x8
23 #define PMCRC 0x4
24 #define PMCRE 0x1
25 #endif
26
27 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
28 {
29 int nregs;
30
31 /* VFP data registers are always little-endian. */
32 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
33 if (reg < nregs) {
34 stfq_le_p(buf, env->vfp.regs[reg]);
35 return 8;
36 }
37 if (arm_feature(env, ARM_FEATURE_NEON)) {
38 /* Aliases for Q regs. */
39 nregs += 16;
40 if (reg < nregs) {
41 stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
42 stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
43 return 16;
44 }
45 }
46 switch (reg - nregs) {
47 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
48 case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
49 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
50 }
51 return 0;
52 }
53
54 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
55 {
56 int nregs;
57
58 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
59 if (reg < nregs) {
60 env->vfp.regs[reg] = ldfq_le_p(buf);
61 return 8;
62 }
63 if (arm_feature(env, ARM_FEATURE_NEON)) {
64 nregs += 16;
65 if (reg < nregs) {
66 env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
67 env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
68 return 16;
69 }
70 }
71 switch (reg - nregs) {
72 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
73 case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
74 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
75 }
76 return 0;
77 }
78
79 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
80 {
81 switch (reg) {
82 case 0 ... 31:
83 /* 128 bit FP register */
84 stfq_le_p(buf, env->vfp.regs[reg * 2]);
85 stfq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
86 return 16;
87 case 32:
88 /* FPSR */
89 stl_p(buf, vfp_get_fpsr(env));
90 return 4;
91 case 33:
92 /* FPCR */
93 stl_p(buf, vfp_get_fpcr(env));
94 return 4;
95 default:
96 return 0;
97 }
98 }
99
100 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
101 {
102 switch (reg) {
103 case 0 ... 31:
104 /* 128 bit FP register */
105 env->vfp.regs[reg * 2] = ldfq_le_p(buf);
106 env->vfp.regs[reg * 2 + 1] = ldfq_le_p(buf + 8);
107 return 16;
108 case 32:
109 /* FPSR */
110 vfp_set_fpsr(env, ldl_p(buf));
111 return 4;
112 case 33:
113 /* FPCR */
114 vfp_set_fpcr(env, ldl_p(buf));
115 return 4;
116 default:
117 return 0;
118 }
119 }
120
121 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
122 {
123 assert(ri->fieldoffset);
124 if (cpreg_field_is_64bit(ri)) {
125 return CPREG_FIELD64(env, ri);
126 } else {
127 return CPREG_FIELD32(env, ri);
128 }
129 }
130
131 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
132 uint64_t value)
133 {
134 assert(ri->fieldoffset);
135 if (cpreg_field_is_64bit(ri)) {
136 CPREG_FIELD64(env, ri) = value;
137 } else {
138 CPREG_FIELD32(env, ri) = value;
139 }
140 }
141
142 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri)
143 {
144 return (char *)env + ri->fieldoffset;
145 }
146
147 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
148 {
149 /* Raw read of a coprocessor register (as needed for migration, etc). */
150 if (ri->type & ARM_CP_CONST) {
151 return ri->resetvalue;
152 } else if (ri->raw_readfn) {
153 return ri->raw_readfn(env, ri);
154 } else if (ri->readfn) {
155 return ri->readfn(env, ri);
156 } else {
157 return raw_read(env, ri);
158 }
159 }
160
161 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
162 uint64_t v)
163 {
164 /* Raw write of a coprocessor register (as needed for migration, etc).
165 * Note that constant registers are treated as write-ignored; the
166 * caller should check for success by whether a readback gives the
167 * value written.
168 */
169 if (ri->type & ARM_CP_CONST) {
170 return;
171 } else if (ri->raw_writefn) {
172 ri->raw_writefn(env, ri, v);
173 } else if (ri->writefn) {
174 ri->writefn(env, ri, v);
175 } else {
176 raw_write(env, ri, v);
177 }
178 }
179
180 static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
181 {
182 /* Return true if the regdef would cause an assertion if you called
183 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
184 * program bug for it not to have the NO_RAW flag).
185 * NB that returning false here doesn't necessarily mean that calling
186 * read/write_raw_cp_reg() is safe, because we can't distinguish "has
187 * read/write access functions which are safe for raw use" from "has
188 * read/write access functions which have side effects but has forgotten
189 * to provide raw access functions".
190 * The tests here line up with the conditions in read/write_raw_cp_reg()
191 * and assertions in raw_read()/raw_write().
192 */
193 if ((ri->type & ARM_CP_CONST) ||
194 ri->fieldoffset ||
195 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) {
196 return false;
197 }
198 return true;
199 }
200
201 bool write_cpustate_to_list(ARMCPU *cpu)
202 {
203 /* Write the coprocessor state from cpu->env to the (index,value) list. */
204 int i;
205 bool ok = true;
206
207 for (i = 0; i < cpu->cpreg_array_len; i++) {
208 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
209 const ARMCPRegInfo *ri;
210
211 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
212 if (!ri) {
213 ok = false;
214 continue;
215 }
216 if (ri->type & ARM_CP_NO_RAW) {
217 continue;
218 }
219 cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
220 }
221 return ok;
222 }
223
224 bool write_list_to_cpustate(ARMCPU *cpu)
225 {
226 int i;
227 bool ok = true;
228
229 for (i = 0; i < cpu->cpreg_array_len; i++) {
230 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
231 uint64_t v = cpu->cpreg_values[i];
232 const ARMCPRegInfo *ri;
233
234 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
235 if (!ri) {
236 ok = false;
237 continue;
238 }
239 if (ri->type & ARM_CP_NO_RAW) {
240 continue;
241 }
242 /* Write value and confirm it reads back as written
243 * (to catch read-only registers and partially read-only
244 * registers where the incoming migration value doesn't match)
245 */
246 write_raw_cp_reg(&cpu->env, ri, v);
247 if (read_raw_cp_reg(&cpu->env, ri) != v) {
248 ok = false;
249 }
250 }
251 return ok;
252 }
253
254 static void add_cpreg_to_list(gpointer key, gpointer opaque)
255 {
256 ARMCPU *cpu = opaque;
257 uint64_t regidx;
258 const ARMCPRegInfo *ri;
259
260 regidx = *(uint32_t *)key;
261 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
262
263 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
264 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
265 /* The value array need not be initialized at this point */
266 cpu->cpreg_array_len++;
267 }
268 }
269
270 static void count_cpreg(gpointer key, gpointer opaque)
271 {
272 ARMCPU *cpu = opaque;
273 uint64_t regidx;
274 const ARMCPRegInfo *ri;
275
276 regidx = *(uint32_t *)key;
277 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
278
279 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
280 cpu->cpreg_array_len++;
281 }
282 }
283
284 static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
285 {
286 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
287 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
288
289 if (aidx > bidx) {
290 return 1;
291 }
292 if (aidx < bidx) {
293 return -1;
294 }
295 return 0;
296 }
297
298 void init_cpreg_list(ARMCPU *cpu)
299 {
300 /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
301 * Note that we require cpreg_tuples[] to be sorted by key ID.
302 */
303 GList *keys;
304 int arraylen;
305
306 keys = g_hash_table_get_keys(cpu->cp_regs);
307 keys = g_list_sort(keys, cpreg_key_compare);
308
309 cpu->cpreg_array_len = 0;
310
311 g_list_foreach(keys, count_cpreg, cpu);
312
313 arraylen = cpu->cpreg_array_len;
314 cpu->cpreg_indexes = g_new(uint64_t, arraylen);
315 cpu->cpreg_values = g_new(uint64_t, arraylen);
316 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
317 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
318 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
319 cpu->cpreg_array_len = 0;
320
321 g_list_foreach(keys, add_cpreg_to_list, cpu);
322
323 assert(cpu->cpreg_array_len == arraylen);
324
325 g_list_free(keys);
326 }
327
328 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
329 {
330 ARMCPU *cpu = arm_env_get_cpu(env);
331
332 raw_write(env, ri, value);
333 tlb_flush(CPU(cpu), 1); /* Flush TLB as domain not tracked in TLB */
334 }
335
336 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
337 {
338 ARMCPU *cpu = arm_env_get_cpu(env);
339
340 if (raw_read(env, ri) != value) {
341 /* Unlike real hardware the qemu TLB uses virtual addresses,
342 * not modified virtual addresses, so this causes a TLB flush.
343 */
344 tlb_flush(CPU(cpu), 1);
345 raw_write(env, ri, value);
346 }
347 }
348
349 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
350 uint64_t value)
351 {
352 ARMCPU *cpu = arm_env_get_cpu(env);
353
354 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_MPU)
355 && !extended_addresses_enabled(env)) {
356 /* For VMSA (when not using the LPAE long descriptor page table
357 * format) this register includes the ASID, so do a TLB flush.
358 * For PMSA it is purely a process ID and no action is needed.
359 */
360 tlb_flush(CPU(cpu), 1);
361 }
362 raw_write(env, ri, value);
363 }
364
365 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,
366 uint64_t value)
367 {
368 /* Invalidate all (TLBIALL) */
369 ARMCPU *cpu = arm_env_get_cpu(env);
370
371 tlb_flush(CPU(cpu), 1);
372 }
373
374 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,
375 uint64_t value)
376 {
377 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
378 ARMCPU *cpu = arm_env_get_cpu(env);
379
380 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
381 }
382
383 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,
384 uint64_t value)
385 {
386 /* Invalidate by ASID (TLBIASID) */
387 ARMCPU *cpu = arm_env_get_cpu(env);
388
389 tlb_flush(CPU(cpu), value == 0);
390 }
391
392 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
393 uint64_t value)
394 {
395 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
396 ARMCPU *cpu = arm_env_get_cpu(env);
397
398 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
399 }
400
401 /* IS variants of TLB operations must affect all cores */
402 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
403 uint64_t value)
404 {
405 CPUState *other_cs;
406
407 CPU_FOREACH(other_cs) {
408 tlb_flush(other_cs, 1);
409 }
410 }
411
412 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
413 uint64_t value)
414 {
415 CPUState *other_cs;
416
417 CPU_FOREACH(other_cs) {
418 tlb_flush(other_cs, value == 0);
419 }
420 }
421
422 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
423 uint64_t value)
424 {
425 CPUState *other_cs;
426
427 CPU_FOREACH(other_cs) {
428 tlb_flush_page(other_cs, value & TARGET_PAGE_MASK);
429 }
430 }
431
432 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
433 uint64_t value)
434 {
435 CPUState *other_cs;
436
437 CPU_FOREACH(other_cs) {
438 tlb_flush_page(other_cs, value & TARGET_PAGE_MASK);
439 }
440 }
441
442 static const ARMCPRegInfo cp_reginfo[] = {
443 /* Define the secure and non-secure FCSE identifier CP registers
444 * separately because there is no secure bank in V8 (no _EL3). This allows
445 * the secure register to be properly reset and migrated. There is also no
446 * v8 EL1 version of the register so the non-secure instance stands alone.
447 */
448 { .name = "FCSEIDR(NS)",
449 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
450 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
451 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns),
452 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
453 { .name = "FCSEIDR(S)",
454 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
455 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
456 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s),
457 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
458 /* Define the secure and non-secure context identifier CP registers
459 * separately because there is no secure bank in V8 (no _EL3). This allows
460 * the secure register to be properly reset and migrated. In the
461 * non-secure case, the 32-bit register will have reset and migration
462 * disabled during registration as it is handled by the 64-bit instance.
463 */
464 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH,
465 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
466 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
467 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]),
468 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
469 { .name = "CONTEXTIDR(S)", .state = ARM_CP_STATE_AA32,
470 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
471 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
472 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s),
473 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
474 REGINFO_SENTINEL
475 };
476
477 static const ARMCPRegInfo not_v8_cp_reginfo[] = {
478 /* NB: Some of these registers exist in v8 but with more precise
479 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
480 */
481 /* MMU Domain access control / MPU write buffer control */
482 { .name = "DACR",
483 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY,
484 .access = PL1_RW, .resetvalue = 0,
485 .writefn = dacr_write, .raw_writefn = raw_write,
486 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
487 offsetoflow32(CPUARMState, cp15.dacr_ns) } },
488 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs.
489 * For v6 and v5, these mappings are overly broad.
490 */
491 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0,
492 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
493 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1,
494 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
495 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4,
496 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
497 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8,
498 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
499 /* Cache maintenance ops; some of this space may be overridden later. */
500 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
501 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
502 .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
503 REGINFO_SENTINEL
504 };
505
506 static const ARMCPRegInfo not_v6_cp_reginfo[] = {
507 /* Not all pre-v6 cores implemented this WFI, so this is slightly
508 * over-broad.
509 */
510 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
511 .access = PL1_W, .type = ARM_CP_WFI },
512 REGINFO_SENTINEL
513 };
514
515 static const ARMCPRegInfo not_v7_cp_reginfo[] = {
516 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
517 * is UNPREDICTABLE; we choose to NOP as most implementations do).
518 */
519 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
520 .access = PL1_W, .type = ARM_CP_WFI },
521 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice
522 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
523 * OMAPCP will override this space.
524 */
525 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
526 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
527 .resetvalue = 0 },
528 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
529 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
530 .resetvalue = 0 },
531 /* v6 doesn't have the cache ID registers but Linux reads them anyway */
532 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
533 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
534 .resetvalue = 0 },
535 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
536 * implementing it as RAZ means the "debug architecture version" bits
537 * will read as a reserved value, which should cause Linux to not try
538 * to use the debug hardware.
539 */
540 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
541 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
542 /* MMU TLB control. Note that the wildcarding means we cover not just
543 * the unified TLB ops but also the dside/iside/inner-shareable variants.
544 */
545 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
546 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
547 .type = ARM_CP_NO_RAW },
548 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
549 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
550 .type = ARM_CP_NO_RAW },
551 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
552 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
553 .type = ARM_CP_NO_RAW },
554 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
555 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
556 .type = ARM_CP_NO_RAW },
557 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2,
558 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP },
559 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2,
560 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP },
561 REGINFO_SENTINEL
562 };
563
564 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
565 uint64_t value)
566 {
567 uint32_t mask = 0;
568
569 /* In ARMv8 most bits of CPACR_EL1 are RES0. */
570 if (!arm_feature(env, ARM_FEATURE_V8)) {
571 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
572 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
573 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
574 */
575 if (arm_feature(env, ARM_FEATURE_VFP)) {
576 /* VFP coprocessor: cp10 & cp11 [23:20] */
577 mask |= (1 << 31) | (1 << 30) | (0xf << 20);
578
579 if (!arm_feature(env, ARM_FEATURE_NEON)) {
580 /* ASEDIS [31] bit is RAO/WI */
581 value |= (1 << 31);
582 }
583
584 /* VFPv3 and upwards with NEON implement 32 double precision
585 * registers (D0-D31).
586 */
587 if (!arm_feature(env, ARM_FEATURE_NEON) ||
588 !arm_feature(env, ARM_FEATURE_VFP3)) {
589 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
590 value |= (1 << 30);
591 }
592 }
593 value &= mask;
594 }
595 env->cp15.cpacr_el1 = value;
596 }
597
598 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri)
599 {
600 if (arm_feature(env, ARM_FEATURE_V8)) {
601 /* Check if CPACR accesses are to be trapped to EL2 */
602 if (arm_current_el(env) == 1 &&
603 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) {
604 return CP_ACCESS_TRAP_EL2;
605 /* Check if CPACR accesses are to be trapped to EL3 */
606 } else if (arm_current_el(env) < 3 &&
607 (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
608 return CP_ACCESS_TRAP_EL3;
609 }
610 }
611
612 return CP_ACCESS_OK;
613 }
614
615 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri)
616 {
617 /* Check if CPTR accesses are set to trap to EL3 */
618 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
619 return CP_ACCESS_TRAP_EL3;
620 }
621
622 return CP_ACCESS_OK;
623 }
624
625 static const ARMCPRegInfo v6_cp_reginfo[] = {
626 /* prefetch by MVA in v6, NOP in v7 */
627 { .name = "MVA_prefetch",
628 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
629 .access = PL1_W, .type = ARM_CP_NOP },
630 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
631 .access = PL0_W, .type = ARM_CP_NOP },
632 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
633 .access = PL0_W, .type = ARM_CP_NOP },
634 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
635 .access = PL0_W, .type = ARM_CP_NOP },
636 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
637 .access = PL1_RW,
638 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s),
639 offsetof(CPUARMState, cp15.ifar_ns) },
640 .resetvalue = 0, },
641 /* Watchpoint Fault Address Register : should actually only be present
642 * for 1136, 1176, 11MPCore.
643 */
644 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
645 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
646 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
647 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
648 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
649 .resetvalue = 0, .writefn = cpacr_write },
650 REGINFO_SENTINEL
651 };
652
653 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri)
654 {
655 /* Performance monitor registers user accessibility is controlled
656 * by PMUSERENR.
657 */
658 if (arm_current_el(env) == 0 && !env->cp15.c9_pmuserenr) {
659 return CP_ACCESS_TRAP;
660 }
661 return CP_ACCESS_OK;
662 }
663
664 #ifndef CONFIG_USER_ONLY
665
666 static inline bool arm_ccnt_enabled(CPUARMState *env)
667 {
668 /* This does not support checking PMCCFILTR_EL0 register */
669
670 if (!(env->cp15.c9_pmcr & PMCRE)) {
671 return false;
672 }
673
674 return true;
675 }
676
677 void pmccntr_sync(CPUARMState *env)
678 {
679 uint64_t temp_ticks;
680
681 temp_ticks = muldiv64(qemu_clock_get_us(QEMU_CLOCK_VIRTUAL),
682 get_ticks_per_sec(), 1000000);
683
684 if (env->cp15.c9_pmcr & PMCRD) {
685 /* Increment once every 64 processor clock cycles */
686 temp_ticks /= 64;
687 }
688
689 if (arm_ccnt_enabled(env)) {
690 env->cp15.c15_ccnt = temp_ticks - env->cp15.c15_ccnt;
691 }
692 }
693
694 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
695 uint64_t value)
696 {
697 pmccntr_sync(env);
698
699 if (value & PMCRC) {
700 /* The counter has been reset */
701 env->cp15.c15_ccnt = 0;
702 }
703
704 /* only the DP, X, D and E bits are writable */
705 env->cp15.c9_pmcr &= ~0x39;
706 env->cp15.c9_pmcr |= (value & 0x39);
707
708 pmccntr_sync(env);
709 }
710
711 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
712 {
713 uint64_t total_ticks;
714
715 if (!arm_ccnt_enabled(env)) {
716 /* Counter is disabled, do not change value */
717 return env->cp15.c15_ccnt;
718 }
719
720 total_ticks = muldiv64(qemu_clock_get_us(QEMU_CLOCK_VIRTUAL),
721 get_ticks_per_sec(), 1000000);
722
723 if (env->cp15.c9_pmcr & PMCRD) {
724 /* Increment once every 64 processor clock cycles */
725 total_ticks /= 64;
726 }
727 return total_ticks - env->cp15.c15_ccnt;
728 }
729
730 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
731 uint64_t value)
732 {
733 uint64_t total_ticks;
734
735 if (!arm_ccnt_enabled(env)) {
736 /* Counter is disabled, set the absolute value */
737 env->cp15.c15_ccnt = value;
738 return;
739 }
740
741 total_ticks = muldiv64(qemu_clock_get_us(QEMU_CLOCK_VIRTUAL),
742 get_ticks_per_sec(), 1000000);
743
744 if (env->cp15.c9_pmcr & PMCRD) {
745 /* Increment once every 64 processor clock cycles */
746 total_ticks /= 64;
747 }
748 env->cp15.c15_ccnt = total_ticks - value;
749 }
750
751 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
752 uint64_t value)
753 {
754 uint64_t cur_val = pmccntr_read(env, NULL);
755
756 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
757 }
758
759 #else /* CONFIG_USER_ONLY */
760
761 void pmccntr_sync(CPUARMState *env)
762 {
763 }
764
765 #endif
766
767 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
768 uint64_t value)
769 {
770 pmccntr_sync(env);
771 env->cp15.pmccfiltr_el0 = value & 0x7E000000;
772 pmccntr_sync(env);
773 }
774
775 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
776 uint64_t value)
777 {
778 value &= (1 << 31);
779 env->cp15.c9_pmcnten |= value;
780 }
781
782 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
783 uint64_t value)
784 {
785 value &= (1 << 31);
786 env->cp15.c9_pmcnten &= ~value;
787 }
788
789 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
790 uint64_t value)
791 {
792 env->cp15.c9_pmovsr &= ~value;
793 }
794
795 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
796 uint64_t value)
797 {
798 env->cp15.c9_pmxevtyper = value & 0xff;
799 }
800
801 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
802 uint64_t value)
803 {
804 env->cp15.c9_pmuserenr = value & 1;
805 }
806
807 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
808 uint64_t value)
809 {
810 /* We have no event counters so only the C bit can be changed */
811 value &= (1 << 31);
812 env->cp15.c9_pminten |= value;
813 }
814
815 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
816 uint64_t value)
817 {
818 value &= (1 << 31);
819 env->cp15.c9_pminten &= ~value;
820 }
821
822 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
823 uint64_t value)
824 {
825 /* Note that even though the AArch64 view of this register has bits
826 * [10:0] all RES0 we can only mask the bottom 5, to comply with the
827 * architectural requirements for bits which are RES0 only in some
828 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
829 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
830 */
831 raw_write(env, ri, value & ~0x1FULL);
832 }
833
834 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
835 {
836 /* We only mask off bits that are RES0 both for AArch64 and AArch32.
837 * For bits that vary between AArch32/64, code needs to check the
838 * current execution mode before directly using the feature bit.
839 */
840 uint32_t valid_mask = SCR_AARCH64_MASK | SCR_AARCH32_MASK;
841
842 if (!arm_feature(env, ARM_FEATURE_EL2)) {
843 valid_mask &= ~SCR_HCE;
844
845 /* On ARMv7, SMD (or SCD as it is called in v7) is only
846 * supported if EL2 exists. The bit is UNK/SBZP when
847 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero
848 * when EL2 is unavailable.
849 * On ARMv8, this bit is always available.
850 */
851 if (arm_feature(env, ARM_FEATURE_V7) &&
852 !arm_feature(env, ARM_FEATURE_V8)) {
853 valid_mask &= ~SCR_SMD;
854 }
855 }
856
857 /* Clear all-context RES0 bits. */
858 value &= valid_mask;
859 raw_write(env, ri, value);
860 }
861
862 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
863 {
864 ARMCPU *cpu = arm_env_get_cpu(env);
865
866 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR
867 * bank
868 */
869 uint32_t index = A32_BANKED_REG_GET(env, csselr,
870 ri->secure & ARM_CP_SECSTATE_S);
871
872 return cpu->ccsidr[index];
873 }
874
875 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
876 uint64_t value)
877 {
878 raw_write(env, ri, value & 0xf);
879 }
880
881 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
882 {
883 CPUState *cs = ENV_GET_CPU(env);
884 uint64_t ret = 0;
885
886 if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
887 ret |= CPSR_I;
888 }
889 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
890 ret |= CPSR_F;
891 }
892 /* External aborts are not possible in QEMU so A bit is always clear */
893 return ret;
894 }
895
896 static const ARMCPRegInfo v7_cp_reginfo[] = {
897 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
898 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
899 .access = PL1_W, .type = ARM_CP_NOP },
900 /* Performance monitors are implementation defined in v7,
901 * but with an ARM recommended set of registers, which we
902 * follow (although we don't actually implement any counters)
903 *
904 * Performance registers fall into three categories:
905 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
906 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
907 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
908 * For the cases controlled by PMUSERENR we must set .access to PL0_RW
909 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
910 */
911 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
912 .access = PL0_RW, .type = ARM_CP_ALIAS,
913 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
914 .writefn = pmcntenset_write,
915 .accessfn = pmreg_access,
916 .raw_writefn = raw_write },
917 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64,
918 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
919 .access = PL0_RW, .accessfn = pmreg_access,
920 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
921 .writefn = pmcntenset_write, .raw_writefn = raw_write },
922 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
923 .access = PL0_RW,
924 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
925 .accessfn = pmreg_access,
926 .writefn = pmcntenclr_write,
927 .type = ARM_CP_ALIAS },
928 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
929 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
930 .access = PL0_RW, .accessfn = pmreg_access,
931 .type = ARM_CP_ALIAS,
932 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
933 .writefn = pmcntenclr_write },
934 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
935 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
936 .accessfn = pmreg_access,
937 .writefn = pmovsr_write,
938 .raw_writefn = raw_write },
939 /* Unimplemented so WI. */
940 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
941 .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP },
942 /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.
943 * We choose to RAZ/WI.
944 */
945 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
946 .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
947 .accessfn = pmreg_access },
948 #ifndef CONFIG_USER_ONLY
949 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
950 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
951 .readfn = pmccntr_read, .writefn = pmccntr_write32,
952 .accessfn = pmreg_access },
953 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
954 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
955 .access = PL0_RW, .accessfn = pmreg_access,
956 .type = ARM_CP_IO,
957 .readfn = pmccntr_read, .writefn = pmccntr_write, },
958 #endif
959 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
960 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
961 .writefn = pmccfiltr_write,
962 .access = PL0_RW, .accessfn = pmreg_access,
963 .type = ARM_CP_IO,
964 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
965 .resetvalue = 0, },
966 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
967 .access = PL0_RW,
968 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
969 .accessfn = pmreg_access, .writefn = pmxevtyper_write,
970 .raw_writefn = raw_write },
971 /* Unimplemented, RAZ/WI. */
972 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
973 .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
974 .accessfn = pmreg_access },
975 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
976 .access = PL0_R | PL1_RW,
977 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
978 .resetvalue = 0,
979 .writefn = pmuserenr_write, .raw_writefn = raw_write },
980 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
981 .access = PL1_RW,
982 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
983 .resetvalue = 0,
984 .writefn = pmintenset_write, .raw_writefn = raw_write },
985 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
986 .access = PL1_RW, .type = ARM_CP_ALIAS,
987 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
988 .writefn = pmintenclr_write, },
989 { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
990 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
991 .access = PL1_RW, .writefn = vbar_write,
992 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s),
993 offsetof(CPUARMState, cp15.vbar_ns) },
994 .resetvalue = 0 },
995 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
996 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
997 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_RAW },
998 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
999 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
1000 .access = PL1_RW, .writefn = csselr_write, .resetvalue = 0,
1001 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s),
1002 offsetof(CPUARMState, cp15.csselr_ns) } },
1003 /* Auxiliary ID register: this actually has an IMPDEF value but for now
1004 * just RAZ for all cores:
1005 */
1006 { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
1007 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
1008 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
1009 /* Auxiliary fault status registers: these also are IMPDEF, and we
1010 * choose to RAZ/WI for all cores.
1011 */
1012 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
1013 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
1014 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
1015 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
1016 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
1017 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
1018 /* MAIR can just read-as-written because we don't implement caches
1019 * and so don't need to care about memory attributes.
1020 */
1021 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
1022 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
1023 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]),
1024 .resetvalue = 0 },
1025 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64,
1026 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0,
1027 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]),
1028 .resetvalue = 0 },
1029 /* For non-long-descriptor page tables these are PRRR and NMRR;
1030 * regardless they still act as reads-as-written for QEMU.
1031 */
1032 /* MAIR0/1 are defined separately from their 64-bit counterpart which
1033 * allows them to assign the correct fieldoffset based on the endianness
1034 * handled in the field definitions.
1035 */
1036 { .name = "MAIR0", .state = ARM_CP_STATE_AA32,
1037 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW,
1038 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s),
1039 offsetof(CPUARMState, cp15.mair0_ns) },
1040 .resetfn = arm_cp_reset_ignore },
1041 { .name = "MAIR1", .state = ARM_CP_STATE_AA32,
1042 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW,
1043 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s),
1044 offsetof(CPUARMState, cp15.mair1_ns) },
1045 .resetfn = arm_cp_reset_ignore },
1046 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
1047 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
1048 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read },
1049 /* 32 bit ITLB invalidates */
1050 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0,
1051 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1052 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
1053 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1054 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2,
1055 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1056 /* 32 bit DTLB invalidates */
1057 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0,
1058 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1059 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
1060 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1061 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2,
1062 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1063 /* 32 bit TLB invalidates */
1064 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
1065 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1066 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
1067 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1068 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
1069 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1070 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
1071 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
1072 REGINFO_SENTINEL
1073 };
1074
1075 static const ARMCPRegInfo v7mp_cp_reginfo[] = {
1076 /* 32 bit TLB invalidates, Inner Shareable */
1077 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
1078 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write },
1079 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
1080 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
1081 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
1082 .type = ARM_CP_NO_RAW, .access = PL1_W,
1083 .writefn = tlbiasid_is_write },
1084 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
1085 .type = ARM_CP_NO_RAW, .access = PL1_W,
1086 .writefn = tlbimvaa_is_write },
1087 REGINFO_SENTINEL
1088 };
1089
1090 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1091 uint64_t value)
1092 {
1093 value &= 1;
1094 env->teecr = value;
1095 }
1096
1097 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri)
1098 {
1099 if (arm_current_el(env) == 0 && (env->teecr & 1)) {
1100 return CP_ACCESS_TRAP;
1101 }
1102 return CP_ACCESS_OK;
1103 }
1104
1105 static const ARMCPRegInfo t2ee_cp_reginfo[] = {
1106 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
1107 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
1108 .resetvalue = 0,
1109 .writefn = teecr_write },
1110 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
1111 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
1112 .accessfn = teehbr_access, .resetvalue = 0 },
1113 REGINFO_SENTINEL
1114 };
1115
1116 static const ARMCPRegInfo v6k_cp_reginfo[] = {
1117 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
1118 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
1119 .access = PL0_RW,
1120 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 },
1121 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
1122 .access = PL0_RW,
1123 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s),
1124 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) },
1125 .resetfn = arm_cp_reset_ignore },
1126 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
1127 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
1128 .access = PL0_R|PL1_W,
1129 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]),
1130 .resetvalue = 0},
1131 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
1132 .access = PL0_R|PL1_W,
1133 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s),
1134 offsetoflow32(CPUARMState, cp15.tpidruro_ns) },
1135 .resetfn = arm_cp_reset_ignore },
1136 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64,
1137 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
1138 .access = PL1_RW,
1139 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 },
1140 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4,
1141 .access = PL1_RW,
1142 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s),
1143 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) },
1144 .resetvalue = 0 },
1145 REGINFO_SENTINEL
1146 };
1147
1148 #ifndef CONFIG_USER_ONLY
1149
1150 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri)
1151 {
1152 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero */
1153 if (arm_current_el(env) == 0 && !extract32(env->cp15.c14_cntkctl, 0, 2)) {
1154 return CP_ACCESS_TRAP;
1155 }
1156 return CP_ACCESS_OK;
1157 }
1158
1159 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx)
1160 {
1161 unsigned int cur_el = arm_current_el(env);
1162 bool secure = arm_is_secure(env);
1163
1164 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */
1165 if (cur_el == 0 &&
1166 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
1167 return CP_ACCESS_TRAP;
1168 }
1169
1170 if (arm_feature(env, ARM_FEATURE_EL2) &&
1171 timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
1172 !extract32(env->cp15.cnthctl_el2, 0, 1)) {
1173 return CP_ACCESS_TRAP_EL2;
1174 }
1175 return CP_ACCESS_OK;
1176 }
1177
1178 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx)
1179 {
1180 unsigned int cur_el = arm_current_el(env);
1181 bool secure = arm_is_secure(env);
1182
1183 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if
1184 * EL0[PV]TEN is zero.
1185 */
1186 if (cur_el == 0 &&
1187 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
1188 return CP_ACCESS_TRAP;
1189 }
1190
1191 if (arm_feature(env, ARM_FEATURE_EL2) &&
1192 timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
1193 !extract32(env->cp15.cnthctl_el2, 1, 1)) {
1194 return CP_ACCESS_TRAP_EL2;
1195 }
1196 return CP_ACCESS_OK;
1197 }
1198
1199 static CPAccessResult gt_pct_access(CPUARMState *env,
1200 const ARMCPRegInfo *ri)
1201 {
1202 return gt_counter_access(env, GTIMER_PHYS);
1203 }
1204
1205 static CPAccessResult gt_vct_access(CPUARMState *env,
1206 const ARMCPRegInfo *ri)
1207 {
1208 return gt_counter_access(env, GTIMER_VIRT);
1209 }
1210
1211 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
1212 {
1213 return gt_timer_access(env, GTIMER_PHYS);
1214 }
1215
1216 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
1217 {
1218 return gt_timer_access(env, GTIMER_VIRT);
1219 }
1220
1221 static CPAccessResult gt_stimer_access(CPUARMState *env,
1222 const ARMCPRegInfo *ri)
1223 {
1224 /* The AArch64 register view of the secure physical timer is
1225 * always accessible from EL3, and configurably accessible from
1226 * Secure EL1.
1227 */
1228 switch (arm_current_el(env)) {
1229 case 1:
1230 if (!arm_is_secure(env)) {
1231 return CP_ACCESS_TRAP;
1232 }
1233 if (!(env->cp15.scr_el3 & SCR_ST)) {
1234 return CP_ACCESS_TRAP_EL3;
1235 }
1236 return CP_ACCESS_OK;
1237 case 0:
1238 case 2:
1239 return CP_ACCESS_TRAP;
1240 case 3:
1241 return CP_ACCESS_OK;
1242 default:
1243 g_assert_not_reached();
1244 }
1245 }
1246
1247 static uint64_t gt_get_countervalue(CPUARMState *env)
1248 {
1249 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
1250 }
1251
1252 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
1253 {
1254 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
1255
1256 if (gt->ctl & 1) {
1257 /* Timer enabled: calculate and set current ISTATUS, irq, and
1258 * reset timer to when ISTATUS next has to change
1259 */
1260 uint64_t offset = timeridx == GTIMER_VIRT ?
1261 cpu->env.cp15.cntvoff_el2 : 0;
1262 uint64_t count = gt_get_countervalue(&cpu->env);
1263 /* Note that this must be unsigned 64 bit arithmetic: */
1264 int istatus = count - offset >= gt->cval;
1265 uint64_t nexttick;
1266
1267 gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
1268 qemu_set_irq(cpu->gt_timer_outputs[timeridx],
1269 (istatus && !(gt->ctl & 2)));
1270 if (istatus) {
1271 /* Next transition is when count rolls back over to zero */
1272 nexttick = UINT64_MAX;
1273 } else {
1274 /* Next transition is when we hit cval */
1275 nexttick = gt->cval + offset;
1276 }
1277 /* Note that the desired next expiry time might be beyond the
1278 * signed-64-bit range of a QEMUTimer -- in this case we just
1279 * set the timer for as far in the future as possible. When the
1280 * timer expires we will reset the timer for any remaining period.
1281 */
1282 if (nexttick > INT64_MAX / GTIMER_SCALE) {
1283 nexttick = INT64_MAX / GTIMER_SCALE;
1284 }
1285 timer_mod(cpu->gt_timer[timeridx], nexttick);
1286 } else {
1287 /* Timer disabled: ISTATUS and timer output always clear */
1288 gt->ctl &= ~4;
1289 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);
1290 timer_del(cpu->gt_timer[timeridx]);
1291 }
1292 }
1293
1294 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
1295 int timeridx)
1296 {
1297 ARMCPU *cpu = arm_env_get_cpu(env);
1298
1299 timer_del(cpu->gt_timer[timeridx]);
1300 }
1301
1302 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
1303 {
1304 return gt_get_countervalue(env);
1305 }
1306
1307 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
1308 {
1309 return gt_get_countervalue(env) - env->cp15.cntvoff_el2;
1310 }
1311
1312 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1313 int timeridx,
1314 uint64_t value)
1315 {
1316 env->cp15.c14_timer[timeridx].cval = value;
1317 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1318 }
1319
1320 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
1321 int timeridx)
1322 {
1323 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
1324
1325 return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
1326 (gt_get_countervalue(env) - offset));
1327 }
1328
1329 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1330 int timeridx,
1331 uint64_t value)
1332 {
1333 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
1334
1335 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset +
1336 sextract64(value, 0, 32);
1337 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1338 }
1339
1340 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1341 int timeridx,
1342 uint64_t value)
1343 {
1344 ARMCPU *cpu = arm_env_get_cpu(env);
1345 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
1346
1347 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
1348 if ((oldval ^ value) & 1) {
1349 /* Enable toggled */
1350 gt_recalc_timer(cpu, timeridx);
1351 } else if ((oldval ^ value) & 2) {
1352 /* IMASK toggled: don't need to recalculate,
1353 * just set the interrupt line based on ISTATUS
1354 */
1355 qemu_set_irq(cpu->gt_timer_outputs[timeridx],
1356 (oldval & 4) && !(value & 2));
1357 }
1358 }
1359
1360 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1361 {
1362 gt_timer_reset(env, ri, GTIMER_PHYS);
1363 }
1364
1365 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1366 uint64_t value)
1367 {
1368 gt_cval_write(env, ri, GTIMER_PHYS, value);
1369 }
1370
1371 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1372 {
1373 return gt_tval_read(env, ri, GTIMER_PHYS);
1374 }
1375
1376 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1377 uint64_t value)
1378 {
1379 gt_tval_write(env, ri, GTIMER_PHYS, value);
1380 }
1381
1382 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1383 uint64_t value)
1384 {
1385 gt_ctl_write(env, ri, GTIMER_PHYS, value);
1386 }
1387
1388 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1389 {
1390 gt_timer_reset(env, ri, GTIMER_VIRT);
1391 }
1392
1393 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1394 uint64_t value)
1395 {
1396 gt_cval_write(env, ri, GTIMER_VIRT, value);
1397 }
1398
1399 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1400 {
1401 return gt_tval_read(env, ri, GTIMER_VIRT);
1402 }
1403
1404 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1405 uint64_t value)
1406 {
1407 gt_tval_write(env, ri, GTIMER_VIRT, value);
1408 }
1409
1410 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1411 uint64_t value)
1412 {
1413 gt_ctl_write(env, ri, GTIMER_VIRT, value);
1414 }
1415
1416 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
1417 uint64_t value)
1418 {
1419 ARMCPU *cpu = arm_env_get_cpu(env);
1420
1421 raw_write(env, ri, value);
1422 gt_recalc_timer(cpu, GTIMER_VIRT);
1423 }
1424
1425 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1426 {
1427 gt_timer_reset(env, ri, GTIMER_HYP);
1428 }
1429
1430 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1431 uint64_t value)
1432 {
1433 gt_cval_write(env, ri, GTIMER_HYP, value);
1434 }
1435
1436 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1437 {
1438 return gt_tval_read(env, ri, GTIMER_HYP);
1439 }
1440
1441 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1442 uint64_t value)
1443 {
1444 gt_tval_write(env, ri, GTIMER_HYP, value);
1445 }
1446
1447 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1448 uint64_t value)
1449 {
1450 gt_ctl_write(env, ri, GTIMER_HYP, value);
1451 }
1452
1453 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1454 {
1455 gt_timer_reset(env, ri, GTIMER_SEC);
1456 }
1457
1458 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1459 uint64_t value)
1460 {
1461 gt_cval_write(env, ri, GTIMER_SEC, value);
1462 }
1463
1464 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1465 {
1466 return gt_tval_read(env, ri, GTIMER_SEC);
1467 }
1468
1469 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1470 uint64_t value)
1471 {
1472 gt_tval_write(env, ri, GTIMER_SEC, value);
1473 }
1474
1475 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1476 uint64_t value)
1477 {
1478 gt_ctl_write(env, ri, GTIMER_SEC, value);
1479 }
1480
1481 void arm_gt_ptimer_cb(void *opaque)
1482 {
1483 ARMCPU *cpu = opaque;
1484
1485 gt_recalc_timer(cpu, GTIMER_PHYS);
1486 }
1487
1488 void arm_gt_vtimer_cb(void *opaque)
1489 {
1490 ARMCPU *cpu = opaque;
1491
1492 gt_recalc_timer(cpu, GTIMER_VIRT);
1493 }
1494
1495 void arm_gt_htimer_cb(void *opaque)
1496 {
1497 ARMCPU *cpu = opaque;
1498
1499 gt_recalc_timer(cpu, GTIMER_HYP);
1500 }
1501
1502 void arm_gt_stimer_cb(void *opaque)
1503 {
1504 ARMCPU *cpu = opaque;
1505
1506 gt_recalc_timer(cpu, GTIMER_SEC);
1507 }
1508
1509 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1510 /* Note that CNTFRQ is purely reads-as-written for the benefit
1511 * of software; writing it doesn't actually change the timer frequency.
1512 * Our reset value matches the fixed frequency we implement the timer at.
1513 */
1514 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
1515 .type = ARM_CP_ALIAS,
1516 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1517 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
1518 },
1519 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
1520 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
1521 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1522 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
1523 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
1524 },
1525 /* overall control: mostly access permissions */
1526 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
1527 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
1528 .access = PL1_RW,
1529 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
1530 .resetvalue = 0,
1531 },
1532 /* per-timer control */
1533 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
1534 .secure = ARM_CP_SECSTATE_NS,
1535 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
1536 .accessfn = gt_ptimer_access,
1537 .fieldoffset = offsetoflow32(CPUARMState,
1538 cp15.c14_timer[GTIMER_PHYS].ctl),
1539 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
1540 },
1541 { .name = "CNTP_CTL(S)",
1542 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
1543 .secure = ARM_CP_SECSTATE_S,
1544 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
1545 .accessfn = gt_ptimer_access,
1546 .fieldoffset = offsetoflow32(CPUARMState,
1547 cp15.c14_timer[GTIMER_SEC].ctl),
1548 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
1549 },
1550 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
1551 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
1552 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1553 .accessfn = gt_ptimer_access,
1554 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
1555 .resetvalue = 0,
1556 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
1557 },
1558 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
1559 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
1560 .accessfn = gt_vtimer_access,
1561 .fieldoffset = offsetoflow32(CPUARMState,
1562 cp15.c14_timer[GTIMER_VIRT].ctl),
1563 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
1564 },
1565 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
1566 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
1567 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1568 .accessfn = gt_vtimer_access,
1569 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
1570 .resetvalue = 0,
1571 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
1572 },
1573 /* TimerValue views: a 32 bit downcounting view of the underlying state */
1574 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
1575 .secure = ARM_CP_SECSTATE_NS,
1576 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1577 .accessfn = gt_ptimer_access,
1578 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
1579 },
1580 { .name = "CNTP_TVAL(S)",
1581 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
1582 .secure = ARM_CP_SECSTATE_S,
1583 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1584 .accessfn = gt_ptimer_access,
1585 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
1586 },
1587 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1588 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
1589 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1590 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
1591 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
1592 },
1593 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
1594 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1595 .accessfn = gt_vtimer_access,
1596 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
1597 },
1598 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1599 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
1600 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1601 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
1602 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
1603 },
1604 /* The counter itself */
1605 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
1606 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
1607 .accessfn = gt_pct_access,
1608 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
1609 },
1610 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
1611 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
1612 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
1613 .accessfn = gt_pct_access, .readfn = gt_cnt_read,
1614 },
1615 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
1616 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
1617 .accessfn = gt_vct_access,
1618 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
1619 },
1620 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
1621 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
1622 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
1623 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
1624 },
1625 /* Comparison value, indicating when the timer goes off */
1626 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
1627 .secure = ARM_CP_SECSTATE_NS,
1628 .access = PL1_RW | PL0_R,
1629 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
1630 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1631 .accessfn = gt_ptimer_access,
1632 .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
1633 },
1634 { .name = "CNTP_CVAL(S)", .cp = 15, .crm = 14, .opc1 = 2,
1635 .secure = ARM_CP_SECSTATE_S,
1636 .access = PL1_RW | PL0_R,
1637 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
1638 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
1639 .accessfn = gt_ptimer_access,
1640 .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
1641 },
1642 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1643 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
1644 .access = PL1_RW | PL0_R,
1645 .type = ARM_CP_IO,
1646 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1647 .resetvalue = 0, .accessfn = gt_ptimer_access,
1648 .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
1649 },
1650 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
1651 .access = PL1_RW | PL0_R,
1652 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
1653 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1654 .accessfn = gt_vtimer_access,
1655 .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
1656 },
1657 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1658 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
1659 .access = PL1_RW | PL0_R,
1660 .type = ARM_CP_IO,
1661 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1662 .resetvalue = 0, .accessfn = gt_vtimer_access,
1663 .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
1664 },
1665 /* Secure timer -- this is actually restricted to only EL3
1666 * and configurably Secure-EL1 via the accessfn.
1667 */
1668 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64,
1669 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0,
1670 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW,
1671 .accessfn = gt_stimer_access,
1672 .readfn = gt_sec_tval_read,
1673 .writefn = gt_sec_tval_write,
1674 .resetfn = gt_sec_timer_reset,
1675 },
1676 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64,
1677 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1,
1678 .type = ARM_CP_IO, .access = PL1_RW,
1679 .accessfn = gt_stimer_access,
1680 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl),
1681 .resetvalue = 0,
1682 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
1683 },
1684 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64,
1685 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2,
1686 .type = ARM_CP_IO, .access = PL1_RW,
1687 .accessfn = gt_stimer_access,
1688 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
1689 .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
1690 },
1691 REGINFO_SENTINEL
1692 };
1693
1694 #else
1695 /* In user-mode none of the generic timer registers are accessible,
1696 * and their implementation depends on QEMU_CLOCK_VIRTUAL and qdev gpio outputs,
1697 * so instead just don't register any of them.
1698 */
1699 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1700 REGINFO_SENTINEL
1701 };
1702
1703 #endif
1704
1705 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1706 {
1707 if (arm_feature(env, ARM_FEATURE_LPAE)) {
1708 raw_write(env, ri, value);
1709 } else if (arm_feature(env, ARM_FEATURE_V7)) {
1710 raw_write(env, ri, value & 0xfffff6ff);
1711 } else {
1712 raw_write(env, ri, value & 0xfffff1ff);
1713 }
1714 }
1715
1716 #ifndef CONFIG_USER_ONLY
1717 /* get_phys_addr() isn't present for user-mode-only targets */
1718
1719 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri)
1720 {
1721 if (ri->opc2 & 4) {
1722 /* Other states are only available with TrustZone; in
1723 * a non-TZ implementation these registers don't exist
1724 * at all, which is an Uncategorized trap. This underdecoding
1725 * is safe because the reginfo is NO_RAW.
1726 */
1727 return CP_ACCESS_TRAP_UNCATEGORIZED;
1728 }
1729 return CP_ACCESS_OK;
1730 }
1731
1732 static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
1733 int access_type, ARMMMUIdx mmu_idx)
1734 {
1735 hwaddr phys_addr;
1736 target_ulong page_size;
1737 int prot;
1738 uint32_t fsr;
1739 bool ret;
1740 uint64_t par64;
1741 MemTxAttrs attrs = {};
1742
1743 ret = get_phys_addr(env, value, access_type, mmu_idx,
1744 &phys_addr, &attrs, &prot, &page_size, &fsr);
1745 if (extended_addresses_enabled(env)) {
1746 /* fsr is a DFSR/IFSR value for the long descriptor
1747 * translation table format, but with WnR always clear.
1748 * Convert it to a 64-bit PAR.
1749 */
1750 par64 = (1 << 11); /* LPAE bit always set */
1751 if (!ret) {
1752 par64 |= phys_addr & ~0xfffULL;
1753 if (!attrs.secure) {
1754 par64 |= (1 << 9); /* NS */
1755 }
1756 /* We don't set the ATTR or SH fields in the PAR. */
1757 } else {
1758 par64 |= 1; /* F */
1759 par64 |= (fsr & 0x3f) << 1; /* FS */
1760 /* Note that S2WLK and FSTAGE are always zero, because we don't
1761 * implement virtualization and therefore there can't be a stage 2
1762 * fault.
1763 */
1764 }
1765 } else {
1766 /* fsr is a DFSR/IFSR value for the short descriptor
1767 * translation table format (with WnR always clear).
1768 * Convert it to a 32-bit PAR.
1769 */
1770 if (!ret) {
1771 /* We do not set any attribute bits in the PAR */
1772 if (page_size == (1 << 24)
1773 && arm_feature(env, ARM_FEATURE_V7)) {
1774 par64 = (phys_addr & 0xff000000) | (1 << 1);
1775 } else {
1776 par64 = phys_addr & 0xfffff000;
1777 }
1778 if (!attrs.secure) {
1779 par64 |= (1 << 9); /* NS */
1780 }
1781 } else {
1782 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) |
1783 ((fsr & 0xf) << 1) | 1;
1784 }
1785 }
1786 return par64;
1787 }
1788
1789 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1790 {
1791 int access_type = ri->opc2 & 1;
1792 uint64_t par64;
1793 ARMMMUIdx mmu_idx;
1794 int el = arm_current_el(env);
1795 bool secure = arm_is_secure_below_el3(env);
1796
1797 switch (ri->opc2 & 6) {
1798 case 0:
1799 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */
1800 switch (el) {
1801 case 3:
1802 mmu_idx = ARMMMUIdx_S1E3;
1803 break;
1804 case 2:
1805 mmu_idx = ARMMMUIdx_S1NSE1;
1806 break;
1807 case 1:
1808 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
1809 break;
1810 default:
1811 g_assert_not_reached();
1812 }
1813 break;
1814 case 2:
1815 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
1816 switch (el) {
1817 case 3:
1818 mmu_idx = ARMMMUIdx_S1SE0;
1819 break;
1820 case 2:
1821 mmu_idx = ARMMMUIdx_S1NSE0;
1822 break;
1823 case 1:
1824 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
1825 break;
1826 default:
1827 g_assert_not_reached();
1828 }
1829 break;
1830 case 4:
1831 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
1832 mmu_idx = ARMMMUIdx_S12NSE1;
1833 break;
1834 case 6:
1835 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
1836 mmu_idx = ARMMMUIdx_S12NSE0;
1837 break;
1838 default:
1839 g_assert_not_reached();
1840 }
1841
1842 par64 = do_ats_write(env, value, access_type, mmu_idx);
1843
1844 A32_BANKED_CURRENT_REG_SET(env, par, par64);
1845 }
1846
1847 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
1848 uint64_t value)
1849 {
1850 int access_type = ri->opc2 & 1;
1851 ARMMMUIdx mmu_idx;
1852 int secure = arm_is_secure_below_el3(env);
1853
1854 switch (ri->opc2 & 6) {
1855 case 0:
1856 switch (ri->opc1) {
1857 case 0: /* AT S1E1R, AT S1E1W */
1858 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
1859 break;
1860 case 4: /* AT S1E2R, AT S1E2W */
1861 mmu_idx = ARMMMUIdx_S1E2;
1862 break;
1863 case 6: /* AT S1E3R, AT S1E3W */
1864 mmu_idx = ARMMMUIdx_S1E3;
1865 break;
1866 default:
1867 g_assert_not_reached();
1868 }
1869 break;
1870 case 2: /* AT S1E0R, AT S1E0W */
1871 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
1872 break;
1873 case 4: /* AT S12E1R, AT S12E1W */
1874 mmu_idx = ARMMMUIdx_S12NSE1;
1875 break;
1876 case 6: /* AT S12E0R, AT S12E0W */
1877 mmu_idx = ARMMMUIdx_S12NSE0;
1878 break;
1879 default:
1880 g_assert_not_reached();
1881 }
1882
1883 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx);
1884 }
1885 #endif
1886
1887 static const ARMCPRegInfo vapa_cp_reginfo[] = {
1888 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
1889 .access = PL1_RW, .resetvalue = 0,
1890 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s),
1891 offsetoflow32(CPUARMState, cp15.par_ns) },
1892 .writefn = par_write },
1893 #ifndef CONFIG_USER_ONLY
1894 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
1895 .access = PL1_W, .accessfn = ats_access,
1896 .writefn = ats_write, .type = ARM_CP_NO_RAW },
1897 #endif
1898 REGINFO_SENTINEL
1899 };
1900
1901 /* Return basic MPU access permission bits. */
1902 static uint32_t simple_mpu_ap_bits(uint32_t val)
1903 {
1904 uint32_t ret;
1905 uint32_t mask;
1906 int i;
1907 ret = 0;
1908 mask = 3;
1909 for (i = 0; i < 16; i += 2) {
1910 ret |= (val >> i) & mask;
1911 mask <<= 2;
1912 }
1913 return ret;
1914 }
1915
1916 /* Pad basic MPU access permission bits to extended format. */
1917 static uint32_t extended_mpu_ap_bits(uint32_t val)
1918 {
1919 uint32_t ret;
1920 uint32_t mask;
1921 int i;
1922 ret = 0;
1923 mask = 3;
1924 for (i = 0; i < 16; i += 2) {
1925 ret |= (val & mask) << i;
1926 mask <<= 2;
1927 }
1928 return ret;
1929 }
1930
1931 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1932 uint64_t value)
1933 {
1934 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
1935 }
1936
1937 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1938 {
1939 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
1940 }
1941
1942 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1943 uint64_t value)
1944 {
1945 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
1946 }
1947
1948 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1949 {
1950 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
1951 }
1952
1953 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri)
1954 {
1955 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
1956
1957 if (!u32p) {
1958 return 0;
1959 }
1960
1961 u32p += env->cp15.c6_rgnr;
1962 return *u32p;
1963 }
1964
1965 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
1966 uint64_t value)
1967 {
1968 ARMCPU *cpu = arm_env_get_cpu(env);
1969 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
1970
1971 if (!u32p) {
1972 return;
1973 }
1974
1975 u32p += env->cp15.c6_rgnr;
1976 tlb_flush(CPU(cpu), 1); /* Mappings may have changed - purge! */
1977 *u32p = value;
1978 }
1979
1980 static void pmsav7_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1981 {
1982 ARMCPU *cpu = arm_env_get_cpu(env);
1983 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
1984
1985 if (!u32p) {
1986 return;
1987 }
1988
1989 memset(u32p, 0, sizeof(*u32p) * cpu->pmsav7_dregion);
1990 }
1991
1992 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1993 uint64_t value)
1994 {
1995 ARMCPU *cpu = arm_env_get_cpu(env);
1996 uint32_t nrgs = cpu->pmsav7_dregion;
1997
1998 if (value >= nrgs) {
1999 qemu_log_mask(LOG_GUEST_ERROR,
2000 "PMSAv7 RGNR write >= # supported regions, %" PRIu32
2001 " > %" PRIu32 "\n", (uint32_t)value, nrgs);
2002 return;
2003 }
2004
2005 raw_write(env, ri, value);
2006 }
2007
2008 static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
2009 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0,
2010 .access = PL1_RW, .type = ARM_CP_NO_RAW,
2011 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar),
2012 .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
2013 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2,
2014 .access = PL1_RW, .type = ARM_CP_NO_RAW,
2015 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr),
2016 .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
2017 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4,
2018 .access = PL1_RW, .type = ARM_CP_NO_RAW,
2019 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr),
2020 .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
2021 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
2022 .access = PL1_RW,
2023 .fieldoffset = offsetof(CPUARMState, cp15.c6_rgnr),
2024 .writefn = pmsav7_rgnr_write },
2025 REGINFO_SENTINEL
2026 };
2027
2028 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
2029 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
2030 .access = PL1_RW, .type = ARM_CP_ALIAS,
2031 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
2032 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
2033 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
2034 .access = PL1_RW, .type = ARM_CP_ALIAS,
2035 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
2036 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
2037 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
2038 .access = PL1_RW,
2039 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
2040 .resetvalue = 0, },
2041 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
2042 .access = PL1_RW,
2043 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
2044 .resetvalue = 0, },
2045 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
2046 .access = PL1_RW,
2047 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
2048 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
2049 .access = PL1_RW,
2050 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
2051 /* Protection region base and size registers */
2052 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
2053 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2054 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
2055 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
2056 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2057 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
2058 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
2059 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2060 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
2061 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
2062 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2063 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
2064 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
2065 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2066 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
2067 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
2068 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2069 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
2070 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
2071 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2072 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
2073 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
2074 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2075 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
2076 REGINFO_SENTINEL
2077 };
2078
2079 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
2080 uint64_t value)
2081 {
2082 TCR *tcr = raw_ptr(env, ri);
2083 int maskshift = extract32(value, 0, 3);
2084
2085 if (!arm_feature(env, ARM_FEATURE_V8)) {
2086 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
2087 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
2088 * using Long-desciptor translation table format */
2089 value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
2090 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
2091 /* In an implementation that includes the Security Extensions
2092 * TTBCR has additional fields PD0 [4] and PD1 [5] for
2093 * Short-descriptor translation table format.
2094 */
2095 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N;
2096 } else {
2097 value &= TTBCR_N;
2098 }
2099 }
2100
2101 /* Update the masks corresponding to the the TCR bank being written
2102 * Note that we always calculate mask and base_mask, but
2103 * they are only used for short-descriptor tables (ie if EAE is 0);
2104 * for long-descriptor tables the TCR fields are used differently
2105 * and the mask and base_mask values are meaningless.
2106 */
2107 tcr->raw_tcr = value;
2108 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift);
2109 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift);
2110 }
2111
2112 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2113 uint64_t value)
2114 {
2115 ARMCPU *cpu = arm_env_get_cpu(env);
2116
2117 if (arm_feature(env, ARM_FEATURE_LPAE)) {
2118 /* With LPAE the TTBCR could result in a change of ASID
2119 * via the TTBCR.A1 bit, so do a TLB flush.
2120 */
2121 tlb_flush(CPU(cpu), 1);
2122 }
2123 vmsa_ttbcr_raw_write(env, ri, value);
2124 }
2125
2126 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2127 {
2128 TCR *tcr = raw_ptr(env, ri);
2129
2130 /* Reset both the TCR as well as the masks corresponding to the bank of
2131 * the TCR being reset.
2132 */
2133 tcr->raw_tcr = 0;
2134 tcr->mask = 0;
2135 tcr->base_mask = 0xffffc000u;
2136 }
2137
2138 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2139 uint64_t value)
2140 {
2141 ARMCPU *cpu = arm_env_get_cpu(env);
2142 TCR *tcr = raw_ptr(env, ri);
2143
2144 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
2145 tlb_flush(CPU(cpu), 1);
2146 tcr->raw_tcr = value;
2147 }
2148
2149 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2150 uint64_t value)
2151 {
2152 /* 64 bit accesses to the TTBRs can change the ASID and so we
2153 * must flush the TLB.
2154 */
2155 if (cpreg_field_is_64bit(ri)) {
2156 ARMCPU *cpu = arm_env_get_cpu(env);
2157
2158 tlb_flush(CPU(cpu), 1);
2159 }
2160 raw_write(env, ri, value);
2161 }
2162
2163 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
2164 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
2165 .access = PL1_RW, .type = ARM_CP_ALIAS,
2166 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s),
2167 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, },
2168 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
2169 .access = PL1_RW, .resetvalue = 0,
2170 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s),
2171 offsetoflow32(CPUARMState, cp15.ifsr_ns) } },
2172 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0,
2173 .access = PL1_RW, .resetvalue = 0,
2174 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s),
2175 offsetof(CPUARMState, cp15.dfar_ns) } },
2176 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64,
2177 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
2178 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
2179 .resetvalue = 0, },
2180 REGINFO_SENTINEL
2181 };
2182
2183 static const ARMCPRegInfo vmsa_cp_reginfo[] = {
2184 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
2185 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
2186 .access = PL1_RW,
2187 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
2188 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
2189 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
2190 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
2191 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
2192 offsetof(CPUARMState, cp15.ttbr0_ns) } },
2193 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
2194 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
2195 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
2196 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
2197 offsetof(CPUARMState, cp15.ttbr1_ns) } },
2198 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
2199 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
2200 .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
2201 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
2202 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) },
2203 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
2204 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write,
2205 .raw_writefn = vmsa_ttbcr_raw_write,
2206 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]),
2207 offsetoflow32(CPUARMState, cp15.tcr_el[1])} },
2208 REGINFO_SENTINEL
2209 };
2210
2211 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri,
2212 uint64_t value)
2213 {
2214 env->cp15.c15_ticonfig = value & 0xe7;
2215 /* The OS_TYPE bit in this register changes the reported CPUID! */
2216 env->cp15.c0_cpuid = (value & (1 << 5)) ?
2217 ARM_CPUID_TI915T : ARM_CPUID_TI925T;
2218 }
2219
2220 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
2221 uint64_t value)
2222 {
2223 env->cp15.c15_threadid = value & 0xffff;
2224 }
2225
2226 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
2227 uint64_t value)
2228 {
2229 /* Wait-for-interrupt (deprecated) */
2230 cpu_interrupt(CPU(arm_env_get_cpu(env)), CPU_INTERRUPT_HALT);
2231 }
2232
2233 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
2234 uint64_t value)
2235 {
2236 /* On OMAP there are registers indicating the max/min index of dcache lines
2237 * containing a dirty line; cache flush operations have to reset these.
2238 */
2239 env->cp15.c15_i_max = 0x000;
2240 env->cp15.c15_i_min = 0xff0;
2241 }
2242
2243 static const ARMCPRegInfo omap_cp_reginfo[] = {
2244 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY,
2245 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE,
2246 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
2247 .resetvalue = 0, },
2248 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,
2249 .access = PL1_RW, .type = ARM_CP_NOP },
2250 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0,
2251 .access = PL1_RW,
2252 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0,
2253 .writefn = omap_ticonfig_write },
2254 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0,
2255 .access = PL1_RW,
2256 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, },
2257 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0,
2258 .access = PL1_RW, .resetvalue = 0xff0,
2259 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) },
2260 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0,
2261 .access = PL1_RW,
2262 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0,
2263 .writefn = omap_threadid_write },
2264 { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
2265 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
2266 .type = ARM_CP_NO_RAW,
2267 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
2268 /* TODO: Peripheral port remap register:
2269 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
2270 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
2271 * when MMU is off.
2272 */
2273 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
2274 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
2275 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW,
2276 .writefn = omap_cachemaint_write },
2277 { .name = "C9", .cp = 15, .crn = 9,
2278 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
2279 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
2280 REGINFO_SENTINEL
2281 };
2282
2283 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
2284 uint64_t value)
2285 {
2286 env->cp15.c15_cpar = value & 0x3fff;
2287 }
2288
2289 static const ARMCPRegInfo xscale_cp_reginfo[] = {
2290 { .name = "XSCALE_CPAR",
2291 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
2292 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
2293 .writefn = xscale_cpar_write, },
2294 { .name = "XSCALE_AUXCR",
2295 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
2296 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
2297 .resetvalue = 0, },
2298 /* XScale specific cache-lockdown: since we have no cache we NOP these
2299 * and hope the guest does not really rely on cache behaviour.
2300 */
2301 { .name = "XSCALE_LOCK_ICACHE_LINE",
2302 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
2303 .access = PL1_W, .type = ARM_CP_NOP },
2304 { .name = "XSCALE_UNLOCK_ICACHE",
2305 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
2306 .access = PL1_W, .type = ARM_CP_NOP },
2307 { .name = "XSCALE_DCACHE_LOCK",
2308 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
2309 .access = PL1_RW, .type = ARM_CP_NOP },
2310 { .name = "XSCALE_UNLOCK_DCACHE",
2311 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
2312 .access = PL1_W, .type = ARM_CP_NOP },
2313 REGINFO_SENTINEL
2314 };
2315
2316 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
2317 /* RAZ/WI the whole crn=15 space, when we don't have a more specific
2318 * implementation of this implementation-defined space.
2319 * Ideally this should eventually disappear in favour of actually
2320 * implementing the correct behaviour for all cores.
2321 */
2322 { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
2323 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
2324 .access = PL1_RW,
2325 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE,
2326 .resetvalue = 0 },
2327 REGINFO_SENTINEL
2328 };
2329
2330 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
2331 /* Cache status: RAZ because we have no cache so it's always clean */
2332 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
2333 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2334 .resetvalue = 0 },
2335 REGINFO_SENTINEL
2336 };
2337
2338 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
2339 /* We never have a a block transfer operation in progress */
2340 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
2341 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2342 .resetvalue = 0 },
2343 /* The cache ops themselves: these all NOP for QEMU */
2344 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
2345 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2346 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
2347 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2348 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
2349 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2350 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
2351 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2352 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
2353 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2354 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
2355 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2356 REGINFO_SENTINEL
2357 };
2358
2359 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
2360 /* The cache test-and-clean instructions always return (1 << 30)
2361 * to indicate that there are no dirty cache lines.
2362 */
2363 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
2364 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2365 .resetvalue = (1 << 30) },
2366 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
2367 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2368 .resetvalue = (1 << 30) },
2369 REGINFO_SENTINEL
2370 };
2371
2372 static const ARMCPRegInfo strongarm_cp_reginfo[] = {
2373 /* Ignore ReadBuffer accesses */
2374 { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
2375 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
2376 .access = PL1_RW, .resetvalue = 0,
2377 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW },
2378 REGINFO_SENTINEL
2379 };
2380
2381 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2382 {
2383 ARMCPU *cpu = ARM_CPU(arm_env_get_cpu(env));
2384 uint64_t mpidr = cpu->mp_affinity;
2385
2386 if (arm_feature(env, ARM_FEATURE_V7MP)) {
2387 mpidr |= (1U << 31);
2388 /* Cores which are uniprocessor (non-coherent)
2389 * but still implement the MP extensions set
2390 * bit 30. (For instance, Cortex-R5).
2391 */
2392 if (cpu->mp_is_up) {
2393 mpidr |= (1u << 30);
2394 }
2395 }
2396 return mpidr;
2397 }
2398
2399 static const ARMCPRegInfo mpidr_cp_reginfo[] = {
2400 { .name = "MPIDR", .state = ARM_CP_STATE_BOTH,
2401 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
2402 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
2403 REGINFO_SENTINEL
2404 };
2405
2406 static const ARMCPRegInfo lpae_cp_reginfo[] = {
2407 /* NOP AMAIR0/1 */
2408 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
2409 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
2410 .access = PL1_RW, .type = ARM_CP_CONST,
2411 .resetvalue = 0 },
2412 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
2413 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
2414 .access = PL1_RW, .type = ARM_CP_CONST,
2415 .resetvalue = 0 },
2416 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
2417 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0,
2418 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s),
2419 offsetof(CPUARMState, cp15.par_ns)} },
2420 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
2421 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
2422 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
2423 offsetof(CPUARMState, cp15.ttbr0_ns) },
2424 .writefn = vmsa_ttbr_write, },
2425 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
2426 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
2427 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
2428 offsetof(CPUARMState, cp15.ttbr1_ns) },
2429 .writefn = vmsa_ttbr_write, },
2430 REGINFO_SENTINEL
2431 };
2432
2433 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2434 {
2435 return vfp_get_fpcr(env);
2436 }
2437
2438 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2439 uint64_t value)
2440 {
2441 vfp_set_fpcr(env, value);
2442 }
2443
2444 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2445 {
2446 return vfp_get_fpsr(env);
2447 }
2448
2449 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2450 uint64_t value)
2451 {
2452 vfp_set_fpsr(env, value);
2453 }
2454
2455 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri)
2456 {
2457 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
2458 return CP_ACCESS_TRAP;
2459 }
2460 return CP_ACCESS_OK;
2461 }
2462
2463 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri,
2464 uint64_t value)
2465 {
2466 env->daif = value & PSTATE_DAIF;
2467 }
2468
2469 static CPAccessResult aa64_cacheop_access(CPUARMState *env,
2470 const ARMCPRegInfo *ri)
2471 {
2472 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
2473 * SCTLR_EL1.UCI is set.
2474 */
2475 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) {
2476 return CP_ACCESS_TRAP;
2477 }
2478 return CP_ACCESS_OK;
2479 }
2480
2481 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions
2482 * Page D4-1736 (DDI0487A.b)
2483 */
2484
2485 static void tlbi_aa64_va_write(CPUARMState *env, const ARMCPRegInfo *ri,
2486 uint64_t value)
2487 {
2488 /* Invalidate by VA (AArch64 version) */
2489 ARMCPU *cpu = arm_env_get_cpu(env);
2490 uint64_t pageaddr = sextract64(value << 12, 0, 56);
2491
2492 tlb_flush_page(CPU(cpu), pageaddr);
2493 }
2494
2495 static void tlbi_aa64_vaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
2496 uint64_t value)
2497 {
2498 /* Invalidate by VA, all ASIDs (AArch64 version) */
2499 ARMCPU *cpu = arm_env_get_cpu(env);
2500 uint64_t pageaddr = sextract64(value << 12, 0, 56);
2501
2502 tlb_flush_page(CPU(cpu), pageaddr);
2503 }
2504
2505 static void tlbi_aa64_asid_write(CPUARMState *env, const ARMCPRegInfo *ri,
2506 uint64_t value)
2507 {
2508 /* Invalidate by ASID (AArch64 version) */
2509 ARMCPU *cpu = arm_env_get_cpu(env);
2510 int asid = extract64(value, 48, 16);
2511 tlb_flush(CPU(cpu), asid == 0);
2512 }
2513
2514 static void tlbi_aa64_va_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2515 uint64_t value)
2516 {
2517 CPUState *other_cs;
2518 uint64_t pageaddr = sextract64(value << 12, 0, 56);
2519
2520 CPU_FOREACH(other_cs) {
2521 tlb_flush_page(other_cs, pageaddr);
2522 }
2523 }
2524
2525 static void tlbi_aa64_vaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2526 uint64_t value)
2527 {
2528 CPUState *other_cs;
2529 uint64_t pageaddr = sextract64(value << 12, 0, 56);
2530
2531 CPU_FOREACH(other_cs) {
2532 tlb_flush_page(other_cs, pageaddr);
2533 }
2534 }
2535
2536 static void tlbi_aa64_asid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2537 uint64_t value)
2538 {
2539 CPUState *other_cs;
2540 int asid = extract64(value, 48, 16);
2541
2542 CPU_FOREACH(other_cs) {
2543 tlb_flush(other_cs, asid == 0);
2544 }
2545 }
2546
2547 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri)
2548 {
2549 /* We don't implement EL2, so the only control on DC ZVA is the
2550 * bit in the SCTLR which can prohibit access for EL0.
2551 */
2552 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) {
2553 return CP_ACCESS_TRAP;
2554 }
2555 return CP_ACCESS_OK;
2556 }
2557
2558 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri)
2559 {
2560 ARMCPU *cpu = arm_env_get_cpu(env);
2561 int dzp_bit = 1 << 4;
2562
2563 /* DZP indicates whether DC ZVA access is allowed */
2564 if (aa64_zva_access(env, NULL) == CP_ACCESS_OK) {
2565 dzp_bit = 0;
2566 }
2567 return cpu->dcz_blocksize | dzp_bit;
2568 }
2569
2570 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
2571 {
2572 if (!(env->pstate & PSTATE_SP)) {
2573 /* Access to SP_EL0 is undefined if it's being used as
2574 * the stack pointer.
2575 */
2576 return CP_ACCESS_TRAP_UNCATEGORIZED;
2577 }
2578 return CP_ACCESS_OK;
2579 }
2580
2581 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri)
2582 {
2583 return env->pstate & PSTATE_SP;
2584 }
2585
2586 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
2587 {
2588 update_spsel(env, val);
2589 }
2590
2591 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2592 uint64_t value)
2593 {
2594 ARMCPU *cpu = arm_env_get_cpu(env);
2595
2596 if (raw_read(env, ri) == value) {
2597 /* Skip the TLB flush if nothing actually changed; Linux likes
2598 * to do a lot of pointless SCTLR writes.
2599 */
2600 return;
2601 }
2602
2603 raw_write(env, ri, value);
2604 /* ??? Lots of these bits are not implemented. */
2605 /* This may enable/disable the MMU, so do a TLB flush. */
2606 tlb_flush(CPU(cpu), 1);
2607 }
2608
2609 static const ARMCPRegInfo v8_cp_reginfo[] = {
2610 /* Minimal set of EL0-visible registers. This will need to be expanded
2611 * significantly for system emulation of AArch64 CPUs.
2612 */
2613 { .name = "NZCV", .state = ARM_CP_STATE_AA64,
2614 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
2615 .access = PL0_RW, .type = ARM_CP_NZCV },
2616 { .name = "DAIF", .state = ARM_CP_STATE_AA64,
2617 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
2618 .type = ARM_CP_NO_RAW,
2619 .access = PL0_RW, .accessfn = aa64_daif_access,
2620 .fieldoffset = offsetof(CPUARMState, daif),
2621 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
2622 { .name = "FPCR", .state = ARM_CP_STATE_AA64,
2623 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
2624 .access = PL0_RW, .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
2625 { .name = "FPSR", .state = ARM_CP_STATE_AA64,
2626 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
2627 .access = PL0_RW, .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
2628 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
2629 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
2630 .access = PL0_R, .type = ARM_CP_NO_RAW,
2631 .readfn = aa64_dczid_read },
2632 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
2633 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
2634 .access = PL0_W, .type = ARM_CP_DC_ZVA,
2635 #ifndef CONFIG_USER_ONLY
2636 /* Avoid overhead of an access check that always passes in user-mode */
2637 .accessfn = aa64_zva_access,
2638 #endif
2639 },
2640 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
2641 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
2642 .access = PL1_R, .type = ARM_CP_CURRENTEL },
2643 /* Cache ops: all NOPs since we don't emulate caches */
2644 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
2645 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
2646 .access = PL1_W, .type = ARM_CP_NOP },
2647 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
2648 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
2649 .access = PL1_W, .type = ARM_CP_NOP },
2650 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
2651 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
2652 .access = PL0_W, .type = ARM_CP_NOP,
2653 .accessfn = aa64_cacheop_access },
2654 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
2655 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
2656 .access = PL1_W, .type = ARM_CP_NOP },
2657 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
2658 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
2659 .access = PL1_W, .type = ARM_CP_NOP },
2660 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
2661 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
2662 .access = PL0_W, .type = ARM_CP_NOP,
2663 .accessfn = aa64_cacheop_access },
2664 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
2665 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
2666 .access = PL1_W, .type = ARM_CP_NOP },
2667 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
2668 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
2669 .access = PL0_W, .type = ARM_CP_NOP,
2670 .accessfn = aa64_cacheop_access },
2671 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
2672 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
2673 .access = PL0_W, .type = ARM_CP_NOP,
2674 .accessfn = aa64_cacheop_access },
2675 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
2676 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
2677 .access = PL1_W, .type = ARM_CP_NOP },
2678 /* TLBI operations */
2679 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,
2680 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
2681 .access = PL2_W, .type = ARM_CP_NO_RAW,
2682 .writefn = tlbiall_write },
2683 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,
2684 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
2685 .access = PL2_W, .type = ARM_CP_NO_RAW,
2686 .writefn = tlbiall_is_write },
2687 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
2688 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
2689 .access = PL1_W, .type = ARM_CP_NO_RAW,
2690 .writefn = tlbiall_is_write },
2691 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
2692 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
2693 .access = PL1_W, .type = ARM_CP_NO_RAW,
2694 .writefn = tlbi_aa64_va_is_write },
2695 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
2696 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
2697 .access = PL1_W, .type = ARM_CP_NO_RAW,
2698 .writefn = tlbi_aa64_asid_is_write },
2699 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
2700 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
2701 .access = PL1_W, .type = ARM_CP_NO_RAW,
2702 .writefn = tlbi_aa64_vaa_is_write },
2703 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
2704 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
2705 .access = PL1_W, .type = ARM_CP_NO_RAW,
2706 .writefn = tlbi_aa64_va_is_write },
2707 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
2708 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
2709 .access = PL1_W, .type = ARM_CP_NO_RAW,
2710 .writefn = tlbi_aa64_vaa_is_write },
2711 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
2712 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
2713 .access = PL1_W, .type = ARM_CP_NO_RAW,
2714 .writefn = tlbiall_write },
2715 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
2716 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
2717 .access = PL1_W, .type = ARM_CP_NO_RAW,
2718 .writefn = tlbi_aa64_va_write },
2719 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
2720 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
2721 .access = PL1_W, .type = ARM_CP_NO_RAW,
2722 .writefn = tlbi_aa64_asid_write },
2723 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
2724 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
2725 .access = PL1_W, .type = ARM_CP_NO_RAW,
2726 .writefn = tlbi_aa64_vaa_write },
2727 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
2728 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
2729 .access = PL1_W, .type = ARM_CP_NO_RAW,
2730 .writefn = tlbi_aa64_va_write },
2731 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
2732 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
2733 .access = PL1_W, .type = ARM_CP_NO_RAW,
2734 .writefn = tlbi_aa64_vaa_write },
2735 #ifndef CONFIG_USER_ONLY
2736 /* 64 bit address translation operations */
2737 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
2738 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
2739 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
2740 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
2741 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
2742 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
2743 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
2744 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
2745 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
2746 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
2747 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
2748 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
2749 #endif
2750 /* TLB invalidate last level of translation table walk */
2751 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
2752 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
2753 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
2754 .type = ARM_CP_NO_RAW, .access = PL1_W,
2755 .writefn = tlbimvaa_is_write },
2756 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
2757 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
2758 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
2759 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
2760 /* 32 bit cache operations */
2761 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
2762 .type = ARM_CP_NOP, .access = PL1_W },
2763 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
2764 .type = ARM_CP_NOP, .access = PL1_W },
2765 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
2766 .type = ARM_CP_NOP, .access = PL1_W },
2767 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
2768 .type = ARM_CP_NOP, .access = PL1_W },
2769 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
2770 .type = ARM_CP_NOP, .access = PL1_W },
2771 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
2772 .type = ARM_CP_NOP, .access = PL1_W },
2773 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
2774 .type = ARM_CP_NOP, .access = PL1_W },
2775 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
2776 .type = ARM_CP_NOP, .access = PL1_W },
2777 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
2778 .type = ARM_CP_NOP, .access = PL1_W },
2779 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
2780 .type = ARM_CP_NOP, .access = PL1_W },
2781 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
2782 .type = ARM_CP_NOP, .access = PL1_W },
2783 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
2784 .type = ARM_CP_NOP, .access = PL1_W },
2785 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
2786 .type = ARM_CP_NOP, .access = PL1_W },
2787 /* MMU Domain access control / MPU write buffer control */
2788 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
2789 .access = PL1_RW, .resetvalue = 0,
2790 .writefn = dacr_write, .raw_writefn = raw_write,
2791 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
2792 offsetoflow32(CPUARMState, cp15.dacr_ns) } },
2793 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
2794 .type = ARM_CP_ALIAS,
2795 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
2796 .access = PL1_RW,
2797 .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
2798 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
2799 .type = ARM_CP_ALIAS,
2800 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
2801 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[1]) },
2802 /* We rely on the access checks not allowing the guest to write to the
2803 * state field when SPSel indicates that it's being used as the stack
2804 * pointer.
2805 */
2806 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
2807 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
2808 .access = PL1_RW, .accessfn = sp_el0_access,
2809 .type = ARM_CP_ALIAS,
2810 .fieldoffset = offsetof(CPUARMState, sp_el[0]) },
2811 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64,
2812 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0,
2813 .access = PL2_RW, .type = ARM_CP_ALIAS,
2814 .fieldoffset = offsetof(CPUARMState, sp_el[1]) },
2815 { .name = "SPSel", .state = ARM_CP_STATE_AA64,
2816 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
2817 .type = ARM_CP_NO_RAW,
2818 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
2819 REGINFO_SENTINEL
2820 };
2821
2822 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */
2823 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
2824 { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
2825 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
2826 .access = PL2_RW,
2827 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
2828 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
2829 .type = ARM_CP_NO_RAW,
2830 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
2831 .access = PL2_RW,
2832 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
2833 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
2834 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
2835 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2836 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
2837 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
2838 .access = PL2_RW, .type = ARM_CP_CONST,
2839 .resetvalue = 0 },
2840 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
2841 .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
2842 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2843 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
2844 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
2845 .access = PL2_RW, .type = ARM_CP_CONST,
2846 .resetvalue = 0 },
2847 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
2848 .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
2849 .access = PL2_RW, .type = ARM_CP_CONST,
2850 .resetvalue = 0 },
2851 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
2852 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
2853 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2854 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
2855 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
2856 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2857 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
2858 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
2859 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2860 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
2861 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
2862 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2863 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
2864 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
2865 .resetvalue = 0 },
2866 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
2867 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
2868 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2869 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
2870 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
2871 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2872 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
2873 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
2874 .resetvalue = 0 },
2875 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
2876 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
2877 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2878 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
2879 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
2880 .resetvalue = 0 },
2881 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
2882 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
2883 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2884 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
2885 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
2886 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2887 REGINFO_SENTINEL
2888 };
2889
2890 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
2891 {
2892 ARMCPU *cpu = arm_env_get_cpu(env);
2893 uint64_t valid_mask = HCR_MASK;
2894
2895 if (arm_feature(env, ARM_FEATURE_EL3)) {
2896 valid_mask &= ~HCR_HCD;
2897 } else {
2898 valid_mask &= ~HCR_TSC;
2899 }
2900
2901 /* Clear RES0 bits. */
2902 value &= valid_mask;
2903
2904 /* These bits change the MMU setup:
2905 * HCR_VM enables stage 2 translation
2906 * HCR_PTW forbids certain page-table setups
2907 * HCR_DC Disables stage1 and enables stage2 translation
2908 */
2909 if ((raw_read(env, ri) ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) {
2910 tlb_flush(CPU(cpu), 1);
2911 }
2912 raw_write(env, ri, value);
2913 }
2914
2915 static const ARMCPRegInfo el2_cp_reginfo[] = {
2916 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
2917 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
2918 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
2919 .writefn = hcr_write },
2920 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64,
2921 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0,
2922 .access = PL2_RW, .resetvalue = 0,
2923 .writefn = dacr_write, .raw_writefn = raw_write,
2924 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) },
2925 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
2926 .type = ARM_CP_ALIAS,
2927 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
2928 .access = PL2_RW,
2929 .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
2930 { .name = "ESR_EL2", .state = ARM_CP_STATE_AA64,
2931 .type = ARM_CP_ALIAS,
2932 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
2933 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
2934 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64,
2935 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1,
2936 .access = PL2_RW, .resetvalue = 0,
2937 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) },
2938 { .name = "FAR_EL2", .state = ARM_CP_STATE_AA64,
2939 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
2940 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
2941 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
2942 .type = ARM_CP_ALIAS,
2943 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
2944 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[6]) },
2945 { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
2946 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
2947 .access = PL2_RW, .writefn = vbar_write,
2948 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
2949 .resetvalue = 0 },
2950 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64,
2951 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0,
2952 .access = PL3_RW, .type = ARM_CP_ALIAS,
2953 .fieldoffset = offsetof(CPUARMState, sp_el[2]) },
2954 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
2955 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
2956 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0,
2957 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]) },
2958 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
2959 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
2960 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),
2961 .resetvalue = 0 },
2962 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
2963 .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
2964 .access = PL2_RW, .type = ARM_CP_ALIAS,
2965 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },
2966 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
2967 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
2968 .access = PL2_RW, .type = ARM_CP_CONST,
2969 .resetvalue = 0 },
2970 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
2971 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
2972 .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
2973 .access = PL2_RW, .type = ARM_CP_CONST,
2974 .resetvalue = 0 },
2975 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
2976 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
2977 .access = PL2_RW, .writefn = vmsa_tcr_el1_write,
2978 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
2979 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
2980 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
2981 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
2982 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
2983 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) },
2984 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
2985 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
2986 .access = PL2_RW, .resetvalue = 0,
2987 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
2988 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
2989 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
2990 .access = PL2_RW, .resetvalue = 0,
2991 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
2992 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
2993 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
2994 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
2995 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64,
2996 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
2997 .type = ARM_CP_NO_RAW, .access = PL2_W,
2998 .writefn = tlbiall_write },
2999 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64,
3000 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
3001 .type = ARM_CP_NO_RAW, .access = PL2_W,
3002 .writefn = tlbi_aa64_vaa_write },
3003 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64,
3004 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
3005 .type = ARM_CP_NO_RAW, .access = PL2_W,
3006 .writefn = tlbi_aa64_vaa_write },
3007 #ifndef CONFIG_USER_ONLY
3008 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
3009 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
3010 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the
3011 * reset values as IMPDEF. We choose to reset to 3 to comply with
3012 * both ARMv7 and ARMv8.
3013 */
3014 .access = PL2_RW, .resetvalue = 3,
3015 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) },
3016 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
3017 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
3018 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
3019 .writefn = gt_cntvoff_write,
3020 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
3021 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
3022 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO,
3023 .writefn = gt_cntvoff_write,
3024 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
3025 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
3026 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
3027 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
3028 .type = ARM_CP_IO, .access = PL2_RW,
3029 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
3030 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
3031 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
3032 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO,
3033 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
3034 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
3035 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
3036 .type = ARM_CP_IO, .access = PL2_RW,
3037 .resetfn = gt_hyp_timer_reset,
3038 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write },
3039 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
3040 .type = ARM_CP_IO,
3041 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
3042 .access = PL2_RW,
3043 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl),
3044 .resetvalue = 0,
3045 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
3046 #endif
3047 REGINFO_SENTINEL
3048 };
3049
3050 static const ARMCPRegInfo el3_cp_reginfo[] = {
3051 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
3052 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
3053 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
3054 .resetvalue = 0, .writefn = scr_write },
3055 { .name = "SCR", .type = ARM_CP_ALIAS,
3056 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
3057 .access = PL3_RW, .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
3058 .writefn = scr_write },
3059 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
3060 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
3061 .access = PL3_RW, .resetvalue = 0,
3062 .fieldoffset = offsetof(CPUARMState, cp15.sder) },
3063 { .name = "SDER",
3064 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1,
3065 .access = PL3_RW, .resetvalue = 0,
3066 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) },
3067 /* TODO: Implement NSACR trapping of secure EL1 accesses to EL3 */
3068 { .name = "NSACR", .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
3069 .access = PL3_W | PL1_R, .resetvalue = 0,
3070 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) },
3071 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
3072 .access = PL3_RW, .writefn = vbar_write, .resetvalue = 0,
3073 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) },
3074 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
3075 .type = ARM_CP_ALIAS, /* reset handled by AArch32 view */
3076 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
3077 .access = PL3_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
3078 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]) },
3079 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64,
3080 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0,
3081 .access = PL3_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
3082 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) },
3083 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
3084 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2,
3085 .access = PL3_RW, .writefn = vmsa_tcr_el1_write,
3086 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
3087 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) },
3088 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
3089 .type = ARM_CP_ALIAS,
3090 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
3091 .access = PL3_RW,
3092 .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
3093 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
3094 .type = ARM_CP_ALIAS,
3095 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
3096 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) },
3097 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64,
3098 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0,
3099 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) },
3100 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
3101 .type = ARM_CP_ALIAS,
3102 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
3103 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[7]) },
3104 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
3105 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
3106 .access = PL3_RW, .writefn = vbar_write,
3107 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
3108 .resetvalue = 0 },
3109 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64,
3110 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2,
3111 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0,
3112 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) },
3113 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64,
3114 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2,
3115 .access = PL3_RW, .resetvalue = 0,
3116 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) },
3117 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64,
3118 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0,
3119 .access = PL3_RW, .type = ARM_CP_CONST,
3120 .resetvalue = 0 },
3121 REGINFO_SENTINEL
3122 };
3123
3124 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
3125 {
3126 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
3127 * but the AArch32 CTR has its own reginfo struct)
3128 */
3129 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) {
3130 return CP_ACCESS_TRAP;
3131 }
3132 return CP_ACCESS_OK;
3133 }
3134
3135 static const ARMCPRegInfo debug_cp_reginfo[] = {
3136 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
3137 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
3138 * unlike DBGDRAR it is never accessible from EL0.
3139 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
3140 * accessor.
3141 */
3142 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
3143 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3144 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
3145 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
3146 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3147 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
3148 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3149 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
3150 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
3151 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
3152 .access = PL1_RW,
3153 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
3154 .resetvalue = 0 },
3155 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1.
3156 * We don't implement the configurable EL0 access.
3157 */
3158 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH,
3159 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
3160 .type = ARM_CP_ALIAS,
3161 .access = PL1_R,
3162 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
3163 /* We define a dummy WI OSLAR_EL1, because Linux writes to it. */
3164 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
3165 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
3166 .access = PL1_W, .type = ARM_CP_NOP },
3167 /* Dummy OSDLR_EL1: 32-bit Linux will read this */
3168 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
3169 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
3170 .access = PL1_RW, .type = ARM_CP_NOP },
3171 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
3172 * implement vector catch debug events yet.
3173 */
3174 { .name = "DBGVCR",
3175 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
3176 .access = PL1_RW, .type = ARM_CP_NOP },
3177 REGINFO_SENTINEL
3178 };
3179
3180 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
3181 /* 64 bit access versions of the (dummy) debug registers */
3182 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
3183 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
3184 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
3185 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
3186 REGINFO_SENTINEL
3187 };
3188
3189 void hw_watchpoint_update(ARMCPU *cpu, int n)
3190 {
3191 CPUARMState *env = &cpu->env;
3192 vaddr len = 0;
3193 vaddr wvr = env->cp15.dbgwvr[n];
3194 uint64_t wcr = env->cp15.dbgwcr[n];
3195 int mask;
3196 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
3197
3198 if (env->cpu_watchpoint[n]) {
3199 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
3200 env->cpu_watchpoint[n] = NULL;
3201 }
3202
3203 if (!extract64(wcr, 0, 1)) {
3204 /* E bit clear : watchpoint disabled */
3205 return;
3206 }
3207
3208 switch (extract64(wcr, 3, 2)) {
3209 case 0:
3210 /* LSC 00 is reserved and must behave as if the wp is disabled */
3211 return;
3212 case 1:
3213 flags |= BP_MEM_READ;
3214 break;
3215 case 2:
3216 flags |= BP_MEM_WRITE;
3217 break;
3218 case 3:
3219 flags |= BP_MEM_ACCESS;
3220 break;
3221 }
3222
3223 /* Attempts to use both MASK and BAS fields simultaneously are
3224 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
3225 * thus generating a watchpoint for every byte in the masked region.
3226 */
3227 mask = extract64(wcr, 24, 4);
3228 if (mask == 1 || mask == 2) {
3229 /* Reserved values of MASK; we must act as if the mask value was
3230 * some non-reserved value, or as if the watchpoint were disabled.
3231 * We choose the latter.
3232 */
3233 return;
3234 } else if (mask) {
3235 /* Watchpoint covers an aligned area up to 2GB in size */
3236 len = 1ULL << mask;
3237 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
3238 * whether the watchpoint fires when the unmasked bits match; we opt
3239 * to generate the exceptions.
3240 */
3241 wvr &= ~(len - 1);
3242 } else {
3243 /* Watchpoint covers bytes defined by the byte address select bits */
3244 int bas = extract64(wcr, 5, 8);
3245 int basstart;
3246
3247 if (bas == 0) {
3248 /* This must act as if the watchpoint is disabled */
3249 return;
3250 }
3251
3252 if (extract64(wvr, 2, 1)) {
3253 /* Deprecated case of an only 4-aligned address. BAS[7:4] are
3254 * ignored, and BAS[3:0] define which bytes to watch.
3255 */
3256 bas &= 0xf;
3257 }
3258 /* The BAS bits are supposed to be programmed to indicate a contiguous
3259 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
3260 * we fire for each byte in the word/doubleword addressed by the WVR.
3261 * We choose to ignore any non-zero bits after the first range of 1s.
3262 */
3263 basstart = ctz32(bas);
3264 len = cto32(bas >> basstart);
3265 wvr += basstart;
3266 }
3267
3268 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
3269 &env->cpu_watchpoint[n]);
3270 }
3271
3272 void hw_watchpoint_update_all(ARMCPU *cpu)
3273 {
3274 int i;
3275 CPUARMState *env = &cpu->env;
3276
3277 /* Completely clear out existing QEMU watchpoints and our array, to
3278 * avoid possible stale entries following migration load.
3279 */
3280 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
3281 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
3282
3283 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
3284 hw_watchpoint_update(cpu, i);
3285 }
3286 }
3287
3288 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3289 uint64_t value)
3290 {
3291 ARMCPU *cpu = arm_env_get_cpu(env);
3292 int i = ri->crm;
3293
3294 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
3295 * register reads and behaves as if values written are sign extended.
3296 * Bits [1:0] are RES0.
3297 */
3298 value = sextract64(value, 0, 49) & ~3ULL;
3299
3300 raw_write(env, ri, value);
3301 hw_watchpoint_update(cpu, i);
3302 }
3303
3304 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3305 uint64_t value)
3306 {
3307 ARMCPU *cpu = arm_env_get_cpu(env);
3308 int i = ri->crm;
3309
3310 raw_write(env, ri, value);
3311 hw_watchpoint_update(cpu, i);
3312 }
3313
3314 void hw_breakpoint_update(ARMCPU *cpu, int n)
3315 {
3316 CPUARMState *env = &cpu->env;
3317 uint64_t bvr = env->cp15.dbgbvr[n];
3318 uint64_t bcr = env->cp15.dbgbcr[n];
3319 vaddr addr;
3320 int bt;
3321 int flags = BP_CPU;
3322
3323 if (env->cpu_breakpoint[n]) {
3324 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
3325 env->cpu_breakpoint[n] = NULL;
3326 }
3327
3328 if (!extract64(bcr, 0, 1)) {
3329 /* E bit clear : watchpoint disabled */
3330 return;
3331 }
3332
3333 bt = extract64(bcr, 20, 4);
3334
3335 switch (bt) {
3336 case 4: /* unlinked address mismatch (reserved if AArch64) */
3337 case 5: /* linked address mismatch (reserved if AArch64) */
3338 qemu_log_mask(LOG_UNIMP,
3339 "arm: address mismatch breakpoint types not implemented");
3340 return;
3341 case 0: /* unlinked address match */
3342 case 1: /* linked address match */
3343 {
3344 /* Bits [63:49] are hardwired to the value of bit [48]; that is,
3345 * we behave as if the register was sign extended. Bits [1:0] are
3346 * RES0. The BAS field is used to allow setting breakpoints on 16
3347 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether
3348 * a bp will fire if the addresses covered by the bp and the addresses
3349 * covered by the insn overlap but the insn doesn't start at the
3350 * start of the bp address range. We choose to require the insn and
3351 * the bp to have the same address. The constraints on writing to
3352 * BAS enforced in dbgbcr_write mean we have only four cases:
3353 * 0b0000 => no breakpoint
3354 * 0b0011 => breakpoint on addr
3355 * 0b1100 => breakpoint on addr + 2
3356 * 0b1111 => breakpoint on addr
3357 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
3358 */
3359 int bas = extract64(bcr, 5, 4);
3360 addr = sextract64(bvr, 0, 49) & ~3ULL;
3361 if (bas == 0) {
3362 return;
3363 }
3364 if (bas == 0xc) {
3365 addr += 2;
3366 }
3367 break;
3368 }
3369 case 2: /* unlinked context ID match */
3370 case 8: /* unlinked VMID match (reserved if no EL2) */
3371 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
3372 qemu_log_mask(LOG_UNIMP,
3373 "arm: unlinked context breakpoint types not implemented");
3374 return;
3375 case 9: /* linked VMID match (reserved if no EL2) */
3376 case 11: /* linked context ID and VMID match (reserved if no EL2) */
3377 case 3: /* linked context ID match */
3378 default:
3379 /* We must generate no events for Linked context matches (unless
3380 * they are linked to by some other bp/wp, which is handled in
3381 * updates for the linking bp/wp). We choose to also generate no events
3382 * for reserved values.
3383 */
3384 return;
3385 }
3386
3387 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
3388 }
3389
3390 void hw_breakpoint_update_all(ARMCPU *cpu)
3391 {
3392 int i;
3393 CPUARMState *env = &cpu->env;
3394
3395 /* Completely clear out existing QEMU breakpoints and our array, to
3396 * avoid possible stale entries following migration load.
3397 */
3398 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
3399 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
3400
3401 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
3402 hw_breakpoint_update(cpu, i);
3403 }
3404 }
3405
3406 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3407 uint64_t value)
3408 {
3409 ARMCPU *cpu = arm_env_get_cpu(env);
3410 int i = ri->crm;
3411
3412 raw_write(env, ri, value);
3413 hw_breakpoint_update(cpu, i);
3414 }
3415
3416 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3417 uint64_t value)
3418 {
3419 ARMCPU *cpu = arm_env_get_cpu(env);
3420 int i = ri->crm;
3421
3422 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
3423 * copy of BAS[0].
3424 */
3425 value = deposit64(value, 6, 1, extract64(value, 5, 1));
3426 value = deposit64(value, 8, 1, extract64(value, 7, 1));
3427
3428 raw_write(env, ri, value);
3429 hw_breakpoint_update(cpu, i);
3430 }
3431
3432 static void define_debug_regs(ARMCPU *cpu)
3433 {
3434 /* Define v7 and v8 architectural debug registers.
3435 * These are just dummy implementations for now.
3436 */
3437 int i;
3438 int wrps, brps, ctx_cmps;
3439 ARMCPRegInfo dbgdidr = {
3440 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
3441 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr,
3442 };
3443
3444 /* Note that all these register fields hold "number of Xs minus 1". */
3445 brps = extract32(cpu->dbgdidr, 24, 4);
3446 wrps = extract32(cpu->dbgdidr, 28, 4);
3447 ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
3448
3449 assert(ctx_cmps <= brps);
3450
3451 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties
3452 * of the debug registers such as number of breakpoints;
3453 * check that if they both exist then they agree.
3454 */
3455 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
3456 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps);
3457 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps);
3458 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps);
3459 }
3460
3461 define_one_arm_cp_reg(cpu, &dbgdidr);
3462 define_arm_cp_regs(cpu, debug_cp_reginfo);
3463
3464 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
3465 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
3466 }
3467
3468 for (i = 0; i < brps + 1; i++) {
3469 ARMCPRegInfo dbgregs[] = {
3470 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH,
3471 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
3472 .access = PL1_RW,
3473 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
3474 .writefn = dbgbvr_write, .raw_writefn = raw_write
3475 },
3476 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH,
3477 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
3478 .access = PL1_RW,
3479 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
3480 .writefn = dbgbcr_write, .raw_writefn = raw_write
3481 },
3482 REGINFO_SENTINEL
3483 };
3484 define_arm_cp_regs(cpu, dbgregs);
3485 }
3486
3487 for (i = 0; i < wrps + 1; i++) {
3488 ARMCPRegInfo dbgregs[] = {
3489 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH,
3490 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
3491 .access = PL1_RW,
3492 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
3493 .writefn = dbgwvr_write, .raw_writefn = raw_write
3494 },
3495 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH,
3496 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
3497 .access = PL1_RW,
3498 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
3499 .writefn = dbgwcr_write, .raw_writefn = raw_write
3500 },
3501 REGINFO_SENTINEL
3502 };
3503 define_arm_cp_regs(cpu, dbgregs);
3504 }
3505 }
3506
3507 void register_cp_regs_for_features(ARMCPU *cpu)
3508 {
3509 /* Register all the coprocessor registers based on feature bits */
3510 CPUARMState *env = &cpu->env;
3511 if (arm_feature(env, ARM_FEATURE_M)) {
3512 /* M profile has no coprocessor registers */
3513 return;
3514 }
3515
3516 define_arm_cp_regs(cpu, cp_reginfo);
3517 if (!arm_feature(env, ARM_FEATURE_V8)) {
3518 /* Must go early as it is full of wildcards that may be
3519 * overridden by later definitions.
3520 */
3521 define_arm_cp_regs(cpu, not_v8_cp_reginfo);
3522 }
3523
3524 if (arm_feature(env, ARM_FEATURE_V6)) {
3525 /* The ID registers all have impdef reset values */
3526 ARMCPRegInfo v6_idregs[] = {
3527 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
3528 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
3529 .access = PL1_R, .type = ARM_CP_CONST,
3530 .resetvalue = cpu->id_pfr0 },
3531 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
3532 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
3533 .access = PL1_R, .type = ARM_CP_CONST,
3534 .resetvalue = cpu->id_pfr1 },
3535 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
3536 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
3537 .access = PL1_R, .type = ARM_CP_CONST,
3538 .resetvalue = cpu->id_dfr0 },
3539 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
3540 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
3541 .access = PL1_R, .type = ARM_CP_CONST,
3542 .resetvalue = cpu->id_afr0 },
3543 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
3544 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
3545 .access = PL1_R, .type = ARM_CP_CONST,
3546 .resetvalue = cpu->id_mmfr0 },
3547 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
3548 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
3549 .access = PL1_R, .type = ARM_CP_CONST,
3550 .resetvalue = cpu->id_mmfr1 },
3551 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
3552 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
3553 .access = PL1_R, .type = ARM_CP_CONST,
3554 .resetvalue = cpu->id_mmfr2 },
3555 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
3556 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
3557 .access = PL1_R, .type = ARM_CP_CONST,
3558 .resetvalue = cpu->id_mmfr3 },
3559 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
3560 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
3561 .access = PL1_R, .type = ARM_CP_CONST,
3562 .resetvalue = cpu->id_isar0 },
3563 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
3564 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
3565 .access = PL1_R, .type = ARM_CP_CONST,
3566 .resetvalue = cpu->id_isar1 },
3567 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
3568 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
3569 .access = PL1_R, .type = ARM_CP_CONST,
3570 .resetvalue = cpu->id_isar2 },
3571 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
3572 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
3573 .access = PL1_R, .type = ARM_CP_CONST,
3574 .resetvalue = cpu->id_isar3 },
3575 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
3576 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
3577 .access = PL1_R, .type = ARM_CP_CONST,
3578 .resetvalue = cpu->id_isar4 },
3579 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
3580 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
3581 .access = PL1_R, .type = ARM_CP_CONST,
3582 .resetvalue = cpu->id_isar5 },
3583 /* 6..7 are as yet unallocated and must RAZ */
3584 { .name = "ID_ISAR6", .cp = 15, .crn = 0, .crm = 2,
3585 .opc1 = 0, .opc2 = 6, .access = PL1_R, .type = ARM_CP_CONST,
3586 .resetvalue = 0 },
3587 { .name = "ID_ISAR7", .cp = 15, .crn = 0, .crm = 2,
3588 .opc1 = 0, .opc2 = 7, .access = PL1_R, .type = ARM_CP_CONST,
3589 .resetvalue = 0 },
3590 REGINFO_SENTINEL
3591 };
3592 define_arm_cp_regs(cpu, v6_idregs);
3593 define_arm_cp_regs(cpu, v6_cp_reginfo);
3594 } else {
3595 define_arm_cp_regs(cpu, not_v6_cp_reginfo);
3596 }
3597 if (arm_feature(env, ARM_FEATURE_V6K)) {
3598 define_arm_cp_regs(cpu, v6k_cp_reginfo);
3599 }
3600 if (arm_feature(env, ARM_FEATURE_V7MP) &&
3601 !arm_feature(env, ARM_FEATURE_MPU)) {
3602 define_arm_cp_regs(cpu, v7mp_cp_reginfo);
3603 }
3604 if (arm_feature(env, ARM_FEATURE_V7)) {
3605 /* v7 performance monitor control register: same implementor
3606 * field as main ID register, and we implement only the cycle
3607 * count register.
3608 */
3609 #ifndef CONFIG_USER_ONLY
3610 ARMCPRegInfo pmcr = {
3611 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
3612 .access = PL0_RW,
3613 .type = ARM_CP_IO | ARM_CP_ALIAS,
3614 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
3615 .accessfn = pmreg_access, .writefn = pmcr_write,
3616 .raw_writefn = raw_write,
3617 };
3618 ARMCPRegInfo pmcr64 = {
3619 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
3620 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
3621 .access = PL0_RW, .accessfn = pmreg_access,
3622 .type = ARM_CP_IO,
3623 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
3624 .resetvalue = cpu->midr & 0xff000000,
3625 .writefn = pmcr_write, .raw_writefn = raw_write,
3626 };
3627 define_one_arm_cp_reg(cpu, &pmcr);
3628 define_one_arm_cp_reg(cpu, &pmcr64);
3629 #endif
3630 ARMCPRegInfo clidr = {
3631 .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
3632 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
3633 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr
3634 };
3635 define_one_arm_cp_reg(cpu, &clidr);
3636 define_arm_cp_regs(cpu, v7_cp_reginfo);
3637 define_debug_regs(cpu);
3638 } else {
3639 define_arm_cp_regs(cpu, not_v7_cp_reginfo);
3640 }
3641 if (arm_feature(env, ARM_FEATURE_V8)) {
3642 /* AArch64 ID registers, which all have impdef reset values */
3643 ARMCPRegInfo v8_idregs[] = {
3644 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
3645 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
3646 .access = PL1_R, .type = ARM_CP_CONST,
3647 .resetvalue = cpu->id_aa64pfr0 },
3648 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
3649 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
3650 .access = PL1_R, .type = ARM_CP_CONST,
3651 .resetvalue = cpu->id_aa64pfr1},
3652 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
3653 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
3654 .access = PL1_R, .type = ARM_CP_CONST,
3655 /* We mask out the PMUVer field, because we don't currently
3656 * implement the PMU. Not advertising it prevents the guest
3657 * from trying to use it and getting UNDEFs on registers we
3658 * don't implement.
3659 */
3660 .resetvalue = cpu->id_aa64dfr0 & ~0xf00 },
3661 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
3662 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
3663 .access = PL1_R, .type = ARM_CP_CONST,
3664 .resetvalue = cpu->id_aa64dfr1 },
3665 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
3666 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
3667 .access = PL1_R, .type = ARM_CP_CONST,
3668 .resetvalue = cpu->id_aa64afr0 },
3669 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
3670 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
3671 .access = PL1_R, .type = ARM_CP_CONST,
3672 .resetvalue = cpu->id_aa64afr1 },
3673 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
3674 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
3675 .access = PL1_R, .type = ARM_CP_CONST,
3676 .resetvalue = cpu->id_aa64isar0 },
3677 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
3678 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
3679 .access = PL1_R, .type = ARM_CP_CONST,
3680 .resetvalue = cpu->id_aa64isar1 },
3681 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
3682 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
3683 .access = PL1_R, .type = ARM_CP_CONST,
3684 .resetvalue = cpu->id_aa64mmfr0 },
3685 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
3686 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
3687 .access = PL1_R, .type = ARM_CP_CONST,
3688 .resetvalue = cpu->id_aa64mmfr1 },
3689 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
3690 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
3691 .access = PL1_R, .type = ARM_CP_CONST,
3692 .resetvalue = cpu->mvfr0 },
3693 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
3694 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
3695 .access = PL1_R, .type = ARM_CP_CONST,
3696 .resetvalue = cpu->mvfr1 },
3697 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
3698 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
3699 .access = PL1_R, .type = ARM_CP_CONST,
3700 .resetvalue = cpu->mvfr2 },
3701 REGINFO_SENTINEL
3702 };
3703 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */
3704 if (!arm_feature(env, ARM_FEATURE_EL3) &&
3705 !arm_feature(env, ARM_FEATURE_EL2)) {
3706 ARMCPRegInfo rvbar = {
3707 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
3708 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
3709 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
3710 };
3711 define_one_arm_cp_reg(cpu, &rvbar);
3712 }
3713 define_arm_cp_regs(cpu, v8_idregs);
3714 define_arm_cp_regs(cpu, v8_cp_reginfo);
3715 }
3716 if (arm_feature(env, ARM_FEATURE_EL2)) {
3717 define_arm_cp_regs(cpu, el2_cp_reginfo);
3718 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */
3719 if (!arm_feature(env, ARM_FEATURE_EL3)) {
3720 ARMCPRegInfo rvbar = {
3721 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
3722 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
3723 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar
3724 };
3725 define_one_arm_cp_reg(cpu, &rvbar);
3726 }
3727 } else {
3728 /* If EL2 is missing but higher ELs are enabled, we need to
3729 * register the no_el2 reginfos.
3730 */
3731 if (arm_feature(env, ARM_FEATURE_EL3)) {
3732 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo);
3733 }
3734 }
3735 if (arm_feature(env, ARM_FEATURE_EL3)) {
3736 define_arm_cp_regs(cpu, el3_cp_reginfo);
3737 ARMCPRegInfo rvbar = {
3738 .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
3739 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
3740 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar
3741 };
3742 define_one_arm_cp_reg(cpu, &rvbar);
3743 }
3744 if (arm_feature(env, ARM_FEATURE_MPU)) {
3745 if (arm_feature(env, ARM_FEATURE_V6)) {
3746 /* PMSAv6 not implemented */
3747 assert(arm_feature(env, ARM_FEATURE_V7));
3748 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
3749 define_arm_cp_regs(cpu, pmsav7_cp_reginfo);
3750 } else {
3751 define_arm_cp_regs(cpu, pmsav5_cp_reginfo);
3752 }
3753 } else {
3754 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
3755 define_arm_cp_regs(cpu, vmsa_cp_reginfo);
3756 }
3757 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
3758 define_arm_cp_regs(cpu, t2ee_cp_reginfo);
3759 }
3760 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
3761 define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
3762 }
3763 if (arm_feature(env, ARM_FEATURE_VAPA)) {
3764 define_arm_cp_regs(cpu, vapa_cp_reginfo);
3765 }
3766 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) {
3767 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo);
3768 }
3769 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) {
3770 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo);
3771 }
3772 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) {
3773 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo);
3774 }
3775 if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
3776 define_arm_cp_regs(cpu, omap_cp_reginfo);
3777 }
3778 if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
3779 define_arm_cp_regs(cpu, strongarm_cp_reginfo);
3780 }
3781 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
3782 define_arm_cp_regs(cpu, xscale_cp_reginfo);
3783 }
3784 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
3785 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
3786 }
3787 if (arm_feature(env, ARM_FEATURE_LPAE)) {
3788 define_arm_cp_regs(cpu, lpae_cp_reginfo);
3789 }
3790 /* Slightly awkwardly, the OMAP and StrongARM cores need all of
3791 * cp15 crn=0 to be writes-ignored, whereas for other cores they should
3792 * be read-only (ie write causes UNDEF exception).
3793 */
3794 {
3795 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = {
3796 /* Pre-v8 MIDR space.
3797 * Note that the MIDR isn't a simple constant register because
3798 * of the TI925 behaviour where writes to another register can
3799 * cause the MIDR value to change.
3800 *
3801 * Unimplemented registers in the c15 0 0 0 space default to
3802 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
3803 * and friends override accordingly.
3804 */
3805 { .name = "MIDR",
3806 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
3807 .access = PL1_R, .resetvalue = cpu->midr,
3808 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
3809 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
3810 .type = ARM_CP_OVERRIDE },
3811 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
3812 { .name = "DUMMY",
3813 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY,
3814 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3815 { .name = "DUMMY",
3816 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY,
3817 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3818 { .name = "DUMMY",
3819 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY,
3820 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3821 { .name = "DUMMY",
3822 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY,
3823 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3824 { .name = "DUMMY",
3825 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
3826 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3827 REGINFO_SENTINEL
3828 };
3829 ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
3830 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
3831 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0,
3832 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->midr },
3833 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */
3834 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
3835 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
3836 .access = PL1_R, .resetvalue = cpu->midr },
3837 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
3838 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7,
3839 .access = PL1_R, .resetvalue = cpu->midr },
3840 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
3841 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
3842 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->revidr },
3843 REGINFO_SENTINEL
3844 };
3845 ARMCPRegInfo id_cp_reginfo[] = {
3846 /* These are common to v8 and pre-v8 */
3847 { .name = "CTR",
3848 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
3849 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
3850 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64,
3851 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0,
3852 .access = PL0_R, .accessfn = ctr_el0_access,
3853 .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
3854 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
3855 { .name = "TCMTR",
3856 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
3857 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3858 REGINFO_SENTINEL
3859 };
3860 /* TLBTR is specific to VMSA */
3861 ARMCPRegInfo id_tlbtr_reginfo = {
3862 .name = "TLBTR",
3863 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
3864 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0,
3865 };
3866 /* MPUIR is specific to PMSA V6+ */
3867 ARMCPRegInfo id_mpuir_reginfo = {
3868 .name = "MPUIR",
3869 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
3870 .access = PL1_R, .type = ARM_CP_CONST,
3871 .resetvalue = cpu->pmsav7_dregion << 8
3872 };
3873 ARMCPRegInfo crn0_wi_reginfo = {
3874 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
3875 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
3876 .type = ARM_CP_NOP | ARM_CP_OVERRIDE
3877 };
3878 if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
3879 arm_feature(env, ARM_FEATURE_STRONGARM)) {
3880 ARMCPRegInfo *r;
3881 /* Register the blanket "writes ignored" value first to cover the
3882 * whole space. Then update the specific ID registers to allow write
3883 * access, so that they ignore writes rather than causing them to
3884 * UNDEF.
3885 */
3886 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
3887 for (r = id_pre_v8_midr_cp_reginfo;
3888 r->type != ARM_CP_SENTINEL; r++) {
3889 r->access = PL1_RW;
3890 }
3891 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
3892 r->access = PL1_RW;
3893 }
3894 id_tlbtr_reginfo.access = PL1_RW;
3895 id_tlbtr_reginfo.access = PL1_RW;
3896 }
3897 if (arm_feature(env, ARM_FEATURE_V8)) {
3898 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
3899 } else {
3900 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
3901 }
3902 define_arm_cp_regs(cpu, id_cp_reginfo);
3903 if (!arm_feature(env, ARM_FEATURE_MPU)) {
3904 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
3905 } else if (arm_feature(env, ARM_FEATURE_V7)) {
3906 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
3907 }
3908 }
3909
3910 if (arm_feature(env, ARM_FEATURE_MPIDR)) {
3911 define_arm_cp_regs(cpu, mpidr_cp_reginfo);
3912 }
3913
3914 if (arm_feature(env, ARM_FEATURE_AUXCR)) {
3915 ARMCPRegInfo auxcr = {
3916 .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH,
3917 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1,
3918 .access = PL1_RW, .type = ARM_CP_CONST,
3919 .resetvalue = cpu->reset_auxcr
3920 };
3921 define_one_arm_cp_reg(cpu, &auxcr);
3922 }
3923
3924 if (arm_feature(env, ARM_FEATURE_CBAR)) {
3925 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
3926 /* 32 bit view is [31:18] 0...0 [43:32]. */
3927 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
3928 | extract64(cpu->reset_cbar, 32, 12);
3929 ARMCPRegInfo cbar_reginfo[] = {
3930 { .name = "CBAR",
3931 .type = ARM_CP_CONST,
3932 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
3933 .access = PL1_R, .resetvalue = cpu->reset_cbar },
3934 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
3935 .type = ARM_CP_CONST,
3936 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
3937 .access = PL1_R, .resetvalue = cbar32 },
3938 REGINFO_SENTINEL
3939 };
3940 /* We don't implement a r/w 64 bit CBAR currently */
3941 assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
3942 define_arm_cp_regs(cpu, cbar_reginfo);
3943 } else {
3944 ARMCPRegInfo cbar = {
3945 .name = "CBAR",
3946 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
3947 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar,
3948 .fieldoffset = offsetof(CPUARMState,
3949 cp15.c15_config_base_address)
3950 };
3951 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
3952 cbar.access = PL1_R;
3953 cbar.fieldoffset = 0;
3954 cbar.type = ARM_CP_CONST;
3955 }
3956 define_one_arm_cp_reg(cpu, &cbar);
3957 }
3958 }
3959
3960 /* Generic registers whose values depend on the implementation */
3961 {
3962 ARMCPRegInfo sctlr = {
3963 .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
3964 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
3965 .access = PL1_RW,
3966 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s),
3967 offsetof(CPUARMState, cp15.sctlr_ns) },
3968 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
3969 .raw_writefn = raw_write,
3970 };
3971 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
3972 /* Normally we would always end the TB on an SCTLR write, but Linux
3973 * arch/arm/mach-pxa/sleep.S expects two instructions following
3974 * an MMU enable to execute from cache. Imitate this behaviour.
3975 */
3976 sctlr.type |= ARM_CP_SUPPRESS_TB_END;
3977 }
3978 define_one_arm_cp_reg(cpu, &sctlr);
3979 }
3980 }
3981
3982 ARMCPU *cpu_arm_init(const char *cpu_model)
3983 {
3984 return ARM_CPU(cpu_generic_init(TYPE_ARM_CPU, cpu_model));
3985 }
3986
3987 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
3988 {
3989 CPUState *cs = CPU(cpu);
3990 CPUARMState *env = &cpu->env;
3991
3992 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
3993 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
3994 aarch64_fpu_gdb_set_reg,
3995 34, "aarch64-fpu.xml", 0);
3996 } else if (arm_feature(env, ARM_FEATURE_NEON)) {
3997 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
3998 51, "arm-neon.xml", 0);
3999 } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
4000 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
4001 35, "arm-vfp3.xml", 0);
4002 } else if (arm_feature(env, ARM_FEATURE_VFP)) {
4003 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
4004 19, "arm-vfp.xml", 0);
4005 }
4006 }
4007
4008 /* Sort alphabetically by type name, except for "any". */
4009 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b)
4010 {
4011 ObjectClass *class_a = (ObjectClass *)a;
4012 ObjectClass *class_b = (ObjectClass *)b;
4013 const char *name_a, *name_b;
4014
4015 name_a = object_class_get_name(class_a);
4016 name_b = object_class_get_name(class_b);
4017 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) {
4018 return 1;
4019 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) {
4020 return -1;
4021 } else {
4022 return strcmp(name_a, name_b);
4023 }
4024 }
4025
4026 static void arm_cpu_list_entry(gpointer data, gpointer user_data)
4027 {
4028 ObjectClass *oc = data;
4029 CPUListState *s = user_data;
4030 const char *typename;
4031 char *name;
4032
4033 typename = object_class_get_name(oc);
4034 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU));
4035 (*s->cpu_fprintf)(s->file, " %s\n",
4036 name);
4037 g_free(name);
4038 }
4039
4040 void arm_cpu_list(FILE *f, fprintf_function cpu_fprintf)
4041 {
4042 CPUListState s = {
4043 .file = f,
4044 .cpu_fprintf = cpu_fprintf,
4045 };
4046 GSList *list;
4047
4048 list = object_class_get_list(TYPE_ARM_CPU, false);
4049 list = g_slist_sort(list, arm_cpu_list_compare);
4050 (*cpu_fprintf)(f, "Available CPUs:\n");
4051 g_slist_foreach(list, arm_cpu_list_entry, &s);
4052 g_slist_free(list);
4053 #ifdef CONFIG_KVM
4054 /* The 'host' CPU type is dynamically registered only if KVM is
4055 * enabled, so we have to special-case it here:
4056 */
4057 (*cpu_fprintf)(f, " host (only available in KVM mode)\n");
4058 #endif
4059 }
4060
4061 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
4062 {
4063 ObjectClass *oc = data;
4064 CpuDefinitionInfoList **cpu_list = user_data;
4065 CpuDefinitionInfoList *entry;
4066 CpuDefinitionInfo *info;
4067 const char *typename;
4068
4069 typename = object_class_get_name(oc);
4070 info = g_malloc0(sizeof(*info));
4071 info->name = g_strndup(typename,
4072 strlen(typename) - strlen("-" TYPE_ARM_CPU));
4073
4074 entry = g_malloc0(sizeof(*entry));
4075 entry->value = info;
4076 entry->next = *cpu_list;
4077 *cpu_list = entry;
4078 }
4079
4080 CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp)
4081 {
4082 CpuDefinitionInfoList *cpu_list = NULL;
4083 GSList *list;
4084
4085 list = object_class_get_list(TYPE_ARM_CPU, false);
4086 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list);
4087 g_slist_free(list);
4088
4089 return cpu_list;
4090 }
4091
4092 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
4093 void *opaque, int state, int secstate,
4094 int crm, int opc1, int opc2)
4095 {
4096 /* Private utility function for define_one_arm_cp_reg_with_opaque():
4097 * add a single reginfo struct to the hash table.
4098 */
4099 uint32_t *key = g_new(uint32_t, 1);
4100 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
4101 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
4102 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
4103
4104 /* Reset the secure state to the specific incoming state. This is
4105 * necessary as the register may have been defined with both states.
4106 */
4107 r2->secure = secstate;
4108
4109 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
4110 /* Register is banked (using both entries in array).
4111 * Overwriting fieldoffset as the array is only used to define
4112 * banked registers but later only fieldoffset is used.
4113 */
4114 r2->fieldoffset = r->bank_fieldoffsets[ns];
4115 }
4116
4117 if (state == ARM_CP_STATE_AA32) {
4118 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
4119 /* If the register is banked then we don't need to migrate or
4120 * reset the 32-bit instance in certain cases:
4121 *
4122 * 1) If the register has both 32-bit and 64-bit instances then we
4123 * can count on the 64-bit instance taking care of the
4124 * non-secure bank.
4125 * 2) If ARMv8 is enabled then we can count on a 64-bit version
4126 * taking care of the secure bank. This requires that separate
4127 * 32 and 64-bit definitions are provided.
4128 */
4129 if ((r->state == ARM_CP_STATE_BOTH && ns) ||
4130 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) {
4131 r2->type |= ARM_CP_ALIAS;
4132 }
4133 } else if ((secstate != r->secure) && !ns) {
4134 /* The register is not banked so we only want to allow migration of
4135 * the non-secure instance.
4136 */
4137 r2->type |= ARM_CP_ALIAS;
4138 }
4139
4140 if (r->state == ARM_CP_STATE_BOTH) {
4141 /* We assume it is a cp15 register if the .cp field is left unset.
4142 */
4143 if (r2->cp == 0) {
4144 r2->cp = 15;
4145 }
4146
4147 #ifdef HOST_WORDS_BIGENDIAN
4148 if (r2->fieldoffset) {
4149 r2->fieldoffset += sizeof(uint32_t);
4150 }
4151 #endif
4152 }
4153 }
4154 if (state == ARM_CP_STATE_AA64) {
4155 /* To allow abbreviation of ARMCPRegInfo
4156 * definitions, we treat cp == 0 as equivalent to
4157 * the value for "standard guest-visible sysreg".
4158 * STATE_BOTH definitions are also always "standard
4159 * sysreg" in their AArch64 view (the .cp value may
4160 * be non-zero for the benefit of the AArch32 view).
4161 */
4162 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
4163 r2->cp = CP_REG_ARM64_SYSREG_CP;
4164 }
4165 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
4166 r2->opc0, opc1, opc2);
4167 } else {
4168 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
4169 }
4170 if (opaque) {
4171 r2->opaque = opaque;
4172 }
4173 /* reginfo passed to helpers is correct for the actual access,
4174 * and is never ARM_CP_STATE_BOTH:
4175 */
4176 r2->state = state;
4177 /* Make sure reginfo passed to helpers for wildcarded regs
4178 * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
4179 */
4180 r2->crm = crm;
4181 r2->opc1 = opc1;
4182 r2->opc2 = opc2;
4183 /* By convention, for wildcarded registers only the first
4184 * entry is used for migration; the others are marked as
4185 * ALIAS so we don't try to transfer the register
4186 * multiple times. Special registers (ie NOP/WFI) are
4187 * never migratable and not even raw-accessible.
4188 */
4189 if ((r->type & ARM_CP_SPECIAL)) {
4190 r2->type |= ARM_CP_NO_RAW;
4191 }
4192 if (((r->crm == CP_ANY) && crm != 0) ||
4193 ((r->opc1 == CP_ANY) && opc1 != 0) ||
4194 ((r->opc2 == CP_ANY) && opc2 != 0)) {
4195 r2->type |= ARM_CP_ALIAS;
4196 }
4197
4198 /* Check that raw accesses are either forbidden or handled. Note that
4199 * we can't assert this earlier because the setup of fieldoffset for
4200 * banked registers has to be done first.
4201 */
4202 if (!(r2->type & ARM_CP_NO_RAW)) {
4203 assert(!raw_accessors_invalid(r2));
4204 }
4205
4206 /* Overriding of an existing definition must be explicitly
4207 * requested.
4208 */
4209 if (!(r->type & ARM_CP_OVERRIDE)) {
4210 ARMCPRegInfo *oldreg;
4211 oldreg = g_hash_table_lookup(cpu->cp_regs, key);
4212 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
4213 fprintf(stderr, "Register redefined: cp=%d %d bit "
4214 "crn=%d crm=%d opc1=%d opc2=%d, "
4215 "was %s, now %s\n", r2->cp, 32 + 32 * is64,
4216 r2->crn, r2->crm, r2->opc1, r2->opc2,
4217 oldreg->name, r2->name);
4218 g_assert_not_reached();
4219 }
4220 }
4221 g_hash_table_insert(cpu->cp_regs, key, r2);
4222 }
4223
4224
4225 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
4226 const ARMCPRegInfo *r, void *opaque)
4227 {
4228 /* Define implementations of coprocessor registers.
4229 * We store these in a hashtable because typically
4230 * there are less than 150 registers in a space which
4231 * is 16*16*16*8*8 = 262144 in size.
4232 * Wildcarding is supported for the crm, opc1 and opc2 fields.
4233 * If a register is defined twice then the second definition is
4234 * used, so this can be used to define some generic registers and
4235 * then override them with implementation specific variations.
4236 * At least one of the original and the second definition should
4237 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard
4238 * against accidental use.
4239 *
4240 * The state field defines whether the register is to be
4241 * visible in the AArch32 or AArch64 execution state. If the
4242 * state is set to ARM_CP_STATE_BOTH then we synthesise a
4243 * reginfo structure for the AArch32 view, which sees the lower
4244 * 32 bits of the 64 bit register.
4245 *
4246 * Only registers visible in AArch64 may set r->opc0; opc0 cannot
4247 * be wildcarded. AArch64 registers are always considered to be 64
4248 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
4249 * the register, if any.
4250 */
4251 int crm, opc1, opc2, state;
4252 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
4253 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
4254 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
4255 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
4256 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
4257 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
4258 /* 64 bit registers have only CRm and Opc1 fields */
4259 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
4260 /* op0 only exists in the AArch64 encodings */
4261 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0));
4262 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
4263 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT));
4264 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1
4265 * encodes a minimum access level for the register. We roll this
4266 * runtime check into our general permission check code, so check
4267 * here that the reginfo's specified permissions are strict enough
4268 * to encompass the generic architectural permission check.
4269 */
4270 if (r->state != ARM_CP_STATE_AA32) {
4271 int mask = 0;
4272 switch (r->opc1) {
4273 case 0: case 1: case 2:
4274 /* min_EL EL1 */
4275 mask = PL1_RW;
4276 break;
4277 case 3:
4278 /* min_EL EL0 */
4279 mask = PL0_RW;
4280 break;
4281 case 4:
4282 /* min_EL EL2 */
4283 mask = PL2_RW;
4284 break;
4285 case 5:
4286 /* unallocated encoding, so not possible */
4287 assert(false);
4288 break;
4289 case 6:
4290 /* min_EL EL3 */
4291 mask = PL3_RW;
4292 break;
4293 case 7:
4294 /* min_EL EL1, secure mode only (we don't check the latter) */
4295 mask = PL1_RW;
4296 break;
4297 default:
4298 /* broken reginfo with out-of-range opc1 */
4299 assert(false);
4300 break;
4301 }
4302 /* assert our permissions are not too lax (stricter is fine) */
4303 assert((r->access & ~mask) == 0);
4304 }
4305
4306 /* Check that the register definition has enough info to handle
4307 * reads and writes if they are permitted.
4308 */
4309 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) {
4310 if (r->access & PL3_R) {
4311 assert((r->fieldoffset ||
4312 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
4313 r->readfn);
4314 }
4315 if (r->access & PL3_W) {
4316 assert((r->fieldoffset ||
4317 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
4318 r->writefn);
4319 }
4320 }
4321 /* Bad type field probably means missing sentinel at end of reg list */
4322 assert(cptype_valid(r->type));
4323 for (crm = crmmin; crm <= crmmax; crm++) {
4324 for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
4325 for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
4326 for (state = ARM_CP_STATE_AA32;
4327 state <= ARM_CP_STATE_AA64; state++) {
4328 if (r->state != state && r->state != ARM_CP_STATE_BOTH) {
4329 continue;
4330 }
4331 if (state == ARM_CP_STATE_AA32) {
4332 /* Under AArch32 CP registers can be common
4333 * (same for secure and non-secure world) or banked.
4334 */
4335 switch (r->secure) {
4336 case ARM_CP_SECSTATE_S:
4337 case ARM_CP_SECSTATE_NS:
4338 add_cpreg_to_hashtable(cpu, r, opaque, state,
4339 r->secure, crm, opc1, opc2);
4340 break;
4341 default:
4342 add_cpreg_to_hashtable(cpu, r, opaque, state,
4343 ARM_CP_SECSTATE_S,
4344 crm, opc1, opc2);
4345 add_cpreg_to_hashtable(cpu, r, opaque, state,
4346 ARM_CP_SECSTATE_NS,
4347 crm, opc1, opc2);
4348 break;
4349 }
4350 } else {
4351 /* AArch64 registers get mapped to non-secure instance
4352 * of AArch32 */
4353 add_cpreg_to_hashtable(cpu, r, opaque, state,
4354 ARM_CP_SECSTATE_NS,
4355 crm, opc1, opc2);
4356 }
4357 }
4358 }
4359 }
4360 }
4361 }
4362
4363 void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
4364 const ARMCPRegInfo *regs, void *opaque)
4365 {
4366 /* Define a whole list of registers */
4367 const ARMCPRegInfo *r;
4368 for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
4369 define_one_arm_cp_reg_with_opaque(cpu, r, opaque);
4370 }
4371 }
4372
4373 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
4374 {
4375 return g_hash_table_lookup(cpregs, &encoded_cp);
4376 }
4377
4378 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
4379 uint64_t value)
4380 {
4381 /* Helper coprocessor write function for write-ignore registers */
4382 }
4383
4384 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri)
4385 {
4386 /* Helper coprocessor write function for read-as-zero registers */
4387 return 0;
4388 }
4389
4390 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque)
4391 {
4392 /* Helper coprocessor reset function for do-nothing-on-reset registers */
4393 }
4394
4395 static int bad_mode_switch(CPUARMState *env, int mode)
4396 {
4397 /* Return true if it is not valid for us to switch to
4398 * this CPU mode (ie all the UNPREDICTABLE cases in
4399 * the ARM ARM CPSRWriteByInstr pseudocode).
4400 */
4401 switch (mode) {
4402 case ARM_CPU_MODE_USR:
4403 case ARM_CPU_MODE_SYS:
4404 case ARM_CPU_MODE_SVC:
4405 case ARM_CPU_MODE_ABT:
4406 case ARM_CPU_MODE_UND:
4407 case ARM_CPU_MODE_IRQ:
4408 case ARM_CPU_MODE_FIQ:
4409 return 0;
4410 case ARM_CPU_MODE_MON:
4411 return !arm_is_secure(env);
4412 default:
4413 return 1;
4414 }
4415 }
4416
4417 uint32_t cpsr_read(CPUARMState *env)
4418 {
4419 int ZF;
4420 ZF = (env->ZF == 0);
4421 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
4422 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
4423 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
4424 | ((env->condexec_bits & 0xfc) << 8)
4425 | (env->GE << 16) | (env->daif & CPSR_AIF);
4426 }
4427
4428 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
4429 {
4430 uint32_t changed_daif;
4431
4432 if (mask & CPSR_NZCV) {
4433 env->ZF = (~val) & CPSR_Z;
4434 env->NF = val;
4435 env->CF = (val >> 29) & 1;
4436 env->VF = (val << 3) & 0x80000000;
4437 }
4438 if (mask & CPSR_Q)
4439 env->QF = ((val & CPSR_Q) != 0);
4440 if (mask & CPSR_T)
4441 env->thumb = ((val & CPSR_T) != 0);
4442 if (mask & CPSR_IT_0_1) {
4443 env->condexec_bits &= ~3;
4444 env->condexec_bits |= (val >> 25) & 3;
4445 }
4446 if (mask & CPSR_IT_2_7) {
4447 env->condexec_bits &= 3;
4448 env->condexec_bits |= (val >> 8) & 0xfc;
4449 }
4450 if (mask & CPSR_GE) {
4451 env->GE = (val >> 16) & 0xf;
4452 }
4453
4454 /* In a V7 implementation that includes the security extensions but does
4455 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control
4456 * whether non-secure software is allowed to change the CPSR_F and CPSR_A
4457 * bits respectively.
4458 *
4459 * In a V8 implementation, it is permitted for privileged software to
4460 * change the CPSR A/F bits regardless of the SCR.AW/FW bits.
4461 */
4462 if (!arm_feature(env, ARM_FEATURE_V8) &&
4463 arm_feature(env, ARM_FEATURE_EL3) &&
4464 !arm_feature(env, ARM_FEATURE_EL2) &&
4465 !arm_is_secure(env)) {
4466
4467 changed_daif = (env->daif ^ val) & mask;
4468
4469 if (changed_daif & CPSR_A) {
4470 /* Check to see if we are allowed to change the masking of async
4471 * abort exceptions from a non-secure state.
4472 */
4473 if (!(env->cp15.scr_el3 & SCR_AW)) {
4474 qemu_log_mask(LOG_GUEST_ERROR,
4475 "Ignoring attempt to switch CPSR_A flag from "
4476 "non-secure world with SCR.AW bit clear\n");
4477 mask &= ~CPSR_A;
4478 }
4479 }
4480
4481 if (changed_daif & CPSR_F) {
4482 /* Check to see if we are allowed to change the masking of FIQ
4483 * exceptions from a non-secure state.
4484 */
4485 if (!(env->cp15.scr_el3 & SCR_FW)) {
4486 qemu_log_mask(LOG_GUEST_ERROR,
4487 "Ignoring attempt to switch CPSR_F flag from "
4488 "non-secure world with SCR.FW bit clear\n");
4489 mask &= ~CPSR_F;
4490 }
4491
4492 /* Check whether non-maskable FIQ (NMFI) support is enabled.
4493 * If this bit is set software is not allowed to mask
4494 * FIQs, but is allowed to set CPSR_F to 0.
4495 */
4496 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) &&
4497 (val & CPSR_F)) {
4498 qemu_log_mask(LOG_GUEST_ERROR,
4499 "Ignoring attempt to enable CPSR_F flag "
4500 "(non-maskable FIQ [NMFI] support enabled)\n");
4501 mask &= ~CPSR_F;
4502 }
4503 }
4504 }
4505
4506 env->daif &= ~(CPSR_AIF & mask);
4507 env->daif |= val & CPSR_AIF & mask;
4508
4509 if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
4510 if (bad_mode_switch(env, val & CPSR_M)) {
4511 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE.
4512 * We choose to ignore the attempt and leave the CPSR M field
4513 * untouched.
4514 */
4515 mask &= ~CPSR_M;
4516 } else {
4517 switch_mode(env, val & CPSR_M);
4518 }
4519 }
4520 mask &= ~CACHED_CPSR_BITS;
4521 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
4522 }
4523
4524 /* Sign/zero extend */
4525 uint32_t HELPER(sxtb16)(uint32_t x)
4526 {
4527 uint32_t res;
4528 res = (uint16_t)(int8_t)x;
4529 res |= (uint32_t)(int8_t)(x >> 16) << 16;
4530 return res;
4531 }
4532
4533 uint32_t HELPER(uxtb16)(uint32_t x)
4534 {
4535 uint32_t res;
4536 res = (uint16_t)(uint8_t)x;
4537 res |= (uint32_t)(uint8_t)(x >> 16) << 16;
4538 return res;
4539 }
4540
4541 uint32_t HELPER(clz)(uint32_t x)
4542 {
4543 return clz32(x);
4544 }
4545
4546 int32_t HELPER(sdiv)(int32_t num, int32_t den)
4547 {
4548 if (den == 0)
4549 return 0;
4550 if (num == INT_MIN && den == -1)
4551 return INT_MIN;
4552 return num / den;
4553 }
4554
4555 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
4556 {
4557 if (den == 0)
4558 return 0;
4559 return num / den;
4560 }
4561
4562 uint32_t HELPER(rbit)(uint32_t x)
4563 {
4564 x = ((x & 0xff000000) >> 24)
4565 | ((x & 0x00ff0000) >> 8)
4566 | ((x & 0x0000ff00) << 8)
4567 | ((x & 0x000000ff) << 24);
4568 x = ((x & 0xf0f0f0f0) >> 4)
4569 | ((x & 0x0f0f0f0f) << 4);
4570 x = ((x & 0x88888888) >> 3)
4571 | ((x & 0x44444444) >> 1)
4572 | ((x & 0x22222222) << 1)
4573 | ((x & 0x11111111) << 3);
4574 return x;
4575 }
4576
4577 #if defined(CONFIG_USER_ONLY)
4578
4579 /* These should probably raise undefined insn exceptions. */
4580 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
4581 {
4582 ARMCPU *cpu = arm_env_get_cpu(env);
4583
4584 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg);
4585 }
4586
4587 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
4588 {
4589 ARMCPU *cpu = arm_env_get_cpu(env);
4590
4591 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg);
4592 return 0;
4593 }
4594
4595 void switch_mode(CPUARMState *env, int mode)
4596 {
4597 ARMCPU *cpu = arm_env_get_cpu(env);
4598
4599 if (mode != ARM_CPU_MODE_USR) {
4600 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n");
4601 }
4602 }
4603
4604 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
4605 {
4606 ARMCPU *cpu = arm_env_get_cpu(env);
4607
4608 cpu_abort(CPU(cpu), "banked r13 write\n");
4609 }
4610
4611 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
4612 {
4613 ARMCPU *cpu = arm_env_get_cpu(env);
4614
4615 cpu_abort(CPU(cpu), "banked r13 read\n");
4616 return 0;
4617 }
4618
4619 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
4620 uint32_t cur_el, bool secure)
4621 {
4622 return 1;
4623 }
4624
4625 void aarch64_sync_64_to_32(CPUARMState *env)
4626 {
4627 g_assert_not_reached();
4628 }
4629
4630 #else
4631
4632 /* Map CPU modes onto saved register banks. */
4633 int bank_number(int mode)
4634 {
4635 switch (mode) {
4636 case ARM_CPU_MODE_USR:
4637 case ARM_CPU_MODE_SYS:
4638 return 0;
4639 case ARM_CPU_MODE_SVC:
4640 return 1;
4641 case ARM_CPU_MODE_ABT:
4642 return 2;
4643 case ARM_CPU_MODE_UND:
4644 return 3;
4645 case ARM_CPU_MODE_IRQ:
4646 return 4;
4647 case ARM_CPU_MODE_FIQ:
4648 return 5;
4649 case ARM_CPU_MODE_HYP:
4650 return 6;
4651 case ARM_CPU_MODE_MON:
4652 return 7;
4653 }
4654 hw_error("bank number requested for bad CPSR mode value 0x%x\n", mode);
4655 }
4656
4657 void switch_mode(CPUARMState *env, int mode)
4658 {
4659 int old_mode;
4660 int i;
4661
4662 old_mode = env->uncached_cpsr & CPSR_M;
4663 if (mode == old_mode)
4664 return;
4665
4666 if (old_mode == ARM_CPU_MODE_FIQ) {
4667 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
4668 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
4669 } else if (mode == ARM_CPU_MODE_FIQ) {
4670 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
4671 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
4672 }
4673
4674 i = bank_number(old_mode);
4675 env->banked_r13[i] = env->regs[13];
4676 env->banked_r14[i] = env->regs[14];
4677 env->banked_spsr[i] = env->spsr;
4678
4679 i = bank_number(mode);
4680 env->regs[13] = env->banked_r13[i];
4681 env->regs[14] = env->banked_r14[i];
4682 env->spsr = env->banked_spsr[i];
4683 }
4684
4685 /* Physical Interrupt Target EL Lookup Table
4686 *
4687 * [ From ARM ARM section G1.13.4 (Table G1-15) ]
4688 *
4689 * The below multi-dimensional table is used for looking up the target
4690 * exception level given numerous condition criteria. Specifically, the
4691 * target EL is based on SCR and HCR routing controls as well as the
4692 * currently executing EL and secure state.
4693 *
4694 * Dimensions:
4695 * target_el_table[2][2][2][2][2][4]
4696 * | | | | | +--- Current EL
4697 * | | | | +------ Non-secure(0)/Secure(1)
4698 * | | | +--------- HCR mask override
4699 * | | +------------ SCR exec state control
4700 * | +--------------- SCR mask override
4701 * +------------------ 32-bit(0)/64-bit(1) EL3
4702 *
4703 * The table values are as such:
4704 * 0-3 = EL0-EL3
4705 * -1 = Cannot occur
4706 *
4707 * The ARM ARM target EL table includes entries indicating that an "exception
4708 * is not taken". The two cases where this is applicable are:
4709 * 1) An exception is taken from EL3 but the SCR does not have the exception
4710 * routed to EL3.
4711 * 2) An exception is taken from EL2 but the HCR does not have the exception
4712 * routed to EL2.
4713 * In these two cases, the below table contain a target of EL1. This value is
4714 * returned as it is expected that the consumer of the table data will check
4715 * for "target EL >= current EL" to ensure the exception is not taken.
4716 *
4717 * SCR HCR
4718 * 64 EA AMO From
4719 * BIT IRQ IMO Non-secure Secure
4720 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3
4721 */
4722 const int8_t target_el_table[2][2][2][2][2][4] = {
4723 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
4724 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},
4725 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
4726 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},},
4727 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
4728 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},
4729 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
4730 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},},
4731 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },},
4732 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},
4733 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },},
4734 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},},
4735 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
4736 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},
4737 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
4738 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},},
4739 };
4740
4741 /*
4742 * Determine the target EL for physical exceptions
4743 */
4744 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
4745 uint32_t cur_el, bool secure)
4746 {
4747 CPUARMState *env = cs->env_ptr;
4748 int rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
4749 int scr;
4750 int hcr;
4751 int target_el;
4752 int is64 = arm_el_is_aa64(env, 3);
4753
4754 switch (excp_idx) {
4755 case EXCP_IRQ:
4756 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ);
4757 hcr = ((env->cp15.hcr_el2 & HCR_IMO) == HCR_IMO);
4758 break;
4759 case EXCP_FIQ:
4760 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ);
4761 hcr = ((env->cp15.hcr_el2 & HCR_FMO) == HCR_FMO);
4762 break;
4763 default:
4764 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA);
4765 hcr = ((env->cp15.hcr_el2 & HCR_AMO) == HCR_AMO);
4766 break;
4767 };
4768
4769 /* If HCR.TGE is set then HCR is treated as being 1 */
4770 hcr |= ((env->cp15.hcr_el2 & HCR_TGE) == HCR_TGE);
4771
4772 /* Perform a table-lookup for the target EL given the current state */
4773 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el];
4774
4775 assert(target_el > 0);
4776
4777 return target_el;
4778 }
4779
4780 static void v7m_push(CPUARMState *env, uint32_t val)
4781 {
4782 CPUState *cs = CPU(arm_env_get_cpu(env));
4783
4784 env->regs[13] -= 4;
4785 stl_phys(cs->as, env->regs[13], val);
4786 }
4787
4788 static uint32_t v7m_pop(CPUARMState *env)
4789 {
4790 CPUState *cs = CPU(arm_env_get_cpu(env));
4791 uint32_t val;
4792
4793 val = ldl_phys(cs->as, env->regs[13]);
4794 env->regs[13] += 4;
4795 return val;
4796 }
4797
4798 /* Switch to V7M main or process stack pointer. */
4799 static void switch_v7m_sp(CPUARMState *env, int process)
4800 {
4801 uint32_t tmp;
4802 if (env->v7m.current_sp != process) {
4803 tmp = env->v7m.other_sp;
4804 env->v7m.other_sp = env->regs[13];
4805 env->regs[13] = tmp;
4806 env->v7m.current_sp = process;
4807 }
4808 }
4809
4810 static void do_v7m_exception_exit(CPUARMState *env)
4811 {
4812 uint32_t type;
4813 uint32_t xpsr;
4814
4815 type = env->regs[15];
4816 if (env->v7m.exception != 0)
4817 armv7m_nvic_complete_irq(env->nvic, env->v7m.exception);
4818
4819 /* Switch to the target stack. */
4820 switch_v7m_sp(env, (type & 4) != 0);
4821 /* Pop registers. */
4822 env->regs[0] = v7m_pop(env);
4823 env->regs[1] = v7m_pop(env);
4824 env->regs[2] = v7m_pop(env);
4825 env->regs[3] = v7m_pop(env);
4826 env->regs[12] = v7m_pop(env);
4827 env->regs[14] = v7m_pop(env);
4828 env->regs[15] = v7m_pop(env);
4829 if (env->regs[15] & 1) {
4830 qemu_log_mask(LOG_GUEST_ERROR,
4831 "M profile return from interrupt with misaligned "
4832 "PC is UNPREDICTABLE\n");
4833 /* Actual hardware seems to ignore the lsbit, and there are several
4834 * RTOSes out there which incorrectly assume the r15 in the stack
4835 * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
4836 */
4837 env->regs[15] &= ~1U;
4838 }
4839 xpsr = v7m_pop(env);
4840 xpsr_write(env, xpsr, 0xfffffdff);
4841 /* Undo stack alignment. */
4842 if (xpsr & 0x200)
4843 env->regs[13] |= 4;
4844 /* ??? The exception return type specifies Thread/Handler mode. However
4845 this is also implied by the xPSR value. Not sure what to do
4846 if there is a mismatch. */
4847 /* ??? Likewise for mismatches between the CONTROL register and the stack
4848 pointer. */
4849 }
4850
4851 void arm_v7m_cpu_do_interrupt(CPUState *cs)
4852 {
4853 ARMCPU *cpu = ARM_CPU(cs);
4854 CPUARMState *env = &cpu->env;
4855 uint32_t xpsr = xpsr_read(env);
4856 uint32_t lr;
4857 uint32_t addr;
4858
4859 arm_log_exception(cs->exception_index);
4860
4861 lr = 0xfffffff1;
4862 if (env->v7m.current_sp)
4863 lr |= 4;
4864 if (env->v7m.exception == 0)
4865 lr |= 8;
4866
4867 /* For exceptions we just mark as pending on the NVIC, and let that
4868 handle it. */
4869 /* TODO: Need to escalate if the current priority is higher than the
4870 one we're raising. */
4871 switch (cs->exception_index) {
4872 case EXCP_UDEF:
4873 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
4874 return;
4875 case EXCP_SWI:
4876 /* The PC already points to the next instruction. */
4877 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC);
4878 return;
4879 case EXCP_PREFETCH_ABORT:
4880 case EXCP_DATA_ABORT:
4881 /* TODO: if we implemented the MPU registers, this is where we
4882 * should set the MMFAR, etc from exception.fsr and exception.vaddress.
4883 */
4884 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
4885 return;
4886 case EXCP_BKPT:
4887 if (semihosting_enabled()) {
4888 int nr;
4889 nr = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
4890 if (nr == 0xab) {
4891 env->regs[15] += 2;
4892 env->regs[0] = do_arm_semihosting(env);
4893 qemu_log_mask(CPU_LOG_INT, "...handled as semihosting call\n");
4894 return;
4895 }
4896 }
4897 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG);
4898 return;
4899 case EXCP_IRQ:
4900 env->v7m.exception = armv7m_nvic_acknowledge_irq(env->nvic);
4901 break;
4902 case EXCP_EXCEPTION_EXIT:
4903 do_v7m_exception_exit(env);
4904 return;
4905 default:
4906 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
4907 return; /* Never happens. Keep compiler happy. */
4908 }
4909
4910 /* Align stack pointer. */
4911 /* ??? Should only do this if Configuration Control Register
4912 STACKALIGN bit is set. */
4913 if (env->regs[13] & 4) {
4914 env->regs[13] -= 4;
4915 xpsr |= 0x200;
4916 }
4917 /* Switch to the handler mode. */
4918 v7m_push(env, xpsr);
4919 v7m_push(env, env->regs[15]);
4920 v7m_push(env, env->regs[14]);
4921 v7m_push(env, env->regs[12]);
4922 v7m_push(env, env->regs[3]);
4923 v7m_push(env, env->regs[2]);
4924 v7m_push(env, env->regs[1]);
4925 v7m_push(env, env->regs[0]);
4926 switch_v7m_sp(env, 0);
4927 /* Clear IT bits */
4928 env->condexec_bits = 0;
4929 env->regs[14] = lr;
4930 addr = ldl_phys(cs->as, env->v7m.vecbase + env->v7m.exception * 4);
4931 env->regs[15] = addr & 0xfffffffe;
4932 env->thumb = addr & 1;
4933 }
4934
4935 /* Function used to synchronize QEMU's AArch64 register set with AArch32
4936 * register set. This is necessary when switching between AArch32 and AArch64
4937 * execution state.
4938 */
4939 void aarch64_sync_32_to_64(CPUARMState *env)
4940 {
4941 int i;
4942 uint32_t mode = env->uncached_cpsr & CPSR_M;
4943
4944 /* We can blanket copy R[0:7] to X[0:7] */
4945 for (i = 0; i < 8; i++) {
4946 env->xregs[i] = env->regs[i];
4947 }
4948
4949 /* Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12.
4950 * Otherwise, they come from the banked user regs.
4951 */
4952 if (mode == ARM_CPU_MODE_FIQ) {
4953 for (i = 8; i < 13; i++) {
4954 env->xregs[i] = env->usr_regs[i - 8];
4955 }
4956 } else {
4957 for (i = 8; i < 13; i++) {
4958 env->xregs[i] = env->regs[i];
4959 }
4960 }
4961
4962 /* Registers x13-x23 are the various mode SP and FP registers. Registers
4963 * r13 and r14 are only copied if we are in that mode, otherwise we copy
4964 * from the mode banked register.
4965 */
4966 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
4967 env->xregs[13] = env->regs[13];
4968 env->xregs[14] = env->regs[14];
4969 } else {
4970 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)];
4971 /* HYP is an exception in that it is copied from r14 */
4972 if (mode == ARM_CPU_MODE_HYP) {
4973 env->xregs[14] = env->regs[14];
4974 } else {
4975 env->xregs[14] = env->banked_r14[bank_number(ARM_CPU_MODE_USR)];
4976 }
4977 }
4978
4979 if (mode == ARM_CPU_MODE_HYP) {
4980 env->xregs[15] = env->regs[13];
4981 } else {
4982 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)];
4983 }
4984
4985 if (mode == ARM_CPU_MODE_IRQ) {
4986 env->xregs[16] = env->regs[13];
4987 env->xregs[17] = env->regs[14];
4988 } else {
4989 env->xregs[16] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)];
4990 env->xregs[17] = env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)];
4991 }
4992
4993 if (mode == ARM_CPU_MODE_SVC) {
4994 env->xregs[18] = env->regs[13];
4995 env->xregs[19] = env->regs[14];
4996 } else {
4997 env->xregs[18] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)];
4998 env->xregs[19] = env->banked_r14[bank_number(ARM_CPU_MODE_SVC)];
4999 }
5000
5001 if (mode == ARM_CPU_MODE_ABT) {
5002 env->xregs[20] = env->regs[13];
5003 env->xregs[21] = env->regs[14];
5004 } else {
5005 env->xregs[20] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)];
5006 env->xregs[21] = env->banked_r14[bank_number(ARM_CPU_MODE_ABT)];
5007 }
5008
5009 if (mode == ARM_CPU_MODE_UND) {
5010 env->xregs[22] = env->regs[13];
5011 env->xregs[23] = env->regs[14];
5012 } else {
5013 env->xregs[22] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)];
5014 env->xregs[23] = env->banked_r14[bank_number(ARM_CPU_MODE_UND)];
5015 }
5016
5017 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
5018 * mode, then we can copy from r8-r14. Otherwise, we copy from the
5019 * FIQ bank for r8-r14.
5020 */
5021 if (mode == ARM_CPU_MODE_FIQ) {
5022 for (i = 24; i < 31; i++) {
5023 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */
5024 }
5025 } else {
5026 for (i = 24; i < 29; i++) {
5027 env->xregs[i] = env->fiq_regs[i - 24];
5028 }
5029 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)];
5030 env->xregs[30] = env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)];
5031 }
5032
5033 env->pc = env->regs[15];
5034 }
5035
5036 /* Function used to synchronize QEMU's AArch32 register set with AArch64
5037 * register set. This is necessary when switching between AArch32 and AArch64
5038 * execution state.
5039 */
5040 void aarch64_sync_64_to_32(CPUARMState *env)
5041 {
5042 int i;
5043 uint32_t mode = env->uncached_cpsr & CPSR_M;
5044
5045 /* We can blanket copy X[0:7] to R[0:7] */
5046 for (i = 0; i < 8; i++) {
5047 env->regs[i] = env->xregs[i];
5048 }
5049
5050 /* Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12.
5051 * Otherwise, we copy x8-x12 into the banked user regs.
5052 */
5053 if (mode == ARM_CPU_MODE_FIQ) {
5054 for (i = 8; i < 13; i++) {
5055 env->usr_regs[i - 8] = env->xregs[i];
5056 }
5057 } else {
5058 for (i = 8; i < 13; i++) {
5059 env->regs[i] = env->xregs[i];
5060 }
5061 }
5062
5063 /* Registers r13 & r14 depend on the current mode.
5064 * If we are in a given mode, we copy the corresponding x registers to r13
5065 * and r14. Otherwise, we copy the x register to the banked r13 and r14
5066 * for the mode.
5067 */
5068 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
5069 env->regs[13] = env->xregs[13];
5070 env->regs[14] = env->xregs[14];
5071 } else {
5072 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13];
5073
5074 /* HYP is an exception in that it does not have its own banked r14 but
5075 * shares the USR r14
5076 */
5077 if (mode == ARM_CPU_MODE_HYP) {
5078 env->regs[14] = env->xregs[14];
5079 } else {
5080 env->banked_r14[bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
5081 }
5082 }
5083
5084 if (mode == ARM_CPU_MODE_HYP) {
5085 env->regs[13] = env->xregs[15];
5086 } else {
5087 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15];
5088 }
5089
5090 if (mode == ARM_CPU_MODE_IRQ) {
5091 env->regs[13] = env->xregs[16];
5092 env->regs[14] = env->xregs[17];
5093 } else {
5094 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
5095 env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17];
5096 }
5097
5098 if (mode == ARM_CPU_MODE_SVC) {
5099 env->regs[13] = env->xregs[18];
5100 env->regs[14] = env->xregs[19];
5101 } else {
5102 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
5103 env->banked_r14[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19];
5104 }
5105
5106 if (mode == ARM_CPU_MODE_ABT) {
5107 env->regs[13] = env->xregs[20];
5108 env->regs[14] = env->xregs[21];
5109 } else {
5110 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
5111 env->banked_r14[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21];
5112 }
5113
5114 if (mode == ARM_CPU_MODE_UND) {
5115 env->regs[13] = env->xregs[22];
5116 env->regs[14] = env->xregs[23];
5117 } else {
5118 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
5119 env->banked_r14[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23];
5120 }
5121
5122 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
5123 * mode, then we can copy to r8-r14. Otherwise, we copy to the
5124 * FIQ bank for r8-r14.
5125 */
5126 if (mode == ARM_CPU_MODE_FIQ) {
5127 for (i = 24; i < 31; i++) {
5128 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */
5129 }
5130 } else {
5131 for (i = 24; i < 29; i++) {
5132 env->fiq_regs[i - 24] = env->xregs[i];
5133 }
5134 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29];
5135 env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
5136 }
5137
5138 env->regs[15] = env->pc;
5139 }
5140
5141 /* Handle a CPU exception. */
5142 void arm_cpu_do_interrupt(CPUState *cs)
5143 {
5144 ARMCPU *cpu = ARM_CPU(cs);
5145 CPUARMState *env = &cpu->env;
5146 uint32_t addr;
5147 uint32_t mask;
5148 int new_mode;
5149 uint32_t offset;
5150 uint32_t moe;
5151
5152 assert(!IS_M(env));
5153
5154 arm_log_exception(cs->exception_index);
5155
5156 if (arm_is_psci_call(cpu, cs->exception_index)) {
5157 arm_handle_psci_call(cpu);
5158 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
5159 return;
5160 }
5161
5162 /* If this is a debug exception we must update the DBGDSCR.MOE bits */
5163 switch (env->exception.syndrome >> ARM_EL_EC_SHIFT) {
5164 case EC_BREAKPOINT:
5165 case EC_BREAKPOINT_SAME_EL:
5166 moe = 1;
5167 break;
5168 case EC_WATCHPOINT:
5169 case EC_WATCHPOINT_SAME_EL:
5170 moe = 10;
5171 break;
5172 case EC_AA32_BKPT:
5173 moe = 3;
5174 break;
5175 case EC_VECTORCATCH:
5176 moe = 5;
5177 break;
5178 default:
5179 moe = 0;
5180 break;
5181 }
5182
5183 if (moe) {
5184 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe);
5185 }
5186
5187 /* TODO: Vectored interrupt controller. */
5188 switch (cs->exception_index) {
5189 case EXCP_UDEF:
5190 new_mode = ARM_CPU_MODE_UND;
5191 addr = 0x04;
5192 mask = CPSR_I;
5193 if (env->thumb)
5194 offset = 2;
5195 else
5196 offset = 4;
5197 break;
5198 case EXCP_SWI:
5199 if (semihosting_enabled()) {
5200 /* Check for semihosting interrupt. */
5201 if (env->thumb) {
5202 mask = arm_lduw_code(env, env->regs[15] - 2, env->bswap_code)
5203 & 0xff;
5204 } else {
5205 mask = arm_ldl_code(env, env->regs[15] - 4, env->bswap_code)
5206 & 0xffffff;
5207 }
5208 /* Only intercept calls from privileged modes, to provide some
5209 semblance of security. */
5210 if (((mask == 0x123456 && !env->thumb)
5211 || (mask == 0xab && env->thumb))
5212 && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
5213 env->regs[0] = do_arm_semihosting(env);
5214 qemu_log_mask(CPU_LOG_INT, "...handled as semihosting call\n");
5215 return;
5216 }
5217 }
5218 new_mode = ARM_CPU_MODE_SVC;
5219 addr = 0x08;
5220 mask = CPSR_I;
5221 /* The PC already points to the next instruction. */
5222 offset = 0;
5223 break;
5224 case EXCP_BKPT:
5225 /* See if this is a semihosting syscall. */
5226 if (env->thumb && semihosting_enabled()) {
5227 mask = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
5228 if (mask == 0xab
5229 && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
5230 env->regs[15] += 2;
5231 env->regs[0] = do_arm_semihosting(env);
5232 qemu_log_mask(CPU_LOG_INT, "...handled as semihosting call\n");
5233 return;
5234 }
5235 }
5236 env->exception.fsr = 2;
5237 /* Fall through to prefetch abort. */
5238 case EXCP_PREFETCH_ABORT:
5239 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr);
5240 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress);
5241 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n",
5242 env->exception.fsr, (uint32_t)env->exception.vaddress);
5243 new_mode = ARM_CPU_MODE_ABT;
5244 addr = 0x0c;
5245 mask = CPSR_A | CPSR_I;
5246 offset = 4;
5247 break;
5248 case EXCP_DATA_ABORT:
5249 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr);
5250 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress);
5251 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n",
5252 env->exception.fsr,
5253 (uint32_t)env->exception.vaddress);
5254 new_mode = ARM_CPU_MODE_ABT;
5255 addr = 0x10;
5256 mask = CPSR_A | CPSR_I;
5257 offset = 8;
5258 break;
5259 case EXCP_IRQ:
5260 new_mode = ARM_CPU_MODE_IRQ;
5261 addr = 0x18;
5262 /* Disable IRQ and imprecise data aborts. */
5263 mask = CPSR_A | CPSR_I;
5264 offset = 4;
5265 if (env->cp15.scr_el3 & SCR_IRQ) {
5266 /* IRQ routed to monitor mode */
5267 new_mode = ARM_CPU_MODE_MON;
5268 mask |= CPSR_F;
5269 }
5270 break;
5271 case EXCP_FIQ:
5272 new_mode = ARM_CPU_MODE_FIQ;
5273 addr = 0x1c;
5274 /* Disable FIQ, IRQ and imprecise data aborts. */
5275 mask = CPSR_A | CPSR_I | CPSR_F;
5276 if (env->cp15.scr_el3 & SCR_FIQ) {
5277 /* FIQ routed to monitor mode */
5278 new_mode = ARM_CPU_MODE_MON;
5279 }
5280 offset = 4;
5281 break;
5282 case EXCP_SMC:
5283 new_mode = ARM_CPU_MODE_MON;
5284 addr = 0x08;
5285 mask = CPSR_A | CPSR_I | CPSR_F;
5286 offset = 0;
5287 break;
5288 default:
5289 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
5290 return; /* Never happens. Keep compiler happy. */
5291 }
5292
5293 if (new_mode == ARM_CPU_MODE_MON) {
5294 addr += env->cp15.mvbar;
5295 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
5296 /* High vectors. When enabled, base address cannot be remapped. */
5297 addr += 0xffff0000;
5298 } else {
5299 /* ARM v7 architectures provide a vector base address register to remap
5300 * the interrupt vector table.
5301 * This register is only followed in non-monitor mode, and is banked.
5302 * Note: only bits 31:5 are valid.
5303 */
5304 addr += A32_BANKED_CURRENT_REG_GET(env, vbar);
5305 }
5306
5307 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
5308 env->cp15.scr_el3 &= ~SCR_NS;
5309 }
5310
5311 switch_mode (env, new_mode);
5312 /* For exceptions taken to AArch32 we must clear the SS bit in both
5313 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.
5314 */
5315 env->uncached_cpsr &= ~PSTATE_SS;
5316 env->spsr = cpsr_read(env);
5317 /* Clear IT bits. */
5318 env->condexec_bits = 0;
5319 /* Switch to the new mode, and to the correct instruction set. */
5320 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
5321 env->daif |= mask;
5322 /* this is a lie, as the was no c1_sys on V4T/V5, but who cares
5323 * and we should just guard the thumb mode on V4 */
5324 if (arm_feature(env, ARM_FEATURE_V4T)) {
5325 env->thumb = (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0;
5326 }
5327 env->regs[14] = env->regs[15] + offset;
5328 env->regs[15] = addr;
5329 cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
5330 }
5331
5332
5333 /* Return the exception level which controls this address translation regime */
5334 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
5335 {
5336 switch (mmu_idx) {
5337 case ARMMMUIdx_S2NS:
5338 case ARMMMUIdx_S1E2:
5339 return 2;
5340 case ARMMMUIdx_S1E3:
5341 return 3;
5342 case ARMMMUIdx_S1SE0:
5343 return arm_el_is_aa64(env, 3) ? 1 : 3;
5344 case ARMMMUIdx_S1SE1:
5345 case ARMMMUIdx_S1NSE0:
5346 case ARMMMUIdx_S1NSE1:
5347 return 1;
5348 default:
5349 g_assert_not_reached();
5350 }
5351 }
5352
5353 /* Return true if this address translation regime is secure */
5354 static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
5355 {
5356 switch (mmu_idx) {
5357 case ARMMMUIdx_S12NSE0:
5358 case ARMMMUIdx_S12NSE1:
5359 case ARMMMUIdx_S1NSE0:
5360 case ARMMMUIdx_S1NSE1:
5361 case ARMMMUIdx_S1E2:
5362 case ARMMMUIdx_S2NS:
5363 return false;
5364 case ARMMMUIdx_S1E3:
5365 case ARMMMUIdx_S1SE0:
5366 case ARMMMUIdx_S1SE1:
5367 return true;
5368 default:
5369 g_assert_not_reached();
5370 }
5371 }
5372
5373 /* Return the SCTLR value which controls this address translation regime */
5374 static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
5375 {
5376 return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
5377 }
5378
5379 /* Return true if the specified stage of address translation is disabled */
5380 static inline bool regime_translation_disabled(CPUARMState *env,
5381 ARMMMUIdx mmu_idx)
5382 {
5383 if (mmu_idx == ARMMMUIdx_S2NS) {
5384 return (env->cp15.hcr_el2 & HCR_VM) == 0;
5385 }
5386 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
5387 }
5388
5389 /* Return the TCR controlling this translation regime */
5390 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
5391 {
5392 if (mmu_idx == ARMMMUIdx_S2NS) {
5393 /* TODO: return VTCR_EL2 */
5394 g_assert_not_reached();
5395 }
5396 return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
5397 }
5398
5399 /* Return the TTBR associated with this translation regime */
5400 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
5401 int ttbrn)
5402 {
5403 if (mmu_idx == ARMMMUIdx_S2NS) {
5404 /* TODO: return VTTBR_EL2 */
5405 g_assert_not_reached();
5406 }
5407 if (ttbrn == 0) {
5408 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
5409 } else {
5410 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
5411 }
5412 }
5413
5414 /* Return true if the translation regime is using LPAE format page tables */
5415 static inline bool regime_using_lpae_format(CPUARMState *env,
5416 ARMMMUIdx mmu_idx)
5417 {
5418 int el = regime_el(env, mmu_idx);
5419 if (el == 2 || arm_el_is_aa64(env, el)) {
5420 return true;
5421 }
5422 if (arm_feature(env, ARM_FEATURE_LPAE)
5423 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) {
5424 return true;
5425 }
5426 return false;
5427 }
5428
5429 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
5430 {
5431 switch (mmu_idx) {
5432 case ARMMMUIdx_S1SE0:
5433 case ARMMMUIdx_S1NSE0:
5434 return true;
5435 default:
5436 return false;
5437 case ARMMMUIdx_S12NSE0:
5438 case ARMMMUIdx_S12NSE1:
5439 g_assert_not_reached();
5440 }
5441 }
5442
5443 /* Translate section/page access permissions to page
5444 * R/W protection flags
5445 *
5446 * @env: CPUARMState
5447 * @mmu_idx: MMU index indicating required translation regime
5448 * @ap: The 3-bit access permissions (AP[2:0])
5449 * @domain_prot: The 2-bit domain access permissions
5450 */
5451 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
5452 int ap, int domain_prot)
5453 {
5454 bool is_user = regime_is_user(env, mmu_idx);
5455
5456 if (domain_prot == 3) {
5457 return PAGE_READ | PAGE_WRITE;
5458 }
5459
5460 switch (ap) {
5461 case 0:
5462 if (arm_feature(env, ARM_FEATURE_V7)) {
5463 return 0;
5464 }
5465 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) {
5466 case SCTLR_S:
5467 return is_user ? 0 : PAGE_READ;
5468 case SCTLR_R:
5469 return PAGE_READ;
5470 default:
5471 return 0;
5472 }
5473 case 1:
5474 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
5475 case 2:
5476 if (is_user) {
5477 return PAGE_READ;
5478 } else {
5479 return PAGE_READ | PAGE_WRITE;
5480 }
5481 case 3:
5482 return PAGE_READ | PAGE_WRITE;
5483 case 4: /* Reserved. */
5484 return 0;
5485 case 5:
5486 return is_user ? 0 : PAGE_READ;
5487 case 6:
5488 return PAGE_READ;
5489 case 7:
5490 if (!arm_feature(env, ARM_FEATURE_V6K)) {
5491 return 0;
5492 }
5493 return PAGE_READ;
5494 default:
5495 g_assert_not_reached();
5496 }
5497 }
5498
5499 /* Translate section/page access permissions to page
5500 * R/W protection flags.
5501 *
5502 * @ap: The 2-bit simple AP (AP[2:1])
5503 * @is_user: TRUE if accessing from PL0
5504 */
5505 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
5506 {
5507 switch (ap) {
5508 case 0:
5509 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
5510 case 1:
5511 return PAGE_READ | PAGE_WRITE;
5512 case 2:
5513 return is_user ? 0 : PAGE_READ;
5514 case 3:
5515 return PAGE_READ;
5516 default:
5517 g_assert_not_reached();
5518 }
5519 }
5520
5521 static inline int
5522 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
5523 {
5524 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
5525 }
5526
5527 /* Translate section/page access permissions to protection flags
5528 *
5529 * @env: CPUARMState
5530 * @mmu_idx: MMU index indicating required translation regime
5531 * @is_aa64: TRUE if AArch64
5532 * @ap: The 2-bit simple AP (AP[2:1])
5533 * @ns: NS (non-secure) bit
5534 * @xn: XN (execute-never) bit
5535 * @pxn: PXN (privileged execute-never) bit
5536 */
5537 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
5538 int ap, int ns, int xn, int pxn)
5539 {
5540 bool is_user = regime_is_user(env, mmu_idx);
5541 int prot_rw, user_rw;
5542 bool have_wxn;
5543 int wxn = 0;
5544
5545 assert(mmu_idx != ARMMMUIdx_S2NS);
5546
5547 user_rw = simple_ap_to_rw_prot_is_user(ap, true);
5548 if (is_user) {
5549 prot_rw = user_rw;
5550 } else {
5551 prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
5552 }
5553
5554 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
5555 return prot_rw;
5556 }
5557
5558 /* TODO have_wxn should be replaced with
5559 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
5560 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
5561 * compatible processors have EL2, which is required for [U]WXN.
5562 */
5563 have_wxn = arm_feature(env, ARM_FEATURE_LPAE);
5564
5565 if (have_wxn) {
5566 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
5567 }
5568
5569 if (is_aa64) {
5570 switch (regime_el(env, mmu_idx)) {
5571 case 1:
5572 if (!is_user) {
5573 xn = pxn || (user_rw & PAGE_WRITE);
5574 }
5575 break;
5576 case 2:
5577 case 3:
5578 break;
5579 }
5580 } else if (arm_feature(env, ARM_FEATURE_V7)) {
5581 switch (regime_el(env, mmu_idx)) {
5582 case 1:
5583 case 3:
5584 if (is_user) {
5585 xn = xn || !(user_rw & PAGE_READ);
5586 } else {
5587 int uwxn = 0;
5588 if (have_wxn) {
5589 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
5590 }
5591 xn = xn || !(prot_rw & PAGE_READ) || pxn ||
5592 (uwxn && (user_rw & PAGE_WRITE));
5593 }
5594 break;
5595 case 2:
5596 break;
5597 }
5598 } else {
5599 xn = wxn = 0;
5600 }
5601
5602 if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
5603 return prot_rw;
5604 }
5605 return prot_rw | PAGE_EXEC;
5606 }
5607
5608 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
5609 uint32_t *table, uint32_t address)
5610 {
5611 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
5612 TCR *tcr = regime_tcr(env, mmu_idx);
5613
5614 if (address & tcr->mask) {
5615 if (tcr->raw_tcr & TTBCR_PD1) {
5616 /* Translation table walk disabled for TTBR1 */
5617 return false;
5618 }
5619 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
5620 } else {
5621 if (tcr->raw_tcr & TTBCR_PD0) {
5622 /* Translation table walk disabled for TTBR0 */
5623 return false;
5624 }
5625 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask;
5626 }
5627 *table |= (address >> 18) & 0x3ffc;
5628 return true;
5629 }
5630
5631 /* All loads done in the course of a page table walk go through here.
5632 * TODO: rather than ignoring errors from physical memory reads (which
5633 * are external aborts in ARM terminology) we should propagate this
5634 * error out so that we can turn it into a Data Abort if this walk
5635 * was being done for a CPU load/store or an address translation instruction
5636 * (but not if it was for a debug access).
5637 */
5638 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure)
5639 {
5640 MemTxAttrs attrs = {};
5641
5642 attrs.secure = is_secure;
5643 return address_space_ldl(cs->as, addr, attrs, NULL);
5644 }
5645
5646 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure)
5647 {
5648 MemTxAttrs attrs = {};
5649
5650 attrs.secure = is_secure;
5651 return address_space_ldq(cs->as, addr, attrs, NULL);
5652 }
5653
5654 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
5655 int access_type, ARMMMUIdx mmu_idx,
5656 hwaddr *phys_ptr, int *prot,
5657 target_ulong *page_size, uint32_t *fsr)
5658 {
5659 CPUState *cs = CPU(arm_env_get_cpu(env));
5660 int code;
5661 uint32_t table;
5662 uint32_t desc;
5663 int type;
5664 int ap;
5665 int domain = 0;
5666 int domain_prot;
5667 hwaddr phys_addr;
5668 uint32_t dacr;
5669
5670 /* Pagetable walk. */
5671 /* Lookup l1 descriptor. */
5672 if (!get_level1_table_address(env, mmu_idx, &table, address)) {
5673 /* Section translation fault if page walk is disabled by PD0 or PD1 */
5674 code = 5;
5675 goto do_fault;
5676 }
5677 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
5678 type = (desc & 3);
5679 domain = (desc >> 5) & 0x0f;
5680 if (regime_el(env, mmu_idx) == 1) {
5681 dacr = env->cp15.dacr_ns;
5682 } else {
5683 dacr = env->cp15.dacr_s;
5684 }
5685 domain_prot = (dacr >> (domain * 2)) & 3;
5686 if (type == 0) {
5687 /* Section translation fault. */
5688 code = 5;
5689 goto do_fault;
5690 }
5691 if (domain_prot == 0 || domain_prot == 2) {
5692 if (type == 2)
5693 code = 9; /* Section domain fault. */
5694 else
5695 code = 11; /* Page domain fault. */
5696 goto do_fault;
5697 }
5698 if (type == 2) {
5699 /* 1Mb section. */
5700 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
5701 ap = (desc >> 10) & 3;
5702 code = 13;
5703 *page_size = 1024 * 1024;
5704 } else {
5705 /* Lookup l2 entry. */
5706 if (type == 1) {
5707 /* Coarse pagetable. */
5708 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
5709 } else {
5710 /* Fine pagetable. */
5711 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
5712 }
5713 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
5714 switch (desc & 3) {
5715 case 0: /* Page translation fault. */
5716 code = 7;
5717 goto do_fault;
5718 case 1: /* 64k page. */
5719 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
5720 ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
5721 *page_size = 0x10000;
5722 break;
5723 case 2: /* 4k page. */
5724 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
5725 ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
5726 *page_size = 0x1000;
5727 break;
5728 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
5729 if (type == 1) {
5730 /* ARMv6/XScale extended small page format */
5731 if (arm_feature(env, ARM_FEATURE_XSCALE)
5732 || arm_feature(env, ARM_FEATURE_V6)) {
5733 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
5734 *page_size = 0x1000;
5735 } else {
5736 /* UNPREDICTABLE in ARMv5; we choose to take a
5737 * page translation fault.
5738 */
5739 code = 7;
5740 goto do_fault;
5741 }
5742 } else {
5743 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
5744 *page_size = 0x400;
5745 }
5746 ap = (desc >> 4) & 3;
5747 break;
5748 default:
5749 /* Never happens, but compiler isn't smart enough to tell. */
5750 abort();
5751 }
5752 code = 15;
5753 }
5754 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
5755 *prot |= *prot ? PAGE_EXEC : 0;
5756 if (!(*prot & (1 << access_type))) {
5757 /* Access permission fault. */
5758 goto do_fault;
5759 }
5760 *phys_ptr = phys_addr;
5761 return false;
5762 do_fault:
5763 *fsr = code | (domain << 4);
5764 return true;
5765 }
5766
5767 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
5768 int access_type, ARMMMUIdx mmu_idx,
5769 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
5770 target_ulong *page_size, uint32_t *fsr)
5771 {
5772 CPUState *cs = CPU(arm_env_get_cpu(env));
5773 int code;
5774 uint32_t table;
5775 uint32_t desc;
5776 uint32_t xn;
5777 uint32_t pxn = 0;
5778 int type;
5779 int ap;
5780 int domain = 0;
5781 int domain_prot;
5782 hwaddr phys_addr;
5783 uint32_t dacr;
5784 bool ns;
5785
5786 /* Pagetable walk. */
5787 /* Lookup l1 descriptor. */
5788 if (!get_level1_table_address(env, mmu_idx, &table, address)) {
5789 /* Section translation fault if page walk is disabled by PD0 or PD1 */
5790 code = 5;
5791 goto do_fault;
5792 }
5793 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
5794 type = (desc & 3);
5795 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
5796 /* Section translation fault, or attempt to use the encoding
5797 * which is Reserved on implementations without PXN.
5798 */
5799 code = 5;
5800 goto do_fault;
5801 }
5802 if ((type == 1) || !(desc & (1 << 18))) {
5803 /* Page or Section. */
5804 domain = (desc >> 5) & 0x0f;
5805 }
5806 if (regime_el(env, mmu_idx) == 1) {
5807 dacr = env->cp15.dacr_ns;
5808 } else {
5809 dacr = env->cp15.dacr_s;
5810 }
5811 domain_prot = (dacr >> (domain * 2)) & 3;
5812 if (domain_prot == 0 || domain_prot == 2) {
5813 if (type != 1) {
5814 code = 9; /* Section domain fault. */
5815 } else {
5816 code = 11; /* Page domain fault. */
5817 }
5818 goto do_fault;
5819 }
5820 if (type != 1) {
5821 if (desc & (1 << 18)) {
5822 /* Supersection. */
5823 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
5824 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
5825 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
5826 *page_size = 0x1000000;
5827 } else {
5828 /* Section. */
5829 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
5830 *page_size = 0x100000;
5831 }
5832 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
5833 xn = desc & (1 << 4);
5834 pxn = desc & 1;
5835 code = 13;
5836 ns = extract32(desc, 19, 1);
5837 } else {
5838 if (arm_feature(env, ARM_FEATURE_PXN)) {
5839 pxn = (desc >> 2) & 1;
5840 }
5841 ns = extract32(desc, 3, 1);
5842 /* Lookup l2 entry. */
5843 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
5844 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
5845 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
5846 switch (desc & 3) {
5847 case 0: /* Page translation fault. */
5848 code = 7;
5849 goto do_fault;
5850 case 1: /* 64k page. */
5851 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
5852 xn = desc & (1 << 15);
5853 *page_size = 0x10000;
5854 break;
5855 case 2: case 3: /* 4k page. */
5856 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
5857 xn = desc & 1;
5858 *page_size = 0x1000;
5859 break;
5860 default:
5861 /* Never happens, but compiler isn't smart enough to tell. */
5862 abort();
5863 }
5864 code = 15;
5865 }
5866 if (domain_prot == 3) {
5867 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
5868 } else {
5869 if (pxn && !regime_is_user(env, mmu_idx)) {
5870 xn = 1;
5871 }
5872 if (xn && access_type == 2)
5873 goto do_fault;
5874
5875 if (arm_feature(env, ARM_FEATURE_V6K) &&
5876 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) {
5877 /* The simplified model uses AP[0] as an access control bit. */
5878 if ((ap & 1) == 0) {
5879 /* Access flag fault. */
5880 code = (code == 15) ? 6 : 3;
5881 goto do_fault;
5882 }
5883 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
5884 } else {
5885 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
5886 }
5887 if (*prot && !xn) {
5888 *prot |= PAGE_EXEC;
5889 }
5890 if (!(*prot & (1 << access_type))) {
5891 /* Access permission fault. */
5892 goto do_fault;
5893 }
5894 }
5895 if (ns) {
5896 /* The NS bit will (as required by the architecture) have no effect if
5897 * the CPU doesn't support TZ or this is a non-secure translation
5898 * regime, because the attribute will already be non-secure.
5899 */
5900 attrs->secure = false;
5901 }
5902 *phys_ptr = phys_addr;
5903 return false;
5904 do_fault:
5905 *fsr = code | (domain << 4);
5906 return true;
5907 }
5908
5909 /* Fault type for long-descriptor MMU fault reporting; this corresponds
5910 * to bits [5..2] in the STATUS field in long-format DFSR/IFSR.
5911 */
5912 typedef enum {
5913 translation_fault = 1,
5914 access_fault = 2,
5915 permission_fault = 3,
5916 } MMUFaultType;
5917
5918 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
5919 int access_type, ARMMMUIdx mmu_idx,
5920 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
5921 target_ulong *page_size_ptr, uint32_t *fsr)
5922 {
5923 CPUState *cs = CPU(arm_env_get_cpu(env));
5924 /* Read an LPAE long-descriptor translation table. */
5925 MMUFaultType fault_type = translation_fault;
5926 uint32_t level = 1;
5927 uint32_t epd;
5928 int32_t tsz;
5929 uint32_t tg;
5930 uint64_t ttbr;
5931 int ttbr_select;
5932 hwaddr descaddr, descmask;
5933 uint32_t tableattrs;
5934 target_ulong page_size;
5935 uint32_t attrs;
5936 int32_t granule_sz = 9;
5937 int32_t va_size = 32;
5938 int32_t tbi = 0;
5939 TCR *tcr = regime_tcr(env, mmu_idx);
5940 int ap, ns, xn, pxn;
5941 uint32_t el = regime_el(env, mmu_idx);
5942 bool ttbr1_valid = true;
5943
5944 /* TODO:
5945 * This code does not handle the different format TCR for VTCR_EL2.
5946 * This code also does not support shareability levels.
5947 * Attribute and permission bit handling should also be checked when adding
5948 * support for those page table walks.
5949 */
5950 if (arm_el_is_aa64(env, el)) {
5951 va_size = 64;
5952 if (el > 1) {
5953 tbi = extract64(tcr->raw_tcr, 20, 1);
5954 } else {
5955 if (extract64(address, 55, 1)) {
5956 tbi = extract64(tcr->raw_tcr, 38, 1);
5957 } else {
5958 tbi = extract64(tcr->raw_tcr, 37, 1);
5959 }
5960 }
5961 tbi *= 8;
5962
5963 /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it
5964 * invalid.
5965 */
5966 if (el > 1) {
5967 ttbr1_valid = false;
5968 }
5969 }
5970
5971 /* Determine whether this address is in the region controlled by
5972 * TTBR0 or TTBR1 (or if it is in neither region and should fault).
5973 * This is a Non-secure PL0/1 stage 1 translation, so controlled by
5974 * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
5975 */
5976 uint32_t t0sz = extract32(tcr->raw_tcr, 0, 6);
5977 if (va_size == 64) {
5978 t0sz = MIN(t0sz, 39);
5979 t0sz = MAX(t0sz, 16);
5980 }
5981 uint32_t t1sz = extract32(tcr->raw_tcr, 16, 6);
5982 if (va_size == 64) {
5983 t1sz = MIN(t1sz, 39);
5984 t1sz = MAX(t1sz, 16);
5985 }
5986 if (t0sz && !extract64(address, va_size - t0sz, t0sz - tbi)) {
5987 /* there is a ttbr0 region and we are in it (high bits all zero) */
5988 ttbr_select = 0;
5989 } else if (ttbr1_valid && t1sz &&
5990 !extract64(~address, va_size - t1sz, t1sz - tbi)) {
5991 /* there is a ttbr1 region and we are in it (high bits all one) */
5992 ttbr_select = 1;
5993 } else if (!t0sz) {
5994 /* ttbr0 region is "everything not in the ttbr1 region" */
5995 ttbr_select = 0;
5996 } else if (!t1sz && ttbr1_valid) {
5997 /* ttbr1 region is "everything not in the ttbr0 region" */
5998 ttbr_select = 1;
5999 } else {
6000 /* in the gap between the two regions, this is a Translation fault */
6001 fault_type = translation_fault;
6002 goto do_fault;
6003 }
6004
6005 /* Note that QEMU ignores shareability and cacheability attributes,
6006 * so we don't need to do anything with the SH, ORGN, IRGN fields
6007 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
6008 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
6009 * implement any ASID-like capability so we can ignore it (instead
6010 * we will always flush the TLB any time the ASID is changed).
6011 */
6012 if (ttbr_select == 0) {
6013 ttbr = regime_ttbr(env, mmu_idx, 0);
6014 epd = extract32(tcr->raw_tcr, 7, 1);
6015 tsz = t0sz;
6016
6017 tg = extract32(tcr->raw_tcr, 14, 2);
6018 if (tg == 1) { /* 64KB pages */
6019 granule_sz = 13;
6020 }
6021 if (tg == 2) { /* 16KB pages */
6022 granule_sz = 11;
6023 }
6024 } else {
6025 /* We should only be here if TTBR1 is valid */
6026 assert(ttbr1_valid);
6027
6028 ttbr = regime_ttbr(env, mmu_idx, 1);
6029 epd = extract32(tcr->raw_tcr, 23, 1);
6030 tsz = t1sz;
6031
6032 tg = extract32(tcr->raw_tcr, 30, 2);
6033 if (tg == 3) { /* 64KB pages */
6034 granule_sz = 13;
6035 }
6036 if (tg == 1) { /* 16KB pages */
6037 granule_sz = 11;
6038 }
6039 }
6040
6041 /* Here we should have set up all the parameters for the translation:
6042 * va_size, ttbr, epd, tsz, granule_sz, tbi
6043 */
6044
6045 if (epd) {
6046 /* Translation table walk disabled => Translation fault on TLB miss
6047 * Note: This is always 0 on 64-bit EL2 and EL3.
6048 */
6049 goto do_fault;
6050 }
6051
6052 /* The starting level depends on the virtual address size (which can be
6053 * up to 48 bits) and the translation granule size. It indicates the number
6054 * of strides (granule_sz bits at a time) needed to consume the bits
6055 * of the input address. In the pseudocode this is:
6056 * level = 4 - RoundUp((inputsize - grainsize) / stride)
6057 * where their 'inputsize' is our 'va_size - tsz', 'grainsize' is
6058 * our 'granule_sz + 3' and 'stride' is our 'granule_sz'.
6059 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
6060 * = 4 - (va_size - tsz - granule_sz - 3 + granule_sz - 1) / granule_sz
6061 * = 4 - (va_size - tsz - 4) / granule_sz;
6062 */
6063 level = 4 - (va_size - tsz - 4) / granule_sz;
6064
6065 /* Clear the vaddr bits which aren't part of the within-region address,
6066 * so that we don't have to special case things when calculating the
6067 * first descriptor address.
6068 */
6069 if (tsz) {
6070 address &= (1ULL << (va_size - tsz)) - 1;
6071 }
6072
6073 descmask = (1ULL << (granule_sz + 3)) - 1;
6074
6075 /* Now we can extract the actual base address from the TTBR */
6076 descaddr = extract64(ttbr, 0, 48);
6077 descaddr &= ~((1ULL << (va_size - tsz - (granule_sz * (4 - level)))) - 1);
6078
6079 /* Secure accesses start with the page table in secure memory and
6080 * can be downgraded to non-secure at any step. Non-secure accesses
6081 * remain non-secure. We implement this by just ORing in the NSTable/NS
6082 * bits at each step.
6083 */
6084 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4);
6085 for (;;) {
6086 uint64_t descriptor;
6087 bool nstable;
6088
6089 descaddr |= (address >> (granule_sz * (4 - level))) & descmask;
6090 descaddr &= ~7ULL;
6091 nstable = extract32(tableattrs, 4, 1);
6092 descriptor = arm_ldq_ptw(cs, descaddr, !nstable);
6093 if (!(descriptor & 1) ||
6094 (!(descriptor & 2) && (level == 3))) {
6095 /* Invalid, or the Reserved level 3 encoding */
6096 goto do_fault;
6097 }
6098 descaddr = descriptor & 0xfffffff000ULL;
6099
6100 if ((descriptor & 2) && (level < 3)) {
6101 /* Table entry. The top five bits are attributes which may
6102 * propagate down through lower levels of the table (and
6103 * which are all arranged so that 0 means "no effect", so
6104 * we can gather them up by ORing in the bits at each level).
6105 */
6106 tableattrs |= extract64(descriptor, 59, 5);
6107 level++;
6108 continue;
6109 }
6110 /* Block entry at level 1 or 2, or page entry at level 3.
6111 * These are basically the same thing, although the number
6112 * of bits we pull in from the vaddr varies.
6113 */
6114 page_size = (1ULL << ((granule_sz * (4 - level)) + 3));
6115 descaddr |= (address & (page_size - 1));
6116 /* Extract attributes from the descriptor and merge with table attrs */
6117 attrs = extract64(descriptor, 2, 10)
6118 | (extract64(descriptor, 52, 12) << 10);
6119 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */
6120 attrs |= extract32(tableattrs, 3, 1) << 5; /* APTable[1] => AP[2] */
6121 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
6122 * means "force PL1 access only", which means forcing AP[1] to 0.
6123 */
6124 if (extract32(tableattrs, 2, 1)) {
6125 attrs &= ~(1 << 4);
6126 }
6127 attrs |= nstable << 3; /* NS */
6128 break;
6129 }
6130 /* Here descaddr is the final physical address, and attributes
6131 * are all in attrs.
6132 */
6133 fault_type = access_fault;
6134 if ((attrs & (1 << 8)) == 0) {
6135 /* Access flag */
6136 goto do_fault;
6137 }
6138
6139 ap = extract32(attrs, 4, 2);
6140 ns = extract32(attrs, 3, 1);
6141 xn = extract32(attrs, 12, 1);
6142 pxn = extract32(attrs, 11, 1);
6143
6144 *prot = get_S1prot(env, mmu_idx, va_size == 64, ap, ns, xn, pxn);
6145
6146 fault_type = permission_fault;
6147 if (!(*prot & (1 << access_type))) {
6148 goto do_fault;
6149 }
6150
6151 if (ns) {
6152 /* The NS bit will (as required by the architecture) have no effect if
6153 * the CPU doesn't support TZ or this is a non-secure translation
6154 * regime, because the attribute will already be non-secure.
6155 */
6156 txattrs->secure = false;
6157 }
6158 *phys_ptr = descaddr;
6159 *page_size_ptr = page_size;
6160 return false;
6161
6162 do_fault:
6163 /* Long-descriptor format IFSR/DFSR value */
6164 *fsr = (1 << 9) | (fault_type << 2) | level;
6165 return true;
6166 }
6167
6168 static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
6169 ARMMMUIdx mmu_idx,
6170 int32_t address, int *prot)
6171 {
6172 *prot = PAGE_READ | PAGE_WRITE;
6173 switch (address) {
6174 case 0xF0000000 ... 0xFFFFFFFF:
6175 if (regime_sctlr(env, mmu_idx) & SCTLR_V) { /* hivecs execing is ok */
6176 *prot |= PAGE_EXEC;
6177 }
6178 break;
6179 case 0x00000000 ... 0x7FFFFFFF:
6180 *prot |= PAGE_EXEC;
6181 break;
6182 }
6183
6184 }
6185
6186 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
6187 int access_type, ARMMMUIdx mmu_idx,
6188 hwaddr *phys_ptr, int *prot, uint32_t *fsr)
6189 {
6190 ARMCPU *cpu = arm_env_get_cpu(env);
6191 int n;
6192 bool is_user = regime_is_user(env, mmu_idx);
6193
6194 *phys_ptr = address;
6195 *prot = 0;
6196
6197 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */
6198 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
6199 } else { /* MPU enabled */
6200 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
6201 /* region search */
6202 uint32_t base = env->pmsav7.drbar[n];
6203 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5);
6204 uint32_t rmask;
6205 bool srdis = false;
6206
6207 if (!(env->pmsav7.drsr[n] & 0x1)) {
6208 continue;
6209 }
6210
6211 if (!rsize) {
6212 qemu_log_mask(LOG_GUEST_ERROR, "DRSR.Rsize field can not be 0");
6213 continue;
6214 }
6215 rsize++;
6216 rmask = (1ull << rsize) - 1;
6217
6218 if (base & rmask) {
6219 qemu_log_mask(LOG_GUEST_ERROR, "DRBAR %" PRIx32 " misaligned "
6220 "to DRSR region size, mask = %" PRIx32,
6221 base, rmask);
6222 continue;
6223 }
6224
6225 if (address < base || address > base + rmask) {
6226 continue;
6227 }
6228
6229 /* Region matched */
6230
6231 if (rsize >= 8) { /* no subregions for regions < 256 bytes */
6232 int i, snd;
6233 uint32_t srdis_mask;
6234
6235 rsize -= 3; /* sub region size (power of 2) */
6236 snd = ((address - base) >> rsize) & 0x7;
6237 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1);
6238
6239 srdis_mask = srdis ? 0x3 : 0x0;
6240 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) {
6241 /* This will check in groups of 2, 4 and then 8, whether
6242 * the subregion bits are consistent. rsize is incremented
6243 * back up to give the region size, considering consistent
6244 * adjacent subregions as one region. Stop testing if rsize
6245 * is already big enough for an entire QEMU page.
6246 */
6247 int snd_rounded = snd & ~(i - 1);
6248 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n],
6249 snd_rounded + 8, i);
6250 if (srdis_mask ^ srdis_multi) {
6251 break;
6252 }
6253 srdis_mask = (srdis_mask << i) | srdis_mask;
6254 rsize++;
6255 }
6256 }
6257 if (rsize < TARGET_PAGE_BITS) {
6258 qemu_log_mask(LOG_UNIMP, "No support for MPU (sub)region"
6259 "alignment of %" PRIu32 " bits. Minimum is %d\n",
6260 rsize, TARGET_PAGE_BITS);
6261 continue;
6262 }
6263 if (srdis) {
6264 continue;
6265 }
6266 break;
6267 }
6268
6269 if (n == -1) { /* no hits */
6270 if (cpu->pmsav7_dregion &&
6271 (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR))) {
6272 /* background fault */
6273 *fsr = 0;
6274 return true;
6275 }
6276 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
6277 } else { /* a MPU hit! */
6278 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
6279
6280 if (is_user) { /* User mode AP bit decoding */
6281 switch (ap) {
6282 case 0:
6283 case 1:
6284 case 5:
6285 break; /* no access */
6286 case 3:
6287 *prot |= PAGE_WRITE;
6288 /* fall through */
6289 case 2:
6290 case 6:
6291 *prot |= PAGE_READ | PAGE_EXEC;
6292 break;
6293 default:
6294 qemu_log_mask(LOG_GUEST_ERROR,
6295 "Bad value for AP bits in DRACR %"
6296 PRIx32 "\n", ap);
6297 }
6298 } else { /* Priv. mode AP bits decoding */
6299 switch (ap) {
6300 case 0:
6301 break; /* no access */
6302 case 1:
6303 case 2:
6304 case 3:
6305 *prot |= PAGE_WRITE;
6306 /* fall through */
6307 case 5:
6308 case 6:
6309 *prot |= PAGE_READ | PAGE_EXEC;
6310 break;
6311 default:
6312 qemu_log_mask(LOG_GUEST_ERROR,
6313 "Bad value for AP bits in DRACR %"
6314 PRIx32 "\n", ap);
6315 }
6316 }
6317
6318 /* execute never */
6319 if (env->pmsav7.dracr[n] & (1 << 12)) {
6320 *prot &= ~PAGE_EXEC;
6321 }
6322 }
6323 }
6324
6325 *fsr = 0x00d; /* Permission fault */
6326 return !(*prot & (1 << access_type));
6327 }
6328
6329 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
6330 int access_type, ARMMMUIdx mmu_idx,
6331 hwaddr *phys_ptr, int *prot, uint32_t *fsr)
6332 {
6333 int n;
6334 uint32_t mask;
6335 uint32_t base;
6336 bool is_user = regime_is_user(env, mmu_idx);
6337
6338 *phys_ptr = address;
6339 for (n = 7; n >= 0; n--) {
6340 base = env->cp15.c6_region[n];
6341 if ((base & 1) == 0) {
6342 continue;
6343 }
6344 mask = 1 << ((base >> 1) & 0x1f);
6345 /* Keep this shift separate from the above to avoid an
6346 (undefined) << 32. */
6347 mask = (mask << 1) - 1;
6348 if (((base ^ address) & ~mask) == 0) {
6349 break;
6350 }
6351 }
6352 if (n < 0) {
6353 *fsr = 2;
6354 return true;
6355 }
6356
6357 if (access_type == 2) {
6358 mask = env->cp15.pmsav5_insn_ap;
6359 } else {
6360 mask = env->cp15.pmsav5_data_ap;
6361 }
6362 mask = (mask >> (n * 4)) & 0xf;
6363 switch (mask) {
6364 case 0:
6365 *fsr = 1;
6366 return true;
6367 case 1:
6368 if (is_user) {
6369 *fsr = 1;
6370 return true;
6371 }
6372 *prot = PAGE_READ | PAGE_WRITE;
6373 break;
6374 case 2:
6375 *prot = PAGE_READ;
6376 if (!is_user) {
6377 *prot |= PAGE_WRITE;
6378 }
6379 break;
6380 case 3:
6381 *prot = PAGE_READ | PAGE_WRITE;
6382 break;
6383 case 5:
6384 if (is_user) {
6385 *fsr = 1;
6386 return true;
6387 }
6388 *prot = PAGE_READ;
6389 break;
6390 case 6:
6391 *prot = PAGE_READ;
6392 break;
6393 default:
6394 /* Bad permission. */
6395 *fsr = 1;
6396 return true;
6397 }
6398 *prot |= PAGE_EXEC;
6399 return false;
6400 }
6401
6402 /* get_phys_addr - get the physical address for this virtual address
6403 *
6404 * Find the physical address corresponding to the given virtual address,
6405 * by doing a translation table walk on MMU based systems or using the
6406 * MPU state on MPU based systems.
6407 *
6408 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
6409 * prot and page_size may not be filled in, and the populated fsr value provides
6410 * information on why the translation aborted, in the format of a
6411 * DFSR/IFSR fault register, with the following caveats:
6412 * * we honour the short vs long DFSR format differences.
6413 * * the WnR bit is never set (the caller must do this).
6414 * * for PSMAv5 based systems we don't bother to return a full FSR format
6415 * value.
6416 *
6417 * @env: CPUARMState
6418 * @address: virtual address to get physical address for
6419 * @access_type: 0 for read, 1 for write, 2 for execute
6420 * @mmu_idx: MMU index indicating required translation regime
6421 * @phys_ptr: set to the physical address corresponding to the virtual address
6422 * @attrs: set to the memory transaction attributes to use
6423 * @prot: set to the permissions for the page containing phys_ptr
6424 * @page_size: set to the size of the page containing phys_ptr
6425 * @fsr: set to the DFSR/IFSR value on failure
6426 */
6427 static inline bool get_phys_addr(CPUARMState *env, target_ulong address,
6428 int access_type, ARMMMUIdx mmu_idx,
6429 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
6430 target_ulong *page_size, uint32_t *fsr)
6431 {
6432 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
6433 /* TODO: when we support EL2 we should here call ourselves recursively
6434 * to do the stage 1 and then stage 2 translations. The arm_ld*_ptw
6435 * functions will also need changing to perform ARMMMUIdx_S2NS loads
6436 * rather than direct physical memory loads when appropriate.
6437 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
6438 */
6439 assert(!arm_feature(env, ARM_FEATURE_EL2));
6440 mmu_idx += ARMMMUIdx_S1NSE0;
6441 }
6442
6443 /* The page table entries may downgrade secure to non-secure, but
6444 * cannot upgrade an non-secure translation regime's attributes
6445 * to secure.
6446 */
6447 attrs->secure = regime_is_secure(env, mmu_idx);
6448 attrs->user = regime_is_user(env, mmu_idx);
6449
6450 /* Fast Context Switch Extension. This doesn't exist at all in v8.
6451 * In v7 and earlier it affects all stage 1 translations.
6452 */
6453 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS
6454 && !arm_feature(env, ARM_FEATURE_V8)) {
6455 if (regime_el(env, mmu_idx) == 3) {
6456 address += env->cp15.fcseidr_s;
6457 } else {
6458 address += env->cp15.fcseidr_ns;
6459 }
6460 }
6461
6462 /* pmsav7 has special handling for when MPU is disabled so call it before
6463 * the common MMU/MPU disabled check below.
6464 */
6465 if (arm_feature(env, ARM_FEATURE_MPU) &&
6466 arm_feature(env, ARM_FEATURE_V7)) {
6467 *page_size = TARGET_PAGE_SIZE;
6468 return get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
6469 phys_ptr, prot, fsr);
6470 }
6471
6472 if (regime_translation_disabled(env, mmu_idx)) {
6473 /* MMU/MPU disabled. */
6474 *phys_ptr = address;
6475 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
6476 *page_size = TARGET_PAGE_SIZE;
6477 return 0;
6478 }
6479
6480 if (arm_feature(env, ARM_FEATURE_MPU)) {
6481 /* Pre-v7 MPU */
6482 *page_size = TARGET_PAGE_SIZE;
6483 return get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
6484 phys_ptr, prot, fsr);
6485 }
6486
6487 if (regime_using_lpae_format(env, mmu_idx)) {
6488 return get_phys_addr_lpae(env, address, access_type, mmu_idx, phys_ptr,
6489 attrs, prot, page_size, fsr);
6490 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
6491 return get_phys_addr_v6(env, address, access_type, mmu_idx, phys_ptr,
6492 attrs, prot, page_size, fsr);
6493 } else {
6494 return get_phys_addr_v5(env, address, access_type, mmu_idx, phys_ptr,
6495 prot, page_size, fsr);
6496 }
6497 }
6498
6499 /* Walk the page table and (if the mapping exists) add the page
6500 * to the TLB. Return false on success, or true on failure. Populate
6501 * fsr with ARM DFSR/IFSR fault register format value on failure.
6502 */
6503 bool arm_tlb_fill(CPUState *cs, vaddr address,
6504 int access_type, int mmu_idx, uint32_t *fsr)
6505 {
6506 ARMCPU *cpu = ARM_CPU(cs);
6507 CPUARMState *env = &cpu->env;
6508 hwaddr phys_addr;
6509 target_ulong page_size;
6510 int prot;
6511 int ret;
6512 MemTxAttrs attrs = {};
6513
6514 ret = get_phys_addr(env, address, access_type, mmu_idx, &phys_addr,
6515 &attrs, &prot, &page_size, fsr);
6516 if (!ret) {
6517 /* Map a single [sub]page. */
6518 phys_addr &= TARGET_PAGE_MASK;
6519 address &= TARGET_PAGE_MASK;
6520 tlb_set_page_with_attrs(cs, address, phys_addr, attrs,
6521 prot, mmu_idx, page_size);
6522 return 0;
6523 }
6524
6525 return ret;
6526 }
6527
6528 hwaddr arm_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
6529 {
6530 ARMCPU *cpu = ARM_CPU(cs);
6531 CPUARMState *env = &cpu->env;
6532 hwaddr phys_addr;
6533 target_ulong page_size;
6534 int prot;
6535 bool ret;
6536 uint32_t fsr;
6537 MemTxAttrs attrs = {};
6538
6539 ret = get_phys_addr(env, addr, 0, cpu_mmu_index(env), &phys_addr,
6540 &attrs, &prot, &page_size, &fsr);
6541
6542 if (ret) {
6543 return -1;
6544 }
6545
6546 return phys_addr;
6547 }
6548
6549 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
6550 {
6551 if ((env->uncached_cpsr & CPSR_M) == mode) {
6552 env->regs[13] = val;
6553 } else {
6554 env->banked_r13[bank_number(mode)] = val;
6555 }
6556 }
6557
6558 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
6559 {
6560 if ((env->uncached_cpsr & CPSR_M) == mode) {
6561 return env->regs[13];
6562 } else {
6563 return env->banked_r13[bank_number(mode)];
6564 }
6565 }
6566
6567 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
6568 {
6569 ARMCPU *cpu = arm_env_get_cpu(env);
6570
6571 switch (reg) {
6572 case 0: /* APSR */
6573 return xpsr_read(env) & 0xf8000000;
6574 case 1: /* IAPSR */
6575 return xpsr_read(env) & 0xf80001ff;
6576 case 2: /* EAPSR */
6577 return xpsr_read(env) & 0xff00fc00;
6578 case 3: /* xPSR */
6579 return xpsr_read(env) & 0xff00fdff;
6580 case 5: /* IPSR */
6581 return xpsr_read(env) & 0x000001ff;
6582 case 6: /* EPSR */
6583 return xpsr_read(env) & 0x0700fc00;
6584 case 7: /* IEPSR */
6585 return xpsr_read(env) & 0x0700edff;
6586 case 8: /* MSP */
6587 return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
6588 case 9: /* PSP */
6589 return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
6590 case 16: /* PRIMASK */
6591 return (env->daif & PSTATE_I) != 0;
6592 case 17: /* BASEPRI */
6593 case 18: /* BASEPRI_MAX */
6594 return env->v7m.basepri;
6595 case 19: /* FAULTMASK */
6596 return (env->daif & PSTATE_F) != 0;
6597 case 20: /* CONTROL */
6598 return env->v7m.control;
6599 default:
6600 /* ??? For debugging only. */
6601 cpu_abort(CPU(cpu), "Unimplemented system register read (%d)\n", reg);
6602 return 0;
6603 }
6604 }
6605
6606 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
6607 {
6608 ARMCPU *cpu = arm_env_get_cpu(env);
6609
6610 switch (reg) {
6611 case 0: /* APSR */
6612 xpsr_write(env, val, 0xf8000000);
6613 break;
6614 case 1: /* IAPSR */
6615 xpsr_write(env, val, 0xf8000000);
6616 break;
6617 case 2: /* EAPSR */
6618 xpsr_write(env, val, 0xfe00fc00);
6619 break;
6620 case 3: /* xPSR */
6621 xpsr_write(env, val, 0xfe00fc00);
6622 break;
6623 case 5: /* IPSR */
6624 /* IPSR bits are readonly. */
6625 break;
6626 case 6: /* EPSR */
6627 xpsr_write(env, val, 0x0600fc00);
6628 break;
6629 case 7: /* IEPSR */
6630 xpsr_write(env, val, 0x0600fc00);
6631 break;
6632 case 8: /* MSP */
6633 if (env->v7m.current_sp)
6634 env->v7m.other_sp = val;
6635 else
6636 env->regs[13] = val;
6637 break;
6638 case 9: /* PSP */
6639 if (env->v7m.current_sp)
6640 env->regs[13] = val;
6641 else
6642 env->v7m.other_sp = val;
6643 break;
6644 case 16: /* PRIMASK */
6645 if (val & 1) {
6646 env->daif |= PSTATE_I;
6647 } else {
6648 env->daif &= ~PSTATE_I;
6649 }
6650 break;
6651 case 17: /* BASEPRI */
6652 env->v7m.basepri = val & 0xff;
6653 break;
6654 case 18: /* BASEPRI_MAX */
6655 val &= 0xff;
6656 if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
6657 env->v7m.basepri = val;
6658 break;
6659 case 19: /* FAULTMASK */
6660 if (val & 1) {
6661 env->daif |= PSTATE_F;
6662 } else {
6663 env->daif &= ~PSTATE_F;
6664 }
6665 break;
6666 case 20: /* CONTROL */
6667 env->v7m.control = val & 3;
6668 switch_v7m_sp(env, (val & 2) != 0);
6669 break;
6670 default:
6671 /* ??? For debugging only. */
6672 cpu_abort(CPU(cpu), "Unimplemented system register write (%d)\n", reg);
6673 return;
6674 }
6675 }
6676
6677 #endif
6678
6679 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
6680 {
6681 /* Implement DC ZVA, which zeroes a fixed-length block of memory.
6682 * Note that we do not implement the (architecturally mandated)
6683 * alignment fault for attempts to use this on Device memory
6684 * (which matches the usual QEMU behaviour of not implementing either
6685 * alignment faults or any memory attribute handling).
6686 */
6687
6688 ARMCPU *cpu = arm_env_get_cpu(env);
6689 uint64_t blocklen = 4 << cpu->dcz_blocksize;
6690 uint64_t vaddr = vaddr_in & ~(blocklen - 1);
6691
6692 #ifndef CONFIG_USER_ONLY
6693 {
6694 /* Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than
6695 * the block size so we might have to do more than one TLB lookup.
6696 * We know that in fact for any v8 CPU the page size is at least 4K
6697 * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
6698 * 1K as an artefact of legacy v5 subpage support being present in the
6699 * same QEMU executable.
6700 */
6701 int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
6702 void *hostaddr[maxidx];
6703 int try, i;
6704 unsigned mmu_idx = cpu_mmu_index(env);
6705 TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
6706
6707 for (try = 0; try < 2; try++) {
6708
6709 for (i = 0; i < maxidx; i++) {
6710 hostaddr[i] = tlb_vaddr_to_host(env,
6711 vaddr + TARGET_PAGE_SIZE * i,
6712 1, mmu_idx);
6713 if (!hostaddr[i]) {
6714 break;
6715 }
6716 }
6717 if (i == maxidx) {
6718 /* If it's all in the TLB it's fair game for just writing to;
6719 * we know we don't need to update dirty status, etc.
6720 */
6721 for (i = 0; i < maxidx - 1; i++) {
6722 memset(hostaddr[i], 0, TARGET_PAGE_SIZE);
6723 }
6724 memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE));
6725 return;
6726 }
6727 /* OK, try a store and see if we can populate the tlb. This
6728 * might cause an exception if the memory isn't writable,
6729 * in which case we will longjmp out of here. We must for
6730 * this purpose use the actual register value passed to us
6731 * so that we get the fault address right.
6732 */
6733 helper_ret_stb_mmu(env, vaddr_in, 0, oi, GETRA());
6734 /* Now we can populate the other TLB entries, if any */
6735 for (i = 0; i < maxidx; i++) {
6736 uint64_t va = vaddr + TARGET_PAGE_SIZE * i;
6737 if (va != (vaddr_in & TARGET_PAGE_MASK)) {
6738 helper_ret_stb_mmu(env, va, 0, oi, GETRA());
6739 }
6740 }
6741 }
6742
6743 /* Slow path (probably attempt to do this to an I/O device or
6744 * similar, or clearing of a block of code we have translations
6745 * cached for). Just do a series of byte writes as the architecture
6746 * demands. It's not worth trying to use a cpu_physical_memory_map(),
6747 * memset(), unmap() sequence here because:
6748 * + we'd need to account for the blocksize being larger than a page
6749 * + the direct-RAM access case is almost always going to be dealt
6750 * with in the fastpath code above, so there's no speed benefit
6751 * + we would have to deal with the map returning NULL because the
6752 * bounce buffer was in use
6753 */
6754 for (i = 0; i < blocklen; i++) {
6755 helper_ret_stb_mmu(env, vaddr + i, 0, oi, GETRA());
6756 }
6757 }
6758 #else
6759 memset(g2h(vaddr), 0, blocklen);
6760 #endif
6761 }
6762
6763 /* Note that signed overflow is undefined in C. The following routines are
6764 careful to use unsigned types where modulo arithmetic is required.
6765 Failure to do so _will_ break on newer gcc. */
6766
6767 /* Signed saturating arithmetic. */
6768
6769 /* Perform 16-bit signed saturating addition. */
6770 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
6771 {
6772 uint16_t res;
6773
6774 res = a + b;
6775 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
6776 if (a & 0x8000)
6777 res = 0x8000;
6778 else
6779 res = 0x7fff;
6780 }
6781 return res;
6782 }
6783
6784 /* Perform 8-bit signed saturating addition. */
6785 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
6786 {
6787 uint8_t res;
6788
6789 res = a + b;
6790 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
6791 if (a & 0x80)
6792 res = 0x80;
6793 else
6794 res = 0x7f;
6795 }
6796 return res;
6797 }
6798
6799 /* Perform 16-bit signed saturating subtraction. */
6800 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
6801 {
6802 uint16_t res;
6803
6804 res = a - b;
6805 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
6806 if (a & 0x8000)
6807 res = 0x8000;
6808 else
6809 res = 0x7fff;
6810 }
6811 return res;
6812 }
6813
6814 /* Perform 8-bit signed saturating subtraction. */
6815 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
6816 {
6817 uint8_t res;
6818
6819 res = a - b;
6820 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
6821 if (a & 0x80)
6822 res = 0x80;
6823 else
6824 res = 0x7f;
6825 }
6826 return res;
6827 }
6828
6829 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
6830 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
6831 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8);
6832 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8);
6833 #define PFX q
6834
6835 #include "op_addsub.h"
6836
6837 /* Unsigned saturating arithmetic. */
6838 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
6839 {
6840 uint16_t res;
6841 res = a + b;
6842 if (res < a)
6843 res = 0xffff;
6844 return res;
6845 }
6846
6847 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
6848 {
6849 if (a > b)
6850 return a - b;
6851 else
6852 return 0;
6853 }
6854
6855 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
6856 {
6857 uint8_t res;
6858 res = a + b;
6859 if (res < a)
6860 res = 0xff;
6861 return res;
6862 }
6863
6864 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
6865 {
6866 if (a > b)
6867 return a - b;
6868 else
6869 return 0;
6870 }
6871
6872 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
6873 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
6874 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8);
6875 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8);
6876 #define PFX uq
6877
6878 #include "op_addsub.h"
6879
6880 /* Signed modulo arithmetic. */
6881 #define SARITH16(a, b, n, op) do { \
6882 int32_t sum; \
6883 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
6884 RESULT(sum, n, 16); \
6885 if (sum >= 0) \
6886 ge |= 3 << (n * 2); \
6887 } while(0)
6888
6889 #define SARITH8(a, b, n, op) do { \
6890 int32_t sum; \
6891 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
6892 RESULT(sum, n, 8); \
6893 if (sum >= 0) \
6894 ge |= 1 << n; \
6895 } while(0)
6896
6897
6898 #define ADD16(a, b, n) SARITH16(a, b, n, +)
6899 #define SUB16(a, b, n) SARITH16(a, b, n, -)
6900 #define ADD8(a, b, n) SARITH8(a, b, n, +)
6901 #define SUB8(a, b, n) SARITH8(a, b, n, -)
6902 #define PFX s
6903 #define ARITH_GE
6904
6905 #include "op_addsub.h"
6906
6907 /* Unsigned modulo arithmetic. */
6908 #define ADD16(a, b, n) do { \
6909 uint32_t sum; \
6910 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
6911 RESULT(sum, n, 16); \
6912 if ((sum >> 16) == 1) \
6913 ge |= 3 << (n * 2); \
6914 } while(0)
6915
6916 #define ADD8(a, b, n) do { \
6917 uint32_t sum; \
6918 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
6919 RESULT(sum, n, 8); \
6920 if ((sum >> 8) == 1) \
6921 ge |= 1 << n; \
6922 } while(0)
6923
6924 #define SUB16(a, b, n) do { \
6925 uint32_t sum; \
6926 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
6927 RESULT(sum, n, 16); \
6928 if ((sum >> 16) == 0) \
6929 ge |= 3 << (n * 2); \
6930 } while(0)
6931
6932 #define SUB8(a, b, n) do { \
6933 uint32_t sum; \
6934 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
6935 RESULT(sum, n, 8); \
6936 if ((sum >> 8) == 0) \
6937 ge |= 1 << n; \
6938 } while(0)
6939
6940 #define PFX u
6941 #define ARITH_GE
6942
6943 #include "op_addsub.h"
6944
6945 /* Halved signed arithmetic. */
6946 #define ADD16(a, b, n) \
6947 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
6948 #define SUB16(a, b, n) \
6949 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
6950 #define ADD8(a, b, n) \
6951 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
6952 #define SUB8(a, b, n) \
6953 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
6954 #define PFX sh
6955
6956 #include "op_addsub.h"
6957
6958 /* Halved unsigned arithmetic. */
6959 #define ADD16(a, b, n) \
6960 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
6961 #define SUB16(a, b, n) \
6962 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
6963 #define ADD8(a, b, n) \
6964 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
6965 #define SUB8(a, b, n) \
6966 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
6967 #define PFX uh
6968
6969 #include "op_addsub.h"
6970
6971 static inline uint8_t do_usad(uint8_t a, uint8_t b)
6972 {
6973 if (a > b)
6974 return a - b;
6975 else
6976 return b - a;
6977 }
6978
6979 /* Unsigned sum of absolute byte differences. */
6980 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
6981 {
6982 uint32_t sum;
6983 sum = do_usad(a, b);
6984 sum += do_usad(a >> 8, b >> 8);
6985 sum += do_usad(a >> 16, b >>16);
6986 sum += do_usad(a >> 24, b >> 24);
6987 return sum;
6988 }
6989
6990 /* For ARMv6 SEL instruction. */
6991 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
6992 {
6993 uint32_t mask;
6994
6995 mask = 0;
6996 if (flags & 1)
6997 mask |= 0xff;
6998 if (flags & 2)
6999 mask |= 0xff00;
7000 if (flags & 4)
7001 mask |= 0xff0000;
7002 if (flags & 8)
7003 mask |= 0xff000000;
7004 return (a & mask) | (b & ~mask);
7005 }
7006
7007 /* VFP support. We follow the convention used for VFP instructions:
7008 Single precision routines have a "s" suffix, double precision a
7009 "d" suffix. */
7010
7011 /* Convert host exception flags to vfp form. */
7012 static inline int vfp_exceptbits_from_host(int host_bits)
7013 {
7014 int target_bits = 0;
7015
7016 if (host_bits & float_flag_invalid)
7017 target_bits |= 1;
7018 if (host_bits & float_flag_divbyzero)
7019 target_bits |= 2;
7020 if (host_bits & float_flag_overflow)
7021 target_bits |= 4;
7022 if (host_bits & (float_flag_underflow | float_flag_output_denormal))
7023 target_bits |= 8;
7024 if (host_bits & float_flag_inexact)
7025 target_bits |= 0x10;
7026 if (host_bits & float_flag_input_denormal)
7027 target_bits |= 0x80;
7028 return target_bits;
7029 }
7030
7031 uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
7032 {
7033 int i;
7034 uint32_t fpscr;
7035
7036 fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
7037 | (env->vfp.vec_len << 16)
7038 | (env->vfp.vec_stride << 20);
7039 i = get_float_exception_flags(&env->vfp.fp_status);
7040 i |= get_float_exception_flags(&env->vfp.standard_fp_status);
7041 fpscr |= vfp_exceptbits_from_host(i);
7042 return fpscr;
7043 }
7044
7045 uint32_t vfp_get_fpscr(CPUARMState *env)
7046 {
7047 return HELPER(vfp_get_fpscr)(env);
7048 }
7049
7050 /* Convert vfp exception flags to target form. */
7051 static inline int vfp_exceptbits_to_host(int target_bits)
7052 {
7053 int host_bits = 0;
7054
7055 if (target_bits & 1)
7056 host_bits |= float_flag_invalid;
7057 if (target_bits & 2)
7058 host_bits |= float_flag_divbyzero;
7059 if (target_bits & 4)
7060 host_bits |= float_flag_overflow;
7061 if (target_bits & 8)
7062 host_bits |= float_flag_underflow;
7063 if (target_bits & 0x10)
7064 host_bits |= float_flag_inexact;
7065 if (target_bits & 0x80)
7066 host_bits |= float_flag_input_denormal;
7067 return host_bits;
7068 }
7069
7070 void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
7071 {
7072 int i;
7073 uint32_t changed;
7074
7075 changed = env->vfp.xregs[ARM_VFP_FPSCR];
7076 env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
7077 env->vfp.vec_len = (val >> 16) & 7;
7078 env->vfp.vec_stride = (val >> 20) & 3;
7079
7080 changed ^= val;
7081 if (changed & (3 << 22)) {
7082 i = (val >> 22) & 3;
7083 switch (i) {
7084 case FPROUNDING_TIEEVEN:
7085 i = float_round_nearest_even;
7086 break;
7087 case FPROUNDING_POSINF:
7088 i = float_round_up;
7089 break;
7090 case FPROUNDING_NEGINF:
7091 i = float_round_down;
7092 break;
7093 case FPROUNDING_ZERO:
7094 i = float_round_to_zero;
7095 break;
7096 }
7097 set_float_rounding_mode(i, &env->vfp.fp_status);
7098 }
7099 if (changed & (1 << 24)) {
7100 set_flush_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
7101 set_flush_inputs_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
7102 }
7103 if (changed & (1 << 25))
7104 set_default_nan_mode((val & (1 << 25)) != 0, &env->vfp.fp_status);
7105
7106 i = vfp_exceptbits_to_host(val);
7107 set_float_exception_flags(i, &env->vfp.fp_status);
7108 set_float_exception_flags(0, &env->vfp.standard_fp_status);
7109 }
7110
7111 void vfp_set_fpscr(CPUARMState *env, uint32_t val)
7112 {
7113 HELPER(vfp_set_fpscr)(env, val);
7114 }
7115
7116 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
7117
7118 #define VFP_BINOP(name) \
7119 float32 VFP_HELPER(name, s)(float32 a, float32 b, void *fpstp) \
7120 { \
7121 float_status *fpst = fpstp; \
7122 return float32_ ## name(a, b, fpst); \
7123 } \
7124 float64 VFP_HELPER(name, d)(float64 a, float64 b, void *fpstp) \
7125 { \
7126 float_status *fpst = fpstp; \
7127 return float64_ ## name(a, b, fpst); \
7128 }
7129 VFP_BINOP(add)
7130 VFP_BINOP(sub)
7131 VFP_BINOP(mul)
7132 VFP_BINOP(div)
7133 VFP_BINOP(min)
7134 VFP_BINOP(max)
7135 VFP_BINOP(minnum)
7136 VFP_BINOP(maxnum)
7137 #undef VFP_BINOP
7138
7139 float32 VFP_HELPER(neg, s)(float32 a)
7140 {
7141 return float32_chs(a);
7142 }
7143
7144 float64 VFP_HELPER(neg, d)(float64 a)
7145 {
7146 return float64_chs(a);
7147 }
7148
7149 float32 VFP_HELPER(abs, s)(float32 a)
7150 {
7151 return float32_abs(a);
7152 }
7153
7154 float64 VFP_HELPER(abs, d)(float64 a)
7155 {
7156 return float64_abs(a);
7157 }
7158
7159 float32 VFP_HELPER(sqrt, s)(float32 a, CPUARMState *env)
7160 {
7161 return float32_sqrt(a, &env->vfp.fp_status);
7162 }
7163
7164 float64 VFP_HELPER(sqrt, d)(float64 a, CPUARMState *env)
7165 {
7166 return float64_sqrt(a, &env->vfp.fp_status);
7167 }
7168
7169 /* XXX: check quiet/signaling case */
7170 #define DO_VFP_cmp(p, type) \
7171 void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env) \
7172 { \
7173 uint32_t flags; \
7174 switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
7175 case 0: flags = 0x6; break; \
7176 case -1: flags = 0x8; break; \
7177 case 1: flags = 0x2; break; \
7178 default: case 2: flags = 0x3; break; \
7179 } \
7180 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
7181 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
7182 } \
7183 void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \
7184 { \
7185 uint32_t flags; \
7186 switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
7187 case 0: flags = 0x6; break; \
7188 case -1: flags = 0x8; break; \
7189 case 1: flags = 0x2; break; \
7190 default: case 2: flags = 0x3; break; \
7191 } \
7192 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
7193 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
7194 }
7195 DO_VFP_cmp(s, float32)
7196 DO_VFP_cmp(d, float64)
7197 #undef DO_VFP_cmp
7198
7199 /* Integer to float and float to integer conversions */
7200
7201 #define CONV_ITOF(name, fsz, sign) \
7202 float##fsz HELPER(name)(uint32_t x, void *fpstp) \
7203 { \
7204 float_status *fpst = fpstp; \
7205 return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \
7206 }
7207
7208 #define CONV_FTOI(name, fsz, sign, round) \
7209 uint32_t HELPER(name)(float##fsz x, void *fpstp) \
7210 { \
7211 float_status *fpst = fpstp; \
7212 if (float##fsz##_is_any_nan(x)) { \
7213 float_raise(float_flag_invalid, fpst); \
7214 return 0; \
7215 } \
7216 return float##fsz##_to_##sign##int32##round(x, fpst); \
7217 }
7218
7219 #define FLOAT_CONVS(name, p, fsz, sign) \
7220 CONV_ITOF(vfp_##name##to##p, fsz, sign) \
7221 CONV_FTOI(vfp_to##name##p, fsz, sign, ) \
7222 CONV_FTOI(vfp_to##name##z##p, fsz, sign, _round_to_zero)
7223
7224 FLOAT_CONVS(si, s, 32, )
7225 FLOAT_CONVS(si, d, 64, )
7226 FLOAT_CONVS(ui, s, 32, u)
7227 FLOAT_CONVS(ui, d, 64, u)
7228
7229 #undef CONV_ITOF
7230 #undef CONV_FTOI
7231 #undef FLOAT_CONVS
7232
7233 /* floating point conversion */
7234 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUARMState *env)
7235 {
7236 float64 r = float32_to_float64(x, &env->vfp.fp_status);
7237 /* ARM requires that S<->D conversion of any kind of NaN generates
7238 * a quiet NaN by forcing the most significant frac bit to 1.
7239 */
7240 return float64_maybe_silence_nan(r);
7241 }
7242
7243 float32 VFP_HELPER(fcvts, d)(float64 x, CPUARMState *env)
7244 {
7245 float32 r = float64_to_float32(x, &env->vfp.fp_status);
7246 /* ARM requires that S<->D conversion of any kind of NaN generates
7247 * a quiet NaN by forcing the most significant frac bit to 1.
7248 */
7249 return float32_maybe_silence_nan(r);
7250 }
7251
7252 /* VFP3 fixed point conversion. */
7253 #define VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
7254 float##fsz HELPER(vfp_##name##to##p)(uint##isz##_t x, uint32_t shift, \
7255 void *fpstp) \
7256 { \
7257 float_status *fpst = fpstp; \
7258 float##fsz tmp; \
7259 tmp = itype##_to_##float##fsz(x, fpst); \
7260 return float##fsz##_scalbn(tmp, -(int)shift, fpst); \
7261 }
7262
7263 /* Notice that we want only input-denormal exception flags from the
7264 * scalbn operation: the other possible flags (overflow+inexact if
7265 * we overflow to infinity, output-denormal) aren't correct for the
7266 * complete scale-and-convert operation.
7267 */
7268 #define VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, round) \
7269 uint##isz##_t HELPER(vfp_to##name##p##round)(float##fsz x, \
7270 uint32_t shift, \
7271 void *fpstp) \
7272 { \
7273 float_status *fpst = fpstp; \
7274 int old_exc_flags = get_float_exception_flags(fpst); \
7275 float##fsz tmp; \
7276 if (float##fsz##_is_any_nan(x)) { \
7277 float_raise(float_flag_invalid, fpst); \
7278 return 0; \
7279 } \
7280 tmp = float##fsz##_scalbn(x, shift, fpst); \
7281 old_exc_flags |= get_float_exception_flags(fpst) \
7282 & float_flag_input_denormal; \
7283 set_float_exception_flags(old_exc_flags, fpst); \
7284 return float##fsz##_to_##itype##round(tmp, fpst); \
7285 }
7286
7287 #define VFP_CONV_FIX(name, p, fsz, isz, itype) \
7288 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
7289 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, _round_to_zero) \
7290 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
7291
7292 #define VFP_CONV_FIX_A64(name, p, fsz, isz, itype) \
7293 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
7294 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
7295
7296 VFP_CONV_FIX(sh, d, 64, 64, int16)
7297 VFP_CONV_FIX(sl, d, 64, 64, int32)
7298 VFP_CONV_FIX_A64(sq, d, 64, 64, int64)
7299 VFP_CONV_FIX(uh, d, 64, 64, uint16)
7300 VFP_CONV_FIX(ul, d, 64, 64, uint32)
7301 VFP_CONV_FIX_A64(uq, d, 64, 64, uint64)
7302 VFP_CONV_FIX(sh, s, 32, 32, int16)
7303 VFP_CONV_FIX(sl, s, 32, 32, int32)
7304 VFP_CONV_FIX_A64(sq, s, 32, 64, int64)
7305 VFP_CONV_FIX(uh, s, 32, 32, uint16)
7306 VFP_CONV_FIX(ul, s, 32, 32, uint32)
7307 VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
7308 #undef VFP_CONV_FIX
7309 #undef VFP_CONV_FIX_FLOAT
7310 #undef VFP_CONV_FLOAT_FIX_ROUND
7311
7312 /* Set the current fp rounding mode and return the old one.
7313 * The argument is a softfloat float_round_ value.
7314 */
7315 uint32_t HELPER(set_rmode)(uint32_t rmode, CPUARMState *env)
7316 {
7317 float_status *fp_status = &env->vfp.fp_status;
7318
7319 uint32_t prev_rmode = get_float_rounding_mode(fp_status);
7320 set_float_rounding_mode(rmode, fp_status);
7321
7322 return prev_rmode;
7323 }
7324
7325 /* Set the current fp rounding mode in the standard fp status and return
7326 * the old one. This is for NEON instructions that need to change the
7327 * rounding mode but wish to use the standard FPSCR values for everything
7328 * else. Always set the rounding mode back to the correct value after
7329 * modifying it.
7330 * The argument is a softfloat float_round_ value.
7331 */
7332 uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env)
7333 {
7334 float_status *fp_status = &env->vfp.standard_fp_status;
7335
7336 uint32_t prev_rmode = get_float_rounding_mode(fp_status);
7337 set_float_rounding_mode(rmode, fp_status);
7338
7339 return prev_rmode;
7340 }
7341
7342 /* Half precision conversions. */
7343 static float32 do_fcvt_f16_to_f32(uint32_t a, CPUARMState *env, float_status *s)
7344 {
7345 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7346 float32 r = float16_to_float32(make_float16(a), ieee, s);
7347 if (ieee) {
7348 return float32_maybe_silence_nan(r);
7349 }
7350 return r;
7351 }
7352
7353 static uint32_t do_fcvt_f32_to_f16(float32 a, CPUARMState *env, float_status *s)
7354 {
7355 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7356 float16 r = float32_to_float16(a, ieee, s);
7357 if (ieee) {
7358 r = float16_maybe_silence_nan(r);
7359 }
7360 return float16_val(r);
7361 }
7362
7363 float32 HELPER(neon_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)
7364 {
7365 return do_fcvt_f16_to_f32(a, env, &env->vfp.standard_fp_status);
7366 }
7367
7368 uint32_t HELPER(neon_fcvt_f32_to_f16)(float32 a, CPUARMState *env)
7369 {
7370 return do_fcvt_f32_to_f16(a, env, &env->vfp.standard_fp_status);
7371 }
7372
7373 float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)
7374 {
7375 return do_fcvt_f16_to_f32(a, env, &env->vfp.fp_status);
7376 }
7377
7378 uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, CPUARMState *env)
7379 {
7380 return do_fcvt_f32_to_f16(a, env, &env->vfp.fp_status);
7381 }
7382
7383 float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, CPUARMState *env)
7384 {
7385 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7386 float64 r = float16_to_float64(make_float16(a), ieee, &env->vfp.fp_status);
7387 if (ieee) {
7388 return float64_maybe_silence_nan(r);
7389 }
7390 return r;
7391 }
7392
7393 uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, CPUARMState *env)
7394 {
7395 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7396 float16 r = float64_to_float16(a, ieee, &env->vfp.fp_status);
7397 if (ieee) {
7398 r = float16_maybe_silence_nan(r);
7399 }
7400 return float16_val(r);
7401 }
7402
7403 #define float32_two make_float32(0x40000000)
7404 #define float32_three make_float32(0x40400000)
7405 #define float32_one_point_five make_float32(0x3fc00000)
7406
7407 float32 HELPER(recps_f32)(float32 a, float32 b, CPUARMState *env)
7408 {
7409 float_status *s = &env->vfp.standard_fp_status;
7410 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
7411 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
7412 if (!(float32_is_zero(a) || float32_is_zero(b))) {
7413 float_raise(float_flag_input_denormal, s);
7414 }
7415 return float32_two;
7416 }
7417 return float32_sub(float32_two, float32_mul(a, b, s), s);
7418 }
7419
7420 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUARMState *env)
7421 {
7422 float_status *s = &env->vfp.standard_fp_status;
7423 float32 product;
7424 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
7425 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
7426 if (!(float32_is_zero(a) || float32_is_zero(b))) {
7427 float_raise(float_flag_input_denormal, s);
7428 }
7429 return float32_one_point_five;
7430 }
7431 product = float32_mul(a, b, s);
7432 return float32_div(float32_sub(float32_three, product, s), float32_two, s);
7433 }
7434
7435 /* NEON helpers. */
7436
7437 /* Constants 256 and 512 are used in some helpers; we avoid relying on
7438 * int->float conversions at run-time. */
7439 #define float64_256 make_float64(0x4070000000000000LL)
7440 #define float64_512 make_float64(0x4080000000000000LL)
7441 #define float32_maxnorm make_float32(0x7f7fffff)
7442 #define float64_maxnorm make_float64(0x7fefffffffffffffLL)
7443
7444 /* Reciprocal functions
7445 *
7446 * The algorithm that must be used to calculate the estimate
7447 * is specified by the ARM ARM, see FPRecipEstimate()
7448 */
7449
7450 static float64 recip_estimate(float64 a, float_status *real_fp_status)
7451 {
7452 /* These calculations mustn't set any fp exception flags,
7453 * so we use a local copy of the fp_status.
7454 */
7455 float_status dummy_status = *real_fp_status;
7456 float_status *s = &dummy_status;
7457 /* q = (int)(a * 512.0) */
7458 float64 q = float64_mul(float64_512, a, s);
7459 int64_t q_int = float64_to_int64_round_to_zero(q, s);
7460
7461 /* r = 1.0 / (((double)q + 0.5) / 512.0) */
7462 q = int64_to_float64(q_int, s);
7463 q = float64_add(q, float64_half, s);
7464 q = float64_div(q, float64_512, s);
7465 q = float64_div(float64_one, q, s);
7466
7467 /* s = (int)(256.0 * r + 0.5) */
7468 q = float64_mul(q, float64_256, s);
7469 q = float64_add(q, float64_half, s);
7470 q_int = float64_to_int64_round_to_zero(q, s);
7471
7472 /* return (double)s / 256.0 */
7473 return float64_div(int64_to_float64(q_int, s), float64_256, s);
7474 }
7475
7476 /* Common wrapper to call recip_estimate */
7477 static float64 call_recip_estimate(float64 num, int off, float_status *fpst)
7478 {
7479 uint64_t val64 = float64_val(num);
7480 uint64_t frac = extract64(val64, 0, 52);
7481 int64_t exp = extract64(val64, 52, 11);
7482 uint64_t sbit;
7483 float64 scaled, estimate;
7484
7485 /* Generate the scaled number for the estimate function */
7486 if (exp == 0) {
7487 if (extract64(frac, 51, 1) == 0) {
7488 exp = -1;
7489 frac = extract64(frac, 0, 50) << 2;
7490 } else {
7491 frac = extract64(frac, 0, 51) << 1;
7492 }
7493 }
7494
7495 /* scaled = '0' : '01111111110' : fraction<51:44> : Zeros(44); */
7496 scaled = make_float64((0x3feULL << 52)
7497 | extract64(frac, 44, 8) << 44);
7498
7499 estimate = recip_estimate(scaled, fpst);
7500
7501 /* Build new result */
7502 val64 = float64_val(estimate);
7503 sbit = 0x8000000000000000ULL & val64;
7504 exp = off - exp;
7505 frac = extract64(val64, 0, 52);
7506
7507 if (exp == 0) {
7508 frac = 1ULL << 51 | extract64(frac, 1, 51);
7509 } else if (exp == -1) {
7510 frac = 1ULL << 50 | extract64(frac, 2, 50);
7511 exp = 0;
7512 }
7513
7514 return make_float64(sbit | (exp << 52) | frac);
7515 }
7516
7517 static bool round_to_inf(float_status *fpst, bool sign_bit)
7518 {
7519 switch (fpst->float_rounding_mode) {
7520 case float_round_nearest_even: /* Round to Nearest */
7521 return true;
7522 case float_round_up: /* Round to +Inf */
7523 return !sign_bit;
7524 case float_round_down: /* Round to -Inf */
7525 return sign_bit;
7526 case float_round_to_zero: /* Round to Zero */
7527 return false;
7528 }
7529
7530 g_assert_not_reached();
7531 }
7532
7533 float32 HELPER(recpe_f32)(float32 input, void *fpstp)
7534 {
7535 float_status *fpst = fpstp;
7536 float32 f32 = float32_squash_input_denormal(input, fpst);
7537 uint32_t f32_val = float32_val(f32);
7538 uint32_t f32_sbit = 0x80000000ULL & f32_val;
7539 int32_t f32_exp = extract32(f32_val, 23, 8);
7540 uint32_t f32_frac = extract32(f32_val, 0, 23);
7541 float64 f64, r64;
7542 uint64_t r64_val;
7543 int64_t r64_exp;
7544 uint64_t r64_frac;
7545
7546 if (float32_is_any_nan(f32)) {
7547 float32 nan = f32;
7548 if (float32_is_signaling_nan(f32)) {
7549 float_raise(float_flag_invalid, fpst);
7550 nan = float32_maybe_silence_nan(f32);
7551 }
7552 if (fpst->default_nan_mode) {
7553 nan = float32_default_nan;
7554 }
7555 return nan;
7556 } else if (float32_is_infinity(f32)) {
7557 return float32_set_sign(float32_zero, float32_is_neg(f32));
7558 } else if (float32_is_zero(f32)) {
7559 float_raise(float_flag_divbyzero, fpst);
7560 return float32_set_sign(float32_infinity, float32_is_neg(f32));
7561 } else if ((f32_val & ~(1ULL << 31)) < (1ULL << 21)) {
7562 /* Abs(value) < 2.0^-128 */
7563 float_raise(float_flag_overflow | float_flag_inexact, fpst);
7564 if (round_to_inf(fpst, f32_sbit)) {
7565 return float32_set_sign(float32_infinity, float32_is_neg(f32));
7566 } else {
7567 return float32_set_sign(float32_maxnorm, float32_is_neg(f32));
7568 }
7569 } else if (f32_exp >= 253 && fpst->flush_to_zero) {
7570 float_raise(float_flag_underflow, fpst);
7571 return float32_set_sign(float32_zero, float32_is_neg(f32));
7572 }
7573
7574
7575 f64 = make_float64(((int64_t)(f32_exp) << 52) | (int64_t)(f32_frac) << 29);
7576 r64 = call_recip_estimate(f64, 253, fpst);
7577 r64_val = float64_val(r64);
7578 r64_exp = extract64(r64_val, 52, 11);
7579 r64_frac = extract64(r64_val, 0, 52);
7580
7581 /* result = sign : result_exp<7:0> : fraction<51:29>; */
7582 return make_float32(f32_sbit |
7583 (r64_exp & 0xff) << 23 |
7584 extract64(r64_frac, 29, 24));
7585 }
7586
7587 float64 HELPER(recpe_f64)(float64 input, void *fpstp)
7588 {
7589 float_status *fpst = fpstp;
7590 float64 f64 = float64_squash_input_denormal(input, fpst);
7591 uint64_t f64_val = float64_val(f64);
7592 uint64_t f64_sbit = 0x8000000000000000ULL & f64_val;
7593 int64_t f64_exp = extract64(f64_val, 52, 11);
7594 float64 r64;
7595 uint64_t r64_val;
7596 int64_t r64_exp;
7597 uint64_t r64_frac;
7598
7599 /* Deal with any special cases */
7600 if (float64_is_any_nan(f64)) {
7601 float64 nan = f64;
7602 if (float64_is_signaling_nan(f64)) {
7603 float_raise(float_flag_invalid, fpst);
7604 nan = float64_maybe_silence_nan(f64);
7605 }
7606 if (fpst->default_nan_mode) {
7607 nan = float64_default_nan;
7608 }
7609 return nan;
7610 } else if (float64_is_infinity(f64)) {
7611 return float64_set_sign(float64_zero, float64_is_neg(f64));
7612 } else if (float64_is_zero(f64)) {
7613 float_raise(float_flag_divbyzero, fpst);
7614 return float64_set_sign(float64_infinity, float64_is_neg(f64));
7615 } else if ((f64_val & ~(1ULL << 63)) < (1ULL << 50)) {
7616 /* Abs(value) < 2.0^-1024 */
7617 float_raise(float_flag_overflow | float_flag_inexact, fpst);
7618 if (round_to_inf(fpst, f64_sbit)) {
7619 return float64_set_sign(float64_infinity, float64_is_neg(f64));
7620 } else {
7621 return float64_set_sign(float64_maxnorm, float64_is_neg(f64));
7622 }
7623 } else if (f64_exp >= 2045 && fpst->flush_to_zero) {
7624 float_raise(float_flag_underflow, fpst);
7625 return float64_set_sign(float64_zero, float64_is_neg(f64));
7626 }
7627
7628 r64 = call_recip_estimate(f64, 2045, fpst);
7629 r64_val = float64_val(r64);
7630 r64_exp = extract64(r64_val, 52, 11);
7631 r64_frac = extract64(r64_val, 0, 52);
7632
7633 /* result = sign : result_exp<10:0> : fraction<51:0> */
7634 return make_float64(f64_sbit |
7635 ((r64_exp & 0x7ff) << 52) |
7636 r64_frac);
7637 }
7638
7639 /* The algorithm that must be used to calculate the estimate
7640 * is specified by the ARM ARM.
7641 */
7642 static float64 recip_sqrt_estimate(float64 a, float_status *real_fp_status)
7643 {
7644 /* These calculations mustn't set any fp exception flags,
7645 * so we use a local copy of the fp_status.
7646 */
7647 float_status dummy_status = *real_fp_status;
7648 float_status *s = &dummy_status;
7649 float64 q;
7650 int64_t q_int;
7651
7652 if (float64_lt(a, float64_half, s)) {
7653 /* range 0.25 <= a < 0.5 */
7654
7655 /* a in units of 1/512 rounded down */
7656 /* q0 = (int)(a * 512.0); */
7657 q = float64_mul(float64_512, a, s);
7658 q_int = float64_to_int64_round_to_zero(q, s);
7659
7660 /* reciprocal root r */
7661 /* r = 1.0 / sqrt(((double)q0 + 0.5) / 512.0); */
7662 q = int64_to_float64(q_int, s);
7663 q = float64_add(q, float64_half, s);
7664 q = float64_div(q, float64_512, s);
7665 q = float64_sqrt(q, s);
7666 q = float64_div(float64_one, q, s);
7667 } else {
7668 /* range 0.5 <= a < 1.0 */
7669
7670 /* a in units of 1/256 rounded down */
7671 /* q1 = (int)(a * 256.0); */
7672 q = float64_mul(float64_256, a, s);
7673 int64_t q_int = float64_to_int64_round_to_zero(q, s);
7674
7675 /* reciprocal root r */
7676 /* r = 1.0 /sqrt(((double)q1 + 0.5) / 256); */
7677 q = int64_to_float64(q_int, s);
7678 q = float64_add(q, float64_half, s);
7679 q = float64_div(q, float64_256, s);
7680 q = float64_sqrt(q, s);
7681 q = float64_div(float64_one, q, s);
7682 }
7683 /* r in units of 1/256 rounded to nearest */
7684 /* s = (int)(256.0 * r + 0.5); */
7685
7686 q = float64_mul(q, float64_256,s );
7687 q = float64_add(q, float64_half, s);
7688 q_int = float64_to_int64_round_to_zero(q, s);
7689
7690 /* return (double)s / 256.0;*/
7691 return float64_div(int64_to_float64(q_int, s), float64_256, s);
7692 }
7693
7694 float32 HELPER(rsqrte_f32)(float32 input, void *fpstp)
7695 {
7696 float_status *s = fpstp;
7697 float32 f32 = float32_squash_input_denormal(input, s);
7698 uint32_t val = float32_val(f32);
7699 uint32_t f32_sbit = 0x80000000 & val;
7700 int32_t f32_exp = extract32(val, 23, 8);
7701 uint32_t f32_frac = extract32(val, 0, 23);
7702 uint64_t f64_frac;
7703 uint64_t val64;
7704 int result_exp;
7705 float64 f64;
7706
7707 if (float32_is_any_nan(f32)) {
7708 float32 nan = f32;
7709 if (float32_is_signaling_nan(f32)) {
7710 float_raise(float_flag_invalid, s);
7711 nan = float32_maybe_silence_nan(f32);
7712 }
7713 if (s->default_nan_mode) {
7714 nan = float32_default_nan;
7715 }
7716 return nan;
7717 } else if (float32_is_zero(f32)) {
7718 float_raise(float_flag_divbyzero, s);
7719 return float32_set_sign(float32_infinity, float32_is_neg(f32));
7720 } else if (float32_is_neg(f32)) {
7721 float_raise(float_flag_invalid, s);
7722 return float32_default_nan;
7723 } else if (float32_is_infinity(f32)) {
7724 return float32_zero;
7725 }
7726
7727 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
7728 * preserving the parity of the exponent. */
7729
7730 f64_frac = ((uint64_t) f32_frac) << 29;
7731 if (f32_exp == 0) {
7732 while (extract64(f64_frac, 51, 1) == 0) {
7733 f64_frac = f64_frac << 1;
7734 f32_exp = f32_exp-1;
7735 }
7736 f64_frac = extract64(f64_frac, 0, 51) << 1;
7737 }
7738
7739 if (extract64(f32_exp, 0, 1) == 0) {
7740 f64 = make_float64(((uint64_t) f32_sbit) << 32
7741 | (0x3feULL << 52)
7742 | f64_frac);
7743 } else {
7744 f64 = make_float64(((uint64_t) f32_sbit) << 32
7745 | (0x3fdULL << 52)
7746 | f64_frac);
7747 }
7748
7749 result_exp = (380 - f32_exp) / 2;
7750
7751 f64 = recip_sqrt_estimate(f64, s);
7752
7753 val64 = float64_val(f64);
7754
7755 val = ((result_exp & 0xff) << 23)
7756 | ((val64 >> 29) & 0x7fffff);
7757 return make_float32(val);
7758 }
7759
7760 float64 HELPER(rsqrte_f64)(float64 input, void *fpstp)
7761 {
7762 float_status *s = fpstp;
7763 float64 f64 = float64_squash_input_denormal(input, s);
7764 uint64_t val = float64_val(f64);
7765 uint64_t f64_sbit = 0x8000000000000000ULL & val;
7766 int64_t f64_exp = extract64(val, 52, 11);
7767 uint64_t f64_frac = extract64(val, 0, 52);
7768 int64_t result_exp;
7769 uint64_t result_frac;
7770
7771 if (float64_is_any_nan(f64)) {
7772 float64 nan = f64;
7773 if (float64_is_signaling_nan(f64)) {
7774 float_raise(float_flag_invalid, s);
7775 nan = float64_maybe_silence_nan(f64);
7776 }
7777 if (s->default_nan_mode) {
7778 nan = float64_default_nan;
7779 }
7780 return nan;
7781 } else if (float64_is_zero(f64)) {
7782 float_raise(float_flag_divbyzero, s);
7783 return float64_set_sign(float64_infinity, float64_is_neg(f64));
7784 } else if (float64_is_neg(f64)) {
7785 float_raise(float_flag_invalid, s);
7786 return float64_default_nan;
7787 } else if (float64_is_infinity(f64)) {
7788 return float64_zero;
7789 }
7790
7791 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
7792 * preserving the parity of the exponent. */
7793
7794 if (f64_exp == 0) {
7795 while (extract64(f64_frac, 51, 1) == 0) {
7796 f64_frac = f64_frac << 1;
7797 f64_exp = f64_exp - 1;
7798 }
7799 f64_frac = extract64(f64_frac, 0, 51) << 1;
7800 }
7801
7802 if (extract64(f64_exp, 0, 1) == 0) {
7803 f64 = make_float64(f64_sbit
7804 | (0x3feULL << 52)
7805 | f64_frac);
7806 } else {
7807 f64 = make_float64(f64_sbit
7808 | (0x3fdULL << 52)
7809 | f64_frac);
7810 }
7811
7812 result_exp = (3068 - f64_exp) / 2;
7813
7814 f64 = recip_sqrt_estimate(f64, s);
7815
7816 result_frac = extract64(float64_val(f64), 0, 52);
7817
7818 return make_float64(f64_sbit |
7819 ((result_exp & 0x7ff) << 52) |
7820 result_frac);
7821 }
7822
7823 uint32_t HELPER(recpe_u32)(uint32_t a, void *fpstp)
7824 {
7825 float_status *s = fpstp;
7826 float64 f64;
7827
7828 if ((a & 0x80000000) == 0) {
7829 return 0xffffffff;
7830 }
7831
7832 f64 = make_float64((0x3feULL << 52)
7833 | ((int64_t)(a & 0x7fffffff) << 21));
7834
7835 f64 = recip_estimate(f64, s);
7836
7837 return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
7838 }
7839
7840 uint32_t HELPER(rsqrte_u32)(uint32_t a, void *fpstp)
7841 {
7842 float_status *fpst = fpstp;
7843 float64 f64;
7844
7845 if ((a & 0xc0000000) == 0) {
7846 return 0xffffffff;
7847 }
7848
7849 if (a & 0x80000000) {
7850 f64 = make_float64((0x3feULL << 52)
7851 | ((uint64_t)(a & 0x7fffffff) << 21));
7852 } else { /* bits 31-30 == '01' */
7853 f64 = make_float64((0x3fdULL << 52)
7854 | ((uint64_t)(a & 0x3fffffff) << 22));
7855 }
7856
7857 f64 = recip_sqrt_estimate(f64, fpst);
7858
7859 return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
7860 }
7861
7862 /* VFPv4 fused multiply-accumulate */
7863 float32 VFP_HELPER(muladd, s)(float32 a, float32 b, float32 c, void *fpstp)
7864 {
7865 float_status *fpst = fpstp;
7866 return float32_muladd(a, b, c, 0, fpst);
7867 }
7868
7869 float64 VFP_HELPER(muladd, d)(float64 a, float64 b, float64 c, void *fpstp)
7870 {
7871 float_status *fpst = fpstp;
7872 return float64_muladd(a, b, c, 0, fpst);
7873 }
7874
7875 /* ARMv8 round to integral */
7876 float32 HELPER(rints_exact)(float32 x, void *fp_status)
7877 {
7878 return float32_round_to_int(x, fp_status);
7879 }
7880
7881 float64 HELPER(rintd_exact)(float64 x, void *fp_status)
7882 {
7883 return float64_round_to_int(x, fp_status);
7884 }
7885
7886 float32 HELPER(rints)(float32 x, void *fp_status)
7887 {
7888 int old_flags = get_float_exception_flags(fp_status), new_flags;
7889 float32 ret;
7890
7891 ret = float32_round_to_int(x, fp_status);
7892
7893 /* Suppress any inexact exceptions the conversion produced */
7894 if (!(old_flags & float_flag_inexact)) {
7895 new_flags = get_float_exception_flags(fp_status);
7896 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
7897 }
7898
7899 return ret;
7900 }
7901
7902 float64 HELPER(rintd)(float64 x, void *fp_status)
7903 {
7904 int old_flags = get_float_exception_flags(fp_status), new_flags;
7905 float64 ret;
7906
7907 ret = float64_round_to_int(x, fp_status);
7908
7909 new_flags = get_float_exception_flags(fp_status);
7910
7911 /* Suppress any inexact exceptions the conversion produced */
7912 if (!(old_flags & float_flag_inexact)) {
7913 new_flags = get_float_exception_flags(fp_status);
7914 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
7915 }
7916
7917 return ret;
7918 }
7919
7920 /* Convert ARM rounding mode to softfloat */
7921 int arm_rmode_to_sf(int rmode)
7922 {
7923 switch (rmode) {
7924 case FPROUNDING_TIEAWAY:
7925 rmode = float_round_ties_away;
7926 break;
7927 case FPROUNDING_ODD:
7928 /* FIXME: add support for TIEAWAY and ODD */
7929 qemu_log_mask(LOG_UNIMP, "arm: unimplemented rounding mode: %d\n",
7930 rmode);
7931 case FPROUNDING_TIEEVEN:
7932 default:
7933 rmode = float_round_nearest_even;
7934 break;
7935 case FPROUNDING_POSINF:
7936 rmode = float_round_up;
7937 break;
7938 case FPROUNDING_NEGINF:
7939 rmode = float_round_down;
7940 break;
7941 case FPROUNDING_ZERO:
7942 rmode = float_round_to_zero;
7943 break;
7944 }
7945 return rmode;
7946 }
7947
7948 /* CRC helpers.
7949 * The upper bytes of val (above the number specified by 'bytes') must have
7950 * been zeroed out by the caller.
7951 */
7952 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes)
7953 {
7954 uint8_t buf[4];
7955
7956 stl_le_p(buf, val);
7957
7958 /* zlib crc32 converts the accumulator and output to one's complement. */
7959 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff;
7960 }
7961
7962 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
7963 {
7964 uint8_t buf[4];
7965
7966 stl_le_p(buf, val);
7967
7968 /* Linux crc32c converts the output to one's complement. */
7969 return crc32c(acc, buf, bytes) ^ 0xffffffff;
7970 }
CRIS target port of Qemu